vibeview 0.52.2 → 0.54.0

package/README.md

@@ -91,6 +91,7 @@ Build-time secrets work the same way:
 
 ```bash
 vibeview env set NPM_TOKEN "..."        # secret by default, injected into builds
+vibeview env set API_URL "https://staging.example.com" --plain --profile preview  # only preview builds
 vibeview webhooks add --url https://ci.example.com/hooks/vibeview
 ```
 

package/dist/{chunk-S4VPSFPP.js → chunk-77OGQKZQ.js}

@@ -13,7 +13,7 @@ import {
   resolveArtifact,
   resolveAuth,
   uploadAppBuild
-} from "./chunk-LRPZFDKL.js";
+} from "./chunk-R4GTQPZH.js";
 
 // src/lib/formatters/not-checked.ts
 function notCheckedSteps(steps) {
@@ -5566,6 +5566,15 @@ var AGENT_COMMANDS = [
       }
     ]
   },
+  {
+    // shake: {} — the same control as the dashboard's Shake button. One shake
+    // per call. Phones, tablets and foldables; refused on TV devices.
+    verb: "shake",
+    tool: "shake",
+    summary: "Shake the device once (phones, tablets and foldables)",
+    mutating: true,
+    params: []
+  },
   {
     // set_location: { latitude: -90..90, longitude: -180..180 } — both
     // required (agent_control.py validate_tool_args refuses anything else).
@@ -6074,6 +6083,7 @@ export {
   stepsNotCheckedLabel,
   notCheckedSuffix,
   outcomeOf,
+  PROFILE_NAME_RE,
   developmentProfile,
   DEV_PLATFORMS,
   PLATFORM_NEEDS_METRO,

package/dist/{chunk-LRPZFDKL.js → chunk-R4GTQPZH.js}

@@ -560,7 +560,8 @@ var ApiClient = class {
     return this.requestRaw("GET", `/build-env/${qs}`);
   }
   /** POST /api/v1/build-env/ (JSON body) for a plain/sensitive/secret value.
-   *  Requires ADMIN role. Upserts by (org, app, name). */
+   *  Requires ADMIN role. Upserts by (org, app, profile, name); `profile`
+   *  omitted = every build profile. */
   async setBuildEnvVar(body) {
     return this.requestRaw("POST", "/build-env/", body);
   }
@@ -573,6 +574,7 @@ var ApiClient = class {
     formData.append("name", body.name);
     formData.append("visibility", body.visibility);
     if (body.app) formData.append("app", body.app);
+    if (body.profile) formData.append("profile", body.profile);
     const blob = new Blob([new Uint8Array(body.content)]);
     formData.append("file", blob, body.filename);
     return this.requestFormData("POST", "/build-env/", formData);
@@ -585,11 +587,15 @@ var ApiClient = class {
   async deleteBuildEnvVar(id) {
     await this.requestRaw("DELETE", `/build-env/${id}`);
   }
-  /** GET /api/v1/build-env/pull[?app=]. Requires DEVELOPER role. The only
-   *  endpoint that returns values — already excludes secret/file variables
-   *  server-side. */
-  async pullBuildEnvVars(app) {
-    const qs = app ? `?app=${encodeURIComponent(app)}` : "";
+  /** GET /api/v1/build-env/pull[?app=][&profile=]. Requires DEVELOPER role.
+   *  The only endpoint that returns values — already excludes secret/file
+   *  variables server-side. With `profile`, the values a build of that
+   *  profile gets (precedence resolved server-side). */
+  async pullBuildEnvVars(app, profile) {
+    const params = new URLSearchParams();
+    if (app) params.set("app", app);
+    if (profile) params.set("profile", profile);
+    const qs = params.toString() ? `?${params.toString()}` : "";
     return this.requestRaw("GET", `/build-env/pull${qs}`);
   }
   /** GET /api/v1/signing-credentials/[?app=]. Requires VIEWER role. Never
@@ -670,8 +676,26 @@ var ApiClient = class {
   async deletePlayKey(id) {
     await this.requestRaw("DELETE", `/signing-credentials/play-keys/${id}`);
   }
+  /** GET /api/v1/signing-credentials/amazon-keys. VIEWER role. */
+  async listAmazonKeys() {
+    return this.requestRaw("GET", "/signing-credentials/amazon-keys");
+  }
+  /** POST /api/v1/signing-credentials/amazon-keys (JSON). ADMIN role. The
+   *  backend mints an Amazon token first, so bad credentials fail here. */
+  async addAmazonKey(body) {
+    return this.requestRaw("POST", "/signing-credentials/amazon-keys", {
+      ...body.name !== void 0 ? { name: body.name } : {},
+      client_id: body.clientId,
+      client_secret: body.clientSecret
+    });
+  }
+  /** DELETE /api/v1/signing-credentials/amazon-keys/{id}. ADMIN role. */
+  async deleteAmazonKey(id) {
+    await this.requestRaw("DELETE", `/signing-credentials/amazon-keys/${id}`);
+  }
   /** POST /api/v1/submissions — submit a succeeded production build's
-   *  artifact to TestFlight (ios/tvos) or a Play track (android/androidtv).
+   *  artifact to TestFlight (ios/tvos), a Play track (android/androidtv), or
+   *  Amazon Appstore review (android/androidtv with store "amazon").
    *  `platform` is always sent: the backend derives the real platform from
    *  the build row and 400s on a mismatch, so a pasted wrong --build id
    *  fails loudly instead of silently submitting to the other store family.
@@ -688,16 +712,22 @@ var ApiClient = class {
       ...body.ascKey !== void 0 ? { asc_key: body.ascKey } : {},
       ...body.releaseStatus !== void 0 ? { release_status: body.releaseStatus } : {},
       ...body.rollout !== void 0 ? { rollout: body.rollout } : {},
-      ...body.changesNotSentForReview !== void 0 ? { changes_not_sent_for_review: body.changesNotSentForReview } : {}
+      ...body.changesNotSentForReview !== void 0 ? { changes_not_sent_for_review: body.changesNotSentForReview } : {},
+      ...body.store !== void 0 ? { store: body.store } : {},
+      ...body.amazonAppId !== void 0 ? { amazon_app_id: body.amazonAppId } : {},
+      ...body.releaseNotes !== void 0 ? { release_notes: body.releaseNotes } : {},
+      ...body.discardOpenEdit !== void 0 ? { discard_open_edit: body.discardOpenEdit } : {}
     });
   }
   /** GET /api/v1/submissions/preflight — is the store ready to receive
-   *  this app? Answers by identifier (bundle id / package name), so it can
-   *  run before any build exists. Always resolves — a "not ready" is an
+   *  this app? Answers by identifier (bundle id / package name, or an
+   *  Amazon App ID with store "amazon"), so it can run before any build
+   *  exists. Always resolves — a "not ready" is an
    *  answer carried in `status`/`message`, never a thrown error. */
   async checkStorePreflight(q) {
     const params = new URLSearchParams({ platform: q.platform, identifier: q.identifier });
     if (q.ascKey !== void 0) params.set("asc_key", q.ascKey);
+    if (q.store !== void 0) params.set("store", q.store);
     return this.requestRaw("GET", `/submissions/preflight?${params.toString()}`);
   }
   /** GET /api/v1/submissions?build=<id> — that build's submissions, newest

package/dist/cli.js

@@ -4,6 +4,7 @@ import {
   BUILD_TERMINAL_STATUSES,
   FEEDBACK_KINDS,
   FEEDBACK_RULES,
+  PROFILE_NAME_RE,
   buildCommand,
   clearDevState,
   createRokuPush,
@@ -35,7 +36,7 @@ import {
   runAgentVerb,
   runStepsNotChecked,
   stepsNotCheckedLabel
-} from "./chunk-S4VPSFPP.js";
+} from "./chunk-77OGQKZQ.js";
 import {
   ApiClient,
   ApiStatusError,
@@ -58,7 +59,7 @@ import {
   runCommandParseExitCode,
   saveConfig,
   uploadApp
-} from "./chunk-LRPZFDKL.js";
+} from "./chunk-R4GTQPZH.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -2376,6 +2377,14 @@ var SUBMIT_PLATFORMS = ["ios", "tvos", "android", "androidtv"];
 function isSubmitPlatform(p) {
   return SUBMIT_PLATFORMS.includes(p);
 }
+var SUBMIT_STORES = {
+  ios: ["app_store"],
+  tvos: ["app_store"],
+  android: ["play", "amazon"],
+  androidtv: ["play", "amazon"]
+};
+var AMAZON_APP_ID_RE = /^amzn1\.devportal\.mobileapp\.[0-9a-f]{32}$/;
+var AMAZON_APK_PROFILE_HINT = 'Amazon needs a build profile with "distribution": "production" whose command builds a signed .apk (e.g. ./gradlew assembleRelease) \u2014 see https://vibeview.io/docs/store-submission#build-an-apk.';
 var PLAY_TRACKS = ["internal", "alpha", "beta", "production"];
 var RELEASE_STATUSES = ["completed", "draft", "inProgress"];
 function submitConfigFor(cwd, platform) {
@@ -2431,9 +2440,25 @@ async function submitCommand(opts, deps) {
   }
   const platform = opts.platform;
   const androidFamily = platform === "android" || platform === "androidtv";
+  if (opts.store !== void 0) {
+    if (!androidFamily) {
+      throw new UsageError(
+        `--store only applies to android/androidtv (Google Play or Amazon Appstore) \u2014 ${platform} builds go to TestFlight`
+      );
+    }
+    if (!SUBMIT_STORES[platform].includes(opts.store)) {
+      throw new UsageError(
+        `--store must be one of ${SUBMIT_STORES[platform].join(", ")} \u2014 got "${opts.store}"`
+      );
+    }
+  }
+  const amazon = opts.store === "amazon";
+  const play = androidFamily && !amazon;
+  const apple = !androidFamily;
+  const target = amazon ? "--store amazon" : platform;
   if (opts.check && (opts.build || opts.latest)) {
     throw new UsageError(
-      "--check looks the app up by identifier, not by build \u2014 drop --build/--latest (pass --bundle-id for ios/tvos or --package for android/androidtv)"
+      "--check looks the app up by identifier, not by build \u2014 drop --build/--latest " + (amazon ? "(pass --amazon-app-id)" : "(pass --bundle-id for ios/tvos or --package for android/androidtv)")
     );
   }
   if (!opts.check && opts.bundleId !== void 0) {
@@ -2449,38 +2474,63 @@ async function submitCommand(opts, deps) {
       "pass --build <id> (see `vibeview builds list`) or --latest (the newest succeeded production build for this platform)"
     );
   }
-  if (!androidFamily && opts.track !== void 0) {
-    throw new UsageError(`--track only applies to android/androidtv (Play) \u2014 not ${platform}`);
+  if (!play && opts.track !== void 0) {
+    throw new UsageError(`--track only applies to android/androidtv (Play) \u2014 not ${target}`);
+  }
+  if (!play && opts.package !== void 0) {
+    throw new UsageError(`--package only applies to android/androidtv (Play) \u2014 not ${target}`);
   }
-  if (!androidFamily && opts.package !== void 0) {
-    throw new UsageError(`--package only applies to android/androidtv (Play) \u2014 not ${platform}`);
+  if (!apple && opts.ascKey !== void 0) {
+    throw new UsageError(`--asc-key only applies to ios/tvos (TestFlight) \u2014 not ${target}`);
   }
-  if (androidFamily && opts.ascKey !== void 0) {
-    throw new UsageError(`--asc-key only applies to ios/tvos (TestFlight) \u2014 not ${platform}`);
+  if (!apple && opts.bundleId !== void 0) {
+    throw new UsageError(
+      amazon ? "--bundle-id only applies to ios/tvos \u2014 for --store amazon pass --amazon-app-id <id>" : `--bundle-id only applies to ios/tvos \u2014 for ${platform} pass --package <name>`
+    );
   }
-  if (androidFamily && opts.bundleId !== void 0) {
+  if (!play && opts.releaseStatus !== void 0) {
     throw new UsageError(
-      `--bundle-id only applies to ios/tvos \u2014 for ${platform} pass --package <name>`
+      `--release-status only applies to android/androidtv (Play) \u2014 not ${target}`
     );
   }
-  if (!androidFamily && opts.releaseStatus !== void 0) {
+  if (!play && opts.rollout !== void 0) {
+    throw new UsageError(`--rollout only applies to android/androidtv (Play) \u2014 not ${target}`);
+  }
+  if (!amazon) {
+    for (const [flag, value] of [
+      ["--amazon-app-id", opts.amazonAppId],
+      ["--release-notes", opts.releaseNotes],
+      ["--discard-open-edit", opts.discardOpenEdit || void 0]
+    ]) {
+      if (value !== void 0) {
+        throw new UsageError(
+          `${flag} only applies with --store amazon (Amazon Appstore, android/androidtv)`
+        );
+      }
+    }
+  }
+  const amazonAppId = opts.amazonAppId?.trim() || void 0;
+  if (amazonAppId !== void 0 && !AMAZON_APP_ID_RE.test(amazonAppId)) {
     throw new UsageError(
-      `--release-status only applies to android/androidtv (Play) \u2014 not ${platform}`
+      `--amazon-app-id must be an Amazon App ID (amzn1.devportal.mobileapp. followed by 32 hex characters) \u2014 got "${amazonAppId}"`
     );
   }
-  if (!androidFamily && opts.rollout !== void 0) {
-    throw new UsageError(`--rollout only applies to android/androidtv (Play) \u2014 not ${platform}`);
+  const releaseNotes = opts.releaseNotes?.trim() || void 0;
+  if (amazon && !opts.check && releaseNotes === void 0) {
+    throw new UsageError(
+      '--release-notes "<text>" is required with --store amazon \u2014 they are written to every language of your Amazon listing'
+    );
   }
-  const cfgDefaults = submitConfigFor(process.cwd(), platform);
-  const track = opts.track ?? (androidFamily ? cfgDefaults.track : void 0);
-  const releaseStatus = opts.releaseStatus ?? (androidFamily ? cfgDefaults.releaseStatus : void 0);
+  const cfgDefaults = amazon ? {} : submitConfigFor(process.cwd(), platform);
+  const track = opts.track ?? (play ? cfgDefaults.track : void 0);
+  const releaseStatus = opts.releaseStatus ?? (play ? cfgDefaults.releaseStatus : void 0);
   const statusUnchanged = opts.releaseStatus === void 0 || opts.releaseStatus === cfgDefaults.releaseStatus;
-  const rollout = opts.rollout !== void 0 ? validateRolloutFraction(Number(opts.rollout), "--rollout", opts.rollout) : androidFamily && statusUnchanged && cfgDefaults.rollout !== void 0 ? validateRolloutFraction(
+  const rollout = opts.rollout !== void 0 ? validateRolloutFraction(Number(opts.rollout), "--rollout", opts.rollout) : play && statusUnchanged && cfgDefaults.rollout !== void 0 ? validateRolloutFraction(
     cfgDefaults.rollout,
     `vibeview.json platforms.${platform}.submit.rollout`
   ) : void 0;
-  const changesNotSentForReview = androidFamily ? cfgDefaults.changesNotSentForReview : void 0;
-  const ascKey2 = opts.ascKey ?? (!androidFamily ? cfgDefaults.ascKey : void 0);
+  const changesNotSentForReview = play ? cfgDefaults.changesNotSentForReview : void 0;
+  const ascKey2 = opts.ascKey ?? (apple ? cfgDefaults.ascKey : void 0);
   if (track !== void 0 && !PLAY_TRACKS.includes(track)) {
     const source = opts.track !== void 0 ? "--track" : `vibeview.json platforms.${platform}.submit.track`;
     throw new UsageError(`${source} must be one of ${PLAY_TRACKS.join(", ")} \u2014 got "${track}"`);
@@ -2505,11 +2555,11 @@ async function submitCommand(opts, deps) {
   const client = new ApiClient(baseUrl, token);
   const d = deps ?? defaultDeps2(client);
   if (opts.check) {
-    await checkStore(platform, androidFamily, ascKey2, opts, d);
+    await checkStore(platform, { androidFamily, amazon, amazonAppId }, ascKey2, opts, d);
     return;
   }
   try {
-    const buildId = opts.build ?? await resolveLatestBuild(platform, d);
+    const buildId = opts.build ?? await resolveLatestBuild(platform, amazon, d);
     const sub = await d.createSubmission({
       build: buildId,
       platform,
@@ -2518,7 +2568,11 @@ async function submitCommand(opts, deps) {
       ...ascKey2 !== void 0 ? { ascKey: ascKey2 } : {},
       ...releaseStatus !== void 0 ? { releaseStatus } : {},
       ...rollout !== void 0 ? { rollout } : {},
-      ...changesNotSentForReview !== void 0 ? { changesNotSentForReview } : {}
+      ...changesNotSentForReview !== void 0 ? { changesNotSentForReview } : {},
+      ...amazon ? { store: "amazon" } : {},
+      ...amazonAppId !== void 0 ? { amazonAppId } : {},
+      ...releaseNotes !== void 0 ? { releaseNotes } : {},
+      ...amazon && opts.discardOpenEdit ? { discardOpenEdit: true } : {}
     });
     emit(opts.json, {
       event: "submission_created",
@@ -2546,13 +2600,14 @@ async function submitCommand(opts, deps) {
     process.exitCode = errorExitCode(err);
   }
 }
-async function checkStore(platform, androidFamily, ascKey2, opts, deps) {
-  const flagged = androidFamily ? opts.package : opts.bundleId;
-  const usage = androidFamily ? `--check needs the package name to look up: --package <name> (e.g. --package io.example.app)` : `--check needs the bundle identifier to look up: --bundle-id <id> (e.g. --bundle-id io.example.app)`;
+async function checkStore(platform, family, ascKey2, opts, deps) {
+  const { androidFamily, amazon } = family;
+  const flagged = amazon ? family.amazonAppId : androidFamily ? opts.package : opts.bundleId;
+  const usage = amazon ? "--check needs the Amazon App ID to look up: --amazon-app-id <id> (in the Amazon Developer Console open the app, then Upload Your App File \u2192 Additional information \u2192 App ID)" : androidFamily ? `--check needs the package name to look up: --package <name> (e.g. --package io.example.app)` : `--check needs the bundle identifier to look up: --bundle-id <id> (e.g. --bundle-id io.example.app)`;
   let identifier = flagged;
   if (!identifier) {
     try {
-      identifier = await linkedIdentifier(platform, opts, deps);
+      identifier = await linkedIdentifier(platform, amazon, opts, deps);
     } catch (err) {
       printError2(opts, err);
       process.exitCode = errorExitCode(err);
@@ -2564,7 +2619,8 @@ async function checkStore(platform, androidFamily, ascKey2, opts, deps) {
     const result = await deps.checkStorePreflight({
       platform,
       identifier,
-      ...ascKey2 !== void 0 ? { ascKey: ascKey2 } : {}
+      ...ascKey2 !== void 0 ? { ascKey: ascKey2 } : {},
+      ...amazon ? { store: "amazon" } : {}
     });
     emit(opts.json, { event: "preflight", ...result });
     if (!opts.json) {
@@ -2573,7 +2629,17 @@ async function checkStore(platform, androidFamily, ascKey2, opts, deps) {
       if (result.ready) {
         console.error(
           chalk17.dim(
-            `  next: vibeview build --cloud --production --platform ${platform}, then vibeview submit --platform ${platform} --latest`
+            amazon ? (
+              // Amazon takes an .apk — under the documented setup that is its
+              // own profile, not --production (an .aab). The profile must
+              // say "distribution": "production" (a prompt-created profile
+              // has none, so it builds for the simulator and --latest never
+              // finds it).
+              // The suggested command never carries --discard-open-edit:
+              // deleting the user's edit is their call, on its own line.
+              `  next: vibeview build --cloud --platform ${platform} --profile <your .apk profile, e.g. amazon>, then vibeview submit --platform ${platform} --store amazon --latest --release-notes "<what's new in this version>"` + (flagged ? ` --amazon-app-id ${flagged}` : "") + `
+  ${AMAZON_APK_PROFILE_HINT}` + (result.open_edit ? "\n  An edit is open in the Amazon Developer Console \u2014 finish or delete it there, or add --discard-open-edit to delete it (and the changes in it)." : "")
+            ) : `  next: vibeview build --cloud --production --platform ${platform}, then vibeview submit --platform ${platform} --latest`
           )
         );
       }
@@ -2584,7 +2650,7 @@ async function checkStore(platform, androidFamily, ascKey2, opts, deps) {
     process.exitCode = errorExitCode(err);
   }
 }
-async function linkedIdentifier(platform, opts, deps) {
+async function linkedIdentifier(platform, amazon, opts, deps) {
   if (!deps.getApp) return void 0;
   let appId;
   try {
@@ -2599,18 +2665,19 @@ async function linkedIdentifier(platform, opts, deps) {
   } catch (err) {
     if (err instanceof NotFoundError) {
       throw new Error(
-        `the app linked in vibeview.json for ${platform} (${appId}) no longer exists \u2014 ` + (platform === "android" || platform === "androidtv" ? "pass --package <name>" : "pass --bundle-id <id>")
+        `the app linked in vibeview.json for ${platform} (${appId}) no longer exists \u2014 ` + (amazon ? "pass --amazon-app-id <id>" : platform === "android" || platform === "androidtv" ? "pass --package <name>" : "pass --bundle-id <id>")
       );
     }
     throw err;
   }
-  if (!app.package_name) return void 0;
+  const identifier = amazon ? app.amazon_app_id ?? void 0 : app.package_name;
+  if (!identifier) return void 0;
   if (!opts.json) {
-    console.error(chalk17.dim(`Checking ${app.package_name} (${app.name}, linked in vibeview.json)`));
+    console.error(chalk17.dim(`Checking ${identifier} (${app.name}, linked in vibeview.json)`));
   }
-  return app.package_name;
+  return identifier;
 }
-async function resolveLatestBuild(platform, deps) {
+async function resolveLatestBuild(platform, apkOnly, deps) {
   const { builds: builds2 } = await deps.listCloudBuilds({
     platform,
     status: "succeeded",
@@ -2618,8 +2685,13 @@ async function resolveLatestBuild(platform, deps) {
     limit: 200
   });
   const match = builds2.find(
-    (b) => b.platform === platform && b.distribution === "production" && b.status === "succeeded" && b.has_artifact
+    (b) => b.platform === platform && b.distribution === "production" && b.status === "succeeded" && b.has_artifact && (!apkOnly || (b.artifact_filename ?? "").toLowerCase().endsWith(".apk"))
   );
+  if (!match && apkOnly) {
+    throw new Error(
+      `no submittable ${platform} .apk build found \u2014 Amazon's API accepts only .apk files, so --latest needs a succeeded production .apk build whose artifact is still stored. ${AMAZON_APK_PROFILE_HINT} Or pass --build <id> (see \`vibeview builds list\`).`
+    );
+  }
   if (!match) {
     throw new Error(
       `no submittable ${platform} build found \u2014 --latest needs a succeeded production build whose artifact is still stored. Run \`vibeview build --cloud --production --platform ${platform}\` first, or pass --build <id> (see \`vibeview builds list\`).`
@@ -2882,6 +2954,17 @@ function isGitIgnored(path, cwd = process.cwd()) {
 }
 
 // src/commands/env.ts
+function checkProfileOption(profile) {
+  if (profile === void 0) return;
+  if (!PROFILE_NAME_RE.test(profile)) {
+    throw new Error(
+      `--profile must be a build profile name (lowercase letters, digits and dashes, starting with a letter), got "${profile}"`
+    );
+  }
+}
+function profileLabel(profile) {
+  return profile ? `profile "${profile}"` : "every profile";
+}
 function clientFor(opts) {
   const { token, baseUrl } = resolveAuth(opts);
   return new ApiClient(baseUrl, token);
@@ -2900,10 +2983,20 @@ function defaultDeps5(client) {
     listVars: (app) => client.listBuildEnvVars(app),
     setVar: (body) => client.setBuildEnvVar(body),
     setFileVar: (body) => client.setBuildEnvFileVar(body),
-    rmVar: async ({ name, app }) => {
+    rmVar: async ({ name, app, profile }) => {
       const { variables } = await client.listBuildEnvVars(app);
       const wantApp = app ?? null;
-      const match = variables.find((v) => v.name === name && (v.app_public_id ?? null) === wantApp);
+      const wantProfile = profile ?? null;
+      const inScope = variables.filter(
+        (v) => v.name === name && (v.app_public_id ?? null) === wantApp
+      );
+      const match = inScope.find((v) => (v.profile ?? null) === wantProfile);
+      if (!match && inScope.length > 0) {
+        const others = inScope.map((v) => v.profile ? `--profile ${v.profile}` : "no --profile (every profile)").join(", ");
+        throw new Error(
+          `No variable named "${name}" for ${profileLabel(wantProfile)}${app ? ` in app "${app}"` : ""}. It exists for: ${others}. Re-run with the matching --profile to remove one.`
+        );
+      }
       if (!match) {
         const otherScope = variables.find((v) => v.name === name);
         if (otherScope) {
@@ -2915,7 +3008,7 @@ function defaultDeps5(client) {
       }
       await client.deleteBuildEnvVar(match.id);
     },
-    pullVars: (app) => client.pullBuildEnvVars(app),
+    pullVars: (app, profile) => client.pullBuildEnvVars(app, profile),
     // `hidden` is always true in practice (env set only prompts for secret
     // values), but the parameter exists so a future caller/test can't
     // accidentally get echoed input by omitting it.
@@ -2928,9 +3021,11 @@ function defaultDeps5(client) {
   };
 }
 async function envList(opts, deps) {
+  checkProfileOption(opts.profile);
   const d = deps ?? defaultDeps5(clientFor(opts));
   try {
-    const { variables } = await d.listVars(opts.app);
+    const listed = (await d.listVars(opts.app)).variables;
+    const variables = opts.profile ? listed.filter((v) => (v.profile ?? null) === null || v.profile === opts.profile) : listed;
     if (opts.json) {
       console.log(JSON.stringify(variables, null, 2));
     } else {
@@ -2946,11 +3041,12 @@ function formatEnvVarsHuman(variables) {
   if (variables.length === 0) {
     return "No build variables found.\n";
   }
-  const HEADERS3 = ["NAME", "VISIBILITY", "SCOPE", "HINT"];
+  const HEADERS3 = ["NAME", "VISIBILITY", "SCOPE", "PROFILE", "HINT"];
   const rows = variables.map((v) => [
     v.name,
     v.is_file ? `${v.visibility} (file)` : v.visibility,
     v.app_public_id ?? "org-wide",
+    v.profile ?? "all",
     v.value_hint ?? ""
   ]);
   const widths = HEADERS3.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
@@ -2961,6 +3057,7 @@ function formatEnvVarsHuman(variables) {
   return lines.join("\n") + "\n";
 }
 async function envSet(name, value, opts, deps) {
+  checkProfileOption(opts.profile);
   const d = deps ?? defaultDeps5(clientFor(opts));
   let resolvedValue = value;
   if (resolvedValue === void 0 && !opts.file) {
@@ -2975,7 +3072,14 @@ async function envSet(name, value, opts, deps) {
     if (opts.file) {
       const content = await d.readFile(opts.file);
       const filename = basename2(opts.file);
-      const result2 = await d.setFileVar({ name, content, filename, visibility, app: opts.app });
+      const result2 = await d.setFileVar({
+        name,
+        content,
+        filename,
+        visibility,
+        app: opts.app,
+        profile: opts.profile
+      });
       printSetResult(opts, result2);
       process.exitCode = 0;
       return;
@@ -2983,7 +3087,13 @@ async function envSet(name, value, opts, deps) {
     if (resolvedValue === void 0) {
       resolvedValue = await d.prompt({ message: `Value for ${name}`, hidden: true });
     }
-    const result = await d.setVar({ name, value: resolvedValue, visibility, app: opts.app });
+    const result = await d.setVar({
+      name,
+      value: resolvedValue,
+      visibility,
+      app: opts.app,
+      profile: opts.profile
+    });
     printSetResult(opts, result);
     process.exitCode = 0;
   } catch (err) {
@@ -3006,17 +3116,20 @@ function printSetResult(opts, result) {
   if (opts.json) {
     console.log(JSON.stringify(result));
   } else {
-    console.log(chalk20.green(`\u2713 set ${result.name} (${result.visibility})`));
+    const forProfile = opts.profile ? `, profile ${opts.profile}` : "";
+    console.log(chalk20.green(`\u2713 set ${result.name} (${result.visibility}${forProfile})`));
   }
 }
 async function envRm(name, opts, deps) {
+  checkProfileOption(opts.profile);
   const d = deps ?? defaultDeps5(clientFor(opts));
   try {
-    await d.rmVar({ name, app: opts.app });
+    await d.rmVar({ name, app: opts.app, profile: opts.profile });
     if (opts.json) {
-      console.log(JSON.stringify({ event: "deleted", name }));
+      console.log(JSON.stringify({ event: "deleted", name, profile: opts.profile ?? null }));
     } else {
-      console.log(chalk20.green(`\u2713 removed ${name}`));
+      const forProfile = opts.profile ? ` (profile ${opts.profile})` : "";
+      console.log(chalk20.green(`\u2713 removed ${name}${forProfile}`));
     }
     process.exitCode = 0;
   } catch (err) {
@@ -3025,10 +3138,11 @@ async function envRm(name, opts, deps) {
   }
 }
 async function envPull(opts, deps) {
+  checkProfileOption(opts.profile);
   const d = deps ?? defaultDeps5(clientFor(opts));
   const outPath = opts.out ?? ".env";
   try {
-    const { variables } = await d.pullVars(opts.app);
+    const { variables } = await d.pullVars(opts.app, opts.profile);
     const ignored = await d.isIgnored(outPath);
     if (!ignored) {
       d.warn(
@@ -3160,7 +3274,24 @@ function defaultDeps6(client) {
       }
       await client.deletePlayKey(match.id);
     },
-    prompt: ({ message, hidden }) => hidden ? password2({ message }) : input({ message }),
+    addAmazonKey: (body) => client.addAmazonKey(body),
+    listAmazonKeys: () => client.listAmazonKeys(),
+    deleteAmazonKey: async (name) => {
+      const { keys } = await client.listAmazonKeys();
+      const match = keys.find((k) => k.name === name);
+      if (!match) {
+        throw new Error(`No Amazon Appstore key named "${name}" found.`);
+      }
+      await client.deleteAmazonKey(match.id);
+    },
+    readStdin: async () => {
+      const chunks = [];
+      for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+      return Buffer.concat(chunks).toString("utf8");
+    },
+    // Prompts render on stderr: inquirer defaults to stdout, which would put
+    // "? Client secret" and its echo ahead of a --json line.
+    prompt: ({ message, hidden }) => hidden ? password2({ message }, { output: process.stderr }) : input({ message }, { output: process.stderr }),
     isTTY: Boolean(process.stdin.isTTY),
     readFile: (path) => readFileAsync2(path),
     fileExists: (path) => access(path).then(
@@ -3593,6 +3724,88 @@ async function playKeyRm(name, opts, deps) {
     process.exitCode = errorExitCode(err);
   }
 }
+async function amazonKeyAdd(opts, deps) {
+  const d = deps ?? defaultDeps6(clientFor2(opts));
+  if (!opts.clientId?.trim()) {
+    throw new UsageError(
+      "--client-id is required (the security profile client ID from the Amazon Developer Console \u2192 API Access)"
+    );
+  }
+  const raw = d.isTTY ? await d.prompt({ message: "Client secret", hidden: true }) : await d.readStdin();
+  const clientSecret = raw.trim();
+  if (!clientSecret) {
+    throw new UsageError(
+      "a client secret is required: run interactively to be prompted, or pipe it on stdin (secrets are never accepted as flags)"
+    );
+  }
+  try {
+    const result = await d.addAmazonKey({
+      ...opts.name !== void 0 ? { name: opts.name } : {},
+      clientId: opts.clientId.trim(),
+      clientSecret
+    });
+    if (opts.json) {
+      console.log(JSON.stringify(result));
+    } else {
+      console.log(chalk21.green(`\u2713 added Amazon Appstore key ${result.name}`));
+      console.log("");
+      console.log(`  Client ID: ${chalk21.bold(result.client_id)}`);
+      console.log("");
+      console.log(
+        chalk21.yellow(
+          "  The client secret is stored encrypted and will never be shown again \u2014 keep your own copy somewhere safe."
+        )
+      );
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError5(opts, err);
+    process.exitCode = errorExitCode(err);
+  }
+}
+async function amazonKeyList(opts, deps) {
+  const d = deps ?? defaultDeps6(clientFor2(opts));
+  try {
+    const { keys } = await d.listAmazonKeys();
+    if (opts.json) {
+      console.log(JSON.stringify(keys, null, 2));
+    } else {
+      process.stdout.write(formatAmazonKeysHuman(keys));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError5(opts, err);
+    process.exitCode = errorExitCode(err);
+  }
+}
+function formatAmazonKeysHuman(keys) {
+  if (keys.length === 0) {
+    return "No Amazon Appstore keys found.\n";
+  }
+  const HEADERS3 = ["NAME", "CLIENT ID", "CREATED"];
+  const rows = keys.map((k) => [k.name, k.client_id, formatUtcTimestamp(k.created_at)]);
+  const widths = HEADERS3.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+  const padCells = (cells) => cells.map((c, i) => c.padEnd(widths[i]));
+  const join5 = (cells) => cells.join("  ").trimEnd();
+  const lines = [chalk21.bold(join5(padCells(HEADERS3)))];
+  for (const row of rows) lines.push(join5(padCells(row)));
+  return lines.join("\n") + "\n";
+}
+async function amazonKeyRm(name, opts, deps) {
+  const d = deps ?? defaultDeps6(clientFor2(opts));
+  try {
+    await d.deleteAmazonKey(name);
+    if (opts.json) {
+      console.log(JSON.stringify({ event: "deleted", name }));
+    } else {
+      console.log(chalk21.green(`\u2713 removed Amazon Appstore key ${name}`));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError5(opts, err);
+    process.exitCode = errorExitCode(err);
+  }
+}
 async function credentialsList(opts, deps) {
   const d = deps ?? defaultDeps6(clientFor2(opts));
   try {
@@ -4390,7 +4603,7 @@ program.command("build").description("Run your configured build command and uplo
   "--cloud only: the Node.js major to build with (e.g. 24), overriding vibeview.json build.node and the project .nvmrc for this run"
 ).option("--json", "Print the result as one JSON line (NDJSON events with --cloud)", false).action((opts) => buildCommand(opts));
 program.command("submit").description(
-  "Submit a succeeded production cloud build's artifact to TestFlight (ios/tvos) or a Google Play track (android/androidtv) \u2014 binary upload only; store listing and review stay in the store consoles"
+  "Submit a succeeded production cloud build's artifact to TestFlight (ios/tvos), a Google Play track (android/androidtv), or Amazon Appstore review (android/androidtv with --store amazon). TestFlight and Google Play: binary upload only \u2014 store listing and review stay in the store consoles. --store amazon also writes the release notes and sends the version for Amazon review"
 ).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--platform <platform>", "ios, tvos, android, or androidtv").option("--build <id>", "Cloud build id to submit (see `vibeview builds list`)").option(
   "--latest",
   "Submit the newest succeeded production build for --platform (pass exactly one of --build/--latest)",
@@ -4410,9 +4623,21 @@ program.command("submit").description(
 ).option(
   "--rollout <fraction>",
   "android/androidtv only: staged-rollout fraction, 0 < f < 1 (requires --release-status inProgress)"
+).option(
+  "--store <store>",
+  "android/androidtv only: play (Google Play, default) or amazon (Amazon Appstore \u2014 .apk builds only; reaches Fire TV and Fire tablets)"
+).option(
+  "--amazon-app-id <id>",
+  "--store amazon only: the Amazon App ID (Developer Console \u2192 your app \u2192 Upload Your App File \u2192 Additional information); saved on the app, so later submits can omit it"
+).option(
+  "--release-notes <text>",
+  "--store amazon only, required: release notes written to every language of the Amazon listing"
+).option(
+  "--discard-open-edit",
+  "--store amazon only: discard an edit already open in the Amazon Developer Console"
 ).option(
   "--check",
-  "Only check store readiness: does the store know this app with your stored key? Takes --platform plus --bundle-id (ios/tvos) or --package (android/androidtv), defaulting to the app linked in vibeview.json; no build needed. Exit 0 when ready",
+  "Only check store readiness: does the store know this app with your stored key? Takes --platform plus --bundle-id (ios/tvos), --package (android/androidtv) or --amazon-app-id (with --store amazon), defaulting to the app linked in vibeview.json; no build needed. Exit 0 when ready",
   false
 ).option("--bundle-id <id>", "ios/tvos, with --check: the bundle identifier to look up").option("--no-wait", "Print the submission id and exit without waiting for completion").option("--json", "Emit line-delimited JSON events on stdout instead of human output", false).action((opts) => submitCommand(opts));
 var builds = program.command("builds").description("Manage cloud builds (see `vibeview build --cloud`)");
@@ -4432,17 +4657,29 @@ versions.command("set <number>").description(
 ).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "App public id (see `vibeview list-apps`)").option("--platform <platform>", "ios, android, tvos, or androidtv").option("--json", "Print the updated version object as one JSON line", false).action((number, opts) => versionsSet(number, opts));
 program.command("whoami").description("Show which account and role this CLI is authenticated as").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the identity as one JSON line", false).action((opts) => whoAmI(opts));
 var env = program.command("env").description("Manage cloud build environment variables and secrets");
-env.command("list").description("List build variables and secrets (never prints a value)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide variables only)").option("--json", "Print the raw variable list as a JSON array", false).action((opts) => envList(opts));
+env.command("list").description("List build variables and secrets (never prints a value)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide variables only)").option(
+  "--profile <name>",
+  "Only variables a build of this vibeview.json build profile can use (its own + every-profile ones)"
+).option("--json", "Print the raw variable list as a JSON array", false).action((opts) => envList(opts));
 env.command("set <name> [value]").description(
   "Set a build variable or secret. Defaults to --secret (never retrievable via the API) unless --plain or --sensitive is passed explicitly."
-).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide)").option("--secret", "Store as secret (default): never returned by the API, including `env pull`").option(
+).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide)").option(
+  "--profile <name>",
+  "Limit to one vibeview.json build profile (default: every profile); its value beats the every-profile one"
+).option("--secret", "Store as secret (default): never returned by the API, including `env pull`").option(
   "--sensitive",
   "Store as sensitive: value_hint only in `env list`, full value via `env pull`"
 ).option("--plain", "Store as plain: value returned by `env pull`, unmasked").option("--file <path>", "Upload a file as the value (e.g. a keystore) instead of a text value").option("--json", "Print the resulting variable as one JSON line", false).action((name, value, opts) => envSet(name, value, opts));
-env.command("rm <name>").description("Remove a build variable or secret").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide)").option("--json", "Print the result as one JSON line", false).action((name, opts) => envRm(name, opts));
+env.command("rm <name>").description("Remove a build variable or secret").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide)").option(
+  "--profile <name>",
+  "Remove the one limited to this build profile (default: the every-profile one)"
+).option("--json", "Print the result as one JSON line", false).action((name, opts) => envRm(name, opts));
 env.command("pull").description(
   "Write plain/sensitive variable values to a .env file (secrets and files are never included)"
-).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide variables only)").option("--out <path>", "Output file path (default: .env)").option("--json", "Print the result as one JSON line", false).action((opts) => envPull(opts));
+).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide variables only)").option(
+  "--profile <name>",
+  "Write the values a build of this vibeview.json build profile gets (default: every-profile values only)"
+).option("--out <path>", "Output file path (default: .env)").option("--json", "Print the result as one JSON line", false).action((opts) => envPull(opts));
 var credentials = program.command("credentials").description("Manage app-signing credentials for production cloud builds");
 credentials.command("add").description(
   "Add a signing credential. Prompts for passwords with hidden input \u2014 they are never accepted as flags (a flag lands in shell history and in `ps`)."
@@ -4492,6 +4729,14 @@ playKey.command("add").description(
 ).option("--name <name>", "Key name (default: server-chosen)").option("--json", "Print the raw response as one JSON line", false).action((opts) => playKeyAdd(opts));
 playKey.command("list").description("List stored Google Play keys (metadata only \u2014 never the JSON key)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the raw key list as a JSON array", false).action((opts) => playKeyList(opts));
 playKey.command("rm <name>").description("Remove a stored Google Play key").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the result as one JSON line", false).action((name, opts) => playKeyRm(name, opts));
+var amazonKey = credentials.command("amazon-key").description(
+  "Manage Amazon Appstore keys (a security profile attached to the App Submission API) \u2014 they power `vibeview submit --store amazon`"
+);
+amazonKey.command("add").description(
+  "Store an Amazon security profile client ID and secret. The secret is prompted for (or read from stdin when piped), stored encrypted and never shown again; adding the same name again rotates the key."
+).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--client-id <id>", "The security profile client ID").option("--name <name>", "Key name (default: amazon)").option("--json", "Print the raw response as one JSON line", false).action((opts) => amazonKeyAdd(opts));
+amazonKey.command("list").description("List stored Amazon Appstore keys (metadata only \u2014 never the secret)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the raw key list as a JSON array", false).action((opts) => amazonKeyList(opts));
+amazonKey.command("rm <name>").description("Remove a stored Amazon Appstore key").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the result as one JSON line", false).action((name, opts) => amazonKeyRm(name, opts));
 credentials.command("list").description("List signing credentials (never prints key material)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide credentials only)").option("--json", "Print the raw credential list as a JSON array", false).action((opts) => credentialsList(opts));
 credentials.command("rm <name>").description("Remove a signing credential (replace by rm then add)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide)").option("--json", "Print the result as one JSON line", false).action((name, opts) => credentialsRm(name, opts));
 var webhooks = program.command("webhooks").description("Manage build-completion webhook endpoints");
@@ -4520,7 +4765,7 @@ program.command("dev-reload").description(
 program.command("mcp").description(
   "Run an MCP stdio server exposing the agent verbs (tap, swipe, type, ...) plus dev_start/dev_stop/dev_reload as tools"
 ).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").action(async (opts) => {
-  const { runMcpServer } = await import("./server-5VWZMZRE.js");
+  const { runMcpServer } = await import("./server-BGOXC6GL.js");
   await runMcpServer({ ...opts, version: pkg.version });
 });
 program.command("agent-setup").description(

package/dist/{server-5VWZMZRE.js → server-BGOXC6GL.js}

@@ -35,12 +35,12 @@ import {
   renderEnvelope,
   resolveMetro,
   startDevSession
-} from "./chunk-S4VPSFPP.js";
+} from "./chunk-77OGQKZQ.js";
 import {
   ApiClient,
   NotFoundError,
   resolveAuth
-} from "./chunk-LRPZFDKL.js";
+} from "./chunk-R4GTQPZH.js";
 
 // src/mcp/server.ts
 import { writeFileSync } from "fs";
@@ -999,7 +999,7 @@ async function handleUploadApp(args, deps) {
   }
   const name = typeof args.name === "string" && args.name ? args.name : void 0;
   const upload = deps.uploadApp ?? (async (f, n) => {
-    const { uploadAppBuild } = await import("./upload-app-OV3QKL7O.js");
+    const { uploadAppBuild } = await import("./upload-app-CYGKCGJE.js");
     const { result: result2 } = await uploadAppBuild(f, { ...deps.auth, name: n });
     return result2;
   });

package/dist/{upload-app-OV3QKL7O.js → upload-app-CYGKCGJE.js}

@@ -3,7 +3,7 @@ import {
   describeBuild,
   uploadApp,
   uploadAppBuild
-} from "./chunk-LRPZFDKL.js";
+} from "./chunk-R4GTQPZH.js";
 export {
   describeBuild,
   uploadApp,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibeview",
-  "version": "0.52.2",
+  "version": "0.54.0",
   "description": "VibeView CLI -- run your app on cloud iOS simulators, Android emulators, Apple TV, Android TV and Roku devices: a React Native dev loop, device control for you or your coding agent (CLI or MCP), and tests from CI",
   "mcpName": "io.github.vibeview/vibeview",
   "type": "module",

package/skills/vibeview-agent/SKILL.md

@@ -311,6 +311,7 @@ human-readable text.
 | `relaunch-app` | — | Close the app and start it again (cold start, data kept) — for "does it persist after a restart" checks. The app log keeps streaming. Not on embed sessions. |
 | `set-posture` | `<closed\|partial\|open>` or `--angle <0-180>` | Fold or unfold a foldable device (form factor `foldable`: the iPhone Duo, Android foldables) to a preset or an exact hinge angle — exactly one. Reports posture, angle and lit screen. Errors on a device without a hinge. |
 | `rotate` | `[--degrees <90\|180\|270>]` | Rotate the device and report the new orientation. Phones/tablets and Android foldables toggle portrait/landscape (90 only); the iPhone Duo turns a quarter clockwise by default. Not on TV. |
+| `shake` | — | Shake the device once, like the dashboard's Shake button, to open an app's shake-triggered menus (a bug-report screen, the React Native developer menu in a debug build). Phones, tablets and foldables; not on TV or embed sessions. |
 | `set-language` | `<tag\|default>` | Restart the app in another language (`de`, `pt-BR`, …) or the device's (`default`). Only the app changes. iPhone, iPad, Apple TV, Android 13+; not Roku or embed sessions. |
 | `set-status-bar` | `<clean\|default>` | Show the clean screenshot status bar (9:41, full battery and signal) or the device's own. iOS phones and tablets only. |
 | `set-location` | `--lat <n> --lon <n>` | Set the device's simulated GPS position (decimal degrees; west and south are negative) for location-based flows. Phones, tablets and foldables; not on TV. |