vibeview 0.52.2 → 0.53.0

package/README.md

@@ -91,6 +91,7 @@ Build-time secrets work the same way:
 
 ```bash
 vibeview env set NPM_TOKEN "..."        # secret by default, injected into builds
+vibeview env set API_URL "https://staging.example.com" --plain --profile preview  # only preview builds
 vibeview webhooks add --url https://ci.example.com/hooks/vibeview
 ```
 

package/dist/{chunk-S4VPSFPP.js → chunk-O6MXCYWR.js}

@@ -13,7 +13,7 @@ import {
   resolveArtifact,
   resolveAuth,
   uploadAppBuild
-} from "./chunk-LRPZFDKL.js";
+} from "./chunk-YCFQKMG7.js";
 
 // src/lib/formatters/not-checked.ts
 function notCheckedSteps(steps) {
@@ -6074,6 +6074,7 @@ export {
   stepsNotCheckedLabel,
   notCheckedSuffix,
   outcomeOf,
+  PROFILE_NAME_RE,
   developmentProfile,
   DEV_PLATFORMS,
   PLATFORM_NEEDS_METRO,

package/dist/{chunk-LRPZFDKL.js → chunk-YCFQKMG7.js}

@@ -560,7 +560,8 @@ var ApiClient = class {
     return this.requestRaw("GET", `/build-env/${qs}`);
   }
   /** POST /api/v1/build-env/ (JSON body) for a plain/sensitive/secret value.
-   *  Requires ADMIN role. Upserts by (org, app, name). */
+   *  Requires ADMIN role. Upserts by (org, app, profile, name); `profile`
+   *  omitted = every build profile. */
   async setBuildEnvVar(body) {
     return this.requestRaw("POST", "/build-env/", body);
   }
@@ -573,6 +574,7 @@ var ApiClient = class {
     formData.append("name", body.name);
     formData.append("visibility", body.visibility);
     if (body.app) formData.append("app", body.app);
+    if (body.profile) formData.append("profile", body.profile);
     const blob = new Blob([new Uint8Array(body.content)]);
     formData.append("file", blob, body.filename);
     return this.requestFormData("POST", "/build-env/", formData);
@@ -585,11 +587,15 @@ var ApiClient = class {
   async deleteBuildEnvVar(id) {
     await this.requestRaw("DELETE", `/build-env/${id}`);
   }
-  /** GET /api/v1/build-env/pull[?app=]. Requires DEVELOPER role. The only
-   *  endpoint that returns values — already excludes secret/file variables
-   *  server-side. */
-  async pullBuildEnvVars(app) {
-    const qs = app ? `?app=${encodeURIComponent(app)}` : "";
+  /** GET /api/v1/build-env/pull[?app=][&profile=]. Requires DEVELOPER role.
+   *  The only endpoint that returns values — already excludes secret/file
+   *  variables server-side. With `profile`, the values a build of that
+   *  profile gets (precedence resolved server-side). */
+  async pullBuildEnvVars(app, profile) {
+    const params = new URLSearchParams();
+    if (app) params.set("app", app);
+    if (profile) params.set("profile", profile);
+    const qs = params.toString() ? `?${params.toString()}` : "";
     return this.requestRaw("GET", `/build-env/pull${qs}`);
   }
   /** GET /api/v1/signing-credentials/[?app=]. Requires VIEWER role. Never

package/dist/cli.js

@@ -4,6 +4,7 @@ import {
   BUILD_TERMINAL_STATUSES,
   FEEDBACK_KINDS,
   FEEDBACK_RULES,
+  PROFILE_NAME_RE,
   buildCommand,
   clearDevState,
   createRokuPush,
@@ -35,7 +36,7 @@ import {
   runAgentVerb,
   runStepsNotChecked,
   stepsNotCheckedLabel
-} from "./chunk-S4VPSFPP.js";
+} from "./chunk-O6MXCYWR.js";
 import {
   ApiClient,
   ApiStatusError,
@@ -58,7 +59,7 @@ import {
   runCommandParseExitCode,
   saveConfig,
   uploadApp
-} from "./chunk-LRPZFDKL.js";
+} from "./chunk-YCFQKMG7.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -2882,6 +2883,17 @@ function isGitIgnored(path, cwd = process.cwd()) {
 }
 
 // src/commands/env.ts
+function checkProfileOption(profile) {
+  if (profile === void 0) return;
+  if (!PROFILE_NAME_RE.test(profile)) {
+    throw new Error(
+      `--profile must be a build profile name (lowercase letters, digits and dashes, starting with a letter), got "${profile}"`
+    );
+  }
+}
+function profileLabel(profile) {
+  return profile ? `profile "${profile}"` : "every profile";
+}
 function clientFor(opts) {
   const { token, baseUrl } = resolveAuth(opts);
   return new ApiClient(baseUrl, token);
@@ -2900,10 +2912,20 @@ function defaultDeps5(client) {
     listVars: (app) => client.listBuildEnvVars(app),
     setVar: (body) => client.setBuildEnvVar(body),
     setFileVar: (body) => client.setBuildEnvFileVar(body),
-    rmVar: async ({ name, app }) => {
+    rmVar: async ({ name, app, profile }) => {
       const { variables } = await client.listBuildEnvVars(app);
       const wantApp = app ?? null;
-      const match = variables.find((v) => v.name === name && (v.app_public_id ?? null) === wantApp);
+      const wantProfile = profile ?? null;
+      const inScope = variables.filter(
+        (v) => v.name === name && (v.app_public_id ?? null) === wantApp
+      );
+      const match = inScope.find((v) => (v.profile ?? null) === wantProfile);
+      if (!match && inScope.length > 0) {
+        const others = inScope.map((v) => v.profile ? `--profile ${v.profile}` : "no --profile (every profile)").join(", ");
+        throw new Error(
+          `No variable named "${name}" for ${profileLabel(wantProfile)}${app ? ` in app "${app}"` : ""}. It exists for: ${others}. Re-run with the matching --profile to remove one.`
+        );
+      }
       if (!match) {
         const otherScope = variables.find((v) => v.name === name);
         if (otherScope) {
@@ -2915,7 +2937,7 @@ function defaultDeps5(client) {
       }
       await client.deleteBuildEnvVar(match.id);
     },
-    pullVars: (app) => client.pullBuildEnvVars(app),
+    pullVars: (app, profile) => client.pullBuildEnvVars(app, profile),
     // `hidden` is always true in practice (env set only prompts for secret
     // values), but the parameter exists so a future caller/test can't
     // accidentally get echoed input by omitting it.
@@ -2928,9 +2950,11 @@ function defaultDeps5(client) {
   };
 }
 async function envList(opts, deps) {
+  checkProfileOption(opts.profile);
   const d = deps ?? defaultDeps5(clientFor(opts));
   try {
-    const { variables } = await d.listVars(opts.app);
+    const listed = (await d.listVars(opts.app)).variables;
+    const variables = opts.profile ? listed.filter((v) => (v.profile ?? null) === null || v.profile === opts.profile) : listed;
     if (opts.json) {
       console.log(JSON.stringify(variables, null, 2));
     } else {
@@ -2946,11 +2970,12 @@ function formatEnvVarsHuman(variables) {
   if (variables.length === 0) {
     return "No build variables found.\n";
   }
-  const HEADERS3 = ["NAME", "VISIBILITY", "SCOPE", "HINT"];
+  const HEADERS3 = ["NAME", "VISIBILITY", "SCOPE", "PROFILE", "HINT"];
   const rows = variables.map((v) => [
     v.name,
     v.is_file ? `${v.visibility} (file)` : v.visibility,
     v.app_public_id ?? "org-wide",
+    v.profile ?? "all",
     v.value_hint ?? ""
   ]);
   const widths = HEADERS3.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
@@ -2961,6 +2986,7 @@ function formatEnvVarsHuman(variables) {
   return lines.join("\n") + "\n";
 }
 async function envSet(name, value, opts, deps) {
+  checkProfileOption(opts.profile);
   const d = deps ?? defaultDeps5(clientFor(opts));
   let resolvedValue = value;
   if (resolvedValue === void 0 && !opts.file) {
@@ -2975,7 +3001,14 @@ async function envSet(name, value, opts, deps) {
     if (opts.file) {
       const content = await d.readFile(opts.file);
       const filename = basename2(opts.file);
-      const result2 = await d.setFileVar({ name, content, filename, visibility, app: opts.app });
+      const result2 = await d.setFileVar({
+        name,
+        content,
+        filename,
+        visibility,
+        app: opts.app,
+        profile: opts.profile
+      });
       printSetResult(opts, result2);
       process.exitCode = 0;
       return;
@@ -2983,7 +3016,13 @@ async function envSet(name, value, opts, deps) {
     if (resolvedValue === void 0) {
       resolvedValue = await d.prompt({ message: `Value for ${name}`, hidden: true });
     }
-    const result = await d.setVar({ name, value: resolvedValue, visibility, app: opts.app });
+    const result = await d.setVar({
+      name,
+      value: resolvedValue,
+      visibility,
+      app: opts.app,
+      profile: opts.profile
+    });
     printSetResult(opts, result);
     process.exitCode = 0;
   } catch (err) {
@@ -3006,17 +3045,20 @@ function printSetResult(opts, result) {
   if (opts.json) {
     console.log(JSON.stringify(result));
   } else {
-    console.log(chalk20.green(`\u2713 set ${result.name} (${result.visibility})`));
+    const forProfile = opts.profile ? `, profile ${opts.profile}` : "";
+    console.log(chalk20.green(`\u2713 set ${result.name} (${result.visibility}${forProfile})`));
   }
 }
 async function envRm(name, opts, deps) {
+  checkProfileOption(opts.profile);
   const d = deps ?? defaultDeps5(clientFor(opts));
   try {
-    await d.rmVar({ name, app: opts.app });
+    await d.rmVar({ name, app: opts.app, profile: opts.profile });
     if (opts.json) {
-      console.log(JSON.stringify({ event: "deleted", name }));
+      console.log(JSON.stringify({ event: "deleted", name, profile: opts.profile ?? null }));
     } else {
-      console.log(chalk20.green(`\u2713 removed ${name}`));
+      const forProfile = opts.profile ? ` (profile ${opts.profile})` : "";
+      console.log(chalk20.green(`\u2713 removed ${name}${forProfile}`));
     }
     process.exitCode = 0;
   } catch (err) {
@@ -3025,10 +3067,11 @@ async function envRm(name, opts, deps) {
   }
 }
 async function envPull(opts, deps) {
+  checkProfileOption(opts.profile);
   const d = deps ?? defaultDeps5(clientFor(opts));
   const outPath = opts.out ?? ".env";
   try {
-    const { variables } = await d.pullVars(opts.app);
+    const { variables } = await d.pullVars(opts.app, opts.profile);
     const ignored = await d.isIgnored(outPath);
     if (!ignored) {
       d.warn(
@@ -4432,17 +4475,29 @@ versions.command("set <number>").description(
 ).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "App public id (see `vibeview list-apps`)").option("--platform <platform>", "ios, android, tvos, or androidtv").option("--json", "Print the updated version object as one JSON line", false).action((number, opts) => versionsSet(number, opts));
 program.command("whoami").description("Show which account and role this CLI is authenticated as").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the identity as one JSON line", false).action((opts) => whoAmI(opts));
 var env = program.command("env").description("Manage cloud build environment variables and secrets");
-env.command("list").description("List build variables and secrets (never prints a value)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide variables only)").option("--json", "Print the raw variable list as a JSON array", false).action((opts) => envList(opts));
+env.command("list").description("List build variables and secrets (never prints a value)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide variables only)").option(
+  "--profile <name>",
+  "Only variables a build of this vibeview.json build profile can use (its own + every-profile ones)"
+).option("--json", "Print the raw variable list as a JSON array", false).action((opts) => envList(opts));
 env.command("set <name> [value]").description(
   "Set a build variable or secret. Defaults to --secret (never retrievable via the API) unless --plain or --sensitive is passed explicitly."
-).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide)").option("--secret", "Store as secret (default): never returned by the API, including `env pull`").option(
+).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide)").option(
+  "--profile <name>",
+  "Limit to one vibeview.json build profile (default: every profile); its value beats the every-profile one"
+).option("--secret", "Store as secret (default): never returned by the API, including `env pull`").option(
   "--sensitive",
   "Store as sensitive: value_hint only in `env list`, full value via `env pull`"
 ).option("--plain", "Store as plain: value returned by `env pull`, unmasked").option("--file <path>", "Upload a file as the value (e.g. a keystore) instead of a text value").option("--json", "Print the resulting variable as one JSON line", false).action((name, value, opts) => envSet(name, value, opts));
-env.command("rm <name>").description("Remove a build variable or secret").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide)").option("--json", "Print the result as one JSON line", false).action((name, opts) => envRm(name, opts));
+env.command("rm <name>").description("Remove a build variable or secret").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide)").option(
+  "--profile <name>",
+  "Remove the one limited to this build profile (default: the every-profile one)"
+).option("--json", "Print the result as one JSON line", false).action((name, opts) => envRm(name, opts));
 env.command("pull").description(
   "Write plain/sensitive variable values to a .env file (secrets and files are never included)"
-).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide variables only)").option("--out <path>", "Output file path (default: .env)").option("--json", "Print the result as one JSON line", false).action((opts) => envPull(opts));
+).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide variables only)").option(
+  "--profile <name>",
+  "Write the values a build of this vibeview.json build profile gets (default: every-profile values only)"
+).option("--out <path>", "Output file path (default: .env)").option("--json", "Print the result as one JSON line", false).action((opts) => envPull(opts));
 var credentials = program.command("credentials").description("Manage app-signing credentials for production cloud builds");
 credentials.command("add").description(
   "Add a signing credential. Prompts for passwords with hidden input \u2014 they are never accepted as flags (a flag lands in shell history and in `ps`)."
@@ -4520,7 +4575,7 @@ program.command("dev-reload").description(
 program.command("mcp").description(
   "Run an MCP stdio server exposing the agent verbs (tap, swipe, type, ...) plus dev_start/dev_stop/dev_reload as tools"
 ).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").action(async (opts) => {
-  const { runMcpServer } = await import("./server-5VWZMZRE.js");
+  const { runMcpServer } = await import("./server-JLT3PQTH.js");
   await runMcpServer({ ...opts, version: pkg.version });
 });
 program.command("agent-setup").description(

package/dist/{server-5VWZMZRE.js → server-JLT3PQTH.js}

@@ -35,12 +35,12 @@ import {
   renderEnvelope,
   resolveMetro,
   startDevSession
-} from "./chunk-S4VPSFPP.js";
+} from "./chunk-O6MXCYWR.js";
 import {
   ApiClient,
   NotFoundError,
   resolveAuth
-} from "./chunk-LRPZFDKL.js";
+} from "./chunk-YCFQKMG7.js";
 
 // src/mcp/server.ts
 import { writeFileSync } from "fs";
@@ -999,7 +999,7 @@ async function handleUploadApp(args, deps) {
   }
   const name = typeof args.name === "string" && args.name ? args.name : void 0;
   const upload = deps.uploadApp ?? (async (f, n) => {
-    const { uploadAppBuild } = await import("./upload-app-OV3QKL7O.js");
+    const { uploadAppBuild } = await import("./upload-app-KQCXAZST.js");
     const { result: result2 } = await uploadAppBuild(f, { ...deps.auth, name: n });
     return result2;
   });

package/dist/{upload-app-OV3QKL7O.js → upload-app-KQCXAZST.js}

@@ -3,7 +3,7 @@ import {
   describeBuild,
   uploadApp,
   uploadAppBuild
-} from "./chunk-LRPZFDKL.js";
+} from "./chunk-YCFQKMG7.js";
 export {
   describeBuild,
   uploadApp,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibeview",
-  "version": "0.52.2",
+  "version": "0.53.0",
   "description": "VibeView CLI -- run your app on cloud iOS simulators, Android emulators, Apple TV, Android TV and Roku devices: a React Native dev loop, device control for you or your coding agent (CLI or MCP), and tests from CI",
   "mcpName": "io.github.vibeview/vibeview",
   "type": "module",