appship-cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Gunwoo Ko
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,93 @@
+# AppShip
+
+> AppShip is an open-source AI release assistant that analyzes your mobile app and prepares everything required for App Store and Google Play submission.
+
+Ship your mobile app without spending hours inside App Store Connect and Google Play Console.
+
+**Status: MVP 3 implemented (early development).** React Native, Expo, Flutter, native iOS, and native Android projects. See [docs/PRD.md](./docs/PRD.md) and [docs/TRD.md](./docs/TRD.md) for the full plan.
+
+## Install
+
+```bash
+npm install -g appship-cli   # installs the `appship` command
+appship --help
+
+# or run one-off without installing
+npx appship-cli init
+```
+
+## Commands
+
+```bash
+appship init                 # analyze your React Native project, ask a few questions
+appship generate             # generate store metadata, privacy docs, legal drafts into .appship/
+appship localize ko-KR ja-JP # translate generated listings into more locales
+appship export fastlane      # export listings to fastlane deliver/supply layouts (offline)
+appship export ci            # generate GitHub Actions workflows (readiness gate + release)
+appship upload ios           # upload a built .ipa to TestFlight via fastlane
+appship upload android       # upload a built .aab to a Play track (default: internal)
+appship screenshots flows    # turn the screenshot plan into Maestro flows (offline)
+appship screenshots capture  # run the flows on a device/emulator via Maestro
+appship submit ios           # submit the latest uploaded build for App Store review
+appship submit android       # promote a tested Play track to production review
+appship doctor               # check submission readiness and rejection risks (offline)
+appship review analyze r.txt # turn a store rejection message into a fix plan
+appship rules update         # fetch the latest policy rules & SDK signatures
+```
+
+`export fastlane` maps everything under `.appship/` into `fastlane/metadata/` (deliver) and `fastlane/metadata/android/` (supply), plus starter `Appfile`/`Fastfile` upload lanes — existing fastlane files are never overwritten without `--force`. Upload with `bundle exec fastlane ios upload_metadata` / `... android upload_metadata`.
+
+`export ci` writes two GitHub Actions workflows: a readiness gate that runs `appship doctor` on every PR (works out of the box — doctor is offline), and a `workflow_dispatch` release pipeline that builds, uploads via `appship upload --yes`, and optionally submits. The build steps are project-specific, so they carry `TODO(appship)` markers for you to finish (Android is pre-filled for gradle/Expo prebuild; iOS signing needs your fastlane match setup). Existing workflow files are never overwritten without `--force`.
+
+`upload` finds your newest built artifact (or takes `--ipa`/`--aab`), shows exactly what will run, asks for confirmation (`--yes` to skip, required in CI), then delegates to the fastlane lanes from `export fastlane`. fastlane owns store auth — set up an App Store Connect API key / Play service account per fastlane's docs.
+
+`submit` is the confirmation-gated final step. It first runs the doctor checks for the target store and refuses on error-severity failures (`--force` to override), shows exactly what will run, then asks for confirmation (`--yes` to skip, required in CI). iOS submits the latest build already on App Store Connect (`--build-number` to pick one) with manual release after approval; Android promotes a tested track (`--from-track`, default `internal`) to `--track` (default `production`). Like `upload`, it delegates to the `:submit_review` fastlane lanes from `export fastlane` — re-export with `--force` if your Fastfile predates them.
+
+`screenshots flows` generates one [Maestro](https://maestro.mobile.dev) flow per screen in the plan; each flow carries a navigation TODO that only you can fill in (appship can't know how to reach your screens). `capture` refuses to run while TODOs remain, then runs `maestro test` and drops PNGs into `.appship/screenshots/raw/`. Your edited flows are never overwritten without `--force`.
+
+`review analyze` reads a rejection message you copied from App Store Connect / Play Console into a text file, and produces per-issue fix steps, the appship commands that help, and (for issues resolvable by replying) a draft response to the review team — written to `.appship/review/rejection-analysis.md`. Guidelines are only cited when the message cites them; nothing is invented beyond the message and the scanned project facts.
+
+Store policies change between releases, so the doctor rules and SDK signature database are plain data files that can be refreshed without a new CLI version: `appship rules update` downloads them from this repository into `~/.appship/data-cache` (schema-validated before anything is written; nothing partial is ever observable), `rules status` shows what is in use, and `rules reset` returns to the bundled files. If a cached file ever stops parsing (e.g. you run a much newer rule format with an old CLI), appship silently falls back to its bundled data.
+
+`generate`, `localize`, and `review analyze` call an AI provider — Anthropic by default (`ANTHROPIC_API_KEY` or `ant auth login`), and any OpenAI-compatible endpoint via `ai.provider` in appship.yml: `gemini` (free keys at [aistudio.google.com](https://aistudio.google.com/apikey), `GEMINI_API_KEY`, default model `gemini-2.5-flash`), `openai` (`OPENAI_API_KEY`), `ollama` (local, set `ai.model`), or `openai-compatible` (set `ai.base_url` + `ai.model` — works with OpenRouter, Groq, and self-hosted servers). Store character limits are validated with retry regardless of provider. `init` and `doctor` run fully offline. Translations go through the same validation as generation; App Review notes are copied, not translated.
+
+Supported projects: React Native CLI, Expo (managed), Flutter, native iOS (`.xcodeproj` at the root), and native Android (`settings.gradle` + `app/` module) — identity and permissions are read from native files (`Info.plist`, `AndroidManifest.xml`, `project.pbxproj`, `build.gradle`), from `app.json`'s `expo` config, or from `pubspec.yaml`. SDK detection matches npm packages, Dart/Flutter packages, CocoaPods, and Gradle Maven coordinates, plus source patterns in JS/TS, Dart, Swift, Kotlin, and Java.
+
+## Using doctor as a CI gate
+
+`appship doctor` exits with code 1 when any error-severity check fails, so it works as a release gate:
+
+```yaml
+# .github/workflows/release-readiness.yml
+name: Release readiness
+on: [pull_request]
+jobs:
+  doctor:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 22 }
+      - run: npx appship-cli doctor        # fails the job on ✗ errors
+```
+
+Add `--json` for machine-readable output; the full report is also written to `.appship/checklist/release-readiness.json`.
+
+## Principles
+
+1. **AI never invents facts** — every finding carries evidence (file paths), and anything code can't prove is confirmed by you, not assumed.
+2. **Your source code stays local** — scanning happens on your machine; only a summary (project type, permissions, SDK list) is sent to the AI provider.
+3. **Nothing is submitted without explicit confirmation.**
+
+## Development
+
+```bash
+npm install
+npm run dev -- --help   # run the CLI
+npm test                # run tests
+npm run typecheck
+```
+
+## License
+
+MIT

package/data/rules/app-store.yml

@@ -0,0 +1,47 @@
+# doctor rules for the App Store (TRD §7).
+# severity: error -> ✗ (weight 3), warning -> ⚠ (weight 1)
+
+- id: apple-name-length
+  store: app-store
+  category: length
+  severity: error
+  target: app-store/*/name.txt
+  check: { type: max_length, value: 30 }
+  message: "App name exceeds Apple's 30 character limit"
+
+- id: apple-subtitle-length
+  store: app-store
+  category: length
+  severity: error
+  target: app-store/*/subtitle.txt
+  check: { type: max_length, value: 30 }
+  message: "Subtitle exceeds Apple's 30 character limit"
+
+- id: apple-keywords-length
+  store: app-store
+  category: length
+  severity: error
+  target: app-store/*/keywords.txt
+  check: { type: max_length, value: 100 }
+  message: "Keywords exceed Apple's 100 character limit"
+
+- id: account-deletion-required
+  store: app-store
+  category: consistency
+  severity: error
+  condition: { finding: login_detected }
+  check: { type: file_exists, value: legal/account-deletion.md }
+  message: "User registration detected but no account deletion flow found"
+  guideline: "Apple Guideline 5.1.1"
+  fix_suggestions:
+    - "Add account deletion under Settings > Account"
+    - "Mention the deletion path in App Review Notes"
+
+- id: unresolved-confirm-placeholders
+  store: app-store
+  category: consistency
+  severity: error
+  target: "**/*.md"
+  check: { type: not_contains, value: "[CONFIRM:" }
+  message: "Generated document still contains unresolved [CONFIRM] placeholders"
+  pass_message: "No unresolved [CONFIRM] placeholders"

package/data/rules/google-play.yml

@@ -0,0 +1,51 @@
+# doctor rules for Google Play (TRD §7).
+
+- id: play-title-length
+  store: google-play
+  category: length
+  severity: error
+  target: google-play/*/title.txt
+  check: { type: max_length, value: 30 }
+  message: "App title exceeds Google Play's 30 character limit"
+
+- id: play-short-description-length
+  store: google-play
+  category: length
+  severity: error
+  target: google-play/*/short-description.txt
+  check: { type: max_length, value: 80 }
+  message: "Short description exceeds Google Play's 80 character limit"
+
+- id: play-full-description-length
+  store: google-play
+  category: length
+  severity: error
+  target: google-play/*/full-description.txt
+  check: { type: max_length, value: 4000 }
+  message: "Full description exceeds Google Play's 4000 character limit"
+
+- id: play-no-emoji-in-title
+  store: google-play
+  category: policy
+  severity: warning
+  target: google-play/*/title.txt
+  check: { type: no_emoji }
+  message: "Emoji in the title may violate Google Play metadata policy"
+
+- id: data-safety-confirm-markers
+  store: google-play
+  category: consistency
+  severity: error
+  target: google-play/data-safety.yml
+  check: { type: not_contains, value: "confirm_before_submitting" }
+  message: "data-safety.yml still contains confirm_before_submitting markers — resolve them before filling the Play Console form"
+  pass_message: "Data Safety confirm markers resolved"
+
+- id: play-unresolved-confirm-placeholders
+  store: google-play
+  category: consistency
+  severity: error
+  target: legal/*.md
+  check: { type: not_contains, value: "[CONFIRM:" }
+  message: "Generated legal documents still contain unresolved [CONFIRM] placeholders"
+  pass_message: "No unresolved [CONFIRM] placeholders in legal documents"

package/data/sdk-signatures/signatures.yml

@@ -0,0 +1,376 @@
+# SDK signature database (TRD §6).
+# Declarative — adding a signature must never require a code change.
+#
+# confidence rules applied by the scanner:
+#   dependencies match  -> high
+#   source_patterns only -> medium
+#   config_keys only     -> low
+
+- id: firebase-analytics
+  name: Firebase Analytics
+  category: analytics
+  detect:
+    dependencies:
+      - "@react-native-firebase/analytics"
+      - "firebase_analytics"
+      - "FirebaseAnalytics"
+      - "com.google.firebase:firebase-analytics"
+    source_patterns:
+      - "analytics\\(\\)\\.logEvent"
+      - "FirebaseAnalytics\\.instance"
+      - "Analytics\\.logEvent"
+      - "Firebase\\.analytics"
+    config_keys: []
+  data_safety:
+    collects: [device_id, app_interactions]
+    purpose_defaults: [analytics]
+    shared_default: true
+    requires_confirmation: false
+
+- id: sentry
+  name: Sentry
+  category: crash-reporting
+  detect:
+    dependencies:
+      - "@sentry/react-native"
+      - "sentry_flutter"
+      - "Sentry"
+      - "io.sentry:sentry-android"
+    source_patterns:
+      - "Sentry\\.init"
+      - "SentryFlutter\\.init"
+      - "SentrySDK\\.start"
+    config_keys: []
+  data_safety:
+    collects: [crash_logs, diagnostics, device_id]
+    purpose_defaults: [app_functionality]
+    shared_default: true
+    requires_confirmation: false
+
+- id: revenuecat
+  name: RevenueCat
+  category: payments
+  detect:
+    dependencies:
+      - "react-native-purchases"
+      - "purchases_flutter"
+      - "RevenueCat"
+      - "com.revenuecat.purchases:purchases"
+    source_patterns:
+      - "Purchases\\.configure"
+    config_keys: []
+  data_safety:
+    collects: [purchase_history]
+    purpose_defaults: [app_functionality]
+    shared_default: true
+    requires_confirmation: false
+
+- id: location
+  name: Location APIs
+  category: device-api
+  detect:
+    dependencies:
+      - "@react-native-community/geolocation"
+      - "react-native-geolocation-service"
+      - "geolocator"
+      - "location"
+    source_patterns:
+      - "Geolocation\\.getCurrentPosition"
+      - "watchPosition"
+      - "Geolocator\\."
+    config_keys:
+      - NSLocationWhenInUseUsageDescription
+      - android.permission.ACCESS_FINE_LOCATION
+      - android.permission.ACCESS_COARSE_LOCATION
+  data_safety:
+    collects: [location]
+    purpose_defaults: [app_functionality]
+    shared_default: false
+    # precise vs approximate vs local-only cannot be decided from code
+    requires_confirmation: true
+
+- id: amplitude
+  name: Amplitude
+  category: analytics
+  detect:
+    dependencies:
+      - "@amplitude/analytics-react-native"
+      - "@amplitude/react-native"
+      - "amplitude_flutter"
+      - "AmplitudeSwift"
+      - "com.amplitude:analytics-android"
+    source_patterns:
+      - "amplitude\\.(init|track)"
+    config_keys: []
+  data_safety:
+    collects: [device_id, app_interactions]
+    purpose_defaults: [analytics]
+    shared_default: true
+    requires_confirmation: false
+
+- id: mixpanel
+  name: Mixpanel
+  category: analytics
+  detect:
+    dependencies:
+      - "mixpanel-react-native"
+      - "mixpanel_flutter"
+      - "Mixpanel-swift"
+      - "com.mixpanel.android:mixpanel-android"
+    source_patterns:
+      - "new Mixpanel\\("
+      - "Mixpanel\\.initialize"
+    config_keys: []
+  data_safety:
+    collects: [device_id, app_interactions]
+    purpose_defaults: [analytics]
+    shared_default: true
+    requires_confirmation: false
+
+- id: firebase-crashlytics
+  name: Firebase Crashlytics
+  category: crash-reporting
+  detect:
+    dependencies:
+      - "@react-native-firebase/crashlytics"
+      - "firebase_crashlytics"
+      - "FirebaseCrashlytics"
+      - "com.google.firebase:firebase-crashlytics"
+    source_patterns:
+      - "crashlytics\\(\\)"
+      - "FirebaseCrashlytics\\.instance"
+      - "Crashlytics\\.crashlytics"
+    config_keys: []
+  data_safety:
+    collects: [crash_logs, diagnostics, device_id]
+    purpose_defaults: [app_functionality]
+    shared_default: true
+    requires_confirmation: false
+
+- id: google-signin
+  name: Google Sign-In
+  category: auth
+  detect:
+    dependencies:
+      - "@react-native-google-signin/google-signin"
+      - "google_sign_in"
+      - "GoogleSignIn"
+      - "com.google.android.gms:play-services-auth"
+    source_patterns:
+      - "GoogleSignin\\."
+      - "GoogleSignIn\\("
+    config_keys: []
+  data_safety:
+    collects: [email, name, account_info]
+    purpose_defaults: [app_functionality]
+    shared_default: true
+    requires_confirmation: false
+
+- id: apple-signin
+  name: Apple Sign-In
+  category: auth
+  detect:
+    dependencies:
+      - "@invertase/react-native-apple-authentication"
+      - "sign_in_with_apple"
+    source_patterns:
+      - "appleAuth\\."
+      - "SignInWithApple\\."
+      - "ASAuthorizationAppleIDProvider"
+    config_keys: []
+  data_safety:
+    collects: [email, name]
+    purpose_defaults: [app_functionality]
+    shared_default: false
+    requires_confirmation: false
+
+- id: facebook-sdk
+  name: Facebook SDK
+  category: auth
+  detect:
+    dependencies:
+      - "react-native-fbsdk-next"
+      - "react-native-fbsdk"
+      - "flutter_facebook_auth"
+      - "facebook_app_events"
+      - "FacebookLogin"
+      - "com.facebook.android:facebook-android-sdk"
+    source_patterns:
+      - "LoginManager\\.logInWithPermissions"
+    config_keys: []
+  data_safety:
+    collects: [device_id, app_interactions, account_info]
+    purpose_defaults: [app_functionality, advertising]
+    shared_default: true
+    requires_confirmation: false
+
+- id: stripe
+  name: Stripe
+  category: payments
+  detect:
+    dependencies:
+      - "@stripe/stripe-react-native"
+      - "flutter_stripe"
+      - "StripePaymentSheet"
+      - "com.stripe:stripe-android"
+    source_patterns:
+      - "useStripe\\(|initPaymentSheet"
+    config_keys: []
+  data_safety:
+    collects: [payment_info, purchase_history]
+    purpose_defaults: [app_functionality]
+    shared_default: true
+    requires_confirmation: false
+
+- id: admob
+  name: AdMob
+  category: ads
+  detect:
+    dependencies:
+      - "react-native-google-mobile-ads"
+      - "google_mobile_ads"
+      - "Google-Mobile-Ads-SDK"
+      - "com.google.android.gms:play-services-ads"
+    source_patterns:
+      - "BannerAd|InterstitialAd|RewardedAd"
+      - "MobileAds\\.instance"
+      - "GADMobileAds|MobileAds\\.initialize"
+    config_keys: []
+  data_safety:
+    collects: [advertising_id, device_id]
+    purpose_defaults: [advertising]
+    shared_default: true
+    requires_confirmation: false
+
+- id: appsflyer
+  name: AppsFlyer
+  category: ads
+  detect:
+    dependencies:
+      - "react-native-appsflyer"
+      - "appsflyer_sdk"
+      - "AppsFlyerFramework"
+      - "com.appsflyer:af-android-sdk"
+    source_patterns:
+      - "appsFlyer\\."
+      - "AppsFlyerLib"
+    config_keys: []
+  data_safety:
+    collects: [advertising_id, device_id, app_interactions]
+    purpose_defaults: [analytics, advertising]
+    shared_default: true
+    requires_confirmation: false
+
+- id: onesignal
+  name: OneSignal
+  category: push
+  detect:
+    dependencies:
+      - "react-native-onesignal"
+      - "onesignal_flutter"
+      - "OneSignalXCFramework"
+      - "com.onesignal:OneSignal"
+    source_patterns:
+      - "OneSignal\\."
+    config_keys: []
+  data_safety:
+    collects: [device_id]
+    purpose_defaults: [app_functionality]
+    shared_default: true
+    requires_confirmation: false
+
+- id: firebase-messaging
+  name: Firebase Messaging
+  category: push
+  detect:
+    dependencies:
+      - "@react-native-firebase/messaging"
+      - "firebase_messaging"
+      - "FirebaseMessaging"
+      - "com.google.firebase:firebase-messaging"
+    source_patterns:
+      - "messaging\\(\\)\\.(getToken|onMessage)"
+      - "FirebaseMessaging\\.instance"
+      - "Messaging\\.messaging"
+    config_keys: []
+  data_safety:
+    collects: [device_id]
+    purpose_defaults: [app_functionality]
+    shared_default: true
+    requires_confirmation: false
+
+- id: microphone
+  name: Microphone
+  category: device-api
+  detect:
+    dependencies:
+      - "record"
+      - "flutter_sound"
+      - "speech_to_text"
+    source_patterns: []
+    config_keys:
+      - NSMicrophoneUsageDescription
+      - android.permission.RECORD_AUDIO
+  data_safety:
+    collects: [voice_or_audio]
+    purpose_defaults: [app_functionality]
+    shared_default: false
+    # recorded audio may be processed locally only — confirm
+    requires_confirmation: true
+
+- id: camera
+  name: Camera
+  category: device-api
+  detect:
+    dependencies:
+      - "react-native-vision-camera"
+      - "react-native-camera"
+      - "react-native-image-picker"
+      - "camera"
+      - "image_picker"
+    source_patterns: []
+    config_keys:
+      - NSCameraUsageDescription
+      - android.permission.CAMERA
+  data_safety:
+    collects: [photos_and_videos]
+    purpose_defaults: [app_functionality]
+    shared_default: false
+    requires_confirmation: true
+
+- id: contacts
+  name: Contacts
+  category: device-api
+  detect:
+    dependencies:
+      - "react-native-contacts"
+      - "flutter_contacts"
+    source_patterns: []
+    config_keys:
+      - NSContactsUsageDescription
+      - android.permission.READ_CONTACTS
+  data_safety:
+    collects: [contacts]
+    purpose_defaults: [app_functionality]
+    shared_default: false
+    requires_confirmation: true
+
+- id: advertising-id
+  name: Advertising ID / Tracking
+  category: device-api
+  detect:
+    dependencies:
+      - "react-native-tracking-transparency"
+      - "app_tracking_transparency"
+      - "com.google.android.gms:play-services-ads-identifier"
+    source_patterns:
+      - "requestTrackingPermission"
+      - "ATTrackingManager"
+    config_keys:
+      - NSUserTrackingUsageDescription
+      - com.google.android.gms.permission.AD_ID
+  data_safety:
+    collects: [advertising_id]
+    purpose_defaults: [advertising]
+    shared_default: true
+    requires_confirmation: true