vibeview 0.17.1 → 0.19.0

package/dist/cli.js

@@ -6,6 +6,7 @@ import {
   clearDevState,
   dev,
   fetchFinalSummary,
+  formatDuration,
   killOwnedMetro,
   newTransitionState,
   printOutcomeLine,
@@ -13,7 +14,7 @@ import {
   readDevState,
   readMetroState,
   runAgentVerb
-} from "./chunk-3IMJ7FNN.js";
+} from "./chunk-T6FS4ELD.js";
 import {
   ApiClient,
   EXIT_INFRA_ERROR,
@@ -26,7 +27,7 @@ import {
   resolveAuth,
   saveConfig,
   uploadApp
-} from "./chunk-SYFMOPJW.js";
+} from "./chunk-FG2J2BGS.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -1210,7 +1211,7 @@ async function buildsList(opts, deps) {
     }
   }
   try {
-    const { builds: builds2 } = await d.listCloudBuilds(limit);
+    const { builds: builds2 } = await d.listCloudBuilds(limit !== void 0 ? { limit } : void 0);
     if (opts.json) {
       console.log(JSON.stringify(builds2, null, 2));
     } else {
@@ -1378,9 +1379,192 @@ function printError(opts, err) {
   console.error(chalk11.red(`error: ${message}`));
 }
 
-// src/commands/whoami.ts
+// src/commands/submit.ts
 import chalk12 from "chalk";
-function defaultDeps2(opts) {
+function defaultDeps2(client) {
+  return {
+    createSubmission: client.createSubmission.bind(client),
+    getSubmission: client.getSubmission.bind(client),
+    getSubmissionLog: client.getSubmissionLog.bind(client),
+    listCloudBuilds: client.listCloudBuilds.bind(client)
+  };
+}
+var POLL_INTERVAL_MS2 = 2e3;
+var SUBMIT_PLATFORMS = ["ios", "tvos", "android", "androidtv"];
+function isSubmitPlatform(p) {
+  return SUBMIT_PLATFORMS.includes(p);
+}
+var PLAY_TRACKS = ["internal", "alpha", "beta", "production"];
+var SUBMISSION_TERMINAL_STATUSES = /* @__PURE__ */ new Set(["succeeded", "failed"]);
+var MAX_CONSECUTIVE_POLL_FAILURES2 = 5;
+function emit(json, evt) {
+  if (json) console.log(JSON.stringify(evt));
+}
+async function submitCommand(opts, deps) {
+  if (!opts.platform || !isSubmitPlatform(opts.platform)) {
+    throw new UsageError(
+      `--platform is required and must be one of ${SUBMIT_PLATFORMS.join(", ")}`
+    );
+  }
+  const platform = opts.platform;
+  const androidFamily = platform === "android" || platform === "androidtv";
+  if (opts.build && opts.latest) {
+    throw new UsageError("pass either --build <id> or --latest, not both");
+  }
+  if (!opts.build && !opts.latest) {
+    throw new UsageError(
+      "pass --build <id> (see `vibeview builds list`) or --latest (the newest succeeded production build for this platform)"
+    );
+  }
+  if (!androidFamily && opts.track !== void 0) {
+    throw new UsageError(`--track only applies to android/androidtv (Play) \u2014 not ${platform}`);
+  }
+  if (!androidFamily && opts.package !== void 0) {
+    throw new UsageError(`--package only applies to android/androidtv (Play) \u2014 not ${platform}`);
+  }
+  if (androidFamily && opts.ascKey !== void 0) {
+    throw new UsageError(`--asc-key only applies to ios/tvos (TestFlight) \u2014 not ${platform}`);
+  }
+  if (opts.track !== void 0 && !PLAY_TRACKS.includes(opts.track)) {
+    throw new UsageError(`--track must be one of ${PLAY_TRACKS.join(", ")} \u2014 got "${opts.track}"`);
+  }
+  const { token, baseUrl } = resolveAuth(opts);
+  const client = new ApiClient(baseUrl, token);
+  const d = deps ?? defaultDeps2(client);
+  try {
+    const buildId = opts.build ?? await resolveLatestBuild(platform, d);
+    const sub = await d.createSubmission({
+      build: buildId,
+      platform,
+      ...opts.track !== void 0 ? { track: opts.track } : {},
+      ...opts.package !== void 0 ? { package: opts.package } : {},
+      ...opts.ascKey !== void 0 ? { asc_key: opts.ascKey } : {}
+    });
+    emit(opts.json, {
+      event: "submission_created",
+      id: sub.id,
+      build_id: sub.build_id,
+      platform: sub.platform
+    });
+    if (opts.wait === false) {
+      if (!opts.json) console.log(sub.id);
+      process.exitCode = 0;
+      return;
+    }
+    if (!opts.json) {
+      console.error(`  ${chalk12.cyan(sub.id)}  ${chalk12.dim(`[${sub.platform}]`)}`);
+    }
+    const final = await followSubmission(sub, opts, d);
+    process.exitCode = final.status === "succeeded" ? 0 : 1;
+  } catch (err) {
+    printError2(opts, err);
+    process.exitCode = 1;
+  }
+}
+async function resolveLatestBuild(platform, deps) {
+  const { builds: builds2 } = await deps.listCloudBuilds({
+    platform,
+    status: "succeeded",
+    distribution: "production",
+    limit: 200
+  });
+  const match = builds2.find(
+    (b) => b.platform === platform && b.distribution === "production" && b.status === "succeeded" && b.has_artifact
+  );
+  if (!match) {
+    throw new Error(
+      `no submittable ${platform} build found \u2014 --latest needs a succeeded production build whose artifact is still stored. Run \`vibeview build --cloud --production --platform ${platform}\` first, or pass --build <id> (see \`vibeview builds list\`).`
+    );
+  }
+  if (match.platform !== platform) {
+    throw new Error(
+      `--latest resolved build ${match.id}, which is ${match.platform}, not ${platform} \u2014 refusing to submit it.`
+    );
+  }
+  return match.id;
+}
+async function followSubmission(created, opts, deps) {
+  const pollIntervalMs = deps.pollIntervalMs ?? POLL_INTERVAL_MS2;
+  let offset = 0;
+  let status = created.status;
+  let consecutiveFailures = 0;
+  let printedQueued = false;
+  let printedRunning = false;
+  while (!SUBMISSION_TERMINAL_STATUSES.has(status)) {
+    try {
+      const log = await deps.getSubmissionLog(created.id, offset);
+      if (log.status === "queued" && !printedQueued) {
+        printedQueued = true;
+        if (opts.json) {
+          emit(opts.json, { event: "status", id: created.id, status: "queued" });
+        } else {
+          console.error(chalk12.dim("\u23F3 queued \u2014 waiting for a submission slot"));
+        }
+      } else if (log.status === "running" && !printedRunning) {
+        printedRunning = true;
+        if (opts.json) {
+          emit(opts.json, { event: "status", id: created.id, status: "running" });
+        } else {
+          console.error(`${chalk12.cyan("\u25B6")} submitting`);
+        }
+      }
+      if (log.content) {
+        if (opts.json) {
+          emit(opts.json, { event: "submission_log", id: created.id, content: log.content });
+        } else {
+          process.stdout.write(log.content);
+        }
+      }
+      offset = log.offset;
+      status = log.status;
+      consecutiveFailures = 0;
+    } catch (err) {
+      if (err instanceof NotFoundError) throw err;
+      consecutiveFailures++;
+      if (consecutiveFailures >= MAX_CONSECUTIVE_POLL_FAILURES2) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(
+          `submission poll failed ${consecutiveFailures} times in a row, giving up: ${message}
+The submission continues server-side \u2014 see its outcome on the Builds page in the dashboard (expand build ${created.build_id}'s row \u2192 Submissions).`
+        );
+      }
+    }
+    if (!SUBMISSION_TERMINAL_STATUSES.has(status)) {
+      await new Promise((r) => setTimeout(r, pollIntervalMs));
+    }
+  }
+  let final;
+  try {
+    final = await deps.getSubmission(created.id);
+  } catch {
+    final = { ...created, status };
+  }
+  emit(opts.json, {
+    event: "submission_finished",
+    id: final.id,
+    status: final.status,
+    error_summary: final.error_summary
+  });
+  if (!opts.json) {
+    const ok = final.status === "succeeded";
+    const mark = ok ? chalk12.green("\u2713") : chalk12.red("\u2717");
+    const duration = formatDuration(final.started_at, final.finished_at);
+    let line = `${mark} ${final.status}`;
+    if (duration) line += ` (${duration})`;
+    if (final.error_summary) line += ` \u2014 ${final.error_summary}`;
+    console.error(line);
+  }
+  return final;
+}
+function printError2(opts, err) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (opts.json) console.log(JSON.stringify({ event: "error", message }));
+  console.error(chalk12.red(`error: ${message}`));
+}
+
+// src/commands/whoami.ts
+import chalk13 from "chalk";
+function defaultDeps3(opts) {
   const { token, baseUrl } = resolveAuth(opts);
   const client = new ApiClient(baseUrl, token);
   return { fetchMe: () => client.whoAmI() };
@@ -1392,7 +1576,7 @@ function effectiveRole(role, tokenRole) {
   return (RANK[tokenRole] ?? 3) < (RANK[role] ?? 3) ? tokenRole : role;
 }
 async function whoAmI(opts, deps) {
-  const d = deps ?? defaultDeps2(opts);
+  const d = deps ?? defaultDeps3(opts);
   try {
     const me = await d.fetchMe();
     const effective = effectiveRole(me.role, me.token_role);
@@ -1401,27 +1585,27 @@ async function whoAmI(opts, deps) {
       process.exitCode = 0;
       return;
     }
-    console.log(`${chalk12.bold("Logged in as")}  ${me.email}`);
+    console.log(`${chalk13.bold("Logged in as")}  ${me.email}`);
     if (me.memberships.length === 1) {
-      console.log(`${chalk12.bold("Organization")}   ${me.memberships[0].organization_name}`);
+      console.log(`${chalk13.bold("Organization")}   ${me.memberships[0].organization_name}`);
     } else if (me.memberships.length > 1) {
-      console.log(chalk12.bold("Organizations"));
+      console.log(chalk13.bold("Organizations"));
       for (const m of me.memberships) {
         console.log(`  ${m.organization_name} (${m.role})`);
       }
     }
-    console.log(`${chalk12.bold("Member role")}    ${me.role ?? "\u2014"}`);
-    console.log(`${chalk12.bold("Token role")}     ${me.token_role ?? "\u2014 (session auth)"}`);
-    console.log(`${chalk12.bold("Effective role")} ${effective ?? "\u2014"}`);
+    console.log(`${chalk13.bold("Member role")}    ${me.role ?? "\u2014"}`);
+    console.log(`${chalk13.bold("Token role")}     ${me.token_role ?? "\u2014 (session auth)"}`);
+    console.log(`${chalk13.bold("Effective role")} ${effective ?? "\u2014"}`);
     if (me.is_superadmin) {
-      console.log(chalk12.dim("Superadmin (platform-wide; does not raise the org role above)"));
+      console.log(chalk13.dim("Superadmin (platform-wide; does not raise the org role above)"));
     }
     if (me.role === "admin" && me.token_role && me.token_role !== "admin") {
       console.log(
-        chalk12.yellow(
+        chalk13.yellow(
           `
-Your account is admin, but this CLI token is ${me.token_role}. The effective role is the lower of the two, so admin-only commands (such as ${chalk12.bold("vibeview env set")}) will fail with a permissions error.
-Create an admin API token in the dashboard and use ${chalk12.bold("--token")} or ${chalk12.bold("VIBEVIEW_API_TOKEN")}.`
+Your account is admin, but this CLI token is ${me.token_role}. The effective role is the lower of the two, so admin-only commands (such as ${chalk13.bold("vibeview env set")}) will fail with a permissions error.
+Create an admin API token in the dashboard and use ${chalk13.bold("--token")} or ${chalk13.bold("VIBEVIEW_API_TOKEN")}.`
         )
       );
     }
@@ -1431,7 +1615,7 @@ Create an admin API token in the dashboard and use ${chalk12.bold("--token")} or
     if (opts.json) {
       console.log(JSON.stringify({ event: "error", message }));
     }
-    console.error(chalk12.red(`error: ${message}`));
+    console.error(chalk13.red(`error: ${message}`));
     process.exitCode = 1;
   }
 }
@@ -1439,7 +1623,7 @@ Create an admin API token in the dashboard and use ${chalk12.bold("--token")} or
 // src/commands/env.ts
 import { chmod, open as open2, readFile as readFileAsync } from "fs/promises";
 import { basename } from "path";
-import chalk13 from "chalk";
+import chalk14 from "chalk";
 import { password } from "@inquirer/prompts";
 
 // src/lib/gitignore.ts
@@ -1466,7 +1650,7 @@ async function writeSecureFile(path, content) {
   }
   await chmod(path, 384);
 }
-function defaultDeps3(client) {
+function defaultDeps4(client) {
   return {
     listVars: (app) => client.listBuildEnvVars(app),
     setVar: (body) => client.setBuildEnvVar(body),
@@ -1495,11 +1679,11 @@ function defaultDeps3(client) {
     isIgnored: (path) => isGitIgnored(path),
     writeFile: writeSecureFile,
     readFile: (path) => readFileAsync(path),
-    warn: (message) => console.error(chalk13.yellow(`warning: ${message}`))
+    warn: (message) => console.error(chalk14.yellow(`warning: ${message}`))
   };
 }
 async function envList(opts, deps) {
-  const d = deps ?? defaultDeps3(clientFor(opts));
+  const d = deps ?? defaultDeps4(clientFor(opts));
   try {
     const { variables } = await d.listVars(opts.app);
     if (opts.json) {
@@ -1509,7 +1693,7 @@ async function envList(opts, deps) {
     }
     process.exitCode = 0;
   } catch (err) {
-    printError2(opts, err);
+    printError3(opts, err);
     process.exitCode = 1;
   }
 }
@@ -1527,12 +1711,12 @@ function formatEnvVarsHuman(variables) {
   const widths = HEADERS3.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
   const padCells = (cells) => cells.map((c, i) => c.padEnd(widths[i]));
   const join3 = (cells) => cells.join("  ").trimEnd();
-  const lines = [chalk13.bold(join3(padCells(HEADERS3)))];
+  const lines = [chalk14.bold(join3(padCells(HEADERS3)))];
   for (const row of rows) lines.push(join3(padCells(row)));
   return lines.join("\n") + "\n";
 }
 async function envSet(name, value, opts, deps) {
-  const d = deps ?? defaultDeps3(clientFor(opts));
+  const d = deps ?? defaultDeps4(clientFor(opts));
   let resolvedValue = value;
   if (resolvedValue === void 0 && !opts.file) {
     if (opts.json || !d.isTTY) {
@@ -1558,7 +1742,7 @@ async function envSet(name, value, opts, deps) {
     printSetResult(opts, result);
     process.exitCode = 0;
   } catch (err) {
-    printError2(opts, err);
+    printError3(opts, err);
     process.exitCode = 1;
   }
 }
@@ -1577,26 +1761,26 @@ function printSetResult(opts, result) {
   if (opts.json) {
     console.log(JSON.stringify(result));
   } else {
-    console.log(chalk13.green(`\u2713 set ${result.name} (${result.visibility})`));
+    console.log(chalk14.green(`\u2713 set ${result.name} (${result.visibility})`));
   }
 }
 async function envRm(name, opts, deps) {
-  const d = deps ?? defaultDeps3(clientFor(opts));
+  const d = deps ?? defaultDeps4(clientFor(opts));
   try {
     await d.rmVar({ name, app: opts.app });
     if (opts.json) {
       console.log(JSON.stringify({ event: "deleted", name }));
     } else {
-      console.log(chalk13.green(`\u2713 removed ${name}`));
+      console.log(chalk14.green(`\u2713 removed ${name}`));
     }
     process.exitCode = 0;
   } catch (err) {
-    printError2(opts, err);
+    printError3(opts, err);
     process.exitCode = 1;
   }
 }
 async function envPull(opts, deps) {
-  const d = deps ?? defaultDeps3(clientFor(opts));
+  const d = deps ?? defaultDeps4(clientFor(opts));
   const outPath = opts.out ?? ".env";
   try {
     const { variables } = await d.pullVars(opts.app);
@@ -1619,11 +1803,11 @@ async function envPull(opts, deps) {
     if (opts.json) {
       console.log(JSON.stringify({ event: "pulled", path: outPath, count: variables.length }));
     } else {
-      console.log(chalk13.green(`\u2713 wrote ${variables.length} variable(s) to ${outPath}`));
+      console.log(chalk14.green(`\u2713 wrote ${variables.length} variable(s) to ${outPath}`));
     }
     process.exitCode = 0;
   } catch (err) {
-    printError2(opts, err);
+    printError3(opts, err);
     process.exitCode = 1;
   }
 }
@@ -1655,10 +1839,10 @@ function escapeEnvValue(value) {
   }
   return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 }
-function printError2(opts, err) {
+function printError3(opts, err) {
   const message = err instanceof Error ? err.message : String(err);
   if (opts.json) console.log(JSON.stringify({ event: "error", message }));
-  console.error(chalk13.red(`error: ${message}`));
+  console.error(chalk14.red(`error: ${message}`));
 }
 
 // src/commands/credentials.ts
@@ -1670,13 +1854,13 @@ import {
 } from "fs/promises";
 import { mkdirSync } from "fs";
 import { basename as basename2, extname, join } from "path";
-import chalk14 from "chalk";
+import chalk15 from "chalk";
 import { input, password as password2 } from "@inquirer/prompts";
 function clientFor2(opts) {
   const { token, baseUrl } = resolveAuth(opts);
   return new ApiClient(baseUrl, token);
 }
-function defaultDeps4(client) {
+function defaultDeps5(client) {
   return {
     addCredential: (body) => client.addSigningCredential({
       platform: body.platform,
@@ -1710,6 +1894,27 @@ function defaultDeps4(client) {
       await client.deleteSigningCredential(match.id);
     },
     generateCredential: (body) => client.generateSigningCredential(body),
+    getMaterial: (id) => client.getSigningCredentialMaterial(id),
+    addAscKey: (body) => client.addAscKey(body),
+    listAscKeys: () => client.listAscKeys(),
+    deleteAscKey: async (name) => {
+      const { keys } = await client.listAscKeys();
+      const match = keys.find((k) => k.name === name);
+      if (!match) {
+        throw new Error(`No App Store Connect key named "${name}" found.`);
+      }
+      await client.deleteAscKey(match.id);
+    },
+    addPlayKey: (body) => client.addPlayKey(body),
+    listPlayKeys: () => client.listPlayKeys(),
+    deletePlayKey: async (name) => {
+      const { keys } = await client.listPlayKeys();
+      const match = keys.find((k) => k.name === name);
+      if (!match) {
+        throw new Error(`No Google Play key named "${name}" found.`);
+      }
+      await client.deletePlayKey(match.id);
+    },
     prompt: ({ message, hidden }) => hidden ? password2({ message }) : input({ message }),
     isTTY: Boolean(process.stdin.isTTY),
     readFile: (path) => readFileAsync2(path),
@@ -1722,7 +1927,7 @@ function defaultDeps4(client) {
     mkdir: (dir) => mkdirSync(dir, { recursive: true }),
     writeFile: (path, data, mode) => writeFileAsync(path, data, mode !== void 0 ? { mode } : void 0),
     chmod: (path, mode) => chmodAsync(path, mode),
-    warn: (message) => console.error(chalk14.yellow(`warning: ${message}`))
+    warn: (message) => console.error(chalk15.yellow(`warning: ${message}`))
   };
 }
 var ANDROID_KIND = "android_keystore";
@@ -1732,7 +1937,7 @@ function isCredentialPlatform(p) {
   return CREDENTIAL_PLATFORMS.includes(p);
 }
 async function credentialsAdd(opts, deps) {
-  const d = deps ?? defaultDeps4(clientFor2(opts));
+  const d = deps ?? defaultDeps5(clientFor2(opts));
   if (!opts.platform || !isCredentialPlatform(opts.platform)) {
     throw new UsageError('--platform is required and must be "ios", "android", or "tvos"');
   }
@@ -1791,27 +1996,29 @@ async function credentialsAdd(opts, deps) {
     if (opts.json) {
       console.log(JSON.stringify(result));
     } else {
-      console.log(chalk14.green(`\u2713 added ${result.name} (${result.platform})`));
+      console.log(chalk15.green(`\u2713 added ${result.name} (${result.platform})`));
     }
     process.exitCode = 0;
   } catch (err) {
-    printError3(opts, err);
+    printError4(opts, err);
     process.exitCode = 1;
   }
 }
 async function credentialsGenerate(opts, deps) {
-  const d = deps ?? defaultDeps4(clientFor2(opts));
+  const d = deps ?? defaultDeps5(clientFor2(opts));
   if (!opts.platform) {
-    throw new UsageError('--platform is required ("android" is the only platform available)');
+    throw new UsageError('--platform is required and must be "android", "ios", or "tvos"');
   }
-  if (opts.platform !== "android") {
-    throw new UsageError(
-      "iOS/tvOS generation isn't available yet because it requires an Apple Developer account; upload an exported certificate with `vibeview credentials add` instead"
-    );
+  if (!isCredentialPlatform(opts.platform)) {
+    throw new UsageError(`--platform must be "android", "ios", or "tvos" \u2014 got "${opts.platform}"`);
   }
   if (!opts.name) {
     throw new UsageError("--name is required");
   }
+  if (opts.platform !== "android") {
+    await generateAppleCredential(opts.platform, opts, d);
+    return;
+  }
   const outDir = opts.out ?? process.cwd();
   try {
     d.mkdir(outDir);
@@ -1847,32 +2054,302 @@ async function credentialsGenerate(opts, deps) {
     }
     if (opts.json) {
     } else {
-      console.log(chalk14.green(`\u2713 generated ${result.name} (android)`));
+      console.log(chalk15.green(`\u2713 generated ${result.name} (android)`));
       console.log("");
-      console.log(`  Keystore saved to: ${chalk14.bold(savedTo)}`);
-      console.log(`  Key alias:         ${chalk14.bold(result.key_alias)}`);
-      console.log(`  Store password:    ${chalk14.bold(result.store_password)}`);
-      console.log(`  Key password:      ${chalk14.bold(result.key_password)}`);
+      console.log(`  Keystore saved to: ${chalk15.bold(savedTo)}`);
+      console.log(`  Key alias:         ${chalk15.bold(result.key_alias)}`);
+      console.log(`  Store password:    ${chalk15.bold(result.store_password)}`);
+      console.log(`  Key password:      ${chalk15.bold(result.key_password)}`);
       console.log("");
       console.log(
-        chalk14.yellow(
+        chalk15.yellow(
           "  These are shown ONCE \u2014 VibeView cannot recover the keystore file or its passwords. Back them up somewhere safe."
         )
       );
       console.log(
-        chalk14.yellow(
+        chalk15.yellow(
           "  The credential is already uploaded and active for android and androidtv production builds."
         )
       );
     }
     process.exitCode = 0;
   } catch (err) {
-    printError3(opts, err);
+    printError4(opts, err);
+    process.exitCode = 1;
+  }
+}
+async function generateAppleCredential(platform, opts, d) {
+  try {
+    const result = await d.generateCredential({
+      name: opts.name,
+      platform,
+      ...opts.app !== void 0 ? { app: opts.app } : {},
+      ...opts.bundleId !== void 0 ? { bundleId: opts.bundleId } : {},
+      ...opts.ascKey !== void 0 ? { ascKey: opts.ascKey } : {},
+      // Same rule as the android path: only ever `overwrite: true`, otherwise
+      // the field is omitted and the server's 409-on-collision stays in charge.
+      ...opts.force ? { overwrite: true } : {}
+    });
+    if (opts.json) {
+      console.log(JSON.stringify(result));
+    } else {
+      console.log(chalk15.green(`\u2713 generated ${result.name} (${result.platform})`));
+      console.log("");
+      console.log(`  Scope:   ${chalk15.bold(result.app_public_id ?? "org-wide")}`);
+      const expires = formatExpires(result);
+      if (expires) {
+        console.log(`  Expires: ${chalk15.bold(expires)}`);
+      }
+      console.log("");
+      console.log(
+        `  The certificate and provisioning profile are stored with VibeView and already active for ${result.platform} production builds.`
+      );
+      console.log(
+        `  Run ${chalk15.bold(`vibeview credentials download ${result.name}`)} if you need the files locally.`
+      );
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError4(opts, err);
+    process.exitCode = 1;
+  }
+}
+async function credentialsDownload(name, opts, deps) {
+  const d = deps ?? defaultDeps5(clientFor2(opts));
+  const outDir = opts.out ?? process.cwd();
+  try {
+    const { credentials: credentials2 } = await d.listCredentials(opts.app);
+    const wantApp = opts.app ?? null;
+    const matches = credentials2.filter(
+      (c) => c.name === name && (c.app_public_id ?? null) === wantApp
+    );
+    if (matches.length === 0) {
+      throw new Error(
+        `No credential named "${name}" found${opts.app ? ` for app "${opts.app}"` : ""}.`
+      );
+    }
+    if (matches.length > 1) {
+      throw new Error(
+        `Multiple credentials named "${name}" match (platforms: ${matches.map((c) => c.platform).join(", ")}) \u2014 narrow the lookup with --app.`
+      );
+    }
+    const cred = matches[0];
+    d.mkdir(outDir);
+    let material;
+    try {
+      material = await d.getMaterial(cred.id);
+    } catch (err) {
+      if (err instanceof NotFoundError) {
+        throw new Error(
+          `"${name}" was uploaded, not generated by VibeView \u2014 uploaded credential material is never readable back. Only credentials created by \`vibeview credentials generate\` can be downloaded.`
+        );
+      }
+      throw err;
+    }
+    const savedTo = join(outDir, basename2(material.filename));
+    const profileSavedTo = material.profile_base64 != null ? join(outDir, `${basename2(material.filename, extname(material.filename))}.mobileprovision`) : null;
+    if (opts.json) {
+      console.log(
+        JSON.stringify({
+          ...material,
+          saved_to: savedTo,
+          ...profileSavedTo !== null ? { profile_saved_to: profileSavedTo } : {}
+        })
+      );
+    }
+    const targets = [[savedTo, material.file_base64]];
+    if (profileSavedTo !== null) targets.push([profileSavedTo, material.profile_base64]);
+    for (const [path] of targets) {
+      if (await d.fileExists(path)) {
+        throw new Error(
+          `${path} already exists \u2014 refusing to overwrite it. Move it away or pass a different --out.`
+        );
+      }
+    }
+    for (const [path, base64] of targets) {
+      await d.writeFile(path, Buffer.from(base64, "base64"), 384);
+      await d.chmod(path, 384);
+    }
+    if (!opts.json) {
+      console.log(chalk15.green(`\u2713 downloaded ${material.name} (${material.platform})`));
+      console.log("");
+      console.log(`  Saved to: ${chalk15.bold(savedTo)}`);
+      if (profileSavedTo !== null) {
+        console.log(`  Profile:  ${chalk15.bold(profileSavedTo)}`);
+      }
+      for (const [key, value] of Object.entries(material.passwords)) {
+        console.log(`  ${key}: ${chalk15.bold(value)}`);
+      }
+      console.log("");
+      console.log(chalk15.yellow("  This download is recorded in your organization's audit log."));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError4(opts, err);
+    process.exitCode = 1;
+  }
+}
+async function ascKeyAdd(opts, deps) {
+  const d = deps ?? defaultDeps5(clientFor2(opts));
+  if (!opts.keyId) {
+    throw new UsageError("--key-id is required (the 10-character App Store Connect key id)");
+  }
+  if (!opts.issuerId) {
+    throw new UsageError("--issuer-id is required (the UUID shown above the keys table)");
+  }
+  if (!opts.file) {
+    throw new UsageError("--file is required (the AuthKey_<KEYID>.p8 file Apple let you download)");
+  }
+  try {
+    const file = await d.readFile(opts.file);
+    const result = await d.addAscKey({
+      ...opts.name !== void 0 ? { name: opts.name } : {},
+      keyId: opts.keyId,
+      issuerId: opts.issuerId,
+      file,
+      filename: basename2(opts.file)
+    });
+    if (opts.json) {
+      console.log(JSON.stringify(result));
+    } else {
+      console.log(chalk15.green(`\u2713 added App Store Connect key ${result.name}`));
+      console.log("");
+      console.log(`  Key ID:    ${chalk15.bold(result.key_id)}`);
+      console.log(`  Issuer ID: ${chalk15.bold(result.issuer_id)}`);
+      console.log("");
+      console.log(
+        chalk15.yellow(
+          "  The .p8 is stored encrypted and will never be shown again \u2014 keep your own copy somewhere safe."
+        )
+      );
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError4(opts, err);
+    process.exitCode = 1;
+  }
+}
+async function ascKeyList(opts, deps) {
+  const d = deps ?? defaultDeps5(clientFor2(opts));
+  try {
+    const { keys } = await d.listAscKeys();
+    if (opts.json) {
+      console.log(JSON.stringify(keys, null, 2));
+    } else {
+      process.stdout.write(formatAscKeysHuman(keys));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError4(opts, err);
+    process.exitCode = 1;
+  }
+}
+function formatAscKeysHuman(keys) {
+  if (keys.length === 0) {
+    return "No App Store Connect keys found.\n";
+  }
+  const HEADERS3 = ["NAME", "KEY ID", "ISSUER ID", "CREATED"];
+  const rows = keys.map((k) => [k.name, k.key_id, k.issuer_id, k.created_at ?? ""]);
+  const widths = HEADERS3.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+  const padCells = (cells) => cells.map((c, i) => c.padEnd(widths[i]));
+  const join3 = (cells) => cells.join("  ").trimEnd();
+  const lines = [chalk15.bold(join3(padCells(HEADERS3)))];
+  for (const row of rows) lines.push(join3(padCells(row)));
+  return lines.join("\n") + "\n";
+}
+async function ascKeyRm(name, opts, deps) {
+  const d = deps ?? defaultDeps5(clientFor2(opts));
+  try {
+    await d.deleteAscKey(name);
+    if (opts.json) {
+      console.log(JSON.stringify({ event: "deleted", name }));
+    } else {
+      console.log(chalk15.green(`\u2713 removed App Store Connect key ${name}`));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError4(opts, err);
+    process.exitCode = 1;
+  }
+}
+async function playKeyAdd(opts, deps) {
+  const d = deps ?? defaultDeps5(clientFor2(opts));
+  if (!opts.file) {
+    throw new UsageError(
+      "--file is required (the service-account JSON from Google Play Console \u2192 API access)"
+    );
+  }
+  try {
+    const file = await d.readFile(opts.file);
+    const result = await d.addPlayKey({
+      ...opts.name !== void 0 ? { name: opts.name } : {},
+      file,
+      filename: basename2(opts.file)
+    });
+    if (opts.json) {
+      console.log(JSON.stringify(result));
+    } else {
+      console.log(chalk15.green(`\u2713 added Google Play key ${result.name}`));
+      console.log("");
+      console.log(`  Service account: ${chalk15.bold(result.client_email)}`);
+      console.log("");
+      console.log(
+        chalk15.yellow(
+          "  The JSON key is stored encrypted and will never be shown again \u2014 keep your own copy somewhere safe."
+        )
+      );
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError4(opts, err);
+    process.exitCode = 1;
+  }
+}
+async function playKeyList(opts, deps) {
+  const d = deps ?? defaultDeps5(clientFor2(opts));
+  try {
+    const { keys } = await d.listPlayKeys();
+    if (opts.json) {
+      console.log(JSON.stringify(keys, null, 2));
+    } else {
+      process.stdout.write(formatPlayKeysHuman(keys));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError4(opts, err);
+    process.exitCode = 1;
+  }
+}
+function formatPlayKeysHuman(keys) {
+  if (keys.length === 0) {
+    return "No Google Play keys found.\n";
+  }
+  const HEADERS3 = ["NAME", "CLIENT EMAIL", "CREATED"];
+  const rows = keys.map((k) => [k.name, k.client_email, k.created_at ?? ""]);
+  const widths = HEADERS3.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+  const padCells = (cells) => cells.map((c, i) => c.padEnd(widths[i]));
+  const join3 = (cells) => cells.join("  ").trimEnd();
+  const lines = [chalk15.bold(join3(padCells(HEADERS3)))];
+  for (const row of rows) lines.push(join3(padCells(row)));
+  return lines.join("\n") + "\n";
+}
+async function playKeyRm(name, opts, deps) {
+  const d = deps ?? defaultDeps5(clientFor2(opts));
+  try {
+    await d.deletePlayKey(name);
+    if (opts.json) {
+      console.log(JSON.stringify({ event: "deleted", name }));
+    } else {
+      console.log(chalk15.green(`\u2713 removed Google Play key ${name}`));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError4(opts, err);
     process.exitCode = 1;
   }
 }
 async function credentialsList(opts, deps) {
-  const d = deps ?? defaultDeps4(clientFor2(opts));
+  const d = deps ?? defaultDeps5(clientFor2(opts));
   try {
     const { credentials: credentials2 } = await d.listCredentials(opts.app);
     for (const c of credentials2) {
@@ -1888,7 +2365,7 @@ async function credentialsList(opts, deps) {
     }
     process.exitCode = 0;
   } catch (err) {
-    printError3(opts, err);
+    printError4(opts, err);
     process.exitCode = 1;
   }
 }
@@ -1932,22 +2409,22 @@ function formatCredentialsHuman(credentials2) {
   const widths = HEADERS3.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
   const padCells = (cells) => cells.map((c, i) => c.padEnd(widths[i]));
   const join3 = (cells) => cells.join("  ").trimEnd();
-  const lines = [chalk14.bold(join3(padCells(HEADERS3)))];
+  const lines = [chalk15.bold(join3(padCells(HEADERS3)))];
   for (const row of rows) lines.push(join3(padCells(row)));
   return lines.join("\n") + "\n";
 }
 async function credentialsRm(name, opts, deps) {
-  const d = deps ?? defaultDeps4(clientFor2(opts));
+  const d = deps ?? defaultDeps5(clientFor2(opts));
   try {
     await d.deleteCredential({ name, app: opts.app });
     if (opts.json) {
       console.log(JSON.stringify({ event: "deleted", name }));
     } else {
-      console.log(chalk14.green(`\u2713 removed ${name}`));
+      console.log(chalk15.green(`\u2713 removed ${name}`));
     }
     process.exitCode = 0;
   } catch (err) {
-    printError3(opts, err);
+    printError4(opts, err);
     process.exitCode = 1;
   }
 }
@@ -1955,16 +2432,16 @@ function printKeystoreWriteFailure(opts, err, result) {
   const message = err instanceof Error ? err.message : String(err);
   if (opts.json) {
     console.log(JSON.stringify({ event: "error", message }));
-    console.error(chalk14.red(`error: ${message}`));
+    console.error(chalk15.red(`error: ${message}`));
     return;
   }
-  console.error(chalk14.red(`error: ${message}`));
+  console.error(chalk15.red(`error: ${message}`));
   console.error(
-    chalk14.red(
+    chalk15.red(
       `The keystore could NOT be saved locally, but the credential "${result.name}" WAS created server-side and its key material can never be re-fetched.`
     )
   );
-  console.error(chalk14.red("Recover it NOW from the values below \u2014 they will not be shown again:"));
+  console.error(chalk15.red("Recover it NOW from the values below \u2014 they will not be shown again:"));
   console.error("");
   console.error(`  Key alias:         ${result.key_alias}`);
   console.error(`  Store password:    ${result.store_password}`);
@@ -1975,19 +2452,19 @@ function printKeystoreWriteFailure(opts, err, result) {
     `  Restore the file with: echo '${result.keystore_base64}' | base64 -d > ${result.name}.keystore`
   );
 }
-function printError3(opts, err) {
+function printError4(opts, err) {
   const message = err instanceof Error ? err.message : String(err);
   if (opts.json) console.log(JSON.stringify({ event: "error", message }));
-  console.error(chalk14.red(`error: ${message}`));
+  console.error(chalk15.red(`error: ${message}`));
 }
 
 // src/commands/webhooks.ts
-import chalk15 from "chalk";
+import chalk16 from "chalk";
 function clientFor3(opts) {
   const { token, baseUrl } = resolveAuth(opts);
   return new ApiClient(baseUrl, token);
 }
-function defaultDeps5(client) {
+function defaultDeps6(client) {
   return {
     addWebhook: (body) => client.addWebhook(body),
     listWebhooks: () => client.listWebhooks(),
@@ -2004,7 +2481,7 @@ async function webhooksAdd(opts, deps) {
   if (!opts.url.startsWith("https://")) {
     throw new UsageError(`--url must start with https:// (got "${opts.url}")`);
   }
-  const d = deps ?? defaultDeps5(clientFor3(opts));
+  const d = deps ?? defaultDeps6(clientFor3(opts));
   try {
     const result = await d.addWebhook({
       url: opts.url,
@@ -2013,19 +2490,19 @@ async function webhooksAdd(opts, deps) {
     if (opts.json) {
       console.log(JSON.stringify(result));
     } else {
-      console.log(chalk15.green(`\u2713 added ${result.id} ${result.url}`));
+      console.log(chalk16.green(`\u2713 added ${result.id} ${result.url}`));
       console.log("");
-      console.log(`  Signing secret: ${chalk15.bold(result.secret)}`);
+      console.log(`  Signing secret: ${chalk16.bold(result.secret)}`);
       if (opts.secret !== void 0) {
-        console.log(chalk15.yellow("  (This is the secret you provided.)"));
+        console.log(chalk16.yellow("  (This is the secret you provided.)"));
       }
       console.log(
-        chalk15.yellow("  This secret is shown ONCE and cannot be retrieved again \u2014 store it now.")
+        chalk16.yellow("  This secret is shown ONCE and cannot be retrieved again \u2014 store it now.")
       );
     }
     process.exitCode = 0;
   } catch (err) {
-    printError4(opts, err);
+    printError5(opts, err);
     process.exitCode = 1;
   }
 }
@@ -2051,12 +2528,12 @@ function formatWebhooksHuman(webhooks2) {
   const widths = HEADERS3.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
   const padCells = (cells) => cells.map((c, i) => c.padEnd(widths[i]));
   const join3 = (cells) => cells.join("  ").trimEnd();
-  const lines = [chalk15.bold(join3(padCells(HEADERS3)))];
+  const lines = [chalk16.bold(join3(padCells(HEADERS3)))];
   for (const row of rows) lines.push(join3(padCells(row)));
   return lines.join("\n") + "\n";
 }
 async function webhooksList(opts, deps) {
-  const d = deps ?? defaultDeps5(clientFor3(opts));
+  const d = deps ?? defaultDeps6(clientFor3(opts));
   try {
     const { webhooks: webhooks2 } = await d.listWebhooks();
     if (opts.json) {
@@ -2066,22 +2543,22 @@ async function webhooksList(opts, deps) {
     }
     process.exitCode = 0;
   } catch (err) {
-    printError4(opts, err);
+    printError5(opts, err);
     process.exitCode = 1;
   }
 }
 async function webhooksRm(id, opts, deps) {
-  const d = deps ?? defaultDeps5(clientFor3(opts));
+  const d = deps ?? defaultDeps6(clientFor3(opts));
   try {
     await d.deleteWebhook(id);
     if (opts.json) {
       console.log(JSON.stringify({ event: "deleted", id }));
     } else {
-      console.log(chalk15.green(`\u2713 removed ${id}`));
+      console.log(chalk16.green(`\u2713 removed ${id}`));
     }
     process.exitCode = 0;
   } catch (err) {
-    printError4(opts, err);
+    printError5(opts, err);
     process.exitCode = 1;
   }
 }
@@ -2098,7 +2575,7 @@ function parseUtcTimestamp(iso) {
 var TEST_POLL_INTERVAL_MS = 3e3;
 var TEST_POLL_BUDGET_MS = 6e4;
 async function webhooksTest(id, opts, deps) {
-  const d = deps ?? defaultDeps5(clientFor3(opts));
+  const d = deps ?? defaultDeps6(clientFor3(opts));
   try {
     const startedAt = d.now();
     await d.testWebhook(id);
@@ -2110,13 +2587,13 @@ async function webhooksTest(id, opts, deps) {
         if (opts.json) console.log(JSON.stringify(ld));
         if (ld.status === "succeeded") {
           if (!opts.json) {
-            console.log(chalk15.green(`\u2713 Delivered (HTTP ${ld.response_code})`));
+            console.log(chalk16.green(`\u2713 Delivered (HTTP ${ld.response_code})`));
           }
           process.exitCode = 0;
         } else {
           if (!opts.json) {
             const code = ld.response_code != null ? `HTTP ${ld.response_code}` : "no response";
-            console.error(chalk15.red(`\u2717 Failed (${code}) at ${ld.at}`));
+            console.error(chalk16.red(`\u2717 Failed (${code}) at ${ld.at}`));
           }
           process.exitCode = 1;
         }
@@ -2125,24 +2602,24 @@ async function webhooksTest(id, opts, deps) {
     }
     if (opts.json) console.log(JSON.stringify({ status: "pending" }));
     console.error(
-      chalk15.yellow(
+      chalk16.yellow(
         `Delivery still pending after ${TEST_POLL_BUDGET_MS / 1e3}s \u2014 check \`vibeview webhooks list\` later for the result.`
       )
     );
     process.exitCode = 1;
   } catch (err) {
-    printError4(opts, err);
+    printError5(opts, err);
     process.exitCode = 1;
   }
 }
-function printError4(opts, err) {
+function printError5(opts, err) {
   const message = err instanceof Error ? err.message : String(err);
   if (opts.json) console.log(JSON.stringify({ event: "error", message }));
-  console.error(chalk15.red(`error: ${message}`));
+  console.error(chalk16.red(`error: ${message}`));
 }
 
 // src/lib/formatters/devices.ts
-import chalk16 from "chalk";
+import chalk17 from "chalk";
 var HEADERS2 = ["DEVICE_ID", "NAME", "TYPE", "CATEGORY", "OS", "STATUS"];
 function formatDevicesHuman(devices) {
   if (devices.length === 0) {
@@ -2158,9 +2635,9 @@ function formatDevicesHuman(devices) {
   ]);
   const widths = HEADERS2.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
   const fmt = (cells) => cells.map((c, i) => c.padEnd(widths[i])).join("  ").trimEnd();
-  const lines = [chalk16.bold(fmt(HEADERS2))];
+  const lines = [chalk17.bold(fmt(HEADERS2))];
   for (const row of rows.sort(rowSort)) {
-    const statusColored = row[5] === "available" ? chalk16.green(row[5]) : row[5] === "busy" ? chalk16.yellow(row[5]) : chalk16.dim(row[5]);
+    const statusColored = row[5] === "available" ? chalk17.green(row[5]) : row[5] === "busy" ? chalk17.yellow(row[5]) : chalk17.dim(row[5]);
     lines.push(fmt([row[0], row[1], row[2], row[3], row[4], statusColored]));
   }
   return lines.join("\n") + "\n";
@@ -2250,7 +2727,7 @@ import { dirname, join as join2 } from "path";
 import { fileURLToPath } from "url";
 import { spawnSync } from "child_process";
 import { confirm } from "@inquirer/prompts";
-import chalk17 from "chalk";
+import chalk18 from "chalk";
 function resolveShippedSkillPath(fromDir) {
   for (const rel of ["..", join2("..", "..")]) {
     const candidate = join2(fromDir, rel, "skills", "vibeview-agent", "SKILL.md");
@@ -2278,23 +2755,23 @@ function registerMcp() {
     encoding: "utf8"
   });
   if (res.status === 0) {
-    console.log(chalk17.green("\u2713 MCP server registered with Claude Code (claude mcp add vibeview)"));
+    console.log(chalk18.green("\u2713 MCP server registered with Claude Code (claude mcp add vibeview)"));
     return;
   }
   const out = `${res.stderr ?? ""}${res.stdout ?? ""}`;
   if (out.includes("already exists")) {
-    console.log(chalk17.dim("MCP server already registered with Claude Code \u2014 nothing to do"));
+    console.log(chalk18.dim("MCP server already registered with Claude Code \u2014 nothing to do"));
     return;
   }
-  console.error(chalk17.yellow(`\u26A0 could not register the MCP server: ${out.trim() || res.error}`));
-  console.error(chalk17.yellow("  register it manually: claude mcp add vibeview -- vibeview mcp"));
+  console.error(chalk18.yellow(`\u26A0 could not register the MCP server: ${out.trim() || res.error}`));
+  console.error(chalk18.yellow("  register it manually: claude mcp add vibeview -- vibeview mcp"));
 }
 async function agentSetup(opts) {
   const moduleDir = dirname(fileURLToPath(import.meta.url));
   const shipped = resolveShippedSkillPath(moduleDir);
   if (!shipped) {
     console.error(
-      chalk17.red(
+      chalk18.red(
         "error: could not find the packaged skill (skills/vibeview-agent/SKILL.md) \u2014 is this a complete install of the vibeview package?"
       )
     );
@@ -2303,9 +2780,9 @@ async function agentSetup(opts) {
   }
   const targetDir = skillInstallDir(opts.project ?? false, process.cwd(), homedir());
   const result = installSkill(shipped, targetDir);
-  console.log(chalk17.green(`\u2713 vibeview-agent skill ${result}: ${join2(targetDir, "SKILL.md")}`));
+  console.log(chalk18.green(`\u2713 vibeview-agent skill ${result}: ${join2(targetDir, "SKILL.md")}`));
   console.log(
-    chalk17.dim(
+    chalk18.dim(
       opts.project ? "  Claude Code discovers it automatically for anyone working in this project." : "  Claude Code discovers it automatically in every project on this machine."
     )
   );
@@ -2313,7 +2790,7 @@ async function agentSetup(opts) {
     if (!claudeCliAvailable()) {
       if (opts.mcp === true) {
         console.error(
-          chalk17.yellow(
+          chalk18.yellow(
             "\u26A0 claude CLI not found \u2014 install Claude Code, then run: claude mcp add vibeview -- vibeview mcp"
           )
         );
@@ -2327,7 +2804,7 @@ async function agentSetup(opts) {
   }
   console.log(
     `
-Suggested line for your project's ${chalk17.bold("CLAUDE.md")} (or ${chalk17.bold(
+Suggested line for your project's ${chalk18.bold("CLAUDE.md")} (or ${chalk18.bold(
       "AGENTS.md"
     )} for other agents):
 `
@@ -2335,7 +2812,7 @@ Suggested line for your project's ${chalk17.bold("CLAUDE.md")} (or ${chalk17.bol
   console.log(`  ${CLAUDE_MD_SUGGESTION}
 `);
   console.log(
-    chalk17.dim(
+    chalk18.dim(
       "Other agents (Cursor, Copilot, Codex, ...): point them at the skill file above, or\nadd the MCP server per client \u2014 see https://vibeview.io/docs/agent-control"
     )
   );
@@ -2499,6 +2976,22 @@ program.command("build").description("Run your configured build command and uplo
   "--cloud only: build a signed, installable production artifact (.aab/.ipa) using uploaded signing credentials (see `vibeview credentials add`), instead of the default unsigned simulator build",
   false
 ).option("--json", "Print the result as one JSON line (NDJSON events with --cloud)", false).action((opts) => buildCommand(opts));
+program.command("submit").description(
+  "Submit a succeeded production cloud build's artifact to TestFlight (ios/tvos) or a Google Play track (android/androidtv) \u2014 binary upload only; store listing and review stay in the store consoles"
+).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--platform <platform>", "ios, tvos, android, or androidtv").option("--build <id>", "Cloud build id to submit (see `vibeview builds list`)").option(
+  "--latest",
+  "Submit the newest succeeded production build for --platform (pass exactly one of --build/--latest)",
+  false
+).option(
+  "--track <track>",
+  "android/androidtv only: Play track \u2014 internal (default), alpha, beta, or production"
+).option(
+  "--package <name>",
+  "android/androidtv only: package name, for a build not linked to an app"
+).option(
+  "--asc-key <name>",
+  "ios/tvos only: which stored App Store Connect key to use (default when exactly one \u2014 see `vibeview credentials asc-key add`)"
+).option("--no-wait", "Print the submission id and exit without waiting for completion").option("--json", "Emit line-delimited JSON events on stdout instead of human output", false).action((opts) => submitCommand(opts));
 var builds = program.command("builds").description("Manage cloud builds (see `vibeview build --cloud`)");
 builds.command("list").description("List cloud builds in your organization").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the raw build summaries as a JSON array", false).option("--limit <n>", "Max builds to return (default 50, max 200)").action((opts) => buildsList(opts));
 builds.command("logs <id>").description("Print a cloud build's log output").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print NDJSON log/outcome events instead of raw text", false).option("--follow", "Keep polling until the build reaches a terminal status", false).action((id, opts) => buildsLogs(id, opts));
@@ -2528,19 +3021,47 @@ credentials.command("add").description(
   "ios/tvos: the .mobileprovision file (required; tvOS profiles are distinct from iOS ones)"
 ).option("--app <id>", "Scope to a single app (default: org-wide)").option("--name <name>", "Credential name (default: the file basename without extension)").action((opts) => credentialsAdd(opts));
 credentials.command("generate").description(
-  "Generate an Android keystore server-side and store it as a signing credential. Saves the keystore file locally and prints its passwords ONCE \u2014 they can never be retrieved again."
-).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option(
-  "--platform <platform>",
-  "android (iOS/tvOS certificates require an Apple Developer account)"
-).option("--name <name>", "Credential name").option("--app <id>", "Scope to a single app (default: org-wide)").option("--alias <alias>", "Key alias (default: server-chosen)").option("--out <dir>", "Directory to save the keystore file into (default: current directory)").option(
+  "Generate a signing credential server-side. android: saves the keystore file locally and prints its passwords ONCE. ios/tvos: creates the distribution certificate and provisioning profile through the App Store Connect API (requires a stored key \u2014 see `vibeview credentials asc-key add`); fetch the files later with `vibeview credentials download`."
+).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--platform <platform>", "android, ios, or tvos").option("--name <name>", "Credential name").option("--app <id>", "Scope to a single app (default: org-wide)").option("--alias <alias>", "android: key alias (default: server-chosen)").option(
+  "--bundle-id <id>",
+  "ios/tvos: bundle id for the provisioning profile (default: the --app's package id)"
+).option(
+  "--asc-key <name>",
+  "ios/tvos: which stored App Store Connect key to use (default when exactly one)"
+).option(
+  "--out <dir>",
+  "android: directory to save the keystore file into (default: current directory)"
+).option(
   "--force",
   "Replace an existing credential of the same name \u2014 irreversible; breaks Play Store updates signed with the old key",
   false
 ).option(
   "--json",
-  "Print the raw generation response (including the one-time secrets) as JSON",
+  "Print the raw generation response (android: including the one-time secrets) as JSON",
   false
 ).action((opts) => credentialsGenerate(opts));
+credentials.command("download <name>").description(
+  "Download the files of a credential VibeView GENERATED (uploaded credentials are never readable back). Admin-only; the download is recorded in the audit log."
+).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide)").option("--out <dir>", "Directory to save the files into (default: current directory)").option("--json", "Print the material (including passwords) and saved paths as JSON", false).action((name, opts) => credentialsDownload(name, opts));
+var ascKey = credentials.command("asc-key").description(
+  "Manage App Store Connect API keys (create one in App Store Connect \u2192 Users and Access \u2192 Integrations) \u2014 they power `credentials generate --platform ios|tvos`"
+);
+ascKey.command("add").description(
+  "Store an App Store Connect API key. The .p8 is stored encrypted and never shown again; uploading the same name again rotates the key."
+).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--key-id <id>", "The 10-character key id (shown next to the key in App Store Connect)").option("--issuer-id <id>", "The issuer id (UUID shown above the keys table)").option("--file <path>", "The AuthKey_<KEYID>.p8 file Apple let you download once").option("--name <name>", "Key name (default: server-chosen)").option("--json", "Print the raw response as one JSON line", false).action((opts) => ascKeyAdd(opts));
+ascKey.command("list").description("List stored App Store Connect keys (metadata only \u2014 never the .p8)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the raw key list as a JSON array", false).action((opts) => ascKeyList(opts));
+ascKey.command("rm <name>").description("Remove a stored App Store Connect key").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the result as one JSON line", false).action((name, opts) => ascKeyRm(name, opts));
+var playKey = credentials.command("play-key").description(
+  "Manage Google Play service-account keys (create one in Google Play Console \u2192 API access, or Google Cloud \u2192 IAM \u2192 service accounts) \u2014 they power `vibeview submit --platform android|androidtv`"
+);
+playKey.command("add").description(
+  "Store a Google Play service-account JSON key. The key is stored encrypted and never shown again; uploading the same name again rotates the key."
+).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option(
+  "--file <path>",
+  "The service-account JSON key file (Google Play Console \u2192 API access / Google Cloud service accounts)"
+).option("--name <name>", "Key name (default: server-chosen)").option("--json", "Print the raw response as one JSON line", false).action((opts) => playKeyAdd(opts));
+playKey.command("list").description("List stored Google Play keys (metadata only \u2014 never the JSON key)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the raw key list as a JSON array", false).action((opts) => playKeyList(opts));
+playKey.command("rm <name>").description("Remove a stored Google Play key").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the result as one JSON line", false).action((name, opts) => playKeyRm(name, opts));
 credentials.command("list").description("List signing credentials (never prints key material)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide credentials only)").option("--json", "Print the raw credential list as a JSON array", false).action((opts) => credentialsList(opts));
 credentials.command("rm <name>").description("Remove a signing credential (replace by rm then add)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide)").option("--json", "Print the result as one JSON line", false).action((name, opts) => credentialsRm(name, opts));
 var webhooks = program.command("webhooks").description("Manage build-completion webhook endpoints");
@@ -2555,7 +3076,7 @@ program.command("dev-stop").description("Stop a `vibeview dev --detach` session
 program.command("mcp").description(
   "Run an MCP stdio server exposing the agent verbs (tap, swipe, type, ...) plus dev_start/dev_stop as tools"
 ).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").action(async (opts) => {
-  const { runMcpServer } = await import("./server-AZLB25BY.js");
+  const { runMcpServer } = await import("./server-GMC6F545.js");
   await runMcpServer(opts);
 });
 program.command("agent-setup").description(