vibeview 0.12.3 → 0.14.0

package/dist/cli.js

@@ -13,19 +13,20 @@ import {
   readDevState,
   readMetroState,
   runAgentVerb
-} from "./chunk-2OI7HL6X.js";
+} from "./chunk-J64ENS7W.js";
 import {
   ApiClient,
   EXIT_INFRA_ERROR,
   EXIT_PASS,
   EXIT_TEST_FAIL,
   NotFoundError,
+  UsageError,
   createSpinner,
   loadConfig,
   resolveAuth,
   saveConfig,
   uploadApp
-} from "./chunk-OHRTLUBD.js";
+} from "./chunk-KUU4IUZU.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -909,9 +910,9 @@ async function resolveSteps(options) {
     return JSON.parse(readFileSync(options.stepsFile, "utf-8"));
   }
   if (!process.stdin.isTTY) {
-    const input = await readStdin();
-    if (input.trim()) {
-      return JSON.parse(input.trim());
+    const input2 = await readStdin();
+    if (input2.trim()) {
+      return JSON.parse(input2.trim());
     }
   }
   throw new Error("No steps provided. Use --steps, --steps-file, or pipe JSON to stdin.");
@@ -1190,7 +1191,8 @@ function defaultDeps(client) {
     getCloudBuild: client.getCloudBuild.bind(client),
     getCloudBuildLogs: client.getCloudBuildLogs.bind(client),
     cancelCloudBuild: client.cancelCloudBuild.bind(client),
-    downloadCloudBuildArtifact: client.downloadCloudBuildArtifact.bind(client)
+    downloadCloudBuildArtifact: client.downloadCloudBuildArtifact.bind(client),
+    deleteCloudBuildArtifact: client.deleteCloudBuildArtifact.bind(client)
   };
 }
 var POLL_INTERVAL_MS = 2e3;
@@ -1347,14 +1349,490 @@ async function buildsCancel(id, opts, deps) {
     process.exitCode = 1;
   }
 }
+async function buildsDeleteArtifact(id, opts, deps) {
+  const { token, baseUrl } = resolveAuth(opts);
+  const client = new ApiClient(baseUrl, token);
+  const d = deps ?? defaultDeps(client);
+  try {
+    const result = await d.deleteCloudBuildArtifact(id);
+    if (opts.json) {
+      console.log(JSON.stringify(result));
+    } else {
+      console.log(chalk11.green(`\u2713 deleted artifact for ${id}`));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError(opts, err);
+    process.exitCode = 1;
+  }
+}
 function printError(opts, err) {
   const message = err instanceof Error ? err.message : String(err);
   if (opts.json) console.log(JSON.stringify({ event: "error", message }));
   console.error(chalk11.red(`error: ${message}`));
 }
 
-// src/lib/formatters/devices.ts
+// src/commands/whoami.ts
 import chalk12 from "chalk";
+function defaultDeps2(opts) {
+  const { token, baseUrl } = resolveAuth(opts);
+  const client = new ApiClient(baseUrl, token);
+  return { fetchMe: () => client.whoAmI() };
+}
+function effectiveRole(role, tokenRole) {
+  const RANK = { admin: 3, developer: 2, viewer: 1 };
+  if (!role) return tokenRole;
+  if (!tokenRole) return role;
+  return (RANK[tokenRole] ?? 3) < (RANK[role] ?? 3) ? tokenRole : role;
+}
+async function whoAmI(opts, deps) {
+  const d = deps ?? defaultDeps2(opts);
+  try {
+    const me = await d.fetchMe();
+    const effective = effectiveRole(me.role, me.token_role);
+    if (opts.json) {
+      console.log(JSON.stringify({ ...me, effective_role: effective }));
+      process.exitCode = 0;
+      return;
+    }
+    console.log(`${chalk12.bold("Logged in as")}  ${me.email}`);
+    if (me.memberships.length === 1) {
+      console.log(`${chalk12.bold("Organization")}   ${me.memberships[0].organization_name}`);
+    } else if (me.memberships.length > 1) {
+      console.log(chalk12.bold("Organizations"));
+      for (const m of me.memberships) {
+        console.log(`  ${m.organization_name} (${m.role})`);
+      }
+    }
+    console.log(`${chalk12.bold("Member role")}    ${me.role ?? "\u2014"}`);
+    console.log(`${chalk12.bold("Token role")}     ${me.token_role ?? "\u2014 (session auth)"}`);
+    console.log(`${chalk12.bold("Effective role")} ${effective ?? "\u2014"}`);
+    if (me.is_superadmin) {
+      console.log(chalk12.dim("Superadmin (platform-wide; does not raise the org role above)"));
+    }
+    if (me.role === "admin" && me.token_role && me.token_role !== "admin") {
+      console.log(
+        chalk12.yellow(
+          `
+Your account is admin, but this CLI token is ${me.token_role}. The effective role is the lower of the two, so admin-only commands (such as ${chalk12.bold("vibeview env set")}) will fail with a permissions error.
+Create an admin API token in the dashboard and use ${chalk12.bold("--token")} or ${chalk12.bold("VIBEVIEW_API_TOKEN")}.`
+        )
+      );
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (opts.json) {
+      console.log(JSON.stringify({ event: "error", message }));
+    }
+    console.error(chalk12.red(`error: ${message}`));
+    process.exitCode = 1;
+  }
+}
+
+// src/commands/env.ts
+import { chmod, open as open2, readFile as readFileAsync } from "fs/promises";
+import { basename } from "path";
+import chalk13 from "chalk";
+import { password } from "@inquirer/prompts";
+
+// src/lib/gitignore.ts
+import { execFile } from "child_process";
+function isGitIgnored(path, cwd = process.cwd()) {
+  return new Promise((resolvePromise) => {
+    execFile("git", ["check-ignore", "-q", path], { cwd }, (error) => {
+      resolvePromise(!error);
+    });
+  });
+}
+
+// src/commands/env.ts
+function clientFor(opts) {
+  const { token, baseUrl } = resolveAuth(opts);
+  return new ApiClient(baseUrl, token);
+}
+async function writeSecureFile(path, content) {
+  const fh = await open2(path, "w", 384);
+  try {
+    await fh.writeFile(content, "utf-8");
+  } finally {
+    await fh.close();
+  }
+  await chmod(path, 384);
+}
+function defaultDeps3(client) {
+  return {
+    listVars: (app) => client.listBuildEnvVars(app),
+    setVar: (body) => client.setBuildEnvVar(body),
+    setFileVar: (body) => client.setBuildEnvFileVar(body),
+    rmVar: async ({ name, app }) => {
+      const { variables } = await client.listBuildEnvVars(app);
+      const wantApp = app ?? null;
+      const match = variables.find((v) => v.name === name && (v.app_public_id ?? null) === wantApp);
+      if (!match) {
+        const otherScope = variables.find((v) => v.name === name);
+        if (otherScope) {
+          throw new Error(
+            `No variable named "${name}" in ${app ? `app "${app}"` : "the org-wide scope"}. It exists ${otherScope.app_public_id ? `for app "${otherScope.app_public_id}"` : "org-wide"} \u2014 re-run ${otherScope.app_public_id ? `with --app ${otherScope.app_public_id}` : "without --app"} to remove that one.`
+          );
+        }
+        throw new Error(`No variable named "${name}" found${app ? ` for app "${app}"` : ""}.`);
+      }
+      await client.deleteBuildEnvVar(match.id);
+    },
+    pullVars: (app) => client.pullBuildEnvVars(app),
+    // `hidden` is always true in practice (env set only prompts for secret
+    // values), but the parameter exists so a future caller/test can't
+    // accidentally get echoed input by omitting it.
+    prompt: ({ message }) => password({ message }),
+    isTTY: Boolean(process.stdin.isTTY),
+    isIgnored: (path) => isGitIgnored(path),
+    writeFile: writeSecureFile,
+    readFile: (path) => readFileAsync(path),
+    warn: (message) => console.error(chalk13.yellow(`warning: ${message}`))
+  };
+}
+async function envList(opts, deps) {
+  const d = deps ?? defaultDeps3(clientFor(opts));
+  try {
+    const { variables } = await d.listVars(opts.app);
+    if (opts.json) {
+      console.log(JSON.stringify(variables, null, 2));
+    } else {
+      process.stdout.write(formatEnvVarsHuman(variables));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError2(opts, err);
+    process.exitCode = 1;
+  }
+}
+function formatEnvVarsHuman(variables) {
+  if (variables.length === 0) {
+    return "No build variables found.\n";
+  }
+  const HEADERS3 = ["NAME", "VISIBILITY", "SCOPE", "HINT"];
+  const rows = variables.map((v) => [
+    v.name,
+    v.is_file ? `${v.visibility} (file)` : v.visibility,
+    v.app_public_id ?? "org-wide",
+    v.value_hint ?? ""
+  ]);
+  const widths = HEADERS3.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+  const padCells = (cells) => cells.map((c, i) => c.padEnd(widths[i]));
+  const join2 = (cells) => cells.join("  ").trimEnd();
+  const lines = [chalk13.bold(join2(padCells(HEADERS3)))];
+  for (const row of rows) lines.push(join2(padCells(row)));
+  return lines.join("\n") + "\n";
+}
+async function envSet(name, value, opts, deps) {
+  const d = deps ?? defaultDeps3(clientFor(opts));
+  let resolvedValue = value;
+  if (resolvedValue === void 0 && !opts.file) {
+    if (opts.json || !d.isTTY) {
+      throw new Error(
+        "A value is required: pass it as the VALUE argument, or run interactively to be prompted."
+      );
+    }
+  }
+  try {
+    const visibility = resolveVisibility(opts);
+    if (opts.file) {
+      const content = await d.readFile(opts.file);
+      const filename = basename(opts.file);
+      const result2 = await d.setFileVar({ name, content, filename, visibility, app: opts.app });
+      printSetResult(opts, result2);
+      process.exitCode = 0;
+      return;
+    }
+    if (resolvedValue === void 0) {
+      resolvedValue = await d.prompt({ message: `Value for ${name}`, hidden: true });
+    }
+    const result = await d.setVar({ name, value: resolvedValue, visibility, app: opts.app });
+    printSetResult(opts, result);
+    process.exitCode = 0;
+  } catch (err) {
+    printError2(opts, err);
+    process.exitCode = 1;
+  }
+}
+function resolveVisibility(opts) {
+  const chosen = [
+    opts.secret && "secret",
+    opts.sensitive && "sensitive",
+    opts.plain && "plain"
+  ].filter((v) => Boolean(v));
+  if (chosen.length > 1) {
+    throw new Error("Pass at most one of --secret, --sensitive, --plain.");
+  }
+  return chosen[0] ?? "secret";
+}
+function printSetResult(opts, result) {
+  if (opts.json) {
+    console.log(JSON.stringify(result));
+  } else {
+    console.log(chalk13.green(`\u2713 set ${result.name} (${result.visibility})`));
+  }
+}
+async function envRm(name, opts, deps) {
+  const d = deps ?? defaultDeps3(clientFor(opts));
+  try {
+    await d.rmVar({ name, app: opts.app });
+    if (opts.json) {
+      console.log(JSON.stringify({ event: "deleted", name }));
+    } else {
+      console.log(chalk13.green(`\u2713 removed ${name}`));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError2(opts, err);
+    process.exitCode = 1;
+  }
+}
+async function envPull(opts, deps) {
+  const d = deps ?? defaultDeps3(clientFor(opts));
+  const outPath = opts.out ?? ".env";
+  try {
+    const { variables } = await d.pullVars(opts.app);
+    const ignored = await d.isIgnored(outPath);
+    if (!ignored) {
+      d.warn(
+        `${outPath} is not covered by .gitignore \u2014 writing credentials into a tracked file risks committing them. Add it to .gitignore.`
+      );
+    }
+    for (const v of variables) {
+      if (isLossyEnvValue(v.value)) {
+        const why = v.value.includes("\r") ? "contains a carriage return, which the .env format normalizes away" : "contains a single quote, a double quote and a backtick, which no .env quoting form can carry together";
+        d.warn(
+          `${v.name} ${why} \u2014 the written value differs from the stored one. Read this variable from the API instead of ${outPath}.`
+        );
+      }
+    }
+    const content = formatDotEnv(variables);
+    await d.writeFile(outPath, content);
+    if (opts.json) {
+      console.log(JSON.stringify({ event: "pulled", path: outPath, count: variables.length }));
+    } else {
+      console.log(chalk13.green(`\u2713 wrote ${variables.length} variable(s) to ${outPath}`));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError2(opts, err);
+    process.exitCode = 1;
+  }
+}
+function isLossyEnvValue(value) {
+  if (value.includes("\r")) return true;
+  return value.includes("'") && value.includes('"') && value.includes("`");
+}
+function formatDotEnv(variables) {
+  const lines = [
+    "# Generated by `vibeview env pull` \u2014 do not commit.",
+    "# Values are quoted/escaped only where the .env format requires it."
+  ];
+  for (const v of variables) {
+    lines.push(`${v.name}=${escapeEnvValue(v.value)}`);
+  }
+  return lines.join("\n") + "\n";
+}
+function escapeEnvValue(value) {
+  if (value === "") return "''";
+  if (!value.includes("'")) {
+    if (!/[\s"'#\\=`]/.test(value)) return value;
+    return `'${value}'`;
+  }
+  if (!value.includes('"') && !value.includes("\\")) {
+    return `"${value}"`;
+  }
+  if (!value.includes("`")) {
+    return `\`${value}\``;
+  }
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function printError2(opts, err) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (opts.json) console.log(JSON.stringify({ event: "error", message }));
+  console.error(chalk13.red(`error: ${message}`));
+}
+
+// src/commands/credentials.ts
+import { readFile as readFileAsync2 } from "fs/promises";
+import { basename as basename2, extname } from "path";
+import chalk14 from "chalk";
+import { input, password as password2 } from "@inquirer/prompts";
+function clientFor2(opts) {
+  const { token, baseUrl } = resolveAuth(opts);
+  return new ApiClient(baseUrl, token);
+}
+function defaultDeps4(client) {
+  return {
+    addCredential: (body) => client.addSigningCredential({
+      platform: body.platform,
+      kind: body.kind,
+      name: body.name,
+      app: body.app,
+      // Convert to the route's snake_case form fields HERE, at the client
+      // boundary, and nowhere else — see api-client.ts's
+      // addSigningCredential doc comment.
+      passwords: {
+        ...body.storePassword !== void 0 ? { store_password: body.storePassword } : {},
+        ...body.keyPassword !== void 0 ? { key_password: body.keyPassword } : {},
+        ...body.keyAlias !== void 0 ? { key_alias: body.keyAlias } : {},
+        ...body.p12Password !== void 0 ? { p12_password: body.p12Password } : {}
+      },
+      file: body.file,
+      filename: body.filename,
+      profile: body.profile,
+      profileFilename: body.profileFilename
+    }),
+    listCredentials: (app) => client.listSigningCredentials(app),
+    deleteCredential: async ({ name, app }) => {
+      const { credentials: credentials2 } = await client.listSigningCredentials(app);
+      const wantApp = app ?? null;
+      const match = credentials2.find(
+        (c) => c.name === name && (c.app_public_id ?? null) === wantApp
+      );
+      if (!match) {
+        throw new Error(`No credential named "${name}" found${app ? ` for app "${app}"` : ""}.`);
+      }
+      await client.deleteSigningCredential(match.id);
+    },
+    prompt: ({ message, hidden }) => hidden ? password2({ message }) : input({ message }),
+    isTTY: Boolean(process.stdin.isTTY),
+    readFile: (path) => readFileAsync2(path),
+    warn: (message) => console.error(chalk14.yellow(`warning: ${message}`))
+  };
+}
+var ANDROID_KIND = "android_keystore";
+var IOS_KIND = "ios_distribution";
+async function credentialsAdd(opts, deps) {
+  const d = deps ?? defaultDeps4(clientFor2(opts));
+  if (!opts.platform || opts.platform !== "ios" && opts.platform !== "android") {
+    throw new UsageError('--platform is required and must be "ios" or "android"');
+  }
+  if (!opts.file) {
+    throw new UsageError("--file is required");
+  }
+  if (opts.platform === "ios" && !opts.profile) {
+    throw new UsageError("--profile is required for ios credentials (a .mobileprovision file)");
+  }
+  const canPrompt = !opts.json && d.isTTY;
+  if (!canPrompt) {
+    throw new UsageError(
+      "a password is required: run interactively to be prompted (passwords are never accepted as flags)."
+    );
+  }
+  const name = opts.name ?? basename2(opts.file, extname(opts.file));
+  try {
+    const file = await d.readFile(opts.file);
+    const filename = basename2(opts.file);
+    let body;
+    if (opts.platform === "android") {
+      const storePassword = await d.prompt({ message: "Keystore (store) password", hidden: true });
+      const keyPassword = await d.prompt({ message: "Key password", hidden: true });
+      const keyAlias = await d.prompt({ message: "Key alias", hidden: false });
+      body = {
+        platform: "android",
+        kind: ANDROID_KIND,
+        name,
+        app: opts.app,
+        storePassword,
+        keyPassword,
+        keyAlias,
+        file,
+        filename
+      };
+    } else {
+      const p12Password = await d.prompt({ message: ".p12 password", hidden: true });
+      const profile = await d.readFile(opts.profile);
+      body = {
+        platform: "ios",
+        kind: IOS_KIND,
+        name,
+        app: opts.app,
+        p12Password,
+        file,
+        filename,
+        profile,
+        profileFilename: basename2(opts.profile)
+      };
+    }
+    const result = await d.addCredential(body);
+    if (opts.json) {
+      console.log(JSON.stringify(result));
+    } else {
+      console.log(chalk14.green(`\u2713 added ${result.name} (${result.platform})`));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError3(opts, err);
+    process.exitCode = 1;
+  }
+}
+async function credentialsList(opts, deps) {
+  const d = deps ?? defaultDeps4(clientFor2(opts));
+  try {
+    const { credentials: credentials2 } = await d.listCredentials(opts.app);
+    for (const c of credentials2) {
+      if (c.expires_soon) {
+        d.warn(
+          `${c.name} (${c.platform}) is expiring soon${c.expires_at ? ` \u2014 ${c.expires_at}` : ""}.`
+        );
+      }
+    }
+    if (opts.json) {
+      console.log(JSON.stringify(credentials2, null, 2));
+    } else {
+      process.stdout.write(formatCredentialsHuman(credentials2));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError3(opts, err);
+    process.exitCode = 1;
+  }
+}
+function formatCredentialsHuman(credentials2) {
+  if (credentials2.length === 0) {
+    return "No signing credentials found.\n";
+  }
+  const HEADERS3 = ["NAME", "PLATFORM", "SCOPE", "FINGERPRINT", "EXPIRES"];
+  const rows = credentials2.map((c) => [
+    c.name,
+    c.platform,
+    c.app_public_id ?? "org-wide",
+    c.fingerprint ?? "",
+    c.expires_at ? c.expires_soon ? `${c.expires_at} (soon)` : c.expires_at : ""
+  ]);
+  const widths = HEADERS3.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+  const padCells = (cells) => cells.map((c, i) => c.padEnd(widths[i]));
+  const join2 = (cells) => cells.join("  ").trimEnd();
+  const lines = [chalk14.bold(join2(padCells(HEADERS3)))];
+  for (const row of rows) lines.push(join2(padCells(row)));
+  return lines.join("\n") + "\n";
+}
+async function credentialsRm(name, opts, deps) {
+  const d = deps ?? defaultDeps4(clientFor2(opts));
+  try {
+    await d.deleteCredential({ name, app: opts.app });
+    if (opts.json) {
+      console.log(JSON.stringify({ event: "deleted", name }));
+    } else {
+      console.log(chalk14.green(`\u2713 removed ${name}`));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError3(opts, err);
+    process.exitCode = 1;
+  }
+}
+function printError3(opts, err) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (opts.json) console.log(JSON.stringify({ event: "error", message }));
+  console.error(chalk14.red(`error: ${message}`));
+}
+
+// src/lib/formatters/devices.ts
+import chalk15 from "chalk";
 var HEADERS2 = ["DEVICE_ID", "NAME", "TYPE", "CATEGORY", "OS", "STATUS"];
 function formatDevicesHuman(devices) {
   if (devices.length === 0) {
@@ -1370,9 +1848,9 @@ function formatDevicesHuman(devices) {
   ]);
   const widths = HEADERS2.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
   const fmt = (cells) => cells.map((c, i) => c.padEnd(widths[i])).join("  ").trimEnd();
-  const lines = [chalk12.bold(fmt(HEADERS2))];
+  const lines = [chalk15.bold(fmt(HEADERS2))];
   for (const row of rows.sort(rowSort)) {
-    const statusColored = row[5] === "available" ? chalk12.green(row[5]) : row[5] === "busy" ? chalk12.yellow(row[5]) : chalk12.dim(row[5]);
+    const statusColored = row[5] === "available" ? chalk15.green(row[5]) : row[5] === "busy" ? chalk15.yellow(row[5]) : chalk15.dim(row[5]);
     lines.push(fmt([row[0], row[1], row[2], row[3], row[4], statusColored]));
   }
   return lines.join("\n") + "\n";
@@ -1462,7 +1940,7 @@ import { dirname, join } from "path";
 import { fileURLToPath } from "url";
 import { spawnSync } from "child_process";
 import { confirm } from "@inquirer/prompts";
-import chalk13 from "chalk";
+import chalk16 from "chalk";
 function resolveShippedSkillPath(fromDir) {
   for (const rel of ["..", join("..", "..")]) {
     const candidate = join(fromDir, rel, "skills", "vibeview-agent", "SKILL.md");
@@ -1490,23 +1968,23 @@ function registerMcp() {
     encoding: "utf8"
   });
   if (res.status === 0) {
-    console.log(chalk13.green("\u2713 MCP server registered with Claude Code (claude mcp add vibeview)"));
+    console.log(chalk16.green("\u2713 MCP server registered with Claude Code (claude mcp add vibeview)"));
     return;
   }
   const out = `${res.stderr ?? ""}${res.stdout ?? ""}`;
   if (out.includes("already exists")) {
-    console.log(chalk13.dim("MCP server already registered with Claude Code \u2014 nothing to do"));
+    console.log(chalk16.dim("MCP server already registered with Claude Code \u2014 nothing to do"));
     return;
   }
-  console.error(chalk13.yellow(`\u26A0 could not register the MCP server: ${out.trim() || res.error}`));
-  console.error(chalk13.yellow("  register it manually: claude mcp add vibeview -- vibeview mcp"));
+  console.error(chalk16.yellow(`\u26A0 could not register the MCP server: ${out.trim() || res.error}`));
+  console.error(chalk16.yellow("  register it manually: claude mcp add vibeview -- vibeview mcp"));
 }
 async function agentSetup(opts) {
   const moduleDir = dirname(fileURLToPath(import.meta.url));
   const shipped = resolveShippedSkillPath(moduleDir);
   if (!shipped) {
     console.error(
-      chalk13.red(
+      chalk16.red(
         "error: could not find the packaged skill (skills/vibeview-agent/SKILL.md) \u2014 is this a complete install of the vibeview package?"
       )
     );
@@ -1515,9 +1993,9 @@ async function agentSetup(opts) {
   }
   const targetDir = skillInstallDir(opts.project ?? false, process.cwd(), homedir());
   const result = installSkill(shipped, targetDir);
-  console.log(chalk13.green(`\u2713 vibeview-agent skill ${result}: ${join(targetDir, "SKILL.md")}`));
+  console.log(chalk16.green(`\u2713 vibeview-agent skill ${result}: ${join(targetDir, "SKILL.md")}`));
   console.log(
-    chalk13.dim(
+    chalk16.dim(
       opts.project ? "  Claude Code discovers it automatically for anyone working in this project." : "  Claude Code discovers it automatically in every project on this machine."
     )
   );
@@ -1525,7 +2003,7 @@ async function agentSetup(opts) {
     if (!claudeCliAvailable()) {
       if (opts.mcp === true) {
         console.error(
-          chalk13.yellow(
+          chalk16.yellow(
             "\u26A0 claude CLI not found \u2014 install Claude Code, then run: claude mcp add vibeview -- vibeview mcp"
           )
         );
@@ -1539,7 +2017,7 @@ async function agentSetup(opts) {
   }
   console.log(
     `
-Suggested line for your project's ${chalk13.bold("CLAUDE.md")} (or ${chalk13.bold(
+Suggested line for your project's ${chalk16.bold("CLAUDE.md")} (or ${chalk16.bold(
       "AGENTS.md"
     )} for other agents):
 `
@@ -1547,7 +2025,7 @@ Suggested line for your project's ${chalk13.bold("CLAUDE.md")} (or ${chalk13.bol
   console.log(`  ${CLAUDE_MD_SUGGESTION}
 `);
   console.log(
-    chalk13.dim(
+    chalk16.dim(
       "Other agents (Cursor, Copilot, Codex, ...): point them at the skill file above, or\nadd the MCP server per client \u2014 see https://vibeview.io/docs/agent-control"
     )
   );
@@ -1706,18 +2184,44 @@ program.command("build").description("Run your configured build command and uplo
   "--download",
   "--cloud only: download the artifact of each succeeded build (implies wait)",
   false
+).option(
+  "--production",
+  "--cloud only: build a signed, installable production artifact (.aab/.ipa) using uploaded signing credentials (see `vibeview credentials add`), instead of the default unsigned simulator build",
+  false
 ).option("--json", "Print the result as one JSON line (NDJSON events with --cloud)", false).action((opts) => buildCommand(opts));
 var builds = program.command("builds").description("Manage cloud builds (see `vibeview build --cloud`)");
 builds.command("list").description("List cloud builds in your organization").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the raw build summaries as a JSON array", false).option("--limit <n>", "Max builds to return (default 50, max 200)").action((opts) => buildsList(opts));
 builds.command("logs <id>").description("Print a cloud build's log output").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print NDJSON log/outcome events instead of raw text", false).option("--follow", "Keep polling until the build reaches a terminal status", false).action((id, opts) => buildsLogs(id, opts));
 builds.command("download <id>").description("Download a succeeded cloud build's artifact").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the saved filename/path as one JSON line", false).option("--out <dir>", "Destination directory (default: current directory)").action((id, opts) => buildsDownload(id, opts));
 builds.command("cancel <id>").description("Cancel a queued or running cloud build").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the resulting build summary as one JSON line", false).action((id, opts) => buildsCancel(id, opts));
+builds.command("delete-artifact <id>").description(
+  "Delete a production build's stored artifact file (irreversible; the build record, logs, and cost stay intact \u2014 only the downloadable file is removed)"
+).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the result as one JSON line", false).action((id, opts) => buildsDeleteArtifact(id, opts));
+program.command("whoami").description("Show which account and role this CLI is authenticated as").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the identity as one JSON line", false).action((opts) => whoAmI(opts));
+var env = program.command("env").description("Manage cloud build environment variables and secrets");
+env.command("list").description("List build variables and secrets (never prints a value)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide variables only)").option("--json", "Print the raw variable list as a JSON array", false).action((opts) => envList(opts));
+env.command("set <name> [value]").description(
+  "Set a build variable or secret. Defaults to --secret (never retrievable via the API) unless --plain or --sensitive is passed explicitly."
+).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide)").option("--secret", "Store as secret (default): never returned by the API, including `env pull`").option(
+  "--sensitive",
+  "Store as sensitive: value_hint only in `env list`, full value via `env pull`"
+).option("--plain", "Store as plain: value returned by `env pull`, unmasked").option("--file <path>", "Upload a file as the value (e.g. a keystore) instead of a text value").option("--json", "Print the resulting variable as one JSON line", false).action((name, value, opts) => envSet(name, value, opts));
+env.command("rm <name>").description("Remove a build variable or secret").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide)").option("--json", "Print the result as one JSON line", false).action((name, opts) => envRm(name, opts));
+env.command("pull").description(
+  "Write plain/sensitive variable values to a .env file (secrets and files are never included)"
+).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide variables only)").option("--out <path>", "Output file path (default: .env)").option("--json", "Print the result as one JSON line", false).action((opts) => envPull(opts));
+var credentials = program.command("credentials").description("Manage app-signing credentials for production cloud builds");
+credentials.command("add").description(
+  "Add a signing credential. Prompts for passwords with hidden input \u2014 they are never accepted as flags (a flag lands in shell history and in `ps`)."
+).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--platform <platform>", "ios or android").option("--file <path>", "The keystore (.jks) or certificate (.p12) file").option("--profile <path>", "ios only: the .mobileprovision file (required for ios)").option("--app <id>", "Scope to a single app (default: org-wide)").option("--name <name>", "Credential name (default: the file basename without extension)").action((opts) => credentialsAdd(opts));
+credentials.command("list").description("List signing credentials (never prints key material)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide credentials only)").option("--json", "Print the raw credential list as a JSON array", false).action((opts) => credentialsList(opts));
+credentials.command("rm <name>").description("Remove a signing credential (replace by rm then add)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide)").option("--json", "Print the result as one JSON line", false).action((name, opts) => credentialsRm(name, opts));
 program.command("dev-status").description("Show the status of a `vibeview dev --detach` session in this project").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print as one JSON line", false).action((opts) => devStatus(opts));
 program.command("dev-stop").description("Stop a `vibeview dev --detach` session in this project").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print as one JSON line", false).action((opts) => devStop(opts));
 program.command("mcp").description(
   "Run an MCP stdio server exposing the agent verbs (tap, swipe, type, ...) plus dev_start/dev_stop as tools"
 ).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").action(async (opts) => {
-  const { runMcpServer } = await import("./server-25CXVTUV.js");
+  const { runMcpServer } = await import("./server-VF3N2CO5.js");
   await runMcpServer(opts);
 });
 program.command("agent-setup").description(
@@ -1746,5 +2250,5 @@ program.parseAsync().catch((e) => {
   if (process.env.VIBEVIEW_DEBUG) throw e;
   process.stderr.write(`error: ${e instanceof Error ? e.message : String(e)}
 `);
-  process.exit(EXIT_INFRA_ERROR);
+  process.exit(e instanceof UsageError ? EXIT_TEST_FAIL : EXIT_INFRA_ERROR);
 });