CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions
402 commits 28 branches 80 tags 76 MiB
Commit graph

16 commits

Author SHA1 Message Date
CRT
47dfd372fe apple: macOS (tvOS, visionOS) versions are no longer invisible: every version and review submission lookup is per platform; status, listing, listing pull, resubmit, submit, release and screenshots take --platform and otherwise pick the platform that has the version they need (refuse naming both when several do); status, validate, release status, the report and the desktop label versions with their platform; MCP and owner actions get platform; pitfall 77 2026-10-20 03:00:05 +07:00
CRT
e5369090fa apple creative-assets: App Store Header and Search Results (PRODUCT_PAGE_HEADER_ASSET, APP_STORE_SEARCH_RESULTS_ASSET) through the App Asset Library: local size / alpha / video checks, upload once by MD5, select only approved assets, replace on a changed file; check / validate note, MCP tool, gallery and desktop Art row, docs, pitfall 75 2026-10-18 13:10:20 +07:00
CRT
3381673ae6 iPhone Duo screenshots (render, check, upload skip with console link while the API has no display type) and the medium display class as the required iPhone set, labels as in the console 2026-10-18 13:07:15 +07:00
CRT
b830a99a5f First in-app purchases left out of a review are caught (pitfall 70): firstProductGaps in validate / release plan (blocker) and the apple submit plan (refuses to leave a never-approved first product out); apple status (WARN + firstProductGaps in --json), release status and the desktop checks warn while a version waits for or is in review without it; iap-review says 'ready, not submitted yet' instead of 'complete' 2026-10-15 19:31:26 +08:00
CRT
992f5bcc0e desktop: a Fix button on scan and validate findings storebound can fix itself. Findings carry action { method, args } (cli/lib/fix-actions.ts); privacy-labels runs scan.write (scan --write-only, the dialog shows the config diff), Play listing gaps play.listing, a missing App Store localization or copyright apple.listing (editable version only), the App Review contact apple.review_details; each a dry run, the native dialog, then the confirmed run. --write-only is forbidden for MCP tools; tests pin the mapping, the round trip on a fixture and that no fix reaches a submit, release or publish 2026-10-15 06:14:49 +08:00
CRT
daae3715bf apple signing ensure with automatic signing only adds capabilities (no profiles or certificates; the dry run says so) and lists unused storebound profiles with the exact delete command, never run; every capability write is read back (lag retries, timeout) and fails with the API answers when one did not stick; apple status, signing status and validate compare the App ID, apple.signing.capabilities and the iOS project's entitlements (CODE_SIGN_ENTITLEMENTS too) and name what is missing where; api writes outside a terminal say TTY by design and name the dedicated command; pitfalls 64-66; tests 2026-10-14 19:10:01 +08:00
CRT
e9507d8884 check blocks an apple app without app.copyright (App Store Connect requires it; never filled in automatically); validate reads the live version's copyright and says whether the store has one; round-trip test that the config writers (upsertBlock, upsertNestedString, removeKeyPath) keep unknown keys and comments; tests 2026-10-14 14:37:47 +08:00
CRT
7219ded3e8 template compliance answers never reach a store: init writes unanswered (dataSafety, appPrivacy, reviewNotes, ageRating, accounts, reviewAccess), older configs are recognised by the template values; check / validate / scan block, play data-safety (also --dry), console plan / fill, apple review-details and appinfo refuse. onboard --declarations replaces them on a live app: name and copyright from the stores (a copyright with a private term is left out), the rows the code proves (scan proposal, sign-up methods from auth code and login SDKs), the rest as one owner question list. play data-safety --dry prints the answers that change (old -> new, account and deletion first) against the last uploaded CSV; pitfall 60; tests 2026-10-14 11:36:30 +08:00
CRT
b7bfe89151 Play console steps without an API as agent plans: play-store-settings (App category; play listing cannot set it), play-app-content (every card in order, one owner batch) and its cards (privacy policy, ads, sign in details, advertising ID, government, financial, health), play-production-countries and play-production-release; IARC plan with the Terms of Use agreement, follow-ups (console.contentRating.details, products[].randomRewards, social) and the Summary's final Save; config play.category / countries / managedPublishing, console.appContent; check, validate, play status and play release reminders; inPageLoop helper and material checkbox clicks; App Privacy published signal; first IAPs via apple iap-submit --with-version. Pitfalls 27, 28 2026-10-12 10:16:34 +08:00
CRT
a9261a8052 play images: tablet, TV and Wear sets are optional; play.tablets switch (default: tablet renders exist); a missing optional set never deletes Play's images without --prune 
A phone-only project aborted with 'no sevenInchScreenshots'. Play requires the 512 icon, the 1024x500 feature graphic and at least 2 screenshots (Play Console Help answer 9866151). play images uploads what exists and prints an info line for missing optional sets; play.tablets true makes missing tablet sets an error in shots render/check/gallery, validate and play images. Pitfall 19.
 2026-10-12 08:21:03 +08:00
CRT
ae58948abd storebound scan: offline rejection-risk scan of the project itself 
Detects the stack (native iOS / Android, React Native, Expo, Capacitor, Cordova,
Flutter, Unity, Godot) and the SDKs from a maintained table with versions,
file:line and each vendor's disclosure page, then reports App Store and Google
Play rejection risks with guideline, evidence, fix, severity and skill: 2.1(a)
demo account and placeholder text, 5.1.1(v) account deletion, 4.8 login
services, 3.1.1 restore and outside payments, 3.1.2 subscription info, 5.1.2(i)
ATT, purpose strings, privacy link, privacy manifest, 2.3.10, 2.3.7, 2.3.8, 4.2
web wrappers, 2.5.1, 2.5.5, ATS, export compliance, 1.3 kids ads, review
prompts, privacy labels vs SDKs; Play target SDK 36, delete-account URL, App
access, foreground services, exact alarms, QUERY_ALL_PACKAGES, SMS / call log,
com.example package name.

Proposes Data safety / App Privacy / ATT / privacy manifest answers (detected
file:line or ask owner) as a diff against the config; --write adds only the
detected ones. scan.ignore records owner-accepted findings. MCP tool scan
(read-only), validate includes open findings, desktop Checks tab shows them.
Fixtures for iOS, Android, Capacitor, Unity, Flutter, clean and teaser.
 2026-10-11 23:20:55 +08:00
CRT
d74d99bcc9 serve --stdio: desktop JSON-RPC profile on the MCP core, confirm tokens, --json results, sidecar builds 
- cli/serve.ts: session.hello with a per-session secret, typed methods per tool, project.inspect,
  portfolio.status over many project folders, progress notifications, cancellation
- cli/lib/confirm-token.ts: single-use HMAC tokens bound to method + canonical params + expiry;
  writes are dry runs without one; no submit / release / publish method exists
- cli/lib/runner.ts: shared child runner for mcp and serve, works from a compiled binary
- --json on check, testflight / ppo status, next-build, next-version-code, analytics compare,
  prices import; inspect command; confirm() always answers no under serve
- tools/build-sidecars.ts: bun build --compile for five targets, ad-hoc re-sign on macOS, path leak check
- tests/serve.test.ts: methods, token binding / expiry / replay, shared vector, stdio and compiled smoke
 2026-10-11 01:57:33 +08:00
CRT
20c0221b1d Review access and account deletion: demo account from .storebound (masked) to App Review, accounts config, profile checks in check and validate, Data safety extra rows 2026-10-11 01:47:08 +08:00
CRT
56e107dbbe Crash and vitals health: storebound health [--weekly], validate findings, store-health skill 
Play Developer Reporting API v1beta1 (crashRateMetricSet / anrRateMetricSet DAILY queries in America/Los_Angeles,
user-perceived 28-day rates, worst device models, errorIssues:search) and App Store Connect perfPowerMetrics,
diagnostic signatures and TestFlight crash submissions. Thresholds 1.09 % crash / 0.47 % ANR / 8 % per device
(developer.android.com/topic/performance/vitals): over = blocker, from 80 % = warn, in validate too (--no-health).
Weekly Markdown report with week-over-week change in .storebound/health/. MCP: health (read-only), health_report.
 2026-10-10 23:28:10 +08:00
CRT
aecdcb1c50 Store image checks in shots check and validate 
- Apple sizes accepted portrait or landscape; Play screenshots any accepted size (320-3840 px, at most 2:1);
  Play rejects 16-bit PNGs; feature graphic exactly 1024 x 500
- Required sets per language (Apple only with an App Store locale, Play only with a Play code)
- shots check scans A/B variant folders only with --variants
- validate adds the local renders checks: store errors are blockers, overflow flags warnings (--no-local skips)
 2026-10-10 21:54:47 +08:00
CRT
1fc94da443 CLI: store readiness, release management, export compliance, ASO audit, release notes, privacy manifest scan 
- validate: read-only App Store Connect + Play report with ordered blockers (exit 1)
- apple release --phased on|pause|resume|complete and --manual-release (asks first)
- apple status --wait-review (exit 0 approved, 1 rejected, 7 timeout), apple next-build, apple encryption
- play rollout --fraction|--halt|--resume|--complete, play next-version-code
- check --aso, whats-new --since <tag>, privacy-manifest --ios <path>, version
- Apple IAP description limit is 45 characters (App Store Connect Help), not 55
- config: apple.usesNonExemptEncryption, apple.screenshotTypes, ads.appAdsTxt
 2026-10-10 21:02:55 +08:00