ubriot 1.2.0 → 2.0.0

package/dist/index.js

@@ -38,12 +38,38 @@ const commander_1 = require("commander");
 const readline_1 = require("./readline");
 const config_1 = require("./config");
 const api_1 = require("./api");
+const runtime_preflight_1 = require("./runtime-preflight");
+const build_preflight_1 = require("./build-preflight");
+const build_identity_1 = require("./build-identity");
 const migrate_1 = require("./migrate");
+const signing_commands_1 = require("./signing-commands");
+const child_env_1 = require("./child-env");
+const unreal_detect_1 = require("./unreal-detect");
+const publish_signing_1 = require("./publish-signing");
 const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const path_1 = require("path");
 const crypto_1 = require("crypto");
-commander_1.program.name("ubriot").description("Ubriot, mobile release infrastructure for teams that ship").version("1.2.0");
+const JSON_OPTION_HELP = "Print the raw API response as JSON instead of human-readable output";
+commander_1.program
+    .name("ubriot")
+    .description("Ubriot, mobile release infrastructure for teams that ship")
+    .version("2.0.0")
+    .enablePositionalOptions()
+    .option("--json", JSON_OPTION_HELP);
+let jsonOutput = false;
+commander_1.program.hook("preAction", (_program, actionCommand) => {
+    jsonOutput = commander_1.program.opts().json === true || actionCommand.opts().json === true;
+});
+function usingApiKey() {
+    return (0, config_1.envToken)()?.startsWith("ubk_") === true;
+}
+function wantsJson() {
+    return jsonOutput;
+}
+function printJson(data) {
+    console.log(JSON.stringify(data, null, 2));
+}
 const MIME = {
     ".avif": "image/avif",
     ".bundle": "application/javascript",
@@ -312,8 +338,8 @@ function optionalGitShortSha() {
         return undefined;
     return result.stdout.trim() || undefined;
 }
-function runLocalCommand(command, args) {
-    const result = (0, child_process_1.spawnSync)(command, args, { stdio: "inherit", env: process.env });
+function runLocalCommand(command, args, extraEnv = {}) {
+    const result = (0, child_process_1.spawnSync)(command, args, { stdio: "inherit", env: (0, child_env_1.childProcessEnv)(extraEnv) });
     if (result.error)
         throw result.error;
     if (result.status !== 0)
@@ -336,6 +362,44 @@ function parsePositiveNumber(value, fallback, label) {
         throw new Error(`${label} must be a positive number`);
     return parsed;
 }
+function parsePlayReleaseStatus(value) {
+    if (value === undefined)
+        return undefined;
+    const status = String(value).trim().toLowerCase();
+    if (status !== "draft" && status !== "completed") {
+        throw new Error('--release-status must be "draft" (staged in the Play Console) or "completed" (live release)');
+    }
+    return status;
+}
+function parseRolloutPercentage(value) {
+    if (value === undefined)
+        return undefined;
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed) || parsed <= 0 || parsed >= 100) {
+        throw new Error("--rollout must be greater than 0 and less than 100. Drop it and use --release-status completed for a full rollout.");
+    }
+    return parsed;
+}
+function playSubmitBody(options) {
+    const body = {};
+    if (options.track)
+        body.track = options.track;
+    if (options.releaseStatus)
+        body.releaseStatus = options.releaseStatus;
+    if (options.rolloutPercentage !== undefined)
+        body.rolloutPercentage = options.rolloutPercentage;
+    if (options.releaseNotes)
+        body.releaseNotes = options.releaseNotes;
+    return body;
+}
+function readPlaySubmitOptions(opts) {
+    return {
+        track: opts.track,
+        releaseStatus: parsePlayReleaseStatus(opts.releaseStatus),
+        rolloutPercentage: parseRolloutPercentage(opts.rollout),
+        releaseNotes: opts.releaseNotes,
+    };
+}
 function buildStatusLine(build) {
     const asc = build.ascSubmissionStatus ? `, TestFlight ${build.ascSubmissionStatus}` : "";
     const play = build.playSubmissionStatus ? `, Google Play ${build.playSubmissionStatus}` : "";
@@ -413,7 +477,7 @@ async function waitForTestFlight(client, buildId, intervalMs, timeoutMs) {
     }
     throw new Error(`Timed out waiting for TestFlight submit for build #${buildId}`);
 }
-async function queueGooglePlayIfNeeded(client, build, track) {
+async function queueGooglePlayIfNeeded(client, build, options = {}) {
     if (build.platform !== "android")
         throw new Error("--submit-google-play is only valid for Android builds");
     if (build.playSubmissionStatus === "succeeded") {
@@ -424,7 +488,7 @@ async function queueGooglePlayIfNeeded(client, build, track) {
         console.log(`Build #${build.id} already has Google Play submission ${build.playSubmissionStatus}.`);
         return build;
     }
-    const { data } = await client.post(`/ubriot/builds/${build.id}/submit-google-play`, track ? { track } : {});
+    const { data } = await client.post(`/ubriot/builds/${build.id}/submit-google-play`, playSubmitBody(options));
     console.log(`Build #${build.id} queued for Google Play submit.`);
     return data;
 }
@@ -534,6 +598,7 @@ async function buildOtaPlatformPayload(input) {
         },
         extra: {
             expoClient: input.expoConfig,
+            ubriot: { ...input.ubriotExtra, platform: input.platform },
         },
     };
     return {
@@ -542,13 +607,148 @@ async function buildOtaPlatformPayload(input) {
         assets: uploadedForDb,
     };
 }
+function runLocalCommandIn(cwd, command, args) {
+    const result = (0, child_process_1.spawnSync)(command, args, { stdio: "inherit", env: (0, child_env_1.childProcessEnv)(), cwd });
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0)
+        throw new Error(`${command} ${args.join(" ")} failed with exit code ${result.status ?? "unknown"}`);
+}
+function detectBareEntryFile(projectDir) {
+    const pkgPath = (0, path_1.join)(projectDir, "package.json");
+    if ((0, fs_1.existsSync)(pkgPath)) {
+        const pkg = readJsonFile(pkgPath);
+        if (typeof pkg.main === "string" && pkg.main.trim() && /\.[cm]?[jt]sx?$/.test(pkg.main)) {
+            if ((0, fs_1.existsSync)((0, path_1.join)(projectDir, pkg.main)))
+                return pkg.main;
+        }
+    }
+    for (const candidate of ["index.js", "index.ts", "index.tsx"]) {
+        if ((0, fs_1.existsSync)((0, path_1.join)(projectDir, candidate)))
+            return candidate;
+    }
+    return "index.js";
+}
+function isBareRnProject(projectDir) {
+    const pkgPath = (0, path_1.join)(projectDir, "package.json");
+    if ((0, fs_1.existsSync)(pkgPath)) {
+        const pkg = readJsonFile(pkgPath);
+        const deps = { ...(pkg.dependencies ?? {}), ...(pkg.devDependencies ?? {}) };
+        if (deps.expo)
+            return false;
+    }
+    const appJsonPath = (0, path_1.join)(projectDir, "app.json");
+    if ((0, fs_1.existsSync)(appJsonPath)) {
+        const appJson = readJsonFile(appJsonPath);
+        if (appJson.expo)
+            return false;
+    }
+    return true;
+}
+function collectBundledAssets(platformDir, bundleFileName) {
+    const files = [];
+    const walk = (dir) => {
+        for (const entry of (0, fs_1.readdirSync)(dir, { withFileTypes: true })) {
+            const full = (0, path_1.join)(dir, entry.name);
+            if (entry.isDirectory())
+                walk(full);
+            else
+                files.push(full);
+        }
+    };
+    walk(platformDir);
+    return files.filter((full) => {
+        const name = (0, path_1.basename)(full);
+        return name !== bundleFileName && name !== `${bundleFileName}.map`;
+    });
+}
+function exportBareRnBundle(input) {
+    const projectDir = (0, path_1.resolve)(input.projectDir);
+    const outDir = (0, path_1.resolve)(input.outDir);
+    const entryFile = input.entryFile ?? detectBareEntryFile(projectDir);
+    const platforms = input.platform === "all" ? ["ios", "android"] : [input.platform];
+    const bundleFileName = "index.bundle";
+    const fileMetadata = {};
+    for (const platform of platforms) {
+        if (platform !== "ios" && platform !== "android")
+            throw new Error("--platform must be ios, android, or all");
+        const platformDir = (0, path_1.join)(outDir, platform);
+        (0, fs_1.mkdirSync)(platformDir, { recursive: true });
+        const bundleOutput = (0, path_1.join)(platformDir, bundleFileName);
+        runLocalCommandIn(projectDir, "npx", [
+            "react-native",
+            "bundle",
+            "--platform",
+            platform,
+            "--dev",
+            "false",
+            "--entry-file",
+            entryFile,
+            "--bundle-output",
+            bundleOutput,
+            "--assets-dest",
+            platformDir,
+        ]);
+        if (!(0, fs_1.existsSync)(bundleOutput))
+            throw new Error(`react-native bundle did not produce ${bundleOutput}`);
+        const assets = collectBundledAssets(platformDir, bundleFileName).map((full) => {
+            const ext = (0, path_1.extname)(full).replace(/^\./, "");
+            return { path: (0, path_1.relative)(outDir, full), ext: ext || null };
+        });
+        fileMetadata[platform] = { bundle: (0, path_1.relative)(outDir, bundleOutput), assets };
+    }
+    (0, fs_1.mkdirSync)(outDir, { recursive: true });
+    const metadata = { version: 0, bundler: "metro", fileMetadata };
+    (0, fs_1.writeFileSync)((0, path_1.join)(outDir, "metadata.json"), JSON.stringify(metadata, null, 2));
+    return { outDir, entryFile, metadata };
+}
+async function confirmRuntimePreflight(client, input) {
+    const result = await (0, runtime_preflight_1.fetchRuntimePreflight)(client, input);
+    if (!result) {
+        console.log("Runtime reach check unavailable, continuing without it.");
+        return true;
+    }
+    for (const line of (0, runtime_preflight_1.renderPreflight)(result))
+        console.log(line);
+    const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+    if ((0, runtime_preflight_1.preflightDecision)(result, { yes: input.yes, interactive }) === "continue")
+        return true;
+    const answer = await (0, readline_1.readlineSync)("Publish anyway? [y/N] ");
+    return /^y(es)?$/i.test(answer.trim());
+}
+async function confirmBuildPreflight(client, input) {
+    if (input.platform !== "ios" && input.platform !== "android")
+        return true;
+    const result = await (0, build_preflight_1.fetchBuildPreflight)(client, { app: input.app, platform: input.platform, runtime: (0, build_preflight_1.detectProjectRuntime)(input.projectDir) });
+    if (!result)
+        return true;
+    const print = wantsJson() ? console.error : console.log;
+    for (const line of (0, build_preflight_1.renderBuildPreflight)(result))
+        print(line);
+    const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+    if ((0, build_preflight_1.buildPreflightDecision)(result, { yes: input.yes, interactive }) === "continue")
+        return true;
+    const answer = await (0, readline_1.readlineSync)("Queue the build anyway? [y/N] ");
+    return /^y(es)?$/i.test(answer.trim());
+}
+async function confirmLocalNode(projectDir, yes) {
+    const problem = (0, build_preflight_1.localNodeProblem)((0, build_preflight_1.detectProjectRuntime)(projectDir), process.versions.node);
+    if (!problem)
+        return true;
+    console.log(`Warning: ${problem}`);
+    const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+    if (yes || !interactive)
+        return true;
+    const answer = await (0, readline_1.readlineSync)("Export anyway? [y/N] ");
+    return /^y(es)?$/i.test(answer.trim());
+}
 async function publishExportedUpdate(input) {
     const exportDir = (0, path_1.resolve)(input.exportDir);
     const metadataPath = (0, path_1.join)(exportDir, "metadata.json");
     if (!(0, fs_1.existsSync)(metadataPath))
         throw new Error(`No metadata.json found in ${exportDir}. Run: npx expo export --output-dir ${input.exportDir}`);
     const metadataJson = readJsonFile(metadataPath);
-    const expoConfig = readExpoConfig(input.expoConfigPath);
+    const expoConfig = input.expoConfig;
     const publishId = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     const selectedPlatforms = input.platform === "all" ? ["ios", "android"] : [input.platform];
     const platforms = [];
@@ -566,6 +766,7 @@ async function publishExportedUpdate(input) {
             expoConfig,
             metadataJson,
             publicApiBase: input.publicApiBase,
+            ubriotExtra: input.ubriotExtra,
         });
         if (payload)
             platforms.push(payload);
@@ -576,7 +777,7 @@ async function publishExportedUpdate(input) {
         channel: input.channel,
         runtimeVersion: input.runtimeVersion,
         message: input.message,
-        platforms,
+        platforms: (0, publish_signing_1.signPlatforms)(platforms, input.signingMaterials),
     }, { timeout: 120000 });
     return { data, platforms };
 }
@@ -586,13 +787,17 @@ commander_1.program
     .description("Log in with your Ubriot credentials")
     .option("--api-base <url>", "API base URL")
     .action(async (opts) => {
+    if (!process.stdin.isTTY) {
+        console.error(`ubriot login needs an interactive terminal. For scripts, CI and agents, set UBRIOT_TOKEN to an API key from ${config_1.API_KEYS_URL}.`);
+        process.exit(1);
+    }
     if (opts.apiBase)
         (0, config_1.writeConfig)({ apiBase: opts.apiBase });
     const email = await (0, readline_1.readlineSync)("Email: ");
     const password = await (0, readline_1.readlineSync)("Password: ", true);
     try {
         const client = (0, api_1.makeClient)();
-        const { data } = await client.post("/auth/login", { email, password });
+        const { data } = await client.post("/auth/login", { email, password }, { headers: { "X-Ubriot-Client": "cli" } });
         const token = data?.user?.token;
         if (!token)
             throw new Error("No token in response");
@@ -607,7 +812,7 @@ commander_1.program
     .command("logout")
     .description("Clear saved credentials")
     .action(async () => {
-    const cfg = (0, config_1.readConfig)();
+    const cfg = (0, config_1.readSavedConfig)();
     if (cfg.refreshToken) {
         // Best-effort server-side revoke; ignore failures.
         try {
@@ -623,9 +828,15 @@ commander_1.program
 commander_1.program
     .command("whoami")
     .description("Show current user")
+    .option("--json", JSON_OPTION_HELP)
     .action(() => {
     const cfg = (0, config_1.readConfig)();
-    if (cfg.email)
+    const source = (0, config_1.envToken)() ? "env" : cfg.token ? "config" : null;
+    if (wantsJson())
+        printJson({ email: cfg.email, source });
+    else if (source === "env")
+        console.log("Using UBRIOT_TOKEN from the environment.");
+    else if (cfg.email)
         console.log(cfg.email);
     else
         console.log("Not logged in.");
@@ -643,10 +854,17 @@ apps
     .option("--ios-bundle <id>", "iOS bundle identifier")
     .option("--google-play-track <track>", "Default Google Play track", "internal")
     .option("--expo-project-root <path>", "Path to the Expo app inside the repo (monorepos), e.g. products/myapp/mobile")
+    .option("--unreal", "Unreal Engine project (Android builds); reads the .uproject in the project root")
+    .option("--engine-version <x.y>", "Unreal Engine version, defaults to the .uproject EngineAssociation")
+    .option("--unreal-configuration <name>", "Unreal build configuration: Development or Shipping (default Shipping)")
+    .option("--package-format <format>", "Unreal Android package: aab or apk (default aab)")
+    .option("--accept-unreal-eula", "Confirm you hold an Unreal Engine licence for this version and accept the Unreal Engine EULA")
     .action(async (opts) => {
     (0, config_1.requireAuth)();
     try {
+        const unreal = (0, unreal_detect_1.unrealAppFields)(opts, (0, path_1.resolve)(opts.expoProjectRoot ?? "."));
         const { data } = await (0, api_1.makeClient)().post("/ubriot/apps", {
+            ...(unreal ?? {}),
             name: opts.name,
             slug: opts.slug,
             repoUrl: opts.repo,
@@ -665,10 +883,15 @@ apps
 apps
     .command("list")
     .description("List your release apps")
+    .option("--json", JSON_OPTION_HELP)
     .action(async () => {
     (0, config_1.requireAuth)();
     try {
         const { data } = await (0, api_1.makeClient)().get("/ubriot/apps");
+        if (wantsJson()) {
+            printJson(data);
+            return;
+        }
         if (!data.length) {
             console.log("No apps yet.");
             return;
@@ -692,15 +915,20 @@ apps
     .option("--android-id <id>", "Android application ID / package name")
     .option("--asc-app-id <id>", "App Store Connect app id (from ASC app URL)")
     .option("--clear-asc-app-id", "Remove stored ASC app id (use bundle id lookup)", false)
-    .option("--auto-submit-testflight", "Enable auto-submit after each successful iOS build", false)
-    .option("--no-auto-submit-testflight", "Disable auto-submit", false)
+    .option("--auto-submit-testflight", "Enable auto-submit after each successful iOS build")
+    .option("--no-auto-submit-testflight", "Disable auto-submit")
     .option("--google-play-track <track>", "Default Google Play track, e.g. internal, alpha, beta, production")
-    .option("--auto-submit-google-play", "Enable auto-submit to Google Play after each successful Android build", false)
-    .option("--no-auto-submit-google-play", "Disable Google Play auto-submit", false)
+    .option("--auto-submit-google-play", "Enable auto-submit to Google Play after each successful Android build")
+    .option("--no-auto-submit-google-play", "Disable Google Play auto-submit")
+    .option("--unreal", "Switch to (or update) an Unreal Engine project; reads the .uproject in the project root")
+    .option("--engine-version <x.y>", "Unreal Engine version, defaults to the .uproject EngineAssociation")
+    .option("--unreal-configuration <name>", "Unreal build configuration: Development or Shipping")
+    .option("--package-format <format>", "Unreal Android package: aab or apk")
+    .option("--accept-unreal-eula", "Confirm you hold an Unreal Engine licence for this version and accept the Unreal Engine EULA")
     .action(async (opts) => {
     (0, config_1.requireAuth)();
     try {
-        const body = {};
+        const body = { ...((0, unreal_detect_1.unrealAppFields)(opts, (0, path_1.resolve)(opts.expoProjectRoot ?? ".")) ?? {}) };
         if (opts.iosBundle !== undefined)
             body.iosBundleIdentifier = opts.iosBundle || null;
         if (opts.expoProjectRoot !== undefined)
@@ -711,18 +939,14 @@ apps
             body.appStoreConnectAppId = null;
         else if (opts.ascAppId !== undefined)
             body.appStoreConnectAppId = opts.ascAppId;
-        if (opts.autoSubmitTestflight)
-            body.autoSubmitTestflight = true;
-        if (opts.noAutoSubmitTestflight)
-            body.autoSubmitTestflight = false;
+        if (opts.autoSubmitTestflight !== undefined)
+            body.autoSubmitTestflight = opts.autoSubmitTestflight;
         if (opts.googlePlayTrack !== undefined)
             body.googlePlayTrack = opts.googlePlayTrack || null;
-        if (opts.autoSubmitGooglePlay)
-            body.autoSubmitGooglePlay = true;
-        if (opts.noAutoSubmitGooglePlay)
-            body.autoSubmitGooglePlay = false;
+        if (opts.autoSubmitGooglePlay !== undefined)
+            body.autoSubmitGooglePlay = opts.autoSubmitGooglePlay;
         if (!Object.keys(body).length) {
-            console.log("Nothing to update, pass --ios-bundle, --android-id, --asc-app-id, --google-play-track, and/or auto-submit flags");
+            console.log("Nothing to update, pass --ios-bundle, --android-id, --asc-app-id, --google-play-track, --unreal, and/or auto-submit flags");
             return;
         }
         const { data } = await (0, api_1.makeClient)().patch(`/ubriot/apps/${opts.app}`, body);
@@ -732,6 +956,37 @@ apps
         (0, api_1.handleError)(err);
     }
 });
+apps
+    .command("activity <app>")
+    .description("Show who changed what on a release app, newest first")
+    .option("--limit <n>", "Number of entries (max 200)", "50")
+    .option("--offset <n>", "Skip this many newer entries", "0")
+    .option("--json", JSON_OPTION_HELP)
+    .action(async (app, opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const { data } = await (0, api_1.makeClient)().get(`/ubriot/apps/${encodeURIComponent(app)}/activity`, {
+            params: { limit: opts.limit, offset: opts.offset },
+        });
+        if (wantsJson()) {
+            printJson(data);
+            return;
+        }
+        if (!data.items.length) {
+            console.log("No activity yet.");
+            return;
+        }
+        for (const entry of data.items) {
+            console.log(`  ${new Date(entry.createdAt).toISOString()}  ${entry.actor.padEnd(24)} ${entry.summary}`);
+        }
+        const shown = Number(opts.offset) + data.items.length;
+        if (shown < data.total)
+            console.log(`  … ${data.total - shown} older, use --offset ${shown}`);
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
 // ─── Releases ────────────────────────────────────────────────────────────────
 commander_1.program
     .command("ship <platform>")
@@ -742,11 +997,15 @@ commander_1.program
     .option("--branch <branch>", "Branch to build")
     .option("--local [path]", "Build from a local directory instead of cloning from remote (path defaults to CWD)")
     .option("--track <track>", "Google Play track for Android", "internal")
+    .option("--release-status <status>", "Google Play release status: draft (default on production) or completed for a live release")
+    .option("--rollout <percent>", "Staged rollout percentage for a live release, greater than 0 and less than 100")
+    .option("--release-notes <text>", "Release notes to attach to the Google Play release")
     .option("--no-submit", "Build only; do not submit to TestFlight / Google Play")
     .option("--reprovision-ios", "Force-regenerate the iOS provisioning profile before building", false)
     .option("--ios-capability <type...>", "Apple capability to ensure on the bundle ID (e.g. HEALTHKIT); regenerates the profile if newly added")
     .option("--poll-interval <seconds>", "Polling interval while waiting", "15")
     .option("--timeout <minutes>", "Maximum wait time for the build and store submit", "180")
+    .option("--yes", "Queue without confirming toolchain warnings", false)
     .action(async (platform, opts) => {
     (0, config_1.requireAuth)();
     try {
@@ -762,6 +1021,7 @@ commander_1.program
         const client = (0, api_1.makeClient)();
         const pollIntervalMs = parsePositiveNumber(opts.pollInterval, 15, "--poll-interval") * 1000;
         const timeoutMs = parsePositiveNumber(opts.timeout, 180, "--timeout") * 60 * 1000;
+        const playSubmitOptions = readPlaySubmitOptions(opts);
         // --local builds from a file:// path so the worker clones locally without needing a remote push
         let repoUrl = opts.repo;
         let branch = opts.branch;
@@ -778,6 +1038,12 @@ commander_1.program
             }
             console.log(`Building from local path: ${localPath} (branch: ${branch ?? "default"})`);
         }
+        const projectDir = opts.local !== undefined && opts.local !== true ? (0, path_1.resolve)(opts.local) : process.cwd();
+        if (!(await confirmBuildPreflight(client, { app, platform: normalizedPlatform, projectDir, yes: opts.yes === true }))) {
+            console.log("Aborted. No build was queued.");
+            process.exitCode = 1;
+            return;
+        }
         // EAS-style auto-provisioning: ensure a provisioning profile exists for iOS.
         if (normalizedPlatform === "ios") {
             // Auto-detect capabilities from the local Expo config so users don't have
@@ -804,21 +1070,27 @@ commander_1.program
                 provisionBody.force = true;
             if (capabilities.length)
                 provisionBody.capabilities = capabilities;
-            try {
-                const { data: prov } = await client.post(`/ubriot/apps/${encodeURIComponent(app)}/provision-ios`, provisionBody);
-                if (prov?.status === "provisioned") {
-                    const caps = prov.capabilitiesAdded?.length ? ` [capabilities added: ${prov.capabilitiesAdded.join(", ")}]` : "";
-                    console.log(`Auto-provisioned iOS signing: ${prov.profileName} (${prov.bundleId})${caps}`);
-                }
-            }
-            catch (provErr) {
-                const msg = provErr?.response?.data?.message ?? provErr?.message ?? "";
-                // When reprovisioning or capabilities were explicitly requested, a provisioning
-                // failure means the build is doomed to fail signing, stop here instead.
+            if (usingApiKey()) {
                 if (provisionExplicit)
-                    throw new Error(`iOS provisioning failed: ${msg}`);
-                console.log(`⚠ Auto-provisioning skipped: ${msg}`);
+                    throw new Error("iOS provisioning needs a signed-in session and does not accept API keys. Run ubriot login on a machine with a terminal, or drop --reprovision-ios and --ios-capability.");
+                console.log("Auto-provisioning skipped: it needs a signed-in session, and UBRIOT_TOKEN is an API key. The build uses the provisioning profile already stored for this app.");
             }
+            else
+                try {
+                    const { data: prov } = await client.post(`/ubriot/apps/${encodeURIComponent(app)}/provision-ios`, provisionBody);
+                    if (prov?.status === "provisioned") {
+                        const caps = prov.capabilitiesAdded?.length ? ` [capabilities added: ${prov.capabilitiesAdded.join(", ")}]` : "";
+                        console.log(`Auto-provisioned iOS signing: ${prov.profileName} (${prov.bundleId})${caps}`);
+                    }
+                }
+                catch (provErr) {
+                    const msg = provErr?.response?.data?.message ?? provErr?.message ?? "";
+                    // When reprovisioning or capabilities were explicitly requested, a provisioning
+                    // failure means the build is doomed to fail signing, stop here instead.
+                    if (provisionExplicit)
+                        throw new Error(`iOS provisioning failed: ${msg}`);
+                    console.log(`⚠ Auto-provisioning skipped: ${msg}`);
+                }
         }
         const { data } = await client.post(`/ubriot/apps/${encodeURIComponent(app)}/builds`, {
             platform: normalizedPlatform,
@@ -836,7 +1108,7 @@ commander_1.program
             console.log(`Build #${submitted.id} is valid in TestFlight.`);
         }
         else {
-            const submitted = await queueGooglePlayIfNeeded(client, finished, opts.track);
+            const submitted = await queueGooglePlayIfNeeded(client, finished, playSubmitOptions);
             await waitForGooglePlay(client, submitted.id, pollIntervalMs, timeoutMs);
             console.log(`Build #${submitted.id} was submitted to Google Play track "${submitted.playTrack ?? opts.track}".`);
         }
@@ -859,14 +1131,20 @@ builds
     .option("--submit-testflight", "For iOS: wait for the build, submit to TestFlight, and wait for App Store Connect", false)
     .option("--submit-google-play", "For Android: wait for the build, submit to Google Play, and wait for commit", false)
     .option("--track <track>", "Google Play track for --submit-google-play", "internal")
+    .option("--release-status <status>", "Google Play release status: draft (default on production) or completed for a live release")
+    .option("--rollout <percent>", "Staged rollout percentage for a live release, greater than 0 and less than 100")
+    .option("--release-notes <text>", "Release notes to attach to the Google Play release")
     .option("--poll-interval <seconds>", "Polling interval while waiting", "15")
     .option("--timeout <minutes>", "Maximum wait time for the build and store submit", "180")
+    .option("--yes", "Queue without confirming toolchain warnings", false)
+    .option("--json", JSON_OPTION_HELP)
     .action(async (opts) => {
     (0, config_1.requireAuth)();
     try {
         const client = (0, api_1.makeClient)();
         const pollIntervalMs = parsePositiveNumber(opts.pollInterval, 15, "--poll-interval") * 1000;
         const timeoutMs = parsePositiveNumber(opts.timeout, 180, "--timeout") * 60 * 1000;
+        const playSubmitOptions = readPlaySubmitOptions(opts);
         const shouldWait = Boolean(opts.wait || opts.submitTestflight || opts.submitGooglePlay);
         if (opts.submitTestflight && opts.platform !== "ios") {
             throw new Error("--submit-testflight can only be used with --platform ios");
@@ -877,12 +1155,21 @@ builds
         if (opts.submitGooglePlay && opts.profile === "preview") {
             throw new Error("--submit-google-play requires a production AAB. Use --wait without --submit-google-play for preview Android builds.");
         }
+        if (!(await confirmBuildPreflight(client, { app: opts.app, platform: opts.platform, projectDir: process.cwd(), yes: opts.yes === true }))) {
+            console.log("Aborted. No build was queued.");
+            process.exitCode = 1;
+            return;
+        }
         const { data } = await client.post(`/ubriot/apps/${opts.app}/builds`, {
             platform: opts.platform,
             profile: opts.profile,
             repoUrl: opts.repo,
             branch: opts.branch,
         });
+        if (!shouldWait && wantsJson()) {
+            printJson(data);
+            return;
+        }
         console.log(`Queued build #${data.id} (${data.platform} / ${data.profile}), status: ${data.status}`);
         if (!shouldWait) {
             if (data.platform === "ios") {
@@ -895,7 +1182,7 @@ builds
         }
         const finished = await waitForBuild(client, data.id, pollIntervalMs, timeoutMs);
         if (opts.submitGooglePlay) {
-            const submitted = await queueGooglePlayIfNeeded(client, finished, opts.track);
+            const submitted = await queueGooglePlayIfNeeded(client, finished, playSubmitOptions);
             await waitForGooglePlay(client, submitted.id, pollIntervalMs, timeoutMs);
             console.log(`Build #${submitted.id} was submitted to Google Play track "${submitted.playTrack ?? opts.track}".`);
             return;
@@ -914,11 +1201,16 @@ builds
     .command("list")
     .description("List recent builds")
     .option("--app <appId>", "Filter by app ID")
+    .option("--json", JSON_OPTION_HELP)
     .action(async (opts) => {
     (0, config_1.requireAuth)();
     try {
         const url = opts.app ? `/ubriot/apps/${opts.app}/builds` : "/ubriot/builds";
         const { data } = await (0, api_1.makeClient)().get(url);
+        if (wantsJson()) {
+            printJson(data);
+            return;
+        }
         if (!data.length) {
             console.log("No builds found.");
             return;
@@ -932,6 +1224,67 @@ builds
         (0, api_1.handleError)(err);
     }
 });
+builds
+    .command("queue")
+    .description("Explain why your queued builds have not started: queue position, worker availability, rough start time")
+    .option("--json", JSON_OPTION_HELP)
+    .action(async () => {
+    (0, config_1.requireAuth)();
+    try {
+        const { data } = await (0, api_1.makeClient)().get("/ubriot/builds/queue");
+        if (wantsJson()) {
+            printJson(data);
+            return;
+        }
+        const rows = data?.builds ?? [];
+        if (!rows.length) {
+            console.log("No queued builds.");
+            return;
+        }
+        for (const q of rows) {
+            console.log(`  #${q.buildId} ${q.platform}  position ${q.position}, waiting ${q.waitingMinutes} min`);
+            console.log(`    ${q.headline}`);
+            console.log(`    ${q.detail}`);
+            for (const c of q.commands ?? [])
+                console.log(`    $ ${c}`);
+        }
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
+builds
+    .command("last-good")
+    .description("Show the last successful build per app, platform and profile, and how many builds have failed since")
+    .option("--app <appId>", "Only this app id")
+    .option("--json", JSON_OPTION_HELP)
+    .action(async (opts) => {
+    (0, config_1.requireAuth)();
+    try {
+        const params = opts.app ? { appId: opts.app } : undefined;
+        const { data } = await (0, api_1.makeClient)().get("/ubriot/builds/last-good", { params });
+        if (wantsJson()) {
+            printJson(data);
+            return;
+        }
+        const lanes = data?.lanes ?? [];
+        if (!lanes.length) {
+            console.log("No builds yet.");
+            return;
+        }
+        for (const lane of lanes) {
+            console.log(`  app ${lane.releaseAppId} ${lane.platform}/${lane.profile}  ${lane.state.replace(/_/g, " ")}, latest #${lane.latestBuildId} ${lane.latestStatus}`);
+            console.log(`    ${lane.headline}`);
+            if (lane.detail)
+                console.log(`    ${lane.detail}`);
+            for (const c of lane.commands ?? [])
+                console.log(`    $ ${c}`);
+        }
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
 builds
     .command("show <buildId>")
     .description("Show build details")
@@ -1079,10 +1432,13 @@ builds
     .command("submit-google-play <buildId>")
     .description("Queue upload of the Android .aab to Google Play; requires a Google service account on the app")
     .option("--track <track>", "Google Play track", "internal")
+    .option("--release-status <status>", "Google Play release status: draft (default on production) or completed for a live release")
+    .option("--rollout <percent>", "Staged rollout percentage for a live release, greater than 0 and less than 100")
+    .option("--release-notes <text>", "Release notes to attach to the Google Play release")
     .action(async (buildId, opts) => {
     (0, config_1.requireAuth)();
     try {
-        const { data } = await (0, api_1.makeClient)().post(`/ubriot/builds/${buildId}/submit-google-play`, { track: opts.track });
+        const { data } = await (0, api_1.makeClient)().post(`/ubriot/builds/${buildId}/submit-google-play`, playSubmitBody(readPlaySubmitOptions(opts)));
         console.log(`Build #${buildId} queued for Google Play submit, playSubmissionStatus: ${data.playSubmissionStatus}`);
     }
     catch (err) {
@@ -1105,10 +1461,15 @@ builds
 builds
     .command("artifacts <buildId>")
     .description("List artifacts for a build")
+    .option("--json", JSON_OPTION_HELP)
     .action(async (buildId) => {
     (0, config_1.requireAuth)();
     try {
         const { data } = await (0, api_1.makeClient)().get(`/ubriot/builds/${buildId}/artifacts`);
+        if (wantsJson()) {
+            printJson(data);
+            return;
+        }
         if (!data.length) {
             console.log("No artifacts yet.");
             return;
@@ -1237,10 +1598,15 @@ creds
     .command("list")
     .description("List credentials for an app")
     .requiredOption("--app <appId>")
+    .option("--json", JSON_OPTION_HELP)
     .action(async (opts) => {
     (0, config_1.requireAuth)();
     try {
         const { data } = await (0, api_1.makeClient)().get(`/ubriot/apps/${opts.app}/credentials`);
+        if (wantsJson()) {
+            printJson(data);
+            return;
+        }
         if (!data.length) {
             console.log("No credentials.");
             return;
@@ -1383,11 +1749,18 @@ creds
         (0, api_1.handleError)(err);
     }
 });
+function uploadAppleIdCommand(app) {
+    return `ubriot credentials upload-apple-id --app ${app} --name <name> --apple-id <email> --app-specific-password <password>`;
+}
 creds
     .command("setup-testflight")
     .description("Interactive guided setup for TestFlight submission (like EAS, walks you through it)")
     .requiredOption("--app <appId>", "App ID (run 'ubriot apps list' if unsure)")
     .action(async (opts) => {
+    if (!process.stdin.isTTY) {
+        console.error(`ubriot credentials setup-testflight needs an interactive terminal. Use instead: ${uploadAppleIdCommand(opts.app)}`);
+        process.exit(1);
+    }
     (0, config_1.requireAuth)();
     try {
         // 1. Confirm the app exists
@@ -1401,7 +1774,7 @@ creds
         // 2. Get Apple ID
         const appleId = await (0, readline_1.readlineSync)("Enter your Apple developer email: ");
         if (!appleId.includes("@")) {
-            console.error("That doesn't look like a valid email. Run the command again.");
+            console.error(`That doesn't look like a valid email. Run the command again, or use: ${uploadAppleIdCommand(opts.app)}`);
             process.exit(1);
         }
         // 3. Guide them to generate an app-specific password
@@ -1656,10 +2029,15 @@ push
     .command("list-server-keys")
     .description("List app-scoped Ubriot Push server keys")
     .requiredOption("--app <appId>")
+    .option("--json", JSON_OPTION_HELP)
     .action(async (opts) => {
     (0, config_1.requireAuth)();
     try {
         const { data } = await (0, api_1.makeClient)().get(`/ubriot/apps/${opts.app}/push/server-keys`);
+        if (wantsJson()) {
+            printJson(data);
+            return;
+        }
         if (!data.length) {
             console.log("No push server keys.");
             return;
@@ -1691,10 +2069,15 @@ const channels = commander_1.program.command("channels").description("Manage OTA
 channels
     .command("list")
     .requiredOption("--app <appId>")
+    .option("--json", JSON_OPTION_HELP)
     .action(async (opts) => {
     (0, config_1.requireAuth)();
     try {
         const { data } = await (0, api_1.makeClient)().get(`/ubriot/apps/${opts.app}/channels`);
+        if (wantsJson()) {
+            printJson(data);
+            return;
+        }
         if (!data.length) {
             console.log("No channels.");
             return;
@@ -1740,27 +2123,83 @@ channels
 });
 commander_1.program
     .command("update")
-    .description("Export and publish an OTA update from the current Expo app")
+    .description("Export and publish an OTA update from the current Expo or bare React Native app")
     .option("--app <appIdOrSlug>", "App ID or slug; defaults to expo.slug from app.json")
     .option("--channel <channel>", "OTA channel", "production")
     .option("--runtime-version <version>", "Runtime version; defaults to runtimeVersion from app.json")
     .option("--message <msg>", "Release note; defaults to the current git short SHA")
     .option("--platform <platform>", "ios, android, or all", "all")
-    .option("--export-dir <dir>", "Expo export output directory", "dist")
-    .option("--expo-config <path>", "Path to app.json or exported Expo config JSON", "app.json")
+    .option("--export-dir <dir>", "Export output directory", "dist")
+    .option("--expo-config <path>", "Path to app.json or exported Expo config JSON; defaults to the resolved app.config.js or app.json")
     .option("--public-url <url>", "Public API base URL used in generated asset URLs")
-    .option("--no-export", "Publish an existing export directory without running expo export")
+    .option("--bare", "Bundle a bare (non-Expo) React Native app with the RN bundler instead of expo export")
+    .option("--entry-file <file>", "Bare RN entry file (defaults to package.json main or index.js)")
+    .option("--no-export", "Publish an existing export directory without exporting again")
+    .option("--yes", "Publish without confirming the runtime reach warning or the local Node.js version warning", false)
+    .option("--private-key-path <path>", "OTA signing private key PEM (or set UBRIOT_OTA_PRIVATE_KEY)")
+    .option("--certificate-path <path>", "OTA signing certificate PEM matching the private key")
+    .option("--sign-with <keyid>", "Sign with this local key; repeat during a rotation", (value, previous) => [...previous, value], [])
     .action(async (opts) => {
     (0, config_1.requireAuth)();
     try {
-        const expoConfig = readExpoConfig(opts.expoConfig);
-        const app = resolveAppSlug(opts.app, expoConfig);
+        const projectDir = process.cwd();
+        const bare = opts.bare === true || (opts.bare === undefined && isBareRnProject(projectDir));
+        const staticConfig = readExpoConfig(opts.expoConfig);
+        const app = resolveAppSlug(opts.app, staticConfig);
+        const client = (0, api_1.makeClient)();
+        const releaseApp = bare ? null : (await client.get(`/ubriot/apps/${encodeURIComponent(app)}`)).data;
+        const identityEnv = releaseApp ? (0, build_identity_1.buildIdentityEnv)(releaseApp) : {};
+        const dynamicConfig = !bare && !opts.expoConfig && (0, build_identity_1.hasDynamicExpoConfig)(projectDir);
+        const expoConfig = dynamicConfig ? (0, build_identity_1.resolveExpoConfig)(projectDir, identityEnv) : staticConfig;
         const runtimeVersion = resolveRuntimeVersion(opts.runtimeVersion, expoConfig);
+        if (releaseApp)
+            (0, build_identity_1.assertUpdateMatchesApp)(expoConfig, releaseApp, runtimeVersion);
         const message = opts.message ?? optionalGitShortSha();
-        const client = (0, api_1.makeClient)();
+        console.log(`Build identity: ${(0, build_identity_1.describeBuildIdentity)(identityEnv)}. ${dynamicConfig ? "Resolved app config" : "App config"}: ${expoConfig.name ?? "unnamed"}, runtime ${runtimeVersion}.`);
         const publicApiBase = (opts.publicUrl || (0, config_1.readConfig)().apiBase).replace(/\/$/, "");
+        const signing = await (0, publish_signing_1.prepareSigning)({
+            client,
+            app,
+            projectDir,
+            env: process.env,
+            privateKeyPath: opts.privateKeyPath,
+            certificatePath: opts.certificatePath,
+            signWith: opts.signWith,
+            runtimeVersion,
+        });
+        for (const warning of signing.warnings)
+            console.log(`Warning: ${warning}`);
+        const identity = await (0, publish_signing_1.fetchAppIdentity)(client, app);
+        const proceed = await confirmRuntimePreflight(client, {
+            app,
+            runtimeVersion,
+            channel: opts.channel,
+            platform: opts.platform,
+            yes: opts.yes === true,
+        });
+        if (!proceed) {
+            console.log("Aborted. Nothing was published.");
+            process.exitCode = 1;
+            return;
+        }
+        if (opts.export !== false && !(await confirmLocalNode(projectDir, opts.yes === true))) {
+            console.log("Aborted. Nothing was published.");
+            process.exitCode = 1;
+            return;
+        }
         if (opts.export !== false) {
-            runLocalCommand("npx", ["expo", "export", "--platform", opts.platform, "--output-dir", opts.exportDir]);
+            if (bare) {
+                const { entryFile } = exportBareRnBundle({
+                    projectDir,
+                    platform: opts.platform,
+                    outDir: (0, path_1.resolve)(opts.exportDir),
+                    entryFile: opts.entryFile,
+                });
+                console.log(`Bundled bare React Native app (entry: ${entryFile}) into ${opts.exportDir}`);
+            }
+            else {
+                runLocalCommand("npx", ["expo", "export", "--platform", opts.platform, "--output-dir", opts.exportDir], identityEnv);
+            }
         }
         const { data, platforms } = await publishExportedUpdate({
             client,
@@ -1769,11 +2208,13 @@ commander_1.program
             runtimeVersion,
             message,
             exportDir: opts.exportDir,
-            expoConfigPath: opts.expoConfig,
+            expoConfig,
             platform: opts.platform,
             publicApiBase,
+            ubriotExtra: (0, publish_signing_1.ubriotManifestExtra)(identity, app, opts.channel),
+            signingMaterials: signing.materials,
         });
-        console.log(`Published update group #${data.updateGroupId} on channel "${data.channel}" (${platforms.map((p) => p.platform).join(", ")})`);
+        console.log(`Published update group #${data.updateGroupId} on channel "${data.channel}" (${platforms.map((p) => p.platform).join(", ")})${signing.materials.length ? `, signed with ${signing.materials.map((m) => m.keyid).join(", ")}` : ""}`);
     }
     catch (err) {
         (0, api_1.handleError)(err);
@@ -1784,10 +2225,15 @@ const updates = commander_1.program.command("updates").description("Manage OTA u
 updates
     .command("list")
     .requiredOption("--app <appId>")
+    .option("--json", JSON_OPTION_HELP)
     .action(async (opts) => {
     (0, config_1.requireAuth)();
     try {
         const { data } = await (0, api_1.makeClient)().get(`/ubriot/apps/${opts.app}/updates`);
+        if (wantsJson()) {
+            printJson(data);
+            return;
+        }
         if (!data.length) {
             console.log("No updates.");
             return;
@@ -1812,22 +2258,62 @@ updates
     .option("--public-url <url>", "Public API base URL used in generated asset URLs")
     .option("--manifest-android <path>", "Path to android manifest JSON")
     .option("--manifest-ios <path>", "Path to ios manifest JSON")
+    .option("--yes", "Publish without confirming runtime reach warnings", false)
+    .option("--private-key-path <path>", "OTA signing private key PEM (or set UBRIOT_OTA_PRIVATE_KEY)")
+    .option("--certificate-path <path>", "OTA signing certificate PEM matching the private key")
+    .option("--sign-with <keyid>", "Sign with this local key; repeat during a rotation", (value, previous) => [...previous, value], [])
     .action(async (opts) => {
     (0, config_1.requireAuth)();
     try {
         const platforms = [];
         const client = (0, api_1.makeClient)();
+        const releaseApp = (await client.get(`/ubriot/apps/${encodeURIComponent(opts.app)}`)).data;
         const publicApiBase = (opts.publicUrl || (0, config_1.readConfig)().apiBase).replace(/\/$/, "");
+        const signing = await (0, publish_signing_1.prepareSigning)({
+            client,
+            app: opts.app,
+            projectDir: process.cwd(),
+            env: process.env,
+            privateKeyPath: opts.privateKeyPath,
+            certificatePath: opts.certificatePath,
+            signWith: opts.signWith,
+            runtimeVersion: opts.runtimeVersion,
+        });
+        for (const warning of signing.warnings)
+            console.log(`Warning: ${warning}`);
+        const preflightPlatform = opts.exportDir
+            ? opts.platform
+            : opts.manifestAndroid && !opts.manifestIos
+                ? "android"
+                : opts.manifestIos && !opts.manifestAndroid
+                    ? "ios"
+                    : "all";
+        const proceed = await confirmRuntimePreflight(client, {
+            app: opts.app,
+            runtimeVersion: opts.runtimeVersion,
+            channel: opts.channel,
+            platform: preflightPlatform,
+            yes: opts.yes === true,
+        });
+        if (!proceed) {
+            console.log("Aborted. Nothing was published.");
+            process.exitCode = 1;
+            return;
+        }
         if (opts.exportDir) {
             const exportDir = (0, path_1.resolve)(opts.exportDir);
             const metadataPath = (0, path_1.join)(exportDir, "metadata.json");
             if (!(0, fs_1.existsSync)(metadataPath))
                 throw new Error(`No metadata.json found in ${exportDir}. Run: npx expo export --output-dir ${opts.exportDir}`);
             const metadataJson = readJsonFile(metadataPath);
-            const configJson = (0, fs_1.existsSync)((0, path_1.resolve)(opts.expoConfig)) ? readJsonFile((0, path_1.resolve)(opts.expoConfig)) : {};
+            if (!(0, fs_1.existsSync)((0, path_1.resolve)(opts.expoConfig)))
+                throw new Error(`Expo config not found: ${(0, path_1.resolve)(opts.expoConfig)}`);
+            const configJson = readJsonFile((0, path_1.resolve)(opts.expoConfig));
             const expoConfig = configJson.expo ?? configJson;
+            (0, build_identity_1.assertUpdateMatchesApp)(expoConfig, releaseApp, opts.runtimeVersion);
             const publishId = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
             const selectedPlatforms = opts.platform === "all" ? ["ios", "android"] : [opts.platform];
+            const ubriotExtra = (0, publish_signing_1.ubriotManifestExtra)(await (0, publish_signing_1.fetchAppIdentity)(client, opts.app), opts.app, opts.channel);
             for (const platform of selectedPlatforms) {
                 if (platform !== "ios" && platform !== "android")
                     throw new Error("--platform must be ios, android, or all");
@@ -1842,6 +2328,7 @@ updates
                     expoConfig,
                     metadataJson,
                     publicApiBase,
+                    ubriotExtra,
                 });
                 if (payload)
                     platforms.push(payload);
@@ -1850,10 +2337,16 @@ updates
         else {
             if (opts.manifestAndroid) {
                 const manifestJson = (0, fs_1.readFileSync)(opts.manifestAndroid, "utf8");
+                const manifest = JSON.parse(manifestJson);
+                if (manifest?.extra?.expoClient)
+                    (0, build_identity_1.assertUpdateMatchesApp)(manifest.extra.expoClient, releaseApp, opts.runtimeVersion);
                 platforms.push({ platform: "android", manifestJson, assets: [] });
             }
             if (opts.manifestIos) {
                 const manifestJson = (0, fs_1.readFileSync)(opts.manifestIos, "utf8");
+                const manifest = JSON.parse(manifestJson);
+                if (manifest?.extra?.expoClient)
+                    (0, build_identity_1.assertUpdateMatchesApp)(manifest.extra.expoClient, releaseApp, opts.runtimeVersion);
                 platforms.push({ platform: "ios", manifestJson, assets: [] });
             }
         }
@@ -1865,14 +2358,15 @@ updates
             channel: opts.channel,
             runtimeVersion: opts.runtimeVersion,
             message: opts.message,
-            platforms,
+            platforms: (0, publish_signing_1.signPlatforms)(platforms, signing.materials),
         }, { timeout: 120000 });
-        console.log(`Published update group #${data.updateGroupId} on channel "${data.channel}" (${platforms.map((p) => p.platform).join(", ")})`);
+        console.log(`Published update group #${data.updateGroupId} on channel "${data.channel}" (${platforms.map((p) => p.platform).join(", ")})${signing.materials.length ? `, signed with ${signing.materials.map((m) => m.keyid).join(", ")}` : ""}`);
     }
     catch (err) {
         (0, api_1.handleError)(err);
     }
 });
+(0, signing_commands_1.registerSigningCommands)(commander_1.program, updates);
 // ─── Migrate ─────────────────────────────────────────────────────────────────
 const migrate = commander_1.program.command("migrate").description("Migrate onto Ubriot from other services");
 migrate
@@ -1947,4 +2441,21 @@ migrate
         (0, api_1.handleError)(err);
     }
 });
+commander_1.program
+    .command("ask <question>")
+    .description("Ask the Release Copilot about your builds, failures, release health and readiness")
+    .action(async (question) => {
+    (0, config_1.requireAuth)();
+    try {
+        const { data } = await (0, api_1.makeClient)().post("/ubriot/copilot/chat", { message: question, history: [] });
+        process.stdout.write(`\n${data.reply}\n`);
+        if (Array.isArray(data.toolsUsed) && data.toolsUsed.length > 0) {
+            const seen = Array.from(new Set(data.toolsUsed));
+            process.stdout.write(`\nLooked at: ${seen.join(", ")}\n`);
+        }
+    }
+    catch (err) {
+        (0, api_1.handleError)(err);
+    }
+});
 commander_1.program.parse(process.argv);