vibeview 0.17.1 → 0.19.0

package/README.md

@@ -49,15 +49,22 @@ cloud device. Add `--production` for a **signed release build** on iOS,
 tvOS, Android, or Android TV, using signing credentials you store once:
 
 ```bash
-# Apple: your distribution certificate + provisioning profile
+# Apple: connect your team once with an App Store Connect API key,
+# then VibeView creates the certificate + provisioning profile for you
+vibeview credentials asc-key add --key-id <K> --issuer-id <I> --file AuthKey_<K>.p8
+vibeview credentials generate --platform ios --name release --app <app-id>
+
+# ...or upload an exported certificate + profile yourself
 vibeview credentials add --platform ios --file cert.p12 --profile app.mobileprovision
 
 # Android: upload a keystore — or have VibeView generate one (no Java needed)
 vibeview credentials generate --platform android --name release
 ```
 
-Credentials are stored encrypted and never readable back. Build-time
-secrets work the same way:
+Uploaded credentials are stored encrypted and never readable back;
+credentials VibeView generated can be re-downloaded by org admins with
+`vibeview credentials download <name>` (every download is audited).
+Build-time secrets work the same way:
 
 ```bash
 vibeview env set NPM_TOKEN "..."        # secret by default, injected into builds
@@ -67,6 +74,10 @@ vibeview webhooks add --url https://ci.example.com/hooks/vibeview
 Webhooks POST a signed payload to your endpoint whenever a build finishes.
 Manage running builds with `vibeview builds list | logs | download | cancel`.
 
+Expo managed projects work out of the box — the default build command runs
+`npx expo prebuild` in the cloud, so no `ios/` or `android/` directory is
+needed.
+
 [Cloud Builds docs →](https://vibeview.io/docs/cloud-builds) ·
 [App Signing →](https://vibeview.io/docs/app-signing) ·
 [Build Webhooks →](https://vibeview.io/docs/build-webhooks)
@@ -123,31 +134,32 @@ Output formats: `human`, `json`, and `junit` for any CI system. The exit code re
 
 ## All commands
 
-| Command | Purpose |
-| --- | --- |
-| `vibeview login` / `logout` / `whoami` | Authenticate via browser, sign out, show who you are |
-| `vibeview dev` | Live development on a cloud device |
-| `vibeview build` | Build your app — locally, or on the build fleet with `--cloud` (add `--production` for a signed release) |
-| `vibeview builds list/logs/download/cancel/delete-artifact` | Manage cloud builds and their artifacts |
-| `vibeview credentials add/generate/list/rm` | App-signing credentials for production builds |
-| `vibeview env list/set/rm/pull` | Build variables and secrets injected into cloud builds |
-| `vibeview webhooks add/list/rm/test` | Notify your systems when builds finish (signed payloads) |
-| `vibeview dev-status` / `dev-stop` | Check on, or stop, a backgrounded dev session |
-| `vibeview agent-setup` | Make VibeView discoverable to your coding agent (skill + MCP) |
-| `vibeview mcp` | Run the MCP server so an agent can drive the device |
-| `vibeview ui-tree` | The current screen's elements, each with a ref to act on |
-| `vibeview logs` | Recent app logs from the device (console output, errors, crashes) |
-| `vibeview screenshot` | Capture the screen to a PNG |
-| `vibeview tap` / `type` / `scroll` / `press` | Drive the device |
-| `vibeview scroll-to` / `drag` / `alert` / `find` | Search, precise gestures, iOS system alerts |
-| `vibeview upload-app <file>` | Upload a build (zipped simulator `.app`, or `.apk`) |
-| `vibeview list-apps` | List your apps |
-| `vibeview list-devices` | List available device types |
-| `vibeview list-suites` | List test suites |
-| `vibeview create-test [name]` | Create a test case |
-| `vibeview run-test <test-id>` | Run a single test |
-| `vibeview run-suite <suite-id>` | Run a test suite |
-| `vibeview run-suites` | Run multiple suites |
+| Command                                                     | Purpose                                                                                                  |
+| ----------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
+| `vibeview login` / `logout` / `whoami`                      | Authenticate via browser, sign out, show who you are                                                     |
+| `vibeview dev`                                              | Live development on a cloud device                                                                       |
+| `vibeview build`                                            | Build your app — locally, or on the build fleet with `--cloud` (add `--production` for a signed release) |
+| `vibeview builds list/logs/download/cancel/delete-artifact` | Manage cloud builds and their artifacts                                                                  |
+| `vibeview credentials add/generate/list/rm/download`        | App-signing credentials for production builds (`generate` covers iOS, tvOS, and Android)                 |
+| `vibeview credentials asc-key add/list/rm`                  | Connect an Apple team via App Store Connect API key                                                      |
+| `vibeview env list/set/rm/pull`                             | Build variables and secrets injected into cloud builds                                                   |
+| `vibeview webhooks add/list/rm/test`                        | Notify your systems when builds finish (signed payloads)                                                 |
+| `vibeview dev-status` / `dev-stop`                          | Check on, or stop, a backgrounded dev session                                                            |
+| `vibeview agent-setup`                                      | Make VibeView discoverable to your coding agent (skill + MCP)                                            |
+| `vibeview mcp`                                              | Run the MCP server so an agent can drive the device                                                      |
+| `vibeview ui-tree`                                          | The current screen's elements, each with a ref to act on                                                 |
+| `vibeview logs`                                             | Recent app logs from the device (console output, errors, crashes)                                        |
+| `vibeview screenshot`                                       | Capture the screen to a PNG                                                                              |
+| `vibeview tap` / `type` / `scroll` / `press`                | Drive the device                                                                                         |
+| `vibeview scroll-to` / `drag` / `alert` / `find`            | Search, precise gestures, iOS system alerts                                                              |
+| `vibeview upload-app <file>`                                | Upload a build (zipped simulator `.app`, or `.apk`)                                                      |
+| `vibeview list-apps`                                        | List your apps                                                                                           |
+| `vibeview list-devices`                                     | List available device types                                                                              |
+| `vibeview list-suites`                                      | List test suites                                                                                         |
+| `vibeview create-test [name]`                               | Create a test case                                                                                       |
+| `vibeview run-test <test-id>`                               | Run a single test                                                                                        |
+| `vibeview run-suite <suite-id>`                             | Run a test suite                                                                                         |
+| `vibeview run-suites`                                       | Run multiple suites                                                                                      |
 
 Run any command with `--help` for its options.
 

package/dist/{chunk-SYFMOPJW.js → chunk-FG2J2BGS.js}

@@ -287,10 +287,15 @@ var ApiClient = class {
     const qs = offset !== void 0 ? `?offset=${offset}` : "";
     return this.requestRaw("GET", `/builds/${id}/logs${qs}`);
   }
-  async listCloudBuilds(limit, offset) {
+  /** GET /api/v1/builds/ — the filter values are forwarded verbatim; the
+   *  backend accepts comma-separated lists for platform/status. */
+  async listCloudBuilds(opts) {
     const params = new URLSearchParams();
-    if (limit !== void 0) params.set("limit", String(limit));
-    if (offset !== void 0) params.set("offset", String(offset));
+    if (opts?.platform !== void 0) params.set("platform", opts.platform);
+    if (opts?.status !== void 0) params.set("status", opts.status);
+    if (opts?.distribution !== void 0) params.set("distribution", opts.distribution);
+    if (opts?.limit !== void 0) params.set("limit", String(opts.limit));
+    if (opts?.offset !== void 0) params.set("offset", String(opts.offset));
     const qs = params.toString();
     return this.requestRaw("GET", `/builds/${qs ? `?${qs}` : ""}`);
   }
@@ -424,18 +429,104 @@ var ApiClient = class {
   async deleteSigningCredential(id) {
     await this.requestRaw("DELETE", `/signing-credentials/${id}`);
   }
+  /** GET /api/v1/signing-credentials/asc-keys. Requires VIEWER role. Metadata
+   *  only — the .p8 is never returned. */
+  async listAscKeys() {
+    return this.requestRaw("GET", "/signing-credentials/asc-keys");
+  }
+  /** POST /api/v1/signing-credentials/asc-keys (multipart). Requires ADMIN
+   *  role. Same-name upload is a rotation upsert server-side. Field names are
+   *  converted to the route's snake_case here, at the client boundary, like
+   *  addSigningCredential. */
+  async addAscKey(body) {
+    const formData = new FormData();
+    if (body.name !== void 0) formData.append("name", body.name);
+    formData.append("issuer_id", body.issuerId);
+    formData.append("key_id", body.keyId);
+    formData.append("file", new Blob([new Uint8Array(body.file)]), body.filename);
+    return this.requestFormData("POST", "/signing-credentials/asc-keys", formData);
+  }
+  /** DELETE /api/v1/signing-credentials/asc-keys/{id}. Requires ADMIN role. */
+  async deleteAscKey(id) {
+    await this.requestRaw("DELETE", `/signing-credentials/asc-keys/${id}`);
+  }
+  /** GET /api/v1/signing-credentials/play-keys. Requires VIEWER role.
+   *  Metadata only — the service-account JSON is never returned. */
+  async listPlayKeys() {
+    return this.requestRaw("GET", "/signing-credentials/play-keys");
+  }
+  /** POST /api/v1/signing-credentials/play-keys (multipart). Requires ADMIN
+   *  role. Same-name upload is a rotation upsert server-side — mirrors
+   *  addAscKey exactly (there are no extra id fields: the client_email is
+   *  read out of the JSON server-side). */
+  async addPlayKey(body) {
+    const formData = new FormData();
+    if (body.name !== void 0) formData.append("name", body.name);
+    formData.append("file", new Blob([new Uint8Array(body.file)]), body.filename);
+    return this.requestFormData("POST", "/signing-credentials/play-keys", formData);
+  }
+  /** DELETE /api/v1/signing-credentials/play-keys/{id}. Requires ADMIN role. */
+  async deletePlayKey(id) {
+    await this.requestRaw("DELETE", `/signing-credentials/play-keys/${id}`);
+  }
+  /** POST /api/v1/submissions — submit a succeeded production build's
+   *  artifact to TestFlight (ios/tvos) or a Play track (android/androidtv).
+   *  `platform` is always sent: the backend derives the real platform from
+   *  the build row and 400s on a mismatch, so a pasted wrong --build id
+   *  fails loudly instead of silently submitting to the other store family.
+   *  As with addSigningCredential, the CLI's camelCase (`ascKey`) is
+   *  converted to the route's snake_case at this boundary and nowhere else.
+   *  4xx details (including the 409 "already active" refusal and the 400
+   *  platform-mismatch) surface verbatim via extractDetail. */
+  async createSubmission(body) {
+    return this.requestRaw("POST", "/submissions", {
+      build: body.build,
+      platform: body.platform,
+      ...body.track !== void 0 ? { track: body.track } : {},
+      ...body.package !== void 0 ? { package: body.package } : {},
+      ...body.ascKey !== void 0 ? { asc_key: body.ascKey } : {}
+    });
+  }
+  /** GET /api/v1/submissions?build=<id> — that build's submissions, newest
+   *  first. */
+  async listSubmissions(build) {
+    return this.requestRaw("GET", `/submissions?build=${encodeURIComponent(build)}`);
+  }
+  /** GET /api/v1/submissions/{id}. */
+  async getSubmission(id) {
+    return this.requestRaw("GET", `/submissions/${id}`);
+  }
+  /** GET /api/v1/submissions/{id}/log[?offset=N] — same {content, offset,
+   *  status} shape as getCloudBuildLogs, so the follow loops share one
+   *  response type. */
+  async getSubmissionLog(id, offset) {
+    const qs = offset !== void 0 ? `?offset=${offset}` : "";
+    return this.requestRaw("GET", `/submissions/${id}/log${qs}`);
+  }
+  /** GET /api/v1/signing-credentials/{id}/material. Requires ADMIN role;
+   *  audited server-side. 404s (NotFoundError) for non-generated rows —
+   *  uploaded material is never readable back. */
+  async getSigningCredentialMaterial(id) {
+    return this.requestRaw("GET", `/signing-credentials/${id}/material`);
+  }
   /**
-   * POST /api/v1/signing-credentials/generate. Requires ADMIN role. Generates an Android
-   * keystore server-side and stores it as a credential; the response is the
-   * ONLY time the keystore bytes and passwords are ever returned. As with
-   * addSigningCredential, the CLI's camelCase (`keyAlias`) is converted to
-   * the route's snake_case at this boundary and nowhere else.
+   * POST /api/v1/signing-credentials/generate. Requires ADMIN role. Generates a signing
+   * credential server-side and stores it. `platform` omitted means android
+   * (the server default); for android the response carries the keystore
+   * bytes and passwords inline, for ios/tvos it is a plain credential (no
+   * inline material — see getSigningCredentialMaterial). As with
+   * addSigningCredential, the CLI's camelCase (`keyAlias`, `bundleId`,
+   * `ascKey`) is converted to the route's snake_case at this boundary and
+   * nowhere else.
    */
   async generateSigningCredential(body) {
     return this.requestRaw("POST", "/signing-credentials/generate", {
       name: body.name,
+      ...body.platform !== void 0 ? { platform: body.platform } : {},
       ...body.app !== void 0 ? { app: body.app } : {},
       ...body.keyAlias !== void 0 ? { key_alias: body.keyAlias } : {},
+      ...body.bundleId !== void 0 ? { bundle_id: body.bundleId } : {},
+      ...body.ascKey !== void 0 ? { asc_key: body.ascKey } : {},
       ...body.overwrite !== void 0 ? { overwrite: body.overwrite } : {}
     });
   }

package/dist/{chunk-3IMJ7FNN.js → chunk-T6FS4ELD.js}

@@ -5,7 +5,7 @@ import {
   loadConfig,
   resolveAuth,
   uploadAppBuild
-} from "./chunk-SYFMOPJW.js";
+} from "./chunk-FG2J2BGS.js";
 
 // src/lib/dev-state.ts
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
@@ -358,6 +358,9 @@ function detectFlavor(cwd) {
   if (isFile(join4(cwd, "manifest"))) return "roku";
   return "unknown";
 }
+function isManagedExpo(cwd) {
+  return detectFlavor(cwd) === "expo" && !existsSync3(join4(cwd, "android", "gradlew")) && iosWorkspaceName(cwd) === null;
+}
 function iosWorkspaceName(cwd) {
   try {
     const found = readdirSync2(join4(cwd, "ios")).find((f) => f.endsWith(".xcworkspace"));
@@ -420,21 +423,51 @@ function defaultsFor(cwd, platform) {
 var ANDROID_PRODUCTION_ARTIFACT = "android/app/build/outputs/bundle/release/*.aab";
 var ANDROID_PRODUCTION_COMMAND = "yarn install --immutable && cd android && ./gradlew bundleRelease";
 var IOS_PRODUCTION_ARTIFACT = "ios/build/*.ipa";
+var MANAGED_EXPO_ANDROID_PRODUCTION_COMMAND = "yarn install --immutable && npx expo prebuild --platform android --no-install && cd android && ./gradlew bundleRelease";
+function expoSanitizedName(name) {
+  return name.replace(/[\W_]+/g, "").normalize("NFD").replace(/[\u0300-\u036f]/g, "");
+}
+function managedExpoIosName(cwd) {
+  if (existsSync3(join4(cwd, "app.config.js")) || existsSync3(join4(cwd, "app.config.ts"))) {
+    return null;
+  }
+  const raw = readJson(cwd, "app.config.json") ?? readJson(cwd, "app.json");
+  if (!raw) return null;
+  const config = "expo" in raw ? raw.expo : raw;
+  if (typeof config !== "object" || config === null) return null;
+  const name = config.name;
+  if (typeof name !== "string") return null;
+  return expoSanitizedName(name) || null;
+}
+function iosArchiveExportCommand(ws) {
+  const archivePath = `ios/build/${ws}.xcarchive`;
+  const archiveCmd = `xcodebuild archive -workspace ios/${ws}.xcworkspace -scheme ${ws} -configuration Release -archivePath ${archivePath} CODE_SIGN_STYLE=Manual \${VIBEVIEW_DEVELOPMENT_TEAM:+"DEVELOPMENT_TEAM=$VIBEVIEW_DEVELOPMENT_TEAM"} \${VIBEVIEW_PROVISIONING_PROFILE:+"PROVISIONING_PROFILE_SPECIFIER=$VIBEVIEW_PROVISIONING_PROFILE"} \${VIBEVIEW_CODE_SIGN_IDENTITY:+"CODE_SIGN_IDENTITY=$VIBEVIEW_CODE_SIGN_IDENTITY"}`;
+  const exportCmd = `xcodebuild -exportArchive -archivePath ${archivePath} -exportPath ios/build -exportOptionsPlist "$VIBEVIEW_EXPORT_OPTIONS_PLIST"`;
+  return `${archiveCmd} && ${exportCmd}`;
+}
 function productionDefaultsFor(cwd, platform) {
   if (platform === "android" || platform === "androidtv") {
-    return { buildCommand: ANDROID_PRODUCTION_COMMAND, artifact: ANDROID_PRODUCTION_ARTIFACT };
+    return {
+      buildCommand: isManagedExpo(cwd) ? MANAGED_EXPO_ANDROID_PRODUCTION_COMMAND : ANDROID_PRODUCTION_COMMAND,
+      artifact: ANDROID_PRODUCTION_ARTIFACT
+    };
   }
   if (platform === "tvos") {
     return { artifact: IOS_PRODUCTION_ARTIFACT };
   }
   if (platform === "ios") {
+    if (isManagedExpo(cwd)) {
+      const name = managedExpoIosName(cwd);
+      if (!name) return { artifact: IOS_PRODUCTION_ARTIFACT };
+      return {
+        buildCommand: "yarn install --immutable && npx expo prebuild --platform ios && " + iosArchiveExportCommand(name),
+        artifact: IOS_PRODUCTION_ARTIFACT
+      };
+    }
     const ws = iosWorkspaceName(cwd);
     if (!ws) return { artifact: IOS_PRODUCTION_ARTIFACT };
-    const archivePath = `ios/build/${ws}.xcarchive`;
-    const archiveCmd = `xcodebuild archive -workspace ios/${ws}.xcworkspace -scheme ${ws} -configuration Release -archivePath ${archivePath} CODE_SIGN_STYLE=Manual \${VIBEVIEW_DEVELOPMENT_TEAM:+"DEVELOPMENT_TEAM=$VIBEVIEW_DEVELOPMENT_TEAM"} \${VIBEVIEW_PROVISIONING_PROFILE:+"PROVISIONING_PROFILE_SPECIFIER=$VIBEVIEW_PROVISIONING_PROFILE"} \${VIBEVIEW_CODE_SIGN_IDENTITY:+"CODE_SIGN_IDENTITY=$VIBEVIEW_CODE_SIGN_IDENTITY"}`;
-    const exportCmd = `xcodebuild -exportArchive -archivePath ${archivePath} -exportPath ios/build -exportOptionsPlist "$VIBEVIEW_EXPORT_OPTIONS_PLIST"`;
     return {
-      buildCommand: `yarn install --immutable && ${archiveCmd} && ${exportCmd}`,
+      buildCommand: `yarn install --immutable && ${iosArchiveExportCommand(ws)}`,
       artifact: IOS_PRODUCTION_ARTIFACT
     };
   }
@@ -1000,8 +1033,13 @@ function persistPickedAppId(cwd, cfg, platform, appId) {
   saveDevConfig(cwd, next);
   return next;
 }
-var CREATE_NEW_APP = "__vibeview_create_new_app__";
-var DONT_LINK_APP = "__vibeview_dont_link_app__";
+var APP_PICKER_SENTINEL = {
+  CREATE_NEW_APP: "__vibeview_create_new_app__",
+  DONT_LINK_APP: "__vibeview_dont_link_app__"
+};
+function isAppPickerSentinel(value) {
+  return Object.values(APP_PICKER_SENTINEL).includes(value);
+}
 async function resolveCloudAppIds(cwd, cfgRef, platforms, opts, listApps) {
   const createFromArtifact = /* @__PURE__ */ new Set();
   const missing = platforms.filter((p) => !cfgRef.current?.platforms?.[p]?.appId);
@@ -1041,18 +1079,23 @@ async function resolveCloudAppIds(cwd, cfgRef, platforms, opts, listApps) {
         // Under --production a "Don't link an app" row leads the list (the
         // neutral default, since the create-from-artifact escape hatch below
         // is suppressed there): production builds aren't linked to an app
-        // unless the user explicitly wants the link — see DONT_LINK_APP.
-        ...opts.production ? [{ value: DONT_LINK_APP, name: "Don't link an app" }] : [],
+        // unless the user explicitly wants the link — see APP_PICKER_SENTINEL.
+        ...opts.production ? [{ value: APP_PICKER_SENTINEL.DONT_LINK_APP, name: "Don't link an app" }] : [],
         ...apps.map((a) => ({ value: a.public_id, name: a.name })),
         // No create-from-artifact row under --production: a production build
         // never creates an app (internal_builds returns before app creation),
         // so offering it would promise something that can't happen. Picking
         // an EXISTING app is still meaningful — app-scoped signing
         // credentials resolve by app.
-        ...opts.production ? [] : [{ value: CREATE_NEW_APP, name: "Create a new app from this build" }]
+        ...opts.production ? [] : [
+          {
+            value: APP_PICKER_SENTINEL.CREATE_NEW_APP,
+            name: "Create a new app from this build"
+          }
+        ]
       ]
     });
-    if (appId === CREATE_NEW_APP || appId === DONT_LINK_APP) {
+    if (isAppPickerSentinel(appId)) {
       createFromArtifact.add(platform);
       continue;
     }
@@ -3361,6 +3404,7 @@ export {
   readMetroState,
   killOwnedMetro,
   buildCommand,
+  formatDuration,
   BUILD_TERMINAL_STATUSES,
   fetchFinalSummary,
   newTransitionState,