@shipvo/cli 0.1.0 → 0.1.1

package/dist/app.d.ts

@@ -0,0 +1 @@
+export declare function appCmd(argv: string[]): Promise<void>;

package/dist/app.js

@@ -0,0 +1,62 @@
+// `shipvo app create`: register this app with the hosted control plane and get a scoped publish token.
+// `shipvo app list`: the apps your account has registered.
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { loadConfig } from "./config.js";
+import { savedCreds } from "./login.js";
+export async function appCmd(argv) {
+    const [sub] = argv;
+    const c = savedCreds();
+    if (!c) {
+        console.error("Not signed in. Run `shipvo login` first.");
+        process.exit(1);
+    }
+    if (sub === "list") {
+        const r = await fetch(`${c.control}/apps`, { headers: { authorization: `Bearer ${c.key}` } });
+        const d = await r.json();
+        if (!r.ok) {
+            console.error(d.hint ?? d.error);
+            process.exit(1);
+        }
+        console.log(d.apps.length ? d.apps.map((a) => `${a.app_id}  ${a.name}  r${a.latest_release ?? "-"}  ${(a.bytes_used / 1048576).toFixed(1)} MB  ${a.listed ? (a.approved ? "public" : "listing under review") : "private"}`).join("\n") : "No apps yet. Run `shipvo app create` inside an app made with `shipvo init`.");
+        return;
+    }
+    if (sub === "delete") {
+        const id = argv[1];
+        if (!id || !argv.includes("--yes")) {
+            console.error("Usage: shipvo app delete <app-id> --yes   (removes the app's published files, tokens and registration; installed shells keep the code they have)");
+            process.exit(2);
+        }
+        const r = await fetch(`${c.control}/apps/${id}`, { method: "DELETE", headers: { authorization: `Bearer ${c.key}` } });
+        const d = await r.json();
+        if (!r.ok) {
+            console.error(r.status === 404 ? `No app "${id}" on your account.` : d.hint ?? d.error);
+            process.exit(1);
+        }
+        console.log(`Deleted "${id}" (${d.files_deleted} files).`);
+        return;
+    }
+    if (sub !== "create") {
+        console.error("Usage: shipvo app create | list | delete <id> --yes");
+        process.exit(2);
+    }
+    const cfg = loadConfig();
+    const r = await fetch(`${c.control}/apps`, { method: "POST", headers: { authorization: `Bearer ${c.key}`, "content-type": "application/json" }, body: JSON.stringify({ app_id: cfg.appId, name: cfg.name, public_key: cfg.publicKey, description: cfg.listing?.description ?? "", category: cfg.listing?.category ?? "other", listed: !!cfg.listing?.public }) });
+    const d = await r.json();
+    if (!r.ok) {
+        console.error(`Could not register "${cfg.appId}": ${d.message ?? d.hint ?? d.error}`);
+        process.exit(1);
+    }
+    mkdirSync(join(process.cwd(), ".shipvo"), { recursive: true });
+    writeFileSync(join(process.cwd(), ".shipvo", "publish-token"), d.publish_token + "\n", { mode: 0o600 });
+    console.log(`${d.created ? "Registered" : "Updated"} "${d.app_id}" (publish token expires ${String(d.expires_at).slice(0, 10)}).`);
+    if (cfg.listing?.public)
+        console.log(`Listing requested: once reviewed, "${cfg.appId}" appears on shipvo.dev/apps and any signed-in agent can open it. Set listing.public to false in shipvo.json and run this again to withdraw.`);
+    else
+        console.log(`Private: only your key opens it. To list it publicly, add { "listing": { "public": true, "description": "...", "category": "shop" } } to shipvo.json and run this again.`);
+    console.log(`Token saved to .shipvo/publish-token (git-ignored), so \`shipvo publish\` works on this machine now.`);
+    console.log(`For CI, add two repository secrets: SHIPVO_PUBLISH_TOKEN (the token) and SHIPVO_SIGNING_SEED (from .shipvo/seed.txt).`);
+    if (cfg.controlPlane.replace(/\/$/, "") !== String(d.control_plane).replace(/\/$/, ""))
+        console.log(`Note: shipvo.json controlPlane is ${cfg.controlPlane}, but you registered on ${d.control_plane}. Installed shells only trust the one built into them.`);
+    console.log(`Agents can open it once published: open_app("${d.app_id}@latest") with your key from \`shipvo mcp\`.`);
+}

package/dist/cli.js

@@ -7,6 +7,7 @@ import { init } from "./init.js";
 import { publish, rollback } from "./publish.js";
 import { sim } from "./sim.js";
 import { keys, login, mcp } from "./login.js";
+import { appCmd } from "./app.js";
 const [cmd, ...rest] = process.argv.slice(2);
 const help = `shipvo <command>
 
@@ -14,6 +15,7 @@ const help = `shipvo <command>
   sim [--port 4545]           Build the app for the simulator and serve it (agents: open_app("<appId>"))
   publish [--bands b0,b1,b2]  Build, sign and publish an over-the-air release (+ the agent-facing web artifact)
   rollback --to <release>     Republish an earlier release's code as a new release
+  app create | list | delete  Register this app with the hosted control plane (publish token), list yours, or remove one
   login                       Sign in with GitHub and get a key for the hosted simulator
   keys                        Show the stored key's status and quota
   mcp                         Print the MCP config agents need (hosted and local)
@@ -41,6 +43,9 @@ switch (cmd) {
     case "login":
         await login(rest);
         break;
+    case "app":
+        await appCmd(rest);
+        break;
     case "keys":
         await keys();
         break;

package/dist/config.d.ts

@@ -11,12 +11,20 @@ export type ShipvoConfig = {
     kv?: {
         namespaceId: string;
     };
+    /** Marketplace listing (hosted control plane): shown to agents and on shipvo.dev once reviewed. */
+    listing?: {
+        public?: boolean;
+        description?: string;
+        category?: string;
+    };
 };
 export declare function loadConfig(dir?: string): ShipvoConfig;
 export declare const args: (argv: string[]) => Record<string, string | undefined>;
 /** Signing seed: SHIPVO_SIGNING_SEED (PURENATIVE_SIGNING_SEED still accepted) or a *_FILE path. */
 export declare function seed(): string;
-/** Cloudflare KV access for publish/rollback. */
+/** The publish token `shipvo app create` issued: SHIPVO_PUBLISH_TOKEN (CI) or .shipvo/publish-token. */
+export declare function publishToken(): string | null;
+/** Where publish/rollback write: your own Cloudflare KV (self-hosted control plane) or the hosted control plane with a publish token. */
 export declare function kv(cfg: ShipvoConfig): {
     get(k: string): Promise<string | null>;
     getBytes(k: string): Promise<Uint8Array<ArrayBuffer> | null>;

package/dist/config.js

@@ -17,18 +17,64 @@ export function seed() {
     const e = process.env;
     const s = e.SHIPVO_SIGNING_SEED || e.PURENATIVE_SIGNING_SEED
         || ((e.SHIPVO_SIGNING_SEED_FILE || e.PURENATIVE_SIGNING_SEED_FILE) && readFileSync((e.SHIPVO_SIGNING_SEED_FILE || e.PURENATIVE_SIGNING_SEED_FILE), "utf8").trim());
+    const local = (() => { try {
+        return readFileSync(join(process.cwd(), ".shipvo", "seed.txt"), "utf8").trim();
+    }
+    catch {
+        return "";
+    } })(); // what `shipvo init` wrote
+    if (!s && local)
+        return local;
     if (!s) {
-        console.error("Set SHIPVO_SIGNING_SEED or SHIPVO_SIGNING_SEED_FILE (the seed `shipvo keygen` printed).");
+        console.error("Set SHIPVO_SIGNING_SEED or SHIPVO_SIGNING_SEED_FILE (the seed `shipvo keygen` printed), or keep it at .shipvo/seed.txt.");
         process.exit(2);
     }
     return s;
 }
-/** Cloudflare KV access for publish/rollback. */
+/** The publish token `shipvo app create` issued: SHIPVO_PUBLISH_TOKEN (CI) or .shipvo/publish-token. */
+export function publishToken() {
+    if (process.env.SHIPVO_PUBLISH_TOKEN)
+        return process.env.SHIPVO_PUBLISH_TOKEN.trim();
+    try {
+        return readFileSync(join(process.cwd(), ".shipvo", "publish-token"), "utf8").trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Publishing through the hosted control plane: the same get/put/keys, scoped to this app and signed-pointer checked server side. */
+function hostedKv(cfg, token) {
+    const base = `${cfg.controlPlane.replace(/\/$/, "")}/apps/${cfg.appId}/kv`;
+    const auth = { Authorization: `Bearer ${token}` };
+    const path = (k) => `${base}/${k.split("/").map(encodeURIComponent).join("/")}`;
+    return {
+        async get(k) { const r = await fetch(path(k), { headers: auth }); if (r.status === 401)
+            throw new Error("publish token rejected: run `shipvo app create` for a new one"); return r.ok ? r.text() : null; },
+        async getBytes(k) { const r = await fetch(path(k), { headers: auth }); return r.ok ? new Uint8Array(await r.arrayBuffer()) : null; },
+        async keys(prefix) { const r = await fetch(`${base}?prefix=${encodeURIComponent(prefix)}`, { headers: auth }); return r.ok ? (await r.json()).keys : []; },
+        async put(k, body, type) {
+            const r = await fetch(path(k), { method: "PUT", headers: { ...auth, "content-type": type }, body });
+            if (!r.ok) {
+                let m = "";
+                try {
+                    const j = await r.json();
+                    m = j.message ?? j.error;
+                }
+                catch { }
+                throw new Error(`publish ${k}: ${r.status} ${m}`);
+            }
+        },
+    };
+}
+/** Where publish/rollback write: your own Cloudflare KV (self-hosted control plane) or the hosted control plane with a publish token. */
 export function kv(cfg) {
     const ACC = process.env.CLOUDFLARE_ACCOUNT_ID, TOKEN = process.env.CLOUDFLARE_API_TOKEN;
     const NS = process.env.SHIPVO_KV_ID || process.env.PURENATIVE_KV_ID || cfg.kv?.namespaceId;
-    if (!ACC || !TOKEN || !NS) {
-        console.error("Need CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_API_TOKEN and the control plane's KV namespace (shipvo.json kv.namespaceId or SHIPVO_KV_ID).");
+    if (!(ACC && TOKEN && NS)) {
+        const pt = publishToken();
+        if (pt)
+            return hostedKv(cfg, pt);
+        console.error("Nothing to publish with. Hosted: run `shipvo login`, then `shipvo app create` (or set SHIPVO_PUBLISH_TOKEN). Self-hosted: set CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_API_TOKEN and SHIPVO_KV_ID.");
         process.exit(2);
     }
     const url = (k) => `https://api.cloudflare.com/client/v4/accounts/${ACC}/storage/kv/namespaces/${NS}/values/${encodeURIComponent(k)}`;

package/dist/init.js

@@ -5,7 +5,7 @@ import { randomBytes } from "node:crypto";
 import { join, resolve } from "node:path";
 import { b64, keyFromSeed } from "./index.js";
 import { args as parse } from "./config.js";
-const HOSTED = "https://purenative-control.purenative.workers.dev";
+const HOSTED = "https://api.shipvo.dev";
 const SDK = { expo: "~58.0.21", camera: "~58.0.14", clipboard: "~58.0.4", localAuth: "~58.0.2", location: "~58.0.20", notifications: "~58.1.7", statusBar: "~58.0.4", constants: "~58.0.0", metroRuntime: "~58.0.15", react: "19.3.0", rn: "0.88.1", rnw: "^0.21.4" };
 const title = (s) => s.replace(/[-_]+/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
 export async function init(argv) {
@@ -34,7 +34,7 @@ export async function init(argv) {
         seedNote = `A release signing key was created at .shipvo/seed.txt (git-ignored). Back it up offline and put it in the SHIPVO_SIGNING_SEED secret of your CI. Lose it and you cannot publish to installed shells.`;
     }
     const w = (p, body) => { mkdirSync(join(dir, p, ".."), { recursive: true }); writeFileSync(join(dir, p), body); };
-    w("shipvo.json", JSON.stringify({ appId, name, shellMajor: 1, controlPlane, publicKey }, null, 2) + "\n");
+    w("shipvo.json", JSON.stringify({ appId, name, shellMajor: 1, controlPlane, publicKey, listing: { public: false, description: "", category: "other" } }, null, 2) + "\n");
     w("package.json", JSON.stringify({
         name: appId, version: "1.0.0", main: "index.ts", private: true,
         scripts: { start: "expo start", android: "expo run:android", ios: "expo run:ios", web: "expo start --web", sim: "shipvo sim", publish: "shipvo publish", rollback: "shipvo rollback", typecheck: "tsc --noEmit" },
@@ -83,8 +83,8 @@ Created ${name} in ${dirArg}
   npx -y @shipvo/mcp          # point Claude / Cursor / ChatGPT at it and open_app("${appId}")
 
 Phones:  npx expo run:android   (needs Android Studio once; the OTA runtime is Android-first)
-Publish: set CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID, SHIPVO_KV_ID and SHIPVO_SIGNING_SEED, then npm run publish
-         (self-host the control plane from services/control-plane, or ask for a hosted app id during the beta)
+Publish: shipvo login, then shipvo app create (hosted), or set CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID and SHIPVO_KV_ID (self-hosted); then npm run publish
+         (self-hosting instead? see docs/self-hosting.md)
 
 ${seedNote}
 Public key pinned in the shell: ${publicKey}
@@ -178,9 +178,7 @@ jobs:
       - run: pip install --break-system-packages bsdiff4
       - name: Build, sign and publish over the air
         env:
-          CLOUDFLARE_API_TOKEN: \${{ secrets.CLOUDFLARE_API_TOKEN }}
-          CLOUDFLARE_ACCOUNT_ID: \${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          SHIPVO_KV_ID: \${{ secrets.SHIPVO_KV_ID }}
+          SHIPVO_PUBLISH_TOKEN: \${{ secrets.SHIPVO_PUBLISH_TOKEN }}   # from \`shipvo app create\`; self-hosting instead: CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID, SHIPVO_KV_ID
           SHIPVO_SIGNING_SEED: \${{ secrets.SHIPVO_SIGNING_SEED }}
         run: npx shipvo publish | tee -a "$GITHUB_STEP_SUMMARY"
 `;

package/dist/login.js

@@ -4,7 +4,7 @@ import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { args as parse } from "./config.js";
-const HOSTED = "https://purenative-control.purenative.workers.dev";
+const HOSTED = "https://api.shipvo.dev";
 const credFile = () => join(process.env.SHIPVO_HOME || join(homedir(), ".shipvo"), "credentials.json");
 export function savedCreds() {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipvo/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "license": "Apache-2.0",
   "bin": {