@mondaydotcomorg/z2h-cli 0.15.2 → 0.16.0

package/src/commands/__tests__/deploy.test.ts

@@ -0,0 +1,215 @@
+import path from 'node:path';
+import os from 'node:os';
+import { mkdtemp, rm, ensureDir, writeJson } from 'fs-extra';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { deployCommand } from '../deploy';
+import { buildPreviewSlug } from '../../util/app-name';
+import { setOutputMode } from '../../util/logger';
+import { buildCommand } from '../build';
+import { uploadDir } from '../../util/s3/upload';
+import { setupS3Client } from '../../util/s3/client';
+import { openInBrowser } from '../../util/open-browser';
+import * as brokerProvider from '../../util/auth/broker-credential-provider';
+import * as brokerApp from '../../util/broker/app';
+import * as authStore from '../../util/auth/auth-store';
+import * as gitRepo from '../../util/git/repo';
+
+vi.mock('../build', () => ({
+  buildCommand: vi.fn(),
+}));
+
+vi.mock('../../util/s3/upload', () => ({
+  uploadDir: vi.fn().mockResolvedValue([]),
+}));
+
+vi.mock('../../util/s3/client', () => ({
+  setupS3Client: vi.fn(),
+}));
+
+vi.mock('../../util/open-browser', () => ({
+  openInBrowser: vi.fn().mockResolvedValue(undefined),
+}));
+
+const FAKE_CREDS = { accessKeyId: 'AKID', secretAccessKey: 'SECRET', sessionToken: 'TOKEN' };
+
+vi.mock('../../util/auth/broker-credential-provider', () => ({
+  brokerCredentialProvider: vi.fn(() => vi.fn().mockResolvedValue(FAKE_CREDS)),
+  fetchDeployVersion: vi.fn(),
+}));
+
+vi.mock('../../util/broker/app', () => ({
+  registerOrUpdateApp: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock('../../util/git/repo', () => ({
+  getRemoteUrl: vi.fn(),
+  guardCleanTree: vi.fn(),
+  pullAndResolve: vi.fn(),
+  pushToRemote: vi.fn(),
+  initRepo: vi.fn(),
+}));
+
+const ASSET_MANIFEST = {
+  sameAsHost: false,
+  skipTranslationFetch: false,
+  shared: [],
+  entrypoints: ['main.js'],
+};
+
+describe('deploy --preview', () => {
+  let tmp: string;
+  let cwd: string;
+
+  beforeEach(async () => {
+    tmp = await mkdtemp(path.join(os.tmpdir(), 'z2h-preview-'));
+    cwd = process.cwd();
+    process.chdir(tmp);
+    // Re-read via process.cwd(): on macOS os.tmpdir() is under a /tmp symlink
+    // that resolves to /private/tmp once we chdir into it, and deployCommand
+    // computes its paths from process.cwd() — normalize so assertions match.
+    tmp = process.cwd();
+    await writeJson(path.join(tmp, 'package.json'), { name: '@mondaydotcomorg/my-app' });
+    await ensureDir(path.join(tmp, '.zth', 'build'));
+
+    vi.spyOn(authStore, 'readZthAuth').mockResolvedValue({ token: 'jwt-stub' });
+    vi.mocked(buildCommand)
+      .mockClear()
+      .mockResolvedValue({
+        appName: 'my-app',
+        port: 13000,
+        buildDir: path.join(tmp, '.zth', 'build'),
+        assetManifest: ASSET_MANIFEST,
+      });
+    vi.mocked(uploadDir).mockClear();
+    vi.mocked(setupS3Client).mockClear();
+    vi.mocked(openInBrowser).mockClear();
+    vi.mocked(brokerProvider.brokerCredentialProvider).mockClear();
+    vi.mocked(brokerProvider.fetchDeployVersion).mockReset().mockResolvedValue(0);
+    vi.mocked(brokerApp.registerOrUpdateApp).mockClear().mockResolvedValue(undefined);
+    vi.mocked(gitRepo.guardCleanTree).mockClear();
+    vi.mocked(gitRepo.pullAndResolve).mockClear();
+    vi.mocked(gitRepo.pushToRemote).mockClear();
+    vi.mocked(gitRepo.initRepo).mockClear();
+  });
+
+  afterEach(async () => {
+    process.chdir(cwd);
+    setOutputMode('human');
+    await rm(tmp, { recursive: true, force: true });
+  });
+
+  it('throws when the consumer package.json has no name', async () => {
+    await writeJson(path.join(tmp, 'package.json'), {});
+    await expect(deployCommand({ preview: true })).rejects.toThrow(/must have a "name" field/);
+  });
+
+  it('mints a fresh previewId and uploads to previews/<mfApp>/<id>/MF', async () => {
+    await deployCommand({ preview: true });
+
+    expect(brokerProvider.brokerCredentialProvider).toHaveBeenCalledTimes(1);
+    const call = vi.mocked(brokerProvider.brokerCredentialProvider).mock.calls[0][0];
+    expect(call.appName).toBe('mf-my-app');
+    expect(call.previewId).toMatch(/^[0-9a-f-]{36}$/);
+
+    expect(uploadDir).toHaveBeenCalledWith(path.join(tmp, '.zth', 'build'), `previews/mf-my-app/${call.previewId}/MF`);
+  });
+
+  it('calls registerOrUpdateApp for a brand-new preview at version 1 with an empty gitRemote', async () => {
+    vi.mocked(brokerProvider.fetchDeployVersion).mockResolvedValue(0);
+
+    await deployCommand({ preview: true, previewId: 'existing-preview-id' });
+
+    const previewSlug = buildPreviewSlug('my-app', 'existing-preview-id');
+    const previewAppName = `mf-${previewSlug}`;
+
+    expect(brokerApp.registerOrUpdateApp).toHaveBeenCalledWith({
+      appName: previewAppName,
+      token: 'jwt-stub',
+      nextVersion: 1,
+      entry: expect.objectContaining({ ...ASSET_MANIFEST, version: 1, gitRemote: '' }),
+      gitRemote: '',
+    });
+  });
+
+  it('reuses a supplied previewId and calls registerOrUpdateApp at version+1', async () => {
+    vi.mocked(brokerProvider.fetchDeployVersion).mockResolvedValue(2);
+
+    await deployCommand({ preview: true, previewId: 'existing-preview-id' });
+
+    const call = vi.mocked(brokerProvider.brokerCredentialProvider).mock.calls[0][0];
+    expect(call.previewId).toBe('existing-preview-id');
+
+    expect(uploadDir).toHaveBeenCalledWith(
+      path.join(tmp, '.zth', 'build'),
+      'previews/mf-my-app/existing-preview-id/MF'
+    );
+
+    const previewSlug = buildPreviewSlug('my-app', 'existing-preview-id');
+    const previewAppName = `mf-${previewSlug}`;
+    expect(brokerApp.registerOrUpdateApp).toHaveBeenCalledWith({
+      appName: previewAppName,
+      token: 'jwt-stub',
+      nextVersion: 3,
+      entry: expect.objectContaining({ ...ASSET_MANIFEST, version: 3, gitRemote: '' }),
+      gitRemote: '',
+    });
+  });
+
+  it('passes a full CDN URL (not a relative path) as publicUrl to the build', async () => {
+    await deployCommand({ preview: true, previewId: 'existing-preview-id' });
+
+    expect(buildCommand).toHaveBeenCalledWith(
+      expect.objectContaining({
+        publicUrl: 'https://bigbrain-zth-mf-assets.bigbrain.me/previews/mf-my-app/existing-preview-id/MF',
+      })
+    );
+  });
+
+  it('never touches git', async () => {
+    await deployCommand({ preview: true });
+
+    expect(gitRepo.guardCleanTree).not.toHaveBeenCalled();
+    expect(gitRepo.pullAndResolve).not.toHaveBeenCalled();
+    expect(gitRepo.pushToRemote).not.toHaveBeenCalled();
+    expect(gitRepo.initRepo).not.toHaveBeenCalled();
+  });
+
+  it('--open opens the previewUrl in the browser on success', async () => {
+    await deployCommand({ preview: true, previewId: 'existing-preview-id', open: true });
+
+    const previewSlug = buildPreviewSlug('my-app', 'existing-preview-id');
+    expect(openInBrowser).toHaveBeenCalledWith(`https://bigbrain.me/bigbrain-vibe/${previewSlug}`);
+  });
+
+  it('does not open a browser when --open is omitted', async () => {
+    await deployCommand({ preview: true });
+    expect(openInBrowser).not.toHaveBeenCalled();
+  });
+
+  it('rejects deploying a preview for an app already named with the preview prefix', async () => {
+    await writeJson(path.join(tmp, 'package.json'), { name: 'zth-preview-abc123-my-app' });
+    await expect(deployCommand({ preview: true })).rejects.toThrow(/reserved for the ephemeral preview mechanism/);
+  });
+
+  it('--json emits a machine-readable payload with an app-shaped previewUrl (not ?z2h_preview=)', async () => {
+    const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    setOutputMode('json');
+
+    await deployCommand({ preview: true, previewId: 'existing-preview-id' });
+
+    const jsonLine = writeSpy.mock.calls.map(c => c[0]).find(line => typeof line === 'string' && line.includes('"ok"'));
+    expect(jsonLine).toBeDefined();
+    const payload = JSON.parse(jsonLine as string);
+    const previewSlug = buildPreviewSlug('my-app', 'existing-preview-id');
+    expect(payload).toMatchObject({
+      ok: true,
+      appName: 'mf-my-app',
+      previewId: 'existing-preview-id',
+      previewAppName: `mf-${previewSlug}`,
+      previewUrl: `https://bigbrain.me/bigbrain-vibe/${previewSlug}`,
+    });
+
+    writeSpy.mockRestore();
+  });
+});

package/src/commands/__tests__/doctor.test.ts

@@ -348,18 +348,6 @@ describe('doctorCommand', () => {
     expect(out).toContain('❌');
   });
 
-  it('shows warn for SSL cert when not found', async () => {
-    mockPathExists.mockImplementation(async (p: unknown) => {
-      if (String(p).includes('devcert')) {
-        return false as never;
-      }
-      return true as never;
-    });
-    const out = await captureStdout(() => doctorCommand());
-    expect(out).toContain('SSL cert');
-    expect(out).toContain('⚠️');
-  });
-
   // ── Plugins ───────────────────────────────────────────────────────────────
 
   it('shows fail for z2h plugin (mandatory) when installPath dir is missing', async () => {

package/src/commands/build.ts

@@ -1,14 +1,23 @@
-import { pathExists } from 'fs-extra';
+import path from 'node:path';
+import { pathExists, readJson } from 'fs-extra';
 import { execa } from 'execa';
 import { info, output } from '../util/logger';
 import { prepareShadow } from '../shadow/prepare';
+import type { AssetManifestFile } from '../util/manifest';
 
 export interface BuildOptions {
   publicUrl?: string;
 }
 
+export interface BuildResult {
+  appName: string;
+  port: number;
+  buildDir: string;
+  assetManifest: AssetManifestFile;
+}
+
 // Should be run from the consumer app directory — uses process.cwd() to locate it.
-export async function buildCommand(opts: BuildOptions = {}): Promise<void> {
+export async function buildCommand(opts: BuildOptions = {}): Promise<BuildResult> {
   const ctx = await prepareShadow();
 
   // Typecheck against the shadow's tsconfig (the consumer dir has none).
@@ -34,10 +43,19 @@ export async function buildCommand(opts: BuildOptions = {}): Promise<void> {
     throw new Error(`Expected build output at ${ctx.paths.shadowBuild} — not found.`);
   }
 
+  // Trident emits the canonical per-MF manifest at build/asset-manifest.json.
+  const assetManifestPath = path.join(ctx.paths.shadowBuild, 'asset-manifest.json');
+  if (!(await pathExists(assetManifestPath))) {
+    throw new Error(`Missing asset-manifest.json at ${assetManifestPath}.`);
+  }
+  const assetManifest = (await readJson(assetManifestPath)) as AssetManifestFile;
+
   output(`[z2h-cli] build complete — artifacts at ${ctx.paths.shadowBuild}`, {
     ok: true,
     appName: ctx.appName,
     port: ctx.port,
     buildDir: ctx.paths.shadowBuild,
   });
+
+  return { appName: ctx.appName, port: ctx.port, buildDir: ctx.paths.shadowBuild, assetManifest };
 }

package/src/commands/create.ts

@@ -4,12 +4,11 @@ import { ensureDir, pathExists, readdir, writeFile, copy } from 'fs-extra';
 import { info, warn, output } from '../util/logger';
 import { assertWorkspace } from '../util/workspace';
 import { getTemplatesDir, renderTemplate, APP_TEMPLATES, type AppTemplate } from '../util/templates';
-import { APP_NAME_PATTERN } from '../constants';
 import { runYarnInstall } from '../util/npm/install';
 import { initRepo } from '../util/git/repo';
 import { REMOTE_TYPES, type RemoteType, validateRemoteOptions, resolveRemoteUrl } from '../util/git/remote-options';
 import { fetchApp } from '../util/broker/app';
-import { mfAppName } from '../util/app-name';
+import { mfAppName, validateAppName } from '../util/app-name';
 import { prepareShadow } from '../shadow/prepare';
 
 export { REMOTE_TYPES, type RemoteType };
@@ -21,11 +20,6 @@ export interface CreateOptions {
   repoUrl?: string;
 }
 
-// Names reserved by the host MF (mf-bigbrain-zth) for platform pages under
-// /bigbrain-vibe/<name>. Creating an app with one of these would shadow the
-// platform page in the URL, so we refuse upfront.
-const RESERVED_APP_NAMES = new Set(['generate-z2h-token']);
-
 /**
  * Convert kebab-case to PascalCase. `demo-app` → `DemoApp`.
  */
@@ -53,17 +47,7 @@ export async function createCommand(appName: string, opts: CreateOptions = {}):
   const workspace = await assertWorkspace();
 
   // Validate app name.
-  if (RESERVED_APP_NAMES.has(appName)) {
-    throw new Error(
-      `App name "${appName}" is reserved by the Z2H host for a platform page under /bigbrain-vibe/${appName}. Pick a different name.`
-    );
-  }
-  if (!APP_NAME_PATTERN.test(appName)) {
-    throw new Error(
-      `App name "${appName}" is invalid. Use lowercase kebab-case (a-z, 0-9, -), ` +
-        `2-50 chars, starting with a letter.`
-    );
-  }
+  validateAppName(appName);
 
   // Validate --remote up front before any file I/O.
   validateRemoteOptions(opts, true);

package/src/commands/deploy.ts

@@ -1,28 +1,50 @@
-import path from 'node:path';
 import os from 'node:os';
-import { createInterface } from 'node:readline';
-import { pathExists, readJson } from 'fs-extra';
+import { randomUUID } from 'node:crypto';
+import { readJson } from 'fs-extra';
 import { info, warn, output, getOutputMode } from '../util/logger';
 import { resolveConsumerPaths } from '../shadow/paths';
 import { fetchAppTags, fetchTagCatalog, setAppTags } from '../util/tags';
-import { type AssetManifestFile, type ManifestEntry } from '../util/manifest';
 import { uploadDir } from '../util/s3/upload';
-import { BUCKET_WRITE_NAME, BUCKET_READ_DNS_URL, brokerBaseUrl, routingHeaders } from '../constants';
+import {
+  BUCKET_WRITE_NAME,
+  BUCKET_READ_DNS_URL,
+  S3_PREVIEWS_FOLDER,
+  brokerBaseUrl,
+  routingHeaders,
+} from '../constants';
 import { brokerCredentialProvider, fetchDeployVersion } from '../util/auth/broker-credential-provider';
 import { readZthAuth } from '../util/auth/auth-store';
-import { cleanAppName, mfAppName } from '../util/app-name';
-import { getMachineAppName } from '../util/machine-identity';
+import { cleanAppName, mfAppName, validateAppName, buildPreviewSlug } from '../util/app-name';
 import { getRemoteUrl, guardCleanTree, pullAndResolve, pushToRemote, initRepo } from '../util/git/repo';
 import { resolveGitEnv } from '../util/git/git-env';
 import { type RemoteType, validateRemoteOptions, resolveRemoteUrl } from '../util/git/remote-options';
 import { setupS3Client } from '../util/s3/client';
-import { promptForTags } from './tag';
+import { getMachineAppName } from '../util/machine-identity';
+import { registerOrUpdateApp } from '../util/broker/app';
+import { openInBrowser } from '../util/open-browser';
 import { buildCommand } from './build';
+import { promptForTags } from './tag';
+import type { ConsumerPaths } from '../types';
+import type { ManifestEntry } from '../util/manifest';
 
 export interface DeployOptions {
   dryRun?: boolean;
   remote?: RemoteType;
   repoUrl?: string;
+  // Registers a real, disposable `apps` row under a synthetic name instead of
+  // deploying — no git, no deploy lock (each previewId's slug is unique).
+  preview?: boolean;
+  // With --preview: update an existing preview instead of minting a new one.
+  previewId?: string;
+  open?: boolean;
+}
+
+interface DeployContext {
+  paths: ConsumerPaths;
+  consumerName: string;
+  appName: string;
+  token: string;
+  opts: DeployOptions;
 }
 
 // Should be run from the consumer app directory — uses process.cwd() to locate it.
@@ -32,12 +54,89 @@ export async function deployCommand(opts: DeployOptions = {}): Promise<void> {
   if (!consumerPkg.name) {
     throw new Error('Consumer package.json must have a "name" field');
   }
+  validateAppName(cleanAppName(consumerPkg.name));
   const appName = mfAppName(consumerPkg.name);
 
   // Validate the user's deploy token is on disk before doing any expensive
   // work. Throws Z2hAuthMissingError with a remediation hint if not.
   const { token } = await readZthAuth();
 
+  const ctx: DeployContext = { paths, consumerName: consumerPkg.name, appName, token, opts };
+
+  if (opts.preview) {
+    await deployPreview(ctx);
+  } else {
+    await deployLive(ctx);
+  }
+}
+
+/**
+ * Runs the build step and turns its output into a ManifestEntry ready to
+ * register/update — the one step a real deploy and a preview both need
+ * identically: build, then stamp version/url/deployedBy/gitRemote onto the
+ * asset manifest Trident emitted.
+ */
+async function buildAndStamp(opts: {
+  paths: ConsumerPaths;
+  publicUrl: string;
+  nextVersion: number;
+  gitRemote: string;
+}): Promise<ManifestEntry> {
+  const { assetManifest } = await buildCommand({ publicUrl: opts.publicUrl });
+  const deployedBy = getMachineAppName() ?? os.userInfo().username;
+
+  return {
+    ...assetManifest,
+    version: opts.nextVersion,
+    url: opts.publicUrl,
+    deployedBy,
+    gitRemote: opts.gitRemote,
+  };
+}
+
+async function deployPreview({ paths, consumerName, appName, token, opts }: DeployContext): Promise<void> {
+  const previewId = opts.previewId ?? randomUUID();
+  const previewSlug = buildPreviewSlug(consumerName, previewId);
+  const previewAppName = mfAppName(previewSlug);
+  const keyPrefix = `${S3_PREVIEWS_FOLDER}/${appName}/${previewId}/MF`;
+  // Full CDN URL, not a relative path — trident-skeleton uses a manifest
+  // entry's `url` verbatim as the asset base, never joined with its own mfUrl.
+  const url = `${BUCKET_READ_DNS_URL}/${keyPrefix}`;
+
+  const nextVersion = (await fetchDeployVersion(previewAppName)) + 1;
+
+  info('building');
+  const entry = await buildAndStamp({ paths, publicUrl: url, nextVersion, gitRemote: '' });
+
+  const creds = await brokerCredentialProvider({ appName, previewId })();
+  setupS3Client(creds);
+
+  info(`uploading preview build → s3://${BUCKET_WRITE_NAME}/${keyPrefix}/`);
+  await uploadDir(paths.shadowBuild, keyPrefix);
+
+  await registerOrUpdateApp({ appName: previewAppName, token, nextVersion, entry, gitRemote: '' });
+
+  const previewUrl = `https://bigbrain.me/bigbrain-vibe/${previewSlug}`;
+  output(
+    `[z2h-cli] preview ready ✅\n  app:            ${appName}\n  previewAppName: ${previewAppName}\n  open:           ${previewUrl}`,
+    {
+      ok: true,
+      appName,
+      previewId,
+      previewAppName,
+      bucket: BUCKET_WRITE_NAME,
+      keyPrefix,
+      url,
+      previewUrl,
+    }
+  );
+
+  if (opts.open) {
+    void openInBrowser(previewUrl);
+  }
+}
+
+async function deployLive({ paths, consumerName, appName, token, opts }: DeployContext): Promise<void> {
   let gitRemote = await getRemoteUrl(process.cwd());
 
   if (gitRemote) {
@@ -60,7 +159,7 @@ export async function deployCommand(opts: DeployOptions = {}): Promise<void> {
     validateRemoteOptions(opts);
     // Pass the raw consumer name (not the mf-prefixed appName) so defaultS3Remote
     // produces the correct s3://bucket/mf-<name>/git path without double prefix.
-    const remote = resolveRemoteUrl(opts.remote as RemoteType, consumerPkg.name, opts.repoUrl);
+    const remote = resolveRemoteUrl(opts.remote as RemoteType, consumerName, opts.repoUrl);
     info(`initializing git repo with ${opts.remote} remote...`);
     await initRepo(process.cwd(), remote);
     gitRemote = remote;
@@ -85,27 +184,7 @@ export async function deployCommand(opts: DeployOptions = {}): Promise<void> {
   const url = `${BUCKET_READ_DNS_URL}/${keyPrefix}`;
 
   info('building');
-  await buildCommand({ publicUrl: url });
-
-  if (!(await pathExists(paths.shadowBuild))) {
-    throw new Error(`No build output at ${paths.shadowBuild} after build step.`);
-  }
-
-  // Trident emits the canonical per-MF manifest at build/asset-manifest.json.
-  const assetManifestPath = path.join(paths.shadowBuild, 'asset-manifest.json');
-  if (!(await pathExists(assetManifestPath))) {
-    throw new Error(`Missing asset-manifest.json at ${assetManifestPath}.`);
-  }
-  const assetManifest = (await readJson(assetManifestPath)) as AssetManifestFile;
-
-  const deployedBy = getMachineAppName() ?? os.userInfo().username;
-  const entry: ManifestEntry = {
-    ...assetManifest,
-    version: nextVersion,
-    url,
-    deployedBy,
-    gitRemote,
-  };
+  const entry = await buildAndStamp({ paths, publicUrl: url, nextVersion, gitRemote });
 
   if (opts.dryRun) {
     output(`[z2h-cli] dry-run: would upload to s3://${BUCKET_WRITE_NAME}/${keyPrefix}/ as v${version}`, {
@@ -140,17 +219,7 @@ export async function deployCommand(opts: DeployOptions = {}): Promise<void> {
     info(`uploading build → s3://${BUCKET_WRITE_NAME}/${keyPrefix}/`);
     await uploadDir(paths.shadowBuild, keyPrefix);
 
-    // v1 creates the app row (+ owner grant); later versions release onto it.
-    // The two are separate endpoints, so the CLI picks based on the version it
-    // was handed.
-    if (nextVersion === 1) {
-      const visibility = await resolveFirstDeployVisibility(appName);
-      info(`registering app "${appName}" → v${nextVersion} (${visibility})`);
-      await registerApp(appName, token, nextVersion, entry, visibility, gitRemote);
-    } else {
-      info(`releasing "${appName}" → v${nextVersion}`);
-      await updateApp(appName, token, nextVersion, entry, gitRemote);
-    }
+    await registerOrUpdateApp({ appName, token, nextVersion, entry, gitRemote });
   } finally {
     await releaseLockBestEffort(appName, token);
   }
@@ -162,7 +231,7 @@ export async function deployCommand(opts: DeployOptions = {}): Promise<void> {
   // The host MF parses the app name from the URL and prepends `mf-` itself
   // before looking it up in the manifest. So the user-facing URL must use
   // the consumer's de-scoped package name (no `mf-` prefix, no `@scope/`).
-  const liveUrl = `https://bigbrain.me/bigbrain-vibe/${cleanAppName(consumerPkg.name)}`;
+  const liveUrl = `https://bigbrain.me/bigbrain-vibe/${cleanAppName(consumerName)}`;
   output(`[z2h-cli] deployed ✅\n  app:     ${appName}\n  version: ${nextVersion}\n  open:    ${liveUrl}`, {
     ok: true,
     appName,
@@ -173,24 +242,9 @@ export async function deployCommand(opts: DeployOptions = {}): Promise<void> {
     liveUrl,
     entry,
   });
-}
 
-async function registerApp(
-  appName: string,
-  token: string,
-  version: number,
-  entry: ManifestEntry,
-  visibility: 'public' | 'private',
-  gitRemote: string
-): Promise<void> {
-  const res = await fetch(`${brokerBaseUrl()}/z2h-cli/apps/register`, {
-    method: 'POST',
-    headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', ...routingHeaders() },
-    body: JSON.stringify({ appName, version, entry, visibility, gitRemote }),
-  });
-  if (!res.ok) {
-    const text = await res.text();
-    throw new Error(`App registration failed (${res.status}): ${text.slice(0, 1024)}`);
+  if (opts.open) {
+    void openInBrowser(liveUrl);
   }
 }
 
@@ -236,40 +290,6 @@ async function acquireDeployLock(appName: string, token: string): Promise<void>
   info(`deploy lock acquired for ${appName}`);
 }
 
-async function updateApp(
-  appName: string,
-  token: string,
-  version: number,
-  entry: ManifestEntry,
-  gitRemote: string
-): Promise<void> {
-  const res = await fetch(`${brokerBaseUrl()}/z2h-cli/apps/update`, {
-    method: 'POST',
-    headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', ...routingHeaders() },
-    body: JSON.stringify({ appName, version, entry, gitRemote }),
-  });
-  if (!res.ok) {
-    const text = await res.text();
-    throw new Error(`App update failed (${res.status}): ${text.slice(0, 1024)}`);
-  }
-}
-
-// First deploy only: decide whether the app is born public or private. The
-// choice is passed to the register endpoint (default private). Non-interactive
-// runs (--json or no TTY) always default to private.
-async function resolveFirstDeployVisibility(appName: string): Promise<'public' | 'private'> {
-  if (getOutputMode() === 'json' || !process.stdout.isTTY) {
-    return 'private';
-  }
-
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  const answer = await new Promise<string>(resolve => {
-    rl.question(`Make "${appName}" public to all monday.com employees? (y/N) `, resolve);
-  });
-  rl.close();
-  return answer.trim().toLowerCase() === 'y' ? 'public' : 'private';
-}
-
 // best-effort — the 2-min TTL backstop handles failures
 async function releaseLockBestEffort(appName: string, token: string): Promise<void> {
   try {

package/src/commands/doctor.ts

@@ -16,15 +16,6 @@ const Z2H_REPO_ROOT = path.join(HOME, 'Development', 'bigbrain-z2h');
 const BOOTSTRAP_CMD = `bash ${path.join(Z2H_REPO_ROOT, 'z2h/setup/bootstrap.sh')}`;
 const UPDATE_CMD = `bash ${path.join(Z2H_REPO_ROOT, 'z2h/setup/update.sh')}`;
 const CLAUDE_PLUGINS_JSON = path.join(HOME, '.claude', 'plugins', 'installed_plugins.json');
-const SSL_CERT_PATH = path.join(
-  HOME,
-  'Library',
-  'Application Support',
-  'devcert',
-  'domains',
-  'webpack.llama.fan',
-  'certificate.crt'
-);
 
 type Status = 'ok' | 'warn' | 'fail';
 
@@ -258,16 +249,6 @@ async function checkReactVersion(): Promise<CheckResult> {
   };
 }
 
-async function checkSslCert(): Promise<CheckResult> {
-  const ok = await pathExists(SSL_CERT_PATH);
-  return {
-    label: 'SSL cert',
-    status: ok ? 'ok' : 'warn',
-    detail: ok ? 'webpack.llama.fan' : 'not found — auto-installs on first z2h-cli dev',
-    fix: ok ? undefined : 'z2h-cli dev',
-  };
-}
-
 async function checkPlugin(
   pluginKey: string,
   label: string,
@@ -325,7 +306,7 @@ export async function doctorCommand(): Promise<void> {
 
   const systemChecks = await Promise.all([checkNvm(), checkNode(), checkYarn(), checkAws(), checkGitRemoteS3()]);
   const cliChecks = await Promise.all([checkZ2hCli(), checkAuthToken(), checkNpmTokenInProfile()]);
-  const workspaceChecks = await Promise.all([checkWorkspace(), checkReactVersion(), checkSslCert()]);
+  const workspaceChecks = await Promise.all([checkWorkspace(), checkReactVersion()]);
   const pluginChecks = await Promise.all([
     checkPlugin('z2h@bigbrain-z2h', 'z2h plugin', true, pluginsJson),
     checkPlugin('cf-external-claude-plugin@client-foundations-ai-tools', 'cf-external plugin', false, pluginsJson),