vibeview 0.18.0 → 0.20.0

package/README.md

@@ -49,15 +49,22 @@ cloud device. Add `--production` for a **signed release build** on iOS,
 tvOS, Android, or Android TV, using signing credentials you store once:
 
 ```bash
-# Apple: your distribution certificate + provisioning profile
+# Apple: connect your team once with an App Store Connect API key,
+# then VibeView creates the certificate + provisioning profile for you
+vibeview credentials asc-key add --key-id <K> --issuer-id <I> --file AuthKey_<K>.p8
+vibeview credentials generate --platform ios --name release --app <app-id>
+
+# ...or upload an exported certificate + profile yourself
 vibeview credentials add --platform ios --file cert.p12 --profile app.mobileprovision
 
 # Android: upload a keystore — or have VibeView generate one (no Java needed)
 vibeview credentials generate --platform android --name release
 ```
 
-Credentials are stored encrypted and never readable back. Build-time
-secrets work the same way:
+Uploaded credentials are stored encrypted and never readable back;
+credentials VibeView generated can be re-downloaded by org admins with
+`vibeview credentials download <name>` (every download is audited).
+Build-time secrets work the same way:
 
 ```bash
 vibeview env set NPM_TOKEN "..."        # secret by default, injected into builds
@@ -67,8 +74,33 @@ vibeview webhooks add --url https://ci.example.com/hooks/vibeview
 Webhooks POST a signed payload to your endpoint whenever a build finishes.
 Manage running builds with `vibeview builds list | logs | download | cancel`.
 
+Set `"autoIncrement": true` in a platform's `build` block and every
+production build gets a server-assigned build number, injected into the
+build as `VIBEVIEW_BUILD_NUMBER` (inspect or seed the counters with
+`vibeview versions list/set`).
+
+Expo managed projects work out of the box — the default build command runs
+`npx expo prebuild` in the cloud, so no `ios/` or `android/` directory is
+needed.
+
+When a production build succeeds, ship it straight to the stores — no
+Xcode, no Play Console upload page:
+
+```bash
+vibeview submit --platform tvos --latest                  # → TestFlight
+vibeview submit --platform android --track internal       # → a Play track
+```
+
+TestFlight uploads use your stored App Store Connect key; Play uploads need
+a Google Play service account key stored once with
+`vibeview credentials play-key add --file service-account.json`. Choose a
+Play track, upload as a draft, or start a staged rollout — and store your
+defaults in `vibeview.json` so `vibeview submit` alone does the right
+thing.
+
 [Cloud Builds docs →](https://vibeview.io/docs/cloud-builds) ·
 [App Signing →](https://vibeview.io/docs/app-signing) ·
+[Store Submission →](https://vibeview.io/docs/store-submission) ·
 [Build Webhooks →](https://vibeview.io/docs/build-webhooks)
 
 ## Let your AI agent drive the device
@@ -123,31 +155,35 @@ Output formats: `human`, `json`, and `junit` for any CI system. The exit code re
 
 ## All commands
 
-| Command | Purpose |
-| --- | --- |
-| `vibeview login` / `logout` / `whoami` | Authenticate via browser, sign out, show who you are |
-| `vibeview dev` | Live development on a cloud device |
-| `vibeview build` | Build your app — locally, or on the build fleet with `--cloud` (add `--production` for a signed release) |
-| `vibeview builds list/logs/download/cancel/delete-artifact` | Manage cloud builds and their artifacts |
-| `vibeview credentials add/generate/list/rm` | App-signing credentials for production builds |
-| `vibeview env list/set/rm/pull` | Build variables and secrets injected into cloud builds |
-| `vibeview webhooks add/list/rm/test` | Notify your systems when builds finish (signed payloads) |
-| `vibeview dev-status` / `dev-stop` | Check on, or stop, a backgrounded dev session |
-| `vibeview agent-setup` | Make VibeView discoverable to your coding agent (skill + MCP) |
-| `vibeview mcp` | Run the MCP server so an agent can drive the device |
-| `vibeview ui-tree` | The current screen's elements, each with a ref to act on |
-| `vibeview logs` | Recent app logs from the device (console output, errors, crashes) |
-| `vibeview screenshot` | Capture the screen to a PNG |
-| `vibeview tap` / `type` / `scroll` / `press` | Drive the device |
-| `vibeview scroll-to` / `drag` / `alert` / `find` | Search, precise gestures, iOS system alerts |
-| `vibeview upload-app <file>` | Upload a build (zipped simulator `.app`, or `.apk`) |
-| `vibeview list-apps` | List your apps |
-| `vibeview list-devices` | List available device types |
-| `vibeview list-suites` | List test suites |
-| `vibeview create-test [name]` | Create a test case |
-| `vibeview run-test <test-id>` | Run a single test |
-| `vibeview run-suite <suite-id>` | Run a test suite |
-| `vibeview run-suites` | Run multiple suites |
+| Command                                                     | Purpose                                                                                                  |
+| ----------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
+| `vibeview login` / `logout` / `whoami`                      | Authenticate via browser, sign out, show who you are                                                     |
+| `vibeview dev`                                              | Live development on a cloud device                                                                       |
+| `vibeview build`                                            | Build your app — locally, or on the build fleet with `--cloud` (add `--production` for a signed release) |
+| `vibeview builds list/logs/download/cancel/delete-artifact` | Manage cloud builds and their artifacts                                                                  |
+| `vibeview versions list/set`                                | Server-side build-number counters for `autoIncrement` production builds                                  |
+| `vibeview credentials add/generate/list/rm/download`        | App-signing credentials for production builds (`generate` covers iOS, tvOS, and Android)                 |
+| `vibeview credentials asc-key add/list/rm`                  | Connect an Apple team via App Store Connect API key                                                      |
+| `vibeview credentials play-key add/list/rm`                 | Store a Google Play service-account key for Play submissions                                             |
+| `vibeview submit`                                           | Upload a production build to TestFlight or a Google Play track                                           |
+| `vibeview env list/set/rm/pull`                             | Build variables and secrets injected into cloud builds                                                   |
+| `vibeview webhooks add/list/rm/test`                        | Notify your systems when builds finish (signed payloads)                                                 |
+| `vibeview dev-status` / `dev-stop`                          | Check on, or stop, a backgrounded dev session                                                            |
+| `vibeview agent-setup`                                      | Make VibeView discoverable to your coding agent (skill + MCP)                                            |
+| `vibeview mcp`                                              | Run the MCP server so an agent can drive the device                                                      |
+| `vibeview ui-tree`                                          | The current screen's elements, each with a ref to act on                                                 |
+| `vibeview logs`                                             | Recent app logs from the device (console output, errors, crashes)                                        |
+| `vibeview screenshot`                                       | Capture the screen to a PNG                                                                              |
+| `vibeview tap` / `type` / `scroll` / `press`                | Drive the device                                                                                         |
+| `vibeview scroll-to` / `drag` / `alert` / `find`            | Search, precise gestures, iOS system alerts                                                              |
+| `vibeview upload-app <file>`                                | Upload a build (zipped simulator `.app`, or `.apk`)                                                      |
+| `vibeview list-apps`                                        | List your apps                                                                                           |
+| `vibeview list-devices`                                     | List available device types                                                                              |
+| `vibeview list-suites`                                      | List test suites                                                                                         |
+| `vibeview create-test [name]`                               | Create a test case                                                                                       |
+| `vibeview run-test <test-id>`                               | Run a single test                                                                                        |
+| `vibeview run-suite <suite-id>`                             | Run a test suite                                                                                         |
+| `vibeview run-suites`                                       | Run multiple suites                                                                                      |
 
 Run any command with `--help` for its options.
 

package/dist/{chunk-MGP3UR7P.js → chunk-GUCKFB4K.js}

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import {
   ApiClient,
+  UsageError,
   createSpinner,
   loadConfig,
   resolveAuth,
   uploadAppBuild
-} from "./chunk-BJEDH672.js";
+} from "./chunk-MCCXPIGE.js";
 
 // src/lib/dev-state.ts
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
@@ -358,6 +359,9 @@ function detectFlavor(cwd) {
   if (isFile(join4(cwd, "manifest"))) return "roku";
   return "unknown";
 }
+function isManagedExpo(cwd) {
+  return detectFlavor(cwd) === "expo" && !existsSync3(join4(cwd, "android", "gradlew")) && iosWorkspaceName(cwd) === null;
+}
 function iosWorkspaceName(cwd) {
   try {
     const found = readdirSync2(join4(cwd, "ios")).find((f) => f.endsWith(".xcworkspace"));
@@ -420,21 +424,51 @@ function defaultsFor(cwd, platform) {
 var ANDROID_PRODUCTION_ARTIFACT = "android/app/build/outputs/bundle/release/*.aab";
 var ANDROID_PRODUCTION_COMMAND = "yarn install --immutable && cd android && ./gradlew bundleRelease";
 var IOS_PRODUCTION_ARTIFACT = "ios/build/*.ipa";
+var MANAGED_EXPO_ANDROID_PRODUCTION_COMMAND = "yarn install --immutable && npx expo prebuild --platform android --no-install && cd android && ./gradlew bundleRelease";
+function expoSanitizedName(name) {
+  return name.replace(/[\W_]+/g, "").normalize("NFD").replace(/[\u0300-\u036f]/g, "");
+}
+function managedExpoIosName(cwd) {
+  if (existsSync3(join4(cwd, "app.config.js")) || existsSync3(join4(cwd, "app.config.ts"))) {
+    return null;
+  }
+  const raw = readJson(cwd, "app.config.json") ?? readJson(cwd, "app.json");
+  if (!raw) return null;
+  const config = "expo" in raw ? raw.expo : raw;
+  if (typeof config !== "object" || config === null) return null;
+  const name = config.name;
+  if (typeof name !== "string") return null;
+  return expoSanitizedName(name) || null;
+}
+function iosArchiveExportCommand(ws) {
+  const archivePath = `ios/build/${ws}.xcarchive`;
+  const archiveCmd = `xcodebuild archive -workspace ios/${ws}.xcworkspace -scheme ${ws} -configuration Release -archivePath ${archivePath} CODE_SIGN_STYLE=Manual \${VIBEVIEW_DEVELOPMENT_TEAM:+"DEVELOPMENT_TEAM=$VIBEVIEW_DEVELOPMENT_TEAM"} \${VIBEVIEW_PROVISIONING_PROFILE:+"PROVISIONING_PROFILE_SPECIFIER=$VIBEVIEW_PROVISIONING_PROFILE"} \${VIBEVIEW_CODE_SIGN_IDENTITY:+"CODE_SIGN_IDENTITY=$VIBEVIEW_CODE_SIGN_IDENTITY"}`;
+  const exportCmd = `xcodebuild -exportArchive -archivePath ${archivePath} -exportPath ios/build -exportOptionsPlist "$VIBEVIEW_EXPORT_OPTIONS_PLIST"`;
+  return `${archiveCmd} && ${exportCmd}`;
+}
 function productionDefaultsFor(cwd, platform) {
   if (platform === "android" || platform === "androidtv") {
-    return { buildCommand: ANDROID_PRODUCTION_COMMAND, artifact: ANDROID_PRODUCTION_ARTIFACT };
+    return {
+      buildCommand: isManagedExpo(cwd) ? MANAGED_EXPO_ANDROID_PRODUCTION_COMMAND : ANDROID_PRODUCTION_COMMAND,
+      artifact: ANDROID_PRODUCTION_ARTIFACT
+    };
   }
   if (platform === "tvos") {
     return { artifact: IOS_PRODUCTION_ARTIFACT };
   }
   if (platform === "ios") {
+    if (isManagedExpo(cwd)) {
+      const name = managedExpoIosName(cwd);
+      if (!name) return { artifact: IOS_PRODUCTION_ARTIFACT };
+      return {
+        buildCommand: "yarn install --immutable && npx expo prebuild --platform ios && " + iosArchiveExportCommand(name),
+        artifact: IOS_PRODUCTION_ARTIFACT
+      };
+    }
     const ws = iosWorkspaceName(cwd);
     if (!ws) return { artifact: IOS_PRODUCTION_ARTIFACT };
-    const archivePath = `ios/build/${ws}.xcarchive`;
-    const archiveCmd = `xcodebuild archive -workspace ios/${ws}.xcworkspace -scheme ${ws} -configuration Release -archivePath ${archivePath} CODE_SIGN_STYLE=Manual \${VIBEVIEW_DEVELOPMENT_TEAM:+"DEVELOPMENT_TEAM=$VIBEVIEW_DEVELOPMENT_TEAM"} \${VIBEVIEW_PROVISIONING_PROFILE:+"PROVISIONING_PROFILE_SPECIFIER=$VIBEVIEW_PROVISIONING_PROFILE"} \${VIBEVIEW_CODE_SIGN_IDENTITY:+"CODE_SIGN_IDENTITY=$VIBEVIEW_CODE_SIGN_IDENTITY"}`;
-    const exportCmd = `xcodebuild -exportArchive -archivePath ${archivePath} -exportPath ios/build -exportOptionsPlist "$VIBEVIEW_EXPORT_OPTIONS_PLIST"`;
     return {
-      buildCommand: `yarn install --immutable && ${archiveCmd} && ${exportCmd}`,
+      buildCommand: `yarn install --immutable && ${iosArchiveExportCommand(ws)}`,
       artifact: IOS_PRODUCTION_ARTIFACT
     };
   }
@@ -1155,6 +1189,11 @@ async function runCloudBuildCommand(cwd, cfgRef, opts, deps) {
   for (const p of platforms) {
     try {
       validateBuildEnv(cfg?.platforms?.[p]?.build?.env, p);
+      if (cfg?.platforms?.[p]?.build?.autoIncrement === true && opts.production && createFromArtifact.has(p)) {
+        throw new UsageError(
+          `platforms.${p}.build.autoIncrement needs the build linked to an app \u2014 set appId in vibeview.json (a brand-new app's first build can't auto-increment)`
+        );
+      }
     } catch (err) {
       fail(opts, err instanceof Error ? err.message : String(err));
     }
@@ -1199,6 +1238,14 @@ ${offenders}`);
       const production = productionBuilds.get(p);
       const command = production ? production.command : build.command;
       const artifactPath = production ? production.artifact : build.artifact;
+      const autoIncrement = build.autoIncrement === true;
+      if (autoIncrement && !production && !opts.json) {
+        console.error(
+          chalk2.yellow(
+            `note: platforms.${p}.build.autoIncrement only applies to production builds (--production) \u2014 ignoring it for this simulator build`
+          )
+        );
+      }
       return {
         platform: p,
         // OMITTED, never invented, for a platform whose app the artifact will
@@ -1210,7 +1257,8 @@ ${offenders}`);
         command,
         artifact_path: artifactPath,
         distribution: production ? "production" : "simulator",
-        ...build.env ? { env: build.env } : {}
+        ...build.env ? { env: build.env } : {},
+        ...autoIncrement && production ? { auto_increment: true } : {}
       };
     });
     const uploadSpinner = !opts.json ? createSpinner("uploading source...") : null;
@@ -3371,6 +3419,7 @@ export {
   readMetroState,
   killOwnedMetro,
   buildCommand,
+  formatDuration,
   BUILD_TERMINAL_STATUSES,
   fetchFinalSummary,
   newTransitionState,

package/dist/{chunk-BJEDH672.js → chunk-MCCXPIGE.js}

@@ -287,10 +287,15 @@ var ApiClient = class {
     const qs = offset !== void 0 ? `?offset=${offset}` : "";
     return this.requestRaw("GET", `/builds/${id}/logs${qs}`);
   }
-  async listCloudBuilds(limit, offset) {
+  /** GET /api/v1/builds/ — the filter values are forwarded verbatim; the
+   *  backend accepts comma-separated lists for platform/status. */
+  async listCloudBuilds(opts) {
     const params = new URLSearchParams();
-    if (limit !== void 0) params.set("limit", String(limit));
-    if (offset !== void 0) params.set("offset", String(offset));
+    if (opts?.platform !== void 0) params.set("platform", opts.platform);
+    if (opts?.status !== void 0) params.set("status", opts.status);
+    if (opts?.distribution !== void 0) params.set("distribution", opts.distribution);
+    if (opts?.limit !== void 0) params.set("limit", String(opts.limit));
+    if (opts?.offset !== void 0) params.set("offset", String(opts.offset));
     const qs = params.toString();
     return this.requestRaw("GET", `/builds/${qs ? `?${qs}` : ""}`);
   }
@@ -445,6 +450,78 @@ var ApiClient = class {
   async deleteAscKey(id) {
     await this.requestRaw("DELETE", `/signing-credentials/asc-keys/${id}`);
   }
+  /** GET /api/v1/signing-credentials/play-keys. Requires VIEWER role.
+   *  Metadata only — the service-account JSON is never returned. */
+  async listPlayKeys() {
+    return this.requestRaw("GET", "/signing-credentials/play-keys");
+  }
+  /** POST /api/v1/signing-credentials/play-keys (multipart). Requires ADMIN
+   *  role. Same-name upload is a rotation upsert server-side — mirrors
+   *  addAscKey exactly (there are no extra id fields: the client_email is
+   *  read out of the JSON server-side). */
+  async addPlayKey(body) {
+    const formData = new FormData();
+    if (body.name !== void 0) formData.append("name", body.name);
+    formData.append("file", new Blob([new Uint8Array(body.file)]), body.filename);
+    return this.requestFormData("POST", "/signing-credentials/play-keys", formData);
+  }
+  /** DELETE /api/v1/signing-credentials/play-keys/{id}. Requires ADMIN role. */
+  async deletePlayKey(id) {
+    await this.requestRaw("DELETE", `/signing-credentials/play-keys/${id}`);
+  }
+  /** POST /api/v1/submissions — submit a succeeded production build's
+   *  artifact to TestFlight (ios/tvos) or a Play track (android/androidtv).
+   *  `platform` is always sent: the backend derives the real platform from
+   *  the build row and 400s on a mismatch, so a pasted wrong --build id
+   *  fails loudly instead of silently submitting to the other store family.
+   *  As with addSigningCredential, the CLI's camelCase (`ascKey`) is
+   *  converted to the route's snake_case at this boundary and nowhere else.
+   *  4xx details (including the 409 "already active" refusal and the 400
+   *  platform-mismatch) surface verbatim via extractDetail. */
+  async createSubmission(body) {
+    return this.requestRaw("POST", "/submissions", {
+      build: body.build,
+      platform: body.platform,
+      ...body.track !== void 0 ? { track: body.track } : {},
+      ...body.package !== void 0 ? { package: body.package } : {},
+      ...body.ascKey !== void 0 ? { asc_key: body.ascKey } : {},
+      ...body.releaseStatus !== void 0 ? { release_status: body.releaseStatus } : {},
+      ...body.rollout !== void 0 ? { rollout: body.rollout } : {},
+      ...body.changesNotSentForReview !== void 0 ? { changes_not_sent_for_review: body.changesNotSentForReview } : {}
+    });
+  }
+  /** GET /api/v1/submissions?build=<id> — that build's submissions, newest
+   *  first. */
+  async listSubmissions(build) {
+    return this.requestRaw("GET", `/submissions?build=${encodeURIComponent(build)}`);
+  }
+  /** GET /api/v1/submissions/{id}. */
+  async getSubmission(id) {
+    return this.requestRaw("GET", `/submissions/${id}`);
+  }
+  /** GET /api/v1/submissions/{id}/log[?offset=N] — same {content, offset,
+   *  status} shape as getCloudBuildLogs, so the follow loops share one
+   *  response type. */
+  async getSubmissionLog(id, offset) {
+    const qs = offset !== void 0 ? `?offset=${offset}` : "";
+    return this.requestRaw("GET", `/submissions/${id}/log${qs}`);
+  }
+  /** GET /api/v1/apps/{appPublicId}/versions — the app's server-side
+   *  build-number counters, one per platform that has ever allocated (or
+   *  been `versions set`) a number. */
+  async listAppVersions(appId) {
+    return this.requestRaw("GET", `/apps/${encodeURIComponent(appId)}/versions`);
+  }
+  /** PUT /api/v1/apps/{appPublicId}/versions/{platform} {build_number} —
+   *  seed or overwrite one counter (org-scoped, DEVELOPER role, audited
+   *  server-side). Returns the updated counter. */
+  async setAppVersion(appId, platform, buildNumber) {
+    return this.requestRaw(
+      "PUT",
+      `/apps/${encodeURIComponent(appId)}/versions/${encodeURIComponent(platform)}`,
+      { build_number: buildNumber }
+    );
+  }
   /** GET /api/v1/signing-credentials/{id}/material. Requires ADMIN role;
    *  audited server-side. 404s (NotFoundError) for non-generated rows —
    *  uploaded material is never readable back. */