@amirhosseinnateghi/vibed-cli 0.1.3 → 0.1.4

package/dist/index.js

@@ -1248,10 +1248,10 @@ var require_decode = __commonJS({
           this.state = EntityDecoderState.NumericDecimal;
           return this.stateNumericDecimal(str2, offset);
         };
-        EntityDecoder2.prototype.addToNumericResult = function(str2, start, end, base) {
+        EntityDecoder2.prototype.addToNumericResult = function(str2, start, end, base2) {
           if (start !== end) {
             var digitCount = end - start;
-            this.result = this.result * Math.pow(base, digitCount) + parseInt(str2.substr(start, digitCount), base);
+            this.result = this.result * Math.pow(base2, digitCount) + parseInt(str2.substr(start, digitCount), base2);
             this.consumed += digitCount;
           }
         };
@@ -6073,7 +6073,19 @@ var config = {
   // Light model that auto-tags the experience category. Falls back to a keyword
   // heuristic if the call fails.
   BUILDER_CLASSIFIER_MODEL: strEnv("BUILDER_CLASSIFIER_MODEL", "gemini-2.5-flash"),
-  BUILDER_MAX_TOKENS: intEnv("BUILDER_MAX_TOKENS", 8192),
+  // Speech-to-text model for the builder's voice input (docs/builder-architecture.md).
+  // Gemini 2.5 Flash transcribes the recorded clip via GapGPT's OpenAI-compatible
+  // chat API (an `input_audio` content part) — verified to accept the exact
+  // formats browsers produce (Chrome webm/opus, Safari mp4). It's multilingual,
+  // so Persian and English speech both work with no per-language config.
+  BUILDER_TRANSCRIBE_MODEL: strEnv("BUILDER_TRANSCRIBE_MODEL", "gemini-2.5-flash"),
+  // Upload cap for a voice clip. A minute of webm/opus is ~250KB; 8MB is ample
+  // headroom while still bounding what one request can hand the model.
+  BUILDER_TRANSCRIBE_MAX_BYTES: intEnv("BUILDER_TRANSCRIBE_MAX_BYTES", 8388608),
+  // Output budget per model call. 8k proved too small in prod — a rich game is
+  // ~7-8k tokens of file alone, and a truncated file used to slip through as a
+  // text dump. 24576 was probed OK against every catalog model on GapGPT.
+  BUILDER_MAX_TOKENS: intEnv("BUILDER_MAX_TOKENS", 24576),
   BUILDER_MAX_MESSAGES: intEnv("BUILDER_MAX_MESSAGES", 30),
   // Hard cap for a single build turn (across the model + one repair). The build
   // runs detached from the request, so this — not the browser — is what stops a
@@ -9815,23 +9827,23 @@ var ZodEffects = class extends ZodType {
     }
     if (effect.type === "transform") {
       if (ctx.common.async === false) {
-        const base = this._def.schema._parseSync({
+        const base2 = this._def.schema._parseSync({
           data: ctx.data,
           path: ctx.path,
           parent: ctx
         });
-        if (!isValid(base))
+        if (!isValid(base2))
           return INVALID;
-        const result = effect.transform(base.value, checkCtx);
+        const result = effect.transform(base2.value, checkCtx);
         if (result instanceof Promise) {
           throw new Error(`Asynchronous transform encountered during synchronous parse operation. Use .parseAsync instead.`);
         }
         return { status: status.value, value: result };
       } else {
-        return this._def.schema._parseAsync({ data: ctx.data, path: ctx.path, parent: ctx }).then((base) => {
-          if (!isValid(base))
+        return this._def.schema._parseAsync({ data: ctx.data, path: ctx.path, parent: ctx }).then((base2) => {
+          if (!isValid(base2))
             return INVALID;
-          return Promise.resolve(effect.transform(base.value, checkCtx)).then((result) => ({
+          return Promise.resolve(effect.transform(base2.value, checkCtx)).then((result) => ({
             status: status.value,
             value: result
           }));
@@ -10226,8 +10238,13 @@ var STORAGE = {
   // 256 KB
   /** Max records returnable in one query page. */
   QUERY_MAX_LIMIT: intEnv("STORE_QUERY_MAX_LIMIT", 100),
-  /** Whether anonymous (logged-out) shared writes may be enabled per post. */
-  ANON_WRITES_AVAILABLE: boolEnv("STORE_ANON_WRITES_AVAILABLE", false)
+  /**
+   * Platform kill-switch for anonymous shared writes. ON by default: the real
+   * gate is per-post owner opt-in (`anon_writes` + writePolicy `anyone`), so a
+   * post only accepts guest writes when its owner turns them on. Set the env to
+   * `false` to disable anon writes platform-wide regardless of per-post config.
+   */
+  ANON_WRITES_AVAILABLE: boolEnv("STORE_ANON_WRITES_AVAILABLE", true)
 };
 var COLLECTION_RE = /^[a-z0-9][a-z0-9:_-]{0,63}$/;
 var collectionSchemaStore = external_exports.string().regex(COLLECTION_RE, "invalid collection name");
@@ -10337,13 +10354,31 @@ var commentSchema = external_exports.object({
   parentId: external_exports.string().uuid().optional()
 });
 var eventSchema = external_exports.object({
-  kind: external_exports.enum(["impression", "play", "play_time", "share"]),
+  // "record"/"screenshot" fire when a viewer captures the vibe (see the in-iframe
+  // bridge capture flow, docs/architecture.md §5.4). Plain-text `viewEvents.kind`
+  // column, so new kinds need no migration.
+  kind: external_exports.enum(["impression", "play", "play_time", "share", "record", "screenshot"]),
   ms: external_exports.number().int().nonnegative().optional()
 });
 var createBuildSchema = external_exports.object({
   mode: external_exports.enum(["ai", "remix"]),
   remixParentId: external_exports.string().uuid().optional()
 });
+var turnAttachmentSchema = external_exports.object({
+  kind: external_exports.enum(["image", "audio", "file", "sketch"]),
+  key: external_exports.string().max(300).default(""),
+  name: external_exports.string().max(200),
+  // NUL bytes break Postgres jsonb (and mean binary-not-text) — strip defensively.
+  text: external_exports.string().max(5e4).transform((t) => t.replace(/\u0000/g, "")).optional()
+});
+var createTurnRequestSchema = external_exports.object({
+  clientTurnId: external_exports.string().uuid(),
+  content: external_exports.string().max(4e3).default(""),
+  attachments: external_exports.array(turnAttachmentSchema).max(6).optional(),
+  model: external_exports.string().max(100).optional()
+}).refine((v) => v.content.trim().length > 0 || (v.attachments?.length ?? 0) > 0, {
+  message: "Send a message or an attachment."
+});
 var builderAttachmentSchema = external_exports.object({
   kind: external_exports.enum(["image", "file", "audio"]),
   name: external_exports.string().max(200),
@@ -10444,27 +10479,52 @@ var notifPrefsPatchSchema = external_exports.object({
   groups: external_exports.record(external_exports.enum(NOTIF_PREF_GROUPS), external_exports.boolean()).optional()
 });
 
-// ../shared/src/models.ts
-var BUILDER_MODELS = [
-  // ── Free (selectable now) — ONLY genuinely strong builders ─────────
-  // Curated 2026-07: every id verified against GapGPT with a real full-HTML
-  // build (not a ping). Weak/cheap models were removed on purpose — a bad
-  // first build costs more in user trust than the tokens save.
-  { id: "claude-sonnet-4-5-20250929", label: "Claude Sonnet 4.5", tier: "free", note: "Best for polished vibes \xB7 fast", vision: true },
-  { id: "claude-sonnet-4-20250514", label: "Claude Sonnet 4", tier: "free", note: "Reliable all-rounder", vision: true },
-  { id: "gpt-5.2", label: "GPT-5.2", tier: "free", note: "Strong generalist", vision: true },
-  { id: "gpt-5.3-codex", label: "GPT-5.3 Codex", tier: "free", note: "Code specialist" },
-  { id: "gemini-2.5-pro", label: "Gemini 2.5 Pro", tier: "free", note: "Great UI sense", vision: true },
-  { id: "deepseek-v4-pro", label: "DeepSeek V4 Pro", tier: "free", note: "Strong coder \xB7 great value" },
-  { id: "qwen3-coder-480b-a35b-instruct", label: "Qwen3 Coder 480B", tier: "free", note: "Fast, capable coder" },
-  // ── Subscription (locked until billing is enabled) — premium ──────
-  // Opus 4.8 is owner-only early access: locked for everyone, live for the owner.
-  { id: "claude-opus-4-8", label: "Claude Opus 4.8", tier: "subscription", note: "Top quality", vision: true, ownerOnly: true },
-  { id: "gpt-5.2-pro", label: "GPT-5.2 Pro", tier: "subscription", note: "Premium" },
-  { id: "gemini-3-pro-preview", label: "Gemini 3 Pro", tier: "subscription", note: "Premium", vision: true }
+// ../shared/src/builderEvents.ts
+var BUILD_EVENT_VERSION = 1;
+var BUILD_PHASES = [
+  "queued",
+  // accepted, waiting for a worker slot
+  "thinking",
+  // model connected, no visible output yet (keep-alives flowing)
+  "writing",
+  // streaming the vibe's code/prose
+  "validating",
+  // sandbox pass on the produced artifact
+  "repairing"
+  // one automatic fix round after a validation failure
 ];
-var FREE_IDS = new Set(BUILDER_MODELS.filter((m) => m.tier === "free").map((m) => m.id));
-var OWNER_MODEL_IDS = new Set(BUILDER_MODELS.filter((m) => m.ownerOnly).map((m) => m.id));
+var base = { v: external_exports.literal(BUILD_EVENT_VERSION), turnId: external_exports.string() };
+var buildEventSchema = external_exports.discriminatedUnion("type", [
+  /** Assistant prose delta (never contains the HTML code block). */
+  external_exports.object({ ...base, type: external_exports.literal("token"), text: external_exports.string() }),
+  /**
+   * Honest heartbeat, ~every 2s while the turn runs: real elapsed ms, real
+   * output-token count, and the executor's actual phase. The UI renders this
+   * as a live counter — a number that moves because work is happening.
+   */
+  external_exports.object({
+    ...base,
+    type: external_exports.literal("progress"),
+    phase: external_exports.enum(BUILD_PHASES),
+    elapsedMs: external_exports.number(),
+    tokensOut: external_exports.number()
+  }),
+  /** Friendly status chip ("index.html", "Fixing a couple of things…"). */
+  external_exports.object({ ...base, type: external_exports.literal("status"), summary: external_exports.string() }),
+  /** First-message category classification. */
+  external_exports.object({ ...base, type: external_exports.literal("category"), category: external_exports.string() }),
+  /** The validated draft landed. Preview loads it from the draft URL. */
+  external_exports.object({ ...base, type: external_exports.literal("artifact"), artifactKey: external_exports.string() }),
+  /** Terminal: failure with taxonomy code + human message. */
+  external_exports.object({
+    ...base,
+    type: external_exports.literal("error"),
+    code: external_exports.string(),
+    message: external_exports.string()
+  }),
+  /** Terminal: success. */
+  external_exports.object({ ...base, type: external_exports.literal("done") })
+]);
 
 // ../shared/src/i18n.ts
 var en = {
@@ -10498,6 +10558,21 @@ var en = {
   "share.title": "Share",
   "share.copyLink": "Copy link",
   "share.copied": "Link copied",
+  "capture.record": "Record",
+  "capture.screenshot": "Screenshot",
+  "capture.recording": "Recording",
+  "capture.stop": "Stop",
+  "capture.preparing": "Preparing\u2026",
+  "capture.processing": "Finishing\u2026",
+  "capture.preview.videoTitle": "Your clip",
+  "capture.preview.imageTitle": "Your screenshot",
+  "capture.save": "Save",
+  "capture.shareVia": "Share via\u2026",
+  "capture.retry": "Try again",
+  "capture.error": "Capture failed \u2014 try again.",
+  "capture.allowShare": "Allow \u201CShare this tab\u201D to record \u2014 it captures just the vibe.",
+  "capture.pickTab": "Choose \u201CThis Tab\u201D so it records only the vibe.",
+  "capture.unsupported": `This ${ITEM.one} can't be captured yet. Try again in a moment.`,
   "create.title": "Create",
   "create.buildWithAI": "Build with AI",
   "create.import": "Import",
@@ -10689,6 +10764,15 @@ function validate(html, opts) {
     errors.push({ code: "NOT_HTML", message: "Content is not parseable as HTML." });
     return { ok: false, errors, warnings };
   }
+  const scriptOpens = (html.match(/<script\b/gi) ?? []).length;
+  const scriptCloses = (html.match(/<\/script\s*>/gi) ?? []).length;
+  if (scriptOpens > scriptCloses) {
+    errors.push({
+      code: "TRUNCATED_DOC",
+      message: "The file ends mid-<script> \u2014 it looks cut off. Regenerate or paste the complete file."
+    });
+    return { ok: false, errors, warnings };
+  }
   if (on("frames") && root.querySelector("iframe, frame, object, embed")) {
     errors.push({
       code: "FRAME_TAG",
@@ -11277,19 +11361,35 @@ function normalizeCategory(input) {
   const match = CATEGORIES.find((c) => c.toLowerCase() === input.toLowerCase());
   return match ?? "Other";
 }
-async function publishArtifact(client, html, meta, projectDir) {
-  const imported = await apiFetch(client, "POST", "/imports", { html });
+async function importDraft(client, html) {
+  const r = await apiFetch(client, "POST", "/imports", { html });
+  return { draftArtifactKey: r.draftArtifactKey, previewUrl: r.previewUrl };
+}
+async function publishDraft(client, draftArtifactKey, meta, html, projectDir) {
   const exp = await apiFetch(client, "POST", "/experiences", {
-    title: meta.title?.trim() || inferTitle(html, projectDir),
+    title: meta.title?.trim() || (html ? inferTitle(html, projectDir ?? ".") : "Untitled"),
     caption: meta.caption ?? "",
     category: normalizeCategory(meta.category),
     tags: meta.tags ?? [],
     remixable: meta.remixable ?? true,
     visibility: meta.visibility ?? "public",
-    draftArtifactKey: imported.draftArtifactKey
+    draftArtifactKey
   });
   return { id: exp.id, status: exp.status, url: `${client.apiBase}/e/${exp.id}` };
 }
+async function publishArtifact(client, html, meta, projectDir) {
+  const { draftArtifactKey } = await importDraft(client, html);
+  return publishDraft(client, draftArtifactKey, meta, html, projectDir);
+}
+function experienceIdFrom(input) {
+  const m = input.match(/\/e\/([0-9a-f-]{36})/i);
+  return (m?.[1] ?? input.trim()).toLowerCase();
+}
+async function deleteExperience(client, idOrUrl) {
+  const id = experienceIdFrom(idOrUrl);
+  await apiFetch(client, "DELETE", `/experiences/${id}`);
+  return id;
+}
 
 // src/index.ts
 function parseArgs(argv) {
@@ -11324,7 +11424,10 @@ Usage:
   vibed login                 Authenticate this machine (opens the browser)
   vibed check [path]          Check if a project can be published (no network)
   vibed preview [path]        Bundle + open the artifact locally (no publish)
+  vibed draft [path]          Upload a private, hosted preview link (no publish)
   vibed publish [path]        Bundle the project and publish it to vibed
+  vibed publish --draft-key <k>   Promote a draft preview to a public post
+  vibed delete <id|url>       Delete one of your posts
   vibed whoami                Show the signed-in account
   vibed logout                Remove the saved token
 
@@ -11388,7 +11491,30 @@ Preview \u2192 ${file2}`);
   }
   return result.ok ? 0 : 1;
 }
-async function cmdPublish(args) {
+function metaFromArgs(args) {
+  return {
+    title: str(args.flags.title),
+    caption: str(args.flags.caption),
+    category: str(args.flags.category),
+    tags: typeof args.flags.tags === "string" ? args.flags.tags.split(",").map((t) => t.trim()).filter(Boolean) : void 0,
+    remixable: !isTrue(args.flags["no-remix"]),
+    visibility: isTrue(args.flags.unlisted) ? "unlisted" : "public"
+  };
+}
+function reportPublishError(e) {
+  if (e instanceof ApiError && e.code === "unauthorized") {
+    console.error("Your token is no longer valid. Run `vibed login` again.");
+    return 1;
+  }
+  console.error(`Failed: ${e instanceof Error ? e.message : String(e)}`);
+  if (e instanceof ApiError && e.details) {
+    const d = e.details;
+    for (const err of d.errors ?? []) console.error(`  \u2717 ${err.code}: ${err.message}`);
+    if (!d.errors) console.error(`  ${JSON.stringify(e.details)}`);
+  }
+  return 1;
+}
+async function cmdDraft(args) {
   const json = isTrue(args.flags.json);
   const dir2 = resolve2(args._[1] ?? ".");
   const cfg = await loadConfig({ api: str(args.flags.api) });
@@ -11403,37 +11529,94 @@ async function cmdPublish(args) {
     policy,
     onLog: (m) => !json && console.error(m)
   });
+  if (!result.ok || !result.html) {
+    out(json, formatReport(result), { ...result, html: void 0 });
+    return 1;
+  }
+  if (!json) console.log(formatReport(result));
+  try {
+    const d = await importDraft({ apiBase: cfg.apiBase, token: cfg.token }, result.html);
+    out(
+      json,
+      `
+\u2713 Preview (not published): ${d.previewUrl ?? "(no preview URL)"}
+  Publish it with:  vibed publish --draft-key ${d.draftArtifactKey} --title "\u2026" --category <Cat>`,
+      { ok: true, ...d }
+    );
+    return 0;
+  } catch (e) {
+    return reportPublishError(e);
+  }
+}
+async function cmdPublish(args) {
+  const json = isTrue(args.flags.json);
+  const cfg = await loadConfig({ api: str(args.flags.api) });
+  if (!cfg.token) {
+    console.error("Not signed in. Run `vibed login` first.");
+    return 1;
+  }
+  const client = { apiBase: cfg.apiBase, token: cfg.token };
+  const meta = metaFromArgs(args);
+  const draftKey = str(args.flags["draft-key"]);
+  if (draftKey) {
+    try {
+      const res = await publishDraft(client, draftKey, meta);
+      out(json, `
+\u2713 Published (${res.status}): ${res.url}`, res);
+      return 0;
+    } catch (e) {
+      return reportPublishError(e);
+    }
+  }
+  const dir2 = resolve2(args._[1] ?? ".");
+  const policy = await fetchPolicy(cfg.apiBase);
+  const result = await bundleProject(dir2, {
+    entry: str(args.flags.entry),
+    build: !isTrue(args.flags["no-build"]),
+    policy,
+    onLog: (m) => !json && console.error(m)
+  });
   if (!result.ok || !result.html) {
     out(json, formatReport(result), { ...result, html: void 0 });
     console.error("\nFix the blockers above, then run `vibed publish` again.");
     return 1;
   }
   if (!json) console.log(formatReport(result));
-  const meta = {
-    title: str(args.flags.title),
-    caption: str(args.flags.caption),
-    category: str(args.flags.category),
-    tags: typeof args.flags.tags === "string" ? args.flags.tags.split(",").map((t) => t.trim()).filter(Boolean) : void 0,
-    remixable: !isTrue(args.flags["no-remix"]),
-    visibility: isTrue(args.flags.unlisted) ? "unlisted" : "public"
-  };
   try {
-    const res = await publishArtifact({ apiBase: cfg.apiBase, token: cfg.token }, result.html, meta, dir2);
+    const res = await publishArtifact(client, result.html, meta, dir2);
     out(json, `
 \u2713 Published (${res.status}): ${res.url}`, res);
     return 0;
   } catch (e) {
-    if (e instanceof ApiError && e.code === "unauthorized") {
-      console.error("Your token is no longer valid. Run `vibed login` again.");
+    return reportPublishError(e);
+  }
+}
+async function cmdDelete(args) {
+  const json = isTrue(args.flags.json);
+  const target = args._[1];
+  if (!target) {
+    console.error("Usage: vibed delete <experience-id | https://\u2026/e/<id>>");
+    return 1;
+  }
+  const cfg = await loadConfig({ api: str(args.flags.api) });
+  if (!cfg.token) {
+    console.error("Not signed in. Run `vibed login` first.");
+    return 1;
+  }
+  try {
+    const id = await deleteExperience({ apiBase: cfg.apiBase, token: cfg.token }, target);
+    out(json, `\u2713 Deleted post ${id}.`, { ok: true, id });
+    return 0;
+  } catch (e) {
+    if (e instanceof ApiError && (e.code === "forbidden" || e.status === 403)) {
+      console.error("That post isn't yours to delete.");
       return 1;
     }
-    console.error(`Publish failed: ${e instanceof Error ? e.message : String(e)}`);
-    if (e instanceof ApiError && e.details) {
-      const d = e.details;
-      for (const err of d.errors ?? []) console.error(`  \u2717 ${err.code}: ${err.message}`);
-      if (!d.errors) console.error(`  ${JSON.stringify(e.details)}`);
+    if (e instanceof ApiError && (e.code === "not_found" || e.status === 404)) {
+      console.error("No such post (or already deleted).");
+      return 1;
     }
-    return 1;
+    return reportPublishError(e);
   }
 }
 async function cmdLogin(args) {
@@ -11489,8 +11672,13 @@ async function main() {
       return cmdCheck(args);
     case "preview":
       return cmdPreview(args);
+    case "draft":
+      return cmdDraft(args);
     case "publish":
       return cmdPublish(args);
+    case "delete":
+    case "rm":
+      return cmdDelete(args);
     case void 0:
     case "help":
     case "--help":

package/dist/vibed.cjs

@@ -1249,10 +1249,10 @@ var require_decode = __commonJS({
           this.state = EntityDecoderState.NumericDecimal;
           return this.stateNumericDecimal(str2, offset);
         };
-        EntityDecoder2.prototype.addToNumericResult = function(str2, start, end, base) {
+        EntityDecoder2.prototype.addToNumericResult = function(str2, start, end, base2) {
           if (start !== end) {
             var digitCount = end - start;
-            this.result = this.result * Math.pow(base, digitCount) + parseInt(str2.substr(start, digitCount), base);
+            this.result = this.result * Math.pow(base2, digitCount) + parseInt(str2.substr(start, digitCount), base2);
             this.consumed += digitCount;
           }
         };
@@ -6074,7 +6074,19 @@ var config = {
   // Light model that auto-tags the experience category. Falls back to a keyword
   // heuristic if the call fails.
   BUILDER_CLASSIFIER_MODEL: strEnv("BUILDER_CLASSIFIER_MODEL", "gemini-2.5-flash"),
-  BUILDER_MAX_TOKENS: intEnv("BUILDER_MAX_TOKENS", 8192),
+  // Speech-to-text model for the builder's voice input (docs/builder-architecture.md).
+  // Gemini 2.5 Flash transcribes the recorded clip via GapGPT's OpenAI-compatible
+  // chat API (an `input_audio` content part) — verified to accept the exact
+  // formats browsers produce (Chrome webm/opus, Safari mp4). It's multilingual,
+  // so Persian and English speech both work with no per-language config.
+  BUILDER_TRANSCRIBE_MODEL: strEnv("BUILDER_TRANSCRIBE_MODEL", "gemini-2.5-flash"),
+  // Upload cap for a voice clip. A minute of webm/opus is ~250KB; 8MB is ample
+  // headroom while still bounding what one request can hand the model.
+  BUILDER_TRANSCRIBE_MAX_BYTES: intEnv("BUILDER_TRANSCRIBE_MAX_BYTES", 8388608),
+  // Output budget per model call. 8k proved too small in prod — a rich game is
+  // ~7-8k tokens of file alone, and a truncated file used to slip through as a
+  // text dump. 24576 was probed OK against every catalog model on GapGPT.
+  BUILDER_MAX_TOKENS: intEnv("BUILDER_MAX_TOKENS", 24576),
   BUILDER_MAX_MESSAGES: intEnv("BUILDER_MAX_MESSAGES", 30),
   // Hard cap for a single build turn (across the model + one repair). The build
   // runs detached from the request, so this — not the browser — is what stops a
@@ -9816,23 +9828,23 @@ var ZodEffects = class extends ZodType {
     }
     if (effect.type === "transform") {
       if (ctx.common.async === false) {
-        const base = this._def.schema._parseSync({
+        const base2 = this._def.schema._parseSync({
           data: ctx.data,
           path: ctx.path,
           parent: ctx
         });
-        if (!isValid(base))
+        if (!isValid(base2))
           return INVALID;
-        const result = effect.transform(base.value, checkCtx);
+        const result = effect.transform(base2.value, checkCtx);
         if (result instanceof Promise) {
           throw new Error(`Asynchronous transform encountered during synchronous parse operation. Use .parseAsync instead.`);
         }
         return { status: status.value, value: result };
       } else {
-        return this._def.schema._parseAsync({ data: ctx.data, path: ctx.path, parent: ctx }).then((base) => {
-          if (!isValid(base))
+        return this._def.schema._parseAsync({ data: ctx.data, path: ctx.path, parent: ctx }).then((base2) => {
+          if (!isValid(base2))
             return INVALID;
-          return Promise.resolve(effect.transform(base.value, checkCtx)).then((result) => ({
+          return Promise.resolve(effect.transform(base2.value, checkCtx)).then((result) => ({
             status: status.value,
             value: result
           }));
@@ -10227,8 +10239,13 @@ var STORAGE = {
   // 256 KB
   /** Max records returnable in one query page. */
   QUERY_MAX_LIMIT: intEnv("STORE_QUERY_MAX_LIMIT", 100),
-  /** Whether anonymous (logged-out) shared writes may be enabled per post. */
-  ANON_WRITES_AVAILABLE: boolEnv("STORE_ANON_WRITES_AVAILABLE", false)
+  /**
+   * Platform kill-switch for anonymous shared writes. ON by default: the real
+   * gate is per-post owner opt-in (`anon_writes` + writePolicy `anyone`), so a
+   * post only accepts guest writes when its owner turns them on. Set the env to
+   * `false` to disable anon writes platform-wide regardless of per-post config.
+   */
+  ANON_WRITES_AVAILABLE: boolEnv("STORE_ANON_WRITES_AVAILABLE", true)
 };
 var COLLECTION_RE = /^[a-z0-9][a-z0-9:_-]{0,63}$/;
 var collectionSchemaStore = external_exports.string().regex(COLLECTION_RE, "invalid collection name");
@@ -10338,13 +10355,31 @@ var commentSchema = external_exports.object({
   parentId: external_exports.string().uuid().optional()
 });
 var eventSchema = external_exports.object({
-  kind: external_exports.enum(["impression", "play", "play_time", "share"]),
+  // "record"/"screenshot" fire when a viewer captures the vibe (see the in-iframe
+  // bridge capture flow, docs/architecture.md §5.4). Plain-text `viewEvents.kind`
+  // column, so new kinds need no migration.
+  kind: external_exports.enum(["impression", "play", "play_time", "share", "record", "screenshot"]),
   ms: external_exports.number().int().nonnegative().optional()
 });
 var createBuildSchema = external_exports.object({
   mode: external_exports.enum(["ai", "remix"]),
   remixParentId: external_exports.string().uuid().optional()
 });
+var turnAttachmentSchema = external_exports.object({
+  kind: external_exports.enum(["image", "audio", "file", "sketch"]),
+  key: external_exports.string().max(300).default(""),
+  name: external_exports.string().max(200),
+  // NUL bytes break Postgres jsonb (and mean binary-not-text) — strip defensively.
+  text: external_exports.string().max(5e4).transform((t) => t.replace(/\u0000/g, "")).optional()
+});
+var createTurnRequestSchema = external_exports.object({
+  clientTurnId: external_exports.string().uuid(),
+  content: external_exports.string().max(4e3).default(""),
+  attachments: external_exports.array(turnAttachmentSchema).max(6).optional(),
+  model: external_exports.string().max(100).optional()
+}).refine((v) => v.content.trim().length > 0 || (v.attachments?.length ?? 0) > 0, {
+  message: "Send a message or an attachment."
+});
 var builderAttachmentSchema = external_exports.object({
   kind: external_exports.enum(["image", "file", "audio"]),
   name: external_exports.string().max(200),
@@ -10445,27 +10480,52 @@ var notifPrefsPatchSchema = external_exports.object({
   groups: external_exports.record(external_exports.enum(NOTIF_PREF_GROUPS), external_exports.boolean()).optional()
 });
 
-// ../shared/src/models.ts
-var BUILDER_MODELS = [
-  // ── Free (selectable now) — ONLY genuinely strong builders ─────────
-  // Curated 2026-07: every id verified against GapGPT with a real full-HTML
-  // build (not a ping). Weak/cheap models were removed on purpose — a bad
-  // first build costs more in user trust than the tokens save.
-  { id: "claude-sonnet-4-5-20250929", label: "Claude Sonnet 4.5", tier: "free", note: "Best for polished vibes \xB7 fast", vision: true },
-  { id: "claude-sonnet-4-20250514", label: "Claude Sonnet 4", tier: "free", note: "Reliable all-rounder", vision: true },
-  { id: "gpt-5.2", label: "GPT-5.2", tier: "free", note: "Strong generalist", vision: true },
-  { id: "gpt-5.3-codex", label: "GPT-5.3 Codex", tier: "free", note: "Code specialist" },
-  { id: "gemini-2.5-pro", label: "Gemini 2.5 Pro", tier: "free", note: "Great UI sense", vision: true },
-  { id: "deepseek-v4-pro", label: "DeepSeek V4 Pro", tier: "free", note: "Strong coder \xB7 great value" },
-  { id: "qwen3-coder-480b-a35b-instruct", label: "Qwen3 Coder 480B", tier: "free", note: "Fast, capable coder" },
-  // ── Subscription (locked until billing is enabled) — premium ──────
-  // Opus 4.8 is owner-only early access: locked for everyone, live for the owner.
-  { id: "claude-opus-4-8", label: "Claude Opus 4.8", tier: "subscription", note: "Top quality", vision: true, ownerOnly: true },
-  { id: "gpt-5.2-pro", label: "GPT-5.2 Pro", tier: "subscription", note: "Premium" },
-  { id: "gemini-3-pro-preview", label: "Gemini 3 Pro", tier: "subscription", note: "Premium", vision: true }
+// ../shared/src/builderEvents.ts
+var BUILD_EVENT_VERSION = 1;
+var BUILD_PHASES = [
+  "queued",
+  // accepted, waiting for a worker slot
+  "thinking",
+  // model connected, no visible output yet (keep-alives flowing)
+  "writing",
+  // streaming the vibe's code/prose
+  "validating",
+  // sandbox pass on the produced artifact
+  "repairing"
+  // one automatic fix round after a validation failure
 ];
-var FREE_IDS = new Set(BUILDER_MODELS.filter((m) => m.tier === "free").map((m) => m.id));
-var OWNER_MODEL_IDS = new Set(BUILDER_MODELS.filter((m) => m.ownerOnly).map((m) => m.id));
+var base = { v: external_exports.literal(BUILD_EVENT_VERSION), turnId: external_exports.string() };
+var buildEventSchema = external_exports.discriminatedUnion("type", [
+  /** Assistant prose delta (never contains the HTML code block). */
+  external_exports.object({ ...base, type: external_exports.literal("token"), text: external_exports.string() }),
+  /**
+   * Honest heartbeat, ~every 2s while the turn runs: real elapsed ms, real
+   * output-token count, and the executor's actual phase. The UI renders this
+   * as a live counter — a number that moves because work is happening.
+   */
+  external_exports.object({
+    ...base,
+    type: external_exports.literal("progress"),
+    phase: external_exports.enum(BUILD_PHASES),
+    elapsedMs: external_exports.number(),
+    tokensOut: external_exports.number()
+  }),
+  /** Friendly status chip ("index.html", "Fixing a couple of things…"). */
+  external_exports.object({ ...base, type: external_exports.literal("status"), summary: external_exports.string() }),
+  /** First-message category classification. */
+  external_exports.object({ ...base, type: external_exports.literal("category"), category: external_exports.string() }),
+  /** The validated draft landed. Preview loads it from the draft URL. */
+  external_exports.object({ ...base, type: external_exports.literal("artifact"), artifactKey: external_exports.string() }),
+  /** Terminal: failure with taxonomy code + human message. */
+  external_exports.object({
+    ...base,
+    type: external_exports.literal("error"),
+    code: external_exports.string(),
+    message: external_exports.string()
+  }),
+  /** Terminal: success. */
+  external_exports.object({ ...base, type: external_exports.literal("done") })
+]);
 
 // ../shared/src/i18n.ts
 var en = {
@@ -10499,6 +10559,21 @@ var en = {
   "share.title": "Share",
   "share.copyLink": "Copy link",
   "share.copied": "Link copied",
+  "capture.record": "Record",
+  "capture.screenshot": "Screenshot",
+  "capture.recording": "Recording",
+  "capture.stop": "Stop",
+  "capture.preparing": "Preparing\u2026",
+  "capture.processing": "Finishing\u2026",
+  "capture.preview.videoTitle": "Your clip",
+  "capture.preview.imageTitle": "Your screenshot",
+  "capture.save": "Save",
+  "capture.shareVia": "Share via\u2026",
+  "capture.retry": "Try again",
+  "capture.error": "Capture failed \u2014 try again.",
+  "capture.allowShare": "Allow \u201CShare this tab\u201D to record \u2014 it captures just the vibe.",
+  "capture.pickTab": "Choose \u201CThis Tab\u201D so it records only the vibe.",
+  "capture.unsupported": `This ${ITEM.one} can't be captured yet. Try again in a moment.`,
   "create.title": "Create",
   "create.buildWithAI": "Build with AI",
   "create.import": "Import",
@@ -10690,6 +10765,15 @@ function validate(html, opts) {
     errors.push({ code: "NOT_HTML", message: "Content is not parseable as HTML." });
     return { ok: false, errors, warnings };
   }
+  const scriptOpens = (html.match(/<script\b/gi) ?? []).length;
+  const scriptCloses = (html.match(/<\/script\s*>/gi) ?? []).length;
+  if (scriptOpens > scriptCloses) {
+    errors.push({
+      code: "TRUNCATED_DOC",
+      message: "The file ends mid-<script> \u2014 it looks cut off. Regenerate or paste the complete file."
+    });
+    return { ok: false, errors, warnings };
+  }
   if (on("frames") && root.querySelector("iframe, frame, object, embed")) {
     errors.push({
       code: "FRAME_TAG",
@@ -11278,19 +11362,35 @@ function normalizeCategory(input) {
   const match = CATEGORIES.find((c) => c.toLowerCase() === input.toLowerCase());
   return match ?? "Other";
 }
-async function publishArtifact(client, html, meta, projectDir) {
-  const imported = await apiFetch(client, "POST", "/imports", { html });
+async function importDraft(client, html) {
+  const r = await apiFetch(client, "POST", "/imports", { html });
+  return { draftArtifactKey: r.draftArtifactKey, previewUrl: r.previewUrl };
+}
+async function publishDraft(client, draftArtifactKey, meta, html, projectDir) {
   const exp = await apiFetch(client, "POST", "/experiences", {
-    title: meta.title?.trim() || inferTitle(html, projectDir),
+    title: meta.title?.trim() || (html ? inferTitle(html, projectDir ?? ".") : "Untitled"),
     caption: meta.caption ?? "",
     category: normalizeCategory(meta.category),
     tags: meta.tags ?? [],
     remixable: meta.remixable ?? true,
     visibility: meta.visibility ?? "public",
-    draftArtifactKey: imported.draftArtifactKey
+    draftArtifactKey
   });
   return { id: exp.id, status: exp.status, url: `${client.apiBase}/e/${exp.id}` };
 }
+async function publishArtifact(client, html, meta, projectDir) {
+  const { draftArtifactKey } = await importDraft(client, html);
+  return publishDraft(client, draftArtifactKey, meta, html, projectDir);
+}
+function experienceIdFrom(input) {
+  const m = input.match(/\/e\/([0-9a-f-]{36})/i);
+  return (m?.[1] ?? input.trim()).toLowerCase();
+}
+async function deleteExperience(client, idOrUrl) {
+  const id = experienceIdFrom(idOrUrl);
+  await apiFetch(client, "DELETE", `/experiences/${id}`);
+  return id;
+}
 
 // src/index.ts
 function parseArgs(argv) {
@@ -11325,7 +11425,10 @@ Usage:
   vibed login                 Authenticate this machine (opens the browser)
   vibed check [path]          Check if a project can be published (no network)
   vibed preview [path]        Bundle + open the artifact locally (no publish)
+  vibed draft [path]          Upload a private, hosted preview link (no publish)
   vibed publish [path]        Bundle the project and publish it to vibed
+  vibed publish --draft-key <k>   Promote a draft preview to a public post
+  vibed delete <id|url>       Delete one of your posts
   vibed whoami                Show the signed-in account
   vibed logout                Remove the saved token
 
@@ -11389,7 +11492,30 @@ Preview \u2192 ${file2}`);
   }
   return result.ok ? 0 : 1;
 }
-async function cmdPublish(args) {
+function metaFromArgs(args) {
+  return {
+    title: str(args.flags.title),
+    caption: str(args.flags.caption),
+    category: str(args.flags.category),
+    tags: typeof args.flags.tags === "string" ? args.flags.tags.split(",").map((t) => t.trim()).filter(Boolean) : void 0,
+    remixable: !isTrue(args.flags["no-remix"]),
+    visibility: isTrue(args.flags.unlisted) ? "unlisted" : "public"
+  };
+}
+function reportPublishError(e) {
+  if (e instanceof ApiError && e.code === "unauthorized") {
+    console.error("Your token is no longer valid. Run `vibed login` again.");
+    return 1;
+  }
+  console.error(`Failed: ${e instanceof Error ? e.message : String(e)}`);
+  if (e instanceof ApiError && e.details) {
+    const d = e.details;
+    for (const err of d.errors ?? []) console.error(`  \u2717 ${err.code}: ${err.message}`);
+    if (!d.errors) console.error(`  ${JSON.stringify(e.details)}`);
+  }
+  return 1;
+}
+async function cmdDraft(args) {
   const json = isTrue(args.flags.json);
   const dir2 = (0, import_node_path4.resolve)(args._[1] ?? ".");
   const cfg = await loadConfig({ api: str(args.flags.api) });
@@ -11404,37 +11530,94 @@ async function cmdPublish(args) {
     policy,
     onLog: (m) => !json && console.error(m)
   });
+  if (!result.ok || !result.html) {
+    out(json, formatReport(result), { ...result, html: void 0 });
+    return 1;
+  }
+  if (!json) console.log(formatReport(result));
+  try {
+    const d = await importDraft({ apiBase: cfg.apiBase, token: cfg.token }, result.html);
+    out(
+      json,
+      `
+\u2713 Preview (not published): ${d.previewUrl ?? "(no preview URL)"}
+  Publish it with:  vibed publish --draft-key ${d.draftArtifactKey} --title "\u2026" --category <Cat>`,
+      { ok: true, ...d }
+    );
+    return 0;
+  } catch (e) {
+    return reportPublishError(e);
+  }
+}
+async function cmdPublish(args) {
+  const json = isTrue(args.flags.json);
+  const cfg = await loadConfig({ api: str(args.flags.api) });
+  if (!cfg.token) {
+    console.error("Not signed in. Run `vibed login` first.");
+    return 1;
+  }
+  const client = { apiBase: cfg.apiBase, token: cfg.token };
+  const meta = metaFromArgs(args);
+  const draftKey = str(args.flags["draft-key"]);
+  if (draftKey) {
+    try {
+      const res = await publishDraft(client, draftKey, meta);
+      out(json, `
+\u2713 Published (${res.status}): ${res.url}`, res);
+      return 0;
+    } catch (e) {
+      return reportPublishError(e);
+    }
+  }
+  const dir2 = (0, import_node_path4.resolve)(args._[1] ?? ".");
+  const policy = await fetchPolicy(cfg.apiBase);
+  const result = await bundleProject(dir2, {
+    entry: str(args.flags.entry),
+    build: !isTrue(args.flags["no-build"]),
+    policy,
+    onLog: (m) => !json && console.error(m)
+  });
   if (!result.ok || !result.html) {
     out(json, formatReport(result), { ...result, html: void 0 });
     console.error("\nFix the blockers above, then run `vibed publish` again.");
     return 1;
   }
   if (!json) console.log(formatReport(result));
-  const meta = {
-    title: str(args.flags.title),
-    caption: str(args.flags.caption),
-    category: str(args.flags.category),
-    tags: typeof args.flags.tags === "string" ? args.flags.tags.split(",").map((t) => t.trim()).filter(Boolean) : void 0,
-    remixable: !isTrue(args.flags["no-remix"]),
-    visibility: isTrue(args.flags.unlisted) ? "unlisted" : "public"
-  };
   try {
-    const res = await publishArtifact({ apiBase: cfg.apiBase, token: cfg.token }, result.html, meta, dir2);
+    const res = await publishArtifact(client, result.html, meta, dir2);
     out(json, `
 \u2713 Published (${res.status}): ${res.url}`, res);
     return 0;
   } catch (e) {
-    if (e instanceof ApiError && e.code === "unauthorized") {
-      console.error("Your token is no longer valid. Run `vibed login` again.");
+    return reportPublishError(e);
+  }
+}
+async function cmdDelete(args) {
+  const json = isTrue(args.flags.json);
+  const target = args._[1];
+  if (!target) {
+    console.error("Usage: vibed delete <experience-id | https://\u2026/e/<id>>");
+    return 1;
+  }
+  const cfg = await loadConfig({ api: str(args.flags.api) });
+  if (!cfg.token) {
+    console.error("Not signed in. Run `vibed login` first.");
+    return 1;
+  }
+  try {
+    const id = await deleteExperience({ apiBase: cfg.apiBase, token: cfg.token }, target);
+    out(json, `\u2713 Deleted post ${id}.`, { ok: true, id });
+    return 0;
+  } catch (e) {
+    if (e instanceof ApiError && (e.code === "forbidden" || e.status === 403)) {
+      console.error("That post isn't yours to delete.");
       return 1;
     }
-    console.error(`Publish failed: ${e instanceof Error ? e.message : String(e)}`);
-    if (e instanceof ApiError && e.details) {
-      const d = e.details;
-      for (const err of d.errors ?? []) console.error(`  \u2717 ${err.code}: ${err.message}`);
-      if (!d.errors) console.error(`  ${JSON.stringify(e.details)}`);
+    if (e instanceof ApiError && (e.code === "not_found" || e.status === 404)) {
+      console.error("No such post (or already deleted).");
+      return 1;
     }
-    return 1;
+    return reportPublishError(e);
   }
 }
 async function cmdLogin(args) {
@@ -11490,8 +11673,13 @@ async function main() {
       return cmdCheck(args);
     case "preview":
       return cmdPreview(args);
+    case "draft":
+      return cmdDraft(args);
     case "publish":
       return cmdPublish(args);
+    case "delete":
+    case "rm":
+      return cmdDelete(args);
     case void 0:
     case "help":
     case "--help":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amirhosseinnateghi/vibed-cli",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "make it vibed — check, bundle, and publish a project to vibed from the terminal",
   "license": "MIT",
   "type": "module",