@shipvo/cli 0.1.4 → 0.1.5

package/dist/help.d.ts

@@ -1,5 +1,5 @@
-export declare const COMMANDS: readonly ["init", "sim", "preview", "publish", "promote", "auto-halt", "rollback", "app", "login", "doctor", "store", "status", "keys", "mcp", "keygen", "pubkey", "hash", "sign-file", "sign-json", "verify-json", "verify"];
-export declare const help = "shipvo <command>\n\nStart\n  init <dir>                  Create a new app wired to Shipvo\n  sim [--port 4545]           Build the app and run it in the simulator\n  sim --watch [--verbose]     Rebuild on file changes and keep serving; --verbose shows full build errors\n  preview [--json]            Publish a public 24-hour preview link (here.now, no account)\n\nShip\n  publish [--bands b0,b1,b2]  Build, sign and publish an over-the-air release\n  publish --dry-run [--out d] Check a release offline: build and sign, write nothing remote\n  promote [--to b1,b2]        Widen a staged release to more bands (same release, new signature)\n  promote --dry-run           Preview a promote, write nothing\n  auto-halt [--threshold 0.2 --min-reports 20 | --off]  Show, turn on or turn off auto-halt\n  rollback --to <release>     Republish an earlier release as a new release\n  rollback --to <n> --dry-run Preview a rollback, write nothing\n  app create | list | delete  Register, list or remove apps on the hosted control plane\n  login                       Sign in with GitHub and get a key for the hosted simulator\n  store details --dry-run     Draft Play Data safety answers and a privacy policy from shipvo.json\n  status [--app id] [--json]  Show how the newest releases are doing on phones\n  doctor [--port <n>]         Check setup before first publish\n  keys                        Show the stored key's status and quota\n  keys export [--out f]       Print or save this app's signing seed, to back it up\n  keys import [seed|--file f] Restore the signing seed on a new machine\n  mcp                         Print the MCP config that agents need\n\nAdvanced\n  keygen [--out seed.txt]     Create an Ed25519 signing key and print the public key\n  pubkey                      Print the public key for SHIPVO_SIGNING_SEED\n  hash <file>                 Print the SHA-256 and size of a file\n  sign-file <file>            Print the Ed25519 signature (base64) of a file\n  sign-json <file.json>       Sign a JSON document and write the signature into it\n  verify <pointer> [public-key-b64]\n                              Check a release pointer (such as one from publish --dry-run)\n  verify-json <file.json> <public-key-b64>\n                              Check the signature of a JSON document\n";
+export declare const COMMANDS: readonly ["init", "sim", "run", "explore", "preview", "publish", "promote", "auto-halt", "rollback", "app", "eas", "login", "doctor", "store", "ci", "status", "agents", "audit", "test", "keys", "mcp", "keygen", "pubkey", "hash", "sign-file", "sign-json", "verify-json", "verify"];
+export declare const help = "shipvo <command>\n\nStart\n  init <dir>                  Create a new app wired to Shipvo\n  sim [--port 4545]           Build the app and run it in the simulator\n  sim --watch [--verbose]     Rebuild on file changes and keep serving; --verbose shows full build errors\n                              First run installs playwright and, if no Chrome or Edge is found, downloads Chromium once.\n                              Set SHIPVO_NO_AUTO_INSTALL=1 to turn the automatic installs off.\n  run android|ios [--no-open] [--port n]  Open the app in a phone frame in your browser (no Playwright)\n  run android|ios --native    Run on an emulator or simulator with npx expo run:android / run:ios\n  explore [--max-depth 3] [--max-steps 100] [--fail-on-findings]  Walk the app in the simulator, write explore-report.md and .json\n  preview [--json]            Publish a public 24-hour preview link (here.now, no account)\n\nShip\n  publish [--bands b0,b1,b2] [--release N]  Build, sign and publish an over-the-air release\n  publish --dry-run [--out d] Check a release offline: build and sign, write nothing remote\n  promote [--to b1,b2]        Widen a staged release to more bands (same release, new signature)\n  promote --dry-run           Preview a promote, write nothing\n  promote --report <file>     Refuse to widen when the test report has a failing flow for this release\n  auto-halt [--threshold 0.2 --min-reports 20 | --off]  Show, turn on or turn off auto-halt\n  rollback --to <release>     Republish an earlier release as a new release\n  rollback --to <n> --dry-run Preview a rollback, write nothing\n  app create | list | delete  Register, list or remove apps on the hosted control plane\n  eas setup [--dry-run] [--run]  Make a Capacitor repo ready for eas build and submit (your own Expo account)\n  eas build [args]            Link the iOS scheme, then run eas build\n  login                       Sign in with GitHub and get a key for the hosted simulator\n  store details --dry-run     Draft Play Data safety answers and a privacy policy from shipvo.json\n  store setup [--company yes|no] [--android-now] [--play-account-before-2023-11-13]\n                              Pick the store accounts to open and write store-plan.json\n  store screenshots [--out dir] [--sim url]\n                              Render each route at store sizes (fast mode: simulator, not the native UI)\n  store testers [--package id] [--track alpha] [--play-key file] [--json]\n                              Steps to get your 12 testers; add the Shipvo Testers group to the closed track\n  store status [--mark <step> [--as waiting|done]]\n                              Show each store's steps and what to do next\n  ci init --framework capacitor [--dry-run] [--force]\n                              Write .github/workflows/shipvo-build.yml (signed Android and iOS builds)\n  status [--app id] [--json]  Show how releases do; --json lists what to do next (exit 0 ok, 1 action needed, 2 error)\n  agents setup [--dry-run] [--json]  Write AGENTS.md section and .mcp.json for AI agents\n  audit <app> [--format json|csv] [--limit n]  Export the audit log to stdout\n  test [files] [--repair [--write]] [--report <file> [--release <id>]]  Run tests/*.steps; --repair shows a diff for broken steps, --write saves it; --report writes JSON results keyed by commit and release\n  doctor [--port <n>]         Check setup before first publish\n  keys                        Show the stored key's status and quota\n  keys export [--out f]       Print or save this app's signing seed, to back it up\n  keys import [seed|--file f] Restore the signing seed on a new machine\n  mcp                         Print the MCP config that agents need\n\nAdvanced\n  keygen [--out seed.txt]     Create an Ed25519 signing key and print the public key\n  pubkey                      Print the public key for SHIPVO_SIGNING_SEED\n  hash <file>                 Print the SHA-256 and size of a file\n  sign-file <file>            Print the Ed25519 signature (base64) of a file\n  sign-json <file.json>       Sign a JSON document and write the signature into it\n  verify <pointer> [public-key-b64]\n                              Check a release pointer (such as one from publish --dry-run)\n  verify-json <file.json> <public-key-b64>\n                              Check the signature of a JSON document\n";
 export declare function distance(a: string, b: string): number;
 /** Closest command within edit distance 2, or undefined. */
 export declare function suggest(input: string): string | undefined;

package/dist/help.js

@@ -1,5 +1,5 @@
 export const COMMANDS = [
-    "init", "sim", "preview", "publish", "promote", "auto-halt", "rollback", "app", "login", "doctor", "store", "status", "keys", "mcp",
+    "init", "sim", "run", "explore", "preview", "publish", "promote", "auto-halt", "rollback", "app", "eas", "login", "doctor", "store", "ci", "status", "agents", "audit", "test", "keys", "mcp",
     "keygen", "pubkey", "hash", "sign-file", "sign-json", "verify-json", "verify",
 ];
 export const help = `shipvo <command>
@@ -8,20 +8,41 @@ Start
   init <dir>                  Create a new app wired to Shipvo
   sim [--port 4545]           Build the app and run it in the simulator
   sim --watch [--verbose]     Rebuild on file changes and keep serving; --verbose shows full build errors
+                              First run installs playwright and, if no Chrome or Edge is found, downloads Chromium once.
+                              Set SHIPVO_NO_AUTO_INSTALL=1 to turn the automatic installs off.
+  run android|ios [--no-open] [--port n]  Open the app in a phone frame in your browser (no Playwright)
+  run android|ios --native    Run on an emulator or simulator with npx expo run:android / run:ios
+  explore [--max-depth 3] [--max-steps 100] [--fail-on-findings]  Walk the app in the simulator, write explore-report.md and .json
   preview [--json]            Publish a public 24-hour preview link (here.now, no account)
 
 Ship
-  publish [--bands b0,b1,b2]  Build, sign and publish an over-the-air release
+  publish [--bands b0,b1,b2] [--release N]  Build, sign and publish an over-the-air release
   publish --dry-run [--out d] Check a release offline: build and sign, write nothing remote
   promote [--to b1,b2]        Widen a staged release to more bands (same release, new signature)
   promote --dry-run           Preview a promote, write nothing
+  promote --report <file>     Refuse to widen when the test report has a failing flow for this release
   auto-halt [--threshold 0.2 --min-reports 20 | --off]  Show, turn on or turn off auto-halt
   rollback --to <release>     Republish an earlier release as a new release
   rollback --to <n> --dry-run Preview a rollback, write nothing
   app create | list | delete  Register, list or remove apps on the hosted control plane
+  eas setup [--dry-run] [--run]  Make a Capacitor repo ready for eas build and submit (your own Expo account)
+  eas build [args]            Link the iOS scheme, then run eas build
   login                       Sign in with GitHub and get a key for the hosted simulator
   store details --dry-run     Draft Play Data safety answers and a privacy policy from shipvo.json
-  status [--app id] [--json]  Show how the newest releases are doing on phones
+  store setup [--company yes|no] [--android-now] [--play-account-before-2023-11-13]
+                              Pick the store accounts to open and write store-plan.json
+  store screenshots [--out dir] [--sim url]
+                              Render each route at store sizes (fast mode: simulator, not the native UI)
+  store testers [--package id] [--track alpha] [--play-key file] [--json]
+                              Steps to get your 12 testers; add the Shipvo Testers group to the closed track
+  store status [--mark <step> [--as waiting|done]]
+                              Show each store's steps and what to do next
+  ci init --framework capacitor [--dry-run] [--force]
+                              Write .github/workflows/shipvo-build.yml (signed Android and iOS builds)
+  status [--app id] [--json]  Show how releases do; --json lists what to do next (exit 0 ok, 1 action needed, 2 error)
+  agents setup [--dry-run] [--json]  Write AGENTS.md section and .mcp.json for AI agents
+  audit <app> [--format json|csv] [--limit n]  Export the audit log to stdout
+  test [files] [--repair [--write]] [--report <file> [--release <id>]]  Run tests/*.steps; --repair shows a diff for broken steps, --write saves it; --report writes JSON results keyed by commit and release
   doctor [--port <n>]         Check setup before first publish
   keys                        Show the stored key's status and quota
   keys export [--out f]       Print or save this app's signing seed, to back it up

package/dist/init.js

@@ -97,7 +97,7 @@ export async function init(argv) {
             react: SDK.react, "react-dom": SDK.react, "react-native": SDK.rn, "react-native-web": SDK.rnw,
             "@shipvo/device": "^0.1.0", "@shipvo/runtime": "^0.1.0",
         },
-        devDependencies: { "@shipvo/cli": "^0.1.0", "@shipvo/sim": "^0.1.0", "@shipvo/test": "^0.1.0", "@types/react": "~19.3.0", playwright: "^1.63.0", typescript: "~6.0.3", vitest: "^2.1.4" },
+        devDependencies: { "@shipvo/cli": "^0.1.0", "@shipvo/sim": "^0.1.0", "@shipvo/test": "^0.1.0", "@types/react": "~19.3.0", playwright: ">=1.63.0 <1.65.0", typescript: "~6.0.3", vitest: "^2.1.4" },
     }, null, 2) + "\n");
     w("app.json", JSON.stringify({ expo: {
             name, slug: appId, version: "1.0.0", orientation: "portrait", userInterfaceStyle: "automatic",
@@ -133,7 +133,7 @@ export const RELEASE = { headline: "Hello from ${name}.", note: "Edit src/releas
         w("App.tsx", SHOP_APP_TSX(name));
         w("src/cart.tsx", SHOP_CART_STATE);
         w("src/money.ts", SHOP_MONEY);
-        w("src/data/shop.json", SHOP_CONFIG);
+        w("src/data/shop.json", SHOP_CONFIG(name));
         w("src/screens/List.tsx", SHOP_LIST);
         w("src/screens/Detail.tsx", SHOP_DETAIL);
         w("src/screens/Cart.tsx", SHOP_CART);
@@ -158,14 +158,14 @@ Publish: shipvo login, then shipvo app create (hosted), or set CLOUDFLARE_API_TO
          (self-hosting instead? see docs/self-hosting.md)
 AI agents: npx -y @shipvo/mcp points Claude / Cursor / ChatGPT at the simulator; then open_app("${appId}")
 
-Install first: npm install (or pnpm / bun), then npx playwright install chromium
-
 Next steps:
   1. cd ${dirArg}
-  2. npx shipvo doctor             # setup checks
-  3. npm run sim                   # open the app in the simulator on http://localhost:4545
-  4. npx shipvo publish --dry-run  # see what a release would contain
-  5. npx shipvo preview            # get a link you can open on any phone
+  2. npm install                   # or pnpm install / bun install; needed before any shipvo command
+  3. npx shipvo sim                # open the app on a simulated phone in your browser
+  4. npx shipvo doctor             # setup checks
+  5. npx shipvo app create ${appId}   # register the app (run npx shipvo login first)
+  6. npx shipvo publish            # send your first update
+  7. npx shipvo preview            # get a link you can open on any phone
 `);
 }
 const APP_TSX = (name, appId) => `import { useEffect, useRef, useState } from "react";
@@ -482,7 +482,7 @@ const SHOP_DATA = JSON.stringify([
     { id: "wool-beanie", name: "Wool beanie", price: 2400, description: "A warm hat in undyed wool." },
     { id: "steel-bottle", name: "Steel bottle", price: 2900, description: "A one litre bottle with a screw cap." },
 ], null, 2) + "\n";
-const SHOP_CONFIG = JSON.stringify({ currency: "$", code: "USD", position: "before", decimals: 2, locale: "en-US" }, null, 2) + "\n";
+const SHOP_CONFIG = (name) => JSON.stringify({ name, currency: "$", code: "USD", position: "before", decimals: 2, locale: "en-US" }, null, 2) + "\n";
 const SHOP_MONEY = `// Prices are whole minor units (cents) in src/data/products.json. This is the one place that turns them into text.
 // To change the currency, edit src/data/shop.json. "code" is the ISO 4217 code sent to the payment provider ("$" is only a symbol). For FCFA: { "currency": "FCFA", "code": "XAF", "position": "after", "decimals": 0, "locale": "fr-FR" }
 import shop from "./data/shop.json";
@@ -496,6 +496,9 @@ export const formatPrice = (minor: number) => {
   return position === "after" ? num + " " + currency : currency + num;
 };
 
+// The payee shown on the payment sheet and the receipt. It is "name" in shop.json.
+export const shopName = (shop as { name?: string }).name ?? "Shop";
+
 // What device.pay.charge takes: "amount" is in whole currency units (10710 for 10710 FCFA, 12.5 for $12.50), as in the device docs.
 // Prices are minor units, so divide by 10 ** decimals. "currency" is the ISO code from shop.json.
 export const chargeRequest = (minor: number) => {
@@ -538,6 +541,15 @@ import products from "./src/data/products.json";
 
 type Route = { name: "list" } | { name: "detail"; id: string } | { name: "cart" };
 
+// Send a placed order to the backend. The simulator records it, so end_session lists it. Add your own backend call here.
+async function sendOrder(order: Record<string, unknown>) {
+  try {
+    const st = Runtime.getState();
+    if (!st?.baseUrl) return;
+    await fetch(st.baseUrl + "/o/" + st.appId, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ order, release: st.runningRelease ?? 0 }) });
+  } catch {}
+}
+
 export default function App() {
   const [route, setRoute] = useState<Route>({ name: "list" });
   // Tell the runtime the first screen rendered, so this release is kept.
@@ -560,7 +572,7 @@ export default function App() {
     <CartProvider>
       <View style={s.root}>
         <StatusBar style="dark" />
-        {route.name === "cart" ? <Cart onBack={toList} />
+        {route.name === "cart" ? <Cart onBack={toList} onOrder={sendOrder} />
           : product ? <Detail product={product} onBack={toList} onCart={toCart} />
           : <List title="${name}" products={products} onOpen={(id) => setRoute({ name: "detail", id })} onCart={toCart} />}
       </View>
@@ -637,10 +649,10 @@ const SHOP_CART = `import { useState } from "react";
 import { Pressable, ScrollView, StyleSheet, Text, View } from "react-native";
 import { device } from "@shipvo/device";
 import { useCart } from "../cart";
-import { chargeRequest, formatPrice } from "../money";
+import { chargeRequest, formatPrice, shopName } from "../money";
 import products from "../data/products.json";
 
-export function Cart({ onBack }: { onBack: () => void }) {
+export function Cart({ onBack, onOrder }: { onBack: () => void; onOrder?: (order: Record<string, unknown>) => void | Promise<void> }) {
   const { lines, remove, clear, totalCents } = useCart();
   const [status, setStatus] = useState<string | null>(null);
   const [busy, setBusy] = useState(false);
@@ -650,8 +662,13 @@ export function Cart({ onBack }: { onBack: () => void }) {
     setBusy(true);
     setStatus("Paying...");
     try {
-      const r = await device.pay.charge({ provider: "mobile_money", ...chargeRequest(totalCents), to: "My Shop", reference: "order-" + Date.now() }, "1234");
-      if (r.ok) { clear(); setStatus("Order placed"); } else setStatus("Payment failed: " + r.reason);
+      const reference = "order-" + Date.now();
+      const r = await device.pay.charge({ provider: "mobile_money", ...chargeRequest(totalCents), to: shopName, reference }, "1234");
+      if (r.ok) {
+        // Only a paid order is sent to the backend.
+        await onOrder?.({ id: reference, total: totalCents, payment: "mobile_money", receipt: r.receipt, lines: lines.map((l) => ({ product_id: l.id, quantity: l.qty })) });
+        clear(); setStatus("Order placed");
+      } else setStatus("Payment failed: " + r.reason);
     } catch (e: any) { setStatus("Payment failed: " + String(e?.message ?? e)); }
     finally { setBusy(false); }
   };

package/dist/policy.d.ts

@@ -1,18 +1,4 @@
-import { Band, type ShipvoPolicy } from "@shipvo/schema";
-type BandName = ReturnType<typeof Band.parse>;
-export type PolicyResult = {
-    ok: true;
-} | {
-    ok: false;
-    rule: string;
-    reason: string;
-};
-/** Checks one publish against the policy. Pure: `now` is read in local time. No policy means no rules. */
-export declare function checkPolicy(policy: ShipvoPolicy | undefined, ctx: {
-    band: BandName;
-    actorKind: "human" | "agent";
-    now: Date;
-}): PolicyResult;
+import { checkPolicy, type PolicyResult } from "@shipvo/schema";
+export { checkPolicy, type PolicyResult };
 /** Reads the `policy` value from a parsed shipvo.json (throws naming the bad field) and checks it. The widest band in `bands` counts. */
 export declare function checkPublishPolicy(rawPolicy: unknown, bands: string[], now?: Date, env?: NodeJS.ProcessEnv): PolicyResult;
-export {};

package/dist/policy.js

@@ -1,22 +1,6 @@
-import { Band, parsePolicy } from "@shipvo/schema";
+import { Band, checkPolicy, parsePolicy } from "@shipvo/schema";
 const ORDER = ["b0", "b1", "b2"];
-const DAYS = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"]; // Date#getDay order
-/** Checks one publish against the policy. Pure: `now` is read in local time. No policy means no rules. */
-export function checkPolicy(policy, ctx) {
-    if (!policy)
-        return { ok: true };
-    const { band, actorKind, now } = ctx;
-    if (policy.maxBand && ORDER.indexOf(band) > ORDER.indexOf(policy.maxBand))
-        return { ok: false, rule: "maxBand", reason: `this publish reaches ${band}, but policy.maxBand is ${policy.maxBand}` };
-    if (actorKind === "agent" && policy.agentMaxBand && ORDER.indexOf(band) > ORDER.indexOf(policy.agentMaxBand))
-        return { ok: false, rule: "agentMaxBand", reason: `an agent-run publish reaches ${band}, but policy.agentMaxBand is ${policy.agentMaxBand}` };
-    if (policy.blockedWeekdays) {
-        const day = DAYS[now.getDay()], from = policy.blockedAfterHour ?? 0;
-        if (policy.blockedWeekdays.includes(day) && now.getHours() >= from)
-            return { ok: false, rule: "blockedWeekdays", reason: `publishing is blocked on ${day} from ${String(from).padStart(2, "0")}:00 local time (policy.blockedWeekdays${policy.blockedAfterHour !== undefined ? ", policy.blockedAfterHour" : ""})` };
-    }
-    return { ok: true };
-}
+export { checkPolicy };
 /** Reads the `policy` value from a parsed shipvo.json (throws naming the bad field) and checks it. The widest band in `bands` counts. */
 export function checkPublishPolicy(rawPolicy, bands, now = new Date(), env = process.env) {
     if (rawPolicy === undefined)

package/dist/preview-recorder.d.ts

@@ -0,0 +1 @@
+export declare const RECORDER_JS: string;

package/dist/preview-recorder.js

@@ -0,0 +1,62 @@
+// The recorder that runs inside the preview frame page. It is plain browser JavaScript kept as a string,
+// so `shipvo preview` can inline it. `shipvoExport` mirrors `exportTest` in packages/mcp/src/export.ts;
+// a test keeps the two outputs identical.
+export const RECORDER_JS = String.raw `
+var shipvoSteps=[];
+function shipvoQ(s){return JSON.stringify(s).replace(new RegExp("\\u2028","g"),"\\\\u2028").replace(new RegExp("\\u2029","g"),"\\\\u2029")}
+function shipvoOneLine(s){return s.replace(new RegExp("[\\r\\n\\u2028\\u2029]+","g")," ")}
+function shipvoEnv(l){return "SHIPVO_TEST_"+(l.replace(/[^A-Za-z0-9]+/g,"_").replace(/^_+|_+$/g,"").toUpperCase()||"FIELD")}
+function shipvoLine(s){
+  var t=s.target;
+  if(s.action==="note")return ["// "+shipvoOneLine(s.text||"")];
+  if(s.action==="set_device")return ["await phone.device.set("+shipvoQ(s.device||{})+");"];
+  if(s.action==="back")return ["await phone.back();"];
+  if(s.action==="scroll")return ["await phone.scroll("+shipvoQ(["down","up","left","right"].indexOf(s.direction)>=0?s.direction:"down")+");"];
+  if(s.action==="tap"){
+    if(!t)return ["// TODO: tap without a target"];
+    if(t.matches>1)return ["// TODO: ambiguous target "+shipvoOneLine(shipvoQ(t.text))];
+    return ["await phone.tap("+shipvoQ(t.text)+");"];
+  }
+  if(s.action==="type"){
+    var label=s.fieldLabel||(t&&t.text);
+    if(!label)return ["// TODO: type without a field label"];
+    if(t&&t.matches>1)return ["// TODO: ambiguous target "+shipvoOneLine(shipvoQ(label))];
+    return ["await phone.type("+shipvoQ(label)+", "+(s.passwordLike?"process.env."+shipvoEnv(label)+"!":shipvoQ(s.text||""))+");"];
+  }
+  return [];
+}
+function shipvoExport(app,steps,title){
+  var out=['import { test } from "@shipvo/test/vitest";','import { openApp } from "@shipvo/test";','','test('+shipvoQ("recorded session for "+(title||app))+', async () => {','  const phone = await openApp({ app: '+shipvoQ(app)+' });'];
+  steps.forEach(function(s){
+    var lines=shipvoLine(s);
+    lines.forEach(function(l){out.push("  "+l)});
+    if(s.changed&&lines.length&&lines[0].indexOf("//")!==0&&s.action!=="open")out.push("  await phone.waitFor(/\\S/); // TODO: name the text that should appear");
+  });
+  out.push("});","");
+  return out.join("\n");
+}
+function shipvoLabel(el){
+  var l=el.getAttribute("aria-label")||(el.labels&&el.labels[0]&&el.labels[0].textContent)||el.getAttribute("placeholder")||el.textContent||"";
+  return l.replace(/\s+/g," ").trim();
+}
+function shipvoCount(doc,label){
+  var n=0;doc.querySelectorAll("button,a,[role=button],[role=link],[role=tab],input,textarea,[aria-label]").forEach(function(e){if(shipvoLabel(e)===label)n++});
+  return n;
+}
+function shipvoAttach(frame,onStep){
+  var doc=frame.contentDocument;if(!doc||doc.__shipvoAttached)return;
+  doc.__shipvoAttached=true;
+  var sel="button,a,[role=button],[role=link],[role=tab],[role=switch],[role=checkbox]";
+  doc.addEventListener("click",function(e){
+    var el=e.target&&e.target.closest&&e.target.closest(sel);
+    if(!el||el.matches("input,textarea"))return;
+    var text=shipvoLabel(el);if(!text){onStep({action:"note",text:"TODO: tap without a label"});return}
+    onStep({action:"tap",target:{text:text,role:el.getAttribute("role")||el.tagName.toLowerCase(),matches:shipvoCount(doc,text)},changed:true});
+  },true);
+  doc.addEventListener("change",function(e){
+    var el=e.target;if(!el||!/^(INPUT|TEXTAREA)$/.test(el.tagName))return;
+    var label=shipvoLabel(el);if(!label)return;
+    onStep({action:"type",fieldLabel:label,text:el.value,passwordLike:el.type==="password",target:{text:label,role:"textbox",matches:shipvoCount(doc,label)}});
+  },true);
+}
+`;

package/dist/preview.d.ts

@@ -20,10 +20,10 @@ export declare const blockedPath: (rel: string) => boolean;
 export declare function refuseSecrets(files: PreviewFile[], secrets?: string[]): void;
 /** Reads a build folder into upload entries, skipping files that must never be uploaded. */
 export declare function collectFiles(dir: string): PreviewFile[];
-/** The page people open: the app in an Android or iPhone frame, with skin, size and theme switches and a back control. */
-export declare function framePage(name: string): string;
+/** The page people open: the app in an Android or iPhone frame, with skin, size and theme switches, a back control and a recorder panel. */
+export declare function framePage(name: string, appId?: string): string;
 /** Puts the frame page at index.html and the app's own entry at app.html (its asset paths are absolute, so it stays at the site root). */
-export declare function wrapBuild(buildDir: string, name: string): PreviewFile[];
+export declare function wrapBuild(buildDir: string, name: string, appId?: string): PreviewFile[];
 /** Publishes to here.now anonymously: create, upload, finalize. Refreshes expired upload URLs and waits out 429s. */
 export declare function publishToHereNow(files: PreviewFile[], o?: PreviewOpts): Promise<PreviewResult>;
 export declare const NOTICE = "This link is public: anyone who has it can open the preview. It expires in 24 hours unless you open the claim link and sign in to here.now, which keeps it.";

package/dist/preview.js

@@ -4,6 +4,7 @@ import { spawn } from "node:child_process";
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync } from "node:fs";
 import { join, relative, sep, extname } from "node:path";
 import { args as parse, loadConfig } from "./config.js";
+import { RECORDER_JS } from "./preview-recorder.js";
 const API = "https://here.now/api/v1";
 const CLIENT = "shipvo/cli";
 const TYPES = {
@@ -72,8 +73,8 @@ export function collectFiles(dir) {
     walk(dir);
     return out;
 }
-/** The page people open: the app in an Android or iPhone frame, with skin, size and theme switches and a back control. */
-export function framePage(name) {
+/** The page people open: the app in an Android or iPhone frame, with skin, size and theme switches, a back control and a recorder panel. */
+export function framePage(name, appId = name) {
     const title = name.replace(/[<>&"']/g, "");
     return `<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
@@ -85,7 +86,7 @@ body.dark{background:#15171a;color:#eee}
 .bar{display:flex;gap:8px;justify-content:center;align-items:center;padding:10px;flex-wrap:wrap}
 .bar button,.back{font:inherit;padding:6px 12px;border:1px solid #888;border-radius:8px;background:transparent;color:inherit;cursor:pointer}
 .bar button[aria-pressed=true]{background:#2563eb;border-color:#2563eb;color:#fff}
-.stage{display:flex;justify-content:center;padding:0 10px 20px}
+.stage{display:flex;justify-content:center;align-items:flex-start;gap:16px;padding:0 10px 20px;flex-wrap:wrap}
 .device{display:flex;flex-direction:column;background:#000;color:#fff;border-radius:28px;box-shadow:0 8px 30px #0005;overflow:hidden;width:360px;max-width:100%;box-sizing:border-box;padding:0 6px}
 .device[data-skin=iphone]{border-radius:44px;padding:0 10px}
 .status{display:flex;justify-content:space-between;align-items:center;height:28px;padding:0 14px;font-size:12px;flex:none}
@@ -103,42 +104,138 @@ iframe{border:0;background:#fff;width:100%;flex:1;min-height:0;display:block}
 .device[data-skin=iphone] .back::after{content:"";position:absolute;left:0;right:0;top:50%;height:5px;margin-top:-2px;border-radius:3px;background:#fff}
 .back:focus-visible{outline:2px solid #fff;outline-offset:2px}
 .device[data-skin=android] .back{border:0}
+.side{max-width:360px;margin:0 auto 20px;padding:0 10px;box-sizing:border-box}
+.side h2{font-size:14px;margin:0 0 6px}.side ol{padding-left:20px;margin:6px 0}.side li{margin-bottom:6px}.side small{opacity:.7}
+.side button,.side input{font:inherit}
+.side input{width:100%;box-sizing:border-box;min-height:36px;background:transparent;color:inherit;border:1px solid #888;border-radius:6px;padding:4px 8px;margin:4px 0}
+body.dark .side input{background:#15171a;color:#eee}body.dark .side small{opacity:.85}
+.fab{position:fixed;right:12px;bottom:12px;z-index:10;min-width:44px;min-height:44px;padding:8px 14px;font:inherit;border:1px solid #888;border-radius:22px;background:#fff;color:#111;cursor:pointer;box-shadow:0 2px 8px #0004}
+.fab[aria-pressed=true]{background:#2563eb;border-color:#2563eb;color:#fff}
+.fab:focus-visible{outline:3px solid #f59e0b;outline-offset:2px}
+body.dark .fab{background:#2a2d31;color:#eee}body.dark .fab[aria-pressed=true]{background:#2563eb;color:#fff}
+.device{position:relative}
+#pin{position:absolute;inset:0;display:none;cursor:crosshair;background:#2563eb22;z-index:5}
+#pin.on{display:block}
+#pin .hint{position:absolute;left:8px;right:8px;top:8px;padding:6px 8px;border-radius:6px;background:#111;color:#fff;font-size:13px;text-align:center}
 .note{text-align:center;opacity:.7;padding:0 12px 16px}
-@media (max-width:500px){.bar,.note{display:none}.stage{padding:0}.device{padding:0!important;width:100vw!important;height:100vh!important;height:100dvh!important;border-radius:0!important;box-shadow:none}}
+.recp a{color:inherit;text-decoration:underline}body.dark .recp a{color:#93c5fd}.recp button:focus-visible,.bar button:focus-visible,.recp a:focus-visible{outline:2px solid #60a5fa;outline-offset:2px}
+.recp{max-width:520px;margin:0 auto;padding:0 12px 24px;text-align:center}.recp p{opacity:.8}.recp button{font:inherit;padding:6px 12px;border:1px solid #888;border-radius:8px;background:transparent;color:inherit;cursor:pointer}
+.panel{width:280px;max-width:100%;box-sizing:border-box;display:grid;gap:10px;padding:12px;border:1px solid #8886;border-radius:12px}
+.panel h2{font-size:15px;margin:0}.panel fieldset{border:0;margin:0;padding:0;display:grid;gap:6px}.panel legend{font-weight:600;padding:0 0 4px}
+.panel .row{display:flex;gap:6px;flex-wrap:wrap}.panel input,.panel select,.panel button{font:inherit;padding:5px 8px;border:1px solid #888;border-radius:8px;background:transparent;color:inherit;min-width:0}
+body.dark .panel select,body.dark .panel option{background:#15171a;color:#eee}.panel button[aria-pressed=true]{background:#2563eb;border-color:#2563eb;color:#fff}.panel input{flex:1 1 80px}.panel button{cursor:pointer}.panel .sim{opacity:.7;font-size:12px;margin:0}
+@media (max-width:500px){.bar,.note{display:none}.stage{padding:0;display:block}.panel{width:auto;margin:10px;max-width:none}.device{padding:0!important;width:100vw!important;height:100vh!important;height:100dvh!important;border-radius:0!important;box-shadow:none}}
 </style></head><body>
 <div class="bar" role="toolbar" aria-label="Preview options">
 <button data-skin="android" aria-pressed="true">Android</button><button data-skin="iphone" aria-pressed="false">iPhone</button>
 <button data-size="phone" aria-pressed="true">Phone</button><button data-size="large" aria-pressed="false">Large phone</button><button data-size="tablet" aria-pressed="false">Tablet</button>
 <button id="theme" aria-pressed="false">Dark</button></div>
+<button id="comment" class="fab" aria-pressed="false">Comment</button>
 <div class="stage"><div class="device" id="device" data-skin="android" style="width:360px;height:760px">
 <div class="status" id="status"><span id="clock">9:41</span><span class="notch"></span><span class="icons" id="icons">&#9679;&#9679; 5G 100%</span></div>
-<iframe id="app" src="app.html" title="${title}"></iframe>
+<iframe id="app" src="app.html" title="${title}"></iframe><div id="pin" role="button" tabindex="0" aria-label="Tap where the problem is, or press Enter to mark the centre of the device"><span class="hint">Tap where the problem is. Press Escape to cancel.</span></div>
 <div class="nav"><button class="back" id="back" aria-label="Back" title="Back">&#9664; Back</button></div>
-</div></div>
+</div>
+<aside class="panel" id="device-panel" aria-label="Device controls"><h2>Device</h2>
+<fieldset><legend>Location</legend><div class="row"><select data-control="location-list" aria-label="Place"><option value="4.0511,9.7679">Douala</option><option value="48.8566,2.3522">Paris</option><option value="40.7128,-74.006">New York</option><option value="-1.2921,36.8219">Nairobi</option></select><button data-control="location-set">Set</button></div>
+<div class="row"><input data-control="lat" placeholder="Latitude" inputmode="decimal" aria-label="Latitude"><input data-control="lng" placeholder="Longitude" inputmode="decimal" aria-label="Longitude"><button data-control="coords-set">Go</button></div></fieldset>
+<fieldset><legend>Camera</legend><div class="row"><select data-control="camera-list" aria-label="Barcode"><option value="ean13|6181234567890">EAN-13 6181234567890</option><option value="qr|https://example.com">QR https://example.com</option><option value="none|">Nothing in view</option></select><button data-control="camera-set">Show</button></div></fieldset>
+<fieldset><legend>Fingerprint / Face ID</legend><div class="row"><button data-control="bio-success">Match</button><button data-control="bio-fail">No match</button></div></fieldset>
+<fieldset><legend>Payment</legend><div class="row"><button data-control="pay-approve">Approve</button><button data-control="pay-decline">Decline</button></div></fieldset>
+<fieldset><legend>Network</legend><div class="row"><button data-control="net-online">Online</button><button data-control="net-slow">Slow</button><button data-control="net-offline">Offline</button></div></fieldset>
+<fieldset><legend>Push notification</legend><input data-control="push-title" placeholder="Title" aria-label="Title"><input data-control="push-body" placeholder="Body" aria-label="Body"><button data-control="push-send">Send</button></fieldset>
+<p class="sim" id="panel-status" role="status">All device events here are simulated.</p></aside>
+</div>
+<div class="side" id="side"><h2>Comments (<span id="count">0</span>)</h2>
+<form id="noteform" hidden><label for="notetext">Note for the point you tapped</label><br><input id="notetext"> <button type="submit">Save</button></form><span id="notesaved" role="status"></span>
+<ol id="notelist"></ol>
+<button id="export">Export comments.json</button>
+<p><small>Notes live in this browser until you export them. Nothing is uploaded.</small></p></div>
 <p class="note">${title}: simulated device, public preview. System sheets such as permissions and payments are simulated.</p>
-<script>
+<script data-notes>
+(function(){
+var KEY="shipvo-preview-comments",steps=[],pending=null,notes=[];
+function $(id){return document.getElementById(id)}
+try{notes=JSON.parse(localStorage.getItem(KEY)||"[]");if(!Array.isArray(notes))notes=[]}catch(e){notes=[]}
+function save(){try{localStorage.setItem(KEY,JSON.stringify(notes))}catch(e){}}
+function esc(t){return String(t).replace(/[&<>"']/g,function(c){return"&#"+c.charCodeAt(0)+";"})}
+function screenName(){try{var w=$("app").contentWindow,t=w.document.title,r=w.location.pathname+(w.location.hash||"");return t?t+" ("+r+")":r}catch(e){return"unknown"}}
+function step(text){steps.push(text)}
+function add(note,x,y){var n={note:String(note),x:Math.round(x),y:Math.round(y),screen:screenName(),steps:steps.slice()};notes.push(n);save();render();return n}
+function exportJson(){return JSON.stringify(notes,null,2)}
+function render(){var l=$("notelist"),c=$("count");if(c)c.textContent=notes.length;if(l)l.innerHTML=notes.map(function(n){return"<li>"+esc(n.note)+"<br><small>"+esc(n.screen)+" at "+Number(n.x)+","+Number(n.y)+", "+(n.steps||[]).length+" steps</small></li>"}).join("")}
+function download(){var b=new Blob([exportJson()],{type:"application/json"}),u=URL.createObjectURL(b),a=document.createElement("a");a.href=u;a.download="comments.json";document.body.appendChild(a);a.click();document.body.removeChild(a);URL.revokeObjectURL(u)}
+function label(e){var t=e.getAttribute&&(e.getAttribute("aria-label")||e.textContent)||"";return String(t).trim().slice(0,40)}
+var seen=typeof WeakSet==="function"?new WeakSet():null;
+function watch(){try{var d=$("app").contentWindow.document;if(seen){if(seen.has(d))return;seen.add(d)}d.addEventListener("click",function(ev){var e=ev.target,k=e&&e.closest&&e.closest("button,[role=button],a,input");step("tap "+(k?label(k)||"control":"screen"))},true)}catch(e){}}
+function setMode(on,refocus){var p=$("pin"),b=$("comment");if(p)p.className=on?"on":"";if(b){b.setAttribute("aria-pressed",on);if(refocus&&b.focus)b.focus()}if(on&&p&&p.focus)p.focus()}
+var cb=$("comment");if(cb)cb.onclick=function(){setMode($("pin").className!=="on")};
+function place(x,y){pending={x:x,y:y};setMode(false);$("noteform").hidden=false;if($("notetext").focus)$("notetext").focus()}
+var pin=$("pin");if(pin){pin.onclick=function(ev){var r=pin.getBoundingClientRect?pin.getBoundingClientRect():{left:0,top:0};place(ev.clientX-r.left,ev.clientY-r.top)};
+pin.onkeydown=function(ev){if(ev.key==="Enter"||ev.key===" "){if(ev.preventDefault)ev.preventDefault();var r=pin.getBoundingClientRect?pin.getBoundingClientRect():{width:0,height:0};place((r.width||0)/2,(r.height||0)/2)}}}
+var fm=$("noteform");if(fm)fm.onsubmit=function(ev){if(ev&&ev.preventDefault)ev.preventDefault();var t=$("notetext");if(pending&&t.value.trim()){add(t.value.trim(),pending.x,pending.y)}t.value="";pending=null;fm.hidden=true;var st=$("notesaved");if(st)st.textContent="Saved";setMode(false,true);return false};
+if(document.addEventListener)document.addEventListener("keydown",function(ev){if(ev.key==="Escape"){var was=$("pin")&&$("pin").className==="on",f=$("noteform");if(was||(f&&!f.hidden)){if(f)f.hidden=true;pending=null;setMode(false,true)}}});
+var ex=$("export");if(ex)ex.onclick=download;
+var bk=$("back");if(bk&&bk.addEventListener)bk.addEventListener("click",function(){step("back")});
+var ap=$("app");if(ap){if(ap.addEventListener)ap.addEventListener("load",watch);watch()}
+window.shipvoNotes={add:add,step:step,list:function(){return notes.slice()},exportJson:exportJson,download:download};
+render();
+})();
+</script>
+<section class="recp" aria-label="Recorder"><p id="honesty">This is the app's web build on Shipvo's simulated device, measured against Android and iOS in <a href="https://github.com/shipvo/shipvo/blob/main/docs/parity-results.md">docs/parity-results.md</a>. Native-only UI can differ.</p>
+<button id="rec" aria-pressed="false">Record</button> <button id="dl" disabled>Download test</button> <span id="stepcount" aria-live="polite">0 steps</span></section>
+<script>${RECORDER_JS}
+var APP=${JSON.stringify(appId).replace(/</g, "\\u003c")},TITLE=${JSON.stringify(title).replace(/</g, "\\u003c")},recording=false;
+function step(s){if(recording){shipvoSteps.push(s);document.getElementById("stepcount").textContent=shipvoSteps.length+(shipvoSteps.length===1?" step":" steps");document.getElementById("dl").disabled=false}}
+document.getElementById("app").addEventListener("load",function(){shipvoAttach(this,step)});
+(function(a){if(a.contentDocument&&a.contentDocument.readyState==="complete")shipvoAttach(a,step)})(document.getElementById("app"));
+document.getElementById("rec").onclick=function(){recording=!recording;if(recording){shipvoSteps.length=0;document.getElementById("stepcount").textContent="0 steps";document.getElementById("dl").disabled=true}this.setAttribute("aria-pressed",recording)};
+document.getElementById("dl").onclick=function(){var a=document.createElement("a");a.href=URL.createObjectURL(new Blob([shipvoExport(APP,shipvoSteps,TITLE)],{type:"text/typescript"}));a.download="recorded-session.test.ts";a.click()};
 var SIZES={phone:[360,760],large:[412,892],tablet:[820,1180]},IPHONE={phone:[390,844],large:[430,932],tablet:[820,1180]};
 var skin="android",size="phone",d=document.getElementById("device"),f=document.getElementById("app"),bk=document.getElementById("back");
 function pressed(sel,val,key){document.querySelectorAll(sel).forEach(function(o){o.setAttribute("aria-pressed",o.dataset[key]===val)})}
 function apply(){var s=(skin==="iphone"?IPHONE:SIZES)[size];d.dataset.skin=skin;d.style.width=s[0]+"px";d.style.height=s[1]+"px";bk.innerHTML=skin==="iphone"?"Back":"&#9664; Back";bk.setAttribute("aria-label","Back");document.getElementById("icons").innerHTML=skin==="iphone"?"5G &#9646; 100%":"&#9679;&#9679; 5G 100%";pressed("[data-skin]",skin,"skin");pressed("[data-size]",size,"size")}
-document.querySelectorAll("[data-skin]").forEach(function(b){b.onclick=function(){skin=b.dataset.skin;apply()}});
-document.querySelectorAll("[data-size]").forEach(function(b){b.onclick=function(){size=b.dataset.size;apply()}});
+document.querySelectorAll("[data-skin]").forEach(function(b){b.onclick=function(){step({action:"note",text:"panel: skin set to "+b.dataset.skin});skin=b.dataset.skin;apply()}});
+document.querySelectorAll("[data-size]").forEach(function(b){b.onclick=function(){step({action:"note",text:"panel: size set to "+b.dataset.size});size=b.dataset.size;apply()}});
 // Back does what the simulator's back action does: press the screen's Back button, else go back in history.
 function goBack(){var w=f.contentWindow;try{var doc=w&&w.document;if(!doc)return;var els=doc.querySelectorAll("button,[role=button],a");for(var i=0;i<els.length;i++){var e=els[i],t=(e.getAttribute("aria-label")||e.textContent||"").trim();if(t==="Back"){e.click();return}}w.history.back()}catch(x){}}
 bk.onclick=goBack;
-var t=document.getElementById("theme");t.onclick=function(){var k=!document.body.classList.contains("dark");document.body.classList.toggle("dark",k);t.setAttribute("aria-pressed",k);t.textContent=k?"Light":"Dark";f.style.colorScheme=k?"dark":"light"};
+var t=document.getElementById("theme");t.onclick=function(){step({action:"note",text:"panel: theme toggled"});var k=!document.body.classList.contains("dark");document.body.classList.toggle("dark",k);t.setAttribute("aria-pressed",k);t.textContent=k?"Light":"Dark";f.style.colorScheme=k?"dark":"light"};
+var P=document.getElementById("panel-status");
+function pnSay(m){P.textContent=m+" (simulated)"}
+function pnDev(){var d=f.contentWindow&&f.contentWindow.__pnDevice;if(!d){pnSay("The app is still loading");return null}return d}
+function pnNum(c){var v=pnVal(c).trim();return v===""?NaN:Number(v)}
+function pnVal(c){return document.querySelector('[data-control="'+c+'"]').value}
+function pnSet(patch,msg){var d=pnDev();if(d){d.set(patch);step({action:"set_device",device:patch});pnSay(msg)}}
+var pnDelay=0;
+function pnSlow(){var w=f.contentWindow;if(!w||w.__pnSlow||!w.fetch)return;w.__pnSlow=1;var o=w.fetch.bind(w);w.fetch=function(){var a=arguments;return new Promise(function(r){setTimeout(r,pnDelay)}).then(function(){return o.apply(null,a)})}}
+var A={
+"location-set":function(){var v=pnVal("location-list").split(",");pnSet({location:{latitude:+v[0],longitude:+v[1],accuracy:20}},"Location set")},
+"coords-set":function(){var a=pnNum("lat"),o=pnNum("lng");if(!(a>=-90&&a<=90&&o>=-180&&o<=180)){pnSay("Enter latitude -90 to 90 and longitude -180 to 180");return}pnSet({location:{latitude:a,longitude:o,accuracy:20}},"Location set")},
+"camera-set":function(){var v=pnVal("camera-list").split("|");pnSet({camera:{barcode:v[0]==="none"?null:{type:v[0],data:v.slice(1).join("|")}}},"Camera shows "+(v[0]==="none"?"nothing":v[0]))},
+"bio-success":function(){pnSet({biometrics:{nextResult:"success"}},"Fingerprint and Face ID match from now on")},
+"bio-fail":function(){pnSet({biometrics:{nextResult:"fail"}},"Fingerprint and Face ID do not match from now on")},
+"pay-approve":function(){pnSet({payment:{nextResult:"approve"}},"Payments are approved from now on")},
+"pay-decline":function(){pnSet({payment:{nextResult:"decline"}},"Payments are declined from now on")},
+"net-online":function(){pnDelay=0;pnSet({online:true},"Network online")},
+"net-slow":function(){if(!pnDev())return;pnDelay=1500;pnSlow();pnSet({online:true},"Network slow (requests wait 1.5 s)")},
+"net-offline":function(){pnDelay=0;pnSet({online:false},"Network offline")},
+"push-send":function(){var d=pnDev();if(!d)return;var t=pnVal("push-title")||"Notification",b=pnVal("push-body");var ok=d.push({title:t,body:b})!==null;if(ok)step({action:"note",text:"panel: push sent"});pnSay(ok?"Push sent":"Not delivered: the app has not been granted notification permission")}
+};
+var pnGroups=[["bio-success","bio-fail"],["pay-approve","pay-decline"],["net-online","net-slow","net-offline"]];
+document.querySelectorAll("[data-control]").forEach(function(e){var c=e.dataset.control;if(A[c])e.onclick=function(){A[c]();pnGroups.forEach(function(g){if(g.indexOf(c)<0)return;g.forEach(function(k){var b=document.querySelector('[data-control="'+k+'"]');if(b.setAttribute)b.setAttribute("aria-pressed",k===c)})})}});
 apply();
 </script></body></html>
 `;
 }
 /** Puts the frame page at index.html and the app's own entry at app.html (its asset paths are absolute, so it stays at the site root). */
-export function wrapBuild(buildDir, name) {
+export function wrapBuild(buildDir, name, appId = name) {
     const files = collectFiles(buildDir).filter((f) => f.path !== "index.html");
     const entry = join(buildDir, "index.html");
     if (!existsSync(entry))
         throw new Error("The web build has no index.html. Run `npx expo export --platform web` and check it works.");
     files.push({ path: "app.html", bytes: new Uint8Array(readFileSync(entry)), contentType: typeOf("x.html") });
-    files.push({ path: "index.html", bytes: new TextEncoder().encode(framePage(name)), contentType: typeOf("x.html") });
+    files.push({ path: "index.html", bytes: new TextEncoder().encode(framePage(name, appId)), contentType: typeOf("x.html") });
     return files;
 }
 const realSleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -226,7 +323,7 @@ export async function runPreview(root, o = {}) {
     const dir = o.buildDir ?? join(root, ".shipvo", "preview-build");
     if (!o.skipBuild)
         await build(root, dir);
-    return publishToHereNow(wrapBuild(dir, cfg.name), o);
+    return publishToHereNow(wrapBuild(dir, cfg.name, cfg.appId), o);
 }
 export async function preview(argv) {
     const a = parse(argv);

package/dist/promote.d.ts

@@ -1,7 +1,7 @@
 import { kv as kvFor } from "./config.js";
 type Store = Pick<ReturnType<typeof kvFor>, "get" | "put">;
 export declare const PROMOTE_FLAGS: string[];
-export declare const PROMOTE_HELP = "Usage: shipvo promote [flags]\n\nWiden a staged release to more bands. The release number, bundle and patches stay the same; the pointer is signed again.\n\nFlags (write a value after a space, not =):\n  --to b1,b2                   Bands to write (default: every band with no pointer for this release)\n                               Bands that already hold a newer release are always skipped\n  --platform android|ios|all   Platform to promote (default android)\n  --dry-run                    Print the plan, write nothing\n  --force                      Promote even if the release is halted or has reverts\n  --help                       Show this help\n";
+export declare const PROMOTE_HELP = "Usage: shipvo promote [flags]\n\nWiden a staged release to more bands. The release number, bundle and patches stay the same; the pointer is signed again.\n\nFlags (write a value after a space, not =):\n  --to b1,b2                   Bands to write (default: every band with no pointer for this release)\n                               Bands that already hold a newer release are always skipped\n  --platform android|ios|all   Platform to promote (default android)\n  --dry-run                    Print the plan, write nothing\n  --report <file>              Test report from shipvo test --report (default shipvo-test-report.json if it exists)\n                               A report for this release with failing flows blocks promote\n  --force                      Promote even if the release is halted, has reverts or has a failing test report\n  --help                       Show this help\n";
 export declare function promote(argv: string[], deps?: {
     kv?: Store;
     fetchFn?: typeof fetch;

package/dist/promote.js

@@ -1,11 +1,12 @@
 // `shipvo promote`: widen a staged release to more bands. Reads the pointer on the narrowest band that has one,
 // and writes the same release (same bundle, hashes and patches) to the other bands with a fresh issued_at and signature.
+import { existsSync, readFileSync } from "node:fs";
 import { signBytes } from "./index.js";
 import { args as parse, kv as kvFor, loadConfig, seed } from "./config.js";
 const BANDS = ["b0", "b1", "b2"];
 const REVERT_EVENTS = ["rolled_back", "crash_loop_revert"];
 const pointerKey = (app, major, band, pf) => (pf === "ios" ? `p/${app}/${major}/ios/${band}` : `p/${app}/${major}/${band}`);
-export const PROMOTE_FLAGS = ["to", "platform", "dry-run", "force"];
+export const PROMOTE_FLAGS = ["to", "platform", "dry-run", "force", "report"];
 export const PROMOTE_HELP = `Usage: shipvo promote [flags]
 
 Widen a staged release to more bands. The release number, bundle and patches stay the same; the pointer is signed again.
@@ -15,7 +16,9 @@ Flags (write a value after a space, not =):
                                Bands that already hold a newer release are always skipped
   --platform android|ios|all   Platform to promote (default android)
   --dry-run                    Print the plan, write nothing
-  --force                      Promote even if the release is halted or has reverts
+  --report <file>              Test report from shipvo test --report (default shipvo-test-report.json if it exists)
+                               A report for this release with failing flows blocks promote
+  --force                      Promote even if the release is halted, has reverts or has a failing test report
   --help                       Show this help
 `;
 function checkFlags(argv, known) {
@@ -46,6 +49,9 @@ export async function promote(argv, deps = {}) {
         if (bad.length)
             throw new Error(`Unknown band ${bad.join(", ")}. Bands are ${BANDS.join(", ")}.`);
     }
+    if (a.report === "true")
+        throw new Error("--report needs a file name: pass --report <file>");
+    const reportFile = a.report ?? (existsSync("shipvo-test-report.json") ? "shipvo-test-report.json" : null);
     const APP = cfg.appId, MAJOR = cfg.shellMajor;
     const store = deps.kv ?? kvFor(cfg);
     // Read every source pointer before touching the network or writing anything.
@@ -78,6 +84,27 @@ export async function promote(argv, deps = {}) {
         const targets = cand.filter((b) => !((have.get(b) ?? 0) > release));
         plans.push({ pf, release, from, body, targets, newer });
     }
+    if (reportFile) {
+        let rep;
+        try {
+            rep = JSON.parse(readFileSync(reportFile, "utf8"));
+        }
+        catch (e) {
+            throw new Error(`Could not read the test report ${reportFile} (${e instanceof Error ? e.message : String(e)}).`);
+        }
+        const rel = rep.release == null ? null : String(rep.release);
+        const failing = (Array.isArray(rep.flows) ? rep.flows : []).filter((f) => f.status === "failed").map((f) => f.name ?? "(unnamed flow)");
+        const mine = plans.filter((x) => String(x.release) === rel);
+        if (mine.length && failing.length) {
+            const msg = `Test report ${reportFile} has ${failing.length} failing flow${failing.length === 1 ? "" : "s"} for release ${mine[0].release}: ${failing.join(", ")}.`;
+            if (!force)
+                throw new Error(`${msg} Fix them and run shipvo test --report again, or pass --force to promote anyway.`);
+            console.log(`${msg} Overridden by --force.`);
+        }
+        else if (!mine.length) {
+            console.log(`Warning: test report ${reportFile} is for ${rel === null ? "no release" : `release ${rel}`}, not release ${plans.map((x) => x.release).join(", ")}. It is stale and was not used.`);
+        }
+    }
     if (!force) {
         const base = cfg.controlPlane.replace(/\/$/, "");
         let data;

package/dist/publish.d.ts

@@ -1,4 +1,4 @@
-export declare const PUBLISH_HELP = "Usage: shipvo publish [flags]\n\nBuild, sign and publish an over-the-air release.\n\nFlags (write a value after a space, not =; on/off flags can be bare, or true/false):\n  --bands b0,b1,b2             Cohorts to publish to (default b0,b1,b2)\n  --platform android|ios|all   Platform to publish (default android)\n  --release N                  Release number (default: the next one)\n  --min-shell X.Y.Z            Oldest app shell that can run this release (default: version in app.json)\n  --hermes-bytecode-version V  Refuse bundles built for another Hermes version, for example 96 or 96,98\n  --max-bases N                How many older releases to build patches from (default 6)\n  --skip-export               Reuse the last build in dist-ota/\n  --skip-web                  Do not publish the web copy for the simulator\n  --dry-run                    Build and sign, write files locally, send nothing\n  --out <dir>                  Where --dry-run writes files (default .shipvo/dry-run)\n  --help                       Show this help\n";
+export declare const PUBLISH_HELP = "Usage: shipvo publish [flags]\n\nBuild, sign and publish an over-the-air release.\n\nFlags (write a value after a space, not =; on/off flags can be bare, or true/false):\n  --bands b0,b1,b2             Cohorts to publish to (default b0,b1,b2)\n  --platform android|ios|all   Platform to publish (default android)\n  --release N                  Release number (default: the next one)\n  --min-shell X.Y.Z            Oldest app shell that can run this release (default: version in app.json)\n  --hermes-bytecode-version V  Refuse bundles built for another Hermes version, for example 96 or 96,98\n  --max-bases N                How many older releases to build patches from (default 6)\n  --skip-export               Reuse the last build in dist-ota/\n  --skip-web                  Do not publish the web copy for the simulator\n  --dry-run                    Build and sign, write files locally, send nothing\n  --dry-run-policy             Check the policy in shipvo.json for these --bands, print the result, publish nothing\n  --out <dir>                  Where --dry-run writes files (default .shipvo/dry-run)\n  --help                       Show this help\n";
 export declare function publish(argv: string[]): Promise<void>;
 /** Bytes in plain units: KB below 1 MB, so a small bundle never reads as 0.00 MB. */
 export declare function formatSize(bytes: number): string;