update

internal/app/static/app.css

@@ -25,6 +25,7 @@ body {
 }
 
 button, input { font: inherit; }
+button:disabled { cursor: wait; opacity: .58; }
 
 .topbar {
   position: sticky;
@@ -208,6 +209,12 @@ dd { margin: 4px 0 0; overflow-wrap: anywhere; }
 .package-row small { color: var(--muted); }
 .toggle { display: flex; align-items: center; gap: 9px; }
 .empty, .fine-print { color: var(--muted); }
+.package-forms { display: grid; gap: 26px; }
+.form-title { margin: 0; color: var(--ink); font-weight: 850; }
+.upload-status { min-height: 1.2em; margin: 0; color: var(--amber); overflow-wrap: anywhere; }
+.manual-metadata { padding-top: 22px; border-top: 1px solid var(--line); }
+.manual-metadata summary { color: var(--accent); cursor: pointer; font-weight: 750; }
+.manual-metadata[open] summary { margin-bottom: 22px; }
 
 .audit-panel { margin-top: 24px; }
 .audit-table { display: grid; max-height: 520px; overflow: auto; }

internal/app/static/app.js

@@ -14,3 +14,35 @@ document.addEventListener("click", async (event) => {
     button.textContent = "Copy failed";
   }
 });
+
+document.addEventListener("submit", async (event) => {
+  const form = event.target.closest("[data-upload-form]");
+  if (!form) return;
+  event.preventDefault();
+
+  const button = form.querySelector("button[type=submit]");
+  const status = form.querySelector("[data-upload-status]");
+  const csrfToken = form.querySelector('input[name="csrf_token"]').value;
+  button.disabled = true;
+  status.textContent = "Uploading package… keep this page open.";
+
+  try {
+    const response = await fetch(form.action, {
+      method: "POST",
+      body: new FormData(form),
+      headers: {"X-CSRF-Token": csrfToken},
+      credentials: "same-origin",
+    });
+    const result = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      throw new Error(result.error || `Upload failed with HTTP ${response.status}`);
+    }
+    status.textContent = `Uploaded ${result.filename}; SHA-256 ${result.sha256}`;
+    window.setTimeout(() => {
+      window.location.assign("/portal?notice=Package+uploaded+and+registered");
+    }, 900);
+  } catch (error) {
+    status.textContent = error.message;
+    button.disabled = false;
+  }
+});