f5da7c9f7a
validate: macOS versions need Mac screenshots, Play reads survive an ended edit; macOS build numbers across platforms; Mac build prebuild + apple.macAppCheck; signing wording off the Mac; dry flows plan uploads
2026-11-02 18:16:25 +07:00
1abd0936c3
testflight: description keys by language id or App Store locale, unknown keys are a config error, primary-locale check before Beta App Review
2026-10-29 22:33:59 +07:00
85cf494c0a
apple: release type (apple.releaseType, apple release --after-approval|--manual), device-family preflight, TestFlight invite needs an installable build
2026-10-27 17:07:37 +07:00
5833776a4b
analytics and reports for a collector: store-only configs, --json snapshot, App Usage and Play install stock numbers, per-day sales ranges for both stores
2026-10-26 10:20:27 +07:00
61b5fa0623
shots: feature rotate, per-language frame fallback, layout-aware capture selectors
2026-10-24 13:00:48 +08:00
fb1609cba7
upload --pre-check/--evidence, shots copy translate, game-center --locale-map, play games API-disabled hint
2026-10-24 12:16:48 +08:00
d4cf1ad3a1
shots: full-bleed layout (shots.layout bleed) with corner captions, per-size frames, and landscape orientation, on top of the landscape sizes
2026-10-23 22:45:10 +08:00
4a74989a95
Open in Google Play Console deep-links the app: Play developer id per credential profile (accounts play-developer, desktop Accounts), shared playAppUrl builder for desktop, CLI and watch; developer chooser instead of the console root
2026-10-23 09:20:35 +08:00
ca7289b173
games: one config section for Game Center and Play Games Services (shared leaderboards and achievements); apple game-center (gameCenterDetails, gameCenterAppVersions, leaderboards, achievements and localizations, upsert by vendor id, read back); play games (Games Configuration API upsert, no POST retry); signing ensure adds GAME_CENTER when games.gameCenter
2026-10-21 05:28:47 +07:00
3a11682a37
shots: app titles get the weights the templates use (variable axis, used range or static weights; font-weight warning), palette.bg as one colour or a CSS gradient string (validated; contrast guard in shots check), photo backgrounds (palette.image, shots.feature.background) with overlay and cover crop
2026-10-21 03:07:26 +07:00
e1e4e05237
shots capture: signed-in web apps (shots.capture.auth request with ${cred:}/${env:} references or storageState), shots login saves a demo sign-in to .storebound/auth.json (0600), expired-session warning, secrets and cookies masked
2026-10-20 12:41:43 +07:00
e59539fec8
shots: Mac App Store screenshots (mac size, APP_DESKTOP to the macOS version), a landscape layout (Mac window or bare; Mac, Play Chromebook, Play tablets), safe margins in every template checked by shots check from the render's layout boxes, a contact sheet timeout that scales with images, sizes and load; pitfall 80
2026-10-20 03:29:19 +07:00
edabbec874
cross-store text: other platforms named in App Store text (2.3.10: Android, Google Play, ...) or Play text (Metadata: iOS, App Store, Game Center, ...) are refused by every text write (apple / play listing, play release / upload notes, listing set, whats-new, storebound edit, desktop editor), blockers in check / validate, scan other-platforms / play-other-platforms; listing.allowPlatformMentions for the owner's functional mentions; whats-new splits [apple] / [play] lines per store; storebound api --yes without a TTY is refused (exit 1, stderr) instead of a silent dry run; pitfalls 77, 78
2026-10-20 02:57:25 +07:00
e5369090fa
apple creative-assets: App Store Header and Search Results (PRODUCT_PAGE_HEADER_ASSET, APP_STORE_SEARCH_RESULTS_ASSET) through the App Asset Library: local size / alpha / video checks, upload once by MD5, select only approved assets, replace on a changed file; check / validate note, MCP tool, gallery and desktop Art row, docs, pitfall 75
2026-10-18 13:10:20 +07:00
3381673ae6
iPhone Duo screenshots (render, check, upload skip with console link while the API has no display type) and the medium display class as the required iPhone set, labels as in the console
2026-10-18 13:07:15 +07:00
e500e88e40
Console pages as absolute deep links: cli/lib/console-links.ts builds the URL of every App Store Connect / Play Console page from apple.appId, play.developerId and play.appId (app list / developer chooser when unknown); every plain 'App Store Connect > ...' / 'Play Console > ...' direction in cli/ and templates/ now carries it, validate / scan / declarations / release plan JSON carry url, the desktop shows an Open button; tests/console-links.test.ts guards it; AGENTS rule 11, pitfall 71
2026-10-15 19:55:37 +08:00
357319a775
--json prints only JSON on stdout (withJsonOutput around every command: logs, tables and prompts to stderr; printJson everywhere; test runs every --json command against the fake stores and parses stdout); prices ppp compares like with like: par = the store's own US-equivalent price (Play convertRegionPrices, Apple equalizations; offline base x fx x (1 + VAT) rounded up) scaled by the PPP price level; defaults only lower, only price levels <= 0.5, World Bank high-income at par, CN at par on Apple and skipped on Play, never above par (--only-decreases, --max-ratio, --min-ratio, --max-level, --include-high-income; --floor / --ceiling kept), top-10 revenue market drops > 20 % warned (sales reports, else a static list), unchanged regions out of the sheet; price changes of existing products only with --allow-price-changes, TTY or not (a terminal yes covered them), then their own question listing each old -> new, held section in dry runs (play products, prices import, play / apple subscriptions); pitfalls 61-63; tests
2026-10-14 17:36:00 +08:00
bab3f63227
whats-new drafts from player-facing notes first (whatsNew.source, docs/RELEASE-<version>.md, the CHANGELOG section of the version or Unreleased; --release, --from-git) and only then from the git log; internal jargon warnings (SDK / vendor names, developer and version-control words, file paths, issue ids, code identifiers) with plain alternatives in the draft and whats-new check, one list in cli/lib/jargon.ts, whatsNew.allowWords keeps a word; skill: write from what players feel, never from commit messages; tests
2026-10-14 14:45:19 +08:00
7219ded3e8
template compliance answers never reach a store: init writes unanswered (dataSafety, appPrivacy, reviewNotes, ageRating, accounts, reviewAccess), older configs are recognised by the template values; check / validate / scan block, play data-safety (also --dry), console plan / fill, apple review-details and appinfo refuse. onboard --declarations replaces them on a live app: name and copyright from the stores (a copyright with a private term is left out), the rows the code proves (scan proposal, sign-up methods from auth code and login SDKs), the rest as one owner question list. play data-safety --dry prints the answers that change (old -> new, account and deletion first) against the last uploaded CSV; pitfall 60; tests
2026-10-14 11:36:30 +08:00
3cea2af4e1
desktop editors: edit in place what App Store Connect and Play Console let the owner edit (listings per language for both stores with live counters and the check / scan rules, store details, App info, age rating, App Review, Play store settings, Data safety and App Privacy answers, promotion blocks, catalog names / prices / offers, TestFlight information, scene order); storebound edit (project.edit) saves into the config by path keeping comments and formatting, the listing files and the review contact, dry run with the diff and the checks first; Apply shows each store's dry run in the window; unsaved edits survive tab switches with undo / redo; tests/edit.test.ts, apps/desktop/tests/edits.test.ts, boot check editor case
2026-10-14 00:37:08 +08:00
19d34286d5
Feature graphic fits the phone: shots.feature.fit 'contain' (default) sizes the device so its rotated box stays inside 1024x500 with a 24 px margin in both templates, 'bleed' keeps the crop, scale 0.5-1.5, config validated; shots render records measured device boxes (report.json devices) and shots check fails a feature graphic whose device leaves the canvas (warns for a screenshot's front device off a side or the top); tests/feature-fit.test.ts (rotated-box geometry, both templates rendered at 1024x500, bleeding fixture) (pitfall 55)
2026-10-13 09:50:15 +08:00
d2ce185441
One product per machine: the CLI and the desktop app share one version, the store accounts and the app folder list
...
- one version: package.json's version is the desktop app's too (desktopVersion removed); tools/desktop-version.ts
keeps the plugin manifests and the app's copies equal, desktop-release publish refuses another version, release
order app first then npm publish; the unpublished desktop 0.1.0 candidate is noted in the docs and CHANGELOG
- storebound desktop installs (per user, no admin: macOS DMG -> /Applications or ~/Applications, Windows NSIS /S,
Linux AppImage + .desktop with the storebound:// handler), updates an older app, notes a newer one (downgrade only
with --force), asks once ([Y/n], --yes, exit 3 without a terminal), opens on the folder; --dry / --json / --download;
the install steps are pure plans (cli/lib/desktop-install.ts); the version's own manifest dl/<version>/latest.json
- credentials: one store, the CLI's credential profiles in ~/.storebound/credentials; the desktop writes and reads
them (profiles.rs, files 0600), moves old keychain accounts into profiles on first start, shows profiles the CLI
made; precedence env > named profile > project file > default profile; config `account`, "account" in the
project's credentials.json; storebound accounts list | import (dedup by key id / service account e-mail, key files
copied 0600, project file keeps keystore and review contact, backup, --dry, never prints values) | use
- app folders: one list ~/.storebound/projects.json shared by the desktop (registry.rs), storebound desktop,
apps folders | add | remove, ws init and ws without a workspace file
- desktop: notice when a folder pins another storebound version; storebound-desktop --version
- tests: version drift, desktop decisions and per-OS plans, credential precedence and import, registry (TS + Rust),
keychain migration and profile round trip (Rust), boot check with old keychain state and the new shared state
2026-10-13 06:17:37 +08:00
1366e7e231
scan, privacy answers and credentials from a second game's first release (lessons 35-37): review-prompt needs rating context, not a bare "rate"; account signals skip import lines and module paths, config-only accounts say "from config"; accounts.inApp without deletion code stays a medium 5.1.1(v) finding; privacy-manifest --propose builds NSPrivacyCollectedDataTypes from appPrivacy.types and check warns on an empty list; appPrivacy.types is authoritative in the App Privacy sheet (unlisted = not collected), ad / support / AR types default to not collected without tracking or ad SDKs; Play advertising ID from SDKs, the AD_ID permission, app-ads.txt or the flag, never from a Device ID alone; scan.ignore[].evidence and warnings for entries that match nothing; empty credentials template, placeholder values count as missing (check, doctor)
2026-10-13 05:39:09 +08:00
36a8bf9625
CLI runs on Node 20+: npx storebound (bunx keeps working)
...
- cli/lib/rt.ts: the runtime layer on node: modules (spawn / spawnSync with Bun's defaults, exit codes and
"Executable not found", which with PATHEXT, sleep, serve, Glob, hasher, gunzip, stdin, SQLite, packageRoot,
config imports with a type-stripping fallback for Node 20); every Bun.* use in cli/ goes through it
- tools/gen-embedded.ts -> cli/lib/embedded.ts: templates/, cli/shots/*.html and Play's Data safety form embedded
(replaces Bun text imports; the bundle and the compiled sidecar carry them), checked fresh by bun run ci
- package.json: bin dist/storebound.mjs (Node ESM bundle, tools/build-node.ts, prepack), engines node >=20
- bun run ci: node bundle + node smoke (real node: --version, help, check same as Bun, scan, release plan --help,
init, MCP handshake + tool call); Forgejo CI sets up Node 20; tests/node-compat.test.ts guards cli/
- install writes npx MCP commands when run with Node; bin/storebound falls back to Node
- docs: npx storebound init (Node 20+) or bunx storebound init
2026-10-13 04:03:28 +08:00
c8213be2b6
ITMS-91064: NSPrivacyTracking and NSPrivacyTrackingDomains must agree in every privacy manifest (true needs domains, domains need true); check, scan and privacy-manifest fail on either mismatch with the exact ITMS text; App Privacy tracking no longer demands the app manifest's true: SDK manifests that declare tracking (Pods, frameworks, SwiftPM, Carthage, plugins, the built IPA) are info, known tracking SDKs info, else a warning; privacy-manifest --propose writes true only with appPrivacy.trackingDomains; apple upload checks every manifest in the IPA (XML or binary) before any network call, apple build after the export. Pitfall 29
2026-10-12 10:27:21 +08:00
b7bfe89151
Play console steps without an API as agent plans: play-store-settings (App category; play listing cannot set it), play-app-content (every card in order, one owner batch) and its cards (privacy policy, ads, sign in details, advertising ID, government, financial, health), play-production-countries and play-production-release; IARC plan with the Terms of Use agreement, follow-ups (console.contentRating.details, products[].randomRewards, social) and the Summary's final Save; config play.category / countries / managedPublishing, console.appContent; check, validate, play status and play release reminders; inPageLoop helper and material checkbox clicks; App Privacy published signal; first IAPs via apple iap-submit --with-version. Pitfalls 27, 28
2026-10-12 10:16:34 +08:00
dbd9f2973c
play data-safety: PSL_SUPPORT_DATA_DELETION_BY_USER is the general 'can users request deletion?' question; a delete-account URL answers yes (with PSL_DATA_DELETION_URL), dataSafety.dataDeletion for apps without one; check flags a no next to a delete-account URL
2026-10-12 09:46:58 +08:00
b5b8f2da9d
play data-safety: PSL_SUPPORT_DATA_DELETION_BY_USER as Play's single choice (partialDeletion true | false | 'auto90'), drop the removed PSL_DATA_COLLECTION_USER_REQUEST_DELETE (deletionRequest deprecated, check notes it); ship Google's empty form (cli/data/play-data-safety-form.csv, exported 2026-10-12), take every Answer requirement from it and report pairs not in it (formPairIssues) in check, declarations and play data-safety. Pitfall 21
2026-10-12 09:34:12 +08:00
5fbb9e63e3
build.prebuild and a Capacitor web-asset staleness guard for apple build / play build
...
apple build and play build run build.prebuild (or apple.prebuild / play.prebuild) first, once per flow run;
--no-prebuild skips it, --dry only prints it. A Capacitor project's copied public/index.html must then be newer
than the last source commit and <webDir>/index.html, else the build stops (--allow-stale-web overrides). check
warns when stale without a prebuild; the build output and dry plan show the web bundle's sha256 and mtime.
The Capacitor project is also found in a monorepo (apps/native etc.); several ask for play.build.dir /
apple.build.*. Pitfall 23.
2026-10-12 08:51:38 +08:00
97ab76e9c8
play data-safety: write the conditional required rows (PSL_ACCOUNT_DELETION_URL from accounts.deletionUrl, PSL_SUPPORT_DATA_DELETION_BY_USER from dataSafety.partialDeletion, PSL_DATA_DELETION_URL); a rule table checks every conditional row in check, declarations and --dry before Play answers 400
2026-10-12 08:40:36 +08:00
c9a7f095c4
console: agent-first mode (console plan / console verify), verified App Privacy and Play Create app facts
...
- `storebound console plan <form> [--json] [--lookup]`: read-only plan for an AI agent that drives the browser
itself: start URL (deep links), ordered steps, answer sheet with the console's exact labels (certain / ask owner,
curly quotes noted), never-press list, verified UI facts, driving guidance (in-page async loop + window.__log),
verify instructions. All six forms.
- `storebound console verify <form> [--from-text <file|->]`: App Privacy per-type summaries from page text, Play
Create app from input states, content rating / target audience summaries, App Store record and age rating from
the API; exit 1 on a mismatch.
- MCP: console_plan, console_verify (read-only); console fill stays off MCP.
- App Privacy (verified 2026-10-12): two information steps, unlabeled purpose checkboxes (nearest parent text),
"Definitions and Examples" never pressed; fixture and engine follow.
- Play Create app (verified 2026-10-12): /developers/<id>/create-new-app, App package name + read-only Check
availability, material-radio inner [role=radio] click, app dashboard URL and play.appId, service account
"Add app" as an owner step.
- console-autofill skill rewritten agent-first; agents-core rule 10; README; pitfalls 12, 18 (confirmed sign-out),
19; CHANGELOG; play-first-release.
2026-10-12 08:39:12 +08:00
a9261a8052
play images: tablet, TV and Wear sets are optional; play.tablets switch (default: tablet renders exist); a missing optional set never deletes Play's images without --prune
...
A phone-only project aborted with 'no sevenInchScreenshots'. Play requires the 512 icon, the 1024x500 feature graphic and at least 2 screenshots (Play Console Help answer 9866151). play images uploads what exists and prints an info line for missing optional sets; play.tablets true makes missing tablet sets an error in shots render/check/gallery, validate and play images. Pitfall 19.
2026-10-12 08:21:03 +08:00
04fb0089b5
Merge remote-tracking branch 'origin/main' into play-app-record
...
# Conflicts:
# CHANGELOG.md
# docs/pitfalls.md
# skills/store-pitfalls/SKILL.md
# tests/console-fill.test.ts
2026-10-12 05:24:52 +08:00
354daba672
shots fonts: local font files (title / body / fallback) with cmap coverage, served in place, hash in fonts.json, license note
2026-10-12 04:15:19 +08:00
d68028caba
Merge remote-tracking branch 'origin/main' into play-app-record
...
# Conflicts:
# CHANGELOG.md
# docs/pitfalls.md
# skills/store-pitfalls/SKILL.md
2026-10-12 04:13:35 +08:00
4533e3e1c4
app privacy: one Apple purpose per Play purpose (advertising is Third-Party Advertising only; Developer's Advertising only from the owner), appPrivacy.types (owner answers per Apple type id: certain in console fill, proposed by scan without linked / tracking, compared by check with Info.plist and PrivacyInfo.xcprivacy)
2026-10-12 04:07:15 +08:00
704231457f
Merge remote-tracking branch 'origin/main' into play-app-record
...
# Conflicts:
# CHANGELOG.md
2026-10-12 03:58:50 +08:00
1150d4e4e6
Merge origin/main into shots-speed
...
# Conflicts:
# CHANGELOG.md
2026-10-12 03:49:58 +08:00
5cb5dc2c32
shots capture / render: --concurrency, per-frame timing, per-language page reuse, input-hash cache
...
Web capture runs frames in parallel browser contexts (default from the CPU count, lower for GPU-heavy capture),
logs n/total + ETA and goto / waitFor / eval / delay / screenshot per frame, writes .storebound/capture-report.json
with the slowest frames and steps. shots.capture.session 'per-language' boots the app once per language and device
and switches shots via pushState / popstate (navigate 'spa') or goto (navigate 'reload'), falling back to a fresh
page when a precondition fails. .storebound/capture-cache.json skips frames with unchanged inputs; --only-missing,
--force. shots render renders with --concurrency pages and async ffmpeg.
2026-10-12 03:49:53 +08:00
75d6f4cb71
console fill play-app-record: Play Console's Create app form (account picked by developerId / workspace / play.developerAccount, else stop and list; Create app opener allowlisted only on the app list, never in the form, EN + TR; name, default language, app or game, free or paid as an owner check; declarations never ticked; package name set by the first AAB upload)
2026-10-12 03:48:20 +08:00
6c4f8a4551
Merge remote-tracking branch 'origin/main' into apple-name
...
# Conflicts:
# CHANGELOG.md
2026-10-12 03:29:53 +08:00
5afe4613c4
apple.name: the App Store name when the plain name is taken; console fill, apple listing, pull, check (30-char error, same-name hint), scan use it
2026-10-12 03:23:43 +08:00
8bfa49807d
Merge origin/main into shots-glyphs
...
# Conflicts:
# CHANGELOG.md
2026-10-12 03:05:32 +08:00
d942275920
shots: glyph coverage check per language, automatic Noto fallbacks, check errors on fallback / system-font glyphs
...
Lilita One lacks most of Latin Extended-A (Turkish s-cedilla, g-breve, dotted I ...), so Turkish titles were drawn
with a silent browser fallback while shots check passed. shots fonts now reads the cmap of every face (pure TS,
TTF/OTF/WOFF/WOFF2), adds a Noto fallback per missing character or fails with language + characters; render
measures which face drew each character (CDP probes) and records it in report.json; check errors on fallbacks the
config did not choose (shots.fonts.fallback) and on system-font glyphs. Default game title font: Paytone One.
2026-10-12 03:05:23 +08:00
21c0c2ed60
console fill: sign-in detected by URL, frame and text; keeps watching after the fallback; session kept across relaunches; one login across Play developer accounts and App Store Connect teams
2026-10-12 02:54:48 +08:00
e92fda612c
scan.ignore: optional match on the finding title, to accept one check of a rule with several (e.g. the ALL CAPS title in play-metadata)
2026-10-12 02:08:11 +08:00
582ea909ca
scan: accounts mean User ID, never email without evidence; accounts.signUp (username -> PSL_ACM_USER_ID_OTHER_AUTH); built bundles are low-trust evidence; privacy-manifest and scan find plugins in monorepo node_modules, workspaces and local SwiftPM packages
2026-10-12 02:03:07 +08:00
2d2fd9040d
Merge remote-tracking branch 'origin/main' into growth-extras
...
# Conflicts:
# cli/index.ts
# cli/lib/config.ts
# cli/lib/credentials.ts
# docs/desktop.md
# templates/credentials.example.json
# tools/site-icons.ts
2026-10-12 00:14:36 +08:00
cea2dffdc3
growth extras: prices ppp, ads apple, web, apple adhoc, play share, revenuecat, console fill (+ desktop button)
2026-10-12 00:14:00 +08:00
97ab678691
Merge scan-play: Google Play scan rule parity
...
Conflict in cli/lib/config.ts (play section): kept play.build from main and the new targetAges, accountType, accountCreated and billingPrograms. Adapters and API tables regenerated (unchanged).
2026-10-12 00:09:22 +08:00
