shipup 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,25 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+## 0.2.0 - 2026-07-13
+
+- Add Android multi-market upload and status commands for Huawei, Honor, OPPO,
+  vivo, Xiaomi, Samsung, Tencent MyApp, and Meizu.
+- Add APK metadata and ABI inspection, launcher-icon extraction, image resizing,
+  screenshot processing, and optional store-listing metadata updates.
+- Expand App Store Connect commands with bundle-ID lookup, standalone build
+  submission, localization metadata, and idempotent phased release.
+- Support combined `android`, `harmony`, `huawei`, and `ios` credential sections
+  in the default credentials file.
+- Add credential permission warnings and redaction for multi-market provider
+  errors and signed responses.
+- Preserve the original HarmonyOS and Huawei compatibility commands.
+
+## 0.1.0 - 2026-07-13
+
+- Add HarmonyOS AppGallery upload, submit, and status commands.
+- Add Huawei Android APK upload and status commands.
+- Add iOS upload, submit, status, and phased-release commands.
+- Add normalized JSON output, stable exit codes, credential indirection, global
+  timeout handling, and dry-run validation.

package/LICENSE

@@ -0,0 +1,14 @@
+Zero-Clause BSD
+
+Copyright (C) 2026 shipup contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/README.md

@@ -0,0 +1,112 @@
+# shipup
+
+[![CI](https://github.com/HenryHaoson/shipup/actions/workflows/ci.yml/badge.svg)](https://github.com/HenryHaoson/shipup/actions/workflows/ci.yml)
+
+`shipup` is a Node.js CLI for uploading, submitting, inspecting, and releasing
+mobile applications across major app stores:
+
+- HarmonyOS AppGallery Connect (`.app`);
+- Android: Huawei, Honor, OPPO, vivo, Xiaomi, Samsung, Tencent MyApp, and Meizu (`.apk`);
+- Apple App Store Connect (`.ipa`).
+
+It is designed for local automation and CI: JSON goes to stdout, diagnostics go
+to stderr, provider states and exit codes are normalized, and `--dry-run`
+performs local validation without network requests.
+
+> `shipup` is an independent community project and is not affiliated with or
+> endorsed by any supported store operator.
+
+## Requirements
+
+- Node.js 18.17 or newer.
+- iOS upload requires macOS, Xcode, and `xcrun altool`.
+- Android icon extraction requires Android SDK `aapt`/`aapt2`; alternatively pass `--icon`.
+- Provider credentials authorized for the target application.
+
+## Install
+
+Until the first npm registry release, install from a checkout or a pinned GitHub tag:
+
+```bash
+npm install
+npm link
+shipup --help
+```
+
+## Quick start
+
+```bash
+mkdir -p ~/.config/shipup
+cp creds.example.yaml ~/.config/shipup/credentials.yaml
+chmod 600 ~/.config/shipup/credentials.yaml
+```
+
+Credentials are resolved from `--creds`, then `SHIPUP_CREDS`, then
+`~/.config/shipup/credentials.yaml`.
+
+```bash
+# HarmonyOS
+shipup harmony status
+shipup harmony upload --package ./application.app --dry-run
+
+# Android multi-market upload
+shipup android upload \
+  --upload huawei=./app-huawei.apk honor=./app-honor.apk \
+  --release-note @./release-note.txt \
+  --submit-review --output json
+shipup android status --channel huawei
+
+# App Store Connect
+shipup ios upload --package ./application.ipa --dry-run
+shipup ios submit --app-version 2.0.0 --build-version 200 --bundle-id com.example.app
+shipup ios status --app-version 2.0.0 --bundle-id com.example.app
+shipup ios release --app-version 2.0.0 --bundle-id com.example.app --phased
+```
+
+## Commands
+
+```text
+shipup harmony upload|submit|status
+shipup huawei  upload|status                    # compatibility command
+shipup android upload|status                    # eight Android markets
+shipup ios     upload|submit|status|release
+```
+
+Android upload supports release notes, icons, screenshots, application names,
+summaries, and descriptions where the selected market API supports them. See
+[Provider behavior](docs/providers.md) and [Android market capabilities](docs/android-markets.md).
+
+## Output and exit codes
+
+`--output json` returns a stable object with `tool`, `platform`, `command`,
+`ok`, `summary`, and per-channel `results`. Normalized states include
+`uploaded`, `submitted`, `pending_review`, `approved`, `published`, `rejected`,
+`offline`, `skipped`, and `failed`.
+
+| Code | Meaning |
+|---:|---|
+| `0` | success |
+| `1` | partial multi-channel failure |
+| `2` | provider or processing failure |
+| `3` | invalid CLI usage |
+| `4` | missing or invalid credentials |
+| `5` | missing or invalid package input |
+| `124` | timeout |
+
+Read [Credentials](docs/credentials.md) and [Security](SECURITY.md) before using
+production accounts.
+
+## Development
+
+```bash
+npm run check
+npm run security
+npm test
+npm run test:coverage
+npm run pack:check
+npm audit
+```
+
+## License
+
+[Zero-Clause BSD](LICENSE).

package/README.zh-CN.md

@@ -0,0 +1,105 @@
+# shipup
+
+`shipup` 是一个跨平台应用商店发布 CLI，支持：
+
+- HarmonyOS `.app`：AppGallery Connect；
+- Android APK：华为、荣耀、OPPO、vivo、小米、三星、应用宝、魅族；
+- iOS `.ipa`：App Store Connect 上传、提审、状态查询和灰度发布。
+
+它适合本地自动化和 CI：JSON 只写 stdout，过程信息写 stderr，状态和退出码统一，
+`--dry-run` 只做本地校验，不发网络请求。
+
+> `shipup` 是独立社区项目，与各应用市场运营方不存在隶属或官方背书关系。
+
+## 环境
+
+- Node.js 18.17 或更新版本；
+- iOS 上传需要 macOS、Xcode 和 `xcrun altool`；
+- Android 自动提取图标需要 Android SDK 的 `aapt`/`aapt2`，也可显式传 `--icon`；
+- 对目标应用具备相应权限的平台凭证。
+
+## 安装
+
+首次 npm registry 发布前，可从仓库或固定 Git tag 安装：
+
+```bash
+npm install
+npm link
+shipup --help
+```
+
+## 凭证
+
+```bash
+mkdir -p ~/.config/shipup
+cp creds.example.yaml ~/.config/shipup/credentials.yaml
+chmod 600 ~/.config/shipup/credentials.yaml
+```
+
+查找顺序为 `--creds`、`SHIPUP_CREDS`、`~/.config/shipup/credentials.yaml`。
+值支持字面量、`${ENVIRONMENT_VARIABLE}` 和 `@相对文件`。完整结构见
+[凭证说明](docs/credentials.md)。
+
+## 使用
+
+```bash
+# HarmonyOS
+shipup harmony status
+shipup harmony upload --package ./application.app --dry-run
+
+# Android 多渠道
+shipup android upload \
+  --upload huawei=./app-huawei.apk honor=./app-honor.apk \
+  --release-note @./release-note.txt \
+  --submit-review --output json
+shipup android status --channel huawei
+
+# iOS
+shipup ios upload --package ./application.ipa --dry-run
+shipup ios submit --app-version 2.0.0 --build-version 200 --bundle-id com.example.app
+shipup ios status --app-version 2.0.0 --bundle-id com.example.app
+shipup ios release --app-version 2.0.0 --bundle-id com.example.app --phased
+```
+
+命令总览：
+
+```text
+shipup harmony upload|submit|status
+shipup huawei  upload|status                    # 原华为兼容命令
+shipup android upload|status                    # Android 八渠道
+shipup ios     upload|submit|status|release
+```
+
+Android 上传支持按渠道更新发布说明、图标、截图、应用名、一句话简介和长描述。
+各市场具体支持情况见 [平台行为](docs/providers.md) 和
+[Android 市场能力表](docs/android-markets.md)。
+
+iOS 新参数统一为 `--app-version` 和 `--build-version`；旧的 `--version`、`--build`
+仍可使用。`--bundle-id` 可以自动反查 App Store Connect 数字 App ID。
+
+## 退出码
+
+| 退出码 | 含义 |
+|---:|---|
+| `0` | 成功 |
+| `1` | 多渠道部分失败 |
+| `2` | 全部失败或平台处理失败 |
+| `3` | 参数错误 |
+| `4` | 凭证缺失或无效 |
+| `5` | 软件包缺失或无效 |
+| `124` | 超时 |
+
+生产使用前请阅读 [SECURITY.md](SECURITY.md)。
+
+## 开发
+
+```bash
+npm run check
+npm run security
+npm test
+npm run test:coverage
+npm run pack:check
+npm audit
+```
+
+许可证：[Zero-Clause BSD](LICENSE)。

package/SECURITY.md

@@ -0,0 +1,32 @@
+# Security policy
+
+## Credentials
+
+Never commit provider credentials, private keys, release packages, or
+application-specific release metadata. Store local credentials under
+`~/.config/shipup` with mode `0600`, or inject them through a CI secret store.
+
+Credential values support literal strings, `${ENVIRONMENT_VARIABLE}`, and
+`@path/to/file`. Environment variables and external files are preferred for
+private keys and service-account JSON.
+
+`--dry-run` does not send network requests, but it still resolves and validates
+the selected credential file. Run it only in an environment allowed to access
+those credentials.
+
+## Logs
+
+Do not upload raw debug logs without reviewing them. `shipup` redacts common
+authorization tokens, private-key blocks, secret-like JSON fields, URL query
+parameters, and long opaque values across both core and multi-market adapters,
+but provider responses can change without notice.
+
+## Reporting a vulnerability
+
+Do not open a public issue containing credentials or private provider output.
+Use GitHub's private vulnerability reporting form in the repository Security
+tab. Do not include secrets in a public issue.
+
+## Supported versions
+
+Security fixes are provided for the latest released minor version only.

package/creds.example.yaml

@@ -0,0 +1,62 @@
+# Copy to ~/.config/shipup/credentials.yaml and chmod 600 it.
+# Values support literals, ${ENVIRONMENT_VARIABLE}, and @relative/file.
+
+android:
+  package_name: com.example.app
+  channels:
+    huawei:
+      app_id: "100000001"
+      client_id: ${HUAWEI_CLIENT_ID}
+      client_secret: ${HUAWEI_CLIENT_SECRET}
+    honor:
+      app_id: "100000002"
+      client_id: ${HONOR_CLIENT_ID}
+      client_secret: ${HONOR_CLIENT_SECRET}
+    oppo:
+      app_id: "100003"
+      client_id: ${OPPO_CLIENT_ID}
+      client_secret: ${OPPO_CLIENT_SECRET}
+    vivo:
+      app_id: "10004"
+      access_key: ${VIVO_ACCESS_KEY}
+      access_secret: ${VIVO_ACCESS_SECRET}
+    xiaomi:
+      user_name: ${XIAOMI_USER_NAME}
+      password: ${XIAOMI_PASSWORD}
+      rsa_modulus: ${XIAOMI_RSA_MODULUS}
+    samsung:
+      app_id: "000001000000"
+      service_account: ${SAMSUNG_SERVICE_ACCOUNT}
+      private_key: "@./samsung-private-key.pem"
+    qq:
+      app_id: "1100000000"
+      user_id: "60000"
+      access_secret: ${QQ_ACCESS_SECRET}
+    meizu:
+      access_key: ${MEIZU_ACCESS_KEY}
+      access_secret: ${MEIZU_ACCESS_SECRET}
+
+harmony:
+  app_id: "1234567890"
+  package_name: com.example.app
+  default_lang: zh-CN
+  service_account: "@./agc-service-account.json"
+  # API client credentials are also supported:
+  # client_id: ${AGC_CLIENT_ID}
+  # client_secret: ${AGC_CLIENT_SECRET}
+
+# Compatibility command: shipup huawei upload|status.
+# Android multi-market commands use android.channels.huawei above.
+huawei:
+  app_id: "123456789"
+  package_name: com.example.app
+  default_lang: zh-CN
+  service_account: "@./agc-service-account.json"
+
+ios:
+  app_id: "1234567890"
+  bundle_id: com.example.app
+  issuer_id: ${ASC_ISSUER_ID}
+  key_id: ${ASC_KEY_ID}
+  private_key: "@./AuthKey_XXXXXXXXXX.p8"
+  team_id: ${APPLE_TEAM_ID}