@capgo/cli 8.0.0-alpha.5 → 8.0.0

package/README.md

@@ -7,14 +7,14 @@
 
 A CLI to upload and download files from the Capgo Cloud.
 
-You can find the most up to date version of this doc in our web doc:
+You can find the most up-to-date version of this doc in our web doc:
 https://capgo.app/docs/cli/overview/
 
 ## Usage
 
 Before using the CLI, you should register here: https://capgo.app/
 
-Then go to your account in `apikey` section and click in the `all` key to copy it.
+Then go to your account in the `apikey` section and click the `all` key to copy it.
 
 Follow the documentation here: https://capacitorjs.com/docs/getting-started/
 
@@ -24,11 +24,16 @@ Follow the documentation here: https://capacitorjs.com/docs/getting-started/
 ## 📋 Table of Contents
 
 - 🚀 [Init](#init)
+- 📱 [Run](#run)
+  - [Device](#run-device)
+- 🔹 [Star](#star)
+- 🔹 [Star-all](#star-all)
 - 👨‍⚕️ [Doctor](#doctor)
 - 🔑 [Login](#login)
 - 📦 [Bundle](#bundle)
   - [Upload](#bundle-upload)
   - [Compatibility](#bundle-compatibility)
+  - [ReleaseType](#bundle-releaseType)
   - [Delete](#bundle-delete)
   - [List](#bundle-list)
   - [Cleanup](#bundle-cleanup)
@@ -54,12 +59,32 @@ Follow the documentation here: https://capacitorjs.com/docs/getting-started/
   - [Delete_old](#key-delete_old)
 - 👤 [Account](#account)
   - [Id](#account-id)
+- 🔹 [Organization](#organization)
+  - [List](#organization-list)
+  - [Add](#organization-add)
+  - [Members](#organization-members)
+  - [Set](#organization-set)
+  - [Delete](#organization-delete)
 - 🔹 [Organisation](#organisation)
   - [List](#organisation-list)
   - [Add](#organisation-add)
   - [Set](#organisation-set)
   - [Delete](#organisation-delete)
 - 🔹 [Build](#build)
+  - [Needed](#build-needed)
+  - [Init](#build-init)
+  - [Request](#build-request)
+  - [Last-output](#build-last-output)
+  - [Credentials](#build-credentials)
+    - [Save](#build-credentials-save)
+    - [List](#build-credentials-list)
+    - [Clear](#build-credentials-clear)
+    - [Update](#build-credentials-update)
+    - [Manage](#build-credentials-manage)
+    - [Migrate](#build-credentials-migrate)
+- 🔹 [Probe](#probe)
+- 🔹 [Generate-docs](#generate-docs)
+- 🔹 [Mcp](#mcp)
 
 ## <a id="init"></a> 🚀 **Init**
 
@@ -71,6 +96,8 @@ npx @capgo/cli@latest init
 
 🚀 Initialize a new app in Capgo Cloud with step-by-step guidance.
 This includes adding code for updates, building, uploading your app, and verifying update functionality.
+Capgo bundles are web assets and can be fetched by anyone who knows the URL. Use encryption for banking, regulated, or other high-security apps.
+During the iOS run-on-device step, choose a physical iPhone/iPad or simulator. If you choose a physical device, the CLI lets you connect, unlock, and check again before it launches the app.
 
 **Example:**
 
@@ -78,16 +105,73 @@ This includes adding code for updates, building, uploading your app, and verifyi
 npx @capgo/cli@latest init YOUR_API_KEY com.example.app
 ```
 
-## <a id="options"></a> Options
+## <a id="options-init"></a> Options (Init)
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-n,** | <code>string</code> | App name for display in Capgo Cloud |
-| **-i,** | <code>string</code> | App icon path for display in Capgo Cloud |
+| **-n** | <code>string</code> | App name for display in Capgo Cloud |
+| **-i** | <code>string</code> | App icon path for display in Capgo Cloud |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
 | **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
 
 
+## <a id="run"></a> 📱 **Run**
+
+📱 Run Capacitor apps on devices from the CLI.
+
+### <a id="run-device"></a> 🔹 **Device**
+
+```bash
+npx @capgo/cli@latest run device
+```
+
+📱 Run your Capacitor app on a connected device or simulator.
+If you omit the platform in an interactive terminal, the command asks whether to start on iOS or Android.
+The command lists available devices and simulators, lets you reload the list, and runs with your selection.
+For iOS, this asks whether to use a physical iPhone/iPad or simulator before showing devices.
+Use --no-launch to print the resolved command without starting the app.
+
+**Example:**
+
+```bash
+npx @capgo/cli@latest run device ios --no-launch
+```
+
+**Options:**
+
+| Param          | Type          | Description          |
+| -------------- | ------------- | -------------------- |
+| **--no-launch** | <code>boolean</code> | Resolve and print the run command without starting the app |
+
+
+## <a id="star"></a> 🔹 **Star**
+
+```bash
+npx @capgo/cli@latest star
+```
+
+⭐ Star a Capgo GitHub repository to support the project.
+If you do not pass a repository name, this defaults to capacitor-updater in the Cap-go org.
+
+
+## <a id="star-all"></a> 🔹 **Star-all**
+
+```bash
+npx @capgo/cli@latest star-all
+```
+
+⭐ Star all Capgo GitHub repositories with a small random delay between each request.
+If you do not pass repositories, this defaults to all Cap-go repositories whose name starts with `capacitor-`.
+
+## <a id="options-star-all"></a> Options (Star-all)
+
+| Param          | Type          | Description          |
+| -------------- | ------------- | -------------------- |
+| **--min-delay-ms** | <code>string</code> | Minimum delay in ms between each star action (default: 20) |
+| **--max-delay-ms** | <code>string</code> | Maximum delay in ms between each star action (default: 180) |
+| **--max-concurrency** | <code>string</code> | Maximum number of star requests running in parallel (default: 4) |
+
+
 ## <a id="doctor"></a> 👨‍⚕️ **Doctor**
 
 ```bash
@@ -103,7 +187,7 @@ This command helps diagnose issues with your setup.
 npx @capgo/cli@latest doctor
 ```
 
-## <a id="options"></a> Options
+## <a id="options-doctor"></a> Options (Doctor)
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
@@ -127,7 +211,7 @@ Use --apikey=******** in any command to override it.
 npx @capgo/cli@latest login YOUR_API_KEY
 ```
 
-## <a id="options"></a> Options
+## <a id="options-login"></a> Options (Login)
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
@@ -163,10 +247,10 @@ npx @capgo/cli@latest bundle upload com.example.app --path ./dist --channel prod
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-a,** | <code>string</code> | API key to link to your account |
-| **-p,** | <code>string</code> | Path of the folder to upload, if not provided it will use the webDir set in capacitor.config |
-| **-c,** | <code>string</code> | Channel to link to |
-| **-e,** | <code>string</code> | Link to external URL instead of upload to Capgo Cloud |
+| **-a** | <code>string</code> | API key to link to your account |
+| **-p** | <code>string</code> | Path of the folder to upload, if not provided it will use the webDir set in capacitor.config |
+| **-c** | <code>string</code> | Channel to link to |
+| **-e** | <code>string</code> | Link to external URL instead of upload to Capgo Cloud |
 | **--iv-session-key** | <code>string</code> | Set the IV and session key for bundle URL external |
 | **--s3-region** | <code>string</code> | Region for your S3 bucket |
 | **--s3-apikey** | <code>string</code> | API key for your S3 endpoint |
@@ -181,13 +265,15 @@ npx @capgo/cli@latest bundle upload com.example.app --path ./dist --channel prod
 | **--no-key** | <code>boolean</code> | Ignore signing key and send clear update |
 | **--no-code-check** | <code>boolean</code> | Ignore checking if notifyAppReady() is called in source code and index present in root folder |
 | **--display-iv-session** | <code>boolean</code> | Show in the console the IV and session key used to encrypt the update |
-| **-b,** | <code>string</code> | Bundle version number of the bundle to upload |
+| **-b** | <code>string</code> | Bundle version number of the bundle to upload |
 | **--link** | <code>string</code> | Link to external resource (e.g. GitHub release) |
 | **--comment** | <code>string</code> | Comment about this version, could be a release note, a commit hash, a commit message, etc. |
 | **--min-update-version** | <code>string</code> | Minimal version required to update to this version. Used only if the disable auto update is set to metadata in channel |
 | **--auto-min-update-version** | <code>boolean</code> | Set the min update version based on native packages |
 | **--ignore-metadata-check** | <code>boolean</code> | Ignores the metadata (node_modules) check when uploading |
+| **--fail-on-incompatible** | <code>boolean</code> | Fail the upload (exit non-zero) instead of uploading when the bundle is incompatible with the channel's current native packages. In an interactive terminal you can still choose a native build; declining fails. Cannot be combined with --ignore-metadata-check. |
 | **--ignore-checksum-check** | <code>boolean</code> | Ignores the checksum check when uploading |
+| **--force-crc32-checksum** | <code>boolean</code> | Force CRC32 checksum for upload (override auto-detection) |
 | **--timeout** | <code>string</code> | Timeout for the upload process in seconds |
 | **--multipart** | <code>boolean</code> | [DEPRECATED] Use --tus instead. Uses multipart protocol for S3 uploads |
 | **--zip** | <code>boolean</code> | Upload the bundle using zip to Capgo cloud (legacy) |
@@ -195,11 +281,12 @@ npx @capgo/cli@latest bundle upload com.example.app --path ./dist --channel prod
 | **--tus-chunk-size** | <code>string</code> | Chunk size in bytes for TUS resumable uploads (default: auto) |
 | **--partial** | <code>boolean</code> | [DEPRECATED] Use --delta instead. Upload incremental updates |
 | **--partial-only** | <code>boolean</code> | [DEPRECATED] Use --delta-only instead. Upload only incremental updates, skip full bundle |
-| **--delta** | <code>boolean</code> | Upload incremental/differential updates to reduce bandwidth |
-| **--delta-only** | <code>boolean</code> | Upload only delta updates without full bundle (useful for large apps) |
+| **--delta** | <code>boolean</code> | Upload delta updates (only changed files) for instant, super-fast updates instead of big zip downloads |
+| **--delta-only** | <code>boolean</code> | Upload only delta updates without full bundle for maximum speed (useful for large apps) |
+| **--no-delta** | <code>boolean</code> | Disable delta updates even if instant updates are enabled |
 | **--encrypted-checksum** | <code>string</code> | An encrypted checksum (signature). Used only when uploading an external bundle. |
 | **--auto-set-bundle** | <code>boolean</code> | Set the bundle in capacitor.config.json |
-| **--dry-upload** | <code>boolean</code> | Dry upload the bundle process, mean it will not upload the files but add the row in database (Used by Capgo for internal testing) |
+| **--dry-upload** | <code>boolean</code> | Dry upload the bundle process: add the row in database without uploading files or updating channels (Used by Capgo for internal testing) |
 | **--package-json** | <code>string</code> | Paths to package.json files for monorepos (comma-separated) |
 | **--node-modules** | <code>string</code> | Paths to node_modules directories for monorepos (comma-separated) |
 | **--encrypt-partial** | <code>boolean</code> | Encrypt delta update files (auto-enabled for updater > 6.14.4) |
@@ -210,7 +297,7 @@ npx @capgo/cli@latest bundle upload com.example.app --path ./dist --channel prod
 | **--self-assign** | <code>boolean</code> | Allow devices to auto-join this channel (updates channel setting) |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
 | **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
-| **--verbose** | <code>boolean</code> | Enable verbose output |
+| **--verbose** | <code>boolean</code> | Enable verbose output with detailed logging |
 
 ### <a id="bundle-compatibility"></a> 🧪 **Compatibility**
 
@@ -230,14 +317,39 @@ npx @capgo/cli@latest bundle compatibility com.example.app --channel production
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-a,** | <code>string</code> | API key to link to your account |
-| **-c,** | <code>string</code> | Channel to check the compatibility with |
+| **-a** | <code>string</code> | API key to link to your account |
+| **-c** | <code>string</code> | Channel to check the compatibility with |
 | **--text** | <code>boolean</code> | Output text instead of emojis |
 | **--package-json** | <code>string</code> | Paths to package.json files for monorepos (comma-separated) |
 | **--node-modules** | <code>string</code> | Paths to node_modules directories for monorepos (comma-separated) |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
 | **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
 
+### <a id="bundle-releaseType"></a> 🔹 **ReleaseType**
+
+```bash
+npx @capgo/cli@latest bundle releaseType
+```
+
+🧭 Print "native" or "OTA" based on compatibility with a channel's latest metadata.
+
+**Example:**
+
+```bash
+npx @capgo/cli@latest bundle releaseType com.example.app --channel production
+```
+
+**Options:**
+
+| Param          | Type          | Description          |
+| -------------- | ------------- | -------------------- |
+| **-a** | <code>string</code> | API key to link to your account |
+| **-c** | <code>string</code> | Channel to compare against |
+| **--package-json** | <code>string</code> | Paths to package.json files for monorepos (comma-separated) |
+| **--node-modules** | <code>string</code> | Paths to node_modules directories for monorepos (comma-separated) |
+| **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
+| **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
+
 ### <a id="bundle-delete"></a> 🗑️ **Delete**
 
 **Alias:** `d`
@@ -258,7 +370,7 @@ npx @capgo/cli@latest bundle delete BUNDLE_ID com.example.app
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-a,** | <code>string</code> | API key to link to your account |
+| **-a** | <code>string</code> | API key to link to your account |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
 | **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
 
@@ -282,7 +394,7 @@ npx @capgo/cli@latest bundle list com.example.app
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-a,** | <code>string</code> | API key to link to your account |
+| **-a** | <code>string</code> | API key to link to your account |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
 | **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
 
@@ -307,10 +419,10 @@ npx @capgo/cli@latest bundle cleanup com.example.app --bundle=1.0 --keep=3
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-b,** | <code>string</code> | Bundle version number of the app to delete |
-| **-a,** | <code>string</code> | API key to link to your account |
-| **-k,** | <code>string</code> | Number of versions to keep |
-| **-f,** | <code>string</code> | Force removal |
+| **-b** | <code>string</code> | Bundle version number of the app to delete |
+| **-a** | <code>string</code> | API key to link to your account |
+| **-k** | <code>string</code> | Number of versions to keep |
+| **-f** | <code>boolean</code> | Force removal |
 | **--ignore-channel** | <code>boolean</code> | Delete bundles even if linked to channels (WARNING: deletes channels too) |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
 | **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
@@ -336,7 +448,8 @@ npx @capgo/cli@latest bundle encrypt ./myapp.zip CHECKSUM
 | -------------- | ------------- | -------------------- |
 | **--key** | <code>string</code> | Custom path for private signing key |
 | **--key-data** | <code>string</code> | Private signing key |
-| **-j,** | <code>string</code> | Output in JSON |
+| **-j** | <code>boolean</code> | Output in JSON |
+| **--package-json** | <code>string</code> | Paths to package.json files for monorepos (comma-separated) |
 
 ### <a id="bundle-decrypt"></a> 🔓 **Decrypt**
 
@@ -360,6 +473,7 @@ npx @capgo/cli@latest bundle decrypt ./myapp_encrypted.zip CHECKSUM
 | **--key** | <code>string</code> | Custom path for private signing key |
 | **--key-data** | <code>string</code> | Private signing key |
 | **--checksum** | <code>string</code> | Checksum of the bundle, to verify the integrity of the bundle |
+| **--package-json** | <code>string</code> | Paths to package.json files for monorepos (comma-separated) |
 
 ### <a id="bundle-zip"></a> 🔹 **Zip**
 
@@ -380,10 +494,10 @@ npx @capgo/cli@latest bundle zip com.example.app --path ./dist
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-p,** | <code>string</code> | Path of the folder to upload, if not provided it will use the webDir set in capacitor.config |
-| **-b,** | <code>string</code> | Bundle version number to name the zip file |
-| **-n,** | <code>string</code> | Name of the zip file |
-| **-j,** | <code>string</code> | Output in JSON |
+| **-p** | <code>string</code> | Path of the folder to upload, if not provided it will use the webDir set in capacitor.config |
+| **-b** | <code>string</code> | Bundle version number to name the zip file |
+| **-n** | <code>string</code> | Name of the zip file |
+| **-j** | <code>boolean</code> | Output in JSON |
 | **--no-code-check** | <code>boolean</code> | Ignore checking if notifyAppReady() is called in source code and index present in root folder |
 | **--key-v2** | <code>boolean</code> | Use encryption v2 |
 | **--package-json** | <code>string</code> | Paths to package.json files for monorepos (comma-separated) |
@@ -414,9 +528,9 @@ npx @capgo/cli@latest app add com.example.app --name "My App" --icon ./icon.png
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-n,** | <code>string</code> | App name for display in Capgo Cloud |
-| **-i,** | <code>string</code> | App icon path for display in Capgo Cloud |
-| **-a,** | <code>string</code> | API key to link to your account |
+| **-n** | <code>string</code> | App name for display in Capgo Cloud |
+| **-i** | <code>string</code> | App icon path for display in Capgo Cloud |
+| **-a** | <code>string</code> | API key to link to your account |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
 | **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
 
@@ -438,7 +552,7 @@ npx @capgo/cli@latest app delete com.example.app
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-a,** | <code>string</code> | API key to link to your account |
+| **-a** | <code>string</code> | API key to link to your account |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
 | **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
 
@@ -462,7 +576,7 @@ npx @capgo/cli@latest app list
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-a,** | <code>string</code> | API key to link to your account |
+| **-a** | <code>string</code> | API key to link to your account |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
 | **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
 
@@ -485,8 +599,8 @@ npx @capgo/cli@latest app debug com.example.app --device DEVICE_ID
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-a,** | <code>string</code> | API key to link to your account |
-| **-d,** | <code>string</code> | The specific device ID to debug |
+| **-a** | <code>string</code> | API key to link to your account |
+| **-d** | <code>string</code> | The specific device ID to debug |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
 | **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
 
@@ -533,10 +647,11 @@ npx @capgo/cli@latest app set com.example.app --name "Updated App" --retention 3
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-n,** | <code>string</code> | App name for display in Capgo Cloud |
-| **-i,** | <code>string</code> | App icon path for display in Capgo Cloud |
-| **-a,** | <code>string</code> | API key to link to your account |
-| **-r,** | <code>string</code> | Days to keep old bundles (0 = infinite, default: 0) |
+| **-n** | <code>string</code> | App name for display in Capgo Cloud |
+| **-i** | <code>string</code> | App icon path for display in Capgo Cloud |
+| **-a** | <code>string</code> | API key to link to your account |
+| **-r** | <code>string</code> | Days to keep old bundles (0 = infinite, default: 0) |
+| **--expose-metadata** | <code>string</code> | Expose bundle metadata (link and comment) to the plugin (true/false, default: false) |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
 | **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
 
@@ -565,9 +680,9 @@ npx @capgo/cli@latest channel add production com.example.app --default
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-d,** | <code>string</code> | Set the channel as default |
+| **-d** | <code>boolean</code> | Set the channel as default |
 | **--self-assign** | <code>boolean</code> | Allow device to self-assign to this channel |
-| **-a,** | <code>string</code> | API key to link to your account |
+| **-a** | <code>string</code> | API key to link to your account |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
 | **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
 
@@ -591,7 +706,7 @@ npx @capgo/cli@latest channel delete production com.example.app
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-a,** | <code>string</code> | API key to link to your account |
+| **-a** | <code>string</code> | API key to link to your account |
 | **--delete-bundle** | <code>boolean</code> | Delete the bundle associated with the channel |
 | **--success-if-not-found** | <code>boolean</code> | Success if the channel is not found |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
@@ -617,7 +732,7 @@ npx @capgo/cli@latest channel list com.example.app
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-a,** | <code>string</code> | API key to link to your account |
+| **-a** | <code>string</code> | API key to link to your account |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
 | **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
 
@@ -639,8 +754,8 @@ npx @capgo/cli@latest channel currentBundle production com.example.app
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-c,** | <code>string</code> | Channel to get the current bundle from |
-| **-a,** | <code>string</code> | API key to link to your account |
+| **-c** | <code>string</code> | Channel to get the current bundle from |
+| **-a** | <code>string</code> | API key to link to your account |
 | **--quiet** | <code>boolean</code> | Only print the bundle version |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
 | **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
@@ -653,7 +768,7 @@ npx @capgo/cli@latest channel currentBundle production com.example.app
 npx @capgo/cli@latest channel set
 ```
 
-⚙️ Configure settings for a channel, such as linking a bundle, setting update strategies (major, minor, metadata, patch, none), or device targeting (iOS, Android, dev, emulator).
+⚙️ Configure settings for a channel, such as linking a bundle, setting update strategies (major, minor, metadata, patch, none), or device targeting (iOS, Android, dev, prod, emulator, device).
 One channel must be default.
 
 **Example:**
@@ -666,9 +781,9 @@ npx @capgo/cli@latest channel set production com.example.app --bundle 1.0.0 --st
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-a,** | <code>string</code> | API key to link to your account |
-| **-b,** | <code>string</code> | Bundle version number of the file to set |
-| **-s,** | <code>string</code> | Set the state of the channel, default or normal |
+| **-a** | <code>string</code> | API key to link to your account |
+| **-b** | <code>string</code> | Bundle version number of the file to set |
+| **-s** | <code>string</code> | Set the state of the channel, default or normal |
 | **--latest-remote** | <code>boolean</code> | Get the latest bundle uploaded in capgo cloud and set it to the channel |
 | **--latest** | <code>boolean</code> | Get the latest version key in the package.json to set it to the channel |
 | **--downgrade** | <code>boolean</code> | Allow to downgrade to version under native one |
@@ -682,8 +797,12 @@ npx @capgo/cli@latest channel set production com.example.app --bundle 1.0.0 --st
 | **--disable-auto-update** | <code>string</code> | Block updates by type: major, minor, metadata, patch, or none (allows all) |
 | **--dev** | <code>boolean</code> | Allow sending update to development devices |
 | **--no-dev** | <code>boolean</code> | Disable sending update to development devices |
+| **--prod** | <code>boolean</code> | Allow sending update to production devices |
+| **--no-prod** | <code>boolean</code> | Disable sending update to production devices |
 | **--emulator** | <code>boolean</code> | Allow sending update to emulator devices |
 | **--no-emulator** | <code>boolean</code> | Disable sending update to emulator devices |
+| **--device** | <code>boolean</code> | Allow sending update to physical devices |
+| **--no-device** | <code>boolean</code> | Disable sending update to physical devices |
 | **--package-json** | <code>string</code> | Paths to package.json files for monorepos (comma-separated) |
 | **--ignore-metadata-check** | <code>boolean</code> | Ignore checking node_modules compatibility if present in the bundle |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
@@ -713,7 +832,7 @@ npx @capgo/cli@latest key save --key ./path/to/key.pub
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-f,** | <code>string</code> | Force generate a new one |
+| **-f** | <code>boolean</code> | Force generate a new one |
 | **--key** | <code>string</code> | Key path to save in Capacitor config |
 | **--key-data** | <code>string</code> | Key data to save in Capacitor config |
 
@@ -738,7 +857,7 @@ npx @capgo/cli@latest key create
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-f,** | <code>string</code> | Force generate a new one |
+| **-f** | <code>boolean</code> | Force generate a new one |
 
 ### <a id="key-delete_old"></a> 🗑️ **Delete_old**
 
@@ -777,19 +896,19 @@ npx @capgo/cli@latest account id
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-a,** | <code>string</code> | API key to link to your account |
+| **-a** | <code>string</code> | API key to link to your account |
 
 
-## <a id="organisation"></a> 🔹 **Organisation**
+## <a id="organization"></a> 🔹 **Organization**
 
 🏢 Manage your organizations in Capgo Cloud for team collaboration and app management.
 
-### <a id="organisation-list"></a> 📋 **List**
+### <a id="organization-list"></a> 📋 **List**
 
 **Alias:** `l`
 
 ```bash
-npx @capgo/cli@latest organisation list
+npx @capgo/cli@latest organization list
 ```
 
 📋 List all organizations you have access to in Capgo Cloud.
@@ -797,23 +916,23 @@ npx @capgo/cli@latest organisation list
 **Example:**
 
 ```bash
-npx @capgo/cli@latest organisation list
+npx @capgo/cli@latest organization list
 ```
 
 **Options:**
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-a,** | <code>string</code> | API key to link to your account |
+| **-a** | <code>string</code> | API key to link to your account |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
 | **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
 
-### <a id="organisation-add"></a> ➕ **Add**
+### <a id="organization-add"></a> ➕ **Add**
 
 **Alias:** `a`
 
 ```bash
-npx @capgo/cli@latest organisation add
+npx @capgo/cli@latest organization add
 ```
 
 ➕ Create a new organization in Capgo Cloud for team collaboration.
@@ -821,51 +940,96 @@ npx @capgo/cli@latest organisation add
 **Example:**
 
 ```bash
-npx @capgo/cli@latest organisation add --name "My Company" --email admin@mycompany.com
+npx @capgo/cli@latest organization add --name "My Company" --email admin@mycompany.com
 ```
 
 **Options:**
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-n,** | <code>string</code> | Organization name |
-| **-e,** | <code>string</code> | Management email for the organization |
-| **-a,** | <code>string</code> | API key to link to your account |
+| **-n** | <code>string</code> | Organization name |
+| **-e** | <code>string</code> | Management email for the organization |
+| **-a** | <code>string</code> | API key to link to your account |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
 | **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
 
-### <a id="organisation-set"></a> ⚙️ **Set**
+### <a id="organization-members"></a> 🔹 **Members**
+
+**Alias:** `m`
+
+```bash
+npx @capgo/cli@latest organization members
+```
+
+👥 List organization members and their 2FA status.
+Shows all members of an organization with their roles and whether they have 2FA enabled.
+Useful before enabling 2FA enforcement to see which members will be affected.
+> ℹ️ Viewing 2FA status requires super_admin rights in the organization.
+
+
+**Example:**
+
+```bash
+npx @capgo/cli@latest organization members ORG_ID
+```
+
+**Options:**
+
+| Param          | Type          | Description          |
+| -------------- | ------------- | -------------------- |
+| **-a** | <code>string</code> | API key to link to your account |
+| **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
+| **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
+
+### <a id="organization-set"></a> ⚙️ **Set**
 
 **Alias:** `s`
 
 ```bash
-npx @capgo/cli@latest organisation set
+npx @capgo/cli@latest organization set
 ```
 
-⚙️ Update organization settings such as name and management email.
+⚙️ Update organization settings including name, email, security policies, and enforcement options.
+Security settings require super_admin role.
 
 **Example:**
 
 ```bash
-npx @capgo/cli@latest organisation set ORG_ID --name "Updated Company Name"
+npx @capgo/cli@latest organization set ORG_ID --name "New Name"
 ```
 
 **Options:**
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-n,** | <code>string</code> | Organization name |
-| **-e,** | <code>string</code> | Management email for the organization |
-| **-a,** | <code>string</code> | API key to link to your account |
+| **-n** | <code>string</code> | Organization name |
+| **-e** | <code>string</code> | Management email for the organization |
+| **--enforce-2fa** | <code>boolean</code> | Enable 2FA enforcement for all organization members |
+| **--no-enforce-2fa** | <code>boolean</code> | Disable 2FA enforcement for organization |
+| **--password-policy** | <code>boolean</code> | Enable password policy enforcement for organization |
+| **--no-password-policy** | <code>boolean</code> | Disable password policy enforcement |
+| **--min-length** | <code>string</code> | Minimum password length (6-128, default: 10) |
+| **--require-uppercase** | <code>boolean</code> | Require uppercase letter in password |
+| **--no-require-uppercase** | <code>boolean</code> | Do not require uppercase letter |
+| **--require-number** | <code>boolean</code> | Require number in password |
+| **--no-require-number** | <code>boolean</code> | Do not require number |
+| **--require-special** | <code>boolean</code> | Require special character in password |
+| **--no-require-special** | <code>boolean</code> | Do not require special character |
+| **--require-apikey-expiration** | <code>boolean</code> | Require all API keys to have an expiration date |
+| **--no-require-apikey-expiration** | <code>boolean</code> | Do not require API key expiration |
+| **--max-apikey-expiration-days** | <code>string</code> | Maximum days before API key expiration (1-365, null for no limit) |
+| **--enforce-hashed-api-keys** | <code>boolean</code> | Enforce hashed/secure API keys (key value stored as hash, shown only once) |
+| **--no-enforce-hashed-api-keys** | <code>boolean</code> | Allow plain-text API keys |
+| **-a** | <code>string</code> | API key to link to your account |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
 | **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
 
-### <a id="organisation-delete"></a> 🗑️ **Delete**
+### <a id="organization-delete"></a> 🗑️ **Delete**
 
 **Alias:** `d`
 
 ```bash
-npx @capgo/cli@latest organisation delete
+npx @capgo/cli@latest organization delete
 ```
 
 🗑️ Delete an organization from Capgo Cloud. This action cannot be undone.
@@ -874,46 +1038,531 @@ Only organization owners can delete organizations.
 **Example:**
 
 ```bash
-npx @capgo/cli@latest organisation delete ORG_ID
+npx @capgo/cli@latest organization delete ORG_ID
+```
+
+**Options:**
+
+| Param          | Type          | Description          |
+| -------------- | ------------- | -------------------- |
+| **-a** | <code>string</code> | API key to link to your account |
+| **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
+| **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
+
+
+## <a id="organisation"></a> 🔹 **Organisation**
+
+[DEPRECATED] Use "organization" instead. This command will be removed in a future version.
+
+### <a id="organisation-list"></a> 📋 **List**
+
+**Alias:** `l`
+
+```bash
+npx @capgo/cli@latest organisation list
+```
+
+[DEPRECATED] Use "organization list" instead.
+
+**Options:**
+
+| Param          | Type          | Description          |
+| -------------- | ------------- | -------------------- |
+| **-a** | <code>string</code> | API key to link to your account |
+| **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
+| **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
+
+### <a id="organisation-add"></a> ➕ **Add**
+
+**Alias:** `a`
+
+```bash
+npx @capgo/cli@latest organisation add
+```
+
+[DEPRECATED] Use "organization add" instead.
+
+**Options:**
+
+| Param          | Type          | Description          |
+| -------------- | ------------- | -------------------- |
+| **-n** | <code>string</code> | Organization name |
+| **-e** | <code>string</code> | Management email for the organization |
+| **-a** | <code>string</code> | API key to link to your account |
+| **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
+| **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
+
+### <a id="organisation-set"></a> ⚙️ **Set**
+
+**Alias:** `s`
+
+```bash
+npx @capgo/cli@latest organisation set
+```
+
+[DEPRECATED] Use "organization set" instead.
+
+**Options:**
+
+| Param          | Type          | Description          |
+| -------------- | ------------- | -------------------- |
+| **-n** | <code>string</code> | Organization name |
+| **-e** | <code>string</code> | Management email for the organization |
+| **--enforce-2fa** | <code>boolean</code> | Enable 2FA enforcement for all organization members |
+| **--no-enforce-2fa** | <code>boolean</code> | Disable 2FA enforcement for organization |
+| **--password-policy** | <code>boolean</code> | Enable password policy enforcement for organization |
+| **--no-password-policy** | <code>boolean</code> | Disable password policy enforcement |
+| **--min-length** | <code>string</code> | Minimum password length (6-128, default: 10) |
+| **--require-uppercase** | <code>boolean</code> | Require uppercase letter in password |
+| **--no-require-uppercase** | <code>boolean</code> | Do not require uppercase letter |
+| **--require-number** | <code>boolean</code> | Require number in password |
+| **--no-require-number** | <code>boolean</code> | Do not require number |
+| **--require-special** | <code>boolean</code> | Require special character in password |
+| **--no-require-special** | <code>boolean</code> | Do not require special character |
+| **--require-apikey-expiration** | <code>boolean</code> | Require all API keys to have an expiration date |
+| **--no-require-apikey-expiration** | <code>boolean</code> | Do not require API key expiration |
+| **--max-apikey-expiration-days** | <code>string</code> | Maximum days before API key expiration (1-365, null for no limit) |
+| **--enforce-hashed-api-keys** | <code>boolean</code> | Enforce hashed/secure API keys (key value stored as hash, shown only once) |
+| **--no-enforce-hashed-api-keys** | <code>boolean</code> | Allow plain-text API keys |
+| **-a** | <code>string</code> | API key to link to your account |
+| **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
+| **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
+
+### <a id="organisation-delete"></a> 🗑️ **Delete**
+
+**Alias:** `d`
+
+```bash
+npx @capgo/cli@latest organisation delete
 ```
 
+[DEPRECATED] Use "organization delete" instead.
+
 **Options:**
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
-| **-a,** | <code>string</code> | API key to link to your account |
+| **-a** | <code>string</code> | API key to link to your account |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
 | **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
 
 
 ## <a id="build"></a> 🔹 **Build**
 
+🏗️  Manage native iOS/Android builds through Capgo Cloud.
+⚠️ Native cloud build requests are currently in LIMITED BETA. Access is restricted.
+ 🔒 SECURITY GUARANTEE:
+    Build credentials are NEVER stored on Capgo servers.
+    They are used only during the build and auto-deleted after.
+    Build outputs may optionally be uploaded for time-limited download links.
+📋 BEFORE BUILDING:
+   Save your credentials first:
+   npx @capgo/cli build credentials save --appId <your-app-id> --platform ios
+   npx @capgo/cli build credentials save --appId <your-app-id> --platform android
+📤 CAPTURE THE OUTPUT URL FROM CI:
+   Pass --output-record to persist the download URL + QR code, then read it
+   back with `build last-output`:
+   npx @capgo/cli build request <appId> --platform android --output-upload --output-record /tmp/build.json
+   URL=$(npx @capgo/cli build last-output --path /tmp/build.json --field outputUrl)
+
+### <a id="build-needed"></a> 🔹 **Needed**
+
+```bash
+npx @capgo/cli@latest build needed
+```
+
+🧭 Print "yes" and exit with code 1 if a native build is required; otherwise print "no" and exit with code 0. Command failures exit with code 2.
+
+**Example:**
+
+```bash
+npx @capgo/cli@latest build needed com.example.app --channel production --verbose
+```
+
+**Options:**
+
+| Param          | Type          | Description          |
+| -------------- | ------------- | -------------------- |
+| **-a** | <code>string</code> | API key to link to your account |
+| **-c** | <code>string</code> | Channel to compare against. Defaults to CapacitorUpdater.defaultChannel or the public default channel |
+| **--package-json** | <code>string</code> | Paths to package.json files for monorepos (comma-separated) |
+| **--node-modules** | <code>string</code> | Paths to node_modules directories for monorepos (comma-separated) |
+| **--verbose** | <code>boolean</code> | Enable verbose output with detailed logging |
+| **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
+| **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
+
+### <a id="build-init"></a> 🚀 **Init**
+
+**Alias:** `onboarding`
+
+```bash
+npx @capgo/cli@latest build init
+```
+
+Set up build credentials interactively (iOS: certificates + profiles automated; Android: keystore + Google OAuth provisions GCP service account and Play Console invite)
+
+**Options:**
+
+| Param          | Type          | Description          |
+| -------------- | ------------- | -------------------- |
+| **-a** | <code>string</code> | API key to link to your account |
+| **-p** | <code>string</code> | Platform to onboard (ios or android). If omitted, auto-detects when only one native folder exists; prompts otherwise. |
+| **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
+
+### <a id="build-request"></a> 🔹 **Request**
+
 ```bash
-npx @capgo/cli@latest build
+npx @capgo/cli@latest build request
 ```
 
-🏗️  Request a native iOS/Android build from Capgo Cloud.
-⚠️ This feature is currently in PRIVATE BETA and cannot be used by anyone at this time.
+Request a native build from Capgo Cloud.
 This command will zip your project directory and upload it to Capgo for building.
-The build will be processed in the cloud and artifacts will be available when complete.
+The build will be processed and sent directly to app stores.
+ 🔒 SECURITY: Credentials are never stored on Capgo servers. They are auto-deleted
+    after build completion. Build outputs may optionally be uploaded for time-limited download links.
+📋 PREREQUISITE: Save credentials first with:
+   `npx @capgo/cli build credentials save --appId <app-id> --platform <ios|android>`
 
 **Example:**
 
 ```bash
-npx @capgo/cli@latest build com.example.app --platform ios --path .
+npx @capgo/cli@latest build request com.example.app --platform ios --path .
 ```
 
-## <a id="options"></a> Options
+**Options:**
 
 | Param          | Type          | Description          |
 | -------------- | ------------- | -------------------- |
 | **--path** | <code>string</code> | Path to the project directory to build (default: current directory) |
-| **--platform** | <code>string</code> | Target platform: ios, android, or both (default: both) |
+| **--node-modules** | <code>string</code> | Paths to node_modules directories for monorepos (comma-separated) |
+| **--platform** | <code>string</code> | Target platform: ios or android (required) |
 | **--build-mode** | <code>string</code> | Build mode: debug or release (default: release) |
-| **--build-config** | <code>string</code> | Additional build configuration as JSON string |
-| **-a,** | <code>string</code> | API key to link to your account |
+| **--build-certificate-base64** | <code>string</code> | iOS: Base64-encoded .p12 certificate |
+| **--p12-password** | <code>string</code> | iOS: Certificate password (optional if cert has no password) |
+| **--apple-id** | <code>string</code> | iOS: Apple ID email |
+| **--apple-app-specific-password** | <code>string</code> | iOS: App-specific password |
+| **--apple-key-id** | <code>string</code> | iOS: App Store Connect API Key ID |
+| **--apple-issuer-id** | <code>string</code> | iOS: App Store Connect Issuer ID |
+| **--apple-key-content** | <code>string</code> | iOS: Base64-encoded App Store Connect API key (.p8) |
+| **--app-store-connect-team-id** | <code>string</code> | iOS: App Store Connect Team ID |
+| **--ios-scheme** | <code>string</code> | iOS: Xcode scheme to build (default: App) |
+| **--ios-target** | <code>string</code> | iOS: Xcode target for reading build settings (default: same as scheme) |
+| **--ios-distribution** | <code>string</code> | iOS: Distribution mode |
+| **--ios-provisioning-profile** | <code>string</code> | iOS: Provisioning profile path or bundleId=path mapping (repeatable) |
+| **--android-keystore-file** | <code>string</code> | Android: Base64-encoded keystore file |
+| **--keystore-key-alias** | <code>string</code> | Android: Keystore key alias |
+| **--keystore-key-password** | <code>string</code> | Android: Keystore key password |
+| **--keystore-store-password** | <code>string</code> | Android: Keystore store password |
+| **--play-config-json** | <code>string</code> | Android: Base64-encoded Google Play service account JSON |
+| **--android-flavor** | <code>string</code> | Android: Product flavor to build (e.g. production). Required if your project has multiple flavors. |
+| **--in-app-update-priority** | <code>string</code> | Android: Google Play in-app update priority for this release (integer 0–5; higher = more urgent). See https://developer.android.com/guide/playcore/in-app-updates. Precedence: CLI > env > saved credentials |
+| **--no-playstore-upload** | <code>boolean</code> | Skip Play Store upload for this build (nulls out saved play config). Requires --output-upload. |
+| **--output-upload** | <code>boolean</code> | Override output upload behavior for this build only (enable). Precedence: CLI > env > saved credentials |
+| **--no-output-upload** | <code>boolean</code> | Override output upload behavior for this build only (disable). Precedence: CLI > env > saved credentials |
+| **--output-retention** | <code>string</code> | Override output link TTL for this build only (1h to 7d). Examples: 1h, 6h, 2d. Precedence: CLI > env > saved credentials |
+| **--output-record** | <code>string</code> | After a successful build, write a JSON record (jobId, status, outputUrl, qrCodeAscii, qrCodePngPath, finishedAt) to <path>. A PNG QR code is also written next to it as <path>.qr.png. Read fields back with `build last-output`. |
+| **--skip-build-number-bump** | <code>boolean</code> | Skip automatic build number/version code incrementing. Uses whatever version is already in the project files. |
+| **--no-skip-build-number-bump** | <code>boolean</code> | Override saved credentials to re-enable automatic build number incrementing for this build only. |
+| **--ai-analytics** | <code>boolean</code> | On build failure, send logs to Capgo AI for diagnosis. In interactive terminals this skips the upfront confirmation; in CI this auto-uploads and prints the analysis to stderr. |
+| **-a** | <code>string</code> | API key to link to your account |
 | **--supa-host** | <code>string</code> | Custom Supabase host URL (for self-hosting or Capgo development) |
 | **--supa-anon** | <code>string</code> | Custom Supabase anon key (for self-hosting) |
+| **--verbose** | <code>boolean</code> | Enable verbose output with detailed logging |
+
+### <a id="build-last-output"></a> 🔹 **Last-output**
+
+```bash
+npx @capgo/cli@latest build last-output
+```
+
+Read the build output record written by a previous `build request --output-record`.
+Prints the full JSON by default, a single field with --field, or the ASCII QR
+code with --qr. Useful in CI to grab the download URL or QR for posting back
+to a PR or issue.
+Examples:
+  npx @capgo/cli build last-output --path /tmp/build.json
+  npx @capgo/cli build last-output --path /tmp/build.json --field outputUrl
+  npx @capgo/cli build last-output --path /tmp/build.json --qr
+
+**Options:**
+
+| Param          | Type          | Description          |
+| -------------- | ------------- | -------------------- |
+| **--path** | <code>string</code> | Path to the JSON record written by --output-record (required) |
+| **--field** | <code>string</code> | Print a single field (one of: jobId, appId, platform, buildMode, status, outputUrl, qrCodeAscii, qrCodePngPath, finishedAt, schemaVersion) |
+| **--qr** | <code>boolean</code> | Print the rendered ASCII QR code (shortcut for --field qrCodeAscii) |
+
+### <a id="build-credentials"></a> 🔹 **Credentials**
+
+Manage build credentials stored locally on your machine.
+🔒 SECURITY:
+   - Credentials saved to ~/.capgo-credentials/credentials.json (global) or .capgo-credentials.json (local)
+   - When building, sent to Capgo but NEVER stored permanently
+   - Deleted from Capgo immediately after build
+   - Build outputs may optionally be uploaded for time-limited download links
+📚 DOCUMENTATION:
+   iOS setup: https://capgo.app/docs/cli/cloud-build/ios/
+   Android setup: https://capgo.app/docs/cli/cloud-build/android/
+
+#### <a id="build-credentials-save"></a> 🔹 **Save**
+
+```bash
+npx @capgo/cli@latest build credentials save
+```
+
+Save build credentials locally for iOS or Android.
+Credentials are stored in:
+  - ~/.capgo-credentials/credentials.json (default, global)
+  - .capgo-credentials.json in project root (with --local flag)
+⚠️  REQUIRED BEFORE BUILDING: You must save credentials before requesting a build.
+🔒 These credentials are NEVER stored on Capgo servers permanently.
+   They are deleted immediately after the build completes.
+📚 Setup guides:
+   iOS: https://capgo.app/docs/cli/cloud-build/ios/
+   Android: https://capgo.app/docs/cli/cloud-build/android/
+  npx @capgo/cli build credentials save --platform ios \
+    --certificate ./cert.p12 --p12-password "password" \
+    --ios-provisioning-profile ./profile.mobileprovision \
+    --apple-key ./AuthKey.p8 --apple-key-id "KEY123" \
+    --apple-issuer-id "issuer-uuid" --apple-team-id "team-id"
+Multi-target Example (app + widget extension):
+  npx @capgo/cli build credentials save --platform ios \
+    --ios-provisioning-profile ./App.mobileprovision \
+    --ios-provisioning-profile com.example.widget=./Widget.mobileprovision \
+    ...
+  npx @capgo/cli build credentials save --platform android \
+    --keystore ./release.keystore --keystore-alias "my-key" \
+    --keystore-key-password "key-pass" \
+    --play-config ./service-account.json
+Local storage (per-project):
+  npx @capgo/cli build credentials save --local --platform ios ...
+
+**Example:**
+
+```bash
+iOS Example:
+```
+
+**Options:**
+
+| Param          | Type          | Description          |
+| -------------- | ------------- | -------------------- |
+| **--appId** | <code>string</code> | App ID (e.g., com.example.app) (required) |
+| **--platform** | <code>string</code> | Platform: ios or android (required) |
+| **--certificate** | <code>string</code> | iOS: Path to .p12 certificate file |
+| **--ios-provisioning-profile** | <code>string</code> | iOS: Provisioning profile path or bundleId=path (repeatable) |
+| **--p12-password** | <code>string</code> | iOS: Certificate password (optional if cert has no password) |
+| **--apple-key** | <code>string</code> | iOS: Path to .p8 App Store Connect API key |
+| **--apple-key-id** | <code>string</code> | iOS: App Store Connect API Key ID |
+| **--apple-issuer-id** | <code>string</code> | iOS: App Store Connect Issuer ID |
+| **--apple-team-id** | <code>string</code> | iOS: App Store Connect Team ID |
+| **--ios-distribution** | <code>string</code> | iOS: Distribution mode |
+| **--apple-id** | <code>string</code> | iOS: Apple ID email (optional) |
+| **--apple-app-password** | <code>string</code> | iOS: App-specific password (optional) |
+| **--keystore** | <code>string</code> | Android: Path to keystore file (.keystore or .jks) |
+| **--keystore-alias** | <code>string</code> | Android: Keystore key alias |
+| **--keystore-key-password** | <code>string</code> | Android: Keystore key password |
+| **--keystore-store-password** | <code>string</code> | Android: Keystore store password |
+| **--play-config** | <code>string</code> | Android: Path to Play Store service account JSON |
+| **--android-flavor** | <code>string</code> | Android: Product flavor to build (e.g. production). Required if your project has multiple flavors. |
+| **--in-app-update-priority** | <code>string</code> | Android: Google Play in-app update priority for future releases (integer 0–5; higher = more urgent). Omit to leave Play’s existing value untouched. |
+| **--local** | <code>boolean</code> | Save to .capgo-credentials.json in project root instead of global ~/.capgo-credentials/ |
+| **--output-upload** | <code>boolean</code> | Upload build outputs (IPA/APK/AAB) to Capgo storage and print download links |
+| **--no-output-upload** | <code>boolean</code> | Do not upload build outputs (IPA/APK/AAB) to Capgo storage |
+| **--output-retention** | <code>string</code> | Output link TTL: 1h to 7d (default: 1h). Examples: 1h, 6h, 2d |
+| **--skip-build-number-bump** | <code>boolean</code> | Skip automatic build number/version code incrementing on future builds |
+| **--no-skip-build-number-bump** | <code>boolean</code> | Re-enable automatic build number incrementing (default behavior) |
+
+#### <a id="build-credentials-list"></a> 📋 **List**
+
+```bash
+npx @capgo/cli@latest build credentials list
+```
+
+List saved build credentials (passwords masked).
+Shows what credentials are currently saved (both global and local).
+Examples:
+  npx @capgo/cli build credentials list  # List all apps
+  npx @capgo/cli build credentials list --appId com.example.app  # List specific app
+
+**Options:**
+
+| Param          | Type          | Description          |
+| -------------- | ------------- | -------------------- |
+| **--appId** | <code>string</code> | App ID to list (optional, lists all if omitted) |
+| **--local** | <code>boolean</code> | List credentials from local .capgo-credentials.json only |
+
+#### <a id="build-credentials-clear"></a> 🔹 **Clear**
+
+```bash
+npx @capgo/cli@latest build credentials clear
+```
+
+Clear saved build credentials.
+Remove credentials from storage.
+Use --appId and --platform to target specific credentials.
+Examples:
+  npx @capgo/cli build credentials clear  # Clear all apps (global)
+  npx @capgo/cli build credentials clear --local  # Clear local credentials
+  npx @capgo/cli build credentials clear --appId com.example.app --platform ios
+
+**Options:**
+
+| Param          | Type          | Description          |
+| -------------- | ------------- | -------------------- |
+| **--appId** | <code>string</code> | App ID to clear (optional, clears all apps if omitted) |
+| **--platform** | <code>string</code> | Platform to clear: ios or android (optional, clears all platforms if omitted) |
+| **--local** | <code>boolean</code> | Clear from local .capgo-credentials.json instead of global |
+
+#### <a id="build-credentials-update"></a> 🔹 **Update**
+
+```bash
+npx @capgo/cli@latest build credentials update
+```
+
+Update specific credentials without providing all of them again.
+Update existing credentials by providing only the fields you want to change.
+Platform is auto-detected from the options you provide.
+Examples:
+  npx @capgo/cli build credentials update --ios-provisioning-profile ./new-profile.mobileprovision
+  npx @capgo/cli build credentials update --local --keystore ./new-keystore.jks
+
+**Options:**
+
+| Param          | Type          | Description          |
+| -------------- | ------------- | -------------------- |
+| **--appId** | <code>string</code> | App ID (auto-detected from capacitor.config if omitted) |
+| **--platform** | <code>string</code> | Platform: ios or android (auto-detected from options) |
+| **--local** | <code>boolean</code> | Update local .capgo-credentials.json instead of global |
+| **--certificate** | <code>string</code> | Path to P12 certificate file |
+| **--ios-provisioning-profile** | <code>string</code> | Provisioning profile path or bundleId=path (repeatable, additive by default) |
+| **--overwrite-ios-provisioning-map** | <code>boolean</code> | Replace the entire provisioning map instead of merging (default: merge) |
+| **--p12-password** | <code>string</code> | P12 certificate password |
+| **--apple-key** | <code>string</code> | Path to App Store Connect API key (.p8 file) |
+| **--apple-key-id** | <code>string</code> | App Store Connect API Key ID |
+| **--apple-issuer-id** | <code>string</code> | App Store Connect Issuer ID |
+| **--apple-team-id** | <code>string</code> | App Store Connect Team ID |
+| **--ios-distribution** | <code>string</code> | iOS: Distribution mode |
+| **--keystore** | <code>string</code> | Path to keystore file (.keystore or .jks) |
+| **--keystore-alias** | <code>string</code> | Keystore key alias |
+| **--keystore-key-password** | <code>string</code> | Keystore key password |
+| **--keystore-store-password** | <code>string</code> | Keystore store password |
+| **--play-config** | <code>string</code> | Path to Google Play service account JSON |
+| **--android-flavor** | <code>string</code> | Android: Product flavor to build (e.g. production). Required if your project has multiple flavors. |
+| **--in-app-update-priority** | <code>string</code> | Android: Google Play in-app update priority for future releases (integer 0–5; higher = more urgent). |
+| **--output-upload** | <code>boolean</code> | Upload build outputs (IPA/APK/AAB) to Capgo storage and print download links |
+| **--no-output-upload** | <code>boolean</code> | Do not upload build outputs (IPA/APK/AAB) to Capgo storage |
+| **--output-retention** | <code>string</code> | Output link TTL: 1h to 7d. Examples: 1h, 6h, 2d |
+| **--skip-build-number-bump** | <code>boolean</code> | Skip automatic build number/version code incrementing on future builds |
+| **--no-skip-build-number-bump** | <code>boolean</code> | Re-enable automatic build number incrementing (default behavior) |
+
+#### <a id="build-credentials-manage"></a> 🔹 **Manage**
+
+```bash
+npx @capgo/cli@latest build credentials manage
+```
+
+Interactively manage saved build credentials.
+Browse stored credentials, view what's configured, export a CI/CD-ready .env file,
+or delete a platform's credentials. Reuses the same TUI as `capgo init`.
+Examples:
+  npx @capgo/cli build credentials manage
+  npx @capgo/cli build credentials manage --appId com.example.app
+  npx @capgo/cli build credentials manage --appId com.example.app --platform ios
+  npx @capgo/cli build credentials manage --local
+
+**Options:**
+
+| Param          | Type          | Description          |
+| -------------- | ------------- | -------------------- |
+| **--appId** | <code>string</code> | App ID to manage (optional, prompts to pick if omitted) |
+| **--platform** | <code>string</code> | Platform to manage: ios or android (optional, prompts to pick if omitted) |
+| **--local** | <code>boolean</code> | Only browse local .capgo-credentials.json |
+
+#### <a id="build-credentials-migrate"></a> 🔹 **Migrate**
+
+```bash
+npx @capgo/cli@latest build credentials migrate
+```
+
+Migrate legacy provisioning profile to the new multi-target format.
+Converts BUILD_PROVISION_PROFILE_BASE64 to CAPGO_IOS_PROVISIONING_MAP.
+Discovers the main bundle ID from your Xcode project automatically.
+  npx @capgo/cli build credentials migrate --platform ios
+
+**Example:**
+
+```bash
+Example:
+```
+
+**Options:**
+
+| Param          | Type          | Description          |
+| -------------- | ------------- | -------------------- |
+| **--appId** | <code>string</code> | App ID (auto-detected from capacitor.config if omitted) |
+| **--platform** | <code>string</code> | Platform (only ios is supported) |
+| **--local** | <code>boolean</code> | Migrate from local .capgo-credentials.json instead of global |
+
+
+## <a id="probe"></a> 🔹 **Probe**
+
+```bash
+npx @capgo/cli@latest probe
+```
+
+🔎 Probe the Capgo updates endpoint to check if an update is available for your app.
+Sends a single request to the updates endpoint using your project's capacitor config
+and reports whether an update would be delivered, or explains why not.
+
+**Example:**
+
+```bash
+npx @capgo/cli@latest probe --platform ios
+```
+
+## <a id="options-probe"></a> Options (Probe)
+
+| Param          | Type          | Description          |
+| -------------- | ------------- | -------------------- |
+| **--platform** | <code>string</code> | Platform to probe: ios or android |
+
+
+## <a id="mcp"></a> 🔹 **Mcp**
+
+```bash
+npx @capgo/cli@latest mcp
+```
+
+🤖 Start the Capgo MCP (Model Context Protocol) server for AI agent integration.
+This command starts an MCP server that exposes Capgo functionality as tools for AI agents.
+The server communicates via stdio and is designed for non-interactive, programmatic use.
+Available tools exposed via MCP:
+  - capgo_list_apps, capgo_add_app, capgo_update_app, capgo_delete_app
+  - capgo_upload_bundle, capgo_list_bundles, capgo_delete_bundle, capgo_cleanup_bundles
+  - capgo_list_channels, capgo_add_channel, capgo_update_channel, capgo_delete_channel
+  - capgo_get_current_bundle, capgo_check_compatibility
+  - capgo_list_organizations, capgo_add_organization
+  - capgo_star_repository
+  - capgo_star_all_repositories
+  - capgo_get_account_id, capgo_doctor, capgo_get_stats
+  - capgo_request_build, capgo_generate_encryption_keys
+Example usage with Claude Desktop:
+  Add to claude_desktop_config.json:
+  {
+    "mcpServers": {
+      "capgo": {
+        "command": "npx",
+        "args": ["@capgo/cli", "mcp"]
+      }
+    }
+  }
+
+**Example:**
+
+```bash
+npx @capgo/cli mcp
+```