@condorinst/mobile-bridge 0.21.0 → 0.22.0

package/AGENTS.md

@@ -53,7 +53,7 @@ command (denied by policy).
 ## The golden path
 
 ```bash
-npm install @condorinst/mobile-bridge@^0.21.0
+npm install @condorinst/mobile-bridge@^0.22.0
 ```
 
 ```ts
@@ -137,6 +137,15 @@ answered and dropped. The **◀ OS back** button at the top presses the OS back
 button. `--native-version null` (or `0.15.0`, …) makes the handshake report that
 version, to test your capability branches.
 
+## Publishing — ask the human, never run it yourself
+
+`npx condor-mobile-bridge canvas publish` puts the bundle live at once for every
+user of a company, and asks for the person's password. **Do not run it.** When
+the bundle is ready, tell the human the exact command — for example
+`npx condor-mobile-bridge canvas publish dist/index.html --version 1.0.1` — and
+recommend publishing to their **test company** first. See
+`docs/device-testing.md`.
+
 ## The validation loop — run this before you call the work done
 
 ```bash

package/CHANGELOG.md

@@ -7,6 +7,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.22.0] — 2026-10-20
+
+### Added
+
+- **`condor-mobile-bridge canvas publish | list | revoke`** — publish the bundle
+  of your company in the Condor Canvas app from the command line, through the
+  same endpoints and login as the Condor web admin. The bundle is validated
+  locally first; the command shows company, version, size and hash and asks
+  before sending; the password is read only from a prompt without echo (there
+  is no flag or variable for it) and never stored; the two-factor code is asked
+  when the company uses it. Production API by default; `--env dev` for Condor
+  staff, `--base-url` to override. Company and user ids may come from
+  `CONDOR_CANVAS_COMPANY` / `CONDOR_CANVAS_USER`.
+- `docs/device-testing.md`: publishing from the command line, and the test
+  company workflow.
+
+### Changed
+
+- `docs/device-testing.md` no longer sends clients to a development
+  environment: clients work in production, on a test company.
+- `AGENTS.md`: an agent must never run `canvas publish`; it hands the command to
+  the human.
+
 ## [0.21.0] — 2026-10-20
 
 A client built from the 0.20.0 docs worked in the browser and stalled on the

package/README.md

@@ -20,8 +20,8 @@ Over the network, every document is plain text at a pinned, unauthenticated
 URL. `llms.txt` is the index:
 
 ```
-https://cdn.jsdelivr.net/npm/@condorinst/mobile-bridge@0.21.0/llms.txt
-https://cdn.jsdelivr.net/npm/@condorinst/mobile-bridge@0.21.0/llms-full.txt   # every doc in one file
+https://cdn.jsdelivr.net/npm/@condorinst/mobile-bridge@0.22.0/llms.txt
+https://cdn.jsdelivr.net/npm/@condorinst/mobile-bridge@0.22.0/llms-full.txt   # every doc in one file
 ```
 
 The machine-readable contract — keys, commands, limits, capability matrix — is
@@ -72,8 +72,8 @@ The published package ships a prebuilt `dist/` (ESM + CJS + type
 declarations) — **no build toolchain is required on your side**.
 
 > **Versioning during the pilot.** The package is on `0.x` (beta). Pin
-> `"@condorinst/mobile-bridge": "^0.21.0"`. Under semver, while on `0.x` a
-> caret range auto-updates **patches only** (`0.21.x`); moving to `0.22.0` is
+> `"@condorinst/mobile-bridge": "^0.22.0"`. Under semver, while on `0.x` a
+> caret range auto-updates **patches only** (`0.22.x`); moving to `0.23.0` is
 > an intentional opt-in. `1.0.0` is reserved for production.
 
 ## Quickstart (legacy, shell-side `Bridge`)
@@ -239,6 +239,22 @@ await createDevHarness({ html, scenario: 'no-devices', mount: document.getElemen
 Never import `@condorinst/mobile-bridge/dev` into the bundle itself: `validate`
 fails it with `dev-harness-bundled`.
 
+## Publish CLI — `condor-mobile-bridge canvas`
+
+```bash
+npx condor-mobile-bridge canvas publish dist/index.html --version 1.4.0   # validate, confirm, publish
+npx condor-mobile-bridge canvas list
+npx condor-mobile-bridge canvas revoke <bundleId> --fallback-version 1.3.0
+```
+
+Publishes the bundle of your company in the Condor Canvas app, through the same
+endpoints and login as the Condor web admin: company id, user id, password
+(prompted without echo, never stored) and the two-factor code when your company
+uses one. It needs a **manager** user and an interactive terminal. A publish goes
+**live at once** for every user of the company — use a test company first. The
+API is production by default (`--env dev` is for Condor staff; `--base-url`
+overrides). Details: `docs/device-testing.md`.
+
 ## Build CLI — `condor-mobile-bridge build`
 
 Generates the **self-contained `.zip` bundle** that the white-label app
@@ -321,10 +337,10 @@ The client passes `Record<string, unknown>`.
 
 ## Versioning policy (semver)
 
-- **PATCH** (`0.21.x`): bugfix with no API change.
+- **PATCH** (`0.22.x`): bugfix with no API change.
 - **MINOR** (`0.x.0`): new observable key, new command, backward-compatible API.
   > While on `0.x`, a minor bump may carry breaking changes (semver treats
-  > pre-1.0 minors as breaking). Pin `^0.21.0` to stay on safe patches.
+  > pre-1.0 minors as breaking). Pin `^0.22.0` to stay on safe patches.
 - **MAJOR** (`x.0.0`): incompatible schema change (key rename, payload shape
   change, public API change). `1.0.0` marks the production-stable contract.
 

package/contract/bridge-contract.json

@@ -1,12 +1,12 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "contractVersion": "0.21.0",
+  "contractVersion": "0.22.0",
   "description": "Machine-readable contract of the Condor Canvas JS<->Native bridge. It states what the TypeScript declarations in dist/index.d.ts cannot express: which keys and commands a sandboxed client can actually reach, which ones need human confirmation, where messages are dropped in silence, the hard limits, and which capability each native version carries. The TypeScript types remain canonical for payload shapes.",
   "audience": "Developers and AI agents building the client bundle that renders inside the Canvas Home.",
 
   "versions": {
     "note": "Four independent numbers coexist. Only nativeVersion tells you what the device can do.",
-    "package": "0.21.0",
+    "package": "0.22.0",
     "shellVersion": "0.6.0",
     "clientProtocolVersion": "0.5.0",
     "nativeVersion": "0.17.0",
@@ -174,7 +174,8 @@
     "integrity": { "algorithm": "sha256", "format": "sha256-<lowercase hex>", "computedOver": "the exact bytes of the .zip" },
     "tooling": {
       "build": "npx condor-mobile-bridge build -i dist/index.html -o dist/bundle.zip",
-      "validate": "npx condor-mobile-bridge validate -i dist/bundle.zip --strict"
+      "validate": "npx condor-mobile-bridge validate -i dist/bundle.zip --strict",
+      "publish": "npx condor-mobile-bridge canvas publish dist/index.html --version <v> — interactive (company id, user id, password, 2FA code); live at once for every user of the company; needs a manager user. Never run it from an agent."
     },
     "statusBarHook": "<meta name=\"theme-color\" content=\"#RRGGBB\"> in the bundle sets the native status bar colour. The setStatusBarColor command overrides it at runtime."
   },