@better-update/cli 0.19.0 → 0.20.0

package/dist/index.mjs

@@ -17,11 +17,12 @@ import forge from "node-forge";
 import { accessSync, chmodSync, constants, createReadStream, existsSync, promises, readFileSync, writeFileSync } from "node:fs";
 import { spawn as spawn$1 } from "node-pty";
 import chalk from "chalk";
-import os from "node:os";
+import os, { tmpdir } from "node:os";
 import plistMod from "@expo/plist";
 import { ExpoRunFormatter } from "@expo/xcpretty";
 import { promisify } from "node:util";
 import ignore from "ignore";
+import { readFile, writeFile } from "node:fs/promises";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { getFormattedSerialNumber, getX509Certificate, parsePKCS12 } from "@expo/pkcs12";
 import qrcode from "qrcode-terminal";
@@ -32,7 +33,7 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 //#endregion
 //#region package.json
-var version = "0.19.0";
+var version = "0.20.0";
 
 //#endregion
 //#region src/lib/interactive-mode.ts
@@ -200,15 +201,15 @@ var NotAcceptable = class extends Schema.TaggedError()("NotAcceptable", { messag
 
 //#endregion
 //#region ../../packages/api/src/groups/android-application-identifiers.ts
-const idParam$16 = HttpApiSchema.param("id", Schema.String);
-const projectIdParam$4 = HttpApiSchema.param("projectId", Schema.String);
-var AndroidApplicationIdentifiersGroup = class extends HttpApiGroup.make("androidApplicationIdentifiers").add(HttpApiEndpoint.get("list")`/api/projects/${projectIdParam$4}/android-application-identifiers`.addSuccess(Schema.Struct({ items: Schema.Array(AndroidApplicationIdentifier) })).annotateContext(OpenApi.annotations({
+const idParam$18 = HttpApiSchema.param("id", Schema.String);
+const projectIdParam$6 = HttpApiSchema.param("projectId", Schema.String);
+var AndroidApplicationIdentifiersGroup = class extends HttpApiGroup.make("androidApplicationIdentifiers").add(HttpApiEndpoint.get("list")`/api/projects/${projectIdParam$6}/android-application-identifiers`.addSuccess(Schema.Struct({ items: Schema.Array(AndroidApplicationIdentifier) })).annotateContext(OpenApi.annotations({
 	title: "List Android application identifiers",
 	description: "List all Android package identifiers for a project"
-}))).add(HttpApiEndpoint.post("create")`/api/projects/${projectIdParam$4}/android-application-identifiers`.setPayload(CreateAndroidApplicationIdentifierBody).addSuccess(AndroidApplicationIdentifier, { status: 201 }).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.post("create")`/api/projects/${projectIdParam$6}/android-application-identifiers`.setPayload(CreateAndroidApplicationIdentifierBody).addSuccess(AndroidApplicationIdentifier, { status: 201 }).annotateContext(OpenApi.annotations({
 	title: "Create Android application identifier",
 	description: "Register an Android package name for a project"
-}))).add(HttpApiEndpoint.del("delete")`/api/android-application-identifiers/${idParam$16}`.addSuccess(DeleteAndroidApplicationIdentifierResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.del("delete")`/api/android-application-identifiers/${idParam$18}`.addSuccess(DeleteAndroidApplicationIdentifierResult).annotateContext(OpenApi.annotations({
 	title: "Delete Android application identifier",
 	description: "Remove an Android application identifier"
 }))).addError(NotFound).addError(Conflict).addError(BadRequest).addError(Forbidden).annotateContext(OpenApi.annotations({
@@ -248,7 +249,7 @@ const DeleteAndroidBuildCredentialsResult = Schema.Struct({ deleted: Schema.Numb
 
 //#endregion
 //#region ../../packages/api/src/groups/android-build-credentials.ts
-const idParam$15 = HttpApiSchema.param("id", Schema.String);
+const idParam$17 = HttpApiSchema.param("id", Schema.String);
 const applicationIdentifierIdParam = HttpApiSchema.param("applicationIdentifierId", Schema.String);
 var AndroidBuildCredentialsGroup = class extends HttpApiGroup.make("androidBuildCredentials").add(HttpApiEndpoint.get("list")`/api/android-application-identifiers/${applicationIdentifierIdParam}/build-credentials`.addSuccess(Schema.Struct({ items: Schema.Array(AndroidBuildCredentials) })).annotateContext(OpenApi.annotations({
 	title: "List Android build credentials",
@@ -256,10 +257,10 @@ var AndroidBuildCredentialsGroup = class extends HttpApiGroup.make("androidBuild
 }))).add(HttpApiEndpoint.post("create")`/api/android-application-identifiers/${applicationIdentifierIdParam}/build-credentials`.setPayload(CreateAndroidBuildCredentialsBody).addSuccess(AndroidBuildCredentials, { status: 201 }).annotateContext(OpenApi.annotations({
 	title: "Create Android build credentials group",
 	description: "Create a named build credentials group (Default or custom)"
-}))).add(HttpApiEndpoint.put("update")`/api/android-build-credentials/${idParam$15}`.setPayload(UpdateAndroidBuildCredentialsBody).addSuccess(AndroidBuildCredentials).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.put("update")`/api/android-build-credentials/${idParam$17}`.setPayload(UpdateAndroidBuildCredentialsBody).addSuccess(AndroidBuildCredentials).annotateContext(OpenApi.annotations({
 	title: "Update Android build credentials",
 	description: "Rename group, change default flag, or swap bound keystore/keys"
-}))).add(HttpApiEndpoint.del("delete")`/api/android-build-credentials/${idParam$15}`.addSuccess(DeleteAndroidBuildCredentialsResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.del("delete")`/api/android-build-credentials/${idParam$17}`.addSuccess(DeleteAndroidBuildCredentialsResult).annotateContext(OpenApi.annotations({
 	title: "Delete Android build credentials",
 	description: "Remove a build credentials group"
 }))).addError(NotFound).addError(Conflict).addError(BadRequest).addError(Forbidden).annotateContext(OpenApi.annotations({
@@ -299,17 +300,17 @@ const DownloadAndroidUploadKeystoreResult = Schema.Struct({
 
 //#endregion
 //#region ../../packages/api/src/groups/android-upload-keystores.ts
-const idParam$14 = HttpApiSchema.param("id", Schema.String);
+const idParam$16 = HttpApiSchema.param("id", Schema.String);
 var AndroidUploadKeystoresGroup = class extends HttpApiGroup.make("androidUploadKeystores").add(HttpApiEndpoint.get("list", "/api/android/upload-keystores").addSuccess(Schema.Struct({ items: Schema.Array(AndroidUploadKeystore) })).annotateContext(OpenApi.annotations({
 	title: "List Android upload keystores",
 	description: "List uploaded Android keystores"
 }))).add(HttpApiEndpoint.post("upload", "/api/android/upload-keystores").setPayload(UploadAndroidUploadKeystoreBody).addSuccess(AndroidUploadKeystore, { status: 201 }).annotateContext(OpenApi.annotations({
 	title: "Upload Android keystore",
 	description: "Upload a JKS/PKCS12 keystore with key alias + passwords"
-}))).add(HttpApiEndpoint.del("delete")`/api/android/upload-keystores/${idParam$14}`.addSuccess(DeleteAndroidUploadKeystoreResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.del("delete")`/api/android/upload-keystores/${idParam$16}`.addSuccess(DeleteAndroidUploadKeystoreResult).annotateContext(OpenApi.annotations({
 	title: "Delete Android keystore",
 	description: "Remove a stored Android keystore"
-}))).add(HttpApiEndpoint.get("download")`/api/android/upload-keystores/${idParam$14}/download`.addSuccess(DownloadAndroidUploadKeystoreResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.get("download")`/api/android/upload-keystores/${idParam$16}/download`.addSuccess(DownloadAndroidUploadKeystoreResult).annotateContext(OpenApi.annotations({
 	title: "Download Android keystore",
 	description: "Fetch the decrypted keystore + passwords for local use (audit-logged)"
 }))).addError(NotFound).addError(Conflict).addError(BadRequest).addError(Forbidden).annotateContext(OpenApi.annotations({
@@ -373,17 +374,17 @@ const DownloadAppleDistributionCertificateResult = Schema.Struct({
 
 //#endregion
 //#region ../../packages/api/src/groups/apple-distribution-certificates.ts
-const idParam$13 = HttpApiSchema.param("id", Schema.String);
+const idParam$15 = HttpApiSchema.param("id", Schema.String);
 var AppleDistributionCertificatesGroup = class extends HttpApiGroup.make("appleDistributionCertificates").add(HttpApiEndpoint.get("list", "/api/apple/distribution-certificates").addSuccess(Schema.Struct({ items: Schema.Array(AppleDistributionCertificate) })).annotateContext(OpenApi.annotations({
 	title: "List Apple distribution certificates",
 	description: "List uploaded Apple distribution certificates for the organization"
 }))).add(HttpApiEndpoint.post("upload", "/api/apple/distribution-certificates").setPayload(UploadAppleDistributionCertificateBody).addSuccess(AppleDistributionCertificate, { status: 201 }).annotateContext(OpenApi.annotations({
 	title: "Upload distribution certificate",
 	description: "Upload a .p12 distribution certificate; auto-derives the Apple team from the provided identifier"
-}))).add(HttpApiEndpoint.del("delete")`/api/apple/distribution-certificates/${idParam$13}`.addSuccess(DeleteAppleDistributionCertificateResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.del("delete")`/api/apple/distribution-certificates/${idParam$15}`.addSuccess(DeleteAppleDistributionCertificateResult).annotateContext(OpenApi.annotations({
 	title: "Delete distribution certificate",
 	description: "Remove a distribution certificate from storage"
-}))).add(HttpApiEndpoint.get("download")`/api/apple/distribution-certificates/${idParam$13}/download`.addSuccess(DownloadAppleDistributionCertificateResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.get("download")`/api/apple/distribution-certificates/${idParam$15}/download`.addSuccess(DownloadAppleDistributionCertificateResult).annotateContext(OpenApi.annotations({
 	title: "Download distribution certificate",
 	description: "Fetch the decrypted .p12 + password for local use (audit-logged)"
 }))).addError(NotFound).addError(Conflict).addError(BadRequest).addError(Forbidden).annotateContext(OpenApi.annotations({
@@ -431,17 +432,17 @@ const ListAppleProvisioningProfilesParams = Schema.Struct({
 
 //#endregion
 //#region ../../packages/api/src/groups/apple-provisioning-profiles.ts
-const idParam$12 = HttpApiSchema.param("id", Schema.String);
+const idParam$14 = HttpApiSchema.param("id", Schema.String);
 var AppleProvisioningProfilesGroup = class extends HttpApiGroup.make("appleProvisioningProfiles").add(HttpApiEndpoint.get("list", "/api/apple/provisioning-profiles").setUrlParams(ListAppleProvisioningProfilesParams).addSuccess(Schema.Struct({ items: Schema.Array(AppleProvisioningProfile) })).annotateContext(OpenApi.annotations({
 	title: "List provisioning profiles",
 	description: "List stored provisioning profiles, optionally filtered by bundle + team"
 }))).add(HttpApiEndpoint.post("upload", "/api/apple/provisioning-profiles").setPayload(UploadAppleProvisioningProfileBody).addSuccess(AppleProvisioningProfile, { status: 201 }).annotateContext(OpenApi.annotations({
 	title: "Upload provisioning profile",
 	description: "Upload an existing or freshly generated .mobileprovision; auto-parses the embedded plist"
-}))).add(HttpApiEndpoint.del("delete")`/api/apple/provisioning-profiles/${idParam$12}`.addSuccess(DeleteAppleProvisioningProfileResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.del("delete")`/api/apple/provisioning-profiles/${idParam$14}`.addSuccess(DeleteAppleProvisioningProfileResult).annotateContext(OpenApi.annotations({
 	title: "Delete provisioning profile",
 	description: "Remove a stored provisioning profile"
-}))).add(HttpApiEndpoint.get("download")`/api/apple/provisioning-profiles/${idParam$12}/download`.addSuccess(DownloadAppleProvisioningProfileResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.get("download")`/api/apple/provisioning-profiles/${idParam$14}/download`.addSuccess(DownloadAppleProvisioningProfileResult).annotateContext(OpenApi.annotations({
 	title: "Download provisioning profile",
 	description: "Fetch the decoded .mobileprovision for local use (audit-logged)"
 }))).addError(NotFound).addError(Conflict).addError(BadRequest).addError(Forbidden).annotateContext(OpenApi.annotations({
@@ -477,17 +478,17 @@ const DownloadApplePushKeyResult = Schema.Struct({
 
 //#endregion
 //#region ../../packages/api/src/groups/apple-push-keys.ts
-const idParam$11 = HttpApiSchema.param("id", Schema.String);
+const idParam$13 = HttpApiSchema.param("id", Schema.String);
 var ApplePushKeysGroup = class extends HttpApiGroup.make("applePushKeys").add(HttpApiEndpoint.get("list", "/api/apple/push-keys").addSuccess(Schema.Struct({ items: Schema.Array(ApplePushKey) })).annotateContext(OpenApi.annotations({
 	title: "List Apple push keys",
 	description: "List APNs push keys for the organization"
 }))).add(HttpApiEndpoint.post("upload", "/api/apple/push-keys").setPayload(UploadApplePushKeyBody).addSuccess(ApplePushKey, { status: 201 }).annotateContext(OpenApi.annotations({
 	title: "Upload push key",
 	description: "Upload an APNs .p8 push notification key"
-}))).add(HttpApiEndpoint.del("delete")`/api/apple/push-keys/${idParam$11}`.addSuccess(DeleteApplePushKeyResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.del("delete")`/api/apple/push-keys/${idParam$13}`.addSuccess(DeleteApplePushKeyResult).annotateContext(OpenApi.annotations({
 	title: "Delete push key",
 	description: "Remove a stored APNs push key"
-}))).add(HttpApiEndpoint.get("download")`/api/apple/push-keys/${idParam$11}/download`.addSuccess(DownloadApplePushKeyResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.get("download")`/api/apple/push-keys/${idParam$13}/download`.addSuccess(DownloadApplePushKeyResult).annotateContext(OpenApi.annotations({
 	title: "Download push key",
 	description: "Fetch the decrypted .p8 push key for local use (audit-logged)"
 }))).addError(NotFound).addError(Conflict).addError(BadRequest).addError(Forbidden).annotateContext(OpenApi.annotations({
@@ -514,6 +515,7 @@ var AscApiKey = class extends Schema.Class("AscApiKey")({
 	organizationId: Id,
 	appleTeamId: Schema.NullOr(Id),
 	keyId: Schema.String,
+	issuerId: IssuerId,
 	name: Schema.String,
 	roles: Schema.Array(Schema.String),
 	createdAt: DateTimeString,
@@ -560,20 +562,20 @@ const SyncDevicesResult = Schema.Struct({
 
 //#endregion
 //#region ../../packages/api/src/groups/asc-api-keys.ts
-const idParam$10 = HttpApiSchema.param("id", Schema.String);
+const idParam$12 = HttpApiSchema.param("id", Schema.String);
 var AscApiKeysGroup = class extends HttpApiGroup.make("ascApiKeys").add(HttpApiEndpoint.get("list", "/api/apple/asc-api-keys").addSuccess(Schema.Struct({ items: Schema.Array(AscApiKey) })).annotateContext(OpenApi.annotations({
 	title: "List App Store Connect API keys",
 	description: "List stored ASC API keys for the organization"
 }))).add(HttpApiEndpoint.post("upload", "/api/apple/asc-api-keys").setPayload(UploadAscApiKeyBody).addSuccess(AscApiKey, { status: 201 }).annotateContext(OpenApi.annotations({
 	title: "Upload ASC API key",
 	description: "Upload an App Store Connect API key (.p8 + issuer)"
-}))).add(HttpApiEndpoint.del("delete")`/api/apple/asc-api-keys/${idParam$10}`.addSuccess(DeleteAscApiKeyResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.del("delete")`/api/apple/asc-api-keys/${idParam$12}`.addSuccess(DeleteAscApiKeyResult).annotateContext(OpenApi.annotations({
 	title: "Delete ASC API key",
 	description: "Remove a stored ASC API key"
-}))).add(HttpApiEndpoint.post("syncDevices")`/api/apple/asc-api-keys/${idParam$10}/sync-devices`.addSuccess(SyncDevicesResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.post("syncDevices")`/api/apple/asc-api-keys/${idParam$12}/sync-devices`.addSuccess(SyncDevicesResult).annotateContext(OpenApi.annotations({
 	title: "Sync devices via ASC API key",
 	description: "Pull registered devices from Apple Developer Portal for this key's team; push local devices that aren't yet registered"
-}))).add(HttpApiEndpoint.get("getCredentials")`/api/apple/asc-api-keys/${idParam$10}/credentials`.addSuccess(AscApiKeyCredentials).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.get("getCredentials")`/api/apple/asc-api-keys/${idParam$12}/credentials`.addSuccess(AscApiKeyCredentials).annotateContext(OpenApi.annotations({
 	title: "Get ASC API key credentials",
 	description: "Return the decrypted .p8 PEM, keyId, issuerId, and Apple team for direct App Store Connect API calls from the CLI"
 }))).addError(NotFound).addError(Conflict).addError(BadRequest).addError(Forbidden).annotateContext(OpenApi.annotations({
@@ -627,7 +629,7 @@ var AssetsGroup = class extends HttpApiGroup.make("assets").add(HttpApiEndpoint.
 
 //#endregion
 //#region ../../packages/api/src/domain/audit-log.ts
-const AuditLogResourceType = Schema.Literal("project", "branch", "channel", "update", "build", "appleCredential", "androidCredential", "iosBundleConfiguration", "envVar", "device", "webhook");
+const AuditLogResourceType = Schema.Literal("project", "branch", "channel", "update", "build", "appleCredential", "androidCredential", "iosBundleConfiguration", "envVar", "device", "webhook", "iosAppMetadata", "submission");
 const AuditLogSource = Schema.Literal("session", "api-key");
 var AuditLog = class extends Schema.Class("AuditLog")({
 	id: Id,
@@ -687,7 +689,7 @@ const DeleteBranchResult = Schema.Struct({ deleted: Schema.Number });
 
 //#endregion
 //#region ../../packages/api/src/groups/branches.ts
-const idParam$9 = HttpApiSchema.param("id", Schema.String);
+const idParam$11 = HttpApiSchema.param("id", Schema.String);
 var BranchesGroup = class extends HttpApiGroup.make("branches").add(HttpApiEndpoint.post("create", "/api/branches").setPayload(CreateBranchBody).addSuccess(Branch, { status: 201 }).annotateContext(OpenApi.annotations({
 	title: "Create branch",
 	description: "Create a new branch within a project"
@@ -699,13 +701,13 @@ var BranchesGroup = class extends HttpApiGroup.make("branches").add(HttpApiEndpo
 })).annotateContext(OpenApi.annotations({
 	title: "List branches",
 	description: "List all branches for a project"
-}))).add(HttpApiEndpoint.get("get")`/api/branches/${idParam$9}`.addSuccess(Branch).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.get("get")`/api/branches/${idParam$11}`.addSuccess(Branch).annotateContext(OpenApi.annotations({
 	title: "Get branch",
 	description: "Fetch a single branch by ID"
-}))).add(HttpApiEndpoint.patch("rename")`/api/branches/${idParam$9}`.setPayload(UpdateBranchBody).addSuccess(Branch).addError(Conflict).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.patch("rename")`/api/branches/${idParam$11}`.setPayload(UpdateBranchBody).addSuccess(Branch).addError(Conflict).annotateContext(OpenApi.annotations({
 	title: "Rename branch",
 	description: "Rename a branch (channels and updates are unaffected)"
-}))).add(HttpApiEndpoint.del("delete")`/api/branches/${idParam$9}`.addSuccess(DeleteBranchResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.del("delete")`/api/branches/${idParam$11}`.addSuccess(DeleteBranchResult).annotateContext(OpenApi.annotations({
 	title: "Delete branch",
 	description: "Delete a branch and all its updates"
 }))).addError(NotFound).addError(Conflict).addError(Forbidden).annotateContext(OpenApi.annotations({
@@ -779,8 +781,8 @@ const ResolveBuildCredentialsResult = Schema.Union(ResolveBuildCredentialsIosRes
 
 //#endregion
 //#region ../../packages/api/src/groups/build-credentials.ts
-const projectIdParam$3 = HttpApiSchema.param("projectId", Schema.String);
-var BuildCredentialsGroup = class extends HttpApiGroup.make("buildCredentials").add(HttpApiEndpoint.post("resolve")`/api/projects/${projectIdParam$3}/build-credentials/resolve`.setPayload(ResolveBuildCredentialsBody).addSuccess(ResolveBuildCredentialsResult).annotateContext(OpenApi.annotations({
+const projectIdParam$5 = HttpApiSchema.param("projectId", Schema.String);
+var BuildCredentialsGroup = class extends HttpApiGroup.make("buildCredentials").add(HttpApiEndpoint.post("resolve")`/api/projects/${projectIdParam$5}/build-credentials/resolve`.setPayload(ResolveBuildCredentialsBody).addSuccess(ResolveBuildCredentialsResult).annotateContext(OpenApi.annotations({
 	title: "Resolve build credentials",
 	description: "Return decrypted signing assets for a project build. Regenerates the iOS provisioning profile via Apple ASC when the registered device roster has changed since the profile was last generated."
 }))).addError(NotFound).addError(BadRequest).addError(Forbidden).annotateContext(OpenApi.annotations({
@@ -940,11 +942,11 @@ const BuildCompatibilityMatrixResult = Schema.Struct({
 
 //#endregion
 //#region ../../packages/api/src/groups/builds.ts
-const idParam$8 = HttpApiSchema.param("id", Schema.String);
+const idParam$10 = HttpApiSchema.param("id", Schema.String);
 var BuildsGroup = class extends HttpApiGroup.make("builds").add(HttpApiEndpoint.post("reserve", "/api/builds").setPayload(CreateBuildBody).addSuccess(ReserveBuildResult, { status: 201 }).annotateContext(OpenApi.annotations({
 	title: "Reserve build",
 	description: "Reserve a build ID and get a presigned upload URL"
-}))).add(HttpApiEndpoint.post("complete")`/api/builds/${idParam$8}/complete`.setPayload(CompleteBuildBody).addSuccess(BuildWithArtifact).addError(Conflict).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.post("complete")`/api/builds/${idParam$10}/complete`.setPayload(CompleteBuildBody).addSuccess(BuildWithArtifact).addError(Conflict).annotateContext(OpenApi.annotations({
 	title: "Complete build",
 	description: "Finalize a build after artifact upload"
 }))).add(HttpApiEndpoint.get("list", "/api/builds").setUrlParams(ListBuildsParams).addSuccess(Schema.Struct({
@@ -958,13 +960,13 @@ var BuildsGroup = class extends HttpApiGroup.make("builds").add(HttpApiEndpoint.
 }))).add(HttpApiEndpoint.get("compatibilityMatrix", "/api/builds/compatibility-matrix").setUrlParams(Schema.Struct({ projectId: Id })).addSuccess(BuildCompatibilityMatrixResult).annotateContext(OpenApi.annotations({
 	title: "Build compatibility matrix",
 	description: "List build-to-channel OTA compatibility for a project"
-}))).add(HttpApiEndpoint.get("get")`/api/builds/${idParam$8}`.addSuccess(BuildWithArtifact).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.get("get")`/api/builds/${idParam$10}`.addSuccess(BuildWithArtifact).annotateContext(OpenApi.annotations({
 	title: "Get build",
 	description: "Get a build by ID with artifact details"
-}))).add(HttpApiEndpoint.del("delete")`/api/builds/${idParam$8}`.addSuccess(DeleteBuildResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.del("delete")`/api/builds/${idParam$10}`.addSuccess(DeleteBuildResult).annotateContext(OpenApi.annotations({
 	title: "Delete build",
 	description: "Delete a build and its artifact from storage"
-}))).add(HttpApiEndpoint.get("getInstallLink")`/api/builds/${idParam$8}/install-link`.addSuccess(InstallLinkResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.get("getInstallLink")`/api/builds/${idParam$10}/install-link`.addSuccess(InstallLinkResult).annotateContext(OpenApi.annotations({
 	title: "Get install link",
 	description: "Generate a signed install link for a build artifact"
 }))).addError(NotFound).addError(Forbidden).addError(BadRequest).annotateContext(OpenApi.annotations({
@@ -1009,11 +1011,11 @@ const DeleteChannelResult = Schema.Struct({ deleted: Schema.Number });
 
 //#endregion
 //#region ../../packages/api/src/groups/channels.ts
-const idParam$7 = HttpApiSchema.param("id", Schema.String);
+const idParam$9 = HttpApiSchema.param("id", Schema.String);
 var ChannelsGroup = class extends HttpApiGroup.make("channels").add(HttpApiEndpoint.post("create", "/api/channels").setPayload(CreateChannelBody).addSuccess(Channel, { status: 201 }).annotateContext(OpenApi.annotations({
 	title: "Create channel",
 	description: "Create a new channel linked to a branch"
-}))).add(HttpApiEndpoint.patch("update")`/api/channels/${idParam$7}`.setPayload(UpdateChannelBody).addSuccess(Channel).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.patch("update")`/api/channels/${idParam$9}`.setPayload(UpdateChannelBody).addSuccess(Channel).annotateContext(OpenApi.annotations({
 	title: "Update channel",
 	description: "Relink channel to a different branch"
 }))).add(HttpApiEndpoint.get("list", "/api/channels").setUrlParams(ListChannelsParams).addSuccess(Schema.Struct({
@@ -1024,25 +1026,25 @@ var ChannelsGroup = class extends HttpApiGroup.make("channels").add(HttpApiEndpo
 })).annotateContext(OpenApi.annotations({
 	title: "List channels",
 	description: "List all channels for a project"
-}))).add(HttpApiEndpoint.post("pause")`/api/channels/${idParam$7}/pause`.addSuccess(Channel).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.post("pause")`/api/channels/${idParam$9}/pause`.addSuccess(Channel).annotateContext(OpenApi.annotations({
 	title: "Pause channel",
 	description: "Pause a channel — manifest requests return 204 No Content"
-}))).add(HttpApiEndpoint.post("resume")`/api/channels/${idParam$7}/resume`.addSuccess(Channel).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.post("resume")`/api/channels/${idParam$9}/resume`.addSuccess(Channel).annotateContext(OpenApi.annotations({
 	title: "Resume channel",
 	description: "Resume a paused channel"
-}))).add(HttpApiEndpoint.post("createBranchRollout")`/api/channels/${idParam$7}/rollout`.setPayload(CreateBranchRolloutBody).addSuccess(Channel).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.post("createBranchRollout")`/api/channels/${idParam$9}/rollout`.setPayload(CreateBranchRolloutBody).addSuccess(Channel).annotateContext(OpenApi.annotations({
 	title: "Create branch rollout",
 	description: "Start a gradual rollout to a new branch on this channel"
-}))).add(HttpApiEndpoint.patch("updateBranchRollout")`/api/channels/${idParam$7}/rollout`.setPayload(UpdateRolloutBody).addSuccess(Channel).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.patch("updateBranchRollout")`/api/channels/${idParam$9}/rollout`.setPayload(UpdateRolloutBody).addSuccess(Channel).annotateContext(OpenApi.annotations({
 	title: "Update branch rollout",
 	description: "Change the rollout percentage for a branch rollout"
-}))).add(HttpApiEndpoint.post("completeBranchRollout")`/api/channels/${idParam$7}/rollout/complete`.addSuccess(Channel).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.post("completeBranchRollout")`/api/channels/${idParam$9}/rollout/complete`.addSuccess(Channel).annotateContext(OpenApi.annotations({
 	title: "Complete branch rollout",
 	description: "Finalize the rollout — promote the new branch to 100%"
-}))).add(HttpApiEndpoint.post("revertBranchRollout")`/api/channels/${idParam$7}/rollout/revert`.addSuccess(Channel).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.post("revertBranchRollout")`/api/channels/${idParam$9}/rollout/revert`.addSuccess(Channel).annotateContext(OpenApi.annotations({
 	title: "Revert branch rollout",
 	description: "Revert the rollout — restore the original branch"
-}))).add(HttpApiEndpoint.del("delete")`/api/channels/${idParam$7}`.addSuccess(DeleteChannelResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.del("delete")`/api/channels/${idParam$9}`.addSuccess(DeleteChannelResult).annotateContext(OpenApi.annotations({
 	title: "Delete channel",
 	description: "Delete a channel"
 }))).addError(NotFound).addError(Conflict).addError(Forbidden).annotateContext(OpenApi.annotations({
@@ -1119,7 +1121,7 @@ const ListRegistrationRequestsParams = Schema.Struct({
 
 //#endregion
 //#region ../../packages/api/src/groups/devices.ts
-const idParam$6 = HttpApiSchema.param("id", Schema.String);
+const idParam$8 = HttpApiSchema.param("id", Schema.String);
 var DevicesGroup = class extends HttpApiGroup.make("devices").add(HttpApiEndpoint.post("register", "/api/devices").setPayload(RegisterDeviceBody).addSuccess(Device, { status: 201 }).annotateContext(OpenApi.annotations({
 	title: "Register device",
 	description: "Register an Apple device UDID in the caller's active organization"
@@ -1131,13 +1133,13 @@ var DevicesGroup = class extends HttpApiGroup.make("devices").add(HttpApiEndpoin
 })).annotateContext(OpenApi.annotations({
 	title: "List devices",
 	description: "List registered Apple devices in the caller's active organization"
-}))).add(HttpApiEndpoint.get("get")`/api/devices/${idParam$6}`.addSuccess(Device).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.get("get")`/api/devices/${idParam$8}`.addSuccess(Device).annotateContext(OpenApi.annotations({
 	title: "Get device",
 	description: "Get a single device by ID"
-}))).add(HttpApiEndpoint.patch("update")`/api/devices/${idParam$6}`.setPayload(UpdateDeviceBody).addSuccess(Device).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.patch("update")`/api/devices/${idParam$8}`.setPayload(UpdateDeviceBody).addSuccess(Device).annotateContext(OpenApi.annotations({
 	title: "Update device",
 	description: "Rename a device or toggle its enabled state"
-}))).add(HttpApiEndpoint.del("delete")`/api/devices/${idParam$6}`.addSuccess(DeleteDeviceResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.del("delete")`/api/devices/${idParam$8}`.addSuccess(DeleteDeviceResult).annotateContext(OpenApi.annotations({
 	title: "Delete device",
 	description: "Remove a registered device from the organization"
 }))).add(HttpApiEndpoint.post("createRegistrationRequest", "/api/devices/registration-requests").setPayload(CreateRegistrationRequestBody).addSuccess(DeviceRegistrationRequest, { status: 201 }).annotateContext(OpenApi.annotations({
@@ -1217,7 +1219,7 @@ const EnvVarExportResult = Schema.Struct({
 
 //#endregion
 //#region ../../packages/api/src/groups/env-vars.ts
-const idParam$5 = HttpApiSchema.param("id", Schema.String);
+const idParam$7 = HttpApiSchema.param("id", Schema.String);
 var EnvVarsGroup = class extends HttpApiGroup.make("env-vars").add(HttpApiEndpoint.post("create", "/api/env-vars").setPayload(CreateEnvVarBody).addSuccess(EnvVar, { status: 201 }).addError(BadRequest).addError(Conflict).annotateContext(OpenApi.annotations({
 	title: "Create environment variable",
 	description: "Create a new environment variable. Scope can be 'project' (requires projectId) or 'global' (organization-wide)."
@@ -1230,13 +1232,13 @@ var EnvVarsGroup = class extends HttpApiGroup.make("env-vars").add(HttpApiEndpoi
 })).addSuccess(Schema.Struct({ items: Schema.Array(EnvVar) })).addError(BadRequest).annotateContext(OpenApi.annotations({
 	title: "List environment variables",
 	description: "List environment variables. scope=all merges project + global vars with project overrides. environments is a comma-separated list. search matches key substring."
-}))).add(HttpApiEndpoint.get("get")`/api/env-vars/${idParam$5}`.addSuccess(EnvVar).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.get("get")`/api/env-vars/${idParam$7}`.addSuccess(EnvVar).annotateContext(OpenApi.annotations({
 	title: "Get environment variable",
 	description: "Get an environment variable by ID"
-}))).add(HttpApiEndpoint.patch("update")`/api/env-vars/${idParam$5}`.setPayload(UpdateEnvVarBody).addSuccess(EnvVar).addError(BadRequest).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.patch("update")`/api/env-vars/${idParam$7}`.setPayload(UpdateEnvVarBody).addSuccess(EnvVar).addError(BadRequest).annotateContext(OpenApi.annotations({
 	title: "Update environment variable",
 	description: "Update value, visibility, or assigned environments"
-}))).add(HttpApiEndpoint.del("delete")`/api/env-vars/${idParam$5}`.addSuccess(DeleteEnvVarResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.del("delete")`/api/env-vars/${idParam$7}`.addSuccess(DeleteEnvVarResult).annotateContext(OpenApi.annotations({
 	title: "Delete environment variable",
 	description: "Delete an environment variable"
 }))).add(HttpApiEndpoint.post("bulkImport", "/api/env-vars/bulk-import").setPayload(BulkImportEnvVarsBody).addSuccess(BulkImportResult).addError(BadRequest).annotateContext(OpenApi.annotations({
@@ -1342,7 +1344,7 @@ const DeleteUpdateResult = Schema.Struct({ deleted: Schema.Number });
 
 //#endregion
 //#region ../../packages/api/src/groups/fingerprints.ts
-const projectIdParam$2 = HttpApiSchema.param("projectId", Id);
+const projectIdParam$4 = HttpApiSchema.param("projectId", Id);
 const hashParam = HttpApiSchema.param("hash", Schema.String.pipe(Schema.minLength(1)));
 const FingerprintDetail = Schema.Struct({
 	hash: Schema.String,
@@ -1350,7 +1352,7 @@ const FingerprintDetail = Schema.Struct({
 	builds: Schema.Array(BuildWithArtifact),
 	updates: Schema.Array(Update)
 });
-var FingerprintsGroup = class extends HttpApiGroup.make("fingerprints").add(HttpApiEndpoint.get("get")`/api/projects/${projectIdParam$2}/fingerprints/${hashParam}`.addSuccess(FingerprintDetail).annotateContext(OpenApi.annotations({
+var FingerprintsGroup = class extends HttpApiGroup.make("fingerprints").add(HttpApiEndpoint.get("get")`/api/projects/${projectIdParam$4}/fingerprints/${hashParam}`.addSuccess(FingerprintDetail).annotateContext(OpenApi.annotations({
 	title: "Get fingerprint",
 	description: "Fetch builds and updates compatible with a given fingerprint hash within a project."
 }))).addError(Forbidden, { status: 403 }).addError(NotFound, { status: 404 }).addError(BadRequest, { status: 400 }) {};
@@ -1376,17 +1378,17 @@ const DownloadGoogleServiceAccountKeyResult = Schema.Struct({
 
 //#endregion
 //#region ../../packages/api/src/groups/google-service-account-keys.ts
-const idParam$4 = HttpApiSchema.param("id", Schema.String);
+const idParam$6 = HttpApiSchema.param("id", Schema.String);
 var GoogleServiceAccountKeysGroup = class extends HttpApiGroup.make("googleServiceAccountKeys").add(HttpApiEndpoint.get("list", "/api/google/service-account-keys").addSuccess(Schema.Struct({ items: Schema.Array(GoogleServiceAccountKey) })).annotateContext(OpenApi.annotations({
 	title: "List Google service account keys",
 	description: "List uploaded Google service account JSON keys"
 }))).add(HttpApiEndpoint.post("upload", "/api/google/service-account-keys").setPayload(UploadGoogleServiceAccountKeyBody).addSuccess(GoogleServiceAccountKey, { status: 201 }).annotateContext(OpenApi.annotations({
 	title: "Upload service account key",
 	description: "Upload a Google service account JSON key"
-}))).add(HttpApiEndpoint.del("delete")`/api/google/service-account-keys/${idParam$4}`.addSuccess(DeleteGoogleServiceAccountKeyResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.del("delete")`/api/google/service-account-keys/${idParam$6}`.addSuccess(DeleteGoogleServiceAccountKeyResult).annotateContext(OpenApi.annotations({
 	title: "Delete service account key",
 	description: "Remove a stored Google service account key"
-}))).add(HttpApiEndpoint.get("download")`/api/google/service-account-keys/${idParam$4}/download`.addSuccess(DownloadGoogleServiceAccountKeyResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.get("download")`/api/google/service-account-keys/${idParam$6}/download`.addSuccess(DownloadGoogleServiceAccountKeyResult).annotateContext(OpenApi.annotations({
 	title: "Download service account key",
 	description: "Fetch the decrypted JSON for local use (audit-logged)"
 }))).addError(NotFound).addError(Conflict).addError(BadRequest).addError(Forbidden).annotateContext(OpenApi.annotations({
@@ -1394,8 +1396,67 @@ var GoogleServiceAccountKeysGroup = class extends HttpApiGroup.make("googleServi
 	description: "Manage Google Play + FCM service account JSON keys"
 })) {};
 
+//#endregion
+//#region ../../packages/api/src/domain/ios-app-metadata.ts
+const AscAppId = Schema.String.pipe(Schema.pattern(/^[0-9]{1,30}$/u, { message: () => "ASC App ID must be 1-30 digits" }));
+const AppStoreLanguage = Schema.String.pipe(Schema.minLength(2), Schema.maxLength(10));
+const AppStoreSku = Schema.String.pipe(Schema.minLength(1), Schema.maxLength(100));
+const CompanyName = Schema.String.pipe(Schema.minLength(1), Schema.maxLength(200));
+const AppName = Schema.String.pipe(Schema.minLength(1), Schema.maxLength(200));
+var IosAppMetadata = class extends Schema.Class("IosAppMetadata")({
+	id: Id,
+	organizationId: Id,
+	projectId: Id,
+	bundleIdentifier: Schema.String,
+	ascAppId: Schema.NullOr(Schema.String),
+	sku: Schema.NullOr(Schema.String),
+	language: Schema.String,
+	companyName: Schema.NullOr(Schema.String),
+	appName: Schema.NullOr(Schema.String),
+	createdAt: DateTimeString,
+	updatedAt: DateTimeString
+}) {};
+const CreateIosAppMetadataBody = Schema.Struct({
+	bundleIdentifier: BundleIdentifier,
+	ascAppId: Schema.optional(AscAppId),
+	sku: Schema.optional(AppStoreSku),
+	language: Schema.optional(AppStoreLanguage),
+	companyName: Schema.optional(CompanyName),
+	appName: Schema.optional(AppName)
+});
+const UpdateIosAppMetadataBody = Schema.Struct({
+	ascAppId: Schema.optional(Schema.NullOr(AscAppId)),
+	sku: Schema.optional(Schema.NullOr(AppStoreSku)),
+	language: Schema.optional(AppStoreLanguage),
+	companyName: Schema.optional(Schema.NullOr(CompanyName)),
+	appName: Schema.optional(Schema.NullOr(AppName))
+});
+const DeleteIosAppMetadataResult = Schema.Struct({ deleted: Schema.Number });
+
+//#endregion
+//#region ../../packages/api/src/groups/ios-app-metadata.ts
+const idParam$5 = HttpApiSchema.param("id", Schema.String);
+const projectIdParam$3 = HttpApiSchema.param("projectId", Schema.String);
+var IosAppMetadataGroup = class extends HttpApiGroup.make("iosAppMetadata").add(HttpApiEndpoint.get("list")`/api/projects/${projectIdParam$3}/ios-app-metadata`.addSuccess(Schema.Struct({ items: Schema.Array(IosAppMetadata) })).annotateContext(OpenApi.annotations({
+	title: "List iOS App Store metadata",
+	description: "List App Store Connect metadata entries for a project"
+}))).add(HttpApiEndpoint.post("create")`/api/projects/${projectIdParam$3}/ios-app-metadata`.setPayload(CreateIosAppMetadataBody).addSuccess(IosAppMetadata, { status: 201 }).annotateContext(OpenApi.annotations({
+	title: "Create iOS App Store metadata",
+	description: "Register App Store Connect metadata for a bundle identifier"
+}))).add(HttpApiEndpoint.put("update")`/api/ios-app-metadata/${idParam$5}`.setPayload(UpdateIosAppMetadataBody).addSuccess(IosAppMetadata).annotateContext(OpenApi.annotations({
+	title: "Update iOS App Store metadata",
+	description: "Change ASC app id / sku / language / company name / app name"
+}))).add(HttpApiEndpoint.del("delete")`/api/ios-app-metadata/${idParam$5}`.addSuccess(DeleteIosAppMetadataResult).annotateContext(OpenApi.annotations({
+	title: "Delete iOS App Store metadata",
+	description: "Remove an App Store metadata entry"
+}))).addError(NotFound).addError(Conflict).addError(BadRequest).addError(Forbidden).annotateContext(OpenApi.annotations({
+	title: "iOS App Store metadata",
+	description: "Per-project per-bundle App Store Connect metadata for submissions"
+})) {};
+
 //#endregion
 //#region ../../packages/api/src/domain/ios-bundle-configuration.ts
+const TargetName = Schema.String.pipe(Schema.minLength(1), Schema.maxLength(200));
 var IosBundleConfiguration = class extends Schema.Class("IosBundleConfiguration")({
 	id: Id,
 	organizationId: Id,
@@ -1407,6 +1468,8 @@ var IosBundleConfiguration = class extends Schema.Class("IosBundleConfiguration"
 	appleProvisioningProfileId: Schema.NullOr(Id),
 	applePushKeyId: Schema.NullOr(Id),
 	ascApiKeyId: Schema.NullOr(Id),
+	targetName: Schema.NullOr(Schema.String),
+	parentBundleIdentifier: Schema.NullOr(Schema.String),
 	createdAt: DateTimeString,
 	updatedAt: DateTimeString
 }) {};
@@ -1417,30 +1480,34 @@ const CreateIosBundleConfigurationBody = Schema.Struct({
 	appleDistributionCertificateId: Schema.optional(Id),
 	appleProvisioningProfileId: Schema.optional(Id),
 	applePushKeyId: Schema.optional(Id),
-	ascApiKeyId: Schema.optional(Id)
+	ascApiKeyId: Schema.optional(Id),
+	targetName: Schema.optional(TargetName),
+	parentBundleIdentifier: Schema.optional(BundleIdentifier)
 });
 const UpdateIosBundleConfigurationBody = Schema.Struct({
 	appleDistributionCertificateId: Schema.optional(Schema.NullOr(Id)),
 	appleProvisioningProfileId: Schema.optional(Schema.NullOr(Id)),
 	applePushKeyId: Schema.optional(Schema.NullOr(Id)),
-	ascApiKeyId: Schema.optional(Schema.NullOr(Id))
+	ascApiKeyId: Schema.optional(Schema.NullOr(Id)),
+	targetName: Schema.optional(Schema.NullOr(TargetName)),
+	parentBundleIdentifier: Schema.optional(Schema.NullOr(BundleIdentifier))
 });
 const DeleteIosBundleConfigurationResult = Schema.Struct({ deleted: Schema.Number });
 
 //#endregion
 //#region ../../packages/api/src/groups/ios-bundle-configurations.ts
-const idParam$3 = HttpApiSchema.param("id", Schema.String);
-const projectIdParam$1 = HttpApiSchema.param("projectId", Schema.String);
-var IosBundleConfigurationsGroup = class extends HttpApiGroup.make("iosBundleConfigurations").add(HttpApiEndpoint.get("list")`/api/projects/${projectIdParam$1}/ios-bundle-configurations`.addSuccess(Schema.Struct({ items: Schema.Array(IosBundleConfiguration) })).annotateContext(OpenApi.annotations({
+const idParam$4 = HttpApiSchema.param("id", Schema.String);
+const projectIdParam$2 = HttpApiSchema.param("projectId", Schema.String);
+var IosBundleConfigurationsGroup = class extends HttpApiGroup.make("iosBundleConfigurations").add(HttpApiEndpoint.get("list")`/api/projects/${projectIdParam$2}/ios-bundle-configurations`.addSuccess(Schema.Struct({ items: Schema.Array(IosBundleConfiguration) })).annotateContext(OpenApi.annotations({
 	title: "List iOS bundle configurations",
 	description: "List all iOS bundle configurations for a project"
-}))).add(HttpApiEndpoint.post("create")`/api/projects/${projectIdParam$1}/ios-bundle-configurations`.setPayload(CreateIosBundleConfigurationBody).addSuccess(IosBundleConfiguration, { status: 201 }).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.post("create")`/api/projects/${projectIdParam$2}/ios-bundle-configurations`.setPayload(CreateIosBundleConfigurationBody).addSuccess(IosBundleConfiguration, { status: 201 }).annotateContext(OpenApi.annotations({
 	title: "Create iOS bundle configuration",
 	description: "Bind certificate + profile + push + ASC to a bundle identifier"
-}))).add(HttpApiEndpoint.put("update")`/api/ios-bundle-configurations/${idParam$3}`.setPayload(UpdateIosBundleConfigurationBody).addSuccess(IosBundleConfiguration).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.put("update")`/api/ios-bundle-configurations/${idParam$4}`.setPayload(UpdateIosBundleConfigurationBody).addSuccess(IosBundleConfiguration).annotateContext(OpenApi.annotations({
 	title: "Update iOS bundle configuration",
 	description: "Change the credentials bound to an iOS bundle configuration"
-}))).add(HttpApiEndpoint.del("delete")`/api/ios-bundle-configurations/${idParam$3}`.addSuccess(DeleteIosBundleConfigurationResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.del("delete")`/api/ios-bundle-configurations/${idParam$4}`.addSuccess(DeleteIosBundleConfigurationResult).annotateContext(OpenApi.annotations({
 	title: "Delete iOS bundle configuration",
 	description: "Remove an iOS bundle configuration binding"
 }))).addError(NotFound).addError(Conflict).addError(BadRequest).addError(Forbidden).annotateContext(OpenApi.annotations({
@@ -1513,7 +1580,7 @@ const DeleteProjectResult = Schema.Struct({ deleted: Schema.Number });
 
 //#endregion
 //#region ../../packages/api/src/groups/projects.ts
-const idParam$2 = HttpApiSchema.param("id", Schema.String);
+const idParam$3 = HttpApiSchema.param("id", Schema.String);
 const slugParam = HttpApiSchema.param("slug", Schema.String);
 var ProjectsGroup = class extends HttpApiGroup.make("projects").add(HttpApiEndpoint.post("create", "/api/projects").setPayload(CreateProjectBody).addSuccess(Project, { status: 201 }).annotateContext(OpenApi.annotations({
 	title: "Create project",
@@ -1526,16 +1593,16 @@ var ProjectsGroup = class extends HttpApiGroup.make("projects").add(HttpApiEndpo
 })).annotateContext(OpenApi.annotations({
 	title: "List projects",
 	description: "List all projects in the caller's active organization"
-}))).add(HttpApiEndpoint.get("get")`/api/projects/${idParam$2}`.addSuccess(Project).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.get("get")`/api/projects/${idParam$3}`.addSuccess(Project).annotateContext(OpenApi.annotations({
 	title: "Get project",
 	description: "Get a single project by ID"
 }))).add(HttpApiEndpoint.get("getBySlug")`/api/projects/by-slug/${slugParam}`.addSuccess(Project).annotateContext(OpenApi.annotations({
 	title: "Get project by slug",
 	description: "Get a single project by slug within the caller's active organization"
-}))).add(HttpApiEndpoint.patch("rename")`/api/projects/${idParam$2}`.setPayload(UpdateProjectBody).addSuccess(Project).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.patch("rename")`/api/projects/${idParam$3}`.setPayload(UpdateProjectBody).addSuccess(Project).annotateContext(OpenApi.annotations({
 	title: "Rename project",
 	description: "Rename a project"
-}))).add(HttpApiEndpoint.del("delete")`/api/projects/${idParam$2}`.addSuccess(DeleteProjectResult).annotateContext(OpenApi.annotations({
+}))).add(HttpApiEndpoint.del("delete")`/api/projects/${idParam$3}`.addSuccess(DeleteProjectResult).annotateContext(OpenApi.annotations({
 	title: "Delete project",
 	description: "Delete a project and all its branches, channels, and updates"
 }))).addError(NotFound).addError(Conflict).addError(Forbidden).annotateContext(OpenApi.annotations({
@@ -1543,6 +1610,128 @@ var ProjectsGroup = class extends HttpApiGroup.make("projects").add(HttpApiEndpo
 	description: "Project management endpoints"
 })) {};
 
+//#endregion
+//#region ../../packages/api/src/domain/submission.ts
+const SubmissionStatus = Schema.Literal("AWAITING_BUILD", "IN_QUEUE", "IN_PROGRESS", "FINISHED", "ERRORED", "CANCELED");
+const SubmissionArchiveSource = Schema.Literal("build", "path", "url");
+const AndroidReleaseStatus = Schema.Literal("completed", "draft", "halted", "inProgress");
+const AndroidTrack = Schema.String.pipe(Schema.minLength(1), Schema.maxLength(100));
+const Rollout = Schema.Number.pipe(Schema.greaterThan(0), Schema.lessThanOrEqualTo(1));
+var IosSubmissionConfig = class extends Schema.Class("IosSubmissionConfig")({
+	appleId: Schema.NullOr(Schema.String),
+	ascAppId: Schema.NullOr(Schema.String),
+	appleTeamId: Schema.NullOr(Schema.String),
+	sku: Schema.NullOr(Schema.String),
+	language: Schema.String,
+	companyName: Schema.NullOr(Schema.String),
+	appName: Schema.NullOr(Schema.String),
+	bundleIdentifier: Schema.String,
+	ascApiKeyId: Schema.NullOr(Id),
+	groups: Schema.Array(Schema.String),
+	whatToTest: Schema.NullOr(Schema.String)
+}) {};
+var AndroidSubmissionConfig = class extends Schema.Class("AndroidSubmissionConfig")({
+	applicationId: Schema.String,
+	track: Schema.String,
+	releaseStatus: AndroidReleaseStatus,
+	changesNotSentForReview: Schema.Boolean,
+	rollout: Schema.NullOr(Schema.Number),
+	googleServiceAccountKeyId: Schema.NullOr(Id)
+}) {};
+var Submission = class extends Schema.Class("Submission")({
+	id: Id,
+	organizationId: Id,
+	projectId: Id,
+	platform: Platform,
+	profileName: Schema.String,
+	status: SubmissionStatus,
+	archiveSource: SubmissionArchiveSource,
+	buildId: Schema.NullOr(Id),
+	archiveUrl: Schema.NullOr(Schema.String),
+	iosConfig: Schema.NullOr(IosSubmissionConfig),
+	androidConfig: Schema.NullOr(AndroidSubmissionConfig),
+	errorCode: Schema.NullOr(Schema.String),
+	errorMessage: Schema.NullOr(Schema.String),
+	logFiles: Schema.Array(Schema.String),
+	initiatingUserId: Schema.NullOr(Schema.String),
+	queuedAt: Schema.NullOr(DateTimeString),
+	startedAt: Schema.NullOr(DateTimeString),
+	completedAt: Schema.NullOr(DateTimeString),
+	createdAt: DateTimeString,
+	updatedAt: DateTimeString
+}) {};
+const CreateIosSubmissionBody = Schema.Struct({
+	appleId: Schema.optional(Schema.String),
+	ascAppId: Schema.optional(Schema.String),
+	appleTeamId: Schema.optional(Schema.String),
+	sku: Schema.optional(Schema.String),
+	language: Schema.optional(Schema.String),
+	companyName: Schema.optional(Schema.String),
+	appName: Schema.optional(Schema.String),
+	bundleIdentifier: BundleIdentifier,
+	ascApiKeyId: Schema.optional(Id),
+	groups: Schema.optional(Schema.Array(Schema.String)),
+	whatToTest: Schema.optional(Schema.String)
+});
+const CreateAndroidSubmissionBody = Schema.Struct({
+	applicationId: Schema.String,
+	track: Schema.optional(AndroidTrack),
+	releaseStatus: Schema.optional(AndroidReleaseStatus),
+	changesNotSentForReview: Schema.optional(Schema.Boolean),
+	rollout: Schema.optional(Rollout),
+	googleServiceAccountKeyId: Schema.optional(Id)
+});
+const CreateSubmissionBody = Schema.Struct({
+	platform: Platform,
+	profileName: Schema.optional(Schema.String),
+	archiveSource: SubmissionArchiveSource,
+	buildId: Schema.optional(Id),
+	archiveUrl: Schema.optional(Schema.String),
+	iosConfig: Schema.optional(CreateIosSubmissionBody),
+	androidConfig: Schema.optional(CreateAndroidSubmissionBody)
+});
+const UpdateSubmissionStatusBody = Schema.Struct({
+	status: SubmissionStatus,
+	errorCode: Schema.optional(Schema.NullOr(Schema.String)),
+	errorMessage: Schema.optional(Schema.NullOr(Schema.String)),
+	logFiles: Schema.optional(Schema.Array(Schema.String))
+});
+const CancelSubmissionResult = Schema.Struct({ canceled: Schema.Boolean });
+const DeleteSubmissionResult = Schema.Struct({ deleted: Schema.Number });
+
+//#endregion
+//#region ../../packages/api/src/groups/submissions.ts
+const idParam$2 = HttpApiSchema.param("id", Schema.String);
+const projectIdParam$1 = HttpApiSchema.param("projectId", Schema.String);
+const ListParams = Schema.Struct({
+	status: Schema.optional(SubmissionStatus),
+	platform: Schema.optional(Platform),
+	profile: Schema.optional(Schema.String),
+	buildId: Schema.optional(Schema.String)
+});
+var SubmissionsGroup = class extends HttpApiGroup.make("submissions").add(HttpApiEndpoint.get("list")`/api/projects/${projectIdParam$1}/submissions`.setUrlParams(ListParams).addSuccess(Schema.Struct({ items: Schema.Array(Submission) })).annotateContext(OpenApi.annotations({
+	title: "List submissions",
+	description: "List store submissions for a project with optional filters"
+}))).add(HttpApiEndpoint.post("create")`/api/projects/${projectIdParam$1}/submissions`.setPayload(CreateSubmissionBody).addSuccess(Submission, { status: 201 }).annotateContext(OpenApi.annotations({
+	title: "Create submission",
+	description: "Start a store submission for a build / IPA / AAB"
+}))).add(HttpApiEndpoint.get("get")`/api/submissions/${idParam$2}`.addSuccess(Submission).annotateContext(OpenApi.annotations({
+	title: "Get submission",
+	description: "Get a submission by id"
+}))).add(HttpApiEndpoint.patch("updateStatus")`/api/submissions/${idParam$2}/status`.setPayload(UpdateSubmissionStatusBody).addSuccess(Submission).annotateContext(OpenApi.annotations({
+	title: "Update submission status",
+	description: "Patch status / error / logFiles. CLI uses this for iOS submissions."
+}))).add(HttpApiEndpoint.post("cancel")`/api/submissions/${idParam$2}/cancel`.addSuccess(CancelSubmissionResult).annotateContext(OpenApi.annotations({
+	title: "Cancel submission",
+	description: "Cancel an AWAITING_BUILD / IN_QUEUE submission"
+}))).add(HttpApiEndpoint.del("delete")`/api/submissions/${idParam$2}`.addSuccess(DeleteSubmissionResult).annotateContext(OpenApi.annotations({
+	title: "Delete submission",
+	description: "Delete a terminal submission record"
+}))).addError(NotFound).addError(Conflict).addError(BadRequest).addError(Forbidden).annotateContext(OpenApi.annotations({
+	title: "Submissions",
+	description: "Store-submission lifecycle (App Store + Google Play)"
+})) {};
+
 //#endregion
 //#region ../../packages/api/src/groups/updates.ts
 const idParam$1 = HttpApiSchema.param("id", Schema.String);
@@ -1644,7 +1833,7 @@ var WebhooksGroup = class extends HttpApiGroup.make("webhooks").add(HttpApiEndpo
 
 //#endregion
 //#region ../../packages/api/src/api.ts
-var ManagementApi = class extends HttpApi.make("management-api").add(ProjectsGroup).add(BranchesGroup).add(ChannelsGroup).add(UpdatesGroup).add(AssetsGroup).add(AnalyticsGroup).add(BuildsGroup).add(EnvVarsGroup).add(FingerprintsGroup).add(AuditLogsGroup).add(DevicesGroup).add(AppleTeamsGroup).add(AppleDistributionCertificatesGroup).add(ApplePushKeysGroup).add(AscApiKeysGroup).add(AppleProvisioningProfilesGroup).add(GoogleServiceAccountKeysGroup).add(IosBundleConfigurationsGroup).add(AndroidApplicationIdentifiersGroup).add(AndroidUploadKeystoresGroup).add(AndroidBuildCredentialsGroup).add(BuildCredentialsGroup).add(MeGroup).add(WebhooksGroup).middleware(Authentication).annotateContext(OpenApi.annotations({
+var ManagementApi = class extends HttpApi.make("management-api").add(ProjectsGroup).add(BranchesGroup).add(ChannelsGroup).add(UpdatesGroup).add(AssetsGroup).add(AnalyticsGroup).add(BuildsGroup).add(EnvVarsGroup).add(FingerprintsGroup).add(AuditLogsGroup).add(DevicesGroup).add(AppleTeamsGroup).add(AppleDistributionCertificatesGroup).add(ApplePushKeysGroup).add(AscApiKeysGroup).add(AppleProvisioningProfilesGroup).add(GoogleServiceAccountKeysGroup).add(IosBundleConfigurationsGroup).add(IosAppMetadataGroup).add(SubmissionsGroup).add(AndroidApplicationIdentifiersGroup).add(AndroidUploadKeystoresGroup).add(AndroidBuildCredentialsGroup).add(BuildCredentialsGroup).add(MeGroup).add(WebhooksGroup).middleware(Authentication).annotateContext(OpenApi.annotations({
 	title: "Better Update Management API",
 	version: "1.0.0",
 	description: "Management API for OTA update publishing, deployment, and analytics"
@@ -3412,7 +3601,7 @@ const pemToPkcs8Der = (pem) => {
 //#region src/lib/apple-asc-jwt.ts
 var AppleAuthError = class extends Data.TaggedError("AppleAuthError") {};
 const MAX_JWT_LIFETIME_SECONDS = 1200;
-const asArrayBuffer = (bytes) => {
+const asArrayBuffer$1 = (bytes) => {
 	const buffer = new ArrayBuffer(bytes.byteLength);
 	new Uint8Array(buffer).set(bytes);
 	return buffer;
@@ -3434,7 +3623,7 @@ const signAscJwt = (credentials) => Effect.gen(function* () {
 	};
 	const signingInput = `${toBase64Url(new TextEncoder().encode(JSON.stringify(header)))}.${toBase64Url(new TextEncoder().encode(JSON.stringify(payload)))}`;
 	const key = yield* Effect.tryPromise({
-		try: async () => crypto.subtle.importKey("pkcs8", asArrayBuffer(der), {
+		try: async () => crypto.subtle.importKey("pkcs8", asArrayBuffer$1(der), {
 			name: "ECDSA",
 			namedCurve: "P-256"
 		}, false, ["sign"]),
@@ -4653,12 +4842,6 @@ const runAndroidBuild = (input) => Effect.gen(function* () {
 	const buildType = androidProfile.buildType ?? "release";
 	const androidDir = path.join(projectRoot, "android");
 	const commandEnv = yield* runtime.commandEnvironment(envVars);
-	const credentials = input.credentialsSource === "local" ? yield* loadLocalAndroidCredentials({ projectRoot }) : yield* downloadAndroidCredentials(api, {
-		projectId,
-		applicationIdentifier,
-		tempDir,
-		buildProfile: input.profileName
-	});
 	yield* runStep({
 		command: "bunx",
 		args: [
@@ -4671,21 +4854,27 @@ const runAndroidBuild = (input) => Effect.gen(function* () {
 		cwd: projectRoot,
 		env: commandEnv
 	}, "expo prebuild android");
-	const fs = yield* FileSystem.FileSystem;
-	const signingGradlePath = path.join(tempDir, "signing.gradle");
-	yield* fs.writeFileString(signingGradlePath, renderSigningGradle({
-		keystorePath: credentials.keystorePath,
-		storePassword: credentials.storePassword,
-		keyAlias: credentials.keyAlias,
-		keyPassword: credentials.keyPassword
-	}));
+	const gradleArgs = yield* input.skipCredentials ? Effect.succeed([]) : Effect.gen(function* () {
+		const credentials = input.credentialsSource === "local" ? yield* loadLocalAndroidCredentials({ projectRoot }) : yield* downloadAndroidCredentials(api, {
+			projectId,
+			applicationIdentifier,
+			tempDir,
+			buildProfile: input.profileName
+		});
+		const fs = yield* FileSystem.FileSystem;
+		const signingGradlePath = path.join(tempDir, "signing.gradle");
+		yield* fs.writeFileString(signingGradlePath, renderSigningGradle({
+			keystorePath: credentials.keystorePath,
+			storePassword: credentials.storePassword,
+			keyAlias: credentials.keyAlias,
+			keyPassword: credentials.keyPassword
+		}));
+		return ["--init-script", signingGradlePath];
+	});
+	const taskName = gradleTaskName(format, flavor, buildType);
 	yield* runStep({
 		command: "./gradlew",
-		args: [
-			"--init-script",
-			signingGradlePath,
-			`:app:${gradleTaskName(format, flavor, buildType)}`
-		],
+		args: [...gradleArgs, `:app:${taskName}`],
 		cwd: androidDir,
 		env: commandEnv
 	}, "gradlew");
@@ -6119,6 +6308,137 @@ const applyAutoIncrement = (input) => Effect.gen(function* () {
 	return bumps;
 });
 
+//#endregion
+//#region src/lib/eas-submit-config.ts
+const MAX_SUBMIT_EXTENDS_DEPTH = 10;
+const asStringValue$1 = (value) => typeof value === "string" ? value : void 0;
+const asBooleanValue$1 = (value) => typeof value === "boolean" ? value : void 0;
+const asNumberValue = (raw) => typeof raw === "number" && Number.isFinite(raw) ? raw : void 0;
+const asStringArray = (raw) => {
+	if (!Array.isArray(raw)) return;
+	const items = raw.filter((item) => typeof item === "string");
+	return items.length === 0 ? void 0 : items;
+};
+const asAndroidReleaseStatus = (raw) => {
+	const value = asStringValue$1(raw);
+	return value === "completed" || value === "draft" || value === "halted" || value === "inProgress" ? value : void 0;
+};
+const parseIosSubmitProfile = (raw) => {
+	const record = asRecord(raw);
+	if (!record) return;
+	const appleId = asStringValue$1(record["appleId"]);
+	const ascAppId = asStringValue$1(record["ascAppId"]);
+	const appleTeamId = asStringValue$1(record["appleTeamId"]);
+	const ascApiKeyPath = asStringValue$1(record["ascApiKeyPath"]);
+	const ascApiKeyId = asStringValue$1(record["ascApiKeyId"]);
+	const ascApiKeyIssuerId = asStringValue$1(record["ascApiKeyIssuerId"]);
+	const sku = asStringValue$1(record["sku"]);
+	const language = asStringValue$1(record["language"]);
+	const companyName = asStringValue$1(record["companyName"]);
+	const appName = asStringValue$1(record["appName"]);
+	const bundleIdentifier = asStringValue$1(record["bundleIdentifier"]);
+	const metadataPath = asStringValue$1(record["metadataPath"]);
+	const groups = asStringArray(record["groups"]);
+	return {
+		...appleId === void 0 ? {} : { appleId },
+		...ascAppId === void 0 ? {} : { ascAppId },
+		...appleTeamId === void 0 ? {} : { appleTeamId },
+		...ascApiKeyPath === void 0 ? {} : { ascApiKeyPath },
+		...ascApiKeyId === void 0 ? {} : { ascApiKeyId },
+		...ascApiKeyIssuerId === void 0 ? {} : { ascApiKeyIssuerId },
+		...sku === void 0 ? {} : { sku },
+		...language === void 0 ? {} : { language },
+		...companyName === void 0 ? {} : { companyName },
+		...appName === void 0 ? {} : { appName },
+		...bundleIdentifier === void 0 ? {} : { bundleIdentifier },
+		...metadataPath === void 0 ? {} : { metadataPath },
+		...groups === void 0 ? {} : { groups }
+	};
+};
+const parseAndroidSubmitProfile = (raw) => {
+	const record = asRecord(raw);
+	if (!record) return;
+	const serviceAccountKeyPath = asStringValue$1(record["serviceAccountKeyPath"]);
+	const serviceAccountKeyId = asStringValue$1(record["serviceAccountKeyId"]);
+	const track = asStringValue$1(record["track"]);
+	const releaseStatus = asAndroidReleaseStatus(record["releaseStatus"]);
+	const changesNotSentForReview = asBooleanValue$1(record["changesNotSentForReview"]);
+	const rollout = asNumberValue(record["rollout"]);
+	const applicationId = asStringValue$1(record["applicationId"]);
+	return {
+		...serviceAccountKeyPath === void 0 ? {} : { serviceAccountKeyPath },
+		...serviceAccountKeyId === void 0 ? {} : { serviceAccountKeyId },
+		...track === void 0 ? {} : { track },
+		...releaseStatus === void 0 ? {} : { releaseStatus },
+		...changesNotSentForReview === void 0 ? {} : { changesNotSentForReview },
+		...rollout === void 0 ? {} : { rollout },
+		...applicationId === void 0 ? {} : { applicationId }
+	};
+};
+const parseSubmitProfile = (raw) => {
+	const record = asRecord(raw);
+	if (!record) return;
+	const extendsName = asStringValue$1(record["extends"]);
+	const ios = parseIosSubmitProfile(record["ios"]);
+	const android = parseAndroidSubmitProfile(record["android"]);
+	return {
+		...extendsName === void 0 ? {} : { extends: extendsName },
+		...ios === void 0 ? {} : { ios },
+		...android === void 0 ? {} : { android }
+	};
+};
+const mergeIosSubmit = (base, overlay) => {
+	if (!base) return overlay;
+	if (!overlay) return base;
+	return {
+		...base,
+		...overlay
+	};
+};
+const mergeAndroidSubmit = (base, overlay) => {
+	if (!base) return overlay;
+	if (!overlay) return base;
+	return {
+		...base,
+		...overlay
+	};
+};
+const mergeSubmitProfile = (base, overlay) => {
+	const ios = mergeIosSubmit(base.ios, overlay.ios);
+	const android = mergeAndroidSubmit(base.android, overlay.android);
+	return {
+		...overlay.extends === void 0 ? {} : { extends: overlay.extends },
+		...ios === void 0 ? {} : { ios },
+		...android === void 0 ? {} : { android }
+	};
+};
+const collectSubmitExtendsChain = (profiles, profileName) => Effect.gen(function* () {
+	const chain = [];
+	const visited = /* @__PURE__ */ new Set();
+	let current = profileName;
+	let depth = 0;
+	while (current !== void 0) {
+		if (visited.has(current)) return yield* new BuildProfileError({ message: `Cycle detected in eas.json submit.${profileName} extends chain at "${current}".` });
+		visited.add(current);
+		const profile = profiles[current];
+		if (!profile) return yield* new BuildProfileError({ message: current === profileName ? `Submit profile "${profileName}" not found in eas.json.` : `Submit profile "${profileName}" extends missing profile "${current}".` });
+		chain.unshift(profile);
+		current = profile.extends;
+		depth += 1;
+		if (depth > MAX_SUBMIT_EXTENDS_DEPTH) return yield* new BuildProfileError({ message: `Too many "extends" levels (max ${String(MAX_SUBMIT_EXTENDS_DEPTH)}) in eas.json submit.${profileName}.` });
+	}
+	return chain;
+});
+const stripSubmitExtends = (profile) => {
+	if (profile.extends === void 0) return profile;
+	const { extends: _omit, ...rest } = profile;
+	return rest;
+};
+const resolveEasSubmitProfile = (profiles, profileName) => Effect.gen(function* () {
+	if (!profiles) return yield* new BuildProfileError({ message: "eas.json has no \"submit\" section. Add at least one submit profile." });
+	return stripSubmitExtends((yield* collectSubmitExtendsChain(profiles, profileName)).reduce((acc, next, index) => index === 0 ? next : mergeSubmitProfile(acc, next), {}));
+});
+
 //#endregion
 //#region src/lib/eas-config.ts
 const MAX_EXTENDS_DEPTH = 10;
@@ -6223,6 +6543,7 @@ const parseBuildProfile = (raw) => {
 	const android = parseAndroidProfile(record["android"]);
 	const credentialsSource = asCredentialsSource(record["credentialsSource"]);
 	const autoIncrement = asAutoIncrement(record["autoIncrement"]);
+	const withoutCredentials = asBooleanValue(record["withoutCredentials"]);
 	return {
 		...extendsName === void 0 ? {} : { extends: extendsName },
 		...developmentClient === void 0 ? {} : { developmentClient },
@@ -6233,7 +6554,8 @@ const parseBuildProfile = (raw) => {
 		...ios === void 0 ? {} : { ios },
 		...android === void 0 ? {} : { android },
 		...credentialsSource === void 0 ? {} : { credentialsSource },
-		...autoIncrement === void 0 ? {} : { autoIncrement }
+		...autoIncrement === void 0 ? {} : { autoIncrement },
+		...withoutCredentials === void 0 ? {} : { withoutCredentials }
 	};
 };
 const parseEasConfig = (text) => Effect.gen(function* () {
@@ -6249,9 +6571,16 @@ const parseEasConfig = (text) => Effect.gen(function* () {
 		const profile = parseBuildProfile(value);
 		if (profile) profiles[name] = profile;
 	}
+	const submitRecord = asRecord(root["submit"]);
+	const submit = {};
+	if (submitRecord) for (const [name, value] of Object.entries(submitRecord)) {
+		const profile = parseSubmitProfile(value);
+		if (profile !== void 0) submit[name] = profile;
+	}
 	return {
 		...asRecord(root["cli"]) ? { cli: parseCli(root["cli"]) } : {},
-		build: profiles
+		build: profiles,
+		...Object.keys(submit).length === 0 ? {} : { submit }
 	};
 });
 const parseCli = (raw) => {
@@ -6302,6 +6631,7 @@ const mergeProfile = (base, overlay) => {
 	const environment = overlay.environment ?? base.environment;
 	const credentialsSource = overlay.credentialsSource ?? base.credentialsSource;
 	const autoIncrement = overlay.autoIncrement ?? base.autoIncrement;
+	const withoutCredentials = overlay.withoutCredentials ?? base.withoutCredentials;
 	return {
 		...overlay.extends === void 0 ? {} : { extends: overlay.extends },
 		...developmentClient === void 0 ? {} : { developmentClient },
@@ -6312,7 +6642,8 @@ const mergeProfile = (base, overlay) => {
 		...ios === void 0 ? {} : { ios },
 		...android === void 0 ? {} : { android },
 		...credentialsSource === void 0 ? {} : { credentialsSource },
-		...autoIncrement === void 0 ? {} : { autoIncrement }
+		...autoIncrement === void 0 ? {} : { autoIncrement },
+		...withoutCredentials === void 0 ? {} : { withoutCredentials }
 	};
 };
 const collectExtendsChain = (profiles, profileName) => Effect.gen(function* () {
@@ -6390,9 +6721,10 @@ const toIosProfile = (eas) => {
 	if (!distribution) return;
 	const ios = eas.ios ?? {};
 	const autoIncrement = resolveIosAutoIncrement(eas);
+	const buildConfiguration = ios.buildConfiguration ?? (eas.developmentClient === true ? "Debug" : void 0);
 	return {
 		distribution,
-		...ios.buildConfiguration === void 0 ? {} : { buildConfiguration: ios.buildConfiguration },
+		...buildConfiguration === void 0 ? {} : { buildConfiguration },
 		...ios.scheme === void 0 ? {} : { scheme: ios.scheme },
 		...ios.simulator === void 0 ? {} : { simulator: ios.simulator },
 		...autoIncrement === void 0 ? {} : { autoIncrement }
@@ -6405,10 +6737,11 @@ const toAndroidProfile = (eas) => {
 	const android = eas.android ?? {};
 	const distribution = deriveAndroidDistribution(eas, format);
 	const autoIncrement = resolveAndroidAutoIncrement(eas);
+	const buildType = android.buildType ?? (eas.developmentClient === true ? "debug" : void 0);
 	return {
 		format,
 		distribution,
-		...android.buildType === void 0 ? {} : { buildType: android.buildType },
+		...buildType === void 0 ? {} : { buildType },
 		...android.flavor === void 0 ? {} : { flavor: android.flavor },
 		...android.gradleCommand === void 0 ? {} : { gradleCommand: android.gradleCommand },
 		...autoIncrement === void 0 ? {} : { autoIncrement }
@@ -6424,7 +6757,9 @@ const fromEasProfile = (eas, profileName) => {
 		...eas.env === void 0 ? {} : { env: eas.env },
 		...ios === void 0 ? {} : { ios },
 		...android === void 0 ? {} : { android },
-		...eas.credentialsSource === void 0 ? {} : { credentialsSource: eas.credentialsSource }
+		...eas.credentialsSource === void 0 ? {} : { credentialsSource: eas.credentialsSource },
+		...eas.developmentClient === void 0 ? {} : { developmentClient: eas.developmentClient },
+		...eas.withoutCredentials === void 0 ? {} : { withoutCredentials: eas.withoutCredentials }
 	};
 };
 const readBuildProfile = (projectRoot, profileName) => Effect.gen(function* () {
@@ -6467,6 +6802,51 @@ const clearBuildCaches = (projectRoot) => Effect.gen(function* () {
 	if (removed.length > 0) yield* Console.error(`Cleared caches: ${removed.join(", ")}`);
 });
 
+//#endregion
+//#region src/lib/dev-client-check.ts
+const readDeps = (filePath) => Effect.gen(function* () {
+	const text = yield* (yield* FileSystem.FileSystem).readFileString(filePath).pipe(Effect.option, Effect.catchAllDefect(() => Effect.succeedNone));
+	if (text._tag === "None") return;
+	const parsed = yield* Effect.try({
+		try: () => JSON.parse(text.value),
+		catch: () => void 0
+	}).pipe(Effect.option);
+	if (parsed._tag === "None") return;
+	const root = asRecord(parsed.value);
+	if (!root) return;
+	const dependencies = asRecord(root["dependencies"]);
+	const devDependencies = asRecord(root["devDependencies"]);
+	return {
+		...dependencies === void 0 ? {} : { dependencies },
+		...devDependencies === void 0 ? {} : { devDependencies }
+	};
+});
+const hasExpoDevClient = (deps) => {
+	if (!deps) return false;
+	return Object.hasOwn(deps.dependencies ?? {}, "expo-dev-client") || Object.hasOwn(deps.devDependencies ?? {}, "expo-dev-client");
+};
+/**
+* Read `<projectRoot>/package.json` and report whether `expo-dev-client` is
+* declared (either in `dependencies` or `devDependencies`). Returns `false`
+* when the file is missing or unparseable — callers treat that as "not
+* installed". Does not walk monorepo workspaces: `expo-dev-client` is an
+* app-level dep in every Expo template and root-hoisting native deps is
+* unusual.
+*/
+const hasDevClientInstalled = (projectRoot) => Effect.gen(function* () {
+	return hasExpoDevClient(yield* readDeps(path.join(projectRoot, "package.json")).pipe(Effect.orElseSucceed(() => void 0)));
+});
+/**
+* Verify `expo-dev-client` is installed when the profile sets
+* `developmentClient: true`. Without it the built binary boots straight into
+* the regular app (no launcher, no Metro switcher) and the user cannot connect
+* a dev server. EAS warns and proceeds; we mirror that — warn, do not block.
+*/
+const warnIfDevClientMissing = (projectRoot) => Effect.gen(function* () {
+	if (yield* hasDevClientInstalled(projectRoot)) return;
+	yield* printWarn("expo-dev-client is not in dependencies. The built artifact will boot the regular app without a Metro launcher. Install it with `bunx expo install expo-dev-client` and rebuild.");
+});
+
 //#endregion
 //#region src/lib/env-exporter.ts
 const coerceEnvironment = (raw) => raw === "development" || raw === "preview" || raw === "production" ? raw : void 0;
@@ -6587,7 +6967,7 @@ const unquote = (input) => input.startsWith("\"") && input.endsWith("\"") ? inpu
 
 //#endregion
 //#region src/lib/platform-detect.ts
-const PLATFORMS = ["ios", "android"];
+const PLATFORMS$1 = ["ios", "android"];
 const inferPlatforms = (config) => {
 	const fromConfig = config["platforms"];
 	if (Array.isArray(fromConfig)) return fromConfig.filter((entry) => entry === "ios" || entry === "android");
@@ -6612,7 +6992,7 @@ const detectPlatform = (explicit, config) => Effect.gen(function* () {
 		return only;
 	}
 	if (!(yield* InteractiveMode).allow) return yield* new BuildProfileError({ message: `Multiple platforms detected (${candidates.join(", ")}). Pass --platform explicitly when running non-interactively.` });
-	return yield* promptSelect("Which platform to build?", PLATFORMS.filter((entry) => candidates.includes(entry)).map((entry) => ({
+	return yield* promptSelect("Which platform to build?", PLATFORMS$1.filter((entry) => candidates.includes(entry)).map((entry) => ({
 		value: entry,
 		label: entry
 	})));
@@ -6620,7 +7000,7 @@ const detectPlatform = (explicit, config) => Effect.gen(function* () {
 
 //#endregion
 //#region src/lib/project-staging.ts
-const execFileAsync = promisify(execFile);
+const execFileAsync$1 = promisify(execFile);
 const LOCKFILES = [
 	["bun.lock", "bun"],
 	["bun.lockb", "bun"],
@@ -6716,7 +7096,7 @@ const copyProjectTree = (params) => Effect.tryPromise({
 * they exist only so `git rev-parse` succeeds during postinstall.
 */
 const initGitRepo = (stagingRoot) => Effect.tryPromise({
-	try: async () => execFileAsync("git", [
+	try: async () => execFileAsync$1("git", [
 		"init",
 		"-q",
 		stagingRoot
@@ -6799,8 +7179,566 @@ const resolveRuntimeVersion = ({ raw, appVersion, projectRoot }) => Effect.gen(f
 	return yield* new RuntimeVersionError({ message: `Unsupported runtimeVersion policy "${policy}". Use a static string, "appVersion", or "fingerprint".` });
 });
 
+//#endregion
+//#region src/lib/google-play.ts
+var GooglePlayAuthError = class extends Schema.TaggedError()("GooglePlayAuthError", {
+	message: Schema.String,
+	cause: Schema.optional(Schema.Unknown)
+}) {};
+var GooglePlayApiError = class extends Schema.TaggedError()("GooglePlayApiError", {
+	message: Schema.String,
+	httpStatus: Schema.optional(Schema.Number),
+	cause: Schema.optional(Schema.Unknown)
+}) {};
+const ANDROID_PUBLISHER_SCOPE = "https://www.googleapis.com/auth/androidpublisher";
+const GOOGLE_OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";
+const ANDROID_PUBLISHER_BASE = "https://androidpublisher.googleapis.com";
+const ANDROID_UPLOAD_BASE = "https://androidpublisher.googleapis.com/upload";
+const ServiceAccountJsonSchema = Schema.Struct({
+	type: Schema.String,
+	client_email: Schema.String,
+	private_key: Schema.String,
+	token_uri: Schema.optional(Schema.String)
+});
+const TokenResponseSchema = Schema.Struct({
+	access_token: Schema.String,
+	expires_in: Schema.optional(Schema.Number)
+});
+const stripPemHeaders = (pem) => pem.replace(/-----BEGIN [A-Z ]+-----/u, "").replace(/-----END [A-Z ]+-----/u, "").replaceAll(/\s+/gu, "");
+const asArrayBuffer = (bytes) => {
+	const buffer = new ArrayBuffer(bytes.byteLength);
+	new Uint8Array(buffer).set(bytes);
+	return buffer;
+};
+const importPrivateKey = (pem) => Effect.tryPromise({
+	try: async () => {
+		const pkcs8 = fromBase64(stripPemHeaders(pem));
+		return crypto.subtle.importKey("pkcs8", asArrayBuffer(pkcs8), {
+			name: "RSASSA-PKCS1-v1_5",
+			hash: "SHA-256"
+		}, false, ["sign"]);
+	},
+	catch: (cause) => new GooglePlayAuthError({
+		message: "Failed to import service account private key",
+		cause
+	})
+});
+const buildJwtAssertion = (params) => {
+	const header = {
+		alg: "RS256",
+		typ: "JWT"
+	};
+	const claims = {
+		iss: params.clientEmail,
+		scope: ANDROID_PUBLISHER_SCOPE,
+		aud: params.tokenUri,
+		exp: params.nowSeconds + 3600,
+		iat: params.nowSeconds
+	};
+	return `${toBase64Url(new TextEncoder().encode(JSON.stringify(header)))}.${toBase64Url(new TextEncoder().encode(JSON.stringify(claims)))}`;
+};
+const signJwt = (key, payload) => Effect.tryPromise({
+	try: async () => {
+		const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, new TextEncoder().encode(payload));
+		return `${payload}.${toBase64Url(new Uint8Array(signature))}`;
+	},
+	catch: (cause) => new GooglePlayAuthError({
+		message: "Failed to sign JWT",
+		cause
+	})
+});
+const postTokenRequest = (tokenUri, jwt) => Effect.tryPromise({
+	try: async () => {
+		const body = new URLSearchParams({
+			grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+			assertion: jwt
+		});
+		const response = await fetch(tokenUri, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body
+		});
+		const text = await response.text();
+		return {
+			ok: response.ok,
+			status: response.status,
+			text
+		};
+	},
+	catch: (cause) => new GooglePlayAuthError({
+		message: "Failed to exchange JWT for access token",
+		cause
+	})
+});
+const exchangeJwtForAccessToken = (tokenUri, jwt) => Effect.gen(function* () {
+	const result = yield* postTokenRequest(tokenUri, jwt);
+	if (!result.ok) return yield* Effect.fail(new GooglePlayAuthError({ message: `OAuth token exchange failed: ${String(result.status)} ${result.text}` }));
+	const json = yield* Effect.try({
+		try: () => JSON.parse(result.text),
+		catch: (cause) => new GooglePlayAuthError({
+			message: "OAuth token response is not JSON",
+			cause
+		})
+	});
+	return (yield* Schema.decodeUnknown(TokenResponseSchema)(json).pipe(Effect.mapError((cause) => new GooglePlayAuthError({
+		message: "OAuth token response missing access_token",
+		cause
+	})))).access_token;
+});
+const acquireGooglePlayAccessToken = (serviceAccountJson) => Effect.gen(function* () {
+	const raw = yield* Effect.try({
+		try: () => JSON.parse(serviceAccountJson),
+		catch: (cause) => new GooglePlayAuthError({
+			message: "Service account JSON is not valid JSON",
+			cause
+		})
+	});
+	const parsed = yield* Schema.decodeUnknown(ServiceAccountJsonSchema)(raw).pipe(Effect.mapError((cause) => new GooglePlayAuthError({
+		message: "Service account JSON missing required fields (type, client_email, private_key)",
+		cause
+	})));
+	if (parsed.type !== "service_account") return yield* Effect.fail(new GooglePlayAuthError({ message: `Service account JSON has wrong type: ${parsed.type}` }));
+	const tokenUri = parsed.token_uri ?? GOOGLE_OAUTH_TOKEN_URL;
+	return {
+		accessToken: yield* exchangeJwtForAccessToken(tokenUri, yield* signJwt(yield* importPrivateKey(parsed.private_key), buildJwtAssertion({
+			clientEmail: parsed.client_email,
+			tokenUri,
+			nowSeconds: Math.floor(Date.now() / 1e3)
+		}))),
+		clientEmail: parsed.client_email
+	};
+});
+const authHeaders = (accessToken) => ({ Authorization: `Bearer ${accessToken}` });
+const performFetch = (params) => Effect.tryPromise({
+	try: async () => {
+		const init = params.body === void 0 ? {
+			method: params.method,
+			headers: authHeaders(params.accessToken)
+		} : {
+			method: params.method,
+			headers: {
+				...authHeaders(params.accessToken),
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify(params.body)
+		};
+		const response = await fetch(params.url, init);
+		const text = await response.text();
+		return {
+			ok: response.ok,
+			status: response.status,
+			text
+		};
+	},
+	catch: (cause) => new GooglePlayApiError({
+		message: `${params.label} request failed`,
+		cause
+	})
+});
+const callJsonRaw = (params) => Effect.gen(function* () {
+	const result = yield* performFetch(params);
+	if (!result.ok) return yield* Effect.fail(new GooglePlayApiError({
+		message: `${params.label} failed: ${String(result.status)} ${result.text}`,
+		httpStatus: result.status
+	}));
+	return yield* Effect.try({
+		try: () => result.text === "" ? {} : JSON.parse(result.text),
+		catch: (cause) => new GooglePlayApiError({
+			message: `${params.label} response is not JSON`,
+			cause
+		})
+	});
+});
+const AppEditSchema = Schema.Struct({
+	id: Schema.String,
+	expiryTimeSeconds: Schema.optional(Schema.String)
+});
+const insertEdit = (params) => Effect.gen(function* () {
+	const raw = yield* callJsonRaw({
+		url: `${ANDROID_PUBLISHER_BASE}/androidpublisher/v3/applications/${encodeURIComponent(params.packageName)}/edits`,
+		method: "POST",
+		accessToken: params.accessToken,
+		body: {},
+		label: "edits.insert"
+	});
+	return yield* Schema.decodeUnknown(AppEditSchema)(raw).pipe(Effect.mapError((cause) => new GooglePlayApiError({
+		message: "edits.insert response missing id",
+		cause
+	})));
+});
+const UploadedBundleSchema = Schema.Struct({
+	versionCode: Schema.Number,
+	sha256: Schema.optional(Schema.String)
+});
+const performBundleUpload = (params) => Effect.tryPromise({
+	try: async () => {
+		const url = `${ANDROID_UPLOAD_BASE}/androidpublisher/v3/applications/${encodeURIComponent(params.packageName)}/edits/${encodeURIComponent(params.editId)}/bundles?uploadType=media`;
+		const response = await fetch(url, {
+			method: "POST",
+			headers: {
+				...authHeaders(params.accessToken),
+				"Content-Type": "application/octet-stream"
+			},
+			body: new Uint8Array(params.aabBytes)
+		});
+		const text = await response.text();
+		return {
+			ok: response.ok,
+			status: response.status,
+			text
+		};
+	},
+	catch: (cause) => new GooglePlayApiError({
+		message: "edits.bundles.upload request failed",
+		cause
+	})
+});
+const uploadBundle = (params) => Effect.gen(function* () {
+	const result = yield* performBundleUpload(params);
+	if (!result.ok) return yield* Effect.fail(new GooglePlayApiError({
+		message: `edits.bundles.upload failed: ${String(result.status)} ${result.text}`,
+		httpStatus: result.status
+	}));
+	const raw = yield* Effect.try({
+		try: () => JSON.parse(result.text),
+		catch: (cause) => new GooglePlayApiError({
+			message: "edits.bundles.upload response is not JSON",
+			cause
+		})
+	});
+	return yield* Schema.decodeUnknown(UploadedBundleSchema)(raw).pipe(Effect.mapError((cause) => new GooglePlayApiError({
+		message: "Bundle upload response missing versionCode",
+		cause
+	})));
+});
+const updateTrack = (params) => {
+	const release = {
+		status: params.releaseStatus,
+		versionCodes: [String(params.versionCode)],
+		...params.rollout === null ? {} : { userFraction: params.rollout },
+		...params.releaseNotes === void 0 ? {} : { releaseNotes: [{
+			language: "en-US",
+			text: params.releaseNotes
+		}] }
+	};
+	return callJsonRaw({
+		url: `${ANDROID_PUBLISHER_BASE}/androidpublisher/v3/applications/${encodeURIComponent(params.packageName)}/edits/${encodeURIComponent(params.editId)}/tracks/${encodeURIComponent(params.track)}`,
+		method: "PUT",
+		accessToken: params.accessToken,
+		body: {
+			track: params.track,
+			releases: [release]
+		},
+		label: "edits.tracks.update"
+	});
+};
+const commitEdit = (params) => callJsonRaw({
+	url: `${ANDROID_PUBLISHER_BASE}/androidpublisher/v3/applications/${encodeURIComponent(params.packageName)}/edits/${encodeURIComponent(params.editId)}:commit?changesNotSentForReview=${String(params.changesNotSentForReview)}`,
+	method: "POST",
+	accessToken: params.accessToken,
+	label: "edits.commit"
+});
+
+//#endregion
+//#region src/lib/nullable.ts
+const toDbNull = (value) => value ?? null;
+
+//#endregion
+//#region src/application/submit-flow.ts
+const execFileAsync = promisify(execFile);
+const ExecErrorSchema = Schema.Struct({
+	code: Schema.optional(Schema.Number),
+	stdout: Schema.optional(Schema.String),
+	stderr: Schema.optional(Schema.String)
+});
+const runAltool = (args) => Effect.tryPromise({
+	try: async () => {
+		const { stdout, stderr } = await execFileAsync("xcrun", ["altool", ...args]);
+		return {
+			exitCode: 0,
+			stdout,
+			stderr
+		};
+	},
+	catch: (error) => {
+		const parsed = Schema.decodeUnknownSync(ExecErrorSchema, { onExcessProperty: "ignore" })(typeof error === "object" && error !== null ? error : {});
+		const stdout = parsed.stdout ?? "";
+		const stderr = parsed.stderr ?? String(error);
+		return {
+			exitCode: parsed.code ?? 1,
+			stdout,
+			stderr: stderr === "" ? String(error) : stderr
+		};
+	}
+}).pipe(Effect.catchAll((result) => Effect.succeed(result)));
+var CliSubmitError = class extends Schema.TaggedError()("CliSubmitError", {
+	code: Schema.String,
+	message: Schema.String
+}) {};
+const createSubmissionViaApi = (api, resolved) => api.submissions.create({
+	path: { projectId: resolved.projectId },
+	payload: {
+		platform: resolved.platform,
+		profileName: resolved.profileName,
+		archiveSource: resolved.archiveSource,
+		...resolved.buildId === void 0 ? {} : { buildId: resolved.buildId },
+		...resolved.archiveUrl === void 0 ? {} : { archiveUrl: resolved.archiveUrl },
+		...resolved.iosConfig === void 0 ? {} : { iosConfig: resolved.iosConfig },
+		...resolved.androidConfig === void 0 ? {} : { androidConfig: resolved.androidConfig }
+	}
+}).pipe(Effect.mapError(() => new CliSubmitError({
+	code: "SUBMISSION_CREATE_FAILED",
+	message: "Failed to create submission via API"
+})));
+const isTerminal = (status) => status === "FINISHED" || status === "ERRORED" || status === "CANCELED";
+const fetchSubmission = (api, submissionId) => api.submissions.get({ path: { id: submissionId } }).pipe(Effect.mapError(() => new CliSubmitError({
+	code: "SUBMISSION_GET_FAILED",
+	message: "Failed to read submission status"
+})));
+const pollSubmissionUntilTerminal = (api, submissionId, pollIntervalMs = 5e3) => Effect.iterate(void 0, {
+	while: (state) => state === void 0 || !isTerminal(state.status),
+	body: (state) => Effect.gen(function* () {
+		if (state !== void 0) yield* Effect.sleep(Duration.millis(pollIntervalMs));
+		const next = yield* fetchSubmission(api, submissionId);
+		yield* printHuman(`status: ${next.status}`);
+		return next;
+	})
+}).pipe(Effect.flatMap((final) => final === void 0 ? Effect.fail(new CliSubmitError({
+	code: "SUBMISSION_POLL_NO_RESULT",
+	message: "Polling completed without producing a submission"
+})) : Effect.succeed(final)));
+const writeAscApiKeyP8 = (api, ascApiKeyId) => Effect.gen(function* () {
+	const creds = yield* fetchAscCredentials(api, ascApiKeyId).pipe(Effect.mapError(() => new CliSubmitError({
+		code: "SUBMISSION_ASC_KEY_FETCH_FAILED",
+		message: `Failed to download ASC API key ${ascApiKeyId}`
+	})));
+	const target = path.join(tmpdir(), `better-update-submit-AuthKey_${creds.keyId}.p8`);
+	yield* Effect.promise(async () => writeFile(target, fromBase64(creds.p8Pem)));
+	return {
+		p8Path: target,
+		keyId: creds.keyId,
+		issuerId: creds.issuerId
+	};
+});
+const runIosAltoolUpload = (inputs) => Effect.gen(function* () {
+	const creds = yield* writeAscApiKeyP8(inputs.api, inputs.ascApiKeyId);
+	const apiKeyDir = path.dirname(creds.p8Path);
+	yield* inputs.api.submissions.updateStatus({
+		path: { id: inputs.submissionId },
+		payload: { status: "IN_PROGRESS" }
+	}).pipe(Effect.mapError(() => new CliSubmitError({
+		code: "SUBMISSION_PATCH_FAILED",
+		message: "Failed to PATCH submission status to IN_PROGRESS"
+	})));
+	const result = yield* runAltool([
+		"--upload-app",
+		"--type",
+		"ios",
+		"--apiKey",
+		creds.keyId,
+		"--apiIssuer",
+		creds.issuerId,
+		"--apiKeyDir",
+		apiKeyDir,
+		"--file",
+		inputs.ipaPath,
+		"--output-format",
+		"xml"
+	]);
+	const terminalStatus = result.exitCode === 0 ? "FINISHED" : "ERRORED";
+	const errorMessage = result.exitCode === 0 ? null : `xcrun altool exited ${String(result.exitCode)}: ${result.stderr}`;
+	yield* inputs.api.submissions.updateStatus({
+		path: { id: inputs.submissionId },
+		payload: {
+			status: terminalStatus,
+			...errorMessage === null ? {} : {
+				errorCode: "SUBMISSION_SERVICE_IOS_ALTOOL_FAILED",
+				errorMessage
+			}
+		}
+	}).pipe(Effect.mapError(() => new CliSubmitError({
+		code: "SUBMISSION_PATCH_FAILED",
+		message: "Failed to PATCH submission terminal status"
+	})));
+	return {
+		status: terminalStatus,
+		stdout: result.stdout,
+		stderr: result.stderr
+	};
+});
+const readLocalFile = (filePath, errorCode, errorMessageFmt) => Effect.tryPromise({
+	try: async () => readFile(filePath),
+	catch: (cause) => new CliSubmitError({
+		code: errorCode,
+		message: errorMessageFmt(cause)
+	})
+});
+const fetchArchiveOverHttp = (url) => Effect.gen(function* () {
+	const result = yield* Effect.tryPromise({
+		try: async () => {
+			const response = await fetch(url);
+			const bytes = response.ok ? new Uint8Array(await response.arrayBuffer()) : null;
+			return {
+				ok: response.ok,
+				status: response.status,
+				bytes
+			};
+		},
+		catch: (cause) => new CliSubmitError({
+			code: "SUBMISSION_ARCHIVE_DOWNLOAD_FAILED",
+			message: `Failed to download AAB from ${url}: ${cause instanceof Error ? cause.message : String(cause)}`
+		})
+	});
+	if (!result.ok || result.bytes === null) return yield* Effect.fail(new CliSubmitError({
+		code: "SUBMISSION_ARCHIVE_DOWNLOAD_FAILED",
+		message: `HTTP ${String(result.status)} fetching archive at ${url}`
+	}));
+	return result.bytes;
+});
+const readArchiveBytes = (archive) => archive.source === "path" ? Effect.map(readLocalFile(archive.value, "SUBMISSION_ARCHIVE_READ_FAILED", (cause) => `Failed to read AAB at ${archive.value}: ${cause instanceof Error ? cause.message : String(cause)}`), (buf) => new Uint8Array(buf)) : fetchArchiveOverHttp(archive.value);
+const fetchServiceAccountKeyById = (api, id) => api.googleServiceAccountKeys.download({ path: { id } }).pipe(Effect.mapError(() => new CliSubmitError({
+	code: "SUBMISSION_ANDROID_SA_KEY_FETCH_FAILED",
+	message: `Failed to download Google service account key ${id}`
+})), Effect.map((data) => data.json));
+const resolveServiceAccountJson = (params) => {
+	if (params.serviceAccountKeyId !== void 0) return fetchServiceAccountKeyById(params.api, params.serviceAccountKeyId);
+	if (params.serviceAccountKeyPath !== void 0) return Effect.map(readLocalFile(params.serviceAccountKeyPath, "SUBMISSION_ANDROID_SA_KEY_LOCAL_READ_FAILED", (cause) => `Failed to read service account JSON at ${String(params.serviceAccountKeyPath)}: ${cause instanceof Error ? cause.message : String(cause)}`), (buf) => new TextDecoder().decode(buf));
+	return Effect.fail(new CliSubmitError({
+		code: "SUBMISSION_ANDROID_SA_KEY_MISSING",
+		message: "Android submission requires a service account key. Pass --service-account-key-id <id>, set serviceAccountKeyId in eas.json submit profile, or set serviceAccountKeyPath to a local JSON file."
+	}));
+};
+const patchSubmissionStatus = (api, submissionId, payload) => api.submissions.updateStatus({
+	path: { id: submissionId },
+	payload
+}).pipe(Effect.mapError(() => new CliSubmitError({
+	code: "SUBMISSION_PATCH_FAILED",
+	message: `Failed to PATCH submission status to ${payload.status}`
+})));
+const wrapGooglePlayError = (label) => (cause) => new CliSubmitError({
+	code: `SUBMISSION_ANDROID_${label}`,
+	message: cause.message
+});
+const runGooglePlayPipeline = (params) => Effect.gen(function* () {
+	const edit = yield* insertEdit({
+		accessToken: params.accessToken,
+		packageName: params.applicationId
+	}).pipe(Effect.mapError(wrapGooglePlayError("EDIT_INSERT_FAILED")));
+	const uploaded = yield* uploadBundle({
+		accessToken: params.accessToken,
+		packageName: params.applicationId,
+		editId: edit.id,
+		aabBytes: params.aab
+	}).pipe(Effect.mapError(wrapGooglePlayError("BUNDLE_UPLOAD_FAILED")));
+	yield* updateTrack({
+		accessToken: params.accessToken,
+		packageName: params.applicationId,
+		editId: edit.id,
+		track: params.track,
+		releaseStatus: params.releaseStatus,
+		versionCode: uploaded.versionCode,
+		rollout: params.rollout
+	}).pipe(Effect.mapError(wrapGooglePlayError("TRACK_UPDATE_FAILED")));
+	yield* commitEdit({
+		accessToken: params.accessToken,
+		packageName: params.applicationId,
+		editId: edit.id,
+		changesNotSentForReview: params.changesNotSentForReview
+	}).pipe(Effect.mapError(wrapGooglePlayError("COMMIT_FAILED")));
+	return uploaded;
+});
+const runAndroidGooglePlayUpload = (inputs) => Effect.gen(function* () {
+	const { applicationId } = inputs.androidProfile;
+	if (applicationId === void 0) return yield* Effect.fail(new CliSubmitError({
+		code: "SUBMISSION_ANDROID_APP_ID_MISSING",
+		message: "Android submit profile requires applicationId — set submit.<profile>.android.applicationId in eas.json"
+	}));
+	const serviceAccountJson = yield* resolveServiceAccountJson({
+		api: inputs.api,
+		serviceAccountKeyId: inputs.serviceAccountKeyId,
+		serviceAccountKeyPath: inputs.androidProfile.serviceAccountKeyPath
+	});
+	yield* patchSubmissionStatus(inputs.api, inputs.submissionId, { status: "IN_PROGRESS" });
+	const result = yield* Effect.gen(function* () {
+		const token = yield* acquireGooglePlayAccessToken(serviceAccountJson).pipe(Effect.mapError(wrapGooglePlayError("AUTH_FAILED")));
+		const aab = yield* readArchiveBytes(inputs.archive);
+		return yield* runGooglePlayPipeline({
+			accessToken: token.accessToken,
+			applicationId,
+			aab,
+			track: inputs.androidProfile.track ?? "internal",
+			releaseStatus: inputs.androidProfile.releaseStatus ?? "completed",
+			changesNotSentForReview: inputs.androidProfile.changesNotSentForReview ?? false,
+			rollout: toDbNull(inputs.androidProfile.rollout)
+		});
+	}).pipe(Effect.catchTag("CliSubmitError", (engineError) => Effect.gen(function* () {
+		yield* patchSubmissionStatus(inputs.api, inputs.submissionId, {
+			status: "ERRORED",
+			errorCode: engineError.code,
+			errorMessage: engineError.message
+		});
+		return yield* Effect.fail(engineError);
+	})));
+	yield* patchSubmissionStatus(inputs.api, inputs.submissionId, { status: "FINISHED" });
+	yield* printHuman(`Google Play bundle uploaded (versionCode ${String(result.versionCode)})`);
+	return result;
+});
+
 //#endregion
 //#region src/application/build-workflow.ts
+const buildAutoSubmitIosConfig = (iosProfile, whatToTest) => {
+	if (iosProfile?.bundleIdentifier === void 0) return;
+	return {
+		bundleIdentifier: iosProfile.bundleIdentifier,
+		...iosProfile.appleId === void 0 ? {} : { appleId: iosProfile.appleId },
+		...iosProfile.ascAppId === void 0 ? {} : { ascAppId: iosProfile.ascAppId },
+		...iosProfile.appleTeamId === void 0 ? {} : { appleTeamId: iosProfile.appleTeamId },
+		...iosProfile.sku === void 0 ? {} : { sku: iosProfile.sku },
+		...iosProfile.language === void 0 ? {} : { language: iosProfile.language },
+		...iosProfile.companyName === void 0 ? {} : { companyName: iosProfile.companyName },
+		...iosProfile.appName === void 0 ? {} : { appName: iosProfile.appName },
+		...iosProfile.groups === void 0 ? {} : { groups: iosProfile.groups },
+		...whatToTest === void 0 ? {} : { whatToTest }
+	};
+};
+const buildAutoSubmitAndroidConfig = (androidProfile) => {
+	if (androidProfile?.applicationId === void 0) return;
+	return {
+		applicationId: androidProfile.applicationId,
+		...androidProfile.track === void 0 ? {} : { track: androidProfile.track },
+		...androidProfile.releaseStatus === void 0 ? {} : { releaseStatus: androidProfile.releaseStatus },
+		...androidProfile.changesNotSentForReview === void 0 ? {} : { changesNotSentForReview: androidProfile.changesNotSentForReview },
+		...androidProfile.rollout === void 0 ? {} : { rollout: androidProfile.rollout }
+	};
+};
+const runAutoSubmit = (input) => Effect.gen(function* () {
+	yield* printHuman(`\nAuto-submitting build ${input.buildId} (profile ${input.profileName})...`);
+	const easProfile = yield* resolveEasSubmitProfile((yield* readEasJson(process.cwd())).submit, input.profileName);
+	const archiveUrl = (yield* input.api.builds.getInstallLink({ path: { id: input.buildId } })).artifactUrl;
+	const iosConfig = input.platform === "ios" ? buildAutoSubmitIosConfig(easProfile.ios, input.whatToTest) : void 0;
+	const androidConfig = input.platform === "android" ? buildAutoSubmitAndroidConfig(easProfile.android) : void 0;
+	const submission = yield* createSubmissionViaApi(input.api, {
+		projectId: input.projectId,
+		platform: input.platform,
+		profileName: input.profileName,
+		archiveSource: "build",
+		buildId: input.buildId,
+		archiveUrl,
+		...iosConfig === void 0 ? {} : { iosConfig },
+		...androidConfig === void 0 ? {} : { androidConfig }
+	});
+	yield* printHuman(`Submission created: ${submission.id} (${submission.status})`);
+	if (input.platform === "ios" && easProfile.ios?.ascApiKeyId !== void 0) {
+		yield* printHuman("Running xcrun altool upload...");
+		yield* runIosAltoolUpload({
+			api: input.api,
+			submissionId: submission.id,
+			ipaPath: archiveUrl,
+			ascApiKeyId: easProfile.ios.ascApiKeyId
+		});
+	}
+	yield* printHuman(`Submission final status: ${(yield* pollSubmissionUntilTerminal(input.api, submission.id)).status}`);
+});
 const runIosPlatformBuild = (input) => Effect.gen(function* () {
 	const { api, appMeta, envVars, options, profile, projectId, projectRoot, tempDir } = input;
 	if (!profile.ios) return yield* new BuildProfileError({ message: `Profile "${profile.name}" has no ios section.` });
@@ -6849,7 +7787,8 @@ const runAndroidPlatformBuild = (input) => Effect.gen(function* () {
 	yield* warnOnGradleMismatch(gradleConfig, androidBundleId);
 	const applicationIdentifier = gradleConfig?.applicationId ?? androidBundleId;
 	const credentialsSource = profile.credentialsSource ?? "remote";
-	if (credentialsSource === "remote") yield* ensureAndroidCredentials(api, {
+	const skipCredentials = profile.developmentClient === true || profile.withoutCredentials === true;
+	if (credentialsSource === "remote" && !skipCredentials) yield* ensureAndroidCredentials(api, {
 		projectId,
 		applicationIdentifier
 	}, { freezeCredentials: options.freezeCredentials ?? false });
@@ -6863,7 +7802,8 @@ const runAndroidPlatformBuild = (input) => Effect.gen(function* () {
 			envVars,
 			projectId,
 			credentialsSource,
-			profileName: profile.name
+			profileName: profile.name,
+			skipCredentials
 		}),
 		target: androidProfile.format === "aab" ? {
 			platform: "android",
@@ -6901,10 +7841,14 @@ const runBuildWorkflow = (options) => Effect.scoped(Effect.gen(function* () {
 	const projectId = yield* extractProjectId(baseConfig);
 	const platform = yield* detectPlatform(options.platform, baseConfig);
 	const profile = yield* readBuildProfile(userCwd, yield* resolveProfileName(userCwd, options.profileName));
-	const envVars = yield* pullEnvVars(api, {
-		projectId,
-		environment: profile.environment
-	});
+	if (profile.developmentClient === true) yield* warnIfDevClientMissing(userCwd);
+	const envVars = {
+		...yield* pullEnvVars(api, {
+			projectId,
+			environment: profile.environment
+		}),
+		...profile.env
+	};
 	yield* applyAutoIncrement({
 		projectRoot: userCwd,
 		platform,
@@ -6991,6 +7935,14 @@ const runBuildWorkflow = (options) => Effect.scoped(Effect.gen(function* () {
 		["SHA-256", build.sha256],
 		["Bytes", String(build.byteSize)]
 	]);
+	if (options.autoSubmit === true) yield* runAutoSubmit({
+		api,
+		buildId: result.id,
+		projectId,
+		platform,
+		profileName: options.autoSubmitProfile ?? profile.name,
+		...options.whatToTest === void 0 ? {} : { whatToTest: options.whatToTest }
+	});
 }));
 
 //#endregion
@@ -7153,6 +8105,19 @@ const buildCommand = defineCommand({
 		"allow-dirty": {
 			type: "boolean",
 			description: "Proceed even with uncommitted git changes"
+		},
+		"auto-submit": {
+			type: "boolean",
+			alias: "s",
+			description: "After upload, submit the build using eas.json submit profile of the same name"
+		},
+		"auto-submit-with-profile": {
+			type: "string",
+			description: "After upload, submit the build using a specific submit profile"
+		},
+		"what-to-test": {
+			type: "string",
+			description: "iOS-only TestFlight changelog when auto-submitting"
 		}
 	},
 	run: async ({ args }) => runEffect(runBuildWorkflow({
@@ -7164,7 +8129,13 @@ const buildCommand = defineCommand({
 		rawOutput: args["raw-output"] ?? false,
 		clearCache: args["clear-cache"] ?? false,
 		freezeCredentials: args["freeze-credentials"] ?? false,
-		allowDirty: args["allow-dirty"] ?? false
+		allowDirty: args["allow-dirty"] ?? false,
+		...args["auto-submit"] === void 0 ? {} : { autoSubmit: args["auto-submit"] },
+		...args["auto-submit-with-profile"] === void 0 ? {} : {
+			autoSubmit: true,
+			autoSubmitProfile: args["auto-submit-with-profile"]
+		},
+		...args["what-to-test"] === void 0 ? {} : { whatToTest: args["what-to-test"] }
 	}), BUILD_EXIT_EXTRAS)
 });
 
@@ -7431,7 +8402,18 @@ const listCommand$5 = defineCommand({
 
 //#endregion
 //#region src/commands/builds/resign.ts
-const resignWorkflowText = (buildId, installLink) => `Resigning iOS build ${buildId}
+const resignWorkflowText = (params) => {
+	const inputs = params.resolved;
+	const profilePathHint = inputs === void 0 ? "/path/to/new.mobileprovision" : inputs.profilePath;
+	const identityHint = inputs === void 0 ? `"iPhone Distribution: Your Team (ABCDE12345)"` : `"${inputs.signingIdentity}"`;
+	const appName = inputs === void 0 ? "YourApp.app" : `${inputs.appName}.app`;
+	const resolvedHeader = inputs === void 0 ? "" : `Resolved inputs
+  Profile: ${inputs.profilePath}
+  Identity: ${inputs.signingIdentity}
+  Target app bundle: ${inputs.appName}.app
+
+`;
+	return `Resigning iOS build ${params.buildId}
 =================================================
 
 iOS code-signing requires native macOS tooling (codesign, security, xcodebuild)
@@ -7439,22 +8421,22 @@ and the matching distribution certificate in your Keychain. better-update does
 not bundle that toolchain — instead it gives you the inputs and a re-upload
 path.
 
-Step 1 — Download the existing IPA
-  ${installLink}
+${resolvedHeader}Step 1 — Download the existing IPA
+  ${params.installLink}
 
 Step 2 — Resign the IPA locally with your new provisioning profile.
   Pick one of:
   a) fastlane sigh resign:
        fastlane sigh resign /tmp/build.ipa \\
-         --signing_identity "iPhone Distribution: Your Team (ABCDE12345)" \\
-         --provisioning_profile /path/to/new.mobileprovision
+         --signing_identity ${identityHint} \\
+         --provisioning_profile ${profilePathHint}
 
   b) Apple's codesign + xcodebuild:
        unzip /tmp/build.ipa -d /tmp/payload
-       cp /path/to/new.mobileprovision /tmp/payload/Payload/YourApp.app/embedded.mobileprovision
-       codesign -f -s "iPhone Distribution: Your Team (ABCDE12345)" \\
-         --entitlements <(security cms -D -i /path/to/new.mobileprovision) \\
-         /tmp/payload/Payload/YourApp.app
+       cp ${profilePathHint} /tmp/payload/Payload/${appName}/embedded.mobileprovision
+       codesign -f -s ${identityHint} \\
+         --entitlements <(security cms -D -i ${profilePathHint}) \\
+         /tmp/payload/Payload/${appName}
        (cd /tmp/payload && zip -qr /tmp/resigned.ipa Payload)
 
 Step 3 — Upload the re-signed IPA as a fresh build:
@@ -7464,16 +8446,40 @@ Step 3 — Upload the re-signed IPA as a fresh build:
 The new build will get a fresh build ID. The original build remains for
 rollback. Disable or delete it when the re-signed build is verified.
 `;
+};
+const downloadProfileToTmp = (api, profileId) => Effect.gen(function* () {
+	const data = yield* api.appleProvisioningProfiles.download({ path: { id: profileId } });
+	const target = path.join(tmpdir(), `better-update-resign-${data.id}.mobileprovision`);
+	yield* Effect.promise(async () => writeFile(target, fromBase64(data.profileBase64)));
+	return {
+		profilePath: target,
+		profileName: data.profileName,
+		bundleIdentifier: data.bundleIdentifier
+	};
+});
+const resolveSigningIdentity = (api, certId) => Effect.gen(function* () {
+	return `iPhone Distribution: ${(yield* api.appleDistributionCertificates.download({ path: { id: certId } })).appleTeamIdentifier}`;
+});
 const resignCommand = defineCommand({
 	meta: {
 		name: "resign",
 		description: "Print step-by-step instructions for re-signing an iOS build with a new provisioning profile"
 	},
-	args: { build: {
-		type: "string",
-		required: true,
-		description: "Source build ID"
-	} },
+	args: {
+		build: {
+			type: "string",
+			required: true,
+			description: "Source build ID"
+		},
+		"profile-id": {
+			type: "string",
+			description: "Provisioning profile ID to bind to the resigned build (downloads it to a tmp path)"
+		},
+		"cert-id": {
+			type: "string",
+			description: "Distribution certificate ID to derive the codesign --signing-identity from"
+		}
+	},
 	run: async ({ args }) => runEffect(Effect.gen(function* () {
 		const api = yield* apiClient;
 		const build = yield* api.builds.get({ path: { id: args.build } });
@@ -7483,7 +8489,19 @@ const resignCommand = defineCommand({
 			return;
 		}
 		const link = yield* api.builds.getInstallLink({ path: { id: args.build } });
-		yield* printHuman(resignWorkflowText(args.build, link.artifactUrl));
+		const profilePromise = args["profile-id"] === void 0 ? Effect.succeed(void 0) : downloadProfileToTmp(api, args["profile-id"]);
+		const identityPromise = args["cert-id"] === void 0 ? Effect.succeed(void 0) : resolveSigningIdentity(api, args["cert-id"]);
+		const [profile, identity] = yield* Effect.all([profilePromise, identityPromise], { concurrency: 2 });
+		const resolved = profile === void 0 && identity === void 0 ? void 0 : {
+			profilePath: profile?.profilePath ?? "/path/to/new.mobileprovision",
+			signingIdentity: identity ?? "iPhone Distribution: Your Team (ABCDE12345)",
+			appName: profile?.bundleIdentifier.split(".").pop() ?? "YourApp"
+		};
+		yield* printHuman(resignWorkflowText({
+			buildId: args.build,
+			installLink: link.artifactUrl,
+			resolved
+		}));
 	}))
 });
 
@@ -7845,10 +8863,13 @@ const runUploadWorkflow = (options) => Effect.gen(function* () {
 	if (!(yield* (yield* FileSystem.FileSystem).exists(options.artifactPath).pipe(Effect.orElseSucceed(() => false)))) yield* new ArtifactNotFoundError({ message: `Artifact not found at ${options.artifactPath}.` });
 	const projectId = yield* extractProjectId(yield* readExpoConfig(projectRoot));
 	const profile = yield* readBuildProfile(projectRoot, options.profileName);
-	const appMeta = yield* readAppMeta(yield* readExpoConfig(projectRoot, yield* pullEnvVars(api, {
-		projectId,
-		environment: profile.environment
-	})), options.platform);
+	const appMeta = yield* readAppMeta(yield* readExpoConfig(projectRoot, {
+		...yield* pullEnvVars(api, {
+			projectId,
+			environment: profile.environment
+		}),
+		...profile.env
+	}), options.platform);
 	const runtimeVersion = yield* resolveRuntimeVersion({
 		raw: appMeta.rawRuntimeVersion,
 		appVersion: appMeta.appVersion,
@@ -12957,6 +13978,195 @@ const statusCommand = defineCommand({
 	}))
 });
 
+//#endregion
+//#region src/commands/submit/index.ts
+const PLATFORMS = ["ios", "android"];
+const resolveArchive = (api, projectId, platform, args) => Effect.gen(function* () {
+	if (args.path !== void 0) return {
+		archiveSource: "path",
+		archiveUrl: args.path,
+		buildId: void 0
+	};
+	if (args.url !== void 0) return {
+		archiveSource: "url",
+		archiveUrl: args.url,
+		buildId: void 0
+	};
+	if (args.id !== void 0) return {
+		archiveSource: "build",
+		archiveUrl: (yield* api.builds.getInstallLink({ path: { id: args.id } })).artifactUrl,
+		buildId: args.id
+	};
+	if (args.latest) {
+		const { items } = yield* api.builds.list({ urlParams: {
+			projectId,
+			limit: 1,
+			platform,
+			sort: "-createdAt"
+		} });
+		const [latest] = items;
+		if (latest === void 0) {
+			yield* printHuman(`No builds found for platform ${platform}`);
+			return null;
+		}
+		return {
+			archiveSource: "build",
+			archiveUrl: (yield* api.builds.getInstallLink({ path: { id: latest.id } })).artifactUrl,
+			buildId: latest.id
+		};
+	}
+	return null;
+});
+const buildIosCreatePayload = (iosProfile, whatToTest) => {
+	if (iosProfile?.bundleIdentifier === void 0) return;
+	return {
+		bundleIdentifier: iosProfile.bundleIdentifier,
+		...iosProfile.appleId === void 0 ? {} : { appleId: iosProfile.appleId },
+		...iosProfile.ascAppId === void 0 ? {} : { ascAppId: iosProfile.ascAppId },
+		...iosProfile.appleTeamId === void 0 ? {} : { appleTeamId: iosProfile.appleTeamId },
+		...iosProfile.sku === void 0 ? {} : { sku: iosProfile.sku },
+		...iosProfile.language === void 0 ? {} : { language: iosProfile.language },
+		...iosProfile.companyName === void 0 ? {} : { companyName: iosProfile.companyName },
+		...iosProfile.appName === void 0 ? {} : { appName: iosProfile.appName },
+		...iosProfile.groups === void 0 ? {} : { groups: iosProfile.groups },
+		...whatToTest === void 0 ? {} : { whatToTest }
+	};
+};
+const buildAndroidCreatePayload = (androidProfile) => {
+	if (androidProfile?.applicationId === void 0) return;
+	return {
+		applicationId: androidProfile.applicationId,
+		...androidProfile.track === void 0 ? {} : { track: androidProfile.track },
+		...androidProfile.releaseStatus === void 0 ? {} : { releaseStatus: androidProfile.releaseStatus },
+		...androidProfile.changesNotSentForReview === void 0 ? {} : { changesNotSentForReview: androidProfile.changesNotSentForReview },
+		...androidProfile.rollout === void 0 ? {} : { rollout: androidProfile.rollout }
+	};
+};
+const runFlow = (api, projectId, args) => Effect.gen(function* () {
+	const iosConfig = buildIosCreatePayload(args.easProfile.ios, args.whatToTest);
+	const androidConfig = buildAndroidCreatePayload(args.easProfile.android);
+	const submission = yield* createSubmissionViaApi(api, {
+		projectId,
+		platform: args.platform,
+		profileName: args.profile,
+		archiveSource: args.archive.archiveSource,
+		buildId: args.archive.buildId,
+		archiveUrl: args.archive.archiveUrl,
+		...iosConfig === void 0 ? {} : { iosConfig },
+		...androidConfig === void 0 ? {} : { androidConfig }
+	});
+	yield* printHuman(`Submission created: ${submission.id} (${submission.status})`);
+	if (args.platform === "ios" && iosConfig !== void 0) {
+		const ascApiKeyId = args.easProfile.ios?.ascApiKeyId;
+		if (ascApiKeyId === void 0) {
+			yield* printHuman("iOS submission queued. Resolve ascApiKeyId in eas.json submit profile to enable client-side altool upload.");
+			return submission;
+		}
+		yield* printHuman("Running xcrun altool upload locally...");
+		yield* runIosAltoolUpload({
+			api,
+			submissionId: submission.id,
+			ipaPath: args.archive.archiveUrl,
+			ascApiKeyId
+		});
+	}
+	if (args.platform === "android" && args.easProfile.android !== void 0) {
+		yield* printHuman("Uploading bundle to Google Play locally...");
+		const serviceAccountKeyId = args.serviceAccountKeyId ?? args.easProfile.android.serviceAccountKeyId;
+		yield* runAndroidGooglePlayUpload({
+			api,
+			submissionId: submission.id,
+			archive: {
+				source: args.archive.archiveSource,
+				value: args.archive.archiveUrl
+			},
+			androidProfile: args.easProfile.android,
+			serviceAccountKeyId
+		});
+	}
+	if (!args.wait) return submission;
+	const terminal = yield* pollSubmissionUntilTerminal(api, submission.id);
+	yield* printHuman(`Final status: ${terminal.status}`);
+	if (terminal.errorCode !== null) yield* printHuman(`Error ${terminal.errorCode}: ${terminal.errorMessage ?? "(no detail)"}`);
+	return terminal;
+});
+const submitCommand = defineCommand({
+	meta: {
+		name: "submit",
+		description: "Submit a build to App Store Connect or Google Play"
+	},
+	args: {
+		platform: {
+			type: "enum",
+			options: [...PLATFORMS],
+			description: "Target platform"
+		},
+		profile: {
+			type: "string",
+			default: "production",
+			description: "eas.json submit profile name (default: production)"
+		},
+		latest: {
+			type: "boolean",
+			description: "Submit the latest build for the platform"
+		},
+		id: {
+			type: "string",
+			description: "Submit a specific build by ID"
+		},
+		path: {
+			type: "string",
+			description: "Submit a local IPA/AAB at this path (URL or file://)"
+		},
+		url: {
+			type: "string",
+			description: "Submit a binary fetched from this URL"
+		},
+		"what-to-test": {
+			type: "string",
+			description: "iOS-only TestFlight changelog ('What to test')"
+		},
+		"service-account-key-id": {
+			type: "string",
+			description: "Android-only: better-update saved Google service account key ID (overrides eas.json submit profile)"
+		},
+		wait: {
+			type: "boolean",
+			default: true,
+			description: "Block until submission reaches a terminal status (default: true)"
+		}
+	},
+	run: async ({ args }) => runEffect(Effect.gen(function* () {
+		const { platform } = args;
+		if (platform === void 0) {
+			yield* printHuman("--platform is required (ios | android)");
+			return;
+		}
+		const projectId = yield* readProjectId;
+		const api = yield* apiClient;
+		const easProfile = yield* resolveEasSubmitProfile((yield* readEasJson(process.cwd())).submit, args.profile);
+		const archive = yield* resolveArchive(api, projectId, platform, {
+			id: args.id,
+			path: args.path,
+			url: args.url,
+			latest: args.latest ?? false
+		});
+		if (archive === null) {
+			yield* printHuman("No archive resolved. Pass one of --latest, --id, --path, or --url.");
+			return;
+		}
+		yield* runFlow(api, projectId, {
+			platform,
+			profile: args.profile,
+			easProfile,
+			archive,
+			...args["what-to-test"] === void 0 ? {} : { whatToTest: args["what-to-test"] },
+			...args["service-account-key-id"] === void 0 ? {} : { serviceAccountKeyId: args["service-account-key-id"] },
+			wait: args.wait
+		});
+	}))
+});
+
 //#endregion
 //#region src/commands/update/configure.ts
 const RUNTIME_POLICIES = ["appVersion", "fingerprint"];
@@ -15042,7 +16252,8 @@ await runMain(defineCommand({
 		webhooks: webhooksCommand,
 		autocomplete: autocompleteCommand,
 		"migrate-config": migrateConfigCommand,
-		apple: appleCommand
+		apple: appleCommand,
+		submit: submitCommand
 	}
 }));