liftbay 0.2.0 → 0.3.1

package/README.md

@@ -31,6 +31,7 @@ It's published at [liftbay/skills](https://github.com/liftbay/skills), and ships
 | `builds list`, `builds view`, `builds logs`, `builds download`, `builds cancel` | Look at builds and their artifacts |
 | `submit`, `submissions list`, `submissions view` | TestFlight and Google Play uploads |
 | `device add`, `device list`, `device remove` | iOS test devices for ad hoc builds |
+| `env list`, `env import`, `env set`, `env unset`, `env export` | Environment variables; `env import` reads `.env` files and `eas.json` |
 | `credentials`, `credentials ios` | Show signing; set up iOS signing with your Apple ID or a `.p8` key |
 | `update publish`, `update list`, `update rollout`, `update rollback` | Over-the-air updates |
 | `channels` | List update channels |

package/dist/index.js

@@ -38,8 +38,8 @@ var require_picocolors = __commonJS({
     "use strict";
     var p = process || {};
     var argv = p.argv || [];
-    var env = p.env || {};
-    var isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env.TERM !== "dumb" || !!env.CI);
+    var env2 = p.env || {};
+    var isColorSupported = !(!!env2.NO_COLOR || argv.includes("--no-color")) && (!!env2.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env2.TERM !== "dumb" || !!env2.CI);
     var formatter = (open, close, replace = open) => (input) => {
       let string = "" + input, index = string.indexOf(close, open.length);
       return ~index ? open + replaceClose(string, close, replace, index) + close : open + string + close;
@@ -4575,10 +4575,10 @@ var require_browser = __commonJS({
           text2 = canvas;
           canvas = void 0;
         }
-        return new Promise(function(resolve3, reject) {
+        return new Promise(function(resolve4, reject) {
           try {
             const data = QRCode3.create(text2, opts);
-            resolve3(renderFunc(data, canvas, opts));
+            resolve4(renderFunc(data, canvas, opts));
           } catch (e) {
             reject(e);
           }
@@ -4660,11 +4660,11 @@ var require_server = __commonJS({
     }
     function render(renderFunc, text2, params) {
       if (!params.cb) {
-        return new Promise(function(resolve3, reject) {
+        return new Promise(function(resolve4, reject) {
           try {
             const data = QRCode3.create(text2, params.opts);
             return renderFunc(data, params.opts, function(err, data2) {
-              return err ? reject(err) : resolve3(data2);
+              return err ? reject(err) : resolve4(data2);
             });
           } catch (e) {
             reject(e);
@@ -28647,11 +28647,11 @@ async function detectApp(cwd = process.cwd()) {
     appJson: existsSync4(join5(cwd, "app.json"))
   };
 }
-async function run(cmd, args, cwd = process.cwd(), env = {}) {
-  const code = await new Promise((resolve3, reject) => {
-    const child = spawn2(cmd, args, { cwd, stdio: "inherit", env: { ...process.env, ...env } });
+async function run(cmd, args, cwd = process.cwd(), env2 = {}) {
+  const code = await new Promise((resolve4, reject) => {
+    const child = spawn2(cmd, args, { cwd, stdio: "inherit", env: { ...process.env, ...env2 } });
     child.on("error", reject);
-    child.on("close", resolve3);
+    child.on("close", resolve4);
   });
   if (code !== 0) fail(`\`${cmd} ${args.join(" ")}\` failed (exit ${code})`);
 }
@@ -28672,6 +28672,22 @@ function cancelled(value) {
   }
   return value;
 }
+var slugify = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
+async function createFirstOrg(lb, given) {
+  const me = await unwrap(lb.GET("/v1/auth/me"));
+  const suggested = given ?? (me.user.name?.trim() || me.user.email.split("@")[0]);
+  const name = isInteractive() && !given ? cancelled(await text({ message: "Name your organization", initialValue: suggested, validate: (v) => slugify(v ?? "").length >= 2 ? void 0 : "At least 2 letters or digits" })) : suggested;
+  const base = slugify(name).padEnd(2, "0");
+  for (const slug of [base, `${base.slice(0, 35)}-${Math.random().toString(36).slice(2, 6)}`]) {
+    const res = await lb.POST("/v1/orgs", { body: { name: name.slice(0, 64), slug } });
+    if (res.data) {
+      log.success(`Created organization ${import_picocolors3.default.bold(res.data.name)} ${import_picocolors3.default.dim(`(liftbay.dev/${res.data.slug})`)}`);
+      return res.data;
+    }
+    if (res.response.status !== 409) await unwrap(Promise.resolve(res));
+  }
+  return fail("Couldn't pick a free organization URL. Pass --org <slug>.");
+}
 async function ensureLinked(app, opts) {
   const existing = readConfig();
   if (existing) {
@@ -28680,7 +28696,7 @@ async function ensureLinked(app, opts) {
   }
   const lb = client();
   const orgs = await unwrap(lb.GET("/v1/orgs"));
-  if (!orgs.length) fail("You're not in any organization yet. Create one at the dashboard first.");
+  if (!orgs.length) orgs.push(await createFirstOrg(lb, opts.org));
   let org = opts.org ?? (orgs.length === 1 ? orgs[0].slug : void 0);
   if (!org) {
     if (!isInteractive()) fail(`Several organizations available; pass --org (${orgs.map((o) => o.slug).join(", ")})`);
@@ -29411,9 +29427,9 @@ async function deviceRemove(id) {
 }
 
 // src/commands/setup.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "fs";
 import { dirname as dirname3 } from "path";
-var import_picocolors10 = __toESM(require_picocolors(), 1);
+var import_picocolors11 = __toESM(require_picocolors(), 1);
 
 // src/generated/workflow.ts
 var WORKFLOW_YAML = `# Liftbay builds on your own GitHub Actions minutes.
@@ -29567,6 +29583,219 @@ jobs:
         run: '"$RUNNER_TEMP/liftbay-runner" run'
 `;
 
+// src/commands/env.ts
+import { existsSync as existsSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename2, join as join8, resolve as resolve3 } from "path";
+var import_picocolors10 = __toESM(require_picocolors(), 1);
+var VISIBILITIES = ["plain", "sensitive", "secret"];
+var KEY = /^[A-Z_][A-Z0-9_]*$/;
+function parseEnv(content) {
+  const vars = [];
+  const invalid = [];
+  content.split(/\r?\n/).forEach((raw, i2) => {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) return;
+    const m2 = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
+    if (!m2) return void invalid.push(i2 + 1);
+    let value = m2[2] ?? "";
+    const q = value[0];
+    if ((q === '"' || q === "'") && value.length >= 2 && value.endsWith(q)) {
+      value = value.slice(1, -1);
+      if (q === '"') value = value.replace(/\\(n|"|\\)/g, (_, c2) => c2 === "n" ? "\n" : c2);
+    } else {
+      const hash = value.indexOf(" #");
+      if (hash >= 0) value = value.slice(0, hash).trimEnd();
+    }
+    vars.push({ key: m2[1], value });
+  });
+  return { vars, invalid };
+}
+function serializeEnv(vars) {
+  return vars.map(({ key, value }) => {
+    const quote = /[\s#"'\\]/.test(value) || value === "";
+    return `${key}=${quote ? `"${value.replace(/\\/g, "\\\\").replace(/\n/g, "\\n").replace(/"/g, '\\"')}"` : value}`;
+  }).join("\n");
+}
+function visibilityFor(key, forced) {
+  if (key.startsWith("EXPO_PUBLIC_")) return forced === "sensitive" ? "sensitive" : "plain";
+  if (forced) return forced;
+  return /(TOKEN|SECRET|PASSWORD|PASSWD|PRIVATE|CREDENTIAL|AUTH|API_KEY|ACCESS_KEY|_KEY$)/.test(key) ? "secret" : "sensitive";
+}
+function parseVisibility(v) {
+  if (v && !VISIBILITIES.includes(v)) fail(`--visibility must be ${VISIBILITIES.join(", ")}`);
+  return v;
+}
+var slugify2 = (name) => name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48) || "default";
+function readEasProfiles(cwd = process.cwd()) {
+  const path2 = join8(cwd, "eas.json");
+  if (!existsSync6(path2)) return null;
+  let eas;
+  try {
+    eas = JSON.parse(readFileSync7(path2, "utf8"));
+  } catch {
+    fail("eas.json isn't valid JSON");
+  }
+  const build2 = eas.build ?? {};
+  const resolveProfile = (name, seen = []) => {
+    const own = build2[name] ?? fail(`eas.json: profile "${seen.at(-1)}" extends unknown profile "${name}"`);
+    if (seen.includes(name)) fail(`eas.json: profiles extend each other in a loop (${[...seen, name].join(" \u2192 ")})`);
+    const parent = own.extends ? resolveProfile(own.extends, [...seen, name]) : {};
+    return { ...parent, ...own, env: { ...parent.env, ...own.env } };
+  };
+  const extended = new Set(Object.values(build2).map((b) => b.extends).filter(Boolean));
+  return Object.keys(build2).filter((name) => !(extended.has(name) && !build2[name].channel && !build2[name].distribution && !build2[name].developmentClient)).map((name) => {
+    const r2 = resolveProfile(name);
+    const env2 = Object.fromEntries(Object.entries(r2.env ?? {}).filter(([k2, v]) => KEY.test(k2) && v !== void 0 && v !== null).map(([k2, v]) => [k2, String(v)]));
+    return { name, slug: slugify2(name), distribution: r2.distribution === "internal" ? "internal" : "store", channel: slugify2(r2.channel ?? name), env: env2, developmentClient: !!r2.developmentClient };
+  });
+}
+async function environments(lb, path2) {
+  return unwrap(lb.GET("/v1/orgs/{org}/projects/{project}/environments", { params: { path: path2 } }));
+}
+async function ensureEnvironment(lb, path2, slug, existing) {
+  const envs = existing ?? await environments(lb, path2);
+  if (envs.some((e) => e.slug === slug)) return false;
+  await unwrap(lb.POST("/v1/orgs/{org}/projects/{project}/environments", { params: { path: path2 }, body: { name: slug, slug } }));
+  return true;
+}
+async function importVariables(lb, path2, env2, vars, opts) {
+  const result = { environment: env2, added: [], updated: [], skipped: [], visibility: {} };
+  const bad = vars.filter((v) => !KEY.test(v.key));
+  for (const v of bad) result.skipped.push({ key: v.key, reason: "names must be UPPER_SNAKE_CASE" });
+  const byVisibility = /* @__PURE__ */ new Map();
+  for (const v of vars.filter((v2) => KEY.test(v2.key))) {
+    const vis = visibilityFor(v.key, opts.visibility);
+    result.visibility[v.key] = vis;
+    byVisibility.set(vis, [...(byVisibility.get(vis) ?? []).filter((x) => x.key !== v.key), v]);
+  }
+  for (const [visibility, group] of byVisibility) {
+    const r2 = await unwrap(
+      lb.POST("/v1/orgs/{org}/projects/{project}/environments/{env}/import", { params: { path: { ...path2, env: env2 } }, body: { content: serializeEnv(group), visibility, overwrite: opts.overwrite } })
+    );
+    result.added.push(...r2.added);
+    result.updated.push(...r2.updated);
+    result.skipped.push(...r2.skipped);
+  }
+  return result;
+}
+function printImport(r2) {
+  const count = (n3, word) => `${n3} ${word}`;
+  log.success(`${import_picocolors10.default.bold(r2.environment)}: ${count(r2.added.length, "added")}, ${count(r2.updated.length, "updated")}${r2.skipped.length ? `, ${r2.skipped.length} skipped` : ""}`);
+  for (const key of [...r2.added, ...r2.updated]) log.message(`  ${key.padEnd(36)} ${import_picocolors10.default.dim(r2.visibility[key] ?? "")}`);
+  for (const s of r2.skipped) log.message(import_picocolors10.default.dim(`  ${s.key.padEnd(36)} skipped: ${s.reason}`));
+}
+async function pickEnvironment(lb, path2, given, file2) {
+  const envs = await environments(lb, path2);
+  const fromName = file2 ? basename2(file2).match(/^\.env\.([a-z0-9-]+?)(?:\.local)?$/)?.[1] : void 0;
+  const slug = given ?? (fromName && envs.some((e) => e.slug === fromName) ? fromName : void 0);
+  if (slug) return { slug, envs };
+  const names = envs.map((e) => e.slug).join(", ");
+  if (!isInteractive()) fail(`Pass --environment (${names})${file2 ? ` for ${file2}` : ""}`);
+  return { slug: cancelled(await select({ message: file2 ? `Environment for ${file2}` : "Environment", options: envs.map((e) => ({ value: e.slug, label: e.name, hint: `${e.variableCount} variables` })) })), envs };
+}
+var projectPath = () => {
+  const config = requireConfig();
+  return { org: config.org, project: config.project };
+};
+async function envList(opts) {
+  const lb = client();
+  const path2 = projectPath();
+  if (!opts.environment) {
+    const envs = await environments(lb, path2);
+    for (const e of envs) console.log(`${import_picocolors10.default.bold(e.slug.padEnd(16))} ${String(e.variableCount).padStart(3)} variables  ${import_picocolors10.default.dim(`revision ${e.revision}`)}`);
+    return { environments: envs.map(({ slug, name, variableCount, revision, updatedAt }) => ({ slug, name, variableCount, revision, updatedAt })) };
+  }
+  const vars = await unwrap(lb.GET("/v1/orgs/{org}/projects/{project}/environments/{env}/variables", { params: { path: { ...path2, env: opts.environment } } }));
+  if (!vars.length) console.log(`No variables in ${opts.environment}. Add some with ${import_picocolors10.default.cyan(`liftbay env import .env --environment ${opts.environment}`)}`);
+  for (const v of vars) {
+    const shown = v.visibility === "plain" ? v.value ?? "" : v.visibility === "secret" ? import_picocolors10.default.dim("(secret)") : import_picocolors10.default.dim("\u2022\u2022\u2022\u2022\u2022\u2022 (sensitive)");
+    console.log(`${v.key.padEnd(36)} ${shown}`);
+  }
+  return { environment: opts.environment, variables: vars.map((v) => ({ key: v.key, visibility: v.visibility, value: v.visibility === "plain" ? v.value : null, updatedAt: v.updatedAt })) };
+}
+async function envSet(pairs, opts) {
+  const lb = client();
+  const path2 = projectPath();
+  const vars = pairs.map((pair) => {
+    const at = pair.indexOf("=");
+    if (at < 1) fail(`"${pair}" isn't KEY=value`);
+    return { key: pair.slice(0, at), value: pair.slice(at + 1) };
+  });
+  const { slug } = await pickEnvironment(lb, path2, opts.environment);
+  const r2 = await importVariables(lb, path2, slug, vars, { visibility: parseVisibility(opts.visibility), overwrite: true });
+  printImport(r2);
+  return r2;
+}
+async function envUnset(keys, opts) {
+  const lb = client();
+  const path2 = projectPath();
+  const { slug } = await pickEnvironment(lb, path2, opts.environment);
+  const vars = await unwrap(lb.GET("/v1/orgs/{org}/projects/{project}/environments/{env}/variables", { params: { path: { ...path2, env: slug } } }));
+  const removed = [];
+  for (const key of keys) {
+    const v = vars.find((x) => x.key === key);
+    if (!v) {
+      log.warn(`${key} isn't set in ${slug}`);
+      continue;
+    }
+    await unwrap(lb.DELETE("/v1/orgs/{org}/projects/{project}/environments/{env}/variables/{id}", { params: { path: { ...path2, env: slug, id: v.id } } }));
+    log.success(`Removed ${key} from ${slug}`);
+    removed.push(key);
+  }
+  return { environment: slug, removed };
+}
+async function envImport(files, opts) {
+  const lb = client();
+  const path2 = projectPath();
+  const visibility = parseVisibility(opts.visibility);
+  const overwrite = opts.overwrite !== false;
+  const results = [];
+  for (const file2 of files) {
+    const abs = resolve3(file2.replace(/^~/, process.env.HOME ?? "~"));
+    if (!existsSync6(abs)) fail(`No file at ${file2}`);
+    if (basename2(abs) === "eas.json") {
+      const profiles = readEasProfiles(resolve3(abs, ".."));
+      if (!profiles.length) fail("eas.json has no build profiles");
+      const envs = await environments(lb, path2);
+      for (const prof of opts.environment ? profiles.filter((x) => x.slug === opts.environment) : profiles) {
+        if (await ensureEnvironment(lb, path2, prof.slug, envs)) log.success(`Created environment ${import_picocolors10.default.bold(prof.slug)}`);
+        const vars2 = Object.entries(prof.env).map(([key, value]) => ({ key, value }));
+        if (!vars2.length) {
+          log.info(`${import_picocolors10.default.bold(prof.slug)}: no env in eas.json`);
+          continue;
+        }
+        const r3 = await importVariables(lb, path2, prof.slug, vars2, { visibility, overwrite });
+        printImport(r3);
+        results.push(r3);
+      }
+      continue;
+    }
+    const { vars, invalid } = parseEnv(readFileSync7(abs, "utf8"));
+    if (invalid.length) log.warn(`${file2}: skipped unreadable line${invalid.length > 1 ? "s" : ""} ${invalid.join(", ")}`);
+    const { slug } = await pickEnvironment(lb, path2, opts.environment, file2);
+    const r2 = await importVariables(lb, path2, slug, vars, { visibility, overwrite });
+    printImport(r2);
+    results.push(r2);
+  }
+  return { imported: results };
+}
+async function envExport(opts) {
+  const lb = client();
+  const path2 = projectPath();
+  const { slug } = await pickEnvironment(lb, path2, opts.environment);
+  const content = String(await unwrap(lb.GET("/v1/orgs/{org}/projects/{project}/environments/{env}/export", { params: { path: { ...path2, env: slug } }, parseAs: "text" })));
+  if (!opts.out) {
+    process.stdout.write(`${content.trimEnd()}
+`);
+    return { environment: slug, content };
+  }
+  if (existsSync6(opts.out) && !opts.force) fail(`${opts.out} exists. Pass --force to overwrite it.`);
+  writeFileSync6(opts.out, `${content.trimEnd()}
+`, { mode: 384 });
+  log.success(`Wrote ${opts.out} ${import_picocolors10.default.dim("(secret values are not exported)")}`);
+  return { environment: slug, file: resolve3(opts.out) };
+}
+
 // src/commands/setup.ts
 var DEFAULT_PROFILES = {
   development: { environment: "development", channel: "development", distribution: "internal" },
@@ -29595,11 +29824,11 @@ async function ciInit(app, config, opts) {
       })
     );
   }
-  if (platforms.includes("ios") && !app.bundleId) log.warn(`No iOS bundle identifier found. Set ${import_picocolors10.default.cyan("expo.ios.bundleIdentifier")} in app.json before the first iOS build.`);
-  if (platforms.includes("android") && !app.androidPackage) log.warn(`No Android package found. Set ${import_picocolors10.default.cyan("expo.android.package")} in app.json before the first Android build.`);
+  if (platforms.includes("ios") && !app.bundleId) log.warn(`No iOS bundle identifier found. Set ${import_picocolors11.default.cyan("expo.ios.bundleIdentifier")} in app.json before the first iOS build.`);
+  if (platforms.includes("android") && !app.androidPackage) log.warn(`No Android package found. Set ${import_picocolors11.default.cyan("expo.android.package")} in app.json before the first Android build.`);
   const path2 = { org: config.org, project: config.project };
   const repo = await githubRepo();
-  if (!repo) log.warn(`No GitHub remote found. Builds run on GitHub Actions: push this app to GitHub, then run ${import_picocolors10.default.cyan("liftbay ci init")} again.`);
+  if (!repo) log.warn(`No GitHub remote found. Builds run on GitHub Actions: push this app to GitHub, then run ${import_picocolors11.default.cyan("liftbay ci init")} again.`);
   await unwrap(
     lb.PATCH("/v1/orgs/{org}/projects/{project}", {
       params: { path: path2 },
@@ -29607,21 +29836,40 @@ async function ciInit(app, config, opts) {
     })
   );
   await writeWorkflow(opts);
-  const envs = await unwrap(lb.GET("/v1/orgs/{org}/projects/{project}/environments", { params: { path: path2 } }));
-  for (const profile of Object.values(DEFAULT_PROFILES)) {
-    if (!envs.some((e) => e.slug === profile.environment)) {
-      await unwrap(lb.POST("/v1/orgs/{org}/projects/{project}/environments", { params: { path: path2 }, body: { name: profile.environment, slug: profile.environment } }));
-    }
+  const eas = opts.eas === false ? null : readEasProfiles();
+  let fromEas = false;
+  if (eas?.length) {
+    fromEas = opts.yes || !isInteractive() || cancelled(await confirm({ message: `Found eas.json (profiles ${eas.map((e) => e.name).join(", ")}). Use its build profiles, channels and env variables?`, initialValue: true }));
   }
-  const profiles = Object.fromEntries(Object.entries(DEFAULT_PROFILES).map(([name, prof]) => [name, { ...prof, platforms }]));
+  const base = fromEas ? Object.fromEntries(eas.map((e) => [e.name, { environment: e.slug, channel: e.channel, distribution: e.distribution }])) : DEFAULT_PROFILES;
+  const envs = await unwrap(lb.GET("/v1/orgs/{org}/projects/{project}/environments", { params: { path: path2 } }));
+  for (const profile of Object.values(base)) {
+    if (await ensureEnvironment(lb, path2, profile.environment, envs)) envs.push({ slug: profile.environment });
+  }
+  const imported = [];
+  if (fromEas) {
+    log.step("Importing env variables from eas.json");
+    for (const e of eas) {
+      const vars = Object.entries(e.env).map(([key, value]) => ({ key, value }));
+      if (!vars.length) continue;
+      const r2 = await importVariables(lb, path2, e.slug, vars, { overwrite: false });
+      printImport(r2);
+      imported.push(r2);
+    }
+    log.info(import_picocolors11.default.dim("EXPO_PUBLIC_* values are plain (they're in the app bundle); names like *_TOKEN or *_SECRET are secret; the rest sensitive."));
+    log.info(import_picocolors11.default.dim(`Variables kept on expo.dev (EAS environment variables) aren't in eas.json: ${import_picocolors11.default.cyan("npx eas env:pull --environment production")}, then ${import_picocolors11.default.cyan("liftbay env import .env.local --environment production")}.`));
+  }
+  const profiles = Object.fromEntries(Object.entries(base).map(([name, prof]) => [name, { ...prof, platforms }]));
   const next = { ...config, build: { profiles, triggers: config.build?.triggers ?? [] } };
   writeConfig(next);
   note(
-    Object.entries(profiles).map(([name, prof]) => `${import_picocolors10.default.bold(name.padEnd(12))} env ${prof.environment.padEnd(12)} ${prof.distribution === "store" ? "store" : "internal"} \xB7 ${prof.platforms.join(", ")}`).join("\n"),
+    Object.entries(profiles).map(([name, prof]) => `${import_picocolors11.default.bold(name.padEnd(12))} env ${prof.environment.padEnd(12)} ${prof.distribution === "store" ? "store" : "internal"} \xB7 ${prof.platforms.join(", ")}`).join("\n"),
     "Build profiles"
   );
+  lastImport = imported;
   return next;
 }
+var lastImport = [];
 var WORKFLOW_PATH = ".github/workflows/liftbay.yml";
 async function githubRepo() {
   try {
@@ -29632,16 +29880,16 @@ async function githubRepo() {
   }
 }
 async function writeWorkflow(opts) {
-  const current = existsSync6(WORKFLOW_PATH) ? readFileSync7(WORKFLOW_PATH, "utf8") : null;
+  const current = existsSync7(WORKFLOW_PATH) ? readFileSync8(WORKFLOW_PATH, "utf8") : null;
   if (current === WORKFLOW_YAML) return;
   if (current !== null) {
     const replace = opts.yes || isInteractive() && cancelled(await confirm({ message: `${WORKFLOW_PATH} differs from the current Liftbay workflow. Replace it?` }));
     if (!replace) return log.info(`Kept your ${WORKFLOW_PATH}.`);
   }
   mkdirSync5(dirname3(WORKFLOW_PATH), { recursive: true });
-  writeFileSync6(WORKFLOW_PATH, WORKFLOW_YAML);
-  log.success(`Wrote ${import_picocolors10.default.cyan(WORKFLOW_PATH)}. Commit and push it: Liftbay starts it for every build, on your GitHub Actions minutes.`);
-  log.info(import_picocolors10.default.dim("GitHub counts macOS minutes about 10\xD7 faster than Linux; on a private repo with GitHub Free that is roughly 10 iOS builds a month."));
+  writeFileSync7(WORKFLOW_PATH, WORKFLOW_YAML);
+  log.success(`Wrote ${import_picocolors11.default.cyan(WORKFLOW_PATH)}. Commit and push it: Liftbay starts it for every build, on your GitHub Actions minutes.`);
+  log.info(import_picocolors11.default.dim("GitHub counts macOS minutes about 10\xD7 faster than Linux; on a private repo with GitHub Free that is roughly 10 iOS builds a month."));
 }
 var pluginSpec = () => process.env.LIFTBAY_EXPO_PLUGIN_SPEC ?? "@liftbay/expo-plugin";
 async function addDependency(app, spec) {
@@ -29662,7 +29910,8 @@ async function otaInit(app, config, opts) {
   }
   log.step("Installing the Liftbay config plugin");
   await addDependency(app, pluginSpec());
-  let policy = opts.runtimePolicy;
+  const existingPolicy = readAppJson()?.expo?.runtimeVersion?.policy;
+  let policy = opts.runtimePolicy ?? (existingPolicy === "appVersion" || existingPolicy === "fingerprint" ? existingPolicy : void 0);
   if (!policy) {
     policy = opts.yes || !isInteractive() ? "appVersion" : cancelled(
       await select({
@@ -29679,16 +29928,16 @@ async function otaInit(app, config, opts) {
   let channels2 = await unwrap(lb.GET("/v1/orgs/{org}/projects/{project}/channels", { params: { path: path2 } }));
   for (const prof of Object.values(profiles)) {
     const existing = channels2.find((c2) => c2.name === prof.channel);
-    const env = envs.find((e) => e.slug === prof.environment);
-    if (!env) fail(`Environment ${prof.environment} not found; run \`liftbay ci init\` first`);
+    const env2 = envs.find((e) => e.slug === prof.environment);
+    if (!env2) fail(`Environment ${prof.environment} not found; run \`liftbay ci init\` first`);
     if (!existing) {
-      await unwrap(lb.POST("/v1/orgs/{org}/projects/{project}/channels", { params: { path: path2 }, body: { name: prof.channel, environmentId: env.id, protocols: ["expo"] } }));
-      log.success(`Created channel ${import_picocolors10.default.bold(prof.channel)} \u2192 ${prof.environment}`);
+      await unwrap(lb.POST("/v1/orgs/{org}/projects/{project}/channels", { params: { path: path2 }, body: { name: prof.channel, environmentId: env2.id, protocols: ["expo"] } }));
+      log.success(`Created channel ${import_picocolors11.default.bold(prof.channel)} \u2192 ${prof.environment}`);
     } else if (!existing.protocols.includes("expo")) {
       await unwrap(
         lb.PATCH("/v1/orgs/{org}/projects/{project}/channels/{channel}", { params: { path: { ...path2, channel: prof.channel } }, body: { protocols: [...existing.protocols, "expo"] } })
       );
-      log.success(`Enabled expo-updates on channel ${import_picocolors10.default.bold(prof.channel)}`);
+      log.success(`Enabled expo-updates on channel ${import_picocolors11.default.bold(prof.channel)}`);
     }
   }
   channels2 = await unwrap(lb.GET("/v1/orgs/{org}/projects/{project}/channels", { params: { path: path2 } }));
@@ -29708,23 +29957,23 @@ runtimeVersion: { "policy": "${policy}" }`, "Add to your app config");
     else plugins.push(entry);
     expo.runtimeVersion = { policy };
     writeAppJson(appJson);
-    log.success(`Updated ${import_picocolors10.default.cyan("app.json")}: Liftbay plugin, runtimeVersion policy "${policy}"`);
+    log.success(`Updated ${import_picocolors11.default.cyan("app.json")}: Liftbay plugin, runtimeVersion policy "${policy}"`);
   }
   const next = { ...config, updates: { client: "expo-updates", runtimeVersion: { policy } } };
   writeConfig(next);
   return next;
 }
 async function ciInitCommand(opts) {
-  intro(import_picocolors10.default.bgCyan(import_picocolors10.default.black(" liftbay ci init ")));
+  intro(import_picocolors11.default.bgCyan(import_picocolors11.default.black(" liftbay ci init ")));
   await ensureSignedIn(opts);
   const app = await detectApp();
   const config = await ensureLinked(app, opts);
   const next = await ciInit(app, config, opts);
-  outro(`Builds are configured. Start one with ${import_picocolors10.default.cyan("liftbay build --profile preview")}`);
-  return { config: next };
+  outro(`Builds are configured. Start one with ${import_picocolors11.default.cyan("liftbay build --profile preview")}`);
+  return { config: next, imported: lastImport };
 }
 async function otaInitCommand(opts) {
-  intro(import_picocolors10.default.bgCyan(import_picocolors10.default.black(" liftbay ota init ")));
+  intro(import_picocolors11.default.bgCyan(import_picocolors11.default.black(" liftbay ota init ")));
   await ensureSignedIn(opts);
   const app = await detectApp();
   const config = await ensureLinked(app, opts);
@@ -29735,29 +29984,30 @@ async function otaInitCommand(opts) {
 var nextStepsOta = () => `OTA updates are configured.
 
   1. Build a new binary once (the update URL and channel are baked in)
-  2. Ship JS changes with ${import_picocolors10.default.cyan("liftbay update publish --channel production")}`;
+  2. Ship JS changes with ${import_picocolors11.default.cyan("liftbay update publish --channel production")}`;
 async function initCommand(opts) {
-  intro(import_picocolors10.default.bgCyan(import_picocolors10.default.black(" liftbay init ")));
+  intro(import_picocolors11.default.bgCyan(import_picocolors11.default.black(" liftbay init ")));
   await ensureSignedIn(opts);
   const app = await detectApp();
   log.info(
-    `${import_picocolors10.default.bold(app.name)}: ${app.framework === "expo" ? "Expo" : "React Native"}${app.version ? ` ${app.version}` : ""}${app.bundleId ? ` \xB7 ${app.bundleId}` : ""}${app.androidPackage && app.androidPackage !== app.bundleId ? ` \xB7 ${app.androidPackage}` : ""}`
+    `${import_picocolors11.default.bold(app.name)}: ${app.framework === "expo" ? "Expo" : "React Native"}${app.version ? ` ${app.version}` : ""}${app.bundleId ? ` \xB7 ${app.bundleId}` : ""}${app.androidPackage && app.androidPackage !== app.bundleId ? ` \xB7 ${app.androidPackage}` : ""}`
   );
   let config = await ensureLinked(app, opts);
-  log.step(import_picocolors10.default.bold("1/2  Builds"));
+  log.step(import_picocolors11.default.bold("1/2  Builds"));
   config = await ciInit(app, config, opts);
-  log.step(import_picocolors10.default.bold("2/2  OTA updates"));
+  log.step(import_picocolors11.default.bold("2/2  OTA updates"));
   const wantOta = opts.ota ?? (opts.yes || !isInteractive() ? true : cancelled(await confirm({ message: "Set up over-the-air updates with expo-updates?", initialValue: true })));
   if (wantOta) config = await otaInit(await detectApp(), config, opts);
-  else log.info(`Skipped. Run ${import_picocolors10.default.cyan("liftbay ota init")} any time.`);
+  else log.info(`Skipped. Run ${import_picocolors11.default.cyan("liftbay ota init")} any time.`);
   outro(
-    `Done. ${import_picocolors10.default.dim(`${dashboardUrl()}/${config.org}/${config.project}`)}
+    `Done. ${import_picocolors11.default.dim(`${dashboardUrl()}/${config.org}/${config.project}`)}
 
-  Build:  ${import_picocolors10.default.cyan("liftbay build --profile preview")}${wantOta ? `
-  Update: ${import_picocolors10.default.cyan("liftbay update publish --channel production")}` : ""}`
+  Build:  ${import_picocolors11.default.cyan("liftbay build --profile preview")}${wantOta ? `
+  Update: ${import_picocolors11.default.cyan("liftbay update publish --channel production")}` : ""}`
   );
   return {
     config,
+    imported: lastImport,
     url: `${dashboardUrl()}/${config.org}/${config.project}`,
     next: ["Commit liftbay.json, .github/workflows/liftbay.yml and app.json, and push", "liftbay build --profile preview", ...wantOta ? ["liftbay update publish --channel production"] : []]
   };
@@ -29766,17 +30016,17 @@ async function initCommand(opts) {
 // src/commands/update.ts
 import { execFileSync as execFileSync2 } from "child_process";
 import { createHash as createHash4 } from "crypto";
-import { mkdtempSync, readFileSync as readFileSync9, rmSync as rmSync4 } from "fs";
+import { mkdtempSync, readFileSync as readFileSync10, rmSync as rmSync4 } from "fs";
 import { tmpdir } from "os";
-import { join as join8 } from "path";
-var import_picocolors12 = __toESM(require_picocolors(), 1);
+import { join as join9 } from "path";
+var import_picocolors13 = __toESM(require_picocolors(), 1);
 
 // src/commands/signing.ts
 import { createPublicKey, createSign, randomBytes as randomBytes2 } from "crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "fs";
+import { chmodSync as chmodSync4, existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname4, relative } from "path";
 var import_node_forge = __toESM(require_lib2(), 1);
-var import_picocolors11 = __toESM(require_picocolors(), 1);
+var import_picocolors12 = __toESM(require_picocolors(), 1);
 var DEFAULT_PRIVATE_KEY = "keys/liftbay-private-key.pem";
 var DEFAULT_PUBLIC_KEY = "certs/liftbay-public-key.pem";
 var DEFAULT_CERTIFICATE = "certs/liftbay-certificate.pem";
@@ -29806,18 +30056,18 @@ function generateSigningCertificate(commonName, years = 10) {
 var signRsaSha256 = (privateKeyPem, data) => createSign("RSA-SHA256").update(data).sign(privateKeyPem, "base64");
 function loadPrivateKey(path2) {
   const read = (file2, label) => {
-    if (!existsSync7(file2)) fail(`No private key at ${file2} (${label})`);
-    return { pem: readFileSync8(file2, "utf8"), source: file2 };
+    if (!existsSync8(file2)) fail(`No private key at ${file2} (${label})`);
+    return { pem: readFileSync9(file2, "utf8"), source: file2 };
   };
   if (path2) return read(path2, "--private-key");
-  const env = process.env.LIFTBAY_UPDATE_PRIVATE_KEY;
-  if (env) return env.includes("PRIVATE KEY") ? { pem: env.replace(/\\n/g, "\n"), source: "LIFTBAY_UPDATE_PRIVATE_KEY" } : read(env, "LIFTBAY_UPDATE_PRIVATE_KEY");
-  return existsSync7(DEFAULT_PRIVATE_KEY) ? { pem: readFileSync8(DEFAULT_PRIVATE_KEY, "utf8"), source: DEFAULT_PRIVATE_KEY } : null;
+  const env2 = process.env.LIFTBAY_UPDATE_PRIVATE_KEY;
+  if (env2) return env2.includes("PRIVATE KEY") ? { pem: env2.replace(/\\n/g, "\n"), source: "LIFTBAY_UPDATE_PRIVATE_KEY" } : read(env2, "LIFTBAY_UPDATE_PRIVATE_KEY");
+  return existsSync8(DEFAULT_PRIVATE_KEY) ? { pem: readFileSync9(DEFAULT_PRIVATE_KEY, "utf8"), source: DEFAULT_PRIVATE_KEY } : null;
 }
 function ensureIgnored(entry) {
-  const current = existsSync7(".gitignore") ? readFileSync8(".gitignore", "utf8") : "";
+  const current = existsSync8(".gitignore") ? readFileSync9(".gitignore", "utf8") : "";
   if (current.split("\n").some((l2) => l2.trim() === entry || l2.trim() === entry.replace(/\/$/, ""))) return false;
-  writeFileSync7(".gitignore", `${current}${current && !current.endsWith("\n") ? "\n" : ""}
+  writeFileSync8(".gitignore", `${current}${current && !current.endsWith("\n") ? "\n" : ""}
 # Liftbay update signing key: never commit it
 ${entry}
 `);
@@ -29839,7 +30089,7 @@ async function signingInit(opts) {
   const config = requireConfig();
   const lb = client();
   const path2 = { org: config.org, project: config.project };
-  intro(import_picocolors11.default.bgCyan(import_picocolors11.default.black(" liftbay update signing init ")));
+  intro(import_picocolors12.default.bgCyan(import_picocolors12.default.black(" liftbay update signing init ")));
   const { signing: signing2 } = await unwrap(lb.GET("/v1/orgs/{org}/projects/{project}/updates/signing", { params: { path: path2 } }));
   if (signing2 && !opts.force) {
     fail(
@@ -29848,16 +30098,16 @@ async function signingInit(opts) {
   }
   const privateKeyPath = opts.privateKey ?? DEFAULT_PRIVATE_KEY;
   const certificatePath = opts.certificate ?? DEFAULT_CERTIFICATE;
-  if (existsSync7(privateKeyPath) && !opts.force) fail(`${privateKeyPath} already exists. Pass --force to overwrite it, or --private-key for another path.`);
+  if (existsSync8(privateKeyPath) && !opts.force) fail(`${privateKeyPath} already exists. Pass --force to overwrite it, or --private-key for another path.`);
   const generated = generateSigningCertificate(opts.commonName ?? config.project);
   for (const dir of /* @__PURE__ */ new Set([dirname4(privateKeyPath), dirname4(certificatePath), dirname4(DEFAULT_PUBLIC_KEY)])) mkdirSync6(dir, { recursive: true });
-  writeFileSync7(privateKeyPath, generated.privateKeyPem, { mode: 384 });
+  writeFileSync8(privateKeyPath, generated.privateKeyPem, { mode: 384 });
   chmodSync4(privateKeyPath, 384);
-  writeFileSync7(certificatePath, generated.certificatePem);
-  writeFileSync7(DEFAULT_PUBLIC_KEY, generated.publicKeyPem);
-  if (ensureIgnored(`${dirname4(relative(".", privateKeyPath))}/`)) log.info(`Added ${import_picocolors11.default.cyan(`${dirname4(privateKeyPath)}/`)} to .gitignore`);
-  log.success(`Private key: ${import_picocolors11.default.cyan(privateKeyPath)} (stays on this machine)
-  Certificate: ${import_picocolors11.default.cyan(certificatePath)} (commit it; it's embedded in your app)`);
+  writeFileSync8(certificatePath, generated.certificatePem);
+  writeFileSync8(DEFAULT_PUBLIC_KEY, generated.publicKeyPem);
+  if (ensureIgnored(`${dirname4(relative(".", privateKeyPath))}/`)) log.info(`Added ${import_picocolors12.default.cyan(`${dirname4(privateKeyPath)}/`)} to .gitignore`);
+  log.success(`Private key: ${import_picocolors12.default.cyan(privateKeyPath)} (stays on this machine)
+  Certificate: ${import_picocolors12.default.cyan(certificatePath)} (commit it; it's embedded in your app)`);
   await unwrap(
     lb.PUT("/v1/orgs/{org}/projects/{project}/updates/signing", {
       params: { path: path2 },
@@ -29865,7 +30115,7 @@ async function signingInit(opts) {
     })
   );
   log.success("Certificate saved to Liftbay");
-  if (configureAppJson(certificatePath)) log.success(`Updated ${import_picocolors11.default.cyan("app.json")}: the Liftbay plugin embeds the certificate in your app`);
+  if (configureAppJson(certificatePath)) log.success(`Updated ${import_picocolors12.default.cyan("app.json")}: the Liftbay plugin embeds the certificate in your app`);
   else note(`plugins: [["@liftbay/expo-plugin", { "codeSigningCertificate": "./${certificatePath}" }]]`, "Add to your app config");
   const channels2 = await unwrap(lb.GET("/v1/orgs/{org}/projects/{project}/channels", { params: { path: path2 } }));
   const signedOnly = !!channels2.length && (opts.yes || !isInteractive() || cancelled(await confirm({ message: "Require signed updates on every channel? Unsigned publishes will be refused.", initialValue: true })));
@@ -29878,12 +30128,12 @@ async function signingInit(opts) {
   note(
     [
       `1. Rebuild your apps once: the certificate is part of the binary.`,
-      `2. ${import_picocolors11.default.cyan("liftbay update publish")} signs automatically with ${privateKeyPath}.`,
-      `3. In CI, store the private key as a secret named ${import_picocolors11.default.cyan("LIFTBAY_UPDATE_PRIVATE_KEY")}.`,
+      `2. ${import_picocolors12.default.cyan("liftbay update publish")} signs automatically with ${privateKeyPath}.`,
+      `3. In CI, store the private key as a secret named ${import_picocolors12.default.cyan("LIFTBAY_UPDATE_PRIVATE_KEY")}.`,
       `4. Back the key up somewhere safe. If it's lost, apps need a rebuild with a new certificate.`,
       ``,
-      `hot-updater: set ${import_picocolors11.default.cyan("HOT_UPDATER_PUBLIC_KEY")} (iOS Info.plist) / ${import_picocolors11.default.cyan("com.hotupdater.PUBLIC_KEY")} (Android) to ${DEFAULT_PUBLIC_KEY}.`,
-      `CodePush: set ${import_picocolors11.default.cyan("CodePushPublicKey")} (iOS) / ${import_picocolors11.default.cyan("CodePushPublicKey")} string resource (Android) to ${DEFAULT_PUBLIC_KEY}.`
+      `hot-updater: set ${import_picocolors12.default.cyan("HOT_UPDATER_PUBLIC_KEY")} (iOS Info.plist) / ${import_picocolors12.default.cyan("com.hotupdater.PUBLIC_KEY")} (Android) to ${DEFAULT_PUBLIC_KEY}.`,
+      `CodePush: set ${import_picocolors12.default.cyan("CodePushPublicKey")} (iOS) / ${import_picocolors12.default.cyan("CodePushPublicKey")} string resource (Android) to ${DEFAULT_PUBLIC_KEY}.`
     ].join("\n"),
     "Next"
   );
@@ -29914,13 +30164,13 @@ var contentTypes = {
   mp4: "video/mp4"
 };
 function file(dir, rel, virtualPath, contentType) {
-  const data = readFileSync9(join8(dir, rel));
-  return { path: virtualPath, abs: join8(dir, rel), sha256: createHash4("sha256").update(data).digest("hex"), sizeBytes: data.length, contentType };
+  const data = readFileSync10(join9(dir, rel));
+  return { path: virtualPath, abs: join9(dir, rel), sha256: createHash4("sha256").update(data).digest("hex"), sizeBytes: data.length, contentType };
 }
 async function exportBundles(platforms) {
-  const out = mkdtempSync(join8(tmpdir(), "liftbay-export-"));
+  const out = mkdtempSync(join9(tmpdir(), "liftbay-export-"));
   await run("npx", ["expo", "export", "--output-dir", out, "--dump-assetmap", ...platforms.flatMap((pl) => ["--platform", pl])]);
-  const meta = JSON.parse(readFileSync9(join8(out, "metadata.json"), "utf8"));
+  const meta = JSON.parse(readFileSync10(join9(out, "metadata.json"), "utf8"));
   const bundles = {};
   for (const pl of platforms) {
     const m2 = meta.fileMetadata[pl];
@@ -29959,7 +30209,7 @@ async function publish(opts) {
       return null;
     }
   })();
-  intro(import_picocolors12.default.bgCyan(import_picocolors12.default.black(" liftbay update publish ")));
+  intro(import_picocolors13.default.bgCyan(import_picocolors13.default.black(" liftbay update publish ")));
   if (!platforms.every((x) => x === "ios" || x === "android")) fail("--platform must be ios, android or all");
   log.step(`Exporting ${platforms.join(" and ")} bundles`);
   const { out, bundles } = await exportBundles(platforms);
@@ -29981,13 +30231,13 @@ async function publish(opts) {
     for (const m2 of prep.missing) {
       const f = bySha.get(m2.sha256);
       spin.message(`Uploading ${++done}/${prep.missing.length}: ${f.path}`);
-      const res = await fetch(m2.uploadUrl, { method: "PUT", body: readFileSync9(f.abs), headers: { "Content-Type": f.contentType } });
+      const res = await fetch(m2.uploadUrl, { method: "PUT", body: readFileSync10(f.abs), headers: { "Content-Type": f.contentType } });
       if (!res.ok) fail(`Upload failed for ${f.path} (${res.status})`);
     }
     spin.stop(`${all.length} files: ${prep.missing.length} uploaded, ${prep.alreadyStored} already stored`);
     const key = loadPrivateKey(opts.privateKey);
     const published = [];
-    if (key) log.info(`Signing with ${import_picocolors12.default.cyan(key.source)}`);
+    if (key) log.info(`Signing with ${import_picocolors13.default.cyan(key.source)}`);
     for (const [runtime, group] of groups) {
       const body = {
         message,
@@ -30013,11 +30263,11 @@ async function publish(opts) {
       if (notice) log.warn(notice);
       published.push({ id: release.id, channel, runtimeVersion: runtime, platforms: group, rolloutPercent: release.rolloutPercent, signed: release.signed, message, notice });
       log.success(
-        `Published to ${import_picocolors12.default.bold(channel)} \xB7 runtime ${runtime} \xB7 ${group.join(", ")}${release.rolloutPercent < 100 ? ` \xB7 ${release.rolloutPercent}% rollout` : ""}${release.signed ? " \xB7 signed" : ""}`
+        `Published to ${import_picocolors13.default.bold(channel)} \xB7 runtime ${runtime} \xB7 ${group.join(", ")}${release.rolloutPercent < 100 ? ` \xB7 ${release.rolloutPercent}% rollout` : ""}${release.signed ? " \xB7 signed" : ""}`
       );
     }
     const url = `${dashboardUrl()}/${config.org}/${config.project}/updates/${channel}`;
-    outro(import_picocolors12.default.dim(url));
+    outro(import_picocolors13.default.dim(url));
     return { releases: published, url };
   } finally {
     rmSync4(out, { recursive: true, force: true });
@@ -30029,8 +30279,8 @@ async function list(opts) {
   const releases = await unwrap(client().GET("/v1/orgs/{org}/projects/{project}/channels/{channel}/releases", { params: { path: { org: config.org, project: config.project, channel } } }));
   if (!releases.length) console.log(`No releases on ${channel} yet.`);
   for (const r2 of releases.slice(0, 20)) {
-    const status = r2.status === "active" ? import_picocolors12.default.green("active") : r2.status === "rolled_back" ? import_picocolors12.default.red("rolled back") : import_picocolors12.default.dim("superseded");
-    console.log(`${new Date(r2.createdAt).toLocaleString().padEnd(24)} ${status.padEnd(22)} ${String(r2.rolloutPercent).padStart(3)}%  ${import_picocolors12.default.dim(r2.runtimeVersion.padEnd(10))} ${r2.message}`);
+    const status = r2.status === "active" ? import_picocolors13.default.green("active") : r2.status === "rolled_back" ? import_picocolors13.default.red("rolled back") : import_picocolors13.default.dim("superseded");
+    console.log(`${new Date(r2.createdAt).toLocaleString().padEnd(24)} ${status.padEnd(22)} ${String(r2.rolloutPercent).padStart(3)}%  ${import_picocolors13.default.dim(r2.runtimeVersion.padEnd(10))} ${r2.message}`);
   }
   return { channel, releases: releases.slice(0, 20) };
 }
@@ -30045,9 +30295,9 @@ async function rollback(opts) {
   const { path: path2, active } = await activeRelease(opts.channel ?? "production");
   const request = client().POST("/v1/orgs/{org}/projects/{project}/channels/{channel}/releases/{release}/rollback", { params: { path: { ...path2, release: active.id } } });
   const res = await unwrap(request);
-  console.log(`${import_picocolors12.default.green("\u2714")} Rolled back "${active.message}". ${res.active ? "The previous release is active again." : "Devices return to the bundle built into the app."}`);
+  console.log(`${import_picocolors13.default.green("\u2714")} Rolled back "${active.message}". ${res.active ? "The previous release is active again." : "Devices return to the bundle built into the app."}`);
   const notice = (await request).response.headers.get("Liftbay-Notice");
-  if (notice) console.log(`${import_picocolors12.default.yellow("!")} ${notice}`);
+  if (notice) console.log(`${import_picocolors13.default.yellow("!")} ${notice}`);
   return { rolledBack: { id: active.id, message: active.message }, active: res.active, notice };
 }
 async function rollout(percent, opts) {
@@ -30055,18 +30305,18 @@ async function rollout(percent, opts) {
   const r2 = await unwrap(
     client().PATCH("/v1/orgs/{org}/projects/{project}/channels/{channel}/releases/{release}/rollout", { params: { path: { ...path2, release: active.id } }, body: { rolloutPercent: Number(percent) } })
   );
-  console.log(`${import_picocolors12.default.green("\u2714")} "${r2.message}" now rolls out to ${r2.rolloutPercent}%`);
+  console.log(`${import_picocolors13.default.green("\u2714")} "${r2.message}" now rolls out to ${r2.rolloutPercent}%`);
   return { id: r2.id, message: r2.message, rolloutPercent: r2.rolloutPercent };
 }
 async function channels() {
   const config = requireConfig();
   const list2 = await unwrap(client().GET("/v1/orgs/{org}/projects/{project}/channels", { params: { path: { org: config.org, project: config.project } } }));
-  for (const c2 of list2) console.log(`${import_picocolors12.default.bold(c2.name.padEnd(16))} env ${c2.environmentSlug.padEnd(12)} ${c2.protocols.join(", ").padEnd(32)} ${import_picocolors12.default.dim(c2.currentRelease?.message ?? "no active release")}`);
+  for (const c2 of list2) console.log(`${import_picocolors13.default.bold(c2.name.padEnd(16))} env ${c2.environmentSlug.padEnd(12)} ${c2.protocols.join(", ").padEnd(32)} ${import_picocolors13.default.dim(c2.currentRelease?.message ?? "no active release")}`);
   return { channels: list2 };
 }
 
 // src/index.ts
-var program2 = new Command("liftbay").description("Build, ship and update React Native apps").version("0.2.0").option("--json", "print the result as JSON on stdout (progress goes to stderr; never prompts). Also LIFTBAY_JSON=1").hook("preAction", () => {
+var program2 = new Command("liftbay").description("Build, ship and update React Native apps").version("0.3.1").option("--json", "print the result as JSON on stdout (progress goes to stderr; never prompts). Also LIFTBAY_JSON=1").hook("preAction", () => {
   if (program2.opts().json || process.env.LIFTBAY_JSON === "1") enableJson();
 });
 var wrap = (fn) => async (...args) => {
@@ -30076,7 +30326,7 @@ var wrap = (fn) => async (...args) => {
     reportError(e);
   }
 };
-var setupOptions = (cmd) => cmd.option("--org <slug>", "organization").option("--project <slug>", "project slug (created if it doesn't exist)").option("--platforms <list>", "ios, android or all").option("--runtime-policy <policy>", "appVersion or fingerprint").option("-y, --yes", "accept defaults, no prompts").option("--api-url <url>", "API URL (for self-hosted or local development)").option("--dashboard-url <url>", "dashboard URL");
+var setupOptions = (cmd) => cmd.option("--org <slug>", "organization").option("--project <slug>", "project slug (created if it doesn't exist)").option("--platforms <list>", "ios, android or all").option("--runtime-policy <policy>", "appVersion or fingerprint").option("--no-eas", "don't use eas.json's build profiles and env, even if there is one").option("-y, --yes", "accept defaults, no prompts").option("--api-url <url>", "API URL (for self-hosted or local development)").option("--dashboard-url <url>", "dashboard URL");
 program2.command("login").description("Sign in through the browser").option("--api-url <url>", "API URL").option("--dashboard-url <url>", "dashboard URL").option("--no-open", "don't open the browser").option("--no-wait", "start the sign-in and exit; run `liftbay login` again after approving to finish (for agents)").action(wrap(login));
 program2.command("logout").description("Sign out and remove the saved token").action(wrap(logout));
 program2.command("whoami").description("Show the signed-in user and organizations").action(wrap(whoami));
@@ -30108,6 +30358,12 @@ var device = program2.command("device").description("iOS test devices for intern
 device.command("add").description("Register an iPhone or iPad: shows a QR code to open on it, or pass --udid").option("--udid <udid>", "add by UDID instead of a registration link").option("--name <name>", "device name (with --udid)").option("--team-id <id>", "Apple team, when the organization has several").option("--no-wait", "print the registration link and exit instead of waiting for the device (for agents)").action(wrap(deviceAdd));
 device.command("list").description("List registered devices").action(wrap(deviceList));
 device.command("remove <id>").description("Remove a device (disabled at Apple)").action(wrap(deviceRemove));
+var env = program2.command("env").description("Environment variables of the project's environments (development, preview, production, \u2026)");
+env.command("list").description("Environments, or with --environment its variables (sensitive values masked, secrets never shown)").option("-e, --environment <slug>", "environment").action(wrap(envList));
+env.command("import <files...>").description("Import .env files (into the environment each is named for, e.g. .env.production, or --environment), or eas.json (every build profile's env)").option("-e, --environment <slug>", "environment (for eas.json: only that profile)").option("--visibility <visibility>", "plain, sensitive or secret for all keys (default: EXPO_PUBLIC_* plain, *_TOKEN/*_SECRET/\u2026 secret, the rest sensitive)").option("--no-overwrite", "keep values that are already set").action(wrap(envImport));
+env.command("set <pairs...>").description("Set KEY=value pairs (values end up in shell history: prefer `env import` for secrets)").option("-e, --environment <slug>", "environment").option("--visibility <visibility>", "plain, sensitive or secret (default: from the name)").action(wrap(envSet));
+env.command("unset <keys...>").description("Remove variables").option("-e, --environment <slug>", "environment").action(wrap(envUnset));
+env.command("export").description("Print an environment as a .env file, or write it with --out (secret values are never exported)").option("-e, --environment <slug>", "environment").option("--out <file>", "file to write").option("--force", "overwrite the file").action(wrap(envExport));
 var ota = program2.command("ota").description("Over-the-air updates");
 setupOptions(ota.command("init").description("Set up expo-updates, the Liftbay plugin and channels")).action(wrap(otaInitCommand));
 var update = program2.command("update").description("Publish and manage OTA updates");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "liftbay",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "Build, sign, submit and update React Native apps from your own CI.",
   "keywords": [
     "react-native",

package/skills/liftbay/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: liftbay
-description: Build, sign, submit and update React Native and Expo apps with Liftbay (liftbay.dev). Use when the user wants to set up CI/CD for a React Native or Expo app, build an iOS .ipa or Android .apk/.aab, set up iOS or Android signing, upload to TestFlight or Google Play, register test iPhones for ad hoc installs, or publish, roll out or roll back over-the-air (OTA) updates. Also use when a repo has a liftbay.json file or the user mentions Liftbay.
+description: Build, sign, submit and update React Native and Expo apps with Liftbay (liftbay.dev). Use when the user wants to set up CI/CD for a React Native or Expo app, move an app from EAS (eas.json) to Liftbay, manage build environment variables or .env files, build an iOS .ipa or Android .apk/.aab, set up iOS or Android signing, upload to TestFlight or Google Play, register test iPhones for ad hoc installs, or publish, roll out or roll back over-the-air (OTA) updates. Also use when a repo has a liftbay.json file or the user mentions Liftbay.
 ---
 
 # Liftbay
@@ -14,7 +14,7 @@ You drive it through the `liftbay` CLI. Run it as `npx liftbay@latest <command>`
 - **Always pass `--json`.** Stdout then holds exactly one JSON document: the result, or `{"error": {"code", "message", ...}}` with exit code 1. Progress and logs go to stderr. With `--json` the CLI never prompts; when it needs something, it fails with a message naming the flag to pass.
 - **Never block on long waits.** Use `--no-wait` on `build`, `submit`, `login` and `device add`, then check back with `builds view`, `submissions list` or `whoami`.
 - **Ask the user before anything that reaches real users or stores:** an OTA publish, rollout change or rollback on `production`; submitting to TestFlight; any Google Play track other than `internal`; cancelling a build someone else started.
-- **Never handle secrets yourself.** Don't ask for, print, pass or commit Apple passwords, keystore passwords or the update signing key (`keys/liftbay-private-key.pem`). When a step needs one, ask the user to run that command in their own terminal.
+- **Never handle secrets yourself.** Importing `.env` files the user points you to is fine; never print their values. Don't ask for, print, pass or commit Apple passwords, keystore passwords or the update signing key (`keys/liftbay-private-key.pem`). When a step needs one, ask the user to run that command in their own terminal.
 - Read error messages: they say exactly what to do next.
 
 ## 1. Sign in
@@ -49,8 +49,10 @@ liftbay init --yes --json
 
 This detects the app (Expo or bare React Native), creates or links the Liftbay project, and writes `liftbay.json`. It also writes `.github/workflows/liftbay.yml` and sets up OTA updates with expo-updates and `@liftbay/expo-plugin` in `app.json`.
 
+**Coming from EAS:** when the app has an `eas.json`, `init` uses it. Each EAS build profile becomes a Liftbay build profile with the same name, channel and distribution, and its `env` (with `extends` resolved) goes into an environment of the same name. Pass `--no-eas` to use Liftbay's default profiles instead.
+
 Useful flags:
-- `--org <slug>`: required if the user is in several organizations; the error lists them.
+- `--org <slug>`: required if the user is in several organizations; the error lists them. For a new account with no organization yet, `init` creates one, named after `--org` or the person's name.
 - `--project <slug>`
 - `--platforms ios|android|all`
 - `--runtime-policy appVersion|fingerprint`
@@ -72,7 +74,37 @@ Then:
 
 Each profile has an `environment` (its secrets and variables) and an OTA `channel` with the same name.
 
-## 3. Signing
+## 3. Environment variables
+
+Builds get the variables of their profile's environment, as real environment variables and in `.env` for Expo. Set them before the first build, or the app will build without its API URLs and keys.
+
+```bash
+liftbay env list --json                                  # environments and how many variables each has
+liftbay env list -e production --json                    # one environment's variables
+liftbay env import .env.production .env.preview --json   # each file into the environment it's named for
+liftbay env import .env.staging -e preview --json        # any file into a named environment
+liftbay env import eas.json --json                       # every EAS profile's env (overwrites)
+liftbay env set API_REGION=us -e production --json
+liftbay env unset OLD_KEY -e production --json
+liftbay env export -e production --out .env.production.liftbay --json
+```
+
+When the user gives you `.env` files or paths, import them. Find them with `ls -a`: `.env`, `.env.local`, `.env.development`, `.env.production` and so on.
+- Map a file to an environment by its name. Ask when it's unclear: `.env` and `.env.local` are often local development settings, not production.
+- Don't print values or read secrets aloud. Report key names and counts only.
+
+Visibility is chosen per key:
+- `EXPO_PUBLIC_*` → plain, because it's inlined into the app bundle.
+- Names like `*_TOKEN`, `*_SECRET`, `*_PASSWORD`, `*_KEY` → secret (write-only).
+- Everything else → sensitive (encrypted, revealable).
+
+Use `--visibility` to override this for a whole import.
+
+If the app used EAS environment variables stored on expo.dev (`eas env:*`), they aren't in `eas.json`. Pull them first with `npx eas env:pull --environment production --path .env.eas.production`, then `liftbay env import .env.eas.production -e production`.
+
+A common build failure after moving from EAS: with `SENTRY_ORG`/`SENTRY_PROJECT` set, the Sentry plugin uploads source maps and needs `SENTRY_AUTH_TOKEN`. The user adds it as a secret (`liftbay env import` from a file, or the dashboard), or removes the two Sentry variables.
+
+## 4. Signing
 
 **Android:** nothing to do. Liftbay creates the upload key on the first Android build and stores it encrypted.
 - To bring an existing key, the user runs `liftbay credentials android import --keystore <file> --alias <alias>`, with the password in `LIFTBAY_KEYSTORE_PASSWORD`.
@@ -94,7 +126,7 @@ Check what's stored:
 liftbay credentials --json
 ```
 
-## 4. Build
+## 5. Build
 
 ```bash
 liftbay build --platform android --profile preview --no-wait --json
@@ -121,7 +153,7 @@ Other flags:
 
 **Xcode Cloud (optional):** `liftbay xcode-cloud connect --json`. Its error says which one-time step the user has to do in App Store Connect.
 
-## 5. Submit to the stores
+## 6. Submit to the stores
 
 Submit as part of the build:
 
@@ -142,7 +174,7 @@ liftbay submissions view <id> --json
 - Play tracks are `internal`, `alpha`, `beta` and `production`. Use `--rollout <percent>` for a staged rollout.
 - The first upload of a brand-new Play app must be done by hand in Play Console. Until then, uploads are saved as drafts.
 
-## 6. Ad hoc iOS installs on test devices
+## 7. Ad hoc iOS installs on test devices
 
 1. Register the device:
    ```bash
@@ -160,7 +192,7 @@ liftbay submissions view <id> --json
    ```
 4. When the build has succeeded, `liftbay builds view <n> --json` returns `installUrl`. The user opens it on the registered device.
 
-## 7. OTA updates (JS-only changes, no store review)
+## 8. OTA updates (JS-only changes, no store review)
 
 The app must have been built once after `liftbay ota init`, so the update URL is inside the binary. Then publish:
 
@@ -199,7 +231,9 @@ An update only reaches binaries with the same runtime version. When native code
 | Build fails at once: no GitHub repository | Push the app to GitHub, then `liftbay ci init --yes --json` |
 | Build fails: workflow not found / 404 | Commit and push `.github/workflows/liftbay.yml` on the branch you build |
 | `github_not_connected` | User installs the Liftbay GitHub App at `liftbay.dev/<org>/github` |
-| iOS build is a simulator build | No iOS signing yet: section 3 |
+| iOS build is a simulator build | No iOS signing yet: section 4 |
+| App builds but can't reach its backend | Missing env variables: `liftbay env list -e <env>`, then section 3 |
+| `Pass --environment` | The file name doesn't match an environment; pass `-e <slug>` |
 | `Apple ID sign-in needs a person` / two-factor code | Ask the user to run `npx liftbay credentials ios` in their terminal |
 | `certificate_limit` | Apple allows a few distribution certificates per team. The user runs `liftbay credentials ios` interactively to pick one to revoke |
 | `no_store_build` | Build with `--profile production` first |