scan: accounts mean User ID, never email without evidence; accounts.signUp (username -> PSL_ACM_USER_ID_OTHER_AUTH); built bundles are low-trust evidence; privacy-manifest and scan find plugins in monorepo node_modules, workspaces and local SwiftPM packages

skills/account-deletion/SKILL.md

@@ -32,7 +32,12 @@ deletion requirements" (https://support.google.com/googleplay/android-developer/
    takes. No login wall to read it. `storebound validate --play` checks that it answers.
 3. In the app: a clear entry, a confirmation step, then the deletion (or the web page). Sign people out afterwards.
 4. Play Data safety: `dataSafety.deletionRequest: true`, `accountCreation` set to the sign-up methods you offer (not
-   `PSL_ACM_NONE`). Google does not publish the question ids for the delete-account URL: export the form once
+   `PSL_ACM_NONE`). Say how people sign up in `accounts.signUp` and `storebound scan` proposes it: `username` (a name
+   picked in the app, no password, no email; a server token on the device) is Play's "Username and other
+   authentication" (`PSL_ACM_USER_ID_OTHER_AUTH`) with User ID as the only account data; `username-password` and
+   `email-password` are "Username and password" (`PSL_ACM_USER_ID_PASSWORD`); `email-link` and `phone` are
+   `PSL_ACM_USER_ID_OTHER_AUTH`; `oauth` is `PSL_ACM_OAUTH`; `other` is `PSL_ACM_OTHER`. An account alone never means
+   an email address: declare Email only when the app asks for one. Google does not publish the question ids for the delete-account URL: export the form once
    (Play Console > App content > Data safety > Export to CSV), copy the id, and add it as
    `dataSafety.extra: [{ question: '<id>', value: '<deletionUrl>' }]`; otherwise enter the URL in the Console after
    `storebound play data-safety`.