CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

config loads without Node's MODULE_TYPELESS_PACKAGE_JSON warning in a CommonJS project; capture sign-in docs use captureAuth and check notes a local capture that signs in with reviewDemoAccount (the App Review account)

Browse source
This commit is contained in:
CRTkafa 2026-10-20 13:11:10 +07:00
parent 2fdd96e68c
commit 8c1a01d856
5 changed files with 38 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

11
skills/store-screenshots/SKILL.md
View file

@ -197,10 +197,13 @@ Key screens behind a login (`source: 'web'`): capture against a **local or demo
demo account. Never real users' data in store screenshots. The same frames feed both stores (App Store and Google
Play), so one sign-in setup covers both. Two ways to sign in, set in `shots.capture.auth`:
- **Sign-in request**: `{ request: { url: '/api/login', method: 'POST', body: { email: '${cred:reviewDemoAccount.username}',
password: '${cred:reviewDemoAccount.password}' } } }`. It runs once per browser context before its first shot, and
the context keeps the cookies. `${cred:NAME}` reads `.storebound/credentials.json` (`reviewDemoAccount.username` /
`.password`, also from REVIEW_DEMO_USER / REVIEW_DEMO_PASSWORD, or any key under `captureAuth`). `${env:NAME}`
- **Sign-in request**: `{ request: { url: '/api/login', method: 'POST', body: { email: '${cred:email}',
password: '${cred:password}' } } }` with `captureAuth: { email, password }` in `.storebound/credentials.json`. It
runs once per browser context before its first shot, and the context keeps the cookies. `${cred:NAME}` reads
`captureAuth.NAME` (or `reviewDemoAccount.username` / `.password`, also from REVIEW_DEMO_USER / REVIEW_DEMO_PASSWORD).
Keep the two apart: `reviewDemoAccount` is the account `apple review-details` sends to App Review and must work on
the live backend; a local demo stack's sign-in belongs in `captureAuth`. `check` warns when a capture against
localhost uses `reviewDemoAccount`. `${env:NAME}`
reads the environment. A password-, token- or key-like field with a literal value is refused. A status outside
2xx/3xx stops the capture and shows the status, never the values.
- **Saved session**: `{ storageState: '.storebound/auth.json' }`, made by `storebound shots login [--url <url>]`. It