@solana-mobile/dapp-store-cli 0.16.0 → 0.16.1

package/src/CliSetup.ts

@@ -1,544 +1,409 @@
-import { Command } from "commander";
-import { validateCommand } from "./commands/index.js";
-import { createAppCommand, createReleaseCommand } from "./commands/create/index.js";
-import {
-  publishRemoveCommand,
-  publishSubmitCommand,
-  publishSupportCommand,
-  publishUpdateCommand
-} from "./commands/publish/index.js";
+import { randomUUID } from 'node:crypto';
+import path from 'node:path';
+
+import * as dotenv from 'dotenv';
+import { Command, Option } from 'commander';
+
 import {
   checkForSelfUpdate,
-  checkSubmissionNetwork,
   Constants,
-  alphaAppSubmissionMessage,
-  dryRunSuccessMessage,
-  generateNetworkSuffix,
+  createPortalAttestationClient,
+  createPortalWorkflowClient,
+  createPublicationSignerFromKeypair,
   parseKeypair,
   showMessage,
-  showNetworkWarningIfApplicable
-} from "./CliUtils.js";
-import * as dotenv from "dotenv";
-import { initScaffold } from "./commands/scaffolding/index.js";
-import { loadPublishDetails, loadPublishDetailsWithChecks } from "./config/PublishDetails.js";
+} from './CliUtils.js';
+import {
+  DEFAULT_API_KEY_ENV,
+  DEFAULT_PRODUCTION_PORTAL_URL,
+  resolveApiKey,
+  resolvePortalTargets,
+  validateNewVersionArgs,
+  validateResumeArgs,
+  type NewVersionCliOptions,
+  type ResumeCliOptions,
+  type ResolvedPortalTargets,
+} from './publication/cliValidation.js';
+import { createPublicationProgressReporter } from './publication/PublicationProgressReporter.js';
+import { extractPublicationSummaryLines } from './publication/publicationSummary.js';
+import { runPublicationWorkflow } from './publication/runPublicationWorkflow.js';
+import { ensurePublicationSignerBalance } from './publication/fundingPreflight.js';
+import type {
+  PublicationResumeInput,
+  PublicationWorkflowInput,
+} from './publication/runPublicationWorkflow.js';
+import type { Keypair } from '@solana/web3.js';
 
 dotenv.config();
 
-const hasAddressInConfig = ({ address }: { address: string }) => {
-  return !!address;
-};
-
 export const mainCli = new Command();
 
-function resolveBuildToolsPath(buildToolsPath: string | undefined) {
-  // If a path was specified on the command line, use that
-  if (buildToolsPath !== undefined) {
-    return buildToolsPath;
-  }
-
-  // If a path is specified in a .env file, use that
-  if (process.env.ANDROID_TOOLS_DIR !== undefined) {
-    return process.env.ANDROID_TOOLS_DIR;
-  }
-
-  // No path was specified
-  return;
-}
-
-/**
- * This method should be updated with each new release of the CLI, and just do nothing when there isn't anything to report
- */
-function latestReleaseMessage() {
-  const messages = [
-    `- Banner Graphic image of size 1200x600px is now manadatory for publishing updates.`,
-    `- Feature Graphic image of size 1200x1200px is required to be featured in Editor's choice carousel. (optional)`,
-    `- Release metadata now publishes publisher.support_email when provided; otherwise we reuse publisher.email for end-user support.`,
-  ].join('\n\n')
-  showMessage(
-    `Publishing Tools Version ${ Constants.CLI_VERSION }`,
-    messages,
-    "warning"
-  );
-}
-
-async function tryWithErrorMessage(block: () => Promise<any>) {
-  try {
-    await block()
-  } catch (e) {
-    const errorMsg = (e as Error | null)?.message ?? "";
-
-    showMessage("Error", errorMsg, "error");
-    process.exit(-1)
-  }
-}
-
 mainCli
-  .name("dapp-store")
+  .name('dapp-store')
   .version(Constants.CLI_VERSION)
-  .description("CLI to assist with publishing to the Saga Dapp Store")
+  .description('Portal-backed CLI for Solana Mobile dApp version publishing')
+  .showHelpAfterError();
 
-export const initCliCmd = mainCli
-  .command("init")
-  .description("First-time initialization of tooling configuration")
-  .action(async () => {
-    await tryWithErrorMessage(async () => {
-      const msg = initScaffold();
-
-      showMessage("Initialized", msg);
-    })
-  });
-
-export const createCliCmd = mainCli
-  .command("create")
-  .description("Create a `app`, or `release`")
-
-createCliCmd.addHelpText(
-  "after",
-  [
-    "",
-    "Release metadata notes:",
-    "  We include publisher.support_email when provided; if omitted we fall back to publisher.email.",
-  ].join("\n")
-);
-
-export const createAppCliCmd = createCliCmd
-  .command("app")
-  .description("Create a app")
-  .requiredOption(
-    "-k, --keypair <path-to-keypair-file>",
-    "Path to keypair file"
-  )
-  .option("-u, --url <url>", "RPC URL", Constants.DEFAULT_RPC_DEVNET)
-  .option("-d, --dry-run", "Flag for dry run. Doesn't mint an NFT")
-  .option("-s, --storage-config <storage-config>", "Provide alternative storage configuration details")
-  .option("-p, --priority-fee-lamports <priority-fee-lamports>", "Priority Fee lamports")
-  .action(async ({keypair, url, dryRun, storageConfig, priorityFeeLamports }) => {
-    await tryWithErrorMessage(async () => {
-      showNetworkWarningIfApplicable(url)
-      latestReleaseMessage();
-      await checkForSelfUpdate();
-
-      const signer = parseKeypair(keypair);
-      if (signer) {
-        const result = await createAppCommand({
-          signer,
-          url,
-          dryRun,
-          storageParams: storageConfig,
-          priorityFeeLamports: priorityFeeLamports,
-        });
-
-        if (dryRun) {
-          dryRunSuccessMessage()
-        } else {
-          const displayUrl = `https://explorer.solana.com/address/${result.appAddress}${generateNetworkSuffix(url)}`;
-          const transactionUrl = `https://explorer.solana.com/tx/${result.transactionSignature}${generateNetworkSuffix(url)}`;
-          const resultText = `App NFT successfully minted:\n${displayUrl}\n${transactionUrl}`;  
-          showMessage("Success", resultText);
-        }
-      }
-    });
-  });
-
-export const createReleaseCliCmd = createCliCmd
-  .command("release")
-  .description("Create a release")
-  .requiredOption(
-    "-k, --keypair <path-to-keypair-file>",
-    "Path to keypair file"
+mainCli
+  .option('--apk-file <path>', 'Path to the APK file to publish')
+  .option('--apk-url <url>', 'HTTPS URL for an externally hosted APK')
+  .option('--whats-new <text>', 'What changed in this version')
+  .option('--portal-url <url>', 'Publishing portal base URL')
+  .option(
+    '--api-key-env <name>',
+    'Environment variable that contains the portal API key',
+    DEFAULT_API_KEY_ENV,
   )
   .option(
-    "-a, --app-mint-address <app-mint-address>",
-    "The mint address of the app NFT"
+    '--api-key-stdin',
+    'Read the portal API key from stdin instead of an env var',
   )
-  .option("-u, --url <url>", "RPC URL", Constants.DEFAULT_RPC_DEVNET)
-  .option("-d, --dry-run", "Flag for dry run. Doesn't mint an NFT")
+  .option('--keypair <path>', 'Path to the Solana signer keypair')
+  .addOption(new Option('--rpc-url <url>', 'Solana RPC URL').hideHelp())
+  .option('--local-dev', 'Allow localhost portal endpoints and skip gating')
   .option(
-    "-b, --build-tools-path <build-tools-path>",
-    "Path to Android build tools which contains AAPT2"
+    '--skip-self-update',
+    'Bypass the self-update check when working against a local portal',
   )
-  .option("-s, --storage-config <storage-config>", "Provide alternative storage configuration details")
-  .option("-p, --priority-fee-lamports <priority-fee-lamports>", "Priority Fee lamports")
-  .action(async ({ appMintAddress, keypair, url, dryRun, buildToolsPath, storageConfig, priorityFeeLamports }) => {
-    await tryWithErrorMessage(async () => {
-        showNetworkWarningIfApplicable(url)
-        latestReleaseMessage();
-        await checkForSelfUpdate();
-
-        const resolvedBuildToolsPath = resolveBuildToolsPath(buildToolsPath);
-        if (resolvedBuildToolsPath === undefined) {
-          throw new Error("Please specify an Android build tools directory in the .env file or via the command line argument.")
-        }
-
-        const config = await loadPublishDetailsWithChecks();
-        if (!hasAddressInConfig(config.app) && !appMintAddress) {
-          throw new Error("Either specify an app mint address in the config file or specify as a CLI argument to this command")
-        }
-
-        const signer = parseKeypair(keypair);
-        if (signer) {
-          const result = await createReleaseCommand({
-            appMintAddress: appMintAddress,
-            buildToolsPath: resolvedBuildToolsPath,
-            signer,
-            url,
-            dryRun,
-            storageParams: storageConfig,
-            priorityFeeLamports: priorityFeeLamports
-          });
-
-          if (dryRun) {
-            dryRunSuccessMessage()
-          } else {
-            const displayUrl = `https://explorer.solana.com/address/${result?.releaseAddress}${generateNetworkSuffix(url)}`;
-            const transactionUrl = `https://explorer.solana.com/tx/${result.transactionSignature}${generateNetworkSuffix(url)}`;
-            const resultText = `Release NFT successfully minted:\n${displayUrl}\n${transactionUrl}`;
-
-            showMessage("Success", resultText);
-          }
-        }
-      });
-    }
-  );
-
-mainCli
-  .command("validate")
-  .description("Validates details prior to publishing")
-  .requiredOption(
-    "-k, --keypair <path-to-keypair-file>",
-    "Path to keypair file"
+  .option(
+    '--idempotency-key <key>',
+    'Optional idempotency key for safe retries',
   )
   .option(
-    "-b, --build-tools-path <build-tools-path>",
-    "Path to Android build tools which contains AAPT2"
+    '--verbose',
+    'Print detailed publication identifiers as they are emitted',
   )
-  .action(async ({ keypair, buildToolsPath }) => {
-    await tryWithErrorMessage(async () => {
-      latestReleaseMessage();
-      await checkForSelfUpdate();
-
-      const resolvedBuildToolsPath = resolveBuildToolsPath(buildToolsPath);
-      if (resolvedBuildToolsPath === undefined) {
-        throw new Error("Please specify an Android build tools directory in the .env file or via the command line argument.")
-      }
-
-      const signer = parseKeypair(keypair);
-      if (signer) {
-        await validateCommand({
-          signer,
-          buildToolsPath: resolvedBuildToolsPath,
-        });
-      }
-    });
+  .action(async () => {
+    await runRootAction();
   });
 
-const publishCommand = mainCli
-  .command("publish")
-  .description(
-    "Submit a publishing request (`submit`, `update`, `remove`, or `support`) to the Solana Mobile dApp publisher portal"
-  );
+const resumeCommand = mainCli.command('resume');
 
-publishCommand
-  .command("submit")
-  .description("Submit a new app to the Solana Mobile dApp publisher portal")
-  .requiredOption(
-    "-k, --keypair <path-to-keypair-file>",
-    "Path to keypair file"
-  )
-  .requiredOption(
-    "--complies-with-solana-dapp-store-policies",
-    "An attestation that the app complies with the Solana dApp Store policies"
-  )
-  .requiredOption(
-    "--requestor-is-authorized",
-    "An attestation that the party making this Solana dApp publisher portal request is authorized to do so"
+resumeCommand
+  .description('Resume a partially completed publication session')
+  .option('--release-id <id>', 'Publication release identifier')
+  .option('--resume-release <id>', 'Alias for --release-id')
+  .option('--session-id <id>', 'Publication session identifier')
+  .option('--resume-session <id>', 'Alias for --session-id')
+  .option('--portal-url <url>', 'Publishing portal base URL')
+  .option(
+    '--api-key-env <name>',
+    'Environment variable that contains the portal API key',
+    DEFAULT_API_KEY_ENV,
   )
   .option(
-    "-a, --app-mint-address <app-mint-address>",
-    "The mint address of the app NFT. If not specified, the value from your config file will be used."
+    '--api-key-stdin',
+    'Read the portal API key from stdin instead of an env var',
   )
+  .option('--keypair <path>', 'Path to the Solana signer keypair')
+  .addOption(new Option('--rpc-url <url>', 'Solana RPC URL').hideHelp())
+  .option('--local-dev', 'Allow localhost portal endpoints and skip gating')
   .option(
-    "-r, --release-mint-address <release-mint-address>",
-    "The mint address of the release NFT. If not specified, the value from your config file will be used."
+    '--skip-self-update',
+    'Bypass the self-update check when working against a local portal',
   )
-  .option("-u, --url <url>", "RPC URL", Constants.DEFAULT_RPC_DEVNET)
   .option(
-    "-d, --dry-run",
-    "Flag for dry run. Doesn't submit the request to the publisher portal."
+    '--verbose',
+    'Print detailed publication identifiers as they are emitted',
   )
-  .option("-l, --alpha", "Flag to mark the submission as alpha test.")
-  .action(
-    async ({
-             appMintAddress,
-             releaseMintAddress,
-             keypair,
-             url,
-             compliesWithSolanaDappStorePolicies,
-             requestorIsAuthorized,
-             dryRun,
-             alpha,
-           }) => {
-      await tryWithErrorMessage(async () => {
-        await checkForSelfUpdate();
-        checkSubmissionNetwork(url);
-
-        const config = await loadPublishDetails(Constants.getConfigFilePath());
-
-        if (!hasAddressInConfig(config.release) && !releaseMintAddress) {
-          throw new Error("Either specify a release mint address in the config file or specify as a CLI argument to this command.")
-        }
-
-        if (alpha) {
-          alphaAppSubmissionMessage()
-        }
-
-        const signer = parseKeypair(keypair);
-        if (signer) {
-          if (config.lastUpdatedVersionOnStore != null && config.lastSubmittedVersionOnChain.address != null) {
-              await publishUpdateCommand({
-                appMintAddress: appMintAddress,
-                releaseMintAddress: releaseMintAddress,
-                signer: signer,
-                url: url,
-                dryRun: dryRun,
-                compliesWithSolanaDappStorePolicies: compliesWithSolanaDappStorePolicies,
-                requestorIsAuthorized: requestorIsAuthorized,
-                critical: false,
-                alphaTest: alpha,
-              });
-          } else {
-            await publishSubmitCommand({
-              appMintAddress: appMintAddress,
-              releaseMintAddress: releaseMintAddress,
-              signer: signer,
-              url: url,
-              dryRun: dryRun,
-              compliesWithSolanaDappStorePolicies: compliesWithSolanaDappStorePolicies,
-              requestorIsAuthorized: requestorIsAuthorized,
-              alphaTest: alpha,
-            });
-          }
-
-          if (dryRun) {
-            dryRunSuccessMessage()
-          } else {
-            showMessage("Success", "Successfully submitted to the Solana Mobile dApp publisher portal");
-          }
-        }
-      });
+  .action(async (options: ResumeCliOptions) => {
+    await runResumeAction(options);
+  });
+
+mainCli.addHelpText(
+  'after',
+  [
+    '',
+    'Usage:',
+    '  dapp-store --apk-file ./app.apk --whats-new "Bug fixes"',
+    '  dapp-store --apk-url https://example.com/app.apk --whats-new "Bug fixes"',
+    '  dapp-store resume --release-id <release-id> [--session-id <session-id>]',
+    '',
+    'Portal:',
+    '  Set DAPP_STORE_PORTAL_URL to the portal origin (for example https://staging.publish.solanamobile.com).',
+    '  The CLI derives the /api endpoint from that URL for the active publication workflow.',
+    `  If unset, it defaults to ${DEFAULT_PRODUCTION_PORTAL_URL}.`,
+    '  The target app must already exist in the portal and already have its App NFT.',
+    '  The portal decides whether the submission is the first release for an existing app or a later update.',
+    '',
+    'Secrets:',
+    `  Portal API key defaults to ${DEFAULT_API_KEY_ENV} or the name passed via --api-key-env.`,
+    '  Use --api-key-stdin to read the portal API key from stdin.',
+    '',
+    'Local development:',
+    '  Pass --local-dev to allow localhost portal endpoints and to skip self-update gating.',
+    '  Local-dev mode rejects non-local portal URLs.',
+  ].join('\n'),
+);
+
+async function runRootAction() {
+  await runWithUserFacingErrors(async () => {
+    const options = mainCli.opts() as NewVersionCliOptions;
+
+    if (!hasPublicationInputs(options)) {
+      mainCli.outputHelp();
+      return;
     }
-  );
 
-publishCommand
-  .command("update")
-  .description(
-    "Update an existing app on the Solana Mobile dApp publisher portal"
-  )
-  .requiredOption(
-    "-k, --keypair <path-to-keypair-file>",
-    "Path to keypair file"
-  )
-  .requiredOption(
-    "--complies-with-solana-dapp-store-policies",
-    "An attestation that the app complies with the Solana dApp Store policies"
-  )
-  .requiredOption(
-    "--requestor-is-authorized",
-    "An attestation that the party making this Solana dApp publisher portal request is authorized to do so"
-  )
-  .option(
-    "-a, --app-mint-address <app-mint-address>",
-    "The mint address of the app NFT. If not specified, the value from your config file will be used."
-  )
-  .option(
-    "-r, --release-mint-address <release-mint-address>",
-    "The mint address of the release NFT. If not specified, the value from your config file will be used."
-  )
-  .option("-c, --critical", "Flag for a critical app update request")
-  .option("-u, --url <url>", "RPC URL", Constants.DEFAULT_RPC_DEVNET)
-  .option(
-    "-d, --dry-run",
-    "Flag for dry run. Doesn't submit the request to the publisher portal."
-  )
-  .option("-l, --alpha", "Flag to mark the submission as alpha test.")
-  .action(
-    async ({
-             appMintAddress,
-             releaseMintAddress,
-             keypair,
-             url,
-             compliesWithSolanaDappStorePolicies,
-             requestorIsAuthorized,
-             critical,
-             dryRun,
-             alpha,
-           }) => {
-      await tryWithErrorMessage(async () => {
-        await checkForSelfUpdate();
-        checkSubmissionNetwork(url);
-
-        const config = await loadPublishDetails(Constants.getConfigFilePath())
-
-        if (!hasAddressInConfig(config.release) && !releaseMintAddress) {
-          throw new Error("Either specify a release mint address in the config file or specify as a CLI argument to this command.")
-        }
-
-        if (alpha) {
-          alphaAppSubmissionMessage()
-        }
-
-        const signer = parseKeypair(keypair);
-        if (signer) {
-          await publishUpdateCommand({
-            appMintAddress,
-            releaseMintAddress,
-            signer,
-            url,
-            dryRun,
-            compliesWithSolanaDappStorePolicies,
-            requestorIsAuthorized,
-            critical,
-            alphaTest: alpha,
-          });
-
-          if (dryRun) {
-            dryRunSuccessMessage()
-          } else {
-            showMessage("Success", "dApp successfully updated on the publisher portal");
-          }
-        }
-      });
+    validateNewVersionArgs(options);
+    enforceSelfUpdatePolicy(options);
+
+    const targets = resolvePortalTargets(options);
+    const apiKey = await resolveApiKey(options);
+    const signerKeypair = loadSignerKeypair(options.keypair);
+    const balanceWarning = await ensurePublicationSignerBalance({
+      publicKey: signerKeypair.publicKey.toBase58(),
+      rpcUrl: options.rpcUrl,
+      localDev: options.localDev,
+    });
+    if (balanceWarning) {
+      showMessage('Warning', balanceWarning, 'warning');
     }
-  );
+    const signer = createPublicationSignerFromKeypair(signerKeypair);
+    const clients = createPortalClients(targets, apiKey);
+    const progress = createPublicationProgressReporter({
+      title: 'Publishing version',
+      mode: 'new-version',
+      verbose: options.verbose,
+    });
 
-publishCommand
-  .command("remove")
-  .description(
-    "Remove an existing app from the Solana Mobile dApp publisher portal"
-  )
-  .requiredOption(
-    "-k, --keypair <path-to-keypair-file>",
-    "Path to keypair file"
-  )
-  .requiredOption(
-    "--requestor-is-authorized",
-    "An attestation that the party making this Solana dApp publisher portal request is authorized to do so"
-  )
-  .option(
-    "-a, --app-mint-address <app-mint-address>",
-    "The mint address of the app NFT. If not specified, the value from your config file will be used."
-  )
-  .option(
-    "-r, --release-mint-address <release-mint-address>",
-    "The mint address of the release NFT. If not specified, the value from your config file will be used."
-  )
-  .option("-c, --critical", "Flag for a critical app removal request")
-  .option("-u, --url <url>", "RPC URL", Constants.DEFAULT_RPC_DEVNET)
-  .option(
-    "-d, --dry-run",
-    "Flag for dry run. Doesn't submit the request to the publisher portal."
-  )
-  .action(
-    async ({
-             appMintAddress,
-             releaseMintAddress,
-             keypair,
-             url,
-             requestorIsAuthorized,
-             critical,
-             dryRun,
-           }) => {
-      await tryWithErrorMessage(async () => {
-        await checkForSelfUpdate();
-        checkSubmissionNetwork(url);
-
-        const config = await loadPublishDetails(Constants.getConfigFilePath())
-
-        if (!hasAddressInConfig(config.release) && !releaseMintAddress) {
-          throw new Error("Either specify a release mint address in the config file or specify as a CLI argument to this command.")
-        }
-
-        const signer = parseKeypair(keypair);
-        if (signer) {
-          await publishRemoveCommand({
-            appMintAddress,
-            releaseMintAddress,
-            signer,
-            url,
-            dryRun,
-            requestorIsAuthorized,
-            critical,
-          });
-
-          if (dryRun) {
-            dryRunSuccessMessage()
-          } else {
-            showMessage("Success", "dApp successfully removed from the publisher portal");
-          }
-        }
-      })
+    progress.start({
+      message: 'Connecting to publishing portal',
+      metadata: buildNewVersionProgressMetadata(options),
+    });
+
+    try {
+      const result = await runPublicationWorkflow({
+        mode: 'new-version',
+        client: clients.workflowClient,
+        input: buildNewVersionWorkflowInput(
+          options,
+          signer,
+          clients.attestationClient,
+        ),
+        options: {
+          logger: progress.logger,
+        },
+      });
+
+      progress.complete(result);
+      showPublicationSummary('Version publication completed', result);
+    } catch (error) {
+      progress.fail(error);
+      throw error;
     }
-  );
+  });
+}
 
-publishCommand
-  .command("support <request_details>")
-  .description(
-    "Submit a support request for an existing app on the Solana Mobile dApp publisher portal"
-  )
-  .requiredOption(
-    "-k, --keypair <path-to-keypair-file>",
-    "Path to keypair file"
-  )
-  .requiredOption(
-    "--requestor-is-authorized",
-    "An attestation that the party making this Solana dApp publisher portal request is authorized to do so"
-  )
-  .option(
-    "-a, --app-mint-address <app-mint-address>",
-    "The mint address of the app NFT. If not specified, the value from your config file will be used."
-  )
-  .option(
-    "-r, --release-mint-address <release-mint-address>",
-    "The mint address of the release NFT. If not specified, the value from your config file will be used."
-  )
-  .option("-u, --url <url>", "RPC URL", Constants.DEFAULT_RPC_DEVNET)
-  .option(
-    "-d, --dry-run",
-    "Flag for dry run. Doesn't submit the request to the publisher portal."
-  )
-  .action(
-    async (
-      requestDetails,
-      { appMintAddress, releaseMintAddress, keypair, url, requestorIsAuthorized, dryRun }
-    ) => {
-      await tryWithErrorMessage(async () => {
-        await checkForSelfUpdate();
-        checkSubmissionNetwork(url);
-
-        const config = await loadPublishDetails(Constants.getConfigFilePath())
-
-        if (!hasAddressInConfig(config.release) && !releaseMintAddress) {
-          throw new Error("Either specify a release mint address in the config file or specify as a CLI argument to this command.")
-        }
-
-        const signer = parseKeypair(keypair);
-        if (signer) {
-          await publishSupportCommand({
-            appMintAddress,
-            releaseMintAddress,
-            signer,
-            url,
-            dryRun,
-            requestorIsAuthorized,
-            requestDetails,
-          });
-
-          if (dryRun) {
-            dryRunSuccessMessage()
-          } else {
-            showMessage("Success", "Support request sent successfully");
-          }
-        }
+async function runResumeAction(options: ResumeCliOptions) {
+  await runWithUserFacingErrors(async () => {
+    validateResumeArgs(options);
+    enforceSelfUpdatePolicy(options);
+
+    const targets = resolvePortalTargets(options);
+    const apiKey = await resolveApiKey(options);
+    const signer = createPublicationSignerFromKeypair(
+      loadSignerKeypair(options.keypair)
+    );
+    const clients = createPortalClients(targets, apiKey);
+    const progress = createPublicationProgressReporter({
+      title: 'Resuming publication',
+      mode: 'resume',
+      verbose: options.verbose,
+    });
+
+    progress.start({
+      message: 'Connecting to publishing portal',
+      metadata: buildResumeProgressMetadata(options),
+    });
+
+    try {
+      const result = await runPublicationWorkflow({
+        mode: 'resume',
+        client: clients.workflowClient,
+        input: buildResumeWorkflowInput(
+          options,
+          signer,
+          clients.attestationClient,
+        ),
+        options: {
+          logger: progress.logger,
+        },
       });
+
+      progress.complete(result);
+      showPublicationSummary('Publication resume completed', result);
+    } catch (error) {
+      progress.fail(error);
+      throw error;
     }
-  );
+  });
+}
+
+function createPortalClients(
+  targets: ResolvedPortalTargets,
+  apiKey: string,
+) {
+  return {
+    workflowClient: createPortalWorkflowClient({
+      apiBaseUrl: targets.apiBaseUrl,
+      apiKey,
+    }),
+    attestationClient: createPortalAttestationClient({
+      apiBaseUrl: targets.apiBaseUrl,
+      apiKey,
+    }),
+  };
+}
+
+function buildNewVersionWorkflowInput(
+  options: NewVersionCliOptions,
+  signer: ReturnType<typeof createPublicationSignerFromKeypair>,
+  attestationClient: PublicationWorkflowInput['attestationClient'],
+): PublicationWorkflowInput {
+  return {
+    source: buildPublicationSource(options),
+    whatsNew: options.whatsNew ?? '',
+    idempotencyKey: options.idempotencyKey ?? randomUUID(),
+    signer,
+    attestationClient,
+  };
+}
+
+function buildResumeWorkflowInput(
+  options: ResumeCliOptions,
+  signer: ReturnType<typeof createPublicationSignerFromKeypair>,
+  attestationClient: PublicationResumeInput['attestationClient'],
+): PublicationResumeInput {
+  return {
+    publicationSessionId: resolveResumeSessionId(options),
+    releaseId: resolveResumeReleaseId(options),
+    signer,
+    attestationClient,
+  };
+}
+
+function buildPublicationSource(options: NewVersionCliOptions) {
+  if (options.apkFile) {
+    return {
+      kind: 'apk-file' as const,
+      filePath: options.apkFile,
+      fileName: path.basename(options.apkFile),
+    };
+  }
+
+  if (!options.apkUrl) {
+    throw new Error('`--apk-file` or `--apk-url` is required.');
+  }
+
+  return {
+    kind: 'apk-url' as const,
+    url: options.apkUrl,
+    fileName: inferFileNameFromUrl(options.apkUrl),
+  };
+}
+
+function buildNewVersionProgressMetadata(
+  options: NewVersionCliOptions,
+): Record<string, string> {
+  if (options.apkFile) {
+    return {
+      sourceKind: 'apk-file',
+      fileName: path.basename(options.apkFile),
+    };
+  }
+
+  if (options.apkUrl) {
+    const fileName = inferFileNameFromUrl(options.apkUrl);
+    return {
+      sourceKind: 'apk-url',
+      apkUrl: options.apkUrl,
+      ...(fileName ? { fileName } : {}),
+    };
+  }
+
+  return {};
+}
+
+function buildResumeProgressMetadata(
+  options: ResumeCliOptions,
+): Record<string, string> {
+  const publicationSessionId = resolveResumeSessionId(options);
+  const releaseId = resolveResumeReleaseId(options);
+
+  return {
+    ...(publicationSessionId ? { publicationSessionId } : {}),
+    ...(releaseId ? { releaseId } : {}),
+  };
+}
+
+function inferFileNameFromUrl(url: string): string | undefined {
+  try {
+    const pathname = new URL(url).pathname;
+    const fileName = pathname.split('/').filter(Boolean).pop();
+    return fileName || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function enforceSelfUpdatePolicy(
+  options: NewVersionCliOptions | ResumeCliOptions,
+) {
+  if (options.skipSelfUpdate && !options.localDev) {
+    throw new Error(
+      '`--skip-self-update` is only allowed together with `--local-dev`.',
+    );
+  }
+}
+
+function resolveResumeReleaseId(options: ResumeCliOptions): string | undefined {
+  return options.releaseId ?? options.resumeRelease;
+}
+
+function resolveResumeSessionId(options: ResumeCliOptions): string | undefined {
+  return options.sessionId ?? options.resumeSession;
+}
+
+function loadSignerKeypair(keypairPath?: string): Keypair {
+  if (!keypairPath) {
+    throw new Error('`--keypair` is required.');
+  }
+
+  const keypair = parseKeypair(keypairPath);
+  if (!keypair) {
+    throw new Error('Failed to load the signer keypair.');
+  }
+
+  return keypair;
+}
+
+function hasPublicationInputs(options: NewVersionCliOptions): boolean {
+  return Boolean(
+    options.apkFile ||
+      options.apkUrl ||
+      options.whatsNew ||
+      options.portalUrl ||
+      options.keypair ||
+      options.rpcUrl ||
+      options.idempotencyKey ||
+      options.dappId ||
+      options.verbose,
+  );
+}
+
+function showPublicationSummary(title: string, result: unknown) {
+  const summaryLines = extractPublicationSummaryLines(result);
+  showMessage(title, summaryLines.join('\n'), 'standard');
+}
+
+async function runWithUserFacingErrors(block: () => Promise<void>) {
+  try {
+    await block();
+  } catch (error) {
+    const message =
+      error instanceof Error ? error.message : 'An unexpected error occurred';
+    showMessage('Error', message, 'error');
+    process.exitCode = 1;
+  }
+}