@stackonward/cli 0.0.1 → 1.0.1

package/dist/resources/apple/.claude/docs/architecture-template.md

@@ -0,0 +1,54 @@
+# Delivery Integration Design Template
+
+Use semantic impact to select LOCAL, FOCUSED or ARCHITECTURAL scope. A new provider, shared lifecycle or cross-module credential boundary requires the complete sections below. A correction within an existing adapter uses the relevant subset.
+
+## 1. Architecture Overview
+
+Describe the requested behavior, authoritative source, current owner and exact target state. List every explicit requirement and its acceptance evidence. Distinguish product choices from reusable mechanisms.
+
+## 2. Domain Boundaries
+
+Map stable App/product identity, versioned metadata, build, review and release resources. State the source and uniqueness scope of every identifier. Name owners for runtime authentication, notifications and payment processing.
+
+## 3. Storage and State
+
+Define configuration, private files, bindings, plans, journals and receipts. Identify retention, locks, recovery, unknown-write reconciliation and portability. Document the limits of local concurrency protection.
+
+## 4. Directory and Naming
+
+List exact affected files, existing reuse searches and the location rationale. Keep protocols private to their adapter. Do not add a new package without a real independent importer.
+
+## 5. Contracts
+
+Specify typed inputs, explicit intents, output fields, errors, cancellation and immutable fields. Reject arbitrary provider requests or executable expressions. Include the safe public projection and private request representation.
+
+## 6. Processing
+
+Trace validation, authenticated reads, planning, explicit execution, provider readback and final evidence. Include expired plans, conflicts, pagination, timeouts, partial completion and cancellation after dispatch.
+
+## 7. API and Configuration
+
+Reference exact official methods, paths, request fields, relationships and state enums. Define stage prerequisites, omission/clear semantics and manual requirements. Explain how input changes are detected before effects.
+
+## 8. Integration
+
+Map protocol adapters, build tools, native projects, package distribution and direct consumers. Explain credential ownership and why a new operation cannot affect another app or an unrelated effect class.
+
+## 9. Lifecycle
+
+Define invocation lifetime, temporary resources, signals, local locks and CI serialization. Describe creation, adoption, maintenance and recovery for each resource without claiming transactional rollback.
+
+## 10. Decisions and Evidence
+
+| Decision | Industry pattern and primary source | Choice | Rationale and limits |
+| -------- | ----------------------------------- | ------ | -------------------- |
+
+Record precise provider documentation and meaningful alternatives. Current source and published API contracts are stronger evidence than a remembered command.
+
+## 11. Implementation and Verification
+
+Group edits by dependencies. Define fake-port contracts, real credential reads, limited authorized writes, external package installation and product acceptance. Name exact external prerequisites that cannot be created automatically.
+
+## 12. Principle Verification
+
+Verify correct owner, complete field flow, strict input boundaries, truthful outcomes, intent separation, no credential leakage, fixed artifact identity, input reproducibility and useful recovery. No unimplemented field may be accepted as silently complete.

package/dist/resources/apple/.claude/docs/architecture.md

@@ -0,0 +1,52 @@
+# Delivery Architecture and Ownership
+
+## 1. Responsibility
+
+The delivery workspace owns product configuration and materials. The CLI owns Apple protocol adaptation, reconciliation and fixed tool orchestration. Product services own runtime identity, push delivery, transaction verification, order accounting and entitlements.
+
+Do not add runtime endpoints to a release script or move product prices and copy into the generic CLI.
+
+## 2. Dependency Direction
+
+```text
+Product manifest and versioned materials
+  → installed delivery CLI
+    → validated Apple resource adapters
+    → fixed fastlane signing/build/upload actions
+```
+
+API transport does not decide pricing, consent, locales or product identity. Native configuration selects a declared target; it does not discover and rewrite every application on the machine.
+
+## 3. Reuse
+
+New products initialize an empty delivery directory using the same pinned CLI. They reuse account references where appropriate and declare separate app, bundle and product identifiers. They do not clone the first product's scripts or product backend.
+
+CLI resources are versioned artifacts. Upgrade by generating into an empty comparison directory and reviewing changes. Reinitialization never overwrites an existing application.
+
+## 4. Stable and Versioned Resources
+
+StoreKit product identity is stable. Reviewable product and subscription-group metadata belongs to version resources. Maintain this boundary when adding locales or images; do not reintroduce the deprecated metadata-writing path.
+
+App version, uploaded build, review submission and release request have independent identities and states. A successful write to one does not imply the others completed.
+
+## 5. Local State
+
+Bindings identify managed resources. Plans identify intended changes. Journals record effects that started. Receipts record verified completions, pending work and failures. These records are private operational state, not public product metadata.
+
+Apple is authoritative for remote state. Local records support identity and recovery, not permission. A copied binding cannot make another account's resource belong to this product.
+
+## 6. Extension Rules
+
+New provider or tool behavior requires interface, configuration, implementation and composition before tests. Reuse existing request, copier, state and process owners. Avoid an arbitrary HTTP or shell escape hatch in product configuration.
+
+Add a CLI-private adapter unless another real runtime importer justifies a public package. A possible future caller alone is not evidence for another package.
+
+## 7. Configuration Changes
+
+Unknown configuration fails. Fields accepted by the schema must have a meaningful action, validation or explicit supported manual requirement. No accepted-and-ignored flags.
+
+Default behavior preserves unspecified state. Removal, invitations, review submission, publication and signing initialization are explicit operations. A newly added convenience command cannot expand their authorization.
+
+## 8. Acceptance
+
+Trace manifest field → validated value → plan projection → scoped effect → provider readback → receipt. For native assets, include compiled archive evidence. Review the actual packed CLI and direct product consumer; source-only tests do not prove distribution.

package/dist/resources/apple/.claude/docs/index.md

@@ -0,0 +1,13 @@
+# Apple Delivery Standards Index
+
+Read the complete root [CLAUDE.md](../../CLAUDE.md), then the relevant owner:
+
+| Standard                                          | Responsibility                                         |
+| ------------------------------------------------- | ------------------------------------------------------ |
+| [Stack](stack.md)                                 | Manifest, command phases, toolchain and resource names |
+| [Architecture](architecture.md)                   | Product, delivery tool and runtime service boundaries  |
+| [Security and Lifecycle](security-lifecycle.md)   | Credentials, effects, state, cancellation and recovery |
+| [Verification](verification.md)                   | Local, provider, artifact and device evidence          |
+| [Architecture Template](architecture-template.md) | New delivery integration design requirements           |
+
+These files govern the delivery directory. Product UI, backend and native source continue to follow their own complete standards. Implementation plans and account-specific evidence belong under ordinary product documentation, not this directory.

package/dist/resources/apple/.claude/docs/security-lifecycle.md

@@ -0,0 +1,57 @@
+# Credentials, Effects and Recovery
+
+## 1. Private Inputs
+
+Account JSON, `.p8`, signing secrets, reviewer credentials and tester lists are external private files owned by the current user with no group/other access. Never embed their contents in app.json, arguments, public build definitions or Git.
+
+API key identity is not proof of signing Team membership. Validate remote access and the actual signed archive. APNs, Apple login and transaction-signing keys have separate purposes; do not reuse the administration key by default.
+
+## 2. Network Boundaries
+
+Management credentials go only to the official App Store Connect API origin. Validate pagination links before following them. Do not convert 401/403, malformed JSON or unavailable services into empty successful lists.
+
+Upload URLs come from authenticated Apple reservations. Upload transport carries the returned upload headers, never the management Bearer. Reject credentials in URLs, private addresses, redirect chains and invalid byte ranges.
+
+## 3. File Boundaries
+
+Resolve material paths against the manifest root. Check real paths and existing ancestors before native or archive output writes. Validate file type, size and required image dimensions before creating remote reservations.
+
+Initialization requires an empty destination. Asset removal requires recorded ownership and current parent verification. Never delete a remote collection before replacement assets are processed.
+
+## 4. Plan and Execution
+
+All effects require a freshly reconstructed plan matching the saved scope, intent, account, product, inputs and observed state. Validate before the first effect. Never deserialize executable closures or provider requests from a plan file.
+
+Same-machine locking prevents overlapping execution for the same account and app. CI must additionally serialize jobs across machines. Do not describe a filesystem lock as distributed transaction protection.
+
+## 5. Unknown Outcomes
+
+An interrupted or timed-out write may have been accepted. Record it before returning. A later command first reconciles the exact resource or upload identity; absence during propagation is not permission to resend.
+
+Bound unfinished asset uploads resume only with the same content and parent. Completed assets with different content require a new resource. Keep remote IDs even when transfer or processing fails.
+
+## 6. Cancellation
+
+Cancel before a request is sent: cancelled. Cancel after a write is sent without a confirmed result: unknown. Stop pending work, release local locks and preserve journal/receipt evidence. Never claim remote rollback merely because a local process ended.
+
+## 7. Signing Lifecycle
+
+Use a private encrypted certificate repository and a temporary invocation-owned keychain. Initialization and read-only synchronization differ. Cleanup only resources owned by the invocation; do not remove the user's existing keychains or certificates.
+
+Validate archive signatures, embedded profiles, validity periods, Team, declared targets and entitlements. A configured profile type is not evidence that the exported archive uses that profile.
+
+## 8. Review and Release
+
+Reviewer contact and demo credentials are private; accepted request bodies must not enter plan output. Local declarations preserve explicit answers and evidence types. They cannot stand in for the App Privacy form or account agreements.
+
+Verify the review submission belongs to the exact app/platform and contains exactly the intended items before submission or an idempotent-success claim. Publication and phased-release transitions require the corresponding Apple state.
+
+## 9. Logs and Diagnostics
+
+Use operation IDs, resource types/IDs, fixed error codes and HTTP status. Do not log emails, signed URLs, API tokens, private keys or subprocess output. Report a safe error stage and the receipt path.
+
+## 10. Recovery Procedure
+
+Read the receipt, journal and exact remote resource. Preserve the failed plan for diagnosis. Correct input or external prerequisites, then create another plan. Do not clear unknown state just to bypass a guard, force retry a creation or treat a new process as a fresh operation.
+
+Stale locks require proving the original writer is no longer running. Separate credential rotation from app resource reconciliation. Avoid deleting state before exporting verified resource bindings needed by another machine.

package/dist/resources/apple/.claude/docs/stack.md

@@ -0,0 +1,93 @@
+# Apple Delivery Stack and Commands
+
+## 1. Installed Dependencies
+
+Use a fixed `@stackonward/cli` version. `Gemfile` fixes fastlane; `Gemfile.lock` fixes transitive Ruby dependencies. Do not replace the lock with a globally installed fastlane or copy TypeScript implementation into the product.
+
+Node 20 or later runs manifest/API commands. Native configuration, signing, archives and IPA verification require macOS, Xcode and the configured Flutter SDK for Flutter projects. Use a Ruby version compatible with the distributed lock and Bundler version recorded there.
+
+```bash
+BUNDLE_PATH="$HOME/.cache/stackonward/apple-gems" bundle install
+bundle --version
+xcodebuild -version
+stackonward apple --help
+```
+
+## 2. Configuration Authority
+
+`app.json` is the product source of truth. `manifest.schema.json` describes supported fields. Unknown keys fail. Omitted optional fields remain unmanaged; omission does not remove remote data.
+
+Do not invent product identifiers, prices, trial periods, territories, reviewer credentials or legal answers. A different product has a different manifest and resource tree.
+
+## 3. Identity
+
+| Identifier         | Meaning                                                          |
+| ------------------ | ---------------------------------------------------------------- |
+| Bundle ID          | Native application and Apple identifier registration             |
+| App ID             | Numeric App Store Connect record assigned by Apple               |
+| SKU                | Immutable product-owned store inventory reference                |
+| Product ID         | StoreKit subscription or purchase identity                       |
+| Team ID            | Signing team, not an App ID or issuer                            |
+| Key ID / Issuer ID | Team API credential identity, supplied privately                 |
+| Group key          | Local stable reference; bind the exact remote subscription group |
+
+Never select the first matching display name to bind an existing app or group.
+
+## 4. Command Phases
+
+`preflight` checks prerequisites; `plan` reads current state and describes effects; `apply` rebuilds and verifies the saved plan before effects; `verify` compares actual state with configured targets. `--offline` is supported only by preflight and proves local input validity, not Apple state.
+
+`status` reads resource states. `export --out <new-file>` writes allowed public metadata and asset references, without original media or credentials. `import-assets <empty-dir> <files...>` copies explicit local artwork and records file digests. `handoff` outputs public runtime identities and required configuration keys; it never claims runtime services are configured.
+
+Plans expire after 15 minutes and bind account, app, input, remote snapshot, scope and intent. Changed input or remote state requires another plan. Never edit saved operations to inject an API endpoint.
+
+## 5. Scopes and Explicit Intent
+
+| Scope      | Intent                                      |
+| ---------- | ------------------------------------------- |
+| setup      | reconcile                                   |
+| native     | configure                                   |
+| metadata   | reconcile                                   |
+| assets     | reconcile; remove-owned-assets              |
+| catalog    | reconcile                                   |
+| pricing    | reconcile                                   |
+| signing    | initialize; sync                            |
+| build      | archive                                     |
+| upload     | upload                                      |
+| testflight | prepare; review; distribute; invite         |
+| review     | prepare; submit; withdraw                   |
+| release    | configure; publish; pause; resume; complete |
+
+Always supply `--intent` when the selected scope does not use `reconcile`. Foundation setup does not authorize commercial, invitation, review or publication operations.
+
+## 6. Materials
+
+Each locale references its own JSON file. Images and video are product-owned files relative to the manifest directory. Native project paths are explicitly configured under `build.projectRoot`. Do not point a material path through a symlink outside its permitted root.
+
+App icons are native build assets. Screenshot and preview resources belong to a locale and device display group. Promotional purchase images and review screenshots have different purposes and different Apple relationships.
+
+## 7. Commercial Configuration
+
+Products are discriminated by kind. Auto-renewable subscriptions require a group, duration and level. One-time purchases cannot accidentally inherit subscription fields.
+
+Use exact Apple price points and territory currency. Preserve-current-price policy is explicit. Offers require eligibility, period and price information applicable to their kind. Do not infer prices by exchange-rate conversion.
+
+## 8. Build Configuration
+
+Declare the Xcode project, target, scheme, Info.plist, entitlements and icon asset set. Flutter declares its exact version and public build definitions. Public definitions cannot carry server credentials.
+
+Signing initialization may create shared signing resources. Regular builds use read-only match and a temporary keychain. The certificate repository is private and encrypted. The build result includes an IPA digest and input identity; upload must use that verified result.
+
+## 9. Review and Publication
+
+Select review items explicitly: an App version, product versions or subscription group versions. An App review selects one marketing version and one build number; never use the latest build implicitly.
+
+First App record creation and the first applicable subscription submission require App Store Connect steps. The tool reports the missing step. Price proposals, legal declarations and local attestations do not prove remote approval.
+
+## 10. Exit and Output Contract
+
+Machine output is one JSON document. Errors use stable codes and safe resource references. No raw Apple response, subprocess log, key or password belongs in output.
+
+Exit codes are 0 for a satisfied target, 2 for input errors, 3 for authorization errors, 4 for state conflicts, 5 for tool/provider failures, 6 for manual requirements, 7 for unknown writes and 130 for cancellation. A pricing plan includes the public commercial configuration so amounts, dates and territories can be reviewed.
+
+An empty plan is evidence only for its selected scope. A completed upload transport is distinct from a processed build, an approved review and an available store version.

package/dist/resources/apple/.claude/docs/verification.md

@@ -0,0 +1,63 @@
+# Apple Delivery Verification
+
+## 1. Scope the Claim
+
+Distinguish local parsing, authenticated reads, verified writes, native builds, TestFlight installation, runtime feature acceptance and store publication. Report only evidence actually collected for the requested scope.
+
+## 2. Input Gate
+
+- Validate manifest version and unknown keys.
+- Resolve all referenced materials and confirm content digests.
+- Verify private file modes without printing contents.
+- Confirm explicit account, Bundle ID, SKU, locale and build identity.
+- Confirm commercial and legal decisions have authoritative product inputs.
+
+## 3. Plan Gate
+
+- Read all pages of the relevant collections.
+- Reject permission, identity, type and parent mismatches.
+- Compare only configured attributes.
+- Confirm intent excludes unrelated effects.
+- Save the plan privately; review resource IDs, action names and fields.
+
+## 4. Apply Gate
+
+- Reconstruct the plan under the local lock.
+- Reject expiration, input drift, remote drift and changed intent.
+- Persist the operation's start before its effect.
+- Validate provider readback before recording completion.
+- Preserve IDs and unknown results for recovery.
+
+## 5. Native and Archive Gate
+
+- Inspect the declared Xcode target changes.
+- Compile configured icons and capability entitlements.
+- Lock Xcode, Flutter and Ruby tools.
+- Verify source input digests before and after archive creation.
+- Inspect signed Bundle ID, marketing version, build number and Team.
+- Validate embedded profiles, certificate membership and entitlement boundaries.
+- Preserve IPA and debug symbol artifacts for the exact build.
+
+## 6. Provider Gate
+
+- Repeat a read-only plan after setup and catalog writes.
+- Verify exact locale, screenshot group, checksum and order.
+- Verify pricing dates, territories, base territory and preservation policy.
+- Verify product versions and review item relationships.
+- Treat upload processing, beta approval, App review and release as separate states.
+
+## 7. Product Acceptance Gate
+
+Test on an installed build: registration, email delivery, session recovery, Apple login, push permission/delivery, purchase/restore, expiration/refund handling, account deletion and the product's main workflow where applicable. Store configuration alone proves none of these runtime behaviors.
+
+## 8. Release Gate
+
+Require a complete product review checklist and explicit release intent. Confirm App Store agreements and declarations. Verify the selected review batch and subsequent release status. Store propagation delays remain pending; do not call the version available merely because Apple accepted a release request.
+
+## 9. Template and Upgrade Gate
+
+Generate the directory using the installed CLI outside its source checkout. Verify schema, Gemfile lock, Fastfile and complete CLAUDE/AGENTS/detailed standards. Upgrade tools through explicit dependency changes; never silently recopy resources into a live product.
+
+## 10. Evidence Maintenance
+
+Keep product-specific evidence under ordinary docs or private execution state. Do not add account IDs, test passwords, one-off repair narratives or future implementation plans to these standards. A failed relevant gate blocks its completion claim, even if unrelated unit tests pass.