Apple Passwords keeps passwords and 2FA codes but not files, so the passwords go in Passwords and the keystore files go in an encrypted disk image in iCloud Drive. Without the keystores you can't update the apps on Google Play.

1. In Finder, open ~/Backups/client-relaunch-2026. Open idotrash_app-secrets/key.properties in TextEdit.
2. In Passwords, create a new entry named "iDoTrash Android upload key". Save storePassword as the password, and keyAlias and keyPassword in Notes. Close the file without changing it.
3. Do the same for mi_mariachi_project-secrets/key.properties as "Mi Mariachi Android upload key". Also save mi_mariachi_project-secrets/.env and sentry.properties values in that entry's Notes.
4. Copy the command below and paste it into Terminal. It asks you to choose a password twice; use a strong one. It creates client-keys.dmg in iCloud Drive containing both secrets folders.
5. In Passwords, save that disk image password as "Client keys disk image".
6. Check it: double-click client-keys.dmg in iCloud Drive, enter the password, and confirm both folders and the two .jks files are inside. Eject it.
7. Optional: in Passwords, create a shared group for the client logins (store accounts, Supabase, Stripe, GoDaddy/cPanel) if the client uses Apple devices.

hdiutil create -encryption AES-256 -volname "Client keys" -srcfolder ~/Backups/client-relaunch-2026/idotrash_app-secrets -srcfolder ~/Backups/client-relaunch-2026/mi_mariachi_project-secrets ~/Library/Mobile\ Documents/com~apple~CloudDocs/client-keys.dmg

Build on this Mac and upload by hand: the .aab in Play Console, the .ipa with Transporter. No Codemagic needed. A RELEASE.md and a release script will be added to each repo before the first release.

1. Before the first release: Xcode updated, new package names in place, and config/stripe.live.json created with the live publishable key (Mi Mariachi now; iDoTrash after Stripe re-verifies the company). Until Mi Mariachi's Phase 1 moves its key to config, build it without the --dart-define-from-file part.
2. Open Terminal, go to the app folder and make sure everything is committed (git status shows nothing).
3. In pubspec.yaml, raise the version, e.g. 1.2.1+68 to 1.2.2+69. The number after + must go up for every upload to either store.
4. Android: run the appbundle command below, then in Play Console open the app, go to Testing, Internal testing, Create new release, and upload build/app/outputs/bundle/release/app-release.aab. Promote it to Production once it checks out. The very first upload must be done this way; it also turns on Play App Signing.
5. iOS: run the ipa command below, open Transporter, drag in the .ipa from build/ios/ipa/ and click Deliver. Then in App Store Connect add the build from TestFlight to a new version and submit it for review.
6. Tag the release in git with the same version (for example v1.2.2+69) so it can always be rebuilt.

# iDoTrash
cd ~/Development/idotrash_app && git status
flutter build appbundle --dart-define-from-file=config/stripe.live.json
flutter build ipa --dart-define-from-file=config/stripe.live.json

# Mi Mariachi
cd ~/Development/mi_mariachi_project && git status
flutter build appbundle --dart-define-from-file=config/stripe.live.json
flutter build ipa --dart-define-from-file=config/stripe.live.json

# Tag after uploading (use the version from pubspec.yaml)
git tag v1.2.2+69