storebase-cli 0.0.0-stage → 1.0.0

package/README.md

@@ -1,3 +1,70 @@
-# Temporary Holding Version
+# StoreBase App Publisher CLI
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A dependency-free npm CLI for validating and releasing a signed Android APK into a local StoreBase app-list catalog. This package is intentionally isolated under `cli/`; it does not change the StoreBase frontend.
+
+## Requirements
+
+- Node.js 18 or newer
+- Java `keytool`
+- Android SDK Build Tools `apksigner` (on `PATH`, or under `$ANDROID_SDK_ROOT/build-tools/` or `$ANDROID_HOME/build-tools/`)
+
+## Install from this repository
+
+```sh
+npm install --global ./cli
+storebase-publish
+```
+
+The CLI prompts for the app name, avatar image, version, APK, category, description, and signing keystore. The supported categories match StoreBase Explore:
+
+- Education
+- Social
+- Productivity
+- Communication
+- Entertainment
+- Games
+- Business
+- Shopping
+- Finance
+- Utilities
+- Health & Fitness
+- Travel & Navigation
+- AI & Machine Learning
+
+The keystore password is requested with hidden terminal input. For automation, set `STOREBASE_KEYSTORE_PASSWORD` in the process environment instead. **Do not put the password in a command-line argument.** If the keystore contains more than one private-key alias, the CLI asks which alias to use (or accepts `--alias`).
+
+The CLI runs `keytool` and `apksigner`, and refuses to add the release unless the APK is signed and its signer certificate matches the selected private-key certificate in the provided keystore. The password is written briefly to a mode-0600 temporary file for `keytool`, then the file is overwritten best-effort and removed. The keystore itself is never copied to the catalog.
+
+## Non-interactive example
+
+```sh
+STOREBASE_KEYSTORE_PASSWORD="$KEYSTORE_PASSWORD" storebase-publish \
+  --name "Example App" \
+  --avatar ./icon.png \
+  --version 1.2.0 \
+  --apk ./app-release.apk \
+  --category Productivity \
+  --description "A short description of the app." \
+  --keystore ./release.jks \
+  --alias release
+```
+
+Available options: `--name`, `--avatar`, `--version`, `--apk`, `--category`, `--description`, `--keystore`, `--alias`, `--catalog`, `--assets-dir`, and `--help`.
+
+## Output
+
+By default, running from a project directory creates or updates:
+
+- `storebase-app-list.json` — schema version 1, with one latest-version listing per app name/slug.
+- `storebase-app-assets/<app-id>/<version>/` — content-addressed APK and avatar files referenced by the JSON manifest.
+
+The catalog entry contains the app name, avatar path, version, APK path, category, description, the public SHA-256 signing-certificate fingerprint, and publish timestamp. Releasing the same app again updates its catalog entry; a different version gets a separate artifact path. The previous artifacts are not removed.
+
+The current StoreBase repository has no app-list API or deployment endpoint. Therefore this CLI creates a **local app-list release artifact only**; it does not upload to a server, publish the npm package, or make the app appear in the existing UI yet. A later frontend/backend change can consume `storebase-app-list.json` without changing this CLI's input contract.
+
+## Development
+
+```sh
+cd cli
+npm test
+```

package/bin/storebase-publish.js

@@ -0,0 +1,170 @@
+#!/usr/bin/env node
+'use strict';
+
+const { createInterface } = require('node:readline/promises');
+const { stdin, stdout } = require('node:process');
+const {
+  CATEGORIES,
+  inspectKeystore,
+  releaseApp,
+  validateInput,
+  verifyApkSignature,
+} = require('../lib/publisher');
+
+const OPTION_NAMES = new Set([
+  'name', 'avatar', 'version', 'apk', 'category', 'description', 'keystore', 'alias', 'catalog', 'assets-dir',
+]);
+
+function parseArguments(args) {
+  const options = {};
+  for (let index = 0; index < args.length; index += 1) {
+    const argument = args[index];
+    if (argument === '--help' || argument === '-h') return { help: true, options };
+    if (!argument.startsWith('--')) throw new Error(`Unexpected argument: ${argument}`);
+    const equals = argument.indexOf('=');
+    const name = argument.slice(2, equals < 0 ? undefined : equals);
+    if (!OPTION_NAMES.has(name)) throw new Error(`Unknown option: --${name}`);
+    const value = equals < 0 ? args[++index] : argument.slice(equals + 1);
+    if (typeof value !== 'string' || !value.trim() || value.startsWith('--')) {
+      throw new Error(`Option --${name} requires a value.`);
+    }
+    options[name] = value;
+  }
+  return { help: false, options };
+}
+
+function showHelp() {
+  stdout.write(`StoreBase app publisher\n\nUsage:\n  storebase-publish [options]\n\nOptions (omitted values are prompted interactively):\n  --name <name>            App name\n  --avatar <file>          PNG, JPEG, or WebP avatar file\n  --version <version>      App version\n  --apk <file>             Signed Android APK\n  --category <category>    One of the 13 StoreBase categories\n  --description <text>     App description\n  --keystore <file>        Signing keystore used for the APK\n  --alias <name>           Private-key alias, if the keystore has multiple\n  --catalog <file>         App-list JSON (default: ./storebase-app-list.json)\n  --assets-dir <directory> Artifact directory (default: next to the catalog)\n  -h, --help               Show this help\n\nThe keystore password is entered in a hidden prompt, or read from\nSTOREBASE_KEYSTORE_PASSWORD for unattended use. It is never accepted as a CLI argument.\n`);
+}
+
+function askHidden(label) {
+  if (!stdin.isTTY || typeof stdin.setRawMode !== 'function') {
+    return Promise.reject(new Error('Set STOREBASE_KEYSTORE_PASSWORD in the environment for non-interactive use.'));
+  }
+  return new Promise((resolve, reject) => {
+    let value = '';
+    let finished = false;
+    const cleanup = () => {
+      stdin.removeListener('data', onData);
+      try { stdin.setRawMode(false); } catch {}
+      stdin.pause();
+      stdout.write('\n');
+    };
+    const finish = (error) => {
+      if (finished) return;
+      finished = true;
+      cleanup();
+      if (error) reject(error);
+      else resolve(value);
+    };
+    const onData = (chunk) => {
+      for (const character of String(chunk)) {
+        if (character === '\u0003') return finish(new Error('Cancelled.'));
+        if (character === '\r' || character === '\n') return finish();
+        if (character === '\u007f' || character === '\b') value = value.slice(0, -1);
+        else if (character >= ' ') value += character;
+      }
+    };
+    stdout.write(`${label}: `);
+    stdin.setRawMode(true);
+    stdin.setEncoding('utf8');
+    stdin.resume();
+    stdin.on('data', onData);
+  });
+}
+
+async function collectInput(options) {
+  const required = [
+    ['name', 'App name'],
+    ['avatar', 'Avatar file path'],
+    ['version', 'Version'],
+    ['apk', 'APK file path'],
+    ['category', 'Category'],
+    ['description', 'Description'],
+    ['keystore', 'Signed keystore file path'],
+  ];
+  const missing = required.filter(([key]) => !options[key]);
+  if (missing.length && (!stdin.isTTY || !stdout.isTTY)) {
+    throw new Error(`Missing required options: ${missing.map(([key]) => `--${key}`).join(', ')}. Prompts require an interactive terminal.`);
+  }
+
+  const rl = createInterface({ input: stdin, output: stdout });
+  try {
+    for (const [key, label] of required) {
+      if (!options[key]) {
+        if (key === 'category') {
+          stdout.write('\nAvailable categories:\n');
+          CATEGORIES.forEach((category, index) => stdout.write(`  ${index + 1}. ${category}\n`));
+        }
+        options[key] = (await rl.question(`${label}${key === 'category' ? ' (number or name)' : ''}: `)).trim();
+        if (key === 'category' && /^\d+$/.test(options[key])) {
+          const category = CATEGORIES[Number(options[key]) - 1];
+          if (category) options[key] = category;
+        }
+      }
+    }
+  } finally {
+    rl.close();
+  }
+  return {
+    name: options.name,
+    avatar: options.avatar,
+    version: options.version,
+    apk: options.apk,
+    category: options.category,
+    description: options.description,
+    keystore: options.keystore,
+    alias: options.alias,
+  };
+}
+
+async function selectEntry(entries, aliasOption) {
+  if (aliasOption) {
+    const selected = entries.find((entry) => entry.alias === aliasOption);
+    if (!selected) throw new Error(`Keystore alias "${aliasOption}" is not a private-key entry. Available aliases: ${entries.map((entry) => entry.alias).join(', ')}.`);
+    return selected;
+  }
+  if (entries.length === 1) return entries[0];
+  if (!stdin.isTTY || !stdout.isTTY) {
+    throw new Error(`Keystore has multiple private-key aliases. Select one with --alias: ${entries.map((entry) => entry.alias).join(', ')}.`);
+  }
+  const rl = createInterface({ input: stdin, output: stdout });
+  try {
+    stdout.write(`Keystore private-key aliases: ${entries.map((entry) => entry.alias).join(', ')}\n`);
+    const alias = (await rl.question('Signing alias: ')).trim();
+    const selected = entries.find((entry) => entry.alias === alias);
+    if (!selected) throw new Error(`Unknown signing alias: ${alias}`);
+    return selected;
+  } finally {
+    rl.close();
+  }
+}
+
+async function main() {
+  const parsed = parseArguments(process.argv.slice(2));
+  if (parsed.help) return showHelp();
+  const options = parsed.options;
+  const rawInput = await collectInput(options);
+  const input = await validateInput(rawInput);
+
+  const password = process.env.STOREBASE_KEYSTORE_PASSWORD ?? await askHidden('Keystore password (input hidden)');
+  const entries = await inspectKeystore(input.keystorePath, password);
+  const entry = await selectEntry(entries, input.alias);
+  const certificate = verifyApkSignature(input.apkPath, entry);
+  const result = await releaseApp(input, {
+    catalogPath: options.catalog,
+    assetsDir: options['assets-dir'],
+    signingCertificateSha256: certificate,
+  });
+
+  stdout.write(`\nRelease complete: ${result.app.name} ${result.app.version}\n`);
+  stdout.write(`App list: ${result.catalogPath}\n`);
+  stdout.write(`APK: ${result.app.apk}\n`);
+  stdout.write(`Avatar: ${result.app.avatar}\n`);
+  stdout.write('The keystore was used only to verify the APK signature; it was not copied.\n');
+}
+
+main().catch((error) => {
+  process.stderr.write(`storebase-publish: ${error.message}\n`);
+  process.exitCode = 1;
+});

package/lib/publisher.js

@@ -0,0 +1,348 @@
+'use strict';
+
+const {
+  copyFile,
+  mkdir,
+  readFile,
+  rename,
+  rm,
+  stat,
+  writeFile,
+} = require('node:fs/promises');
+const { createReadStream } = require('node:fs');
+const { createHash, randomBytes } = require('node:crypto');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { createInterface } = require('node:readline/promises');
+const { stdin, stdout } = require('node:process');
+const { tmpdir } = require('node:os');
+
+const CATEGORIES = Object.freeze([
+  'Education',
+  'Social',
+  'Productivity',
+  'Communication',
+  'Entertainment',
+  'Games',
+  'Business',
+  'Shopping',
+  'Finance',
+  'Utilities',
+  'Health & Fitness',
+  'Travel & Navigation',
+  'AI & Machine Learning',
+]);
+
+function fail(message) {
+  throw new Error(message);
+}
+
+function normalizeFingerprint(value) {
+  return String(value || '').replace(/[^a-f\d]/gi, '').toUpperCase();
+}
+
+function slugify(value) {
+  const slug = String(value)
+    .normalize('NFKD')
+    .replace(/[\u0300-\u036f]/g, '')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+  return slug || `app-${createHash('sha256').update(String(value)).digest('hex').slice(0, 10)}`;
+}
+
+async function requireFile(value, label, cwd) {
+  if (typeof value !== 'string' || !value.trim()) fail(`${label} is required.`);
+  const resolved = path.resolve(cwd, value.trim());
+  let details;
+  try {
+    details = await stat(resolved);
+  } catch {
+    fail(`${label} does not exist: ${resolved}`);
+  }
+  if (!details.isFile() || details.size === 0) fail(`${label} must be a non-empty file: ${resolved}`);
+  return resolved;
+}
+
+async function detectImageExtension(filePath) {
+  const handle = await require('node:fs/promises').open(filePath, 'r');
+  try {
+    const buffer = Buffer.alloc(12);
+    const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+    const head = buffer.subarray(0, bytesRead);
+    if (head.length >= 8 && head.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))) return '.png';
+    if (head.length >= 3 && head[0] === 0xff && head[1] === 0xd8 && head[2] === 0xff) return '.jpg';
+    if (head.length >= 12 && head.toString('ascii', 0, 4) === 'RIFF' && head.toString('ascii', 8, 12) === 'WEBP') return '.webp';
+    fail('Avatar must be a PNG, JPEG, or WebP image.');
+  } finally {
+    await handle.close();
+  }
+}
+
+async function validateInput(raw, options = {}) {
+  const cwd = options.cwd || process.cwd();
+  const name = typeof raw.name === 'string' ? raw.name.trim() : '';
+  if (!name) fail('App name is required.');
+  if ([...name].length > 100) fail('App name must be 100 characters or fewer.');
+
+  const version = typeof raw.version === 'string' ? raw.version.trim() : '';
+  if (!/^[A-Za-z0-9][A-Za-z0-9.+_-]{0,63}$/.test(version)) {
+    fail('Version is required and must be 1–64 safe characters (letters, numbers, dot, plus, underscore, or hyphen).');
+  }
+
+  const description = typeof raw.description === 'string' ? raw.description.trim() : '';
+  if (!description) fail('Description is required.');
+  if (description.length > 1000) fail('Description must be 1000 characters or fewer.');
+
+  const categoryText = typeof raw.category === 'string' ? raw.category.trim() : '';
+  const category = CATEGORIES.find((item) => item.toLocaleLowerCase('en') === categoryText.toLocaleLowerCase('en'));
+  if (!category) fail(`Category must match one of: ${CATEGORIES.join(', ')}.`);
+
+  const avatarPath = await requireFile(raw.avatar, 'Avatar file', cwd);
+  const avatarExtension = await detectImageExtension(avatarPath);
+  const apkPath = await requireFile(raw.apk, 'APK file', cwd);
+  if (path.extname(apkPath).toLowerCase() !== '.apk') fail('APK file must have the .apk extension.');
+  const apkHandle = await require('node:fs/promises').open(apkPath, 'r');
+  try {
+    const signature = Buffer.alloc(4);
+    const { bytesRead } = await apkHandle.read(signature, 0, 4, 0);
+    if (bytesRead !== 4 || signature.toString('hex') !== '504b0304') fail('APK file does not have a valid ZIP/APK header.');
+  } finally {
+    await apkHandle.close();
+  }
+  const keystorePath = await requireFile(raw.keystore, 'Signed keystore file', cwd);
+
+  return {
+    id: slugify(name),
+    name,
+    avatarPath,
+    avatarExtension,
+    version,
+    apkPath,
+    category,
+    description,
+    keystorePath,
+    alias: typeof raw.alias === 'string' && raw.alias.trim() ? raw.alias.trim() : undefined,
+  };
+}
+
+function runTool(command, args, options = {}) {
+  const result = spawnSync(command, args, {
+    encoding: 'utf8',
+    maxBuffer: 16 * 1024 * 1024,
+    env: { ...process.env, LC_ALL: 'C', LANG: 'C' },
+    ...options,
+  });
+  if (result.error) fail(`Could not run ${command}: ${result.error.message}`);
+  if (result.status !== 0) {
+    const details = [result.stderr, result.stdout].filter(Boolean).join('\n').trim();
+    fail(`${command} failed${details ? `:\n${details}` : '.'}`);
+  }
+  return `${result.stdout || ''}\n${result.stderr || ''}`;
+}
+
+function parseKeystoreEntries(output) {
+  const blocks = output.split(/(?=Alias name:\s*)/i).filter((block) => /Alias name:/i.test(block));
+  return blocks.flatMap((block) => {
+    const alias = block.match(/Alias name:\s*([^\r\n]+)/i)?.[1]?.trim();
+    const entryType = block.match(/Entry type:\s*([^\r\n]+)/i)?.[1]?.trim();
+    const fingerprints = [...block.matchAll(/SHA256:\s*([A-F\d:]+)/gi)].map((match) => normalizeFingerprint(match[1]));
+    if (!alias || !/PrivateKeyEntry/i.test(entryType || '') || fingerprints.length === 0) return [];
+    return [{ alias, fingerprint: fingerprints[0] }];
+  });
+}
+
+function parseApkSignerFingerprints(output) {
+  return [...output.matchAll(/Signer\s+#\d+\s+certificate\s+SHA-256\s+digest:\s*([a-f\d:]+)/gi)]
+    .map((match) => normalizeFingerprint(match[1]))
+    .filter((fingerprint) => fingerprint.length === 64);
+}
+
+async function inspectKeystore(keystorePath, password) {
+  if (typeof password !== 'string') fail('A keystore password is required to verify the signing certificate.');
+  if (password.includes('\n') || password.includes('\r')) fail('Keystore passwords cannot contain line breaks.');
+  const fs = require('node:fs');
+  const folder = await require('node:fs/promises').mkdtemp(path.join(tmpdir(), 'storebase-keystore-'));
+  const passwordFile = path.join(folder, 'password');
+  try {
+    await writeFile(passwordFile, `${password}\n`, { mode: 0o600, flag: 'wx' });
+    const output = runTool('keytool', [
+      '-J-Duser.language=en',
+      '-J-Duser.country=US',
+      '-list',
+      '-v',
+      '-keystore',
+      keystorePath,
+      '-storepass:file',
+      passwordFile,
+    ]);
+    const entries = parseKeystoreEntries(output);
+    if (!entries.length) fail('The keystore has no readable private-key entry with a SHA-256 certificate.');
+    return entries;
+  } finally {
+    // Best-effort overwrite before removal; the temporary directory is private (0700).
+    try {
+      const fd = fs.openSync(passwordFile, 'r+');
+      const size = fs.fstatSync(fd).size;
+      fs.writeSync(fd, Buffer.alloc(size));
+      fs.closeSync(fd);
+    } catch {}
+    await rm(folder, { recursive: true, force: true });
+  }
+}
+
+function findApksigner() {
+  const fs = require('node:fs');
+  const pathCandidates = [];
+  if (process.env.PATH) {
+    for (const folder of process.env.PATH.split(path.delimiter)) pathCandidates.push(path.join(folder, 'apksigner'));
+  }
+  const sdkRoots = [
+    process.env.ANDROID_SDK_ROOT,
+    process.env.ANDROID_HOME,
+    path.join(require('node:os').homedir(), 'Android', 'Sdk'),
+    '/usr/lib/android-sdk',
+    '/opt/android-sdk',
+  ].filter(Boolean);
+  for (const root of sdkRoots) {
+    const buildTools = path.join(root, 'build-tools');
+    try {
+      const versions = fs.readdirSync(buildTools).sort((a, b) => {
+        const aa = a.split('.').map((part) => Number.parseInt(part, 10) || 0);
+        const bb = b.split('.').map((part) => Number.parseInt(part, 10) || 0);
+        for (let i = 0; i < Math.max(aa.length, bb.length); i += 1) {
+          const difference = (bb[i] || 0) - (aa[i] || 0);
+          if (difference) return difference;
+        }
+        return 0;
+      });
+      for (const version of versions) pathCandidates.push(path.join(buildTools, version, 'apksigner'));
+    } catch {}
+  }
+  const found = pathCandidates.find((candidate) => {
+    try { return fs.statSync(candidate).isFile(); } catch { return false; }
+  });
+  if (!found) fail('Android apksigner was not found. Install Android SDK Build Tools or add apksigner to PATH.');
+  return found;
+}
+
+function verifyApkSignature(apkPath, keystoreEntry) {
+  const apksigner = findApksigner();
+  const output = runTool(apksigner, ['verify', '--verbose', '--print-certs', apkPath]);
+  const fingerprints = parseApkSignerFingerprints(output);
+  if (!fingerprints.length) fail('apksigner did not report a SHA-256 signer certificate for this APK.');
+  const matchingFingerprint = fingerprints.find((fingerprint) => fingerprint === normalizeFingerprint(keystoreEntry.fingerprint));
+  if (!matchingFingerprint) {
+    fail(`APK signer does not match keystore alias "${keystoreEntry.alias}". The APK was not added to the app list.`);
+  }
+  return matchingFingerprint;
+}
+
+async function sha256File(filePath) {
+  const hash = createHash('sha256');
+  for await (const chunk of createReadStream(filePath)) hash.update(chunk);
+  return hash.digest('hex');
+}
+
+function toCatalogPath(fromDirectory, absolutePath) {
+  return path.relative(fromDirectory, absolutePath).split(path.sep).join('/');
+}
+
+async function copyIfMissing(source, destination) {
+  await mkdir(path.dirname(destination), { recursive: true });
+  try {
+    await stat(destination);
+    return;
+  } catch {}
+  const temporary = `${destination}.tmp-${process.pid}-${randomBytes(5).toString('hex')}`;
+  try {
+    await copyFile(source, temporary);
+    try {
+      await rename(temporary, destination);
+    } catch (error) {
+      // A concurrent publish of the identical content-addressed asset is harmless.
+      try { await stat(destination); } catch { throw error; }
+      await rm(temporary, { force: true });
+    }
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+
+async function writeJsonAtomically(filePath, value) {
+  await mkdir(path.dirname(filePath), { recursive: true });
+  const temporary = `${filePath}.tmp-${process.pid}-${randomBytes(5).toString('hex')}`;
+  try {
+    await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { flag: 'wx', mode: 0o644 });
+    await rename(temporary, filePath);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+
+async function releaseApp(input, options = {}) {
+  const catalogPath = path.resolve(options.catalogPath || path.join(process.cwd(), 'storebase-app-list.json'));
+  const catalogDirectory = path.dirname(catalogPath);
+  const assetsDirectory = path.resolve(options.assetsDir || path.join(catalogDirectory, 'storebase-app-assets'));
+  const certificate = normalizeFingerprint(options.signingCertificateSha256);
+  if (certificate.length !== 64) fail('A verified 64-character SHA-256 signing certificate is required before release.');
+
+  let current = { schemaVersion: 1, apps: [] };
+  try {
+    current = JSON.parse(await readFile(catalogPath, 'utf8'));
+  } catch (error) {
+    if (error.code !== 'ENOENT') fail(`Cannot read app-list catalog ${catalogPath}: ${error.message}`);
+  }
+  if (!current || current.schemaVersion !== 1 || !Array.isArray(current.apps)) {
+    fail(`Catalog ${catalogPath} must be JSON with schemaVersion: 1 and an apps array.`);
+  }
+  const conflicting = current.apps.find((app) => app.id === input.id && app.name !== input.name);
+  if (conflicting) fail(`App id "${input.id}" is already used by "${conflicting.name}".`);
+
+  const apkHash = await sha256File(input.apkPath);
+  const avatarHash = await sha256File(input.avatarPath);
+  const versionDirectory = path.join(assetsDirectory, input.id, input.version);
+  const apkDestination = path.join(versionDirectory, `app-${apkHash}.apk`);
+  const avatarDestination = path.join(versionDirectory, `avatar-${avatarHash}${input.avatarExtension}`);
+
+  // Content-addressed paths ensure that a failed catalog write never corrupts the previous listing.
+  await copyIfMissing(input.apkPath, apkDestination);
+  await copyIfMissing(input.avatarPath, avatarDestination);
+
+  const appRecord = {
+    id: input.id,
+    name: input.name,
+    avatar: toCatalogPath(catalogDirectory, avatarDestination),
+    version: input.version,
+    apk: toCatalogPath(catalogDirectory, apkDestination),
+    category: input.category,
+    description: input.description,
+    signingCertificateSha256: certificate,
+    publishedAt: options.publishedAt || new Date().toISOString(),
+  };
+  const apps = current.apps.filter((app) => app.id !== input.id);
+  apps.push(appRecord);
+  apps.sort((a, b) => a.name.localeCompare(b.name));
+  const nextCatalog = { ...current, schemaVersion: 1, updatedAt: appRecord.publishedAt, apps };
+  await writeJsonAtomically(catalogPath, nextCatalog);
+
+  return {
+    app: appRecord,
+    catalogPath,
+    assetsDirectory,
+    catalog: nextCatalog,
+  };
+}
+
+module.exports = {
+  CATEGORIES,
+  findApksigner,
+  normalizeFingerprint,
+  parseApkSignerFingerprints,
+  parseKeystoreEntries,
+  releaseApp,
+  slugify,
+  validateInput,
+  verifyApkSignature,
+  inspectKeystore,
+};

package/package.json

@@ -1,6 +1,22 @@
 {
   "name": "storebase-cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "Publish signed Android apps into a local StoreBase app-list catalog",
+  "license": "UNLICENSED",
+  "private": false,
+  "type": "commonjs",
+  "bin": {
+    "storebase-publish": "bin/storebase-publish.js"
+  },
+  "files": [
+    "bin/",
+    "lib/",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "test": "node --test"
+  }
+}