Onboarding live apps without owner questions for what the stores and the code prove: storebound onboard imports the live products and subscriptions with USD / base prices (catalog diff clean), contact values, the App Review contact and demo account (credentials.json, masked), sign-in for review from Apple's review detail and auth code, and the account deletion page from the app's site; App Store keywords count characters (live fields up to 265 bytes accepted); validate accepts the 6.5-inch iPhone set and Play's default-language graphics fallback; Play Reporting API off gives the project's enable link and apps list falls back to local apps; accounts default <profile>; store-only apps (apps add --store --app-id) shown read-only in the desktop (pitfalls 43-52)

apps/desktop/src-tauri/src/commands.rs

@@ -1091,9 +1091,21 @@ pub async fn store_apps_refresh(window: WebviewWindow, app: AppHandle, state: St
     let value = r.call_job("apps.list", json!({ "credentials": creds, "args": { "icons": icons } }), job.as_deref()).await?;
     let at = store::now_iso();
     state.cache.put(&format!("acct:{id}"), "apps.list", &json!({}), &value, &at).map_err(Fail::host)?;
+    let st = saved(&state)?;
+    let value = match st.accounts.iter().find(|a| a.id == id) {
+        Some(a) => store_only_into(&st.accounts, a, Some(value.clone()), &registry::read_store_apps(&state.registry), &at).unwrap_or(value),
+        None => value,
+    };
     Ok(Entry { value, at })
 }
 
+/// One account's app list with the machine's store-only apps of its credential profile added (registry.rs).
+fn store_only_into(all: &[Account], a: &Account, list: Option<Value>, apps: &[registry::StoreOnly], at: &str) -> Option<Value> {
+    let store = match a.kind { AccountKind::Apple => "apple", AccountKind::Play => "play" };
+    let only = all.iter().filter(|x| x.kind == a.kind).count() == 1;
+    registry::with_store_only(list, store, a.profile.as_deref(), only, apps, at)
+}
+
 #[derive(Serialize)]
 pub struct AccountApps {
     account: String,
@@ -1104,11 +1116,19 @@ pub struct AccountApps {
 #[tauri::command]
 pub fn store_apps_cached(window: WebviewWindow, state: State<'_, AppState>) -> Res<Vec<AccountApps>> {
     guard(&window)?;
-    let ids: Vec<String> = saved(&state)?.accounts.iter().map(|a| a.id.clone()).collect();
-    ids.into_iter()
-        .map(|account| {
-            let entry = state.cache.get(&format!("acct:{account}"), "apps.list", &json!({})).map_err(Fail::host)?;
-            Ok(AccountApps { account, entry })
+    let accounts = saved(&state)?.accounts.clone();
+    let store_only = registry::read_store_apps(&state.registry);
+    accounts
+        .iter()
+        .map(|a| {
+            let entry = state.cache.get(&format!("acct:{}", a.id), "apps.list", &json!({})).map_err(Fail::host)?;
+            // apps live on a store with no project on this machine (`storebound apps add --store … --app-id …`)
+            let at = entry.as_ref().map(|e| e.at.clone()).unwrap_or_else(store::now_iso);
+            let entry = match store_only_into(&accounts, a, entry.as_ref().map(|e| e.value.clone()), &store_only, &at) {
+                Some(value) => Some(Entry { value, at }),
+                None => entry,
+            };
+            Ok(AccountApps { account: a.id.clone(), entry })
         })
         .collect()
 }

apps/desktop/src-tauri/src/registry.rs

@@ -4,7 +4,11 @@
 //! in state.json under the same id. `sync` runs at start, when the list is shown and before a deep link is handled;
 //! adding, removing and locating a folder in the app write the registry too. The first start with a registry missing
 //! writes the app's own list into it.
-//!   { "version": 1, "projects": [{ "id": "<16 hex>", "path": "/abs/folder", "name": "Star Dash", "added": "<iso>" }] }
+//!   { "version": 1, "projects": [{ "id": "<16 hex>", "path": "/abs/folder", "name": "Star Dash", "added": "<iso>" }],
+//!     "storeApps": [{ "id": "<16 hex>", "store": "apple", "appId": "6400000000", "account": "<profile>", "name": "…" }] }
+//! `storeApps` (written by `storebound apps add --store … --app-id …`) are apps live on a store with no project on this
+//! machine: they join the app list of the account with that credential profile (`store_apps_cached`), so the
+//! portfolio shows them read-only ("store only"). Writing the folder list keeps them.
 use std::fs;
 use std::path::{Path, PathBuf};
 
@@ -69,12 +73,87 @@ pub fn write(file: &Path, entries: &[Entry]) -> Result<(), String> {
     if let Some(d) = file.parent() {
         fs::create_dir_all(d).map_err(|e| e.to_string())?;
     }
-    let text = serde_json::to_string_pretty(&serde_json::json!({ "version": 1, "projects": entries })).map_err(|e| e.to_string())? + "\n";
+    // the store-only entries the CLI wrote stay as they are
+    let keep = fs::read_to_string(file).ok().and_then(|t| serde_json::from_str::<Value>(&t).ok()).and_then(|v| v.get("storeApps").cloned()).filter(|s| s.as_array().is_some_and(|a| !a.is_empty()));
+    let mut doc = serde_json::json!({ "version": 1, "projects": entries });
+    if let Some(s) = keep {
+        doc["storeApps"] = s;
+    }
+    let text = serde_json::to_string_pretty(&doc).map_err(|e| e.to_string())? + "\n";
     let tmp = file.with_extension(format!("tmp-{}", std::process::id()));
     fs::write(&tmp, text).map_err(|e| e.to_string())?;
     fs::rename(&tmp, file).map_err(|e| e.to_string())
 }
 
+/// An app that is live on a store with no project on this machine (cli/lib/registry.ts StoreOnlyApp).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct StoreOnly {
+    pub id: String,
+    /// "apple" | "play"
+    pub store: String,
+    /// Apple: the numeric app id; Play: the package name.
+    pub app_id: String,
+    /// The credential profile that reads it; None = the account of that store when there is only one.
+    pub account: Option<String>,
+    pub name: String,
+    pub bundle_id: Option<String>,
+}
+
+/// The store-only entries of the file's text (pure): malformed ones are dropped.
+pub fn parse_store_apps(text: &str) -> Vec<StoreOnly> {
+    let Ok(v) = serde_json::from_str::<Value>(text) else { return vec![] };
+    let mut out: Vec<StoreOnly> = vec![];
+    for x in v.get("storeApps").and_then(Value::as_array).into_iter().flatten() {
+        let s = |k: &str| x.get(k).and_then(Value::as_str).map(str::trim).filter(|s| !s.is_empty()).map(str::to_string);
+        let (Some(store), Some(app_id)) = (s("store"), s("appId")) else { continue };
+        let ok = match store.as_str() {
+            "apple" => app_id.len() >= 6 && app_id.len() <= 12 && app_id.chars().all(|c| c.is_ascii_digit()),
+            "play" => app_id.contains('.') && app_id.chars().all(|c| c.is_ascii_alphanumeric() || c == '.' || c == '_'),
+            _ => false,
+        };
+        if !ok || out.iter().any(|o| o.store == store && o.app_id == app_id) {
+            continue;
+        }
+        let id: String = Sha256::digest(format!("store:{store}:{app_id}").as_bytes()).iter().take(8).map(|b| format!("{b:02x}")).collect();
+        let bundle_id = s("bundleId").or_else(|| (store == "play").then(|| app_id.clone()));
+        out.push(StoreOnly { id, name: s("name").unwrap_or_else(|| app_id.clone()), account: s("account"), bundle_id, store, app_id });
+    }
+    out
+}
+
+pub fn read_store_apps(file: &Path) -> Vec<StoreOnly> {
+    fs::read_to_string(file).map(|t| parse_store_apps(&t)).unwrap_or_default()
+}
+
+/// One account's app list (`apps.list` JSON, or None when never read) with the store-only entries of its profile
+/// added (pure). `store` is "apple" | "play"; `only` = this is the only account of that store (entries that name no
+/// profile go to it). The entries already in the list (same id) are left as the store reported them.
+pub fn with_store_only(list: Option<Value>, store: &str, profile: Option<&str>, only: bool, apps: &[StoreOnly], at: &str) -> Option<Value> {
+    let mine: Vec<&StoreOnly> = apps.iter().filter(|a| a.store == store && (a.account.as_deref().is_some_and(|p| Some(p) == profile) || (a.account.is_none() && only))).collect();
+    if mine.is_empty() {
+        return list;
+    }
+    let ios = store == "apple";
+    let mut v = list.unwrap_or_else(|| serde_json::json!({ "store": if ios { "ios" } else { "android" }, "apps": [], "warnings": [], "at": at }));
+    if !v.get("apps").is_some_and(Value::is_array) {
+        v["apps"] = serde_json::json!([]);
+    }
+    let have: Vec<String> = v["apps"].as_array().map(|a| a.iter().filter_map(|x| x.get("id").and_then(Value::as_str).map(str::to_string)).collect()).unwrap_or_default();
+    for a in mine {
+        if have.contains(&a.app_id) {
+            continue;
+        }
+        let app = serde_json::json!({
+            "store": if ios { "ios" } else { "android" }, "id": a.app_id, "bundleId": a.bundle_id.clone().unwrap_or_default(), "name": a.name,
+            "platforms": [if ios { "IOS" } else { "ANDROID" }], "sku": null, "primaryLocale": null, "latest": null, "icon": null, "registered": true,
+        });
+        if let Some(list) = v["apps"].as_array_mut() {
+            list.push(app);
+        }
+    }
+    Some(v)
+}
+
 fn entry_of(p: &Project) -> Entry {
     Entry { id: p.id.clone(), path: p.path.clone(), name: p.name.clone(), added: p.added.clone() }
 }