lim 0.19.4 → 0.20.0

package/dist/lib/backend.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.androidSigningKeySecretType = void 0;
+exports.whoAmI = whoAmI;
+exports.getSecret = getSecret;
+exports.putSecret = putSecret;
+const api_1 = require("@limrun/api");
+exports.androidSigningKeySecretType = 'androidSigningKey';
+/** Wraps transport errors with call context; auth errors pass through untouched. */
+function rethrow(err, context) {
+    if (err instanceof api_1.AuthenticationError || !(err instanceof api_1.APIError)) {
+        throw err;
+    }
+    throw new Error(`${context}: ${err.message}`);
+}
+/**
+ * Resolves the organization the API key acts for. `lim login` keys are
+ * organization tokens, so `organization` is the normal path; hand-set
+ * user API keys fall back to the user's default organization, which
+ * /v1/whoami nests inside `user`.
+ */
+async function whoAmI(client) {
+    let body;
+    try {
+        body = await client.get('/v1/whoami');
+    }
+    catch (err) {
+        rethrow(err, 'Failed to resolve the organization');
+    }
+    const organizationId = body.organization?.id ?? body.user?.defaultOrganization?.id;
+    if (!organizationId) {
+        throw new Error('The Limrun API did not report an organization for this API key.');
+    }
+    return organizationId;
+}
+function secretPath(organizationId, secretType, secretName) {
+    return `/v1/organizations/${encodeURIComponent(organizationId)}/secrets/${encodeURIComponent(secretType)}/${encodeURIComponent(secretName)}`;
+}
+/** Fetches a secret's data, or undefined when it does not exist. */
+async function getSecret(client, organizationId, secretType, secretName) {
+    let body;
+    try {
+        body = await client.get(secretPath(organizationId, secretType, secretName));
+    }
+    catch (err) {
+        if (err instanceof api_1.NotFoundError) {
+            return undefined;
+        }
+        rethrow(err, `Failed to fetch the ${secretType} secret ${secretName}`);
+    }
+    if (!body.data) {
+        throw new Error(`The Limrun API returned a ${secretType} secret without data.`);
+    }
+    return body.data;
+}
+/**
+ * Get-or-create put. The response data is authoritative: on a hit the
+ * submitted data was NOT stored and the caller must adopt the returned
+ * material instead. Creation is signaled by the response body's
+ * `created` today and by HTTP 201 after the status-split hardening;
+ * accept both so either server version works.
+ */
+async function putSecret(client, organizationId, secretType, secretName, data) {
+    let body;
+    let response;
+    try {
+        ({ data: body, response } = await client
+            .put(secretPath(organizationId, secretType, secretName), {
+            body: { data },
+        })
+            .withResponse());
+    }
+    catch (err) {
+        rethrow(err, `Failed to store the ${secretType} secret ${secretName}`);
+    }
+    if (!body.data) {
+        throw new Error(`The Limrun API returned a ${secretType} secret without data.`);
+    }
+    return { data: body.data, created: body.created ?? response.status === 201 };
+}
+//# sourceMappingURL=backend.js.map

package/dist/lib/backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../../src/lib/backend.ts"],"names":[],"mappings":";;;AAiCA,wBAYC;AASD,8BAmBC;AASD,8BAsBC;AAxGD,qCAAmF;AAiBtE,QAAA,2BAA2B,GAAG,mBAAmB,CAAC;AAE/D,oFAAoF;AACpF,SAAS,OAAO,CAAC,GAAY,EAAE,OAAe;IAC5C,IAAI,GAAG,YAAY,yBAAmB,IAAI,CAAC,CAAC,GAAG,YAAY,cAAQ,CAAC,EAAE,CAAC;QACrE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,MAAM,CAAC,MAAc;IACzC,IAAI,IAA0F,CAAC;IAC/F,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC;IACnF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,UAAU,CAAC,cAAsB,EAAE,UAAkB,EAAE,UAAkB;IAChF,OAAO,qBAAqB,kBAAkB,CAAC,cAAc,CAAC,YAAY,kBAAkB,CAC1F,UAAU,CACX,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,oEAAoE;AAC7D,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,cAAsB,EACtB,UAAkB,EAClB,UAAkB;IAElB,IAAI,IAA2B,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAa,EAAE,CAAC;YACjC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,uBAAuB,UAAU,WAAW,UAAU,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6BAA6B,UAAU,uBAAuB,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,cAAsB,EACtB,UAAkB,EAClB,UAAkB,EAClB,IAAgB;IAEhB,IAAI,IAA8C,CAAC;IACnD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM;aACrC,GAAG,CAA2C,UAAU,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE;YACjG,IAAI,EAAE,EAAE,IAAI,EAAE;SACf,CAAC;aACD,YAAY,EAAE,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,EAAE,uBAAuB,UAAU,WAAW,UAAU,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6BAA6B,UAAU,uBAAuB,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;AAC/E,CAAC"}

package/dist/lib/backend.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=backend.test.d.ts.map

package/dist/lib/backend.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.test.d.ts","sourceRoot":"","sources":["../../src/lib/backend.test.ts"],"names":[],"mappings":""}

package/dist/lib/backend.test.js

@@ -0,0 +1,124 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = __importStar(require("@limrun/api"));
+const backend_1 = require("./backend");
+const apiEndpoint = 'https://api.example.test';
+function mockResponse(status, body) {
+    return new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
+}
+describe('backend client', () => {
+    let fetchMock;
+    let client;
+    beforeEach(() => {
+        fetchMock = jest.spyOn(globalThis, 'fetch');
+        client = new api_1.default({ apiKey: 'key', baseURL: apiEndpoint, maxRetries: 0 });
+    });
+    afterEach(() => {
+        fetchMock.mockRestore();
+    });
+    function requestOf(call) {
+        const [input, init] = call;
+        return {
+            url: String(input),
+            auth: new Headers(init?.headers).get('authorization'),
+        };
+    }
+    describe('whoAmI', () => {
+        it('resolves the organization for org tokens with the bearer key', async () => {
+            fetchMock.mockResolvedValue(mockResponse(200, { type: 'organization', organization: { id: 'org_1' } }));
+            await expect((0, backend_1.whoAmI)(client)).resolves.toBe('org_1');
+            const { url, auth } = requestOf(fetchMock.mock.calls[0]);
+            expect(url).toBe(`${apiEndpoint}/v1/whoami`);
+            expect(auth).toBe('Bearer key');
+        });
+        it('falls back to the default organization NESTED IN user for user tokens', async () => {
+            fetchMock.mockResolvedValue(mockResponse(200, { type: 'user', user: { defaultOrganization: { id: 'org_2' } } }));
+            await expect((0, backend_1.whoAmI)(client)).resolves.toBe('org_2');
+        });
+        it('throws the SDK AuthenticationError on 401 so withAuth can re-login', async () => {
+            fetchMock.mockResolvedValue(mockResponse(401, {}));
+            await expect((0, backend_1.whoAmI)(client)).rejects.toBeInstanceOf(api_1.AuthenticationError);
+        });
+        it('fails when no organization is reported', async () => {
+            fetchMock.mockResolvedValue(mockResponse(200, { type: 'user', user: {} }));
+            await expect((0, backend_1.whoAmI)(client)).rejects.toThrow(/did not report an organization/);
+        });
+    });
+    describe('getSecret', () => {
+        it('returns undefined on 404', async () => {
+            fetchMock.mockResolvedValue(mockResponse(404, { message: 'not found' }));
+            await expect((0, backend_1.getSecret)(client, 'org_1', 'androidSigningKey', 'com.x')).resolves.toBeUndefined();
+        });
+        it('URL-encodes path segments and returns the data', async () => {
+            fetchMock.mockResolvedValue(mockResponse(200, { data: { keyAlias: 'upload' } }));
+            await expect((0, backend_1.getSecret)(client, 'org/1', 'androidSigningKey', 'com/x')).resolves.toEqual({
+                keyAlias: 'upload',
+            });
+            const { url } = requestOf(fetchMock.mock.calls[0]);
+            expect(url).toBe(`${apiEndpoint}/v1/organizations/org%2F1/secrets/androidSigningKey/com%2Fx`);
+        });
+        it('surfaces the API error message', async () => {
+            fetchMock.mockResolvedValue(mockResponse(500, { message: 'db down' }));
+            await expect((0, backend_1.getSecret)(client, 'org_1', 'androidSigningKey', 'com.x')).rejects.toThrow(/db down/);
+        });
+    });
+    describe('putSecret', () => {
+        it("reads `created` from the response body (today's 200-only server)", async () => {
+            fetchMock.mockResolvedValue(mockResponse(200, { data: { keyAlias: 'upload' }, created: true }));
+            await expect((0, backend_1.putSecret)(client, 'org_1', 'androidSigningKey', 'com.x', { keyAlias: 'upload' })).resolves.toEqual({
+                data: { keyAlias: 'upload' },
+                created: true,
+            });
+        });
+        it('falls back to HTTP 201 when the body has no created field (status-split server)', async () => {
+            fetchMock.mockResolvedValue(mockResponse(201, { data: { keyAlias: 'upload' } }));
+            await expect((0, backend_1.putSecret)(client, 'org_1', 'androidSigningKey', 'com.x', { keyAlias: 'upload' })).resolves.toEqual({
+                data: { keyAlias: 'upload' },
+                created: true,
+            });
+        });
+        it('returns the WINNER data on a get-or-create hit, not the submitted data', async () => {
+            fetchMock.mockResolvedValue(mockResponse(200, { data: { keyAlias: 'winner' }, created: false }));
+            const result = await (0, backend_1.putSecret)(client, 'org_1', 'androidSigningKey', 'com.x', { keyAlias: 'loser' });
+            expect(result).toEqual({ data: { keyAlias: 'winner' }, created: false });
+        });
+        it('rejects validation failures with the API message', async () => {
+            fetchMock.mockResolvedValue(mockResponse(400, { message: 'keystoreBase64 is required' }));
+            await expect((0, backend_1.putSecret)(client, 'org_1', 'androidSigningKey', 'com.x', {})).rejects.toThrow(/keystoreBase64 is required/);
+        });
+    });
+});
+//# sourceMappingURL=backend.test.js.map

package/dist/lib/backend.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.test.js","sourceRoot":"","sources":["../../src/lib/backend.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mDAA0D;AAE1D,uCAAyD;AAEzD,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAE/C,SAAS,YAAY,CAAC,MAAc,EAAE,IAAa;IACjD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;AACzG,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,IAAI,SAA2B,CAAC;IAChC,IAAI,MAAc,CAAC;IAEnB,UAAU,CAAC,GAAG,EAAE;QACd,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,GAAG,IAAI,aAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,SAAS,CAAC,WAAW,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,SAAS,SAAS,CAAC,IAAe;QAChC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,IAA+C,CAAC;QACtE,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC;YAClB,IAAI,EAAE,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;SACtD,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;QACtB,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;YAC5E,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;YACxG,MAAM,MAAM,CAAC,IAAA,gBAAM,EAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,WAAW,YAAY,CAAC,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;YACrF,SAAS,CAAC,iBAAiB,CACzB,YAAY,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CACpF,CAAC;YACF,MAAM,MAAM,CAAC,IAAA,gBAAM,EAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;YAClF,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;YACnD,MAAM,MAAM,CAAC,IAAA,gBAAM,EAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,yBAAmB,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YAC3E,MAAM,MAAM,CAAC,IAAA,gBAAM,EAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;QACzB,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;YACxC,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;YACzE,MAAM,MAAM,CAAC,IAAA,mBAAS,EAAC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAClG,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC9D,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;YACjF,MAAM,MAAM,CAAC,IAAA,mBAAS,EAAC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACtF,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,WAAW,6DAA6D,CAAC,CAAC;QAChG,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;YAC9C,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YACvE,MAAM,MAAM,CAAC,IAAA,mBAAS,EAAC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpG,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;QACzB,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;YAChF,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAChG,MAAM,MAAM,CACV,IAAA,mBAAS,EAAC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CACjF,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACjB,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;gBAC5B,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;YAC/F,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;YACjF,MAAM,MAAM,CACV,IAAA,mBAAS,EAAC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CACjF,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACjB,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;gBAC5B,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;YACtF,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YACjG,MAAM,MAAM,GAAG,MAAM,IAAA,mBAAS,EAAC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YACrG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;YAChE,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC,CAAC;YAC1F,MAAM,MAAM,CAAC,IAAA,mBAAS,EAAC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACxF,4BAA4B,CAC7B,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/gradle-build-options.d.ts

@@ -12,7 +12,28 @@ export interface GradleBuildFlagValues {
     abi?: string[];
     upload?: string;
     'signed-upload-url'?: string;
+    sign?: boolean;
+    'application-id'?: string;
+    keystore?: string;
+    'keystore-password'?: string;
+    'key-alias'?: string;
+    'key-password'?: string;
+    'save-key'?: boolean;
 }
+/** Whether any explicit task produces an app bundle (AAB) artifact. */
+export declare function tasksIncludeBundle(tasks: string[]): boolean;
+/**
+ * Validates the signing flag combinations. Separate from the options
+ * mapping because signing material is resolved asynchronously (file read
+ * or escrow round-trip) after validation, while the mapper stays pure.
+ *
+ * The bring-your-own group is anchored on --keystore alone: the password
+ * flags are env-backed (LIM_KEYSTORE_PASSWORD, LIM_KEY_PASSWORD), so an
+ * ambient export must not drag a plain or --sign build into BYO
+ * validation. Presence checks use undefined, not truthiness: empty
+ * keystore passwords are legal.
+ */
+export declare function validateSigningFlags(flags: GradleBuildFlagValues): void;
 /**
  * Maps parsed `lim gradle build` flags to the exec options, throwing on
  * contradictory combinations. Pure and oclif-free so it is unit-testable and

package/dist/lib/gradle-build-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gradle-build-options.d.ts","sourceRoot":"","sources":["../../src/lib/gradle-build-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAoB,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,+DAMkB,CAAC;AAEjD,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,qBAAqB,GAAG,kBAAkB,CA8B5F"}
+{"version":3,"file":"gradle-build-options.d.ts","sourceRoot":"","sources":["../../src/lib/gradle-build-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAoB,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,+DAMkB,CAAC;AAEjD,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAE3D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CA2BvE;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,qBAAqB,GAAG,kBAAkB,CA+B5F"}

package/dist/lib/gradle-build-options.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.gradleAndroidABIs = void 0;
+exports.tasksIncludeBundle = tasksIncludeBundle;
+exports.validateSigningFlags = validateSigningFlags;
 exports.gradleBuildOptionsFromFlags = gradleBuildOptionsFromFlags;
 /**
  * Single source for the --abi enum: `satisfies` pins every entry to the SDK
@@ -14,6 +16,44 @@ exports.gradleAndroidABIs = [
     'x86_64',
     'all',
 ];
+/** Whether any explicit task produces an app bundle (AAB) artifact. */
+function tasksIncludeBundle(tasks) {
+    return tasks.some((t) => t.toLowerCase().includes('bundle'));
+}
+/**
+ * Validates the signing flag combinations. Separate from the options
+ * mapping because signing material is resolved asynchronously (file read
+ * or escrow round-trip) after validation, while the mapper stays pure.
+ *
+ * The bring-your-own group is anchored on --keystore alone: the password
+ * flags are env-backed (LIM_KEYSTORE_PASSWORD, LIM_KEY_PASSWORD), so an
+ * ambient export must not drag a plain or --sign build into BYO
+ * validation. Presence checks use undefined, not truthiness: empty
+ * keystore passwords are legal.
+ */
+function validateSigningFlags(flags) {
+    if (flags.sign && flags.keystore) {
+        throw new Error('Use either --sign (escrowed key) or --keystore (bring your own key), not both.');
+    }
+    if (flags.keystore) {
+        const missing = ['keystore-password', 'key-alias', 'key-password'].filter((f) => flags[f] === undefined);
+        if (missing.length > 0) {
+            throw new Error(`Signing with your own key requires ${missing.map((f) => `--${f}`).join(', ')} as well.`);
+        }
+    }
+    else if (flags['key-alias'] !== undefined) {
+        throw new Error('--key-alias requires --keystore.');
+    }
+    if (flags['save-key'] && !flags.keystore) {
+        throw new Error('--save-key escrows a provided key and requires the --keystore flags.');
+    }
+    if (flags['application-id'] && !flags.sign && !flags['save-key']) {
+        throw new Error('--application-id only applies to --sign or --save-key.');
+    }
+    if (flags.sign && flags.task?.length && !tasksIncludeBundle(flags.task)) {
+        throw new Error('--sign produces a Play-ready signed AAB; include a bundle task (e.g. bundleRelease) in --task or omit --task.');
+    }
+}
 /**
  * Maps parsed `lim gradle build` flags to the exec options, throwing on
  * contradictory combinations. Pure and oclif-free so it is unit-testable and
@@ -26,6 +66,7 @@ function gradleBuildOptionsFromFlags(flags) {
     if (flags.upload && flags['signed-upload-url']) {
         throw new Error('Use either --upload or --signed-upload-url, not both.');
     }
+    validateSigningFlags(flags);
     const options = {};
     if (flags.task?.length) {
         options.tasks = flags.task;

package/dist/lib/gradle-build-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"gradle-build-options.js","sourceRoot":"","sources":["../../src/lib/gradle-build-options.ts"],"names":[],"mappings":";;;AAgCA,kEA8BC;AA5DD;;;;GAIG;AACU,QAAA,iBAAiB,GAAG;IAC/B,aAAa;IACb,WAAW;IACX,KAAK;IACL,QAAQ;IACR,KAAK;CACyC,CAAC;AAWjD;;;;;;;GAOG;AACH,SAAgB,2BAA2B,CAAC,KAA4B;IACtE,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC;IAC7B,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAwB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,IAAI,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,WAAW,GAAG;YACpB,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SACrC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAC/C,CAAC;SAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,MAAM,GAAG,EAAE,eAAe,EAAE,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"gradle-build-options.js","sourceRoot":"","sources":["../../src/lib/gradle-build-options.ts"],"names":[],"mappings":";;;AAgCA,gDAEC;AAaD,oDA2BC;AAUD,kEA+BC;AAjHD;;;;GAIG;AACU,QAAA,iBAAiB,GAAG;IAC/B,aAAa;IACb,WAAW;IACX,KAAK;IACL,QAAQ;IACR,KAAK;CACyC,CAAC;AAkBjD,uEAAuE;AACvE,SAAgB,kBAAkB,CAAC,KAAe;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,oBAAoB,CAAC,KAA4B;IAC/D,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,OAAO,GAAI,CAAC,mBAAmB,EAAE,WAAW,EAAE,cAAc,CAAW,CAAC,MAAM,CAClF,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAC9B,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,sCAAsC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,2BAA2B,CAAC,KAA4B;IACtE,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC;IAC7B,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAwB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,IAAI,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,WAAW,GAAG;YACpB,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SACrC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAC/C,CAAC;SAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,MAAM,GAAG,EAAE,eAAe,EAAE,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/lib/gradle-build-options.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=gradle-build-options.test.d.ts.map

package/dist/lib/gradle-build-options.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gradle-build-options.test.d.ts","sourceRoot":"","sources":["../../src/lib/gradle-build-options.test.ts"],"names":[],"mappings":""}

package/dist/lib/gradle-build-options.test.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const gradle_build_options_1 = require("./gradle-build-options");
+const byo = {
+    keystore: 'upload.jks',
+    'keystore-password': 'store-pass',
+    'key-alias': 'upload',
+    'key-password': 'key-pass',
+};
+describe('gradleBuildOptionsFromFlags signing validation', () => {
+    const cases = [
+        { name: 'no signing flags', flags: {} },
+        { name: 'sign alone', flags: { sign: true } },
+        { name: 'sign with application-id', flags: { sign: true, 'application-id': 'com.x' } },
+        { name: 'full BYO group', flags: { ...byo } },
+        { name: 'full BYO group with save-key', flags: { ...byo, 'save-key': true, 'application-id': 'com.x' } },
+        {
+            name: 'empty-string keystore password is provided, not missing',
+            flags: { ...byo, 'keystore-password': '' },
+        },
+        {
+            name: 'ambient env passwords without --keystore do not poison a plain build',
+            flags: { 'keystore-password': 'from-env', 'key-password': 'from-env' },
+        },
+        {
+            name: 'ambient env passwords without --keystore do not poison --sign',
+            flags: { sign: true, 'keystore-password': 'from-env', 'key-password': 'from-env' },
+        },
+        { name: 'sign and keystore together', flags: { sign: true, ...byo }, error: /not both/ },
+        {
+            name: 'keystore without the rest names the missing flags',
+            flags: { keystore: 'upload.jks', 'key-alias': 'upload' },
+            error: /--keystore-password, --key-password/,
+        },
+        { name: 'key-alias without keystore', flags: { 'key-alias': 'upload' }, error: /requires --keystore/ },
+        { name: 'save-key without keystore', flags: { 'save-key': true }, error: /requires the --keystore/ },
+        {
+            name: 'application-id without sign or save-key',
+            flags: { 'application-id': 'com.x' },
+            error: /only applies to --sign or --save-key/,
+        },
+        {
+            name: 'sign with an explicit non-bundle task',
+            flags: { sign: true, task: ['assembleDebug'] },
+            error: /include a bundle task/,
+        },
+        { name: 'sign with an explicit bundle task', flags: { sign: true, task: [':app:bundleRelease'] } },
+        { name: 'BYO keystore with a debug task stays allowed', flags: { ...byo, task: ['assembleDebug'] } },
+    ];
+    it.each(cases)('$name', ({ flags, error }) => {
+        if (error) {
+            expect(() => (0, gradle_build_options_1.gradleBuildOptionsFromFlags)(flags)).toThrow(error);
+        }
+        else {
+            expect(() => (0, gradle_build_options_1.gradleBuildOptionsFromFlags)(flags)).not.toThrow();
+        }
+    });
+    it('never maps signing material itself: the command resolves it asynchronously', () => {
+        expect((0, gradle_build_options_1.gradleBuildOptionsFromFlags)({ ...byo }).signing).toBeUndefined();
+        expect((0, gradle_build_options_1.gradleBuildOptionsFromFlags)({ sign: true }).signing).toBeUndefined();
+    });
+});
+//# sourceMappingURL=gradle-build-options.test.js.map

package/dist/lib/gradle-build-options.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gradle-build-options.test.js","sourceRoot":"","sources":["../../src/lib/gradle-build-options.test.ts"],"names":[],"mappings":";;AAAA,iEAAiG;AAEjG,MAAM,GAAG,GAAG;IACV,QAAQ,EAAE,YAAY;IACtB,mBAAmB,EAAE,YAAY;IACjC,WAAW,EAAE,QAAQ;IACrB,cAAc,EAAE,UAAU;CAC3B,CAAC;AAEF,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,MAAM,KAAK,GAA0E;QACnF,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,EAAE;QACvC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC7C,EAAE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE;QACtF,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE;QAC7C,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE;QACxG;YACE,IAAI,EAAE,yDAAyD;YAC/D,KAAK,EAAE,EAAE,GAAG,GAAG,EAAE,mBAAmB,EAAE,EAAE,EAAE;SAC3C;QACD;YACE,IAAI,EAAE,sEAAsE;YAC5E,KAAK,EAAE,EAAE,mBAAmB,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE;SACvE;QACD;YACE,IAAI,EAAE,+DAA+D;YACrE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE;SACnF;QACD,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE;QACxF;YACE,IAAI,EAAE,mDAAmD;YACzD,KAAK,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE;YACxD,KAAK,EAAE,qCAAqC;SAC7C;QACD,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE;QACtG,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE;QACpG;YACE,IAAI,EAAE,yCAAyC;YAC/C,KAAK,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE;YACpC,KAAK,EAAE,sCAAsC;SAC9C;QACD;YACE,IAAI,EAAE,uCAAuC;YAC7C,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,eAAe,CAAC,EAAE;YAC9C,KAAK,EAAE,uBAAuB;SAC/B;QACD,EAAE,IAAI,EAAE,mCAAmC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE;QAClG,EAAE,IAAI,EAAE,8CAA8C,EAAE,KAAK,EAAE,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE;KACrG,CAAC;IAEF,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,kDAA2B,EAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,kDAA2B,EAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,CAAC,IAAA,kDAA2B,EAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;QACxE,MAAM,CAAC,IAAA,kDAA2B,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/gradle-signing.d.ts

@@ -0,0 +1,44 @@
+import type { GradleSigningConfig } from '@limrun/api';
+import type Limrun from '@limrun/api';
+/**
+ * Resolves the Android applicationId that names the escrowed signing key.
+ * Precedence: explicit flag, Expo app config, Gradle build script. The
+ * file probes are heuristics; --application-id is the escape hatch.
+ */
+export declare function resolveApplicationId(opts: {
+    explicit?: string;
+    syncPath: string;
+    expoAppDir?: string;
+    projectPath?: string;
+}): string;
+/**
+ * Reads a bring-your-own keystore file into the wire signing shape. The
+ * flag validator guarantees the passwords and alias are set; the checks
+ * here keep that invariant local instead of relying on call-site order.
+ */
+export declare function readProvidedSigning(flags: {
+    keystore: string;
+    keystorePassword?: string;
+    keyAlias?: string;
+    keyPassword?: string;
+}): GradleSigningConfig;
+export type EscrowedSigning = {
+    signing: GradleSigningConfig;
+    /** True when this invocation created the key; false when it already existed. */
+    created: boolean;
+};
+/**
+ * Fetches the organization's upload key for the application, generating
+ * and escrowing one on first use. The backend's get-or-create makes the
+ * concurrent-first-build race safe: whichever caller wins, everyone signs
+ * with the same key, because the response data is authoritative.
+ */
+export declare function resolveEscrowedSigning(client: Limrun, applicationId: string): Promise<EscrowedSigning>;
+/**
+ * Escrows a user-provided key under the application's name. Refuses to
+ * proceed when a DIFFERENT key is already escrowed: silently signing with
+ * either key would surprise someone, and replacing an upload key is not a
+ * side effect a build command should have.
+ */
+export declare function saveProvidedKey(client: Limrun, applicationId: string, provided: GradleSigningConfig): Promise<boolean>;
+//# sourceMappingURL=gradle-signing.d.ts.map

package/dist/lib/gradle-signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gradle-signing.d.ts","sourceRoot":"","sources":["../../src/lib/gradle-signing.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGvD,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAMtC;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAoBT;AAmCD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,mBAAmB,CAwBtB;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,mBAAmB,CAAC;IAC7B,gFAAgF;IAChF,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,eAAe,CAAC,CAe1B;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,OAAO,CAAC,CAgBlB"}

package/dist/lib/gradle-signing.js

@@ -0,0 +1,167 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveApplicationId = resolveApplicationId;
+exports.readProvidedSigning = readProvidedSigning;
+exports.resolveEscrowedSigning = resolveEscrowedSigning;
+exports.saveProvidedKey = saveProvidedKey;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const android_keystore_1 = require("./android-keystore");
+const backend_1 = require("./backend");
+const signingFields = ['keystoreBase64', 'keystorePassword', 'keyAlias', 'keyPassword'];
+/**
+ * Resolves the Android applicationId that names the escrowed signing key.
+ * Precedence: explicit flag, Expo app config, Gradle build script. The
+ * file probes are heuristics; --application-id is the escape hatch.
+ */
+function resolveApplicationId(opts) {
+    if (opts.explicit) {
+        return opts.explicit;
+    }
+    const fromExpo = expoAndroidPackage(path.join(opts.syncPath, opts.expoAppDir ?? '.'));
+    if (fromExpo) {
+        return fromExpo;
+    }
+    // Probe the explicit gradle root first, then the conventional bare
+    // React Native layout (android/), which users rarely spell out because
+    // the server auto-discovers it.
+    for (const root of [...new Set([opts.projectPath ?? '.', 'android'])]) {
+        const fromGradle = gradleApplicationId(path.join(opts.syncPath, root));
+        if (fromGradle) {
+            return fromGradle;
+        }
+    }
+    throw new Error('Cannot determine the Android application ID for signing. Pass --application-id <id> (the value of android.package in app.json, or applicationId in app/build.gradle).');
+}
+function expoAndroidPackage(appDir) {
+    try {
+        const raw = fs.readFileSync(path.join(appDir, 'app.json'), 'utf8');
+        const parsed = JSON.parse(raw);
+        return parsed.expo?.android?.package || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function gradleApplicationId(gradleRoot) {
+    for (const candidate of ['app/build.gradle', 'app/build.gradle.kts']) {
+        let content;
+        try {
+            content = fs.readFileSync(path.join(gradleRoot, candidate), 'utf8');
+        }
+        catch {
+            continue;
+        }
+        // Matches both Groovy (applicationId "com.x") and Kotlin DSL
+        // (applicationId = "com.x"), skipping line comments so a commented-out
+        // previous ID cannot shadow the live one. First live match wins;
+        // flavor-specific overrides are out of heuristic scope.
+        for (const line of content.split('\n')) {
+            const code = line.split('//', 1)[0];
+            const match = code.match(/applicationId\s*=?\s*["']([A-Za-z0-9_.]+)["']/);
+            if (match) {
+                return match[1];
+            }
+        }
+    }
+    return undefined;
+}
+/**
+ * Reads a bring-your-own keystore file into the wire signing shape. The
+ * flag validator guarantees the passwords and alias are set; the checks
+ * here keep that invariant local instead of relying on call-site order.
+ */
+function readProvidedSigning(flags) {
+    const { keystorePassword, keyAlias, keyPassword } = flags;
+    if (keystorePassword === undefined || keyAlias === undefined || keyPassword === undefined) {
+        throw new Error('Signing with your own key requires --keystore-password, --key-alias and --key-password.');
+    }
+    let keystore;
+    try {
+        keystore = fs.readFileSync(flags.keystore);
+    }
+    catch (err) {
+        throw new Error(`Cannot read the keystore file ${flags.keystore}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (keystore.length === 0) {
+        throw new Error(`The keystore file ${flags.keystore} is empty.`);
+    }
+    return {
+        keystoreBase64: keystore.toString('base64'),
+        keystorePassword,
+        keyAlias,
+        keyPassword,
+    };
+}
+/**
+ * Fetches the organization's upload key for the application, generating
+ * and escrowing one on first use. The backend's get-or-create makes the
+ * concurrent-first-build race safe: whichever caller wins, everyone signs
+ * with the same key, because the response data is authoritative.
+ */
+async function resolveEscrowedSigning(client, applicationId) {
+    const organizationId = await (0, backend_1.whoAmI)(client);
+    const existing = await (0, backend_1.getSecret)(client, organizationId, backend_1.androidSigningKeySecretType, applicationId);
+    if (existing) {
+        return { signing: asSigningConfig(existing, applicationId), created: false };
+    }
+    const generated = (0, android_keystore_1.generateAndroidSigningKey)(applicationId);
+    const result = await (0, backend_1.putSecret)(client, organizationId, backend_1.androidSigningKeySecretType, applicationId, generated);
+    return { signing: asSigningConfig(result.data, applicationId), created: result.created };
+}
+/**
+ * Escrows a user-provided key under the application's name. Refuses to
+ * proceed when a DIFFERENT key is already escrowed: silently signing with
+ * either key would surprise someone, and replacing an upload key is not a
+ * side effect a build command should have.
+ */
+async function saveProvidedKey(client, applicationId, provided) {
+    const organizationId = await (0, backend_1.whoAmI)(client);
+    const result = await (0, backend_1.putSecret)(client, organizationId, backend_1.androidSigningKeySecretType, applicationId, provided);
+    if (!result.created && !signingFields.every((f) => result.data[f] === provided[f])) {
+        throw new Error(`The organization already has a different upload key escrowed for ${applicationId}. ` +
+            'Builds with --sign use that key; drop --save-key to sign with the provided keystore for this build only.');
+    }
+    return result.created;
+}
+function asSigningConfig(data, applicationId) {
+    if (signingFields.some((f) => !data[f])) {
+        throw new Error(`The escrowed signing key for ${applicationId} is missing required fields; contact support before retrying.`);
+    }
+    const { keystoreBase64, keystorePassword, keyAlias, keyPassword } = data;
+    return { keystoreBase64, keystorePassword, keyAlias, keyPassword };
+}
+//# sourceMappingURL=gradle-signing.js.map