@viberaven/cli 1.5.0 → 1.5.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viberaven/cli",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "Local Studio cockpit for AI-built apps: agentic chat, provider context, release review, diffs, and approval-controlled repo work.",
   "license": "MIT",
   "author": "VibeRaven",
@@ -42,7 +42,8 @@
     "playbooks",
     "AGENTS.md",
     "SECURITY.md",
-    "templates"
+    "templates",
+    "schemas"
   ],
   "scripts": {
     "sync-report-assets": "node scripts/sync-report-assets.mjs",
@@ -66,7 +67,16 @@
     "@clack/prompts": "^0.10.1",
     "picocolors": "^1.1.1"
   },
+  "peerDependencies": {
+    "@electric-sql/pglite": ">=0.5.8 <0.6.0"
+  },
+  "peerDependenciesMeta": {
+    "@electric-sql/pglite": {
+      "optional": true
+    }
+  },
   "devDependencies": {
+    "@electric-sql/pglite": "0.5.8",
     "esbuild": "^0.25.0",
     "typescript": "^5.8.0",
     "vitest": "^3.2.0"

package/playbooks/_stack-default.json

@@ -1,11 +1,11 @@
-{
-  "id": "stack-default",
-  "recommendation": {
-    "frontend": "react",
-    "ui": "tailwind + shadcn/ui",
-    "database": "supabase",
-    "auth": "supabase",
-    "deploy": "vercel",
-    "reason": "Highest agent training density; lowest friction for autonomous deploy loop"
-  }
-}
+{
+  "id": "stack-default",
+  "recommendation": {
+    "frontend": "react",
+    "ui": "tailwind + shadcn/ui",
+    "database": "supabase",
+    "auth": "supabase",
+    "deploy": "vercel",
+    "reason": "Highest agent training density; lowest friction for autonomous deploy loop"
+  }
+}

package/playbooks/auth-supabase.json

@@ -1,31 +1,31 @@
-{
-  "id": "auth-supabase",
-  "provider": "auth-supabase",
-  "title": "Supabase Auth providers",
-  "steps": [
-    {
-      "id": "auth-providers",
-      "title": "Enable providers",
-      "instruction": "Enable Email and any OAuth providers your app uses (Google, GitHub, etc.).",
-      "openUrl": "https://supabase.com/dashboard/project/_/auth/providers"
-    },
-    {
-      "id": "auth-urls",
-      "title": "Redirect URLs",
-      "instruction": "Site URL and Redirect URLs must include your Vercel deployment URL.",
-      "openUrl": "https://supabase.com/dashboard/project/_/auth/url-configuration"
-    },
-    {
-      "id": "auth-email-templates",
-      "title": "Email templates",
-      "instruction": "Customize confirm signup and magic link templates if your app uses email auth.",
-      "openUrl": "https://supabase.com/dashboard/project/_/auth/templates"
-    },
-    {
-      "id": "auth-jwt",
-      "title": "JWT settings",
-      "instruction": "Confirm JWT expiry matches your session strategy. Use service role key only on the server.",
-      "openUrl": "https://supabase.com/dashboard/project/_/settings/api"
-    }
-  ]
-}
+{
+  "id": "auth-supabase",
+  "provider": "auth-supabase",
+  "title": "Supabase Auth providers",
+  "steps": [
+    {
+      "id": "auth-providers",
+      "title": "Enable providers",
+      "instruction": "Enable Email and any OAuth providers your app uses (Google, GitHub, etc.).",
+      "openUrl": "https://supabase.com/dashboard/project/_/auth/providers"
+    },
+    {
+      "id": "auth-urls",
+      "title": "Redirect URLs",
+      "instruction": "Site URL and Redirect URLs must include your Vercel deployment URL.",
+      "openUrl": "https://supabase.com/dashboard/project/_/auth/url-configuration"
+    },
+    {
+      "id": "auth-email-templates",
+      "title": "Email templates",
+      "instruction": "Customize confirm signup and magic link templates if your app uses email auth.",
+      "openUrl": "https://supabase.com/dashboard/project/_/auth/templates"
+    },
+    {
+      "id": "auth-jwt",
+      "title": "JWT settings",
+      "instruction": "Confirm JWT expiry matches your session strategy. Use service role key only on the server.",
+      "openUrl": "https://supabase.com/dashboard/project/_/settings/api"
+    }
+  ]
+}

package/playbooks/stripe.json

@@ -1,66 +1,66 @@
-{
-  "id": "stripe-launch",
-  "provider": "stripe",
-  "title": "Configure Stripe billing",
-  "steps": [
-    {
-      "id": "stripe-dashboard",
-      "title": "Stripe dashboard",
-      "instruction": "Open Stripe. For development, turn Test mode ON.",
-      "openUrl": "https://dashboard.stripe.com/"
-    },
-    {
-      "id": "stripe-keys",
-      "title": "API keys",
-      "instruction": "Copy test (or live) keys into .env. Never commit secret keys.",
-      "openUrl": "https://dashboard.stripe.com/test/apikeys",
-      "pasteTarget": {
-        "file": ".env",
-        "keys": ["STRIPE_SECRET_KEY", "NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY"]
-      }
-    },
-    {
-      "id": "stripe-product",
-      "title": "Product and price",
-      "instruction": "Create a product with a recurring price for your Pro or paid tier.",
-      "openUrl": "https://dashboard.stripe.com/test/products"
-    },
-    {
-      "id": "stripe-price-id",
-      "title": "Price ID",
-      "instruction": "Copy the Price ID (price_...) into .env as STRIPE_PRICE_ID."
-    },
-    {
-      "id": "stripe-webhook",
-      "title": "Webhook endpoint",
-      "instruction": "Add endpoint URL: {APP_URL}/api/webhooks/stripe (replace {APP_URL} with your Vercel URL).",
-      "openUrl": "https://dashboard.stripe.com/test/webhooks"
-    },
-    {
-      "id": "stripe-webhook-events",
-      "title": "Webhook events",
-      "instruction": "Subscribe to these events at minimum.",
-      "events": [
-        "checkout.session.completed",
-        "customer.subscription.updated",
-        "customer.subscription.deleted",
-        "invoice.payment_failed"
-      ]
-    },
-    {
-      "id": "stripe-signing-secret",
-      "title": "Signing secret",
-      "instruction": "Copy the webhook signing secret into .env as STRIPE_WEBHOOK_SECRET.",
-      "pasteTarget": {
-        "file": ".env",
-        "keys": ["STRIPE_WEBHOOK_SECRET"]
-      }
-    },
-    {
-      "id": "stripe-test-event",
-      "title": "Test event",
-      "instruction": "Use Send test event on the Stripe webhook endpoint and confirm a successful 2xx delivery for checkout.session.completed before launch.",
-      "openUrl": "https://dashboard.stripe.com/test/webhooks"
-    }
-  ]
-}
+{
+  "id": "stripe-launch",
+  "provider": "stripe",
+  "title": "Configure Stripe billing",
+  "steps": [
+    {
+      "id": "stripe-dashboard",
+      "title": "Stripe dashboard",
+      "instruction": "Open Stripe. For development, turn Test mode ON.",
+      "openUrl": "https://dashboard.stripe.com/"
+    },
+    {
+      "id": "stripe-keys",
+      "title": "API keys",
+      "instruction": "Copy test (or live) keys into .env. Never commit secret keys.",
+      "openUrl": "https://dashboard.stripe.com/test/apikeys",
+      "pasteTarget": {
+        "file": ".env",
+        "keys": ["STRIPE_SECRET_KEY", "NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY"]
+      }
+    },
+    {
+      "id": "stripe-product",
+      "title": "Product and price",
+      "instruction": "Create a product with a recurring price for your Pro or paid tier.",
+      "openUrl": "https://dashboard.stripe.com/test/products"
+    },
+    {
+      "id": "stripe-price-id",
+      "title": "Price ID",
+      "instruction": "Copy the Price ID (price_...) into .env as STRIPE_PRICE_ID."
+    },
+    {
+      "id": "stripe-webhook",
+      "title": "Webhook endpoint",
+      "instruction": "Add endpoint URL: {APP_URL}/api/webhooks/stripe (replace {APP_URL} with your Vercel URL).",
+      "openUrl": "https://dashboard.stripe.com/test/webhooks"
+    },
+    {
+      "id": "stripe-webhook-events",
+      "title": "Webhook events",
+      "instruction": "Subscribe to these events at minimum.",
+      "events": [
+        "checkout.session.completed",
+        "customer.subscription.updated",
+        "customer.subscription.deleted",
+        "invoice.payment_failed"
+      ]
+    },
+    {
+      "id": "stripe-signing-secret",
+      "title": "Signing secret",
+      "instruction": "Copy the webhook signing secret into .env as STRIPE_WEBHOOK_SECRET.",
+      "pasteTarget": {
+        "file": ".env",
+        "keys": ["STRIPE_WEBHOOK_SECRET"]
+      }
+    },
+    {
+      "id": "stripe-test-event",
+      "title": "Test event",
+      "instruction": "Use Send test event on the Stripe webhook endpoint and confirm a successful 2xx delivery for checkout.session.completed before launch.",
+      "openUrl": "https://dashboard.stripe.com/test/webhooks"
+    }
+  ]
+}

package/playbooks/supabase.json

@@ -1,51 +1,51 @@
-{
-  "id": "supabase-launch",
-  "provider": "supabase",
-  "title": "Configure Supabase",
-  "steps": [
-    {
-      "id": "supabase-project",
-      "title": "Open Supabase dashboard",
-      "instruction": "Create a project or open your existing Supabase project.",
-      "openUrl": "https://supabase.com/dashboard"
-    },
-    {
-      "id": "supabase-api-keys",
-      "title": "API keys",
-      "instruction": "Copy Project URL and anon/public key into .env.",
-      "openUrl": "https://supabase.com/dashboard/project/_/settings/api",
-      "pasteTarget": {
-        "file": ".env",
-        "keys": ["NEXT_PUBLIC_SUPABASE_URL", "NEXT_PUBLIC_SUPABASE_ANON_KEY"]
-      }
-    },
-    {
-      "id": "supabase-db-url",
-      "title": "Database connection",
-      "instruction": "Copy the connection string (use pooler for serverless). Server-side only — never expose in client code.",
-      "openUrl": "https://supabase.com/dashboard/project/_/settings/database",
-      "pasteTarget": {
-        "file": ".env",
-        "keys": ["DATABASE_URL"]
-      }
-    },
-    {
-      "id": "supabase-auth-urls",
-      "title": "Auth URL configuration",
-      "instruction": "Set Site URL to your Vercel preview or production URL. Add the same URL to Redirect URLs with /** wildcard.",
-      "openUrl": "https://supabase.com/dashboard/project/_/auth/url-configuration"
-    },
-    {
-      "id": "supabase-rls",
-      "title": "Row Level Security",
-      "instruction": "Enable RLS on tables that hold user data. Add policies for authenticated users.",
-      "openUrl": "https://supabase.com/dashboard/project/_/auth/policies"
-    },
-    {
-      "id": "supabase-migrate",
-      "title": "Apply migrations",
-      "instruction": "Run supabase db push or apply SQL migrations so production schema matches the repo.",
-      "openUrl": "https://supabase.com/docs/guides/cli"
-    }
-  ]
-}
+{
+  "id": "supabase-launch",
+  "provider": "supabase",
+  "title": "Configure Supabase",
+  "steps": [
+    {
+      "id": "supabase-project",
+      "title": "Open Supabase dashboard",
+      "instruction": "Create a project or open your existing Supabase project.",
+      "openUrl": "https://supabase.com/dashboard"
+    },
+    {
+      "id": "supabase-api-keys",
+      "title": "API keys",
+      "instruction": "Copy Project URL and anon/public key into .env.",
+      "openUrl": "https://supabase.com/dashboard/project/_/settings/api",
+      "pasteTarget": {
+        "file": ".env",
+        "keys": ["NEXT_PUBLIC_SUPABASE_URL", "NEXT_PUBLIC_SUPABASE_ANON_KEY"]
+      }
+    },
+    {
+      "id": "supabase-db-url",
+      "title": "Database connection",
+      "instruction": "Copy the connection string (use pooler for serverless). Server-side only — never expose in client code.",
+      "openUrl": "https://supabase.com/dashboard/project/_/settings/database",
+      "pasteTarget": {
+        "file": ".env",
+        "keys": ["DATABASE_URL"]
+      }
+    },
+    {
+      "id": "supabase-auth-urls",
+      "title": "Auth URL configuration",
+      "instruction": "Set Site URL to your Vercel preview or production URL. Add the same URL to Redirect URLs with /** wildcard.",
+      "openUrl": "https://supabase.com/dashboard/project/_/auth/url-configuration"
+    },
+    {
+      "id": "supabase-rls",
+      "title": "Row Level Security",
+      "instruction": "Enable RLS on tables that hold user data. Add policies for authenticated users.",
+      "openUrl": "https://supabase.com/dashboard/project/_/auth/policies"
+    },
+    {
+      "id": "supabase-migrate",
+      "title": "Apply migrations",
+      "instruction": "Run supabase db push or apply SQL migrations so production schema matches the repo.",
+      "openUrl": "https://supabase.com/docs/guides/cli"
+    }
+  ]
+}

package/playbooks/vercel.json

@@ -1,42 +1,42 @@
-{
-  "id": "vercel-launch",
-  "provider": "vercel",
-  "title": "Deploy on Vercel",
-  "steps": [
-    {
-      "id": "vercel-signup",
-      "title": "Sign in to Vercel",
-      "instruction": "Create or sign in to your Vercel account.",
-      "openUrl": "https://vercel.com/signup"
-    },
-    {
-      "id": "vercel-import",
-      "title": "Import repository",
-      "instruction": "Import your Git repository. Connect GitHub or GitLab if prompted.",
-      "openUrl": "https://vercel.com/new"
-    },
-    {
-      "id": "vercel-env",
-      "title": "Environment variables",
-      "instruction": "Project → Settings → Environment Variables. Add every key from .env.example for Production and Preview.",
-      "openUrl": "https://vercel.com/docs/projects/environment-variables"
-    },
-    {
-      "id": "vercel-deploy",
-      "title": "Deploy",
-      "instruction": "Push to your production branch or click Redeploy in the Vercel dashboard.",
-      "openUrl": "https://vercel.com/docs/deployments"
-    },
-    {
-      "id": "vercel-preview",
-      "title": "Copy live URL",
-      "instruction": "Copy the Production or Preview URL from Vercel. Set NEXT_PUBLIC_APP_URL (or your app's public URL env) in .env and Vercel env settings."
-    },
-    {
-      "id": "vercel-domains",
-      "title": "Custom domain (optional)",
-      "instruction": "Add a custom domain when you are ready for production traffic.",
-      "openUrl": "https://vercel.com/docs/projects/domains"
-    }
-  ]
-}
+{
+  "id": "vercel-launch",
+  "provider": "vercel",
+  "title": "Deploy on Vercel",
+  "steps": [
+    {
+      "id": "vercel-signup",
+      "title": "Sign in to Vercel",
+      "instruction": "Create or sign in to your Vercel account.",
+      "openUrl": "https://vercel.com/signup"
+    },
+    {
+      "id": "vercel-import",
+      "title": "Import repository",
+      "instruction": "Import your Git repository. Connect GitHub or GitLab if prompted.",
+      "openUrl": "https://vercel.com/new"
+    },
+    {
+      "id": "vercel-env",
+      "title": "Environment variables",
+      "instruction": "Project → Settings → Environment Variables. Add every key from .env.example for Production and Preview.",
+      "openUrl": "https://vercel.com/docs/projects/environment-variables"
+    },
+    {
+      "id": "vercel-deploy",
+      "title": "Deploy",
+      "instruction": "Push to your production branch or click Redeploy in the Vercel dashboard.",
+      "openUrl": "https://vercel.com/docs/deployments"
+    },
+    {
+      "id": "vercel-preview",
+      "title": "Copy live URL",
+      "instruction": "Copy the Production or Preview URL from Vercel. Set NEXT_PUBLIC_APP_URL (or your app's public URL env) in .env and Vercel env settings."
+    },
+    {
+      "id": "vercel-domains",
+      "title": "Custom domain (optional)",
+      "instruction": "Add a custom domain when you are ready for production traffic.",
+      "openUrl": "https://vercel.com/docs/projects/domains"
+    }
+  ]
+}

package/schemas/permissions-matrix.schema.json

@@ -0,0 +1,90 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://viberaven.dev/schemas/permissions-matrix.v1.json",
+  "title": "VibeRaven permissions matrix (viberaven.permissions.json)",
+  "description": "Who may read, add, change and delete rows in each table, written by a person. `viberaven rls-test` checks the migrations against it. Never generate it from the app's own policies. Every cell is about rows owned by `owner`: owner acts on their own row, other_user is a different signed-in user acting on the owner's row, anon is a request with only the public anon key. For insert, the new row names the owner as its owner.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "tables"],
+  "properties": {
+    "$schema": { "type": "string" },
+    "version": { "const": 1 },
+    "description": { "type": "string" },
+    "defaultGrants": {
+      "description": "Table grants the test database gives new public tables. supabase-legacy: anon and authenticated get all privileges on new public tables, as on existing Supabase projects (the more exposed assumption). none: no default grants, only what the migrations grant.",
+      "enum": ["supabase-legacy", "none"],
+      "default": "supabase-legacy"
+    },
+    "tables": {
+      "type": "object",
+      "minProperties": 1,
+      "propertyNames": { "pattern": "^[A-Za-z_][A-Za-z0-9_$]*(\\.[A-Za-z_][A-Za-z0-9_$]*)?$" },
+      "additionalProperties": { "$ref": "#/$defs/table" }
+    }
+  },
+  "$defs": {
+    "table": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["owner", "expect"],
+      "properties": {
+        "description": { "type": "string" },
+        "owner": {
+          "description": "How a row's owner is defined. Only `column = auth.uid()` is supported.",
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["column", "is"],
+          "properties": {
+            "column": { "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_$]*$" },
+            "is": { "const": "auth.uid()" }
+          }
+        },
+        "expect": { "$ref": "#/$defs/expectation" },
+        "seed": {
+          "description": "Values for columns the test cannot fill by itself (for example a NOT NULL foreign key). Used for every seeded and inserted row. Leave the owner column out.",
+          "type": "object",
+          "propertyNames": { "pattern": "^[A-Za-z_][A-Za-z0-9_$]*$" },
+          "additionalProperties": { "type": ["string", "number", "boolean", "null"] }
+        },
+        "updateColumn": {
+          "description": "Column the update probe changes. Default: the first plain column that is not the owner column or part of the primary key.",
+          "type": "string",
+          "pattern": "^[A-Za-z_][A-Za-z0-9_$]*$"
+        }
+      }
+    },
+    "expectation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["owner", "other_user", "anon"],
+      "properties": {
+        "owner": { "$ref": "#/$defs/actorCells" },
+        "other_user": { "$ref": "#/$defs/actorCells" },
+        "anon": { "$ref": "#/$defs/actorCells" },
+        "service_role": {
+          "description": "The service role bypasses RLS, so it is never tested.",
+          "const": "excluded"
+        }
+      }
+    },
+    "actorCells": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["select", "insert", "update", "delete"],
+      "properties": {
+        "select": { "$ref": "#/$defs/cell" },
+        "insert": { "$ref": "#/$defs/cell" },
+        "update": { "$ref": "#/$defs/cell" },
+        "delete": { "$ref": "#/$defs/cell" },
+        "reassign": {
+          "description": "Optional. Setting the owner column of the owner's row to another user: the owner giving the row away, or another user taking it. Not tested when absent.",
+          "$ref": "#/$defs/cell"
+        }
+      }
+    },
+    "cell": {
+      "description": "allow: the action must work on the owner's row. deny: it must return nothing, change nothing, or be refused with a permission error. skip: not tested (N/A).",
+      "enum": ["allow", "deny", "skip"]
+    }
+  }
+}

package/templates/AGENTS.snippet.md

@@ -1,52 +1,52 @@
-## VibeRaven Launch Readiness
-
-VibeRaven is the Agent Context + Production Gate.
-
-Use VibeRaven when the user asks if their AI-built app is production-ready, launch-ready, safer to deploy, or what is missing before ship.
-
-### Humans
-
-```bash
-npx -y viberaven
-```
-
-In a real terminal, this opens the interactive VibeRaven menu.
-
-### Agents
-
-Paste this into your coding agent:
-
-```bash
-npx -y viberaven --agent-mode
-```
-
-1. Run `npx -y viberaven --agent-mode` from the project root.
-2. If VibeRaven prints `LOGIN_URL_READY`, open that exact URL for the user. Say: "I opened VibeRaven sign-in so you can approve access; I will continue after approval." Do not ask for passwords, tokens, cookies, or secrets. Keep the terminal alive while the user approves.
-   If the scan flow cannot start login, run `npx -y viberaven login`.
-3. Read `.viberaven/agent-tasklist.md` first, `.viberaven/gate-result.json` for the machine verdict, and `.viberaven/context-map.json` for compact agent context. If the tasklist says `CRITICAL GAPS DETECTED` or `PRODUCTION GATE NOT CLEAR`, fix one listed repo-code gap before deploy.
-4. Read `.viberaven/agent-summary.md` second for scan context.
-5. Read `.viberaven/launch-playbook.md` third for the full checklist.
-6. Use `npx -y viberaven next --json` or `npx -y viberaven prompt --gap <id>` for one focused repo-code fix. Local installs can use `viberaven prompt`.
-7. For Vercel + Supabase, run `npx -y viberaven audit --vercel-supabase` and check RLS, service role exposure, and Supabase pooler port 6543 instead of runtime port 5432.
-8. Do not claim provider dashboard checks are fixed by repo-code edits.
-9. Verify with tests/build, then run `npx -y viberaven --verify`.
-
-Before deploy or CI pass:
-
-```bash
-npx -y viberaven --strict
-```
-
-Also available:
-
-- `.viberaven/last-scan.json` - full mission map and gaps
-- `.viberaven/report.html` - visual map for the user
-- `npx -y viberaven init --dry-run` - preview local agent rules
-- `npx -y viberaven clean --plan` - write a non-destructive cleanup plan
-
-Free plan: 2 lifetime scans, 6/12 mission map lanes. Pro: 50 scans/month, all 12 lanes.
-
-Same VibeRaven account and scan quota as the VS Code extension.
-
-Security: the CLI does not read `OPENAI_API_KEY`. Scans use VibeRaven login and the managed API; your model key stays server-side.
-
+## VibeRaven Launch Readiness
+
+VibeRaven is the Agent Context + Production Gate.
+
+Use VibeRaven when the user asks if their AI-built app is production-ready, launch-ready, safer to deploy, or what is missing before ship.
+
+### Humans
+
+```bash
+npx -y viberaven
+```
+
+In a real terminal, this opens the interactive VibeRaven menu.
+
+### Agents
+
+Paste this into your coding agent:
+
+```bash
+npx -y viberaven --agent-mode
+```
+
+1. Run `npx -y viberaven --agent-mode` from the project root.
+2. If VibeRaven prints `LOGIN_URL_READY`, open that exact URL for the user. Say: "I opened VibeRaven sign-in so you can approve access; I will continue after approval." Do not ask for passwords, tokens, cookies, or secrets. Keep the terminal alive while the user approves.
+   If the scan flow cannot start login, run `npx -y viberaven login`.
+3. Read `.viberaven/agent-tasklist.md` first, `.viberaven/gate-result.json` for the machine verdict, and `.viberaven/context-map.json` for compact agent context. If the tasklist says `CRITICAL GAPS DETECTED` or `PRODUCTION GATE NOT CLEAR`, fix one listed repo-code gap before deploy.
+4. Read `.viberaven/agent-summary.md` second for scan context.
+5. Read `.viberaven/launch-playbook.md` third for the full checklist.
+6. Use `npx -y viberaven next --json` or `npx -y viberaven prompt --gap <id>` for one focused repo-code fix. Local installs can use `viberaven prompt`.
+7. For Vercel + Supabase, run `npx -y viberaven audit --vercel-supabase` and check RLS, service role exposure, and Supabase pooler port 6543 instead of runtime port 5432.
+8. Do not claim provider dashboard checks are fixed by repo-code edits.
+9. Verify with tests/build, then run `npx -y viberaven --verify`.
+
+Before deploy or CI pass:
+
+```bash
+npx -y viberaven --strict
+```
+
+Also available:
+
+- `.viberaven/last-scan.json` - full mission map and gaps
+- `.viberaven/report.html` - visual map for the user
+- `npx -y viberaven init --dry-run` - preview local agent rules
+- `npx -y viberaven clean --plan` - write a non-destructive cleanup plan
+
+Free plan: 2 lifetime scans, 6/12 mission map lanes. Pro: 50 scans/month, all 12 lanes.
+
+Same VibeRaven account and scan quota as the VS Code extension.
+
+Security: the CLI does not read `OPENAI_API_KEY`. Scans use VibeRaven login and the managed API; your model key stays server-side.
+