CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions
267 commits 28 branches 80 tags 76 MiB
Commit graph

94 commits

Author SHA1 Message Date
CRT
7e09947e62 console verify App Privacy: real page text (category-only summary sections, ' | ' joined lines, Apple's commas); tracking label without 'data data'; Play Data safety page path confirmed 2026-10-13 01:38:50 +08:00
CRT
2b101f0fd8 desktop: Releases > Send for review (App Store submission state, builds by number, Submit / Resubmit / in-app purchases; Play versionCodes by number, Send to production, managed publishing, console plans for countries and Send changes for review), plan panel before every owner dialog with streamed progress; App info console steps for every console plan form with verify; Catalog price-change owner actions and the declined state; Data safety deletion answer; TestFlight create missing groups; Android SDK in Dependencies; upload progress in job toasts; boot check send-for-review cases on D1 and D3 state 2026-10-12 12:08:43 +08:00
CRT
2e7dd44ae6 play build versionCode source check: follow a variable (def / ext. / val) to its definition; a variable read from the property is not flagged 2026-10-12 11:34:41 +08:00
CRT
0b1451800c apple iap-submit: DEVELOPER_REJECTED IAP / subscription / group versions (left by a canceled submission) are submitted as they are, plan says 'add (developer rejected, re-submitted as is)', --new-version only for APPROVED / REJECTED, empty draft reused; fake ASC models cancel and re-add. play build / check: warn before Gradle when defaultConfig does not read -PversionCode / -PversionName, with the exact Groovy / Kotlin line (built with AGP 8.13); android.injected.version.code does not override bundleRelease; post-build versionCode mismatch is a hard stop. play-production-release plan: 'Do you want to restart your review?' dialog, Restart review is never-press. Pitfalls 31-33 2026-10-12 11:32:05 +08:00
CRT
41d2ffcc24 apple testflight groups: bare lists the groups and what the config would create (read-only); groups sync (or --yes) creates; flows: bare = read, sync = write; MCP tool runs groups sync 2026-10-12 10:48:59 +08:00
CRT
1724296e59 apple resubmit: REJECTED review submission items are marked resolved before the submit (PATCH reviewSubmissionItems resolved: true; the version item by default, IAP / subscription items with --resolve-iaps), plan table 'mark resolved' rows; on 409 'not ready yet' the items are re-read and a REJECTED item out of scope stops the run at once naming it and how to resolve it, backoff only when none is left; an empty READY_FOR_REVIEW draft is never canceled (409 'not in cancellable state'): left as is, no cancel command, apple status labels it harmless and treats the cancel 409 as such; fake ASC blocks submit on REJECTED items and refuses to cancel empty drafts. Pitfall 30 2026-10-12 10:45:05 +08:00
CRT
0da5ee9d01 apple resubmit after a rejection: iap-submit reuses the open review submission (UNRESOLVED_ISSUES gets only missing items and is resubmitted, a draft is reused, one waiting for or in review means nothing is sent), never a second draft; 409 ITEM_PART_OF_ANOTHER_SUBMISSION names the other submission instead of the list-lag message, a draft the run created is canceled and the named one used; submit retried with backoff and heartbeat while Apple says not ready yet; new apple resubmit --build <n> (build by number, plan table, --yes); apple status lists UNRESOLVED_ISSUES items and the resubmit command. Pitfall 30 2026-10-12 10:34:12 +08:00
CRT
c8213be2b6 ITMS-91064: NSPrivacyTracking and NSPrivacyTrackingDomains must agree in every privacy manifest (true needs domains, domains need true); check, scan and privacy-manifest fail on either mismatch with the exact ITMS text; App Privacy tracking no longer demands the app manifest's true: SDK manifests that declare tracking (Pods, frameworks, SwiftPM, Carthage, plugins, the built IPA) are info, known tracking SDKs info, else a warning; privacy-manifest --propose writes true only with appPrivacy.trackingDomains; apple upload checks every manifest in the IPA (XML or binary) before any network call, apple build after the export. Pitfall 29 2026-10-12 10:27:21 +08:00
CRT
b7bfe89151 Play console steps without an API as agent plans: play-store-settings (App category; play listing cannot set it), play-app-content (every card in order, one owner batch) and its cards (privacy policy, ads, sign in details, advertising ID, government, financial, health), play-production-countries and play-production-release; IARC plan with the Terms of Use agreement, follow-ups (console.contentRating.details, products[].randomRewards, social) and the Summary's final Save; config play.category / countries / managedPublishing, console.appContent; check, validate, play status and play release reminders; inPageLoop helper and material checkbox clicks; App Privacy published signal; first IAPs via apple iap-submit --with-version. Pitfalls 27, 28 2026-10-12 10:16:34 +08:00
CRT
dbd9f2973c play data-safety: PSL_SUPPORT_DATA_DELETION_BY_USER is the general 'can users request deletion?' question; a delete-account URL answers yes (with PSL_DATA_DELETION_URL), dataSafety.dataDeletion for apps without one; check flags a no next to a delete-account URL 2026-10-12 09:46:58 +08:00
CRT
e01a27d7b7 price changes of existing products need --allow-price-changes (play products, play/apple subscriptions, prices import): --yes and flow run --apply --yes confirm creates, first prices and other updates only; without the flag the run writes the rest, names each held change and exits 3 (declined), dry runs mark them owner, flows refuse the flag; lib/price-gate.ts, tests/price-gate.test.ts. CLI wording: console fill leaves what it cannot open or fill to the calling agent's browser tool (console plan / verify) instead of 'yourself'; other 'by hand' output points at the config; do-it-dont-ask test scans cli/ output 2026-10-12 09:38:57 +08:00
CRT
b5b8f2da9d play data-safety: PSL_SUPPORT_DATA_DELETION_BY_USER as Play's single choice (partialDeletion true | false | 'auto90'), drop the removed PSL_DATA_COLLECTION_USER_REQUEST_DELETE (deletionRequest deprecated, check notes it); ship Google's empty form (cli/data/play-data-safety-form.csv, exported 2026-10-12), take every Answer requirement from it and report pairs not in it (formPairIssues) in check, declarations and play data-safety. Pitfall 21 2026-10-12 09:34:12 +08:00
CRT
dfc28c15f8 agent rules: first rule "Do it, don't ask" (agents-core and every adapter, README, store-pitfalls lead, first-release, declarations and console skills); the agent runs the real command after the dry run, the owner presses only final public or irreversible buttons and answers compliance facts in one batch; handoff text removed from skills; tests/do-it-dont-ask.test.ts. Pitfall 26 2026-10-12 09:28:45 +08:00
CRT
fc524cd2d4 play build: find the Android SDK like Android Studio (ANDROID_HOME, ANDROID_SDK_ROOT, sdk.dir, default folder), pass it in the env, stop before Gradle when missing; doctor shows it. apple upload: size, per-part lines, 20 s heartbeat (api, altool, processing wait), per-part and per-call timeouts, --timeout exits 7 with the resume hint. Pitfall 25 2026-10-12 08:59:45 +08:00
CRT
366362d62b flow run: a declined confirmation stops the flow; --apply --yes confirms write steps 
confirm() prints 'declined: <reason>' and exits 3 whenever the answer is no or nobody can answer (not a
terminal without --yes, serve without the owner's dialog), so no command reports success after declining.
flow run stops at such a step with 'step N declined: <reason>' (status declined), never ok. flow run
--apply --yes passes --yes to write steps only; --yes without --apply is refused. Pitfall 24.
 2026-10-12 08:51:58 +08:00
CRT
5fbb9e63e3 build.prebuild and a Capacitor web-asset staleness guard for apple build / play build 
apple build and play build run build.prebuild (or apple.prebuild / play.prebuild) first, once per flow run;
--no-prebuild skips it, --dry only prints it. A Capacitor project's copied public/index.html must then be newer
than the last source commit and <webDir>/index.html, else the build stops (--allow-stale-web overrides). check
warns when stale without a prebuild; the build output and dry plan show the web bundle's sha256 and mtime.
The Capacitor project is also found in a monorepo (apps/native etc.); several ask for play.build.dir /
apple.build.*. Pitfall 23.
 2026-10-12 08:51:38 +08:00
CRT
f694af80eb pitfall 22: AAB proto manifest field numbers 2026-10-12 08:46:03 +08:00
CRT
720cb2a13a play images: same languages as play listing (drafts skipped unless --include-drafts); a language with no Play listing (404) is skipped with an info line, never fatal 2026-10-12 08:45:43 +08:00
CRT
97ab76e9c8 play data-safety: write the conditional required rows (PSL_ACCOUNT_DELETION_URL from accounts.deletionUrl, PSL_SUPPORT_DATA_DELETION_BY_USER from dataSafety.partialDeletion, PSL_DATA_DELETION_URL); a rule table checks every conditional row in check, declarations and --dry before Play answers 400 2026-10-12 08:40:36 +08:00
CRT
c9a7f095c4 console: agent-first mode (console plan / console verify), verified App Privacy and Play Create app facts 
- `storebound console plan <form> [--json] [--lookup]`: read-only plan for an AI agent that drives the browser
  itself: start URL (deep links), ordered steps, answer sheet with the console's exact labels (certain / ask owner,
  curly quotes noted), never-press list, verified UI facts, driving guidance (in-page async loop + window.__log),
  verify instructions. All six forms.
- `storebound console verify <form> [--from-text <file|->]`: App Privacy per-type summaries from page text, Play
  Create app from input states, content rating / target audience summaries, App Store record and age rating from
  the API; exit 1 on a mismatch.
- MCP: console_plan, console_verify (read-only); console fill stays off MCP.
- App Privacy (verified 2026-10-12): two information steps, unlabeled purpose checkboxes (nearest parent text),
  "Definitions and Examples" never pressed; fixture and engine follow.
- Play Create app (verified 2026-10-12): /developers/<id>/create-new-app, App package name + read-only Check
  availability, material-radio inner [role=radio] click, app dashboard URL and play.appId, service account
  "Add app" as an owner step.
- console-autofill skill rewritten agent-first; agents-core rule 10; README; pitfalls 12, 18 (confirmed sign-out),
  19; CHANGELOG; play-first-release.
 2026-10-12 08:39:12 +08:00
CRT
a9261a8052 play images: tablet, TV and Wear sets are optional; play.tablets switch (default: tablet renders exist); a missing optional set never deletes Play's images without --prune 
A phone-only project aborted with 'no sevenInchScreenshots'. Play requires the 512 icon, the 1024x500 feature graphic and at least 2 screenshots (Play Console Help answer 9866151). play images uploads what exists and prints an info line for missing optional sets; play.tablets true makes missing tablet sets an error in shots render/check/gallery, validate and play images. Pitfall 19.
 2026-10-12 08:21:03 +08:00
CRT
0035931734 console fill: never copy Google session cookies by default (device-bound); own profile in a Chrome started without automation switches 
Google binds its session cookies to the device (Device Bound Session Credentials) and signs out
sessions whose cookies look stolen, which can sign the owner out of their real Chrome. The default is
now storebound's own profile per store; storebound starts Chrome itself (--user-data-dir,
--remote-debugging-port=0, no --enable-automation, navigator.webdriver false) and attaches over CDP.
--use-chrome-session google|apple is an explicit opt-in that warns. /signin/rejected is said plainly.
 2026-10-12 07:46:38 +08:00
CRT
d531626836 Merge remote-tracking branch 'origin/main' into play-app-record 
# Conflicts:
#	CHANGELOG.md
 2026-10-12 05:26:34 +08:00
CRT
04fb0089b5 Merge remote-tracking branch 'origin/main' into play-app-record 
# Conflicts:
#	CHANGELOG.md
#	docs/pitfalls.md
#	skills/store-pitfalls/SKILL.md
#	tests/console-fill.test.ts
 2026-10-12 05:24:52 +08:00
CRT
7746a984ec Merge remote-tracking branch 'origin/main' into shots-liga 
# Conflicts:
#	CHANGELOG.md
#	cli/index.ts
 2026-10-12 05:24:19 +08:00
CRT
af08d7113a shots check: ligatures no longer read as system-font glyphs (probe spans shaped as one run); --help on every command and group, unknown flags rejected before anything runs 
Root cause: the per-character font probes were inline spans side by side, so Chrome shaped f + i into the fi ligature across them and the lone i probe reported no glyph of ours. Each probe is now its own block. The Google Fonts text= subsets keep the GSUB ligatures; regression test with a real Montserrat text= subset.

--help / -h prints the command's usage and exits 0 before any config, render or network; unknown flags exit 2 with the usage (cli/data/flags.json from tools/gen-flags.ts). Command tables moved to cli/commands.ts; ads apple reachable again; shots render --scenes rejects unknown ids at once.
 2026-10-12 05:23:37 +08:00
CRT
d9515fa8f0 Merge remote-tracking branch 'origin/main' into fast-ci 
# Conflicts:
#	CHANGELOG.md
#	tests/site-overflow.test.ts
 2026-10-12 05:10:37 +08:00
CRT
5e1357116d fast ci: task graph runner, sharded tests balanced by recorded durations, ci:quick (typecheck + related tests + scrub), Rust only when src-tauri / sidecar build changed, event waits instead of sleeps 2026-10-12 05:05:26 +08:00
CRT
fd82db0d75 Merge remote-tracking branch 'origin/main' into aso-plus 2026-10-12 04:59:49 +08:00
CRT
3fb3f2108a Merge remote-tracking branch 'origin/main' into aso-plus 
# Conflicts:
#	CHANGELOG.md
 2026-10-12 04:24:52 +08:00
CRT
96d1e6b62d Merge remote-tracking branch 'origin/main' into idem-listing 2026-10-12 04:24:49 +08:00
CRT
a2009fa7ac idempotency: apple listing findOrCreate / createOnce, play listing re-plan in the edit, data-safety hash, twice-run tests for the last open rows 2026-10-12 04:24:45 +08:00
CRT
e38f68fa33 Merge origin/main into local-fonts 2026-10-12 04:15:26 +08:00
CRT
354daba672 shots fonts: local font files (title / body / fallback) with cmap coverage, served in place, hash in fonts.json, license note 2026-10-12 04:15:19 +08:00
CRT
17f4413afa Merge remote-tracking branch 'origin/main' into aso-plus 
# Conflicts:
#	CHANGELOG.md
#	docs/pitfalls.md
#	skills/store-pitfalls/SKILL.md
 2026-10-12 04:13:48 +08:00
CRT
d68028caba Merge remote-tracking branch 'origin/main' into play-app-record 
# Conflicts:
#	CHANGELOG.md
#	docs/pitfalls.md
#	skills/store-pitfalls/SKILL.md
 2026-10-12 04:13:35 +08:00
CRT
b65843828b Merge remote-tracking branch 'origin/main' into aso-plus 
# Conflicts:
#	CHANGELOG.md
 2026-10-12 04:09:46 +08:00
CRT
7e26941ffc aso: competitors, suggest and audit from official data; ASO card on the Growth tab 
- aso competitors: top apps per keyword from the iTunes Search API (name, developer,
  rating count, release / update dates, localized genre), coverage gaps (words of 2+
  developers), new entrants vs the last snapshot (.storebound/aso/competitors/)
- aso suggest: candidates from own text, competitor names, localized category names and
  Apple Ads keyword suggestions (POST /v1/suggestions/keywords/query, relative 0-100
  popularity, only with credentials); 100-byte keyword field per locale as a diff,
  --write marks it a draft that check --aso and aso audit report
- aso audit: check --aso, free keyword room, rank trend arrows, gaps, Play short
  description / density, App Store conversion, PPO / Play experiment ideas, next 3 actions
- MCP: read-only aso_competitors, aso_suggest, aso_audit; desktop ASO card (visx rank chart)
- docs: README, aso-basics, store-pitfalls (Search API order, no Play search API), CHANGELOG;
  demo-app listing files; tests on recorded Search API and mocked Ads answers
 2026-10-12 04:09:34 +08:00
CRT
4533e3e1c4 app privacy: one Apple purpose per Play purpose (advertising is Third-Party Advertising only; Developer's Advertising only from the owner), appPrivacy.types (owner answers per Apple type id: certain in console fill, proposed by scan without linked / tracking, compared by check with Info.plist and PrivacyInfo.xcprivacy) 2026-10-12 04:07:15 +08:00
CRT
d5bc7b8889 idempotency: docs table, pitfall 9, changelog; lock scan fix 2026-10-12 04:03:23 +08:00
CRT
704231457f Merge remote-tracking branch 'origin/main' into play-app-record 
# Conflicts:
#	CHANGELOG.md
 2026-10-12 03:58:50 +08:00
CRT
1150d4e4e6 Merge origin/main into shots-speed 
# Conflicts:
#	CHANGELOG.md
 2026-10-12 03:49:58 +08:00
CRT
5cb5dc2c32 shots capture / render: --concurrency, per-frame timing, per-language page reuse, input-hash cache 
Web capture runs frames in parallel browser contexts (default from the CPU count, lower for GPU-heavy capture),
logs n/total + ETA and goto / waitFor / eval / delay / screenshot per frame, writes .storebound/capture-report.json
with the slowest frames and steps. shots.capture.session 'per-language' boots the app once per language and device
and switches shots via pushState / popstate (navigate 'spa') or goto (navigate 'reload'), falling back to a fresh
page when a precondition fails. .storebound/capture-cache.json skips frames with unchanged inputs; --only-missing,
--force. shots render renders with --concurrency pages and async ffmpeg.
 2026-10-12 03:49:53 +08:00
CRT
75d6f4cb71 console fill play-app-record: Play Console's Create app form (account picked by developerId / workspace / play.developerAccount, else stop and list; Create app opener allowlisted only on the app list, never in the form, EN + TR; name, default language, app or game, free or paid as an owner check; declarations never ticked; package name set by the first AAB upload) 2026-10-12 03:48:20 +08:00
CRT
d466d4a3c2 Merge remote-tracking branch 'origin/main' into apple-name 
# Conflicts:
#	CHANGELOG.md
 2026-10-12 03:40:51 +08:00
CRT
59e60960b0 pitfalls: store-pitfalls skill and docs/pitfalls.md, store list lag warnings (apple iap-review exits 1), dryPlan table and a scan for count-only dry runs 2026-10-12 03:29:53 +08:00
CRT
6c4f8a4551 Merge remote-tracking branch 'origin/main' into apple-name 
# Conflicts:
#	CHANGELOG.md
 2026-10-12 03:29:53 +08:00
CRT
b88648499e apple listing, play listing, apple appinfo: the dry run prints a real plan (version decision, old -> new per field, draft locales skipped); the real run asks and applies exactly it 2026-10-12 03:29:38 +08:00
CRT
5afe4613c4 apple.name: the App Store name when the plain name is taken; console fill, apple listing, pull, check (30-char error, same-name hint), scan use it 2026-10-12 03:23:43 +08:00
CRT
8bfa49807d Merge origin/main into shots-glyphs 
# Conflicts:
#	CHANGELOG.md
 2026-10-12 03:05:32 +08:00