@privos_ai/app-server 0.8.3 → 0.9.0

package/README.md

@@ -467,12 +467,50 @@ owner, or invalid content) with a specific reason instead of degrading silently.
 
 ```bash
 npx privos-app-lint ./privos-app.json
+# equivalent to:
+npx privos-app lint ./privos-app.json
 ```
 
 The command rejects mixed legacy/v2 permission declarations and prints deterministic
 `canonicalManifestHash` and `publisherPermissionDeclarationHash` values. The latter covers the
 publisher declaration only; Hub/Portal compute the authoritative permission contract hash with
-the versioned server-owned catalog and immutable image digest.
+the versioned server-owned catalog and immutable image digest. `privos-app-lint` is kept as a
+compatibility alias for `privos-app lint` — same output, same exit code.
+
+## CLI: `privos-app publish`
+
+Run from inside the app folder (where `privos-app.json` and `package.json` live):
+
+```bash
+npx privos-app publish
+```
+
+This packages the git worktree into a source archive (`git archive`, with the same
+dirty-tree refusal, credential-file scan, and entry-policy checks as
+`scripts/package-source.sh`), authorizes with the Portal, uploads the archive, creates
+the version, and submits it for review — in one command, no hand-minted session.
+
+Two authorization modes, both ending in a scoped, short-lived Portal grant (never a
+browser session):
+
+- **Browser approval (default).** The CLI prints a URL and a user code; approve on
+  `client.privos.io` and the CLI proceeds automatically once approved.
+- **Publisher token (CI).** Set `PRIVOS_PUBLISHER_TOKEN` (or pass `--token-stdin`) to
+  skip the browser step — only works once the listing's first version was approved
+  interactively (`409 LISTING_NOT_BOUND` otherwise).
+
+Useful flags: `--listing <slug>`, `--changelog <text>` / `--changelog-file <path>`,
+`--allow-dirty`, `--dry-run` (package only, prints the git revision + archive sha256),
+`--yes` (skip the confirmation prompt), `--portal <origin>`, `--machine-label <text>`,
+`--open` (open the approval URL), `--json` (one NDJSON event per step), `--cwd <path>`.
+
+Exit codes: `0` submitted, `2` blocked by policy (lint/package/semver/preflight
+failed/unbound listing), `3` authorization denied/expired, `4` network/portal error,
+`5` usage. The CLI's own manifest lint is structure-only — its
+`canonicalManifestHash` is **not** the Portal's canonical digest and is never sent;
+the Portal returns the authoritative `manifestDigest` after upload. Secrets are never
+printed in full: publisher tokens are shown masked to a prefix, and the publish grant
+value is never printed.
 
 ## Scripts
 

package/dist/cli/commands/lint.d.ts

@@ -0,0 +1,8 @@
+/**
+ * `privos-app lint [manifestPath]` — identical behavior to the original
+ * `privos-app-lint` binary (byte-identical stdout/stderr and exit code).
+ * `src/manifest-lint-cli.ts` delegates here so the compatibility alias never
+ * drifts from this implementation.
+ */
+export declare function runLint(argv: readonly string[]): number;
+//# sourceMappingURL=lint.d.ts.map

package/dist/cli/commands/lint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/lint.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAavD"}

package/dist/cli/commands/lint.js

@@ -0,0 +1,24 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { lintManifest } from '../../manifest-tools.js';
+/**
+ * `privos-app lint [manifestPath]` — identical behavior to the original
+ * `privos-app-lint` binary (byte-identical stdout/stderr and exit code).
+ * `src/manifest-lint-cli.ts` delegates here so the compatibility alias never
+ * drifts from this implementation.
+ */
+export function runLint(argv) {
+    const manifestPath = path.resolve(argv[0] || 'privos-app.json');
+    let manifest;
+    try {
+        manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    }
+    catch {
+        console.error(JSON.stringify({ valid: false, errors: [`Unable to read valid JSON from ${manifestPath}`] }, null, 2));
+        return 1;
+    }
+    const result = lintManifest(manifest);
+    console.log(JSON.stringify({ manifestPath, ...result }, null, 2));
+    return result.valid ? 0 : 1;
+}
+//# sourceMappingURL=lint.js.map

package/dist/cli/commands/lint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint.js","sourceRoot":"","sources":["../../../src/cli/commands/lint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,IAAuB;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC;IAChE,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,kCAAkC,YAAY,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACrH,OAAO,CAAC,CAAC;IACV,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC"}

package/dist/cli/commands/publish.d.ts

@@ -0,0 +1,20 @@
+export type PublishRuntimeOptions = Readonly<{
+    env?: NodeJS.ProcessEnv;
+    cwd?: string;
+    fetchImpl?: typeof fetch;
+    sleepImpl?: (ms: number) => Promise<void>;
+    openBrowser?: (url: string) => void;
+    readTokenFromStdin?: () => Promise<string>;
+    confirm?: (question: string) => Promise<boolean>;
+    isTTY?: boolean;
+    cliVersion?: string;
+}>;
+/**
+ * `privos-app publish` — package → lint (structure only) → authorize
+ * (browser device flow or `PRIVOS_PUBLISHER_TOKEN`) → upload → version →
+ * submit. See phase-04 requirements for the exact sequencing and exit codes
+ * (0 submitted, 2 blocked by policy, 3 authorization denied/expired, 4
+ * network/portal error, 5 usage).
+ */
+export declare function runPublish(argv: readonly string[], runtime?: PublishRuntimeOptions): Promise<number>;
+//# sourceMappingURL=publish.d.ts.map

package/dist/cli/commands/publish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/publish.ts"],"names":[],"mappings":"AAuBA,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC,CAAC;AAUH;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAiL9G"}

package/dist/cli/commands/publish.js

@@ -0,0 +1,365 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import readline from 'node:readline/promises';
+import { parseArgs } from 'node:util';
+import { spawn } from 'node:child_process';
+import { loadManifest, loadPackageJson, assertIdentityAgreement, structuralLint, ManifestLoadError } from '../lib/manifest.js';
+import { packageSource, PackagePolicyError } from '../lib/package-source.js';
+import { PortalClient, PortalError } from '../lib/portal-client.js';
+import { createAuthorization, waitForApproval } from '../lib/authorize.js';
+import { createUploadSession, uploadPartsSequentially, completeUpload, createVersion, submitVersion, waitForPreflight, DEFAULT_PART_SIZE_BYTES, } from '../lib/upload.js';
+import { Reporter, maskSecret } from '../lib/output.js';
+const DEFAULT_PORTAL_ORIGIN = 'https://portal.privos.io';
+/** Internal control-flow error carrying the CLI exit code to return. */
+class CliExitError extends Error {
+    exitCode;
+    code;
+    constructor(message, exitCode, code) {
+        super(message);
+        this.exitCode = exitCode;
+        this.code = code;
+        this.name = 'CliExitError';
+    }
+}
+/**
+ * `privos-app publish` — package → lint (structure only) → authorize
+ * (browser device flow or `PRIVOS_PUBLISHER_TOKEN`) → upload → version →
+ * submit. See phase-04 requirements for the exact sequencing and exit codes
+ * (0 submitted, 2 blocked by policy, 3 authorization denied/expired, 4
+ * network/portal error, 5 usage).
+ */
+export async function runPublish(argv, runtime = {}) {
+    const env = runtime.env ?? process.env;
+    let values;
+    try {
+        ({ values } = parseArgs({
+            args: argv,
+            options: {
+                listing: { type: 'string' },
+                changelog: { type: 'string' },
+                'changelog-file': { type: 'string' },
+                'allow-dirty': { type: 'boolean', default: false },
+                'dry-run': { type: 'boolean', default: false },
+                yes: { type: 'boolean', default: false },
+                portal: { type: 'string' },
+                'machine-label': { type: 'string' },
+                open: { type: 'boolean', default: false },
+                json: { type: 'boolean', default: false },
+                cwd: { type: 'string' },
+                'token-stdin': { type: 'boolean', default: false },
+                help: { type: 'boolean', default: false, short: 'h' },
+            },
+            allowPositionals: false,
+        }));
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        return 5;
+    }
+    if (values.help) {
+        printPublishUsage();
+        return 0;
+    }
+    const jsonMode = Boolean(values.json);
+    const reporter = new Reporter(jsonMode);
+    const cwd = path.resolve(runtime.cwd ?? (typeof values.cwd === 'string' ? values.cwd : process.cwd()));
+    try {
+        // Step 1: locate + validate manifest identity (structure only — never send this hash to the Portal).
+        const { manifestPath, manifest } = loadManifest(cwd);
+        const { pkg } = loadPackageJson(cwd);
+        const lintResult = structuralLint(manifest);
+        if (!lintResult.valid) {
+            reporter.emit({ event: 'lint', ok: false, manifestPath });
+            throw new CliExitError(`Manifest is invalid:\n- ${lintResult.errors.join('\n- ')}`, 2, 'MANIFEST_INVALID');
+        }
+        const identityErrors = assertIdentityAgreement(manifest, pkg);
+        if (identityErrors.length > 0) {
+            reporter.emit({ event: 'lint', ok: false, manifestPath });
+            throw new CliExitError(identityErrors.join('\n'), 2, 'MANIFEST_IDENTITY_MISMATCH');
+        }
+        reporter.emit({ event: 'lint', ok: true, manifestPath });
+        const name = String(manifest.name);
+        const version = String(manifest.version);
+        // Step 2: package (refuse dirty tree unless --allow-dirty; entry policy enforced inside).
+        const packaged = packageOrThrow(cwd, name, version, Boolean(values['allow-dirty']));
+        reporter.emit({
+            event: 'package',
+            archivePath: packaged.archivePath,
+            bytes: packaged.bytes,
+            sha256: packaged.sha256,
+            entryCount: packaged.entries.length,
+        });
+        if (values['dry-run']) {
+            reporter.emit({ event: 'status', state: 'DRY_RUN', message: `git ${packaged.gitRevision} · sha256:${packaged.sha256}` });
+            return 0;
+        }
+        // Step 3: resolve config + credentials.
+        const changelog = resolveChangelog(values, cwd);
+        const portalOrigin = typeof values.portal === 'string' ? values.portal : env.PRIVOS_PORTAL_ORIGIN || DEFAULT_PORTAL_ORIGIN;
+        const cliVersion = runtime.cliVersion ?? getOwnPackageVersion();
+        const token = values['token-stdin']
+            ? (await (runtime.readTokenFromStdin ?? readTokenFromStdin)()).trim()
+            : env.PRIVOS_PUBLISHER_TOKEN || undefined;
+        if (token)
+            reporter.emit({ event: 'authorization_token', maskedToken: maskSecret(token) });
+        if (!values.yes && !jsonMode && (runtime.isTTY ?? Boolean(process.stdin.isTTY))) {
+            const confirm = runtime.confirm ?? defaultConfirm;
+            const proceed = await confirm(`Publish ${name}@${version} (sha256:${packaged.sha256.slice(0, 12)}…)? [y/N] `);
+            if (!proceed)
+                throw new CliExitError('Publish cancelled.', 5, 'CANCELLED');
+        }
+        const client = new PortalClient({ origin: portalOrigin, fetchImpl: runtime.fetchImpl, sleepImpl: runtime.sleepImpl });
+        // Step 4: authorize — browser device flow (default) or publisher-token auto-approve (CI).
+        const { grant, listing } = await authorize(client, runtime, reporter, token, {
+            manifestName: name,
+            semver: version,
+            archiveSha256: packaged.sha256,
+            archiveBytes: packaged.bytes,
+            cliVersion,
+            listingSlug: typeof values.listing === 'string' ? values.listing : undefined,
+            machineLabel: typeof values['machine-label'] === 'string' ? values['machine-label'] : undefined,
+            open: Boolean(values.open),
+        });
+        reporter.emit({ event: 'authorization_approved', listingId: listing.id, listingSlug: listing.slug });
+        // Step 5: upload sequentially under the grant.
+        const archiveBuffer = fs.readFileSync(packaged.archivePath);
+        let uploadId;
+        try {
+            ({ uploadId } = await createUploadSession(client, grant.value, listing.id, {
+                fileName: path.basename(packaged.archivePath),
+                totalBytes: archiveBuffer.length,
+                paths: packaged.filePaths,
+            }));
+            await uploadPartsSequentially(client, grant.value, uploadId, archiveBuffer, DEFAULT_PART_SIZE_BYTES, (part, totalParts) => reporter.emit({ event: 'upload_progress', part, totalParts }));
+        }
+        catch (error) {
+            throw mapGrantPortalError(error);
+        }
+        // Step 6: complete — verify + print the Portal's canonical digest.
+        let manifestDigest;
+        try {
+            const completed = await completeUpload(client, grant.value, uploadId);
+            manifestDigest = completed.manifestDigest;
+            reporter.emit({ event: 'upload_complete', sha256: completed.sha256, manifestDigest });
+        }
+        catch (error) {
+            throw mapGrantPortalError(error);
+        }
+        // Step 7: version.
+        let createdVersion;
+        try {
+            createdVersion = await createVersion(client, grant.value, listing.id, { semver: version, uploadId, changelog });
+        }
+        catch (error) {
+            throw mapGrantPortalError(error);
+        }
+        reporter.emit({ event: 'version_created', versionId: createdVersion.id, semver: createdVersion.semver });
+        // Step 8: submit, then wait ≤60s for preflight to leave PENDING.
+        try {
+            await submitVersion(client, grant.value, listing.id, createdVersion.id);
+        }
+        catch (error) {
+            throw mapGrantPortalError(error);
+        }
+        reporter.emit({ event: 'submitted', versionId: createdVersion.id });
+        const finalVersion = await waitForPreflight(client, grant.value, listing.id, createdVersion.id, { sleepImpl: runtime.sleepImpl });
+        const finalState = finalVersion?.state ?? 'PREFLIGHT_PENDING';
+        if (finalState === 'PREFLIGHT_FAILED') {
+            const findings = JSON.stringify(finalVersion.preflightFindings ?? finalVersion);
+            throw new CliExitError(`Preflight failed:\n${findings}`, 2, 'PREFLIGHT_FAILED');
+        }
+        if (finalState === 'PREFLIGHT_BLOCKED_INFRA') {
+            reporter.emit({
+                event: 'status',
+                state: finalState,
+                message: 'blocked on Portal build infrastructure — this is admin-side, not a problem with your submission',
+            });
+            return 0;
+        }
+        reporter.emit({ event: 'status', state: finalState, message: 'follow up in Creator Studio' });
+        return 0;
+    }
+    catch (error) {
+        if (error instanceof CliExitError) {
+            reporter.emit({ event: 'error', code: error.code, message: error.message });
+            return error.exitCode;
+        }
+        if (error instanceof ManifestLoadError) {
+            reporter.emit({ event: 'error', message: error.message });
+            return 5;
+        }
+        if (error instanceof PortalError) {
+            reporter.emit({ event: 'error', code: error.code, message: error.message });
+            return 4;
+        }
+        reporter.emit({ event: 'error', message: error instanceof Error ? error.message : String(error) });
+        return 4;
+    }
+}
+function packageOrThrow(cwd, name, version, allowDirty) {
+    try {
+        return packageSource({ cwd, name, version, allowDirty });
+    }
+    catch (error) {
+        if (error instanceof PackagePolicyError) {
+            const exitCode = error.code === 'NOT_GIT_REPOSITORY' || error.code === 'GIT_ARCHIVE_FAILED' ? 5 : 2;
+            const message = error.details.length > 0 ? `${error.message}\n- ${error.details.join('\n- ')}` : error.message;
+            throw new CliExitError(message, exitCode, error.code);
+        }
+        throw error;
+    }
+}
+async function authorize(client, runtime, reporter, token, request) {
+    try {
+        const outcome = await createAuthorization(client, request, token);
+        if (outcome.kind === 'grant') {
+            return { grant: outcome.grant, listing: outcome.listing };
+        }
+        reporter.emit({
+            event: 'authorization_device',
+            verificationUrl: outcome.verificationUrl,
+            userCode: outcome.userCode,
+            expiresIn: outcome.expiresIn,
+        });
+        if (request.open) {
+            try {
+                (runtime.openBrowser ?? openBrowser)(outcome.verificationUrl);
+            }
+            catch {
+                // best-effort only — the printed URL remains the source of truth.
+            }
+        }
+        const pollOutcome = await waitForApproval(client, outcome.deviceCode, {
+            intervalMs: outcome.interval * 1000,
+            expiresInMs: outcome.expiresIn * 1000,
+            sleepImpl: runtime.sleepImpl,
+            onPending: (elapsedMs) => reporter.emit({ event: 'authorization_waiting', elapsedMs }),
+        });
+        if (pollOutcome.state === 'DENIED') {
+            reporter.emit({ event: 'authorization_denied' });
+            throw new CliExitError('Publish authorization was denied.', 3, 'AUTHORIZATION_DENIED');
+        }
+        if (pollOutcome.state === 'EXPIRED') {
+            reporter.emit({ event: 'authorization_expired' });
+            throw new CliExitError('Publish authorization expired; re-run to request a new approval.', 3, 'AUTHORIZATION_EXPIRED');
+        }
+        if (pollOutcome.state === 'CONSUMED') {
+            throw new CliExitError('Publish authorization was already consumed; re-run to request a new approval.', 3, 'AUTHORIZATION_CONSUMED');
+        }
+        return { grant: pollOutcome.grant, listing: { id: pollOutcome.grant.listingId, slug: pollOutcome.grant.listingSlug } };
+    }
+    catch (error) {
+        if (error instanceof CliExitError)
+            throw error;
+        if (error instanceof PortalError)
+            throw mapAuthorizationPortalError(error);
+        throw error;
+    }
+}
+function mapAuthorizationPortalError(error) {
+    if (error.code === 'LISTING_NOT_BOUND') {
+        return new CliExitError('Listing is not yet bound to this manifest — approve the first version of this listing in your browser: run without the token.', 2, error.code);
+    }
+    if (error.code === 'LISTING_UNRESOLVED') {
+        return new CliExitError('Listing could not be resolved — pass --listing <slug> to select it.', 2, error.code);
+    }
+    // A revoked/expired/invalid publisher token is an authorization denial, not a
+    // transport fault — surface it as exit 3 so CI can tell "rotate the token" apart
+    // from "the Portal is unreachable".
+    if (error.code === 'PUBLISHER_TOKEN_REVOKED' ||
+        error.code === 'PUBLISHER_TOKEN_EXPIRED' ||
+        error.code === 'PUBLISHER_TOKEN_INVALID') {
+        return new CliExitError(`Publisher token rejected (${error.code}); rotate it in Creator Studio.`, 3, error.code);
+    }
+    return new CliExitError(error.message, 4, error.code);
+}
+function mapGrantPortalError(error) {
+    if (!(error instanceof PortalError))
+        return error instanceof Error ? error : new Error(String(error));
+    if (error.code === 'PUBLISH_GRANT_EXPIRED') {
+        return new CliExitError('Publish grant expired mid-upload; re-run to request a new approval.', 3, error.code);
+    }
+    if (error.code === 'PUBLISH_GRANT_MISMATCH') {
+        return new CliExitError('Uploaded archive or manifest does not match the approved authorization; re-run publish from a clean state.', 2, error.code);
+    }
+    if (error.code === 'VERSION_SEMVER_EXISTS') {
+        return new CliExitError('Version already exists — bump `version` in privos-app.json and package.json.', 2, error.code);
+    }
+    return new CliExitError(error.message, 4, error.code);
+}
+function resolveChangelog(values, cwd) {
+    if (typeof values.changelog === 'string')
+        return values.changelog;
+    if (typeof values['changelog-file'] === 'string') {
+        const changelogPath = path.resolve(cwd, values['changelog-file']);
+        try {
+            return fs.readFileSync(changelogPath, 'utf8').trim();
+        }
+        catch {
+            throw new CliExitError(`Unable to read changelog file: ${changelogPath}`, 5, 'USAGE');
+        }
+    }
+    return '';
+}
+function getOwnPackageVersion() {
+    try {
+        const packageJsonUrl = new URL('../../../package.json', import.meta.url);
+        const pkg = JSON.parse(fs.readFileSync(packageJsonUrl, 'utf8'));
+        return typeof pkg.version === 'string' ? pkg.version : '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+async function readTokenFromStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(Buffer.from(chunk));
+    return Buffer.concat(chunks).toString('utf8');
+}
+async function defaultConfirm(question) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = await rl.question(question);
+        return /^y(es)?$/i.test(answer.trim());
+    }
+    finally {
+        rl.close();
+    }
+}
+function openBrowser(url) {
+    if (process.platform === 'darwin') {
+        spawn('open', [url], { detached: true, stdio: 'ignore' }).unref();
+    }
+    else if (process.platform === 'win32') {
+        spawn('cmd', ['/c', 'start', '""', url], { detached: true, stdio: 'ignore' }).unref();
+    }
+    else {
+        spawn('xdg-open', [url], { detached: true, stdio: 'ignore' }).unref();
+    }
+}
+function printPublishUsage() {
+    console.log(`Usage: privos-app publish [options]
+
+Packages the app in the current directory (or --cwd), authorizes with the
+Portal (browser approval by default, or PRIVOS_PUBLISHER_TOKEN for CI),
+uploads the source archive, creates the version, and submits it for review.
+
+Options:
+  --listing <slug>          Listing slug when it cannot be resolved from the manifest name
+  --changelog <text>        Changelog text for this version
+  --changelog-file <path>   Read changelog text from a file
+  --allow-dirty             Package an uncommitted working tree (git write-tree snapshot)
+  --dry-run                 Package only; print the git revision and archive sha256, then stop
+  --yes                     Skip the interactive confirmation prompt
+  --portal <origin>         Portal origin (default: $PRIVOS_PORTAL_ORIGIN or https://portal.privos.io)
+  --machine-label <text>    Label shown on the approval page (never the hostname by default)
+  --open                    Open the approval URL in a browser
+  --json                    Emit one NDJSON event per step
+  --cwd <path>              Directory containing privos-app.json and package.json
+  --token-stdin             Read PRIVOS_PUBLISHER_TOKEN from stdin instead of the environment
+  -h, --help                Show this help
+
+Exit codes: 0 submitted, 2 blocked by policy, 3 authorization denied/expired, 4 network/portal error, 5 usage.`);
+}
+//# sourceMappingURL=publish.js.map

package/dist/cli/commands/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../../src/cli/commands/publish.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,QAAQ,MAAM,wBAAwB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC/H,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AAC9F,OAAO,EACN,mBAAmB,EACnB,uBAAuB,EACvB,cAAc,EACd,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,uBAAuB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAczD,wEAAwE;AACxE,MAAM,YAAa,SAAQ,KAAK;IACc;IAAkC;IAA/E,YAAY,OAAe,EAAkB,QAAgB,EAAkB,IAAa;QAC3F,KAAK,CAAC,OAAO,CAAC,CAAC;QAD6B,aAAQ,GAAR,QAAQ,CAAQ;QAAkB,SAAI,GAAJ,IAAI,CAAS;QAE3F,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC5B,CAAC;CACD;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAuB,EAAE,UAAiC,EAAE;IAC5F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;YACvB,IAAI,EAAE,IAAgB;YACtB,OAAO,EAAE;gBACR,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC7B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACpC,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;gBAClD,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC9C,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;gBACxC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACnC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;gBACzC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;gBACzC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACvB,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;gBAClD,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE;aACrD;YACD,gBAAgB,EAAE,KAAK;SACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC;IACV,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,iBAAiB,EAAE,CAAC;QACpB,OAAO,CAAC,CAAC;IACV,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAEvG,IAAI,CAAC;QACJ,qGAAqG;QACrG,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YAC1D,MAAM,IAAI,YAAY,CAAC,2BAA2B,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,cAAc,GAAG,uBAAuB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC9D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YAC1D,MAAM,IAAI,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,4BAA4B,CAAC,CAAC;QACpF,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAEzD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAEzC,0FAA0F;QAC1F,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACpF,QAAQ,CAAC,IAAI,CAAC;YACb,KAAK,EAAE,SAAS;YAChB,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;SACnC,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,QAAQ,CAAC,WAAW,aAAa,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACzH,OAAO,CAAC,CAAC;QACV,CAAC;QAED,wCAAwC;QACxC,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChD,MAAM,YAAY,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,IAAI,qBAAqB,CAAC;QAC3H,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,oBAAoB,EAAE,CAAC;QAChE,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;YAClC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,IAAI,kBAAkB,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE;YACrE,CAAC,CAAC,GAAG,CAAC,sBAAsB,IAAI,SAAS,CAAC;QAC3C,IAAI,KAAK;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAE3F,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC;YAClD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,IAAI,IAAI,OAAO,YAAY,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;YAC9G,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAEtH,0FAA0F;QAC1F,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC5E,YAAY,EAAE,IAAI;YAClB,MAAM,EAAE,OAAO;YACf,aAAa,EAAE,QAAQ,CAAC,MAAM;YAC9B,YAAY,EAAE,QAAQ,CAAC,KAAK;YAC5B,UAAU;YACV,WAAW,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YAC5E,YAAY,EAAE,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS;YAC/F,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;SAC1B,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAErG,+CAA+C;QAC/C,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5D,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACJ,CAAC,EAAE,QAAQ,EAAE,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE;gBAC1E,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC7C,UAAU,EAAE,aAAa,CAAC,MAAM;gBAChC,KAAK,EAAE,QAAQ,CAAC,SAAS;aACzB,CAAC,CAAC,CAAC;YACJ,MAAM,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,uBAAuB,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,CACzH,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAC7D,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QAED,mEAAmE;QACnE,IAAI,cAAsB,CAAC;QAC3B,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACtE,cAAc,GAAG,SAAS,CAAC,cAAc,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QACvF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QAED,mBAAmB;QACnB,IAAI,cAAc,CAAC;QACnB,IAAI,CAAC;YACJ,cAAc,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QACjH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QAEzG,iEAAiE;QACjE,IAAI,CAAC;YACJ,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;QAEpE,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAClI,MAAM,UAAU,GAAG,YAAY,EAAE,KAAK,IAAI,mBAAmB,CAAC;QAE9D,IAAI,UAAU,KAAK,kBAAkB,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAE,YAAwC,CAAC,iBAAiB,IAAI,YAAY,CAAC,CAAC;YAC7G,MAAM,IAAI,YAAY,CAAC,sBAAsB,QAAQ,EAAE,EAAE,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,UAAU,KAAK,yBAAyB,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC;gBACb,KAAK,EAAE,QAAQ;gBACf,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,iGAAiG;aAC1G,CAAC,CAAC;YACH,OAAO,CAAC,CAAC;QACV,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC9F,OAAO,CAAC,CAAC;IACV,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5E,OAAO,KAAK,CAAC,QAAQ,CAAC;QACvB,CAAC;QACD,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1D,OAAO,CAAC,CAAC;QACV,CAAC;QACD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,CAAC;QACV,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnG,OAAO,CAAC,CAAC;IACV,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,IAAY,EAAE,OAAe,EAAE,UAAmB;IACtF,IAAI,CAAC;QACJ,OAAO,aAAa,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,KAAK,oBAAoB,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpG,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;YAC/G,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAaD,KAAK,UAAU,SAAS,CACvB,MAAoB,EACpB,OAA8B,EAC9B,QAAkB,EAClB,KAAyB,EACzB,OAA6B;IAE7B,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3D,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC;YACb,KAAK,EAAE,sBAAsB;YAC7B,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,IAAI,CAAC;gBACJ,CAAC,OAAO,CAAC,WAAW,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACR,kEAAkE;YACnE,CAAC;QACF,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE;YACrE,UAAU,EAAE,OAAO,CAAC,QAAQ,GAAG,IAAI;YACnC,WAAW,EAAE,OAAO,CAAC,SAAS,GAAG,IAAI;YACrC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,SAAS,EAAE,CAAC;SACtF,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACjD,MAAM,IAAI,YAAY,CAAC,mCAAmC,EAAE,CAAC,EAAE,sBAAsB,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAClD,MAAM,IAAI,YAAY,CAAC,kEAAkE,EAAE,CAAC,EAAE,uBAAuB,CAAC,CAAC;QACxH,CAAC;QACD,IAAI,WAAW,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACtC,MAAM,IAAI,YAAY,CAAC,+EAA+E,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC;QACtI,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;IACxH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,YAAY;YAAE,MAAM,KAAK,CAAC;QAC/C,IAAI,KAAK,YAAY,WAAW;YAAE,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;QAC3E,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAkB;IACtD,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACxC,OAAO,IAAI,YAAY,CACtB,+HAA+H,EAC/H,CAAC,EACD,KAAK,CAAC,IAAI,CACV,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACzC,OAAO,IAAI,YAAY,CAAC,qEAAqE,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/G,CAAC;IACD,8EAA8E;IAC9E,iFAAiF;IACjF,oCAAoC;IACpC,IACC,KAAK,CAAC,IAAI,KAAK,yBAAyB;QACxC,KAAK,CAAC,IAAI,KAAK,yBAAyB;QACxC,KAAK,CAAC,IAAI,KAAK,yBAAyB,EACvC,CAAC;QACF,OAAO,IAAI,YAAY,CAAC,6BAA6B,KAAK,CAAC,IAAI,iCAAiC,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,IAAI,CAAC,CAAC,KAAK,YAAY,WAAW,CAAC;QAAE,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtG,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAC5C,OAAO,IAAI,YAAY,CAAC,qEAAqE,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;QAC7C,OAAO,IAAI,YAAY,CACtB,4GAA4G,EAC5G,CAAC,EACD,KAAK,CAAC,IAAI,CACV,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAC5C,OAAO,IAAI,YAAY,CAAC,8EAA8E,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACxH,CAAC;IACD,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA+B,EAAE,GAAW;IACrE,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC;IAClE,IAAI,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC;YACJ,OAAO,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,YAAY,CAAC,kCAAkC,aAAa,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QACvF,CAAC;IACF,CAAC;IACD,OAAO,EAAE,CAAC;AACX,CAAC;AAED,SAAS,oBAAoB;IAC5B,IAAI,CAAC;QACJ,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAyB,CAAC;QACxF,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,OAAO,CAAC;IAChB,CAAC;AACF,CAAC;AAED,KAAK,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3C,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;YAAS,CAAC;QACV,EAAE,CAAC,KAAK,EAAE,CAAC;IACZ,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACnE,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzC,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACvF,CAAC;SAAM,CAAC;QACP,KAAK,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACvE,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB;IACzB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;+GAqBkG,CAAC,CAAC;AACjH,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":""}

package/dist/cli/index.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+import { runLint } from './commands/lint.js';
+import { runPublish } from './commands/publish.js';
+function printUsage() {
+    console.log(`Usage: privos-app <command> [options]
+
+Commands:
+  lint [manifestPath]   Validate privos-app.json structure (default: ./privos-app.json)
+  publish [options]     Package, authorize, upload and submit the app to the Marketplace
+
+Run "privos-app publish --help" for publish options.`);
+}
+async function main() {
+    const [subcommand, ...rest] = process.argv.slice(2);
+    switch (subcommand) {
+        case 'lint':
+            return runLint(rest);
+        case 'publish':
+            return runPublish(rest);
+        case '-h':
+        case '--help':
+            printUsage();
+            return 0;
+        case undefined:
+            printUsage();
+            return 5;
+        default:
+            console.error(`Unknown command "${subcommand}". Usage: privos-app <lint|publish> [options]`);
+            return 5;
+    }
+}
+main().then((exitCode) => process.exit(exitCode), (error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(4);
+});
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,SAAS,UAAU;IAClB,OAAO,CAAC,GAAG,CAAC;;;;;;qDAMwC,CAAC,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,IAAI;IAClB,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpD,QAAQ,UAAU,EAAE,CAAC;QACpB,KAAK,MAAM;YACV,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACtB,KAAK,SAAS;YACb,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QACzB,KAAK,IAAI,CAAC;QACV,KAAK,QAAQ;YACZ,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,CAAC;QACV,KAAK,SAAS;YACb,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,CAAC;QACV;YACC,OAAO,CAAC,KAAK,CAAC,oBAAoB,UAAU,+CAA+C,CAAC,CAAC;YAC7F,OAAO,CAAC,CAAC;IACX,CAAC;AACF,CAAC;AAED,IAAI,EAAE,CAAC,IAAI,CACV,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EACpC,CAAC,KAAc,EAAE,EAAE;IAClB,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC,CACD,CAAC"}

package/dist/cli/lib/authorize.d.ts

@@ -0,0 +1,80 @@
+import { PortalClient } from './portal-client.js';
+/**
+ * A publish grant as returned by the Portal — `pvg_<authorizationId>.<mac>`,
+ * used verbatim as `Authorization: Bearer <value>`. Never composed
+ * client-side; the CLI only ever forwards the Portal's own string.
+ */
+export type PublishGrant = Readonly<{
+    value: string;
+    expiresAt: string;
+    listingId: string;
+    listingSlug: string;
+}>;
+export type AuthorizationRequest = Readonly<{
+    manifestName: string;
+    semver: string;
+    archiveSha256: string;
+    archiveBytes: number;
+    cliVersion: string;
+    listingSlug?: string;
+    machineLabel?: string;
+}>;
+export type AuthorizationOutcome = Readonly<{
+    kind: 'grant';
+    grant: PublishGrant;
+    listing: {
+        id: string;
+        slug: string;
+        name?: string;
+    };
+}> | Readonly<{
+    kind: 'device';
+    deviceCode: string;
+    userCode: string;
+    verificationUrl: string;
+    expiresIn: number;
+    interval: number;
+}>;
+export type PollOutcome = Readonly<{
+    state: 'PENDING';
+}> | Readonly<{
+    state: 'APPROVED';
+    grant: PublishGrant;
+}> | Readonly<{
+    state: 'DENIED';
+}> | Readonly<{
+    state: 'EXPIRED';
+}> | Readonly<{
+    state: 'CONSUMED';
+}>;
+/** The states {@link waitForApproval} can resolve to — `PENDING` is a polling-loop-internal state only. */
+export type TerminalPollOutcome = Exclude<PollOutcome, Readonly<{
+    state: 'PENDING';
+}>>;
+/**
+ * `POST /publish-authorizations` — anonymous (interactive/device flow) or
+ * bearer `pvp_…` (publisher token, CI). A token whose scope covers the
+ * resolved listing and whose `manifestName` is already bound returns
+ * `{ grant, listing }` inline (`kind: 'grant'`); otherwise the Portal issues
+ * a device code (`kind: 'device'`). `409 LISTING_NOT_BOUND` / `409
+ * LISTING_UNRESOLVED` surface as {@link PortalError} for the caller to map
+ * to the documented exit codes and remediation text.
+ */
+export declare function createAuthorization(client: PortalClient, request: AuthorizationRequest, token?: string): Promise<AuthorizationOutcome>;
+/** `POST /publish-authorizations/token` — RFC 8628 polling; a `slow_down` error surfaces as a `PortalError` with that code. */
+export declare function pollAuthorization(client: PortalClient, deviceCode: string): Promise<PollOutcome>;
+export type WaitForApprovalOptions = Readonly<{
+    intervalMs: number;
+    expiresInMs: number;
+    onPending?: (elapsedMs: number) => void;
+    sleepImpl?: (ms: number) => Promise<void>;
+}>;
+/**
+ * Polls until a terminal state, honoring `slow_down` by backing off (RFC
+ * 8628 §3.5) and stopping once the authorization's own `expiresIn` window
+ * elapses. While `APPROVED`, the Portal returns the same grant on every
+ * poll, so a lost response mid-poll is recoverable by design — this loop
+ * simply returns on the first non-`PENDING` state it observes.
+ */
+export declare function waitForApproval(client: PortalClient, deviceCode: string, options: WaitForApprovalOptions): Promise<TerminalPollOutcome>;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/cli/lib/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,oBAAoB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACpB,CAAC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAC7B,QAAQ,CAAC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,GACtG,QAAQ,CAAC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEpI,MAAM,MAAM,WAAW,GACpB,QAAQ,CAAC;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC,GAC9B,QAAQ,CAAC;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,CAAC,GACpD,QAAQ,CAAC;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,CAAC,GAC7B,QAAQ,CAAC;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC,GAC9B,QAAQ,CAAC;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC,CAAC;AAEnC,2GAA2G;AAC3G,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC,CAAC;AAWvF;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0B5I;AAED,+HAA+H;AAC/H,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAOtG;AAED,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAqB7I"}