@ekanos/cli 0.17.0 → 0.18.0

package/dist/publish-api.d.ts

@@ -12,12 +12,22 @@ import type { AuthEnvironment } from './auth/session.js';
  *   POST /api/partner/submissions    [Authorization: Bearer <access_token>]
  *     ← multipart/form-data:
  *         source   — Ekanos source slug
- *         slug     — integration slug (kebab-case)
+ *         slug     — integration (or experience) slug (kebab-case; bare, never namespaced)
  *         version  — semver
- *         manifest — JSON string (the parsed ekanos.json + declaration summary)
+ *         kind     — "experience" for a composed experience; omitted for an
+ *                    integration (an older host never sees the field). Sent
+ *                    only to a host that advertises
+ *                    `capabilities.experienceSubmissions` on the toolchain
+ *                    route.
+ *         manifest — JSON string (the parsed ekanos.json + declaration
+ *                    summary; for an experience, its built manifest.json)
  *         archive  — gzipped tarball, ≤ 4 MiB
+ *         availability — "global" | "restricted"; sent only when ekanos.json
+ *                        declares it
  *     → 201 { ok: true, data: { submissionId, slug, version, state,
- *                               archiveSha256 } }
+ *                               archiveSha256,
+ *                               // newer hosts only:
+ *                               namespace?: string|null, displayName? } }
  *     → 400 { error, code: "INVALID_REQUEST" | "INVALID_ARCHIVE" }
  *     → 401 { error, code: "AUTH_REQUIRED" }      token absent or expired —
  *                                                 refresh once and retry
@@ -25,6 +35,12 @@ import type { AuthEnvironment } from './auth/session.js';
  *     → 404 { error, code: "SOURCE_NOT_FOUND" }
  *     → 409 { error, code: "VERSION_EXISTS" }     this (slug, version) is
  *                                                 already submitted
+ *     → 409 { error, code: "KIND_MISMATCH" }      the slug is registered as
+ *                                                 the other kind
+ *     → 409 { error, code: "GLOBAL_NAME_UNAPPROVED", hint? }
+ *                                                 availability "global" without
+ *                                                 an approved global name
+ *     → 409 { error, code: "NAMESPACE_REQUIRED" } the source has no namespace
  *     → 413 { error, code: "ARCHIVE_TOO_LARGE" }
  *     → 3xx                                       treated as 401 (an
  *                                                 auth-gated Ekanos page
@@ -33,7 +49,7 @@ import type { AuthEnvironment } from './auth/session.js';
  *   GET /api/partner/submissions?source=<slug|id>[&detail=findings]
  *       [Authorization: Bearer]
  *     → 200 { ok: true, data: { source, integrations: [{ id, slug, name,
- *             createdAt, versions: [{ id, version, state, archiveSha256,
+ *             createdAt, namespace?: string|null, displayName?, versions: [{ id, version, state, archiveSha256,
  *             submittedAt, gatedAt,
  *             // present once a gate has run (gate_report is non-null):
  *             errorCount?, warnCount?,
@@ -46,7 +62,8 @@ import type { AuthEnvironment } from './auth/session.js';
  *     → 404 { error, code: "SOURCE_NOT_FOUND" }
  *     → 3xx                                       treated as 401
  *
- *   `state` walks submitted -> gated|rejected -> dev -> prod -> revoked,
+ *   `state` walks submitted -> gated|rejected -> dev -> prod -> revoked (a
+ *   `dev` version is marked `superseded` once a newer version reaches dev),
  *   enforced by a database trigger on the host's side (the full transition
  *   matrix lives there). `gated`/`dev`/`rejected` are the
  *   terminal-for-waiting states `ekanos status --watch` polls for.
@@ -61,10 +78,14 @@ export declare const MAX_MANIFEST_BYTES: number;
 export interface SubmissionPayload {
     source: string;
     slug: string;
+    /** Omitted for an integration. */
+    kind?: 'experience';
     version: string;
     /** JSON string — already serialized by the caller. */
     manifest: string;
     archive: Uint8Array;
+    /** Sent only when ekanos.json declares an availability mode. */
+    availability?: 'global' | 'restricted';
 }
 export interface SubmissionReceipt {
     submissionId: string;
@@ -72,6 +93,10 @@ export interface SubmissionReceipt {
     version: string;
     state: string;
     archiveSha256: string;
+    /** The Source namespace the package is named under; absent on an older host. */
+    namespace?: string | null;
+    /** The full name the host uses (`acme/google-drive`); absent on an older host. */
+    displayName?: string;
 }
 export type SubmitResult = {
     status: 'ok';
@@ -82,6 +107,11 @@ export type SubmitResult = {
     status: 'unauthorized';
 };
 export declare function submitArchive(host: string, accessToken: string, payload: SubmissionPayload): Promise<SubmitResult>;
+/**
+ * The refusal for a `global` package whose name no super-admin has approved.
+ * Shared by the pre-flight (`publish.ts`) and the 409 the host answers with.
+ */
+export declare function globalNameUnapprovedError(slug: string): import("./errors.js").CliError;
 /**
  * One gate finding, mirroring `@ekanos/integration-schema`'s `Finding` shape
  * (the same one `validate`/`publish` carry in `data.findings`). Declared
@@ -135,6 +165,9 @@ export interface SubmissionListing {
     slug: string;
     name: string | null;
     createdAt: string | null;
+    /** Absent on an older host. */
+    namespace?: string | null;
+    displayName?: string;
     versions: SubmissionVersion[];
 }
 export type ListResult = {

package/dist/publish-api.js

@@ -14,12 +14,22 @@ import { authRequiredError, forbiddenError, invalidStateError, networkError, not
  *   POST /api/partner/submissions    [Authorization: Bearer <access_token>]
  *     ← multipart/form-data:
  *         source   — Ekanos source slug
- *         slug     — integration slug (kebab-case)
+ *         slug     — integration (or experience) slug (kebab-case; bare, never namespaced)
  *         version  — semver
- *         manifest — JSON string (the parsed ekanos.json + declaration summary)
+ *         kind     — "experience" for a composed experience; omitted for an
+ *                    integration (an older host never sees the field). Sent
+ *                    only to a host that advertises
+ *                    `capabilities.experienceSubmissions` on the toolchain
+ *                    route.
+ *         manifest — JSON string (the parsed ekanos.json + declaration
+ *                    summary; for an experience, its built manifest.json)
  *         archive  — gzipped tarball, ≤ 4 MiB
+ *         availability — "global" | "restricted"; sent only when ekanos.json
+ *                        declares it
  *     → 201 { ok: true, data: { submissionId, slug, version, state,
- *                               archiveSha256 } }
+ *                               archiveSha256,
+ *                               // newer hosts only:
+ *                               namespace?: string|null, displayName? } }
  *     → 400 { error, code: "INVALID_REQUEST" | "INVALID_ARCHIVE" }
  *     → 401 { error, code: "AUTH_REQUIRED" }      token absent or expired —
  *                                                 refresh once and retry
@@ -27,6 +37,12 @@ import { authRequiredError, forbiddenError, invalidStateError, networkError, not
  *     → 404 { error, code: "SOURCE_NOT_FOUND" }
  *     → 409 { error, code: "VERSION_EXISTS" }     this (slug, version) is
  *                                                 already submitted
+ *     → 409 { error, code: "KIND_MISMATCH" }      the slug is registered as
+ *                                                 the other kind
+ *     → 409 { error, code: "GLOBAL_NAME_UNAPPROVED", hint? }
+ *                                                 availability "global" without
+ *                                                 an approved global name
+ *     → 409 { error, code: "NAMESPACE_REQUIRED" } the source has no namespace
  *     → 413 { error, code: "ARCHIVE_TOO_LARGE" }
  *     → 3xx                                       treated as 401 (an
  *                                                 auth-gated Ekanos page
@@ -35,7 +51,7 @@ import { authRequiredError, forbiddenError, invalidStateError, networkError, not
  *   GET /api/partner/submissions?source=<slug|id>[&detail=findings]
  *       [Authorization: Bearer]
  *     → 200 { ok: true, data: { source, integrations: [{ id, slug, name,
- *             createdAt, versions: [{ id, version, state, archiveSha256,
+ *             createdAt, namespace?: string|null, displayName?, versions: [{ id, version, state, archiveSha256,
  *             submittedAt, gatedAt,
  *             // present once a gate has run (gate_report is non-null):
  *             errorCount?, warnCount?,
@@ -48,7 +64,8 @@ import { authRequiredError, forbiddenError, invalidStateError, networkError, not
  *     → 404 { error, code: "SOURCE_NOT_FOUND" }
  *     → 3xx                                       treated as 401
  *
- *   `state` walks submitted -> gated|rejected -> dev -> prod -> revoked,
+ *   `state` walks submitted -> gated|rejected -> dev -> prod -> revoked (a
+ *   `dev` version is marked `superseded` once a newer version reaches dev),
  *   enforced by a database trigger on the host's side (the full transition
  *   matrix lives there). `gated`/`dev`/`rejected` are the
  *   terminal-for-waiting states `ekanos status --watch` polls for.
@@ -61,12 +78,16 @@ import { authRequiredError, forbiddenError, invalidStateError, networkError, not
  */
 export const MAX_MANIFEST_BYTES = 64 * 1024;
 export async function submitArchive(host, accessToken, payload) {
-    var _a;
+    var _a, _b;
     const form = new FormData();
     form.append('source', payload.source);
     form.append('slug', payload.slug);
     form.append('version', payload.version);
+    if (payload.kind)
+        form.append('kind', payload.kind);
     form.append('manifest', payload.manifest);
+    if (payload.availability)
+        form.append('availability', payload.availability);
     form.append('archive', 
     // Copy into a fresh Uint8Array: Buffer is Uint8Array<ArrayBufferLike>,
     // which BlobPart refuses (a SharedArrayBuffer view is not a BlobPart).
@@ -95,6 +116,17 @@ export async function submitArchive(host, accessToken, payload) {
         throw notFoundError(serverMessage !== null && serverMessage !== void 0 ? serverMessage : `${host} has no source with slug "${payload.source}".`, `Check the --source value (or the "source" field in ekanos.json) ` +
             `against the slug your Ekanos operator gave you.`);
     }
+    if (response.status === 409 && str(body.code) === 'KIND_MISMATCH') {
+        throw invalidStateError(serverMessage !== null && serverMessage !== void 0 ? serverMessage : `"${payload.slug}" is registered as the other kind of package.`, `A slug names one kind for its whole life. Pick a different slug, or ` +
+            `submit it as the kind it was first registered as.`);
+    }
+    if (response.status === 409 && body.code === 'GLOBAL_NAME_UNAPPROVED') {
+        throw globalNameUnapprovedError(payload.slug);
+    }
+    if (response.status === 409 && body.code === 'NAMESPACE_REQUIRED') {
+        throw invalidStateError(serverMessage !== null && serverMessage !== void 0 ? serverMessage : `Source "${payload.source}" has no namespace to name "${payload.slug}" under.`, (_a = str(body.hint)) !== null && _a !== void 0 ? _a : `Ask an Ekanos super-admin to give "${payload.source}" a namespace, ` +
+            `then retry.`);
+    }
     if (response.status === 409) {
         throw invalidStateError(serverMessage !== null && serverMessage !== void 0 ? serverMessage : `Version ${payload.version} of "${payload.slug}" is already submitted.`, `Submitted versions are immutable. Bump the "version" field in ` +
             `package.json and publish again.`);
@@ -110,7 +142,7 @@ export async function submitArchive(host, accessToken, payload) {
             : `Confirm the host is an Ekanos deployment running a build that ` +
                 `includes the partner submissions route.`);
     }
-    const data = ((_a = body.data) !== null && _a !== void 0 ? _a : {});
+    const data = ((_b = body.data) !== null && _b !== void 0 ? _b : {});
     const receipt = {
         submissionId: str(data.submissionId),
         slug: str(data.slug),
@@ -118,12 +150,27 @@ export async function submitArchive(host, accessToken, payload) {
         state: str(data.state),
         archiveSha256: str(data.archiveSha256),
     };
+    const displayName = str(data.displayName);
     if (Object.values(receipt).some((value) => value === null)) {
         throw networkError(`${host} accepted the submission but returned an incomplete receipt.`, `Confirm the deployment is running an Ekanos build that includes the ` +
             `partner submissions route, then check the submission's state with ` +
             `your operator before re-publishing.`);
     }
-    return { status: 'ok', receipt: receipt };
+    return {
+        status: 'ok',
+        receipt: Object.assign(Object.assign(Object.assign({}, receipt), (data.namespace === null || typeof data.namespace === 'string'
+            ? { namespace: data.namespace }
+            : {})), (displayName ? { displayName } : {})),
+    };
+}
+/**
+ * The refusal for a `global` package whose name no super-admin has approved.
+ * Shared by the pre-flight (`publish.ts`) and the 409 the host answers with.
+ */
+export function globalNameUnapprovedError(slug) {
+    return invalidStateError(`The global name "${slug}" is not approved.`, `Run "ekanos names claim ${slug}" to request it, or publish restricted ` +
+        `(remove availability.mode "global" from ekanos.json, or set it to ` +
+        `"restricted").`);
 }
 /**
  * List the caller's visible submissions for a source. Same authorization model
@@ -173,19 +220,15 @@ export async function listSubmissions(host, accessToken, source, options = {}) {
     const rows = Array.isArray(data.integrations) ? data.integrations : [];
     const integrations = rows
         .filter((row) => typeof row === 'object' && row !== null)
-        .map((row) => { var _a, _b; return ({
-        id: (_a = str(row.id)) !== null && _a !== void 0 ? _a : '',
-        slug: (_b = str(row.slug)) !== null && _b !== void 0 ? _b : '',
-        name: str(row.name),
-        createdAt: str(row.createdAt),
-        versions: (Array.isArray(row.versions) ? row.versions : [])
+        .map((row) => { var _a, _b; return (Object.assign(Object.assign(Object.assign({ id: (_a = str(row.id)) !== null && _a !== void 0 ? _a : '', slug: (_b = str(row.slug)) !== null && _b !== void 0 ? _b : '', name: str(row.name), createdAt: str(row.createdAt) }, (row.namespace === null || typeof row.namespace === 'string'
+        ? { namespace: row.namespace }
+        : {})), (str(row.displayName) ? { displayName: str(row.displayName) } : {})), { versions: (Array.isArray(row.versions) ? row.versions : [])
             .filter((version) => typeof version === 'object' && version !== null)
             .map((version) => { var _a, _b, _c; return (Object.assign(Object.assign({ id: (_a = str(version.id)) !== null && _a !== void 0 ? _a : '', version: (_b = str(version.version)) !== null && _b !== void 0 ? _b : '', state: (_c = str(version.state)) !== null && _c !== void 0 ? _c : '', archiveSha256: str(version.archiveSha256), submittedAt: str(version.submittedAt), gatedAt: str(version.gatedAt), errorCount: num(version.errorCount), warnCount: num(version.warnCount) }, (Array.isArray(version.findings)
             ? { findings: version.findings }
             : {})), (Array.isArray(version.stages)
             ? { stages: version.stages }
-            : {}))); }),
-    }); });
+            : {}))); }) })); });
     return { status: 'ok', integrations };
 }
 /** Guard for the "still unauthorized after one refresh" terminal case. */

package/dist/publish-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish-api.js","sourceRoot":"","sources":["../src/publish-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,eAAe,GAChB,MAAM,UAAU,CAAC;AAElB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAwB5C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,WAAmB,EACnB,OAA0B;;IAE1B,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CACT,SAAS;IACT,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,IAAI,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,EACzE,aAAa,CACd,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,0BAA0B,EAAE;QAChE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;QACD,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;IAEH,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEtC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,aAAa,aAAb,aAAa,cAAb,aAAa,GACX,GAAG,IAAI,0DAA0D;YAC/D,6BAA6B,OAAO,CAAC,MAAM,IAAI,EACnD,uEAAuE;YACrE,IAAI,OAAO,CAAC,MAAM,gBAAgB,CACrC,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,GAAG,IAAI,6BAA6B,OAAO,CAAC,MAAM,IAAI,EACvE,kEAAkE;YAChE,iDAAiD,CACpD,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,aAAa,aAAb,aAAa,cAAb,aAAa,GACX,WAAW,OAAO,CAAC,OAAO,QAAQ,OAAO,CAAC,IAAI,yBAAyB,EACzE,gEAAgE;YAC9D,iCAAiC,CACpC,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,MAAM,eAAe,CACnB,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,GAAG,IAAI,sCAAsC,EAC9D,uEAAuE;YACrE,qEAAqE,CACxE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,sCAAsC,QAAQ,CAAC,MAAM,GAAG,EAC/D,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,mEAAmE;gBACjE,8CAA8C;YAClD,CAAC,CAAC,gEAAgE;gBAC9D,yCAAyC,CAChD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAC,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,OAAO,GAAG;QACd,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;QACpC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QACpB,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;QAC1B,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QACtB,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC;KACvC,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,YAAY,CAChB,GAAG,IAAI,8DAA8D,EACrE,sEAAsE;YACpE,oEAAoE;YACpE,qCAAqC,CACxC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAA4B,EAAE,CAAC;AACjE,CAAC;AAkED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,WAAmB,EACnB,MAAc,EACd,OAAO,GAA4B,EAAE;;IAErC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,4BAA4B,KAAK,CAAC,QAAQ,EAAE,EAAE,EACrD;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CACF,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEtC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,GAAG,IAAI,qCAAqC,MAAM,IAAI,EACvE,gEAAgE;YAC9D,uBAAuB,CAC1B,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,GAAG,IAAI,6BAA6B,MAAM,IAAI,EAC/D,oEAAoE;YAClE,qCAAqC,CACxC,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,eAAe,CACnB,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,GAAG,IAAI,kCAAkC,EAC1D,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,sCAAsC,QAAQ,CAAC,MAAM,GAAG,EAC/D,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,mEAAmE;gBACjE,8CAA8C;YAClD,CAAC,CAAC,gEAAgE;gBAC9D,yCAAyC,CAChD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAC,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvE,MAAM,YAAY,GAAG,IAAI;SACtB,MAAM,CACL,CAAC,GAAG,EAAkC,EAAE,CACtC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAC1C;SACA,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,sBAAC,CAAC;QACb,EAAE,QAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,mCAAI,EAAE;QACrB,IAAI,QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAI,EAAE;QACzB,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;QACnB,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC;QAC7B,QAAQ,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,MAAM,CACL,CAAC,OAAO,EAAsC,EAAE,CAC9C,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAClD;aACA,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,0BAAC,+BAChB,EAAE,QAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,mCAAI,EAAE,EACzB,OAAO,QAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,mCAAI,EAAE,EACnC,KAAK,QAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,mCAAI,EAAE,EAC/B,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,EACzC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,EACrC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAC7B,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EACnC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,IAC9B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;YACjC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAyB,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAA2B,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC,EACP,GAAA,CAAC;KACN,CAAC,GAAA,CAAC,CAAC;IAEN,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACxC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAAC,GAAoB;IACpD,MAAM,iBAAiB,CACrB,mBAAmB,GAAG,CAAC,IAAI,sCAAsC,EACjE,SAAS,CAAC,GAAG,CAAC,CACf,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5E,CAAC","sourcesContent":["import { request } from './auth/ekanos-api';\nimport { loginHint } from './auth/host-trust';\nimport type { AuthEnvironment } from './auth/session';\nimport {\n  authRequiredError,\n  forbiddenError,\n  invalidStateError,\n  networkError,\n  notFoundError,\n  validationError,\n} from './errors';\n\n/**\n * The CLI's client for the Ekanos submission intake route.\n *\n * ---------------------------------------------------------------------------\n * WIRE CONTRACT — the seam between this package and the Ekanos web app.\n *\n * The server side is the host's `/api/partner/submissions` route. As with\n * the auth routes (see `auth/ekanos-api.ts`), the two halves are coupled\n * only by HTTP; tests stub `fetch`, never the route.\n *\n *   POST /api/partner/submissions    [Authorization: Bearer <access_token>]\n *     ← multipart/form-data:\n *         source   — Ekanos source slug\n *         slug     — integration slug (kebab-case)\n *         version  — semver\n *         manifest — JSON string (the parsed ekanos.json + declaration summary)\n *         archive  — gzipped tarball, ≤ 4 MiB\n *     → 201 { ok: true, data: { submissionId, slug, version, state,\n *                               archiveSha256 } }\n *     → 400 { error, code: \"INVALID_REQUEST\" | \"INVALID_ARCHIVE\" }\n *     → 401 { error, code: \"AUTH_REQUIRED\" }      token absent or expired —\n *                                                 refresh once and retry\n *     → 403 { error, code: \"FORBIDDEN\" }          no developer seat on the source\n *     → 404 { error, code: \"SOURCE_NOT_FOUND\" }\n *     → 409 { error, code: \"VERSION_EXISTS\" }     this (slug, version) is\n *                                                 already submitted\n *     → 413 { error, code: \"ARCHIVE_TOO_LARGE\" }\n *     → 3xx                                       treated as 401 (an\n *                                                 auth-gated Ekanos page\n *                                                 answers 307)\n *\n *   GET /api/partner/submissions?source=<slug|id>[&detail=findings]\n *       [Authorization: Bearer]\n *     → 200 { ok: true, data: { source, integrations: [{ id, slug, name,\n *             createdAt, versions: [{ id, version, state, archiveSha256,\n *             submittedAt, gatedAt,\n *             // present once a gate has run (gate_report is non-null):\n *             errorCount?, warnCount?,\n *             // present ONLY with ?detail=findings, alongside the above:\n *             findings?, stages?\n *           }] }] } }\n *     → 400 { error, code: \"INVALID_REQUEST\" }\n *     → 401 { error, code: \"AUTH_REQUIRED\" }      refresh once and retry\n *     → 403 { error, code: \"MFA_REQUIRED\" }\n *     → 404 { error, code: \"SOURCE_NOT_FOUND\" }\n *     → 3xx                                       treated as 401\n *\n *   `state` walks submitted -> gated|rejected -> dev -> prod -> revoked,\n *   enforced by a database trigger on the host's side (the full transition\n *   matrix lives there). `gated`/`dev`/`rejected` are the\n *   terminal-for-waiting states `ekanos status --watch` polls for.\n * ---------------------------------------------------------------------------\n */\n\n/**\n * The server's manifest cap — 64 KiB of UTF-8, enforced server-side against\n * `Buffer.byteLength`. Mirrored here so `publish` can refuse an oversized\n * manifest with a clear message instead of the server's generic 400.\n */\nexport const MAX_MANIFEST_BYTES = 64 * 1024;\n\nexport interface SubmissionPayload {\n  source: string;\n  slug: string;\n  version: string;\n  /** JSON string — already serialized by the caller. */\n  manifest: string;\n  archive: Uint8Array;\n}\n\nexport interface SubmissionReceipt {\n  submissionId: string;\n  slug: string;\n  version: string;\n  state: string;\n  archiveSha256: string;\n}\n\nexport type SubmitResult =\n  | { status: 'ok'; receipt: SubmissionReceipt }\n  /** The bearer token did not authenticate — refresh and retry, once. */\n  | { status: 'unauthorized' };\n\nexport async function submitArchive(\n  host: string,\n  accessToken: string,\n  payload: SubmissionPayload,\n): Promise<SubmitResult> {\n  const form = new FormData();\n  form.append('source', payload.source);\n  form.append('slug', payload.slug);\n  form.append('version', payload.version);\n  form.append('manifest', payload.manifest);\n  form.append(\n    'archive',\n    // Copy into a fresh Uint8Array: Buffer is Uint8Array<ArrayBufferLike>,\n    // which BlobPart refuses (a SharedArrayBuffer view is not a BlobPart).\n    new Blob([new Uint8Array(payload.archive)], { type: 'application/gzip' }),\n    'archive.tgz',\n  );\n\n  const response = await request(`${host}/api/partner/submissions`, {\n    method: 'POST',\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n    },\n    body: form,\n  });\n\n  // 401, or the 307 an auth-gated Ekanos route answers with: the token did\n  // not authenticate. The caller owns the refresh-and-retry decision.\n  if (response.status === 401 || isRedirect(response.status)) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n  const serverMessage = str(body.error);\n\n  if (response.status === 403) {\n    throw forbiddenError(\n      serverMessage ??\n        `${host} refused the submission: this account does not hold the ` +\n          `developer seat on source \"${payload.source}\".`,\n      `Ask the source operator to grant your account the developer seat for ` +\n        `\"${payload.source}\", then retry.`,\n    );\n  }\n\n  if (response.status === 404) {\n    throw notFoundError(\n      serverMessage ?? `${host} has no source with slug \"${payload.source}\".`,\n      `Check the --source value (or the \"source\" field in ekanos.json) ` +\n        `against the slug your Ekanos operator gave you.`,\n    );\n  }\n\n  if (response.status === 409) {\n    throw invalidStateError(\n      serverMessage ??\n        `Version ${payload.version} of \"${payload.slug}\" is already submitted.`,\n      `Submitted versions are immutable. Bump the \"version\" field in ` +\n        `package.json and publish again.`,\n    );\n  }\n\n  if (response.status === 400 || response.status === 413) {\n    throw validationError(\n      serverMessage ?? `${host} rejected the submission as invalid.`,\n      `Fix the reported problem and re-run \"ekanos publish\". If the message ` +\n        `names the archive, re-check the project layout (\"ekanos validate\").`,\n    );\n  }\n\n  if (!response.ok) {\n    throw networkError(\n      `${host}/api/partner/submissions responded ${response.status}.`,\n      response.status >= 500\n        ? `The Ekanos deployment returned a server error. Retry shortly; if ` +\n            `it persists, report it with the status code.`\n        : `Confirm the host is an Ekanos deployment running a build that ` +\n            `includes the partner submissions route.`,\n    );\n  }\n\n  const data = (body.data ?? {}) as Record<string, unknown>;\n  const receipt = {\n    submissionId: str(data.submissionId),\n    slug: str(data.slug),\n    version: str(data.version),\n    state: str(data.state),\n    archiveSha256: str(data.archiveSha256),\n  };\n\n  if (Object.values(receipt).some((value) => value === null)) {\n    throw networkError(\n      `${host} accepted the submission but returned an incomplete receipt.`,\n      `Confirm the deployment is running an Ekanos build that includes the ` +\n        `partner submissions route, then check the submission's state with ` +\n        `your operator before re-publishing.`,\n    );\n  }\n\n  return { status: 'ok', receipt: receipt as SubmissionReceipt };\n}\n\n/**\n * One gate finding, mirroring `@ekanos/integration-schema`'s `Finding` shape\n * (the same one `validate`/`publish` carry in `data.findings`). Declared\n * locally rather than imported: the gate's own report type lives in a\n * server-side toolchain package private to the platform monorepo, which this\n * partner-facing CLI has no business depending on — the wire shape is the\n * only contract.\n *\n * `origin`/`id`/`createdAt`/`resolvedAt` are the additive fields the host's\n * findings-merge endpoint puts on the wire once host-filed findings — CI\n * failures, host observations, a revocation reason — are merged in alongside\n * the gate's own verdict. A gate-only finding still omits them entirely\n * (this CLI's own `validate`/`publish` findings never set `origin`, which\n * the renderer reads as \"gate\"); they only appear on findings read back from\n * `GET /api/partner/submissions?detail=findings`.\n */\nexport interface GateFinding {\n  check: string;\n  severity: 'error' | 'warn' | 'info';\n  file?: string;\n  line?: number;\n  message: string;\n  hint: string;\n  /** `'gate' | 'ci' | 'host' | 'revocation'` on the wire; kept as `string` — see the doc comment on `HostFindingRow` in `merge-findings.ts` for why the host stays defensive rather than a narrower literal union here. */\n  origin?: string;\n  id?: string;\n  createdAt?: string;\n  resolvedAt?: string | null;\n}\n\nexport interface GateStageResult {\n  id: string;\n  status: 'pass' | 'fail' | 'skipped';\n  durationMs: number;\n}\n\nexport interface SubmissionVersion {\n  id: string;\n  version: string;\n  state: string;\n  archiveSha256: string | null;\n  submittedAt: string | null;\n  gatedAt: string | null;\n  /** Present once a gate has run. */\n  errorCount: number | null;\n  warnCount: number | null;\n  /** Present only when the request passed `?detail=findings`. */\n  findings?: GateFinding[];\n  stages?: GateStageResult[];\n}\n\nexport interface SubmissionListing {\n  id: string;\n  slug: string;\n  name: string | null;\n  createdAt: string | null;\n  versions: SubmissionVersion[];\n}\n\nexport type ListResult =\n  | { status: 'ok'; integrations: SubmissionListing[] }\n  /** The bearer token did not authenticate — refresh and retry, once. */\n  | { status: 'unauthorized' };\n\n/**\n * List the caller's visible submissions for a source. Same authorization model\n * as `submitArchive`: the seat SELECT policies filter server-side, so a caller\n * with no seat sees an empty list rather than an error.\n *\n * `detail: 'findings'` requests the full per-version findings/stages arrays\n * (used by `status --findings` and `status --watch`); omitted, the server\n * answers with counts only — see the wire contract above.\n */\nexport async function listSubmissions(\n  host: string,\n  accessToken: string,\n  source: string,\n  options: { detail?: 'findings' } = {},\n): Promise<ListResult> {\n  const query = new URLSearchParams({ source });\n  if (options.detail) query.set('detail', options.detail);\n\n  const response = await request(\n    `${host}/api/partner/submissions?${query.toString()}`,\n    {\n      method: 'GET',\n      headers: {\n        accept: 'application/json',\n        authorization: `Bearer ${accessToken}`,\n      },\n    },\n  );\n\n  if (response.status === 401 || isRedirect(response.status)) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n  const serverMessage = str(body.error);\n\n  if (response.status === 403) {\n    throw forbiddenError(\n      serverMessage ?? `${host} refused to list submissions for \"${source}\".`,\n      `Complete MFA in the browser if the message names it, then run ` +\n        `\"ekanos login\" again.`,\n    );\n  }\n\n  if (response.status === 404) {\n    throw notFoundError(\n      serverMessage ?? `${host} has no source with slug \"${source}\".`,\n      `Check the \"source\" field in ekanos.json (or --source) against the ` +\n        `slug your Ekanos operator gave you.`,\n    );\n  }\n\n  if (response.status === 400) {\n    throw validationError(\n      serverMessage ?? `${host} rejected the submissions query.`,\n      `Fix the reported problem and re-run \"ekanos status\".`,\n    );\n  }\n\n  if (!response.ok) {\n    throw networkError(\n      `${host}/api/partner/submissions responded ${response.status}.`,\n      response.status >= 500\n        ? `The Ekanos deployment returned a server error. Retry shortly; if ` +\n            `it persists, report it with the status code.`\n        : `Confirm the host is an Ekanos deployment running a build that ` +\n            `includes the partner submissions route.`,\n    );\n  }\n\n  const data = (body.data ?? {}) as Record<string, unknown>;\n  const rows = Array.isArray(data.integrations) ? data.integrations : [];\n\n  const integrations = rows\n    .filter(\n      (row): row is Record<string, unknown> =>\n        typeof row === 'object' && row !== null,\n    )\n    .map((row) => ({\n      id: str(row.id) ?? '',\n      slug: str(row.slug) ?? '',\n      name: str(row.name),\n      createdAt: str(row.createdAt),\n      versions: (Array.isArray(row.versions) ? row.versions : [])\n        .filter(\n          (version): version is Record<string, unknown> =>\n            typeof version === 'object' && version !== null,\n        )\n        .map((version) => ({\n          id: str(version.id) ?? '',\n          version: str(version.version) ?? '',\n          state: str(version.state) ?? '',\n          archiveSha256: str(version.archiveSha256),\n          submittedAt: str(version.submittedAt),\n          gatedAt: str(version.gatedAt),\n          errorCount: num(version.errorCount),\n          warnCount: num(version.warnCount),\n          ...(Array.isArray(version.findings)\n            ? { findings: version.findings as GateFinding[] }\n            : {}),\n          ...(Array.isArray(version.stages)\n            ? { stages: version.stages as GateStageResult[] }\n            : {}),\n        })),\n    }));\n\n  return { status: 'ok', integrations };\n}\n\n/** Guard for the \"still unauthorized after one refresh\" terminal case. */\nexport function stillUnauthorized(env: AuthEnvironment): never {\n  throw authRequiredError(\n    `The session for ${env.host} could not authorize the submission.`,\n    loginHint(env),\n  );\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n\nfunction isRedirect(status: number): boolean {\n  return status >= 300 && status < 400;\n}\n\nfunction str(value: unknown): string | null {\n  return typeof value === 'string' && value.length > 0 ? value : null;\n}\n\nfunction num(value: unknown): number | null {\n  return typeof value === 'number' && Number.isFinite(value) ? value : null;\n}\n"]}
+{"version":3,"file":"publish-api.js","sourceRoot":"","sources":["../src/publish-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,eAAe,GAChB,MAAM,UAAU,CAAC;AAElB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAgC5C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,WAAmB,EACnB,OAA0B;;IAE1B,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,IAAI;QAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,YAAY;QAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CACT,SAAS;IACT,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,IAAI,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,EACzE,aAAa,CACd,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,0BAA0B,EAAE;QAChE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;QACD,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;IAEH,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEtC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,aAAa,aAAb,aAAa,cAAb,aAAa,GACX,GAAG,IAAI,0DAA0D;YAC/D,6BAA6B,OAAO,CAAC,MAAM,IAAI,EACnD,uEAAuE;YACrE,IAAI,OAAO,CAAC,MAAM,gBAAgB,CACrC,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,GAAG,IAAI,6BAA6B,OAAO,CAAC,MAAM,IAAI,EACvE,kEAAkE;YAChE,iDAAiD,CACpD,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,eAAe,EAAE,CAAC;QAClE,MAAM,iBAAiB,CACrB,aAAa,aAAb,aAAa,cAAb,aAAa,GACX,IAAI,OAAO,CAAC,IAAI,+CAA+C,EACjE,sEAAsE;YACpE,mDAAmD,CACtD,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;QACtE,MAAM,yBAAyB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAClE,MAAM,iBAAiB,CACrB,aAAa,aAAb,aAAa,cAAb,aAAa,GACX,WAAW,OAAO,CAAC,MAAM,+BAA+B,OAAO,CAAC,IAAI,UAAU,QAChF,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,mCACZ,sCAAsC,OAAO,CAAC,MAAM,iBAAiB;YACnE,aAAa,CAClB,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,aAAa,aAAb,aAAa,cAAb,aAAa,GACX,WAAW,OAAO,CAAC,OAAO,QAAQ,OAAO,CAAC,IAAI,yBAAyB,EACzE,gEAAgE;YAC9D,iCAAiC,CACpC,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,MAAM,eAAe,CACnB,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,GAAG,IAAI,sCAAsC,EAC9D,uEAAuE;YACrE,qEAAqE,CACxE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,sCAAsC,QAAQ,CAAC,MAAM,GAAG,EAC/D,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,mEAAmE;gBACjE,8CAA8C;YAClD,CAAC,CAAC,gEAAgE;gBAC9D,yCAAyC,CAChD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAC,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,OAAO,GAAG;QACd,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;QACpC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QACpB,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;QAC1B,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QACtB,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC;KACvC,CAAC;IACF,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAE1C,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,YAAY,CAChB,GAAG,IAAI,8DAA8D,EACrE,sEAAsE;YACpE,oEAAoE;YACpE,qCAAqC,CACxC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,OAAO,gDACD,OAA6B,GAC9B,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;YAC/D,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;YAC/B,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACxC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,iBAAiB,CACtB,oBAAoB,IAAI,oBAAoB,EAC5C,2BAA2B,IAAI,yCAAyC;QACtE,oEAAoE;QACpE,gBAAgB,CACnB,CAAC;AACJ,CAAC;AAqED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,WAAmB,EACnB,MAAc,EACd,OAAO,GAA4B,EAAE;;IAErC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,4BAA4B,KAAK,CAAC,QAAQ,EAAE,EAAE,EACrD;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CACF,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEtC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,GAAG,IAAI,qCAAqC,MAAM,IAAI,EACvE,gEAAgE;YAC9D,uBAAuB,CAC1B,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,GAAG,IAAI,6BAA6B,MAAM,IAAI,EAC/D,oEAAoE;YAClE,qCAAqC,CACxC,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,eAAe,CACnB,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,GAAG,IAAI,kCAAkC,EAC1D,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,sCAAsC,QAAQ,CAAC,MAAM,GAAG,EAC/D,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,mEAAmE;gBACjE,8CAA8C;YAClD,CAAC,CAAC,gEAAgE;gBAC9D,yCAAyC,CAChD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAC,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvE,MAAM,YAAY,GAAG,IAAI;SACtB,MAAM,CACL,CAAC,GAAG,EAAkC,EAAE,CACtC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAC1C;SACA,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,sBAAC,6CACZ,EAAE,QAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,mCAAI,EAAE,EACrB,IAAI,QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAI,EAAE,EACzB,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EACnB,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAC1B,CAAC,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QAC7D,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE;QAC9B,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACvE,QAAQ,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,MAAM,CACL,CAAC,OAAO,EAAsC,EAAE,CAC9C,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAClD;aACA,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,0BAAC,+BAChB,EAAE,QAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,mCAAI,EAAE,EACzB,OAAO,QAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,mCAAI,EAAE,EACnC,KAAK,QAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,mCAAI,EAAE,EAC/B,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,EACzC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,EACrC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAC7B,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EACnC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,IAC9B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;YACjC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAyB,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAA2B,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC,EACP,GAAA,CAAC,IACL,GAAA,CAAC,CAAC;IAEN,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACxC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAAC,GAAoB;IACpD,MAAM,iBAAiB,CACrB,mBAAmB,GAAG,CAAC,IAAI,sCAAsC,EACjE,SAAS,CAAC,GAAG,CAAC,CACf,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5E,CAAC","sourcesContent":["import { request } from './auth/ekanos-api';\nimport { loginHint } from './auth/host-trust';\nimport type { AuthEnvironment } from './auth/session';\nimport {\n  authRequiredError,\n  forbiddenError,\n  invalidStateError,\n  networkError,\n  notFoundError,\n  validationError,\n} from './errors';\n\n/**\n * The CLI's client for the Ekanos submission intake route.\n *\n * ---------------------------------------------------------------------------\n * WIRE CONTRACT — the seam between this package and the Ekanos web app.\n *\n * The server side is the host's `/api/partner/submissions` route. As with\n * the auth routes (see `auth/ekanos-api.ts`), the two halves are coupled\n * only by HTTP; tests stub `fetch`, never the route.\n *\n *   POST /api/partner/submissions    [Authorization: Bearer <access_token>]\n *     ← multipart/form-data:\n *         source   — Ekanos source slug\n *         slug     — integration (or experience) slug (kebab-case; bare, never namespaced)\n *         version  — semver\n *         kind     — \"experience\" for a composed experience; omitted for an\n *                    integration (an older host never sees the field). Sent\n *                    only to a host that advertises\n *                    `capabilities.experienceSubmissions` on the toolchain\n *                    route.\n *         manifest — JSON string (the parsed ekanos.json + declaration\n *                    summary; for an experience, its built manifest.json)\n *         archive  — gzipped tarball, ≤ 4 MiB\n *         availability — \"global\" | \"restricted\"; sent only when ekanos.json\n *                        declares it\n *     → 201 { ok: true, data: { submissionId, slug, version, state,\n *                               archiveSha256,\n *                               // newer hosts only:\n *                               namespace?: string|null, displayName? } }\n *     → 400 { error, code: \"INVALID_REQUEST\" | \"INVALID_ARCHIVE\" }\n *     → 401 { error, code: \"AUTH_REQUIRED\" }      token absent or expired —\n *                                                 refresh once and retry\n *     → 403 { error, code: \"FORBIDDEN\" }          no developer seat on the source\n *     → 404 { error, code: \"SOURCE_NOT_FOUND\" }\n *     → 409 { error, code: \"VERSION_EXISTS\" }     this (slug, version) is\n *                                                 already submitted\n *     → 409 { error, code: \"KIND_MISMATCH\" }      the slug is registered as\n *                                                 the other kind\n *     → 409 { error, code: \"GLOBAL_NAME_UNAPPROVED\", hint? }\n *                                                 availability \"global\" without\n *                                                 an approved global name\n *     → 409 { error, code: \"NAMESPACE_REQUIRED\" } the source has no namespace\n *     → 413 { error, code: \"ARCHIVE_TOO_LARGE\" }\n *     → 3xx                                       treated as 401 (an\n *                                                 auth-gated Ekanos page\n *                                                 answers 307)\n *\n *   GET /api/partner/submissions?source=<slug|id>[&detail=findings]\n *       [Authorization: Bearer]\n *     → 200 { ok: true, data: { source, integrations: [{ id, slug, name,\n *             createdAt, namespace?: string|null, displayName?, versions: [{ id, version, state, archiveSha256,\n *             submittedAt, gatedAt,\n *             // present once a gate has run (gate_report is non-null):\n *             errorCount?, warnCount?,\n *             // present ONLY with ?detail=findings, alongside the above:\n *             findings?, stages?\n *           }] }] } }\n *     → 400 { error, code: \"INVALID_REQUEST\" }\n *     → 401 { error, code: \"AUTH_REQUIRED\" }      refresh once and retry\n *     → 403 { error, code: \"MFA_REQUIRED\" }\n *     → 404 { error, code: \"SOURCE_NOT_FOUND\" }\n *     → 3xx                                       treated as 401\n *\n *   `state` walks submitted -> gated|rejected -> dev -> prod -> revoked (a\n *   `dev` version is marked `superseded` once a newer version reaches dev),\n *   enforced by a database trigger on the host's side (the full transition\n *   matrix lives there). `gated`/`dev`/`rejected` are the\n *   terminal-for-waiting states `ekanos status --watch` polls for.\n * ---------------------------------------------------------------------------\n */\n\n/**\n * The server's manifest cap — 64 KiB of UTF-8, enforced server-side against\n * `Buffer.byteLength`. Mirrored here so `publish` can refuse an oversized\n * manifest with a clear message instead of the server's generic 400.\n */\nexport const MAX_MANIFEST_BYTES = 64 * 1024;\n\nexport interface SubmissionPayload {\n  source: string;\n  slug: string;\n  /** Omitted for an integration. */\n  kind?: 'experience';\n  version: string;\n  /** JSON string — already serialized by the caller. */\n  manifest: string;\n  archive: Uint8Array;\n  /** Sent only when ekanos.json declares an availability mode. */\n  availability?: 'global' | 'restricted';\n}\n\nexport interface SubmissionReceipt {\n  submissionId: string;\n  slug: string;\n  version: string;\n  state: string;\n  archiveSha256: string;\n  /** The Source namespace the package is named under; absent on an older host. */\n  namespace?: string | null;\n  /** The full name the host uses (`acme/google-drive`); absent on an older host. */\n  displayName?: string;\n}\n\nexport type SubmitResult =\n  | { status: 'ok'; receipt: SubmissionReceipt }\n  /** The bearer token did not authenticate — refresh and retry, once. */\n  | { status: 'unauthorized' };\n\nexport async function submitArchive(\n  host: string,\n  accessToken: string,\n  payload: SubmissionPayload,\n): Promise<SubmitResult> {\n  const form = new FormData();\n  form.append('source', payload.source);\n  form.append('slug', payload.slug);\n  form.append('version', payload.version);\n  if (payload.kind) form.append('kind', payload.kind);\n  form.append('manifest', payload.manifest);\n  if (payload.availability) form.append('availability', payload.availability);\n  form.append(\n    'archive',\n    // Copy into a fresh Uint8Array: Buffer is Uint8Array<ArrayBufferLike>,\n    // which BlobPart refuses (a SharedArrayBuffer view is not a BlobPart).\n    new Blob([new Uint8Array(payload.archive)], { type: 'application/gzip' }),\n    'archive.tgz',\n  );\n\n  const response = await request(`${host}/api/partner/submissions`, {\n    method: 'POST',\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n    },\n    body: form,\n  });\n\n  // 401, or the 307 an auth-gated Ekanos route answers with: the token did\n  // not authenticate. The caller owns the refresh-and-retry decision.\n  if (response.status === 401 || isRedirect(response.status)) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n  const serverMessage = str(body.error);\n\n  if (response.status === 403) {\n    throw forbiddenError(\n      serverMessage ??\n        `${host} refused the submission: this account does not hold the ` +\n          `developer seat on source \"${payload.source}\".`,\n      `Ask the source operator to grant your account the developer seat for ` +\n        `\"${payload.source}\", then retry.`,\n    );\n  }\n\n  if (response.status === 404) {\n    throw notFoundError(\n      serverMessage ?? `${host} has no source with slug \"${payload.source}\".`,\n      `Check the --source value (or the \"source\" field in ekanos.json) ` +\n        `against the slug your Ekanos operator gave you.`,\n    );\n  }\n\n  if (response.status === 409 && str(body.code) === 'KIND_MISMATCH') {\n    throw invalidStateError(\n      serverMessage ??\n        `\"${payload.slug}\" is registered as the other kind of package.`,\n      `A slug names one kind for its whole life. Pick a different slug, or ` +\n        `submit it as the kind it was first registered as.`,\n    );\n  }\n\n  if (response.status === 409 && body.code === 'GLOBAL_NAME_UNAPPROVED') {\n    throw globalNameUnapprovedError(payload.slug);\n  }\n\n  if (response.status === 409 && body.code === 'NAMESPACE_REQUIRED') {\n    throw invalidStateError(\n      serverMessage ??\n        `Source \"${payload.source}\" has no namespace to name \"${payload.slug}\" under.`,\n      str(body.hint) ??\n        `Ask an Ekanos super-admin to give \"${payload.source}\" a namespace, ` +\n          `then retry.`,\n    );\n  }\n\n  if (response.status === 409) {\n    throw invalidStateError(\n      serverMessage ??\n        `Version ${payload.version} of \"${payload.slug}\" is already submitted.`,\n      `Submitted versions are immutable. Bump the \"version\" field in ` +\n        `package.json and publish again.`,\n    );\n  }\n\n  if (response.status === 400 || response.status === 413) {\n    throw validationError(\n      serverMessage ?? `${host} rejected the submission as invalid.`,\n      `Fix the reported problem and re-run \"ekanos publish\". If the message ` +\n        `names the archive, re-check the project layout (\"ekanos validate\").`,\n    );\n  }\n\n  if (!response.ok) {\n    throw networkError(\n      `${host}/api/partner/submissions responded ${response.status}.`,\n      response.status >= 500\n        ? `The Ekanos deployment returned a server error. Retry shortly; if ` +\n            `it persists, report it with the status code.`\n        : `Confirm the host is an Ekanos deployment running a build that ` +\n            `includes the partner submissions route.`,\n    );\n  }\n\n  const data = (body.data ?? {}) as Record<string, unknown>;\n  const receipt = {\n    submissionId: str(data.submissionId),\n    slug: str(data.slug),\n    version: str(data.version),\n    state: str(data.state),\n    archiveSha256: str(data.archiveSha256),\n  };\n  const displayName = str(data.displayName);\n\n  if (Object.values(receipt).some((value) => value === null)) {\n    throw networkError(\n      `${host} accepted the submission but returned an incomplete receipt.`,\n      `Confirm the deployment is running an Ekanos build that includes the ` +\n        `partner submissions route, then check the submission's state with ` +\n        `your operator before re-publishing.`,\n    );\n  }\n\n  return {\n    status: 'ok',\n    receipt: {\n      ...(receipt as SubmissionReceipt),\n      ...(data.namespace === null || typeof data.namespace === 'string'\n        ? { namespace: data.namespace }\n        : {}),\n      ...(displayName ? { displayName } : {}),\n    },\n  };\n}\n\n/**\n * The refusal for a `global` package whose name no super-admin has approved.\n * Shared by the pre-flight (`publish.ts`) and the 409 the host answers with.\n */\nexport function globalNameUnapprovedError(slug: string) {\n  return invalidStateError(\n    `The global name \"${slug}\" is not approved.`,\n    `Run \"ekanos names claim ${slug}\" to request it, or publish restricted ` +\n      `(remove availability.mode \"global\" from ekanos.json, or set it to ` +\n      `\"restricted\").`,\n  );\n}\n\n/**\n * One gate finding, mirroring `@ekanos/integration-schema`'s `Finding` shape\n * (the same one `validate`/`publish` carry in `data.findings`). Declared\n * locally rather than imported: the gate's own report type lives in a\n * server-side toolchain package private to the platform monorepo, which this\n * partner-facing CLI has no business depending on — the wire shape is the\n * only contract.\n *\n * `origin`/`id`/`createdAt`/`resolvedAt` are the additive fields the host's\n * findings-merge endpoint puts on the wire once host-filed findings — CI\n * failures, host observations, a revocation reason — are merged in alongside\n * the gate's own verdict. A gate-only finding still omits them entirely\n * (this CLI's own `validate`/`publish` findings never set `origin`, which\n * the renderer reads as \"gate\"); they only appear on findings read back from\n * `GET /api/partner/submissions?detail=findings`.\n */\nexport interface GateFinding {\n  check: string;\n  severity: 'error' | 'warn' | 'info';\n  file?: string;\n  line?: number;\n  message: string;\n  hint: string;\n  /** `'gate' | 'ci' | 'host' | 'revocation'` on the wire; kept as `string` — see the doc comment on `HostFindingRow` in `merge-findings.ts` for why the host stays defensive rather than a narrower literal union here. */\n  origin?: string;\n  id?: string;\n  createdAt?: string;\n  resolvedAt?: string | null;\n}\n\nexport interface GateStageResult {\n  id: string;\n  status: 'pass' | 'fail' | 'skipped';\n  durationMs: number;\n}\n\nexport interface SubmissionVersion {\n  id: string;\n  version: string;\n  state: string;\n  archiveSha256: string | null;\n  submittedAt: string | null;\n  gatedAt: string | null;\n  /** Present once a gate has run. */\n  errorCount: number | null;\n  warnCount: number | null;\n  /** Present only when the request passed `?detail=findings`. */\n  findings?: GateFinding[];\n  stages?: GateStageResult[];\n}\n\nexport interface SubmissionListing {\n  id: string;\n  slug: string;\n  name: string | null;\n  createdAt: string | null;\n  /** Absent on an older host. */\n  namespace?: string | null;\n  displayName?: string;\n  versions: SubmissionVersion[];\n}\n\nexport type ListResult =\n  | { status: 'ok'; integrations: SubmissionListing[] }\n  /** The bearer token did not authenticate — refresh and retry, once. */\n  | { status: 'unauthorized' };\n\n/**\n * List the caller's visible submissions for a source. Same authorization model\n * as `submitArchive`: the seat SELECT policies filter server-side, so a caller\n * with no seat sees an empty list rather than an error.\n *\n * `detail: 'findings'` requests the full per-version findings/stages arrays\n * (used by `status --findings` and `status --watch`); omitted, the server\n * answers with counts only — see the wire contract above.\n */\nexport async function listSubmissions(\n  host: string,\n  accessToken: string,\n  source: string,\n  options: { detail?: 'findings' } = {},\n): Promise<ListResult> {\n  const query = new URLSearchParams({ source });\n  if (options.detail) query.set('detail', options.detail);\n\n  const response = await request(\n    `${host}/api/partner/submissions?${query.toString()}`,\n    {\n      method: 'GET',\n      headers: {\n        accept: 'application/json',\n        authorization: `Bearer ${accessToken}`,\n      },\n    },\n  );\n\n  if (response.status === 401 || isRedirect(response.status)) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n  const serverMessage = str(body.error);\n\n  if (response.status === 403) {\n    throw forbiddenError(\n      serverMessage ?? `${host} refused to list submissions for \"${source}\".`,\n      `Complete MFA in the browser if the message names it, then run ` +\n        `\"ekanos login\" again.`,\n    );\n  }\n\n  if (response.status === 404) {\n    throw notFoundError(\n      serverMessage ?? `${host} has no source with slug \"${source}\".`,\n      `Check the \"source\" field in ekanos.json (or --source) against the ` +\n        `slug your Ekanos operator gave you.`,\n    );\n  }\n\n  if (response.status === 400) {\n    throw validationError(\n      serverMessage ?? `${host} rejected the submissions query.`,\n      `Fix the reported problem and re-run \"ekanos status\".`,\n    );\n  }\n\n  if (!response.ok) {\n    throw networkError(\n      `${host}/api/partner/submissions responded ${response.status}.`,\n      response.status >= 500\n        ? `The Ekanos deployment returned a server error. Retry shortly; if ` +\n            `it persists, report it with the status code.`\n        : `Confirm the host is an Ekanos deployment running a build that ` +\n            `includes the partner submissions route.`,\n    );\n  }\n\n  const data = (body.data ?? {}) as Record<string, unknown>;\n  const rows = Array.isArray(data.integrations) ? data.integrations : [];\n\n  const integrations = rows\n    .filter(\n      (row): row is Record<string, unknown> =>\n        typeof row === 'object' && row !== null,\n    )\n    .map((row) => ({\n      id: str(row.id) ?? '',\n      slug: str(row.slug) ?? '',\n      name: str(row.name),\n      createdAt: str(row.createdAt),\n      ...(row.namespace === null || typeof row.namespace === 'string'\n        ? { namespace: row.namespace }\n        : {}),\n      ...(str(row.displayName) ? { displayName: str(row.displayName)! } : {}),\n      versions: (Array.isArray(row.versions) ? row.versions : [])\n        .filter(\n          (version): version is Record<string, unknown> =>\n            typeof version === 'object' && version !== null,\n        )\n        .map((version) => ({\n          id: str(version.id) ?? '',\n          version: str(version.version) ?? '',\n          state: str(version.state) ?? '',\n          archiveSha256: str(version.archiveSha256),\n          submittedAt: str(version.submittedAt),\n          gatedAt: str(version.gatedAt),\n          errorCount: num(version.errorCount),\n          warnCount: num(version.warnCount),\n          ...(Array.isArray(version.findings)\n            ? { findings: version.findings as GateFinding[] }\n            : {}),\n          ...(Array.isArray(version.stages)\n            ? { stages: version.stages as GateStageResult[] }\n            : {}),\n        })),\n    }));\n\n  return { status: 'ok', integrations };\n}\n\n/** Guard for the \"still unauthorized after one refresh\" terminal case. */\nexport function stillUnauthorized(env: AuthEnvironment): never {\n  throw authRequiredError(\n    `The session for ${env.host} could not authorize the submission.`,\n    loginHint(env),\n  );\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n\nfunction isRedirect(status: number): boolean {\n  return status >= 300 && status < 400;\n}\n\nfunction str(value: unknown): string | null {\n  return typeof value === 'string' && value.length > 0 ? value : null;\n}\n\nfunction num(value: unknown): number | null {\n  return typeof value === 'number' && Number.isFinite(value) ? value : null;\n}\n"]}

package/dist/repo/publish.d.ts

@@ -27,6 +27,8 @@ export interface PackageRow {
     findings?: Finding[];
     /** Integration submissions: what the host answered. */
     receipt?: Record<string, unknown>;
+    /** The full name the host gave a submitted integration (`acme/google-drive`). */
+    displayName?: string;
 }
 /**
  * `ekanos publish [name...] | --all [--dry-run]` in a repo.
@@ -35,8 +37,9 @@ export interface PackageRow {
  * use them (a same-repo integration is not an override, so it is ordered
  * first, never refused). Every package passes its own gate before anything is
  * sent. `--dry-run` also builds each artifact under `.ekanos/publish/` and
- * touches no network. A real run submits the integrations in order through the
- * existing path; the host cannot admit an experience yet, so selected
- * experiences end the run with that refusal.
+ * touches no network. A real run submits the packages in order through the
+ * existing path; an experience goes to a host that advertises experience
+ * submissions, and against an older host that cannot admit one the run ends
+ * with that refusal after the rest were submitted.
  */
 export declare function runRepoPublish(ctx: CliContext, args: RepoPublishArgs): Promise<ExitCode>;

package/dist/repo/publish.js

@@ -3,13 +3,19 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { buildManifest, escalateForPublish, prepareIntegrationSubmission, readProjectVersion, submitPrepared, } from '../commands/publish.js';
 import { CliError, gateFailedError, preconditionError, usageError, validationError, } from '../errors.js';
-import { EXPERIENCE_NOT_SUPPORTED, gateExperience, packExperience, } from '../experience/publish.js';
+import { EXPERIENCE_NOT_SUPPORTED, gateExperience, packExperience, submitExperience, } from '../experience/publish.js';
 import { packProject } from '../pack.js';
 import { loadProject } from '../project.js';
 import { shortHost } from '../ui.js';
 import { collectAllFindings } from '../validate-findings.js';
 export const PUBLISH_ARTIFACT_DIR = path.join('.ekanos', 'publish');
-const AVAILABILITY_NOTE = 'availability is set by a super admin today; the host does not take it at submission';
+/** What an integration's declared availability means at submission. */
+function availabilityNote(pkg) {
+    var _a;
+    return ((_a = pkg.availability) === null || _a === void 0 ? void 0 : _a.mode) === 'global'
+        ? `needs an approved global name (run "ekanos names claim ${pkg.name}"); without one the publish is refused`
+        : 'publishes restricted, named under your Source namespace';
+}
 function loadRepo(root) {
     try {
         return discoverRepo(root);
@@ -40,12 +46,12 @@ function artifactName(pkg) {
     return `${pkg.name}-${pkg.version}`;
 }
 function renderTable(ctx, rows) {
-    return ctx.ui.table(['package', 'kind', 'version', 'availability', 'artifact', 'status'], rows.map((row) => { var _a; return [
-        row.name,
+    return ctx.ui.table(['package', 'kind', 'version', 'availability', 'artifact', 'status'], rows.map((row) => { var _a, _b; return [
+        (_a = row.displayName) !== null && _a !== void 0 ? _a : row.name,
         row.kind,
         row.version,
         row.availability,
-        (_a = row.artifact) !== null && _a !== void 0 ? _a : '-',
+        (_b = row.artifact) !== null && _b !== void 0 ? _b : '-',
         row.detail ? `${row.status}: ${row.detail}` : row.status,
     ]; }));
 }
@@ -129,9 +135,10 @@ async function checkExperience(pkg, repoRoot, build, env) {
  * use them (a same-repo integration is not an override, so it is ordered
  * first, never refused). Every package passes its own gate before anything is
  * sent. `--dry-run` also builds each artifact under `.ekanos/publish/` and
- * touches no network. A real run submits the integrations in order through the
- * existing path; the host cannot admit an experience yet, so selected
- * experiences end the run with that refusal.
+ * touches no network. A real run submits the packages in order through the
+ * existing path; an experience goes to a host that advertises experience
+ * submissions, and against an older host that cannot admit one the run ends
+ * with that refusal after the rest were submitted.
  */
 export async function runRepoPublish(ctx, args) {
     const repo = loadRepo(args.repoRoot);
@@ -150,7 +157,7 @@ export async function runRepoPublish(ctx, args) {
     const warnings = plan.unselectedDependencies.map((dep) => `${dep.experience} uses ${dep.integration}, which is in this repo but not in this publish: publish ${dep.integration} first, or make sure it is already published at a compatible version.`);
     const notes = plan.order.flatMap((pkg) => pkg.kind === 'integration' && pkg.availability
         ? [
-            `${pkg.name}: ${describeAvailability(pkg.availability)} - ${AVAILABILITY_NOTE}.`,
+            `${pkg.name}: ${describeAvailability(pkg.availability)} - ${availabilityNote(pkg)}.`,
         ]
         : []);
     if (!ctx.jsonMode) {
@@ -183,14 +190,38 @@ export async function runRepoPublish(ctx, args) {
     let host = null;
     for (const [index, pkg] of plan.order.entries()) {
         const row = rows[index];
-        if (pkg.kind === 'experience') {
-            row.status = 'not supported by the host';
-            continue;
-        }
         if (stop) {
             row.status = 'not attempted';
             continue;
         }
+        if (pkg.kind === 'experience') {
+            try {
+                const single = Object.assign(Object.assign({}, args.publish), { dir: pkg.dir });
+                const gate = await gateExperience({
+                    dir: pkg.dir,
+                    dryRun: false,
+                    env: args.publish.env,
+                });
+                const submission = await submitExperience(ctx, Object.assign(Object.assign({}, single), { dryRun: false }), gate);
+                if (submission.status === 'unsupported') {
+                    host = submission.host;
+                    row.status = 'not supported by the host';
+                    continue;
+                }
+                row.status = 'submitted';
+                row.receipt = submission.data;
+                if (!ctx.jsonMode)
+                    ctx.log(submission.human);
+            }
+            catch (error) {
+                if (!(error instanceof CliError))
+                    throw error;
+                row.status = 'failed';
+                row.detail = error.message;
+                stop = error;
+            }
+            continue;
+        }
         try {
             const single = Object.assign(Object.assign({}, args.publish), { dir: pkg.dir });
             const prepared = await prepareIntegrationSubmission(ctx, single);
@@ -198,6 +229,9 @@ export async function runRepoPublish(ctx, args) {
             const submitted = await submitPrepared(ctx, single, prepared);
             row.status = 'submitted';
             row.receipt = submitted.data;
+            if (typeof submitted.data.displayName === 'string') {
+                row.displayName = submitted.data.displayName;
+            }
             if (!ctx.jsonMode)
                 ctx.log(submitted.human);
         }
@@ -218,7 +252,7 @@ export async function runRepoPublish(ctx, args) {
     if (rows.some((row) => row.status === 'not supported by the host')) {
         if (!ctx.jsonMode)
             ctx.log(summary(`Submitted${hostNote}.`));
-        return ctx.fail(gateFailedError(EXPERIENCE_NOT_SUPPORTED, 'The integrations in this publish were submitted; run "ekanos publish --dry-run" to build and pack the experiences. The host has no admission path for experiences until it ships one.'), data({ published: true }));
+        return ctx.fail(gateFailedError(EXPERIENCE_NOT_SUPPORTED, 'The other packages in this publish were submitted; run "ekanos publish --dry-run" to build and pack the experiences. This host has no admission path for experiences until it ships one.'), data({ published: true }));
     }
     return ctx.succeed(data({ published: true }), summary(`Submitted ${rows.length} package${rows.length === 1 ? '' : 's'}${hostNote}.`));
 }