@proappstore/cli 2.6.42 → 2.6.43

package/dist/index.js

@@ -17,6 +17,7 @@ import { workerCommand } from './worker.js';
 import { hookCommand } from './hook.js';
 import { scheduleCommand } from './schedule.js';
 import { mcpAuthCommand } from './mcp-auth.js';
+import { sourcemapsCommand } from './sourcemaps.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8'));
 const program = new Command();
@@ -62,6 +63,7 @@ program.addCommand(workerCommand);
 program.addCommand(hookCommand);
 program.addCommand(scheduleCommand);
 program.addCommand(mcpAuthCommand);
+program.addCommand(sourcemapsCommand);
 program.parseAsync().catch((err) => {
     const msg = err instanceof Error ? err.message : String(err);
     process.stderr.write(`pas: ${msg}\n`);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;AAE3G,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,KAAK,CAAC;KACX,WAAW,CAAC,0DAA0D,CAAC;KACvE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,4FAA4F,CAAC;KACzG,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;KAC7C,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;KACrC,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC;KAC7D,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;KAC7E,MAAM,CAAC,qBAAqB,EAAE,oDAAoD,CAAC;KACnF,MAAM,CAAC,iBAAiB,EAAE,8FAA8F,CAAC;KACzH,MAAM,CAAC,eAAe,EAAE,6GAA6G,CAAC;KACtI,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAmJ,EAAE,EAAE;IACnL,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAElC,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,iFAAiF,CAAC;KAC9F,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;KACrF,MAAM,CAAC,uBAAuB,EAAE,iDAAiD,CAAC;KAClF,MAAM,CAAC,6BAA6B,EAAE,8CAA8C,CAAC;KACrF,MAAM,CAAC,eAAe,EAAE,oCAAoC,CAAC;KAC7D,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;KACxD,MAAM,CAAC,uBAAuB,EAAE,+DAA+D,CAAC;KAChG,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;KAC7E,MAAM,CAAC,KAAK,EAAE,IAAsI,EAAE,EAAE;IACvJ,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AACrC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AAEnC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC1C,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;AAE3G,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,KAAK,CAAC;KACX,WAAW,CAAC,0DAA0D,CAAC;KACvE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,4FAA4F,CAAC;KACzG,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;KAC7C,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;KACrC,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC;KAC7D,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;KAC7E,MAAM,CAAC,qBAAqB,EAAE,oDAAoD,CAAC;KACnF,MAAM,CAAC,iBAAiB,EAAE,8FAA8F,CAAC;KACzH,MAAM,CAAC,eAAe,EAAE,6GAA6G,CAAC;KACtI,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAmJ,EAAE,EAAE;IACnL,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAElC,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,iFAAiF,CAAC;KAC9F,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;KACrF,MAAM,CAAC,uBAAuB,EAAE,iDAAiD,CAAC;KAClF,MAAM,CAAC,6BAA6B,EAAE,8CAA8C,CAAC;KACrF,MAAM,CAAC,eAAe,EAAE,oCAAoC,CAAC;KAC7D,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;KACxD,MAAM,CAAC,uBAAuB,EAAE,+DAA+D,CAAC;KAChG,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;KAC7E,MAAM,CAAC,KAAK,EAAE,IAAsI,EAAE,EAAE;IACvJ,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AACrC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;AAEtC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC1C,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/sourcemaps.d.ts

@@ -0,0 +1,55 @@
+import { Command } from 'commander';
+/**
+ * `pas sourcemaps upload` (#393, ADR-008 decision 7): send a build's hidden
+ * source maps to the platform's PRIVATE store as one release bundle, then remove
+ * them from the build so the public upload never carries them.
+ *
+ * Keyless, like every deploy step: in GitHub Actions it mints the repository's
+ * OIDC token itself; `PAS_OIDC_TOKEN` may carry one minted elsewhere. No stored
+ * secret, and no session token — the platform accepts only the app repository's
+ * OIDC on main, for the commit the run is building.
+ *
+ * Bundle: `{ "files": { "<asset path>": <v3 source map> } }`, the asset path being
+ * the map's path in the build without `.map` (`assets/index-abc.js`). Limits match
+ * the platform's: 500 maps, 20 MB in total.
+ */
+export declare const API_BASE = "https://api.proappstore.online";
+export declare const MAX_FILES = 500;
+export declare const MAX_BUNDLE_BYTES: number;
+/** Every `*.map` under `dir`, as build-relative POSIX paths, sorted. */
+export declare function findSourceMaps(dir: string): string[];
+/** The release bundle for `dir`'s maps, refused (throws) when over the platform's limits or not JSON. */
+export declare function buildBundle(dir: string, maps?: string[]): {
+    body: Buffer;
+    count: number;
+    digest: string;
+};
+/** Delete `dir`'s maps so the public upload cannot carry them. Returns how many. */
+export declare function stripSourceMaps(dir: string, maps?: string[]): number;
+/** The GitHub OIDC token for the platform audience: `PAS_OIDC_TOKEN`, or minted from the Actions runtime. */
+export declare function oidcToken(env?: NodeJS.ProcessEnv, fetchImpl?: typeof fetch): Promise<string>;
+export type UploadOutcome = {
+    status: 'uploaded';
+    count: number;
+    digest: string;
+    expiresAt: number;
+} | {
+    status: 'exists';
+    count: number;
+    digest: string;
+};
+/**
+ * Upload the bundle for `commitSha` and verify the platform recorded exactly the
+ * bytes sent (its digest equals ours). A 409 means this commit's release already
+ * exists — immutable, so a re-run is not an error. Anything else throws.
+ */
+export declare function uploadSourceMaps(opts: {
+    dir: string;
+    appId: string;
+    commitSha: string;
+    token: string;
+    apiBase?: string | undefined;
+    fetchImpl?: typeof fetch;
+}): Promise<UploadOutcome>;
+export declare const sourcemapsCommand: Command;
+//# sourceMappingURL=sourcemaps.d.ts.map

package/dist/sourcemaps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sourcemaps.d.ts","sourceRoot":"","sources":["../src/sourcemaps.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;;;;;;;;;;;GAaG;AAEH,eAAO,MAAM,QAAQ,mCAAmC,CAAC;AACzD,eAAO,MAAM,SAAS,MAAM,CAAC;AAC7B,eAAO,MAAM,gBAAgB,QAAmB,CAAC;AAGjD,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAMpD;AAED,yGAAyG;AACzG,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,EAAwB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAkB9H;AAED,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,EAAwB,GAAG,MAAM,CAGzF;AAED,6GAA6G;AAC7G,wBAAsB,SAAS,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,EAAE,SAAS,GAAE,OAAO,KAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAWtH;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACxE;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC,aAAa,CAAC,CAczB;AASD,eAAO,MAAM,iBAAiB,SA4B3B,CAAC"}

package/dist/sourcemaps.js

@@ -0,0 +1,142 @@
+import { createHash } from 'node:crypto';
+import { readdirSync, readFileSync, statSync, unlinkSync } from 'node:fs';
+import { join, sep } from 'node:path';
+import { Command } from 'commander';
+/**
+ * `pas sourcemaps upload` (#393, ADR-008 decision 7): send a build's hidden
+ * source maps to the platform's PRIVATE store as one release bundle, then remove
+ * them from the build so the public upload never carries them.
+ *
+ * Keyless, like every deploy step: in GitHub Actions it mints the repository's
+ * OIDC token itself; `PAS_OIDC_TOKEN` may carry one minted elsewhere. No stored
+ * secret, and no session token — the platform accepts only the app repository's
+ * OIDC on main, for the commit the run is building.
+ *
+ * Bundle: `{ "files": { "<asset path>": <v3 source map> } }`, the asset path being
+ * the map's path in the build without `.map` (`assets/index-abc.js`). Limits match
+ * the platform's: 500 maps, 20 MB in total.
+ */
+export const API_BASE = 'https://api.proappstore.online';
+export const MAX_FILES = 500;
+export const MAX_BUNDLE_BYTES = 20 * 1024 * 1024;
+const COMMIT_SHA_RE = /^[0-9a-f]{40}$/;
+/** Every `*.map` under `dir`, as build-relative POSIX paths, sorted. */
+export function findSourceMaps(dir) {
+    return readdirSync(dir, { recursive: true })
+        .map(String)
+        .filter((f) => f.endsWith('.map') && statSync(join(dir, f)).isFile())
+        .map((f) => f.split(sep).join('/'))
+        .sort();
+}
+/** The release bundle for `dir`'s maps, refused (throws) when over the platform's limits or not JSON. */
+export function buildBundle(dir, maps = findSourceMaps(dir)) {
+    if (maps.length === 0)
+        throw new Error(`no *.map files in ${dir} — build with source maps (vite: build.sourcemap: 'hidden')`);
+    if (maps.length > MAX_FILES)
+        throw new Error(`${maps.length} source maps — the platform takes at most ${MAX_FILES} per release`);
+    let total = 0;
+    const files = {};
+    for (const rel of maps) {
+        const raw = readFileSync(join(dir, rel));
+        total += raw.length;
+        if (total > MAX_BUNDLE_BYTES)
+            throw new Error(`source maps exceed ${MAX_BUNDLE_BYTES / 1024 / 1024} MB in total — refusing to upload`);
+        try {
+            files[rel.slice(0, -'.map'.length)] = JSON.parse(raw.toString('utf8'));
+        }
+        catch {
+            throw new Error(`${rel} is not a JSON source map`);
+        }
+    }
+    const body = Buffer.from(JSON.stringify({ files }));
+    if (body.length > MAX_BUNDLE_BYTES)
+        throw new Error(`source-map bundle exceeds ${MAX_BUNDLE_BYTES / 1024 / 1024} MB — refusing to upload`);
+    return { body, count: maps.length, digest: createHash('sha256').update(body).digest('hex') };
+}
+/** Delete `dir`'s maps so the public upload cannot carry them. Returns how many. */
+export function stripSourceMaps(dir, maps = findSourceMaps(dir)) {
+    for (const rel of maps)
+        unlinkSync(join(dir, rel));
+    return maps.length;
+}
+/** The GitHub OIDC token for the platform audience: `PAS_OIDC_TOKEN`, or minted from the Actions runtime. */
+export async function oidcToken(env = process.env, fetchImpl = fetch) {
+    if (env.PAS_OIDC_TOKEN)
+        return env.PAS_OIDC_TOKEN;
+    const url = env.ACTIONS_ID_TOKEN_REQUEST_URL;
+    const bearer = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+    if (!url || !bearer) {
+        throw new Error('no OIDC token: run in GitHub Actions with `permissions: id-token: write` (keyless; no stored secret is accepted)');
+    }
+    const res = await fetchImpl(`${url}&audience=${encodeURIComponent(API_BASE)}`, { headers: { Authorization: `bearer ${bearer}` } });
+    const value = res.ok ? (await res.json()).value : undefined;
+    if (!value)
+        throw new Error(`could not obtain an OIDC token (HTTP ${res.status})`);
+    return value;
+}
+/**
+ * Upload the bundle for `commitSha` and verify the platform recorded exactly the
+ * bytes sent (its digest equals ours). A 409 means this commit's release already
+ * exists — immutable, so a re-run is not an error. Anything else throws.
+ */
+export async function uploadSourceMaps(opts) {
+    const commitSha = opts.commitSha.toLowerCase();
+    if (!COMMIT_SHA_RE.test(commitSha))
+        throw new Error('--commit must be a 40-character commit SHA');
+    const { body, count, digest } = buildBundle(opts.dir);
+    const res = await (opts.fetchImpl ?? fetch)(`${opts.apiBase ?? API_BASE}/v1/apps/${encodeURIComponent(opts.appId)}/sourcemaps?commitSha=${commitSha}`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${opts.token}`, 'Content-Type': 'application/json' },
+        body,
+    });
+    if (res.status === 409)
+        return { status: 'exists', count, digest };
+    const json = (await res.json().catch(() => ({})));
+    if (res.status !== 201)
+        throw new Error(`upload refused (HTTP ${res.status}): ${json.error ?? 'no detail'}`);
+    if (json.assetDigest !== digest)
+        throw new Error(`manifest digest ${json.assetDigest ?? '(none)'} does not match the uploaded bundle ${digest}`);
+    return { status: 'uploaded', count, digest, expiresAt: json.expiresAt ?? 0 };
+}
+function defaultDir() {
+    for (const d of ['web/dist', 'dist']) {
+        try {
+            if (statSync(d).isDirectory())
+                return d;
+        }
+        catch { /* next */ }
+    }
+    return 'dist';
+}
+export const sourcemapsCommand = new Command('sourcemaps')
+    .description('Private browser source maps for crash symbolication (ADR-008 decision 7).')
+    .addCommand(new Command('upload')
+    .description("Upload a build's source maps to the platform's private store, then remove them from the build.")
+    .option('--dir <dir>', 'build output directory (default: web/dist or dist)')
+    .option('--app <appId>', 'app id (default: the GitHub repository name)')
+    .option('--commit <sha>', 'commit the build was made from (default: $GITHUB_SHA)')
+    .option('--keep-maps', 'do not delete the maps from the build afterwards')
+    .action(async (opts) => {
+    const dir = opts.dir ?? defaultDir();
+    const appId = opts.app ?? process.env.GITHUB_REPOSITORY?.split('/')[1] ?? '';
+    const commitSha = opts.commit ?? process.env.GITHUB_SHA ?? '';
+    const maps = findSourceMaps(dir);
+    try {
+        if (!appId)
+            throw new Error('--app is required outside GitHub Actions');
+        const outcome = await uploadSourceMaps({ dir, appId, commitSha, token: await oidcToken(), apiBase: process.env.PAS_API_URL });
+        process.stdout.write(outcome.status === 'uploaded'
+            ? `✓ Uploaded ${outcome.count} source map(s) for ${appId}@${commitSha.slice(0, 7)} (sha256 ${outcome.digest.slice(0, 12)}…, verified)\n`
+            : `✓ Source maps for ${appId}@${commitSha.slice(0, 7)} were already uploaded (releases are immutable)\n`);
+    }
+    catch (e) {
+        process.stderr.write(`✗ ${e.message}\n`);
+        process.exitCode = 1;
+    }
+    finally {
+        // Whatever happened above, the maps must not reach the public upload.
+        if (!opts.keepMaps)
+            process.stdout.write(`Removed ${stripSourceMaps(dir, maps)} source map(s) from ${dir}\n`);
+    }
+}));
+//# sourceMappingURL=sourcemaps.js.map

package/dist/sourcemaps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sourcemaps.js","sourceRoot":"","sources":["../src/sourcemaps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;;;;;;;;;;;GAaG;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,gCAAgC,CAAC;AACzD,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,CAAC;AAC7B,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACjD,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAEvC,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAQ,WAAW,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAc;SACvD,GAAG,CAAC,MAAM,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACpE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SAClC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,OAAiB,cAAc,CAAC,GAAG,CAAC;IAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,6DAA6D,CAAC,CAAC;IAC9H,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,6CAA6C,SAAS,cAAc,CAAC,CAAC;IACjI,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACzC,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC;QACpB,IAAI,KAAK,GAAG,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,gBAAgB,GAAG,IAAI,GAAG,IAAI,mCAAmC,CAAC,CAAC;QACvI,IAAI,CAAC;YACH,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,2BAA2B,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,MAAM,GAAG,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,gBAAgB,GAAG,IAAI,GAAG,IAAI,0BAA0B,CAAC,CAAC;IAC3I,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC/F,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,OAAiB,cAAc,CAAC,GAAG,CAAC;IAC/E,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,6GAA6G;AAC7G,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,YAA0B,KAAK;IACnG,IAAI,GAAG,CAAC,cAAc;QAAE,OAAO,GAAG,CAAC,cAAc,CAAC;IAClD,MAAM,GAAG,GAAG,GAAG,CAAC,4BAA4B,CAAC;IAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,8BAA8B,CAAC;IAClD,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,kHAAkH,CAAC,CAAC;IACtI,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,GAAG,aAAa,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACnI,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC;AACf,CAAC;AAMD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAOtC;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAClG,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,YAAY,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,yBAAyB,SAAS,EAAE,EAAE;QACrJ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QACtF,IAAI;KACL,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACnE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAiE,CAAC;IAClH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC,CAAC;IAC7G,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,WAAW,IAAI,QAAQ,uCAAuC,MAAM,EAAE,CAAC,CAAC;IACjJ,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,UAAU;IACjB,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;gBAAE,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,OAAO,CAAC,YAAY,CAAC;KACvD,WAAW,CAAC,2EAA2E,CAAC;KACxF,UAAU,CACT,IAAI,OAAO,CAAC,QAAQ,CAAC;KAClB,WAAW,CAAC,gGAAgG,CAAC;KAC7G,MAAM,CAAC,aAAa,EAAE,oDAAoD,CAAC;KAC3E,MAAM,CAAC,eAAe,EAAE,8CAA8C,CAAC;KACvE,MAAM,CAAC,gBAAgB,EAAE,uDAAuD,CAAC;KACjF,MAAM,CAAC,aAAa,EAAE,kDAAkD,CAAC;KACzE,MAAM,CAAC,KAAK,EAAE,IAAyE,EAAE,EAAE;IAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9H,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU;YAChD,CAAC,CAAC,cAAc,OAAO,CAAC,KAAK,sBAAsB,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB;YACxI,CAAC,CAAC,qBAAqB,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,mDAAmD,CAAC,CAAC;IAC9G,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAM,CAAW,CAAC,OAAO,IAAI,CAAC,CAAC;QACpD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,sEAAsE;QACtE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAChH,CAAC;AACH,CAAC,CAAC,CACL,CAAC"}

package/dist/sourcemaps.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sourcemaps.test.d.ts.map

package/dist/sourcemaps.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sourcemaps.test.d.ts","sourceRoot":"","sources":["../src/sourcemaps.test.ts"],"names":[],"mappings":""}

package/dist/sourcemaps.test.js

@@ -0,0 +1,83 @@
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { buildBundle, findSourceMaps, MAX_BUNDLE_BYTES, oidcToken, sourcemapsCommand, stripSourceMaps, uploadSourceMaps } from './sourcemaps.js';
+// #393: one private release bundle per commit, verified against the platform's
+// manifest digest, keyless, and the maps never left in the build afterwards.
+const SHA = 'a'.repeat(40);
+const map = { version: 3, sources: ['src/App.tsx'], names: [], mappings: 'AASI' };
+function build(extra = {}) {
+    const dir = mkdtempSync(join(tmpdir(), 'pas-maps-'));
+    mkdirSync(join(dir, 'assets'));
+    writeFileSync(join(dir, 'index.html'), '<html></html>');
+    writeFileSync(join(dir, 'assets/index-abc.js'), 'x()');
+    writeFileSync(join(dir, 'assets/index-abc.js.map'), JSON.stringify(map));
+    writeFileSync(join(dir, 'assets/vendor-1.js.map'), JSON.stringify(map));
+    for (const [f, c] of Object.entries(extra))
+        writeFileSync(join(dir, f), c);
+    return dir;
+}
+const digestOf = (dir) => createHash('sha256').update(buildBundle(dir).body).digest('hex');
+afterEach(() => { vi.restoreAllMocks(); process.exitCode = undefined; });
+describe('pas sourcemaps upload (#393)', () => {
+    it('sends one bundle keyed by asset path to the release endpoint, with the OIDC bearer, and verifies the digest', async () => {
+        const dir = build();
+        const sent = [];
+        const fetchImpl = vi.fn(async (url, init) => {
+            sent.push({ url: String(url), init: init });
+            return Response.json({ assetDigest: digestOf(dir), expiresAt: 123 }, { status: 201 });
+        });
+        const out = await uploadSourceMaps({ dir, appId: 'map-demo', commitSha: SHA, token: 'oidc-jwt', apiBase: 'https://api.test', fetchImpl });
+        expect(out).toEqual({ status: 'uploaded', count: 2, digest: digestOf(dir), expiresAt: 123 });
+        expect(sent[0].url).toBe(`https://api.test/v1/apps/map-demo/sourcemaps?commitSha=${SHA}`);
+        expect(sent[0].init.headers.Authorization).toBe('Bearer oidc-jwt');
+        expect(Object.keys(JSON.parse(String(sent[0].init.body)).files)).toEqual(['assets/index-abc.js', 'assets/vendor-1.js']);
+    });
+    it('a digest the platform did not record for these bytes is an error; a 409 is an existing immutable release', async () => {
+        const dir = build();
+        const wrong = vi.fn(async () => Response.json({ assetDigest: 'f'.repeat(64) }, { status: 201 }));
+        await expect(uploadSourceMaps({ dir, appId: 'map-demo', commitSha: SHA, token: 't', fetchImpl: wrong })).rejects.toThrow(/does not match/);
+        const exists = vi.fn(async () => new Response(null, { status: 409 }));
+        expect((await uploadSourceMaps({ dir, appId: 'map-demo', commitSha: SHA, token: 't', fetchImpl: exists })).status).toBe('exists');
+    });
+    it('refuses before uploading: oversized maps, non-JSON maps, no maps, a bad commit', async () => {
+        const fetchImpl = vi.fn();
+        const big = build({ 'huge.js.map': 'x'.repeat(MAX_BUNDLE_BYTES + 1) });
+        await expect(uploadSourceMaps({ dir: big, appId: 'a', commitSha: SHA, token: 't', fetchImpl })).rejects.toThrow(/exceed/);
+        const bad = build({ 'bad.js.map': 'not json' });
+        await expect(uploadSourceMaps({ dir: bad, appId: 'a', commitSha: SHA, token: 't', fetchImpl })).rejects.toThrow(/not a JSON source map/);
+        const none = mkdtempSync(join(tmpdir(), 'pas-maps-'));
+        await expect(uploadSourceMaps({ dir: none, appId: 'a', commitSha: SHA, token: 't', fetchImpl })).rejects.toThrow(/no \*\.map files/);
+        await expect(uploadSourceMaps({ dir: build(), appId: 'a', commitSha: 'main', token: 't', fetchImpl })).rejects.toThrow(/40-character/);
+        expect(fetchImpl).not.toHaveBeenCalled();
+    });
+    it('stripSourceMaps removes every map and nothing else', () => {
+        const dir = build();
+        expect(stripSourceMaps(dir)).toBe(2);
+        expect(findSourceMaps(dir)).toEqual([]);
+        expect(existsSync(join(dir, 'assets/index-abc.js'))).toBe(true);
+        expect(existsSync(join(dir, 'index.html'))).toBe(true);
+    });
+    it('is keyless: uses PAS_OIDC_TOKEN or mints from the Actions runtime; refuses with neither', async () => {
+        expect(await oidcToken({ PAS_OIDC_TOKEN: 'jwt' })).toBe('jwt');
+        const fetchImpl = vi.fn(async () => Response.json({ value: 'minted' }));
+        expect(await oidcToken({ ACTIONS_ID_TOKEN_REQUEST_URL: 'https://gh.test/token?x=1', ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'rt' }, fetchImpl)).toBe('minted');
+        expect(fetchImpl.mock.calls[0][0]).toBe('https://gh.test/token?x=1&audience=https%3A%2F%2Fapi.proappstore.online');
+        await expect(oidcToken({})).rejects.toThrow(/GitHub Actions/);
+    });
+    it('the command exits non-zero on a refused upload and still strips the maps from the build', async () => {
+        const dir = build();
+        vi.stubEnv('PAS_OIDC_TOKEN', 'jwt');
+        vi.spyOn(globalThis, 'fetch').mockResolvedValue(Response.json({ error: 'repository not authorized' }, { status: 403 }));
+        const err = vi.spyOn(process.stderr, 'write').mockImplementation(() => true);
+        vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        await sourcemapsCommand.parseAsync(['upload', '--dir', dir, '--app', 'map-demo', '--commit', SHA], { from: 'user' });
+        expect(process.exitCode).toBe(1);
+        expect(String(err.mock.calls[0][0])).toContain('upload refused (HTTP 403)');
+        expect(findSourceMaps(dir)).toEqual([]);
+        vi.unstubAllEnvs();
+    });
+});
+//# sourceMappingURL=sourcemaps.test.js.map

package/dist/sourcemaps.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sourcemaps.test.js","sourceRoot":"","sources":["../src/sourcemaps.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,SAAS,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEjJ,+EAA+E;AAC/E,6EAA6E;AAE7E,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC3B,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAElF,SAAS,KAAK,CAAC,QAAgC,EAAE;IAC/C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IACrD,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/B,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,eAAe,CAAC,CAAC;IACxD,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,EAAE,KAAK,CAAC,CAAC;IACvD,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,yBAAyB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,wBAAwB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3E,OAAO,GAAG,CAAC;AACb,CAAC;AACD,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEnG,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAEzE,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,6GAA6G,EAAE,KAAK,IAAI,EAAE;QAC3H,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,GAAyC,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAA2B,EAAE,IAAkB,EAAE,EAAE;YAChF,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAK,EAAE,CAAC,CAAC;YAC7C,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,CAAC,CAA4B,CAAC;QAC9B,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1I,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,0DAA0D,GAAG,EAAE,CAAC,CAAC;QAC3F,MAAM,CAAE,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,OAAkC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC3H,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0GAA0G,EAAE,KAAK,IAAI,EAAE;QACxH,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAA4B,CAAC;QAC5H,MAAM,MAAM,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC3I,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAA4B,CAAC;QACjG,MAAM,CAAC,CAAC,MAAM,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpI,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAA6B,CAAC;QACrD,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,MAAM,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1H,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;QAChD,MAAM,MAAM,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACzI,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QACtD,MAAM,MAAM,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACrI,MAAM,MAAM,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACvI,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,CAAC,MAAM,SAAS,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAA4B,CAAC;QACnG,MAAM,CAAC,MAAM,SAAS,CAAC,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvJ,MAAM,CAAE,SAAwD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QACpK,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QACpC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACxH,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7E,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACrH,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QAC7E,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxC,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proappstore/cli",
-  "version": "2.6.42",
+  "version": "2.6.43",
   "description": "pas — CLI for publishing paid apps to proappstore.online",
   "license": "MIT",
   "type": "module",