ubriot 0.2.0

package/dist/index.js

@@ -0,0 +1,1650 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const commander_1 = require("commander");
+const readline_1 = require("./readline");
+const config_1 = require("./config");
+const api_1 = require("./api");
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const crypto_1 = require("crypto");
+commander_1.program.name("ubriot").description("Ubriot — self-hosted Expo release infrastructure").version("0.1.0");
+const MIME = {
+    ".avif": "image/avif",
+    ".bundle": "application/javascript",
+    ".gif": "image/gif",
+    ".heic": "image/heic",
+    ".jpeg": "image/jpeg",
+    ".jpg": "image/jpeg",
+    ".js": "application/javascript",
+    ".json": "application/json",
+    ".m4a": "audio/mp4",
+    ".mp3": "audio/mpeg",
+    ".mp4": "video/mp4",
+    ".otf": "font/otf",
+    ".png": "image/png",
+    ".ttf": "font/ttf",
+    ".webp": "image/webp",
+    ".wav": "audio/wav",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2",
+};
+function base64Url(buffer) {
+    return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function sha256Base64Url(buffer) {
+    return base64Url((0, crypto_1.createHash)("sha256").update(buffer).digest());
+}
+function sha256Hex(buffer) {
+    return (0, crypto_1.createHash)("sha256").update(buffer).digest("hex");
+}
+function md5Hex(buffer) {
+    return (0, crypto_1.createHash)("md5").update(buffer).digest("hex");
+}
+function readJsonFile(path) {
+    return JSON.parse((0, fs_1.readFileSync)(path, "utf8"));
+}
+function readExpoConfig(path = "app.json") {
+    const configPath = (0, path_1.resolve)(path);
+    if (!(0, fs_1.existsSync)(configPath))
+        return {};
+    const configJson = readJsonFile(configPath);
+    return configJson.expo ?? configJson;
+}
+function readExpoConfigFromPath(configPath) {
+    const configJson = readJsonFile(configPath);
+    return configJson.expo ?? configJson;
+}
+function hasExpoIdentity(config) {
+    return Boolean(config?.slug ||
+        config?.name ||
+        config?.ios?.bundleIdentifier ||
+        config?.android?.package ||
+        config?.runtimeVersion);
+}
+function scoreExpoConfigCandidate(config, filePath, rootDir, app) {
+    let score = hasExpoIdentity(config) ? 0 : -200;
+    const appNeedle = String(app ?? "").toLowerCase();
+    const slug = String(config?.slug ?? "").toLowerCase();
+    const pushSlug = String(config?.extra?.ubriot?.pushAppSlug ?? "").toLowerCase();
+    const loweredPath = filePath.toLowerCase();
+    if (appNeedle && (slug === appNeedle || pushSlug === appNeedle))
+        score += 500;
+    if (appNeedle && loweredPath.includes(`/${appNeedle}/`))
+        score += 80;
+    if (config?.ios?.bundleIdentifier)
+        score += 25;
+    if (config?.android?.package)
+        score += 25;
+    if ((0, fs_1.existsSync)((0, path_1.join)((0, path_1.dirname)(filePath), "google-services.json")))
+        score += 10;
+    const depthPenalty = (0, path_1.relative)(rootDir, filePath).split(/[\\/]/).length;
+    return score - depthPenalty;
+}
+function discoverExpoConfig(input) {
+    const rootDir = (0, path_1.resolve)(input.projectDir ?? process.cwd());
+    if (input.expoConfig) {
+        const configPath = (0, path_1.resolve)(rootDir, input.expoConfig);
+        if (!(0, fs_1.existsSync)(configPath))
+            throw new Error(`Expo config not found: ${configPath}`);
+        return { config: readExpoConfigFromPath(configPath), configPath, projectDir: (0, path_1.dirname)(configPath) };
+    }
+    const candidates = [];
+    const seen = new Set();
+    const skipDirs = new Set([".git", ".next", ".expo", "android", "build", "dist", "ios", "node_modules"]);
+    const collect = (configPath) => {
+        const resolved = (0, path_1.resolve)(configPath);
+        if (seen.has(resolved) || !(0, fs_1.existsSync)(resolved))
+            return;
+        seen.add(resolved);
+        try {
+            const config = readExpoConfigFromPath(resolved);
+            candidates.push({ config, configPath: resolved, score: scoreExpoConfigCandidate(config, resolved, rootDir, input.app) });
+        }
+        catch {
+            // Ignore app.json files that are not valid JSON.
+        }
+    };
+    collect((0, path_1.join)(rootDir, "app.json"));
+    const walk = (dir, depth) => {
+        if (depth <= 0)
+            return;
+        let entries;
+        try {
+            entries = (0, fs_1.readdirSync)(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const fullPath = (0, path_1.join)(dir, entry.name);
+            if (entry.isFile() && entry.name === "app.json")
+                collect(fullPath);
+            if (entry.isDirectory() && !skipDirs.has(entry.name))
+                walk(fullPath, depth - 1);
+        }
+    };
+    walk(rootDir, 5);
+    candidates.sort((a, b) => b.score - a.score);
+    const best = candidates[0];
+    if (!best || best.score < -100)
+        return { config: {}, configPath: undefined, projectDir: rootDir };
+    return { config: best.config, configPath: best.configPath, projectDir: (0, path_1.dirname)(best.configPath) };
+}
+function normalizePushPlatforms(platform) {
+    const value = String(platform ?? "all").toLowerCase();
+    if (value === "all")
+        return ["ios", "android"];
+    if (value === "ios" || value === "android")
+        return [value];
+    throw new Error("--platform must be ios, android, or all");
+}
+function findLocalFiles(rootDir, matches, maxDepth = 4) {
+    const results = [];
+    const skipDirs = new Set([".git", ".next", ".expo", "android", "build", "dist", "ios", "node_modules"]);
+    const walk = (dir, depth) => {
+        if (depth <= 0)
+            return;
+        let entries;
+        try {
+            entries = (0, fs_1.readdirSync)(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const fullPath = (0, path_1.join)(dir, entry.name);
+            if (entry.isFile() && matches(fullPath))
+                results.push(fullPath);
+            if (entry.isDirectory() && !skipDirs.has(entry.name))
+                walk(fullPath, depth - 1);
+        }
+    };
+    walk(rootDir, maxDepth);
+    return results;
+}
+function resolveExistingPath(filePath, baseDir = process.cwd()) {
+    if (!filePath)
+        return undefined;
+    const resolved = (0, path_1.resolve)(baseDir, filePath);
+    if (!(0, fs_1.existsSync)(resolved))
+        throw new Error(`File not found: ${resolved}`);
+    return resolved;
+}
+function looksLikeFirebaseServiceAccount(filePath) {
+    try {
+        const json = readJsonFile(filePath);
+        return (json?.type === "service_account" &&
+            typeof json.project_id === "string" &&
+            typeof json.private_key === "string" &&
+            typeof json.client_email === "string");
+    }
+    catch {
+        return false;
+    }
+}
+function findFirebaseServiceAccount(projectDir) {
+    const likelyNames = new Set([
+        "firebase-service-account.json",
+        "firebase-adminsdk.json",
+        "service-account.json",
+        "serviceAccount.json",
+    ]);
+    const candidates = findLocalFiles(projectDir, (filePath) => likelyNames.has((0, path_1.basename)(filePath)) || (0, path_1.basename)(filePath).endsWith("-firebase-adminsdk.json"), 4);
+    return candidates.find(looksLikeFirebaseServiceAccount);
+}
+function findApnsKeyP8(projectDir) {
+    const candidates = findLocalFiles(projectDir, (filePath) => (0, path_1.extname)(filePath).toLowerCase() === ".p8", 4);
+    const authKey = candidates.find((filePath) => /^AuthKey_[A-Za-z0-9]+\.p8$/.test((0, path_1.basename)(filePath)));
+    return authKey ?? (candidates.length === 1 ? candidates[0] : undefined);
+}
+function inferApnsKeyId(filePath) {
+    if (!filePath)
+        return undefined;
+    const match = (0, path_1.basename)(filePath).match(/^AuthKey_([A-Za-z0-9]+)\.p8$/);
+    return match?.[1];
+}
+async function promptRequired(label, value, option) {
+    if (value)
+        return value;
+    if (!process.stdin.isTTY)
+        throw new Error(`Missing ${label}. Pass ${option}.`);
+    const answer = (await (0, readline_1.readlineSync)(`${label}: `)).trim();
+    if (!answer)
+        throw new Error(`Missing ${label}. Pass ${option}.`);
+    return answer;
+}
+async function promptOptionalPath(label, value, option, baseDir) {
+    if (value)
+        return resolveExistingPath(value, baseDir);
+    if (!process.stdin.isTTY)
+        return undefined;
+    const answer = (await (0, readline_1.readlineSync)(`${label} (leave blank to skip): `)).trim();
+    if (!answer)
+        return undefined;
+    return resolveExistingPath(answer, baseDir);
+}
+function resolveAppSlug(app, expoConfig) {
+    const slug = app ?? expoConfig.slug;
+    if (!slug)
+        throw new Error("No app specified. Pass --app <appSlug> or run from an Expo app with expo.slug in app.json.");
+    return slug;
+}
+function resolveRuntimeVersion(runtimeVersion, expoConfig) {
+    const runtime = runtimeVersion ?? expoConfig.runtimeVersion;
+    if (!runtime)
+        throw new Error("No runtime version specified. Pass --runtime-version <version> or set runtimeVersion in app.json.");
+    if (typeof runtime === "string")
+        return runtime;
+    if (runtime.policy)
+        throw new Error("Runtime version policies must be resolved before publishing. Pass --runtime-version <version>.");
+    throw new Error("Unsupported runtimeVersion in app.json. Pass --runtime-version <version>.");
+}
+function optionalGitShortSha() {
+    const result = (0, child_process_1.spawnSync)("git", ["rev-parse", "--short", "HEAD"], { encoding: "utf8" });
+    if (result.status !== 0)
+        return undefined;
+    return result.stdout.trim() || undefined;
+}
+function runLocalCommand(command, args) {
+    const result = (0, child_process_1.spawnSync)(command, args, { stdio: "inherit", env: process.env });
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0)
+        throw new Error(`${command} ${args.join(" ")} failed with exit code ${result.status ?? "unknown"}`);
+}
+function contentTypeFor(filePath, fallback = "application/octet-stream") {
+    return MIME[(0, path_1.extname)(filePath).toLowerCase()] ?? fallback;
+}
+const BUILD_TERMINAL_STATUSES = new Set(["succeeded", "failed", "cancelled"]);
+const ASC_TERMINAL_STATUSES = new Set(["succeeded", "failed"]);
+const PLAY_TERMINAL_STATUSES = new Set(["succeeded", "failed"]);
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function parsePositiveNumber(value, fallback, label) {
+    if (value === undefined)
+        return fallback;
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        throw new Error(`${label} must be a positive number`);
+    return parsed;
+}
+function buildStatusLine(build) {
+    const asc = build.ascSubmissionStatus ? `, TestFlight ${build.ascSubmissionStatus}` : "";
+    const play = build.playSubmissionStatus ? `, Google Play ${build.playSubmissionStatus}` : "";
+    const processing = build.ascProcessingState ? ` (${build.ascProcessingState})` : "";
+    return `Build #${build.id}: ${build.status}${asc}${play}${processing}`;
+}
+async function waitForBuild(client, buildId, intervalMs, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    let lastLine = "";
+    while (Date.now() <= deadline) {
+        const { data } = await client.get(`/ubriot/builds/${buildId}`);
+        const line = buildStatusLine(data);
+        if (line !== lastLine) {
+            console.log(line);
+            lastLine = line;
+        }
+        if (BUILD_TERMINAL_STATUSES.has(data.status)) {
+            if (data.status === "succeeded")
+                return data;
+            throw new Error(`Build #${buildId} ${data.status}${data.errorMessage ? `: ${data.errorMessage}` : ""}`);
+        }
+        await sleep(intervalMs);
+    }
+    throw new Error(`Timed out waiting for build #${buildId}`);
+}
+async function resolveReleaseApp(client, appIdOrSlug) {
+    const value = String(appIdOrSlug ?? "").trim();
+    if (!value)
+        throw new Error("No app specified. Pass --app <appIdOrSlug>.");
+    if (/^\d+$/.test(value)) {
+        const { data } = await client.get(`/ubriot/apps/${value}`);
+        return data;
+    }
+    const { data } = await client.get("/ubriot/apps");
+    const matches = data.filter((app) => app.slug === value || app.name.toLowerCase() === value.toLowerCase());
+    if (matches.length === 1)
+        return matches[0];
+    if (matches.length > 1)
+        throw new Error(`Multiple apps match "${value}". Pass the numeric app id instead.`);
+    throw new Error(`App "${value}" not found. Run: ubriot apps list`);
+}
+async function queueTestFlightIfNeeded(client, build) {
+    if (build.platform !== "ios")
+        throw new Error("--submit-testflight is only valid for iOS builds");
+    if (build.ascSubmissionStatus === "succeeded") {
+        console.log(`Build #${build.id} was already submitted to TestFlight.`);
+        return build;
+    }
+    if (build.ascSubmissionStatus === "queued" || build.ascSubmissionStatus === "running") {
+        console.log(`Build #${build.id} already has TestFlight submission ${build.ascSubmissionStatus}.`);
+        return build;
+    }
+    const { data } = await client.post(`/ubriot/builds/${build.id}/submit-testflight`);
+    console.log(`Build #${build.id} queued for TestFlight submit.`);
+    return data;
+}
+async function waitForTestFlight(client, buildId, intervalMs, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    let lastLine = "";
+    while (Date.now() <= deadline) {
+        const { data } = await client.get(`/ubriot/builds/${buildId}`);
+        const status = data.ascSubmissionStatus ?? "not queued";
+        const processing = data.ascProcessingState ? ` (${data.ascProcessingState})` : "";
+        const line = `TestFlight #${buildId}: ${status}${processing}`;
+        if (line !== lastLine) {
+            console.log(line);
+            lastLine = line;
+        }
+        if (ASC_TERMINAL_STATUSES.has(status)) {
+            if (status === "succeeded")
+                return data;
+            throw new Error(`TestFlight submit for build #${buildId} failed${data.ascSubmissionError ? `: ${data.ascSubmissionError}` : ""}`);
+        }
+        await sleep(intervalMs);
+    }
+    throw new Error(`Timed out waiting for TestFlight submit for build #${buildId}`);
+}
+async function queueGooglePlayIfNeeded(client, build, track) {
+    if (build.platform !== "android")
+        throw new Error("--submit-google-play is only valid for Android builds");
+    if (build.playSubmissionStatus === "succeeded") {
+        console.log(`Build #${build.id} was already submitted to Google Play.`);
+        return build;
+    }
+    if (build.playSubmissionStatus === "queued" || build.playSubmissionStatus === "running") {
+        console.log(`Build #${build.id} already has Google Play submission ${build.playSubmissionStatus}.`);
+        return build;
+    }
+    const { data } = await client.post(`/ubriot/builds/${build.id}/submit-google-play`, track ? { track } : {});
+    console.log(`Build #${build.id} queued for Google Play submit.`);
+    return data;
+}
+async function waitForGooglePlay(client, buildId, intervalMs, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    let lastLine = "";
+    while (Date.now() <= deadline) {
+        const { data } = await client.get(`/ubriot/builds/${buildId}`);
+        const status = data.playSubmissionStatus ?? "not queued";
+        const track = data.playTrack ? ` (${data.playTrack})` : "";
+        const version = data.playVersionCode ? ` version ${data.playVersionCode}` : "";
+        const line = `Google Play #${buildId}: ${status}${track}${version}`;
+        if (line !== lastLine) {
+            console.log(line);
+            lastLine = line;
+        }
+        if (PLAY_TERMINAL_STATUSES.has(status)) {
+            if (status === "succeeded")
+                return data;
+            throw new Error(`Google Play submit for build #${buildId} failed${data.playSubmissionError ? `: ${data.playSubmissionError}` : ""}`);
+        }
+        await sleep(intervalMs);
+    }
+    throw new Error(`Timed out waiting for Google Play submit for build #${buildId}`);
+}
+function sanitizePart(value) {
+    return value.replace(/[^A-Za-z0-9._-]/g, "-").slice(0, 80);
+}
+function updateAssetUrl(assetKey, publicApiBase) {
+    return `${publicApiBase.replace(/\/$/, "")}/ubriot/updates/assets/${encodeURIComponent(assetKey)}`;
+}
+async function uploadOtaFile(client, app, assetKey, filePath, contentType, publicApiBase) {
+    const buffer = (0, fs_1.readFileSync)(filePath);
+    const { data } = await client.put(`/ubriot/apps/${encodeURIComponent(app)}/updates/assets`, buffer, {
+        params: { assetKey, fileName: (0, path_1.basename)(filePath) },
+        headers: {
+            "Content-Type": contentType,
+            "Content-Length": String(buffer.length),
+        },
+        maxBodyLength: Infinity,
+        maxContentLength: Infinity,
+        timeout: 120000,
+    });
+    return {
+        assetKey,
+        storagePath: data.storagePath,
+        fileName: (0, path_1.basename)(filePath),
+        contentType,
+        sizeBytes: (0, fs_1.statSync)(filePath).size,
+        sha256: sha256Hex(buffer),
+        manifestAsset: {
+            hash: sha256Base64Url(buffer),
+            key: md5Hex(buffer),
+            fileExtension: "",
+            contentType,
+            url: updateAssetUrl(assetKey, publicApiBase),
+        },
+    };
+}
+async function buildOtaPlatformPayload(input) {
+    const platformMetadata = input.metadataJson.fileMetadata?.[input.platform];
+    if (!platformMetadata?.bundle)
+        return null;
+    const uploadedAssets = [];
+    const uploadedForDb = [];
+    const uploadOne = async (relativePath, ext, isLaunchAsset) => {
+        const filePath = (0, path_1.resolve)(input.exportDir, relativePath);
+        if (!(0, fs_1.existsSync)(filePath))
+            throw new Error(`Expo export file missing: ${filePath}`);
+        const buffer = (0, fs_1.readFileSync)(filePath);
+        const fileHash = md5Hex(buffer);
+        const suffix = isLaunchAsset ? "bundle" : (ext ?? ((0, path_1.extname)(filePath).replace(/^\./, "") || "asset"));
+        const assetKey = [
+            sanitizePart(input.app),
+            sanitizePart(input.runtimeVersion),
+            input.platform,
+            input.publishId,
+            fileHash,
+            suffix,
+        ].join(".");
+        const contentType = isLaunchAsset ? "application/javascript" : contentTypeFor(filePath);
+        const uploaded = await uploadOtaFile(input.client, input.app, assetKey, filePath, contentType, input.publicApiBase);
+        uploaded.manifestAsset.fileExtension = `.${isLaunchAsset ? "bundle" : suffix}`;
+        uploadedForDb.push({
+            assetKey: uploaded.assetKey,
+            storagePath: uploaded.storagePath,
+            fileName: uploaded.fileName,
+            contentType: uploaded.contentType,
+            sizeBytes: uploaded.sizeBytes,
+            sha256: uploaded.sha256,
+        });
+        return uploaded.manifestAsset;
+    };
+    for (const asset of platformMetadata.assets ?? []) {
+        uploadedAssets.push(await uploadOne(asset.path, asset.ext, false));
+    }
+    const launchAsset = await uploadOne(platformMetadata.bundle, null, true);
+    const manifest = {
+        id: (0, crypto_1.randomUUID)(),
+        createdAt: new Date().toISOString(),
+        runtimeVersion: input.runtimeVersion,
+        assets: uploadedAssets,
+        launchAsset,
+        metadata: {
+            updateId: input.publishId,
+            message: input.message ?? null,
+        },
+        extra: {
+            expoClient: input.expoConfig,
+        },
+    };
+    return {
+        platform: input.platform,
+        manifestJson: JSON.stringify(manifest),
+        assets: uploadedForDb,
+    };
+}
+async function publishExportedUpdate(input) {
+    const exportDir = (0, path_1.resolve)(input.exportDir);
+    const metadataPath = (0, path_1.join)(exportDir, "metadata.json");
+    if (!(0, fs_1.existsSync)(metadataPath))
+        throw new Error(`No metadata.json found in ${exportDir}. Run: npx expo export --output-dir ${input.exportDir}`);
+    const metadataJson = readJsonFile(metadataPath);
+    const expoConfig = readExpoConfig(input.expoConfigPath);
+    const publishId = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+    const selectedPlatforms = input.platform === "all" ? ["ios", "android"] : [input.platform];
+    const platforms = [];
+    for (const platform of selectedPlatforms) {
+        if (platform !== "ios" && platform !== "android")
+            throw new Error("--platform must be ios, android, or all");
+        const payload = await buildOtaPlatformPayload({
+            client: input.client,
+            app: input.app,
+            exportDir,
+            publishId,
+            platform,
+            runtimeVersion: input.runtimeVersion,
+            message: input.message,
+            expoConfig,
+            metadataJson,
+            publicApiBase: input.publicApiBase,
+        });
+        if (payload)
+            platforms.push(payload);
+    }
+    if (!platforms.length)
+        throw new Error(`No ${input.platform} bundle found in ${exportDir}.`);
+    const { data } = await input.client.post(`/ubriot/apps/${encodeURIComponent(input.app)}/updates`, {
+        channel: input.channel,
+        runtimeVersion: input.runtimeVersion,
+        message: input.message,
+        platforms,
+    }, { timeout: 120000 });
+    return { data, platforms };
+}
+// ─── Auth ────────────────────────────────────────────────────────────────────
+commander_1.program
+    .command("login")
+    .description("Log in with your Ubriot credentials")
+    .option("--api-base <url>", "API base URL")
+    .action(async (opts) => {
+    if (opts.apiBase)
+        (0, config_1.writeConfig)({ apiBase: opts.apiBase });
+    const email = await (0, readline_1.readlineSync)("Email: ");
+    const password = await (0, readline_1.readlineSync)("Password: ", true);
+    try {
+        const client = (0, api_1.makeClient)();
+        const { data } = await client.post("/auth/login", { email, password });
+        const token = data?.user?.token;
+        if (!token)
+            throw new Error("No token in response");
+        (0, config_1.writeConfig)({ token, email });
+        console.log(`Logged in as ${email}`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+commander_1.program
+    .command("logout")
+    .description("Clear saved credentials")
+    .action(() => {
+    (0, config_1.writeConfig)({ token: null, email: null });
+    console.log("Logged out.");
+});
+commander_1.program
+    .command("whoami")
+    .description("Show current user")
+    .action(() => {
+    const cfg = (0, config_1.readConfig)();
+    if (cfg.email)
+        console.log(cfg.email);
+    else
+        console.log("Not logged in.");
+});
+// ─── Apps ────────────────────────────────────────────────────────────────────
+const apps = commander_1.program.command("apps").description("Manage release apps");
+apps
+    .command("create")
+    .description("Create a new release app")
+    .requiredOption("--name <name>")
+    .requiredOption("--slug <slug>")
+    .option("--repo <url>", "Git repository URL")
+    .option("--branch <branch>", "Default branch", "main")
+    .option("--android-id <id>", "Android application ID")
+    .option("--ios-bundle <id>", "iOS bundle identifier")
+    .option("--google-play-track <track>", "Default Google Play track", "internal")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const { data } = await (0, api_1.makeClient)().post("/ubriot/apps", {
+            name: opts.name,
+            slug: opts.slug,
+            repoUrl: opts.repo,
+            defaultBranch: opts.branch,
+            androidApplicationId: opts.androidId,
+            iosBundleIdentifier: opts.iosBundle,
+            googlePlayTrack: opts.googlePlayTrack,
+        });
+        console.log(`Created app: ${data.name} (id: ${data.id}, slug: ${data.slug})`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+apps
+    .command("list")
+    .description("List your release apps")
+    .action(async () => {
+    (0, config_1.requireAuth)();
+    try {
+        const { data } = await (0, api_1.makeClient)().get("/ubriot/apps");
+        if (!data.length) {
+            console.log("No apps yet.");
+            return;
+        }
+        for (const a of data) {
+            const asc = a.appStoreConnectAppId ? ` ascApp=${a.appStoreConnectAppId}` : "";
+            const auto = a.autoSubmitTestflight ? " autoSubmit" : "";
+            console.log(`  ${a.id}  ${a.slug.padEnd(30)} ${a.name}${asc}${auto}`);
+        }
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+apps
+    .command("update")
+    .description("Update release app settings (TestFlight mapping, auto-submit)")
+    .requiredOption("--app <appId>", "Release app id")
+    .option("--ios-bundle <id>", "iOS bundle identifier")
+    .option("--android-id <id>", "Android application ID / package name")
+    .option("--asc-app-id <id>", "App Store Connect app id (from ASC app URL)")
+    .option("--clear-asc-app-id", "Remove stored ASC app id (use bundle id lookup)", false)
+    .option("--auto-submit-testflight", "Enable auto-submit after each successful iOS build", false)
+    .option("--no-auto-submit-testflight", "Disable auto-submit", false)
+    .option("--google-play-track <track>", "Default Google Play track, e.g. internal, alpha, beta, production")
+    .option("--auto-submit-google-play", "Enable auto-submit to Google Play after each successful Android build", false)
+    .option("--no-auto-submit-google-play", "Disable Google Play auto-submit", false)
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const body = {};
+        if (opts.iosBundle !== undefined)
+            body.iosBundleIdentifier = opts.iosBundle || null;
+        if (opts.androidId !== undefined)
+            body.androidApplicationId = opts.androidId || null;
+        if (opts.clearAscAppId)
+            body.appStoreConnectAppId = null;
+        else if (opts.ascAppId !== undefined)
+            body.appStoreConnectAppId = opts.ascAppId;
+        if (opts.autoSubmitTestflight)
+            body.autoSubmitTestflight = true;
+        if (opts.noAutoSubmitTestflight)
+            body.autoSubmitTestflight = false;
+        if (opts.googlePlayTrack !== undefined)
+            body.googlePlayTrack = opts.googlePlayTrack || null;
+        if (opts.autoSubmitGooglePlay)
+            body.autoSubmitGooglePlay = true;
+        if (opts.noAutoSubmitGooglePlay)
+            body.autoSubmitGooglePlay = false;
+        if (!Object.keys(body).length) {
+            console.log("Nothing to update — pass --ios-bundle, --android-id, --asc-app-id, --google-play-track, and/or auto-submit flags");
+            return;
+        }
+        const { data } = await (0, api_1.makeClient)().patch(`/ubriot/apps/${opts.app}`, body);
+        console.log(`Updated app #${data.id} ${data.slug}`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+// ─── Releases ────────────────────────────────────────────────────────────────
+commander_1.program
+    .command("ship <platform>")
+    .description("Build and submit a store release")
+    .option("--app <appIdOrSlug>", "App ID or slug; defaults to expo.slug from app.json")
+    .option("--profile <profile>", "Build profile", "production")
+    .option("--repo <url>", "Override repo URL")
+    .option("--branch <branch>", "Branch to build")
+    .option("--track <track>", "Google Play track for Android", "internal")
+    .option("--no-submit", "Build only; do not submit to TestFlight / Google Play")
+    .option("--poll-interval <seconds>", "Polling interval while waiting", "15")
+    .option("--timeout <minutes>", "Maximum wait time for the build and store submit", "180")
+    .action(async (platform, opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const normalizedPlatform = String(platform).toLowerCase();
+        if (normalizedPlatform !== "ios" && normalizedPlatform !== "android") {
+            throw new Error("Use: ubriot ship ios or ubriot ship android");
+        }
+        if (normalizedPlatform === "android" && opts.submit !== false && opts.profile === "preview") {
+            throw new Error("Google Play submission requires a production AAB. Use --no-submit for preview Android builds.");
+        }
+        const expoConfig = readExpoConfig();
+        const app = resolveAppSlug(opts.app, expoConfig);
+        const client = (0, api_1.makeClient)();
+        const pollIntervalMs = parsePositiveNumber(opts.pollInterval, 15, "--poll-interval") * 1000;
+        const timeoutMs = parsePositiveNumber(opts.timeout, 180, "--timeout") * 60 * 1000;
+        const { data } = await client.post(`/ubriot/apps/${encodeURIComponent(app)}/builds`, {
+            platform: normalizedPlatform,
+            profile: opts.profile,
+            repoUrl: opts.repo,
+            branch: opts.branch,
+        });
+        console.log(`Queued build #${data.id} (${data.platform} / ${data.profile}) — status: ${data.status}`);
+        const finished = await waitForBuild(client, data.id, pollIntervalMs, timeoutMs);
+        if (opts.submit === false)
+            return;
+        if (normalizedPlatform === "ios") {
+            const submitted = await queueTestFlightIfNeeded(client, finished);
+            await waitForTestFlight(client, submitted.id, pollIntervalMs, timeoutMs);
+            console.log(`Build #${submitted.id} is valid in TestFlight.`);
+        }
+        else {
+            const submitted = await queueGooglePlayIfNeeded(client, finished, opts.track);
+            await waitForGooglePlay(client, submitted.id, pollIntervalMs, timeoutMs);
+            console.log(`Build #${submitted.id} was submitted to Google Play track "${submitted.playTrack ?? opts.track}".`);
+        }
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+// ─── Builds ──────────────────────────────────────────────────────────────────
+const builds = commander_1.program.command("builds").description("Manage builds");
+builds
+    .command("create")
+    .description("Queue a build")
+    .requiredOption("--app <appId>", "App ID or slug")
+    .requiredOption("--platform <platform>", "android | ios | web")
+    .option("--profile <profile>", "Build profile", "production")
+    .option("--repo <url>", "Override repo URL")
+    .option("--branch <branch>", "Branch to build")
+    .option("--wait", "Wait until the build reaches a terminal state", false)
+    .option("--submit-testflight", "For iOS: wait for the build, submit to TestFlight, and wait for App Store Connect", false)
+    .option("--submit-google-play", "For Android: wait for the build, submit to Google Play, and wait for commit", false)
+    .option("--track <track>", "Google Play track for --submit-google-play", "internal")
+    .option("--poll-interval <seconds>", "Polling interval while waiting", "15")
+    .option("--timeout <minutes>", "Maximum wait time for the build and store submit", "180")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const client = (0, api_1.makeClient)();
+        const pollIntervalMs = parsePositiveNumber(opts.pollInterval, 15, "--poll-interval") * 1000;
+        const timeoutMs = parsePositiveNumber(opts.timeout, 180, "--timeout") * 60 * 1000;
+        const shouldWait = Boolean(opts.wait || opts.submitTestflight || opts.submitGooglePlay);
+        if (opts.submitTestflight && opts.platform !== "ios") {
+            throw new Error("--submit-testflight can only be used with --platform ios");
+        }
+        if (opts.submitGooglePlay && opts.platform !== "android") {
+            throw new Error("--submit-google-play can only be used with --platform android");
+        }
+        if (opts.submitGooglePlay && opts.profile === "preview") {
+            throw new Error("--submit-google-play requires a production AAB. Use --wait without --submit-google-play for preview Android builds.");
+        }
+        const { data } = await client.post(`/ubriot/apps/${opts.app}/builds`, {
+            platform: opts.platform,
+            profile: opts.profile,
+            repoUrl: opts.repo,
+            branch: opts.branch,
+        });
+        console.log(`Queued build #${data.id} (${data.platform} / ${data.profile}) — status: ${data.status}`);
+        if (!shouldWait) {
+            if (data.platform === "ios") {
+                console.log(`To submit after it succeeds: ubriot builds submit-testflight ${data.id}`);
+            }
+            if (data.platform === "android") {
+                console.log(`To submit after it succeeds: ubriot builds submit-google-play ${data.id}`);
+            }
+            return;
+        }
+        const finished = await waitForBuild(client, data.id, pollIntervalMs, timeoutMs);
+        if (opts.submitGooglePlay) {
+            const submitted = await queueGooglePlayIfNeeded(client, finished, opts.track);
+            await waitForGooglePlay(client, submitted.id, pollIntervalMs, timeoutMs);
+            console.log(`Build #${submitted.id} was submitted to Google Play track "${submitted.playTrack ?? opts.track}".`);
+            return;
+        }
+        if (!opts.submitTestflight)
+            return;
+        const submitted = await queueTestFlightIfNeeded(client, finished);
+        await waitForTestFlight(client, submitted.id, pollIntervalMs, timeoutMs);
+        console.log(`Build #${submitted.id} is valid in TestFlight.`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+builds
+    .command("list")
+    .description("List recent builds")
+    .option("--app <appId>", "Filter by app ID")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const url = opts.app ? `/ubriot/apps/${opts.app}/builds` : "/ubriot/builds";
+        const { data } = await (0, api_1.makeClient)().get(url);
+        if (!data.length) {
+            console.log("No builds found.");
+            return;
+        }
+        for (const b of data) {
+            const asc = b.ascSubmissionStatus ? ` asc:${b.ascSubmissionStatus}` : "";
+            console.log(`  #${String(b.id).padEnd(5)} ${b.platform.padEnd(10)} ${b.profile.padEnd(15)} ${b.status.padEnd(25)}${asc} ${b.createdAt}`);
+        }
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+builds
+    .command("show <buildId>")
+    .description("Show build details")
+    .action(async (buildId) => {
+    (0, config_1.requireAuth)();
+    try {
+        const { data } = await (0, api_1.makeClient)().get(`/ubriot/builds/${buildId}`);
+        console.log(JSON.stringify(data, null, 2));
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+builds
+    .command("logs <buildId>")
+    .description("Show build logs")
+    .action(async (buildId) => {
+    (0, config_1.requireAuth)();
+    try {
+        const { data } = await (0, api_1.makeClient)().get(`/ubriot/builds/${buildId}/logs`);
+        for (const l of data)
+            process.stdout.write(`[${l.phase ?? "-"}] ${l.message}`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+builds
+    .command("cancel <buildId>")
+    .description("Cancel a queued/running build")
+    .action(async (buildId) => {
+    (0, config_1.requireAuth)();
+    try {
+        await (0, api_1.makeClient)().post(`/ubriot/builds/${buildId}/cancel`);
+        console.log(`Build #${buildId} cancelled.`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+builds
+    .command("retry-upload <buildId>")
+    .description("Retry only the artifact upload stage for a failed mobile build")
+    .action(async (buildId) => {
+    (0, config_1.requireAuth)();
+    try {
+        await (0, api_1.makeClient)().post(`/ubriot/builds/${buildId}/retry-upload`);
+        console.log(`Build #${buildId} queued for upload retry.`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+builds
+    .command("submit-testflight <buildId>")
+    .description("Queue upload of the build .ipa to App Store Connect (TestFlight); requires ASC API key on the app")
+    .action(async (buildId) => {
+    (0, config_1.requireAuth)();
+    try {
+        const { data } = await (0, api_1.makeClient)().post(`/ubriot/builds/${buildId}/submit-testflight`);
+        console.log(`Build #${buildId} queued for TestFlight submit — ascSubmissionStatus: ${data.ascSubmissionStatus}`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+builds
+    .command("reset-testflight <buildId>")
+    .description("Clear a queued or running TestFlight submission so you can retry or unstick after a worker crash")
+    .action(async (buildId) => {
+    (0, config_1.requireAuth)();
+    try {
+        await (0, api_1.makeClient)().post(`/ubriot/builds/${buildId}/reset-testflight-submit`);
+        console.log(`Build #${buildId}: TestFlight submission reset.`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+builds
+    .command("submit-google-play <buildId>")
+    .description("Queue upload of the Android .aab to Google Play; requires a Google service account on the app")
+    .option("--track <track>", "Google Play track", "internal")
+    .action(async (buildId, opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const { data } = await (0, api_1.makeClient)().post(`/ubriot/builds/${buildId}/submit-google-play`, { track: opts.track });
+        console.log(`Build #${buildId} queued for Google Play submit — playSubmissionStatus: ${data.playSubmissionStatus}`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+builds
+    .command("reset-google-play <buildId>")
+    .description("Clear a queued or running Google Play submission so you can retry")
+    .action(async (buildId) => {
+    (0, config_1.requireAuth)();
+    try {
+        await (0, api_1.makeClient)().post(`/ubriot/builds/${buildId}/reset-google-play-submit`);
+        console.log(`Build #${buildId}: Google Play submission reset.`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+builds
+    .command("artifacts <buildId>")
+    .description("List artifacts for a build")
+    .action(async (buildId) => {
+    (0, config_1.requireAuth)();
+    try {
+        const { data } = await (0, api_1.makeClient)().get(`/ubriot/builds/${buildId}/artifacts`);
+        if (!data.length) {
+            console.log("No artifacts yet.");
+            return;
+        }
+        for (const a of data)
+            console.log(`  #${a.id}  ${a.kind.padEnd(10)} ${a.fileName}  (${a.sizeBytes} bytes)`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+// ─── Credentials ─────────────────────────────────────────────────────────────
+const creds = commander_1.program.command("credentials").description("Manage signing credentials");
+creds
+    .command("upload-android")
+    .description("Upload an Android keystore credential")
+    .requiredOption("--app <appId>")
+    .requiredOption("--name <name>")
+    .requiredOption("--keystore <path>", "Path to .keystore or .jks file")
+    .requiredOption("--keystore-password <pwd>")
+    .requiredOption("--key-alias <alias>")
+    .requiredOption("--key-password <pwd>")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const keystoreBase64 = (0, fs_1.readFileSync)(opts.keystore).toString("base64");
+        const { data } = await (0, api_1.makeClient)().post(`/ubriot/apps/${opts.app}/credentials`, {
+            platform: "android",
+            kind: "android-keystore",
+            name: opts.name,
+            payload: {
+                keystoreBase64,
+                keystorePassword: opts.keystorePassword,
+                keyAlias: opts.keyAlias,
+                keyPassword: opts.keyPassword,
+            },
+        });
+        console.log(`Credential created: #${data.id} "${data.name}"`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+creds
+    .command("upload-google-service-account")
+    .description("Upload a Google Play service account JSON key (for Android internal/track submit)")
+    .requiredOption("--app <appId>")
+    .requiredOption("--name <name>")
+    .requiredOption("--json <path>", "Path to Google service account JSON")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const serviceAccountJsonBase64 = (0, fs_1.readFileSync)(opts.json).toString("base64");
+        const { data } = await (0, api_1.makeClient)().post(`/ubriot/apps/${opts.app}/credentials`, {
+            platform: "android",
+            kind: "google-service-account",
+            name: opts.name,
+            payload: { serviceAccountJsonBase64 },
+        });
+        console.log(`Google Play service account credential created: #${data.id} "${data.name}"`);
+        console.log(`Ready to ship — run: ubriot ship android`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+creds
+    .command("upload-apns-key")
+    .description("Upload an APNs auth key for native iOS push notifications")
+    .requiredOption("--app <appId>")
+    .requiredOption("--name <name>")
+    .requiredOption("--key-id <id>", "APNs key ID from Apple Developer")
+    .requiredOption("--team-id <id>", "Apple Developer Team ID")
+    .requiredOption("--bundle-id <id>", "iOS bundle identifier (e.g. com.company.app)")
+    .requiredOption("--key-p8 <path>", "Path to the APNs .p8 private key file")
+    .option("--environment <env>", "APNs environment: production or sandbox", "production")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const environment = String(opts.environment).toLowerCase();
+        if (environment !== "production" && environment !== "sandbox") {
+            throw new Error("--environment must be production or sandbox");
+        }
+        const privateKeyP8Base64 = (0, fs_1.readFileSync)(opts.keyP8).toString("base64");
+        const { data } = await (0, api_1.makeClient)().post(`/ubriot/apps/${opts.app}/credentials`, {
+            platform: "ios",
+            kind: "apns-auth-key",
+            name: opts.name,
+            payload: {
+                keyId: opts.keyId,
+                teamId: opts.teamId,
+                bundleId: opts.bundleId,
+                privateKeyP8Base64,
+                environment,
+            },
+        });
+        console.log(`APNs push credential created: #${data.id} "${data.name}"`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+creds
+    .command("upload-firebase-service-account")
+    .description("Upload a Firebase service account JSON key for native Android push notifications")
+    .requiredOption("--app <appId>")
+    .requiredOption("--name <name>")
+    .requiredOption("--json <path>", "Path to Firebase service account JSON")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const serviceAccountJsonBase64 = (0, fs_1.readFileSync)(opts.json).toString("base64");
+        const { data } = await (0, api_1.makeClient)().post(`/ubriot/apps/${opts.app}/credentials`, {
+            platform: "android",
+            kind: "firebase-service-account",
+            name: opts.name,
+            payload: { serviceAccountJsonBase64 },
+        });
+        console.log(`Firebase push credential created: #${data.id} "${data.name}"`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+creds
+    .command("list")
+    .description("List credentials for an app")
+    .requiredOption("--app <appId>")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const { data } = await (0, api_1.makeClient)().get(`/ubriot/apps/${opts.app}/credentials`);
+        if (!data.length) {
+            console.log("No credentials.");
+            return;
+        }
+        for (const c of data)
+            console.log(`  #${c.id}  ${c.kind.padEnd(35)} ${c.name}`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+creds
+    .command("upload-ios-cert")
+    .description("Upload an iOS distribution certificate (.p12)")
+    .requiredOption("--app <appId>")
+    .requiredOption("--name <name>", "A label for this credential")
+    .requiredOption("--p12 <path>", "Path to the .p12 certificate file")
+    .requiredOption("--p12-password <pwd>", "Password to unlock the .p12")
+    .requiredOption("--team-id <id>", "Apple Developer Team ID (10-char alphanumeric)")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const p12Base64 = (0, fs_1.readFileSync)(opts.p12).toString("base64");
+        const { data } = await (0, api_1.makeClient)().post(`/ubriot/apps/${opts.app}/credentials`, {
+            platform: "ios",
+            kind: "ios-distribution-certificate",
+            name: opts.name,
+            payload: {
+                p12Base64,
+                p12Password: opts.p12Password,
+                teamId: opts.teamId,
+            },
+        });
+        console.log(`iOS certificate credential created: #${data.id} "${data.name}"`);
+        console.log(`Team ID: ${opts.teamId}`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+creds
+    .command("upload-ios-profile")
+    .description("Upload an iOS provisioning profile (.mobileprovision)")
+    .requiredOption("--app <appId>")
+    .requiredOption("--name <name>", "Must match the profile name exactly in Apple Developer portal")
+    .requiredOption("--profile <path>", "Path to the .mobileprovision file")
+    .requiredOption("--bundle-id <id>", "iOS bundle identifier (e.g. com.company.app)")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const mobileProvisionBase64 = (0, fs_1.readFileSync)(opts.profile).toString("base64");
+        const { data } = await (0, api_1.makeClient)().post(`/ubriot/apps/${opts.app}/credentials`, {
+            platform: "ios",
+            kind: "ios-provisioning-profile",
+            name: opts.name,
+            payload: {
+                mobileProvisionBase64,
+                name: opts.name,
+                bundleIdentifier: opts.bundleId,
+            },
+        });
+        console.log(`iOS provisioning profile credential created: #${data.id} "${data.name}"`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+creds
+    .command("upload-asc-key")
+    .description("Upload an App Store Connect API key (for TestFlight / store submission)")
+    .requiredOption("--app <appId>")
+    .requiredOption("--name <name>")
+    .requiredOption("--key-id <id>", "Key ID from App Store Connect")
+    .requiredOption("--issuer-id <id>", "Issuer ID from App Store Connect")
+    .requiredOption("--key-p8 <path>", "Path to the .p8 private key file")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const privateKeyP8Base64 = (0, fs_1.readFileSync)(opts.keyP8).toString("base64");
+        const { data } = await (0, api_1.makeClient)().post(`/ubriot/apps/${opts.app}/credentials`, {
+            platform: "ios",
+            kind: "app-store-connect-api-key",
+            name: opts.name,
+            payload: {
+                keyId: opts.keyId,
+                issuerId: opts.issuerId,
+                privateKeyP8Base64,
+            },
+        });
+        console.log(`App Store Connect API key created: #${data.id} "${data.name}"`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+creds
+    .command("upload-apple-id")
+    .description("Upload Apple ID + app-specific password for TestFlight submission (simpler than ASC API key)")
+    .requiredOption("--app <appId>")
+    .requiredOption("--name <name>")
+    .requiredOption("--apple-id <email>", "Your Apple developer email")
+    .requiredOption("--app-specific-password <xxxx-xxxx-xxxx-xxxx>", "App-specific password from appleid.apple.com")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const { data } = await (0, api_1.makeClient)().post(`/ubriot/apps/${opts.app}/credentials`, {
+            platform: "ios",
+            kind: "apple-id-credentials",
+            name: opts.name,
+            payload: {
+                appleId: opts.appleId,
+                appSpecificPassword: opts.appSpecificPassword,
+            },
+        });
+        console.log(`Apple ID credential created: #${data.id} "${data.name}"`);
+        console.log(`Ready to ship — run: ubriot ship ios`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+creds
+    .command("setup-testflight")
+    .description("Interactive guided setup for TestFlight submission (like EAS — walks you through it)")
+    .requiredOption("--app <appId>", "App ID (run 'ubriot apps list' if unsure)")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        // 1. Confirm the app exists
+        const { data: app } = await (0, api_1.makeClient)().get(`/ubriot/apps/${opts.app}`);
+        console.log(`\n🚀  Setting up TestFlight submission for: ${app.name}`);
+        console.log(`   Bundle ID: ${app.iosBundleIdentifier || "(not set)"}\n`);
+        console.log("We need your Apple credentials to submit to TestFlight.");
+        console.log("You only do this ONCE — the same credentials work for all your apps.");
+        console.log("Apple requires a special one-time password for scripts — your regular");
+        console.log("Apple ID password won't work here (Apple blocks it for security).\n");
+        // 2. Get Apple ID
+        const appleId = await (0, readline_1.readlineSync)("Enter your Apple developer email: ");
+        if (!appleId.includes("@")) {
+            console.error("That doesn't look like a valid email. Run the command again.");
+            process.exit(1);
+        }
+        // 3. Guide them to generate an app-specific password
+        console.log(`
+Next, generate an app-specific password:
+  1. Open  https://appleid.apple.com  in your browser
+  2. Sign in with ${appleId}
+  3. Go to  Security  →  App-Specific Passwords  →  click  +
+  4. Name it  "Ubriot"  and click  Create
+  5. Copy the password Apple shows you (looks like  xxxx-xxxx-xxxx-xxxx)
+`);
+        // 4. Collect the password (hidden input)
+        const appSpecificPassword = await (0, readline_1.readlineSync)("Paste the app-specific password here: ", true);
+        if (!appSpecificPassword.match(/^[a-z]{4}-[a-z]{4}-[a-z]{4}-[a-z]{4}$/)) {
+            console.log("\n⚠  That doesn't look like the expected format (xxxx-xxxx-xxxx-xxxx).");
+            console.log("   Saving anyway — if the format was wrong the submit step will tell you.\n");
+        }
+        // 5. Save credential
+        const { data: cred } = await (0, api_1.makeClient)().post(`/ubriot/apps/${opts.app}/credentials`, {
+            platform: "ios",
+            kind: "apple-id-credentials",
+            name: "Apple ID (TestFlight)",
+            payload: { appleId, appSpecificPassword },
+        });
+        console.log(`\n✅  Apple credentials saved (#${cred.id}).`);
+        console.log(`   These will be used automatically for all your apps — no setup needed for future apps.`);
+        console.log(`\nTo build and submit to TestFlight, run:`);
+        console.log(`   ubriot ship ios\n`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+creds
+    .command("upload-github-token")
+    .description("Upload a GitHub personal access token (for private repo cloning)")
+    .requiredOption("--app <appId>")
+    .requiredOption("--name <name>")
+    .requiredOption("--token <ghp_xxx>", "GitHub personal access token with repo scope")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const { data } = await (0, api_1.makeClient)().post(`/ubriot/apps/${opts.app}/credentials`, {
+            platform: "any",
+            kind: "github-token",
+            name: opts.name,
+            payload: { token: opts.token },
+        });
+        console.log(`GitHub token credential created: #${data.id} "${data.name}"`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+creds
+    .command("delete <credId>")
+    .description("Delete a credential")
+    .action(async (credId) => {
+    (0, config_1.requireAuth)();
+    try {
+        await (0, api_1.makeClient)().delete(`/ubriot/credentials/${credId}`);
+        console.log(`Credential #${credId} deleted.`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+// ─── Push ────────────────────────────────────────────────────────────────────
+const push = commander_1.program.command("push").description("Manage Ubriot Push");
+push
+    .command("setup")
+    .description("Guided setup for Ubriot Push credentials and backend key")
+    .requiredOption("--app <appIdOrSlug>", "Release app id or slug")
+    .option("--project-dir <dir>", "Expo project directory; searched automatically when omitted")
+    .option("--expo-config <path>", "Path to app.json relative to --project-dir")
+    .option("--platform <platform>", "ios, android, or all", "all")
+    .option("--name <name>", "Credential name prefix", "Ubriot Push")
+    .option("--ios-bundle <id>", "iOS bundle identifier")
+    .option("--android-package <id>", "Android package name")
+    .option("--apns-key-id <id>", "APNs key ID from Apple Developer")
+    .option("--apns-team-id <id>", "Apple Developer Team ID")
+    .option("--apns-key-p8 <path>", "Path to APNs .p8 private key")
+    .option("--apns-environment <env>", "APNs environment: production or sandbox", "production")
+    .option("--firebase-service-account <path>", "Path to Firebase service account JSON")
+    .option("--server-key-name <name>", "Backend server key label", "Backend")
+    .option("--skip-server-key", "Do not create or inspect a backend push server key", false)
+    .option("--new-server-key", "Create a new backend push server key even if one already exists", false)
+    .option("--force-credentials", "Upload push provider credentials even when one already exists", false)
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const client = (0, api_1.makeClient)();
+        const app = await resolveReleaseApp(client, opts.app);
+        const appKey = encodeURIComponent(String(app.id));
+        const discovery = discoverExpoConfig({ projectDir: opts.projectDir, expoConfig: opts.expoConfig, app: app.slug ?? opts.app });
+        const expoConfig = discovery.config;
+        const platforms = normalizePushPlatforms(opts.platform);
+        const credentialPrefix = String(opts.name ?? "Ubriot Push");
+        console.log(`Setting up Ubriot Push for ${app.name ?? opts.app} (${app.slug ?? opts.app})`);
+        if (discovery.configPath) {
+            console.log(`Expo config: ${(0, path_1.relative)(process.cwd(), discovery.configPath)}`);
+        }
+        else {
+            console.log("Expo config: not found; pass --project-dir or --expo-config to improve auto-detection.");
+        }
+        const iosBundleId = opts.iosBundle ?? app.iosBundleIdentifier ?? expoConfig?.ios?.bundleIdentifier;
+        const androidPackage = opts.androidPackage ?? app.androidApplicationId ?? expoConfig?.android?.package;
+        const appPatch = {};
+        if (iosBundleId && !app.iosBundleIdentifier)
+            appPatch.iosBundleIdentifier = iosBundleId;
+        if (androidPackage && !app.androidApplicationId)
+            appPatch.androidApplicationId = androidPackage;
+        if (Object.keys(appPatch).length) {
+            await client.patch(`/ubriot/apps/${appKey}`, appPatch);
+            console.log("Synced native app identifiers to Ubriot.");
+        }
+        if (iosBundleId && app.iosBundleIdentifier && app.iosBundleIdentifier !== iosBundleId) {
+            console.log(`Warning: Ubriot app has iOS bundle ${app.iosBundleIdentifier}, but local config has ${iosBundleId}.`);
+        }
+        if (androidPackage && app.androidApplicationId && app.androidApplicationId !== androidPackage) {
+            console.log(`Warning: Ubriot app has Android package ${app.androidApplicationId}, but local config has ${androidPackage}.`);
+        }
+        const { data: credentials } = await client.get(`/ubriot/apps/${appKey}/credentials`);
+        const hasCredential = (kind) => credentials.some((credential) => credential.kind === kind);
+        const completed = [];
+        const skipped = [];
+        if (platforms.includes("ios")) {
+            if (hasCredential("apns-auth-key") && !opts.forceCredentials) {
+                skipped.push("iOS APNs credential already exists");
+            }
+            else {
+                const environment = String(opts.apnsEnvironment ?? "production").toLowerCase();
+                if (environment !== "production" && environment !== "sandbox") {
+                    throw new Error("--apns-environment must be production or sandbox");
+                }
+                let apnsKeyP8 = resolveExistingPath(opts.apnsKeyP8, discovery.projectDir) ?? findApnsKeyP8(discovery.projectDir);
+                if (!apnsKeyP8) {
+                    apnsKeyP8 = await promptOptionalPath("APNs .p8 path", undefined, "--apns-key-p8", discovery.projectDir);
+                }
+                if (!apnsKeyP8)
+                    throw new Error("Missing APNs .p8 path. Create/download the key in Apple Developer, then rerun with --apns-key-p8 <path>.");
+                const bundleId = await promptRequired("iOS bundle identifier", iosBundleId, "--ios-bundle <id>");
+                const keyId = await promptRequired("APNs key ID", opts.apnsKeyId ?? inferApnsKeyId(apnsKeyP8), "--apns-key-id <id>");
+                const teamId = await promptRequired("Apple Team ID", opts.apnsTeamId, "--apns-team-id <id>");
+                const privateKeyP8Base64 = (0, fs_1.readFileSync)(apnsKeyP8).toString("base64");
+                const { data } = await client.post(`/ubriot/apps/${appKey}/credentials`, {
+                    platform: "ios",
+                    kind: "apns-auth-key",
+                    name: `${credentialPrefix} APNs`,
+                    payload: {
+                        keyId,
+                        teamId,
+                        bundleId,
+                        privateKeyP8Base64,
+                        environment,
+                    },
+                });
+                completed.push(`iOS APNs credential #${data.id}`);
+            }
+        }
+        if (platforms.includes("android")) {
+            if (hasCredential("firebase-service-account") && !opts.forceCredentials) {
+                skipped.push("Android Firebase credential already exists");
+            }
+            else {
+                let firebaseServiceAccount = resolveExistingPath(opts.firebaseServiceAccount, discovery.projectDir) ?? findFirebaseServiceAccount(discovery.projectDir);
+                if (!firebaseServiceAccount) {
+                    firebaseServiceAccount = await promptOptionalPath("Firebase service account JSON path", undefined, "--firebase-service-account <path>", discovery.projectDir);
+                }
+                if (!firebaseServiceAccount) {
+                    skipped.push("Android Firebase credential not uploaded");
+                }
+                else {
+                    if (!looksLikeFirebaseServiceAccount(firebaseServiceAccount)) {
+                        throw new Error(`${firebaseServiceAccount} is not a Firebase service account JSON key.`);
+                    }
+                    const serviceAccountJsonBase64 = (0, fs_1.readFileSync)(firebaseServiceAccount).toString("base64");
+                    const { data } = await client.post(`/ubriot/apps/${appKey}/credentials`, {
+                        platform: "android",
+                        kind: "firebase-service-account",
+                        name: `${credentialPrefix} Firebase`,
+                        payload: { serviceAccountJsonBase64 },
+                    });
+                    completed.push(`Android Firebase credential #${data.id}`);
+                }
+            }
+        }
+        let serverKey;
+        if (opts.skipServerKey) {
+            skipped.push("backend push server key");
+        }
+        else {
+            const { data: pushKeys } = await client.get(`/ubriot/apps/${appKey}/push/server-keys`);
+            const activeKeys = pushKeys.filter((key) => !key.revokedAt);
+            if (activeKeys.length && !opts.newServerKey) {
+                skipped.push(`backend push server key already exists (${activeKeys.length} active)`);
+            }
+            else {
+                const { data } = await client.post(`/ubriot/apps/${appKey}/push/server-keys`, { name: opts.serverKeyName });
+                serverKey = data.key;
+                completed.push(`backend push server key #${data.id}`);
+            }
+        }
+        console.log("");
+        if (completed.length) {
+            console.log("Completed:");
+            for (const item of completed)
+                console.log(`  - ${item}`);
+        }
+        if (skipped.length) {
+            console.log("Skipped:");
+            for (const item of skipped)
+                console.log(`  - ${item}`);
+        }
+        if (serverKey) {
+            console.log("");
+            console.log("Set this on the app backend:");
+            console.log(`UBRIOT_PUSH_SERVER_KEY=${serverKey}`);
+            console.log("");
+            console.log("This key is shown once. Store it in the backend environment now.");
+        }
+        else {
+            console.log("");
+            console.log("No new server key was printed. Existing server keys cannot be revealed; pass --new-server-key if the backend needs a fresh value.");
+        }
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+push
+    .command("create-server-key")
+    .description("Create an app-scoped server key for sending Ubriot Push messages")
+    .requiredOption("--app <appId>")
+    .option("--name <name>", "A label for this server key", "Backend")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const { data } = await (0, api_1.makeClient)().post(`/ubriot/apps/${opts.app}/push/server-keys`, { name: opts.name });
+        console.log(`Push server key created: #${data.id} ${data.keyPrefix}…`);
+        console.log("");
+        console.log("Set this on your backend only:");
+        console.log(`UBRIOT_PUSH_SERVER_KEY=${data.key}`);
+        console.log("");
+        console.log("This key is only shown once. Create a new one if it is lost.");
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+push
+    .command("list-server-keys")
+    .description("List app-scoped Ubriot Push server keys")
+    .requiredOption("--app <appId>")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const { data } = await (0, api_1.makeClient)().get(`/ubriot/apps/${opts.app}/push/server-keys`);
+        if (!data.length) {
+            console.log("No push server keys.");
+            return;
+        }
+        for (const key of data) {
+            const state = key.revokedAt ? "revoked" : "active";
+            console.log(`  #${key.id}  ${key.keyPrefix}…  ${state}  ${key.name}`);
+        }
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+push
+    .command("revoke-server-key <keyId>")
+    .description("Revoke a Ubriot Push server key")
+    .action(async (keyId) => {
+    (0, config_1.requireAuth)();
+    try {
+        await (0, api_1.makeClient)().delete(`/ubriot/push/server-keys/${keyId}`);
+        console.log(`Push server key #${keyId} revoked.`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+// ─── Channels ────────────────────────────────────────────────────────────────
+const channels = commander_1.program.command("channels").description("Manage OTA channels");
+channels
+    .command("list")
+    .requiredOption("--app <appId>")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const { data } = await (0, api_1.makeClient)().get(`/ubriot/apps/${opts.app}/channels`);
+        if (!data.length) {
+            console.log("No channels.");
+            return;
+        }
+        for (const c of data)
+            console.log(`  ${c.name.padEnd(20)} current group: ${c.currentUpdateGroupId ?? "none"}`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+channels
+    .command("create")
+    .requiredOption("--app <appId>")
+    .requiredOption("--name <name>")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const { data } = await (0, api_1.makeClient)().post(`/ubriot/apps/${opts.app}/channels`, { name: opts.name });
+        console.log(`Channel "${data.name}" created (id: ${data.id})`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+channels
+    .command("point")
+    .description("Point a channel to an update group")
+    .requiredOption("--app <appId>")
+    .requiredOption("--channel <name>")
+    .requiredOption("--update-group <id>")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        await (0, api_1.makeClient)().patch(`/ubriot/apps/${opts.app}/channels/${opts.channel}`, {
+            updateGroupId: Number(opts.updateGroup),
+        });
+        console.log(`Channel "${opts.channel}" now points to update group #${opts.updateGroup}`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+commander_1.program
+    .command("update")
+    .description("Export and publish an OTA update from the current Expo app")
+    .option("--app <appIdOrSlug>", "App ID or slug; defaults to expo.slug from app.json")
+    .option("--channel <channel>", "OTA channel", "production")
+    .option("--runtime-version <version>", "Runtime version; defaults to runtimeVersion from app.json")
+    .option("--message <msg>", "Release note; defaults to the current git short SHA")
+    .option("--platform <platform>", "ios, android, or all", "all")
+    .option("--export-dir <dir>", "Expo export output directory", "dist")
+    .option("--expo-config <path>", "Path to app.json or exported Expo config JSON", "app.json")
+    .option("--public-url <url>", "Public API base URL used in generated asset URLs")
+    .option("--no-export", "Publish an existing export directory without running expo export")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const expoConfig = readExpoConfig(opts.expoConfig);
+        const app = resolveAppSlug(opts.app, expoConfig);
+        const runtimeVersion = resolveRuntimeVersion(opts.runtimeVersion, expoConfig);
+        const message = opts.message ?? optionalGitShortSha();
+        const client = (0, api_1.makeClient)();
+        const publicApiBase = (opts.publicUrl || (0, config_1.readConfig)().apiBase).replace(/\/$/, "");
+        if (opts.export !== false) {
+            runLocalCommand("npx", ["expo", "export", "--platform", opts.platform, "--output-dir", opts.exportDir]);
+        }
+        const { data, platforms } = await publishExportedUpdate({
+            client,
+            app,
+            channel: opts.channel,
+            runtimeVersion,
+            message,
+            exportDir: opts.exportDir,
+            expoConfigPath: opts.expoConfig,
+            platform: opts.platform,
+            publicApiBase,
+        });
+        console.log(`Published update group #${data.updateGroupId} on channel "${data.channel}" (${platforms.map((p) => p.platform).join(", ")})`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+// ─── Updates ─────────────────────────────────────────────────────────────────
+const updates = commander_1.program.command("updates").description("Manage OTA updates");
+updates
+    .command("list")
+    .requiredOption("--app <appId>")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const { data } = await (0, api_1.makeClient)().get(`/ubriot/apps/${opts.app}/updates`);
+        if (!data.length) {
+            console.log("No updates.");
+            return;
+        }
+        for (const u of data)
+            console.log(`  #${u.id}  channel: ${(u.channelName ?? "-").padEnd(15)} msg: ${u.message ?? ""}`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+updates
+    .command("publish")
+    .description("Publish an OTA update (wrap expo export output)")
+    .requiredOption("--app <appIdOrSlug>")
+    .requiredOption("--channel <channel>")
+    .requiredOption("--runtime-version <version>")
+    .option("--message <msg>")
+    .option("--export-dir <dir>", "Path to npx expo export output directory")
+    .option("--expo-config <path>", "Path to app.json or exported Expo config JSON", "app.json")
+    .option("--platform <platform>", "ios, android, or all when using --export-dir", "all")
+    .option("--public-url <url>", "Public API base URL used in generated asset URLs")
+    .option("--manifest-android <path>", "Path to android manifest JSON")
+    .option("--manifest-ios <path>", "Path to ios manifest JSON")
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const platforms = [];
+        const client = (0, api_1.makeClient)();
+        const publicApiBase = (opts.publicUrl || (0, config_1.readConfig)().apiBase).replace(/\/$/, "");
+        if (opts.exportDir) {
+            const exportDir = (0, path_1.resolve)(opts.exportDir);
+            const metadataPath = (0, path_1.join)(exportDir, "metadata.json");
+            if (!(0, fs_1.existsSync)(metadataPath))
+                throw new Error(`No metadata.json found in ${exportDir}. Run: npx expo export --output-dir ${opts.exportDir}`);
+            const metadataJson = readJsonFile(metadataPath);
+            const configJson = (0, fs_1.existsSync)((0, path_1.resolve)(opts.expoConfig)) ? readJsonFile((0, path_1.resolve)(opts.expoConfig)) : {};
+            const expoConfig = configJson.expo ?? configJson;
+            const publishId = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+            const selectedPlatforms = opts.platform === "all" ? ["ios", "android"] : [opts.platform];
+            for (const platform of selectedPlatforms) {
+                if (platform !== "ios" && platform !== "android")
+                    throw new Error("--platform must be ios, android, or all");
+                const payload = await buildOtaPlatformPayload({
+                    client,
+                    app: opts.app,
+                    exportDir,
+                    publishId,
+                    platform,
+                    runtimeVersion: opts.runtimeVersion,
+                    message: opts.message,
+                    expoConfig,
+                    metadataJson,
+                    publicApiBase,
+                });
+                if (payload)
+                    platforms.push(payload);
+            }
+        }
+        else {
+            if (opts.manifestAndroid) {
+                const manifestJson = (0, fs_1.readFileSync)(opts.manifestAndroid, "utf8");
+                platforms.push({ platform: "android", manifestJson, assets: [] });
+            }
+            if (opts.manifestIos) {
+                const manifestJson = (0, fs_1.readFileSync)(opts.manifestIos, "utf8");
+                platforms.push({ platform: "ios", manifestJson, assets: [] });
+            }
+        }
+        if (!platforms.length) {
+            console.error("Provide --export-dir, or at least one of --manifest-android / --manifest-ios");
+            process.exit(1);
+        }
+        const { data } = await client.post(`/ubriot/apps/${encodeURIComponent(opts.app)}/updates`, {
+            channel: opts.channel,
+            runtimeVersion: opts.runtimeVersion,
+            message: opts.message,
+            platforms,
+        }, { timeout: 120000 });
+        console.log(`Published update group #${data.updateGroupId} on channel "${data.channel}" (${platforms.map((p) => p.platform).join(", ")})`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+commander_1.program.parse(process.argv);