@shipvo/cli 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,73 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.
+
+"Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:
+
+     (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and
+
+     (b) You must cause any modified files to carry prominent notices stating that You changed the files; and
+
+     (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
+
+     (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.
+
+     You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!)  The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/README.md

@@ -1,3 +1,13 @@
-# Temporary Holding Version
+# @shipvo/cli
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Command-line tools for [Shipvo](https://github.com/shipvo/shipvo), the open-source React Native framework for signed over-the-air updates.
+
+```bash
+npx @shipvo/cli keygen --out seed.txt   # Ed25519 release signing key
+npx @shipvo/cli hash bundle.hbc         # SHA-256 and size
+npx @shipvo/cli sign-file bundle.hbc    # signature over bytes
+```
+
+Also usable as a library: `signDoc`, `verifyDoc`, `signBytes`, `sha256Hex`, `keyFromSeed`.
+
+License: Apache-2.0

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+import { readFileSync, writeFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { b64, keyFromSeed, sha256Hex, signBytes, signDoc, verifyDoc } from "./index.js";
+import { seed } from "./config.js";
+import { init } from "./init.js";
+import { publish, rollback } from "./publish.js";
+import { sim } from "./sim.js";
+import { keys, login, mcp } from "./login.js";
+const [cmd, ...rest] = process.argv.slice(2);
+const help = `shipvo <command>
+
+  init <dir>                  New app wired to Shipvo: OTA runtime, device API, simulator, publish workflow
+  sim [--port 4545]           Build the app for the simulator and serve it (agents: open_app("<appId>"))
+  publish [--bands b0,b1,b2]  Build, sign and publish an over-the-air release (+ the agent-facing web artifact)
+  rollback --to <release>     Republish an earlier release's code as a new release
+  login                       Sign in with GitHub and get a key for the hosted simulator
+  keys                        Show the stored key's status and quota
+  mcp                         Print the MCP config agents need (hosted and local)
+
+  keygen [--out seed.txt]     Create an Ed25519 release signing key; prints the public key
+  pubkey                      Print the public key for the seed in SHIPVO_SIGNING_SEED
+  hash <file>                 SHA-256 and size of a bundle
+  sign-file <file>            Ed25519 signature (base64) over a file's bytes
+  sign-json <file.json>       Sign a JSON document (canonical form); writes signature into it
+  verify-json <file.json> <public-key-b64>
+`;
+switch (cmd) {
+    case "init":
+        await init(rest);
+        break;
+    case "sim":
+        await sim(rest);
+        break;
+    case "publish":
+        await publish(rest);
+        break;
+    case "rollback":
+        await rollback(rest);
+        break;
+    case "login":
+        await login(rest);
+        break;
+    case "keys":
+        await keys();
+        break;
+    case "mcp":
+        mcp();
+        break;
+    case "keygen": {
+        const s = b64(randomBytes(32));
+        const out = rest[rest.indexOf("--out") + 1];
+        if (rest.includes("--out") && out) {
+            writeFileSync(out, s, { mode: 0o600 });
+            console.error(`Seed written to ${out}. Back it up offline; never commit it.`);
+        }
+        else
+            console.log(`seed (secret): ${s}`);
+        console.log(`public key: ${b64(keyFromSeed(s).publicKey)}`);
+        break;
+    }
+    case "pubkey":
+        console.log(b64(keyFromSeed(seed()).publicKey));
+        break;
+    case "hash": {
+        const b = readFileSync(rest[0]);
+        console.log(JSON.stringify({ sha256: sha256Hex(b), size: b.length }));
+        break;
+    }
+    case "sign-file":
+        console.log(signBytes(new Uint8Array(readFileSync(rest[0])), seed()));
+        break;
+    case "sign-json": {
+        const d = JSON.parse(readFileSync(rest[0], "utf8"));
+        writeFileSync(rest[0], JSON.stringify(signDoc(d, seed()), null, 2));
+        console.log("signed");
+        break;
+    }
+    case "verify-json": {
+        const ok = verifyDoc(JSON.parse(readFileSync(rest[0], "utf8")), rest[1]);
+        console.log(ok ? "valid" : "INVALID");
+        process.exit(ok ? 0 : 1);
+    }
+    default:
+        console.log(help);
+        process.exit(cmd ? 1 : 0);
+}

package/dist/config.d.ts

@@ -0,0 +1,25 @@
+/** shipvo.json at the app root: what `shipvo init` writes and every other command reads. */
+export type ShipvoConfig = {
+    appId: string;
+    name: string;
+    shellMajor: number;
+    /** Control plane the shell trusts (also in app.json's @shipvo/runtime plugin props). */
+    controlPlane: string;
+    /** Base64 Ed25519 public key built into the shell. */
+    publicKey: string;
+    /** Where `shipvo publish` writes: the control plane's Cloudflare KV namespace. */
+    kv?: {
+        namespaceId: string;
+    };
+};
+export declare function loadConfig(dir?: string): ShipvoConfig;
+export declare const args: (argv: string[]) => Record<string, string | undefined>;
+/** Signing seed: SHIPVO_SIGNING_SEED (PURENATIVE_SIGNING_SEED still accepted) or a *_FILE path. */
+export declare function seed(): string;
+/** Cloudflare KV access for publish/rollback. */
+export declare function kv(cfg: ShipvoConfig): {
+    get(k: string): Promise<string | null>;
+    getBytes(k: string): Promise<Uint8Array<ArrayBuffer> | null>;
+    keys(prefix: string): Promise<any>;
+    put(k: string, body: BodyInit, type: string): Promise<void>;
+};

package/dist/config.js

@@ -0,0 +1,49 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+export function loadConfig(dir = process.cwd()) {
+    const p = join(dir, "shipvo.json");
+    if (!existsSync(p))
+        throw new Error("No shipvo.json here. Run this inside an app created with `shipvo init`, or create one (see docs/getting-started.md).");
+    const c = JSON.parse(readFileSync(p, "utf8"));
+    for (const k of ["appId", "controlPlane", "publicKey"])
+        if (!c[k])
+            throw new Error(`shipvo.json: "${k}" is required`);
+    return { shellMajor: 1, name: c.appId, ...c };
+}
+const argPairs = (argv) => Object.fromEntries(argv.reduce((a, x, i, all) => (x.startsWith("--") ? [...a, [x.slice(2), all[i + 1] === undefined || all[i + 1].startsWith("--") ? "true" : all[i + 1]]] : a), []));
+export const args = (argv) => argPairs(argv);
+/** Signing seed: SHIPVO_SIGNING_SEED (PURENATIVE_SIGNING_SEED still accepted) or a *_FILE path. */
+export function seed() {
+    const e = process.env;
+    const s = e.SHIPVO_SIGNING_SEED || e.PURENATIVE_SIGNING_SEED
+        || ((e.SHIPVO_SIGNING_SEED_FILE || e.PURENATIVE_SIGNING_SEED_FILE) && readFileSync((e.SHIPVO_SIGNING_SEED_FILE || e.PURENATIVE_SIGNING_SEED_FILE), "utf8").trim());
+    if (!s) {
+        console.error("Set SHIPVO_SIGNING_SEED or SHIPVO_SIGNING_SEED_FILE (the seed `shipvo keygen` printed).");
+        process.exit(2);
+    }
+    return s;
+}
+/** Cloudflare KV access for publish/rollback. */
+export function kv(cfg) {
+    const ACC = process.env.CLOUDFLARE_ACCOUNT_ID, TOKEN = process.env.CLOUDFLARE_API_TOKEN;
+    const NS = process.env.SHIPVO_KV_ID || process.env.PURENATIVE_KV_ID || cfg.kv?.namespaceId;
+    if (!ACC || !TOKEN || !NS) {
+        console.error("Need CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_API_TOKEN and the control plane's KV namespace (shipvo.json kv.namespaceId or SHIPVO_KV_ID).");
+        process.exit(2);
+    }
+    const url = (k) => `https://api.cloudflare.com/client/v4/accounts/${ACC}/storage/kv/namespaces/${NS}/values/${encodeURIComponent(k)}`;
+    const auth = { Authorization: `Bearer ${TOKEN}` };
+    return {
+        async get(k) { const r = await fetch(url(k), { headers: auth }); return r.ok ? r.text() : null; },
+        async getBytes(k) { const r = await fetch(url(k), { headers: auth }); return r.ok ? new Uint8Array(await r.arrayBuffer()) : null; },
+        async keys(prefix) {
+            const r = await fetch(`https://api.cloudflare.com/client/v4/accounts/${ACC}/storage/kv/namespaces/${NS}/keys?prefix=${encodeURIComponent(prefix)}&limit=1000`, { headers: auth });
+            return r.ok ? (await r.json()).result.map((k) => k.name) : [];
+        },
+        async put(k, body, type) {
+            const r = await fetch(url(k), { method: "PUT", headers: { ...auth, "content-type": type }, body });
+            if (!r.ok)
+                throw new Error(`KV put ${k}: ${r.status} ${await r.text()}`);
+        },
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+import * as ed from "@noble/ed25519";
+export declare const b64: (u: Uint8Array) => string;
+export declare const unb64: (s: string) => Uint8Array<ArrayBuffer>;
+/** Seed is 32 random bytes, base64. Public key is derived. */
+export declare function keyFromSeed(seedB64: string): {
+    seed: Uint8Array<ArrayBuffer>;
+    publicKey: ed.Bytes;
+};
+export declare function signDoc<T extends object>(doc: T, seedB64: string): T & {
+    signature: string;
+};
+export declare function verifyDoc(doc: {
+    signature: string;
+}, publicKeyB64: string): boolean;
+export declare function signBytes(bytes: Uint8Array, seedB64: string): string;
+export declare function sha256Hex(bytes: Uint8Array): string;

package/dist/index.js

@@ -0,0 +1,31 @@
+import * as ed from "@noble/ed25519";
+import { sha512 } from "@noble/hashes/sha512";
+import { sha256 } from "@noble/hashes/sha256";
+import { bytesToHex } from "@noble/hashes/utils";
+import { canonicalize } from "@shipvo/schema";
+ed.etc.sha512Sync = (...m) => sha512(ed.etc.concatBytes(...m));
+const enc = new TextEncoder();
+export const b64 = (u) => Buffer.from(u).toString("base64");
+export const unb64 = (s) => new Uint8Array(Buffer.from(s, "base64"));
+/** Seed is 32 random bytes, base64. Public key is derived. */
+export function keyFromSeed(seedB64) {
+    const seed = unb64(seedB64);
+    if (seed.length !== 32)
+        throw new Error("signing seed must be 32 bytes (base64)");
+    return { seed, publicKey: ed.getPublicKey(seed) };
+}
+export function signDoc(doc, seedB64) {
+    const { seed } = keyFromSeed(seedB64);
+    const sig = ed.sign(enc.encode(canonicalize(doc)), seed);
+    return { ...doc, signature: b64(sig) };
+}
+export function verifyDoc(doc, publicKeyB64) {
+    try {
+        return ed.verify(unb64(doc.signature), enc.encode(canonicalize(doc)), unb64(publicKeyB64));
+    }
+    catch {
+        return false;
+    }
+}
+export function signBytes(bytes, seedB64) { return b64(ed.sign(bytes, keyFromSeed(seedB64).seed)); }
+export function sha256Hex(bytes) { return bytesToHex(sha256(bytes)); }

package/dist/init.d.ts

@@ -0,0 +1 @@
+export declare function init(argv: string[]): Promise<void>;

package/dist/init.js

@@ -0,0 +1,195 @@
+// `shipvo init <dir>`: a new Expo app wired to Shipvo: signed OTA runtime + plugin, the device API, the simulator,
+// a publish workflow and a shipvo.json. Everything an agent needs to open it is in place on the first commit.
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { join, resolve } from "node:path";
+import { b64, keyFromSeed } from "./index.js";
+import { args as parse } from "./config.js";
+const HOSTED = "https://purenative-control.purenative.workers.dev";
+const SDK = { expo: "~58.0.21", camera: "~58.0.14", clipboard: "~58.0.4", localAuth: "~58.0.2", location: "~58.0.20", notifications: "~58.1.7", statusBar: "~58.0.4", constants: "~58.0.0", metroRuntime: "~58.0.15", react: "19.3.0", rn: "0.88.1", rnw: "^0.21.4" };
+const title = (s) => s.replace(/[-_]+/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
+export async function init(argv) {
+    const [dirArg] = argv.filter((x) => !x.startsWith("--") && !argv[argv.indexOf(x) - 1]?.startsWith("--"));
+    const a = parse(argv);
+    if (!dirArg) {
+        console.error("Usage: shipvo init <dir> [--app-id myshop] [--name \"My Shop\"] [--control-plane URL] [--public-key B64] [--bundle-id com.example.myshop]");
+        process.exit(2);
+    }
+    const dir = resolve(dirArg);
+    if (existsSync(dir)) {
+        console.error(`${dir} already exists`);
+        process.exit(1);
+    }
+    const appId = (a["app-id"] || dirArg.split("/").pop().toLowerCase().replace(/[^a-z0-9-]/g, "-")).slice(0, 32);
+    const name = a.name || title(appId);
+    const controlPlane = (a["control-plane"] || HOSTED).replace(/\/$/, "");
+    const bundleId = a["bundle-id"] || `dev.shipvo.${appId.replace(/-/g, "")}`;
+    // Signing key: use the one given, or make one. The seed never enters the repo; the public key is pinned in the shell.
+    let publicKey = a["public-key"], seedNote = "";
+    if (!publicKey) {
+        const seed = b64(randomBytes(32));
+        publicKey = b64(keyFromSeed(seed).publicKey);
+        mkdirSync(join(dir, ".shipvo"), { recursive: true });
+        writeFileSync(join(dir, ".shipvo", "seed.txt"), seed, { mode: 0o600 });
+        seedNote = `A release signing key was created at .shipvo/seed.txt (git-ignored). Back it up offline and put it in the SHIPVO_SIGNING_SEED secret of your CI. Lose it and you cannot publish to installed shells.`;
+    }
+    const w = (p, body) => { mkdirSync(join(dir, p, ".."), { recursive: true }); writeFileSync(join(dir, p), body); };
+    w("shipvo.json", JSON.stringify({ appId, name, shellMajor: 1, controlPlane, publicKey }, null, 2) + "\n");
+    w("package.json", JSON.stringify({
+        name: appId, version: "1.0.0", main: "index.ts", private: true,
+        scripts: { start: "expo start", android: "expo run:android", ios: "expo run:ios", web: "expo start --web", sim: "shipvo sim", publish: "shipvo publish", rollback: "shipvo rollback", typecheck: "tsc --noEmit" },
+        dependencies: {
+            "@expo/metro-runtime": SDK.metroRuntime, expo: SDK.expo, "expo-camera": SDK.camera, "expo-clipboard": SDK.clipboard, "expo-constants": SDK.constants,
+            "expo-local-authentication": SDK.localAuth, "expo-location": SDK.location, "expo-notifications": SDK.notifications, "expo-status-bar": SDK.statusBar,
+            react: SDK.react, "react-dom": SDK.react, "react-native": SDK.rn, "react-native-web": SDK.rnw,
+            "@shipvo/device": "^0.1.0", "@shipvo/runtime": "^0.1.0",
+        },
+        devDependencies: { "@shipvo/cli": "^0.1.0", "@shipvo/sim": "^0.1.0", "@types/react": "~19.3.0", playwright: "^1.63.0", typescript: "~6.0.3" },
+    }, null, 2) + "\n");
+    w("app.json", JSON.stringify({ expo: {
+            name, slug: appId, version: "1.0.0", orientation: "portrait", userInterfaceStyle: "automatic",
+            ios: { bundleIdentifier: bundleId, supportsTablet: false },
+            android: { package: bundleId, versionCode: 1, predictiveBackGestureEnabled: false },
+            web: { output: "single" },
+            plugins: [
+                ["@shipvo/runtime", { baseUrl: controlPlane, publicKey, appId, shellMajor: 1 }],
+                ["expo-camera", { cameraPermission: `${name} uses the camera to scan codes.` }],
+                ["expo-location", { locationWhenInUsePermission: `${name} uses your location to find what is near you.` }],
+                ["expo-local-authentication", { faceIDPermission: `${name} uses Face ID to confirm actions.` }],
+                ["expo-notifications", {}],
+            ],
+        } }, null, 2) + "\n");
+    w("tsconfig.json", JSON.stringify({ extends: "expo/tsconfig.base", compilerOptions: { strict: true, allowImportingTsExtensions: true, noEmit: true }, exclude: ["node_modules"] }, null, 2) + "\n");
+    w("metro.config.js", `// Shipvo: PN_SIM=1 web builds use the simulated device (system sheets in the accessibility tree) instead of Expo's native modules.
+const { getDefaultConfig } = require("expo/metro-config");
+const withShipvoSim = require("@shipvo/device/metro");
+module.exports = withShipvoSim(getDefaultConfig(__dirname));
+`);
+    w("index.ts", `import { registerRootComponent } from "expo";\nimport App from "./App";\nregisterRootComponent(App);\n`);
+    w(".gitignore", `node_modules/\n.expo/\ndist/\ndist-ota/\ndist-web/\nsim-dist/\nweb-build/\n/ios\n/android\n.kotlin/\n*.jks\n*.p8\n*.p12\n*.key\n*.mobileprovision\n*.tsbuildinfo\n.env*.local\n.DS_Store\n# never commit the release signing seed\n.shipvo/\n`);
+    w("src/release.ts", `// Edit and push: the publish workflow signs and ships this to every installed phone and to the simulator.
+export const RELEASE = { headline: "Release 1: hello from ${name}.", note: "Edit src/release.ts and push to main." };
+`);
+    w("App.tsx", APP_TSX(name, appId));
+    w(".github/workflows/publish.yml", WORKFLOW);
+    w("README.md", README(name, appId, controlPlane));
+    console.log(`
+Created ${name} in ${dirArg}
+
+  cd ${dirArg}
+  npm install                 # or pnpm / bun
+  npx playwright install chromium
+  npm run sim                 # the app in the simulator on http://localhost:4545
+  npx -y @shipvo/mcp          # point Claude / Cursor / ChatGPT at it and open_app("${appId}")
+
+Phones:  npx expo run:android   (needs Android Studio once; the OTA runtime is Android-first)
+Publish: set CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID, SHIPVO_KV_ID and SHIPVO_SIGNING_SEED, then npm run publish
+         (self-host the control plane from services/control-plane, or ask for a hosted app id during the beta)
+
+${seedNote}
+Public key pinned in the shell: ${publicKey}
+`);
+}
+const APP_TSX = (name, appId) => `import { useEffect, useRef, useState } from "react";
+import { AppState, Pressable, ScrollView, StyleSheet, Text, View } from "react-native";
+import { StatusBar } from "expo-status-bar";
+import { Runtime } from "@shipvo/runtime";
+import { device } from "@shipvo/device";
+import { ScanHost } from "@shipvo/device/scan";
+import { RELEASE } from "./src/release";
+
+const POLL_MS = 10_000;
+
+export default function App() {
+  const [state] = useState(() => { try { return Runtime.getState(); } catch { return null; } });
+  const [log, setLog] = useState<string[]>([]);
+  const busy = useRef(false);
+  const add = (t: string) => setLog((l) => [t, ...l].slice(0, 20));
+
+  // Over-the-air updates: tell the runtime the first screen rendered (so this release is kept), then poll while open.
+  useEffect(() => {
+    try { const h = Runtime.markHealthy(); add(\`Running release \${h.release}\`); } catch {}
+    const check = async () => {
+      if (busy.current || !state?.baseUrl) return; busy.current = true;
+      try { const r = await Runtime.checkForUpdate(true); if (r.status === "staged") add(\`Applied release \${r.release} (\${r.via ?? "full"})\`); }
+      finally { busy.current = false; }
+    };
+    check(); const id = setInterval(() => { if (AppState.currentState === "active") check(); }, POLL_MS);
+    return () => clearInterval(id);
+  }, []);
+
+  // Device API: real on phones, simulated in the simulator (agents answer the system sheets and set what the camera sees).
+  const scan = async () => { try { const r = await device.camera.scan({ prompt: "Point at a code" }); add(r ? \`Scanned \${r.data}\` : "Scan cancelled"); } catch (e: any) { add(String(e.message)); } };
+  const locate = async () => { try { const c = await device.location.current(); add(\`At \${c.latitude.toFixed(4)}, \${c.longitude.toFixed(4)}\`); } catch (e: any) { add(String(e.message)); } };
+  const notify = async () => { await device.notifications.show({ title: "${name}", body: "Hello from a notification.", data: {} }); add("Notification sent"); };
+  const confirm = async () => { const r = await device.auth.confirm("Confirm it is you"); add(r.ok ? "Confirmed" : \`Not confirmed (\${r.reason})\`); };
+
+  return (
+    <View style={s.root}>
+      <StatusBar style="dark" />
+      <ScrollView contentContainerStyle={s.page}>
+        <Text style={s.h1} accessibilityRole="header">${name}</Text>
+        <View style={s.hero}><Text style={s.heroText}>{RELEASE.headline}</Text><Text style={s.heroNote}>{RELEASE.note}</Text></View>
+        <Text style={s.h2} accessibilityRole="header">Try the device</Text>
+        <Btn label="Scan a code" onPress={scan} />
+        <Btn label="Use my location" onPress={locate} />
+        <Btn label="Confirm with fingerprint" onPress={confirm} />
+        <Btn label="Send a notification" onPress={notify} />
+        <Text style={s.h2} accessibilityRole="header">Log</Text>
+        {log.length === 0 ? <Text style={s.muted}>Nothing yet.</Text> : log.map((l, i) => <Text key={i} style={s.line}>{l}</Text>)}
+        <Text style={s.muted}>App id ${appId} · shell {state?.shellVersion ?? "none"} · release {state?.runningRelease ?? 0}</Text>
+      </ScrollView>
+      <ScanHost accent="#1F4E5F" />
+    </View>
+  );
+}
+
+function Btn({ label, onPress }: { label: string; onPress: () => void }) {
+  return <Pressable accessibilityRole="button" accessibilityLabel={label} onPress={onPress} style={s.btn}><Text style={s.btnText}>{label}</Text></Pressable>;
+}
+
+const s = StyleSheet.create({
+  root: { flex: 1, backgroundColor: "#F6F8F7" },
+  page: { padding: 20, paddingTop: 56, gap: 12 },
+  h1: { fontSize: 28, fontWeight: "800", color: "#111" }, h2: { fontSize: 17, fontWeight: "700", color: "#111", marginTop: 8 },
+  hero: { backgroundColor: "#1F4E5F", borderRadius: 16, padding: 20, gap: 6 },
+  heroText: { color: "#fff", fontSize: 20, fontWeight: "800" }, heroNote: { color: "#fff", opacity: 0.9 },
+  btn: { minHeight: 48, borderRadius: 10, borderWidth: 1, borderColor: "#CBD5D1", alignItems: "center", justifyContent: "center", backgroundColor: "#fff" },
+  btnText: { fontSize: 16, fontWeight: "700", color: "#111" },
+  line: { fontSize: 14, color: "#111" }, muted: { fontSize: 13, color: "#5B6B66" },
+});
+`;
+const WORKFLOW = `name: publish
+on:
+  push:
+    branches: [main]
+    paths: ["src/**", "App.tsx"]
+  workflow_dispatch:
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    concurrency: shipvo-publish
+    if: \${{ github.event_name != 'push' || !contains(github.event.head_commit.message, '[no-ota]') }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 22 }
+      - run: npm ci
+      - run: pip install --break-system-packages bsdiff4
+      - name: Build, sign and publish over the air
+        env:
+          CLOUDFLARE_API_TOKEN: \${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: \${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          SHIPVO_KV_ID: \${{ secrets.SHIPVO_KV_ID }}
+          SHIPVO_SIGNING_SEED: \${{ secrets.SHIPVO_SIGNING_SEED }}
+        run: npx shipvo publish | tee -a "$GITHUB_STEP_SUMMARY"
+`;
+const README = (name, appId, cp) => `# ${name}
+
+A [Shipvo](https://github.com/shipvo/shipvo) app: one React Native codebase that people install from the stores and AI agents operate in a simulator, kept current with signed over-the-air releases.
+
+- \`npm run sim\` opens it in the simulator; \`npx -y @shipvo/mcp\` lets Claude, Cursor or ChatGPT use it (\`open_app("${appId}")\`).
+- \`npx expo run:android\` builds the native shell (the trust root and control plane \`${cp}\` are pinned in it).
+- Push to \`main\`: the publish workflow signs the new JavaScript and every phone and simulator gets it.
+- \`src/release.ts\` is the first thing to edit; \`App.tsx\` shows the device API (camera, location, biometrics, notifications).
+`;

package/dist/login.d.ts

@@ -0,0 +1,9 @@
+export declare function savedCreds(): {
+    key: string;
+    control: string;
+    mcp_url: string;
+    login?: string;
+} | null;
+export declare function login(argv: string[]): Promise<void>;
+export declare function keys(): Promise<void>;
+export declare function mcp(): void;

package/dist/login.js

@@ -0,0 +1,77 @@
+// `shipvo login`: sign in with GitHub (device flow) and get an API key for the hosted simulator.
+// `shipvo keys`: show the stored key's status. `shipvo mcp`: print the MCP config for agents.
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { args as parse } from "./config.js";
+const HOSTED = "https://purenative-control.purenative.workers.dev";
+const credFile = () => join(process.env.SHIPVO_HOME || join(homedir(), ".shipvo"), "credentials.json");
+export function savedCreds() {
+    try {
+        return JSON.parse(readFileSync(credFile(), "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+export async function login(argv) {
+    const a = parse(argv);
+    const control = (a["control-plane"] || process.env.SHIPVO_CONTROL || HOSTED).replace(/\/$/, "");
+    const start = await fetch(`${control}/auth/device/start`, { method: "POST" });
+    const s = await start.json();
+    if (!start.ok) {
+        console.error(`Login is not available on ${control}: ${s.message ?? s.error}`);
+        process.exit(1);
+    }
+    console.log(`\nOpen ${s.verification_uri} and enter the code:\n\n    ${s.user_code}\n\nWaiting for GitHub…`);
+    const deadline = Date.now() + (s.expires_in ?? 900) * 1000;
+    let interval = (s.interval ?? 5) * 1000;
+    while (Date.now() < deadline) {
+        await new Promise((r) => setTimeout(r, interval));
+        const r = await fetch(`${control}/auth/device/poll`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ device_code: s.device_code }) });
+        const d = await r.json();
+        if (r.status === 202) {
+            if (d.status === "slow_down")
+                interval += 5000;
+            continue;
+        }
+        if (!r.ok) {
+            console.error(`Login failed: ${d.status ?? d.error}`);
+            process.exit(1);
+        }
+        mkdirSync(join(credFile(), ".."), { recursive: true });
+        writeFileSync(credFile(), JSON.stringify({ key: d.key, control, mcp_url: d.mcp.url, login: d.login, apps: d.apps, saved_at: new Date().toISOString() }, null, 2), { mode: 0o600 });
+        console.log(`\nSigned in as ${d.login}. Key ${d.prefix}… saved to ${credFile()} (quota: ${d.quota_minutes} sandbox minutes; expires ${String(d.expires_at).slice(0, 10)}; apps: ${d.apps.join(", ")}).\n`);
+        printMcp(d.mcp.url, d.key);
+        return;
+    }
+    console.error("Timed out waiting for GitHub.");
+    process.exit(1);
+}
+export async function keys() {
+    const c = savedCreds();
+    if (!c) {
+        console.error("Not signed in. Run `shipvo login`.");
+        process.exit(1);
+    }
+    const r = await fetch(`${c.control}/auth/me`, { headers: { authorization: `Bearer ${c.key}` } });
+    const d = await r.json();
+    if (!r.ok) {
+        console.error(d.error === "key_expired" ? `Key ${c.key.slice(0, 12)}… expired on ${d.expires_at}. Run \`shipvo login\` to get a new one.` : `Key ${c.key.slice(0, 12)}… is not valid any more (${d.error}). Run \`shipvo login\`.`);
+        process.exit(1);
+    }
+    console.log(JSON.stringify({ login: d.github_login, prefix: d.prefix, scope: d.scope, app: d.app_id, expires_at: d.expires_at, used_minutes: d.used_minutes, quota_minutes: d.quota_minutes, last_used_at: d.last_used_at, mcp_url: c.mcp_url }, null, 2));
+}
+export function mcp() {
+    const c = savedCreds();
+    if (!c) {
+        console.error("Not signed in. Run `shipvo login`.");
+        process.exit(1);
+    }
+    printMcp(c.mcp_url, c.key);
+}
+function printMcp(url, key) {
+    console.log(`Claude Desktop / Cursor / Claude Code (remote):\n${JSON.stringify({ mcpServers: { shipvo: { url, headers: { Authorization: `Bearer ${key}` } } } }, null, 2)}\n`);
+    console.log(`ChatGPT (custom MCP connector, cannot send headers): ${url}/${key}\n`);
+    console.log(`Local simulator instead: { "mcpServers": { "shipvo": { "command": "npx", "args": ["-y", "@shipvo/mcp"] } } } after \`shipvo sim\`.`);
+}

package/dist/publish.d.ts

@@ -0,0 +1,2 @@
+export declare function publish(argv: string[]): Promise<void>;
+export declare function rollback(argv: string[]): Promise<void>;

package/dist/publish.js

@@ -0,0 +1,153 @@
+// `shipvo publish`: build the Hermes bundle, sign a release pointer, publish bundle + patches + the agent-facing web
+// artifact to the control plane. `shipvo rollback --to N`: republish an earlier bundle as a new release.
+import { execSync } from "node:child_process";
+import { mkdtempSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { sha256Hex, signBytes } from "./index.js";
+import { args as parse, kv as kvFor, loadConfig, seed } from "./config.js";
+const MIME = { ".html": "text/html", ".js": "text/javascript", ".json": "application/json", ".css": "text/css", ".ico": "image/x-icon", ".png": "image/png", ".ttf": "font/ttf", ".svg": "image/svg+xml" };
+const walk = (d) => readdirSync(d).flatMap((f) => (statSync(join(d, f)).isDirectory() ? walk(join(d, f)) : [join(d, f)]));
+async function currentRelease(kv, app, major) {
+    let max = 0;
+    for (const b of ["b0", "b1", "b2"]) {
+        const raw = await kv.get(`p/${app}/${major}/${b}`);
+        if (raw)
+            try {
+                max = Math.max(max, JSON.parse(JSON.parse(raw).body).release);
+            }
+            catch { }
+    }
+    return max;
+}
+export async function publish(argv) {
+    const a = parse(argv), cfg = loadConfig(), SEED = seed(), kv = kvFor(cfg);
+    const APP = cfg.appId, MAJOR = cfg.shellMajor;
+    const MIN_SHELL = a["min-shell"] || JSON.parse(readFileSync("app.json", "utf8")).expo.version; // a bundle needs the shell it was built against
+    const bands = (a.bands || "b0,b1,b2").split(",");
+    const release = Number(a.release || 0) || (await currentRelease(kv, APP, MAJOR)) + 1;
+    if (a["skip-export"] !== "true")
+        execSync("npx expo export --platform android --output-dir dist-ota --clear", { stdio: "inherit" });
+    const jsDir = "dist-ota/_expo/static/js/android";
+    const file = readdirSync(jsDir).find((f) => f.endsWith(".hbc")) || readdirSync(jsDir).find((f) => f.endsWith(".js"));
+    if (!file)
+        throw new Error("no bundle in " + jsDir);
+    const bytes = new Uint8Array(readFileSync(join(jsDir, file)));
+    const name = `r${release}.hbc`, newSha = sha256Hex(bytes);
+    await kv.put(`b/${APP}/${name}`, bytes, "application/octet-stream");
+    // Patches from recent releases and from each shell's embedded bundle; devices verify the patched result against the signed sha256.
+    const MAX_BASES = Number(a["max-bases"] || 6);
+    const bases = new Map();
+    const hist = (await Promise.all((await kv.keys(`h/${APP}/r`)).map(async (k) => { try {
+        return JSON.parse((await kv.get(k)));
+    }
+    catch {
+        return null;
+    } })))
+        .filter((h) => h && h.release < release).sort((x, y) => y.release - x.release).slice(0, MAX_BASES - 2);
+    for (const h of hist)
+        bases.set(h.sha256, `b/${APP}/r${h.release}.hbc`);
+    for (const k of await kv.keys(`base/${APP}/`)) {
+        try {
+            const b = JSON.parse((await kv.get(k)));
+            bases.set(b.sha256, b.key);
+        }
+        catch { }
+    }
+    const patches = [];
+    let bsdiff = true;
+    try {
+        execSync("python3 -c 'import bsdiff4'", { stdio: "ignore" });
+    }
+    catch {
+        bsdiff = false;
+        console.error("bsdiff4 not installed (pip install bsdiff4): publishing full bundles only");
+    }
+    if (bsdiff) {
+        const work = mkdtempSync(join(tmpdir(), "shipvo-"));
+        writeFileSync(join(work, "new.hbc"), bytes);
+        for (const [fromSha, key] of bases) {
+            if (fromSha === newSha)
+                continue;
+            const base = await kv.getBytes(key);
+            if (!base)
+                continue;
+            writeFileSync(join(work, "old.hbc"), base);
+            execSync(`python3 -c "import bsdiff4; bsdiff4.file_diff('${join(work, "old.hbc")}', '${join(work, "new.hbc")}', '${join(work, "p.bsdiff")}')"`);
+            const patch = new Uint8Array(readFileSync(join(work, "p.bsdiff")));
+            if (patch.length >= bytes.length * 0.6)
+                continue;
+            const pkey = `b/${APP}/d-${fromSha.slice(0, 16)}-r${release}.bsdiff`;
+            await kv.put(pkey, patch, "application/octet-stream");
+            patches.push({ from_sha256: fromSha, url: pkey, size: patch.length, sha256: sha256Hex(patch) });
+        }
+    }
+    console.error(`patches: ${patches.map((p) => `${p.from_sha256.slice(0, 8)}=${(p.size / 1024).toFixed(1)}KB`).join(", ") || "none"}`);
+    // The agent-facing web artifact of the same commit, served at /w/<app>/r<N>/ for the simulator.
+    let web = null;
+    if (a["skip-web"] !== "true") {
+        execSync("PN_SIM=1 npx expo export --platform web --output-dir dist-web --clear", { stdio: "inherit" });
+        const base = `w/${APP}/r${release}`;
+        const files = [];
+        let indexSha = "";
+        for (const f of walk("dist-web")) {
+            const rel = f.slice("dist-web/".length);
+            if (rel === "metadata.json")
+                continue;
+            let body = readFileSync(f);
+            if (rel === "index.html") {
+                body = Buffer.from(body.toString("utf8").replace(/(src|href)="\//g, `$1="/${base}/`));
+                indexSha = sha256Hex(new Uint8Array(body));
+            }
+            await kv.put(`${base}/${rel}`, new Uint8Array(body), MIME[rel.slice(rel.lastIndexOf("."))] ?? "application/octet-stream");
+            files.push(rel);
+        }
+        web = { base: `/${base}/`, entry: "index.html", sha256: indexSha, files: files.length };
+        const idxKey = `w/${APP}/releases`;
+        let idx = { releases: [] };
+        try {
+            idx = JSON.parse((await kv.get(idxKey))) ?? idx;
+        }
+        catch { }
+        idx.releases = [...new Set([...idx.releases, release])].sort((x, y) => x - y);
+        idx.latest = Math.max(...idx.releases);
+        await kv.put(idxKey, JSON.stringify(idx), "application/json");
+        console.error(`web artifact: ${files.length} files at /${base}/`);
+    }
+    const issued_at = new Date().toISOString();
+    for (const band of bands) {
+        const body = JSON.stringify({ schema_version: "1.0", app_id: APP, shell_major: MAJOR, band, release, issued_at,
+            core: { version: `1.0.${release}`, sha256: newSha, size: bytes.length, url: `b/${APP}/${name}`, patches },
+            addons: [], screens: [], min_shell_version: MIN_SHELL, ...(web ? { web } : {}) });
+        await kv.put(`p/${APP}/${MAJOR}/${band}`, JSON.stringify({ body, signature: signBytes(new TextEncoder().encode(body), SEED) }), "application/json");
+    }
+    await kv.put(`h/${APP}/r${release}`, JSON.stringify({ release, issued_at, sha256: newSha, size: bytes.length, min_shell_version: MIN_SHELL, web }), "application/json");
+    console.log(JSON.stringify({ app: APP, release, bands, bytes: bytes.length, min_shell_version: MIN_SHELL, web, patches: patches.map((p) => ({ from: p.from_sha256.slice(0, 12), kb: +(p.size / 1024).toFixed(1) })) }));
+}
+export async function rollback(argv) {
+    const a = parse(argv), cfg = loadConfig(), SEED = seed(), kv = kvFor(cfg);
+    const APP = cfg.appId, MAJOR = cfg.shellMajor, to = Number(a.to);
+    if (!to) {
+        console.error("Usage: shipvo rollback --to <release> [--bands b0,b1,b2]");
+        process.exit(2);
+    }
+    const bytes = await kv.getBytes(`b/${APP}/r${to}.hbc`);
+    if (!bytes) {
+        console.error(`Release ${to} bundle not found`);
+        process.exit(1);
+    }
+    const release = (await currentRelease(kv, APP, MAJOR)) + 1, issued_at = new Date().toISOString();
+    let minShell = "1.0.0", web = undefined;
+    try {
+        const h = JSON.parse((await kv.get(`h/${APP}/r${to}`)));
+        minShell = h.min_shell_version || minShell;
+        web = h.web ?? undefined;
+    }
+    catch { }
+    for (const band of (a.bands || "b0,b1,b2").split(",")) {
+        const body = JSON.stringify({ schema_version: "1.0", app_id: APP, shell_major: MAJOR, band, release, issued_at,
+            core: { version: `1.0.${release}`, sha256: sha256Hex(bytes), size: bytes.length, url: `b/${APP}/r${to}.hbc` }, addons: [], screens: [], min_shell_version: minShell, ...(web ? { web } : {}) });
+        await kv.put(`p/${APP}/${MAJOR}/${band}`, JSON.stringify({ body, signature: signBytes(new TextEncoder().encode(body), SEED) }), "application/json");
+    }
+    console.log(JSON.stringify({ app: APP, rolled_back_to_code_of: to, new_release: release, min_shell_version: minShell, issued_at }));
+}

package/dist/sim.d.ts

@@ -0,0 +1 @@
+export declare function sim(argv: string[]): Promise<void>;

package/dist/sim.js

@@ -0,0 +1,25 @@
+// `shipvo sim`: build the app's web bundle with the simulated device and serve it in the simulator.
+import { execSync, spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import { args as parse, loadConfig } from "./config.js";
+export async function sim(argv) {
+    const a = parse(argv);
+    const cfg = loadConfig();
+    if (a["skip-build"] !== "true" || !existsSync("sim-dist/index.html")) {
+        console.error(`Building ${cfg.name} for the simulator…`);
+        execSync("PN_SIM=1 npx expo export --platform web --output-dir sim-dist --clear", { stdio: "inherit", env: { ...process.env, PN_SIM: "1" } });
+    }
+    let server;
+    try {
+        server = createRequire(process.cwd() + "/package.json").resolve("@shipvo/sim/server.mjs");
+    }
+    catch {
+        console.error("Install @shipvo/sim (and playwright) in this app: npm i -D @shipvo/sim playwright && npx playwright install chromium");
+        process.exit(2);
+    }
+    const port = a.port || "4545";
+    console.error(`Simulator on http://localhost:${port}  (open_app("${cfg.appId}") from @shipvo/mcp; Ctrl-C to stop)`);
+    const p = spawn(process.execPath, [server, "--port", port, "--app", cfg.appId, ...(a.dir ? ["--dir", a.dir] : [])], { stdio: "inherit", env: { ...process.env, PN_CONTROL: cfg.controlPlane } });
+    p.on("exit", (c) => process.exit(c ?? 0));
+}

package/package.json

@@ -1,6 +1,64 @@
 {
   "name": "@shipvo/cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "type": "module",
+  "license": "Apache-2.0",
+  "bin": {
+    "shipvo": "dist/cli.js"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "dependencies": {
+    "@noble/ed25519": "^2.1.0",
+    "@noble/hashes": "^1.5.0",
+    "@shipvo/schema": "0.0.1"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.4",
+    "@types/node": "^22.8.0"
+  },
+  "description": "Shipvo CLI: create an app (init), run it in the simulator (sim), sign and publish over-the-air releases (publish, rollback), manage signing keys.",
+  "keywords": [
+    "react-native",
+    "expo",
+    "ota",
+    "over-the-air-updates",
+    "codepush",
+    "codepush-alternative",
+    "hot-updates",
+    "mobile-app-updates",
+    "android",
+    "ios",
+    "hermes",
+    "cloudflare-workers",
+    "self-hosted",
+    "staged-rollout",
+    "mobile-cms",
+    "ai-agents"
+  ],
+  "homepage": "https://github.com/shipvo/shipvo#readme",
+  "bugs": {
+    "url": "https://github.com/shipvo/shipvo/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/shipvo/shipvo.git",
+    "directory": "packages/cli"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json && chmod +x dist/cli.js",
+    "test": "vitest run"
+  }
 }