appship-cli 0.1.0

package/dist/index.js

@@ -0,0 +1,3697 @@
+#!/usr/bin/env node
+import {
+  EXPO_APP_JSON_EVIDENCE,
+  UnsupportedProjectError,
+  analyzeFlutterProject,
+  analyzeReactNativeProject,
+  detectProjectType,
+  normalizeAndroidPermission,
+  readExpoConfig,
+  readPackageJson,
+  readPubspec
+} from "./chunk-7GCQ6I27.js";
+import {
+  analyzeNativeAndroidProject,
+  analyzeNativeIosProject
+} from "./chunk-TLOV7VBN.js";
+import "./chunk-CVYD5FVI.js";
+import {
+  UploadError,
+  assertUploadLane,
+  buildUploadPlan,
+  findArtifact,
+  resolveFastlaneCommand,
+  runUpload,
+  spawnRunner
+} from "./chunk-ICHGACSP.js";
+
+// src/index.ts
+import { Command as Command11 } from "commander";
+
+// src/cli/init.ts
+import { Command } from "commander";
+import pc from "picocolors";
+import * as p from "@clack/prompts";
+
+// src/core/rules-update/index.ts
+import { mkdir, readFile as readFile3, rm, writeFile } from "fs/promises";
+import { existsSync as existsSync2 } from "fs";
+import { homedir } from "os";
+import { dirname as dirname2, join as join3 } from "path";
+import { parse as parse3 } from "yaml";
+import "zod";
+
+// src/core/scanner/signatures.ts
+import { readFile } from "fs/promises";
+import { existsSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+import { parse } from "yaml";
+import { z } from "zod";
+var sdkSignatureSchema = z.object({
+  id: z.string().min(1),
+  name: z.string().min(1).optional(),
+  category: z.string().min(1),
+  detect: z.object({
+    dependencies: z.array(z.string()).default([]),
+    source_patterns: z.array(z.string()).default([]),
+    config_keys: z.array(z.string()).default([])
+  }),
+  data_safety: z.object({
+    collects: z.array(z.string()).min(1),
+    purpose_defaults: z.array(z.string()),
+    shared_default: z.boolean(),
+    requires_confirmation: z.boolean()
+  })
+});
+var signaturesFileSchema = z.array(sdkSignatureSchema);
+function findDataDir() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (let i = 0; i < 6; i++) {
+    const candidate = join(dir, "data");
+    if (existsSync(join(candidate, "sdk-signatures"))) return candidate;
+    dir = dirname(dir);
+  }
+  throw new Error("Could not locate the appship data/ directory");
+}
+async function loadSignatures(dataDir = findDataDir()) {
+  const path = join(dataDir, "sdk-signatures", "signatures.yml");
+  const raw = await readFile(path, "utf8");
+  const parsed = signaturesFileSchema.safeParse(parse(raw));
+  if (!parsed.success) {
+    const details = parsed.error.issues.map((i) => `  ${i.path.join(".")}: ${i.message}`).join("\n");
+    throw new Error(`Invalid SDK signature database (${path}):
+${details}`);
+  }
+  return parsed.data;
+}
+
+// src/core/doctor/rules.ts
+import { readdir, readFile as readFile2 } from "fs/promises";
+import { join as join2 } from "path";
+import { parse as parse2 } from "yaml";
+import { z as z2 } from "zod";
+var storeSchema = z2.enum(["app-store", "google-play"]);
+var checkSchema = z2.object({
+  type: z2.enum(["max_length", "file_exists", "not_contains", "no_emoji"]),
+  value: z2.union([z2.string(), z2.number()]).optional()
+});
+var ruleSchema = z2.object({
+  id: z2.string().min(1),
+  store: storeSchema,
+  category: z2.enum(["required", "length", "policy", "quality", "consistency"]),
+  severity: z2.enum(["error", "warning"]),
+  /** Glob relative to .appship/ that the check runs against (content checks). */
+  target: z2.string().optional(),
+  /** Only evaluate when this scanner-derived finding is present. */
+  condition: z2.object({ finding: z2.string() }).optional(),
+  check: checkSchema,
+  message: z2.string().min(1),
+  /** Report line when the check passes; defaults to a humanized rule id. */
+  pass_message: z2.string().optional(),
+  guideline: z2.string().optional(),
+  fix_suggestions: z2.array(z2.string()).optional()
+});
+var ruleFileSchema = z2.array(ruleSchema);
+async function loadRules(dataDir = findDataDir()) {
+  const rulesDir = join2(dataDir, "rules");
+  const files = (await readdir(rulesDir)).filter((f) => f.endsWith(".yml") || f.endsWith(".yaml"));
+  const rules = [];
+  for (const file of files.sort()) {
+    const raw = await readFile2(join2(rulesDir, file), "utf8");
+    const parsed = ruleFileSchema.safeParse(parse2(raw));
+    if (!parsed.success) {
+      const details = parsed.error.issues.map((i) => `  ${i.path.join(".")}: ${i.message}`).join("\n");
+      throw new Error(`Invalid doctor rule file (${file}):
+${details}`);
+    }
+    rules.push(...parsed.data);
+  }
+  return rules;
+}
+
+// src/core/rules-update/index.ts
+var RulesUpdateError = class extends Error {
+};
+var DEFAULT_RULES_SOURCE = "https://raw.githubusercontent.com/gunwooko/appship/main/data";
+var SYNCED_FILES = [
+  {
+    path: "rules/app-store.yml",
+    validate: (raw) => parseWith(ruleFileSchema, raw, "rules/app-store.yml").length
+  },
+  {
+    path: "rules/google-play.yml",
+    validate: (raw) => parseWith(ruleFileSchema, raw, "rules/google-play.yml").length
+  },
+  {
+    path: "sdk-signatures/signatures.yml",
+    validate: (raw) => parseWith(signaturesFileSchema, raw, "sdk-signatures/signatures.yml").length
+  }
+];
+function parseWith(schema, raw, label) {
+  const parsed = schema.safeParse(parse3(raw));
+  if (!parsed.success) {
+    throw new RulesUpdateError(
+      `Downloaded ${label} does not match the schema this appship version understands (update appship itself, or retry later).`
+    );
+  }
+  return parsed.data;
+}
+function dataCacheDir() {
+  return process.env.APPSHIP_DATA_CACHE_DIR ?? join3(homedir(), ".appship", "data-cache");
+}
+async function readCacheMeta(cacheDir = dataCacheDir()) {
+  try {
+    return JSON.parse(await readFile3(join3(cacheDir, "meta.json"), "utf8"));
+  } catch {
+    return null;
+  }
+}
+var defaultFetch = async (url) => {
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new RulesUpdateError(`Download failed (${response.status}) for ${url}`);
+  }
+  return response.text();
+};
+async function updateRules(options = {}) {
+  const source = (options.source ?? DEFAULT_RULES_SOURCE).replace(/\/$/, "");
+  const cacheDir = options.cacheDir ?? dataCacheDir();
+  const fetchText = options.fetchText ?? defaultFetch;
+  const bundledDir = findDataDir();
+  const downloads = [];
+  for (const file of SYNCED_FILES) {
+    let content;
+    try {
+      content = await fetchText(`${source}/${file.path}`);
+    } catch (error) {
+      if (error instanceof RulesUpdateError) throw error;
+      throw new RulesUpdateError(
+        `Could not download ${file.path} from ${source} \u2014 check your network and retry.`
+      );
+    }
+    downloads.push({ path: file.path, content, entries: file.validate(content) });
+  }
+  const files = [];
+  for (const download of downloads) {
+    const cachePath = join3(cacheDir, download.path);
+    let current = null;
+    try {
+      current = await readFile3(
+        existsSync2(cachePath) ? cachePath : join3(bundledDir, download.path),
+        "utf8"
+      );
+    } catch {
+    }
+    await mkdir(dirname2(cachePath), { recursive: true });
+    await writeFile(cachePath, download.content, "utf8");
+    files.push({
+      path: download.path,
+      entries: download.entries,
+      changed: current !== download.content
+    });
+  }
+  const updatedAt = (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
+  const meta = { updatedAt, source };
+  await writeFile(join3(cacheDir, "meta.json"), JSON.stringify(meta, null, 2) + "\n", "utf8");
+  return { files, cacheDir, updatedAt };
+}
+async function resetRules(cacheDir = dataCacheDir()) {
+  if (!existsSync2(cacheDir)) return false;
+  await rm(cacheDir, { recursive: true, force: true });
+  return true;
+}
+async function loadRulesWithCache(cacheDir = dataCacheDir()) {
+  if (existsSync2(join3(cacheDir, "rules"))) {
+    try {
+      return await loadRules(cacheDir);
+    } catch {
+    }
+  }
+  return loadRules();
+}
+async function loadSignaturesWithCache(cacheDir = dataCacheDir()) {
+  if (existsSync2(join3(cacheDir, "sdk-signatures"))) {
+    try {
+      return await loadSignatures(cacheDir);
+    } catch {
+    }
+  }
+  return loadSignatures();
+}
+
+// src/core/scanner/permissions.ts
+import { readFile as readFile4 } from "fs/promises";
+import { join as join4 } from "path";
+import glob from "fast-glob";
+import * as plist from "plist";
+import { XMLParser } from "fast-xml-parser";
+
+// src/core/types.ts
+function requireEvidence(evidence, context) {
+  if (evidence.length === 0) {
+    throw new Error(`Refusing to create a finding without evidence: ${context}`);
+  }
+  return evidence;
+}
+
+// src/core/scanner/permissions.ts
+var IGNORE_DIRS = ["**/node_modules/**", "**/Pods/**", "**/build/**", "**/.git/**"];
+var IOS_PLIST_GLOBS = {
+  "react-native": ["ios/**/Info.plist"],
+  flutter: ["ios/**/Info.plist"],
+  "native-ios": ["**/Info.plist"],
+  "native-android": []
+};
+var ANDROID_MANIFEST_GLOBS = {
+  "react-native": ["android/**/AndroidManifest.xml"],
+  flutter: ["android/**/AndroidManifest.xml"],
+  "native-ios": [],
+  "native-android": ["**/AndroidManifest.xml"]
+};
+var GENERIC_MESSAGE_PATTERNS = [
+  /^this app (requires|needs|uses)\b/i,
+  /^(requires|needs|used for)\b/i,
+  /\baccess\.?$/i
+];
+function assessUsageDescription(message) {
+  const trimmed = message.trim();
+  if (trimmed.length === 0) return "missing";
+  if (trimmed.length < 25) return "needs_improvement";
+  if (GENERIC_MESSAGE_PATTERNS.some((p5) => p5.test(trimmed))) return "needs_improvement";
+  return "ok";
+}
+async function scanIosPermissions(projectRoot, projectType = "react-native") {
+  const plistFiles = await glob(IOS_PLIST_GLOBS[projectType], {
+    cwd: projectRoot,
+    ignore: IGNORE_DIRS
+  });
+  const findings = /* @__PURE__ */ new Map();
+  for (const file of plistFiles) {
+    const raw = await readFile4(join4(projectRoot, file), "utf8");
+    let parsed;
+    try {
+      parsed = plist.parse(raw);
+    } catch {
+      continue;
+    }
+    for (const [key, value] of Object.entries(parsed)) {
+      if (!key.endsWith("UsageDescription")) continue;
+      const message = typeof value === "string" ? value : "";
+      const existing = findings.get(key);
+      if (existing) {
+        existing.evidence.push(file);
+      } else {
+        findings.set(key, {
+          key,
+          currentMessage: message,
+          qualityAssessment: assessUsageDescription(message),
+          evidence: requireEvidence([file], `ios permission ${key}`)
+        });
+      }
+    }
+  }
+  const expo = await readExpoConfig(projectRoot);
+  for (const [key, value] of Object.entries(expo?.ios?.infoPlist ?? {})) {
+    if (!key.endsWith("UsageDescription") || findings.has(key)) continue;
+    const message = typeof value === "string" ? value : "";
+    findings.set(key, {
+      key,
+      currentMessage: message,
+      qualityAssessment: assessUsageDescription(message),
+      evidence: requireEvidence([EXPO_APP_JSON_EVIDENCE], `ios permission ${key}`)
+    });
+  }
+  return [...findings.values()];
+}
+async function scanAndroidPermissions(projectRoot, projectType = "react-native") {
+  const manifestFiles = await glob(ANDROID_MANIFEST_GLOBS[projectType], {
+    cwd: projectRoot,
+    ignore: [...IGNORE_DIRS, "**/debug/**", "**/androidTest/**"]
+  });
+  const parser = new XMLParser({ ignoreAttributes: false, attributeNamePrefix: "@_" });
+  const findings = /* @__PURE__ */ new Map();
+  for (const file of manifestFiles) {
+    const raw = await readFile4(join4(projectRoot, file), "utf8");
+    let manifest;
+    try {
+      manifest = parser.parse(raw);
+    } catch {
+      continue;
+    }
+    const root = manifest["manifest"];
+    if (!root) continue;
+    const entries = root["uses-permission"];
+    const list = Array.isArray(entries) ? entries : entries ? [entries] : [];
+    for (const entry of list) {
+      const name = entry["@_android:name"];
+      if (!name) continue;
+      const existing = findings.get(name);
+      if (existing) {
+        existing.evidence.push(file);
+      } else {
+        findings.set(name, {
+          key: name,
+          evidence: requireEvidence([file], `android permission ${name}`)
+        });
+      }
+    }
+  }
+  const expo = await readExpoConfig(projectRoot);
+  for (const raw of expo?.android?.permissions ?? []) {
+    const name = normalizeAndroidPermission(raw);
+    if (findings.has(name)) continue;
+    findings.set(name, {
+      key: name,
+      evidence: requireEvidence([EXPO_APP_JSON_EVIDENCE], `android permission ${name}`)
+    });
+  }
+  return [...findings.values()];
+}
+async function scanPermissions(projectRoot, projectType = "react-native") {
+  const [ios, android] = await Promise.all([
+    scanIosPermissions(projectRoot, projectType),
+    scanAndroidPermissions(projectRoot, projectType)
+  ]);
+  return { ios, android };
+}
+
+// src/core/scanner/sdk.ts
+import { readFile as readFile5 } from "fs/promises";
+import { join as join5 } from "path";
+import glob2 from "fast-glob";
+var SOURCE_GLOBS = ["**/*.{js,jsx,ts,tsx}", "lib/**/*.dart", "**/*.swift", "**/*.{kt,java}"];
+var SOURCE_IGNORE = [
+  "**/node_modules/**",
+  "ios/**",
+  "android/**",
+  "**/dist/**",
+  "**/build/**",
+  "**/.git/**",
+  "**/*.test.*",
+  "**/*.spec.*"
+];
+function confidenceOf(match) {
+  if (match.dependencyEvidence.length > 0) return "high";
+  if (match.sourceEvidence.length > 0) return "medium";
+  if (match.configEvidence.length > 0) return "low";
+  return null;
+}
+async function readPodfile(projectRoot) {
+  for (const path of [join5("ios", "Podfile"), "Podfile"]) {
+    try {
+      return { path, content: await readFile5(join5(projectRoot, path), "utf8") };
+    } catch {
+    }
+  }
+  return null;
+}
+async function collectGradleFiles(projectRoot) {
+  const files = await glob2(["**/build.gradle", "**/build.gradle.kts"], {
+    cwd: projectRoot,
+    ignore: SOURCE_IGNORE.filter((i) => i !== "android/**")
+  });
+  return Promise.all(
+    files.map(async (path) => ({
+      path,
+      content: await readFile5(join5(projectRoot, path), "utf8")
+    }))
+  );
+}
+async function collectSourceFiles(projectRoot) {
+  const files = await glob2(SOURCE_GLOBS, { cwd: projectRoot, ignore: SOURCE_IGNORE });
+  return Promise.all(
+    files.map(async (path) => ({
+      path,
+      lines: (await readFile5(join5(projectRoot, path), "utf8")).split("\n")
+    }))
+  );
+}
+async function scanSdks(projectRoot, signatures, permissions) {
+  const pkg = await readPackageJson(projectRoot);
+  const dependencyNames = Object.keys({ ...pkg?.dependencies, ...pkg?.devDependencies });
+  const pubspec = await readPubspec(projectRoot);
+  const pubspecDependencyNames = Object.keys({
+    ...pubspec?.dependencies,
+    ...pubspec?.dev_dependencies
+  });
+  const podfile = await readPodfile(projectRoot);
+  const gradleFiles = await collectGradleFiles(projectRoot);
+  const sourceFiles = await collectSourceFiles(projectRoot);
+  const permissionKeys = /* @__PURE__ */ new Map();
+  for (const finding of [...permissions.ios, ...permissions.android]) {
+    permissionKeys.set(finding.key, finding.evidence);
+  }
+  const sdks = [];
+  const dataCollection = {};
+  for (const signature of signatures) {
+    const match = {
+      dependencyEvidence: [],
+      sourceEvidence: [],
+      configEvidence: []
+    };
+    for (const dep of signature.detect.dependencies) {
+      if (dependencyNames.includes(dep)) {
+        match.dependencyEvidence.push(`package.json: ${dep}`);
+      }
+      if (pubspecDependencyNames.includes(dep)) {
+        match.dependencyEvidence.push(`pubspec.yaml: ${dep}`);
+      }
+      if (!/^[a-z0-9_]+$/.test(dep) && podfile?.content.includes(dep)) {
+        match.dependencyEvidence.push(`${podfile.path}: ${dep}`);
+      }
+      if (dep.includes(":")) {
+        for (const gradle of gradleFiles) {
+          if (gradle.content.includes(dep)) {
+            match.dependencyEvidence.push(`${gradle.path}: ${dep}`);
+          }
+        }
+      }
+    }
+    const patterns = signature.detect.source_patterns.map((p5) => new RegExp(p5));
+    for (const { path, lines } of sourceFiles) {
+      for (const pattern of patterns) {
+        const lineIndex = lines.findIndex((line) => pattern.test(line));
+        if (lineIndex >= 0) {
+          match.sourceEvidence.push(`${path}:${lineIndex + 1}`);
+          break;
+        }
+      }
+    }
+    for (const key of signature.detect.config_keys) {
+      const evidence2 = permissionKeys.get(key);
+      if (evidence2) match.configEvidence.push(...evidence2);
+    }
+    const confidence = confidenceOf(match);
+    if (!confidence) continue;
+    const evidence = requireEvidence(
+      [...match.dependencyEvidence, ...match.sourceEvidence, ...match.configEvidence],
+      `sdk ${signature.id}`
+    );
+    sdks.push({
+      id: signature.id,
+      name: signature.name ?? signature.id,
+      category: signature.category,
+      confidence,
+      evidence
+    });
+    for (const dataType of signature.data_safety.collects) {
+      const existing = dataCollection[dataType];
+      if (existing) {
+        existing.purpose = [.../* @__PURE__ */ new Set([...existing.purpose, ...signature.data_safety.purpose_defaults])];
+        existing.shared = existing.shared || signature.data_safety.shared_default;
+        existing.evidence = [.../* @__PURE__ */ new Set([...existing.evidence, ...evidence])];
+        existing.requiresConfirmation = existing.requiresConfirmation || signature.data_safety.requires_confirmation;
+      } else {
+        dataCollection[dataType] = {
+          collected: true,
+          purpose: [...signature.data_safety.purpose_defaults],
+          shared: signature.data_safety.shared_default,
+          evidence: [...evidence],
+          requiresConfirmation: signature.data_safety.requires_confirmation,
+          confirmed: null
+        };
+      }
+    }
+  }
+  return { sdkReport: { sdks }, privacyReport: { dataCollection } };
+}
+
+// src/core/scanner/index.ts
+function analyzeByType(projectRoot, projectType) {
+  switch (projectType) {
+    case "flutter":
+      return analyzeFlutterProject(projectRoot);
+    case "native-ios":
+      return analyzeNativeIosProject(projectRoot);
+    case "native-android":
+      return analyzeNativeAndroidProject(projectRoot);
+    default:
+      return analyzeReactNativeProject(projectRoot);
+  }
+}
+async function scanProject(projectRoot) {
+  const projectType = await detectProjectType(projectRoot);
+  const [project, permissions, signatures] = await Promise.all([
+    analyzeByType(projectRoot, projectType),
+    scanPermissions(projectRoot, projectType),
+    loadSignaturesWithCache()
+  ]);
+  const { sdkReport, privacyReport } = await scanSdks(projectRoot, signatures, permissions);
+  return { project, permissions, sdkReport, privacyReport };
+}
+
+// src/core/config/load.ts
+import { readFile as readFile6 } from "fs/promises";
+import { join as join6 } from "path";
+import { parse as parse5 } from "yaml";
+
+// src/core/config/schema.ts
+import { z as z4 } from "zod";
+var aiProviderSchema = z4.enum([
+  "anthropic",
+  "openai",
+  "gemini",
+  "ollama",
+  "openai-compatible"
+]);
+var appshipConfigSchema = z4.object({
+  project: z4.object({
+    name: z4.string().min(1),
+    description: z4.string().min(1),
+    audience: z4.array(z4.string()).default([]),
+    requires_login: z4.boolean().optional(),
+    collects_personal_data: z4.boolean().optional(),
+    support_url: z4.string().url().optional()
+  }),
+  platforms: z4.object({
+    ios: z4.object({
+      bundle_id: z4.string().min(1)
+    }).optional(),
+    android: z4.object({
+      package_name: z4.string().min(1)
+    }).optional()
+  }),
+  stores: z4.object({
+    default_locale: z4.string().default("en-US"),
+    locales: z4.array(z4.string()).min(1).default(["en-US"]),
+    countries: z4.array(z4.string()).default([])
+  }),
+  ai: z4.object({
+    provider: aiProviderSchema.default("anthropic"),
+    model: z4.string().optional(),
+    /** Endpoint for openai-compatible (and optionally ollama) providers. */
+    base_url: z4.string().url().optional(),
+    tone: z4.string().default("friendly")
+  }).default({}),
+  privacy: z4.object({
+    send_source_code_to_ai: z4.boolean().default(false),
+    require_manual_confirmation: z4.boolean().default(true),
+    scan_dependencies: z4.boolean().default(true),
+    scan_source_code: z4.boolean().default(true)
+  }).default({})
+});
+
+// src/core/config/load.ts
+var CONFIG_FILENAME = "appship.yml";
+var ConfigError = class extends Error {
+};
+async function loadConfig(projectRoot) {
+  const path = join6(projectRoot, CONFIG_FILENAME);
+  let raw;
+  try {
+    raw = await readFile6(path, "utf8");
+  } catch {
+    throw new ConfigError(
+      `${CONFIG_FILENAME} not found in ${projectRoot}. Run \`appship init\` first.`
+    );
+  }
+  const parsed = parse5(raw);
+  const result = appshipConfigSchema.safeParse(parsed);
+  if (!result.success) {
+    const details = result.error.issues.map((i) => `  ${i.path.join(".") || "(root)"}: ${i.message}`).join("\n");
+    throw new ConfigError(`Invalid ${CONFIG_FILENAME}:
+${details}`);
+  }
+  return result.data;
+}
+
+// src/core/init/init.ts
+import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
+import { join as join7 } from "path";
+import { stringify } from "yaml";
+var APPSHIP_DIR = ".appship";
+var DESCRIPTION_PLACEHOLDER = "[CONFIRM: describe what your app does in one or two sentences]";
+function defaultAnswers(scan) {
+  return {
+    description: DESCRIPTION_PLACEHOLDER,
+    audience: [],
+    requiresLogin: null,
+    // suggest true when the scanner already found data collection
+    collectsPersonalData: Object.keys(scan.privacyReport.dataCollection).length > 0 ? true : null,
+    countries: [],
+    locales: ["en-US"]
+  };
+}
+function buildConfig(scan, answers, existing) {
+  const bundleId = scan.project.ios?.bundleId ?? null;
+  const packageName = scan.project.android?.packageName ?? null;
+  const locales = answers.locales.length > 0 ? answers.locales : ["en-US"];
+  return appshipConfigSchema.parse({
+    project: {
+      name: scan.project.appName ?? "My App",
+      description: answers.description || DESCRIPTION_PLACEHOLDER,
+      audience: answers.audience,
+      ...answers.requiresLogin === null ? {} : { requires_login: answers.requiresLogin },
+      ...answers.collectsPersonalData === null ? {} : { collects_personal_data: answers.collectsPersonalData },
+      // preserve fields init doesn't ask about — re-running must not lose them
+      ...existing?.project.support_url ? { support_url: existing.project.support_url } : {}
+    },
+    platforms: {
+      ...bundleId ? { ios: { bundle_id: bundleId } } : {},
+      ...packageName ? { android: { package_name: packageName } } : {}
+    },
+    stores: {
+      default_locale: locales[0],
+      locales,
+      countries: answers.countries
+    },
+    ...existing ? { ai: existing.ai, privacy: existing.privacy } : {}
+  });
+}
+async function writeConfig(projectRoot, config) {
+  const header = "# AppShip configuration\n# Generated by `appship init` \u2014 edit freely, then run `appship generate`.\n# API keys are read from environment variables and never stored here.\n";
+  const path = join7(projectRoot, CONFIG_FILENAME);
+  await writeFile2(path, header + stringify(config), "utf8");
+  return path;
+}
+async function writeAnalysis(projectRoot, scan) {
+  const analysisDir = join7(projectRoot, APPSHIP_DIR, "analysis");
+  await mkdir2(analysisDir, { recursive: true });
+  const files = [
+    ["project.json", scan.project],
+    ["permissions.json", scan.permissions],
+    ["sdk-report.json", scan.sdkReport],
+    ["privacy-report.json", scan.privacyReport]
+  ];
+  const written = [];
+  for (const [name, data] of files) {
+    const path = join7(analysisDir, name);
+    await writeFile2(path, JSON.stringify(data, null, 2) + "\n", "utf8");
+    written.push(path);
+  }
+  return written;
+}
+async function runInit(projectRoot, scan, answers, existing) {
+  const config = buildConfig(scan, answers, existing);
+  const [configPath, analysisPaths] = await Promise.all([
+    writeConfig(projectRoot, config),
+    writeAnalysis(projectRoot, scan)
+  ]);
+  return { configPath, analysisPaths, config };
+}
+
+// src/cli/init.ts
+var SENSITIVE_PERMISSION_NAMES = {
+  NSMicrophoneUsageDescription: "Microphone",
+  NSCameraUsageDescription: "Camera",
+  NSLocationWhenInUseUsageDescription: "Location",
+  NSLocationAlwaysAndWhenInUseUsageDescription: "Location (always)",
+  NSContactsUsageDescription: "Contacts",
+  NSPhotoLibraryUsageDescription: "Photo Library",
+  "android.permission.RECORD_AUDIO": "Microphone",
+  "android.permission.CAMERA": "Camera",
+  "android.permission.ACCESS_FINE_LOCATION": "Location",
+  "android.permission.ACCESS_COARSE_LOCATION": "Location",
+  "android.permission.READ_CONTACTS": "Contacts",
+  "android.permission.POST_NOTIFICATIONS": "Notifications"
+};
+function printDetectionSummary(scan) {
+  const check = (label) => console.log(`${pc.green("\u2713")} ${label}`);
+  const typeLabels = {
+    "react-native": "React Native",
+    flutter: "Flutter",
+    "native-ios": "Native iOS",
+    "native-android": "Native Android"
+  };
+  check(`${typeLabels[scan.project.projectType] ?? scan.project.projectType} project detected`);
+  if (scan.project.ios?.bundleId) check(`iOS bundle ID: ${scan.project.ios.bundleId}`);
+  if (scan.project.android?.packageName)
+    check(`Android package: ${scan.project.android.packageName}`);
+  if (scan.project.appName) check(`App name: ${scan.project.appName}`);
+  if (scan.project.version) check(`Version: ${scan.project.version}`);
+  const permissionNames = [
+    ...new Set(
+      [...scan.permissions.ios, ...scan.permissions.android].map((f) => SENSITIVE_PERMISSION_NAMES[f.key]).filter((name) => name !== void 0)
+    )
+  ];
+  if (permissionNames.length > 0) {
+    check(`Permissions detected: ${permissionNames.join(", ")}`);
+  }
+  for (const sdk of scan.sdkReport.sdks) {
+    check(`${sdk.name} detected`);
+  }
+}
+function parseList(value) {
+  return value.split(",").map((s) => s.trim()).filter(Boolean);
+}
+async function askQuestions(scan, existing) {
+  const defaults = defaultAnswers(scan);
+  p.intro("A few questions the code cannot answer:");
+  const existingDescription = existing && existing.project.description !== DESCRIPTION_PLACEHOLDER ? existing.project.description : void 0;
+  const description = await p.text({
+    message: "What does your app do?",
+    placeholder: "e.g. A language learning app with real-time voice rooms",
+    ...existingDescription ? { initialValue: existingDescription } : {},
+    validate: (v) => !v || v.trim().length === 0 ? "A short description is required." : void 0
+  });
+  if (p.isCancel(description)) return null;
+  const audience = await p.text({
+    message: "Who is the target audience? (comma-separated, optional)",
+    placeholder: "e.g. language learners, international students",
+    ...existing?.project.audience.length ? { initialValue: existing.project.audience.join(", ") } : {},
+    defaultValue: ""
+  });
+  if (p.isCancel(audience)) return null;
+  const requiresLogin = await p.confirm({
+    message: "Does the app require login?",
+    initialValue: existing?.project.requires_login ?? false
+  });
+  if (p.isCancel(requiresLogin)) return null;
+  const detectedCollection = Object.keys(scan.privacyReport.dataCollection);
+  const collectsPersonalData = await p.confirm({
+    message: detectedCollection.length > 0 ? `Does the app collect personal data? (detected: ${detectedCollection.join(", ")})` : "Does the app collect personal data?",
+    initialValue: existing?.project.collects_personal_data ?? defaults.collectsPersonalData ?? false
+  });
+  if (p.isCancel(collectsPersonalData)) return null;
+  const countries = await p.text({
+    message: "Which countries will you release in? (comma-separated, optional)",
+    placeholder: "e.g. US, KR, JP \u2014 leave empty for worldwide",
+    ...existing?.stores.countries.length ? { initialValue: existing.stores.countries.join(", ") } : {},
+    defaultValue: ""
+  });
+  if (p.isCancel(countries)) return null;
+  const locales = await p.text({
+    message: "Which store listing languages should be generated? (comma-separated)",
+    initialValue: existing?.stores.locales.join(", ") ?? "en-US"
+  });
+  if (p.isCancel(locales)) return null;
+  p.outro("Thanks \u2014 writing your files now.");
+  return {
+    description: description.trim(),
+    audience: parseList(audience),
+    requiresLogin,
+    collectsPersonalData,
+    countries: parseList(countries),
+    locales: parseList(locales).length > 0 ? parseList(locales) : ["en-US"]
+  };
+}
+function answersFromExisting(scan, existing) {
+  return {
+    description: existing.project.description,
+    audience: existing.project.audience,
+    requiresLogin: existing.project.requires_login ?? null,
+    collectsPersonalData: existing.project.collects_personal_data ?? null,
+    countries: existing.stores.countries,
+    locales: existing.stores.locales
+  };
+}
+var initCommand = new Command("init").description("Analyze the project and create appship.yml and the .appship/ folder").option("--force", "ignore existing appship.yml and re-initialize from scratch").option("--non-interactive", "skip interactive questions (unconfirmed findings are left for doctor)").action(async (options) => {
+  const projectRoot = process.cwd();
+  let scan;
+  try {
+    scan = await scanProject(projectRoot);
+  } catch (error) {
+    if (error instanceof UnsupportedProjectError) {
+      console.error(pc.red(`\u2717 ${error.message}`));
+      process.exitCode = 1;
+      return;
+    }
+    throw error;
+  }
+  printDetectionSummary(scan);
+  console.log();
+  let existing = null;
+  if (!options.force) {
+    try {
+      existing = await loadConfig(projectRoot);
+      console.log(pc.dim(`Existing ${CONFIG_FILENAME} found \u2014 using it as defaults.`));
+    } catch (error) {
+      if (!(error instanceof ConfigError)) throw error;
+    }
+  }
+  const interactive = !options.nonInteractive && process.stdout.isTTY;
+  let answers;
+  if (interactive) {
+    const asked = await askQuestions(scan, existing);
+    if (asked === null) {
+      console.log(pc.yellow("Cancelled \u2014 no files were written."));
+      process.exitCode = 1;
+      return;
+    }
+    answers = asked;
+  } else {
+    answers = existing ? answersFromExisting(scan, existing) : defaultAnswers(scan);
+  }
+  const result = await runInit(projectRoot, scan, answers, existing ?? void 0);
+  console.log();
+  console.log(pc.green("\u2713") + ` ${CONFIG_FILENAME} written`);
+  for (const path of result.analysisPaths) {
+    console.log(pc.green("\u2713") + ` ${path.replace(projectRoot + "/", "")} written`);
+  }
+  if (result.config.project.description.startsWith("[CONFIRM:")) {
+    console.log(
+      pc.yellow("\u26A0") + ` project.description in ${CONFIG_FILENAME} still needs your input before generate.`
+    );
+  }
+  console.log();
+  console.log(`Next: run ${pc.cyan("appship generate")} to create your store materials.`);
+});
+
+// src/cli/generate.ts
+import { writeFile as writeFile4 } from "fs/promises";
+import { existsSync as existsSync3 } from "fs";
+import { join as join10 } from "path";
+import { Command as Command2 } from "commander";
+import pc2 from "picocolors";
+import * as p2 from "@clack/prompts";
+
+// src/core/scanner/confirmations.ts
+import { readFile as readFile7 } from "fs/promises";
+import { join as join8 } from "path";
+var PRIVACY_REPORT_PATH = ".appship/analysis/privacy-report.json";
+async function mergePreviousConfirmations(projectRoot, scan) {
+  try {
+    const raw = await readFile7(join8(projectRoot, PRIVACY_REPORT_PATH), "utf8");
+    const previous = JSON.parse(raw);
+    for (const [dataType, entry] of Object.entries(previous.dataCollection ?? {})) {
+      const current = scan.privacyReport.dataCollection[dataType];
+      if (current && entry.confirmed !== null && entry.confirmed !== void 0) {
+        current.confirmed = entry.confirmed;
+      }
+    }
+  } catch {
+  }
+}
+
+// src/core/ai/anthropic.ts
+import Anthropic from "@anthropic-ai/sdk";
+
+// src/core/ai/provider.ts
+var AIProviderError = class extends Error {
+};
+
+// src/core/ai/anthropic.ts
+var DEFAULT_MODEL = "claude-opus-4-8";
+var DEFAULT_MAX_TOKENS = 16e3;
+var AnthropicProvider = class {
+  name = "anthropic";
+  client;
+  model;
+  constructor(model) {
+    this.client = new Anthropic();
+    this.model = model ?? DEFAULT_MODEL;
+  }
+  async createMessage(request, outputConfig) {
+    let response;
+    try {
+      response = await this.client.messages.create({
+        model: this.model,
+        max_tokens: request.maxTokens ?? DEFAULT_MAX_TOKENS,
+        system: request.system,
+        messages: [{ role: "user", content: request.prompt }],
+        ...outputConfig ? { output_config: outputConfig } : {}
+      });
+    } catch (error) {
+      if (error instanceof Anthropic.AuthenticationError) {
+        throw new AIProviderError(
+          "Anthropic authentication failed. Set ANTHROPIC_API_KEY or run `ant auth login`."
+        );
+      }
+      if (error instanceof Anthropic.APIError) {
+        throw new AIProviderError(`Anthropic API error (${error.status}): ${error.message}`);
+      }
+      throw error;
+    }
+    if (response.stop_reason === "refusal") {
+      throw new AIProviderError("The model declined to generate this content.");
+    }
+    const text2 = response.content.filter((block) => block.type === "text").map((block) => block.text).join("");
+    if (response.stop_reason === "max_tokens") {
+      throw new AIProviderError("Generation was truncated (max_tokens reached).");
+    }
+    return text2;
+  }
+  async generateText(request) {
+    return this.createMessage(request);
+  }
+  async generateObject(request) {
+    const text2 = await this.createMessage(request, {
+      format: { type: "json_schema", schema: request.jsonSchema }
+    });
+    try {
+      return JSON.parse(text2);
+    } catch {
+      throw new AIProviderError(`Model returned invalid JSON: ${text2.slice(0, 200)}`);
+    }
+  }
+};
+
+// src/core/ai/openai-compatible.ts
+var DEFAULT_MAX_TOKENS2 = 16e3;
+var MAX_RETRIES_429 = 3;
+var DEFAULT_RETRY_AFTER_SECONDS = 15;
+var defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function extractJson(text2) {
+  const trimmed = text2.trim();
+  const candidates = [trimmed];
+  const fenced = trimmed.match(/```(?:json)?\s*([\s\S]*?)```/);
+  if (fenced?.[1]) candidates.push(fenced[1].trim());
+  const first = trimmed.indexOf("{");
+  const last = trimmed.lastIndexOf("}");
+  if (first >= 0 && last > first) candidates.push(trimmed.slice(first, last + 1));
+  for (const candidate of candidates) {
+    try {
+      return JSON.parse(candidate);
+    } catch {
+    }
+  }
+  throw new AIProviderError(`Model returned invalid JSON: ${text2.slice(0, 200)}`);
+}
+var OpenAICompatibleProvider = class {
+  name;
+  options;
+  fetchImpl;
+  sleep;
+  constructor(options, fetchImpl = (url, init) => fetch(url, init), sleep = defaultSleep) {
+    this.name = `${options.name} (${options.model})`;
+    this.options = options;
+    this.fetchImpl = fetchImpl;
+    this.sleep = sleep;
+  }
+  resolveApiKey() {
+    for (const env of this.options.apiKeyEnv) {
+      const value = process.env[env];
+      if (value) return value;
+    }
+    return null;
+  }
+  async complete(system, prompt, maxTokens) {
+    const apiKey = this.resolveApiKey();
+    if (this.options.apiKeyEnv.length > 0 && !apiKey) {
+      throw new AIProviderError(
+        `No API key found for ${this.options.name}. ` + (this.options.keyHint ?? `Set ${this.options.apiKeyEnv[0]}.`)
+      );
+    }
+    const url = `${this.options.baseUrl.replace(/\/$/, "")}/chat/completions`;
+    const body = JSON.stringify({
+      model: this.options.model,
+      max_tokens: maxTokens ?? DEFAULT_MAX_TOKENS2,
+      messages: [
+        { role: "system", content: system },
+        { role: "user", content: prompt }
+      ]
+    });
+    let response;
+    for (let attempt = 0; ; attempt++) {
+      try {
+        response = await this.fetchImpl(url, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            ...apiKey ? { authorization: `Bearer ${apiKey}` } : {}
+          },
+          body
+        });
+      } catch (error) {
+        throw new AIProviderError(
+          `Could not reach ${this.options.name} at ${this.options.baseUrl} \u2014 ${error instanceof Error ? error.message : "network error"}.`
+        );
+      }
+      if ((response.status === 429 || response.status >= 500) && attempt < MAX_RETRIES_429) {
+        const retryAfter = Number(response.headers.get("retry-after"));
+        const seconds = Number.isFinite(retryAfter) && retryAfter > 0 ? Math.min(retryAfter, 60) : DEFAULT_RETRY_AFTER_SECONDS;
+        await this.sleep(seconds * 1e3);
+        continue;
+      }
+      break;
+    }
+    if (response.status === 401 || response.status === 403) {
+      throw new AIProviderError(
+        `${this.options.name} rejected the API key (${response.status}). ` + (this.options.keyHint ?? `Check ${this.options.apiKeyEnv[0] ?? "your credentials"}.`)
+      );
+    }
+    if (!response.ok) {
+      const detail = (await response.text().catch(() => "")).slice(0, 300);
+      throw new AIProviderError(
+        `${this.options.name} API error (${response.status})${detail ? `: ${detail}` : ""}`
+      );
+    }
+    const parsed = await response.json().catch(() => null);
+    const choice = parsed?.choices?.[0];
+    const content = choice?.message?.content;
+    if (typeof content !== "string" || content.length === 0) {
+      throw new AIProviderError(`${this.options.name} returned an empty response.`);
+    }
+    if (choice?.finish_reason === "length") {
+      throw new AIProviderError("Generation was truncated (max_tokens reached).");
+    }
+    return content;
+  }
+  async generateText(request) {
+    return this.complete(request.system, request.prompt, request.maxTokens);
+  }
+  async generateObject(request) {
+    const system = request.system + "\n\nOutput format: respond with a single JSON object and nothing else \u2014 no prose, no markdown fences. The object must match this JSON Schema exactly:\n" + JSON.stringify(request.jsonSchema);
+    const text2 = await this.complete(system, request.prompt, request.maxTokens);
+    return extractJson(text2);
+  }
+};
+function createOpenAICompatibleProvider(config) {
+  switch (config.provider) {
+    case "gemini":
+      return new OpenAICompatibleProvider({
+        name: "gemini",
+        baseUrl: "https://generativelanguage.googleapis.com/v1beta/openai",
+        model: config.model ?? "gemini-2.5-flash",
+        apiKeyEnv: ["GEMINI_API_KEY", "GOOGLE_API_KEY"],
+        keyHint: "Set GEMINI_API_KEY \u2014 free keys are available at https://aistudio.google.com/apikey."
+      });
+    case "openai":
+      return new OpenAICompatibleProvider({
+        name: "openai",
+        baseUrl: "https://api.openai.com/v1",
+        model: config.model ?? "gpt-4o",
+        apiKeyEnv: ["OPENAI_API_KEY"],
+        keyHint: "Set OPENAI_API_KEY (https://platform.openai.com/api-keys)."
+      });
+    case "ollama": {
+      if (!config.model) {
+        throw new AIProviderError(
+          "Set ai.model in appship.yml when using ollama (e.g. llama3.1, qwen2.5)."
+        );
+      }
+      return new OpenAICompatibleProvider({
+        name: "ollama",
+        baseUrl: config.baseUrl ?? "http://localhost:11434/v1",
+        model: config.model,
+        apiKeyEnv: []
+      });
+    }
+    case "openai-compatible": {
+      if (!config.baseUrl) {
+        throw new AIProviderError(
+          "Set ai.base_url in appship.yml when using openai-compatible (e.g. https://openrouter.ai/api/v1)."
+        );
+      }
+      if (!config.model) {
+        throw new AIProviderError("Set ai.model in appship.yml when using openai-compatible.");
+      }
+      return new OpenAICompatibleProvider({
+        name: "openai-compatible",
+        baseUrl: config.baseUrl,
+        model: config.model,
+        apiKeyEnv: ["OPENAI_COMPATIBLE_API_KEY", "OPENAI_API_KEY"],
+        keyHint: "Set OPENAI_COMPATIBLE_API_KEY (or OPENAI_API_KEY) for your endpoint."
+      });
+    }
+  }
+}
+
+// src/core/ai/payload.ts
+var PERMISSION_FEATURES = {
+  NSMicrophoneUsageDescription: "microphone",
+  "android.permission.RECORD_AUDIO": "microphone",
+  NSCameraUsageDescription: "camera",
+  "android.permission.CAMERA": "camera",
+  NSLocationWhenInUseUsageDescription: "location",
+  NSLocationAlwaysAndWhenInUseUsageDescription: "location",
+  "android.permission.ACCESS_FINE_LOCATION": "location",
+  "android.permission.ACCESS_COARSE_LOCATION": "location",
+  NSContactsUsageDescription: "contacts",
+  "android.permission.READ_CONTACTS": "contacts",
+  NSPhotoLibraryUsageDescription: "photo-library",
+  "android.permission.POST_NOTIFICATIONS": "notifications"
+};
+function buildSummaryPayload(scan, config) {
+  const permissions = [
+    ...new Set(
+      [...scan.permissions.ios, ...scan.permissions.android].map((f) => PERMISSION_FEATURES[f.key]).filter((name) => name !== void 0)
+    )
+  ];
+  const features = [
+    .../* @__PURE__ */ new Set([
+      ...scan.sdkReport.sdks.map((s) => s.category),
+      ...permissions,
+      ...config.project.requires_login ? ["login"] : []
+    ])
+  ];
+  return {
+    projectType: scan.project.projectType,
+    appName: scan.project.appName,
+    userDescription: config.project.description,
+    audience: config.project.audience,
+    features,
+    permissions,
+    sdks: scan.sdkReport.sdks.map((s) => s.name),
+    locales: config.stores.locales
+  };
+}
+
+// src/core/ai/index.ts
+function createProvider(config) {
+  switch (config.ai.provider) {
+    case "anthropic":
+      return new AnthropicProvider(config.ai.model);
+    case "gemini":
+    case "openai":
+    case "ollama":
+    case "openai-compatible":
+      return createOpenAICompatibleProvider({
+        provider: config.ai.provider,
+        ...config.ai.model ? { model: config.ai.model } : {},
+        ...config.ai.base_url ? { baseUrl: config.ai.base_url } : {}
+      });
+  }
+}
+
+// src/core/generate/index.ts
+import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname3, join as join9 } from "path";
+import glob3 from "fast-glob";
+import { stringify as stringify3 } from "yaml";
+import { z as z6 } from "zod";
+
+// src/core/generate/listings.ts
+import { z as z5 } from "zod";
+
+// src/core/metadata/validator.ts
+var APP_STORE_LIMITS = [
+  { field: "name", maxLength: 30 },
+  { field: "subtitle", maxLength: 30 },
+  { field: "description", maxLength: 4e3 },
+  { field: "keywords", maxLength: 100 },
+  { field: "promotionalText", maxLength: 170 },
+  { field: "releaseNotes", maxLength: 4e3 }
+];
+var GOOGLE_PLAY_LIMITS = [
+  { field: "title", maxLength: 30 },
+  { field: "shortDescription", maxLength: 80 },
+  { field: "fullDescription", maxLength: 4e3 },
+  { field: "releaseNotes", maxLength: 500 }
+];
+var EMOJI_PATTERN = new RegExp("\\p{Extended_Pictographic}", "u");
+function validateFields(values, limits) {
+  const violations = [];
+  for (const { field, maxLength } of limits) {
+    const value = values[field];
+    if (value === void 0) continue;
+    if (value.length > maxLength) {
+      violations.push({
+        field,
+        message: `${field} is ${value.length} characters; the store limit is ${maxLength}.`
+      });
+    }
+  }
+  return violations;
+}
+function validatePlayTitlePolicy(title) {
+  if (EMOJI_PATTERN.test(title)) {
+    return [{ field: "title", message: "Title contains emoji, which Google Play metadata policy disallows." }];
+  }
+  return [];
+}
+
+// src/core/generate/listings.ts
+var MAX_RETRIES = 3;
+var appStoreListingSchema = z5.object({
+  name: z5.string(),
+  subtitle: z5.string(),
+  description: z5.string(),
+  keywords: z5.string(),
+  promotionalText: z5.string(),
+  releaseNotes: z5.string(),
+  reviewNotes: z5.string()
+});
+var playListingSchema = z5.object({
+  title: z5.string(),
+  shortDescription: z5.string(),
+  fullDescription: z5.string(),
+  releaseNotes: z5.string(),
+  suggestedCategory: z5.string(),
+  suggestedTags: z5.array(z5.string())
+});
+var APP_STORE_JSON_SCHEMA = {
+  type: "object",
+  additionalProperties: false,
+  required: [
+    "name",
+    "subtitle",
+    "description",
+    "keywords",
+    "promotionalText",
+    "releaseNotes",
+    "reviewNotes"
+  ],
+  properties: {
+    name: { type: "string", description: "App name, at most 30 characters" },
+    subtitle: { type: "string", description: "Subtitle, at most 30 characters" },
+    description: { type: "string", description: "Full description, at most 4000 characters" },
+    keywords: {
+      type: "string",
+      description: "Comma-separated keywords, at most 100 characters total"
+    },
+    promotionalText: { type: "string", description: "Promotional text, at most 170 characters" },
+    releaseNotes: { type: "string", description: "Release notes for this version" },
+    reviewNotes: {
+      type: "string",
+      description: "Notes for the App Review team: how to test the app, login/test account needs, subscription details"
+    }
+  }
+};
+var PLAY_JSON_SCHEMA = {
+  type: "object",
+  additionalProperties: false,
+  required: [
+    "title",
+    "shortDescription",
+    "fullDescription",
+    "releaseNotes",
+    "suggestedCategory",
+    "suggestedTags"
+  ],
+  properties: {
+    title: { type: "string", description: "App title, at most 30 characters, no emoji" },
+    shortDescription: { type: "string", description: "Short description, at most 80 characters" },
+    fullDescription: { type: "string", description: "Full description, at most 4000 characters" },
+    releaseNotes: { type: "string", description: "Release notes, at most 500 characters" },
+    suggestedCategory: { type: "string", description: "Suggested Google Play category" },
+    suggestedTags: { type: "array", items: { type: "string" }, description: "Suggested tags" }
+  }
+};
+var SYSTEM_PROMPT = `You are AppShip, an assistant that writes app store submission materials.
+
+Rules you must never break:
+- Only describe features, permissions, and SDKs listed in the provided project summary. Never invent capabilities the summary does not mention.
+- Never make definitive privacy claims like "does not share user data". If something is unknown, either omit it or mark it as [CONFIRM: <question for the developer>].
+- Respect every character limit stated in the field descriptions.
+- Avoid store-policy violations: no emoji or repeated special characters in titles, no ranking claims ("#1 app"), no price mentions in App Store metadata, no misleading claims.
+- Write in the locale requested by the user.`;
+function buildPrompt(payload, locale, store) {
+  return `Write ${store} listing metadata for this app, in locale "${locale}".
+
+Project summary (the only source of truth about the app):
+` + JSON.stringify(payload, null, 2);
+}
+async function generateWithRetry(provider, basePrompt, jsonSchema, parse7, validate, system = SYSTEM_PROMPT) {
+  let prompt = basePrompt;
+  let listing = parse7(await provider.generateObject({ system, prompt, jsonSchema }));
+  let violations = validate(listing);
+  for (let attempt = 0; violations.length > 0 && attempt < MAX_RETRIES; attempt++) {
+    prompt = basePrompt + "\n\nYour previous attempt violated these constraints \u2014 fix them and regenerate:\n" + violations.map((v) => `- ${v.message}`).join("\n") + "\n\nFor character-limit violations: character limits are hard store rules, not suggestions. Count the characters of your replacement before answering and make it comfortably shorter than the limit (aim for ~10% under) \u2014 cutting words is better than exceeding the limit.";
+    listing = parse7(await provider.generateObject({ system, prompt, jsonSchema }));
+    violations = validate(listing);
+  }
+  return { listing, violations };
+}
+async function generateAppStoreListing(provider, payload, locale) {
+  return generateWithRetry(
+    provider,
+    buildPrompt(payload, locale, "Apple App Store"),
+    APP_STORE_JSON_SCHEMA,
+    (raw) => appStoreListingSchema.parse(raw),
+    (l) => validateFields({ ...l }, APP_STORE_LIMITS)
+  );
+}
+async function generatePlayListing(provider, payload, locale) {
+  return generateWithRetry(
+    provider,
+    buildPrompt(payload, locale, "Google Play"),
+    PLAY_JSON_SCHEMA,
+    (raw) => playListingSchema.parse(raw),
+    (l) => [
+      ...validateFields(
+        {
+          title: l.title,
+          shortDescription: l.shortDescription,
+          fullDescription: l.fullDescription,
+          releaseNotes: l.releaseNotes
+        },
+        GOOGLE_PLAY_LIMITS
+      ),
+      ...validatePlayTitlePolicy(l.title)
+    ]
+  );
+}
+
+// src/core/generate/legal.ts
+var LEGAL_SYSTEM_PROMPT = `You are AppShip, drafting legal/support documents for a mobile app's store submission.
+
+Rules you must never break:
+- Ground every statement in the provided project summary and data-collection findings. Never invent data practices.
+- Never write definitive negative claims like "we do not share your data". Instead describe only what was detected, and add: "Please verify whether data is transferred to these providers." where relevant.
+- For anything the developer must decide or confirm (company name, contact email, jurisdiction, retention periods), insert a placeholder in the exact form [CONFIRM: <question>].
+- Start the document with a blockquote disclaimer: "> This is an AI-generated draft, not legal advice. Review it with a qualified professional before publishing."
+- Output plain Markdown only.`;
+var LEGAL_DOCS = [
+  {
+    filename: "privacy-policy.md",
+    title: "Privacy Policy",
+    instructions: "Cover: what data is collected (from the findings), purposes, third-party SDKs detected, user rights, contact. "
+  },
+  {
+    filename: "terms-of-service.md",
+    title: "Terms of Service",
+    instructions: "Cover: acceptance, license, user accounts (if login is a feature), acceptable use, subscriptions/purchases only if payments SDKs were detected, liability, governing law."
+  },
+  {
+    filename: "account-deletion.md",
+    title: "Account Deletion Instructions",
+    instructions: "Explain how a user deletes their account and data (Apple Guideline 5.1.1). If the summary does not include login, state that the app has no accounts and this page may not be required."
+  },
+  {
+    filename: "support-page.md",
+    title: "Support",
+    instructions: "A short support page: what the app does, FAQ stubs based on the features, and a contact placeholder."
+  }
+];
+async function generateLegalDoc(provider, spec, payload, privacyReport) {
+  const prompt = `Write the "${spec.title}" document for this app. ${spec.instructions}
+
+Project summary:
+${JSON.stringify(payload, null, 2)}
+
+Detected data collection (scanner findings with evidence):
+` + JSON.stringify(privacyReport.dataCollection, null, 2);
+  return provider.generateText({ system: LEGAL_SYSTEM_PROMPT, prompt });
+}
+
+// src/core/generate/privacy-docs.ts
+import { stringify as stringify2 } from "yaml";
+function renderDataSafetyYaml(report) {
+  const header = "# Google Play Data Safety draft \u2014 generated by appship from code analysis.\n# Data Safety answers are the developer's self-declaration: review every\n# entry, resolve the confirm_before_submitting items, then transcribe into\n# the Play Console form.\n";
+  const dataCollection = {};
+  for (const [dataType, entry] of Object.entries(report.dataCollection)) {
+    dataCollection[dataType] = {
+      collected: entry.collected,
+      purpose: entry.purpose,
+      shared: entry.shared,
+      evidence: entry.evidence,
+      ...entry.requiresConfirmation && entry.confirmed === null ? { confirm_before_submitting: "Detection could not determine the exact answer \u2014 confirm manually." } : {}
+    };
+  }
+  return header + stringify2({ data_collection: dataCollection });
+}
+function renderPrivacyQuestionnaireYaml(report) {
+  const header = "# Apple privacy questionnaire draft (App Privacy / Nutrition Labels) \u2014\n# generated by appship from code analysis. Review before answering in\n# App Store Connect.\n";
+  const dataTypes = Object.entries(report.dataCollection).map(([dataType, entry]) => ({
+    data_type: dataType,
+    collected: entry.collected,
+    linked_to_user: "[CONFIRM: is this data linked to the user's identity?]",
+    used_for_tracking: entry.shared ? "[CONFIRM: shared with third parties \u2014 is it used for tracking?]" : false,
+    purposes: entry.purpose,
+    evidence: entry.evidence
+  }));
+  return header + stringify2({ privacy_questionnaire: dataTypes });
+}
+function renderContentRatingYaml(config) {
+  const header = "# Google Play content rating questionnaire draft. Every answer must be\n# confirmed by the developer \u2014 appship cannot infer app content.\n";
+  return header + stringify2({
+    content_rating: {
+      app_name: config.project.name,
+      category: "[CONFIRM: pick the questionnaire category in Play Console]",
+      violence: "[CONFIRM]",
+      sexuality: "[CONFIRM]",
+      language: "[CONFIRM]",
+      controlled_substances: "[CONFIRM]",
+      user_generated_content: "[CONFIRM: does the app host user-generated content?]",
+      user_interaction: "[CONFIRM: can users interact or share location?]"
+    }
+  });
+}
+
+// src/core/generate/checklists.ts
+function item(text2) {
+  return `- [ ] ${text2}`;
+}
+function renderAppStoreChecklist(config, scan) {
+  const lines = [
+    `# App Store submission checklist \u2014 ${config.project.name}`,
+    "",
+    "## Metadata",
+    item("Review generated name/subtitle/description/keywords in .appship/app-store/"),
+    item("Review review-notes.txt (test account, subscription details)"),
+    item("Support URL configured in App Store Connect"),
+    item("Marketing URL (optional) configured"),
+    "",
+    "## Privacy",
+    item("Resolve every [CONFIRM] in .appship/legal/ and privacy-questionnaire.yml"),
+    item("Answer App Privacy questionnaire in App Store Connect"),
+    item("PrivacyInfo.xcprivacy present in the Xcode project"),
+    ...config.project.requires_login ? [item("Account deletion flow available in-app (Guideline 5.1.1) and documented")] : [],
+    "",
+    "## Permissions",
+    ...scan.permissions.ios.map(
+      (p5) => item(
+        `${p5.key}: usage description reviewed` + (p5.qualityAssessment !== "ok" ? " (\u26A0 current message needs improvement)" : "")
+      )
+    ),
+    "",
+    "## Assets",
+    item("App icon (1024\xD71024) uploaded"),
+    item("Screenshots for required device sizes (see screenshots/screenshot-plan.yml)"),
+    ""
+  ];
+  return lines.join("\n");
+}
+function renderGooglePlayChecklist(config, scan) {
+  const lines = [
+    `# Google Play submission checklist \u2014 ${config.project.name}`,
+    "",
+    "## Metadata",
+    item("Review generated title/short/full description in .appship/google-play/"),
+    item("Category and tags set in Play Console"),
+    "",
+    "## Data Safety & Policy",
+    item("Resolve confirm_before_submitting items in data-safety.yml, then fill the Data Safety form"),
+    item("Complete the content rating questionnaire (see content-rating.yml)"),
+    item("Privacy policy URL published and linked in Play Console"),
+    ...config.project.requires_login ? [item("Account deletion URL provided in Play Console (required when accounts exist)")] : [],
+    item("App access instructions provided if login is required"),
+    item("Ads declaration completed"),
+    "",
+    "## Permissions",
+    ...scan.permissions.android.map((p5) => item(`${p5.key}: usage justified in the declaration`)),
+    "",
+    "## Assets",
+    item("App icon (512\xD7512) and feature graphic (1024\xD7500) uploaded"),
+    item("Screenshots uploaded (see screenshots plan)"),
+    ""
+  ];
+  return lines.join("\n");
+}
+
+// src/core/generate/index.ts
+var screenshotPlanSchema = z6.object({
+  screens: z6.array(z6.object({ screen: z6.string(), headline: z6.string() }))
+});
+var SCREENSHOT_JSON_SCHEMA = {
+  type: "object",
+  additionalProperties: false,
+  required: ["screens"],
+  properties: {
+    screens: {
+      type: "array",
+      items: {
+        type: "object",
+        additionalProperties: false,
+        required: ["screen", "headline"],
+        properties: {
+          screen: { type: "string", description: "Screen name exactly as given" },
+          headline: { type: "string", description: "Marketing headline overlay, under 60 characters" }
+        }
+      }
+    }
+  }
+};
+async function detectScreens(projectRoot) {
+  const files = await glob3(["src/screens/*.{tsx,jsx,ts,js}", "app/screens/*.{tsx,jsx,ts,js}"], {
+    cwd: projectRoot,
+    ignore: ["**/node_modules/**", "**/*.test.*"]
+  });
+  return files.map((route) => ({
+    name: (route.split("/").pop() ?? route).replace(/\.(tsx|jsx|ts|js)$/, ""),
+    route
+  }));
+}
+async function buildScreenshotPlan(provider, projectRoot, payloadJson) {
+  const screens = await detectScreens(projectRoot);
+  const header = "# Screenshot plan \u2014 generated by appship. Screenshot capture automation\n# is planned for a later release; use this as the shot list.\n";
+  if (screens.length === 0) {
+    return header + stringify3({
+      screens: [],
+      note: "No screen components detected under src/screens or app/screens. Add entries manually."
+    });
+  }
+  const raw = await provider.generateObject({
+    system: "You write short app-store screenshot marketing headlines. Only use the provided app summary; never invent features.",
+    prompt: `App summary:
+${payloadJson}
+
+Screens: ${screens.map((s) => s.name).join(", ")}
+
+Write one headline per screen.`,
+    jsonSchema: SCREENSHOT_JSON_SCHEMA
+  });
+  const plan = screenshotPlanSchema.parse(raw);
+  const headlines = new Map(plan.screens.map((s) => [s.screen, s.headline]));
+  return header + stringify3({
+    screens: screens.map((s) => ({
+      screen: s.name,
+      headline: headlines.get(s.name) ?? "[CONFIRM: write a headline]",
+      source_route: s.route
+    }))
+  });
+}
+async function runGenerate(projectRoot, config, scan, provider, options = {}) {
+  const locales = options.locales ?? config.stores.locales;
+  const payload = buildSummaryPayload(scan, config);
+  const payloadJson = JSON.stringify(payload, null, 2);
+  const files = [];
+  const add = (path, content, violations = []) => files.push({ path: join9(".appship", path), content, violations });
+  const wantIos = options.target !== "android";
+  const wantAndroid = options.target !== "ios";
+  for (const locale of locales) {
+    if (wantIos) {
+      const { listing, violations } = await generateAppStoreListing(provider, payload, locale);
+      const dir = `app-store/${locale}`;
+      add(`${dir}/name.txt`, listing.name + "\n", violations.filter((v) => v.field === "name"));
+      add(`${dir}/subtitle.txt`, listing.subtitle + "\n", violations.filter((v) => v.field === "subtitle"));
+      add(`${dir}/description.txt`, listing.description + "\n", violations.filter((v) => v.field === "description"));
+      add(`${dir}/keywords.txt`, listing.keywords + "\n", violations.filter((v) => v.field === "keywords"));
+      add(`${dir}/promotional-text.txt`, listing.promotionalText + "\n", violations.filter((v) => v.field === "promotionalText"));
+      add(`${dir}/release-notes.txt`, listing.releaseNotes + "\n", violations.filter((v) => v.field === "releaseNotes"));
+      add(`${dir}/review-notes.txt`, listing.reviewNotes + "\n");
+    }
+    if (wantAndroid) {
+      const { listing, violations } = await generatePlayListing(provider, payload, locale);
+      const dir = `google-play/${locale}`;
+      add(`${dir}/title.txt`, listing.title + "\n", violations.filter((v) => v.field === "title"));
+      add(`${dir}/short-description.txt`, listing.shortDescription + "\n", violations.filter((v) => v.field === "shortDescription"));
+      add(`${dir}/full-description.txt`, listing.fullDescription + "\n", violations.filter((v) => v.field === "fullDescription"));
+      add(`${dir}/release-notes.txt`, listing.releaseNotes + "\n", violations.filter((v) => v.field === "releaseNotes"));
+      add(
+        `${dir}/store-settings.yml`,
+        stringify3({ suggested_category: listing.suggestedCategory, suggested_tags: listing.suggestedTags })
+      );
+    }
+  }
+  if (wantIos) {
+    add("app-store/privacy/privacy-questionnaire.yml", renderPrivacyQuestionnaireYaml(scan.privacyReport));
+  }
+  if (wantAndroid) {
+    add("google-play/data-safety.yml", renderDataSafetyYaml(scan.privacyReport));
+    add("google-play/content-rating.yml", renderContentRatingYaml(config));
+  }
+  for (const spec of LEGAL_DOCS) {
+    const doc = await generateLegalDoc(provider, spec, payload, scan.privacyReport);
+    add(`legal/${spec.filename}`, doc.endsWith("\n") ? doc : doc + "\n");
+  }
+  const screenshotPlan = await buildScreenshotPlan(provider, projectRoot, payloadJson);
+  if (wantIos) add("app-store/screenshots/screenshot-plan.yml", screenshotPlan);
+  if (wantAndroid) add("google-play/screenshots/screenshot-plan.yml", screenshotPlan);
+  if (wantIos) add("checklist/app-store.md", renderAppStoreChecklist(config, scan));
+  if (wantAndroid) add("checklist/google-play.md", renderGooglePlayChecklist(config, scan));
+  if (!options.dryRun) {
+    for (const file of files) {
+      const absolute = join9(projectRoot, file.path);
+      await mkdir3(dirname3(absolute), { recursive: true });
+      await writeFile3(absolute, file.content, "utf8");
+    }
+  }
+  return { files };
+}
+function planArtifacts(config, options = {}) {
+  const locales = options.locales ?? config.stores.locales;
+  const wantIos = options.target !== "android";
+  const wantAndroid = options.target !== "ios";
+  const paths = [];
+  for (const locale of locales) {
+    if (wantIos) {
+      for (const f of ["name", "subtitle", "description", "keywords", "promotional-text", "release-notes", "review-notes"]) {
+        paths.push(`.appship/app-store/${locale}/${f}.txt`);
+      }
+    }
+    if (wantAndroid) {
+      for (const f of ["title", "short-description", "full-description", "release-notes"]) {
+        paths.push(`.appship/google-play/${locale}/${f}.txt`);
+      }
+      paths.push(`.appship/google-play/${locale}/store-settings.yml`);
+    }
+  }
+  if (wantIos) paths.push(".appship/app-store/privacy/privacy-questionnaire.yml");
+  if (wantAndroid) {
+    paths.push(".appship/google-play/data-safety.yml", ".appship/google-play/content-rating.yml");
+  }
+  paths.push(...LEGAL_DOCS.map((d) => `.appship/legal/${d.filename}`));
+  if (wantIos) paths.push(".appship/app-store/screenshots/screenshot-plan.yml");
+  if (wantAndroid) paths.push(".appship/google-play/screenshots/screenshot-plan.yml");
+  if (wantIos) paths.push(".appship/checklist/app-store.md");
+  if (wantAndroid) paths.push(".appship/checklist/google-play.md");
+  return paths;
+}
+
+// src/cli/generate.ts
+async function confirmFindings(scan, interactive) {
+  const pending = Object.entries(scan.privacyReport.dataCollection).filter(
+    ([, entry]) => entry.requiresConfirmation && entry.confirmed === null
+  );
+  if (pending.length === 0) return true;
+  if (!interactive) {
+    console.log(
+      pc2.yellow("\u26A0") + ` ${pending.length} detection(s) need your confirmation (${pending.map(([t]) => t).join(", ")}). Generated privacy docs will carry confirm markers.`
+    );
+    return true;
+  }
+  for (const [dataType, entry] of pending) {
+    console.log();
+    console.log(pc2.yellow("\u26A0") + ` ${dataType} collection detected. Evidence:`);
+    for (const ev of entry.evidence) console.log(pc2.dim(`  - ${ev}`));
+    const answer = await p2.confirm({
+      message: `Does the app collect "${dataType}" as detected?`,
+      initialValue: true
+    });
+    if (p2.isCancel(answer)) return false;
+    entry.confirmed = answer;
+  }
+  return true;
+}
+var generateCommand = new Command2("generate").description("Generate store metadata, privacy documents, and checklists into .appship/").argument("[target]", "ios | android (default: both)").option("--locale <locale>", "generate only for the given locale").option("--dry-run", "list what would be generated without calling AI or writing files").option("--yes", "overwrite existing generated files without asking").option("--non-interactive", "never prompt (CI): skip confirmations, overwrite existing files").action(
+  async (targetArg, options) => {
+    const projectRoot = process.cwd();
+    let target;
+    if (targetArg === "ios" || targetArg === "android") target = targetArg;
+    else if (targetArg !== void 0 && targetArg !== "metadata") {
+      console.error(pc2.red(`\u2717 Unknown target "${targetArg}". Use ios, android, or omit.`));
+      process.exitCode = 1;
+      return;
+    }
+    let config;
+    try {
+      config = await loadConfig(projectRoot);
+    } catch (error) {
+      if (error instanceof ConfigError) {
+        console.error(pc2.red(`\u2717 ${error.message}`));
+        process.exitCode = 1;
+        return;
+      }
+      throw error;
+    }
+    if (config.project.description.startsWith("[CONFIRM:")) {
+      console.error(
+        pc2.red("\u2717 project.description in appship.yml is still a placeholder. ") + "Fill it in (or re-run `appship init`) before generating."
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const generateOptions = {
+      ...target ? { target } : {},
+      ...options.locale ? { locales: [options.locale] } : {}
+    };
+    if (options.dryRun) {
+      console.log(pc2.bold("Would generate (no AI calls, no writes):"));
+      for (const path of planArtifacts(config, generateOptions)) {
+        console.log(`  ${path}`);
+      }
+      return;
+    }
+    let scan;
+    try {
+      scan = await scanProject(projectRoot);
+    } catch (error) {
+      if (error instanceof UnsupportedProjectError) {
+        console.error(pc2.red(`\u2717 ${error.message}`));
+        process.exitCode = 1;
+        return;
+      }
+      throw error;
+    }
+    await mergePreviousConfirmations(projectRoot, scan);
+    const interactive = !options.nonInteractive && Boolean(process.stdout.isTTY);
+    if (!await confirmFindings(scan, interactive)) {
+      console.log(pc2.yellow("Cancelled \u2014 nothing was generated."));
+      process.exitCode = 1;
+      return;
+    }
+    const existing = planArtifacts(config, generateOptions).filter(
+      (path) => existsSync3(join10(projectRoot, path))
+    );
+    if (existing.length > 0 && !options.yes && interactive) {
+      const overwrite = await p2.confirm({
+        message: `${existing.length} generated file(s) already exist and will be overwritten. Continue?`,
+        initialValue: true
+      });
+      if (p2.isCancel(overwrite) || !overwrite) {
+        console.log(pc2.yellow("Cancelled \u2014 nothing was generated."));
+        process.exitCode = 1;
+        return;
+      }
+    }
+    let provider;
+    try {
+      provider = createProvider(config);
+    } catch (error) {
+      if (error instanceof AIProviderError) {
+        console.error(pc2.red(`\u2717 ${error.message}`));
+        process.exitCode = 1;
+        return;
+      }
+      throw error;
+    }
+    console.log(
+      `Generating with ${pc2.cyan(provider.name)} for locales: ${(generateOptions.locales ?? config.stores.locales).join(", ")} ...`
+    );
+    let result;
+    try {
+      result = await runGenerate(projectRoot, config, scan, provider, generateOptions);
+    } catch (error) {
+      if (error instanceof AIProviderError) {
+        console.error(pc2.red(`\u2717 ${error.message}`));
+        process.exitCode = 1;
+        return;
+      }
+      throw error;
+    }
+    await writeFile4(
+      join10(projectRoot, PRIVACY_REPORT_PATH),
+      JSON.stringify(scan.privacyReport, null, 2) + "\n",
+      "utf8"
+    );
+    console.log();
+    for (const file of result.files) {
+      const marker = file.violations.length > 0 ? pc2.yellow("\u26A0") : pc2.green("\u2713");
+      console.log(`${marker} ${file.path}`);
+      for (const violation of file.violations) {
+        console.log(pc2.yellow(`    VALIDATION: ${violation.message}`));
+      }
+    }
+    const violationCount = result.files.reduce((n, f) => n + f.violations.length, 0);
+    console.log();
+    if (violationCount > 0) {
+      console.log(
+        pc2.yellow(`\u26A0 ${violationCount} constraint violation(s) remain after retries \u2014 fix manually.`)
+      );
+    }
+    console.log(`Next: run ${pc2.cyan("appship doctor")} to check submission readiness.`);
+  }
+);
+
+// src/cli/doctor.ts
+import { mkdir as mkdir4, writeFile as writeFile5 } from "fs/promises";
+import { join as join12 } from "path";
+import { Command as Command3 } from "commander";
+import pc3 from "picocolors";
+
+// src/core/doctor/engine.ts
+import { existsSync as existsSync4 } from "fs";
+import { readFile as readFile8 } from "fs/promises";
+import { join as join11 } from "path";
+import glob4 from "fast-glob";
+var EMOJI_PATTERN2 = new RegExp("\\p{Extended_Pictographic}", "u");
+function humanize(id) {
+  return id.replace(/-/g, " ").replace(/^./, (c) => c.toUpperCase());
+}
+function deriveFindings(ctx) {
+  const findings = /* @__PURE__ */ new Set();
+  if (ctx.config.project.requires_login === true || ctx.scan.sdkReport.sdks.some((s) => s.category === "auth")) {
+    findings.add("login_detected");
+  }
+  if (ctx.scan.sdkReport.sdks.some((s) => s.category === "analytics")) {
+    findings.add("analytics_detected");
+  }
+  if (ctx.scan.sdkReport.sdks.some((s) => s.category === "payments")) {
+    findings.add("payments_detected");
+  }
+  return findings;
+}
+async function evaluateRule(rule, ctx, findings) {
+  const base = {
+    id: rule.id,
+    store: rule.store,
+    category: rule.category,
+    severity: rule.severity,
+    ...rule.guideline ? { guideline: rule.guideline } : {},
+    ...rule.fix_suggestions ? { fixSuggestions: rule.fix_suggestions } : {}
+  };
+  const pass = () => ({
+    ...base,
+    status: "pass",
+    message: rule.pass_message ?? humanize(rule.id)
+  });
+  const fail = (detail) => ({
+    ...base,
+    status: "fail",
+    message: rule.message,
+    ...detail ? { detail } : {}
+  });
+  const skip = (why) => ({ ...base, status: "skip", message: why });
+  if (rule.condition && !findings.has(rule.condition.finding)) {
+    return skip(`not applicable (${rule.condition.finding} not found)`);
+  }
+  const appshipDir = join11(ctx.projectRoot, ".appship");
+  if (rule.check.type === "file_exists") {
+    const target = join11(appshipDir, String(rule.check.value));
+    return existsSync4(target) ? pass() : fail();
+  }
+  const targets = rule.target ? await glob4(rule.target, { cwd: appshipDir }) : [];
+  if (targets.length === 0) {
+    return skip("no generated files to check (run appship generate)");
+  }
+  for (const file of targets) {
+    const content = (await readFile8(join11(appshipDir, file), "utf8")).trimEnd();
+    switch (rule.check.type) {
+      case "max_length":
+        if (content.length > Number(rule.check.value)) {
+          return fail(`${file}: ${content.length} characters`);
+        }
+        break;
+      case "not_contains": {
+        const needle = String(rule.check.value);
+        if (content.includes(needle)) {
+          const count = content.split(needle).length - 1;
+          return fail(`${file}: ${count} occurrence(s)`);
+        }
+        break;
+      }
+      case "no_emoji":
+        if (EMOJI_PATTERN2.test(content)) {
+          return fail(file);
+        }
+        break;
+    }
+  }
+  return pass();
+}
+async function builtInChecks(ctx, findings) {
+  const results = [];
+  const { config, scan, projectRoot } = ctx;
+  const push = (store, id, category, severity, ok, passMessage, failMessage, extra = {}) => results.push({
+    id,
+    store,
+    category,
+    severity,
+    status: ok ? "pass" : "fail",
+    message: ok ? passMessage : failMessage,
+    ...extra
+  });
+  push(
+    "app-store",
+    "bundle-id-configured",
+    "required",
+    "error",
+    scan.project.ios?.bundleId != null,
+    "Bundle ID configured",
+    "iOS bundle ID could not be detected"
+  );
+  push(
+    "google-play",
+    "package-name-configured",
+    "required",
+    "error",
+    scan.project.android?.packageName != null,
+    "Android package name configured",
+    "Android package name could not be detected"
+  );
+  const appIcon = await glob4("ios/**/AppIcon.appiconset", {
+    cwd: projectRoot,
+    onlyDirectories: true,
+    ignore: ["**/node_modules/**", "**/Pods/**"]
+  });
+  push(
+    "app-store",
+    "app-icon-present",
+    "required",
+    "warning",
+    appIcon.length > 0,
+    "App icon found",
+    "App icon (AppIcon.appiconset) not found in the iOS project"
+  );
+  const privacyManifest = await glob4("ios/**/PrivacyInfo.xcprivacy", {
+    cwd: projectRoot,
+    ignore: ["**/node_modules/**", "**/Pods/**"]
+  });
+  push(
+    "app-store",
+    "privacy-manifest-present",
+    "required",
+    "warning",
+    privacyManifest.length > 0,
+    "Privacy manifest found",
+    "PrivacyInfo.xcprivacy not found \u2014 Apple requires a privacy manifest"
+  );
+  for (const store of ["app-store", "google-play"]) {
+    push(
+      store,
+      "support-url-configured",
+      "required",
+      "error",
+      config.project.support_url !== void 0,
+      "Support URL configured",
+      "Support URL missing \u2014 add project.support_url to appship.yml"
+    );
+    push(
+      store,
+      "description-filled",
+      "required",
+      "error",
+      !config.project.description.startsWith("[CONFIRM:"),
+      "Project description filled in",
+      "project.description in appship.yml is still a placeholder"
+    );
+    push(
+      store,
+      "generated-materials-exist",
+      "required",
+      "error",
+      existsSync4(join11(projectRoot, ".appship", store)),
+      "Store materials generated",
+      `No generated materials for ${store} \u2014 run appship generate`
+    );
+  }
+  for (const permission of scan.permissions.ios) {
+    push(
+      "app-store",
+      `permission-quality:${permission.key}`,
+      "quality",
+      "warning",
+      permission.qualityAssessment === "ok",
+      `${permission.key} usage description looks specific`,
+      `${permission.key} usage description ${permission.qualityAssessment === "missing" ? "is empty" : "is too generic"}: "${permission.currentMessage}"`,
+      {
+        fixSuggestions: [
+          'Describe the concrete user-facing situation, e.g. "Microphone access is used when you join a voice room and speak with other participants."'
+        ]
+      }
+    );
+  }
+  const unconfirmed = Object.entries(scan.privacyReport.dataCollection).filter(([, e]) => e.requiresConfirmation && e.confirmed === null).map(([t]) => t);
+  for (const store of ["app-store", "google-play"]) {
+    push(
+      store,
+      "data-collection-confirmed",
+      "consistency",
+      "error",
+      unconfirmed.length === 0,
+      "All detected data collection confirmed",
+      `Unconfirmed data-collection detection(s): ${unconfirmed.join(", ")} \u2014 run appship generate to confirm`
+    );
+  }
+  const privacyPolicyPath = join11(projectRoot, ".appship/legal/privacy-policy.md");
+  if (findings.has("analytics_detected") || scan.sdkReport.sdks.some((s) => s.category === "crash-reporting")) {
+    if (existsSync4(privacyPolicyPath)) {
+      const policy = await readFile8(privacyPolicyPath, "utf8");
+      const missing = scan.sdkReport.sdks.filter((s) => s.category === "analytics" || s.category === "crash-reporting").filter((s) => !policy.toLowerCase().includes(s.name.toLowerCase())).map((s) => s.name);
+      for (const store of ["app-store", "google-play"]) {
+        push(
+          store,
+          "privacy-policy-mentions-sdks",
+          "consistency",
+          "warning",
+          missing.length === 0,
+          "Privacy policy mentions detected analytics/crash SDKs",
+          `Privacy policy does not mention: ${missing.join(", ")}`
+        );
+      }
+    }
+  }
+  return results;
+}
+function scoreOf(results) {
+  const evaluated = results.filter((r) => r.status !== "skip");
+  const weight = (r) => r.severity === "error" ? 3 : 1;
+  const total = evaluated.reduce((n, r) => n + weight(r), 0);
+  if (total === 0) return 100;
+  const passed = evaluated.filter((r) => r.status === "pass").reduce((n, r) => n + weight(r), 0);
+  return Math.round(100 * passed / total);
+}
+async function runDoctor(ctx, rules, stores = ["app-store", "google-play"]) {
+  const findings = deriveFindings(ctx);
+  const declarative = await Promise.all(rules.map((rule) => evaluateRule(rule, ctx, findings)));
+  const builtIn = await builtInChecks(ctx, findings);
+  const all = [...builtIn, ...declarative];
+  return stores.map((store) => {
+    const results = all.filter((r) => r.store === store);
+    return { store, score: scoreOf(results), results };
+  });
+}
+
+// src/cli/doctor.ts
+var STORE_LABELS = {
+  "app-store": "App Store",
+  "google-play": "Google Play"
+};
+function renderReport(report) {
+  console.log();
+  console.log(pc3.bold(`${STORE_LABELS[report.store]} readiness: ${report.score}%`));
+  console.log();
+  const order = { pass: 0, fail: 1, skip: 2 };
+  const sorted = [...report.results].sort(
+    (a, b) => order[a.status] - order[b.status] || (a.severity === b.severity ? 0 : a.severity === "error" ? -1 : 1)
+  );
+  for (const result of sorted) {
+    if (result.status === "skip") continue;
+    const icon = result.status === "pass" ? pc3.green("\u2713") : result.severity === "error" ? pc3.red("\u2717") : pc3.yellow("\u26A0");
+    const detail = result.detail ? pc3.dim(` (${result.detail})`) : "";
+    console.log(`${icon} ${result.message}${detail}`);
+    if (result.status === "fail") {
+      if (result.guideline) console.log(pc3.dim(`    ${result.guideline}`));
+      for (const fix of result.fixSuggestions ?? []) {
+        console.log(pc3.dim(`    \u2192 ${fix}`));
+      }
+    }
+  }
+  const skipped = report.results.filter((r) => r.status === "skip").length;
+  if (skipped > 0) {
+    console.log(pc3.dim(`(${skipped} check(s) skipped \u2014 not applicable or nothing generated yet)`));
+  }
+}
+var doctorCommand = new Command3("doctor").description("Check store submission readiness (runs fully offline, no AI calls)").option("--store <store>", "app-store | google-play (default: both)").option("--json", "output machine-readable JSON instead of the human report").action(async (options) => {
+  const projectRoot = process.cwd();
+  let stores = ["app-store", "google-play"];
+  if (options.store !== void 0) {
+    const parsed = storeSchema.safeParse(options.store);
+    if (!parsed.success) {
+      console.error(pc3.red(`\u2717 Unknown store "${options.store}". Use app-store or google-play.`));
+      process.exitCode = 1;
+      return;
+    }
+    stores = [parsed.data];
+  }
+  let config;
+  let scan;
+  try {
+    config = await loadConfig(projectRoot);
+    scan = await scanProject(projectRoot);
+  } catch (error) {
+    if (error instanceof ConfigError || error instanceof UnsupportedProjectError) {
+      console.error(pc3.red(`\u2717 ${error.message}`));
+      process.exitCode = 1;
+      return;
+    }
+    throw error;
+  }
+  await mergePreviousConfirmations(projectRoot, scan);
+  const rules = await loadRulesWithCache();
+  const reports = await runDoctor({ projectRoot, config, scan }, rules, stores);
+  const machineReport = {
+    appshipVersion: scan.project.appshipVersion,
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    stores: Object.fromEntries(reports.map((r) => [r.store, { score: r.score, results: r.results }]))
+  };
+  const checklistDir = join12(projectRoot, ".appship", "checklist");
+  await mkdir4(checklistDir, { recursive: true });
+  await writeFile5(
+    join12(checklistDir, "release-readiness.json"),
+    JSON.stringify(machineReport, null, 2) + "\n",
+    "utf8"
+  );
+  if (options.json) {
+    console.log(JSON.stringify(machineReport, null, 2));
+  } else {
+    for (const report of reports) renderReport(report);
+    console.log();
+    console.log(pc3.dim("Full report written to .appship/checklist/release-readiness.json"));
+  }
+  const hasErrors = reports.some(
+    (r) => r.results.some((result) => result.status === "fail" && result.severity === "error")
+  );
+  if (hasErrors) process.exitCode = 1;
+});
+
+// src/cli/localize.ts
+import { Command as Command4 } from "commander";
+import pc4 from "picocolors";
+
+// src/core/localize/index.ts
+import { mkdir as mkdir5, readFile as readFile9, writeFile as writeFile6 } from "fs/promises";
+import { existsSync as existsSync5 } from "fs";
+import { dirname as dirname4, join as join13 } from "path";
+import { z as z7 } from "zod";
+var TRANSLATE_SYSTEM_PROMPT = `You are AppShip, localizing app store listings.
+
+Rules you must never break:
+- Translate meaning, not words: write natural, market-appropriate store copy for the target locale.
+- Do not add, remove, or invent product claims \u2014 the source text is the only source of truth.
+- Keywords must be adapted for how users in the target market actually search, not translated literally.
+- Respect every character limit stated in the field descriptions. Translations often expand; shorten rather than exceed limits.
+- Keep placeholders of the form [CONFIRM: ...] exactly as-is, untranslated.`;
+var APP_STORE_SPEC = {
+  store: "app-store",
+  storeLabel: "Apple App Store",
+  files: {
+    name: "name",
+    subtitle: "subtitle",
+    description: "description",
+    keywords: "keywords",
+    "promotional-text": "promotionalText",
+    "release-notes": "releaseNotes"
+  },
+  jsonSchema: {
+    type: "object",
+    additionalProperties: false,
+    required: ["name", "subtitle", "description", "keywords", "promotionalText", "releaseNotes"],
+    properties: {
+      name: { type: "string", description: "App name, at most 30 characters" },
+      subtitle: { type: "string", description: "Subtitle, at most 30 characters" },
+      description: { type: "string", description: "Full description, at most 4000 characters" },
+      keywords: {
+        type: "string",
+        description: "Comma-separated keywords adapted to the target market, at most 100 characters total"
+      },
+      promotionalText: { type: "string", description: "Promotional text, at most 170 characters" },
+      releaseNotes: { type: "string", description: "Release notes, at most 4000 characters" }
+    }
+  },
+  validate: (values) => validateFields(values, APP_STORE_LIMITS),
+  // Review notes are for the App Review team — they stay in the source language.
+  copyFiles: ["review-notes"]
+};
+var PLAY_SPEC = {
+  store: "google-play",
+  storeLabel: "Google Play",
+  files: {
+    title: "title",
+    "short-description": "shortDescription",
+    "full-description": "fullDescription",
+    "release-notes": "releaseNotes"
+  },
+  jsonSchema: {
+    type: "object",
+    additionalProperties: false,
+    required: ["title", "shortDescription", "fullDescription", "releaseNotes"],
+    properties: {
+      title: { type: "string", description: "App title, at most 30 characters, no emoji" },
+      shortDescription: { type: "string", description: "Short description, at most 80 characters" },
+      fullDescription: { type: "string", description: "Full description, at most 4000 characters" },
+      releaseNotes: { type: "string", description: "Release notes, at most 500 characters" }
+    }
+  },
+  validate: (values) => [
+    ...validateFields(values, GOOGLE_PLAY_LIMITS),
+    ...values["title"] !== void 0 ? validatePlayTitlePolicy(values["title"]) : []
+  ],
+  copyFiles: []
+};
+var LocalizeError = class extends Error {
+};
+function specsFor(target) {
+  return [
+    ...target !== "android" ? [APP_STORE_SPEC] : [],
+    ...target !== "ios" ? [PLAY_SPEC] : []
+  ];
+}
+async function readSourceListing(projectRoot, spec, sourceLocale) {
+  const dir = join13(projectRoot, ".appship", spec.store, sourceLocale);
+  if (!existsSync5(dir)) {
+    throw new LocalizeError(
+      `No generated ${spec.storeLabel} listing for source locale ${sourceLocale} (${dir} not found). Run \`appship generate\` first.`
+    );
+  }
+  const values = {};
+  for (const [filename, field] of Object.entries(spec.files)) {
+    const path = join13(dir, `${filename}.txt`);
+    try {
+      values[field] = (await readFile9(path, "utf8")).trimEnd();
+    } catch {
+      throw new LocalizeError(
+        `Missing source file ${spec.store}/${sourceLocale}/${filename}.txt. Run \`appship generate\` first.`
+      );
+    }
+  }
+  return values;
+}
+function planLocalize(options) {
+  const paths = [];
+  for (const spec of specsFor(options.target)) {
+    for (const locale of options.targetLocales) {
+      for (const filename of [...Object.keys(spec.files), ...spec.copyFiles]) {
+        paths.push(`.appship/${spec.store}/${locale}/${filename}.txt`);
+      }
+    }
+  }
+  return paths;
+}
+async function runLocalize(projectRoot, config, provider, options) {
+  const sourceLocale = options.sourceLocale ?? config.stores.default_locale;
+  const targets = options.targetLocales.filter((locale) => locale !== sourceLocale);
+  if (targets.length === 0) {
+    throw new LocalizeError("No target locales to localize (source locale excluded).");
+  }
+  const files = [];
+  for (const spec of specsFor(options.target)) {
+    const source = await readSourceListing(projectRoot, spec, sourceLocale);
+    const fieldSchema = z7.record(z7.string(), z7.string());
+    for (const locale of targets) {
+      const prompt = `Translate this ${spec.storeLabel} listing from locale "${sourceLocale}" to locale "${locale}".
+
+Source listing (JSON):
+${JSON.stringify(source, null, 2)}`;
+      const { listing, violations } = await generateWithRetry(
+        provider,
+        prompt,
+        spec.jsonSchema,
+        (raw) => fieldSchema.parse(raw),
+        (values) => spec.validate(values),
+        TRANSLATE_SYSTEM_PROMPT
+      );
+      for (const [filename, field] of Object.entries(spec.files)) {
+        files.push({
+          path: join13(".appship", spec.store, locale, `${filename}.txt`),
+          content: (listing[field] ?? "") + "\n",
+          violations: violations.filter((v) => v.field === field)
+        });
+      }
+      for (const filename of spec.copyFiles) {
+        const sourcePath = join13(projectRoot, ".appship", spec.store, sourceLocale, `${filename}.txt`);
+        if (existsSync5(sourcePath)) {
+          files.push({
+            path: join13(".appship", spec.store, locale, `${filename}.txt`),
+            content: await readFile9(sourcePath, "utf8"),
+            violations: []
+          });
+        }
+      }
+    }
+  }
+  if (!options.dryRun) {
+    for (const file of files) {
+      const absolute = join13(projectRoot, file.path);
+      await mkdir5(dirname4(absolute), { recursive: true });
+      await writeFile6(absolute, file.content, "utf8");
+    }
+  }
+  return { files, sourceLocale };
+}
+
+// src/cli/localize.ts
+var localizeCommand = new Command4("localize").description("Translate generated store listings into additional locales").argument("[locales...]", "target locales, e.g. ko-KR ja-JP (default: appship.yml stores.locales)").option("--source <locale>", "source locale to translate from (default: stores.default_locale)").option("--target <target>", "ios | android (default: both stores)").option("--dry-run", "list what would be localized without calling AI or writing files").action(
+  async (localeArgs, options) => {
+    const projectRoot = process.cwd();
+    let target;
+    if (options.target === "ios" || options.target === "android") target = options.target;
+    else if (options.target !== void 0) {
+      console.error(pc4.red(`\u2717 Unknown target "${options.target}". Use ios or android.`));
+      process.exitCode = 1;
+      return;
+    }
+    let config;
+    try {
+      config = await loadConfig(projectRoot);
+    } catch (error) {
+      if (error instanceof ConfigError) {
+        console.error(pc4.red(`\u2717 ${error.message}`));
+        process.exitCode = 1;
+        return;
+      }
+      throw error;
+    }
+    const sourceLocale = options.source ?? config.stores.default_locale;
+    const targetLocales = (localeArgs.length > 0 ? localeArgs : config.stores.locales).filter((locale) => locale !== sourceLocale);
+    if (targetLocales.length === 0) {
+      console.error(
+        pc4.red("\u2717 No target locales. Pass them as arguments (e.g. `appship localize ko-KR ja-JP`) ") + "or add them to stores.locales in appship.yml."
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const localizeOptions = {
+      targetLocales,
+      sourceLocale,
+      ...target ? { target } : {}
+    };
+    if (options.dryRun) {
+      console.log(pc4.bold(`Would localize ${sourceLocale} \u2192 ${targetLocales.join(", ")} (no AI calls, no writes):`));
+      for (const path of planLocalize(localizeOptions)) {
+        console.log(`  ${path}`);
+      }
+      return;
+    }
+    let provider;
+    try {
+      provider = createProvider(config);
+    } catch (error) {
+      if (error instanceof AIProviderError) {
+        console.error(pc4.red(`\u2717 ${error.message}`));
+        process.exitCode = 1;
+        return;
+      }
+      throw error;
+    }
+    console.log(
+      `Localizing ${pc4.cyan(sourceLocale)} \u2192 ${pc4.cyan(targetLocales.join(", "))} with ${provider.name} ...`
+    );
+    let result;
+    try {
+      result = await runLocalize(projectRoot, config, provider, localizeOptions);
+    } catch (error) {
+      if (error instanceof LocalizeError || error instanceof AIProviderError) {
+        console.error(pc4.red(`\u2717 ${error.message}`));
+        process.exitCode = 1;
+        return;
+      }
+      throw error;
+    }
+    console.log();
+    for (const file of result.files) {
+      const marker = file.violations.length > 0 ? pc4.yellow("\u26A0") : pc4.green("\u2713");
+      console.log(`${marker} ${file.path}`);
+      for (const violation of file.violations) {
+        console.log(pc4.yellow(`    VALIDATION: ${violation.message}`));
+      }
+    }
+    const missingFromConfig = targetLocales.filter(
+      (locale) => !config.stores.locales.includes(locale)
+    );
+    if (missingFromConfig.length > 0) {
+      console.log();
+      console.log(
+        pc4.yellow("\u26A0") + ` Add ${missingFromConfig.join(", ")} to stores.locales in appship.yml so generate and doctor include them.`
+      );
+    }
+  }
+);
+
+// src/cli/export.ts
+import { existsSync as existsSync8 } from "fs";
+import { join as join16 } from "path";
+import { Command as Command5 } from "commander";
+import pc5 from "picocolors";
+
+// src/core/fastlane/index.ts
+import { mkdir as mkdir6, readdir as readdir2, readFile as readFile10, writeFile as writeFile7 } from "fs/promises";
+import { existsSync as existsSync6 } from "fs";
+import { dirname as dirname5, join as join14 } from "path";
+var FastlaneExportError = class extends Error {
+};
+var DELIVER_FILE_MAP = [
+  ["name", "name"],
+  ["subtitle", "subtitle"],
+  ["description", "description"],
+  ["keywords", "keywords"],
+  ["promotional-text", "promotional_text"],
+  ["release-notes", "release_notes"]
+];
+var SUPPLY_FILE_MAP = [
+  ["title", "title"],
+  ["short-description", "short_description"],
+  ["full-description", "full_description"]
+];
+var NON_LOCALE_DIRS = /* @__PURE__ */ new Set(["privacy", "screenshots"]);
+async function listLocales(storeDir) {
+  if (!existsSync6(storeDir)) return [];
+  const entries = await readdir2(storeDir, { withFileTypes: true });
+  return entries.filter((e) => e.isDirectory() && !NON_LOCALE_DIRS.has(e.name)).map((e) => e.name).sort();
+}
+async function copyListingFiles(projectRoot, sourceDir, destDir, fileMap, written) {
+  for (const [src, dest] of fileMap) {
+    const sourcePath = join14(projectRoot, sourceDir, `${src}.txt`);
+    if (!existsSync6(sourcePath)) continue;
+    const destPath = join14(destDir, `${dest}.txt`);
+    await mkdir6(dirname5(join14(projectRoot, destPath)), { recursive: true });
+    await writeFile7(join14(projectRoot, destPath), await readFile10(sourcePath, "utf8"), "utf8");
+    written.push(destPath);
+  }
+}
+function appfileContent(config) {
+  const lines = ["# Generated by appship \u2014 fastlane app identity."];
+  if (config.platforms.ios) {
+    lines.push(`app_identifier "${config.platforms.ios.bundle_id}"`);
+  }
+  if (config.platforms.android) {
+    lines.push(`package_name "${config.platforms.android.package_name}"`);
+    lines.push('# json_key_file "path/to/play-console-service-account.json"');
+  }
+  return lines.join("\n") + "\n";
+}
+function fastfileContent(config) {
+  const sections = ["# Generated by appship \u2014 metadata upload lanes."];
+  if (config.platforms.ios) {
+    sections.push(
+      `platform :ios do
+  desc "Upload App Store metadata prepared by appship (no binary, no screenshots)"
+  lane :upload_metadata do
+    deliver(
+      metadata_path: "fastlane/metadata",
+      skip_binary_upload: true,
+      skip_screenshots: true,
+      force: true
+    )
+  end
+
+  desc "Upload a build to TestFlight (used by appship upload ios)"
+  lane :upload_testflight do |options|
+    upload_to_testflight(
+      ipa: options[:ipa],
+      skip_waiting_for_build_processing: true
+    )
+  end
+
+  desc "Submit an already-uploaded build for App Store review (used by appship submit ios)"
+  lane :submit_review do |options|
+    deliver(
+      metadata_path: "fastlane/metadata",
+      skip_binary_upload: true,
+      skip_screenshots: true,
+      submit_for_review: true,
+      automatic_release: false,
+      build_number: options[:build_number] || "latest",
+      force: true
+    )
+  end
+end`
+    );
+  }
+  if (config.platforms.android) {
+    sections.push(
+      `platform :android do
+  desc "Upload Google Play metadata prepared by appship (no binary, no images)"
+  lane :upload_metadata do
+    supply(
+      metadata_path: "fastlane/metadata/android",
+      skip_upload_apk: true,
+      skip_upload_aab: true,
+      skip_upload_screenshots: true,
+      skip_upload_images: true,
+      skip_upload_changelogs: false
+    )
+  end
+
+  desc "Upload a build to a Play track (used by appship upload android)"
+  lane :upload_build do |options|
+    upload_to_play_store(
+      aab: options[:aab],
+      track: options[:track] || "internal",
+      skip_upload_metadata: true,
+      skip_upload_screenshots: true,
+      skip_upload_images: true,
+      skip_upload_changelogs: true
+    )
+  end
+
+  desc "Promote a tested build to a release track for review (used by appship submit android)"
+  lane :submit_review do |options|
+    upload_to_play_store(
+      track: options[:from_track] || "internal",
+      track_promote_to: options[:track] || "production",
+      skip_upload_apk: true,
+      skip_upload_aab: true,
+      skip_upload_metadata: true,
+      skip_upload_screenshots: true,
+      skip_upload_images: true,
+      skip_upload_changelogs: true
+    )
+  end
+end`
+    );
+  }
+  return sections.join("\n\n") + "\n";
+}
+async function exportFastlane(projectRoot, config, options = {}) {
+  const written = [];
+  const skipped = [];
+  const wantIos = options.target !== "android" && config.platforms.ios !== void 0;
+  const wantAndroid = options.target !== "ios" && config.platforms.android !== void 0;
+  const appStoreDir = join14(projectRoot, ".appship", "app-store");
+  const playDir = join14(projectRoot, ".appship", "google-play");
+  const iosLocales = wantIos ? await listLocales(appStoreDir) : [];
+  const androidLocales = wantAndroid ? await listLocales(playDir) : [];
+  if (iosLocales.length === 0 && androidLocales.length === 0) {
+    throw new FastlaneExportError(
+      "No generated store listings found under .appship/. Run `appship generate` first."
+    );
+  }
+  for (const locale of iosLocales) {
+    const destDir = join14("fastlane", "metadata", locale);
+    await copyListingFiles(
+      projectRoot,
+      join14(".appship", "app-store", locale),
+      destDir,
+      DELIVER_FILE_MAP,
+      written
+    );
+    if (config.project.support_url) {
+      const path = join14(destDir, "support_url.txt");
+      await mkdir6(dirname5(join14(projectRoot, path)), { recursive: true });
+      await writeFile7(join14(projectRoot, path), config.project.support_url + "\n", "utf8");
+      written.push(path);
+    }
+  }
+  if (iosLocales.length > 0) {
+    const reviewSource = join14(
+      projectRoot,
+      ".appship",
+      "app-store",
+      iosLocales.includes(config.stores.default_locale) ? config.stores.default_locale : iosLocales[0],
+      "review-notes.txt"
+    );
+    if (existsSync6(reviewSource)) {
+      const path = join14("fastlane", "metadata", "review_information", "notes.txt");
+      await mkdir6(dirname5(join14(projectRoot, path)), { recursive: true });
+      await writeFile7(join14(projectRoot, path), await readFile10(reviewSource, "utf8"), "utf8");
+      written.push(path);
+    }
+  }
+  for (const locale of androidLocales) {
+    const destDir = join14("fastlane", "metadata", "android", locale);
+    await copyListingFiles(
+      projectRoot,
+      join14(".appship", "google-play", locale),
+      destDir,
+      SUPPLY_FILE_MAP,
+      written
+    );
+    const releaseNotes = join14(projectRoot, ".appship", "google-play", locale, "release-notes.txt");
+    if (existsSync6(releaseNotes)) {
+      const path = join14(destDir, "changelogs", "default.txt");
+      await mkdir6(dirname5(join14(projectRoot, path)), { recursive: true });
+      await writeFile7(join14(projectRoot, path), await readFile10(releaseNotes, "utf8"), "utf8");
+      written.push(path);
+    }
+  }
+  const scaffolding = [
+    [join14("fastlane", "Appfile"), appfileContent(config)],
+    [join14("fastlane", "Fastfile"), fastfileContent(config)]
+  ];
+  for (const [path, content] of scaffolding) {
+    const absolute = join14(projectRoot, path);
+    if (existsSync6(absolute) && !options.force) {
+      skipped.push(path);
+      continue;
+    }
+    await mkdir6(dirname5(absolute), { recursive: true });
+    await writeFile7(absolute, content, "utf8");
+    written.push(path);
+  }
+  return { written, skipped };
+}
+
+// src/core/ci/index.ts
+import { mkdir as mkdir7, writeFile as writeFile8 } from "fs/promises";
+import { existsSync as existsSync7 } from "fs";
+import { dirname as dirname6, join as join15 } from "path";
+var CIExportError = class extends Error {
+};
+function readinessWorkflowContent() {
+  return `# Generated by appship \u2014 release readiness gate.
+# appship doctor runs fully offline and exits 1 on error-severity findings.
+name: Release readiness
+
+on:
+  pull_request:
+
+jobs:
+  doctor:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: npx appship-cli doctor
+`;
+}
+var ANDROID_BUILD_STEPS = {
+  rn: `      # TODO(appship): adjust to your release signing setup.
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 17
+      - name: Build release bundle
+        run: cd android && ./gradlew bundleRelease`,
+  expo: `      # TODO(appship): this project uses Expo \u2014 either build with EAS
+      # (eas build -p android --non-interactive) and download the artifact,
+      # or prebuild and use gradle as below.
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 17
+      - name: Build release bundle
+        run: npx expo prebuild -p android --no-install && cd android && ./gradlew bundleRelease`,
+  native: `      # TODO(appship): adjust to your release signing setup.
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 17
+      - name: Build release bundle
+        run: ./gradlew bundleRelease`
+};
+function releaseWorkflowContent(config, options) {
+  const wantIos = options.target !== "android" && config.platforms.ios !== void 0;
+  const wantAndroid = options.target !== "ios" && config.platforms.android !== void 0;
+  const npmCi = options.hasNodeProject === false ? "" : "\n      - run: npm ci";
+  const jobs = [];
+  if (wantAndroid) {
+    jobs.push(`  android:
+    if: \${{ inputs.platform == 'android' || inputs.platform == 'both' }}
+    runs-on: ubuntu-latest
+    env:
+      # Play Console service account JSON \u2014 see fastlane supply docs.
+      SUPPLY_JSON_KEY_DATA: \${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22${npmCi}
+${ANDROID_BUILD_STEPS[options.androidBuildStyle ?? "rn"]}
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.3'
+          bundler-cache: true
+      - name: Upload to Play track
+        run: npx appship-cli upload android --track \${{ inputs.track }} --yes
+      - name: Submit for review
+        if: \${{ inputs.submit }}
+        run: npx appship-cli submit android --from-track \${{ inputs.track }} --yes`);
+  }
+  if (wantIos) {
+    jobs.push(`  ios:
+    if: \${{ inputs.platform == 'ios' || inputs.platform == 'both' }}
+    runs-on: macos-latest
+    env:
+      # App Store Connect API key \u2014 see fastlane app_store_connect_api_key docs.
+      APP_STORE_CONNECT_API_KEY_KEY_ID: \${{ secrets.ASC_KEY_ID }}
+      APP_STORE_CONNECT_API_KEY_ISSUER_ID: \${{ secrets.ASC_ISSUER_ID }}
+      APP_STORE_CONNECT_API_KEY_KEY: \${{ secrets.ASC_KEY_CONTENT }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22${npmCi}
+      # TODO(appship): building a signed .ipa needs your certificates and
+      # provisioning profiles in CI \u2014 fastlane match is the usual answer
+      # (https://docs.fastlane.tools/actions/match/). Replace this step.
+      - name: Build signed ipa
+        run: 'echo "TODO: build a signed .ipa (e.g. fastlane gym after fastlane match)" && exit 1'
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.3'
+          bundler-cache: true
+      - name: Upload to TestFlight
+        run: npx appship-cli upload ios --yes
+      - name: Submit for review
+        if: \${{ inputs.submit }}
+        run: npx appship-cli submit ios --yes`);
+  }
+  return `# Generated by appship \u2014 build, upload to test tracks, and optionally submit.
+# Search for TODO(appship) and finish the build steps before first use.
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      platform:
+        description: Platform to release
+        type: choice
+        options: [${[wantIos ? "ios" : null, wantAndroid ? "android" : null, wantIos && wantAndroid ? "both" : null].filter(Boolean).join(", ")}]
+        required: true
+      track:
+        description: Play track for the android upload
+        type: string
+        default: internal
+      submit:
+        description: Also submit for store review (confirmation-gated by doctor)
+        type: boolean
+        default: false
+
+jobs:
+${jobs.join("\n\n")}
+`;
+}
+async function exportCI(projectRoot, config, options = {}) {
+  const wantIos = options.target !== "android" && config.platforms.ios !== void 0;
+  const wantAndroid = options.target !== "ios" && config.platforms.android !== void 0;
+  if (!wantIos && !wantAndroid) {
+    throw new CIExportError("No platforms configured in appship.yml for the requested target.");
+  }
+  const files = [
+    [join15(".github", "workflows", "appship-readiness.yml"), readinessWorkflowContent()],
+    [join15(".github", "workflows", "appship-release.yml"), releaseWorkflowContent(config, options)]
+  ];
+  const written = [];
+  const skipped = [];
+  for (const [path, content] of files) {
+    const absolute = join15(projectRoot, path);
+    if (existsSync7(absolute) && !options.force) {
+      skipped.push(path);
+      continue;
+    }
+    await mkdir7(dirname6(absolute), { recursive: true });
+    await writeFile8(absolute, content, "utf8");
+    written.push(path);
+  }
+  return { written, skipped };
+}
+
+// src/cli/export.ts
+var exportCommand = new Command5("export").description("Export prepared materials for external tools").argument("<format>", "export format: fastlane | ci").option("--target <target>", "ios | android (default: both)").option("--force", "overwrite existing exported scaffolding files").action(async (format, options) => {
+  const projectRoot = process.cwd();
+  if (format !== "fastlane" && format !== "ci") {
+    console.error(pc5.red(`\u2717 Unknown export format "${format}". Supported: fastlane, ci.`));
+    process.exitCode = 1;
+    return;
+  }
+  let target;
+  if (options.target === "ios" || options.target === "android") target = options.target;
+  else if (options.target !== void 0) {
+    console.error(pc5.red(`\u2717 Unknown target "${options.target}". Use ios or android.`));
+    process.exitCode = 1;
+    return;
+  }
+  let config;
+  try {
+    config = await loadConfig(projectRoot);
+  } catch (error) {
+    if (error instanceof ConfigError) {
+      console.error(pc5.red(`\u2717 ${error.message}`));
+      process.exitCode = 1;
+      return;
+    }
+    throw error;
+  }
+  let result;
+  try {
+    if (format === "fastlane") {
+      result = await exportFastlane(projectRoot, config, {
+        ...target ? { target } : {},
+        ...options.force ? { force: true } : {}
+      });
+    } else {
+      let projectType = null;
+      try {
+        projectType = await detectProjectType(projectRoot);
+      } catch {
+      }
+      const isExpo = projectType === "react-native" && await readExpoConfig(projectRoot) !== null;
+      const androidBuildStyle = projectType === "native-android" ? "native" : isExpo ? "expo" : "rn";
+      result = await exportCI(projectRoot, config, {
+        ...target ? { target } : {},
+        ...options.force ? { force: true } : {},
+        androidBuildStyle,
+        hasNodeProject: existsSync8(join16(projectRoot, "package.json"))
+      });
+    }
+  } catch (error) {
+    if (error instanceof FastlaneExportError || error instanceof CIExportError) {
+      console.error(pc5.red(`\u2717 ${error.message}`));
+      process.exitCode = 1;
+      return;
+    }
+    throw error;
+  }
+  for (const path of result.written) {
+    console.log(`${pc5.green("\u2713")} ${path}`);
+  }
+  for (const path of result.skipped) {
+    console.log(`${pc5.dim("\u2022")} ${path} ${pc5.dim("(exists \u2014 kept; use --force to overwrite)")}`);
+  }
+  console.log();
+  console.log("Next steps:");
+  if (format === "fastlane") {
+    if (config.platforms.ios && target !== "android") {
+      console.log(`  ${pc5.cyan("bundle exec fastlane ios upload_metadata")}   # App Store Connect`);
+    }
+    if (config.platforms.android && target !== "ios") {
+      console.log(`  ${pc5.cyan("bundle exec fastlane android upload_metadata")} # Play Console`);
+    }
+    console.log(pc5.dim("  (requires fastlane auth: App Store Connect API key / Play service account)"));
+  } else {
+    console.log("  1. Search the workflows for TODO(appship) and finish the build steps.");
+    console.log(
+      "  2. Add repository secrets: " + [
+        config.platforms.android && target !== "ios" ? "PLAY_SERVICE_ACCOUNT_JSON" : null,
+        config.platforms.ios && target !== "android" ? "ASC_KEY_ID, ASC_ISSUER_ID, ASC_KEY_CONTENT" : null
+      ].filter(Boolean).join(" / ")
+    );
+    console.log('  3. Run the "Release" workflow from the Actions tab (workflow_dispatch).');
+  }
+});
+
+// src/cli/upload.ts
+import { existsSync as existsSync9 } from "fs";
+import { join as join17 } from "path";
+import { execFile } from "child_process";
+import { promisify } from "util";
+import { Command as Command6 } from "commander";
+import pc6 from "picocolors";
+import * as p3 from "@clack/prompts";
+var execFileAsync = promisify(execFile);
+async function hasGlobalFastlane() {
+  try {
+    await execFileAsync("fastlane", ["--version"]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var BUILD_HINTS = {
+  ios: "Build an .ipa first (e.g. `eas build -p ios`, Xcode archive, or `fastlane gym`).",
+  android: "Build an .aab first (e.g. `cd android && ./gradlew bundleRelease` or `eas build -p android`)."
+};
+var uploadCommand = new Command6("upload").description("Upload a built binary to a test track via fastlane (TestFlight / Play internal)").argument("<platform>", "ios | android").option("--ipa <path>", "path to the .ipa (ios; default: newest found in the project)").option("--aab <path>", "path to the .aab (android; default: newest found in the project)").option("--track <track>", "Play track for android uploads", "internal").option("--testflight", "upload iOS build to TestFlight (default and only destination)").option("--yes", "skip the confirmation prompt (required in CI)").action(
+  async (platformArg, options) => {
+    const projectRoot = process.cwd();
+    if (platformArg !== "ios" && platformArg !== "android") {
+      console.error(pc6.red(`\u2717 Unknown platform "${platformArg}". Use ios or android.`));
+      process.exitCode = 1;
+      return;
+    }
+    const platform = platformArg;
+    let config;
+    try {
+      config = await loadConfig(projectRoot);
+    } catch (error) {
+      if (error instanceof ConfigError) {
+        console.error(pc6.red(`\u2717 ${error.message}`));
+        process.exitCode = 1;
+        return;
+      }
+      throw error;
+    }
+    const platformConfigured = platform === "ios" ? config.platforms.ios !== void 0 : config.platforms.android !== void 0;
+    if (!platformConfigured) {
+      console.error(pc6.red(`\u2717 No ${platform} platform configured in appship.yml.`));
+      process.exitCode = 1;
+      return;
+    }
+    const explicit = platform === "ios" ? options.ipa : options.aab;
+    const artifact = explicit ?? await findArtifact(projectRoot, platform);
+    if (explicit && !existsSync9(join17(projectRoot, explicit)) && !existsSync9(explicit)) {
+      console.error(pc6.red(`\u2717 Artifact not found: ${explicit}`));
+      process.exitCode = 1;
+      return;
+    }
+    if (!artifact) {
+      console.error(
+        pc6.red(`\u2717 No ${platform === "ios" ? ".ipa" : ".aab"} found in the project. `) + BUILD_HINTS[platform]
+      );
+      process.exitCode = 1;
+      return;
+    }
+    try {
+      await assertUploadLane(projectRoot, platform);
+    } catch (error) {
+      if (error instanceof UploadError) {
+        console.error(pc6.red(`\u2717 ${error.message}`));
+        process.exitCode = 1;
+        return;
+      }
+      throw error;
+    }
+    const fastlane = resolveFastlaneCommand(projectRoot, await hasGlobalFastlane());
+    if (!fastlane) {
+      console.error(
+        pc6.red("\u2717 fastlane not found. ") + "Install it (`brew install fastlane` or `gem install fastlane`), or add it to your Gemfile."
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const plan = buildUploadPlan(platform, artifact, options.track);
+    console.log(`App:         ${config.project.name}`);
+    console.log(
+      `Identifier:  ${platform === "ios" ? config.platforms.ios.bundle_id : config.platforms.android.package_name}`
+    );
+    console.log(`Artifact:    ${plan.artifact}`);
+    console.log(`Destination: ${plan.destination}`);
+    console.log(
+      `Command:     ${fastlane.command} ${[...fastlane.prefixArgs, ...plan.fastlaneArgs].join(" ")}`
+    );
+    console.log();
+    if (!options.yes) {
+      if (!process.stdout.isTTY) {
+        console.error(pc6.red("\u2717 Refusing to upload without confirmation. Pass --yes in CI."));
+        process.exitCode = 1;
+        return;
+      }
+      const proceed = await p3.confirm({ message: "Proceed with the upload?", initialValue: false });
+      if (p3.isCancel(proceed) || !proceed) {
+        console.log(pc6.yellow("Cancelled \u2014 nothing was uploaded."));
+        process.exitCode = 1;
+        return;
+      }
+    }
+    const exitCode = await runUpload(projectRoot, fastlane, plan);
+    if (exitCode === 0) {
+      console.log(pc6.green(`\u2713 Upload finished (${plan.destination}).`));
+    } else {
+      console.error(pc6.red(`\u2717 fastlane exited with code ${exitCode}.`));
+      process.exitCode = exitCode;
+    }
+  }
+);
+
+// src/cli/screenshots.ts
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+import { Command as Command7 } from "commander";
+import pc7 from "picocolors";
+
+// src/core/screenshots/index.ts
+import { mkdir as mkdir8, readdir as readdir3, readFile as readFile11, writeFile as writeFile9 } from "fs/promises";
+import { existsSync as existsSync10 } from "fs";
+import { join as join18 } from "path";
+import { parse as parse6 } from "yaml";
+import { z as z8 } from "zod";
+var ScreenshotsError = class extends Error {
+};
+var FLOWS_DIR = join18(".maestro", "appship");
+var RAW_OUTPUT_DIR = join18(".appship", "screenshots", "raw");
+var NAVIGATION_TODO = "TODO(appship): navigate to this screen";
+var planSchema = z8.object({
+  screens: z8.array(
+    z8.object({
+      screen: z8.string().min(1),
+      headline: z8.string(),
+      source_route: z8.string().optional()
+    })
+  ).default([]),
+  note: z8.string().optional()
+});
+var PLAN_LOCATIONS = [
+  join18(".appship", "app-store", "screenshots", "screenshot-plan.yml"),
+  join18(".appship", "google-play", "screenshots", "screenshot-plan.yml")
+];
+async function loadScreenshotPlan(projectRoot) {
+  for (const location of PLAN_LOCATIONS) {
+    const path = join18(projectRoot, location);
+    if (!existsSync10(path)) continue;
+    const parsed = planSchema.safeParse(parse6(await readFile11(path, "utf8")));
+    if (!parsed.success) {
+      throw new ScreenshotsError(`Invalid screenshot plan (${location}): ${parsed.error.message}`);
+    }
+    return parsed.data;
+  }
+  throw new ScreenshotsError(
+    "No screenshot plan found under .appship/. Run `appship generate` first."
+  );
+}
+function slugify(name) {
+  return name.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+function flowContent(appId, index, screen) {
+  const number = String(index + 1).padStart(2, "0");
+  const slug = slugify(screen.screen);
+  const lines = [
+    `# Maestro flow for the "${screen.screen}" screen \u2014 generated by appship.`,
+    `# Store headline: ${screen.headline}`,
+    ...screen.source_route ? [`# Screen source: ${screen.source_route}`] : [],
+    `appId: ${appId}`,
+    "---",
+    "- launchApp",
+    `# ${NAVIGATION_TODO} (then delete this comment)`,
+    "# Examples:",
+    '#   - tapOn: "Some button text"',
+    `#   - openLink: yourapp://${slug}`,
+    `- takeScreenshot: ${RAW_OUTPUT_DIR}/${number}-${slug}`
+  ];
+  return lines.join("\n") + "\n";
+}
+async function generateFlows(projectRoot, config, plan, options = {}) {
+  if (plan.screens.length === 0) {
+    throw new ScreenshotsError(
+      "The screenshot plan has no screens. Add entries to screenshot-plan.yml (or add screen components under src/screens/ and re-run `appship generate`)."
+    );
+  }
+  const appId = config.platforms.android?.package_name ?? config.platforms.ios?.bundle_id ?? null;
+  if (!appId) {
+    throw new ScreenshotsError("No platform identifier in appship.yml (platforms.ios/android).");
+  }
+  const written = [];
+  const skipped = [];
+  await mkdir8(join18(projectRoot, FLOWS_DIR), { recursive: true });
+  for (const [index, screen] of plan.screens.entries()) {
+    const number = String(index + 1).padStart(2, "0");
+    const path = join18(FLOWS_DIR, `${number}-${slugify(screen.screen)}.yaml`);
+    const absolute = join18(projectRoot, path);
+    if (existsSync10(absolute) && !options.force) {
+      skipped.push(path);
+      continue;
+    }
+    await writeFile9(absolute, flowContent(appId, index, screen), "utf8");
+    written.push(path);
+  }
+  return { written, skipped };
+}
+async function preflightCapture(projectRoot) {
+  const flowsDir = join18(projectRoot, FLOWS_DIR);
+  if (!existsSync10(flowsDir)) {
+    throw new ScreenshotsError(
+      `No Maestro flows found (${FLOWS_DIR}). Run \`appship screenshots flows\` first.`
+    );
+  }
+  const flowFiles = (await readdir3(flowsDir)).filter((f) => f.endsWith(".yaml")).sort();
+  if (flowFiles.length === 0) {
+    throw new ScreenshotsError(
+      `No Maestro flows found (${FLOWS_DIR}). Run \`appship screenshots flows\` first.`
+    );
+  }
+  const pendingTodos = [];
+  for (const file of flowFiles) {
+    const content = await readFile11(join18(flowsDir, file), "utf8");
+    if (content.includes(NAVIGATION_TODO)) pendingTodos.push(join18(FLOWS_DIR, file));
+  }
+  return { flowFiles, pendingTodos };
+}
+async function runCapture(projectRoot, runner, options = {}) {
+  await mkdir8(join18(projectRoot, RAW_OUTPUT_DIR), { recursive: true });
+  const args = ["test", ...options.device ? ["--device", options.device] : [], FLOWS_DIR];
+  return runner("maestro", args, projectRoot);
+}
+
+// src/cli/screenshots.ts
+var execFileAsync2 = promisify2(execFile2);
+async function hasMaestro() {
+  try {
+    await execFileAsync2("maestro", ["--version"]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function reportAndExit(error) {
+  if (error instanceof ScreenshotsError || error instanceof ConfigError) {
+    console.error(pc7.red(`\u2717 ${error.message}`));
+    process.exitCode = 1;
+    return true;
+  }
+  return false;
+}
+var flowsSubcommand = new Command7("flows").description("Generate Maestro flow files from the screenshot plan").option("--force", "overwrite existing flow files (discards your navigation edits)").action(async (options) => {
+  const projectRoot = process.cwd();
+  try {
+    const config = await loadConfig(projectRoot);
+    const plan = await loadScreenshotPlan(projectRoot);
+    const result = await generateFlows(projectRoot, config, plan, {
+      ...options.force ? { force: true } : {}
+    });
+    for (const path of result.written) console.log(`${pc7.green("\u2713")} ${path}`);
+    for (const path of result.skipped) {
+      console.log(`${pc7.dim("\u2022")} ${path} ${pc7.dim("(exists \u2014 kept; use --force to overwrite)")}`);
+    }
+    console.log();
+    console.log(
+      `Next: fill in the navigation TODO in each flow, then run ${pc7.cyan("appship screenshots capture")}.`
+    );
+  } catch (error) {
+    if (!reportAndExit(error)) throw error;
+  }
+});
+var captureSubcommand = new Command7("capture").description("Run the Maestro flows and capture screenshots").option("--device <id>", "Maestro device id to run on").action(async (options) => {
+  const projectRoot = process.cwd();
+  try {
+    await loadConfig(projectRoot);
+    const preflight = await preflightCapture(projectRoot);
+    if (preflight.pendingTodos.length > 0) {
+      console.error(
+        pc7.red(`\u2717 ${preflight.pendingTodos.length} flow(s) still contain the navigation TODO:`)
+      );
+      for (const path of preflight.pendingTodos) console.error(pc7.dim(`  - ${path}`));
+      console.error("Fill in how to reach each screen, then re-run capture.");
+      process.exitCode = 1;
+      return;
+    }
+    if (!await hasMaestro()) {
+      console.error(
+        pc7.red("\u2717 maestro not found. ") + 'Install it: `curl -fsSL "https://get.maestro.mobile.dev" | bash` (see maestro.dev).'
+      );
+      process.exitCode = 1;
+      return;
+    }
+    console.log(
+      `Running ${preflight.flowFiles.length} flow(s) from ${FLOWS_DIR} \u2192 ${RAW_OUTPUT_DIR}/ ...`
+    );
+    const { spawnRunner: spawnRunner2 } = await import("./upload-FMEKKZSD.js");
+    const exitCode = await runCapture(projectRoot, spawnRunner2, {
+      ...options.device ? { device: options.device } : {}
+    });
+    if (exitCode === 0) {
+      console.log(pc7.green(`\u2713 Screenshots captured into ${RAW_OUTPUT_DIR}/`));
+    } else {
+      console.error(pc7.red(`\u2717 maestro exited with code ${exitCode}.`));
+      process.exitCode = exitCode;
+    }
+  } catch (error) {
+    if (!reportAndExit(error)) throw error;
+  }
+});
+var screenshotsCommand = new Command7("screenshots").description("Generate Maestro flows and capture store screenshots").addCommand(flowsSubcommand).addCommand(captureSubcommand);
+
+// src/cli/submit.ts
+import { execFile as execFile3 } from "child_process";
+import { promisify as promisify3 } from "util";
+import { Command as Command8 } from "commander";
+import pc8 from "picocolors";
+import * as p4 from "@clack/prompts";
+
+// src/core/submit/index.ts
+import { existsSync as existsSync11 } from "fs";
+import { readFile as readFile12 } from "fs/promises";
+import { join as join19 } from "path";
+var SubmitError = class extends Error {
+};
+var SUBMIT_LANE = "submit_review";
+function platformBlock(fastfile, platform) {
+  const marker = `platform :${platform} do`;
+  const start = fastfile.indexOf(marker);
+  if (start === -1) return null;
+  const next = fastfile.indexOf("platform :", start + marker.length);
+  return next === -1 ? fastfile.slice(start) : fastfile.slice(start, next);
+}
+async function assertSubmitLane(projectRoot, platform) {
+  const fastfilePath = join19(projectRoot, "fastlane", "Fastfile");
+  if (!existsSync11(fastfilePath)) {
+    throw new SubmitError("fastlane/Fastfile not found. Run `appship export fastlane` first.");
+  }
+  const block = platformBlock(await readFile12(fastfilePath, "utf8"), platform);
+  if (!block || !block.includes(`lane :${SUBMIT_LANE}`)) {
+    throw new SubmitError(
+      `fastlane/Fastfile has no ${platform} :${SUBMIT_LANE} lane. Re-export with \`appship export fastlane --force\` (or add the lane yourself).`
+    );
+  }
+}
+function buildSubmitPlan(platform, options) {
+  if (platform === "ios") {
+    const args = ["ios", SUBMIT_LANE];
+    if (options.buildNumber) args.push(`build_number:${options.buildNumber}`);
+    return {
+      platform,
+      destination: "App Store review",
+      details: [
+        ["Build", options.buildNumber ?? "latest uploaded to App Store Connect"],
+        ["Release", "manual (after approval)"]
+      ],
+      fastlaneArgs: args
+    };
+  }
+  return {
+    platform,
+    destination: `Play track "${options.track}"`,
+    details: [["Promote", `"${options.fromTrack}" \u2192 "${options.track}"`]],
+    fastlaneArgs: [
+      "android",
+      SUBMIT_LANE,
+      `from_track:${options.fromTrack}`,
+      `track:${options.track}`
+    ]
+  };
+}
+async function runSubmit(projectRoot, fastlane, plan, runner = spawnRunner) {
+  return runner(fastlane.command, [...fastlane.prefixArgs, ...plan.fastlaneArgs], projectRoot);
+}
+
+// src/cli/submit.ts
+var execFileAsync3 = promisify3(execFile3);
+async function hasGlobalFastlane2() {
+  try {
+    await execFileAsync3("fastlane", ["--version"]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var DOCTOR_STORE = {
+  ios: "app-store",
+  android: "google-play"
+};
+var submitCommand = new Command8("submit").description("Submit the app for store review via fastlane (confirmation required)").argument("<platform>", "ios | android").option("--build-number <n>", "ios: build number to submit (default: latest uploaded)").option("--from-track <track>", "android: track holding the tested build", "internal").option("--track <track>", "android: track to promote into", "production").option("--force", "submit even when doctor reports blocking errors").option("--yes", "skip the confirmation prompt (required in CI)").action(
+  async (platformArg, options) => {
+    const projectRoot = process.cwd();
+    if (platformArg !== "ios" && platformArg !== "android") {
+      console.error(pc8.red(`\u2717 Unknown platform "${platformArg}". Use ios or android.`));
+      process.exitCode = 1;
+      return;
+    }
+    const platform = platformArg;
+    let config;
+    let scan;
+    try {
+      config = await loadConfig(projectRoot);
+      scan = await scanProject(projectRoot);
+    } catch (error) {
+      if (error instanceof ConfigError || error instanceof UnsupportedProjectError) {
+        console.error(pc8.red(`\u2717 ${error.message}`));
+        process.exitCode = 1;
+        return;
+      }
+      throw error;
+    }
+    const platformConfigured = platform === "ios" ? config.platforms.ios !== void 0 : config.platforms.android !== void 0;
+    if (!platformConfigured) {
+      console.error(pc8.red(`\u2717 No ${platform} platform configured in appship.yml.`));
+      process.exitCode = 1;
+      return;
+    }
+    try {
+      await assertSubmitLane(projectRoot, platform);
+    } catch (error) {
+      if (error instanceof SubmitError) {
+        console.error(pc8.red(`\u2717 ${error.message}`));
+        process.exitCode = 1;
+        return;
+      }
+      throw error;
+    }
+    const fastlane = resolveFastlaneCommand(projectRoot, await hasGlobalFastlane2());
+    if (!fastlane) {
+      console.error(
+        pc8.red("\u2717 fastlane not found. ") + "Install it (`brew install fastlane` or `gem install fastlane`), or add it to your Gemfile."
+      );
+      process.exitCode = 1;
+      return;
+    }
+    await mergePreviousConfirmations(projectRoot, scan);
+    const store = DOCTOR_STORE[platform];
+    const [report] = await runDoctor({ projectRoot, config, scan }, await loadRulesWithCache(), [store]);
+    const blocking = report.results.filter(
+      (r) => r.status === "fail" && r.severity === "error"
+    );
+    const warnings = report.results.filter(
+      (r) => r.status === "fail" && r.severity === "warning"
+    );
+    console.log(
+      `Doctor:      ${report.score}% ready` + (warnings.length > 0 ? pc8.yellow(` (${warnings.length} warning(s))`) : "")
+    );
+    if (blocking.length > 0) {
+      console.log();
+      for (const result of blocking) {
+        console.log(`${pc8.red("\u2717")} ${result.message}`);
+      }
+      console.log();
+      if (!options.force) {
+        console.error(
+          pc8.red(`\u2717 ${blocking.length} blocking error(s). `) + "Fix them (see `appship doctor`) or pass --force to submit anyway."
+        );
+        process.exitCode = 1;
+        return;
+      }
+      console.log(pc8.yellow("\u26A0 Continuing despite blocking errors (--force)."));
+      console.log();
+    }
+    const plan = buildSubmitPlan(platform, options);
+    console.log(`App:         ${config.project.name}`);
+    console.log(
+      `Identifier:  ${platform === "ios" ? config.platforms.ios.bundle_id : config.platforms.android.package_name}`
+    );
+    console.log(`Destination: ${plan.destination}`);
+    for (const [label, value] of plan.details) {
+      console.log(`${(label + ":").padEnd(13)}${value}`);
+    }
+    console.log(
+      `Command:     ${fastlane.command} ${[...fastlane.prefixArgs, ...plan.fastlaneArgs].join(" ")}`
+    );
+    console.log();
+    if (!options.yes) {
+      if (!process.stdout.isTTY) {
+        console.error(pc8.red("\u2717 Refusing to submit without confirmation. Pass --yes in CI."));
+        process.exitCode = 1;
+        return;
+      }
+      const proceed = await p4.confirm({
+        message: `Submit ${config.project.name} for review? This starts a store review.`,
+        initialValue: false
+      });
+      if (p4.isCancel(proceed) || !proceed) {
+        console.log(pc8.yellow("Cancelled \u2014 nothing was submitted."));
+        process.exitCode = 1;
+        return;
+      }
+    }
+    const exitCode = await runSubmit(projectRoot, fastlane, plan);
+    if (exitCode === 0) {
+      console.log(pc8.green(`\u2713 Submitted (${plan.destination}).`));
+    } else {
+      console.error(pc8.red(`\u2717 fastlane exited with code ${exitCode}.`));
+      process.exitCode = exitCode;
+    }
+  }
+);
+
+// src/cli/review.ts
+import { readFile as readFile13 } from "fs/promises";
+import { Command as Command9 } from "commander";
+import pc9 from "picocolors";
+
+// src/core/review/index.ts
+import { mkdir as mkdir9, writeFile as writeFile10 } from "fs/promises";
+import { join as join20 } from "path";
+import { z as z9 } from "zod";
+var ReviewAnalyzeError = class extends Error {
+};
+var reviewStoreSchema = z9.enum(["app-store", "google-play"]);
+var reviewIssueSchema = z9.object({
+  guideline: z9.string().nullable(),
+  title: z9.string(),
+  summary: z9.string(),
+  category: z9.enum([
+    "metadata",
+    "privacy",
+    "permissions",
+    "account",
+    "content",
+    "functionality",
+    "payments",
+    "legal",
+    "design",
+    "other"
+  ]),
+  severity: z9.enum(["blocker", "clarification"]),
+  fixSteps: z9.array(z9.string()),
+  appshipCommands: z9.array(z9.string()),
+  responseDraft: z9.string().nullable()
+});
+var reviewAnalysisSchema = z9.object({
+  store: z9.enum(["app-store", "google-play", "unknown"]),
+  issues: z9.array(reviewIssueSchema).min(1),
+  overallPlan: z9.array(z9.string())
+});
+var ANALYSIS_JSON_SCHEMA = {
+  type: "object",
+  additionalProperties: false,
+  required: ["store", "issues", "overallPlan"],
+  properties: {
+    store: {
+      type: "string",
+      enum: ["app-store", "google-play", "unknown"],
+      description: "Which store the rejection message is from, judged from its wording"
+    },
+    issues: {
+      type: "array",
+      description: "One entry per distinct problem the reviewer raised",
+      items: {
+        type: "object",
+        additionalProperties: false,
+        required: [
+          "guideline",
+          "title",
+          "summary",
+          "category",
+          "severity",
+          "fixSteps",
+          "appshipCommands",
+          "responseDraft"
+        ],
+        properties: {
+          guideline: {
+            type: ["string", "null"],
+            description: 'Exact guideline/policy cited in the message (e.g. "Guideline 5.1.1", "User Data policy"), or null if none is cited. Never invent one.'
+          },
+          title: { type: "string", description: "Short label for the issue" },
+          summary: {
+            type: "string",
+            description: "What the reviewer is objecting to, in plain language"
+          },
+          category: {
+            type: "string",
+            enum: [
+              "metadata",
+              "privacy",
+              "permissions",
+              "account",
+              "content",
+              "functionality",
+              "payments",
+              "legal",
+              "design",
+              "other"
+            ]
+          },
+          severity: {
+            type: "string",
+            enum: ["blocker", "clarification"],
+            description: "blocker: the app/metadata must change. clarification: replying with information may resolve it."
+          },
+          fixSteps: {
+            type: "array",
+            items: { type: "string" },
+            description: "Concrete ordered steps the developer should take"
+          },
+          appshipCommands: {
+            type: "array",
+            items: { type: "string" },
+            description: "AppShip commands (from the provided list only) that help apply the fix; empty if none apply"
+          },
+          responseDraft: {
+            type: ["string", "null"],
+            description: "For clarification issues: a draft reply to the review team. null for blockers."
+          }
+        }
+      }
+    },
+    overallPlan: {
+      type: "array",
+      items: { type: "string" },
+      description: "Recommended order of actions across all issues, ending with resubmission"
+    }
+  }
+};
+var APPSHIP_COMMANDS = [
+  "appship generate",
+  "appship localize",
+  "appship export fastlane",
+  "appship screenshots flows",
+  "appship screenshots capture",
+  "appship upload ios",
+  "appship upload android",
+  "appship doctor",
+  "appship submit ios",
+  "appship submit android"
+];
+var SYSTEM_PROMPT2 = `You are AppShip, an assistant that analyzes app store rejection messages and produces a concrete fix plan.
+
+Rules you must never break:
+- Ground every issue in the rejection message itself. Never invent problems the reviewer did not raise.
+- Only cite a guideline or policy name if the message cites it, or if you are certain it is the standard reference for exactly what the message describes; otherwise set guideline to null.
+- The project summary is the only source of truth about the app. Never assume features, permissions, or SDKs it does not list.
+- appshipCommands may only contain commands from this list (with arguments where noted): ${APPSHIP_COMMANDS.join(", ")}. Use an empty array when none genuinely helps.
+- Fix steps must be actions the developer can take, not restatements of the problem.
+- Write responseDraft in a professional, factual tone; never promise changes the developer has not decided to make.`;
+function buildAnalyzePrompt(rejectionText, payload, options = {}) {
+  const parts = [
+    "Analyze this store rejection message and produce a fix plan.",
+    options.storeHint ? `The developer says it came from: ${options.storeHint}.` : "",
+    payload ? `Project summary (the only source of truth about the app):
+${JSON.stringify(payload, null, 2)}` : "No project summary is available \u2014 do not assume anything about the app beyond the message.",
+    `Rejection message:
+"""
+${rejectionText}
+"""`
+  ];
+  return parts.filter(Boolean).join("\n\n");
+}
+async function analyzeRejection(provider, rejectionText, payload, options = {}) {
+  const trimmed = rejectionText.trim();
+  if (trimmed.length === 0) {
+    throw new ReviewAnalyzeError("The rejection message is empty.");
+  }
+  const raw = await provider.generateObject({
+    system: SYSTEM_PROMPT2,
+    prompt: buildAnalyzePrompt(trimmed, payload, options),
+    jsonSchema: ANALYSIS_JSON_SCHEMA
+  });
+  const parsed = reviewAnalysisSchema.safeParse(raw);
+  if (!parsed.success) {
+    throw new ReviewAnalyzeError(
+      `The model returned an invalid analysis: ${parsed.error.issues[0]?.message ?? "unknown error"}`
+    );
+  }
+  if (options.storeHint && parsed.data.store === "unknown") {
+    return { ...parsed.data, store: options.storeHint };
+  }
+  return parsed.data;
+}
+var STORE_LABELS2 = {
+  "app-store": "App Store",
+  "google-play": "Google Play",
+  unknown: "Unknown store"
+};
+function renderAnalysisMarkdown(analysis, appName) {
+  const lines = [
+    `# Rejection analysis \u2014 ${appName}`,
+    "",
+    `Store: ${STORE_LABELS2[analysis.store]}`,
+    ""
+  ];
+  analysis.issues.forEach((issue, index) => {
+    const guideline = issue.guideline ? ` (${issue.guideline})` : "";
+    lines.push(`## ${index + 1}. ${issue.title}${guideline}`);
+    lines.push("");
+    lines.push(`- Category: ${issue.category}`);
+    lines.push(`- Severity: ${issue.severity}`);
+    lines.push("");
+    lines.push(issue.summary);
+    lines.push("");
+    if (issue.fixSteps.length > 0) {
+      lines.push("### Fix");
+      lines.push(...issue.fixSteps.map((step, i) => `${i + 1}. ${step}`));
+      lines.push("");
+    }
+    if (issue.appshipCommands.length > 0) {
+      lines.push("### Relevant appship commands");
+      lines.push(...issue.appshipCommands.map((c) => `- \`${c}\``));
+      lines.push("");
+    }
+    if (issue.responseDraft) {
+      lines.push("### Draft reply to the review team");
+      lines.push("");
+      lines.push("> " + issue.responseDraft.split("\n").join("\n> "));
+      lines.push("");
+    }
+  });
+  if (analysis.overallPlan.length > 0) {
+    lines.push("## Recommended order");
+    lines.push(...analysis.overallPlan.map((step, i) => `${i + 1}. ${step}`));
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+async function writeAnalysis2(projectRoot, analysis, appName) {
+  const dir = join20(projectRoot, ".appship", "review");
+  await mkdir9(dir, { recursive: true });
+  const markdownPath = join20(".appship", "review", "rejection-analysis.md");
+  const jsonPath = join20(".appship", "review", "rejection-analysis.json");
+  await writeFile10(
+    join20(projectRoot, markdownPath),
+    renderAnalysisMarkdown(analysis, appName),
+    "utf8"
+  );
+  await writeFile10(join20(projectRoot, jsonPath), JSON.stringify(analysis, null, 2) + "\n", "utf8");
+  return { markdownPath, jsonPath };
+}
+
+// src/cli/review.ts
+function renderIssues(analysis) {
+  analysis.issues.forEach((issue, index) => {
+    const icon = issue.severity === "blocker" ? pc9.red("\u2717") : pc9.yellow("\u25C6");
+    const guideline = issue.guideline ? pc9.dim(` (${issue.guideline})`) : "";
+    console.log(`${icon} ${pc9.bold(issue.title)}${guideline}`);
+    console.log(`  ${issue.summary}`);
+    for (const step of issue.fixSteps) {
+      console.log(pc9.dim(`  \u2192 ${step}`));
+    }
+    for (const command of issue.appshipCommands) {
+      console.log(pc9.cyan(`  $ ${command}`));
+    }
+    if (issue.responseDraft) {
+      console.log(pc9.dim("  (a draft reply to the review team is in the report)"));
+    }
+    if (index < analysis.issues.length - 1) console.log();
+  });
+}
+var analyzeSubcommand = new Command9("analyze").description("Analyze a store rejection message and produce a fix plan").argument("<file>", "text file containing the rejection message (copy it from the store console)").option("--store <store>", "app-store | google-play (hint when the message is ambiguous)").action(async (file, options) => {
+  const projectRoot = process.cwd();
+  let storeHint;
+  if (options.store !== void 0) {
+    const parsed = reviewStoreSchema.safeParse(options.store);
+    if (!parsed.success) {
+      console.error(pc9.red(`\u2717 Unknown store "${options.store}". Use app-store or google-play.`));
+      process.exitCode = 1;
+      return;
+    }
+    storeHint = parsed.data;
+  }
+  let rejectionText;
+  try {
+    rejectionText = await readFile13(file, "utf8");
+  } catch {
+    console.error(pc9.red(`\u2717 Could not read "${file}".`));
+    process.exitCode = 1;
+    return;
+  }
+  if (rejectionText.trim().length === 0) {
+    console.error(pc9.red(`\u2717 "${file}" is empty.`));
+    process.exitCode = 1;
+    return;
+  }
+  let config;
+  try {
+    config = await loadConfig(projectRoot);
+  } catch (error) {
+    if (error instanceof ConfigError) {
+      console.error(pc9.red(`\u2717 ${error.message}`));
+      process.exitCode = 1;
+      return;
+    }
+    throw error;
+  }
+  let payload = null;
+  try {
+    const scan = await scanProject(projectRoot);
+    await mergePreviousConfirmations(projectRoot, scan);
+    payload = buildSummaryPayload(scan, config);
+  } catch (error) {
+    if (!(error instanceof UnsupportedProjectError)) throw error;
+    console.log(pc9.yellow("\u26A0 Project scan unavailable \u2014 analyzing the message without app context."));
+  }
+  let provider;
+  try {
+    provider = createProvider(config);
+  } catch (error) {
+    if (error instanceof AIProviderError) {
+      console.error(pc9.red(`\u2717 ${error.message}`));
+      process.exitCode = 1;
+      return;
+    }
+    throw error;
+  }
+  console.log(`Analyzing the rejection message with ${provider.name} ...`);
+  console.log();
+  let analysis;
+  try {
+    analysis = await analyzeRejection(
+      provider,
+      rejectionText,
+      payload,
+      storeHint ? { storeHint } : {}
+    );
+  } catch (error) {
+    if (error instanceof ReviewAnalyzeError || error instanceof AIProviderError) {
+      console.error(pc9.red(`\u2717 ${error.message}`));
+      process.exitCode = 1;
+      return;
+    }
+    throw error;
+  }
+  renderIssues(analysis);
+  if (analysis.overallPlan.length > 0) {
+    console.log();
+    console.log(pc9.bold("Recommended order:"));
+    analysis.overallPlan.forEach((step, i) => console.log(`  ${i + 1}. ${step}`));
+  }
+  const written = await writeAnalysis2(projectRoot, analysis, config.project.name);
+  console.log();
+  console.log(pc9.dim(`Full report written to ${written.markdownPath}`));
+});
+var reviewCommand = new Command9("review").description("Work with store review feedback").addCommand(analyzeSubcommand);
+
+// src/cli/rules.ts
+import { Command as Command10 } from "commander";
+import pc10 from "picocolors";
+var updateSubcommand = new Command10("update").description("Download the latest doctor rules and SDK signatures (no new CLI release needed)").option("--source <url>", "base URL to download the data/ files from").action(async (options) => {
+  let result;
+  try {
+    result = await updateRules(options.source ? { source: options.source } : {});
+  } catch (error) {
+    if (error instanceof RulesUpdateError) {
+      console.error(pc10.red(`\u2717 ${error.message}`));
+      process.exitCode = 1;
+      return;
+    }
+    throw error;
+  }
+  for (const file of result.files) {
+    const marker = file.changed ? pc10.green("\u2713") : pc10.dim("\u2022");
+    const note = file.changed ? "updated" : "already up to date";
+    console.log(`${marker} ${file.path} ${pc10.dim(`(${file.entries} entries, ${note})`)}`);
+  }
+  console.log();
+  console.log(
+    pc10.dim(`Cached in ${result.cacheDir} \u2014 doctor and the scanner now prefer these files.`)
+  );
+});
+var statusSubcommand = new Command10("status").description("Show whether bundled or updated rules are in use").action(async () => {
+  const meta = await readCacheMeta();
+  if (!meta) {
+    console.log("Using the rules and SDK signatures bundled with this appship version.");
+    console.log(pc10.dim("Run `appship rules update` to fetch the latest."));
+    return;
+  }
+  console.log(`Using updated rules from ${meta.source}`);
+  console.log(`Fetched:  ${meta.updatedAt}`);
+  console.log(`Cache:    ${dataCacheDir()}`);
+  console.log(pc10.dim("Run `appship rules reset` to go back to the bundled rules."));
+});
+var resetSubcommand = new Command10("reset").description("Delete the downloaded rules cache and return to the bundled rules").action(async () => {
+  const removed = await resetRules();
+  if (removed) {
+    console.log(pc10.green("\u2713") + " Cache removed \u2014 bundled rules are in use again.");
+  } else {
+    console.log("No rules cache to remove \u2014 bundled rules are already in use.");
+  }
+});
+var rulesCommand = new Command10("rules").description("Manage the store policy rules and SDK signature database").addCommand(updateSubcommand).addCommand(statusSubcommand).addCommand(resetSubcommand);
+
+// src/index.ts
+var program = new Command11();
+program.name("appship").description(
+  "AI release assistant that analyzes your mobile app and prepares everything required for App Store and Google Play submission"
+).version("0.1.0");
+program.addCommand(initCommand);
+program.addCommand(generateCommand);
+program.addCommand(localizeCommand);
+program.addCommand(exportCommand);
+program.addCommand(uploadCommand);
+program.addCommand(screenshotsCommand);
+program.addCommand(submitCommand);
+program.addCommand(reviewCommand);
+program.addCommand(doctorCommand);
+program.addCommand(rulesCommand);
+program.parseAsync(process.argv);