vibeview 0.13.0 → 0.14.1

package/dist/{chunk-J7V3GYOI.js → chunk-2WTLJ66O.js}

@@ -38,7 +38,7 @@ function resolveAuth(options) {
 
 // src/lib/api-client.ts
 import { openAsBlob, readFileSync as readFileSync2 } from "fs";
-import { createWriteStream, renameSync, rmSync } from "fs";
+import { createWriteStream, mkdirSync as mkdirSync2, renameSync, rmSync } from "fs";
 import { basename, join as join2, resolve, sep } from "path";
 import { pipeline } from "stream/promises";
 import { Readable } from "stream";
@@ -297,6 +297,13 @@ var ApiClient = class {
   async cancelCloudBuild(id) {
     return this.requestRaw("POST", `/builds/${id}/cancel`);
   }
+  /** DELETE /api/v1/builds/{id}/artifact — deletes a production build's
+   *  stored artifact file. The build record, its logs, and its cost stay
+   *  intact; this only removes the downloadable file. 409 if the build has
+   *  no artifact (never had one, or already deleted). */
+  async deleteCloudBuildArtifact(id) {
+    return this.requestRaw("DELETE", `/builds/${id}/artifact`);
+  }
   /**
    * Download a finished build's artifact (GET /api/v1/builds/{id}/artifact),
    * streaming the response body straight to a file in destDir. The filename
@@ -325,6 +332,7 @@ var ApiClient = class {
     if (resolvedPath !== join2(resolvedDestDir, filename) || !resolvedPath.startsWith(resolvedDestDir + sep)) {
       throw new Error(`Refusing to write artifact outside destination directory: ${filename}`);
     }
+    mkdirSync2(resolvedDestDir, { recursive: true });
     if (!resp.body) {
       createWriteStream(path).end();
       return { filename, path };
@@ -363,6 +371,10 @@ var ApiClient = class {
     formData.append("file", blob, body.filename);
     return this.requestFormData("POST", "/build-env/", formData);
   }
+  /** GET /api/v1/users/me — identity + roles for `vibeview whoami`. */
+  async whoAmI() {
+    return this.requestRaw("GET", "/users/me");
+  }
   /** DELETE /api/v1/build-env/{id}. Requires ADMIN role. */
   async deleteBuildEnvVar(id) {
     await this.requestRaw("DELETE", `/build-env/${id}`);
@@ -374,6 +386,44 @@ var ApiClient = class {
     const qs = app ? `?app=${encodeURIComponent(app)}` : "";
     return this.requestRaw("GET", `/build-env/pull${qs}`);
   }
+  /** GET /api/v1/signing-credentials/[?app=]. Requires VIEWER role. Never
+   *  returns file bytes, profile bytes, or a password — see
+   *  routes/signing.py's module docstring. */
+  async listSigningCredentials(app) {
+    const qs = app ? `?app=${encodeURIComponent(app)}` : "";
+    return this.requestRaw("GET", `/signing-credentials/${qs}`);
+  }
+  /**
+   * POST /api/v1/signing-credentials/ (multipart). Requires ADMIN role.
+   * `passwords` carries the route's own snake_case form field names
+   * (store_password, key_password, key_alias, p12_password) — the CLI's own
+   * camelCase objects are converted to this shape ONLY at this boundary
+   * (see credentials.ts), never anywhere else, so there is exactly one place
+   * the two naming conventions meet.
+   */
+  async addSigningCredential(body) {
+    const formData = new FormData();
+    formData.append("platform", body.platform);
+    formData.append("kind", body.kind);
+    formData.append("name", body.name);
+    if (body.app) formData.append("app", body.app);
+    for (const [key, value] of Object.entries(body.passwords)) {
+      formData.append(key, value);
+    }
+    formData.append("file", new Blob([new Uint8Array(body.file)]), body.filename);
+    if (body.profile) {
+      formData.append(
+        "profile",
+        new Blob([new Uint8Array(body.profile)]),
+        body.profileFilename ?? "profile"
+      );
+    }
+    return this.requestFormData("POST", "/signing-credentials/", formData);
+  }
+  /** DELETE /api/v1/signing-credentials/{id}. Requires ADMIN role. */
+  async deleteSigningCredential(id) {
+    await this.requestRaw("DELETE", `/signing-credentials/${id}`);
+  }
 };
 function parseContentDispositionFilename(header) {
   if (!header) return void 0;
@@ -410,6 +460,12 @@ function createSpinner(text) {
 var EXIT_PASS = 0;
 var EXIT_TEST_FAIL = 1;
 var EXIT_INFRA_ERROR = 2;
+var UsageError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "UsageError";
+  }
+};
 
 // src/commands/upload-app.ts
 async function uploadAppBuild(filePath, options) {
@@ -480,6 +536,7 @@ export {
   EXIT_PASS,
   EXIT_TEST_FAIL,
   EXIT_INFRA_ERROR,
+  UsageError,
   uploadAppBuild,
   uploadApp
 };

package/dist/cli.js

@@ -13,19 +13,20 @@ import {
   readDevState,
   readMetroState,
   runAgentVerb
-} from "./chunk-YFXMXO5T.js";
+} from "./chunk-2VNBRBST.js";
 import {
   ApiClient,
   EXIT_INFRA_ERROR,
   EXIT_PASS,
   EXIT_TEST_FAIL,
   NotFoundError,
+  UsageError,
   createSpinner,
   loadConfig,
   resolveAuth,
   saveConfig,
   uploadApp
-} from "./chunk-J7V3GYOI.js";
+} from "./chunk-2WTLJ66O.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -909,9 +910,9 @@ async function resolveSteps(options) {
     return JSON.parse(readFileSync(options.stepsFile, "utf-8"));
   }
   if (!process.stdin.isTTY) {
-    const input = await readStdin();
-    if (input.trim()) {
-      return JSON.parse(input.trim());
+    const input2 = await readStdin();
+    if (input2.trim()) {
+      return JSON.parse(input2.trim());
     }
   }
   throw new Error("No steps provided. Use --steps, --steps-file, or pipe JSON to stdin.");
@@ -1190,7 +1191,8 @@ function defaultDeps(client) {
     getCloudBuild: client.getCloudBuild.bind(client),
     getCloudBuildLogs: client.getCloudBuildLogs.bind(client),
     cancelCloudBuild: client.cancelCloudBuild.bind(client),
-    downloadCloudBuildArtifact: client.downloadCloudBuildArtifact.bind(client)
+    downloadCloudBuildArtifact: client.downloadCloudBuildArtifact.bind(client),
+    deleteCloudBuildArtifact: client.deleteCloudBuildArtifact.bind(client)
   };
 }
 var POLL_INTERVAL_MS = 2e3;
@@ -1347,16 +1349,91 @@ async function buildsCancel(id, opts, deps) {
     process.exitCode = 1;
   }
 }
+async function buildsDeleteArtifact(id, opts, deps) {
+  const { token, baseUrl } = resolveAuth(opts);
+  const client = new ApiClient(baseUrl, token);
+  const d = deps ?? defaultDeps(client);
+  try {
+    const result = await d.deleteCloudBuildArtifact(id);
+    if (opts.json) {
+      console.log(JSON.stringify(result));
+    } else {
+      console.log(chalk11.green(`\u2713 deleted artifact for ${id}`));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError(opts, err);
+    process.exitCode = 1;
+  }
+}
 function printError(opts, err) {
   const message = err instanceof Error ? err.message : String(err);
   if (opts.json) console.log(JSON.stringify({ event: "error", message }));
   console.error(chalk11.red(`error: ${message}`));
 }
 
+// src/commands/whoami.ts
+import chalk12 from "chalk";
+function defaultDeps2(opts) {
+  const { token, baseUrl } = resolveAuth(opts);
+  const client = new ApiClient(baseUrl, token);
+  return { fetchMe: () => client.whoAmI() };
+}
+function effectiveRole(role, tokenRole) {
+  const RANK = { admin: 3, developer: 2, viewer: 1 };
+  if (!role) return tokenRole;
+  if (!tokenRole) return role;
+  return (RANK[tokenRole] ?? 3) < (RANK[role] ?? 3) ? tokenRole : role;
+}
+async function whoAmI(opts, deps) {
+  const d = deps ?? defaultDeps2(opts);
+  try {
+    const me = await d.fetchMe();
+    const effective = effectiveRole(me.role, me.token_role);
+    if (opts.json) {
+      console.log(JSON.stringify({ ...me, effective_role: effective }));
+      process.exitCode = 0;
+      return;
+    }
+    console.log(`${chalk12.bold("Logged in as")}  ${me.email}`);
+    if (me.memberships.length === 1) {
+      console.log(`${chalk12.bold("Organization")}   ${me.memberships[0].organization_name}`);
+    } else if (me.memberships.length > 1) {
+      console.log(chalk12.bold("Organizations"));
+      for (const m of me.memberships) {
+        console.log(`  ${m.organization_name} (${m.role})`);
+      }
+    }
+    console.log(`${chalk12.bold("Member role")}    ${me.role ?? "\u2014"}`);
+    console.log(`${chalk12.bold("Token role")}     ${me.token_role ?? "\u2014 (session auth)"}`);
+    console.log(`${chalk12.bold("Effective role")} ${effective ?? "\u2014"}`);
+    if (me.is_superadmin) {
+      console.log(chalk12.dim("Superadmin (platform-wide; does not raise the org role above)"));
+    }
+    if (me.role === "admin" && me.token_role && me.token_role !== "admin") {
+      console.log(
+        chalk12.yellow(
+          `
+Your account is admin, but this CLI token is ${me.token_role}. The effective role is the lower of the two, so admin-only commands (such as ${chalk12.bold("vibeview env set")}) will fail with a permissions error.
+Create an admin API token in the dashboard and use ${chalk12.bold("--token")} or ${chalk12.bold("VIBEVIEW_API_TOKEN")}.`
+        )
+      );
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (opts.json) {
+      console.log(JSON.stringify({ event: "error", message }));
+    }
+    console.error(chalk12.red(`error: ${message}`));
+    process.exitCode = 1;
+  }
+}
+
 // src/commands/env.ts
 import { chmod, open as open2, readFile as readFileAsync } from "fs/promises";
 import { basename } from "path";
-import chalk12 from "chalk";
+import chalk13 from "chalk";
 import { password } from "@inquirer/prompts";
 
 // src/lib/gitignore.ts
@@ -1383,7 +1460,7 @@ async function writeSecureFile(path, content) {
   }
   await chmod(path, 384);
 }
-function defaultDeps2(client) {
+function defaultDeps3(client) {
   return {
     listVars: (app) => client.listBuildEnvVars(app),
     setVar: (body) => client.setBuildEnvVar(body),
@@ -1412,11 +1489,11 @@ function defaultDeps2(client) {
     isIgnored: (path) => isGitIgnored(path),
     writeFile: writeSecureFile,
     readFile: (path) => readFileAsync(path),
-    warn: (message) => console.error(chalk12.yellow(`warning: ${message}`))
+    warn: (message) => console.error(chalk13.yellow(`warning: ${message}`))
   };
 }
 async function envList(opts, deps) {
-  const d = deps ?? defaultDeps2(clientFor(opts));
+  const d = deps ?? defaultDeps3(clientFor(opts));
   try {
     const { variables } = await d.listVars(opts.app);
     if (opts.json) {
@@ -1444,12 +1521,12 @@ function formatEnvVarsHuman(variables) {
   const widths = HEADERS3.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
   const padCells = (cells) => cells.map((c, i) => c.padEnd(widths[i]));
   const join2 = (cells) => cells.join("  ").trimEnd();
-  const lines = [chalk12.bold(join2(padCells(HEADERS3)))];
+  const lines = [chalk13.bold(join2(padCells(HEADERS3)))];
   for (const row of rows) lines.push(join2(padCells(row)));
   return lines.join("\n") + "\n";
 }
 async function envSet(name, value, opts, deps) {
-  const d = deps ?? defaultDeps2(clientFor(opts));
+  const d = deps ?? defaultDeps3(clientFor(opts));
   let resolvedValue = value;
   if (resolvedValue === void 0 && !opts.file) {
     if (opts.json || !d.isTTY) {
@@ -1494,17 +1571,17 @@ function printSetResult(opts, result) {
   if (opts.json) {
     console.log(JSON.stringify(result));
   } else {
-    console.log(chalk12.green(`\u2713 set ${result.name} (${result.visibility})`));
+    console.log(chalk13.green(`\u2713 set ${result.name} (${result.visibility})`));
   }
 }
 async function envRm(name, opts, deps) {
-  const d = deps ?? defaultDeps2(clientFor(opts));
+  const d = deps ?? defaultDeps3(clientFor(opts));
   try {
     await d.rmVar({ name, app: opts.app });
     if (opts.json) {
       console.log(JSON.stringify({ event: "deleted", name }));
     } else {
-      console.log(chalk12.green(`\u2713 removed ${name}`));
+      console.log(chalk13.green(`\u2713 removed ${name}`));
     }
     process.exitCode = 0;
   } catch (err) {
@@ -1513,7 +1590,7 @@ async function envRm(name, opts, deps) {
   }
 }
 async function envPull(opts, deps) {
-  const d = deps ?? defaultDeps2(clientFor(opts));
+  const d = deps ?? defaultDeps3(clientFor(opts));
   const outPath = opts.out ?? ".env";
   try {
     const { variables } = await d.pullVars(opts.app);
@@ -1536,7 +1613,7 @@ async function envPull(opts, deps) {
     if (opts.json) {
       console.log(JSON.stringify({ event: "pulled", path: outPath, count: variables.length }));
     } else {
-      console.log(chalk12.green(`\u2713 wrote ${variables.length} variable(s) to ${outPath}`));
+      console.log(chalk13.green(`\u2713 wrote ${variables.length} variable(s) to ${outPath}`));
     }
     process.exitCode = 0;
   } catch (err) {
@@ -1575,11 +1652,195 @@ function escapeEnvValue(value) {
 function printError2(opts, err) {
   const message = err instanceof Error ? err.message : String(err);
   if (opts.json) console.log(JSON.stringify({ event: "error", message }));
-  console.error(chalk12.red(`error: ${message}`));
+  console.error(chalk13.red(`error: ${message}`));
+}
+
+// src/commands/credentials.ts
+import { readFile as readFileAsync2 } from "fs/promises";
+import { basename as basename2, extname } from "path";
+import chalk14 from "chalk";
+import { input, password as password2 } from "@inquirer/prompts";
+function clientFor2(opts) {
+  const { token, baseUrl } = resolveAuth(opts);
+  return new ApiClient(baseUrl, token);
+}
+function defaultDeps4(client) {
+  return {
+    addCredential: (body) => client.addSigningCredential({
+      platform: body.platform,
+      kind: body.kind,
+      name: body.name,
+      app: body.app,
+      // Convert to the route's snake_case form fields HERE, at the client
+      // boundary, and nowhere else — see api-client.ts's
+      // addSigningCredential doc comment.
+      passwords: {
+        ...body.storePassword !== void 0 ? { store_password: body.storePassword } : {},
+        ...body.keyPassword !== void 0 ? { key_password: body.keyPassword } : {},
+        ...body.keyAlias !== void 0 ? { key_alias: body.keyAlias } : {},
+        ...body.p12Password !== void 0 ? { p12_password: body.p12Password } : {}
+      },
+      file: body.file,
+      filename: body.filename,
+      profile: body.profile,
+      profileFilename: body.profileFilename
+    }),
+    listCredentials: (app) => client.listSigningCredentials(app),
+    deleteCredential: async ({ name, app }) => {
+      const { credentials: credentials2 } = await client.listSigningCredentials(app);
+      const wantApp = app ?? null;
+      const match = credentials2.find(
+        (c) => c.name === name && (c.app_public_id ?? null) === wantApp
+      );
+      if (!match) {
+        throw new Error(`No credential named "${name}" found${app ? ` for app "${app}"` : ""}.`);
+      }
+      await client.deleteSigningCredential(match.id);
+    },
+    prompt: ({ message, hidden }) => hidden ? password2({ message }) : input({ message }),
+    isTTY: Boolean(process.stdin.isTTY),
+    readFile: (path) => readFileAsync2(path),
+    warn: (message) => console.error(chalk14.yellow(`warning: ${message}`))
+  };
+}
+var ANDROID_KIND = "android_keystore";
+var IOS_KIND = "ios_distribution";
+async function credentialsAdd(opts, deps) {
+  const d = deps ?? defaultDeps4(clientFor2(opts));
+  if (!opts.platform || opts.platform !== "ios" && opts.platform !== "android") {
+    throw new UsageError('--platform is required and must be "ios" or "android"');
+  }
+  if (!opts.file) {
+    throw new UsageError("--file is required");
+  }
+  if (opts.platform === "ios" && !opts.profile) {
+    throw new UsageError("--profile is required for ios credentials (a .mobileprovision file)");
+  }
+  const canPrompt = !opts.json && d.isTTY;
+  if (!canPrompt) {
+    throw new UsageError(
+      "a password is required: run interactively to be prompted (passwords are never accepted as flags)."
+    );
+  }
+  const name = opts.name ?? basename2(opts.file, extname(opts.file));
+  try {
+    const file = await d.readFile(opts.file);
+    const filename = basename2(opts.file);
+    let body;
+    if (opts.platform === "android") {
+      const storePassword = await d.prompt({ message: "Keystore (store) password", hidden: true });
+      const keyPassword = await d.prompt({ message: "Key password", hidden: true });
+      const keyAlias = await d.prompt({ message: "Key alias", hidden: false });
+      body = {
+        platform: "android",
+        kind: ANDROID_KIND,
+        name,
+        app: opts.app,
+        storePassword,
+        keyPassword,
+        keyAlias,
+        file,
+        filename
+      };
+    } else {
+      const p12Password = await d.prompt({ message: ".p12 password", hidden: true });
+      const profile = await d.readFile(opts.profile);
+      body = {
+        platform: "ios",
+        kind: IOS_KIND,
+        name,
+        app: opts.app,
+        p12Password,
+        file,
+        filename,
+        profile,
+        profileFilename: basename2(opts.profile)
+      };
+    }
+    const result = await d.addCredential(body);
+    if (opts.json) {
+      console.log(JSON.stringify(result));
+    } else {
+      console.log(chalk14.green(`\u2713 added ${result.name} (${result.platform})`));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError3(opts, err);
+    process.exitCode = 1;
+  }
+}
+async function credentialsList(opts, deps) {
+  const d = deps ?? defaultDeps4(clientFor2(opts));
+  try {
+    const { credentials: credentials2 } = await d.listCredentials(opts.app);
+    for (const c of credentials2) {
+      if (c.expires_soon) {
+        d.warn(
+          `${c.name} (${c.platform}) is expiring soon${c.expires_at ? ` \u2014 ${c.expires_at}` : ""}.`
+        );
+      }
+    }
+    if (opts.json) {
+      console.log(JSON.stringify(credentials2, null, 2));
+    } else {
+      process.stdout.write(formatCredentialsHuman(credentials2));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError3(opts, err);
+    process.exitCode = 1;
+  }
+}
+function formatIdentity(c) {
+  if (!c.fingerprint) return "";
+  const [tag, ...rest] = c.fingerprint.split(":");
+  const value = rest.join(":");
+  if (tag === "cert-sha256") return `cert sha256:${value}`;
+  if (tag === "file-sha256") return `keystore-file sha256:${value}`;
+  return c.platform === "android" ? `keystore-file sha256:${c.fingerprint}` : `cert sha1:${c.fingerprint}`;
+}
+function formatCredentialsHuman(credentials2) {
+  if (credentials2.length === 0) {
+    return "No signing credentials found.\n";
+  }
+  const HEADERS3 = ["NAME", "PLATFORM", "SCOPE", "IDENTITY", "EXPIRES"];
+  const rows = credentials2.map((c) => [
+    c.name,
+    c.platform,
+    c.app_public_id ?? "org-wide",
+    formatIdentity(c),
+    c.expires_at ? c.expires_soon ? `${c.expires_at} (soon)` : c.expires_at : ""
+  ]);
+  const widths = HEADERS3.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+  const padCells = (cells) => cells.map((c, i) => c.padEnd(widths[i]));
+  const join2 = (cells) => cells.join("  ").trimEnd();
+  const lines = [chalk14.bold(join2(padCells(HEADERS3)))];
+  for (const row of rows) lines.push(join2(padCells(row)));
+  return lines.join("\n") + "\n";
+}
+async function credentialsRm(name, opts, deps) {
+  const d = deps ?? defaultDeps4(clientFor2(opts));
+  try {
+    await d.deleteCredential({ name, app: opts.app });
+    if (opts.json) {
+      console.log(JSON.stringify({ event: "deleted", name }));
+    } else {
+      console.log(chalk14.green(`\u2713 removed ${name}`));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError3(opts, err);
+    process.exitCode = 1;
+  }
+}
+function printError3(opts, err) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (opts.json) console.log(JSON.stringify({ event: "error", message }));
+  console.error(chalk14.red(`error: ${message}`));
 }
 
 // src/lib/formatters/devices.ts
-import chalk13 from "chalk";
+import chalk15 from "chalk";
 var HEADERS2 = ["DEVICE_ID", "NAME", "TYPE", "CATEGORY", "OS", "STATUS"];
 function formatDevicesHuman(devices) {
   if (devices.length === 0) {
@@ -1595,9 +1856,9 @@ function formatDevicesHuman(devices) {
   ]);
   const widths = HEADERS2.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
   const fmt = (cells) => cells.map((c, i) => c.padEnd(widths[i])).join("  ").trimEnd();
-  const lines = [chalk13.bold(fmt(HEADERS2))];
+  const lines = [chalk15.bold(fmt(HEADERS2))];
   for (const row of rows.sort(rowSort)) {
-    const statusColored = row[5] === "available" ? chalk13.green(row[5]) : row[5] === "busy" ? chalk13.yellow(row[5]) : chalk13.dim(row[5]);
+    const statusColored = row[5] === "available" ? chalk15.green(row[5]) : row[5] === "busy" ? chalk15.yellow(row[5]) : chalk15.dim(row[5]);
     lines.push(fmt([row[0], row[1], row[2], row[3], row[4], statusColored]));
   }
   return lines.join("\n") + "\n";
@@ -1687,7 +1948,7 @@ import { dirname, join } from "path";
 import { fileURLToPath } from "url";
 import { spawnSync } from "child_process";
 import { confirm } from "@inquirer/prompts";
-import chalk14 from "chalk";
+import chalk16 from "chalk";
 function resolveShippedSkillPath(fromDir) {
   for (const rel of ["..", join("..", "..")]) {
     const candidate = join(fromDir, rel, "skills", "vibeview-agent", "SKILL.md");
@@ -1715,23 +1976,23 @@ function registerMcp() {
     encoding: "utf8"
   });
   if (res.status === 0) {
-    console.log(chalk14.green("\u2713 MCP server registered with Claude Code (claude mcp add vibeview)"));
+    console.log(chalk16.green("\u2713 MCP server registered with Claude Code (claude mcp add vibeview)"));
     return;
   }
   const out = `${res.stderr ?? ""}${res.stdout ?? ""}`;
   if (out.includes("already exists")) {
-    console.log(chalk14.dim("MCP server already registered with Claude Code \u2014 nothing to do"));
+    console.log(chalk16.dim("MCP server already registered with Claude Code \u2014 nothing to do"));
     return;
   }
-  console.error(chalk14.yellow(`\u26A0 could not register the MCP server: ${out.trim() || res.error}`));
-  console.error(chalk14.yellow("  register it manually: claude mcp add vibeview -- vibeview mcp"));
+  console.error(chalk16.yellow(`\u26A0 could not register the MCP server: ${out.trim() || res.error}`));
+  console.error(chalk16.yellow("  register it manually: claude mcp add vibeview -- vibeview mcp"));
 }
 async function agentSetup(opts) {
   const moduleDir = dirname(fileURLToPath(import.meta.url));
   const shipped = resolveShippedSkillPath(moduleDir);
   if (!shipped) {
     console.error(
-      chalk14.red(
+      chalk16.red(
         "error: could not find the packaged skill (skills/vibeview-agent/SKILL.md) \u2014 is this a complete install of the vibeview package?"
       )
     );
@@ -1740,9 +2001,9 @@ async function agentSetup(opts) {
   }
   const targetDir = skillInstallDir(opts.project ?? false, process.cwd(), homedir());
   const result = installSkill(shipped, targetDir);
-  console.log(chalk14.green(`\u2713 vibeview-agent skill ${result}: ${join(targetDir, "SKILL.md")}`));
+  console.log(chalk16.green(`\u2713 vibeview-agent skill ${result}: ${join(targetDir, "SKILL.md")}`));
   console.log(
-    chalk14.dim(
+    chalk16.dim(
       opts.project ? "  Claude Code discovers it automatically for anyone working in this project." : "  Claude Code discovers it automatically in every project on this machine."
     )
   );
@@ -1750,7 +2011,7 @@ async function agentSetup(opts) {
     if (!claudeCliAvailable()) {
       if (opts.mcp === true) {
         console.error(
-          chalk14.yellow(
+          chalk16.yellow(
             "\u26A0 claude CLI not found \u2014 install Claude Code, then run: claude mcp add vibeview -- vibeview mcp"
           )
         );
@@ -1764,7 +2025,7 @@ async function agentSetup(opts) {
   }
   console.log(
     `
-Suggested line for your project's ${chalk14.bold("CLAUDE.md")} (or ${chalk14.bold(
+Suggested line for your project's ${chalk16.bold("CLAUDE.md")} (or ${chalk16.bold(
       "AGENTS.md"
     )} for other agents):
 `
@@ -1772,7 +2033,7 @@ Suggested line for your project's ${chalk14.bold("CLAUDE.md")} (or ${chalk14.bol
   console.log(`  ${CLAUDE_MD_SUGGESTION}
 `);
   console.log(
-    chalk14.dim(
+    chalk16.dim(
       "Other agents (Cursor, Copilot, Codex, ...): point them at the skill file above, or\nadd the MCP server per client \u2014 see https://vibeview.io/docs/agent-control"
     )
   );
@@ -1931,12 +2192,20 @@ program.command("build").description("Run your configured build command and uplo
   "--download",
   "--cloud only: download the artifact of each succeeded build (implies wait)",
   false
+).option(
+  "--production",
+  "--cloud only: build a signed, installable production artifact (.aab/.ipa) using uploaded signing credentials (see `vibeview credentials add`), instead of the default unsigned simulator build",
+  false
 ).option("--json", "Print the result as one JSON line (NDJSON events with --cloud)", false).action((opts) => buildCommand(opts));
 var builds = program.command("builds").description("Manage cloud builds (see `vibeview build --cloud`)");
 builds.command("list").description("List cloud builds in your organization").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the raw build summaries as a JSON array", false).option("--limit <n>", "Max builds to return (default 50, max 200)").action((opts) => buildsList(opts));
 builds.command("logs <id>").description("Print a cloud build's log output").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print NDJSON log/outcome events instead of raw text", false).option("--follow", "Keep polling until the build reaches a terminal status", false).action((id, opts) => buildsLogs(id, opts));
 builds.command("download <id>").description("Download a succeeded cloud build's artifact").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the saved filename/path as one JSON line", false).option("--out <dir>", "Destination directory (default: current directory)").action((id, opts) => buildsDownload(id, opts));
 builds.command("cancel <id>").description("Cancel a queued or running cloud build").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the resulting build summary as one JSON line", false).action((id, opts) => buildsCancel(id, opts));
+builds.command("delete-artifact <id>").description(
+  "Delete a production build's stored artifact file (irreversible; the build record, logs, and cost stay intact \u2014 only the downloadable file is removed)"
+).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the result as one JSON line", false).action((id, opts) => buildsDeleteArtifact(id, opts));
+program.command("whoami").description("Show which account and role this CLI is authenticated as").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the identity as one JSON line", false).action((opts) => whoAmI(opts));
 var env = program.command("env").description("Manage cloud build environment variables and secrets");
 env.command("list").description("List build variables and secrets (never prints a value)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide variables only)").option("--json", "Print the raw variable list as a JSON array", false).action((opts) => envList(opts));
 env.command("set <name> [value]").description(
@@ -1949,12 +2218,18 @@ env.command("rm <name>").description("Remove a build variable or secret").option
 env.command("pull").description(
   "Write plain/sensitive variable values to a .env file (secrets and files are never included)"
 ).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide variables only)").option("--out <path>", "Output file path (default: .env)").option("--json", "Print the result as one JSON line", false).action((opts) => envPull(opts));
+var credentials = program.command("credentials").description("Manage app-signing credentials for production cloud builds");
+credentials.command("add").description(
+  "Add a signing credential. Prompts for passwords with hidden input \u2014 they are never accepted as flags (a flag lands in shell history and in `ps`)."
+).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--platform <platform>", "ios or android").option("--file <path>", "The keystore (.jks) or certificate (.p12) file").option("--profile <path>", "ios only: the .mobileprovision file (required for ios)").option("--app <id>", "Scope to a single app (default: org-wide)").option("--name <name>", "Credential name (default: the file basename without extension)").action((opts) => credentialsAdd(opts));
+credentials.command("list").description("List signing credentials (never prints key material)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide credentials only)").option("--json", "Print the raw credential list as a JSON array", false).action((opts) => credentialsList(opts));
+credentials.command("rm <name>").description("Remove a signing credential (replace by rm then add)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide)").option("--json", "Print the result as one JSON line", false).action((name, opts) => credentialsRm(name, opts));
 program.command("dev-status").description("Show the status of a `vibeview dev --detach` session in this project").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print as one JSON line", false).action((opts) => devStatus(opts));
 program.command("dev-stop").description("Stop a `vibeview dev --detach` session in this project").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print as one JSON line", false).action((opts) => devStop(opts));
 program.command("mcp").description(
   "Run an MCP stdio server exposing the agent verbs (tap, swipe, type, ...) plus dev_start/dev_stop as tools"
 ).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").action(async (opts) => {
-  const { runMcpServer } = await import("./server-JA5A5PY6.js");
+  const { runMcpServer } = await import("./server-KG7CEBEY.js");
   await runMcpServer(opts);
 });
 program.command("agent-setup").description(
@@ -1983,5 +2258,5 @@ program.parseAsync().catch((e) => {
   if (process.env.VIBEVIEW_DEBUG) throw e;
   process.stderr.write(`error: ${e instanceof Error ? e.message : String(e)}
 `);
-  process.exit(EXIT_INFRA_ERROR);
+  process.exit(e instanceof UsageError ? EXIT_TEST_FAIL : EXIT_INFRA_ERROR);
 });

package/dist/{server-JA5A5PY6.js → server-KG7CEBEY.js}

@@ -11,11 +11,11 @@ import {
   readDevState,
   renderEnvelope,
   startDevSession
-} from "./chunk-YFXMXO5T.js";
+} from "./chunk-2VNBRBST.js";
 import {
   ApiClient,
   resolveAuth
-} from "./chunk-J7V3GYOI.js";
+} from "./chunk-2WTLJ66O.js";
 
 // src/mcp/server.ts
 import { writeFileSync } from "fs";
@@ -239,7 +239,7 @@ async function handleUploadApp(args, deps) {
   }
   const name = typeof args.name === "string" && args.name ? args.name : void 0;
   const upload = deps.uploadApp ?? (async (f, n) => {
-    const { uploadAppBuild } = await import("./upload-app-ZAWCZFQE.js");
+    const { uploadAppBuild } = await import("./upload-app-NVPQ7KRO.js");
     const { result: result2 } = await uploadAppBuild(f, { ...deps.auth, name: n });
     return result2;
   });