@yolo-labs/yolo-cli 0.23.0

package/dist/tileapp-personal.js

@@ -0,0 +1,461 @@
+/**
+ * `yolo tileapp init` + `yolo tileapp publish --personal` — the PERSONAL
+ * (owner-only) app path. Unlike the marketplace `sign`/`publish` flow, this
+ * needs no signing, no review, no publisher entity: it registers the manifest
+ * under the caller's own namespace and uploads the static bundle, both via the
+ * user-authed `/v1/tileapps/personal*` routes. See docs/PERSONAL_TILE_APPS_PLAN.md.
+ *
+ *   yolo tileapp init <name>
+ *     → scaffold ./<name>/tileapp.json + ./<name>/index.html (a renderable
+ *       pure-UI starter). Offline, no auth.
+ *
+ *   yolo tileapp publish <manifest.json> --personal [--bundle-dir <dir>]
+ *     → POST /v1/tileapps/personal (register the manifest, returns the namespaced
+ *       appId) then PUT /v1/tileapps/personal/<appId>/bundle (upload the static
+ *       files). Prints the appId. Auth: user JWT (no SESSION_ID needed).
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { resolveUserToken } from './auth-context.js';
+import { validateManifest, isRuntimeManifest } from './tileapp-validator.js';
+import { resolveBundleDir } from './tileapp-developer.js';
+import { parseDockerfile, assembleOciArchive } from './tileapp-oci-assembler.js';
+function defaultExec(file, args) {
+    return new Promise((resolve) => {
+        let proc;
+        try {
+            proc = spawn(file, args, { stdio: ['ignore', 'inherit', 'pipe'] });
+        }
+        catch (err) {
+            return resolve({ code: null, stderr: err.message });
+        }
+        let stderr = '';
+        proc.stderr?.on('data', (d) => { stderr += d; process.stderr.write(d); });
+        proc.on('error', (err) => resolve({ code: null, stderr: stderr + err.message }));
+        proc.on('close', (code) => resolve({ code, stderr }));
+    });
+}
+export function exitCodeForFailure(kind) {
+    if (kind === 'http')
+        return 1;
+    if (kind === 'validation')
+        return 65; // EX_DATAERR
+    return 64; // EX_USAGE / auth / io
+}
+const LOCAL_ID_RE = /^[a-z0-9][a-z0-9-]{1,31}$/;
+// Extensions served as text (utf8); everything else is uploaded base64.
+const TEXT_EXTS = new Set(['.html', '.htm', '.js', '.mjs', '.css', '.json', '.svg', '.txt', '.map', '.xml', '.webmanifest']);
+const MAX_FILES = 100;
+const MAX_TOTAL_BYTES = 3 * 1024 * 1024;
+function apiBase(commonApiUrl) {
+    const base = commonApiUrl.replace(/\/$/, '');
+    return base.endsWith('/v1') ? base : `${base}/v1`;
+}
+function resolveAuth(env) {
+    const commonApiUrl = env.YOLO_COMMON_API_URL || env.YOLO_API_URL;
+    if (!commonApiUrl)
+        return { ok: false, message: 'YOLO_COMMON_API_URL (or YOLO_API_URL) env var is required' };
+    const userToken = resolveUserToken(env);
+    if (!userToken)
+        return { ok: false, message: 'no user token: set YOLO_API_TOKEN or sign in (~/.config/yolo/token)' };
+    return { ok: true, commonApiUrl, userToken };
+}
+async function safeText(res) {
+    try {
+        return await res.text();
+    }
+    catch {
+        return '<no body>';
+    }
+}
+function readManifest(p) {
+    let raw;
+    try {
+        raw = fs.readFileSync(p, 'utf-8');
+    }
+    catch (e) {
+        return { ok: false, message: `cannot read manifest '${p}': ${e.message}` };
+    }
+    try {
+        return { ok: true, manifest: JSON.parse(raw) };
+    }
+    catch (e) {
+        return { ok: false, message: `manifest '${p}' is not valid JSON: ${e.message}` };
+    }
+}
+/** Scaffold a renderable pure-UI personal app under ./<name>/. */
+export function runTileAppInit(opts) {
+    const name = opts.name;
+    if (!LOCAL_ID_RE.test(name)) {
+        return { ok: false, kind: 'usage', message: `name must be a lowercase kebab-case slug, 2-32 chars (got '${name}')` };
+    }
+    const dir = path.resolve(opts.cwd ?? process.cwd(), name);
+    if (fs.existsSync(dir))
+        return { ok: false, kind: 'io', message: `directory already exists: ${dir}` };
+    const title = name.split('-').map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(' ');
+    const manifest = {
+        id: name,
+        version: '1.0.0',
+        displayName: title,
+        publisher: 'personal',
+        description: `${title} — a personal tile-app.`,
+        ui: { icon: '🧩', color: '#4f46e5', label: title },
+        surface: { kind: 'iframe', entry: 'index.html', tilePrefersSize: { rowSpan: 2, colSpan: 2 } },
+        permissions: { required: [] },
+    };
+    const indexHtml = `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>${title}</title>
+  <!--
+    ⚠️ CONTENT-SECURITY-POLICY — read this before you build.
+    Tile-app bundles are served with \`script-src 'self'\`. That means:
+      • NO inline <script> — put ALL your JavaScript in app.js (loaded below).
+      • NO eval() / new Function() — they are blocked. If your app needs to
+        evaluate expressions (a calculator, grapher, template engine, …), write
+        a real tokenizer/parser in app.js; you cannot shortcut with eval.
+      • NO network — no CDN scripts, remote fonts, or fetch() to other origins.
+        Keep the app fully self-contained (only the files in this folder).
+    Inline <style> is fine; CSS may also live in a bundled .css file.
+  -->
+  <style>
+    body { font: 15px/1.5 system-ui, sans-serif; margin: 0; display: grid; place-items: center;
+           height: 100vh; color: #e5e7eb; background: #111827; }
+  </style>
+</head>
+<body>
+  <main>
+    <h1>${title}</h1>
+    <p id="status">Loading…</p>
+    <p>Edit <code>index.html</code> + <code>app.js</code>, then re-run
+       <code>yolo tileapp publish tileapp.json --personal</code>.</p>
+  </main>
+  <!-- All JS lives in app.js (the CSP forbids inline scripts). type="module" so
+       you can \`import\` the app-sdk (a same-origin module is allowed under 'self'). -->
+  <script src="app.js" type="module"></script>
+</body>
+</html>
+`;
+    const appJs = `// ${title} — personal tile-app logic.
+//
+// ⚠️ CSP: served under \`script-src 'self'\` → eval() and new Function() are
+// BLOCKED, and there is no network. If you need to evaluate user input (e.g. a
+// calculator/grapher), write a real parser here (tokenizer → shunting-yard →
+// RPN eval) rather than reaching for eval. Keep everything self-contained.
+//
+// To call HOST capabilities (LLM, MCP tools, files), vendor @yololabs/app-sdk's
+// browser build into ./vendor/app-sdk/ and request matching permissions in
+// tileapp.json (permissions.required / optional):
+//   import { createTileApp } from './vendor/app-sdk/index.js';
+//   const app = createTileApp();
+//   const res = await app.call('llm', 'complete', { prompt: '...' });
+
+const status = document.getElementById('status');
+if (status) status.textContent = 'Ready — edit app.js to build your app.';
+`;
+    try {
+        fs.mkdirSync(dir, { recursive: false });
+        fs.writeFileSync(path.join(dir, 'tileapp.json'), `${JSON.stringify(manifest, null, 2)}\n`);
+        fs.writeFileSync(path.join(dir, 'index.html'), indexHtml);
+        fs.writeFileSync(path.join(dir, 'app.js'), appJs);
+    }
+    catch (e) {
+        return { ok: false, kind: 'io', message: `scaffold failed: ${e.message}` };
+    }
+    return {
+        ok: true,
+        output: `Created ${name}/ (tileapp.json + index.html + app.js)\n  note: bundle CSP is \`script-src 'self'\` — keep JS in app.js (no inline <script>, no eval, no network)\n  next: cd ${name} && yolo tileapp publish tileapp.json --personal`,
+    };
+}
+/** Recursively collect a bundle dir's files as upload entries. Skips VCS/dep
+ *  dirs and the manifest itself; classifies text vs binary by extension. */
+function collectBundleFiles(rootDir, manifestPath) {
+    const out = [];
+    const manifestAbs = path.resolve(manifestPath);
+    const root = path.resolve(rootDir);
+    let total = 0;
+    const SKIP_DIRS = new Set(['node_modules', '.git', '.yolo']);
+    const walk = (abs) => {
+        for (const entry of fs.readdirSync(abs, { withFileTypes: true })) {
+            // Skip dotfiles/dotdirs entirely — the bundle is served PUBLICLY, so a
+            // stray .env/.npmrc/.git from the project dir must never be uploaded (the
+            // server's sanitizeBundlePath also rejects dot-leading paths). codex Round-3 P1.
+            if (entry.name.startsWith('.'))
+                continue;
+            const childAbs = path.join(abs, entry.name);
+            if (entry.isDirectory()) {
+                if (SKIP_DIRS.has(entry.name))
+                    continue;
+                const err = walk(childAbs);
+                if (err)
+                    return err;
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            if (path.resolve(childAbs) === manifestAbs)
+                continue; // never upload the manifest
+            const rel = path.relative(root, childAbs).split(path.sep).join('/');
+            const buf = fs.readFileSync(childAbs);
+            total += buf.byteLength;
+            if (out.length + 1 > MAX_FILES)
+                return `too many files (max ${MAX_FILES})`;
+            if (total > MAX_TOTAL_BYTES)
+                return `bundle exceeds ${MAX_TOTAL_BYTES} bytes — use a smaller bundle`;
+            const ext = path.extname(rel).toLowerCase();
+            if (TEXT_EXTS.has(ext))
+                out.push({ path: rel, content: buf.toString('utf8'), encoding: 'utf8' });
+            else
+                out.push({ path: rel, content: buf.toString('base64'), encoding: 'base64' });
+        }
+        return null;
+    };
+    try {
+        const err = walk(root);
+        if (err)
+            return { ok: false, message: err };
+    }
+    catch (e) {
+        return { ok: false, message: `reading bundle failed: ${e.message}` };
+    }
+    if (out.length === 0)
+        return { ok: false, message: `no files found in bundle dir: ${rootDir}` };
+    return { ok: true, files: out, totalBytes: total };
+}
+export async function runTileAppPublishPersonal(opts) {
+    const env = opts.env ?? process.env;
+    const auth = resolveAuth(env);
+    if (!auth.ok)
+        return { ok: false, kind: 'auth', message: auth.message };
+    const read = readManifest(opts.manifestPath);
+    if (!read.ok)
+        return { ok: false, kind: 'io', message: read.message };
+    // Guard non-object manifests (JSON `null`/array/scalar) BEFORE dereferencing —
+    // the runtime branch + id read below assume an object (the strict validator
+    // only runs on the pure-UI path).
+    if (typeof read.manifest !== 'object' || read.manifest === null || Array.isArray(read.manifest)) {
+        return { ok: false, kind: 'validation', message: 'manifest must be a JSON object' };
+    }
+    const localId = typeof read.manifest.id === 'string' ? read.manifest.id : '';
+    if (!LOCAL_ID_RE.test(localId)) {
+        return { ok: false, kind: 'validation', message: `manifest "id" must be a lowercase kebab-case slug, 2-32 chars (got '${localId}')` };
+    }
+    // Runtime app (has `runtime`/`image`): build the image in-pod + mediated push.
+    // Branch BEFORE the strict pure-UI lint, since a runtime manifest legitimately
+    // omits `image` (the server fills it from the actual pushed digest).
+    if (isRuntimeManifest(read.manifest)) {
+        return publishRuntime({
+            manifest: read.manifest, localId, manifestPath: opts.manifestPath,
+            context: opts.context, dockerfile: opts.dockerfile, builder: opts.builder,
+            auth, env, fetchImpl: opts.fetchImpl ?? fetch, execImpl: opts.execImpl ?? defaultExec,
+        });
+    }
+    // Pure-UI path: strict schema lint (the server re-validates authoritatively).
+    const v = validateManifest(read.manifest);
+    if (v.errors.length > 0) {
+        return { ok: false, kind: 'validation', message: `manifest invalid:\n  - ${v.errors.join('\n  - ')}` };
+    }
+    // Resolve + collect the static bundle BEFORE registering, so a bad bundle
+    // fails before we create a registry doc.
+    const resolved = resolveBundleDir(opts.manifestPath, read.manifest, opts.bundleDir);
+    if (!resolved.ok)
+        return { ok: false, kind: 'io', message: `bundle: ${resolved.message}` };
+    const collected = collectBundleFiles(resolved.dir, opts.manifestPath);
+    if (!collected.ok)
+        return { ok: false, kind: 'io', message: collected.message };
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const base = apiBase(auth.commonApiUrl);
+    const headers = { 'content-type': 'application/json', authorization: `Bearer ${auth.userToken}` };
+    // 1) Register the manifest (id + publisher are stamped server-side).
+    let appId;
+    try {
+        const res = await fetchImpl(`${base}/tileapps/personal`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ id: localId, manifest: read.manifest }),
+        });
+        if (!res.ok)
+            return { ok: false, kind: 'http', message: `register failed: HTTP ${res.status} — ${await safeText(res)}` };
+        const json = (await res.json());
+        if (!json.appId)
+            return { ok: false, kind: 'http', message: 'register response missing appId' };
+        appId = json.appId;
+    }
+    catch (e) {
+        return { ok: false, kind: 'http', message: `register request failed: ${e.message}` };
+    }
+    // 2) Upload the bundle.
+    try {
+        const res = await fetchImpl(`${base}/tileapps/personal/${encodeURIComponent(appId)}/bundle`, {
+            method: 'PUT',
+            headers,
+            body: JSON.stringify({ files: collected.files }),
+        });
+        if (!res.ok)
+            return { ok: false, kind: 'http', message: `bundle upload failed: HTTP ${res.status} — ${await safeText(res)}` };
+    }
+    catch (e) {
+        return { ok: false, kind: 'http', message: `bundle upload request failed: ${e.message}` };
+    }
+    return {
+        ok: true,
+        output: `Published ${appId} (${collected.files.length} file${collected.files.length === 1 ? '' : 's'}, ${collected.totalBytes} bytes)\n  next: install it + add a tile from the workspace (or via the studio.install_app / studio.create_app_tile MCP tools).`,
+    };
+}
+/**
+ * Build the app image in-pod with podman, `save` it to an OCI archive in the
+ * workspace, and hand it to common-api's MEDIATED push endpoint — common-api
+ * mints the registry token + chooses the destination and directs container-api
+ * to push it. We never see a registry credential and never choose the dest.
+ */
+async function publishRuntime(p) {
+    const { manifest, localId } = p;
+    const version = typeof manifest.version === 'string' ? manifest.version : '';
+    if (!version)
+        return { ok: false, kind: 'validation', message: 'manifest.version is required for a runtime app' };
+    // PRE-FLIGHT manifest validation BEFORE the (expensive) build + multi-MB
+    // upload — so a trivial manifest error (a missing `ui` block, bad surface,
+    // etc.) fails locally in milliseconds instead of after a full image build,
+    // push, and a server 400 (dogfood feedback 2026-06-18). A runtime manifest
+    // legitimately OMITS `image` (the server fills it from the pushed digest), so
+    // we drop ONLY that one expected error; every other field is validated exactly
+    // as the server will, surfacing all problems at once.
+    // SCOPE: this mirrors the shared manifest SCHEMA validator (catches the common
+    // dogfood errors — missing ui/surface/displayName — before the build). It does
+    // NOT duplicate common-api's personal-specific gates (the runtime.exec ban,
+    // per-permission tier/grantability rules) — those stay server-authoritative to
+    // avoid CLI↔server validator drift, so a manifest that passes here can still be
+    // rejected server-side. Acceptable: this strictly improves on the prior
+    // no-preflight behavior and never false-rejects.
+    // Validate with `image` STRIPPED: the publish-image path ignores any
+    // author-supplied image and the server fills ref/tag/digest from the actual
+    // pushed image, so a placeholder/partial `image` block (e.g. `image: {}`)
+    // must NOT trip a local image.ref/tag failure. Stripping it also leaves the
+    // "runtime requires either `image` or exec" error, which we filter (the push
+    // supplies the image). Everything else (ui, surface, …) is validated as the
+    // server will, surfacing all problems at once before the build.
+    const { image: _serverFilledImage, ...rest } = manifest;
+    const forValidation = {
+        ...rest,
+        // The server OVERWRITES publisher with `personal:<ownerId>` before validating
+        // (the author's value is ignored entirely), so ALWAYS stamp a valid
+        // placeholder here — an absent OR empty-string author publisher must not
+        // cause a false local rejection that the server wouldn't.
+        publisher: 'personal',
+    };
+    const v = validateManifest(forValidation);
+    if (!v.ok) {
+        const real = v.errors.filter((e) => !e.startsWith('runtime requires either `image`'));
+        if (real.length > 0) {
+            return { ok: false, kind: 'validation', message: `manifest invalid (fix before build):\n  - ${real.join('\n  - ')}` };
+        }
+    }
+    const manifestDir = path.dirname(path.resolve(p.manifestPath));
+    const context = p.context ? path.resolve(p.context) : manifestDir;
+    const dockerfile = p.dockerfile ? path.resolve(p.dockerfile) : path.join(context, 'Dockerfile');
+    try {
+        if (!fs.statSync(dockerfile).isFile())
+            return { ok: false, kind: 'io', message: `Dockerfile not found: ${dockerfile}` };
+    }
+    catch {
+        return { ok: false, kind: 'io', message: `Dockerfile not found: ${dockerfile}` };
+    }
+    const localTag = `localhost/tileapp-${localId}:${version}`;
+    // Archive goes to a LOCAL temp file — common-api does the push, so it never
+    // needs to be in the workspace / reachable by another in-pod process.
+    const archiveTmp = path.join(os.tmpdir(), `tileapp-build-${localId}-${version}-${Date.now()}.tar`);
+    const parsed = parseDockerfile(fs.readFileSync(dockerfile, 'utf-8'));
+    const builder = p.builder ?? 'auto';
+    let ociTmpDir = null;
+    // archiveTmp (and the assembler's ociTmpDir, when used) may exist even on a
+    // partial failure past this point, so the finally always reaps both.
+    try {
+        // Produce `archiveTmp` (an oci-archive) via the selected builder.
+        if (builder === 'podman' || (builder === 'auto' && !parsed.assemblable)) {
+            if (builder === 'auto') {
+                process.stdout.write(`Dockerfile needs a full container build (${parsed.unsupported.join('; ')}) — using podman.\n`);
+            }
+            process.stdout.write(`Building ${localTag} …\n`);
+            const build = await p.execImpl('podman', ['build', '-t', localTag, '-f', dockerfile, context]);
+            if (build.code !== 0)
+                return { ok: false, kind: 'io', message: `podman build failed (code ${build.code}): ${build.stderr.trim().slice(-4000)}` };
+            process.stdout.write(`Exporting OCI archive …\n`);
+            const save = await p.execImpl('podman', ['save', '--format', 'oci-archive', '-o', archiveTmp, localTag]);
+            if (save.code !== 0)
+                return { ok: false, kind: 'io', message: `podman save failed (code ${save.code}): ${save.stderr.trim().slice(-4000)}` };
+        }
+        else {
+            // skopeo assembler — no container engine (works under the in-pod Kata
+            // uid_map/fuse limits that break rootless podman, PERSONAL_TILE_APPS §7.1 #2).
+            if (!parsed.assemblable) {
+                return { ok: false, kind: 'validation', message: `--builder skopeo can't assemble this Dockerfile (it needs a full container build): ${parsed.unsupported.join('; ')}` };
+            }
+            ociTmpDir = fs.mkdtempSync(path.join(os.tmpdir(), `tileapp-oci-${localId}-`));
+            process.stdout.write(`Assembling ${localTag} via skopeo (no container engine) …\n`);
+            const asm = await assembleOciArchive({
+                baseRef: parsed.from, contextDir: context, parsed,
+                ociLayoutDir: ociTmpDir, outArchivePath: archiveTmp, tag: version,
+                exec: p.execImpl, log: (m) => process.stdout.write(`${m}\n`),
+            });
+            if (!asm.ok)
+                return { ok: false, kind: asm.kind, message: asm.message };
+        }
+        // Strip any `image` the author put in — common-api computes ref + the actual
+        // pushed digest and fills it in. `runtime` is carried through. The manifest
+        // travels in a header; the body is the raw archive (streamed, never buffered).
+        const sentManifest = { ...manifest };
+        delete sentManifest.image;
+        const manifestHeader = Buffer.from(JSON.stringify({ id: localId, manifest: sentManifest })).toString('base64');
+        // The manifest rides in a header (the body is the archive). Keep it well
+        // under HTTP header limits — a runtime manifest is small; if you've packed in
+        // large store-listing metadata (screenshots/changelog), trim it.
+        if (Buffer.byteLength(manifestHeader) > 7000) {
+            return { ok: false, kind: 'validation', message: 'manifest is too large to publish as a runtime app — remove bulky fields (screenshots/changelog) or shorten description/permissions' };
+        }
+        let size = 0;
+        try {
+            size = fs.statSync(archiveTmp).size;
+        }
+        catch { /* server validates the upload */ }
+        process.stdout.write(`Uploading + pushing (mediated, ${size} bytes) …\n`);
+        const res = await p.fetchImpl(`${apiBase(p.auth.commonApiUrl)}/tileapps/personal/publish-image`, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/octet-stream',
+                authorization: `Bearer ${p.auth.userToken}`,
+                'x-tileapp-manifest': manifestHeader,
+            },
+            body: fs.createReadStream(archiveTmp),
+            // Node/undici requires duplex for a streaming request body.
+            duplex: 'half',
+        });
+        if (!res.ok)
+            return { ok: false, kind: 'http', message: `publish-image failed: HTTP ${res.status} — ${await safeText(res)}` };
+        const json = (await res.json());
+        if (!json.appId)
+            return { ok: false, kind: 'http', message: 'publish-image response missing appId' };
+        return {
+            ok: true,
+            output: `Published runtime app ${json.appId}\n  image: ${json.ref}:${json.tag}@${json.digest}\n  next: install it + add a tile (studio.install_app / studio.create_app_tile).`,
+        };
+    }
+    catch (e) {
+        return { ok: false, kind: 'http', message: `publish-image request failed: ${e.message}` };
+    }
+    finally {
+        try {
+            fs.unlinkSync(archiveTmp);
+        }
+        catch { /* best effort */ }
+        if (ociTmpDir) {
+            try {
+                fs.rmSync(ociTmpDir, { recursive: true, force: true });
+            }
+            catch { /* best effort */ }
+        }
+    }
+}

package/dist/tileapp-publisher.js

@@ -0,0 +1,134 @@
+/**
+ * `yolo tileapp sign|publish` — the publisher submission flow (M1).
+ *
+ *   yolo tileapp sign    <manifest.json> --publisher <id> [--key <keyId>] [--stdout]
+ *     → POST /v1/publisher/sign — the platform KMS-signs the manifest on the
+ *       publisher's behalf and the CLI writes `signature`/`publisherKeyId` back
+ *       into the manifest file (or prints it with --stdout).
+ *
+ *   yolo tileapp publish <manifest.json> [--channel beta|stable] [--image-digest <d>]
+ *     → POST /v1/publisher/publish — submits the SIGNED manifest as a quarantine
+ *       (`submitted`) release; review promotes it later. Prints the releaseId.
+ *
+ * Both use the user JWT directly (the publisher endpoints are user-authed), so
+ * no MCP delegation. The HTTP transport is injectable for unit tests.
+ */
+import fs from 'node:fs';
+import { resolveUserToken } from './auth-context.js';
+function resolvePublisherAuth(env) {
+    const commonApiUrl = env.YOLO_COMMON_API_URL || env.YOLO_API_URL;
+    if (!commonApiUrl)
+        return { ok: false, message: 'YOLO_COMMON_API_URL (or YOLO_API_URL) env var is required' };
+    const userToken = resolveUserToken(env);
+    if (!userToken) {
+        return { ok: false, message: 'no user token: set YOLO_API_TOKEN or sign in (~/.config/yolo/token)' };
+    }
+    return { ok: true, commonApiUrl, userToken };
+}
+/** publisher routes live under `/v1`; `commonApiUrl` is the host base. */
+function apiBase(commonApiUrl) {
+    const base = commonApiUrl.replace(/\/$/, '');
+    return base.endsWith('/v1') ? base : `${base}/v1`;
+}
+function readManifest(path) {
+    let raw;
+    try {
+        raw = fs.readFileSync(path, 'utf-8');
+    }
+    catch (e) {
+        return { ok: false, message: `cannot read manifest '${path}': ${e.message}` };
+    }
+    try {
+        return { ok: true, manifest: JSON.parse(raw) };
+    }
+    catch (e) {
+        return { ok: false, message: `manifest '${path}' is not valid JSON: ${e.message}` };
+    }
+}
+async function safeText(res) {
+    try {
+        return await res.text();
+    }
+    catch {
+        return '<no body>';
+    }
+}
+export async function runTileAppSign(opts) {
+    const env = opts.env ?? process.env;
+    if (!opts.publisherId)
+        return { ok: false, kind: 'usage', message: '--publisher <id> is required' };
+    const auth = resolvePublisherAuth(env);
+    if (!auth.ok)
+        return { ok: false, kind: 'auth', message: auth.message };
+    const read = readManifest(opts.manifestPath);
+    if (!read.ok)
+        return { ok: false, kind: 'io', message: read.message };
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    let res;
+    try {
+        res = await fetchImpl(`${apiBase(auth.commonApiUrl)}/publisher/sign`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', authorization: `Bearer ${auth.userToken}` },
+            body: JSON.stringify({ publisherId: opts.publisherId, keyId: opts.keyId, manifest: read.manifest }),
+        });
+    }
+    catch (e) {
+        return { ok: false, kind: 'http', message: `sign request failed: ${e.message}` };
+    }
+    if (!res.ok)
+        return { ok: false, kind: 'http', message: `sign failed: HTTP ${res.status} — ${await safeText(res)}` };
+    const json = (await res.json());
+    if (!json.signature || !json.publisherKeyId)
+        return { ok: false, kind: 'http', message: 'sign response missing signature/publisherKeyId' };
+    const signed = { ...read.manifest, signature: json.signature, publisherKeyId: json.publisherKeyId };
+    if (opts.toStdout)
+        return { ok: true, output: JSON.stringify(signed, null, 2) };
+    try {
+        fs.writeFileSync(opts.manifestPath, `${JSON.stringify(signed, null, 2)}\n`);
+    }
+    catch (e) {
+        return { ok: false, kind: 'io', message: `cannot write signed manifest: ${e.message}` };
+    }
+    return { ok: true, output: `Signed ${String(read.manifest.id)}@${String(read.manifest.version)} with key ${json.publisherKeyId} → ${opts.manifestPath}` };
+}
+export async function runTileAppPublish(opts) {
+    const env = opts.env ?? process.env;
+    const auth = resolvePublisherAuth(env);
+    if (!auth.ok)
+        return { ok: false, kind: 'auth', message: auth.message };
+    const read = readManifest(opts.manifestPath);
+    if (!read.ok)
+        return { ok: false, kind: 'io', message: read.message };
+    if (!read.manifest.signature) {
+        return { ok: false, kind: 'usage', message: 'manifest is not signed — run `yolo tileapp sign` first' };
+    }
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    let res;
+    try {
+        // Only send `channel` when the user explicitly passed --channel, so the
+        // CLI default can't diverge from the server's (the publish endpoint defaults
+        // to `stable`). Same for imageDigest.
+        const body = { manifest: read.manifest };
+        if (opts.channel)
+            body.channel = opts.channel;
+        if (opts.imageDigest)
+            body.imageDigest = opts.imageDigest;
+        res = await fetchImpl(`${apiBase(auth.commonApiUrl)}/publisher/publish`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', authorization: `Bearer ${auth.userToken}` },
+            body: JSON.stringify(body),
+        });
+    }
+    catch (e) {
+        return { ok: false, kind: 'http', message: `publish request failed: ${e.message}` };
+    }
+    if (!res.ok)
+        return { ok: false, kind: 'http', message: `publish failed: HTTP ${res.status} — ${await safeText(res)}` };
+    const json = (await res.json());
+    if (!json.releaseId)
+        return { ok: false, kind: 'http', message: 'publish response missing releaseId' };
+    return { ok: true, output: `Submitted ${json.releaseId} (status: ${json.status ?? 'submitted'}) — awaiting review` };
+}
+export function exitCodeForFailure(kind) {
+    return kind === 'http' ? 1 : 64;
+}