@privos_ai/app-server 0.8.4 → 0.10.0

package/dist/cli/lib/authorize.d.ts

@@ -0,0 +1,80 @@
+import { PortalClient } from './portal-client.js';
+/**
+ * A publish grant as returned by the Portal — `pvg_<authorizationId>.<mac>`,
+ * used verbatim as `Authorization: Bearer <value>`. Never composed
+ * client-side; the CLI only ever forwards the Portal's own string.
+ */
+export type PublishGrant = Readonly<{
+    value: string;
+    expiresAt: string;
+    listingId: string;
+    listingSlug: string;
+}>;
+export type AuthorizationRequest = Readonly<{
+    manifestName: string;
+    semver: string;
+    archiveSha256: string;
+    archiveBytes: number;
+    cliVersion: string;
+    listingSlug?: string;
+    machineLabel?: string;
+}>;
+export type AuthorizationOutcome = Readonly<{
+    kind: 'grant';
+    grant: PublishGrant;
+    listing: {
+        id: string;
+        slug: string;
+        name?: string;
+    };
+}> | Readonly<{
+    kind: 'device';
+    deviceCode: string;
+    userCode: string;
+    verificationUrl: string;
+    expiresIn: number;
+    interval: number;
+}>;
+export type PollOutcome = Readonly<{
+    state: 'PENDING';
+}> | Readonly<{
+    state: 'APPROVED';
+    grant: PublishGrant;
+}> | Readonly<{
+    state: 'DENIED';
+}> | Readonly<{
+    state: 'EXPIRED';
+}> | Readonly<{
+    state: 'CONSUMED';
+}>;
+/** The states {@link waitForApproval} can resolve to — `PENDING` is a polling-loop-internal state only. */
+export type TerminalPollOutcome = Exclude<PollOutcome, Readonly<{
+    state: 'PENDING';
+}>>;
+/**
+ * `POST /publish-authorizations` — anonymous (interactive/device flow) or
+ * bearer `pvp_…` (publisher token, CI). A token whose scope covers the
+ * resolved listing and whose `manifestName` is already bound returns
+ * `{ grant, listing }` inline (`kind: 'grant'`); otherwise the Portal issues
+ * a device code (`kind: 'device'`). `409 LISTING_NOT_BOUND` / `409
+ * LISTING_UNRESOLVED` surface as {@link PortalError} for the caller to map
+ * to the documented exit codes and remediation text.
+ */
+export declare function createAuthorization(client: PortalClient, request: AuthorizationRequest, token?: string): Promise<AuthorizationOutcome>;
+/** `POST /publish-authorizations/token` — RFC 8628 polling; a `slow_down` error surfaces as a `PortalError` with that code. */
+export declare function pollAuthorization(client: PortalClient, deviceCode: string): Promise<PollOutcome>;
+export type WaitForApprovalOptions = Readonly<{
+    intervalMs: number;
+    expiresInMs: number;
+    onPending?: (elapsedMs: number) => void;
+    sleepImpl?: (ms: number) => Promise<void>;
+}>;
+/**
+ * Polls until a terminal state, honoring `slow_down` by backing off (RFC
+ * 8628 §3.5) and stopping once the authorization's own `expiresIn` window
+ * elapses. While `APPROVED`, the Portal returns the same grant on every
+ * poll, so a lost response mid-poll is recoverable by design — this loop
+ * simply returns on the first non-`PENDING` state it observes.
+ */
+export declare function waitForApproval(client: PortalClient, deviceCode: string, options: WaitForApprovalOptions): Promise<TerminalPollOutcome>;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/cli/lib/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,oBAAoB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACpB,CAAC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAC7B,QAAQ,CAAC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,GACtG,QAAQ,CAAC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEpI,MAAM,MAAM,WAAW,GACpB,QAAQ,CAAC;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC,GAC9B,QAAQ,CAAC;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,CAAC,GACpD,QAAQ,CAAC;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,CAAC,GAC7B,QAAQ,CAAC;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC,GAC9B,QAAQ,CAAC;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC,CAAC;AAEnC,2GAA2G;AAC3G,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC,CAAC;AAWvF;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0B5I;AAED,+HAA+H;AAC/H,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAOtG;AAED,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAqB7I"}

package/dist/cli/lib/authorize.js

@@ -0,0 +1,86 @@
+import { PortalError } from './portal-client.js';
+function normalizeGrant(raw) {
+    return {
+        value: String(raw.token),
+        expiresAt: String(raw.expiresAt),
+        listingId: String(raw.listingId),
+        listingSlug: String(raw.listingSlug),
+    };
+}
+/**
+ * `POST /publish-authorizations` — anonymous (interactive/device flow) or
+ * bearer `pvp_…` (publisher token, CI). A token whose scope covers the
+ * resolved listing and whose `manifestName` is already bound returns
+ * `{ grant, listing }` inline (`kind: 'grant'`); otherwise the Portal issues
+ * a device code (`kind: 'device'`). `409 LISTING_NOT_BOUND` / `409
+ * LISTING_UNRESOLVED` surface as {@link PortalError} for the caller to map
+ * to the documented exit codes and remediation text.
+ */
+export async function createAuthorization(client, request, token) {
+    const body = {
+        manifestName: request.manifestName,
+        semver: request.semver,
+        archiveSha256: request.archiveSha256,
+        archiveBytes: request.archiveBytes,
+        cliVersion: request.cliVersion,
+        ...(request.listingSlug ? { listingSlug: request.listingSlug } : {}),
+        ...(request.machineLabel ? { machineLabel: request.machineLabel } : {}),
+    };
+    const response = await client.request('/publish-authorizations', { method: 'POST', token, body });
+    if (response.grant) {
+        return {
+            kind: 'grant',
+            grant: normalizeGrant(response.grant),
+            listing: response.listing,
+        };
+    }
+    return {
+        kind: 'device',
+        deviceCode: String(response.deviceCode),
+        userCode: String(response.userCode),
+        verificationUrl: String(response.verificationUrl),
+        expiresIn: Number(response.expiresIn),
+        interval: Number(response.interval),
+    };
+}
+/** `POST /publish-authorizations/token` — RFC 8628 polling; a `slow_down` error surfaces as a `PortalError` with that code. */
+export async function pollAuthorization(client, deviceCode) {
+    const response = await client.request('/publish-authorizations/token', { method: 'POST', body: { deviceCode } });
+    const state = String(response.state);
+    if (state === 'APPROVED') {
+        return { state: 'APPROVED', grant: normalizeGrant(response.grant) };
+    }
+    return { state: state };
+}
+/**
+ * Polls until a terminal state, honoring `slow_down` by backing off (RFC
+ * 8628 §3.5) and stopping once the authorization's own `expiresIn` window
+ * elapses. While `APPROVED`, the Portal returns the same grant on every
+ * poll, so a lost response mid-poll is recoverable by design — this loop
+ * simply returns on the first non-`PENDING` state it observes.
+ */
+export async function waitForApproval(client, deviceCode, options) {
+    const sleepImpl = options.sleepImpl ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    let intervalMs = options.intervalMs;
+    const start = Date.now();
+    const deadline = start + options.expiresInMs;
+    for (;;) {
+        if (Date.now() >= deadline)
+            return { state: 'EXPIRED' };
+        await sleepImpl(intervalMs);
+        try {
+            const outcome = await pollAuthorization(client, deviceCode);
+            if (outcome.state !== 'PENDING')
+                return outcome;
+            options.onPending?.(Date.now() - start);
+        }
+        catch (error) {
+            if (error instanceof PortalError && error.code?.toLowerCase() === 'slow_down') {
+                intervalMs += 5_000;
+                continue;
+            }
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=authorize.js.map

package/dist/cli/lib/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/cli/lib/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAsC/D,SAAS,cAAc,CAAC,GAA4B;IACnD,OAAO;QACN,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QACxB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAChC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAChC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;KACpC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAoB,EAAE,OAA6B,EAAE,KAAc;IAC5G,MAAM,IAAI,GAA4B;QACrC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAA0B,yBAAyB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3H,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,OAAO;YACN,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,KAAgC,CAAC;YAChE,OAAO,EAAE,QAAQ,CAAC,OAAsD;SACxE,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;QACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACnC,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;QACjD,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACnC,CAAC;AACH,CAAC;AAED,+HAA+H;AAC/H,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAoB,EAAE,UAAkB;IAC/E,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAA0B,+BAA+B,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC1I,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,KAAgC,CAAC,EAAE,CAAC;IAChG,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAsD,EAAE,CAAC;AAC1E,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAoB,EAAE,UAAkB,EAAE,OAA+B;IAC9G,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACjH,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC;IAE7C,SAAS,CAAC;QACT,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QACxD,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;QAC5B,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAC5D,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;YAChD,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,WAAW,IAAI,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;gBAC/E,UAAU,IAAI,KAAK,CAAC;gBACpB,SAAS;YACV,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/cli/lib/manifest.d.ts

@@ -0,0 +1,30 @@
+import { type ManifestLintResult } from '../../manifest-tools.js';
+/** Raised when `privos-app.json` or `package.json` cannot be located or parsed. */
+export declare class ManifestLoadError extends Error {
+}
+export type LoadedManifest = Readonly<{
+    manifestPath: string;
+    manifest: Record<string, unknown>;
+}>;
+export type LoadedPackageJson = Readonly<{
+    packagePath: string;
+    pkg: Record<string, unknown>;
+}>;
+export declare function loadManifest(cwd: string, manifestFile?: string): LoadedManifest;
+export declare function loadPackageJson(cwd: string): LoadedPackageJson;
+/**
+ * `privos-app.json` and `package.json` must agree on the identity fields the
+ * Portal binds a publish grant to (`name`, `version`). This is a CLI-side
+ * fast-fail check; the Portal independently verifies `manifest.name` /
+ * `manifest.version` on `complete` (`409 PUBLISH_GRANT_MISMATCH`).
+ */
+export declare function assertIdentityAgreement(manifest: Record<string, unknown>, pkg: Record<string, unknown>): string[];
+/**
+ * Structure-only lint. `result.canonicalManifestHash` is the SDK's structural
+ * digest (key-sorted JSON, `localeCompare`) and is NOT the Portal's canonical
+ * digest (which may differ in comparator and Zod-applied defaults). It must
+ * never be sent to the Portal; the Portal computes and returns the
+ * authoritative `manifestDigest` on upload `complete`.
+ */
+export declare function structuralLint(manifest: unknown): ManifestLintResult;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/cli/lib/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/manifest.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAEhF,mFAAmF;AACnF,qBAAa,iBAAkB,SAAQ,KAAK;CAAG;AAE/C,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7B,CAAC,CAAC;AAqBH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,SAAoB,GAAG,cAAc,CAG1F;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAG9D;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CASjH;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,GAAG,kBAAkB,CAEpE"}

package/dist/cli/lib/manifest.js

@@ -0,0 +1,61 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { lintManifest } from '../../manifest-tools.js';
+/** Raised when `privos-app.json` or `package.json` cannot be located or parsed. */
+export class ManifestLoadError extends Error {
+}
+function readJsonObject(filePath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(filePath, 'utf8');
+    }
+    catch {
+        throw new ManifestLoadError(`Unable to read ${filePath}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new ManifestLoadError(`Unable to read valid JSON from ${filePath}`);
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new ManifestLoadError(`${filePath} must contain a JSON object`);
+    }
+    return parsed;
+}
+export function loadManifest(cwd, manifestFile = 'privos-app.json') {
+    const manifestPath = path.resolve(cwd, manifestFile);
+    return { manifestPath, manifest: readJsonObject(manifestPath) };
+}
+export function loadPackageJson(cwd) {
+    const packagePath = path.resolve(cwd, 'package.json');
+    return { packagePath, pkg: readJsonObject(packagePath) };
+}
+/**
+ * `privos-app.json` and `package.json` must agree on the identity fields the
+ * Portal binds a publish grant to (`name`, `version`). This is a CLI-side
+ * fast-fail check; the Portal independently verifies `manifest.name` /
+ * `manifest.version` on `complete` (`409 PUBLISH_GRANT_MISMATCH`).
+ */
+export function assertIdentityAgreement(manifest, pkg) {
+    const errors = [];
+    if (manifest.name !== pkg.name) {
+        errors.push(`privos-app.json "name" (${JSON.stringify(manifest.name)}) does not match package.json "name" (${JSON.stringify(pkg.name)})`);
+    }
+    if (manifest.version !== pkg.version) {
+        errors.push(`privos-app.json "version" (${JSON.stringify(manifest.version)}) does not match package.json "version" (${JSON.stringify(pkg.version)})`);
+    }
+    return errors;
+}
+/**
+ * Structure-only lint. `result.canonicalManifestHash` is the SDK's structural
+ * digest (key-sorted JSON, `localeCompare`) and is NOT the Portal's canonical
+ * digest (which may differ in comparator and Zod-applied defaults). It must
+ * never be sent to the Portal; the Portal computes and returns the
+ * authoritative `manifestDigest` on upload `complete`.
+ */
+export function structuralLint(manifest) {
+    return lintManifest(manifest);
+}
+//# sourceMappingURL=manifest.js.map

package/dist/cli/lib/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../src/cli/lib/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,YAAY,EAA2B,MAAM,yBAAyB,CAAC;AAEhF,mFAAmF;AACnF,MAAM,OAAO,iBAAkB,SAAQ,KAAK;CAAG;AAY/C,SAAS,cAAc,CAAC,QAAgB;IACvC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACJ,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,QAAQ,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,iBAAiB,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,iBAAiB,CAAC,GAAG,QAAQ,6BAA6B,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,MAAiC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,YAAY,GAAG,iBAAiB;IACzE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACrD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACtD,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAiC,EAAE,GAA4B;IACtG,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,yCAAyC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3I,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,4CAA4C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvJ,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,QAAiB;IAC/C,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC"}

package/dist/cli/lib/output.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Human vs `--json` (NDJSON) rendering for `privos-app publish`, plus secret
+ * masking. Grants are never rendered by any event — callers must not pass a
+ * grant value into a {@link PublishEvent}. Tokens are only ever shown masked.
+ */
+export type PublishEvent = Readonly<{
+    event: 'lint';
+    ok: boolean;
+    manifestPath: string;
+}> | Readonly<{
+    event: 'package';
+    archivePath: string;
+    bytes: number;
+    sha256: string;
+    entryCount: number;
+}> | Readonly<{
+    event: 'authorization_token';
+    maskedToken: string;
+}> | Readonly<{
+    event: 'authorization_device';
+    verificationUrl: string;
+    userCode: string;
+    expiresIn: number;
+}> | Readonly<{
+    event: 'authorization_waiting';
+    elapsedMs: number;
+}> | Readonly<{
+    event: 'authorization_approved';
+    listingId: string;
+    listingSlug: string;
+}> | Readonly<{
+    event: 'authorization_denied';
+}> | Readonly<{
+    event: 'authorization_expired';
+}> | Readonly<{
+    event: 'upload_progress';
+    part: number;
+    totalParts: number;
+}> | Readonly<{
+    event: 'upload_complete';
+    sha256: string;
+    manifestDigest: string;
+}> | Readonly<{
+    event: 'version_created';
+    versionId: string;
+    semver: string;
+}> | Readonly<{
+    event: 'submitted';
+    versionId: string;
+}> | Readonly<{
+    event: 'status';
+    state: string;
+    message?: string;
+}> | Readonly<{
+    event: 'error';
+    code?: string;
+    message: string;
+}>;
+export declare class Reporter {
+    private readonly jsonMode;
+    constructor(jsonMode: boolean);
+    emit(event: PublishEvent): void;
+}
+/** Shows only enough of a secret to identify it in logs; never the full value. */
+export declare function maskSecret(value: string): string;
+//# sourceMappingURL=output.d.ts.map

package/dist/cli/lib/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/output.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACrB,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,GAC9D,QAAQ,CAAC;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,GACtG,QAAQ,CAAC;IAAE,KAAK,EAAE,qBAAqB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,GAC/D,QAAQ,CAAC;IAAE,KAAK,EAAE,sBAAsB,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,GACzG,QAAQ,CAAC;IAAE,KAAK,EAAE,uBAAuB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,GAC/D,QAAQ,CAAC;IAAE,KAAK,EAAE,wBAAwB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,GACrF,QAAQ,CAAC;IAAE,KAAK,EAAE,sBAAsB,CAAA;CAAE,CAAC,GAC3C,QAAQ,CAAC;IAAE,KAAK,EAAE,uBAAuB,CAAA;CAAE,CAAC,GAC5C,QAAQ,CAAC;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,GACxE,QAAQ,CAAC;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,GAC9E,QAAQ,CAAC;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GACzE,QAAQ,CAAC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,GACnD,QAAQ,CAAC;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAC9D,QAAQ,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEhE,qBAAa,QAAQ;IACR,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,OAAO;IAE9C,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI;CAO/B;AA4CD,kFAAkF;AAClF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGhD"}

package/dist/cli/lib/output.js

@@ -0,0 +1,61 @@
+export class Reporter {
+    jsonMode;
+    constructor(jsonMode) {
+        this.jsonMode = jsonMode;
+    }
+    emit(event) {
+        if (this.jsonMode) {
+            process.stdout.write(`${JSON.stringify(event)}\n`);
+            return;
+        }
+        process.stdout.write(`${formatHumanLine(event)}\n`);
+    }
+}
+function formatHumanLine(event) {
+    switch (event.event) {
+        case 'lint':
+            return event.ok ? `✔ manifest ${event.manifestPath} valid` : `✖ manifest ${event.manifestPath} invalid`;
+        case 'package':
+            return `✔ archive ${event.archivePath} (${event.bytes} bytes, ${event.entryCount} entries, sha256:${event.sha256})`;
+        case 'authorization_token':
+            return `→ authorizing with publisher token ${event.maskedToken}`;
+        case 'authorization_device':
+            return [
+                '→ Approve this publish in your browser:',
+                `    ${event.verificationUrl}`,
+                `    user code: ${event.userCode}`,
+                `  (waiting… expires in ${Math.round(event.expiresIn / 60)} min)`,
+            ].join('\n');
+        case 'authorization_waiting':
+            return '  (waiting for approval…)';
+        case 'authorization_approved':
+            return `✔ approved → listing ${event.listingSlug}`;
+        case 'authorization_denied':
+            return '✖ publish authorization was denied';
+        case 'authorization_expired':
+            return '✖ publish authorization expired';
+        case 'upload_progress':
+            return `  uploaded ${event.part}/${event.totalParts} parts`;
+        case 'upload_complete':
+            return `✔ uploaded · manifest digest ${event.manifestDigest}`;
+        case 'version_created':
+            return `✔ version ${event.semver} created`;
+        case 'submitted':
+            return '✔ submitted';
+        case 'status':
+            return event.message ? `→ status: ${event.state}  (${event.message})` : `→ status: ${event.state}`;
+        case 'error':
+            return `✖ ${event.message}`;
+        default: {
+            const exhaustive = event;
+            return JSON.stringify(exhaustive);
+        }
+    }
+}
+/** Shows only enough of a secret to identify it in logs; never the full value. */
+export function maskSecret(value) {
+    if (value.length <= 8)
+        return '***';
+    return `${value.slice(0, 8)}…(${value.length} chars)`;
+}
+//# sourceMappingURL=output.js.map

package/dist/cli/lib/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../../src/cli/lib/output.ts"],"names":[],"mappings":"AAqBA,MAAM,OAAO,QAAQ;IACS;IAA7B,YAA6B,QAAiB;QAAjB,aAAQ,GAAR,QAAQ,CAAS;IAAG,CAAC;IAElD,IAAI,CAAC,KAAmB;QACvB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACnD,OAAO;QACR,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC;CACD;AAED,SAAS,eAAe,CAAC,KAAmB;IAC3C,QAAQ,KAAK,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,MAAM;YACV,OAAO,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,CAAC,YAAY,QAAQ,CAAC,CAAC,CAAC,cAAc,KAAK,CAAC,YAAY,UAAU,CAAC;QACzG,KAAK,SAAS;YACb,OAAO,aAAa,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,WAAW,KAAK,CAAC,UAAU,oBAAoB,KAAK,CAAC,MAAM,GAAG,CAAC;QACrH,KAAK,qBAAqB;YACzB,OAAO,sCAAsC,KAAK,CAAC,WAAW,EAAE,CAAC;QAClE,KAAK,sBAAsB;YAC1B,OAAO;gBACN,yCAAyC;gBACzC,OAAO,KAAK,CAAC,eAAe,EAAE;gBAC9B,kBAAkB,KAAK,CAAC,QAAQ,EAAE;gBAClC,0BAA0B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC,OAAO;aACjE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,KAAK,uBAAuB;YAC3B,OAAO,2BAA2B,CAAC;QACpC,KAAK,wBAAwB;YAC5B,OAAO,wBAAwB,KAAK,CAAC,WAAW,EAAE,CAAC;QACpD,KAAK,sBAAsB;YAC1B,OAAO,oCAAoC,CAAC;QAC7C,KAAK,uBAAuB;YAC3B,OAAO,iCAAiC,CAAC;QAC1C,KAAK,iBAAiB;YACrB,OAAO,cAAc,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,QAAQ,CAAC;QAC7D,KAAK,iBAAiB;YACrB,OAAO,gCAAgC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC/D,KAAK,iBAAiB;YACrB,OAAO,aAAa,KAAK,CAAC,MAAM,UAAU,CAAC;QAC5C,KAAK,WAAW;YACf,OAAO,aAAa,CAAC;QACtB,KAAK,QAAQ;YACZ,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,KAAK,MAAM,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,KAAK,EAAE,CAAC;QACpG,KAAK,OAAO;YACX,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACnC,CAAC;IACF,CAAC;AACF,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,UAAU,CAAC,KAAa;IACvC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,SAAS,CAAC;AACvD,CAAC"}

package/dist/cli/lib/package-source.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Policy-violation codes surfaced by {@link packageSource}. Every code maps to
+ * CLI exit code 2 ("blocked by policy") except `NOT_GIT_REPOSITORY` and
+ * `GIT_ARCHIVE_FAILED`, which the caller treats as environment/usage problems.
+ */
+export type PackagePolicyCode = 'NOT_GIT_REPOSITORY' | 'DIRTY_TREE' | 'CREDENTIAL_FILE_FOUND' | 'GIT_ARCHIVE_FAILED' | 'INVALID_ZIP' | 'MISSING_REQUIRED_ENTRY' | 'DENIED_PATH_IN_ARCHIVE' | 'ENTRY_LIMIT_EXCEEDED' | 'FILE_SIZE_EXCEEDED' | 'TOTAL_SIZE_EXCEEDED';
+export declare class PackagePolicyError extends Error {
+    readonly code: PackagePolicyCode;
+    readonly details: readonly string[];
+    constructor(message: string, code: PackagePolicyCode, details?: readonly string[]);
+}
+export type PackageSourceOptions = Readonly<{
+    /** Directory the CLI was invoked from; resolved up to the git worktree root. */
+    cwd: string;
+    /** Package identity used to name the archive: `<outputDir>/<safeName>-<version>.zip`. */
+    name: string;
+    version: string;
+    /** Refuse a dirty tree unless true (mirrors `scripts/package-source.sh`). */
+    allowDirty: boolean;
+    /** Relative to the git worktree root. Defaults to `dist-source`. */
+    outputDir?: string;
+}>;
+export type ZipEntry = Readonly<{
+    name: string;
+    uncompressedSize: number;
+    isDirectory: boolean;
+}>;
+export type PackageSourceResult = Readonly<{
+    archivePath: string;
+    sha256: string;
+    bytes: number;
+    /** All central-directory entries, including directory entries (`unzip -Z1` parity). */
+    entries: readonly string[];
+    /** File entries only (directories filtered out) — the `paths` sent to the Portal upload session. */
+    filePaths: readonly string[];
+    /** `git rev-parse HEAD` of the worktree the archive was produced from. */
+    gitRevision: string;
+    repoRoot: string;
+}>;
+export declare const ENTRY_LIMIT = 20000;
+export declare const MAX_FILE_BYTES: number;
+export declare const MAX_TOTAL_BYTES: number;
+export declare function isDeniedArchiveEntry(entryName: string): boolean;
+/**
+ * Reads entry names + uncompressed sizes from a ZIP's central directory —
+ * the same source `unzip -Z1` reads from, never from `git ls-tree` (a git
+ * tree cannot reflect `.gitattributes export-ignore` or `--allow-dirty`
+ * untracked additions the way the produced archive does).
+ */
+export declare function readZipCentralDirectoryEntries(buffer: Buffer): ZipEntry[];
+/** Pure policy evaluation over an already-read entry list — kept separate from I/O for fast unit tests. */
+export declare function evaluateArchiveEntries(entries: readonly ZipEntry[]): void;
+/** Recursively scans the worktree for credential-like files, mirroring the `find` guard in `scripts/package-source.sh`. */
+export declare function findCredentialLikeFiles(root: string): string[];
+/**
+ * Packages the git worktree at `options.cwd` into a zip archive, applying the
+ * same safety policy as `scripts/package-source.sh` (dirty-tree refusal,
+ * credential-file scan, denied-path/entry-count/size limits, required root
+ * entries), and reads the produced archive's entries from its ZIP central
+ * directory. Throws {@link PackagePolicyError} on any violation.
+ */
+export declare function packageSource(options: PackageSourceOptions): PackageSourceResult;
+//# sourceMappingURL=package-source.d.ts.map

package/dist/cli/lib/package-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-source.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/package-source.ts"],"names":[],"mappings":"AAMA;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAC1B,oBAAoB,GACpB,YAAY,GACZ,uBAAuB,GACvB,oBAAoB,GACpB,aAAa,GACb,wBAAwB,GACxB,wBAAwB,GACxB,sBAAsB,GACtB,oBAAoB,GACpB,qBAAqB,CAAC;AAEzB,qBAAa,kBAAmB,SAAQ,KAAK;aACC,IAAI,EAAE,iBAAiB;aAAkB,OAAO,EAAE,SAAS,MAAM,EAAE;gBAApG,OAAO,EAAE,MAAM,EAAkB,IAAI,EAAE,iBAAiB,EAAkB,OAAO,GAAE,SAAS,MAAM,EAAO;CAIrH;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAC3C,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC;IACZ,yFAAyF;IACzF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,UAAU,EAAE,OAAO,CAAC;IACpB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAElG,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,oGAAoG;IACpG,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH,eAAO,MAAM,WAAW,QAAS,CAAC;AAClC,eAAO,MAAM,cAAc,QAAmB,CAAC;AAC/C,eAAO,MAAM,eAAe,QAAoB,CAAC;AASjD,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAQ/D;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,CAmCzE;AAED,2GAA2G;AAC3G,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,GAAG,IAAI,CAkBzE;AAED,2HAA2H;AAC3H,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAmC9D;AAOD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,mBAAmB,CAqFhF"}