feat(store): CI/CD publishing — publisher API tokens + publish script (#6)

Lets extensions be published from git/CI instead of the web form. The only
backend gap was headless auth, so this adds long-lived publisher API tokens:
- migration 0005_publisher_tokens (stores only the sha256 of the token)
- mint/list/revoke endpoints; minting requires a real session (a leaked CI
  token can't mint more); store currentUser() resolves `tbpub_…` bearers
- scripts/publish-extension.sh: zip → scp to files.profullstack.com → register
  the new version via the API with the token (generic; any CI)
- docs/ci-publishing.md: token + SSH-key setup and a paste-in GitHub workflow

scp upload + the version endpoint + slug lookup already existed, so CI reuses
them. Typecheck clean; token mint/resolve/list/revoke round-trip verified.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: ralyodio

docs/ci-publishing.md

@@ -0,0 +1,84 @@
+# CI/CD publishing to the TronBrowser store
+
+Publish a new version of your extension automatically from git — on every tag or
+push — instead of using the web form. Works from GitHub Actions, GitLab CI, or any
+shell.
+
+## How it works
+
+1. **One-time setup (web UI):** create the listing and pay the one-time **$1**
+   fee at `https://tronbrowser.dev/store/submit.html`, and register your **SSH
+   key** (the publisher identity that can upload to files.profullstack.com).
+2. **Mint a publisher API token** (shown once) — your CI uses it instead of a
+   browser session.
+3. **Each CI run** builds your MV3 bundle, `scp`s it to
+   `files.profullstack.com`, and registers the new version via the store API.
+   Listings update **free and instantly** after the initial paid listing.
+
+## 1. Mint a publisher token
+
+Signed in, from a browser session:
+
+```bash
+curl -X POST https://tronbrowser.dev/api/store/publisher/tokens \
+  -H 'content-type: application/json' --cookie 'tb_session=…' \
+  -d '{"name":"github-actions"}'
+# => { "ok": true, "token": "tbpub_…", ... }   # store the token now — shown once
+```
+
+List or revoke: `GET /api/store/publisher/tokens`, `DELETE /api/store/publisher/tokens/:id`.
+
+## 2. Add CI secrets
+
+| Secret | Value |
+| --- | --- |
+| `TRONBROWSER_STORE_TOKEN` | the `tbpub_…` token from step 1 |
+| `TRONBROWSER_SSH_KEY` | the **private** SSH key whose public key is registered with your publisher account |
+
+## 3. The publish step
+
+It calls [`scripts/publish-extension.sh`](../scripts/publish-extension.sh).
+Required env: `TRONBROWSER_STORE_TOKEN`, `TRONBROWSER_SSH_KEY`, `STORE_SLUG`.
+Optional: `STORE_URL`, `SCP_TARGET`, `MANIFEST` (default `manifest.json`),
+`BUNDLE` (dir to zip, or a `.zip`/`.crx`; default `dist`). Needs `jq`, `curl`,
+`ssh`/`scp`, `zip` (all preinstalled on `ubuntu-latest`).
+
+### GitHub Actions (paste into your extension's repo)
+
+```yaml
+name: Publish to TronBrowser store
+on:
+  push:
+    tags: ['v*']
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm ci && npm run build      # produce ./dist
+      - name: Publish
+        env:
+          TRONBROWSER_STORE_TOKEN: ${{ secrets.TRONBROWSER_STORE_TOKEN }}
+          TRONBROWSER_SSH_KEY: ${{ secrets.TRONBROWSER_SSH_KEY }}
+          STORE_SLUG: my-extension
+          BUNDLE: dist
+          MANIFEST: dist/manifest.json
+        run: curl -fsSL https://raw.githubusercontent.com/profullstack/tronbrowser.dev/main/scripts/publish-extension.sh | bash
+```
+
+### Any other CI / local
+
+```bash
+export TRONBROWSER_STORE_TOKEN=tbpub_…
+export TRONBROWSER_SSH_KEY="$(cat ~/.ssh/id_ed25519)"
+export STORE_SLUG=my-extension BUNDLE=dist
+./scripts/publish-extension.sh
+```
+
+## Notes
+
+- The version number comes from your `manifest.json` `version` — bump it each
+  release or Chromium won't auto-update clients.
+- The first publish for a slug must be the paid web listing; CI handles every
+  version after that.
+- Tokens are long-lived and revocable; treat them like a deploy key.

packages/storage/migrations/0005_publisher_tokens.sql

@@ -0,0 +1,18 @@
+-- Long-lived publisher API tokens for headless / CI publishing.
+--
+-- A publisher mints a token in the web UI (shown once) and stores it as a CI
+-- secret. CI then sends it as `Authorization: Bearer tbpub_...` to push new
+-- extension versions without a browser session. We store only the SHA-256 hash
+-- of the token, never the token itself.
+
+CREATE TABLE IF NOT EXISTS publisher_tokens (
+  id            TEXT PRIMARY KEY,
+  user_id       TEXT NOT NULL,
+  token_hash    TEXT NOT NULL UNIQUE,                 -- sha256 hex of the raw token
+  name          TEXT,                                 -- human label, e.g. "github-actions"
+  created_at    TEXT NOT NULL DEFAULT (datetime('now')),
+  last_used_at  TEXT,
+  FOREIGN KEY (user_id) REFERENCES users(id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_publisher_tokens_user ON publisher_tokens (user_id);

scripts/publish-extension.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# Publish a new version of a TronBrowser store extension from CI (or locally).
+#
+# Build-free: expects a prebuilt Manifest V3 bundle (a directory to zip, or a
+# ready .zip/.crx). It (1) zips the bundle, (2) scps it to files.profullstack.com
+# using your publisher SSH key, then (3) registers the new version via the store
+# API with a publisher token. Generic — works from GitHub Actions, GitLab CI, or
+# your shell. Requires: bash, curl, jq, ssh/scp, zip.
+#
+# The listing must already EXIST and have its one-time $1 fee paid (do that once
+# in the web UI at <store>/store/submit.html). After that, every push is free
+# and goes live instantly via this script.
+#
+# Required env:
+#   TRONBROWSER_STORE_TOKEN   publisher API token (tbpub_...), minted in the web UI
+#   TRONBROWSER_SSH_KEY       private SSH key registered with your publisher account
+#   STORE_SLUG                the extension's slug
+# Optional env:
+#   STORE_URL   default https://tronbrowser.dev
+#   SCP_TARGET  default files@files.profullstack.com
+#   MANIFEST    path to manifest.json (default: manifest.json)
+#   BUNDLE      dir to zip, or a .zip/.crx file (default: dist)
+set -euo pipefail
+
+STORE_URL="${STORE_URL:-https://tronbrowser.dev}"
+SCP_TARGET="${SCP_TARGET:-files@files.profullstack.com}"
+MANIFEST="${MANIFEST:-manifest.json}"
+BUNDLE="${BUNDLE:-dist}"
+: "${TRONBROWSER_STORE_TOKEN:?set TRONBROWSER_STORE_TOKEN (mint one in the store web UI)}"
+: "${TRONBROWSER_SSH_KEY:?set TRONBROWSER_SSH_KEY (your publisher private key)}"
+: "${STORE_SLUG:?set STORE_SLUG}"
+
+work="$(mktemp -d)"; trap 'rm -rf "$work"' EXIT
+
+# 1) Produce the artifact.
+case "$BUNDLE" in
+  *.zip|*.crx) artifact="$BUNDLE" ;;
+  *) artifact="$work/${STORE_SLUG}.zip"; ( cd "$BUNDLE" && zip -qr "$artifact" . ) ;;
+esac
+fname="$(basename "$artifact")"
+case "$fname" in *.crx) ftype=crx ;; *) ftype=zip ;; esac
+
+# 2) Upload to files.profullstack.com under the slug's path.
+key="$work/id_key"; printf '%s\n' "$TRONBROWSER_SSH_KEY" > "$key"; chmod 600 "$key"
+host="${SCP_TARGET#*@}"
+ssh-keyscan -H "$host" >> "$work/known_hosts" 2>/dev/null || true
+scp -i "$key" -o UserKnownHostsFile="$work/known_hosts" "$artifact" \
+  "${SCP_TARGET}:/public/extensions/${STORE_SLUG}/${fname}"
+
+# 3) Resolve the listing id, then register the new version with the token.
+id="$(curl -fsS "${STORE_URL}/api/store/extensions/${STORE_SLUG}" | jq -r '.id // empty')"
+if [ -z "$id" ]; then
+  echo "error: listing '${STORE_SLUG}' not found — create it and pay the one-time \$1 fee in the web UI first." >&2
+  exit 1
+fi
+
+body="$(jq -n --argjson m "$(cat "$MANIFEST")" --arg f "$fname" --arg t "$ftype" \
+  '{manifest: $m, files: {($t): $f}, source: "pr"}')"
+resp="$(curl -fsS -X POST "${STORE_URL}/api/store/extensions/${id}/versions" \
+  -H "authorization: Bearer ${TRONBROWSER_STORE_TOKEN}" \
+  -H 'content-type: application/json' -d "$body")"
+
+echo "published ${STORE_SLUG}: $resp"

services/api/src/store/db.ts

@@ -1,6 +1,7 @@
 // Data access for the extension store. Mirrors the style of ../db.ts (raw
 // libSQL via the shared db() client).
-import { db } from '../db.js';
+import { createHash, randomBytes } from 'node:crypto';
+import { db, type User } from '../db.js';
 import { uuid } from '../auth.js';
 
 export interface Extension {
@@ -276,3 +277,55 @@ export async function upsertPublisherKey(k: {
     args: [k.userId, k.handle, k.pubkey, k.fingerprint, k.provisioned ? new Date().toISOString() : null],
   });
 }
+
+/* ---------- publisher API tokens (headless / CI publishing) ---------- */
+
+export interface PublisherToken {
+  id: string;
+  user_id: string;
+  name: string | null;
+  created_at: string;
+  last_used_at: string | null;
+}
+
+const TOKEN_PREFIX = 'tbpub_';
+const hashToken = (raw: string): string => createHash('sha256').update(raw).digest('hex');
+
+/** Mint a long-lived publisher token. Returns the RAW token (shown once). */
+export async function createPublisherToken(
+  userId: string,
+  name?: string | null,
+): Promise<{ token: string; id: string; name: string | null }> {
+  const token = TOKEN_PREFIX + randomBytes(24).toString('base64url');
+  const id = uuid();
+  await db().execute({
+    sql: 'INSERT INTO publisher_tokens (id, user_id, token_hash, name) VALUES (?, ?, ?, ?)',
+    args: [id, userId, hashToken(token), name ?? null],
+  });
+  return { token, id, name: name ?? null };
+}
+
+/** Resolve a raw `tbpub_…` token to its user, stamping last_used_at. */
+export async function userByPublisherToken(raw: string): Promise<User | null> {
+  if (!raw.startsWith(TOKEN_PREFIX)) return null;
+  const hash = hashToken(raw);
+  const r = await db().execute({ sql: 'SELECT user_id FROM publisher_tokens WHERE token_hash = ?', args: [hash] });
+  const row = r.rows[0];
+  if (!row) return null;
+  await db().execute({ sql: "UPDATE publisher_tokens SET last_used_at = datetime('now') WHERE token_hash = ?", args: [hash] });
+  const u = await db().execute({ sql: 'SELECT * FROM users WHERE id = ?', args: [String(row.user_id)] });
+  return (u.rows[0] as unknown as User) ?? null;
+}
+
+export async function listPublisherTokens(userId: string): Promise<PublisherToken[]> {
+  const r = await db().execute({
+    sql: 'SELECT id, user_id, name, created_at, last_used_at FROM publisher_tokens WHERE user_id = ? ORDER BY created_at DESC',
+    args: [userId],
+  });
+  return r.rows as unknown as PublisherToken[];
+}
+
+export async function revokePublisherToken(userId: string, id: string): Promise<boolean> {
+  const r = await db().execute({ sql: 'DELETE FROM publisher_tokens WHERE id = ? AND user_id = ?', args: [id, userId] });
+  return (r.rowsAffected ?? 0) > 0;
+}

services/api/src/store/routes.ts

@@ -11,6 +11,7 @@ import {
   setExtensionStatus, addVersion, latestVersion, createPayment, setPaymentRef,
   markPaidByRef, hasPaidListing, latestScan, addFlag, openFlagCount,
   publisherKey, handleTaken, upsertPublisherKey,
+  createPublisherToken, userByPublisherToken, listPublisherTokens, revokePublisherToken,
 } from './db.js';
 import { validateManifest, slugify } from './manifest.js';
 import {
@@ -27,10 +28,20 @@ const APP_URL = process.env.APP_URL || 'https://tronbrowser.dev';
 
 async function currentUser(c: any): Promise<User | null> {
   const bearer = c.req.header('authorization')?.replace(/^Bearer\s+/i, '');
+  // Long-lived publisher API tokens (CI) are distinguishable by prefix; anything
+  // else in the bearer position is treated as a normal session token.
+  if (bearer?.startsWith('tbpub_')) return userByPublisherToken(bearer);
   const sess = bearer || getCookie(c, 'tb_session');
   return sess ? userBySession(sess) : null;
 }
 
+/** A user resolved from a browser SESSION only (not an API token). */
+async function sessionUser(c: any): Promise<User | null> {
+  const bearer = c.req.header('authorization')?.replace(/^Bearer\s+/i, '');
+  if (bearer?.startsWith('tbpub_')) return null;
+  return currentUser(c);
+}
+
 function xmlEscape(s: string): string {
   return s.replace(/[<>&'"]/g, (ch) => ({ '<': '&lt;', '>': '&gt;', '&': '&amp;', "'": '&apos;', '"': '&quot;' }[ch]!));
 }
@@ -180,6 +191,38 @@ store.post('/publisher/key', async (c) => {
   });
 });
 
+/* ---------- publisher API tokens (headless / CI publishing) ----------
+   A token authenticates CI as the publisher so it can push new versions without
+   a browser session. Minting requires a real session (so a leaked CI token
+   can't mint more). The raw token is returned ONCE; only its hash is stored. */
+store.post('/publisher/tokens', async (c) => {
+  const user = await sessionUser(c);
+  if (!user) return c.json({ error: 'mint tokens from a signed-in browser session' }, 401);
+  const body = await c.req.json().catch(() => ({}));
+  const name = String(body.name || 'ci').trim().slice(0, 40) || 'ci';
+  const { token, id } = await createPublisherToken(user.id, name);
+  return c.json({
+    ok: true,
+    token,
+    id,
+    name,
+    note: 'Shown once — store it as the CI secret TRONBROWSER_STORE_TOKEN.',
+  });
+});
+
+store.get('/publisher/tokens', async (c) => {
+  const user = await currentUser(c);
+  if (!user) return c.json({ error: 'unauthorized' }, 401);
+  return c.json({ tokens: await listPublisherTokens(user.id) });
+});
+
+store.delete('/publisher/tokens/:id', async (c) => {
+  const user = await sessionUser(c);
+  if (!user) return c.json({ error: 'unauthorized' }, 401);
+  const ok = await revokePublisherToken(user.id, c.req.param('id'));
+  return c.json({ ok }, ok ? 200 : 404);
+});
+
 /* ---------- publisher: submit an MV3 version (upload or PR) ----------
    Accepts JSON: { manifest, bundleUrl?, crxUrl?, bundleSha256?, sizeBytes?, source? }
    `manifest` may be the manifest.json string or object. We keep Chromium's