@amirhosseinnateghi/vibed-cli 0.1.2 → 0.1.4

package/dist/index.js

@@ -1248,10 +1248,10 @@ var require_decode = __commonJS({
           this.state = EntityDecoderState.NumericDecimal;
           return this.stateNumericDecimal(str2, offset);
         };
-        EntityDecoder2.prototype.addToNumericResult = function(str2, start, end, base) {
+        EntityDecoder2.prototype.addToNumericResult = function(str2, start, end, base2) {
           if (start !== end) {
             var digitCount = end - start;
-            this.result = this.result * Math.pow(base, digitCount) + parseInt(str2.substr(start, digitCount), base);
+            this.result = this.result * Math.pow(base2, digitCount) + parseInt(str2.substr(start, digitCount), base2);
             this.consumed += digitCount;
           }
         };
@@ -5973,7 +5973,10 @@ var require_dist = __commonJS({
 });
 
 // src/index.ts
-import { resolve as resolve2 } from "node:path";
+import { resolve as resolve2, join as join3 } from "node:path";
+import { writeFile as writeFile2 } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { pathToFileURL } from "node:url";
 
 // src/config.ts
 import { homedir } from "node:os";
@@ -6019,6 +6022,18 @@ import { dirname, extname, isAbsolute, join as join2, resolve } from "node:path"
 // ../sandbox/src/index.ts
 var import_node_html_parser = __toESM(require_dist(), 1);
 
+// ../shared/src/terms.ts
+var ITEM = {
+  /** lowercase singular — "vibe" */
+  one: "vibe",
+  /** lowercase plural — "vibes" */
+  many: "vibes",
+  /** Capitalized singular — "Vibe" */
+  One: "Vibe",
+  /** Capitalized plural — "Vibes" */
+  Many: "Vibes"
+};
+
 // ../shared/src/constants.ts
 var CATEGORIES = [
   "Game",
@@ -6031,10 +6046,13 @@ var CATEGORIES = [
   "Other"
 ];
 var VISIBILITY = ["public", "unlisted"];
+var COVER_MODES = ["image", "gif"];
 var EXPERIENCE_SOURCE = ["builder", "import", "remix"];
+var PUSH_PROVIDERS = ["webpush", "fcm", "apns"];
+var DEVICE_PLATFORMS = ["web", "ios", "android"];
 var config = {
-  ARTIFACT_MAX_BYTES: intEnv("ARTIFACT_MAX_BYTES", 3145728),
-  // 3 MB
+  ARTIFACT_MAX_BYTES: intEnv("ARTIFACT_MAX_BYTES", 8388608),
+  // 8 MB — headroom for an embedded audio track
   ARTIFACT_ALLOWED_ORIGINS: strEnv(
     "ARTIFACT_ALLOWED_ORIGINS",
     "fonts.googleapis.com,fonts.gstatic.com,cdnjs.cloudflare.com,cdn.jsdelivr.net,unpkg.com"
@@ -6055,8 +6073,33 @@ var config = {
   // Light model that auto-tags the experience category. Falls back to a keyword
   // heuristic if the call fails.
   BUILDER_CLASSIFIER_MODEL: strEnv("BUILDER_CLASSIFIER_MODEL", "gemini-2.5-flash"),
-  BUILDER_MAX_TOKENS: intEnv("BUILDER_MAX_TOKENS", 8192),
+  // Speech-to-text model for the builder's voice input (docs/builder-architecture.md).
+  // Gemini 2.5 Flash transcribes the recorded clip via GapGPT's OpenAI-compatible
+  // chat API (an `input_audio` content part) — verified to accept the exact
+  // formats browsers produce (Chrome webm/opus, Safari mp4). It's multilingual,
+  // so Persian and English speech both work with no per-language config.
+  BUILDER_TRANSCRIBE_MODEL: strEnv("BUILDER_TRANSCRIBE_MODEL", "gemini-2.5-flash"),
+  // Upload cap for a voice clip. A minute of webm/opus is ~250KB; 8MB is ample
+  // headroom while still bounding what one request can hand the model.
+  BUILDER_TRANSCRIBE_MAX_BYTES: intEnv("BUILDER_TRANSCRIBE_MAX_BYTES", 8388608),
+  // Output budget per model call. 8k proved too small in prod — a rich game is
+  // ~7-8k tokens of file alone, and a truncated file used to slip through as a
+  // text dump. 24576 was probed OK against every catalog model on GapGPT.
+  BUILDER_MAX_TOKENS: intEnv("BUILDER_MAX_TOKENS", 24576),
   BUILDER_MAX_MESSAGES: intEnv("BUILDER_MAX_MESSAGES", 30),
+  // Hard cap for a single build turn (across the model + one repair). The build
+  // runs detached from the request, so this — not the browser — is what stops a
+  // runaway/abandoned turn. The provider's own 90s per-stall timeout still applies.
+  // Never cut a LIVE generation — these two guards only catch dead work:
+  // stall = total silence (not even a keep-alive byte) long enough to mean the
+  // connection is dead (TCP half-open never errors on its own); the turn cap is
+  // a platform-cost safety ceiling for the whole turn incl. one repair pass.
+  BUILDER_STALL_TIMEOUT_MS: intEnv("BUILDER_STALL_TIMEOUT_MS", 3e5),
+  BUILDER_TURN_TIMEOUT_MS: intEnv("BUILDER_TURN_TIMEOUT_MS", 9e5),
+  // Once a build has run this long, the UI nudges the user to go explore, and on
+  // completion the server drops a notification (§7.1) — so a slow build never
+  // traps them staring at a spinner.
+  BUILDER_SLOW_MS: intEnv("BUILDER_SLOW_MS", 12e3),
   DEFAULT_LOCALE: strEnv("DEFAULT_LOCALE", "en")
 };
 function strEnv(key, fallback) {
@@ -6079,6 +6122,31 @@ function boolEnv(key, fallback) {
   return v === "true" || v === "1";
 }
 
+// ../shared/src/notifications.ts
+var NOTIF_VERB = {
+  like_milestone: `liked your ${ITEM.one}`,
+  comment: `commented on your ${ITEM.one}`,
+  reply: "replied to your comment",
+  follow: "started following you",
+  mention: "mentioned you",
+  remix: `remixed your ${ITEM.one}`
+};
+var SYSTEM_NOTIF = {
+  build_ready: { icon: "\u2728", text: "Your build is ready \u2014 tap to see it", tone: "info" },
+  build_failed: { icon: "\u26A0\uFE0F", text: "A build didn't finish \u2014 tap to try again", tone: "error" },
+  // Moderation reject (spec §9): the vibe never went live (or was pulled), so
+  // the inbox row must carry everything — title + reason arrive in the payload.
+  post_rejected: { icon: "\u{1F6AB}", text: `Your ${ITEM.one} didn't pass moderation`, tone: "error" }
+};
+var NOTIF_PREF_GROUPS = ["follow", "comments", "likes", "remixes", "builder"];
+var NOTIF_GROUP_LABEL = {
+  follow: { title: "New followers", hint: "when someone follows you" },
+  comments: { title: "Comments", hint: "comments, replies & mentions" },
+  likes: { title: "Likes", hint: `when your ${ITEM.many} hit like milestones` },
+  remixes: { title: "Remixes", hint: `when someone remixes your ${ITEM.one}` },
+  builder: { title: "Builder", hint: "when a build finishes or fails" }
+};
+
 // ../shared/src/policy.ts
 function boolEnv2(key, fallback) {
   const v = typeof process !== "undefined" ? process.env[key] : void 0;
@@ -9759,23 +9827,23 @@ var ZodEffects = class extends ZodType {
     }
     if (effect.type === "transform") {
       if (ctx.common.async === false) {
-        const base = this._def.schema._parseSync({
+        const base2 = this._def.schema._parseSync({
           data: ctx.data,
           path: ctx.path,
           parent: ctx
         });
-        if (!isValid(base))
+        if (!isValid(base2))
           return INVALID;
-        const result = effect.transform(base.value, checkCtx);
+        const result = effect.transform(base2.value, checkCtx);
         if (result instanceof Promise) {
           throw new Error(`Asynchronous transform encountered during synchronous parse operation. Use .parseAsync instead.`);
         }
         return { status: status.value, value: result };
       } else {
-        return this._def.schema._parseAsync({ data: ctx.data, path: ctx.path, parent: ctx }).then((base) => {
-          if (!isValid(base))
+        return this._def.schema._parseAsync({ data: ctx.data, path: ctx.path, parent: ctx }).then((base2) => {
+          if (!isValid(base2))
             return INVALID;
-          return Promise.resolve(effect.transform(base.value, checkCtx)).then((result) => ({
+          return Promise.resolve(effect.transform(base2.value, checkCtx)).then((result) => ({
             status: status.value,
             value: result
           }));
@@ -10151,10 +10219,107 @@ var coerce = {
 };
 var NEVER = INVALID;
 
+// ../shared/src/storage.ts
+var STORAGE = {
+  /** Total shared bytes per post (values, serialized). */
+  SHARED_MAX_BYTES: intEnv("STORE_SHARED_MAX_BYTES", 1048576),
+  // 1 MB
+  /** Total shared records (rows) per post. */
+  SHARED_MAX_RECORDS: intEnv("STORE_SHARED_MAX_RECORDS", 5e3),
+  /** Serialized size cap for a single value. */
+  VALUE_MAX_BYTES: intEnv("STORE_VALUE_MAX_BYTES", 16384),
+  // 16 KB
+  /** Records a single author may hold in one post (anti-flood / anti-grief). */
+  AUTHOR_MAX_RECORDS: intEnv("STORE_AUTHOR_MAX_RECORDS", 100),
+  /** Distinct collections per post. */
+  MAX_COLLECTIONS: intEnv("STORE_MAX_COLLECTIONS", 32),
+  /** Local-tier budget per (post, identity) — enforced by the host broker. */
+  LOCAL_MAX_BYTES: intEnv("STORE_LOCAL_MAX_BYTES", 262144),
+  // 256 KB
+  /** Max records returnable in one query page. */
+  QUERY_MAX_LIMIT: intEnv("STORE_QUERY_MAX_LIMIT", 100),
+  /**
+   * Platform kill-switch for anonymous shared writes. ON by default: the real
+   * gate is per-post owner opt-in (`anon_writes` + writePolicy `anyone`), so a
+   * post only accepts guest writes when its owner turns them on. Set the env to
+   * `false` to disable anon writes platform-wide regardless of per-post config.
+   */
+  ANON_WRITES_AVAILABLE: boolEnv("STORE_ANON_WRITES_AVAILABLE", true)
+};
+var COLLECTION_RE = /^[a-z0-9][a-z0-9:_-]{0,63}$/;
+var collectionSchemaStore = external_exports.string().regex(COLLECTION_RE, "invalid collection name");
+var STORE_KEY_RE = /^[a-zA-Z0-9][a-zA-Z0-9:._-]{0,127}$/;
+var RESERVED_STORE_KEYS = ["submit", "rank", "increment"];
+var storeKeySchema = external_exports.string().regex(STORE_KEY_RE, "invalid key").refine((k) => !RESERVED_STORE_KEYS.includes(k), {
+  message: "reserved key"
+});
+var STORE_WRITE_POLICIES = ["anyone", "logged_in", "owner_only"];
+var STORE_SORTS = ["num", "-num", "created", "-created"];
+var storeValueSchema = external_exports.unknown().refine(
+  (v) => {
+    try {
+      const s = JSON.stringify(v);
+      return s !== void 0 && byteLength(s) <= STORAGE.VALUE_MAX_BYTES;
+    } catch {
+      return false;
+    }
+  },
+  { message: `value must be JSON-serializable and <= ${STORAGE.VALUE_MAX_BYTES} bytes` }
+);
+var storePutSchema = external_exports.object({
+  value: storeValueSchema,
+  /** Optimistic concurrency: fail with `conflict` unless current version matches. */
+  ifVersion: external_exports.number().int().positive().optional()
+});
+var storeAppendSchema = external_exports.object({
+  value: storeValueSchema,
+  /** Optional numeric field to index (sorting/leaderboards). */
+  num: external_exports.number().finite().optional()
+});
+var storeIncrementSchema = external_exports.object({
+  delta: external_exports.number().int().min(-1e6).max(1e6).default(1)
+});
+var storeSubmitSchema = external_exports.object({
+  /** The number that ranks this author (mapped into `num`). */
+  score: external_exports.number().finite(),
+  /** Conflict rule when the author already has a row. */
+  keep: external_exports.enum(["max", "min", "last"]).default("max"),
+  /** Small display payload stored alongside (same value-size gate). */
+  meta: storeValueSchema.optional()
+});
+var storeQuerySchema = external_exports.object({
+  sort: external_exports.enum(STORE_SORTS).default("-created"),
+  limit: external_exports.coerce.number().int().min(1).max(STORAGE.QUERY_MAX_LIMIT).default(30),
+  cursor: external_exports.string().max(200).optional(),
+  /** Only the caller's records. */
+  mine: external_exports.coerce.boolean().default(false)
+});
+var storeAdminSchema = external_exports.discriminatedUnion("action", [
+  external_exports.object({ action: external_exports.literal("freeze") }),
+  external_exports.object({ action: external_exports.literal("unfreeze") }),
+  external_exports.object({ action: external_exports.literal("set_policy"), writePolicy: external_exports.enum(STORE_WRITE_POLICIES) }),
+  external_exports.object({ action: external_exports.literal("set_anon_writes"), anonWrites: external_exports.boolean() }),
+  external_exports.object({ action: external_exports.literal("reset"), collection: collectionSchemaStore.optional() })
+]);
+var storageOptInSchema = external_exports.object({
+  local: external_exports.boolean().default(false),
+  shared: external_exports.boolean().default(false)
+});
+function byteLength(s) {
+  if (typeof TextEncoder !== "undefined") return new TextEncoder().encode(s).length;
+  let n = 0;
+  for (let i = 0; i < s.length; i++) {
+    const c = s.codePointAt(i);
+    n += c <= 127 ? 1 : c <= 2047 ? 2 : c <= 65535 ? 3 : (i++, 4);
+  }
+  return n;
+}
+
 // ../shared/src/schemas.ts
 var handleSchema = external_exports.string().regex(/^[a-z0-9_.]{3,24}$/, "3\u201324 chars: a\u2013z, 0\u20139, _ or .");
 var categorySchema = external_exports.enum(CATEGORIES);
 var visibilitySchema = external_exports.enum(VISIBILITY);
+var coverModeSchema = external_exports.enum(COVER_MODES);
 var sourceSchema = external_exports.enum(EXPERIENCE_SOURCE);
 var tagsSchema = external_exports.array(external_exports.string().min(1).max(40)).max(10).transform(
   (tags) => Array.from(
@@ -10168,8 +10333,12 @@ var publishSchema = external_exports.object({
   tags: tagsSchema,
   remixable: external_exports.boolean().default(true),
   visibility: visibilitySchema.default("public"),
+  coverMode: coverModeSchema.default("gif"),
   draftArtifactKey: external_exports.string().min(1),
-  buildSessionId: external_exports.string().uuid().optional()
+  buildSessionId: external_exports.string().uuid().optional(),
+  /** Storage opt-in override; when omitted, publish auto-detects from the source
+   *  (docs/post-storage.md §9 — default off, enabled only when actually used). */
+  storage: storageOptInSchema.optional()
 });
 var patchExperienceSchema = external_exports.object({
   title: external_exports.string().min(1).max(120).optional(),
@@ -10177,25 +10346,44 @@ var patchExperienceSchema = external_exports.object({
   tags: tagsSchema.optional(),
   category: categorySchema.optional(),
   remixable: external_exports.boolean().optional(),
-  visibility: visibilitySchema.optional()
+  visibility: visibilitySchema.optional(),
+  coverMode: coverModeSchema.optional()
 });
 var commentSchema = external_exports.object({
   body: external_exports.string().min(1).max(500),
   parentId: external_exports.string().uuid().optional()
 });
 var eventSchema = external_exports.object({
-  kind: external_exports.enum(["impression", "play", "play_time", "share"]),
+  // "record"/"screenshot" fire when a viewer captures the vibe (see the in-iframe
+  // bridge capture flow, docs/architecture.md §5.4). Plain-text `viewEvents.kind`
+  // column, so new kinds need no migration.
+  kind: external_exports.enum(["impression", "play", "play_time", "share", "record", "screenshot"]),
   ms: external_exports.number().int().nonnegative().optional()
 });
 var createBuildSchema = external_exports.object({
   mode: external_exports.enum(["ai", "remix"]),
   remixParentId: external_exports.string().uuid().optional()
 });
+var turnAttachmentSchema = external_exports.object({
+  kind: external_exports.enum(["image", "audio", "file", "sketch"]),
+  key: external_exports.string().max(300).default(""),
+  name: external_exports.string().max(200),
+  // NUL bytes break Postgres jsonb (and mean binary-not-text) — strip defensively.
+  text: external_exports.string().max(5e4).transform((t) => t.replace(/\u0000/g, "")).optional()
+});
+var createTurnRequestSchema = external_exports.object({
+  clientTurnId: external_exports.string().uuid(),
+  content: external_exports.string().max(4e3).default(""),
+  attachments: external_exports.array(turnAttachmentSchema).max(6).optional(),
+  model: external_exports.string().max(100).optional()
+}).refine((v) => v.content.trim().length > 0 || (v.attachments?.length ?? 0) > 0, {
+  message: "Send a message or an attachment."
+});
 var builderAttachmentSchema = external_exports.object({
-  kind: external_exports.enum(["image", "file"]),
+  kind: external_exports.enum(["image", "file", "audio"]),
   name: external_exports.string().max(200),
-  dataUrl: external_exports.string().max(8e6).optional(),
-  // ~6MB image as base64 data URL
+  // base64 data URL for image/audio (~8.7MB raw fits, covering a short song).
+  dataUrl: external_exports.string().max(12e6).optional(),
   text: external_exports.string().max(5e4).optional()
 });
 var builderMessageSchema = external_exports.object({
@@ -10227,10 +10415,21 @@ var reportSchema = external_exports.object({
 var patchMeSchema = external_exports.object({
   displayName: external_exports.string().min(1).max(60).optional(),
   bio: external_exports.string().max(300).optional(),
-  avatar: external_exports.string().url().optional(),
+  // A stored image URL, or "" to remove the photo and fall back to the color avatar.
+  avatar: external_exports.string().url().or(external_exports.literal("")).optional(),
+  // Fallback avatar colour (used when there's no photo). Hex like #6C4CF1.
+  avatarBg: external_exports.string().regex(/^#[0-9a-fA-F]{6}$/, "hex colour, e.g. #6C4CF1").optional(),
   handle: handleSchema.optional()
   // once
 });
+var waitlistSchema = external_exports.object({
+  email: external_exports.string().trim().email().max(200),
+  note: external_exports.string().trim().max(500).optional()
+});
+var waitlistReviewSchema = external_exports.object({
+  requestId: external_exports.string().uuid(),
+  action: external_exports.enum(["approve", "reject"])
+});
 var aiConnectionSchema = external_exports.object({
   provider: external_exports.enum(AI_PROVIDERS),
   apiKey: external_exports.string().trim().min(12).max(300)
@@ -10244,28 +10443,225 @@ var feedQuerySchema = external_exports.object({
 var searchQuerySchema = external_exports.object({
   q: external_exports.string().default(""),
   tab: external_exports.enum(["experiences", "tags", "creators"]).default("experiences"),
-  remixableOnly: external_exports.coerce.boolean().default(false),
+  // Query params arrive as strings; z.coerce.boolean() is just Boolean(x), so
+  // "false"/"0" would (wrongly) become true and the filter could never be turned
+  // off. Parse the string explicitly: only "true"/"1" (or a real boolean) is true.
+  remixableOnly: external_exports.union([external_exports.boolean(), external_exports.string()]).optional().transform((v) => v === true || v === "true" || v === "1"),
   cursor: external_exports.string().optional(),
   limit: external_exports.coerce.number().int().min(1).max(30).default(15)
 });
+var registerPushDeviceSchema = external_exports.object({
+  provider: external_exports.enum(PUSH_PROVIDERS),
+  token: external_exports.string().trim().min(16).max(4096),
+  keys: external_exports.record(external_exports.string().max(512)).default({}),
+  platform: external_exports.enum(DEVICE_PLATFORMS).default("web"),
+  userAgent: external_exports.string().trim().max(400).default("")
+}).superRefine((v, ctx) => {
+  if (v.provider === "webpush" && (!v.keys.p256dh || !v.keys.auth)) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["keys"],
+      message: "webpush requires keys.p256dh and keys.auth"
+    });
+  }
+});
+var unregisterPushDeviceSchema = external_exports.object({
+  token: external_exports.string().trim().min(16).max(4096)
+});
+var notificationsQuerySchema = external_exports.object({
+  filter: external_exports.enum(["all", "mentions", "remixes"]).default("all"),
+  // Keyset cursor: the `createdAt` ISO timestamp of the last item seen.
+  cursor: external_exports.string().datetime({ offset: true }).optional(),
+  limit: external_exports.coerce.number().int().min(1).max(80).default(30)
+});
+var notifPrefsPatchSchema = external_exports.object({
+  enabled: external_exports.boolean().optional(),
+  groups: external_exports.record(external_exports.enum(NOTIF_PREF_GROUPS), external_exports.boolean()).optional()
+});
 
-// ../shared/src/models.ts
-var BUILDER_MODELS = [
-  // ── Free (selectable now) — good quality, reasonable price ─────────
-  { id: "claude-sonnet-4-20250514", label: "Claude Sonnet 4", tier: "free", note: "Best for polished HTML", vision: true },
-  { id: "gemini-2.5-flash", label: "Gemini 2.5 Flash", tier: "free", note: "Fast \xB7 great UI \xB7 cheap", vision: true },
-  { id: "gpt-4o-mini", label: "GPT-4o mini", tier: "free", note: "Cheap & reliable", vision: true },
-  { id: "gpt-5-mini", label: "GPT-5 mini", tier: "free", note: "Newer, capable", vision: true },
-  { id: "gpt-5.1-codex", label: "GPT-5.1 Codex", tier: "free", note: "Code specialist" },
-  { id: "deepseek-v4-pro", label: "DeepSeek V4 Pro", tier: "free", note: "Strong coder \xB7 great value" },
-  { id: "deepseek-v4-flash", label: "DeepSeek V4 Flash", tier: "free", note: "Fast \xB7 very cheap" },
-  { id: "gapgpt-qwen-3.6", label: "Qwen 3.6", tier: "free", note: "Good value" },
-  // ── Subscription (locked until billing is enabled) — premium ──────
-  { id: "claude-opus-4-8", label: "Claude Opus 4.8", tier: "subscription", note: "Top quality", vision: true },
-  { id: "gpt-5.2-pro", label: "GPT-5.2 Pro", tier: "subscription", note: "Premium" },
-  { id: "gemini-3-pro-preview", label: "Gemini 3 Pro", tier: "subscription", note: "Premium", vision: true }
+// ../shared/src/builderEvents.ts
+var BUILD_EVENT_VERSION = 1;
+var BUILD_PHASES = [
+  "queued",
+  // accepted, waiting for a worker slot
+  "thinking",
+  // model connected, no visible output yet (keep-alives flowing)
+  "writing",
+  // streaming the vibe's code/prose
+  "validating",
+  // sandbox pass on the produced artifact
+  "repairing"
+  // one automatic fix round after a validation failure
 ];
-var FREE_IDS = new Set(BUILDER_MODELS.filter((m) => m.tier === "free").map((m) => m.id));
+var base = { v: external_exports.literal(BUILD_EVENT_VERSION), turnId: external_exports.string() };
+var buildEventSchema = external_exports.discriminatedUnion("type", [
+  /** Assistant prose delta (never contains the HTML code block). */
+  external_exports.object({ ...base, type: external_exports.literal("token"), text: external_exports.string() }),
+  /**
+   * Honest heartbeat, ~every 2s while the turn runs: real elapsed ms, real
+   * output-token count, and the executor's actual phase. The UI renders this
+   * as a live counter — a number that moves because work is happening.
+   */
+  external_exports.object({
+    ...base,
+    type: external_exports.literal("progress"),
+    phase: external_exports.enum(BUILD_PHASES),
+    elapsedMs: external_exports.number(),
+    tokensOut: external_exports.number()
+  }),
+  /** Friendly status chip ("index.html", "Fixing a couple of things…"). */
+  external_exports.object({ ...base, type: external_exports.literal("status"), summary: external_exports.string() }),
+  /** First-message category classification. */
+  external_exports.object({ ...base, type: external_exports.literal("category"), category: external_exports.string() }),
+  /** The validated draft landed. Preview loads it from the draft URL. */
+  external_exports.object({ ...base, type: external_exports.literal("artifact"), artifactKey: external_exports.string() }),
+  /** Terminal: failure with taxonomy code + human message. */
+  external_exports.object({
+    ...base,
+    type: external_exports.literal("error"),
+    code: external_exports.string(),
+    message: external_exports.string()
+  }),
+  /** Terminal: success. */
+  external_exports.object({ ...base, type: external_exports.literal("done") })
+]);
+
+// ../shared/src/i18n.ts
+var en = {
+  "nav.home": "Home",
+  "nav.search": "Search",
+  "nav.create": "Create",
+  "nav.notifications": "Notifications",
+  "nav.profile": "Profile",
+  "feed.explore": "Explore",
+  "feed.following": "Following",
+  "feed.tapToInteract": "Tap to interact",
+  "feed.loading": `Loading ${ITEM.one}`,
+  "feed.exit": "Exit",
+  "feed.remixedFrom": "Remixed from @{handle}",
+  "feed.remixedFromRemoved": `Remixed from a removed ${ITEM.one}`,
+  "feed.newVersionOf": "New version of {title}",
+  "feed.end.title": "You're all caught up",
+  "feed.end.body": `No new ${ITEM.many} right now \u2014 remix one you loved, or check back soon.`,
+  "feed.end.remix": "Find something to remix",
+  "feed.end.top": "Back to top",
+  "rail.like": "Like",
+  "rail.comment": "Comment",
+  "rail.remix": "Remix",
+  "rail.save": "Save",
+  "rail.share": "Share",
+  "comments.title": "Comments",
+  "comments.placeholder": "Add a comment\u2026",
+  "comments.reply": "Reply",
+  "comments.empty": "No comments yet \u2014 be the first.",
+  "comments.post": "Post",
+  "share.title": "Share",
+  "share.copyLink": "Copy link",
+  "share.copied": "Link copied",
+  "capture.record": "Record",
+  "capture.screenshot": "Screenshot",
+  "capture.recording": "Recording",
+  "capture.stop": "Stop",
+  "capture.preparing": "Preparing\u2026",
+  "capture.processing": "Finishing\u2026",
+  "capture.preview.videoTitle": "Your clip",
+  "capture.preview.imageTitle": "Your screenshot",
+  "capture.save": "Save",
+  "capture.shareVia": "Share via\u2026",
+  "capture.retry": "Try again",
+  "capture.error": "Capture failed \u2014 try again.",
+  "capture.allowShare": "Allow \u201CShare this tab\u201D to record \u2014 it captures just the vibe.",
+  "capture.pickTab": "Choose \u201CThis Tab\u201D so it records only the vibe.",
+  "capture.unsupported": `This ${ITEM.one} can't be captured yet. Try again in a moment.`,
+  "create.title": "Create",
+  "create.buildWithAI": "Build with AI",
+  "create.import": "Import",
+  "create.remix": "Remix something",
+  "create.prompt.placeholder": "Describe what you want to build\u2026",
+  "create.prompt.starters": "Start from a template",
+  "builder.publish": "Publish",
+  "builder.thinking": "Building\u2026",
+  "builder.updated": "Updated \u2713",
+  "builder.placeholder": "Ask for a change\u2026",
+  "builder.mockNotice": "Preview builder \u2014 AI generation is mocked for now.",
+  "import.title": "Import",
+  "import.paste": "Paste HTML, or drop an .html file",
+  "import.validate": "Validate",
+  "import.warnings": "Warnings",
+  "publish.title": "Publish",
+  "publish.postTitle": "Title",
+  "publish.caption": "Caption",
+  "publish.category": "Category",
+  "publish.remixable": "Allow remixes",
+  "publish.public": "Public",
+  "publish.unlisted": "Unlisted",
+  "publish.cta": "Publish",
+  "publish.remixCredit": "Remixing @{handle} \u2014 {title}",
+  "publish.toast.published": "Published! \u{1F389}",
+  "publish.toast.remix": "Remix published \u{1F501} @{handle} was credited",
+  "remix.confirmTitle": "Remixing @{handle}'s {title}",
+  "remix.confirmBody": `They'll be credited on your ${ITEM.one}. Attribution can't be removed.`,
+  "remix.start": "Start remixing",
+  "remix.galleryTitle": "Remixes",
+  "remix.sortPopular": "Popular",
+  "remix.sortRecent": "Recent",
+  "remix.count": "{n} remixes",
+  "remix.identicalWarn": "This looks identical to the original \u2014 publish anyway?",
+  "search.placeholder": `Search ${ITEM.many}, tags, creators`,
+  "search.tab.experiences": ITEM.Many,
+  "search.tab.tags": "Hashtags",
+  "search.tab.creators": "Creators",
+  "search.remixableOnly": "Remixable only",
+  "search.trending": "Trending",
+  "profile.tab.experiences": ITEM.Many,
+  "profile.tab.remixes": "Remixes",
+  "profile.tab.saved": "Saved",
+  "profile.followers": "followers",
+  "profile.following": "following",
+  "profile.likes": "likes",
+  "profile.follow": "Follow",
+  "profile.unfollow": "Following",
+  "profile.edit": "Edit profile",
+  "notifs.all": "All",
+  "notifs.mentions": "Mentions",
+  "notifs.remixes": "Remixes",
+  "notifs.remixedYou": `@{handle} remixed your ${ITEM.one}`,
+  "notifs.liked": `@{handle} liked your ${ITEM.one}`,
+  "notifs.commented": "@{handle} commented",
+  "notifs.followed": "@{handle} started following you",
+  "notifs.empty": "Nothing here yet.",
+  "collections.title": "Saved",
+  "collections.new": "New collection",
+  "analytics.title": "Analytics",
+  "analytics.views": "Views",
+  "analytics.plays": "Plays",
+  "analytics.playRate": "Play rate",
+  "analytics.avgTime": "Avg. time",
+  "analytics.likes": "Likes",
+  "analytics.comments": "Comments",
+  "analytics.shares": "Shares",
+  "analytics.saves": "Saves",
+  "analytics.remixes": "Remixes",
+  "post.options": `${ITEM.One} options`,
+  "post.analytics": "View analytics",
+  "post.edit": "Edit caption",
+  "post.delete": `Delete ${ITEM.one}`,
+  "post.deleteConfirm": `Delete this ${ITEM.one}? This can't be undone.`,
+  "post.captionPlaceholder": "Write a caption\u2026",
+  "auth.signIn": "Sign in",
+  "auth.google": "Continue with Google",
+  "auth.github": "Continue with GitHub",
+  "auth.dev": "Dev login",
+  "auth.needAccount": "Sign in to like, comment, and remix.",
+  "common.cancel": "Cancel",
+  "common.save": "Save",
+  "common.back": "Back",
+  "common.retry": "Retry",
+  "common.loading": "Loading\u2026",
+  "common.report": "Report",
+  "common.delete": "Delete",
+  "common.views": "{n} views"
+};
 
 // ../shared/src/tokens.ts
 var colors = {
@@ -10368,6 +10764,15 @@ function validate(html, opts) {
     errors.push({ code: "NOT_HTML", message: "Content is not parseable as HTML." });
     return { ok: false, errors, warnings };
   }
+  const scriptOpens = (html.match(/<script\b/gi) ?? []).length;
+  const scriptCloses = (html.match(/<\/script\s*>/gi) ?? []).length;
+  if (scriptOpens > scriptCloses) {
+    errors.push({
+      code: "TRUNCATED_DOC",
+      message: "The file ends mid-<script> \u2014 it looks cut off. Regenerate or paste the complete file."
+    });
+    return { ok: false, errors, warnings };
+  }
   if (on("frames") && root.querySelector("iframe, frame, object, embed")) {
     errors.push({
       code: "FRAME_TAG",
@@ -10452,6 +10857,12 @@ function validate(html, opts) {
       }
     }
   }
+  if (/(localStorage|sessionStorage|indexedDB|document\s*\.\s*cookie)/.test(html)) {
+    warnings.push({
+      code: "BROWSER_STORAGE",
+      message: "Uses browser storage (localStorage/sessionStorage/indexedDB/cookies), which throws inside the vibed sandbox. Port persistence to window.vibed.storage (local per-viewer, shared collective)."
+    });
+  }
   const lower = html.toLowerCase();
   const hasCredField = root.querySelector('input[type="email"], input[type="text"], input[type="tel"]') != null && /(password|passcode|otp|verify|sign\s*in|log\s*in|account)/i.test(html);
   if (hasCredField) {
@@ -10950,19 +11361,35 @@ function normalizeCategory(input) {
   const match = CATEGORIES.find((c) => c.toLowerCase() === input.toLowerCase());
   return match ?? "Other";
 }
-async function publishArtifact(client, html, meta, projectDir) {
-  const imported = await apiFetch(client, "POST", "/imports", { html });
+async function importDraft(client, html) {
+  const r = await apiFetch(client, "POST", "/imports", { html });
+  return { draftArtifactKey: r.draftArtifactKey, previewUrl: r.previewUrl };
+}
+async function publishDraft(client, draftArtifactKey, meta, html, projectDir) {
   const exp = await apiFetch(client, "POST", "/experiences", {
-    title: meta.title?.trim() || inferTitle(html, projectDir),
+    title: meta.title?.trim() || (html ? inferTitle(html, projectDir ?? ".") : "Untitled"),
     caption: meta.caption ?? "",
     category: normalizeCategory(meta.category),
     tags: meta.tags ?? [],
     remixable: meta.remixable ?? true,
     visibility: meta.visibility ?? "public",
-    draftArtifactKey: imported.draftArtifactKey
+    draftArtifactKey
   });
   return { id: exp.id, status: exp.status, url: `${client.apiBase}/e/${exp.id}` };
 }
+async function publishArtifact(client, html, meta, projectDir) {
+  const { draftArtifactKey } = await importDraft(client, html);
+  return publishDraft(client, draftArtifactKey, meta, html, projectDir);
+}
+function experienceIdFrom(input) {
+  const m = input.match(/\/e\/([0-9a-f-]{36})/i);
+  return (m?.[1] ?? input.trim()).toLowerCase();
+}
+async function deleteExperience(client, idOrUrl) {
+  const id = experienceIdFrom(idOrUrl);
+  await apiFetch(client, "DELETE", `/experiences/${id}`);
+  return id;
+}
 
 // src/index.ts
 function parseArgs(argv) {
@@ -10996,7 +11423,11 @@ var USAGE = `vibed \u2014 make it vibed
 Usage:
   vibed login                 Authenticate this machine (opens the browser)
   vibed check [path]          Check if a project can be published (no network)
+  vibed preview [path]        Bundle + open the artifact locally (no publish)
+  vibed draft [path]          Upload a private, hosted preview link (no publish)
   vibed publish [path]        Bundle the project and publish it to vibed
+  vibed publish --draft-key <k>   Promote a draft preview to a public post
+  vibed delete <id|url>       Delete one of your posts
   vibed whoami                Show the signed-in account
   vibed logout                Remove the saved token
 
@@ -11032,7 +11463,58 @@ async function cmdCheck(args) {
   });
   return result.ok ? 0 : 1;
 }
-async function cmdPublish(args) {
+async function cmdPreview(args) {
+  const json = isTrue(args.flags.json);
+  const dir2 = resolve2(args._[1] ?? ".");
+  const cfg = await loadConfig({ api: str(args.flags.api) });
+  const policy = isTrue(args.flags["local-policy"]) ? void 0 : await fetchPolicy(cfg.apiBase);
+  const result = await bundleProject(dir2, {
+    entry: str(args.flags.entry),
+    build: !isTrue(args.flags["no-build"]),
+    policy,
+    onLog: (m) => !json && console.error(m)
+  });
+  if (!json) console.log(formatReport(result));
+  if (!result.html) {
+    if (json) out(json, "", { ok: false, fatal: result.fatal });
+    return 1;
+  }
+  const file2 = join3(tmpdir(), `vibed-preview-${result.sizeBytes ?? 0}.html`);
+  await writeFile2(file2, result.html, "utf8");
+  const url = pathToFileURL(file2).href;
+  if (json) {
+    out(json, "", { ok: result.ok, previewFile: file2, previewUrl: url });
+  } else {
+    console.log(`
+Preview \u2192 ${file2}`);
+    openBrowser(url);
+  }
+  return result.ok ? 0 : 1;
+}
+function metaFromArgs(args) {
+  return {
+    title: str(args.flags.title),
+    caption: str(args.flags.caption),
+    category: str(args.flags.category),
+    tags: typeof args.flags.tags === "string" ? args.flags.tags.split(",").map((t) => t.trim()).filter(Boolean) : void 0,
+    remixable: !isTrue(args.flags["no-remix"]),
+    visibility: isTrue(args.flags.unlisted) ? "unlisted" : "public"
+  };
+}
+function reportPublishError(e) {
+  if (e instanceof ApiError && e.code === "unauthorized") {
+    console.error("Your token is no longer valid. Run `vibed login` again.");
+    return 1;
+  }
+  console.error(`Failed: ${e instanceof Error ? e.message : String(e)}`);
+  if (e instanceof ApiError && e.details) {
+    const d = e.details;
+    for (const err of d.errors ?? []) console.error(`  \u2717 ${err.code}: ${err.message}`);
+    if (!d.errors) console.error(`  ${JSON.stringify(e.details)}`);
+  }
+  return 1;
+}
+async function cmdDraft(args) {
   const json = isTrue(args.flags.json);
   const dir2 = resolve2(args._[1] ?? ".");
   const cfg = await loadConfig({ api: str(args.flags.api) });
@@ -11047,37 +11529,94 @@ async function cmdPublish(args) {
     policy,
     onLog: (m) => !json && console.error(m)
   });
+  if (!result.ok || !result.html) {
+    out(json, formatReport(result), { ...result, html: void 0 });
+    return 1;
+  }
+  if (!json) console.log(formatReport(result));
+  try {
+    const d = await importDraft({ apiBase: cfg.apiBase, token: cfg.token }, result.html);
+    out(
+      json,
+      `
+\u2713 Preview (not published): ${d.previewUrl ?? "(no preview URL)"}
+  Publish it with:  vibed publish --draft-key ${d.draftArtifactKey} --title "\u2026" --category <Cat>`,
+      { ok: true, ...d }
+    );
+    return 0;
+  } catch (e) {
+    return reportPublishError(e);
+  }
+}
+async function cmdPublish(args) {
+  const json = isTrue(args.flags.json);
+  const cfg = await loadConfig({ api: str(args.flags.api) });
+  if (!cfg.token) {
+    console.error("Not signed in. Run `vibed login` first.");
+    return 1;
+  }
+  const client = { apiBase: cfg.apiBase, token: cfg.token };
+  const meta = metaFromArgs(args);
+  const draftKey = str(args.flags["draft-key"]);
+  if (draftKey) {
+    try {
+      const res = await publishDraft(client, draftKey, meta);
+      out(json, `
+\u2713 Published (${res.status}): ${res.url}`, res);
+      return 0;
+    } catch (e) {
+      return reportPublishError(e);
+    }
+  }
+  const dir2 = resolve2(args._[1] ?? ".");
+  const policy = await fetchPolicy(cfg.apiBase);
+  const result = await bundleProject(dir2, {
+    entry: str(args.flags.entry),
+    build: !isTrue(args.flags["no-build"]),
+    policy,
+    onLog: (m) => !json && console.error(m)
+  });
   if (!result.ok || !result.html) {
     out(json, formatReport(result), { ...result, html: void 0 });
     console.error("\nFix the blockers above, then run `vibed publish` again.");
     return 1;
   }
   if (!json) console.log(formatReport(result));
-  const meta = {
-    title: str(args.flags.title),
-    caption: str(args.flags.caption),
-    category: str(args.flags.category),
-    tags: typeof args.flags.tags === "string" ? args.flags.tags.split(",").map((t) => t.trim()).filter(Boolean) : void 0,
-    remixable: !isTrue(args.flags["no-remix"]),
-    visibility: isTrue(args.flags.unlisted) ? "unlisted" : "public"
-  };
   try {
-    const res = await publishArtifact({ apiBase: cfg.apiBase, token: cfg.token }, result.html, meta, dir2);
+    const res = await publishArtifact(client, result.html, meta, dir2);
     out(json, `
 \u2713 Published (${res.status}): ${res.url}`, res);
     return 0;
   } catch (e) {
-    if (e instanceof ApiError && e.code === "unauthorized") {
-      console.error("Your token is no longer valid. Run `vibed login` again.");
+    return reportPublishError(e);
+  }
+}
+async function cmdDelete(args) {
+  const json = isTrue(args.flags.json);
+  const target = args._[1];
+  if (!target) {
+    console.error("Usage: vibed delete <experience-id | https://\u2026/e/<id>>");
+    return 1;
+  }
+  const cfg = await loadConfig({ api: str(args.flags.api) });
+  if (!cfg.token) {
+    console.error("Not signed in. Run `vibed login` first.");
+    return 1;
+  }
+  try {
+    const id = await deleteExperience({ apiBase: cfg.apiBase, token: cfg.token }, target);
+    out(json, `\u2713 Deleted post ${id}.`, { ok: true, id });
+    return 0;
+  } catch (e) {
+    if (e instanceof ApiError && (e.code === "forbidden" || e.status === 403)) {
+      console.error("That post isn't yours to delete.");
       return 1;
     }
-    console.error(`Publish failed: ${e instanceof Error ? e.message : String(e)}`);
-    if (e instanceof ApiError && e.details) {
-      const d = e.details;
-      for (const err of d.errors ?? []) console.error(`  \u2717 ${err.code}: ${err.message}`);
-      if (!d.errors) console.error(`  ${JSON.stringify(e.details)}`);
+    if (e instanceof ApiError && (e.code === "not_found" || e.status === 404)) {
+      console.error("No such post (or already deleted).");
+      return 1;
     }
-    return 1;
+    return reportPublishError(e);
   }
 }
 async function cmdLogin(args) {
@@ -11131,8 +11670,15 @@ async function main() {
       return cmdWhoami(args);
     case "check":
       return cmdCheck(args);
+    case "preview":
+      return cmdPreview(args);
+    case "draft":
+      return cmdDraft(args);
     case "publish":
       return cmdPublish(args);
+    case "delete":
+    case "rm":
+      return cmdDelete(args);
     case void 0:
     case "help":
     case "--help":