runcloud 0.1.20 → 0.1.22

package/dist/commands/appStore.js

@@ -0,0 +1,162 @@
+import { readFileSync } from 'node:fs';
+import { evaluateCompliance, renderEvaluation } from './appStoreEvaluate.js';
+const STATUSES = new Set(['pass', 'warning', 'fail', 'info']);
+const EVIDENCE_REQUIRED = new Set(['pass', 'warning', 'fail']);
+function activeItems(manifest) {
+    return manifest.items.filter((item) => !item.deferred && item.resolvedBy !== 'card');
+}
+export function loadComplianceManifest(path) {
+    const manifestPath = path ?? process.env.NEWLY_APP_STORE_COMPLIANCE_MANIFEST;
+    if (!manifestPath) {
+        throw new Error('Missing compliance manifest. Pass --manifest or set NEWLY_APP_STORE_COMPLIANCE_MANIFEST.');
+    }
+    return JSON.parse(readFileSync(manifestPath, 'utf8'));
+}
+export function renderComplianceCheck(manifest) {
+    const lines = activeItems(manifest).map((item) => {
+        const bits = [item.category, item.platform.join('+'), item.check];
+        if (item.guideline)
+            bits.push(`§${item.guideline}`);
+        if (item.critical)
+            bits.push('CRITICAL');
+        if (item.limit)
+            bits.push(`limit ${item.limit}`);
+        if (item.source)
+            bits.push(item.source);
+        if (item.authorable)
+            bits.push('authorable');
+        if (item.autofill)
+            bits.push(`autofill:${item.autofill}`);
+        return `[${item.priority}] ${item.id} (${bits.join(', ')}) - ${item.label}`;
+    });
+    return (`Compliance manifest v${manifest.manifest_version}. The item list and completeness gate are ` +
+        `deterministic manifest contracts. Start local deterministic rows with: newly app-store ` +
+        `compliance evaluate --manifest <compliance_manifest.json> --project . --json. Use Markdown ` +
+        `skills only for unresolved judgment/live-store rows and listing authoring. Determine a status ` +
+        `(pass/warning/fail/info) for EVERY item below and submit them ALL in one report_compliance ` +
+        `call, each with a short message and evidence (a file:line or command output). Carry each ` +
+        `item's guideline / critical / authorable / autofill flags through into the report.\n\n${lines.join('\n')}`);
+}
+export function validateComplianceReport(rawItems, manifest) {
+    const list = Array.isArray(rawItems) ? rawItems : [];
+    const byId = new Map();
+    for (const item of list) {
+        if (item && typeof item === 'object' && typeof item.id === 'string') {
+            byId.set(item.id, item);
+        }
+    }
+    const missing = [];
+    const invalid = [];
+    for (const item of activeItems(manifest)) {
+        const reported = byId.get(item.id);
+        if (!reported) {
+            missing.push(item.id);
+            continue;
+        }
+        const status = reported.status;
+        if (typeof status !== 'string' || !STATUSES.has(status)) {
+            invalid.push(`${item.id} (status must be pass/warning/fail/info)`);
+            continue;
+        }
+        const evidence = reported.evidence;
+        if (EVIDENCE_REQUIRED.has(status) &&
+            (typeof evidence !== 'string' || evidence.trim() === '')) {
+            invalid.push(`${item.id} (a ${status} verdict needs evidence)`);
+        }
+    }
+    if (missing.length || invalid.length) {
+        const parts = ['report_compliance rejected: the report is incomplete or invalid.'];
+        if (missing.length)
+            parts.push(`Missing ${missing.length} item(s): ${missing.join(', ')}.`);
+        if (invalid.length)
+            parts.push(`Invalid item(s): ${invalid.join('; ')}.`);
+        parts.push('Re-call report_compliance with the complete, corrected item list.');
+        return { ok: false, error: parts.join(' '), missing, invalid };
+    }
+    return {
+        ok: true,
+        items: activeItems(manifest).map((item) => {
+            const reported = byId.get(item.id);
+            return {
+                id: item.id,
+                label: typeof reported.label === 'string' ? reported.label : item.label,
+                status: reported.status,
+                message: typeof reported.message === 'string' ? reported.message : '',
+                evidence: typeof reported.evidence === 'string' ? reported.evidence : undefined,
+                category: typeof reported.category === 'string' ? reported.category : item.category,
+                priority: typeof reported.priority === 'string' ? reported.priority : item.priority,
+                platform: item.platform,
+                authorable: item.authorable === true || undefined,
+                autofill: item.autofill,
+                guideline: item.guideline,
+                critical: item.critical === true || undefined,
+            };
+        }),
+    };
+}
+export function registerAppStore(program) {
+    const appStore = program.command('app-store').description('App Store / Google Play workflows');
+    const compliance = appStore
+        .command('compliance')
+        .description('App Store / Google Play readiness manifest contracts');
+    const printContract = (opts) => {
+        console.log(renderComplianceCheck(loadComplianceManifest(opts.manifest)));
+    };
+    const validateReport = (opts) => {
+        const manifest = loadComplianceManifest(opts.manifest);
+        const report = JSON.parse(readFileSync(opts.report, 'utf8'));
+        const items = Array.isArray(report) ? report : report.items;
+        const result = validateComplianceReport(items, manifest);
+        if (!result.ok) {
+            console.error(result.error);
+            process.exitCode = 1;
+            return;
+        }
+        console.log(JSON.stringify({ items: result.items }, null, 2));
+    };
+    const evaluateProject = (opts) => {
+        const manifest = loadComplianceManifest(opts.manifest);
+        const result = evaluateCompliance(manifest, opts.project ?? process.cwd());
+        if (opts.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        console.log(renderEvaluation(result));
+    };
+    compliance
+        .command('contract')
+        .description('Print the canonical manifest contract; this does not evaluate the app')
+        .requiredOption('--manifest <path>', 'path to compliance_manifest.json')
+        .action(printContract);
+    compliance
+        .command('check')
+        .description('Alias for contract')
+        .requiredOption('--manifest <path>', 'path to compliance_manifest.json')
+        .action(printContract);
+    compliance
+        .command('validate-report')
+        .description('Validate a report_compliance JSON payload against the manifest')
+        .requiredOption('--manifest <path>', 'path to compliance_manifest.json')
+        .requiredOption('--report <path>', 'path to JSON report: either an array or { "items": [...] }')
+        .action(validateReport);
+    compliance
+        .command('validate')
+        .description('Alias for validate-report')
+        .requiredOption('--manifest <path>', 'path to compliance_manifest.json')
+        .requiredOption('--report <path>', 'path to JSON report: either an array or { "items": [...] }')
+        .action(validateReport);
+    compliance
+        .command('evaluate')
+        .description('Evaluate deterministic local checks and list unresolved manual/live-store rows')
+        .requiredOption('--manifest <path>', 'path to compliance_manifest.json')
+        .option('--project <path>', 'project directory to evaluate', process.cwd())
+        .option('--json', 'emit machine-readable JSON')
+        .action(evaluateProject);
+    compliance
+        .command('run')
+        .description('Alias for evaluate')
+        .requiredOption('--manifest <path>', 'path to compliance_manifest.json')
+        .option('--project <path>', 'project directory to evaluate', process.cwd())
+        .option('--json', 'emit machine-readable JSON')
+        .action(evaluateProject);
+}

package/dist/commands/appStoreEvaluate.js

@@ -0,0 +1,515 @@
+import { existsSync, readFileSync, readdirSync, statSync, } from 'node:fs';
+import path from 'node:path';
+const CONFIG_RULES = {
+    app_name: { path: ['expo', 'name'], absent: 'fail' },
+    slug: { path: ['expo', 'slug'], absent: 'fail' },
+    ios_bundle_id: { path: ['expo', 'ios', 'bundleIdentifier'], absent: 'fail' },
+    android_package: { path: ['expo', 'android', 'package'], absent: 'fail' },
+    version: { path: ['expo', 'version'], absent: 'warning' },
+    scheme: { path: ['expo', 'scheme'], absent: 'info' },
+    ios_encryption: { path: ['expo', 'ios', 'infoPlist', 'ITSAppUsesNonExemptEncryption'], absent: 'warning' },
+    user_interface_style: { path: ['expo', 'userInterfaceStyle'], absent: 'info' },
+    orientation: { path: ['expo', 'orientation'], absent: 'info' },
+    ios_supports_tablet: { path: ['expo', 'ios', 'supportsTablet'], absent: 'info' },
+};
+const JUDGMENT_IDS = new Set([
+    'apple_sign_in_order',
+    'permission_string_quality',
+    'account_deletion',
+    'iap_screen_compliance',
+    'background_mode_justification',
+    'push_notification_setup',
+    'deep_link_config',
+]);
+const LIVE_STORE_IDS = new Set([
+    'apple_privacy_policy',
+    'apple_support_url',
+    'apple_description',
+    'apple_store_name',
+    'apple_subtitle',
+    'apple_keywords',
+    'apple_promotional_text',
+    'apple_whats_new',
+    'apple_marketing_url',
+    'apple_copyright',
+    'apple_app_category',
+    'apple_secondary_category',
+    'apple_content_rights',
+    'apple_age_rating',
+    'apple_privacy_label',
+    'google_play_title',
+    'google_play_short_description',
+    'google_play_description',
+    'google_play_contact_email',
+    'google_play_contact_website',
+    'apple_screenshots',
+    'google_play_screenshots',
+    'google_play_feature_graphic',
+]);
+const STORE_REMINDER_IDS = new Set([
+    'android_privacy_policy',
+    'android_content_rating',
+    'android_app_category',
+    'google_data_safety',
+    'google_app_access',
+    'google_ads_declaration',
+    'google_target_audience',
+    'google_government_apps',
+    'google_financial_features',
+    'google_health',
+]);
+const TEXT_EXTENSIONS = new Set([
+    '.c',
+    '.cc',
+    '.cpp',
+    '.cxx',
+    '.h',
+    '.hpp',
+    '.java',
+    '.js',
+    '.jsx',
+    '.json',
+    '.kt',
+    '.m',
+    '.md',
+    '.mm',
+    '.mjs',
+    '.plist',
+    '.swift',
+    '.ts',
+    '.tsx',
+    '.xml',
+]);
+const SKIP_DIRS = new Set([
+    '.expo',
+    '.git',
+    '.next',
+    'build',
+    'dist',
+    'node_modules',
+    'Pods',
+]);
+export function evaluateCompliance(manifest, projectDir) {
+    const root = path.resolve(projectDir);
+    const appJson = readJson(path.join(root, 'app.json'));
+    const targetPlatforms = targetPlatformsFromAppJson(appJson);
+    const items = [];
+    const unresolved = [];
+    for (const item of activeItems(manifest)) {
+        if (!targetsItem(item, targetPlatforms)) {
+            items.push(makeItem(item, 'info', `Not targeting ${platformNames(item.platform)}.`, 'app.json target platform detection'));
+            continue;
+        }
+        const evaluated = evaluateLocalItem(root, appJson, item);
+        if (evaluated) {
+            items.push(evaluated);
+            continue;
+        }
+        unresolved.push({
+            id: item.id,
+            label: item.label,
+            category: item.category,
+            priority: item.priority,
+            platform: item.platform,
+            check: item.check,
+            reason: unresolvedReason(item),
+        });
+    }
+    return {
+        manifestVersion: manifest.manifest_version,
+        projectDir: root,
+        targetPlatforms,
+        items,
+        unresolved,
+    };
+}
+export function renderEvaluation(result) {
+    const lines = [
+        `Compliance evaluation draft for ${result.projectDir}`,
+        `Manifest v${result.manifestVersion}; target platforms: ${result.targetPlatforms.join(', ')}`,
+        '',
+        `Deterministic items (${result.items.length}):`,
+    ];
+    for (const item of result.items) {
+        lines.push(`- ${item.status.toUpperCase()} ${item.id}: ${item.message ?? ''}`);
+        if (item.evidence)
+            lines.push(`  evidence: ${item.evidence}`);
+    }
+    lines.push('', `Unresolved items (${result.unresolved.length}):`);
+    for (const item of result.unresolved) {
+        lines.push(`- ${item.id}: ${item.reason}`);
+    }
+    lines.push('', 'JSON shape: { "items": [...deterministic report_compliance rows...], "unresolved": [...] }');
+    return lines.join('\n');
+}
+function activeItems(manifest) {
+    return manifest.items.filter((item) => !item.deferred && item.resolvedBy !== 'card');
+}
+function evaluateLocalItem(root, appJson, item) {
+    if (CONFIG_RULES[item.id])
+        return evaluateConfigItem(appJson, item, CONFIG_RULES[item.id]);
+    switch (item.id) {
+        case 'hardcoded_secrets':
+            return patternItem(root, item, /sk-[A-Za-z0-9]{20,}|AIza[0-9A-Za-z_-]{30,}|-----BEGIN.*PRIVATE KEY|api[_-]?key\s*[:=]\s*['"][A-Za-z0-9]{16,}/i, 'fail', 'Hardcoded secret-like value found.', 'No secret-like values found.');
+        case 'http_endpoints':
+            return patternItem(root, item, /http:\/\/(?!localhost|127\.0\.0\.1)/i, 'warning', 'Non-local HTTP endpoint found.', 'No non-local HTTP endpoints found.');
+        case 'placeholder_content':
+            return patternItem(root, item, /lorem ipsum|example\.com|\bTBD\b|\bTODO\b|Coming soon|placeholder/i, 'warning', 'Placeholder text found.', 'No placeholder text found.');
+        case 'competitor_reference':
+            return patternItem(root, item, /google play|\.apk\b|samsung|android app/i, 'warning', 'Possible platform/competitor reference found in user-facing copy.', 'No competitor platform references found.', { dirs: ['app', 'src', 'components'] });
+        case 'private_api_usage':
+            return patternItem(root, item, /dlopen|dlsym|NSSelectorFromString|performSelector|valueForKey.*private|_UI[A-Z]/, 'fail', 'Private API or dynamic lookup pattern found.', 'No private API patterns found.', { dirs: ['ios', 'app', 'src'] });
+        case 'dynamic_code_execution':
+            return patternItem(root, item, /JSPatch|rollout\.io|CodePush.*eval|eval\(.*fetch|new Function\(.*http/i, 'fail', 'Dynamic code execution pattern found.', 'No dynamic code execution patterns found.');
+        case 'uiwebview':
+            return patternItem(root, item, /\bUIWebView\b/, 'fail', 'UIWebView reference found.', 'No UIWebView references found.', { dirs: ['ios', 'app', 'src'] });
+        case 'crypto_mining':
+            return patternItem(root, item, /coinhive|cryptonight|miner|monero|stratum\+tcp/i, 'fail', 'Cryptocurrency mining pattern found.', 'No cryptocurrency mining patterns found.');
+        case 'hardcoded_ipv4':
+            return patternItem(root, item, /\b((25[0-5]|2[0-4][0-9]|1?[0-9]?[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1?[0-9]?[0-9])\b/, 'warning', 'Non-local hardcoded IPv4 address found.', 'No non-local hardcoded IPv4 addresses found.', {
+                dirs: ['app', 'src'],
+                filter: (match) => !/\b(127\.0\.0\.1|0\.0\.0\.0)\b/.test(match.text),
+            });
+        case 'restore_purchases':
+            return evaluateRestorePurchases(root, item);
+        case 'tracking_without_att':
+            return evaluateTrackingWithoutAtt(root, item);
+        case 'external_payment_digital':
+            return evaluateExternalPayment(root, item);
+        case 'expo_layout_missing':
+            return evaluateExpoLayout(root, item);
+        case 'expo_duplicate_route':
+            return evaluateDuplicateRoutes(root, item);
+        case 'plugin_permission_missing':
+            return evaluatePluginPermissions(root, appJson, item);
+        case 'permission_descriptions':
+            return evaluatePermissionDescriptions(root, appJson, item);
+        case 'privacy_manifest':
+            return evaluatePrivacyManifest(root, item);
+        default:
+            if (STORE_REMINDER_IDS.has(item.id)) {
+                return makeItem(item, 'info', 'Complete this declaration in Google Play Console.', 'Play Console questionnaire');
+            }
+            if (JUDGMENT_IDS.has(item.id) || LIVE_STORE_IDS.has(item.id))
+                return null;
+            return null;
+    }
+}
+function evaluateConfigItem(appJson, item, rule) {
+    const value = getPath(appJson, rule.path);
+    const present = hasValue(value);
+    const evidence = `app.json ${rule.path.join('.')} = ${value === undefined ? 'undefined' : JSON.stringify(value)}`;
+    if (present)
+        return makeItem(item, 'pass', `${item.label} is set.`, evidence);
+    return makeItem(item, rule.absent, `${item.label} is not set.`, evidence);
+}
+function evaluateRestorePurchases(root, item) {
+    const iap = scan(root, /react-native-purchases|expo-in-app-purchases|StoreKit/i);
+    if (!iap.length)
+        return makeItem(item, 'pass', 'No in-app purchase APIs found.', 'scan: no IAP APIs found');
+    const restore = scan(root, /restorePurchases|restoreTransactions/i);
+    if (restore.length)
+        return makeItem(item, 'pass', 'Restore purchases flow appears in source.', evidence(restore));
+    return makeItem(item, 'fail', 'IAP APIs found but no restore purchases flow was found.', evidence(iap));
+}
+function evaluateTrackingWithoutAtt(root, item) {
+    const tracking = scan(root, /react-native-firebase\/analytics|facebook|appsflyer|amplitude|segment/i);
+    if (!tracking.length)
+        return makeItem(item, 'pass', 'No tracking SDK patterns found.', 'scan: no tracking SDK patterns found');
+    const att = scan(root, /expo-tracking-transparency|requestTrackingPermission/i);
+    if (att.length)
+        return makeItem(item, 'pass', 'Tracking SDK and ATT permission request were both found.', evidence(att));
+    return makeItem(item, 'fail', 'Tracking SDK found without ATT permission request.', evidence(tracking));
+}
+function evaluateExternalPayment(root, item) {
+    const matches = scan(root, /@stripe\/stripe-react-native|paypal|braintree/i);
+    if (!matches.length)
+        return makeItem(item, 'pass', 'No external payment SDK patterns found.', 'scan: no Stripe/PayPal/Braintree patterns found');
+    return makeItem(item, 'warning', 'External payment SDK found; verify it is not used for digital goods on iOS.', evidence(matches));
+}
+function evaluateExpoLayout(root, item) {
+    const appDir = path.join(root, 'app');
+    if (!existsSync(appDir))
+        return makeItem(item, 'pass', 'No Expo Router app directory found.', 'scan: app/ directory absent');
+    const dirs = walkDirs(appDir).map((dir) => path.relative(root, dir) || 'app');
+    const missing = dirs.filter((dir) => !hasLayoutFile(path.join(root, dir)));
+    if (!missing.length)
+        return makeItem(item, 'pass', 'Every app route directory has a layout file.', 'scan: app route directories');
+    return makeItem(item, 'fail', 'Expo Router directories without _layout files found.', missing.slice(0, 8).join(', '));
+}
+function evaluateDuplicateRoutes(root, item) {
+    const appDir = path.join(root, 'app');
+    if (!existsSync(appDir))
+        return makeItem(item, 'pass', 'No Expo Router app directory found.', 'scan: app/ directory absent');
+    const routes = new Map();
+    for (const file of walkFiles(appDir)) {
+        if (!/\.(tsx|ts|jsx|js)$/.test(file) || /(^|\/)_layout\.(tsx|ts|jsx|js)$/.test(toRel(root, file)))
+            continue;
+        const route = routePath(root, file);
+        const current = routes.get(route) ?? [];
+        current.push(toRel(root, file));
+        routes.set(route, current);
+    }
+    const duplicates = [...routes.entries()].filter(([, files]) => files.length > 1);
+    if (!duplicates.length)
+        return makeItem(item, 'pass', 'No duplicate Expo routes found.', 'scan: app route files');
+    return makeItem(item, 'fail', 'Duplicate Expo route files found.', duplicates.slice(0, 5).map(([route, files]) => `${route}: ${files.join(', ')}`).join('\n'));
+}
+function evaluatePluginPermissions(root, appJson, item) {
+    const missing = missingPermissionRequirements(root, appJson);
+    if (!missing.length)
+        return makeItem(item, 'pass', 'Used native capabilities have matching plugin/permission declarations.', 'app.json permission cross-check');
+    return makeItem(item, 'fail', 'Native capability usage is missing a matching permission declaration.', missing.join('; '));
+}
+function evaluatePermissionDescriptions(root, appJson, item) {
+    const missing = missingIosUsageDescriptions(root, appJson);
+    if (!missing.length)
+        return makeItem(item, 'pass', 'Used iOS capabilities have usage descriptions.', 'app.json ios.infoPlist cross-check');
+    return makeItem(item, 'fail', 'Used iOS capability is missing an NS*UsageDescription.', missing.join('; '));
+}
+function evaluatePrivacyManifest(root, item) {
+    const hasManifest = findByName(root, 'PrivacyInfo.xcprivacy').length > 0;
+    const requiredReasonApi = scan(root, /NSUserDefaults|systemUptime|fileModificationDate|diskSpace|activeInputModes/i);
+    const tracking = scan(root, /react-native-firebase\/analytics|facebook|appsflyer|amplitude|segment/i);
+    if (hasManifest)
+        return makeItem(item, 'pass', 'PrivacyInfo.xcprivacy is present.', 'scan: PrivacyInfo.xcprivacy found');
+    if (tracking.length)
+        return makeItem(item, 'fail', 'Tracking SDK pattern found but no PrivacyInfo.xcprivacy file was found.', evidence(tracking));
+    if (requiredReasonApi.length)
+        return makeItem(item, 'warning', 'Required-reason API pattern found but no PrivacyInfo.xcprivacy file was found.', evidence(requiredReasonApi));
+    return makeItem(item, 'pass', 'No required-reason API patterns found and no tracking SDK patterns found.', 'scan: no required privacy manifest signals found');
+}
+function patternItem(root, item, regex, statusOnHit, messageOnHit, messageOnMiss, options = {}) {
+    const matches = scan(root, regex, options);
+    if (matches.length)
+        return makeItem(item, statusOnHit, messageOnHit, evidence(matches));
+    return makeItem(item, 'pass', messageOnMiss, `scan: no matches for ${regex}`);
+}
+function missingPermissionRequirements(root, appJson) {
+    const missing = [...missingIosUsageDescriptions(root, appJson)];
+    const permissions = arrayOfStrings(getPath(appJson, ['expo', 'android', 'permissions']));
+    const source = sourceText(root, ['app', 'src', 'components']);
+    const androidChecks = [
+        { name: 'camera', used: /expo-camera|CameraView|requestCameraPermissions/i, permissions: ['CAMERA'] },
+        { name: 'location', used: /expo-location|getCurrentPositionAsync|watchPositionAsync/i, permissions: ['ACCESS_FINE_LOCATION', 'ACCESS_COARSE_LOCATION'] },
+        { name: 'photos', used: /expo-image-picker|expo-media-library|MediaLibrary/i, permissions: ['READ_MEDIA_IMAGES', 'READ_EXTERNAL_STORAGE'] },
+        { name: 'microphone', used: /expo-av|expo-audio|Audio\.|requestMicrophonePermissions/i, permissions: ['RECORD_AUDIO'] },
+        { name: 'notifications', used: /expo-notifications/i, permissions: ['POST_NOTIFICATIONS'] },
+    ];
+    for (const check of androidChecks) {
+        if (!check.used.test(source))
+            continue;
+        if (!check.permissions.some((permission) => permissions.includes(permission))) {
+            missing.push(`android ${check.name} permission (${check.permissions.join(' or ')})`);
+        }
+    }
+    return missing;
+}
+function missingIosUsageDescriptions(root, appJson) {
+    const infoPlist = objectValue(getPath(appJson, ['expo', 'ios', 'infoPlist']));
+    const source = sourceText(root, ['app', 'src', 'components']);
+    const checks = [
+        { name: 'camera', used: /expo-camera|CameraView|requestCameraPermissions/i, keys: ['NSCameraUsageDescription'] },
+        { name: 'location', used: /expo-location|getCurrentPositionAsync|watchPositionAsync/i, keys: ['NSLocationWhenInUseUsageDescription', 'NSLocationAlwaysAndWhenInUseUsageDescription'] },
+        { name: 'photos', used: /expo-image-picker|expo-media-library|MediaLibrary/i, keys: ['NSPhotoLibraryUsageDescription'] },
+        { name: 'microphone', used: /expo-av|expo-audio|Audio\.|requestMicrophonePermissions/i, keys: ['NSMicrophoneUsageDescription'] },
+    ];
+    const missing = [];
+    for (const check of checks) {
+        if (!check.used.test(source))
+            continue;
+        if (!check.keys.some((key) => hasValue(infoPlist[key]))) {
+            missing.push(`ios ${check.name} usage description (${check.keys.join(' or ')})`);
+        }
+    }
+    return missing;
+}
+function unresolvedReason(item) {
+    if (JUDGMENT_IDS.has(item.id))
+        return 'requires app-specific judgment over UI/copy behavior';
+    if (LIVE_STORE_IDS.has(item.id))
+        return 'requires live store metadata/media state or listing authoring workflow';
+    return `no deterministic evaluator is registered for ${item.check} item`;
+}
+function targetPlatformsFromAppJson(appJson) {
+    const ios = stringValue(getPath(appJson, ['expo', 'ios', 'bundleIdentifier']));
+    const android = stringValue(getPath(appJson, ['expo', 'android', 'package']));
+    const platforms = [];
+    if (ios)
+        platforms.push('ios');
+    if (android)
+        platforms.push('android');
+    return platforms.length ? platforms : ['ios', 'android'];
+}
+function targetsItem(item, targetPlatforms) {
+    return item.platform.some((platform) => targetPlatforms.includes(platform));
+}
+function makeItem(manifestItem, status, message, evidenceText) {
+    return {
+        id: manifestItem.id,
+        label: manifestItem.label,
+        status,
+        message,
+        evidence: evidenceText,
+        category: manifestItem.category,
+        priority: manifestItem.priority,
+        platform: manifestItem.platform,
+        authorable: manifestItem.authorable === true || undefined,
+        autofill: manifestItem.autofill,
+        guideline: manifestItem.guideline,
+        critical: manifestItem.critical === true || undefined,
+    };
+}
+function scan(root, regex, options = {}) {
+    const files = collectScanFiles(root, options.dirs);
+    const matches = [];
+    for (const file of files) {
+        const content = readText(file);
+        if (content == null)
+            continue;
+        const rel = toRel(root, file);
+        const lines = content.split(/\r?\n/);
+        lines.forEach((line, index) => {
+            regex.lastIndex = 0;
+            if (!regex.test(line))
+                return;
+            const match = { file: rel, line: index + 1, text: compact(line) };
+            if (options.filter && !options.filter(match))
+                return;
+            matches.push(match);
+        });
+    }
+    return matches.slice(0, 30);
+}
+function collectScanFiles(root, dirs) {
+    const roots = dirs?.length ? dirs : ['app', 'src', 'components', 'ios', 'android', 'app.json', 'package.json'];
+    const files = [];
+    for (const entry of roots) {
+        const full = path.join(root, entry);
+        if (!existsSync(full))
+            continue;
+        const stat = safeStat(full);
+        if (!stat)
+            continue;
+        if (stat.isDirectory())
+            files.push(...walkFiles(full));
+        else if (shouldScanFile(full))
+            files.push(full);
+    }
+    return files;
+}
+function walkFiles(dir) {
+    const files = [];
+    for (const entry of safeReadDir(dir)) {
+        if (SKIP_DIRS.has(entry.name))
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            files.push(...walkFiles(full));
+            continue;
+        }
+        if (entry.isFile() && shouldScanFile(full))
+            files.push(full);
+    }
+    return files;
+}
+function walkDirs(dir) {
+    const dirs = [dir];
+    for (const entry of safeReadDir(dir)) {
+        if (SKIP_DIRS.has(entry.name))
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory())
+            dirs.push(...walkDirs(full));
+    }
+    return dirs;
+}
+function shouldScanFile(file) {
+    return TEXT_EXTENSIONS.has(path.extname(file));
+}
+function findByName(root, name) {
+    return walkFiles(root).filter((file) => path.basename(file) === name);
+}
+function sourceText(root, dirs) {
+    return collectScanFiles(root, dirs).map((file) => readText(file) ?? '').join('\n');
+}
+function hasLayoutFile(dir) {
+    return ['_layout.tsx', '_layout.ts', '_layout.jsx', '_layout.js'].some((name) => existsSync(path.join(dir, name)));
+}
+function routePath(root, file) {
+    const rel = toRel(root, file).replace(/^app\//, '').replace(/\.(tsx|ts|jsx|js)$/, '');
+    const parts = rel.split('/').filter((part) => part && !/^\(.+\)$/.test(part));
+    if (parts[parts.length - 1] === 'index')
+        parts.pop();
+    return `/${parts.join('/')}`;
+}
+function evidence(matches) {
+    return matches.slice(0, 5).map((match) => `${match.file}:${match.line}: ${match.text}`).join('\n');
+}
+function readJson(file) {
+    try {
+        return JSON.parse(readFileSync(file, 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+function readText(file) {
+    try {
+        return readFileSync(file, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+function safeReadDir(dir) {
+    try {
+        return readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+}
+function safeStat(file) {
+    try {
+        return statSync(file);
+    }
+    catch {
+        return null;
+    }
+}
+function getPath(value, keys) {
+    let current = value;
+    for (const key of keys) {
+        if (!current || typeof current !== 'object' || Array.isArray(current))
+            return undefined;
+        current = current[key];
+    }
+    return current;
+}
+function objectValue(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function arrayOfStrings(value) {
+    return Array.isArray(value) ? value.filter((item) => typeof item === 'string') : [];
+}
+function stringValue(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+function hasValue(value) {
+    if (value === undefined || value === null)
+        return false;
+    if (typeof value === 'string')
+        return value.trim().length > 0 && value !== 'null';
+    return true;
+}
+function platformNames(platforms) {
+    return platforms.map((platform) => (platform === 'ios' ? 'iOS' : 'Android')).join('/');
+}
+function toRel(root, file) {
+    return path.relative(root, file).split(path.sep).join('/');
+}
+function compact(line) {
+    const trimmed = line.trim().replace(/\s+/g, ' ');
+    return trimmed.length > 160 ? `${trimmed.slice(0, 157)}...` : trimmed;
+}

package/dist/commands/sandbox.js

@@ -10,6 +10,7 @@ import { printJson, StatusLine, style } from '../terminal.js';
 import { noteDeprecated, registerAccessCommands } from './boxAccess.js';
 import { renderSandbox, renderSandboxList, } from './sandboxOutput.js';
 const MAX_SANDBOX_DISK_GIB = 2048;
+const DEFAULT_SANDBOX_TIMEOUT_SECONDS = 300;
 const DEFAULT_BOX_CPU_CORES = 2;
 const DEFAULT_BOX_MEMORY_MIB = 24 * 1024;
 const SANDBOX_POLL_INTERVAL_MS = 1_000;
@@ -283,7 +284,7 @@ export function registerSandbox(program) {
         .option('--memory <mb>', 'memory allocation in MiB', parseMemoryMb)
         .option('--disk <gb>', 'root disk capacity in GiB', parseDiskGb)
         .option('--idle-pause <seconds>', 'pause after inactivity; 0 keeps it running', parseIdlePauseSeconds)
-        .option('--timeout <seconds>', 'maximum sandbox lifetime; 0 disables the lifetime timer', parseTimeoutSeconds, 0)
+        .option('--timeout <seconds>', 'maximum sandbox lifetime; defaults to 300, or 0 for persistent sandboxes', parseTimeoutSeconds)
         .option('--persistent', 'never pause when idle (same as --idle-pause 0)', false)
         .option('--expose <port>', 'publish a guest port at <name>-box.run.cloud; implies --persistent', parsePort)
         .option('--secret-group <group>', 'attach a secret group; repeatable and ORDER MATTERS (a later group wins on a name collision)', collectRepeatable, [])
@@ -315,7 +316,8 @@ export function registerSandbox(program) {
             body.memory = memory;
         if (opts.disk !== undefined)
             body.disk = opts.disk;
-        body.timeoutSeconds = opts.timeout;
+        const persistent = exposed || opts.persistent || opts.idlePause === 0;
+        body.timeoutSeconds = opts.timeout ?? (persistent ? 0 : DEFAULT_SANDBOX_TIMEOUT_SECONDS);
         if (exposed || opts.persistent)
             body.idlePauseSeconds = 0;
         else if (opts.idlePause !== undefined)

package/dist/config.js

@@ -32,7 +32,9 @@ export function saveCredentials(creds) {
 }
 export function loadCredentials() {
     const envToken = isRunCloud()
-        ? process.env.RUN_CLOUD_API_TOKEN ?? process.env.RUN_CLOUD_API_KEY
+        ? process.env.RUN_CLOUD_API_TOKEN ??
+            process.env.RUN_CLOUD_API_KEY ??
+            process.env.RUN_CLOUD_CI_ENVIRONMENT_TOKEN
         : process.env.NEWLY_API_TOKEN ?? process.env.NEWLY_CLI_TOKEN;
     const envApiUrl = isRunCloud()
         ? process.env.RUN_CLOUD_API_URL

package/dist/index.js

@@ -18,6 +18,7 @@ import { registerDns } from './commands/dns.js';
 import { registerDiagnose } from './diagnose.js';
 import { registerDesktop } from './commands/desktop.js';
 import { registerEnvironment } from './commands/environment.js';
+import { registerAppStore } from './commands/appStore.js';
 const program = new Command('newly')
     .description('Develop, provision, and deploy Newly backends')
     .version('0.1.0');
@@ -39,4 +40,5 @@ registerDns(program);
 registerDiagnose(program);
 registerDesktop(program);
 registerEnvironment(program);
+registerAppStore(program);
 await program.parseAsync(process.argv);

package/dist/version.js

@@ -1 +1 @@
-export const CLI_VERSION = '0.1.20';
+export const CLI_VERSION = '0.1.22';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runcloud",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "Create and control run.cloud remote mobile simulators and cloud sandboxes",
   "license": "Apache-2.0",
   "keywords": [