storeshot 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,15 @@
+# Changelog
+
+All notable changes to StoreShot will be documented in this file. The format is
+based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versioning
+follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0] - 2026-07-16
+
+Initial public pre-release of the local-first StoreShot CLI and visual App Store
+screenshot editor.
+
+This `0.x` release line is under active development and may contain breaking
+project-format or API changes.

package/CONTRIBUTING.md

@@ -0,0 +1,75 @@
+# Contributing to StoreShot
+
+Thank you for helping improve StoreShot. The project is in active development,
+so small, focused changes with a clear user benefit are easiest to review.
+
+## Before you start
+
+- Search existing issues before opening a new one.
+- For a bug, include the StoreShot version, Node.js version, operating system,
+  reproduction steps, and the smallest safe example project you can share.
+- For a substantial feature or architecture change, open an issue first so the
+  approach and scope can be agreed before implementation.
+- Never attach private screenshots, signing material, tokens, or proprietary
+  mockup assets to an issue.
+
+## Development setup
+
+StoreShot requires Node.js 22.12 or newer and npm.
+
+```bash
+npm ci
+npm run dev
+```
+
+The development command uses the ignored `playground/` directory. To test a
+different project without opening the browser:
+
+```bash
+npm run storeshot -- dev /tmp/storeshot-project --no-open
+```
+
+## Project principles
+
+- Keep StoreShot local-first and folder-based. Do not introduce accounts, a
+  remote backend, or a database without prior agreement.
+- Treat the directory passed to `storeshot dev` as a strict filesystem boundary.
+- Keep Node-only code out of the browser bundle and browser-only code out of the
+  CLI runtime.
+- Prefer readable types and direct solutions over compatibility layers or clever
+  abstractions. The `0.x` format may evolve when a cleaner design warrants it.
+- Prefer the existing source-owned shadcn/Base UI components for interactive UI.
+- Do not commit `dist/`, `node_modules/`, `playground/` contents, or local
+  `mockup-bundles/` and `element-bundles/` archives.
+
+## Licensing new dependencies and assets
+
+Every new dependency and redistributed asset must have a license that permits
+its intended use and distribution.
+
+- Add package dependencies through npm so `package-lock.json` records their SPDX
+  license metadata.
+- Run `npm run licenses` after changing a package whose code or assets are
+  included in StoreShot's distributable output.
+- Preserve upstream copyright notices and license files for bundled artwork,
+  fonts, and mockups.
+- Record an asset's source URL and exact revision in its local README or manifest.
+- Do not add assets copied from commercial products or websites without explicit
+  redistribution permission.
+
+Update `THIRD_PARTY_NOTICES.md` when attribution changes.
+
+## Validation and pull requests
+
+Run the full gate before opening a pull request:
+
+```bash
+npm run check
+```
+
+For UI changes, also exercise the affected workflow in the browser. Keep commits
+focused, explain user-visible behavior in the pull request, and call out project
+format changes explicitly.
+
+By submitting a contribution, you agree that it may be distributed under the
+project's MIT License.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mikko Kutilainen
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,142 @@
+# StoreShot
+
+StoreShot is a local-first, agent-native CLI and visual editor for creating
+App Store screenshots. Run it in a folder, edit screenshot sets in the browser,
+and keep the complete project as ordinary assets and JSON files that humans,
+scripts, and AI coding agents can all inspect and change.
+
+> **Pre-release:** StoreShot is currently at `0.1.0`. It is under active
+> development, changes quickly, and does not yet promise backward compatibility.
+> It supports Apple App Store screenshots today; Google Play support is planned.
+
+StoreShot is already used in production for the iOS app
+[Lokimaps](https://www.lokimaps.com/).
+
+## Why StoreShot?
+
+Many existing screenshot tools were designed as closed, manual design silos.
+Their project data is difficult to inspect, version, automate, or hand to an AI
+agent, which makes routine localization and release work unnecessarily awkward.
+
+StoreShot keeps the workflow open and file-based. The visual editor is useful
+for hands-on design, while the same project can be reviewed, generated, or
+updated by an agent through normal filesystem tools. There is no account,
+database, hosted project, or remote backend.
+
+## What it can do
+
+- Organize raw screenshots, brand artwork, logos, and reusable image assets.
+- Create ordered screenshot sets for a locale and Apple device family.
+- Arrange text, shapes, images, recolorable artwork, and device mockups on a
+  free-form canvas.
+- Use undo/redo, copy/paste, alignment guides, layers, keyboard movement, and
+  canvas zoom.
+- Export an entire set as full-resolution PNG files in a ZIP archive.
+- Import portable device-mockup bundles with explicit frame geometry and license
+  metadata.
+- Persist everything inside the selected project directory.
+
+## Quick start
+
+StoreShot requires Node.js 22.12 or newer.
+
+```bash
+npm install --global storeshot
+mkdir app-store-screenshots
+storeshot dev app-store-screenshots
+```
+
+The command opens a local workspace at `http://127.0.0.1:4173`. To use a
+different port or avoid opening the browser:
+
+```bash
+storeshot dev ./app-store-screenshots --port 4174 --no-open
+```
+
+The default server is bound to the loopback interface. Be deliberate when using
+`--host` to expose it to another interface.
+
+## Project format
+
+StoreShot creates a transparent, portable project structure:
+
+```text
+app-store-screenshots/
+├── storeshot.json
+├── assets/
+│   ├── screenshots/
+│   ├── brand/
+│   ├── logos/
+│   └── other/
+├── mockup-bundles/
+│   └── my-device-frames/
+│       ├── storeshot-mockups.json
+│       ├── LICENSE
+│       └── assets/
+└── sets/
+    ├── english-iphone-a1b2c3d4.json
+    └── finnish-iphone-e5f6g7h8.json
+```
+
+Each set stores its locale, device, output dimensions, ordered screenshots, and
+canvas layers. StoreShot only serves files inside the selected project boundary.
+Project assets and imported bundles remain subject to their own licenses.
+
+The editor can load fonts from [Bunny Fonts](https://fonts.bunny.net/) on demand.
+The project itself remains local, but selecting a hosted font requires a network
+request to Bunny Fonts.
+
+## Device mockups
+
+The built-in Apple frames come from the MIT-licensed
+[FrameUp Free](https://github.com/amirmun99/FrameUp-Free) project. StoreShot also
+supports project-local bundles and lets users import all or selected frames.
+
+See the [mockup bundle format](docs/mockup-bundles.md) for the manifest and
+geometry specification.
+
+## Develop from source
+
+From a checkout of this repository or your fork:
+
+```bash
+npm ci
+npm run dev
+```
+
+`npm run dev` starts the CLI in watch mode against the ignored `playground/`
+project and serves the React UI with Vite hot reload.
+
+Useful commands:
+
+| Command | Purpose |
+| --- | --- |
+| `npm run dev` | Run the development CLI and UI against `playground/` |
+| `npm run storeshot -- dev <dir> --no-open` | Run the unbuilt CLI against another folder |
+| `npm run typecheck` | Type-check the project |
+| `npm run build` | Build the CLI and browser UI |
+| `npm run licenses` | Regenerate bundled dependency license texts |
+| `npm run check` | Run license, type, and production-build validation |
+
+The repository also includes `AGENTS.md` and project-local Codex configuration
+for agent-assisted development.
+
+Maintainers can follow the [release guide](docs/releasing.md) to publish a new
+version through npm trusted publishing and GitHub Actions.
+
+## Contributing and security
+
+StoreShot is early software, and focused issues and pull requests are welcome.
+Read [CONTRIBUTING.md](CONTRIBUTING.md) before making a substantial change. Please
+report vulnerabilities according to [SECURITY.md](SECURITY.md), not in a public
+issue.
+
+## License
+
+StoreShot is released under the [MIT License](LICENSE).
+
+Third-party packages, fonts, icons, and device frames retain their own licenses.
+See [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md) and
+[THIRD_PARTY_LICENSES.txt](THIRD_PARTY_LICENSES.txt) for attribution and license
+details. StoreShot is not affiliated with or endorsed by Apple Inc. Apple,
+App Store, iPhone, iPad, Apple Watch, and Mac are trademarks of Apple Inc.

package/SECURITY.md

@@ -0,0 +1,25 @@
+# Security policy
+
+## Supported versions
+
+StoreShot is pre-release software. Security fixes are made against the latest
+`0.x` release and the current default branch; older prereleases are not
+maintained.
+
+## Reporting a vulnerability
+
+Please do not report a vulnerability in a public issue. Use the repository's
+private vulnerability reporting feature on GitHub. If private reporting is not
+available, contact the maintainer privately through the contact information on
+their GitHub profile.
+
+Include the affected version, impact, reproduction steps, and any suggested
+mitigation. Do not include real user screenshots, credentials, tokens, or other
+sensitive project data. You should receive an acknowledgement within seven days,
+although this volunteer project cannot guarantee a resolution timeline.
+
+## Local server model
+
+StoreShot serves a user-selected project directory and binds to `127.0.0.1` by
+default. Exposing the service with `--host` changes its threat model. Only do so
+on a trusted network, and do not place untrusted files in the project directory.