Commit graph

262 commits

Author SHA1 Message Date
CRT
a5295db539 browser tests: deterministic under load
The afterAll hook of tests/console-fill.test.ts timed out (30 s) in 2 of 3
runs with 10 CPU hogs. Cause: Google Chrome (the fallback when playwright's
Chromium is not downloaded) hangs in its own shutdown after loading http
pages until its 10 s teardown watchdog fires; under load that passed 30 s.

- tests/helpers/browser.ts: one shared launch per file as a browser server
  with a 60 s launch timeout, killed at the end (throwaway profile, nothing
  to flush); a launch timeout fails instead of silently skipping; contexts
  and engine runs tracked per test and closed in afterEach (capped);
  event-driven waits for engine log lines
- console-fill: explicit test timeouts, slow tests marked, waits expected
  to succeed get a long cap (they return at once), sign-in / watching
  navTimeoutMs 1.5 s -> 5 s, persistent-profile Chromium closed in finally,
  temp account dirs removed
- site-overflow, console-session: same plumbing (site-overflow's afterAll
  had bun's 5 s default)
- console session: launchTimeoutMs option (tests only)
2026-10-12 04:54:07 +08:00
CRT
3fb3f2108a Merge remote-tracking branch 'origin/main' into aso-plus
# Conflicts:
#	CHANGELOG.md
2026-10-12 04:24:52 +08:00
CRT
96d1e6b62d Merge remote-tracking branch 'origin/main' into idem-listing 2026-10-12 04:24:49 +08:00
CRT
a2009fa7ac idempotency: apple listing findOrCreate / createOnce, play listing re-plan in the edit, data-safety hash, twice-run tests for the last open rows 2026-10-12 04:24:45 +08:00
CRT
e38f68fa33 Merge origin/main into local-fonts 2026-10-12 04:15:26 +08:00
CRT
354daba672 shots fonts: local font files (title / body / fallback) with cmap coverage, served in place, hash in fonts.json, license note 2026-10-12 04:15:19 +08:00
CRT
17f4413afa Merge remote-tracking branch 'origin/main' into aso-plus
# Conflicts:
#	CHANGELOG.md
#	docs/pitfalls.md
#	skills/store-pitfalls/SKILL.md
2026-10-12 04:13:48 +08:00
CRT
d68028caba Merge remote-tracking branch 'origin/main' into play-app-record
# Conflicts:
#	CHANGELOG.md
#	docs/pitfalls.md
#	skills/store-pitfalls/SKILL.md
2026-10-12 04:13:35 +08:00
CRT
124e3097ec listing check: App Store keywords shown and limited in UTF-8 bytes (96/100 B), other fields in characters 2026-10-12 04:10:28 +08:00
CRT
b65843828b Merge remote-tracking branch 'origin/main' into aso-plus
# Conflicts:
#	CHANGELOG.md
2026-10-12 04:09:46 +08:00
CRT
7e26941ffc aso: competitors, suggest and audit from official data; ASO card on the Growth tab
- aso competitors: top apps per keyword from the iTunes Search API (name, developer,
  rating count, release / update dates, localized genre), coverage gaps (words of 2+
  developers), new entrants vs the last snapshot (.storebound/aso/competitors/)
- aso suggest: candidates from own text, competitor names, localized category names and
  Apple Ads keyword suggestions (POST /v1/suggestions/keywords/query, relative 0-100
  popularity, only with credentials); 100-byte keyword field per locale as a diff,
  --write marks it a draft that check --aso and aso audit report
- aso audit: check --aso, free keyword room, rank trend arrows, gaps, Play short
  description / density, App Store conversion, PPO / Play experiment ideas, next 3 actions
- MCP: read-only aso_competitors, aso_suggest, aso_audit; desktop ASO card (visx rank chart)
- docs: README, aso-basics, store-pitfalls (Search API order, no Play search API), CHANGELOG;
  demo-app listing files; tests on recorded Search API and mocked Ads answers
2026-10-12 04:09:34 +08:00
CRT
4533e3e1c4 app privacy: one Apple purpose per Play purpose (advertising is Third-Party Advertising only; Developer's Advertising only from the owner), appPrivacy.types (owner answers per Apple type id: certain in console fill, proposed by scan without linked / tracking, compared by check with Info.plist and PrivacyInfo.xcprivacy) 2026-10-12 04:07:15 +08:00
CRT
d5bc7b8889 idempotency: docs table, pitfall 9, changelog; lock scan fix 2026-10-12 04:03:23 +08:00
CRT
8f41ed4c02 Merge origin/main into idempotency 2026-10-12 04:01:25 +08:00
CRT
00cf2ed341 idempotency: WIP 2026-10-12 04:00:58 +08:00
CRT
704231457f Merge remote-tracking branch 'origin/main' into play-app-record
# Conflicts:
#	CHANGELOG.md
2026-10-12 03:58:50 +08:00
CRT
1150d4e4e6 Merge origin/main into shots-speed
# Conflicts:
#	CHANGELOG.md
2026-10-12 03:49:58 +08:00
CRT
5cb5dc2c32 shots capture / render: --concurrency, per-frame timing, per-language page reuse, input-hash cache
Web capture runs frames in parallel browser contexts (default from the CPU count, lower for GPU-heavy capture),
logs n/total + ETA and goto / waitFor / eval / delay / screenshot per frame, writes .storebound/capture-report.json
with the slowest frames and steps. shots.capture.session 'per-language' boots the app once per language and device
and switches shots via pushState / popstate (navigate 'spa') or goto (navigate 'reload'), falling back to a fresh
page when a precondition fails. .storebound/capture-cache.json skips frames with unchanged inputs; --only-missing,
--force. shots render renders with --concurrency pages and async ffmpeg.
2026-10-12 03:49:53 +08:00
CRT
75d6f4cb71 console fill play-app-record: Play Console's Create app form (account picked by developerId / workspace / play.developerAccount, else stop and list; Create app opener allowlisted only on the app list, never in the form, EN + TR; name, default language, app or game, free or paid as an owner check; declarations never ticked; package name set by the first AAB upload) 2026-10-12 03:48:20 +08:00
CRT
d466d4a3c2 Merge remote-tracking branch 'origin/main' into apple-name
# Conflicts:
#	CHANGELOG.md
2026-10-12 03:40:51 +08:00
CRT
e1e0b689d2 api tables: regenerate for apple iap-review's new reads 2026-10-12 03:33:16 +08:00
CRT
866aa4a041 Merge remote-tracking branch 'origin/main' into pitfalls
# Conflicts:
#	cli/apple/iap-review.ts
2026-10-12 03:30:34 +08:00
CRT
dc3ff364a4 api: refresh coverage tables (iap-review reads more operations) 2026-10-12 03:30:15 +08:00
CRT
6f561393f4 api tables regenerated after the merge 2026-10-12 03:30:08 +08:00
CRT
59e60960b0 pitfalls: store-pitfalls skill and docs/pitfalls.md, store list lag warnings (apple iap-review exits 1), dryPlan table and a scan for count-only dry runs 2026-10-12 03:29:53 +08:00
CRT
6c4f8a4551 Merge remote-tracking branch 'origin/main' into apple-name
# Conflicts:
#	CHANGELOG.md
2026-10-12 03:29:53 +08:00
CRT
b88648499e apple listing, play listing, apple appinfo: the dry run prints a real plan (version decision, old -> new per field, draft locales skipped); the real run asks and applies exactly it 2026-10-12 03:29:38 +08:00
CRT
221f08aaf6 apple iap-review: size check before upload, delivery state read back after (FAILED shown with Apple's reason), dry run names why it would upload, MISSING_METADATA explained per part; check flags non-screenshot sizes offline 2026-10-12 03:24:41 +08:00
CRT
5afe4613c4 apple.name: the App Store name when the plain name is taken; console fill, apple listing, pull, check (30-char error, same-name hint), scan use it 2026-10-12 03:23:43 +08:00
CRT
296aa6a6ae Merge origin/main into shots-glyphs 2026-10-12 03:13:05 +08:00
CRT
8bfa49807d Merge origin/main into shots-glyphs
# Conflicts:
#	CHANGELOG.md
2026-10-12 03:05:32 +08:00
CRT
d942275920 shots: glyph coverage check per language, automatic Noto fallbacks, check errors on fallback / system-font glyphs
Lilita One lacks most of Latin Extended-A (Turkish s-cedilla, g-breve, dotted I ...), so Turkish titles were drawn
with a silent browser fallback while shots check passed. shots fonts now reads the cmap of every face (pure TS,
TTF/OTF/WOFF/WOFF2), adds a Noto fallback per missing character or fails with language + characters; render
measures which face drew each character (CDP probes) and records it in report.json; check errors on fallbacks the
config did not choose (shots.fonts.fallback) and on system-font glyphs. Default game title font: Paytone One.
2026-10-12 03:05:23 +08:00
CRT
8186b25575 console fill: User Access radios found under a plain heading (real App Store Connect), a lasting partial miss fills every field found and leaves only the missing ones to the owner 2026-10-12 03:05:11 +08:00
CRT
21c0c2ed60 console fill: sign-in detected by URL, frame and text; keeps watching after the fallback; session kept across relaunches; one login across Play developer accounts and App Store Connect teams 2026-10-12 02:54:48 +08:00
CRT
e5f610a033 Merge origin/main into console-nav 2026-10-12 02:21:37 +08:00
CRT
ce69fbd600 console fill: opens the form itself and reuses the owner's Chrome sign-in
Navigation after sign-in (navPlan + navigate): App Store Connect Apps > + > New App
(EN/TR), App Privacy by /apps/<appId>/distribution/privacy or the app list, Play app
list by package name > Policy and programs > App content > Start / Manage. Every
navigation click goes through navClick: the click gate stays absolute, only a link
named exactly Start / Manage / Başla / Yönet passes. Each step is logged; a step not
found in time or two matching apps -> the printed steps and wait (no crash).
The TR gate now refuses "uygula" (apply) but not "uygulama" (app).

Browser (cli/console/session.ts): attach to a Chrome with remote debugging (--cdp or
DevToolsActivePort), else on macOS a temporary profile with only Local State and the
profile's Cookies filtered to the console hosts, opened in real Chrome and deleted at
the end, else storebound's own profile (--fresh-profile). Cookies are never printed.
Desktop: fresh_profile option, the dialog says it uses the Chrome sign-in.
Tests: navigation fixtures (ASC EN/TR, Play list, App content, missing step,
duplicates, deny-listed decoys), session file selection, host filter, cleanup, and a
real-Chrome copy-mode test on a throwaway profile and a local site.
2026-10-12 02:21:35 +08:00
CRT
bee5627ec0 aso: App Store keyword fill hint and limit both count UTF-8 bytes (non-Latin locales were warned to add characters that would break the 100-byte limit) 2026-10-12 02:14:27 +08:00
CRT
e92fda612c scan.ignore: optional match on the finding title, to accept one check of a rule with several (e.g. the ALL CAPS title in play-metadata) 2026-10-12 02:08:11 +08:00
CRT
582ea909ca scan: accounts mean User ID, never email without evidence; accounts.signUp (username -> PSL_ACM_USER_ID_OTHER_AUTH); built bundles are low-trust evidence; privacy-manifest and scan find plugins in monorepo node_modules, workspaces and local SwiftPM packages 2026-10-12 02:03:07 +08:00
CRT
20f8d6a311 Merge origin/main into close-gaps 2026-10-12 01:26:37 +08:00
CRT
8a23bf7eec live read run fixes: Xcode-managed profiles in signing, TestFlight-only release trains, scan skips agent worktrees and takes an absolute --config, --all-pages paging meta, iap-submit json, report hints 2026-10-12 01:24:56 +08:00
CRT
236977940e flows, listing translate, scan 2.2 + --originality, prices export with subscriptions, site sections
- storebound flow list|validate|run: repo-local workflows (store/workflows/*.yml, storebound.workflows.*), writes dry unless --apply, owner steps never run, --from / --resume; init templates for app and game; MCP flow_list + dry flow_run; release-flows skill
- storebound listing translate|check|reviewed: per-language listing drafts with store limits and keyword rules, agent or --translate hook, marked until reviewed; MCP listing_translate / listing_check; listing-localization skill
- scan: Apple 2.2 beta/demo/test wording rule; scan --originality [--against]
- prices export includes subscriptions; prices import skips their rows
- site: rejection scan section, Desktop app section with fixture-mode screenshots, Everything else grid, FAQ 4.3 answer
- README, CHANGELOG, adapters, API tables
2026-10-12 01:24:21 +08:00
CRT
4a894a1937 growth extras: MCP safe tools, README and CHANGELOG, socialMedia age rating defaults, regenerated adapters and API coverage 2026-10-12 00:19:32 +08:00
CRT
2d2fd9040d Merge remote-tracking branch 'origin/main' into growth-extras
# Conflicts:
#	cli/index.ts
#	cli/lib/config.ts
#	cli/lib/credentials.ts
#	docs/desktop.md
#	templates/credentials.example.json
#	tools/site-icons.ts
2026-10-12 00:14:36 +08:00
CRT
cea2dffdc3 growth extras: prices ppp, ads apple, web, apple adhoc, play share, revenuecat, console fill (+ desktop button) 2026-10-12 00:14:00 +08:00
CRT
97ab678691 Merge scan-play: Google Play scan rule parity
Conflict in cli/lib/config.ts (play section): kept play.build from main and the new targetAges, accountType, accountCreated and billingPrograms. Adapters and API tables regenerated (unchanged).
2026-10-12 00:09:22 +08:00
CRT
d972c36fa8 Merge store-ops: TestFlight wait / expire, IAP review submissions, pulls, offers, CPP, events, reports, triage, ASO rank, ads scan
Conflicts resolved for both sides:
- cli/lib/plist.ts, cli/lib/zip.ts: one implementation each. plist reads XML (text or
  bytes, attributes tolerated) and binary plists; ads scan now reads bytes, so a binary
  Info.plist works too. zip gains unzip() for the Play report exports on top of
  zipEntries / zipRead.
- apple upload waits with testflight wait's loop (waitForBuild) instead of its own copy;
  BUILD_DONE removed.
- config, credentials (profiles, keystore, ASC_VENDOR_NUMBER, now also a profile key),
  command table, MCP tools, credentials template, README, CHANGELOG: union.
- MCP: --write stays forbidden; the three pull tools are the listed local-file exception
  (LOCAL_WRITE_TOOLS), so scan --write remains unreachable.
- Adapters and API coverage tables regenerated.
2026-10-12 00:07:26 +08:00
CRT
84ef94253c storebound scan: Google Play parity
Play rules verified against the live Policy Center / Play Console Help pages
(checked 2026-10-11, cited in cli/lib/scan/play-rules.ts): restricted
permissions and their declarations (background location, photo / video, All
files access, AccessibilityService, REQUEST_INSTALL_PACKAGES, Health Connect,
full-screen intent, VpnService), prominent disclosure and the in-app privacy
policy, Data safety vs SDK disclosures, Families (certified ad SDKs, AD_ID,
location), AD_ID on targetSdk 33+, 16 KB page sizes (Unity, React Native, NDK,
AGP, prebuilt .so), testing for new personal accounts, Play metadata, ads at
launch, payments outside Play Billing, impersonation. Detection reads manifest
components, accessibility configs, strings.xml, native toolchain versions and a
local build's merged manifest. New fixtures and tests; README table per store.
2026-10-12 00:05:35 +08:00
CRT
b63f2fdfbc Store operations: TestFlight wait / expire, IAP review submissions, listing pulls, release notes per language, offers, custom product pages, in-app events, reports, triage, keyword ranks, AdAttributionKit scan
- apple testflight wait --build N (progress, timeout, exit 0/1/7) and expire --keep N | --older-than D (dry run, asks)
- apple iap-submit: IAP / subscription / group versions into a review submission; first of a type only with the app
  version (--with-version), --no-submit keeps the draft; read-only MCP plan
- apple listing pull, play listing pull (diff, --write), catalog pull (config proposal, never rewritten)
- whats-new --languages / check / apply: one file per language, agent or hook translation, per-store limits
- apple offer-codes, win-back, promoted, preorder; Play pre-registration as a guide (no API)
- apple cpp and apple events: list, create, upload, submit (asks)
- reports: Apple sales / finance, Play earnings / sales into .storebound/reports with summary and CSV
- triage: TestFlight crash / feedback and Play error reports grouped by signature, device, OS
- aso rank: iTunes Search API ranks and competitors, rate limited
- ads scan: AdAttributionKit / SKAdNetwork Info.plist and source checks
- tests against recorded, sanitized answers; skills, README, CHANGELOG
2026-10-11 23:58:17 +08:00
CRT
2a91a791be api: refresh the coverage tables after the build and signing commands 2026-10-11 23:48:30 +08:00