tsoft-cli 3.14.4 → 3.15.0

package/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to T-Soft CLI will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [3.15.0] - 2026-10-31
+
+### Added
+- `tsoft app deploy [dirs...]` uploads storefront embed versions without the partner panel. Publishing an embed meant zipping the package by hand and uploading it in the browser, which a pipeline cannot do. The command reads `prefix` and `version` from each package's `package.json`, zips the same files the panel accepts (`legacy/` copies are left out) and uploads them with an organization deploy token from `TSOFT_DEPLOY_TOKEN` or `--token`; no `tsoft login` is needed. Each package is reported as live, in review or skipped: first-party apps with nothing to review go live at once, other versions wait for T-Soft approval, and a version number that is already live or in review is skipped without failing the run. Several directories can be given in one run; the command carries on after a refused package and exits with code 1 at the end. `--json` prints one document with every result.
+
+### Fixed
+- `theme push` now says which authorization failed when the store cannot renew its link to the theme store. The push carries a separate partner authorization alongside your CLI session; when the store could not renew that one it answered with `PUSH-AUTH-REFRESH-FAILED`, which the CLI did not know, so it repeated the store's text and left it unclear whether your CLI session had ended. The message now says the theme store (partner) authorization could not be renewed while your CLI session is still valid, and points at `tsoft login` to reconnect. With `--json` the code is returned under `error.code`.
+- `theme push <name>` now pushes the theme with that name. The argument was sent to the store as given, but the store only knows a theme by its folder or alias, so pushing by the name `theme list` shows ended in `Request failed with status code 410`. A name is now looked up in the same theme list `theme list` reads and sent as the theme's folder; when two themes share the name, or none has it, the push stops before contacting the store and says so, listing the folders to choose from. A folder, an alias, a folder uuid and a push with no argument behave exactly as before, and if the theme list cannot be read the argument is sent as typed.
+- A push to a theme the store does not have now reads "Theme not found: <theme>" with a pointer to `tsoft theme list`, instead of `Request failed with status code 410`. A 404 or 410 from the push is reported this way even when the store sends no error code, and the store's own message is kept next to it.
+- `tsoft login` now names the application that holds the sign-in port. When the port is taken the message shows the process name and pid and the command to stop it (`kill` on macOS and Linux, `taskkill` on Windows); the CLI never stops it on its own. When the owner cannot be found the message is the same as before.
+
 ## [3.14.4] - 2026-10-26
 
 ### Fixed

package/README.md

@@ -115,6 +115,14 @@ Available on every command:
 | `tsoft theme section create`  | Create an empty section in the active theme   |
 | `tsoft theme section fork`    | Fork an existing section into the active theme |
 
+### Apps
+
+| Command                          | Description                                              |
+| -------------------------------- | -------------------------------------------------------- |
+| `tsoft app deploy [dirs...]`     | Upload storefront embed packages (no sign-in, for CI)    |
+
+See [Deploying Storefront Embeds](#deploying-storefront-embeds).
+
 ## Developing a Theme
 
 ```bash
@@ -208,6 +216,40 @@ Combine with `--store` to target a specific store from a pipeline:
 tsoft theme push my-theme --store example.com --json
 ```
 
+## Deploying Storefront Embeds
+
+`tsoft app deploy` uploads an app's storefront embed version the same way the partner panel's zip upload does, without a browser or a store sign-in. Point it at one or more package directories in the installer layout:
+
+```
+my-app/
+├── package.json                 # prefix and version (e.g. "1.2.0")
+├── input.json                   # settings form
+├── modules/trackingcode/*.html  # loader templates
+└── embed/v1/*.js|css            # scripts for major 1
+```
+
+Only these files are uploaded; `legacy/` template copies and anything else in the directory stay local.
+
+```bash
+# The token is an organization deploy token, read from the environment...
+export TSOFT_DEPLOY_TOKEN=tsd_...
+tsoft app deploy stores/apps/dev.64/my-app
+
+# ...or given on the command line. Several packages can go in one run.
+tsoft app deploy stores/apps/dev.64/a stores/apps/dev.64/b --token tsd_...
+```
+
+Each package ends up in one of these states:
+
+| Result      | Meaning                                                                                      |
+| ----------- | -------------------------------------------------------------------------------------------- |
+| Live        | First-party app with nothing to review: the scripts are already served to stores.           |
+| In review   | Waits for T-Soft approval in the review queue (partner apps, or a new script host).          |
+| Skipped     | That version number is already live or in review; nothing is uploaded, the run does not fail. |
+| Failed      | The package was refused (the reason is printed); the run exits with code 1.                  |
+
+A changed script needs a new version in `package.json`; the same number is skipped. Removing a setting or changing a field's type needs a new major version. With `--json` the command prints one document with a `results` array. `TSOFT_APPS_API_URL` points the command at another API (default `https://api.tsoftapps.com`).
+
 ## Security
 
 - **OAuth2 PKCE**: Authorization as a public client, no client secret on disk

package/locales/en.json

@@ -26,6 +26,11 @@
   "error.push.payload_too_large.message_unknown_size": "Theme package exceeds the server limit.",
   "error.push.payload_too_large.hint": "Compress large images or remove them from the theme.",
   "error.push.payload_too_large.largest_files_title": "Largest files:",
+  "error.push.auth_refresh_failed.message": "The theme store (partner) authorization could not be renewed; your CLI session is still valid.",
+  "error.push.auth_refresh_failed.hint": "Reconnect with: tsoft login",
+  "error.push.theme_not_found.message": "Theme not found: {{theme}}",
+  "error.push.theme_not_found.message_with_detail": "Theme not found: {{theme}} ({{detail}})",
+  "error.push.theme_not_found.hint": "See the themes in this store: tsoft theme list",
   "error.http.401.message": "Authorization error.",
   "error.http.401.hint": "Login again: tsoft login --org",
   "error.http.403.message": "You do not have permission for this operation.",
@@ -61,6 +66,8 @@
   "login.port_in_use.message": "Port {{port}}, which sign-in needs, is already in use by another application.",
   "login.port_in_use.close_hint": "If \"tsoft login\" is still running in another terminal, stop it there with Ctrl+C and try again.",
   "login.port_in_use.find_hint": "To see which application is using the port, run: {{command}}",
+  "login.port_in_use.owner": "It is held by {{command}} (pid {{pid}}).",
+  "login.port_in_use.stop_hint": "If you do not need that application, stop it with: {{command}}",
   "login.server_start_failed.message": "Sign-in could not start: the local connection it needs could not be opened on this computer.",
   "login.server_start_failed.hint": "For details: tsoft login --verbose",
   "login.security_error": "State parameter mismatch! This may indicate a security issue.",
@@ -146,6 +153,8 @@
   "push.no_active_theme": "No active theme found.",
   "push.usage": "Usage: tsoft theme push <theme-name>",
   "push.use_tip": "Or set an active theme with \"tsoft theme use <theme-name>\".",
+  "push.name_ambiguous.message": "More than one theme is named \"{{name}}\". Push by folder instead:",
+  "push.name_ambiguous.hint": "tsoft theme push <folder>",
   "push.connecting": "Connecting to server...",
   "push.checking_status": "Checking current status...",
   "push.pushing": "Pushing theme...",
@@ -406,5 +415,25 @@
   "config.autoupgrade.status_on": "Version checking: on",
   "config.autoupgrade.status_off": "Version checking: off",
   "config.autoupgrade.usage": "Usage: tsoft config autoupgrade on | off | status",
-  "dev.no_active_store": "No active store.\n\nTo sign in: tsoft login"
+  "dev.no_active_store": "No active store.\n\nTo sign in: tsoft login",
+  "help.group.apps": "Apps",
+  "help.cmd.app_deploy": "Publish a storefront embed version (CI)",
+  "app.deploy.published": "✓ Live: {{label}}",
+  "app.deploy.pending_review": "◷ In review: {{label}} — goes live after T-Soft approves it",
+  "app.deploy.already_live": "↷ Skipped: {{label}} is already live",
+  "app.deploy.already_pending": "↷ Skipped: {{label}} is already in review",
+  "app.deploy.failed": "✗ Upload failed: {{label}}",
+  "app.deploy.summary": "{{total}} packages: {{published}} live, {{pending}} in review, {{skipped}} skipped, {{failed}} failed",
+  "app.deploy.error.no_token": "No deploy token found.",
+  "app.deploy.error.no_token_hint": "Set the TSOFT_DEPLOY_TOKEN environment variable or pass --token.",
+  "app.deploy.error.not_a_directory": "{{dir}} is not a directory.",
+  "app.deploy.error.no_manifest": "No package.json in {{dir}}.",
+  "app.deploy.error.bad_manifest": "Could not read {{dir}}/package.json (invalid JSON).",
+  "app.deploy.error.missing_fields": "{{dir}}/package.json must have prefix and version.",
+  "app.deploy.error.no_embed": "The package in {{dir}} has no embed module; only storefront embed packages are uploaded.",
+  "app.deploy.error.network": "Could not reach {{url}}: {{message}}",
+  "app.deploy.error.unauthorized": "The deploy token is invalid or revoked.",
+  "app.deploy.error.forbidden": "The deploy token may not upload versions.",
+  "app.deploy.error.app_not_found": "App {{prefix}} was not found in the token's organization.",
+  "app.deploy.error.http": "The server answered {{status}}."
 }

package/locales/tr.json

@@ -26,6 +26,11 @@
   "error.push.payload_too_large.message_unknown_size": "Tema paketi sunucu sınırını aşıyor.",
   "error.push.payload_too_large.hint": "Büyük görselleri sıkıştırın ya da temadan çıkarın.",
   "error.push.payload_too_large.largest_files_title": "En büyük dosyalar:",
+  "error.push.auth_refresh_failed.message": "Tema mağazası (partner) yetkisi yenilenemedi; CLI oturumunuz geçerli.",
+  "error.push.auth_refresh_failed.hint": "Yeniden bağlanmak için: tsoft login",
+  "error.push.theme_not_found.message": "Tema bulunamadı: {{theme}}",
+  "error.push.theme_not_found.message_with_detail": "Tema bulunamadı: {{theme}} ({{detail}})",
+  "error.push.theme_not_found.hint": "Bu mağazadaki temaları görmek için: tsoft theme list",
   "error.http.401.message": "Yetkilendirme hatası.",
   "error.http.401.hint": "Tekrar giriş yapın: tsoft login --org",
   "error.http.403.message": "Bu işlem için yetkiniz yok.",
@@ -61,6 +66,8 @@
   "login.port_in_use.message": "Giriş için gereken {{port}} numaralı port şu anda başka bir uygulama tarafından kullanılıyor.",
   "login.port_in_use.close_hint": "Başka bir terminalde açık kalmış bir \"tsoft login\" varsa o pencerede Ctrl+C ile durdurup tekrar deneyin.",
   "login.port_in_use.find_hint": "Portu hangi uygulamanın kullandığını görmek için şunu çalıştırın: {{command}}",
+  "login.port_in_use.owner": "Portu {{command}} (pid {{pid}}) kullanıyor.",
+  "login.port_in_use.stop_hint": "O uygulamaya ihtiyacınız yoksa şununla kapatın: {{command}}",
   "login.server_start_failed.message": "Giriş başlatılamadı: giriş için gereken yerel bağlantı bu bilgisayarda açılamadı.",
   "login.server_start_failed.hint": "Detaylar için: tsoft login --verbose",
   "login.security_error": "State parametresi eşleşmiyor! Güvenlik hatası olabilir.",
@@ -146,6 +153,8 @@
   "push.no_active_theme": "Aktif tema bulunamadı.",
   "push.usage": "Kullanim: tsoft theme push <theme-name>",
   "push.use_tip": "veya \"tsoft theme use <theme-name>\" ile aktif tema ayarlayın.",
+  "push.name_ambiguous.message": "\"{{name}}\" adını taşıyan birden çok tema var. Klasör adıyla push edin:",
+  "push.name_ambiguous.hint": "tsoft theme push <klasör>",
   "push.connecting": "Sunucuya bağlanılıyor...",
   "push.checking_status": "Mevcut durum kontrol ediliyor...",
   "push.pushing": "Tema push ediliyor...",
@@ -406,5 +415,25 @@
   "config.autoupgrade.status_on": "Sürüm kontrolü: açık",
   "config.autoupgrade.status_off": "Sürüm kontrolü: kapalı",
   "config.autoupgrade.usage": "Kullanım: tsoft config autoupgrade on | off | status",
-  "dev.no_active_store": "Aktif mağaza bulunamadı.\n\nGiriş yapmak için: tsoft login"
+  "dev.no_active_store": "Aktif mağaza bulunamadı.\n\nGiriş yapmak için: tsoft login",
+  "help.group.apps": "Uygulamalar",
+  "help.cmd.app_deploy": "Vitrin eklentisi sürümünü yayınlayın (CI)",
+  "app.deploy.published": "✓ Yayında: {{label}}",
+  "app.deploy.pending_review": "◷ İncelemede: {{label}} — T-Soft onayından sonra yayına çıkar",
+  "app.deploy.already_live": "↷ Atlandı: {{label}} zaten yayında",
+  "app.deploy.already_pending": "↷ Atlandı: {{label}} zaten incelemede",
+  "app.deploy.failed": "✗ Yüklenemedi: {{label}}",
+  "app.deploy.summary": "{{total}} paket: {{published}} yayında, {{pending}} incelemede, {{skipped}} atlandı, {{failed}} hata",
+  "app.deploy.error.no_token": "Deploy token'ı bulunamadı.",
+  "app.deploy.error.no_token_hint": "TSOFT_DEPLOY_TOKEN ortam değişkenini tanımlayın ya da --token verin.",
+  "app.deploy.error.not_a_directory": "{{dir}} bir klasör değil.",
+  "app.deploy.error.no_manifest": "{{dir}} içinde package.json yok.",
+  "app.deploy.error.bad_manifest": "{{dir}}/package.json okunamadı (geçersiz JSON).",
+  "app.deploy.error.missing_fields": "{{dir}}/package.json içinde prefix ve version olmalı.",
+  "app.deploy.error.no_embed": "{{dir}} paketinde embed modülü yok; yalnız vitrin eklentisi taşıyan paketler yüklenir.",
+  "app.deploy.error.network": "{{url}} adresine ulaşılamadı: {{message}}",
+  "app.deploy.error.unauthorized": "Deploy token'ı geçersiz ya da iptal edilmiş.",
+  "app.deploy.error.forbidden": "Deploy token'ının sürüm yükleme yetkisi yok.",
+  "app.deploy.error.app_not_found": "{{prefix}} uygulaması token'ın organizasyonunda bulunamadı.",
+  "app.deploy.error.http": "Sunucu {{status}} yanıtı verdi."
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tsoft-cli",
-  "version": "3.14.4",
+  "version": "3.15.0",
   "description": "Command-line tool for tsoft360 theme development and management",
   "type": "module",
   "main": "src/index.js",

package/src/app-package.js

@@ -0,0 +1,90 @@
+import { existsSync, readFileSync, readdirSync, statSync } from 'fs';
+import path from 'path';
+import AdmZip from 'adm-zip';
+
+/**
+ * Storefront embed package (installer layout): package.json, input.json,
+ * modules/trackingcode/*.html and embed/v<major>/*.js|css. Everything else —
+ * legacy/ template copies, README, sources — stays out of the upload, the same
+ * set the partner panel accepts.
+ */
+const ACCEPTED = [
+    /^package\.json$/,
+    /^input\.json$/,
+    /^modules\/trackingcode\/[A-Za-z0-9._-]+\.html$/,
+    /^embed\/v[0-9]+\/[A-Za-z0-9._-]+\.(js|css)$/,
+];
+
+export class AppPackageError extends Error {
+    constructor(key, vars = {}) {
+        super(key);
+        this.key = key;
+        this.vars = vars;
+    }
+}
+
+function listFiles(root, dir = '') {
+    const files = [];
+
+    for (const entry of readdirSync(path.join(root, dir), { withFileTypes: true })) {
+        const relative = dir ? `${dir}/${entry.name}` : entry.name;
+
+        if (entry.isDirectory()) {
+            files.push(...listFiles(root, relative));
+        } else if (entry.isFile()) {
+            files.push(relative);
+        }
+    }
+
+    return files;
+}
+
+/**
+ * @returns {{dir: string, prefix: string, version: string, files: string[]}}
+ */
+export function readAppPackage(dir) {
+    const root = path.resolve(dir);
+    const manifestPath = path.join(root, 'package.json');
+
+    if (!existsSync(root) || !statSync(root).isDirectory()) {
+        throw new AppPackageError('app.deploy.error.not_a_directory', { dir });
+    }
+
+    if (!existsSync(manifestPath)) {
+        throw new AppPackageError('app.deploy.error.no_manifest', { dir });
+    }
+
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(manifestPath, 'utf-8'));
+    } catch {
+        throw new AppPackageError('app.deploy.error.bad_manifest', { dir });
+    }
+
+    const prefix = typeof manifest.prefix === 'string' ? manifest.prefix.trim() : '';
+    const version = typeof manifest.version === 'string' ? manifest.version.trim() : '';
+
+    if (!prefix || !version) {
+        throw new AppPackageError('app.deploy.error.missing_fields', { dir });
+    }
+
+    const modules = Array.isArray(manifest.modules) ? manifest.modules : [];
+    if (!modules.some((module) => module?.type === 'embed')) {
+        throw new AppPackageError('app.deploy.error.no_embed', { dir });
+    }
+
+    const files = listFiles(root).filter((file) => ACCEPTED.some((pattern) => pattern.test(file))).sort();
+
+    return { dir: root, prefix, version, files };
+}
+
+/** Zip of the accepted files, laid out exactly like a partner panel upload. */
+export function buildAppPackageZip(pkg) {
+    const zip = new AdmZip();
+
+    for (const file of pkg.files) {
+        zip.addFile(file, readFileSync(path.join(pkg.dir, file)));
+    }
+
+    return zip.toBuffer();
+}

package/src/commands/app-deploy.js

@@ -0,0 +1,157 @@
+import axios from 'axios';
+import chalk from 'chalk';
+import path from 'path';
+import { APPS_API_URL } from '../config.js';
+import { isJsonMode, jsonOut, verboseLog } from '../output-mode.js';
+import { t } from '../i18n.js';
+import { AppPackageError, readAppPackage, buildAppPackageZip } from '../app-package.js';
+
+export const DEPLOY_TOKEN_ENV = 'TSOFT_DEPLOY_TOKEN';
+
+/**
+ * Sends one package to the deploy endpoint and turns the answer into a result row.
+ * The server runs the partner panel's checks; a first-party version with nothing to
+ * review goes live at once, anything else waits in the admin review queue.
+ */
+async function deployOne(dir, token, post) {
+    const row = { dir, prefix: null, version: null, result: 'failed', status: null, warnings: [], error: null };
+
+    let pkg;
+    try {
+        pkg = readAppPackage(dir);
+    } catch (error) {
+        row.error = error instanceof AppPackageError ? t(error.key, error.vars) : error.message;
+        return row;
+    }
+
+    row.prefix = pkg.prefix;
+    row.version = pkg.version;
+
+    const form = new FormData();
+    form.append('version', pkg.version);
+    form.append('file', new Blob([buildAppPackageZip(pkg)], { type: 'application/zip' }), `${path.basename(pkg.dir)}-${pkg.version}.zip`);
+
+    let response;
+    try {
+        response = await post(`${APPS_API_URL}/api/v3/deploy/apps/${encodeURIComponent(pkg.prefix)}/embed-versions`, form, {
+            headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+            maxBodyLength: Infinity,
+            validateStatus: () => true,
+        });
+    } catch (error) {
+        verboseLog(error);
+        row.error = t('app.deploy.error.network', { url: APPS_API_URL, message: error.message });
+        return row;
+    }
+
+    const body = response.data && typeof response.data === 'object' ? response.data : {};
+    const data = body.data ?? {};
+
+    row.status = data.status ?? null;
+    row.warnings = Array.isArray(data.warnings) ? data.warnings.map((warning) => warning.message) : [];
+
+    if (response.status >= 200 && response.status < 300) {
+        if (data.result === 'skipped') {
+            row.result = data.live ? 'already_live' : 'already_pending';
+        } else {
+            row.result = data.live ? 'published' : 'pending_review';
+        }
+        return row;
+    }
+
+    verboseLog(response.status, body);
+
+    const serverMessage = body.errors?.file?.[0] ?? Object.values(body.errors ?? {})[0]?.[0] ?? body.message;
+
+    if (response.status === 401) {
+        row.error = t('app.deploy.error.unauthorized');
+    } else if (response.status === 403) {
+        row.error = t('app.deploy.error.forbidden');
+    } else if (response.status === 404) {
+        row.error = t('app.deploy.error.app_not_found', { prefix: pkg.prefix });
+    } else {
+        row.error = serverMessage || t('app.deploy.error.http', { status: response.status });
+    }
+
+    return row;
+}
+
+function printRow(row) {
+    const label = row.prefix ? `${row.prefix} ${row.version}` : row.dir;
+
+    switch (row.result) {
+        case 'published':
+            console.log(chalk.green(t('app.deploy.published', { label })));
+            break;
+        case 'pending_review':
+            console.log(chalk.yellow(t('app.deploy.pending_review', { label })));
+            break;
+        case 'already_live':
+            console.log(chalk.gray(t('app.deploy.already_live', { label })));
+            break;
+        case 'already_pending':
+            console.log(chalk.gray(t('app.deploy.already_pending', { label })));
+            break;
+        default:
+            console.log(chalk.red(t('app.deploy.failed', { label })));
+            console.log(chalk.red(`   ${row.error}`));
+    }
+
+    if (row.result === 'pending_review' || row.result === 'published') {
+        for (const warning of row.warnings) {
+            console.log(chalk.gray(`   • ${warning}`));
+        }
+    }
+}
+
+/**
+ * tsoft app deploy [dirs...] — CI-friendly: no login, token from --token or TSOFT_DEPLOY_TOKEN.
+ * Exits non-zero when any package failed; a version left in review is not a failure.
+ */
+export async function appDeployCommand(dirs, options = {}, { post = axios.post, exit = process.exit } = {}) {
+    const token = (options.token ?? process.env[DEPLOY_TOKEN_ENV] ?? '').trim();
+    const targets = dirs?.length ? dirs : ['.'];
+
+    if (!token) {
+        if (isJsonMode()) {
+            jsonOut({ status: 'error', command: 'app deploy', error: { message: t('app.deploy.error.no_token'), hint: t('app.deploy.error.no_token_hint') } });
+        } else {
+            console.log(chalk.red(t('app.deploy.error.no_token')));
+            console.log(chalk.gray('   ' + t('app.deploy.error.no_token_hint')));
+        }
+        exit(1);
+        return [];
+    }
+
+    const results = [];
+
+    for (const dir of targets) {
+        const row = await deployOne(dir, token, post);
+        results.push(row);
+
+        if (!isJsonMode()) {
+            printRow(row);
+        }
+    }
+
+    const failed = results.filter((row) => row.result === 'failed').length;
+
+    if (isJsonMode()) {
+        jsonOut({ status: failed ? 'error' : 'success', command: 'app deploy', data: { results } });
+    } else if (targets.length > 1) {
+        console.log();
+        console.log(t('app.deploy.summary', {
+            total: results.length,
+            published: results.filter((row) => row.result === 'published').length,
+            pending: results.filter((row) => row.result === 'pending_review').length,
+            skipped: results.filter((row) => row.result.startsWith('already_')).length,
+            failed,
+        }));
+    }
+
+    if (failed) {
+        exit(1);
+    }
+
+    return results;
+}

package/src/commands/login.js

@@ -2,6 +2,7 @@ import open from 'open';
 import chalk from 'chalk';
 import {generateCodeVerifier, generateCodeChallenge} from '../pkce.js';
 import {startCallbackServer} from '../server.js';
+import { findPortOwner } from '../port-owner.js';
 import {exchangeToken, saveTokens, setActiveStore} from '../storage.js';
 import * as config from '../config.js';
 import { isJsonMode, jsonOut, verboseLog } from '../output-mode.js';
@@ -94,13 +95,21 @@ export async function loginCommand() {
     }
 }
 
-function exitOnListenFailure(error, port) {
+async function exitOnListenFailure(error, port) {
     verboseLog(error.message);
 
     if (error.code === 'EADDRINUSE') {
+        const owner = await findPortOwner(port);
         console.error(chalk.red('\n❌ ' + t('login.port_in_use.message', { port })));
+        if (owner) {
+            console.error(chalk.gray('   ' + t('login.port_in_use.owner', { command: owner.command || '-', pid: owner.pid })));
+        }
         console.error(chalk.gray('   ' + t('login.port_in_use.close_hint')));
-        console.error(chalk.gray('   ' + t('login.port_in_use.find_hint', { command: findPortOwnerCommand(port) })));
+        if (owner) {
+            console.error(chalk.gray('   ' + t('login.port_in_use.stop_hint', { command: stopProcessCommand(owner.pid) })));
+        } else {
+            console.error(chalk.gray('   ' + t('login.port_in_use.find_hint', { command: findPortOwnerCommand(port) })));
+        }
     } else {
         console.error(chalk.red('\n❌ ' + t('login.server_start_failed.message')));
         console.error(chalk.gray('   ' + t('login.server_start_failed.hint')));
@@ -109,6 +118,10 @@ function exitOnListenFailure(error, port) {
     process.exit(1);
 }
 
+function stopProcessCommand(pid) {
+    return process.platform === 'win32' ? `taskkill /PID ${pid}` : `kill ${pid}`;
+}
+
 function findPortOwnerCommand(port) {
     return process.platform === 'win32' ? `netstat -ano | findstr :${port}` : `lsof -i :${port}`;
 }

package/src/commands/theme-push.js

@@ -2,7 +2,8 @@ import chalk from 'chalk';
 import ora from 'ora';
 import { createApiClient } from '../api-client.js';
 import { describeActiveTheme, getActiveStore } from '../storage.js';
-import { formatMegabytes, mapPushError } from '../errors/error-mapper.js';
+import { formatMegabytes, mapPushError, themeNotFoundMessage, THEME_NOT_FOUND_CODE } from '../errors/error-mapper.js';
+import { resolveThemeTarget } from '../theme-list.js';
 import { isJsonMode, jsonOut } from '../output-mode.js';
 import { t } from '../i18n.js';
 
@@ -17,6 +18,61 @@ const CHANGE_CATEGORIES = {
 
 const LARGEST_FILES_SHOWN = 5;
 
+class PushTargetError extends Error {
+    constructor({ message, hint, code, matches = [] }) {
+        super(message);
+        this.hint = hint;
+        this.code = code;
+        this.matches = matches;
+    }
+}
+
+async function resolvePushTarget(themeName, apiClient) {
+    const target = await resolveThemeTarget(themeName, apiClient);
+
+    if (target.status === 'ambiguous') {
+        throw new PushTargetError({
+            message: t('push.name_ambiguous.message', { name: themeName }),
+            hint: t('push.name_ambiguous.hint'),
+            code: 'THEME-NAME-AMBIGUOUS',
+            matches: target.matches,
+        });
+    }
+
+    if (target.status === 'not_found') {
+        throw new PushTargetError({
+            message: themeNotFoundMessage(themeName),
+            hint: t('error.push.theme_not_found.hint'),
+            code: THEME_NOT_FOUND_CODE,
+        });
+    }
+
+    return target.folder;
+}
+
+function exitOnTargetError(error) {
+    if (isJsonMode()) {
+        jsonOut({
+            status: 'error',
+            command: 'theme push',
+            error: {
+                message: error.message,
+                hint: error.hint,
+                code: error.code,
+                ...(error.matches.length > 0 ? { details: { matches: error.matches.map(match => match.folder) } } : {}),
+            }
+        });
+        process.exit(1);
+    }
+
+    console.error(chalk.red(`X ${error.message}`));
+    for (const match of error.matches) {
+        console.log(chalk.gray(`  - ${match.folder}  ${match.name}`));
+    }
+    console.log(chalk.yellow(`  ${error.hint}`));
+    process.exit(1);
+}
+
 const PARTNERS_BASE = 'https://partners.tsoft360.com';
 const PARTNERS_THEMES_INDEX = `${PARTNERS_BASE}/themes`;
 
@@ -99,12 +155,12 @@ export async function themePushCommand(themeName, options = {}) {
     const verbose = options.verbose || false;
 
     // Tema belirleme
-    let themeUuid;
-    if (themeName) {
-        themeUuid = themeName;
-    } else {
+    let themeUuid = null;
+    let themeLabel = themeName;
+    if (!themeName) {
         const active = await describeActiveTheme();
         themeUuid = active?.uuid ?? null;
+        themeLabel = active?.label ?? themeUuid;
         if (active && !isJsonMode()) {
             const store = await getActiveStore();
             if (store) {
@@ -132,6 +188,10 @@ export async function themePushCommand(themeName, options = {}) {
         spinner.text = t('push.checking_status');
         const apiClient = await createApiClient();
 
+        if (themeName) {
+            themeUuid = await resolvePushTarget(themeName, apiClient);
+        }
+
         try {
             const statusResponse = await apiClient.getThemeDevStatus(themeUuid);
             previousVersion = statusResponse.data?.current_version || null;
@@ -190,15 +250,20 @@ export async function themePushCommand(themeName, options = {}) {
     } catch (error) {
         spinner.stop();
 
+        if (error instanceof PushTargetError) {
+            exitOnTargetError(error);
+        }
+
         // JSON mode error output
         if (isJsonMode()) {
-            const mapped = mapPushError(error, false);
+            const mapped = mapPushError(error, false, { theme: themeLabel });
             jsonOut({
                 status: 'error',
                 command: 'theme push',
                 error: {
                     message: mapped.message,
                     hint: mapped.hint || null,
+                    ...(mapped.code ? { code: mapped.code } : {}),
                     ...(mapped.details ? { details: mapped.details } : {}),
                 }
             });
@@ -207,7 +272,7 @@ export async function themePushCommand(themeName, options = {}) {
 
         // Push hatasi (axios error, error.response mevcut)
         if (error.response) {
-            const mapped = mapPushError(error, verbose);
+            const mapped = mapPushError(error, verbose, { theme: themeLabel });
             console.error(chalk.red(`X ${mapped.message}`));
             displayLargestFiles(mapped.details);
             if (mapped.hint) {

package/src/config.js

@@ -17,3 +17,6 @@ export const getRefreshUrl = (store) =>
 export const getRevokeUrl = (store) =>
   `https://${store}/oauth/revoke`;
 
+
+// T-Soft apps API (backend-core): app market, partner and deploy endpoints
+export const APPS_API_URL = (process.env.TSOFT_APPS_API_URL ?? 'https://api.tsoftapps.com').replace(/\/+$/, '');

package/src/errors/error-mapper.js

@@ -13,6 +13,10 @@ const ERROR_MAP = {
         message: 'error.push.auth.message',
         hint: 'error.push.auth.hint',
     },
+    'PUSH-AUTH-REFRESH-FAILED': {
+        message: 'error.push.auth_refresh_failed.message',
+        hint: 'error.push.auth_refresh_failed.hint',
+    },
     'PUSH-BACKEND-ERROR': {
         message: 'error.push.backend_error.message',
         hint: 'error.push.backend_error.hint',
@@ -33,6 +37,8 @@ const ERROR_MAP = {
 };
 
 const PAYLOAD_TOO_LARGE_STATUS = 413;
+const THEME_MISSING_STATUSES = new Set([404, 410]);
+export const THEME_NOT_FOUND_CODE = 'THEME-NOT-FOUND';
 const BYTES_PER_MEGABYTE = 1048576;
 
 const SMALLEST_ROUNDED_MEGABYTES = 0.1;
@@ -92,6 +98,23 @@ function mapPayloadTooLarge(responseData, verbose) {
     };
 }
 
+export function themeNotFoundMessage(theme, serverMessage = null) {
+    const detail = typeof serverMessage === 'string' ? serverMessage.trim() : '';
+
+    return detail
+        ? t('error.push.theme_not_found.message_with_detail', { theme, detail })
+        : t('error.push.theme_not_found.message', { theme });
+}
+
+function mapThemeNotFound(responseData, theme, verbose) {
+    return {
+        message: themeNotFoundMessage(theme, responseData?.message),
+        hint: t('error.push.theme_not_found.hint'),
+        raw: verbose ? responseData : null,
+        code: THEME_NOT_FOUND_CODE,
+    };
+}
+
 const HTTP_STATUS_MAP = {
     401: {
         message: 'error.http.401.message',
@@ -121,7 +144,7 @@ const HTTP_STATUS_MAP = {
  * @param {boolean} verbose - Detayli cikti
  * @returns {{ message: string, hint: string|null, raw: object|null }}
  */
-export function mapPushError(error, verbose = false) {
+export function mapPushError(error, verbose = false, { theme = null } = {}) {
     const responseData = error.response?.data;
     const errorCode = responseData?.error_code;
     const statusCode = error.response?.status;
@@ -137,9 +160,14 @@ export function mapPushError(error, verbose = false) {
             message: t(mapped.message),
             hint: t(mapped.hint),
             raw: verbose ? responseData : null,
+            code: errorCode,
         };
     }
 
+    if (theme && THEME_MISSING_STATUSES.has(statusCode)) {
+        return mapThemeNotFound(responseData, theme, verbose);
+    }
+
     // 2. Sunucu mesaji varsa (error_code bilinmiyor ama mesaj var)
     if (responseData?.message && errorCode) {
         return {

package/src/index.js

@@ -19,6 +19,7 @@ import { themeInitCommand } from './commands/theme-init.js';
 import { orgSwitchCommand } from './commands/org-switch.js';
 import { storeListCommand, storeUseCommand } from './commands/store.js';
 import { docsCommand } from './commands/docs.js';
+import { appDeployCommand } from './commands/app-deploy.js';
 import { upgradeCommand, buildUpgradeNotice } from './commands/upgrade.js';
 import { configAutoupgradeCommand } from './commands/config.js';
 import { getAutoupgrade, getLastCheck, setLastCheck } from './cli-settings.js';
@@ -329,6 +330,19 @@ theme
     await themeInitCommand(options.from);
   });
 
+// app commands
+const app = program
+  .command('app')
+  .description('App commands');
+
+app
+  .command('deploy [dirs...]')
+  .description('Upload storefront embed packages; live at once for first-party apps, otherwise sent to review')
+  .option('--token <token>', 'Organization deploy token (default: TSOFT_DEPLOY_TOKEN)')
+  .action(async (dirs, options) => {
+    await appDeployCommand(dirs, options);
+  });
+
 // store commands
 const store = program
   .command('store')

package/src/port-owner.js

@@ -0,0 +1,71 @@
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+
+const run = promisify(execFile);
+const PROBE_TIMEOUT_MS = 3000;
+
+export function parseLsofOutput(output) {
+    let pid = null;
+    let command = null;
+
+    for (const line of output.split('\n')) {
+        if (line.startsWith('p')) {
+            if (pid !== null) break;
+            pid = Number(line.slice(1));
+        } else if (line.startsWith('c') && pid !== null && command === null) {
+            command = line.slice(1).trim();
+        }
+    }
+
+    return Number.isInteger(pid) && pid > 0 ? { pid, command: command || null } : null;
+}
+
+export function parseNetstatOutput(output, port) {
+    for (const line of output.split(/\r?\n/)) {
+        const columns = line.trim().split(/\s+/);
+        if (columns.length < 5 || columns[0].toUpperCase() !== 'TCP') continue;
+        if (columns[3].toUpperCase() !== 'LISTENING') continue;
+        if (!columns[1].endsWith(`:${port}`)) continue;
+
+        const pid = Number(columns[4]);
+        if (Number.isInteger(pid) && pid > 0) return pid;
+    }
+
+    return null;
+}
+
+export function parseTasklistOutput(output) {
+    const match = output.match(/^"([^"]+)","\d+"/m);
+    return match ? match[1] : null;
+}
+
+async function findWindowsPortOwner(port) {
+    const { stdout } = await run('netstat', ['-ano', '-p', 'TCP'], { timeout: PROBE_TIMEOUT_MS, windowsHide: true });
+    const pid = parseNetstatOutput(stdout, port);
+    if (pid === null) return null;
+
+    try {
+        const { stdout: tasks } = await run('tasklist', ['/FI', `PID eq ${pid}`, '/FO', 'CSV', '/NH'], {
+            timeout: PROBE_TIMEOUT_MS,
+            windowsHide: true,
+        });
+        return { pid, command: parseTasklistOutput(tasks) };
+    } catch {
+        return { pid, command: null };
+    }
+}
+
+async function findUnixPortOwner(port) {
+    const { stdout } = await run('lsof', ['-nP', `-iTCP:${port}`, '-sTCP:LISTEN', '-Fpc'], { timeout: PROBE_TIMEOUT_MS });
+    return parseLsofOutput(stdout);
+}
+
+export async function findPortOwner(port) {
+    try {
+        return process.platform === 'win32'
+            ? await findWindowsPortOwner(port)
+            : await findUnixPortOwner(port);
+    } catch {
+        return null;
+    }
+}

package/src/theme-list.js

@@ -1,4 +1,5 @@
 import { createApiClient } from './api-client.js';
+import { isThemeUuid, slugify } from './storage.js';
 
 export async function fetchAllThemes(client = null) {
     const apiClient = client ?? await createApiClient();
@@ -23,3 +24,46 @@ export async function fetchAllThemes(client = null) {
 
     return { themes: all, envelope };
 }
+
+function folderOf(theme) {
+    return theme.theme_folder || theme.alias || null;
+}
+
+function sameName(name, identifier) {
+    if (typeof name !== 'string') return false;
+    return name.trim().toLowerCase() === identifier.trim().toLowerCase() || slugify(name) === identifier;
+}
+
+export async function resolveThemeTarget(identifier, client) {
+    if (isThemeUuid(identifier)) {
+        return { status: 'direct', folder: identifier };
+    }
+
+    let themes;
+    try {
+        ({ themes } = await fetchAllThemes(client));
+    } catch {
+        return { status: 'direct', folder: identifier };
+    }
+
+    if (themes.some(theme => theme.theme_folder === identifier || theme.alias === identifier)) {
+        return { status: 'direct', folder: identifier };
+    }
+
+    const matches = themes
+        .filter(theme => sameName(theme.name, identifier) && folderOf(theme))
+        .filter((theme, index, all) => all.findIndex(other => folderOf(other) === folderOf(theme)) === index);
+
+    if (matches.length === 1) {
+        return { status: 'resolved', folder: folderOf(matches[0]), name: matches[0].name };
+    }
+
+    if (matches.length > 1) {
+        return {
+            status: 'ambiguous',
+            matches: matches.map(theme => ({ name: theme.name, folder: folderOf(theme) })),
+        };
+    }
+
+    return { status: 'not_found' };
+}

package/src/ui/help-renderer.js

@@ -56,6 +56,12 @@ const COMMAND_GROUPS = [
             { display: 'theme fork',   descKey: 'help.cmd.theme_init' },
         ]
     },
+    {
+        groupKey: 'help.group.apps',
+        commands: [
+            { display: 'app deploy', descKey: 'help.cmd.app_deploy' },
+        ]
+    },
     {
         groupKey: 'help.group.account',
         commands: [