[duyet]

What

Generic, app-agnostic publishing, like anyr api. No app names in Rust.

• anyr api: --data @file, --data - (stdin), -H key:value (repeatable), --idempotency-key.
• anyr publish <app> [file|-] [--visibility unlisted|private|public] [--yes] [--dry-run] [--json]: GET /v1/apps/<app>/schema, validate locally, exit 2 with field errors, POST /v1/apps/<app>/submissions with Idempotency-Key = hash of app + canonical payload, print the URL.
• anyr apps schema|ls|rm|visibility: thin wrappers over the same client.
• Fix: --data and --method were not value flags in the parser, so anyr api ... --data '{...}' never worked. They are now.

Notes

• Validator is in-house (src/schema.rs, ~200 lines), not the jsonschema crate: that crate pulls regex and more, which risks the 4 MiB binary cap and the wasm build. Covers type, enum, const, properties, required, additionalProperties, items, prefixItems, size bounds, anyOf/oneOf/allOf/not, local $ref. pattern and format are ignored locally; the server re-validates.
• Schema is fetched each run (no 1h cache yet).
• Server contract is coded from the spec and mocked in tests; routes land in duyet/anyrouter feat/app-submissions-api.
• Public publish asks for confirmation (--yes in scripts).

Tests

cargo test --locked --all-targets, cargo clippy, cargo fmt --check all clean. tests/publish.rs (12): stdin/@file/-H, local validation exit 2 with no POST, stable idempotency key, 404 exit 3, visibility, apps verbs, and a grep test that no app name appears in src/ outside help examples.

🤖 Generated with Claude Code

[duyetbot]

Reviewed: validator, auth origin, path encoding, input cap (fixed in this branch), release binary 3.30 MiB (<4 MiB), tests pass.