Onboarding live apps without owner questions for what the stores and the code prove: storebound onboard imports the live products and subscriptions with USD / base prices (catalog diff clean), contact values, the App Review contact and demo account (credentials.json, masked), sign-in for review from Apple's review detail and auth code, and the account deletion page from the app's site; App Store keywords count characters (live fields up to 265 bytes accepted); validate accepts the 6.5-inch iPhone set and Play's default-language graphics fallback; Play Reporting API off gives the project's enable link and apps list falls back to local apps; accounts default <profile>; store-only apps (apps add --store --app-id) shown read-only in the desktop (pitfalls 43-52)

cli/lib/registry.ts

@@ -3,7 +3,12 @@
 // the desktop's App folders screen add to it; `storebound apps folders` and the desktop show it; `storebound ws ...`
 // without a storebound.workspace.json works over it. The desktop keeps its per-folder extras (mapped accounts, saved
 // reads) in its own state by the same id. Only paths and names: no keys, nothing from inside the folders.
-//   { "version": 1, "projects": [{ "id": "<16 hex>", "path": "/abs/folder", "name": "Star Dash", "added": "<iso>" }] }
+//   { "version": 1, "projects": [{ "id": "<16 hex>", "path": "/abs/folder", "name": "Star Dash", "added": "<iso>" }],
+//     "storeApps": [{ "id": "<16 hex>", "store": "apple", "appId": "6400000000", "account": "teamA", "name": "Demo App",
+//                     "bundleId": "com.example.demo", "added": "<iso>" }] }
+// storeApps: apps that are live on a store but have no project on this machine (`storebound apps add --store apple
+// --app-id <id> --account <profile>`). The desktop shows them read-only (status, reviews, analytics) under that
+// profile's account, noted "no local project"; they carry no path. Absent when there are none (older readers ignore it).
 // Written atomically (temp file, rename); a missing or unreadable file reads as empty (an unreadable one is kept).
 import { createHash } from 'node:crypto';
 import { copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
@@ -11,7 +16,10 @@ import { homedir } from 'node:os';
 import { basename, dirname, join, resolve } from 'node:path';
 
 export interface RegistryProject { id: string; path: string; name: string; added: string }
-export interface Registry { version: 1; projects: RegistryProject[] }
+/** A store app without a local project: store + app id (Apple: the numeric app id; Play: the package name), the
+ *  credential profile that reads it. */
+export interface StoreOnlyApp { id: string; store: 'apple' | 'play'; appId: string; account: string | null; name: string; bundleId: string | null; added: string }
+export interface Registry { version: 1; projects: RegistryProject[]; storeApps?: StoreOnlyApp[] }
 
 export const registryFile = (env: Record<string, string | undefined> = process.env): string => env.STOREBOUND_REGISTRY || join(homedir(), '.storebound', 'projects.json');
 
@@ -20,6 +28,26 @@ export const folderId = (absPath: string): string => createHash('sha256').update
 
 const ID = /^[0-9a-f]{16}$/;
 
+/** The id of a store-only entry: stable per store and app id. */
+export const storeAppId = (store: 'apple' | 'play', appId: string): string => createHash('sha256').update(`store:${store}:${appId}`).digest('hex').slice(0, 16);
+export const APPLE_APP_ID = /^\d{6,12}$/;
+export const PACKAGE_NAME = /^[A-Za-z][A-Za-z0-9_]*(\.[A-Za-z][A-Za-z0-9_]*)+$/;
+
+/** Store-only entries of the file's JSON; malformed ones are dropped. Pure. */
+function parseStoreApps(list: unknown): StoreOnlyApp[] {
+  const out: StoreOnlyApp[] = [];
+  if (Array.isArray(list)) for (const x of list) {
+    const o = x as Partial<StoreOnlyApp>;
+    if (o?.store !== 'apple' && o?.store !== 'play') continue;
+    const appId = typeof o.appId === 'string' ? o.appId.trim() : '';
+    if (!(o.store === 'apple' ? APPLE_APP_ID : PACKAGE_NAME).test(appId) || out.some(a => a.store === o.store && a.appId === appId)) continue;
+    out.push({ id: storeAppId(o.store, appId), store: o.store, appId, account: typeof o.account === 'string' && o.account ? o.account : null,
+      name: typeof o.name === 'string' && o.name.trim() ? o.name : appId, bundleId: typeof o.bundleId === 'string' && o.bundleId ? o.bundleId : o.store === 'play' ? appId : null,
+      added: typeof o.added === 'string' ? o.added : '' });
+  }
+  return out;
+}
+
 /** Parses the file's text; drops entries that are not well formed (an id, an absolute path). Pure. */
 export function parseRegistry(text: string): Registry {
   let raw: unknown;
@@ -33,7 +61,8 @@ export function parseRegistry(text: string): Registry {
     out.push({ id: typeof o.id === 'string' && ID.test(o.id) && !out.some(x => x.id === o.id) ? o.id : folderId(o.path), path: o.path,
       name: typeof o.name === 'string' && o.name.trim() ? o.name : basename(o.path), added: typeof o.added === 'string' ? o.added : '' });
   }
-  return { version: 1, projects: out };
+  const storeApps = parseStoreApps((raw as { storeApps?: unknown })?.storeApps);
+  return storeApps.length ? { version: 1, projects: out, storeApps } : { version: 1, projects: out };
 }
 
 export function readRegistry(file = registryFile()): Registry {
@@ -48,7 +77,7 @@ export function writeRegistry(r: Registry, file = registryFile()): void {
     try { JSON.parse(readFileSync(file, 'utf8')); } catch { copyFileSync(file, `${file}.unreadable`); }
   }
   const tmp = `${file}.tmp-${process.pid}`;
-  writeFileSync(tmp, JSON.stringify({ version: 1, projects: r.projects }, null, 2) + '\n');
+  writeFileSync(tmp, JSON.stringify({ version: 1, projects: r.projects, ...(r.storeApps?.length ? { storeApps: r.storeApps } : {}) }, null, 2) + '\n');
   renameSync(tmp, file);
 }
 
@@ -58,14 +87,48 @@ export function withFolder(r: Registry, path: string, name: string | undefined,
   const have = r.projects.find(p => p.path === abs);
   if (have) return { registry: r, project: have, added: false };
   const project = { id: folderId(abs), path: abs, name: name?.trim() || basename(abs), added: now };
-  return { registry: { version: 1, projects: [...r.projects, project] }, project, added: true };
+  return { registry: { ...r, version: 1, projects: [...r.projects, project] }, project, added: true };
+}
+
+/** Adds a store-only app (the same store + app id again updates its account, name and bundle id). Pure. */
+export function withStoreApp(r: Registry, a: { store: 'apple' | 'play'; appId: string; account?: string | null; name?: string; bundleId?: string | null }, now: string): { registry: Registry; app: StoreOnlyApp; added: boolean } {
+  const appId = a.appId.trim();
+  if (!(a.store === 'apple' ? APPLE_APP_ID : PACKAGE_NAME).test(appId)) throw new Error(a.store === 'apple' ? `--app-id ${appId}: the numeric Apple ID of the app (App Store Connect > App Information)` : `--app-id ${appId}: the Play package name (com.example.app)`);
+  const list = r.storeApps ?? [];
+  const have = list.find(x => x.store === a.store && x.appId === appId);
+  const app: StoreOnlyApp = { id: storeAppId(a.store, appId), store: a.store, appId, account: a.account ?? have?.account ?? null, name: a.name?.trim() || have?.name || appId,
+    bundleId: a.bundleId ?? have?.bundleId ?? (a.store === 'play' ? appId : null), added: have?.added ?? now };
+  if (have && JSON.stringify(have) === JSON.stringify(app)) return { registry: r, app: have, added: false };
+  return { registry: { ...r, version: 1, storeApps: [...list.filter(x => x !== have), app] }, app, added: !have };
+}
+
+/** Removes a store-only app by id or "<store>:<app id>". Pure. */
+export function withoutStoreApp(r: Registry, key: string): { registry: Registry; removed: StoreOnlyApp | null } {
+  const removed = (r.storeApps ?? []).find(x => x.id === key || `${x.store}:${x.appId}` === key) ?? null;
+  if (!removed) return { registry: r, removed };
+  const rest = (r.storeApps ?? []).filter(x => x !== removed);
+  const { storeApps: _, ...base } = r;
+  return { registry: rest.length ? { ...base, storeApps: rest } : base, removed };
+}
+
+export function addStoreApp(a: Parameters<typeof withStoreApp>[1], file = registryFile()): { app: StoreOnlyApp; added: boolean; changed: boolean } {
+  const cur = readRegistry(file);
+  const { registry, app, added } = withStoreApp(cur, a, new Date().toISOString());
+  if (registry !== cur) writeRegistry(registry, file);
+  return { app, added, changed: registry !== cur };
+}
+
+export function removeStoreApp(key: string, file = registryFile()): StoreOnlyApp | null {
+  const { registry, removed } = withoutStoreApp(readRegistry(file), key);
+  if (removed) writeRegistry(registry, file);
+  return removed;
 }
 
 /** Removes a folder by path or id. Pure. */
 export function withoutFolder(r: Registry, pathOrId: string): { registry: Registry; removed: RegistryProject | null } {
   const abs = ID.test(pathOrId) ? '' : resolve(pathOrId);
   const removed = r.projects.find(p => p.id === pathOrId || p.path === abs) ?? null;
-  return { registry: removed ? { version: 1, projects: r.projects.filter(p => p !== removed) } : r, removed };
+  return { registry: removed ? { ...r, version: 1, projects: r.projects.filter(p => p !== removed) } : r, removed };
 }
 
 /** Reads, adds and writes (only when it changed). */