@extension.dev/deploy 0.2.5 → 1.0.0

package/dist/module.mjs

@@ -11,10 +11,7 @@ const chromeOptionsSchema = z.object({
     clientId: z.string().min(1).trim(),
     clientSecret: z.string().min(1).trim(),
     refreshToken: z.string().min(1).trim(),
-    publishTarget: z["enum"]([
-        "default",
-        "trustedTesters"
-    ]).default("default"),
+    publisherId: z.string().min(1).trim(),
     deployPercentage: z.number().int().min(1).max(100).optional(),
     reviewExemption: z.boolean().default(false),
     skipSubmitReview: z.boolean().default(false)
@@ -64,7 +61,7 @@ function resolveConfig(flags) {
             clientId: flags.chromeClientId ?? envStr("CHROME_CLIENT_ID") ?? "",
             clientSecret: flags.chromeClientSecret ?? envStr("CHROME_CLIENT_SECRET") ?? "",
             refreshToken: flags.chromeRefreshToken ?? envStr("CHROME_REFRESH_TOKEN") ?? "",
-            publishTarget: flags.chromePublishTarget ?? envStr("CHROME_PUBLISH_TARGET"),
+            publisherId: flags.chromePublisherId ?? envStr("CHROME_PUBLISHER_ID") ?? "",
             deployPercentage: flags.chromeDeployPercentage ?? envInt("CHROME_DEPLOY_PERCENTAGE"),
             reviewExemption: flags.chromeReviewExemption ?? envBool("CHROME_REVIEW_EXEMPTION"),
             skipSubmitReview: flags.chromeSkipSubmitReview ?? envBool("CHROME_SKIP_SUBMIT_REVIEW")
@@ -94,6 +91,7 @@ const SETUP_HINTS = {
     CHROME_CLIENT_ID: "Create OAuth 2.0 credentials at https://console.cloud.google.com/apis/credentials",
     CHROME_CLIENT_SECRET: "Generated alongside the Client ID in the Google Cloud Console.",
     CHROME_REFRESH_TOKEN: "Obtain by completing the OAuth consent flow. See the Chrome Web Store API docs.",
+    CHROME_PUBLISHER_ID: "The publisher UUID from your Chrome Web Store dev console URL (chrome.google.com/webstore/devconsole/<UUID>).",
     CHROME_ZIP: "Path to the .zip file built for Chrome Web Store upload.",
     FIREFOX_EXTENSION_ID: "The addon GUID ({uuid} format) or email-style ID from your addon's AMO page.",
     FIREFOX_JWT_ISSUER: "API key from https://addons.mozilla.org/developers/addon/api/key/",
@@ -134,16 +132,24 @@ function envInt(name) {
     const val = process.env[name];
     return null == val ? void 0 : parseInt(val, 10);
 }
-async function fetchJson(url, init) {
-    const res = await fetch(url, init);
+const DEFAULT_TIMEOUT_MS = 60000;
+function withTimeout(init, timeoutMs = DEFAULT_TIMEOUT_MS) {
+    if (null == init ? void 0 : init.signal) return init;
+    return {
+        ...init || {},
+        signal: AbortSignal.timeout(timeoutMs)
+    };
+}
+async function fetchJson(url, init, timeoutMs) {
+    const res = await fetch(url, withTimeout(init, timeoutMs));
     if (!res.ok) {
         const body = await res.text().catch(()=>"");
         throw new Error(`HTTP ${res.status} ${res.statusText} \u{2014} ${(null == init ? void 0 : init.method) ?? "GET"} ${url}\n${body}`);
     }
     return res.json();
 }
-async function fetchRaw(url, init) {
-    const res = await fetch(url, init);
+async function fetchRaw(url, init, timeoutMs) {
+    const res = await fetch(url, withTimeout(init, timeoutMs));
     if (!res.ok) {
         const body = await res.text().catch(()=>"");
         throw new Error(`HTTP ${res.status} ${res.statusText} \u{2014} ${(null == init ? void 0 : init.method) ?? "GET"} ${url}\n${body}`);
@@ -194,10 +200,19 @@ function logDryStep(scope, step, details) {
         for (const [key, value] of Object.entries(details))if (null != value) console.log(labelLine(key, value));
     }
 }
+const UPLOAD_TIMEOUT_MS = 120000;
+const PUBLISH_TIMEOUT_MS = 60000;
 const CWS_OAUTH_URL = "https://oauth2.googleapis.com/token";
-const CWS_UPLOAD_BASE = "https://www.googleapis.com/upload/chromewebstore/v1.1/items";
-const CWS_PUBLISH_BASE = "https://www.googleapis.com/chromewebstore/v1.1/items";
-const CWS_ITEMS_BASE = "https://www.googleapis.com/chromewebstore/v1.1/items";
+const CWS_V2_BASE = "https://chromewebstore.googleapis.com/v2";
+const CWS_V2_UPLOAD_BASE = "https://chromewebstore.googleapis.com/upload/v2";
+function v2ItemName(publisherId, extensionId) {
+    return `publishers/${encodeURIComponent(publisherId)}/items/${encodeURIComponent(extensionId)}`;
+}
+function requirePublisherId(publisherId, op) {
+    const id = String(publisherId || "").trim();
+    if (!id) throw new Error(`Chrome ${op} needs a publisher ID (the UUID from your Chrome Web Store dev console URL).`);
+    return id;
+}
 function chromeStoreUrl(extensionId) {
     return `https://chromewebstore.google.com/detail/${extensionId}`;
 }
@@ -216,16 +231,17 @@ async function authenticate(clientId, clientSecret, refreshToken) {
         }
     });
 }
-async function chrome_upload(extensionId, zipPath, token) {
+async function chrome_upload(extensionId, publisherId, zipPath, token) {
     const body = await promises_default.readFile(zipPath);
-    const res = await fetch(`${CWS_UPLOAD_BASE}/${extensionId}`, {
-        method: "PUT",
+    const url = `${CWS_V2_UPLOAD_BASE}/${v2ItemName(publisherId, extensionId)}:upload`;
+    const res = await fetch(url, {
+        method: "POST",
         body,
         headers: {
             Authorization: `${token.token_type} ${token.access_token}`,
-            "x-goog-api-version": "2",
             "Content-Type": "application/zip"
-        }
+        },
+        signal: AbortSignal.timeout(UPLOAD_TIMEOUT_MS)
     });
     if (!res.ok) {
         const text = await res.text().catch(()=>"");
@@ -233,17 +249,23 @@ async function chrome_upload(extensionId, zipPath, token) {
     }
 }
 async function publish(params) {
-    const url = new URL(`${CWS_PUBLISH_BASE}/${params.extensionId}/publish`);
-    url.searchParams.set("publishTarget", params.publishTarget);
-    if (null != params.deployPercentage) url.searchParams.set("deployPercentage", String(params.deployPercentage));
-    if (null != params.reviewExemption) url.searchParams.set("reviewExemption", String(params.reviewExemption));
-    const res = await fetch(url.href, {
+    const reqBody = {
+        publishType: "DEFAULT_PUBLISH"
+    };
+    if (null != params.deployPercentage) reqBody.deployInfos = [
+        {
+            deployPercentage: params.deployPercentage
+        }
+    ];
+    if (params.reviewExemption) reqBody.skipReview = true;
+    const res = await fetch(`${CWS_V2_BASE}/${v2ItemName(params.publisherId, params.extensionId)}:publish`, {
         method: "POST",
         headers: {
             Authorization: `${params.token.token_type} ${params.token.access_token}`,
-            "x-goog-api-version": "2",
-            "Content-Length": "0"
-        }
+            "Content-Type": "application/json"
+        },
+        body: JSON.stringify(reqBody),
+        signal: AbortSignal.timeout(PUBLISH_TIMEOUT_MS)
     });
     if (!res.ok) {
         const text = await res.text().catch(()=>"");
@@ -253,7 +275,8 @@ async function publish(params) {
 async function publishChrome(options, dryRun) {
     await assertFilePresent(options.zip);
     const zipSize = await getFileSize(options.zip);
-    log("chrome", "Authenticating with Chrome Web Store");
+    const publisherId = requirePublisherId(options.publisherId, "submit");
+    log("chrome", "Authenticating with Chrome Web Store (API v2)");
     const token = await authenticate(options.clientId, options.clientSecret, options.refreshToken);
     const outcome = {
         storeUrl: chromeStoreUrl(options.extensionId),
@@ -266,21 +289,17 @@ async function publishChrome(options, dryRun) {
         });
         logDryStep("chrome", "Would upload ZIP", {
             file: options.zip,
-            size: formatBytes(zipSize),
-            target: `${CWS_UPLOAD_BASE}/${options.extensionId}`,
-            method: "PUT"
+            size: formatBytes(zipSize)
         });
         options.skipSubmitReview ? logDryStep("chrome", "Would skip publish (skipSubmitReview=true)") : logDryStep("chrome", "Would publish for review", {
-            target: `${CWS_PUBLISH_BASE}/${options.extensionId}/publish`,
-            publishTarget: options.publishTarget ?? "default",
             deployPercentage: options.deployPercentage,
             reviewExemption: options.reviewExemption
         });
-        log("chrome", "Dry run complete \u2014 no changes made");
+        log("chrome", "Dry run complete - no changes made");
         return outcome;
     }
     log("chrome", `Uploading ZIP file (${formatBytes(zipSize)})`);
-    await chrome_upload(options.extensionId, options.zip, token);
+    await chrome_upload(options.extensionId, publisherId, options.zip, token);
     if (options.skipSubmitReview) {
         log("chrome", "Skipping publish step (skipSubmitReview=true)");
         return outcome;
@@ -288,7 +307,7 @@ async function publishChrome(options, dryRun) {
     log("chrome", "Publishing extension");
     await publish({
         extensionId: options.extensionId,
-        publishTarget: options.publishTarget,
+        publisherId,
         token,
         deployPercentage: options.deployPercentage,
         reviewExemption: options.reviewExemption
@@ -296,14 +315,22 @@ async function publishChrome(options, dryRun) {
     return outcome;
 }
 async function getChromeItem(params) {
+    var _rev_distributionChannels_, _rev_distributionChannels;
     const token = await authenticate(params.clientId, params.clientSecret, params.refreshToken);
-    const url = `${CWS_ITEMS_BASE}/${encodeURIComponent(params.extensionId)}?projection=${params.projection ?? "DRAFT"}`;
-    return fetchJson(url, {
-        headers: {
-            Authorization: `${token.token_type} ${token.access_token}`,
-            "x-goog-api-version": "2"
-        }
+    const auth = {
+        Authorization: `${token.token_type} ${token.access_token}`
+    };
+    const pub = requirePublisherId(params.publisherId, "status");
+    const status = await fetchJson(`${CWS_V2_BASE}/${v2ItemName(pub, params.extensionId)}:fetchStatus`, {
+        headers: auth
     });
+    const rev = status.submittedItemRevisionStatus || status.publishedItemRevisionStatus;
+    return {
+        uploadState: status.lastAsyncUploadState,
+        crxVersion: null == rev ? void 0 : null == (_rev_distributionChannels = rev.distributionChannels) ? void 0 : null == (_rev_distributionChannels_ = _rev_distributionChannels[0]) ? void 0 : _rev_distributionChannels_.crxVersion,
+        publicKey: status.publicKey,
+        state: null == rev ? void 0 : rev.state
+    };
 }
 async function verifyChromeCredentials(params) {
     let token;
@@ -315,17 +342,18 @@ async function verifyChromeCredentials(params) {
             message: `OAuth token exchange failed. Verify your Client ID, Client Secret, and Refresh Token are correct.\n${err instanceof Error ? err.message : err}`
         };
     }
+    const auth = {
+        Authorization: `${token.token_type} ${token.access_token}`
+    };
     try {
-        const item = await fetchJson(`${CWS_ITEMS_BASE}/${encodeURIComponent(params.extensionId)}?projection=DRAFT`, {
-            headers: {
-                Authorization: `${token.token_type} ${token.access_token}`
-            }
+        const pub = requirePublisherId(params.publisherId, "verify");
+        const status = await fetchJson(`${CWS_V2_BASE}/${v2ItemName(pub, params.extensionId)}:fetchStatus`, {
+            headers: auth
         });
-        const title = (null == item ? void 0 : item.title) || params.extensionId;
+        const rev = status.submittedItemRevisionStatus || status.publishedItemRevisionStatus;
         return {
             ok: true,
-            message: `Credentials verified. You have access to "${title}".`,
-            extensionTitle: title
+            message: `Credentials verified (Chrome Web Store API v2). Item state: ${(null == rev ? void 0 : rev.state) || "unknown"}.`
         };
     } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -335,7 +363,7 @@ async function verifyChromeCredentials(params) {
         };
         if (msg.includes("403")) return {
             ok: false,
-            message: `Access denied to extension ${params.extensionId}. You may not be the owner or a developer on this item.`
+            message: "Access denied. Check the publisher ID matches this extension's account, and that the extension ID is correct."
         };
         return {
             ok: false,
@@ -349,12 +377,6 @@ function delay(ms) {
     });
 }
 const AMO_BASE = "https://addons.mozilla.org/api/v5/addons";
-const AMO_PROFILE_URL = "https://addons.mozilla.org/api/v5/accounts/profile/";
-const POLL_INTERVAL_MS = 5000;
-const VALIDATION_TIMEOUT_MS = 600000;
-function firefoxStoreUrl(addonIdOrSlug) {
-    return `https://addons.mozilla.org/firefox/addon/${addonIdOrSlug}`;
-}
 function signJwt(issuer, secret, expiresInSeconds = 30) {
     const header = {
         alg: "HS256",
@@ -439,6 +461,12 @@ async function createAddon(params) {
         headers: authHeaders(params.jwtIssuer, params.jwtSecret)
     });
 }
+const AMO_PROFILE_URL = "https://addons.mozilla.org/api/v5/accounts/profile/";
+const POLL_INTERVAL_MS = 5000;
+const VALIDATION_TIMEOUT_MS = 600000;
+function firefoxStoreUrl(addonIdOrSlug) {
+    return `https://addons.mozilla.org/firefox/addon/${addonIdOrSlug}`;
+}
 async function publishFirefox(options, dryRun) {
     await assertFilePresent(options.zip);
     const zipSize = await getFileSize(options.zip);
@@ -804,8 +832,134 @@ async function deploy(config) {
         success
     };
 }
+function usage() {
+    return `
+extension-deploy \u{2014} Deploy browser extensions to Chrome, Firefox, and Edge.
+
+USAGE
+  extension-deploy [options]                    submit to one or more stores
+  extension-deploy init [options]               interactive credential setup wizard
+  extension-deploy watch --chrome [options]     poll an in-flight submission
+  extension-deploy watch --firefox [options]
+  extension-deploy watch --edge [options]
+
+GLOBAL
+  --dry-run                 Verify auth without uploading or publishing
+  --output-json <path>      Write the DeployResult / WatchEvent as JSON to <path>
+  --help                    Show this help message
+
+CHROME
+  --chrome-zip <path>               Path to Chrome extension ZIP
+  --chrome-extension-id <id>        Chrome extension ID
+  --chrome-publisher-id <uuid>      Publisher UUID from the dev console (required)
+  --chrome-client-id <id>           OAuth2 client ID
+  --chrome-client-secret <secret>   OAuth2 client secret
+  --chrome-refresh-token <token>    OAuth2 refresh token
+  --chrome-deploy-percentage <n>    Staged rollout percentage (1-100)
+  --chrome-review-exemption         Request expedited review
+  --chrome-skip-submit-review       Upload only, skip publish
+
+FIREFOX
+  --firefox-zip <path>              Path to Firefox extension ZIP
+  --firefox-sources-zip <path>      Path to sources ZIP (optional)
+  --firefox-extension-id <id>       Addon GUID or email-style ID
+  --firefox-jwt-issuer <issuer>     AMO JWT issuer
+  --firefox-jwt-secret <secret>     AMO JWT secret
+  --firefox-channel <channel>       "listed" or "unlisted"
+
+EDGE
+  --edge-zip <path>                 Path to Edge extension ZIP
+  --edge-product-id <id>            Partner Center product ID
+  --edge-client-id <id>             Partner Center client ID
+  --edge-api-key <key>              Partner Center API key (v1.1)
+  --edge-skip-submit-review         Upload only, skip publish
+
+WATCH
+  --watch-submission-id <id>        Required for firefox/edge (version id / operation id)
+  --watch-interval <seconds>        Poll interval (default 60)
+  --watch-timeout <seconds>         Max time to wait for a terminal state (default 3600)
+
+INIT
+  --init-stores <list>              Comma-separated store list (skip picker)
+  --init-output <path>              Destination file (default .env.submit)
+  --init-skip-verify                Don't run verifyCredentials after collection
+  --init-force                      Overwrite existing .env.submit without asking
+
+ENVIRONMENT VARIABLES
+  All flags can be set via SCREAMING_SNAKE_CASE env vars (e.g. CHROME_ZIP,
+  FIREFOX_JWT_SECRET, EDGE_API_KEY). Flags take precedence over env vars.
+  A .env.submit file in the current directory is loaded automatically.
+`.trim();
+}
+const BOOLEAN_FLAGS = new Set([
+    "help",
+    "dryRun",
+    "chromeReviewExemption",
+    "chromeSkipSubmitReview",
+    "edgeSkipSubmitReview",
+    "initSkipVerify",
+    "initForce"
+]);
+const INT_FLAGS = new Set([
+    "chromeDeployPercentage",
+    "watchInterval",
+    "watchTimeout"
+]);
+function parseArgs(argv) {
+    const flags = {};
+    let i = 0;
+    if ("watch" === argv[0]) {
+        flags.command = "watch";
+        i = 1;
+    } else if ("init" === argv[0]) {
+        flags.command = "init";
+        i = 1;
+    }
+    while(i < argv.length){
+        const arg = argv[i];
+        if ("--help" === arg || "-h" === arg) {
+            flags.help = true;
+            i++;
+            continue;
+        }
+        if ("--chrome" === arg) {
+            flags.watchStore = "chrome";
+            i++;
+            continue;
+        }
+        if ("--firefox" === arg) {
+            flags.watchStore = "firefox";
+            i++;
+            continue;
+        }
+        if ("--edge" === arg) {
+            flags.watchStore = "edge";
+            i++;
+            continue;
+        }
+        if (!(null == arg ? void 0 : arg.startsWith("--"))) {
+            i++;
+            continue;
+        }
+        const key = arg.slice(2).replace(/-([a-z])/g, (_, c)=>c.toUpperCase());
+        if (BOOLEAN_FLAGS.has(key)) {
+            flags[key] = true;
+            i++;
+            continue;
+        }
+        const next = argv[i + 1];
+        if (null == next || next.startsWith("--")) {
+            flags[key] = true;
+            i++;
+            continue;
+        }
+        flags[key] = INT_FLAGS.has(key) ? parseInt(next, 10) : next;
+        i += 2;
+    }
+    return flags;
+}
 const DEFAULT_POLL_INTERVAL_MS = 60000;
-const DEFAULT_TIMEOUT_MS = 3600000;
+const watch_DEFAULT_TIMEOUT_MS = 3600000;
 function watch_now() {
     return new Date().toISOString();
 }
@@ -932,7 +1086,7 @@ function watchFirefoxSubmission(input, options = {}) {
 }
 async function runWatchLoop(_store, probe, options) {
     const pollInterval = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-    const timeout = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const timeout = options.timeoutMs ?? watch_DEFAULT_TIMEOUT_MS;
     const deadline = Date.now() + timeout;
     let lastEvent;
     while(true){
@@ -944,47 +1098,174 @@ async function runWatchLoop(_store, probe, options) {
         await delay(pollInterval);
     }
 }
-const STORE_CHOICES = [
-    {
-        value: "chrome",
-        label: "Chrome Web Store"
-    },
-    {
-        value: "firefox",
-        label: "Firefox AMO (addons.mozilla.org)"
-    },
-    {
-        value: "edge",
-        label: "Edge Add-ons (Partner Center)"
+async function requireValue(io, label, hint, opts) {
+    const question = hint ? `${label} ${hint}:` : `${label}:`;
+    for(let attempt = 0; attempt < 3; attempt++){
+        const answer = (await io.prompt(question, opts)).trim();
+        if (answer) return answer;
+        io.log(`  ${label} is required.`);
     }
-];
+    throw new Error(`init: ${label} is required.`);
+}
 const CHROME_OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";
 const CHROME_OAUTH_AUTH_URL = "https://accounts.google.com/o/oauth2/auth";
 const CHROME_OOB_REDIRECT = "urn:ietf:wg:oauth:2.0:oob";
 const CHROME_SCOPE = "https://www.googleapis.com/auth/chromewebstore";
-async function runInit(deps, options = {}) {
+async function collectChromeCredentials(deps) {
     const { io } = deps;
+    io.log("Chrome Web Store needs OAuth credentials. You'll need:");
+    io.log("  1. A Google Cloud project with the Chrome Web Store API enabled:");
+    io.log("     https://console.cloud.google.com/apis/library/chromewebstore.googleapis.com");
+    io.log("  2. OAuth 2.0 credentials (application type: Desktop app):");
+    io.log("     https://console.cloud.google.com/apis/credentials");
+    io.log("  3. Your extension ID from the Chrome Web Store Developer Dashboard.");
+    io.log("  4. Your publisher ID (the UUID in your dev console URL: chrome.google.com/webstore/devconsole/<UUID>).");
     io.log("");
-    io.log(`${colors.green("\u23F5\u23F5\u23F5")} ${colors.blue("init")} ${colors.underline("extension-deploy \u2014 set up store credentials")}`);
+    io.log("This wizard will take your Client ID + Secret and walk you through");
+    io.log("generating a refresh token automatically.");
     io.log("");
-    io.log("This wizard walks you through creating credentials for each store and");
-    io.log("writes them to a .env.submit file. Press Ctrl+C at any time to abort.");
+    const extensionId = await requireValue(io, "Chrome extension ID", "(32-character ID from the CWS dashboard URL)");
+    const publisherId = await requireValue(io, "Chrome publisher ID", "(UUID from your dev console URL)");
+    const clientId = await requireValue(io, "OAuth Client ID");
+    const clientSecret = await requireValue(io, "OAuth Client Secret", void 0, {
+        secret: true
+    });
+    const refreshToken = await obtainChromeRefreshToken(deps, clientId, clientSecret);
+    return {
+        extensionId,
+        publisherId,
+        clientId,
+        clientSecret,
+        refreshToken
+    };
+}
+function buildChromeAuthUrl(clientId) {
+    const params = new URLSearchParams({
+        response_type: "code",
+        client_id: clientId,
+        redirect_uri: CHROME_OOB_REDIRECT,
+        scope: CHROME_SCOPE,
+        access_type: "offline",
+        prompt: "consent"
+    });
+    return `${CHROME_OAUTH_AUTH_URL}?${params.toString()}`;
+}
+async function exchangeChromeAuthCode(input) {
+    const fetchFn = input.fetchImpl ?? fetch;
+    const body = new URLSearchParams({
+        code: input.authCode,
+        client_id: input.clientId,
+        client_secret: input.clientSecret,
+        redirect_uri: CHROME_OOB_REDIRECT,
+        grant_type: "authorization_code"
+    });
+    const res = await fetchFn(CHROME_OAUTH_TOKEN_URL, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: body.toString()
+    });
+    if (!res.ok) {
+        const text = await res.text().catch(()=>"");
+        throw new Error(`Chrome token exchange failed (HTTP ${res.status}): ${text || res.statusText}`);
+    }
+    const json = await res.json();
+    if (!json.refresh_token) throw new Error(`Chrome token exchange returned no refresh_token${json.error ? `: ${json.error} \u{2014} ${json.error_description ?? ""}` : ""}. This usually means the authorization code was already used or expired; try the init wizard again.`);
+    return json.refresh_token;
+}
+async function obtainChromeRefreshToken(deps, clientId, clientSecret) {
+    const { io } = deps;
+    const authUrl = buildChromeAuthUrl(clientId);
     io.log("");
-    const stores = options.stores ? options.stores : await io.multiselect("Which stores do you want to configure?", STORE_CHOICES);
-    if (0 === stores.length) throw new Error("init: at least one store must be selected. Use --init-stores chrome,firefox,edge or make a selection.");
-    const envLines = [
-        "# Generated by `extension-deploy init`.",
-        "# Do not commit secrets to source control.",
-        ""
-    ];
-    const verified = {};
-    for (const store of stores){
-        io.log("");
+    io.log("Open the URL below in your browser, approve the scope, and paste the");
+    io.log("authorization code shown on the page:");
+    io.log("");
+    io.log(`  ${authUrl}`);
+    io.log("");
+    const authCode = await requireValue(io, "Authorization code", void 0, {
+        secret: true
+    });
+    return exchangeChromeAuthCode({
+        clientId,
+        clientSecret,
+        authCode,
+        fetchImpl: deps.fetchImpl
+    });
+}
+async function collectFirefoxCredentials(deps) {
+    const { io } = deps;
+    io.log("Firefox AMO needs JWT API credentials:");
+    io.log("  1. Sign in at https://addons.mozilla.org");
+    io.log("  2. Create API credentials at https://addons.mozilla.org/developers/addon/api/key/");
+    io.log("  3. Copy the JWT issuer and JWT secret (the secret is only shown once).");
+    io.log("");
+    const addonId = await requireValue(io, "Firefox addon ID", "({uuid} GUID or email-style ID from your addon page)");
+    const jwtIssuer = await requireValue(io, "JWT issuer");
+    const jwtSecret = await requireValue(io, "JWT secret", void 0, {
+        secret: true
+    });
+    return {
+        addonId,
+        jwtIssuer,
+        jwtSecret
+    };
+}
+async function collectEdgeCredentials(deps) {
+    const { io } = deps;
+    io.log("Edge Partner Center needs the v1.1 API credentials:");
+    io.log("  1. Open the Partner Center dashboard: https://partner.microsoft.com/dashboard/microsoftedge/overview");
+    io.log("  2. Under your extension, go to Settings \u2192 API access \u2192 API v1.1 and generate credentials.");
+    io.log("  3. Copy the Client ID, API key, and Product ID.");
+    io.log("");
+    const productId = await requireValue(io, "Edge product ID");
+    const clientId = await requireValue(io, "Edge client ID");
+    const apiKey = await requireValue(io, "Edge API key", void 0, {
+        secret: true
+    });
+    return {
+        productId,
+        clientId,
+        apiKey
+    };
+}
+const STORE_CHOICES = [
+    {
+        value: "chrome",
+        label: "Chrome Web Store"
+    },
+    {
+        value: "firefox",
+        label: "Firefox AMO (addons.mozilla.org)"
+    },
+    {
+        value: "edge",
+        label: "Edge Add-ons (Partner Center)"
+    }
+];
+async function runInit(deps, options = {}) {
+    const { io } = deps;
+    io.log("");
+    io.log(`${colors.green("\u23F5\u23F5\u23F5")} ${colors.blue("init")} ${colors.underline("extension-deploy \u2014 set up store credentials")}`);
+    io.log("");
+    io.log("This wizard walks you through creating credentials for each store and");
+    io.log("writes them to a .env.submit file. Press Ctrl+C at any time to abort.");
+    io.log("");
+    const stores = options.stores ? options.stores : await io.multiselect("Which stores do you want to configure?", STORE_CHOICES);
+    if (0 === stores.length) throw new Error("init: at least one store must be selected. Use --init-stores chrome,firefox,edge or make a selection.");
+    const envLines = [
+        "# Generated by `extension-deploy init`.",
+        "# Do not commit secrets to source control.",
+        ""
+    ];
+    const verified = {};
+    for (const store of stores){
+        io.log("");
         io.log(colors.underline(colors.blue(labelFor(store))));
         io.log("");
         if ("chrome" === store) {
             const creds = await collectChromeCredentials(deps);
-            envLines.push(`CHROME_EXTENSION_ID=${creds.extensionId}`, `CHROME_CLIENT_ID=${creds.clientId}`, `CHROME_CLIENT_SECRET=${creds.clientSecret}`, `CHROME_REFRESH_TOKEN=${creds.refreshToken}`, "");
+            envLines.push(`CHROME_EXTENSION_ID=${creds.extensionId}`, `CHROME_PUBLISHER_ID=${creds.publisherId}`, `CHROME_CLIENT_ID=${creds.clientId}`, `CHROME_CLIENT_SECRET=${creds.clientSecret}`, `CHROME_REFRESH_TOKEN=${creds.refreshToken}`, "");
             if (!options.skipVerify) {
                 const verify = deps.verifyChrome ?? verifyChromeCredentials;
                 verified.chrome = normalizeVerify(await verify(creds));
@@ -1052,121 +1333,6 @@ async function runInit(deps, options = {}) {
         wrote
     };
 }
-async function collectChromeCredentials(deps) {
-    const { io } = deps;
-    io.log("Chrome Web Store needs OAuth credentials. You'll need:");
-    io.log("  1. A Google Cloud project with the Chrome Web Store API enabled:");
-    io.log("     https://console.cloud.google.com/apis/library/chromewebstore.googleapis.com");
-    io.log("  2. OAuth 2.0 credentials (application type: Desktop app):");
-    io.log("     https://console.cloud.google.com/apis/credentials");
-    io.log("  3. Your extension ID from the Chrome Web Store Developer Dashboard.");
-    io.log("");
-    io.log("This wizard will take your Client ID + Secret and walk you through");
-    io.log("generating a refresh token automatically.");
-    io.log("");
-    const extensionId = await requireValue(io, "Chrome extension ID", "(32-character ID from the CWS dashboard URL)");
-    const clientId = await requireValue(io, "OAuth Client ID");
-    const clientSecret = await requireValue(io, "OAuth Client Secret", void 0, {
-        secret: true
-    });
-    const refreshToken = await obtainChromeRefreshToken(deps, clientId, clientSecret);
-    return {
-        extensionId,
-        clientId,
-        clientSecret,
-        refreshToken
-    };
-}
-function buildChromeAuthUrl(clientId) {
-    const params = new URLSearchParams({
-        response_type: "code",
-        client_id: clientId,
-        redirect_uri: CHROME_OOB_REDIRECT,
-        scope: CHROME_SCOPE,
-        access_type: "offline",
-        prompt: "consent"
-    });
-    return `${CHROME_OAUTH_AUTH_URL}?${params.toString()}`;
-}
-async function exchangeChromeAuthCode(input) {
-    const fetchFn = input.fetchImpl ?? fetch;
-    const body = new URLSearchParams({
-        code: input.authCode,
-        client_id: input.clientId,
-        client_secret: input.clientSecret,
-        redirect_uri: CHROME_OOB_REDIRECT,
-        grant_type: "authorization_code"
-    });
-    const res = await fetchFn(CHROME_OAUTH_TOKEN_URL, {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/x-www-form-urlencoded"
-        },
-        body: body.toString()
-    });
-    if (!res.ok) {
-        const text = await res.text().catch(()=>"");
-        throw new Error(`Chrome token exchange failed (HTTP ${res.status}): ${text || res.statusText}`);
-    }
-    const json = await res.json();
-    if (!json.refresh_token) throw new Error(`Chrome token exchange returned no refresh_token${json.error ? `: ${json.error} \u{2014} ${json.error_description ?? ""}` : ""}. This usually means the authorization code was already used or expired; try the init wizard again.`);
-    return json.refresh_token;
-}
-async function obtainChromeRefreshToken(deps, clientId, clientSecret) {
-    const { io } = deps;
-    const authUrl = buildChromeAuthUrl(clientId);
-    io.log("");
-    io.log("Open the URL below in your browser, approve the scope, and paste the");
-    io.log("authorization code shown on the page:");
-    io.log("");
-    io.log(`  ${authUrl}`);
-    io.log("");
-    const authCode = await requireValue(io, "Authorization code", void 0, {
-        secret: true
-    });
-    return exchangeChromeAuthCode({
-        clientId,
-        clientSecret,
-        authCode,
-        fetchImpl: deps.fetchImpl
-    });
-}
-async function collectFirefoxCredentials(deps) {
-    const { io } = deps;
-    io.log("Firefox AMO needs JWT API credentials:");
-    io.log("  1. Sign in at https://addons.mozilla.org");
-    io.log("  2. Create API credentials at https://addons.mozilla.org/developers/addon/api/key/");
-    io.log("  3. Copy the JWT issuer and JWT secret (the secret is only shown once).");
-    io.log("");
-    const addonId = await requireValue(io, "Firefox addon ID", "({uuid} GUID or email-style ID from your addon page)");
-    const jwtIssuer = await requireValue(io, "JWT issuer");
-    const jwtSecret = await requireValue(io, "JWT secret", void 0, {
-        secret: true
-    });
-    return {
-        addonId,
-        jwtIssuer,
-        jwtSecret
-    };
-}
-async function collectEdgeCredentials(deps) {
-    const { io } = deps;
-    io.log("Edge Partner Center needs the v1.1 API credentials:");
-    io.log("  1. Open the Partner Center dashboard: https://partner.microsoft.com/dashboard/microsoftedge/overview");
-    io.log("  2. Under your extension, go to Settings \u2192 API access \u2192 API v1.1 and generate credentials.");
-    io.log("  3. Copy the Client ID, API key, and Product ID.");
-    io.log("");
-    const productId = await requireValue(io, "Edge product ID");
-    const clientId = await requireValue(io, "Edge client ID");
-    const apiKey = await requireValue(io, "Edge API key", void 0, {
-        secret: true
-    });
-    return {
-        productId,
-        clientId,
-        apiKey
-    };
-}
 function labelFor(store) {
     var _STORE_CHOICES_find;
     return (null == (_STORE_CHOICES_find = STORE_CHOICES.find((c)=>c.value === store)) ? void 0 : _STORE_CHOICES_find.label) ?? String(store);
@@ -1185,15 +1351,6 @@ function resolveEnvPath(cwd, outputPath) {
     const target = outputPath ?? ".env.submit";
     return external_node_path_default.isAbsolute(target) ? target : external_node_path_default.join(cwd, target);
 }
-async function requireValue(io, label, hint, opts) {
-    const question = hint ? `${label} ${hint}:` : `${label}:`;
-    for(let attempt = 0; attempt < 3; attempt++){
-        const answer = (await io.prompt(question, opts)).trim();
-        if (answer) return answer;
-        io.log(`  ${label} is required.`);
-    }
-    throw new Error(`init: ${label} is required.`);
-}
 function createStdinIO() {
     const rl = external_node_readline_default.createInterface({
         input: process.stdin,
@@ -1247,7 +1404,13 @@ function createStdinIO() {
 }
 const stdinFs = {
     async writeFile (filePath, content) {
-        await promises_default.writeFile(filePath, content, "utf-8");
+        await promises_default.writeFile(filePath, content, {
+            encoding: "utf-8",
+            mode: 384
+        });
+        try {
+            await promises_default.chmod(filePath, 384);
+        } catch  {}
     },
     async fileExists (filePath) {
         try {
@@ -1258,173 +1421,12 @@ const stdinFs = {
         }
     }
 };
-function usage() {
-    return `
-extension-deploy \u{2014} Deploy browser extensions to Chrome, Firefox, and Edge.
-
-USAGE
-  extension-deploy [options]                    submit to one or more stores
-  extension-deploy init [options]               interactive credential setup wizard
-  extension-deploy watch --chrome [options]     poll an in-flight submission
-  extension-deploy watch --firefox [options]
-  extension-deploy watch --edge [options]
-
-GLOBAL
-  --dry-run                 Verify auth without uploading or publishing
-  --output-json <path>      Write the DeployResult / WatchEvent as JSON to <path>
-  --help                    Show this help message
-
-CHROME
-  --chrome-zip <path>               Path to Chrome extension ZIP
-  --chrome-extension-id <id>        Chrome extension ID
-  --chrome-client-id <id>           OAuth2 client ID
-  --chrome-client-secret <secret>   OAuth2 client secret
-  --chrome-refresh-token <token>    OAuth2 refresh token
-  --chrome-publish-target <target>  "default" or "trustedTesters"
-  --chrome-deploy-percentage <n>    Staged rollout percentage (1-100)
-  --chrome-review-exemption         Request expedited review
-  --chrome-skip-submit-review       Upload only, skip publish
-
-FIREFOX
-  --firefox-zip <path>              Path to Firefox extension ZIP
-  --firefox-sources-zip <path>      Path to sources ZIP (optional)
-  --firefox-extension-id <id>       Addon GUID or email-style ID
-  --firefox-jwt-issuer <issuer>     AMO JWT issuer
-  --firefox-jwt-secret <secret>     AMO JWT secret
-  --firefox-channel <channel>       "listed" or "unlisted"
-
-EDGE
-  --edge-zip <path>                 Path to Edge extension ZIP
-  --edge-product-id <id>            Partner Center product ID
-  --edge-client-id <id>             Partner Center client ID
-  --edge-api-key <key>              Partner Center API key (v1.1)
-  --edge-skip-submit-review         Upload only, skip publish
-
-WATCH
-  --watch-submission-id <id>        Required for firefox/edge (version id / operation id)
-  --watch-interval <seconds>        Poll interval (default 60)
-  --watch-timeout <seconds>         Max time to wait for a terminal state (default 3600)
-
-INIT
-  --init-stores <list>              Comma-separated store list (skip picker)
-  --init-output <path>              Destination file (default .env.submit)
-  --init-skip-verify                Don't run verifyCredentials after collection
-  --init-force                      Overwrite existing .env.submit without asking
-
-ENVIRONMENT VARIABLES
-  All flags can be set via SCREAMING_SNAKE_CASE env vars (e.g. CHROME_ZIP,
-  FIREFOX_JWT_SECRET, EDGE_API_KEY). Flags take precedence over env vars.
-  A .env.submit file in the current directory is loaded automatically.
-`.trim();
-}
-const BOOLEAN_FLAGS = new Set([
-    "help",
-    "dryRun",
-    "chromeReviewExemption",
-    "chromeSkipSubmitReview",
-    "edgeSkipSubmitReview",
-    "initSkipVerify",
-    "initForce"
-]);
-const INT_FLAGS = new Set([
-    "chromeDeployPercentage",
-    "watchInterval",
-    "watchTimeout"
-]);
-function parseArgs(argv) {
-    const flags = {};
-    let i = 0;
-    if ("watch" === argv[0]) {
-        flags.command = "watch";
-        i = 1;
-    } else if ("init" === argv[0]) {
-        flags.command = "init";
-        i = 1;
-    }
-    while(i < argv.length){
-        const arg = argv[i];
-        if ("--help" === arg || "-h" === arg) {
-            flags.help = true;
-            i++;
-            continue;
-        }
-        if ("--chrome" === arg) {
-            flags.watchStore = "chrome";
-            i++;
-            continue;
-        }
-        if ("--firefox" === arg) {
-            flags.watchStore = "firefox";
-            i++;
-            continue;
-        }
-        if ("--edge" === arg) {
-            flags.watchStore = "edge";
-            i++;
-            continue;
-        }
-        if (!(null == arg ? void 0 : arg.startsWith("--"))) {
-            i++;
-            continue;
-        }
-        const key = arg.slice(2).replace(/-([a-z])/g, (_, c)=>c.toUpperCase());
-        if (BOOLEAN_FLAGS.has(key)) {
-            flags[key] = true;
-            i++;
-            continue;
-        }
-        const next = argv[i + 1];
-        if (null == next || next.startsWith("--")) {
-            flags[key] = true;
-            i++;
-            continue;
-        }
-        flags[key] = INT_FLAGS.has(key) ? parseInt(next, 10) : next;
-        i += 2;
-    }
-    return flags;
-}
-function loadDotEnv() {
-    try {
-        const envPath = external_node_path_default.resolve(process.cwd(), ".env.submit");
-        const content = external_node_fs_default.readFileSync(envPath, "utf-8");
-        for (const line of content.split("\n")){
-            const trimmed = line.trim();
-            if (!trimmed || trimmed.startsWith("#")) continue;
-            const eqIdx = trimmed.indexOf("=");
-            if (-1 === eqIdx) continue;
-            const key = trimmed.slice(0, eqIdx).trim();
-            let value = trimmed.slice(eqIdx + 1).trim();
-            if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
-            if (!(key in process.env)) process.env[key] = value;
-        }
-    } catch  {}
-}
 function writeJsonOutput(filePath, payload) {
     external_node_fs_default.mkdirSync(external_node_path_default.dirname(external_node_path_default.resolve(filePath)), {
         recursive: true
     });
     external_node_fs_default.writeFileSync(filePath, JSON.stringify(payload, null, 2) + "\n", "utf-8");
 }
-async function main() {
-    loadDotEnv();
-    const flags = parseArgs(process.argv.slice(2));
-    if (flags.help) {
-        console.log(usage());
-        process.exit(0);
-    }
-    if ("watch" === flags.command) return void await runWatch(flags);
-    if ("init" === flags.command) return void await runInitCommand(flags);
-    const config = resolveConfig(flags);
-    try {
-        const result = await deploy(config);
-        if (flags.outputJson) writeJsonOutput(flags.outputJson, result);
-        if (!result.success) process.exit(1);
-    } catch (err) {
-        logError("deploy", err instanceof Error ? err.message : String(err));
-        process.exit(1);
-    }
-}
 async function runWatch(flags) {
     const store = flags.watchStore;
     if (!store) {
@@ -1447,7 +1449,8 @@ async function runWatch(flags) {
             clientId: mustEnv("CHROME_CLIENT_ID", flags.chromeClientId),
             clientSecret: mustEnv("CHROME_CLIENT_SECRET", flags.chromeClientSecret),
             refreshToken: mustEnv("CHROME_REFRESH_TOKEN", flags.chromeRefreshToken),
-            extensionId: mustEnv("CHROME_EXTENSION_ID", flags.chromeExtensionId)
+            extensionId: mustEnv("CHROME_EXTENSION_ID", flags.chromeExtensionId),
+            publisherId: mustEnv("CHROME_PUBLISHER_ID", flags.chromePublisherId)
         }, {
             pollIntervalMs,
             timeoutMs,
@@ -1520,4 +1523,39 @@ function parseInitStores(raw) {
     if (0 === parsed.length) throw new Error(`--init-stores: expected a comma-separated list of chrome,firefox,edge (got "${raw}")`);
     return parsed;
 }
+function loadDotEnv() {
+    try {
+        const envPath = external_node_path_default.resolve(process.cwd(), ".env.submit");
+        const content = external_node_fs_default.readFileSync(envPath, "utf-8");
+        for (const line of content.split("\n")){
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith("#")) continue;
+            const eqIdx = trimmed.indexOf("=");
+            if (-1 === eqIdx) continue;
+            const key = trimmed.slice(0, eqIdx).trim();
+            let value = trimmed.slice(eqIdx + 1).trim();
+            if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
+            if (!(key in process.env)) process.env[key] = value;
+        }
+    } catch  {}
+}
+async function main() {
+    loadDotEnv();
+    const flags = parseArgs(process.argv.slice(2));
+    if (flags.help) {
+        console.log(usage());
+        process.exit(0);
+    }
+    if ("watch" === flags.command) return void await runWatch(flags);
+    if ("init" === flags.command) return void await runInitCommand(flags);
+    const config = resolveConfig(flags);
+    try {
+        const result = await deploy(config);
+        if (flags.outputJson) writeJsonOutput(flags.outputJson, result);
+        if (!result.success) process.exit(1);
+    } catch (err) {
+        logError("deploy", err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
 export { chromeOptionsSchema, deploy, deployConfigSchema, edgeOptionsSchema, firefoxOptionsSchema, getChromeSubmissionEvent, getEdgeSubmissionEvent, getFirefoxSubmissionEvent, main, resolveConfig, validateConfig, verifyChromeCredentials, verifyEdgeCredentials, verifyFirefoxCredentials, watchChromeSubmission, watchEdgeSubmission, watchFirefoxSubmission };