vydanne 0.2.0

package/src/play/commands/preflight.mjs

@@ -0,0 +1,37 @@
+import { green, red, yellow } from "../../util.mjs";
+
+// Play listing limits.
+const LIMITS = { title: 30, shortDescription: 80, fullDescription: 4000 };
+
+// Verify the Play listing is submission-complete: default-language title/short/full present + within limits,
+// the required feature graphic, and >=2 phone screenshots. Reads via a throwaway edit.
+export async function run(config, client) {
+  const g = config.google;
+  const editId = await client.newEdit();
+  const problems = [];
+  try {
+    const details = (await client.getDetails(editId)).json;
+    const lang = details.defaultLanguage || g.defaultLocale;
+    console.log(`  PLAY ${g.packageName}  default=${lang}`);
+    const listings = (await client.getListings(editId)).json.listings || [];
+    const dl = listings.find((l) => l.language === lang);
+    if (!dl) problems.push(`default language ${lang}: no listing`);
+    else {
+      for (const [f, lim] of Object.entries(LIMITS)) {
+        const v = (dl[f] || "").trim();
+        if (!v) problems.push(`${lang}: ${f} empty`);
+        else if (v.length > lim) problems.push(`${lang}: ${f} ${v.length}>${lim}`);
+      }
+    }
+    const fg = (await client.listImages(editId, lang, "featureGraphic")).json.images || [];
+    if (!fg.length) problems.push(`${lang}: feature graphic missing (required)`);
+    const ph = (await client.listImages(editId, lang, "phoneScreenshots")).json.images || [];
+    if (ph.length < 2) problems.push(`${lang}: needs >=2 phone screenshots (have ${ph.length})`);
+  } finally {
+    await client.deleteEdit(editId);
+  }
+  console.log();
+  if (!problems.length) console.log(green("preflight: no blockers"));
+  else { console.log(red(`preflight: ${problems.length} blocker(s)`)); problems.forEach((p) => console.log(`  ${red("x")} ${p}`)); }
+  return problems.length === 0;
+}

package/src/registry.mjs

@@ -0,0 +1,29 @@
+// The canonical command registry — the single source of vydanne's public commands. bin/ dispatches from
+// this, and the drift guards (scripts/check-docs.mjs, scripts/check-types.mjs) assert every command is
+// documented in README/SKILL and typed in types/index.d.ts. Add a command here → the guards force it into
+// the docs + types before publish.  name -> { mod: <file in src/commands>, client: needs an ASC client }
+export const COMMANDS = {
+  fill: { mod: "fill", client: true },
+  "age-rating": { mod: "ageRating", client: true },
+  "review-contact": { mod: "reviewContact", client: true },
+  accessibility: { mod: "accessibility", client: true },
+  privacy: { mod: "privacy", client: false },
+  previews: { mod: "previews", client: true },
+  iap: { mod: "iap", client: false },
+  compliance: { mod: "compliance", client: false },
+  inspect: { mod: "inspect", client: true },
+  diff: { mod: "diff", client: true },
+  preflight: { mod: "preflight", client: true },
+};
+
+// Commands available for `--store google` (Google Play). Same names as the Apple ones, different backend
+// (src/play/commands/). Store-specific commands (Apple accessibility/iap; Play data-safety) aren't shared.
+export const PLAY_COMMANDS = {
+  inspect: { mod: "inspect" },
+  preflight: { mod: "preflight" },
+  diff: { mod: "diff" },
+  fill: { mod: "fill" },
+};
+
+// Full public command surface (the module-dispatched ones above + the two handled inline in bin/).
+export const COMMAND_NAMES = [...Object.keys(COMMANDS), "locales", "version"];

package/src/upload.mjs

@@ -0,0 +1,47 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+const md5 = (buf) => crypto.createHash("md5").update(buf).digest("hex");
+
+// Native ASC asset upload (what spaceship does internally): reserve the asset (returns pre-signed
+// uploadOperations) -> PUT each chunk -> commit with uploaded:true + the MD5 checksum.
+// `type` = "appScreenshots" | "appPreviews"; `setType` = "appScreenshotSet" | "appPreviewSet".
+export async function uploadAsset(client, { type, setType, setId, filePath }) {
+  const bytes = fs.readFileSync(filePath);
+  const reserve = await client.post(`/v1/${type}`, {
+    data: {
+      type,
+      attributes: { fileSize: bytes.length, fileName: path.basename(filePath) },
+      relationships: { [setType]: { data: { type: `${setType}s`, id: setId } } },
+    },
+  });
+  if (reserve.status >= 300) throw new Error(`reserve ${type} ${reserve.status}: ${JSON.stringify(reserve.json).slice(0, 200)}`);
+  const asset = reserve.json.data;
+  for (const op of asset.attributes.uploadOperations || []) {
+    const headers = {};
+    for (const h of op.requestHeaders || []) headers[h.name] = h.value;
+    const r = await fetch(op.url, { method: op.method, headers, body: bytes.subarray(op.offset, op.offset + op.length) });
+    if (r.status >= 300) throw new Error(`upload op ${r.status} for ${path.basename(filePath)}`);
+  }
+  const commit = await client.patch(`/v1/${type}/${asset.id}`, {
+    data: { type, id: asset.id, attributes: { uploaded: true, sourceFileChecksum: md5(bytes) } },
+  });
+  if (commit.status >= 300) throw new Error(`commit ${type} ${commit.status}: ${JSON.stringify(commit.json).slice(0, 200)}`);
+  return asset.id;
+}
+
+// Previews process asynchronously — poll until Apple exposes videoUrl, then set the poster frame.
+export async function setPreviewPoster(client, previewId, frameTimeCode, { tries = 30, delayMs = 15000 } = {}) {
+  for (let i = 0; i < tries; i++) {
+    const { json } = await client.get(`/v1/appPreviews/${previewId}`);
+    if (json.data?.attributes?.videoUrl) {
+      await client.patch(`/v1/appPreviews/${previewId}`, {
+        data: { type: "appPreviews", id: previewId, attributes: { previewFrameTimeCode: frameTimeCode } },
+      });
+      return true;
+    }
+    await new Promise((r) => setTimeout(r, delayMs));
+  }
+  return false;
+}

package/src/util.mjs

@@ -0,0 +1,9 @@
+export const green = (s) => `\x1b[32m${s}\x1b[0m`;
+export const red = (s) => `\x1b[31m${s}\x1b[0m`;
+export const yellow = (s) => `\x1b[33m${s}\x1b[0m`;
+
+// App Store char limits (validated before upload so nothing eats a mid-upload rejection).
+export const LIMITS = { name: 30, subtitle: 30, keywords: 100, promotional_text: 170, iap_display_name: 30, iap_description: 45 };
+
+// Version-localization text fields (name/subtitle live on AppInfo). key = the ASC camelCase attribute.
+export const VERSION_FIELDS = { description: "description", keywords: "keywords", promotional_text: "promotionalText" };

package/types/index.d.ts

@@ -0,0 +1,119 @@
+// Type definitions for vydanne — App Store Connect submission prep (companion to zdymak).
+// Author a config with:  /** @type {import('vydanne').VydanneConfig} */ export default { … }
+
+export type Platform = 'IOS' | 'MAC_OS';
+
+/** Every vydanne CLI command (kept in sync with src/registry.mjs by scripts/check-types.mjs). */
+export type CommandName =
+  | 'fill'
+  | 'age-rating'
+  | 'review-contact'
+  | 'accessibility'
+  | 'privacy'
+  | 'previews'
+  | 'iap'
+  | 'compliance'
+  | 'inspect'
+  | 'diff'
+  | 'preflight'
+  | 'locales'
+  | 'version';
+
+export interface IapConfig {
+  productId: string;
+  /** 'non_consumable' | 'consumable' | 'auto_renewable' … */
+  type: string;
+  price: number;
+  /** App Store facing — max 30 chars. */
+  displayName: string;
+  /** App Store facing — max 45 chars. */
+  description: string;
+  reviewNote?: string;
+}
+
+export interface PreviewSpec {
+  platform: Platform;
+  /** Apple PreviewType, e.g. 'IPHONE_67' (6.9") | 'IPHONE_65' | 'IPAD_PRO_3GEN_129' | 'DESKTOP'. */
+  type: string;
+  /** Path to the .mp4 (from zdymak). */
+  file: string;
+  /** Poster frame, 'HH:MM:SS:FF'. */
+  poster?: string;
+  /** ASC locale codes to attach the preview to; defaults to the primary locale. */
+  locales?: string[];
+}
+
+export interface PrivacyConfig {
+  /** ASC data-type ids, e.g. ['CRASH_DATA', 'PERFORMANCE_DATA']. */
+  collected: string[];
+  tracking: boolean;
+}
+
+export interface GoogleConfig {
+  /** Play package name (usually the same as the iOS bundle id). */
+  packageName: string;
+  /** Path to the Play service-account JSON. Prefer the PLAY_JSON_KEY_FILE env over committing a path. */
+  serviceAccountKey?: string;
+  /** Listing-text folders, supply convention. Default 'fastlane/metadata/android'. */
+  metadataDir?: string;
+  defaultLocale?: string;
+}
+
+export interface ExportConfig {
+  /** 'standard' → self-classify (ECCN 5D002, ENC 740.17(b)(1)); else no compliance doc is generated. */
+  encryption: string;
+  /** Generate/expect the France ANSSI declaration for the France territory. */
+  france?: boolean;
+  appName?: string;
+  version?: string;
+  teamId?: string;
+}
+
+/** The `vydanne.config.mjs` default export. */
+export interface VydanneConfig {
+  bundleId: string;
+  /** Fallback for every locale without its own listing — must be populated. */
+  primaryLocale: string;
+  /** Prefer ASC_KEY_ID / ASC_ISSUER_ID env over putting these in the config. */
+  asc?: { keyId?: string; issuerId?: string };
+  /** iOS and macOS are separate ASC platforms. */
+  platforms?: Platform[];
+  /** App UI locales; mapped to ASC codes (unsupported ones fall back to primary). */
+  uiLocales?: string[];
+  metadataDir?: string;
+  /** e.g. '4+'. */
+  rating?: string;
+  privacy?: PrivacyConfig;
+  iaps?: IapConfig[];
+  previews?: PreviewSpec[];
+  export?: ExportConfig;
+  /** Google Play (`--store google`): listings, screenshots, feature graphic via the Edits API. */
+  google?: GoogleConfig;
+}
+
+/** Thin ASC REST client (native fetch + ES256 JWT). */
+export declare class Client {
+  constructor(opts: { keyId: string; issuerId: string });
+  token: string;
+  appId?: string;
+  app?: unknown;
+  findApp(bundleId: string): Promise<unknown>;
+  get(path: string, opts?: { iris?: boolean }): Promise<{ status: number; json: any }>;
+  post(path: string, body: unknown): Promise<{ status: number; json: any }>;
+  patch(path: string, body: unknown): Promise<{ status: number; json: any }>;
+  editVersion(platform: Platform): Promise<any>;
+  appInfo(): Promise<any>;
+  versionLocalizations(versionId: string): Promise<any[]>;
+  localization(id: string, kind?: string): Promise<Record<string, unknown>>;
+}
+
+export declare function loadConfig(path?: string): Promise<VydanneConfig & { resolvedLocales: { supported: Record<string, string>; unsupported: string[] } }>;
+export declare function makeToken(opts: { keyId: string; issuerId: string; keyPath?: string }): string;
+export declare function resolveLocales(uiCodes: string[]): { supported: Record<string, string>; unsupported: string[] };
+export declare function toAsc(code: string): string | null;
+export declare const VALID: Set<string>;
+export declare const CONFIG_KEYS: readonly string[];
+export declare const COMMAND_NAMES: readonly CommandName[];
+export declare const COMMANDS: Record<string, { mod: string; client: boolean }>;
+
+export default VydanneConfig;

package/vydanne.config.example.mjs

@@ -0,0 +1,56 @@
+// vydanne — one ESM file describes an app for App Store Connect (like zdymak.config.mjs). Copy to
+// `vydanne.config.mjs` and edit. Secrets never live here: ASC key at
+// ~/.appstoreconnect/private_keys/AuthKey_<id>.p8 + ASC_KEY_ID / ASC_ISSUER_ID env; review-contact PII in
+// the gitignored fastlane/metadata/review_information/.
+export default {
+  bundleId: "com.example.app",
+  primaryLocale: "en-GB", // fallback for every locale without its own listing — MUST be populated
+  platforms: ["IOS", "MAC_OS"], // macOS is a SEPARATE platform; its listing text is NOT shared with iOS
+
+  // asc: { keyId: "…", issuerId: "…" },   // prefer ASC_KEY_ID / ASC_ISSUER_ID env
+
+  // The app's UI locales. vydanne maps each to its ASC App Store code (de -> de-DE, ar -> ar-SA …) and
+  // flags any with no App Store language (e.g. Belarusian `be`) so you never abort an upload on a bad name.
+  uiLocales: ["en", "de", "es", "fr", "ja", "zh-Hans"],
+  metadataDir: "fastlane/metadata",
+
+  rating: "4+",
+
+  // Honest, minimal privacy — "accesses" is not "collects"; E2EE content the developer can't read is not
+  // collected. Declare only what actually leaves the device to you.
+  privacy: { collected: ["CRASH_DATA", "PERFORMANCE_DATA"], tracking: false },
+
+  iaps: [
+    {
+      productId: "com.example.app.unlock",
+      type: "non_consumable",
+      price: 19.99,
+      displayName: "Unlock App", // <= 30 chars (App Store facing)
+      description: "Unlock the full app forever. Buy once.", // <= 45 chars
+      reviewNote: "Non-consumable buy-once unlock; free to try, then unlocks forever. No account; reviewer can test via StoreKit sandbox.",
+    },
+  ],
+
+  // App Preview videos (from zdymak). type per Apple's PreviewType (IPHONE_67 = 6.9", DESKTOP = Mac).
+  previews: [
+    { platform: "IOS", type: "IPHONE_67", file: "marketing/out/appstore-preview.mp4", poster: "00:00:05:00", locales: ["en-GB", "en-US"] },
+  ],
+
+  export: { encryption: "standard", france: true, appName: "Example", version: "1.0", teamId: "ABCDE12345" },
+
+  // Google Play (optional). Add this block + set PLAY_JSON_KEY_FILE to the service-account JSON, then run
+  // any command with `--store google`. Package-SCOPED: vydanne only ever touches THIS packageName — a
+  // shared account key can never mutate another app. The listing lives in <metadataDir>/<play-locale>/ as
+  // title.txt (<=30) / short_description.txt (<=80) / full_description.txt (<=4000). Play uses its OWN
+  // locale codes (de-DE, es-ES, zh-CN, iw-IL, ar, ur, be … — NOT Apple's), so each folder is named for the
+  // Play code. Store graphics come from zdymak, auto-skipped when absent:
+  //   brand/icons/play/icon-512.png (512 icon) · marketing/out/play-feature-graphic.png (1024x500) ·
+  //   play-phone-plain/ · play-tablet7-plain/ (7") · play-tablet-plain/ (10"). The AAB binary stays with
+  //   fastlane; the promo video is a YouTube URL (set in Play Console). `fill --store google` is DRY unless
+  //   VYDANNE_COMMIT=1.
+  google: {
+    packageName: "com.example.app",
+    metadataDir: "fastlane/metadata/android",
+    defaultLocale: "en-GB",
+  },
+};