@extension.dev/deploy 0.2.4 → 0.3.0

package/dist/module.js

@@ -68,18 +68,31 @@ const chromeOptionsSchema = external_zod_namespaceObject.z.object({
     ]).default("default"),
     deployPercentage: external_zod_namespaceObject.z.number().int().min(1).max(100).optional(),
     reviewExemption: external_zod_namespaceObject.z.boolean().default(false),
-    skipSubmitReview: external_zod_namespaceObject.z.boolean().default(false)
+    skipSubmitReview: external_zod_namespaceObject.z.boolean().default(false),
+    publisherId: external_zod_namespaceObject.z.string().trim().optional(),
+    apiVersion: external_zod_namespaceObject.z["enum"]([
+        "v1.1",
+        "v2"
+    ]).optional()
 });
 const firefoxOptionsSchema = external_zod_namespaceObject.z.object({
     zip: external_zod_namespaceObject.z.string().min(1),
     sourcesZip: external_zod_namespaceObject.z.string().min(1).optional(),
-    extensionId: external_zod_namespaceObject.z.string().min(1).trim(),
+    extensionId: external_zod_namespaceObject.z.string().trim().default(""),
     jwtIssuer: external_zod_namespaceObject.z.string().min(1).trim(),
     jwtSecret: external_zod_namespaceObject.z.string().min(1).trim(),
     channel: external_zod_namespaceObject.z["enum"]([
         "listed",
         "unlisted"
     ]).default("listed")
+}).superRefine((val, ctx)=>{
+    if ("listed" === val.channel && 0 === val.extensionId.length) ctx.addIssue({
+        code: external_zod_namespaceObject.z.ZodIssueCode.custom,
+        path: [
+            "extensionId"
+        ],
+        message: 'Listed Firefox submissions require an existing add-on GUID. Use channel "unlisted" for a first submission.'
+    });
 });
 const edgeOptionsSchema = external_zod_namespaceObject.z.object({
     zip: external_zod_namespaceObject.z.string().min(1),
@@ -110,7 +123,9 @@ function resolveConfig(flags) {
             publishTarget: flags.chromePublishTarget ?? envStr("CHROME_PUBLISH_TARGET"),
             deployPercentage: flags.chromeDeployPercentage ?? envInt("CHROME_DEPLOY_PERCENTAGE"),
             reviewExemption: flags.chromeReviewExemption ?? envBool("CHROME_REVIEW_EXEMPTION"),
-            skipSubmitReview: flags.chromeSkipSubmitReview ?? envBool("CHROME_SKIP_SUBMIT_REVIEW")
+            skipSubmitReview: flags.chromeSkipSubmitReview ?? envBool("CHROME_SKIP_SUBMIT_REVIEW"),
+            publisherId: flags.chromePublisherId ?? envStr("CHROME_PUBLISHER_ID"),
+            apiVersion: flags.chromeApiVersion ?? envStr("CHROME_API_VERSION")
         },
         firefox: null == firefoxZip ? void 0 : {
             zip: firefoxZip,
@@ -137,6 +152,7 @@ const SETUP_HINTS = {
     CHROME_CLIENT_ID: "Create OAuth 2.0 credentials at https://console.cloud.google.com/apis/credentials",
     CHROME_CLIENT_SECRET: "Generated alongside the Client ID in the Google Cloud Console.",
     CHROME_REFRESH_TOKEN: "Obtain by completing the OAuth consent flow. See the Chrome Web Store API docs.",
+    CHROME_PUBLISHER_ID: "The publisher UUID from your Chrome Web Store dev console URL (chrome.google.com/webstore/devconsole/<UUID>). Required for the v2 API.",
     CHROME_ZIP: "Path to the .zip file built for Chrome Web Store upload.",
     FIREFOX_EXTENSION_ID: "The addon GUID ({uuid} format) or email-style ID from your addon's AMO page.",
     FIREFOX_JWT_ISSUER: "API key from https://addons.mozilla.org/developers/addon/api/key/",
@@ -179,16 +195,24 @@ function envInt(name) {
 }
 const promises_namespaceObject = require("node:fs/promises");
 var promises_default = /*#__PURE__*/ __webpack_require__.n(promises_namespaceObject);
-async function fetchJson(url, init) {
-    const res = await fetch(url, init);
+const DEFAULT_TIMEOUT_MS = 60000;
+function withTimeout(init, timeoutMs = DEFAULT_TIMEOUT_MS) {
+    if (null == init ? void 0 : init.signal) return init;
+    return {
+        ...init || {},
+        signal: AbortSignal.timeout(timeoutMs)
+    };
+}
+async function fetchJson(url, init, timeoutMs) {
+    const res = await fetch(url, withTimeout(init, timeoutMs));
     if (!res.ok) {
         const body = await res.text().catch(()=>"");
         throw new Error(`HTTP ${res.status} ${res.statusText} \u{2014} ${(null == init ? void 0 : init.method) ?? "GET"} ${url}\n${body}`);
     }
     return res.json();
 }
-async function fetchRaw(url, init) {
-    const res = await fetch(url, init);
+async function fetchRaw(url, init, timeoutMs) {
+    const res = await fetch(url, withTimeout(init, timeoutMs));
     if (!res.ok) {
         const body = await res.text().catch(()=>"");
         throw new Error(`HTTP ${res.status} ${res.statusText} \u{2014} ${(null == init ? void 0 : init.method) ?? "GET"} ${url}\n${body}`);
@@ -241,10 +265,26 @@ function logDryStep(scope, step, details) {
         for (const [key, value] of Object.entries(details))if (null != value) console.log(labelLine(key, value));
     }
 }
+const UPLOAD_TIMEOUT_MS = 120000;
+const PUBLISH_TIMEOUT_MS = 60000;
 const CWS_OAUTH_URL = "https://oauth2.googleapis.com/token";
 const CWS_UPLOAD_BASE = "https://www.googleapis.com/upload/chromewebstore/v1.1/items";
 const CWS_PUBLISH_BASE = "https://www.googleapis.com/chromewebstore/v1.1/items";
 const CWS_ITEMS_BASE = "https://www.googleapis.com/chromewebstore/v1.1/items";
+const CWS_V2_BASE = "https://chromewebstore.googleapis.com/v2";
+const CWS_V2_UPLOAD_BASE = "https://chromewebstore.googleapis.com/upload/v2";
+function resolveChromeApiVersion(opts) {
+    if ("v1.1" === opts.apiVersion || "v2" === opts.apiVersion) return opts.apiVersion;
+    return String(opts.publisherId || "").trim() ? "v2" : "v1.1";
+}
+function v2ItemName(publisherId, extensionId) {
+    return `publishers/${encodeURIComponent(publisherId)}/items/${encodeURIComponent(extensionId)}`;
+}
+function requirePublisherId(publisherId, op) {
+    const id = String(publisherId || "").trim();
+    if (!id) throw new Error(`Chrome ${op} on the v2 API needs a publisher ID (the UUID from your Chrome Web Store dev console URL).`);
+    return id;
+}
 function chromeStoreUrl(extensionId) {
     return `https://chromewebstore.google.com/detail/${extensionId}`;
 }
@@ -263,16 +303,28 @@ async function authenticate(clientId, clientSecret, refreshToken) {
         }
     });
 }
-async function chrome_upload(extensionId, zipPath, token) {
+async function chrome_upload(extensionId, zipPath, token, ctx) {
     const body = await promises_default().readFile(zipPath);
-    const res = await fetch(`${CWS_UPLOAD_BASE}/${extensionId}`, {
-        method: "PUT",
+    let url;
+    let method;
+    const headers = {
+        Authorization: `${token.token_type} ${token.access_token}`,
+        "Content-Type": "application/zip"
+    };
+    if ("v2" === ctx.apiVersion) {
+        const pub = requirePublisherId(ctx.publisherId, "upload");
+        url = `${CWS_V2_UPLOAD_BASE}/${v2ItemName(pub, extensionId)}:upload`;
+        method = "POST";
+    } else {
+        url = `${CWS_UPLOAD_BASE}/${extensionId}`;
+        method = "PUT";
+        headers["x-goog-api-version"] = "2";
+    }
+    const res = await fetch(url, {
+        method,
         body,
-        headers: {
-            Authorization: `${token.token_type} ${token.access_token}`,
-            "x-goog-api-version": "2",
-            "Content-Type": "application/zip"
-        }
+        headers,
+        signal: AbortSignal.timeout(UPLOAD_TIMEOUT_MS)
     });
     if (!res.ok) {
         const text = await res.text().catch(()=>"");
@@ -280,6 +332,33 @@ async function chrome_upload(extensionId, zipPath, token) {
     }
 }
 async function publish(params) {
+    if ("v2" === params.apiVersion) {
+        const pub = requirePublisherId(params.publisherId, "publish");
+        if ("trustedTesters" === params.publishTarget) throw new Error("The Chrome v2 API has no trusted-tester publish target. Use staged publish, or keep this project on the v1.1 API for trusted-tester releases.");
+        const reqBody = {
+            publishType: "DEFAULT_PUBLISH"
+        };
+        if (null != params.deployPercentage) reqBody.deployInfos = [
+            {
+                deployPercentage: params.deployPercentage
+            }
+        ];
+        if (params.reviewExemption) reqBody.skipReview = true;
+        const res = await fetch(`${CWS_V2_BASE}/${v2ItemName(pub, params.extensionId)}:publish`, {
+            method: "POST",
+            headers: {
+                Authorization: `${params.token.token_type} ${params.token.access_token}`,
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify(reqBody),
+            signal: AbortSignal.timeout(PUBLISH_TIMEOUT_MS)
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(()=>"");
+            throw new Error(`Chrome publish failed: ${res.status} ${res.statusText}\n${text}`);
+        }
+        return;
+    }
     const url = new URL(`${CWS_PUBLISH_BASE}/${params.extensionId}/publish`);
     url.searchParams.set("publishTarget", params.publishTarget);
     if (null != params.deployPercentage) url.searchParams.set("deployPercentage", String(params.deployPercentage));
@@ -290,7 +369,8 @@ async function publish(params) {
             Authorization: `${params.token.token_type} ${params.token.access_token}`,
             "x-goog-api-version": "2",
             "Content-Length": "0"
-        }
+        },
+        signal: AbortSignal.timeout(PUBLISH_TIMEOUT_MS)
     });
     if (!res.ok) {
         const text = await res.text().catch(()=>"");
@@ -300,7 +380,8 @@ async function publish(params) {
 async function publishChrome(options, dryRun) {
     await assertFilePresent(options.zip);
     const zipSize = await getFileSize(options.zip);
-    log("chrome", "Authenticating with Chrome Web Store");
+    const apiVersion = resolveChromeApiVersion(options);
+    log("chrome", `Authenticating with Chrome Web Store (API ${apiVersion})`);
     const token = await authenticate(options.clientId, options.clientSecret, options.refreshToken);
     const outcome = {
         storeUrl: chromeStoreUrl(options.extensionId),
@@ -309,25 +390,28 @@ async function publishChrome(options, dryRun) {
     if (dryRun) {
         logDryStep("chrome", "Authentication succeeded", {
             tokenType: token.token_type,
-            scope: "chromewebstore"
+            scope: "chromewebstore",
+            apiVersion
         });
         logDryStep("chrome", "Would upload ZIP", {
             file: options.zip,
             size: formatBytes(zipSize),
-            target: `${CWS_UPLOAD_BASE}/${options.extensionId}`,
-            method: "PUT"
+            apiVersion
         });
         options.skipSubmitReview ? logDryStep("chrome", "Would skip publish (skipSubmitReview=true)") : logDryStep("chrome", "Would publish for review", {
-            target: `${CWS_PUBLISH_BASE}/${options.extensionId}/publish`,
+            apiVersion,
             publishTarget: options.publishTarget ?? "default",
             deployPercentage: options.deployPercentage,
             reviewExemption: options.reviewExemption
         });
-        log("chrome", "Dry run complete \u2014 no changes made");
+        log("chrome", "Dry run complete - no changes made");
         return outcome;
     }
     log("chrome", `Uploading ZIP file (${formatBytes(zipSize)})`);
-    await chrome_upload(options.extensionId, options.zip, token);
+    await chrome_upload(options.extensionId, options.zip, token, {
+        apiVersion,
+        publisherId: options.publisherId
+    });
     if (options.skipSubmitReview) {
         log("chrome", "Skipping publish step (skipSubmitReview=true)");
         return outcome;
@@ -338,16 +422,36 @@ async function publishChrome(options, dryRun) {
         publishTarget: options.publishTarget,
         token,
         deployPercentage: options.deployPercentage,
-        reviewExemption: options.reviewExemption
+        reviewExemption: options.reviewExemption,
+        apiVersion,
+        publisherId: options.publisherId
     });
     return outcome;
 }
 async function getChromeItem(params) {
     const token = await authenticate(params.clientId, params.clientSecret, params.refreshToken);
+    const auth = {
+        Authorization: `${token.token_type} ${token.access_token}`
+    };
+    const version = resolveChromeApiVersion(params);
+    if ("v2" === version) {
+        var _rev_distributionChannels_, _rev_distributionChannels;
+        const pub = requirePublisherId(params.publisherId, "status");
+        const status = await fetchJson(`${CWS_V2_BASE}/${v2ItemName(pub, params.extensionId)}:fetchStatus`, {
+            headers: auth
+        });
+        const rev = status.submittedItemRevisionStatus || status.publishedItemRevisionStatus;
+        return {
+            uploadState: status.lastAsyncUploadState,
+            crxVersion: null == rev ? void 0 : null == (_rev_distributionChannels = rev.distributionChannels) ? void 0 : null == (_rev_distributionChannels_ = _rev_distributionChannels[0]) ? void 0 : _rev_distributionChannels_.crxVersion,
+            publicKey: status.publicKey,
+            state: null == rev ? void 0 : rev.state
+        };
+    }
     const url = `${CWS_ITEMS_BASE}/${encodeURIComponent(params.extensionId)}?projection=${params.projection ?? "DRAFT"}`;
     return fetchJson(url, {
         headers: {
-            Authorization: `${token.token_type} ${token.access_token}`,
+            ...auth,
             "x-goog-api-version": "2"
         }
     });
@@ -362,11 +466,24 @@ async function verifyChromeCredentials(params) {
             message: `OAuth token exchange failed. Verify your Client ID, Client Secret, and Refresh Token are correct.\n${err instanceof Error ? err.message : err}`
         };
     }
+    const auth = {
+        Authorization: `${token.token_type} ${token.access_token}`
+    };
+    const version = resolveChromeApiVersion(params);
     try {
+        if ("v2" === version) {
+            const pub = requirePublisherId(params.publisherId, "verify");
+            const status = await fetchJson(`${CWS_V2_BASE}/${v2ItemName(pub, params.extensionId)}:fetchStatus`, {
+                headers: auth
+            });
+            const rev = status.submittedItemRevisionStatus || status.publishedItemRevisionStatus;
+            return {
+                ok: true,
+                message: `Credentials verified (Chrome v2 API). Item state: ${(null == rev ? void 0 : rev.state) || "unknown"}.`
+            };
+        }
         const item = await fetchJson(`${CWS_ITEMS_BASE}/${encodeURIComponent(params.extensionId)}?projection=DRAFT`, {
-            headers: {
-                Authorization: `${token.token_type} ${token.access_token}`
-            }
+            headers: auth
         });
         const title = (null == item ? void 0 : item.title) || params.extensionId;
         return {
@@ -382,7 +499,7 @@ async function verifyChromeCredentials(params) {
         };
         if (msg.includes("403")) return {
             ok: false,
-            message: `Access denied to extension ${params.extensionId}. You may not be the owner or a developer on this item.`
+            message: "v2" === version ? "Access denied. Check the publisher ID matches this extension's account, and that the extension ID is correct." : `Access denied to extension ${params.extensionId}. You may not be the owner or a developer on this item.`
         };
         return {
             ok: false,
@@ -390,20 +507,14 @@ async function verifyChromeCredentials(params) {
         };
     }
 }
-const external_node_crypto_namespaceObject = require("node:crypto");
-var external_node_crypto_default = /*#__PURE__*/ __webpack_require__.n(external_node_crypto_namespaceObject);
 function delay(ms) {
     return new Promise((resolve)=>{
         setTimeout(resolve, ms);
     });
 }
+const external_node_crypto_namespaceObject = require("node:crypto");
+var external_node_crypto_default = /*#__PURE__*/ __webpack_require__.n(external_node_crypto_namespaceObject);
 const AMO_BASE = "https://addons.mozilla.org/api/v5/addons";
-const AMO_PROFILE_URL = "https://addons.mozilla.org/api/v5/accounts/profile/";
-const POLL_INTERVAL_MS = 5000;
-const VALIDATION_TIMEOUT_MS = 600000;
-function firefoxStoreUrl(addonIdOrSlug) {
-    return `https://addons.mozilla.org/firefox/addon/${addonIdOrSlug}`;
-}
 function signJwt(issuer, secret, expiresInSeconds = 30) {
     const header = {
         alg: "HS256",
@@ -470,6 +581,30 @@ async function createVersion(params) {
         headers: authHeaders(params.jwtIssuer, params.jwtSecret)
     });
 }
+async function createAddon(params) {
+    const form = new FormData();
+    form.set("version.upload", params.uploadUuid);
+    if (params.sourcesZip) {
+        const srcBuf = await promises_default().readFile(params.sourcesZip);
+        const srcBlob = new Blob([
+            srcBuf
+        ], {
+            type: "application/zip"
+        });
+        form.set("version.source", srcBlob, "sources.zip");
+    }
+    return fetchJson(`${AMO_BASE}/addon/`, {
+        method: "POST",
+        body: form,
+        headers: authHeaders(params.jwtIssuer, params.jwtSecret)
+    });
+}
+const AMO_PROFILE_URL = "https://addons.mozilla.org/api/v5/accounts/profile/";
+const POLL_INTERVAL_MS = 5000;
+const VALIDATION_TIMEOUT_MS = 600000;
+function firefoxStoreUrl(addonIdOrSlug) {
+    return `https://addons.mozilla.org/firefox/addon/${addonIdOrSlug}`;
+}
 async function publishFirefox(options, dryRun) {
     await assertFilePresent(options.zip);
     const zipSize = await getFileSize(options.zip);
@@ -478,22 +613,28 @@ async function publishFirefox(options, dryRun) {
         await assertFilePresent(options.sourcesZip);
         sourcesSize = await getFileSize(options.sourcesZip);
     }
-    const addonId = normalizeAddonId(options.extensionId);
+    const addonId = normalizeAddonId(options.extensionId ?? "");
     const { jwtIssuer, jwtSecret } = options;
-    log("firefox", "Verifying addon exists");
-    await getAddon(addonId, jwtIssuer, jwtSecret);
+    const channel = options.channel ?? "listed";
+    const isNewAddon = 0 === addonId.length;
+    if (isNewAddon && "listed" === channel) throw new Error('Listed Firefox submissions require an existing add-on GUID. Use channel "unlisted" for a first submission, or set the add-on GUID.');
+    if (!isNewAddon) {
+        log("firefox", "Verifying addon exists");
+        await getAddon(addonId, jwtIssuer, jwtSecret);
+    }
     const outcome = {
-        storeUrl: firefoxStoreUrl(addonId),
+        storeUrl: isNewAddon ? firefoxStoreUrl("new") : firefoxStoreUrl(addonId),
         submissionId: addonId
     };
     if (dryRun) {
-        logDryStep("firefox", "Addon verified", {
-            addonId
+        logDryStep("firefox", isNewAddon ? "New add-on (no GUID)" : "Addon verified", {
+            addonId: isNewAddon ? "(assigned by AMO)" : addonId,
+            channel
         });
         logDryStep("firefox", "Would upload ZIP", {
             file: options.zip,
             size: formatBytes(zipSize),
-            channel: options.channel ?? "listed",
+            channel,
             target: `${AMO_BASE}/upload/`,
             method: "POST"
         });
@@ -501,8 +642,8 @@ async function publishFirefox(options, dryRun) {
             interval: `${POLL_INTERVAL_MS / 1000}s`,
             timeout: `${VALIDATION_TIMEOUT_MS / 60000}min`
         });
-        logDryStep("firefox", "Would create new version", {
-            target: `${AMO_BASE}/addon/${addonId}/versions/`,
+        logDryStep("firefox", isNewAddon ? "Would create new add-on" : "Would create new version", {
+            target: isNewAddon ? `${AMO_BASE}/addon/` : `${AMO_BASE}/addon/${addonId}/versions/`,
             method: "POST",
             sourcesZip: options.sourcesZip ? `${options.sourcesZip} (${formatBytes(sourcesSize)})` : "(none)"
         });
@@ -511,18 +652,31 @@ async function publishFirefox(options, dryRun) {
     }
     const upload = await uploadAndAwaitProcessing(options, jwtIssuer, jwtSecret);
     outcome.submissionId = upload.uuid;
-    log("firefox", "Creating new version");
-    const version = await createVersion({
-        addonId,
-        sourcesZip: options.sourcesZip,
-        uploadUuid: upload.uuid,
-        jwtIssuer,
-        jwtSecret
-    });
-    outcome.submissionId = String(version.id);
     const { errors, warnings, notices } = upload.validation;
     log("firefox", `Validation: ${errors} error(s), ${warnings} warning(s), ${notices} notice(s)`);
     if (!upload.valid) throw new Error("Firefox extension failed validation");
+    if (isNewAddon) {
+        var _created_version;
+        log("firefox", "Creating new add-on");
+        const created = await createAddon({
+            sourcesZip: options.sourcesZip,
+            uploadUuid: upload.uuid,
+            jwtIssuer,
+            jwtSecret
+        });
+        outcome.submissionId = String((null == (_created_version = created.version) ? void 0 : _created_version.id) ?? created.id);
+        outcome.storeUrl = firefoxStoreUrl(created.slug ?? created.guid);
+    } else {
+        log("firefox", "Creating new version");
+        const version = await createVersion({
+            addonId,
+            sourcesZip: options.sourcesZip,
+            uploadUuid: upload.uuid,
+            jwtIssuer,
+            jwtSecret
+        });
+        outcome.submissionId = String(version.id);
+    }
     return outcome;
 }
 function getFirefoxVersion(params) {
@@ -816,8 +970,134 @@ async function deploy(config) {
         success
     };
 }
+function usage() {
+    return `
+extension-deploy \u{2014} Deploy browser extensions to Chrome, Firefox, and Edge.
+
+USAGE
+  extension-deploy [options]                    submit to one or more stores
+  extension-deploy init [options]               interactive credential setup wizard
+  extension-deploy watch --chrome [options]     poll an in-flight submission
+  extension-deploy watch --firefox [options]
+  extension-deploy watch --edge [options]
+
+GLOBAL
+  --dry-run                 Verify auth without uploading or publishing
+  --output-json <path>      Write the DeployResult / WatchEvent as JSON to <path>
+  --help                    Show this help message
+
+CHROME
+  --chrome-zip <path>               Path to Chrome extension ZIP
+  --chrome-extension-id <id>        Chrome extension ID
+  --chrome-client-id <id>           OAuth2 client ID
+  --chrome-client-secret <secret>   OAuth2 client secret
+  --chrome-refresh-token <token>    OAuth2 refresh token
+  --chrome-publish-target <target>  "default" or "trustedTesters"
+  --chrome-deploy-percentage <n>    Staged rollout percentage (1-100)
+  --chrome-review-exemption         Request expedited review
+  --chrome-skip-submit-review       Upload only, skip publish
+
+FIREFOX
+  --firefox-zip <path>              Path to Firefox extension ZIP
+  --firefox-sources-zip <path>      Path to sources ZIP (optional)
+  --firefox-extension-id <id>       Addon GUID or email-style ID
+  --firefox-jwt-issuer <issuer>     AMO JWT issuer
+  --firefox-jwt-secret <secret>     AMO JWT secret
+  --firefox-channel <channel>       "listed" or "unlisted"
+
+EDGE
+  --edge-zip <path>                 Path to Edge extension ZIP
+  --edge-product-id <id>            Partner Center product ID
+  --edge-client-id <id>             Partner Center client ID
+  --edge-api-key <key>              Partner Center API key (v1.1)
+  --edge-skip-submit-review         Upload only, skip publish
+
+WATCH
+  --watch-submission-id <id>        Required for firefox/edge (version id / operation id)
+  --watch-interval <seconds>        Poll interval (default 60)
+  --watch-timeout <seconds>         Max time to wait for a terminal state (default 3600)
+
+INIT
+  --init-stores <list>              Comma-separated store list (skip picker)
+  --init-output <path>              Destination file (default .env.submit)
+  --init-skip-verify                Don't run verifyCredentials after collection
+  --init-force                      Overwrite existing .env.submit without asking
+
+ENVIRONMENT VARIABLES
+  All flags can be set via SCREAMING_SNAKE_CASE env vars (e.g. CHROME_ZIP,
+  FIREFOX_JWT_SECRET, EDGE_API_KEY). Flags take precedence over env vars.
+  A .env.submit file in the current directory is loaded automatically.
+`.trim();
+}
+const BOOLEAN_FLAGS = new Set([
+    "help",
+    "dryRun",
+    "chromeReviewExemption",
+    "chromeSkipSubmitReview",
+    "edgeSkipSubmitReview",
+    "initSkipVerify",
+    "initForce"
+]);
+const INT_FLAGS = new Set([
+    "chromeDeployPercentage",
+    "watchInterval",
+    "watchTimeout"
+]);
+function parseArgs(argv) {
+    const flags = {};
+    let i = 0;
+    if ("watch" === argv[0]) {
+        flags.command = "watch";
+        i = 1;
+    } else if ("init" === argv[0]) {
+        flags.command = "init";
+        i = 1;
+    }
+    while(i < argv.length){
+        const arg = argv[i];
+        if ("--help" === arg || "-h" === arg) {
+            flags.help = true;
+            i++;
+            continue;
+        }
+        if ("--chrome" === arg) {
+            flags.watchStore = "chrome";
+            i++;
+            continue;
+        }
+        if ("--firefox" === arg) {
+            flags.watchStore = "firefox";
+            i++;
+            continue;
+        }
+        if ("--edge" === arg) {
+            flags.watchStore = "edge";
+            i++;
+            continue;
+        }
+        if (!(null == arg ? void 0 : arg.startsWith("--"))) {
+            i++;
+            continue;
+        }
+        const key = arg.slice(2).replace(/-([a-z])/g, (_, c)=>c.toUpperCase());
+        if (BOOLEAN_FLAGS.has(key)) {
+            flags[key] = true;
+            i++;
+            continue;
+        }
+        const next = argv[i + 1];
+        if (null == next || next.startsWith("--")) {
+            flags[key] = true;
+            i++;
+            continue;
+        }
+        flags[key] = INT_FLAGS.has(key) ? parseInt(next, 10) : next;
+        i += 2;
+    }
+    return flags;
+}
 const DEFAULT_POLL_INTERVAL_MS = 60000;
-const DEFAULT_TIMEOUT_MS = 3600000;
+const watch_DEFAULT_TIMEOUT_MS = 3600000;
 function watch_now() {
     return new Date().toISOString();
 }
@@ -944,7 +1224,7 @@ function watchFirefoxSubmission(input, options = {}) {
 }
 async function runWatchLoop(_store, probe, options) {
     const pollInterval = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-    const timeout = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const timeout = options.timeoutMs ?? watch_DEFAULT_TIMEOUT_MS;
     const deadline = Date.now() + timeout;
     let lastEvent;
     while(true){
@@ -956,125 +1236,30 @@ async function runWatchLoop(_store, probe, options) {
         await delay(pollInterval);
     }
 }
-const STORE_CHOICES = [
-    {
-        value: "chrome",
-        label: "Chrome Web Store"
-    },
-    {
-        value: "firefox",
-        label: "Firefox AMO (addons.mozilla.org)"
-    },
-    {
-        value: "edge",
-        label: "Edge Add-ons (Partner Center)"
+async function requireValue(io, label, hint, opts) {
+    const question = hint ? `${label} ${hint}:` : `${label}:`;
+    for(let attempt = 0; attempt < 3; attempt++){
+        const answer = (await io.prompt(question, opts)).trim();
+        if (answer) return answer;
+        io.log(`  ${label} is required.`);
     }
-];
+    throw new Error(`init: ${label} is required.`);
+}
 const CHROME_OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";
 const CHROME_OAUTH_AUTH_URL = "https://accounts.google.com/o/oauth2/auth";
 const CHROME_OOB_REDIRECT = "urn:ietf:wg:oauth:2.0:oob";
 const CHROME_SCOPE = "https://www.googleapis.com/auth/chromewebstore";
-async function runInit(deps, options = {}) {
+async function collectChromeCredentials(deps) {
     const { io } = deps;
+    io.log("Chrome Web Store needs OAuth credentials. You'll need:");
+    io.log("  1. A Google Cloud project with the Chrome Web Store API enabled:");
+    io.log("     https://console.cloud.google.com/apis/library/chromewebstore.googleapis.com");
+    io.log("  2. OAuth 2.0 credentials (application type: Desktop app):");
+    io.log("     https://console.cloud.google.com/apis/credentials");
+    io.log("  3. Your extension ID from the Chrome Web Store Developer Dashboard.");
     io.log("");
-    io.log(`${colors.green("\u23F5\u23F5\u23F5")} ${colors.blue("init")} ${colors.underline("extension-deploy \u2014 set up store credentials")}`);
-    io.log("");
-    io.log("This wizard walks you through creating credentials for each store and");
-    io.log("writes them to a .env.submit file. Press Ctrl+C at any time to abort.");
-    io.log("");
-    const stores = options.stores ? options.stores : await io.multiselect("Which stores do you want to configure?", STORE_CHOICES);
-    if (0 === stores.length) throw new Error("init: at least one store must be selected. Use --init-stores chrome,firefox,edge or make a selection.");
-    const envLines = [
-        "# Generated by `extension-deploy init`.",
-        "# Do not commit secrets to source control.",
-        ""
-    ];
-    const verified = {};
-    for (const store of stores){
-        io.log("");
-        io.log(colors.underline(colors.blue(labelFor(store))));
-        io.log("");
-        if ("chrome" === store) {
-            const creds = await collectChromeCredentials(deps);
-            envLines.push(`CHROME_EXTENSION_ID=${creds.extensionId}`, `CHROME_CLIENT_ID=${creds.clientId}`, `CHROME_CLIENT_SECRET=${creds.clientSecret}`, `CHROME_REFRESH_TOKEN=${creds.refreshToken}`, "");
-            if (!options.skipVerify) {
-                const verify = deps.verifyChrome ?? verifyChromeCredentials;
-                verified.chrome = normalizeVerify(await verify(creds));
-                logVerify(io, "chrome", verified.chrome);
-            }
-        } else if ("firefox" === store) {
-            const creds = await collectFirefoxCredentials(deps);
-            envLines.push(`FIREFOX_EXTENSION_ID=${creds.addonId}`, `FIREFOX_JWT_ISSUER=${creds.jwtIssuer}`, `FIREFOX_JWT_SECRET=${creds.jwtSecret}`, "");
-            if (!options.skipVerify) {
-                const verify = deps.verifyFirefox ?? verifyFirefoxCredentials;
-                verified.firefox = normalizeVerify(await verify({
-                    jwtIssuer: creds.jwtIssuer,
-                    jwtSecret: creds.jwtSecret,
-                    addonId: creds.addonId
-                }));
-                logVerify(io, "firefox", verified.firefox);
-            }
-        } else {
-            const creds = await collectEdgeCredentials(deps);
-            envLines.push(`EDGE_PRODUCT_ID=${creds.productId}`, `EDGE_CLIENT_ID=${creds.clientId}`, `EDGE_API_KEY=${creds.apiKey}`, "");
-            if (!options.skipVerify) {
-                const verify = deps.verifyEdge ?? verifyEdgeCredentials;
-                verified.edge = normalizeVerify(await verify({
-                    clientId: creds.clientId,
-                    apiKey: creds.apiKey,
-                    productId: creds.productId
-                }));
-                logVerify(io, "edge", verified.edge);
-            }
-        }
-    }
-    const envContent = envLines.join("\n");
-    const envPath = resolveEnvPath(deps.cwd, options.outputPath);
-    const exists = await deps.fileExists(envPath);
-    let wrote = false;
-    if (exists && !options.force) {
-        const overwrite = await deps.io.confirm(`${envPath} already exists. Overwrite?`, false);
-        if (overwrite) {
-            await deps.writeFile(envPath, envContent);
-            wrote = true;
-        } else {
-            io.log("");
-            io.log(`Skipped writing ${envPath}. Credential block:`);
-            io.log("");
-            io.log(envContent);
-        }
-    } else {
-        await deps.writeFile(envPath, envContent);
-        wrote = true;
-    }
-    if (wrote) {
-        io.log("");
-        io.log(`${colors.green("\u23F5\u23F5\u23F5")} ${colors.blue("init")} Wrote ${colors.underline(envPath)}`);
-        io.log("");
-        io.log(colors.gray("Next steps:"));
-        io.log("  - Add .env.submit to .gitignore if it isn't already (it contains secrets).");
-        io.log("  - Run `extension-deploy --dry-run` to sanity-check the full submit flow.");
-        io.log("");
-    }
-    return {
-        stores,
-        envPath,
-        envContent,
-        verified,
-        wrote
-    };
-}
-async function collectChromeCredentials(deps) {
-    const { io } = deps;
-    io.log("Chrome Web Store needs OAuth credentials. You'll need:");
-    io.log("  1. A Google Cloud project with the Chrome Web Store API enabled:");
-    io.log("     https://console.cloud.google.com/apis/library/chromewebstore.googleapis.com");
-    io.log("  2. OAuth 2.0 credentials (application type: Desktop app):");
-    io.log("     https://console.cloud.google.com/apis/credentials");
-    io.log("  3. Your extension ID from the Chrome Web Store Developer Dashboard.");
-    io.log("");
-    io.log("This wizard will take your Client ID + Secret and walk you through");
-    io.log("generating a refresh token automatically.");
+    io.log("This wizard will take your Client ID + Secret and walk you through");
+    io.log("generating a refresh token automatically.");
     io.log("");
     const extensionId = await requireValue(io, "Chrome extension ID", "(32-character ID from the CWS dashboard URL)");
     const clientId = await requireValue(io, "OAuth Client ID");
@@ -1179,6 +1364,110 @@ async function collectEdgeCredentials(deps) {
         apiKey
     };
 }
+const STORE_CHOICES = [
+    {
+        value: "chrome",
+        label: "Chrome Web Store"
+    },
+    {
+        value: "firefox",
+        label: "Firefox AMO (addons.mozilla.org)"
+    },
+    {
+        value: "edge",
+        label: "Edge Add-ons (Partner Center)"
+    }
+];
+async function runInit(deps, options = {}) {
+    const { io } = deps;
+    io.log("");
+    io.log(`${colors.green("\u23F5\u23F5\u23F5")} ${colors.blue("init")} ${colors.underline("extension-deploy \u2014 set up store credentials")}`);
+    io.log("");
+    io.log("This wizard walks you through creating credentials for each store and");
+    io.log("writes them to a .env.submit file. Press Ctrl+C at any time to abort.");
+    io.log("");
+    const stores = options.stores ? options.stores : await io.multiselect("Which stores do you want to configure?", STORE_CHOICES);
+    if (0 === stores.length) throw new Error("init: at least one store must be selected. Use --init-stores chrome,firefox,edge or make a selection.");
+    const envLines = [
+        "# Generated by `extension-deploy init`.",
+        "# Do not commit secrets to source control.",
+        ""
+    ];
+    const verified = {};
+    for (const store of stores){
+        io.log("");
+        io.log(colors.underline(colors.blue(labelFor(store))));
+        io.log("");
+        if ("chrome" === store) {
+            const creds = await collectChromeCredentials(deps);
+            envLines.push(`CHROME_EXTENSION_ID=${creds.extensionId}`, `CHROME_CLIENT_ID=${creds.clientId}`, `CHROME_CLIENT_SECRET=${creds.clientSecret}`, `CHROME_REFRESH_TOKEN=${creds.refreshToken}`, "");
+            if (!options.skipVerify) {
+                const verify = deps.verifyChrome ?? verifyChromeCredentials;
+                verified.chrome = normalizeVerify(await verify(creds));
+                logVerify(io, "chrome", verified.chrome);
+            }
+        } else if ("firefox" === store) {
+            const creds = await collectFirefoxCredentials(deps);
+            envLines.push(`FIREFOX_EXTENSION_ID=${creds.addonId}`, `FIREFOX_JWT_ISSUER=${creds.jwtIssuer}`, `FIREFOX_JWT_SECRET=${creds.jwtSecret}`, "");
+            if (!options.skipVerify) {
+                const verify = deps.verifyFirefox ?? verifyFirefoxCredentials;
+                verified.firefox = normalizeVerify(await verify({
+                    jwtIssuer: creds.jwtIssuer,
+                    jwtSecret: creds.jwtSecret,
+                    addonId: creds.addonId
+                }));
+                logVerify(io, "firefox", verified.firefox);
+            }
+        } else {
+            const creds = await collectEdgeCredentials(deps);
+            envLines.push(`EDGE_PRODUCT_ID=${creds.productId}`, `EDGE_CLIENT_ID=${creds.clientId}`, `EDGE_API_KEY=${creds.apiKey}`, "");
+            if (!options.skipVerify) {
+                const verify = deps.verifyEdge ?? verifyEdgeCredentials;
+                verified.edge = normalizeVerify(await verify({
+                    clientId: creds.clientId,
+                    apiKey: creds.apiKey,
+                    productId: creds.productId
+                }));
+                logVerify(io, "edge", verified.edge);
+            }
+        }
+    }
+    const envContent = envLines.join("\n");
+    const envPath = resolveEnvPath(deps.cwd, options.outputPath);
+    const exists = await deps.fileExists(envPath);
+    let wrote = false;
+    if (exists && !options.force) {
+        const overwrite = await deps.io.confirm(`${envPath} already exists. Overwrite?`, false);
+        if (overwrite) {
+            await deps.writeFile(envPath, envContent);
+            wrote = true;
+        } else {
+            io.log("");
+            io.log(`Skipped writing ${envPath}. Credential block:`);
+            io.log("");
+            io.log(envContent);
+        }
+    } else {
+        await deps.writeFile(envPath, envContent);
+        wrote = true;
+    }
+    if (wrote) {
+        io.log("");
+        io.log(`${colors.green("\u23F5\u23F5\u23F5")} ${colors.blue("init")} Wrote ${colors.underline(envPath)}`);
+        io.log("");
+        io.log(colors.gray("Next steps:"));
+        io.log("  - Add .env.submit to .gitignore if it isn't already (it contains secrets).");
+        io.log("  - Run `extension-deploy --dry-run` to sanity-check the full submit flow.");
+        io.log("");
+    }
+    return {
+        stores,
+        envPath,
+        envContent,
+        verified,
+        wrote
+    };
+}
 function labelFor(store) {
     var _STORE_CHOICES_find;
     return (null == (_STORE_CHOICES_find = STORE_CHOICES.find((c)=>c.value === store)) ? void 0 : _STORE_CHOICES_find.label) ?? String(store);
@@ -1197,15 +1486,6 @@ function resolveEnvPath(cwd, outputPath) {
     const target = outputPath ?? ".env.submit";
     return external_node_path_default().isAbsolute(target) ? target : external_node_path_default().join(cwd, target);
 }
-async function requireValue(io, label, hint, opts) {
-    const question = hint ? `${label} ${hint}:` : `${label}:`;
-    for(let attempt = 0; attempt < 3; attempt++){
-        const answer = (await io.prompt(question, opts)).trim();
-        if (answer) return answer;
-        io.log(`  ${label} is required.`);
-    }
-    throw new Error(`init: ${label} is required.`);
-}
 const external_node_readline_namespaceObject = require("node:readline");
 var external_node_readline_default = /*#__PURE__*/ __webpack_require__.n(external_node_readline_namespaceObject);
 function createStdinIO() {
@@ -1261,7 +1541,13 @@ function createStdinIO() {
 }
 const stdinFs = {
     async writeFile (filePath, content) {
-        await promises_default().writeFile(filePath, content, "utf-8");
+        await promises_default().writeFile(filePath, content, {
+            encoding: "utf-8",
+            mode: 384
+        });
+        try {
+            await promises_default().chmod(filePath, 384);
+        } catch  {}
     },
     async fileExists (filePath) {
         try {
@@ -1272,173 +1558,12 @@ const stdinFs = {
         }
     }
 };
-function usage() {
-    return `
-extension-deploy \u{2014} Deploy browser extensions to Chrome, Firefox, and Edge.
-
-USAGE
-  extension-deploy [options]                    submit to one or more stores
-  extension-deploy init [options]               interactive credential setup wizard
-  extension-deploy watch --chrome [options]     poll an in-flight submission
-  extension-deploy watch --firefox [options]
-  extension-deploy watch --edge [options]
-
-GLOBAL
-  --dry-run                 Verify auth without uploading or publishing
-  --output-json <path>      Write the DeployResult / WatchEvent as JSON to <path>
-  --help                    Show this help message
-
-CHROME
-  --chrome-zip <path>               Path to Chrome extension ZIP
-  --chrome-extension-id <id>        Chrome extension ID
-  --chrome-client-id <id>           OAuth2 client ID
-  --chrome-client-secret <secret>   OAuth2 client secret
-  --chrome-refresh-token <token>    OAuth2 refresh token
-  --chrome-publish-target <target>  "default" or "trustedTesters"
-  --chrome-deploy-percentage <n>    Staged rollout percentage (1-100)
-  --chrome-review-exemption         Request expedited review
-  --chrome-skip-submit-review       Upload only, skip publish
-
-FIREFOX
-  --firefox-zip <path>              Path to Firefox extension ZIP
-  --firefox-sources-zip <path>      Path to sources ZIP (optional)
-  --firefox-extension-id <id>       Addon GUID or email-style ID
-  --firefox-jwt-issuer <issuer>     AMO JWT issuer
-  --firefox-jwt-secret <secret>     AMO JWT secret
-  --firefox-channel <channel>       "listed" or "unlisted"
-
-EDGE
-  --edge-zip <path>                 Path to Edge extension ZIP
-  --edge-product-id <id>            Partner Center product ID
-  --edge-client-id <id>             Partner Center client ID
-  --edge-api-key <key>              Partner Center API key (v1.1)
-  --edge-skip-submit-review         Upload only, skip publish
-
-WATCH
-  --watch-submission-id <id>        Required for firefox/edge (version id / operation id)
-  --watch-interval <seconds>        Poll interval (default 60)
-  --watch-timeout <seconds>         Max time to wait for a terminal state (default 3600)
-
-INIT
-  --init-stores <list>              Comma-separated store list (skip picker)
-  --init-output <path>              Destination file (default .env.submit)
-  --init-skip-verify                Don't run verifyCredentials after collection
-  --init-force                      Overwrite existing .env.submit without asking
-
-ENVIRONMENT VARIABLES
-  All flags can be set via SCREAMING_SNAKE_CASE env vars (e.g. CHROME_ZIP,
-  FIREFOX_JWT_SECRET, EDGE_API_KEY). Flags take precedence over env vars.
-  A .env.submit file in the current directory is loaded automatically.
-`.trim();
-}
-const BOOLEAN_FLAGS = new Set([
-    "help",
-    "dryRun",
-    "chromeReviewExemption",
-    "chromeSkipSubmitReview",
-    "edgeSkipSubmitReview",
-    "initSkipVerify",
-    "initForce"
-]);
-const INT_FLAGS = new Set([
-    "chromeDeployPercentage",
-    "watchInterval",
-    "watchTimeout"
-]);
-function parseArgs(argv) {
-    const flags = {};
-    let i = 0;
-    if ("watch" === argv[0]) {
-        flags.command = "watch";
-        i = 1;
-    } else if ("init" === argv[0]) {
-        flags.command = "init";
-        i = 1;
-    }
-    while(i < argv.length){
-        const arg = argv[i];
-        if ("--help" === arg || "-h" === arg) {
-            flags.help = true;
-            i++;
-            continue;
-        }
-        if ("--chrome" === arg) {
-            flags.watchStore = "chrome";
-            i++;
-            continue;
-        }
-        if ("--firefox" === arg) {
-            flags.watchStore = "firefox";
-            i++;
-            continue;
-        }
-        if ("--edge" === arg) {
-            flags.watchStore = "edge";
-            i++;
-            continue;
-        }
-        if (!(null == arg ? void 0 : arg.startsWith("--"))) {
-            i++;
-            continue;
-        }
-        const key = arg.slice(2).replace(/-([a-z])/g, (_, c)=>c.toUpperCase());
-        if (BOOLEAN_FLAGS.has(key)) {
-            flags[key] = true;
-            i++;
-            continue;
-        }
-        const next = argv[i + 1];
-        if (null == next || next.startsWith("--")) {
-            flags[key] = true;
-            i++;
-            continue;
-        }
-        flags[key] = INT_FLAGS.has(key) ? parseInt(next, 10) : next;
-        i += 2;
-    }
-    return flags;
-}
-function loadDotEnv() {
-    try {
-        const envPath = external_node_path_default().resolve(process.cwd(), ".env.submit");
-        const content = external_node_fs_default().readFileSync(envPath, "utf-8");
-        for (const line of content.split("\n")){
-            const trimmed = line.trim();
-            if (!trimmed || trimmed.startsWith("#")) continue;
-            const eqIdx = trimmed.indexOf("=");
-            if (-1 === eqIdx) continue;
-            const key = trimmed.slice(0, eqIdx).trim();
-            let value = trimmed.slice(eqIdx + 1).trim();
-            if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
-            if (!(key in process.env)) process.env[key] = value;
-        }
-    } catch  {}
-}
 function writeJsonOutput(filePath, payload) {
     external_node_fs_default().mkdirSync(external_node_path_default().dirname(external_node_path_default().resolve(filePath)), {
         recursive: true
     });
     external_node_fs_default().writeFileSync(filePath, JSON.stringify(payload, null, 2) + "\n", "utf-8");
 }
-async function main() {
-    loadDotEnv();
-    const flags = parseArgs(process.argv.slice(2));
-    if (flags.help) {
-        console.log(usage());
-        process.exit(0);
-    }
-    if ("watch" === flags.command) return void await runWatch(flags);
-    if ("init" === flags.command) return void await runInitCommand(flags);
-    const config = resolveConfig(flags);
-    try {
-        const result = await deploy(config);
-        if (flags.outputJson) writeJsonOutput(flags.outputJson, result);
-        if (!result.success) process.exit(1);
-    } catch (err) {
-        logError("deploy", err instanceof Error ? err.message : String(err));
-        process.exit(1);
-    }
-}
 async function runWatch(flags) {
     const store = flags.watchStore;
     if (!store) {
@@ -1534,6 +1659,41 @@ function parseInitStores(raw) {
     if (0 === parsed.length) throw new Error(`--init-stores: expected a comma-separated list of chrome,firefox,edge (got "${raw}")`);
     return parsed;
 }
+function loadDotEnv() {
+    try {
+        const envPath = external_node_path_default().resolve(process.cwd(), ".env.submit");
+        const content = external_node_fs_default().readFileSync(envPath, "utf-8");
+        for (const line of content.split("\n")){
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith("#")) continue;
+            const eqIdx = trimmed.indexOf("=");
+            if (-1 === eqIdx) continue;
+            const key = trimmed.slice(0, eqIdx).trim();
+            let value = trimmed.slice(eqIdx + 1).trim();
+            if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
+            if (!(key in process.env)) process.env[key] = value;
+        }
+    } catch  {}
+}
+async function main() {
+    loadDotEnv();
+    const flags = parseArgs(process.argv.slice(2));
+    if (flags.help) {
+        console.log(usage());
+        process.exit(0);
+    }
+    if ("watch" === flags.command) return void await runWatch(flags);
+    if ("init" === flags.command) return void await runInitCommand(flags);
+    const config = resolveConfig(flags);
+    try {
+        const result = await deploy(config);
+        if (flags.outputJson) writeJsonOutput(flags.outputJson, result);
+        if (!result.success) process.exit(1);
+    } catch (err) {
+        logError("deploy", err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
 exports.chromeOptionsSchema = __webpack_exports__.chromeOptionsSchema;
 exports.deploy = __webpack_exports__.deploy;
 exports.deployConfigSchema = __webpack_exports__.deployConfigSchema;