aiblueprint-cli 1.4.85 → 1.4.87

package/agents-config/skills/app-icon/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: app-icon
-description: Generate a polished iOS + Android app icon for an Expo / React Native app with AI image generation, then post-process it to App Store / Play specs. Use for "create my app icon", "generate the iOS icon", "redo the app logo", "make the launcher icon". Requires an image-generation tool (Codex imagegen / gpt-image); without one it builds the prompt for you to run, then resumes at post-processing.
+description: Generate a premium, vibrant, dimensional iOS + Android app icon for an Expo / React Native app with AI image generation, then post-process it to App Store / Play specs. Use for "create my app icon", "generate the iOS icon", "redo the app logo", "make the launcher icon". Works with ANY image-generation tool (Codex `image_gen`, `gemini-cli` Nano Banana, gpt-image, …).
 argument-hint: "[app concept or brand]"
 ---
 
@@ -8,11 +8,25 @@ argument-hint: "[app concept or brand]"
 
 Generate a store-quality launcher icon (iOS App Store icon + Android adaptive icon + web favicon) for an Expo / React Native app, then post-process it to meet store requirements.
 
+<aesthetic_target>
+The target is a **premium, vibrant, dimensional** icon like top App Store featured apps — NOT a flat pictogram. See `references/` for the north star:
+
+- `references/example-character-mascot.webp` — what this recipe produces for a character app (glossy 3D mascot + heart, full-bleed warm gradient).
+- `references/example-symbol-object.webp` — what it produces for a symbol / monochrome brand (glossy 3D spark on a deep ink background — proof a one-color brand still gets a dimensional icon, not a flat glyph).
+- `references/inspiration-premium-icons.webp` — external inspiration (soft glossy blob mascot on a vivid gradient tile).
+
+The look every time: **one dimensional hero** (a soft glossy 3D character/mascot, or a bold symbolic object/abstract form) with smooth gradients, soft studio lighting, gentle rim light and a subtle glow, **centered on a full-bleed vivid branded background** that reaches all four edges. Saturated, high-contrast, polished, delightful.
+
+**The #1 failure to avoid:** a flat monochrome pictogram / black-on-white glyph / line icon on a plain white background. If the output looks like an SVG symbol, it is wrong — regenerate.
+</aesthetic_target>
+
 <capability_gate>
-**This workflow requires an image-generation tool** (Codex's `imagegen` skill backed by gpt-image, or any model/agent that can generate raster images).
+**Use ANY image-generation tool you have.** Generate the icon yourself; do not just hand the prompt back if you can run a tool.
 
-- **Codex**: invoke the `imagegen` skill with the prompt below. Generated files land in `~/.codex/generated_images/<session-id>/ig_*.png` — copy them into the repo.
-- **Agent WITHOUT image generation (e.g. Claude Code without an image tool)**: do NOT fake it (no SVG-to-PNG pipelines — that produces flat, amateur results). Instead: build the final prompt from the recipe below, give it to the user to run in their image tool of choice, then resume at the Post-Processing phase with the file they provide.
+- **Codex** → the built-in **`image_gen`** tool. Generate, then copy the file into the repo.
+- **`gemini-cli` available** (the api2cli CLI — `gemini-cli image generate`) → use it directly; it is excellent for icons (exact command in `<generation_loop>`). One-time auth: `gemini-cli auth set <GOOGLE_API_KEY>`. (Install: `npx api2cli bundle gemini && npx api2cli link gemini`.)
+- **Any other raster image tool** (gpt-image, an MCP image tool, Imagen, etc.) → use it with the prompt from `<icon_recipe>`.
+- **Truly no image tool reachable** → do NOT fake it (no SVG-to-PNG pipelines — that produces flat, amateur results). Build the final prompt from `<icon_recipe>`, give it to the user to run, then resume at `<post_processing>` with the file they provide.
 </capability_gate>
 
 <locate_assets>
@@ -23,9 +37,7 @@ Find where this app's icon actually lives before writing anything. Read the Expo
 - Android adaptive background color → `expo.android.adaptiveIcon.backgroundColor`
 - Web favicon → `expo.web.favicon` (commonly `./assets/favicon.png`)
 
-In a monorepo the app may live under `mobile-app/` or `apps/<name>/` — resolve paths relative to the Expo project root, not the repo root. Below, `<ASSETS>` means that app's resolved assets directory.
-
-Pull the **brand colors** and **app concept/name** from the project (a brand/site config, the README, or just ask the user). Use color *names* in the prompt, never hex.
+In a monorepo the app may live under `mobile-app/` or `apps/<name>/` — resolve paths relative to the Expo project root. Below, `<ASSETS>` means that app's resolved assets directory. Pull **brand colors** and **app concept/name** from the project (a brand/site config, the README, or ask the user). Use color *names* in the prompt, never hex.
 </locate_assets>
 
 <objective>
@@ -37,125 +49,92 @@ Pull the **brand colors** and **app concept/name** from the project (a brand/sit
 </objective>
 
 <icon_recipe>
-A layered prompt that avoids the common app-icon failure modes (baked rounded tiles, logo plates, accidental text, drop-shadow "floating card" look, unwanted mascots). Fill the two project blanks — **Subject** (the product's core concept/mascot/symbol) and the **Color palette** (named brand colors, never hex) — then send the entire block as one prompt to the image model.
-
-Counter-intuitive but critical: tell the model it is **NOT** making an app-icon tile. Models bake in rounded-square plates, outer margins, and drop shadows the moment they hear "app icon". You want a full-bleed square subject filling 92-98% of the canvas; iOS applies its own mask afterward.
+Fill the two project blanks — **Subject** (the product's concept/mascot/symbol) and the **Color palette** (named brand colors, never hex) — then send the whole block as ONE prompt to your image tool.
 
 ```
-Create a 1024x1024 square symbol illustration.
-
-Subject: <single centered mark for <AppName> — the product's core concept/mascot/symbol, highly readable at small sizes>
-
-Context: standalone symbol/illustration for general use, not an app launcher icon or UI mockup.
-Do not design or imply an app icon, logo plate, badge, or rounded-square container, even if the words "app icon" or "logo" appear.
-Do not draw an icon inside a larger canvas. No outer margins, padding, or separate card background.
-Do not draw any rounded-square tile, card, or container behind the subject.
-The canvas itself is a perfect square with sharp 90° corners; do not simulate rounded-corner app icon masks or device-rounded corners.
-No global drop shadows, long cast shadows, outer glows, or halos around the subject or canvas.
-No UI mockups. No borders, frames, stickers, app plates, or device chrome.
-No text/typography (letters, numbers, monograms). No watermark.
-Not a full photo/portrait/real-world scene. No realistic human faces as the main subject.
-Do not copy or imitate real brand logos, trademarked shapes, or recognizable brand marks.
-
-Archetype (internal decision, do not mention in the output):
-Choose exactly ONE archetype: object_icon, abstract_form_icon, hybrid_icon, or character_icon. Characters are optional and must only be used when clearly appropriate; never the default.
-- object_icon: a single physical/symbolic object without a face (finance, productivity, utilities, dev tools, dashboards, system apps).
-- abstract_form_icon: pure form/metaphor without literal objects or faces (AI tools, design tools, analytics, experimental products).
-- hybrid_icon: an object with subtle life cues (no face), friendly but restrained (health, lifestyle).
-- character_icon: a friendly expressive character with a face (kids, games, beginner education, wellness, fun social).
-
-Concept:
-Design a single, intentional visual element that represents the app. Avoid generic logos and the most literal/obvious metaphor; choose a clear but slightly unexpected metaphor.
-Creativity means unusual material choices, unexpected-but-clear metaphors, expressive lighting, playful proportions, premium texture decisions. It does NOT mean always adding eyes/faces or always making it cute.
-
-Material:
-Default to an illustration-friendly matte finish (painted polymer, ceramic, paper, or flat vector). Avoid glass/chrome/neon unless explicitly requested. Material choice should communicate the product category.
-
-Composition:
-Main subject fills 92-98% of the canvas. Strong silhouette. No unnecessary elements.
-
-Lighting:
-Soft, controlled lighting. Minimal specular highlights. No bloom/glow/lens flares. No "3D glass icon" look.
-
-Overall feel:
-Modern, bold, subject-first illustration (not an app icon layout). Creative without being childish. Readable at small sizes. Clean illustration / 2D or 2.5D, matte finish, subtle shading only.
-
-Color palette: <brand colors as names — e.g. "warm peach background, deep ink subject">. Clean contrast on both light and dark backgrounds.
-
-Technical constraints:
-Square 1:1 aspect ratio.
-Main subject fills 92-98% of the canvas (zoom in; avoid excessive empty space).
-Center/balance the silhouette. Keep critical details within ~5-8% safe area.
-Android-safe: keep critical details within the central ~70% (silhouette may extend).
-Background extends to all four edges of the square canvas with straight (non-rounded) corners; keep it clean (low-detail, low-noise).
-Default-look guardrail: avoid inflated glass/chrome/neon/glow/sparkles/lens flare/exaggerated shine unless explicitly requested.
-
-Quality filters (internal):
-Reject if: it reads like a photo/portrait/full scene; it becomes a mascot by default; too many elements hurt clarity; a face appears without choosing character_icon; any rounded-square/card/tile background or app-icon container appears behind the subject.
-Accept if: instant read at small size; strong silhouette; intentional material; clean contrast on both light and dark backgrounds.
-
-Icon QA (internal): blur test (~64px), small-size readability, wallpaper contrast, one focal point.
-```
+Create a 1024x1024 square app icon — premium, vibrant and dimensional, in the style of top App Store featured apps.
 
-**Optional style preset.** Lock a look as a HARD constraint (it wins any conflict) by appending a dominant style block before the technical constraints. Useful named looks: `minimalism`, `glassy`, `geometric`, `gradient`, `flat`, `material`, `clay`, `kawaii`. Example for `minimalism`:
+Subject: <single hero for <AppName> — a friendly soft 3D character/mascot with simple dot eyes, OR a bold symbolic object/abstract form; instantly readable at small sizes>
 
-```
-STYLE SYSTEM: MINIMALISM (dominant — if anything conflicts, the style wins)
-Cultural DNA: Swiss design, Apple, Braun, Dieter Rams, Functionalism.
-Visual traits: max 3 colors; simple primary silhouettes; large negative space; no textures; no effects.
-Mandatory: readable at very small sizes; works in monochrome; single dominant symbol.
-Forbidden: gradients, shadows, 3D effects, decorative details, textures.
+The look (north star): one dimensional hero rendered in soft glossy 3D (or rich 2.5D) — smooth color gradients, soft studio lighting, gentle rim light, a subtle soft glow, rounded volumes and real depth — centered on a FULL-BLEED vivid branded background (solid color or smooth gradient) that reaches all four edges. Saturated, high-contrast, polished, delightful. Like a soft glossy jelly/clay form with tasteful highlights.
+
+Background: fill the ENTIRE square edge-to-edge with a bold branded color or smooth gradient (e.g. a vivid blue gradient, or a deep dark backdrop for high contrast). Never plain white, never empty. The background is part of the icon.
+
+Subject treatment: dimensional and glossy — soft rounded 3D forms, smooth gradients, gentle highlights and rim light, a subtle inner glow, clear depth and volume. Rich saturated color. One strong, simple silhouette.
+
+Composition: the hero centered, filling ~60-80% of the canvas with comfortable breathing room; the branded background fills the rest to the edges. One focal point, no clutter.
+
+If the brand is monochrome (one ink + one accent), STILL make it fully dimensional and premium — glossy 3D form, tonal gradients within the brand color, soft lighting, a bold full-bleed background. Never a flat single-color glyph.
+
+Do NOT: flat monochrome pictogram, black-on-white glyph, single-color line/silhouette icon, plain SVG/vector symbol, sticker or clip-art; plain white or empty background; a smaller rounded card/icon floating inside the canvas (no icon-in-icon, no outer margins); baked rounded app-icon corners or device-rounded corners (keep a full square with sharp 90 degree corners — iOS applies its own mask); any text, letters, numbers, monograms or watermark; realistic human faces or photos as the main subject; real or trademarked brand logos; mirror chrome, garish neon, or lens flares.
+
+Color palette: <brand colors as names — e.g. "vivid blue gradient background, soft white-to-sky-blue glossy character with subtle highlights">. High saturation, strong contrast on the home screen.
+
+Technical: square 1:1; background bleeds to all four edges with sharp corners; keep critical details within the central ~70% so an Android circular/rounded mask never clips them; punchy and readable at 60px (blur test).
 ```
 
-Non-negotiable for iOS (enforced in Post-Processing, not the prompt): the saved `icon.png` must have **no baked rounded corners** (iOS applies the mask), **no transparency** (App Store rejects alpha in the marketing icon), and stay **readable at 60px**.
+**Archetype** (pick one, internal): a friendly **character/mascot** (simple dot eyes) is a strong default for consumer / social / wellness / AI apps; a **symbolic object or abstract form** fits finance, productivity, dev tools, utilities. Don't force a face onto a utility, and don't flatten a playful app into a glyph.
 </icon_recipe>
 
 <generation_loop>
-1. Generate the icon (1-3 candidates if the concept is open).
-2. **Visually inspect every output** (open/read the images): strong silhouette? readable at small size? no baked rounded-square tile / no drop-shadow card? no accidental text or watermark? no transparency artifacts?
-3. Reject and regenerate what fails — refine the prompt, don't accept "almost".
-4. **Safety-filter gotcha**: a prompt can be rejected for ambiguous wording with harmless content. Reword to simple, neutral, single-paragraph phrasing and retry.
-5. **Blur test:** shrink to ~64px — if the mark turns to mush, the concept is too detailed; simplify the silhouette.
+1. **Generate** with your tool. With `gemini-cli` the validated command (Nano Banana Pro) is:
+   ```bash
+   PROMPT="$(cat <<'EOF'
+   <paste the filled icon_recipe prompt here>
+   EOF
+   )"
+   gemini-cli image generate --prompt "$PROMPT" \
+     --model gemini-3-pro-image-preview --aspect-ratio 1:1 --image-size 2K \
+     --out ./icon-raw.png --images-only --json
+   ```
+   (`gemini-3-pro-image-preview` = Nano Banana Pro, best for icons; `gemini-2.5-flash-image` is the cheaper fallback. Codex: use the `image_gen` tool with the same prompt.)
+2. **Visually inspect** every output: premium and dimensional (glossy 3D, depth)? full-bleed branded background (NOT white)? strong simple silhouette? readable at small size? NO flat-glyph look, NO accidental text/watermark?
+3. **Reject and regenerate** anything that drifts flat/monochrome/SVG-like or lands on a white background — tighten the prompt, don't accept "almost".
+4. **Safety-filter gotcha:** reword ambiguous prompts to a plain neutral paragraph and retry.
+5. **Blur test:** shrink to ~64px — if the mark turns to mush, simplify the silhouette.
 </generation_loop>
 
 <post_processing>
-macOS uses `sips` (built in) + ImageMagick (`magick`, `brew install imagemagick`). Replace `<ASSETS>` and `<brand-bg-color>` with the values from `<locate_assets>`.
+Models often **bake rounded corners or a light border** around the tile. Scale up slightly and center-crop so the rounded ring falls off-canvas, leaving a true full-bleed square. `sips` is built into macOS; ImageMagick (`magick`, `brew install imagemagick`) is only needed for Android padding. Replace `<ASSETS>` and `<brand-bg-color>` with the values from `<locate_assets>`.
 
 ```bash
-# 1. iOS icon: enforce 1024x1024 and strip alpha (App Store requirement)
-sips -z 1024 1024 icon-raw.png --out /tmp/icon-1024.png
-magick /tmp/icon-1024.png -background "<brand-bg-color>" -alpha remove -alpha off <ASSETS>/icon.png
-# (no ImageMagick? `sips -s format jpeg /tmp/icon-1024.png --out /tmp/icon.jpg` then back to png also strips alpha)
+# 1. Full-bleed fix: push any baked rounded corners / border off-canvas, then normalize to 1024.
+sips -z 1126 1126 icon-raw.png --out /tmp/icon-up.png             # scale up ~10%
+sips -c 1024 1024 /tmp/icon-up.png --out /tmp/icon-fullbleed.png  # center-crop to 1024 square
+#    (skip step 1 if the generated background already bleeds to sharp corners.)
+
+# 2. iOS icon: enforce 1024 and guarantee NO transparency (App Store rejects alpha).
+sips -s format png /tmp/icon-fullbleed.png --out <ASSETS>/icon.png
+sips -g hasAlpha <ASSETS>/icon.png   # must say: hasAlpha no
+#    If it reports alpha, flatten: magick in.png -background "<brand-bg-color>" -alpha remove -alpha off <ASSETS>/icon.png
 
-# 2. Android adaptive icon: pad the subject into the central ~66% safe circle on a brand background.
-#    Scaling the full-bleed icon to ~66% places the SUBJECT inside the safe zone; the brand-bg extent fills the rest.
+# 3. Android adaptive icon: pad the subject into the central ~66% safe circle on a brand background.
 magick <ASSETS>/icon.png -resize 66% -background "<brand-bg-color>" -gravity center -extent 1024x1024 <ASSETS>/adaptive-icon.png
-#    Then make sure app config matches: expo.android.adaptiveIcon.backgroundColor == <brand-bg-color>.
-#    (For a cleaner result you can instead re-run the recipe with "leave ~20% padding for Android adaptive safe zone".)
+#    Make app config match: expo.android.adaptiveIcon.backgroundColor == <brand-bg-color>.
+#    No magick? Re-run the recipe adding "leave ~20% padding for the Android adaptive safe zone".
 
-# 3. Favicon + verification
+# 4. Favicon + final verification
 sips -z 192 192 <ASSETS>/icon.png --out <ASSETS>/favicon.png
 sips -g pixelWidth -g pixelHeight -g hasAlpha <ASSETS>/icon.png <ASSETS>/adaptive-icon.png <ASSETS>/favicon.png
-# icon.png MUST report hasAlpha: no
 ```
 
 Remember: **icon and adaptive-icon changes require a native rebuild** (`npx expo run:ios` / `npx expo run:android`, or a new EAS build) — they will NOT appear on hot reload. The favicon is a web asset and reloads normally.
 </post_processing>
 
 <render_verification>
-File inspection is not enough for the launcher icon — confirm it on a device/simulator after a native rebuild.
+File inspection is not enough — confirm the icon on a device/simulator after a native rebuild.
 
-1. Rebuild the dev client so the new icon is bundled (`npx expo run:ios` or `npx expo run:android`).
-2. On the home screen, confirm: the icon shows the new art (not the old/default), iOS applies a clean rounded mask with no double-rounding or visible alpha edge, and the mark is readable at home-screen size.
-3. Fail the run if the icon still shows the previous art or a transparent/white corner halo. Fix before reporting completion.
+1. Rebuild the dev client (`npx expo run:ios` or `npx expo run:android`).
+2. On the home screen confirm: the new art shows (not the old/default), iOS applies a clean rounded mask with **no double-rounding and no white/transparent corner halo**, and the mark is readable at home-screen size.
+3. Fail the run if the icon still shows the previous art, a flat glyph, or a corner halo. Fix before reporting completion.
 </render_verification>
 
 <failure_modes>
-- Generated icon has transparency or baked rounded corners → App Store rejection; strip alpha (`-alpha remove`), regenerate without any tile/mask.
-- iOS shows a white/transparent corner halo → alpha was not stripped; re-run the `magick ... -alpha remove -alpha off` step and rebuild.
-- Android adaptive icon looks cropped at the edges → subject sat outside the central 66% safe circle; increase padding (lower the `-resize` percentage) or regenerate with explicit padding.
+- **Flat monochrome glyph / black-on-white pictogram** (the most common, worst failure) → the prompt leaned minimal/matte; re-emphasize "premium vibrant dimensional, glossy 3D, full-bleed branded background, NOT a flat SVG symbol", and regenerate.
+- White/transparent corner halo after the iOS mask → baked rounded corners; run the step-1 scale-up + center-crop, verify `hasAlpha no`, rebuild.
+- Generated icon has transparency → App Store rejection; flatten onto the brand bg (`magick ... -alpha remove -alpha off`).
+- Android adaptive icon looks cropped at the edges → subject sat outside the central 66% safe circle; increase padding or regenerate with explicit padding.
 - Icon unchanged after editing the PNG → no native rebuild; hot reload never updates the launcher icon.
-- Flat/amateur output → prompt missed the "subject-first illustration, not an app icon layout" + matte/material anchors, or fell back to a generic logo.
-- Prompt rejected by safety filter → reword neutrally, simplify to one plain paragraph; content was almost certainly fine.
+- Prompt rejected by safety filter → reword neutrally, simplify to one plain paragraph.
 - Mark turns to mush at small size → too detailed; simplify to a single strong silhouette (blur/64px test).
 </failure_modes>

package/agents-config/skills/appstore-connect/SKILL.md

@@ -1,12 +1,17 @@
 ---
 name: appstore-connect
-description: Interact with App Store Connect via the asc CLI - apps, builds, TestFlight, beta testers, reviews, sales/analytics, metadata, IAP, signing, submissions. Use for "check my app", "App Store Connect", "TestFlight status", "app review", "my app sales", or "asc".
+description: Interact with App Store Connect via the asc CLI - apps, builds, TestFlight, beta testers, reviews, sales/analytics, metadata, IAP, signing, submissions. Also builds an Expo/React Native iOS app and ships it to TestFlight via "appstore-connect testflight". Use for "check my app", "App Store Connect", "TestFlight status", "ship to TestFlight", "app review", "my app sales", or "asc".
+argument-hint: "[testflight [--expo] [setup]] | <natural-language ASC request>"
 ---
 
 # App Store Connect (asc)
 
 Read, manage, and ship any of the user's App Store apps through the **`asc`** CLI (App Store Connect CLI by Rork). `asc` covers nearly the entire ASC surface; reach for the raw API only for the rare gap.
 
+<testflight_mode>
+**If invoked as `appstore-connect testflight` (or "build and ship to TestFlight"):** this is a full build-and-upload workflow, not a single `asc` call. Read [references/testflight.md](references/testflight.md) and follow it end to end — it takes an Expo / React Native iOS app from local dev to an installable TestFlight build (ASC API-key signing to avoid Apple ID 2FA, `eas build --local` by default, `--expo` for a cloud build, then `asc publish testflight`). Pass `--expo` for a cloud build, or `testflight setup` to stop after credentials are ready. Everything below is the general `asc` surface for everyday read/manage tasks.
+</testflight_mode>
+
 <auth>
 `asc` is usually already authenticated on this machine (a default keychain profile). Verify before doing real work:
 
@@ -40,6 +45,7 @@ asc docs list              # embedded guides; `asc docs <topic>` to read one
 | List/inspect apps, app id | `asc apps`, `asc status --app <id>` |
 | Builds (processing, ids) | `asc builds` |
 | TestFlight: beta groups, testers, distribute a build | `asc testflight` |
+| **Build an iOS app + ship to TestFlight (end to end)** | `appstore-connect testflight` → [references/testflight.md](references/testflight.md) |
 | Versions / release state | `asc versions`, `asc release`, `asc status` |
 | Metadata, localizations, keywords | `asc metadata`, `asc localizations` |
 | Screenshots / previews | `asc screenshots`, `asc video-previews` |

package/agents-config/skills/appstore-connect/references/testflight.md

@@ -0,0 +1,212 @@
+# TestFlight: build an iOS app and ship it to TestFlight
+
+Loaded for `appstore-connect testflight`. Takes an Expo / React Native iOS app from local dev to an installable TestFlight build, fully non-interactively.
+
+**Two key insights that make this automatable:**
+
+1. **ASC API key signing avoids Apple ID 2FA.** Interactive `eas build` credential setup needs Apple ID 2FA and cannot be scripted. Creating the distribution certificate + App Store provisioning profile through the App Store Connect API (`$SKILL_DIR/scripts/asc-api.mjs`) avoids 2FA entirely.
+2. **`eas build --local` avoids Expo cloud build credits.** Default to the local Mac build with `credentialsSource: "local"`; use `--expo` only when the user explicitly wants a cloud build.
+
+`$SKILL_DIR` is the `appstore-connect` skill directory; `<APP_DIR>` is the Expo project root (often the repo root, or `mobile-app/` / `apps/<name>/` in a monorepo).
+
+## Arguments
+
+- **default** (`appstore-connect testflight`): run setup → local build → upload → verify.
+- **`--expo`**: use the EAS **cloud** build instead of local (consumes EAS build quota — confirm once).
+- **setup-only** (`testflight setup`, "prepare credentials"): run phases A–D, then stop and report readiness.
+
+## Prerequisites (ask once, as a group — the agent cannot create these)
+
+1. **Apple Developer Program** membership (paid, enrolled).
+2. **App Store Connect API key**: the `AuthKey_<KEY_ID>.p8` file, its key ID, and the team issuer ID (App Store Connect → Users and Access → Integrations; needs Admin or App Manager). If unknown, follow [setup.md](setup.md).
+3. **Expo account** logged in: `npx eas-cli@latest whoami` (else `login`).
+4. **App record** in App Store Connect for the bundle ID. The public API **cannot** create app records — if missing, the user creates it once at appstoreconnect.apple.com (My Apps → + → New App). Verified in Phase D.
+5. **`asc` CLI** (`brew install asc`) — used only for the final upload.
+6. For the default local build: macOS with Xcode CLT + CocoaPods (`xcodebuild -version`, `command -v pod`). If missing, stop and ask whether to use `--expo`.
+
+## Critical safety
+
+- Never commit or print `.p8` keys, `.p12` files, p12 passwords, provisioning profiles, or `credentials.json`. Verify `.gitignore` excludes them before any commit.
+- Export ASC credentials as env vars for `asc-api.mjs`; never write them into repo files.
+- Get explicit confirmation before: creating Apple certificates (low per-account limit), `--expo` cloud builds (consumes credits), and the TestFlight upload.
+- Env vars are **baked in at build time** — confirm the production config points at prod backends before building, or testers ship with a dev backend.
+
+## Phase A — Preflight
+
+```bash
+cd <APP_DIR>
+npx tsc --noEmit && npm run lint        # whatever checks the project has
+npx expo-doctor                          # surface config problems early
+npx eas-cli@latest whoami                # Expo account logged in?
+command -v asc && asc version
+xcodebuild -version && command -v pod    # required for default local builds
+```
+
+Confirm the permanent values with the user: app `title`, `bundleId`, Apple `teamId`. The bundle ID is permanent once the app record exists.
+
+Export ASC credentials for the rest of the session:
+
+```bash
+export ASC_KEY_ID="<10-char key id>"
+export ASC_ISSUER_ID="<issuer uuid>"
+export ASC_P8_PATH="/path/to/AuthKey_<KEY_ID>.p8"
+```
+
+## Phase B — EAS project init
+
+Skip if the project already has a real `eas.projectId` (a UUID).
+
+```bash
+cd <APP_DIR>
+npx eas-cli@latest project:init --non-interactive --force
+npx eas-cli@latest project:info
+```
+
+Write the printed project ID into the Expo config (`app.json`/`app.config.ts` → `extra.eas.projectId`, or your project config).
+
+## Phase C — Production env + eas.json
+
+Point the build at production. Set every required production backend env var (auth secrets, API keys, URLs), then wire the prod values into `<APP_DIR>/eas.json → build.production`:
+
+```json
+"production": {
+  "autoIncrement": true,
+  "credentialsSource": "local",
+  "env": {
+    "EXPO_PUBLIC_API_URL": "https://<prod-backend>"
+  }
+}
+```
+
+`credentialsSource: "local"` is what makes Phase E fully non-interactive.
+
+## Phase D — Apple signing credentials via the ASC API
+
+All calls: `node "$SKILL_DIR/scripts/asc-api.mjs" <METHOD> <path> [body.json]` with the Phase A env vars. Work in a directory **outside** the repo (e.g. `~/ios-credentials/<slug>/`) so nothing secret can be committed.
+
+**1. Resolve the app record (hard gate):**
+
+```bash
+node "$SKILL_DIR/scripts/asc-api.mjs" GET "/v1/apps?filter[bundleId]=<bundle_id>"
+```
+
+Empty `data` → STOP: tell the user to create the app record (My Apps → + → New App) with this exact bundle ID, then resume. Otherwise save `app_id = data[0].id`.
+
+**2. Bundle ID registration + capabilities:**
+
+```bash
+node "$SKILL_DIR/scripts/asc-api.mjs" GET "/v1/bundleIds?filter[identifier]=<bundle_id>"
+# if missing: POST /v1/bundleIds {"data":{"type":"bundleIds","attributes":{"identifier":"<bundle_id>","name":"<title>","platform":"IOS"}}}
+# enable capabilities the app uses (IN_APP_PURCHASE, APPLE_ID_AUTH, PUSH_NOTIFICATIONS) via POST /v1/bundleIdCapabilities
+```
+
+**3. Distribution certificate** (Apple caps these at ~2–3 per account — check first):
+
+```bash
+node "$SKILL_DIR/scripts/asc-api.mjs" GET "/v1/certificates?filter[certificateType]=DISTRIBUTION"
+```
+
+Reuse only if the user has its private key/.p12 locally. Otherwise create one (with confirmation):
+
+```bash
+openssl req -new -newkey rsa:2048 -nodes -keyout dist.key -out dist.csr \
+  -subj "/emailAddress=<user-email>/CN=<title> Distribution/C=US"
+node -e "const fs=require('fs');fs.writeFileSync('cert-req.json',JSON.stringify({data:{type:'certificates',attributes:{certificateType:'DISTRIBUTION',csrContent:fs.readFileSync('dist.csr','utf8')}}}))"
+node "$SKILL_DIR/scripts/asc-api.mjs" POST /v1/certificates cert-req.json
+# save body.data.id (cert id) and body.data.attributes.certificateContent (base64) -> dist.cer
+```
+
+**4. App Store provisioning profile:**
+
+```bash
+node -e "const fs=require('fs');fs.writeFileSync('profile-req.json',JSON.stringify({data:{type:'profiles',attributes:{name:'<title> AppStore',profileType:'IOS_APP_STORE'},relationships:{bundleId:{data:{type:'bundleIds',id:'<BUNDLE_DB_ID>'}},certificates:{data:[{type:'certificates',id:'<CERT_ID>'}]},devices:{data:[]}}}}))"
+node "$SKILL_DIR/scripts/asc-api.mjs" POST /v1/profiles profile-req.json
+# save body.data.attributes.profileContent (base64) -> appstore.mobileprovision
+```
+
+**5. Build the `.p12` (the `-legacy` flag is mandatory — Apple tooling rejects OpenSSL 3.x default ciphers):**
+
+```bash
+echo "<certificateContent-b64>" | base64 -d > dist.cer
+P12PASS=$(openssl rand -hex 12)
+openssl x509 -inform der -in dist.cer -out dist.pem 2>/dev/null || cp dist.cer dist.pem
+openssl pkcs12 -export -in dist.pem -inkey dist.key -out dist.p12 \
+  -name "<title> Distribution" -passout pass:"$P12PASS" -legacy
+echo "<profileContent-b64>" | base64 -d > appstore.mobileprovision
+```
+
+**6. Wire into the project (gitignored paths only):**
+
+```bash
+mkdir -p <APP_DIR>/credentials
+cp dist.p12 appstore.mobileprovision <APP_DIR>/credentials/
+node -e "const fs=require('fs');fs.writeFileSync('<APP_DIR>/credentials.json',JSON.stringify({ios:{provisioningProfilePath:'credentials/appstore.mobileprovision',distributionCertificate:{path:'credentials/dist.p12',password:process.argv[1]}}},null,2))" "$P12PASS"
+git check-ignore <APP_DIR>/credentials.json <APP_DIR>/credentials/dist.p12   # MUST print both
+```
+
+**Setup-only mode STOPS here** — report readiness (app record, cert, profile, credentials.json, eas.json) and the next command.
+
+## Phase E — Local iOS build (default)
+
+Uses the local Mac/Xcode toolchain; does **not** consume Expo cloud credits.
+
+```bash
+cd <APP_DIR>
+npx eas-cli@latest build --platform ios --profile production \
+  --local --non-interactive --output /tmp/<slug>.ipa
+```
+
+If `expo-doctor` blocks on dependency patch mismatches, run `npx expo install --check`, apply the minimal patch updates, re-run `npx tsc --noEmit && npm run lint`, then rebuild. Don't blindly upgrade deps mid-release.
+
+## Phase E (--expo) — EAS cloud build
+
+Only when the user passes `--expo` (confirm once — consumes EAS credits):
+
+```bash
+cd <APP_DIR>
+npx eas-cli@latest build --platform ios --profile production --non-interactive --no-wait
+npx eas-cli@latest build:list --platform ios --limit 1 --json --non-interactive   # poll to FINISHED/ERRORED
+curl -sL -o /tmp/<slug>.ipa "<artifacts.buildUrl>"                                  # download on FINISHED
+```
+
+## Phase F — TestFlight upload
+
+**1. Internal beta group** (`asc publish testflight` fails without `--group`):
+
+```bash
+node -e "const fs=require('fs');fs.writeFileSync('group-req.json',JSON.stringify({data:{type:'betaGroups',attributes:{name:'Internal',isInternalGroup:true,hasAccessToAllBuilds:true},relationships:{app:{data:{type:'apps',id:'<app_id>'}}}}}))"
+node "$SKILL_DIR/scripts/asc-api.mjs" POST /v1/betaGroups group-req.json
+# 409 "already exists" is fine — fetch the id: GET "/v1/apps/<app_id>/betaGroups"
+```
+
+**2. Upload and wait** (`asc auth status --validate`, else `asc auth login` with the same ASC key):
+
+```bash
+asc publish testflight --app "<app_id>" --ipa /tmp/<slug>.ipa --group "<BETA_GROUP_ID>" --wait --timeout 45m
+```
+
+**3. Add testers** (internal testers must be ASC team members; external emails work via groups):
+
+```bash
+node -e "const fs=require('fs');fs.writeFileSync('tester-req.json',JSON.stringify({data:{type:'betaTesters',attributes:{email:'<tester-email>'},relationships:{betaGroups:{data:[{type:'betaGroups',id:'<BETA_GROUP_ID>'}]}}}}))"
+node "$SKILL_DIR/scripts/asc-api.mjs" POST /v1/betaTesters tester-req.json
+```
+
+**4. Verify:** `asc status --app "<app_id>" --output table` shows the build processed and attached to the group. Report build number, group, and testers.
+
+## Failure modes
+
+- **`.p12` rejected during signing** → exported without `-legacy`. Re-export with `-legacy`.
+- **Certificate creation 409 / limit reached** → list existing DISTRIBUTION certs; ask which to revoke (`DELETE /v1/certificates/<id>`) or whether the user has its `.p12` to reuse. Never revoke without confirmation — it breaks other apps.
+- **Local build fails before Xcode archive** → check `xcodebuild -version`, `xcode-select -p`, `command -v pod`. If unavailable and the user accepts cloud quota, rerun with `--expo`.
+- **Build asks for credentials** → `credentialsSource: "local"` missing in `eas.json`, or `credentials.json` paths wrong (relative to `<APP_DIR>`).
+- **`asc publish testflight` "--group is required"** → create the beta group first (Phase F step 1).
+- **Upload rejected: missing export compliance** → answer the encryption question once in App Store Connect, or add `"ITSAppUsesNonExemptEncryption": false` to `infoPlist` in the Expo config.
+- **App opens but can't reach backend** → built before `eas.json` had prod URLs, or prod env vars missing. Env is baked at build time — rebuild after fixing.
+- **User insists on EAS-managed credentials (Apple ID login)** → that needs interactive 2FA; run `npx eas-cli@latest credentials` in a real terminal with the user present. Do not script the 2FA prompt.
+
+## Success metrics
+
+- Default local build produces `/tmp/<slug>.ipa` with no interactive prompt; `--expo` cloud builds reach FINISHED.
+- The build shows as processed in TestFlight, attached to a beta group with at least one tester.
+- `git status` shows no credential files staged; nothing secret printed in the transcript.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiblueprint-cli",
-  "version": "1.4.85",
+  "version": "1.4.87",
   "description": "AIBlueprint CLI for setting up AI coding configurations",
   "author": "AIBlueprint",
   "license": "MIT",

package/agents-config/skills/codex-environment/SKILL.md

@@ -1,184 +0,0 @@
----
-name: codex-environment
-description: Create, inspect, or repair Codex app Local Environment configuration for worktrees, including .codex/environments/environment.toml, setup and cleanup scripts, worktree up/down scripts, copied env files, isolated databases, and reusable app actions.
-disable-model-invocation: true
-allow_implicit_invocation: false
----
-
-# Codex Environment
-
-Use this skill when the user asks about Codex Local Environments, worktree setup scripts, cleanup scripts, Codex actions, `.codex/environments/environment.toml`, `CODEX_WORKTREE_PATH`, `CODEX_SOURCE_TREE_PATH`, or making a worktree ready to run.
-
-## What We Learned
-
-- Codex app Local Environments are project config, not one-off terminal commands.
-- The shareable config lives at `.codex/environments/environment.toml` at the project root.
-- Setup scripts run when Codex creates a new worktree for a new thread.
-- Cleanup scripts run before Codex cleans up the worktree.
-- Actions appear in the Codex app top bar and run in the integrated terminal.
-- Worktrees only contain checked-in files, so ignored files like `.env` must be copied or recreated by setup.
-- Prefer short setup/cleanup entries that call versioned project scripts instead of long inline shell.
-- Keep executable entrypoints in `scripts/`, for example `scripts/worktree-up` and `scripts/worktree-down`.
-- Keep `.codex` focused on Codex config; keep operational logic in `scripts/`.
-- Do not commit secrets. It is fine for setup to copy ignored env files locally.
-- For projects with local databases, setup should create a worktree-specific DB name and rewrite the copied `.env` to point to it.
-- Cleanup should drop only the worktree-specific databases and remove copied local env files.
-- Use `CODEX_SOURCE_TREE_PATH` for the original project checkout and `CODEX_WORKTREE_PATH` for the new worktree when available.
-
-## Preferred Shape
-
-Create or update:
-
-```text
-.codex/
-└── environments/
-    └── environment.toml
-scripts/
-├── worktree-up
-├── worktree-down
-├── codex-dev.sh
-└── project-specific helpers...
-```
-
-Use this `environment.toml` pattern:
-
-```toml
-# THIS IS AUTOGENERATED. DO NOT EDIT MANUALLY
-version = 1
-name = "Project Worktree"
-
-[setup]
-script = "cd \"$CODEX_WORKTREE_PATH\"\nscripts/worktree-up"
-
-[cleanup]
-script = "cd \"$CODEX_WORKTREE_PATH\"\nscripts/worktree-down"
-
-[[actions]]
-name = "Dev"
-icon = "tool"
-command = "scripts/codex-dev.sh"
-
-[[actions]]
-name = "Typecheck"
-icon = "tool"
-command = "pnpm ts"
-
-[[actions]]
-name = "Unit tests"
-icon = "tool"
-command = "pnpm test:ci"
-
-[[actions]]
-name = "Lint"
-icon = "tool"
-command = "pnpm lint:ci"
-```
-
-Keep setup script content small:
-
-```bash
-#!/usr/bin/env bash
-set -euo pipefail
-
-cd "${CODEX_WORKTREE_PATH:-$(pwd)}"
-scripts/make-worktree-ready.sh
-```
-
-Keep cleanup script content small:
-
-```bash
-#!/usr/bin/env bash
-set -euo pipefail
-
-cd "${CODEX_WORKTREE_PATH:-$(pwd)}"
-scripts/worktree-db-down.sh
-```
-
-## Setup Script Rules
-
-When writing `scripts/worktree-up` or its helper:
-
-- Start with `set -euo pipefail`.
-- `cd "${CODEX_WORKTREE_PATH:-$(pwd)}"` before touching files.
-- Locate the source checkout with `CODEX_SOURCE_TREE_PATH`, then a project-specific fallback like `$HOME/Developer/saas/<repo>`.
-- Copy ignored env files from source to worktree, usually `.env`, `.env.local`, and `.env.development.local`.
-- Prefer project package manager conventions, for example `pnpm install`, never `npm install` in a pnpm repo.
-- Create a deterministic worktree DB name from the branch or target worktree, replacing `/` with `-`.
-- Rewrite only DB-related env values in the copied `.env`.
-- Run project generation steps needed after env setup, for example `pnpm prisma:generate`.
-- Make reruns idempotent. If the DB already exists, skip import unless a reset env var is set.
-- Add an explicit reset escape hatch such as `LUMAIL_RESET_DB=1`.
-
-## Cleanup Script Rules
-
-When writing `scripts/worktree-down` or its helper:
-
-- Read DB names from the worktree `.env`, not from guessed branch names.
-- Drop only the DBs referenced by the worktree env.
-- Use `dropdb --if-exists` and a maintenance database.
-- Remove copied local env files from the worktree after DB cleanup.
-- If env files or PostgreSQL tools are missing, exit cleanly with a short message.
-
-## Actions
-
-Use actions for commands the user will run often:
-
-- `Dev`: start the app, ideally via a script that finds a free port.
-- `Typecheck`: `pnpm ts`, `npm run typecheck`, or equivalent.
-- `Unit tests`: the project unit test command.
-- `Lint`: the CI lint command.
-- `E2E`: optional, only if it is not too expensive/noisy for a quick action.
-
-For dev servers, prefer a script like:
-
-```bash
-#!/usr/bin/env bash
-set -euo pipefail
-
-cd "${CODEX_WORKTREE_PATH:-$(pwd)}"
-
-port="${CODEX_DEV_PORT_START:-3910}"
-while lsof -nP -iTCP:"$port" -sTCP:LISTEN >/dev/null 2>&1; do
-  port=$((port + 1))
-done
-
-echo "Starting app on http://localhost:$port"
-exec pnpm dev -p "$port"
-```
-
-## Verification
-
-After editing a Codex environment:
-
-```bash
-bash -n scripts/worktree-up scripts/worktree-down
-sed -n '1,220p' .codex/environments/environment.toml
-git status --short
-```
-
-If Python 3.11+ is available, validate TOML:
-
-```bash
-python3 - <<'PY'
-import tomllib
-with open(".codex/environments/environment.toml", "rb") as f:
-    tomllib.load(f)
-PY
-```
-
-## Guardrails
-
-- Do not read or write `.conductor` directories.
-- Do not print full env values or secrets in logs; print only DB names or redacted hosts.
-- Do not create duplicate environments when the user already has one; update the existing `.codex/environments/environment.toml`.
-- Do not put large fragile shell programs directly in TOML strings.
-- Do not hardcode a dev port unless the user asks; pick a free port or allow `PORT`.
-- Do not drop databases unless their names come from the worktree env or from an explicit user-provided target.
-- If the environment is meant for future worktrees, ensure the `.codex` config and scripts are present in the source checkout/main branch, not only the current Codex worktree.
-
-## Online References
-
-- OpenAI Codex Local Environments: https://developers.openai.com/codex/app/local-environments
-- OpenAI Codex Worktrees: https://developers.openai.com/codex/app/worktrees
-- `CODEX_SOURCE_TREE_PATH` / `CODEX_WORKTREE_PATH` community note: https://zenn.dev/route06/articles/c1f686b4479957
-- Codex app environment TOML practice note: https://zenn.dev/devneko/articles/8a5f6f44adf606

package/agents-config/skills/ios-testflight/SKILL.md

@@ -1,280 +0,0 @@
----
-name: ios-testflight
-description: Build a NowStack Mobile iOS app and upload it to TestFlight. Defaults to local `eas build --local`; use `--expo` only when the user explicitly wants an EAS cloud build.
----
-
-# iOS TestFlight - NowStack Mobile
-
-Take a working NowStack Mobile app from local dev to an installable TestFlight build. Run phases A-D for setup only (stop before the build, report readiness); run all phases end to end to build and upload. This is the iOS beta surface; for App Store review use `ns-ios-distribute`.
-
-Default build mode is **local Mac build** with `eas build --local`, so it does not consume Expo/EAS cloud build credits. If the user passes `--expo`, opt into the EAS cloud build path instead.
-
-<objective>
-Go from "the app works in the simulator" to "a build is installable from TestFlight" with maximum automation. Default to the local Mac build path to preserve Expo cloud credits; use `--expo` only when the user asks for a cloud build. Everything used here ships in this repo or is a public CLI (`eas-cli`, `asc`, `openssl`, `node`).
-
-The proven flow (battle-tested on a real app built from this boilerplate):
-
-1. Create the EAS project and wire `easProjectId` into `site-config.ts`.
-2. Deploy Convex to production and set prod env vars.
-3. Point `eas.json` production env at the prod Convex URLs.
-4. Create Apple signing credentials (distribution cert + App Store provisioning profile) through the **App Store Connect API** using `mobile-app/scripts/asc-api.mjs` — no browser, no Apple ID 2FA.
-5. Run a local signed App Store IPA build with `eas build --local`, `credentialsSource: "local"`, and an explicit `--output /tmp/{slug}.ipa`.
-6. Upload the `.ipa` to TestFlight with `asc publish testflight` into an internal beta group.
-
-The key insight: interactive `eas build` credential setup requires Apple ID 2FA and cannot be automated reliably. The ASC API key path avoids 2FA entirely, and local `eas build --local` avoids Expo cloud build credits while still using the same local signing files.
-</objective>
-
-<arguments>
-- Default / no flag: run setup, local build, upload, and verify.
-- `--expo`: use the EAS cloud build phase instead of local build. This consumes Expo/EAS build quota and requires explicit user confirmation.
-- Setup-only requests (`ios setup`, "prepare TestFlight", "credentials only"): run phases A-D, then stop before any build/upload.
-</arguments>
-
-<prerequisites>
-The user must have (ask once, as a group — these cannot be created by the agent):
-
-1. **Apple Developer Program membership** (paid, enrolled).
-2. **App Store Connect API key**: the `AuthKey_<KEY_ID>.p8` file, its key ID, and the team issuer ID. If unknown, follow the `appstore-connect` skill's setup workflow (`references/setup.md`), or point the user to App Store Connect > Users and Access > Integrations > App Store Connect API (key must have Admin or App Manager role).
-3. **Expo account** logged in: `npx eas-cli@latest whoami` (else `npx eas-cli@latest login`).
-4. **App record in App Store Connect** for the bundle ID. The public API cannot create app records — if missing, the user creates it once at appstoreconnect.apple.com (My Apps > + > New App, selecting the bundle ID). Verify with Phase D step 1 and stop with clear instructions if absent.
-5. `asc` CLI installed (`brew install asc`) — used only for the final upload; everything else goes through `scripts/asc-api.mjs`.
-6. For the default local build: macOS with Xcode command line tools and CocoaPods (`xcodebuild -version`, `command -v pod`). If those are unavailable, stop and ask whether to use `--expo`.
-</prerequisites>
-
-<state_variables>
-| Variable | Source |
-| --- | --- |
-| `{bundle_id}` | `SiteConfig.bundleId` |
-| `{apple_team_id}` | `SiteConfig.appleTeamId` |
-| `{eas_project_id}` | output of `eas project:init`, then written to `site-config.ts` |
-| `{asc_key_id}` / `{asc_issuer_id}` / `{asc_p8_path}` | from the user / the `appstore-connect` skill's `references/setup.md`. Never commit, never print. |
-| `{convex_prod_url}` / `{convex_prod_site_url}` | from `npx convex deploy` output / Convex dashboard |
-| `{asc_app_id}` | numeric app ID resolved from the bundle ID (Phase D) |
-| `{build_mode}` | default `local`; `expo` only when the user passes `--expo` |
-| `{ipa_path}` | `/tmp/{slug}.ipa` from local build, or downloaded cloud artifact |
-</state_variables>
-
-<critical_safety>
-- Never commit or print `.p8` keys, `.p12` files, p12 passwords, provisioning profiles, or `credentials.json`. The repo `.gitignore` already excludes them — verify before any commit.
-- Export ASC credentials as env vars for `scripts/asc-api.mjs`; do not write them into files inside the repo.
-- Get explicit user confirmation before: creating Apple certificates (accounts have a low cert limit), using `--expo` cloud EAS builds (consumes build credits), and the TestFlight upload.
-- Local builds do not consume Expo cloud credits, but they still sign a production App Store IPA and may increment the remote EAS build number when `appVersionSource` is `remote`.
-- Builds bake env vars in permanently: confirm `eas.json` points at the PROD Convex deployment before building, or testers ship with a dev backend.
-</critical_safety>
-
-<phase n="A" title="Preflight">
-From the repo root:
-
-```bash
-npm run check-setup          # must be free of errors (easProjectId warning is expected pre-init)
-cd mobile-app && npx tsc --noEmit && npm run lint
-npx eas-cli@latest whoami    # Expo account logged in?
-command -v asc && asc version
-xcodebuild -version && command -v pod   # required for default local builds
-```
-
-Read `site-config.ts` and confirm with the user: `title`, `bundleId`, `appleTeamId`, payment product IDs. The bundle ID is permanent once the app record exists — it must be final now.
-
-Export the ASC credentials for the rest of the session:
-
-```bash
-export ASC_KEY_ID="<10-char key id>"
-export ASC_ISSUER_ID="<issuer uuid>"
-export ASC_P8_PATH="/path/to/AuthKey_<KEY_ID>.p8"
-```
-</phase>
-
-<phase n="B" title="EAS project init">
-Skip if `easProjectId` in `site-config.ts` is already a real UUID.
-
-```bash
-cd mobile-app
-npx eas-cli@latest project:init --non-interactive --force
-npx eas-cli@latest project:info
-```
-
-Write the printed project ID into `site-config.ts > easProjectId`. Re-run `npm run check-setup` — the easProjectId warning must be gone.
-</phase>
-
-<phase n="C" title="Convex production + eas.json">
-Follow `docs/production-checklist.md` stage 1. Summary:
-
-```bash
-npx convex deploy -y
-# prod env starts EMPTY — set every required var:
-npx convex env set --prod SITE_URL "https://<the-app-domain>"
-npx convex env set --prod BETTER_AUTH_SECRET "$(openssl rand -hex 32)"   # fresh, never reuse dev
-npx convex env set --prod RESEND_API_KEY "$(npx convex env get RESEND_API_KEY)"
-npx convex env set --prod EMAIL_FROM "$(npx convex env get EMAIL_FROM)"
-# if Apple Sign In is enabled: APPLE_CLIENT_ID = {bundle_id}, APPLE_CLIENT_SECRET copied from dev
-# if Google Sign In is enabled: GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET copied from dev
-npx convex env list --prod
-```
-
-Then put the prod URLs into `mobile-app/eas.json > build.production`:
-
-```json
-"production": {
-  "autoIncrement": true,
-  "credentialsSource": "local",
-  "env": {
-    "EXPO_PUBLIC_CONVEX_URL": "https://<prod-deployment>.convex.cloud",
-    "EXPO_PUBLIC_CONVEX_SITE_URL": "https://<prod-deployment>.convex.site"
-  }
-}
-```
-
-`credentialsSource: "local"` is what makes the build fully non-interactive (Phase E).
-</phase>
-
-<phase n="D" title="Apple signing credentials via ASC API">
-All API calls use `node mobile-app/scripts/asc-api.mjs <METHOD> <path> [body.json]` with the env vars from Phase A. Work in a directory OUTSIDE the repo (e.g. `~/ios-credentials/<slug>/`) so nothing secret can be committed.
-
-**1. Resolve the app record (hard gate):**
-
-```bash
-node mobile-app/scripts/asc-api.mjs GET "/v1/apps?filter[bundleId]={bundle_id}"
-```
-
-Empty `data` → STOP. Tell the user to create the app record at appstoreconnect.apple.com (My Apps > + > New App) with this exact bundle ID, then resume. Otherwise save `{asc_app_id}` = `data[0].id`.
-
-**2. Bundle ID registration + capabilities:**
-
-```bash
-node mobile-app/scripts/asc-api.mjs GET "/v1/bundleIds?filter[identifier]={bundle_id}"
-# if missing, register it:
-# POST /v1/bundleIds  {"data":{"type":"bundleIds","attributes":{"identifier":"{bundle_id}","name":"{title}","platform":"IOS"}}}
-node mobile-app/scripts/asc-api.mjs GET "/v1/bundleIds/<BUNDLE_DB_ID>/bundleIdCapabilities"
-# enable missing capabilities the app uses (IN_APP_PURCHASE, APPLE_ID_AUTH, PUSH_NOTIFICATIONS):
-# POST /v1/bundleIdCapabilities {"data":{"type":"bundleIdCapabilities","attributes":{"capabilityType":"APPLE_ID_AUTH"},"relationships":{"bundleId":{"data":{"type":"bundleIds","id":"<BUNDLE_DB_ID>"}}}}}
-```
-
-**3. Distribution certificate.** First check for an existing one (Apple caps distribution certs at ~2-3 per account):
-
-```bash
-node mobile-app/scripts/asc-api.mjs GET "/v1/certificates?filter[certificateType]=DISTRIBUTION"
-```
-
-Reuse only if the user has its private key/.p12 locally. Otherwise create a new one (with user confirmation):
-
-```bash
-openssl req -new -newkey rsa:2048 -nodes -keyout dist.key -out dist.csr \
-  -subj "/emailAddress=<user-email>/CN={title} Distribution/C=US"
-node -e "const fs=require('fs');fs.writeFileSync('cert-req.json',JSON.stringify({data:{type:'certificates',attributes:{certificateType:'DISTRIBUTION',csrContent:fs.readFileSync('dist.csr','utf8')}}}))"
-node mobile-app/scripts/asc-api.mjs POST /v1/certificates cert-req.json
-# save body.data.id (cert id) and body.data.attributes.certificateContent (base64) -> dist.cer
-```
-
-**4. App Store provisioning profile:**
-
-```bash
-node -e "const fs=require('fs');fs.writeFileSync('profile-req.json',JSON.stringify({data:{type:'profiles',attributes:{name:'{title} AppStore',profileType:'IOS_APP_STORE'},relationships:{bundleId:{data:{type:'bundleIds',id:'<BUNDLE_DB_ID>'}},certificates:{data:[{type:'certificates',id:'<CERT_ID>'}]},devices:{data:[]}}}}))"
-node mobile-app/scripts/asc-api.mjs POST /v1/profiles profile-req.json
-# save body.data.attributes.profileContent (base64) -> profile.mobileprovision
-```
-
-**5. Build the .p12 (the `-legacy` flag is mandatory — Apple tooling rejects OpenSSL 3.x default ciphers):**
-
-```bash
-echo "<certificateContent-b64>" | base64 -d > dist.cer
-P12PASS=$(openssl rand -hex 12)
-openssl x509 -inform der -in dist.cer -out dist.pem 2>/dev/null || cp dist.cer dist.pem
-openssl pkcs12 -export -in dist.pem -inkey dist.key -out dist.p12 \
-  -name "{title} Distribution" -passout pass:"$P12PASS" -legacy
-echo "<profileContent-b64>" | base64 -d > appstore.mobileprovision
-```
-
-**6. Wire into the project (gitignored paths only):**
-
-```bash
-mkdir -p mobile-app/credentials
-cp dist.p12 mobile-app/credentials/dist.p12
-cp appstore.mobileprovision mobile-app/credentials/
-node -e "const fs=require('fs');fs.writeFileSync('mobile-app/credentials.json',JSON.stringify({ios:{provisioningProfilePath:'credentials/appstore.mobileprovision',distributionCertificate:{path:'credentials/dist.p12',password:process.argv[1]}}},null,2))" "$P12PASS"
-git check-ignore mobile-app/credentials.json mobile-app/credentials/dist.p12   # MUST print both paths
-```
-
-Setup-only mode STOPS here — report readiness (app record, cert, profile, credentials.json, eas.json) and the next command.
-</phase>
-
-<phase n="E" title="Local iOS build (default)">
-Default path. This uses the local Mac/Xcode toolchain and does **not** consume Expo cloud build credits. It still uses EAS CLI for config/versioning and local credentials for signing.
-
-```bash
-cd mobile-app
-npx eas-cli@latest build --platform ios --profile production \
-  --local --non-interactive --output /tmp/{slug}.ipa
-```
-
-If the build fails in `expo doctor` due to patch-version mismatches, inspect the exact error. Do not blindly upgrade dependencies during a release unless the build is blocked; if blocked, run `npx expo install --check`, apply the minimal Expo SDK patch updates, rerun `npx tsc --noEmit && npm run lint`, then rebuild.
-
-Local `autoIncrement` can skip build numbers if a canceled cloud build already reserved one. That is acceptable for App Store Connect.
-</phase>
-
-<phase n="E-expo" title="EAS cloud build (--expo only)">
-Run this phase only when the user passes `--expo`, and confirm once because it consumes Expo/EAS build credits:
-
-```bash
-cd mobile-app
-npx eas-cli@latest build --platform ios --profile production --non-interactive --no-wait
-```
-
-Poll until terminal state (FINISHED / ERRORED):
-
-```bash
-npx eas-cli@latest build:list --platform ios --limit 1 --json --non-interactive
-# or: npx eas-cli@latest build:view <BUILD_ID> --json
-```
-
-On FINISHED, download the artifact:
-
-```bash
-curl -sL -o /tmp/{slug}.ipa "<artifacts.buildUrl>"
-```
-</phase>
-
-<phase n="F" title="TestFlight upload">
-**1. Internal beta group** (TestFlight needs a group; `asc publish testflight` fails without `--group`):
-
-```bash
-node -e "const fs=require('fs');fs.writeFileSync('group-req.json',JSON.stringify({data:{type:'betaGroups',attributes:{name:'Internal',isInternalGroup:true,hasAccessToAllBuilds:true},relationships:{app:{data:{type:'apps',id:'{asc_app_id}'}}}}}))"
-node mobile-app/scripts/asc-api.mjs POST /v1/betaGroups group-req.json
-# 409 "already exists" is fine — fetch the id: GET "/v1/apps/{asc_app_id}/betaGroups"
-```
-
-**2. Upload and wait for processing** (asc must be authenticated — `asc auth status --validate`, else `asc auth login` with the same ASC key):
-
-```bash
-asc publish testflight --app "{asc_app_id}" --ipa /tmp/{slug}.ipa \
-  --group "<BETA_GROUP_ID>" --wait --timeout 45m
-```
-
-**3. Add testers** (internal testers must be App Store Connect team members; external emails work via groups):
-
-```bash
-node -e "const fs=require('fs');fs.writeFileSync('tester-req.json',JSON.stringify({data:{type:'betaTesters',attributes:{email:'<tester-email>'},relationships:{betaGroups:{data:[{type:'betaGroups',id:'<BETA_GROUP_ID>'}]}}}}))"
-node mobile-app/scripts/asc-api.mjs POST /v1/betaTesters tester-req.json
-```
-
-**4. Verify**: `asc status --app "{asc_app_id}" --output table` shows the build processed and attached to the group. Report build number, group, and tester list to the user.
-</phase>
-
-<failure_modes>
-- **`.p12` rejected during signing** → it was exported without `-legacy`. Re-export: `openssl pkcs12 -in dist.p12 -nodes -out tmp.pem -passin pass:"$P12PASS" && openssl pkcs12 -export -in tmp.pem -out dist.p12 -passout pass:"$P12PASS" -legacy`.
-- **Certificate creation returns 409 / limit reached** → list existing DISTRIBUTION certs; ask the user which to revoke (`DELETE /v1/certificates/<id>`) or whether they have its .p12 to reuse. Never revoke without confirmation — it breaks other apps signed with it.
-- **Local build fails before Xcode archive** → verify macOS/Xcode/CocoaPods: `xcodebuild -version`, `xcode-select -p`, `command -v pod`. If unavailable and the user accepts cloud quota usage, rerun with `--expo`.
-- **Local build fails asking for credentials** → `credentialsSource: "local"` is missing in `eas.json`, or `credentials.json` paths are wrong (they are relative to `mobile-app/`).
-- **`--expo` cloud build fails asking for credentials** → same credential checks as local, then rerun cloud build.
-- **`asc publish testflight` fails with "--group is required"** → create the beta group first (Phase F step 1).
-- **Upload rejected: missing export compliance** → answer the encryption question in App Store Connect once, or add `"ITSAppUsesNonExemptEncryption": false` to `infoPlist` in `mobile-app/app.config.ts` so future builds skip it.
-- **App opens but can't reach backend** → build was made before `eas.json` had prod URLs, or prod Convex env vars are missing (`npx convex env list --prod`). Rebuild after fixing — env is baked at build time.
-- **User insists on EAS-managed credentials (Apple ID login)** → that flow requires interactive 2FA and cannot run with `--non-interactive`. Run `npx eas-cli@latest credentials` in a real terminal with the user present, then build. Do not attempt to script the 2FA prompt.
-</failure_modes>
-
-<success_metrics>
-- `npm run check-setup` passes with a real `easProjectId`.
-- Default local build produces `/tmp/{slug}.ipa` without any interactive prompt; `--expo` cloud builds reach FINISHED.
-- The build shows as processed in TestFlight, attached to a beta group with at least one tester.
-- The TestFlight app signs in and talks to the PROD Convex deployment.
-- `git status` shows no credential files staged; nothing secret printed in the transcript.
-</success_metrics>