storebound/docs/project.md

Roadmap, contributing and credits

Roadmap

Wave 2 (TestFlight, vitals, review replies, price sheets, analytics, MCP 2026-07-28, Product Page Optimization) shipped in 0.4.0. 0.5.0 made storebound app-first (profiles, app screenshot style, account deletion, review access) and brought the full in-app catalog: subscriptions on both stores with offers and offer codes, non-renewing products and the cross-store catalog diff. Next, roughly in this order:

• Play prepaid base plans for non_renewing.
• The App Asset Library (API 4.5.1) for screenshots, custom product pages and in-app events once the screenshot sets it replaces stop working.
• Play store listing experiments and their results, as soon as Google offers an API.
• App preview treatments and alternate icons in Product Page Optimization tests.
• The iPhone Duo screenshot classes Apple lists for apps built with the iOS 27.1 SDK (required from April 2027).

Contributing

Issues and pull requests are welcome: store rule updates (with a source), new capture sources, adapters for more AI tools. See CONTRIBUTING.md; bun run ci must be green.

Agent support: formats and what is not verified

Checked against each tool's own docs in October 2026:

• Agent Skills: frontmatter is only name (lowercase-hyphen, equals the folder) and description; the generator fails if a skill adds anything else.
• Claude Code: plugin manifest + root .mcp.json with ${CLAUDE_PLUGIN_ROOT}; claude plugin validate . passes.
• Codex: .codex-plugin/plugin.json with "skills": "./skills/". Not verified: whether Codex starts the root .mcp.json from a plugin and expands ${CLAUDE_PLUGIN_ROOT} there, so use install --agent codex for the MCP server. OpenAI also documents a newer portable root plugin.json; not shipped yet.
• Gemini CLI: gemini-extension.json with ${extensionPath}${/}, GEMINI.md as context, skills/ inside the extension. Google now points unpaid users to Antigravity CLI; not tested there. The .gemini/skills folder used by install --agent gemini is not verified (the extension route is).
• Windsurf: the current docs name ~/.config/devin/mcp_config.json; install keeps using ~/.codeium/windsurf/mcp_config.json when that file already exists (older installs).
• MCP: built for 2026-07-28 (final, modelcontextprotocol.io) and dual-era: initialize clients get 2025-11-25 (or 2025-06-18 / 2025-03-26 / 2024-11-05). Tested with both handshakes on one stdio process, not yet against every client listed above.
• Not verified against a live account yet (no credentials during development; request builders are tested with fixtures from the official docs): the scale of the Play Reporting API rates (read as fractions, 0.0109 = 1.09 %), the App Store review reply limit (5970 characters is commonly reported; Apple documents none, storebound only warns), the TestFlight "What to Test" limit (4000 assumed), whether an analytics segment checksum covers the gzip file or its content (both are accepted), that a new App Store price schedule replaces the old one (Apple's example implies it), stopping a Product Page Optimization test with started: false, and APP_IPHONE_61 for the 6.3" iPhone set. From 0.5.0 (request bodies follow Apple's and Google's published schemas, tested with fixtures, not yet run against a live account): free promotional offers and offer codes sent with territories but no price point, subscription prices and introductory offers created inline through PATCH /v1/subscriptions/{id}, Play pay-as-you-go offers as a relativeDiscount, Play "developer determined" offers as offers without targeting plus an offer tag, the ISO 8601 strings for Play billing periods (Google lists them only in words), the Play subscription benefit length (40, from Play Console), the Data safety sign-up method ids (PSL_ACM_*, Google publishes none: compare with a Console export) and the data deletion question ids (PSL_ACCOUNT_DELETION_URL is confirmed by a Play 400; PSL_SUPPORT_DATA_DELETION_BY_USER with its three options and PSL_DATA_DELETION_URL are in Google's empty form exported 2026-10-12, cli/data/play-data-safety-form.csv, which every generated pair is checked against). From the store operations (built from the App Store Connect API 4.5.1 OpenAPI spec and the cited Help pages, tested with recorded answers, not yet run live): the first IAP of a type sent through reviewSubmissionItems next to the app version (--no-submit leaves the draft for the UI if Apple refuses it), free IAP offer code and win-back prices without a price point, the order request for promoted purchases, the Play earnings / sales zip names beyond the documented prefix (storebound lists the prefix), and where Xcode stores AttributionCopyEndpoint (top level or inside an AdAttributionKit dictionary: both are read).
• Apple IAP description: 45 characters (App Store Connect Help, "In-app purchase information"); an older App Store marketing page says 55. storebound checks 45.

Develop

bun install
bun run ci                  # adapters fresh (gen-adapters --check), tests, typecheck, secrets / personal data scrub
bun tools/gen-adapters.ts   # after editing skills/*/SKILL.md or docs/agents-core.md

skills/*/SKILL.md and docs/agents-core.md are the single source; AGENTS.md, GEMINI.md, the plugin manifests, .github/copilot-instructions.md and .cursor/rules/storebound.mdc are generated and committed, and CI fails when they are stale.

Thanks and idea sources

Some skills were sparked by other people's open work. I wrote my own text; the ideas deserve the credit:

• rorkai/app-store-connect-cli-skills (MIT): App Store Connect workflow ideas.
• rshankras/claude-code-apple-skills (MIT): Apple platform and App Store topic ideas.

Built with Bun and plain fetch against the Google Play Developer API v3, the Play Developer Reporting API and the App Store Connect API. Screenshot fonts come from Google Fonts at render time (Noto, Paytone One, Montserrat, Inter; SIL Open Font License 1.1). Not affiliated with Google or Apple.

---

All docs · README