vydanne 0.4.2 → 0.6.0

package/src/commands/accessibility.mjs

@@ -1,36 +1,146 @@
 import { green, yellow, red } from "../util.mjs";
 
-const T = true, F = false;
-// Honest DoD-backed matrix; Apple caveats: Larger Text N/A on Mac, Voice Control N/A on Watch, no video →
-// no captions/AD. DRAFT-safe; VYDANNE_A11Y_PUBLISH=1 publishes, but Apple 409s publish until the app is live.
-const MATRIX = {
-  IPHONE: { supportsVoiceover: T, supportsVoiceControl: T, supportsLargerText: T, supportsSufficientContrast: T, supportsDarkInterface: T, supportsDifferentiateWithoutColorAlone: T, supportsReducedMotion: T, supportsCaptions: F, supportsAudioDescriptions: F },
-  IPAD: { supportsVoiceover: T, supportsVoiceControl: T, supportsLargerText: T, supportsSufficientContrast: T, supportsDarkInterface: T, supportsDifferentiateWithoutColorAlone: T, supportsReducedMotion: T, supportsCaptions: F, supportsAudioDescriptions: F },
-  MAC: { supportsVoiceover: T, supportsVoiceControl: T, supportsSufficientContrast: T, supportsDarkInterface: T, supportsDifferentiateWithoutColorAlone: T, supportsReducedMotion: T, supportsCaptions: F, supportsAudioDescriptions: F },
-  APPLE_WATCH: { supportsVoiceover: T, supportsLargerText: T, supportsSufficientContrast: T, supportsDarkInterface: T, supportsDifferentiateWithoutColorAlone: T, supportsReducedMotion: T, supportsCaptions: F, supportsAudioDescriptions: F },
+/**
+ * Accessibility Nutrition Labels.
+ *
+ * These used to come from a hardcoded matrix that said the same thing for every app the tool was
+ * pointed at. That is the wrong shape for this one command. Everything else vydanne writes is a
+ * FACT about an app — its name, its price, the data it collects — but this is a CLAIM about
+ * behaviour, made to Apple, and the tool had no way of knowing whether it was true. It asserted
+ * VoiceOver, Voice Control and Larger Text support for apps nobody had audited, and at least one
+ * of them did not honour Larger Text at all: its board glyphs scaled twice and grew off the
+ * high-contrast disc drawn behind them.
+ *
+ * So the app declares it, feature by feature, in `vydanne.config.mjs`. Silence is not consent — an
+ * app with no `accessibility` block gets an error, not a default, because "nobody wrote this down"
+ * must never become "supports everything".
+ *
+ * Apple's platform caveats are still applied here, because they are facts about the platforms
+ * rather than about any app: Larger Text does not exist on macOS and Voice Control does not exist
+ * on watchOS, so those are forced false regardless of what an app claims.
+ */
+
+/** Config key -> the ASC attribute it sets. */
+const FEATURES = {
+  voiceover: "supportsVoiceover",
+  voiceControl: "supportsVoiceControl",
+  largerText: "supportsLargerText",
+  sufficientContrast: "supportsSufficientContrast",
+  darkInterface: "supportsDarkInterface",
+  differentiateWithoutColorAlone: "supportsDifferentiateWithoutColorAlone",
+  reducedMotion: "supportsReducedMotion",
+  captions: "supportsCaptions",
+  audioDescriptions: "supportsAudioDescriptions",
+};
+
+/** Features Apple does not offer on a device family — never sent, whatever the app declares. */
+const UNAVAILABLE = {
+  IPHONE: [],
+  IPAD: [],
+  MAC: ["largerText"],
+  APPLE_WATCH: ["voiceControl"],
 };
 
+const EXAMPLE = `  accessibility: {
+    voiceover: true,
+    voiceControl: true,
+    largerText: true,
+    sufficientContrast: true,
+    darkInterface: true,
+    differentiateWithoutColorAlone: true,
+    reducedMotion: true,
+    captions: false,
+    audioDescriptions: false,
+  },`;
+
+/** Turn the app's declaration into the attributes for one device family. */
+function attributesFor(declared, family) {
+  const out = {};
+  for (const [key, attribute] of Object.entries(FEATURES)) {
+    out[attribute] = UNAVAILABLE[family].includes(key) ? false : declared[key] === true;
+  }
+  return out;
+}
+
+/** Returns a human-readable problem, or null when the declaration is usable. */
+export function validate(config) {
+  const declared = config.accessibility;
+  if (!declared || typeof declared !== "object") {
+    return [
+      "accessibility: missing.",
+      "This command publishes CLAIMS about your app's behaviour to Apple, so it will not guess.",
+      "Declare what you have actually verified:",
+      "",
+      EXAMPLE,
+    ].join("\n");
+  }
+  const unknown = Object.keys(declared).filter((k) => !(k in FEATURES));
+  if (unknown.length) {
+    return `accessibility: unknown feature(s) ${unknown.join(", ")}. Known: ${Object.keys(FEATURES).join(", ")}`;
+  }
+  const missing = Object.keys(FEATURES).filter((k) => typeof declared[k] !== "boolean");
+  if (missing.length) {
+    return [
+      `accessibility: ${missing.join(", ")} must be declared true or false.`,
+      "Every feature is stated explicitly — an omission would read as a quiet 'no', which is just",
+      "as unverified as a quiet 'yes'.",
+    ].join("\n");
+  }
+  return null;
+}
+
 export async function run(config, client) {
+  const problem = validate(config);
+  if (problem) {
+    console.error(red(problem));
+    return false;
+  }
+  const declared = config.accessibility;
+
   await client.findApp(config.bundleId);
   const publish = process.env.VYDANNE_A11Y_PUBLISH === "1";
   const { json } = await client.get(`/v1/apps/${client.appId}/accessibilityDeclarations?limit=50`);
   const decls = {};
   for (const d of json.data || []) decls[d.attributes.deviceFamily] = d.id;
+
+  const claimed = Object.keys(FEATURES).filter((k) => declared[k]);
+  console.log(`  declaring: ${claimed.length ? claimed.join(", ") : "(nothing)"}`);
+
   let gated = false;
-  for (const [fam, attributes] of Object.entries(MATRIX)) {
-    const id = decls[fam];
-    if (!id) { console.error(yellow(`  no ${fam} declaration`)); continue; }
-    const r = await client.patch(`/v1/accessibilityDeclarations/${id}`, { data: { type: "accessibilityDeclarations", id, attributes } });
-    if (r.status >= 300) { console.error(red(`  ${fam} draft ${r.status}`)); continue; }
+  for (const family of Object.keys(UNAVAILABLE)) {
+    const id = decls[family];
+    if (!id) {
+      console.error(yellow(`  no ${family} declaration`));
+      continue;
+    }
+    const attributes = attributesFor(declared, family);
+    const r = await client.patch(`/v1/accessibilityDeclarations/${id}`, {
+      data: { type: "accessibilityDeclarations", id, attributes },
+    });
+    if (r.status >= 300) {
+      console.error(red(`  ${family} draft ${r.status}`));
+      continue;
+    }
     if (publish) {
-      const p = await client.patch(`/v1/accessibilityDeclarations/${id}`, { data: { type: "accessibilityDeclarations", id, attributes: { publish: true } } });
-      if (p.status < 300) console.log(green(`  ${fam}: PUBLISHED`));
-      else if (JSON.stringify(p.json).includes("CANNOT_PUBLISH_APP_MUST_BE_AVAILABLE")) { gated = true; console.log(yellow(`  ${fam}: draft saved — publish deferred (app not live yet)`)); }
-      else console.error(red(`  ${fam} publish ${p.status}`));
+      const p = await client.patch(`/v1/accessibilityDeclarations/${id}`, {
+        data: { type: "accessibilityDeclarations", id, attributes: { publish: true } },
+      });
+      if (p.status < 300) {
+        console.log(green(`  ${family}: PUBLISHED`));
+      } else if (JSON.stringify(p.json).includes("CANNOT_PUBLISH_APP_MUST_BE_AVAILABLE")) {
+        gated = true;
+        console.log(yellow(`  ${family}: draft saved — publish deferred (app not live yet)`));
+      } else {
+        console.error(red(`  ${family} publish ${p.status}`));
+      }
     } else {
-      console.log(green(`  ${fam}: draft saved`));
+      console.log(green(`  ${family}: draft saved`));
     }
   }
-  console.log(gated ? yellow("accessibility staged (DRAFT); re-run with VYDANNE_A11Y_PUBLISH=1 once the app is live") : "accessibility done");
+  console.log(
+    gated
+      ? yellow("accessibility staged (DRAFT); re-run with VYDANNE_A11Y_PUBLISH=1 once the app is live")
+      : "accessibility done",
+  );
   return true;
 }

package/src/commands/ageRating.mjs

@@ -28,6 +28,6 @@ export async function run(config, client) {
   };
   const r = await client.patch(`/v1/ageRatingDeclarations/${id}`, { data: { type: "ageRatingDeclarations", id, attributes } });
   if (r.status >= 300) { console.error(red(`age-rating: ${r.status}: ${JSON.stringify(r.json).slice(0, 200)}`)); return false; }
-  console.log(green("age rating set -> 4+"));
+  console.log(client.dryRun ? yellow("age rating WOULD be set -> 4+") : green("age rating set -> 4+"));
   return true;
 }

package/src/commands/fill.mjs

@@ -3,6 +3,7 @@ import path from "node:path";
 import { green, yellow, red } from "../util.mjs";
 import { VALID } from "../locales.mjs";
 import { uploadAsset } from "../upload.mjs";
+import { reportCrossStore } from "../crossStore.mjs";
 
 // Version-localization fields (attr -> metadata filename) and AppInfo fields (name/subtitle, shared).
 const VERSION_TXT = { description: "description", keywords: "keywords", promotionalText: "promotional_text", whatsNew: "release_notes", marketingUrl: "marketing_url", supportUrl: "support_url" };
@@ -50,6 +51,16 @@ export async function run(config, client) {
   let ok = true; // a locale Apple refused must fail the command, not just print
   const skipMeta = process.env.VYDANNE_SKIP_METADATA === "1";
   const skipShots = process.env.VYDANNE_SKIP_SCREENSHOTS === "1";
+
+  // Checked here and not only in preflight, because preflight is something you REMEMBER to run and
+  // this is the thing that actually uploads. A cross-store reference costs a review cycle, and it
+  // is free to catch one function call earlier. VYDANNE_ALLOW_CROSS_STORE=1 is the deliberate
+  // override for the rare listing that genuinely needs the word.
+  if (!skipMeta && process.env.VYDANNE_ALLOW_CROSS_STORE !== "1"
+      && !reportCrossStore("apple", config.metadataDir, config.allowCrossStoreTerms)) {
+    console.error(red("fill: refusing to upload — fix the listing text, or set VYDANNE_ALLOW_CROSS_STORE=1."));
+    return false;
+  }
   const info = await client.appInfo();
   const infoLocs = info ? (await client.get(`/v1/appInfos/${info.id}/appInfoLocalizations?limit=200`)).json.data || [] : [];
 

package/src/commands/preflight.mjs

@@ -1,4 +1,5 @@
 import { green, red, yellow, LIMITS, VERSION_FIELDS } from "../util.mjs";
+import { reportCrossStore } from "../crossStore.mjs";
 
 // Verify a listing is submission-complete the CORRECT way — each localization read by id (not the sparse
 // list), char limits, primary-locale coverage, per-platform — and warn on the gotchas before ASC does.
@@ -34,6 +35,11 @@ export async function run(config, client) {
     }
   }
 
+  // Local copy that is about to be uploaded, checked before it can earn a rejection.
+  if (!reportCrossStore("apple", config.metadataDir, config.allowCrossStoreTerms)) {
+    problems.push("listing text references another mobile platform (see above)");
+  }
+
   console.log();
   if (!problems.length) console.log(green("preflight: no blockers"));
   else { console.log(red(`preflight: ${problems.length} blocker(s)`)); problems.forEach((p) => console.log(`  ${red("x")} ${p}`)); }

package/src/commands/prerelease.mjs

@@ -0,0 +1,267 @@
+import fs from "node:fs";
+import path from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { green, yellow, red } from "../util.mjs";
+
+const run_ = promisify(execFile);
+
+/**
+ * Upload a build to App Store Connect, for TestFlight.
+ *
+ * The Play side has had this since the beginning; Apple did not, so the one step that actually
+ * moves a binary had to be done by hand for iOS while Android was a command. This closes that,
+ * with the same refusals.
+ *
+ * **The REST API cannot carry a binary.** Everything else vydanne does is ASC REST over a JWT it
+ * mints itself, but Apple has never exposed binary upload there — `altool` and Transporter are the
+ * only supported paths. So this shells out to `xcrun altool`, which is not a departure from "no
+ * fastlane/Ruby": altool ships with Xcode, and you already needed Xcode to produce the .ipa this
+ * command uploads. It does mean the command is macOS-only, which is checked up front rather than
+ * discovered as a confusing spawn error.
+ *
+ * WHAT IT REFUSES, mirroring `--store google`:
+ *  - it does not submit for App Store review. That release is a human's to make, and there is no
+ *    arrangement of arguments here that reaches the public.
+ *  - it does not touch EXTERNAL TestFlight groups. External testing needs Beta App Review, which
+ *    is a submission by another name. Internal groups only — the exact parallel of Play's
+ *    `internal` track, and for the same practical reason: on a PAID app, internal testers are the
+ *    ones who install without buying it.
+ *
+ * Apple assigns nothing: the build number comes from the archive's own CFBundleVersion, so build
+ * numbering stays with the build, and re-uploading one Apple already holds fails loudly instead of
+ * silently replacing a binary.
+ *
+ * WHAT IT ALSO DOES: points the version you are preparing AT the build it just uploaded. That is
+ * the loop this command exists to serve — ship a build to testers, find something, fix it, upload
+ * again — and without it the version keeps whatever build was attached first while TestFlight
+ * quietly moves on. Re-running simply re-points: the relationship is a single build, so the newest
+ * upload replaces the old one and there is nothing to clean up.
+ *
+ * It will not re-point a version that is no longer editable (in review, or already released),
+ * because Apple would need that version withdrawn first — a decision with reviewer-facing
+ * consequences, and therefore the operator's.
+ */
+
+/** How long to watch processing before handing back. Apple is usually minutes, occasionally not. */
+const PROCESS_TIMEOUT_MS = 15 * 60 * 1000;
+const POLL_MS = 20 * 1000;
+
+/** Newest `.ipa` in a directory, or the file itself. Mirrors how `google.aab` is resolved. */
+export function resolveIpa(spec) {
+  const target = process.env.VYDANNE_IPA || spec;
+  if (!target) return null;
+  if (!fs.existsSync(target)) return null;
+  if (fs.statSync(target).isFile()) return target.endsWith(".ipa") ? path.resolve(target) : null;
+  const ipas = fs
+    .readdirSync(target)
+    .filter((f) => f.endsWith(".ipa"))
+    .map((f) => path.join(target, f))
+    .sort((a, b) => fs.statSync(b).mtimeMs - fs.statSync(a).mtimeMs);
+  return ipas.length ? path.resolve(ipas[0]) : null;
+}
+
+async function altool(args, credentials) {
+  // altool finds the key itself, in the same ~/.appstoreconnect/private_keys location vydanne
+  // already resolves for its JWT — so a working `vydanne auth` is a working upload.
+  const full = ["altool", ...args, "--apiKey", credentials.keyId, "--apiIssuer", credentials.issuerId];
+  return run_("xcrun", full, { maxBuffer: 32 * 1024 * 1024 });
+}
+
+/** The newest build Apple has for this app, if any. */
+async function newestBuild(client) {
+  const { json } = await client.get(
+    `/v1/builds?filter[app]=${client.appId}&sort=-uploadedDate&limit=1` +
+      `&fields[builds]=version,processingState,uploadedDate`,
+  );
+  return json.data?.[0] ?? null;
+}
+
+export async function run(config, client, credentials) {
+  const ios = config.ios || {};
+
+  if (process.platform !== "darwin") {
+    console.error(red("prerelease: uploading to App Store Connect needs `xcrun altool`, which is macOS-only."));
+    console.error("  Apple has never exposed binary upload over the REST API — altool or Transporter only.");
+    return false;
+  }
+
+  const ipa = resolveIpa(ios.ipa);
+  if (!ipa) {
+    console.error(red("prerelease: no .ipa found — set `ios.ipa` in the config, or pass VYDANNE_IPA=<path>."));
+    console.error("  It may be a file or a directory; a directory takes its newest .ipa.");
+    return false;
+  }
+
+  await client.findApp(config.bundleId);
+  const before = await newestBuild(client);
+  const size = (fs.statSync(ipa).size / 1e6).toFixed(1);
+  console.log(green("prerelease → App Store Connect (TestFlight)"));
+  console.log(`  archive: ${path.relative(process.cwd(), ipa) || ipa}  (${size} MB)`);
+
+  // Validate before uploading. A rejected upload has already cost the transfer; altool's validation
+  // catches the common refusals (entitlements, missing icons, bad version) in seconds.
+  try {
+    await altool(["--validate-app", "-f", ipa, "-t", "ios"], credentials);
+    console.log(green("  validated"));
+  } catch (e) {
+    console.error(red("  validation failed — Apple would reject this archive:"));
+    console.error(indent(e.stdout || e.stderr || e.message));
+    return false;
+  }
+
+  // The binary upload is the one mutation that does NOT go through the ASC client, so the client-level
+  // dry-run gate cannot see it — it has to be refused here, or a dry run would ship a build to TestFlight.
+  // Validation above has already run, which is the useful half: exactly Play's "validate, then discard".
+  if (client.dryRun) {
+    console.log(yellow("  DRY RUN — archive validated, NOT uploaded. Re-run with --apply to send it to TestFlight."));
+    return true;
+  }
+
+  try {
+    await altool(["--upload-app", "-f", ipa, "-t", "ios"], credentials);
+    console.log(green("  uploaded"));
+  } catch (e) {
+    const text = `${e.stdout || ""}${e.stderr || ""}` || e.message;
+    // The one refusal worth naming: re-uploading a build number Apple already holds. It is the
+    // right answer for an accident and a dead end for a re-run, so say which it is.
+    if (/already exists|redundant binary|previously uploaded/i.test(text)) {
+      console.error(red("  Apple already holds this build number."));
+      console.error("  Bump CFBundleVersion (Scripts/build-number.sh in the games) and re-archive.");
+    } else {
+      console.error(red("  upload failed:"));
+      console.error(indent(text));
+    }
+    return false;
+  }
+
+  const build = await waitForProcessing(client, before);
+  if (!build) {
+    console.log(yellow("  build not visible yet — Apple is still ingesting it."));
+    console.log("  It will appear in TestFlight shortly; nothing further is needed here.");
+    return true;
+  }
+  console.log(green(`  build ${build.attributes.version}: ${build.attributes.processingState}`));
+
+  if (build.attributes.processingState === "FAILED") {
+    console.error(red("  Apple failed to process this build — check the email it sent for the reason."));
+    return false;
+  }
+
+  if (ios.testFlightGroup) {
+    await assignToInternalGroup(client, build, ios.testFlightGroup);
+  }
+
+  await pointVersionAtBuild(client, config, build);
+
+  console.log("prerelease done — the build is in TestFlight.");
+  console.log(yellow("  Submitting for App Store review stays manual, by design."));
+  return true;
+}
+
+async function waitForProcessing(client, before) {
+  const deadline = Date.now() + PROCESS_TIMEOUT_MS;
+  let announced = false;
+  while (Date.now() < deadline) {
+    const build = await newestBuild(client);
+    // "New" means a different build than the one that was newest before the upload. Comparing ids
+    // rather than timestamps avoids any assumption about clock skew between here and Apple.
+    if (build && build.id !== before?.id) {
+      if (build.attributes.processingState !== "PROCESSING") return build;
+      if (!announced) {
+        console.log("  processing…");
+        announced = true;
+      }
+    }
+    await new Promise((r) => setTimeout(r, POLL_MS));
+  }
+  return null;
+}
+
+/**
+ * Add the build to an INTERNAL TestFlight group.
+ *
+ * External groups are refused: distributing to them requires Beta App Review, which is a
+ * submission, and this tool does not submit.
+ */
+async function assignToInternalGroup(client, build, groupName) {
+  const { json } = await client.get(
+    `/v1/apps/${client.appId}/betaGroups?limit=200&fields[betaGroups]=name,isInternalGroup`,
+  );
+  const groups = json.data || [];
+  const group = groups.find((g) => g.attributes.name === groupName);
+  if (!group) {
+    const names = groups.map((g) => `${g.attributes.name}${g.attributes.isInternalGroup ? "" : " (external)"}`);
+    console.error(yellow(`  no TestFlight group named "${groupName}" — have: ${names.join(", ") || "none"}`));
+    return;
+  }
+  if (!group.attributes.isInternalGroup) {
+    console.error(red(`  "${groupName}" is an EXTERNAL group — refusing.`));
+    console.error("  External testing needs Beta App Review, which is a submission by another name.");
+    return;
+  }
+  const r = await client.post(`/v1/betaGroups/${group.id}/relationships/builds`, {
+    data: [{ type: "builds", id: build.id }],
+  });
+  if (r.status < 300) console.log(green(`  added to internal group "${groupName}"`));
+  else console.error(yellow(`  could not add to "${groupName}" (${r.status})`));
+}
+
+/** Versions Apple will not let us re-point without the operator withdrawing them first. */
+const LOCKED_STATES = new Set([
+  "WAITING_FOR_REVIEW",
+  "IN_REVIEW",
+  "PENDING_DEVELOPER_RELEASE",
+  "PENDING_APPLE_RELEASE",
+  "READY_FOR_SALE",
+  "REPLACED_WITH_NEW_VERSION",
+]);
+
+/**
+ * Attach [build] to the version being prepared, replacing whatever was there.
+ *
+ * This is what makes "upload a fix and try again" one command rather than a trip to the web UI:
+ * the version → build relationship holds exactly one build, so a PATCH re-points it.
+ */
+export async function pointVersionAtBuild(client, config, build) {
+  const platform = (config.platforms && config.platforms[0]) || "IOS";
+  const version = await client.editVersion(platform);
+  if (!version) {
+    console.log(yellow("  no editable App Store version — build uploaded, nothing to attach it to."));
+    return;
+  }
+  const state = version.attributes.appStoreState;
+  const versionString = version.attributes.versionString;
+  if (LOCKED_STATES.has(state)) {
+    console.log(yellow(`  version ${versionString} is ${state} — leaving its build alone.`));
+    console.log("  Re-pointing it would mean withdrawing that submission, which is your call.");
+    return;
+  }
+
+  // What it currently points at, so a no-op re-run says so rather than looking like a change.
+  const { json: current } = await client.get(
+    `/v1/appStoreVersions/${version.id}/build?fields[builds]=version`,
+  );
+  const was = current.data?.attributes?.version ?? current.data?.id ?? null;
+  if (current.data?.id === build.id) {
+    console.log(green(`  version ${versionString} already points at build ${build.attributes.version}`));
+    return;
+  }
+
+  const r = await client.patch(`/v1/appStoreVersions/${version.id}/relationships/build`, {
+    data: { type: "builds", id: build.id },
+  });
+  if (r.status < 300) {
+    const from = was ? `build ${was} -> ` : "";
+    console.log(green(`  version ${versionString}: ${from}build ${build.attributes.version}`));
+  } else {
+    console.error(yellow(`  could not attach the build to version ${versionString} (${r.status})`));
+  }
+}
+
+const indent = (text) =>
+  String(text)
+    .trim()
+    .split("\n")
+    .map((l) => `    ${l}`)
+    .join("\n");

package/src/commands/previews.mjs

@@ -24,17 +24,24 @@ export async function run(config, client) {
         }
         for (const p of existing) { // VYDANNE_REPLACE: drop the old preview so the new upload takes its place
           await client.del(`/v1/appPreviews/${p.id}`);
-          console.log(yellow(`  ${s.platform}/${code}/${s.type}: removed old preview ${p.id}`));
+          console.log(yellow(`  ${s.platform}/${code}/${s.type}: ${client.dryRun ? "would remove" : "removed"} old preview ${p.id}`));
         }
         if (!set) {
           const c = await client.post(`/v1/appPreviewSets`, { data: { type: "appPreviewSets", attributes: { previewType: s.type }, relationships: { appStoreVersionLocalization: { data: { type: "appStoreVersionLocalizations", id: loc.id } } } } });
           set = c.json.data;
         }
         const file = path.resolve(s.file);
-        console.log(`  ${s.platform}/${code}/${s.type}: uploading ${path.basename(file)}...`);
+        // A configured preview whose file is missing is the whole reason this is checked here: the
+        // upload would throw ENOENT mid-run, and in a DRY run it would otherwise look like a plan that
+        // works. Name it and move on, so one missing video doesn't hide the rest of the report.
+        if (!fs.existsSync(file)) {
+          console.error(red(`  ${s.platform}/${code}/${s.type}: ${path.relative(process.cwd(), file)} does not exist — nothing to upload`));
+          continue;
+        }
+        console.log(`  ${s.platform}/${code}/${s.type}: ${client.dryRun ? "would upload" : "uploading"} ${path.basename(file)}...`);
         const id = await uploadAsset(client, { type: "appPreviews", setType: "appPreviewSet", setId: set.id, filePath: file });
         await setPreviewPoster(client, id, s.poster);
-        console.log(green(`    done ${s.platform}/${code}/${s.type}`));
+        if (!client.dryRun) console.log(green(`    done ${s.platform}/${code}/${s.type}`));
       } catch (e) {
         console.error(red(`    error ${s.platform}/${code}/${s.type}: ${e.message}`));
       }

package/src/commands/reviewContact.mjs

@@ -1,6 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
-import { green, red } from "../util.mjs";
+import { green, yellow, red } from "../util.mjs";
 
 // App Review contact from the GITIGNORED metadata/review_information/*.txt. PATCH (or POST) the review
 // detail directly — deliver can't do this cleanly pre-first-submission.
@@ -22,6 +22,7 @@ export async function run(config, client) {
     ? await client.patch(`/v1/appStoreReviewDetails/${existing.id}`, { data: { type: "appStoreReviewDetails", id: existing.id, attributes } })
     : await client.post(`/v1/appStoreReviewDetails`, { data: { type: "appStoreReviewDetails", attributes, relationships: { appStoreVersion: { data: { type: "appStoreVersions", id: v.id } } } } });
   if (r.status >= 300) { console.error(red(`review-contact: ${r.status}: ${JSON.stringify(r.json).slice(0, 200)}`)); return false; }
-  console.log(green(`review contact set -> ${attributes.contactFirstName} ${attributes.contactLastName} · ${attributes.contactPhone}`));
+  const who = `${attributes.contactFirstName} ${attributes.contactLastName} · ${attributes.contactPhone}`;
+  console.log(client.dryRun ? yellow(`review contact WOULD be set -> ${who}`) : green(`review contact set -> ${who}`));
   return true;
 }

package/src/config.mjs

@@ -6,7 +6,7 @@ import { resolveCredentials } from "./credentials.mjs";
 
 // The public config surface — the drift guards assert each key is documented (README/SKILL) and typed
 // (types/index.d.ts). Add a config knob → document + type it, or the guards fail before publish.
-export const CONFIG_KEYS = ["bundleId", "primaryLocale", "asc", "platforms", "uiLocales", "metadataDir", "rating", "privacy", "iaps", "previews", "export", "google"];
+export const CONFIG_KEYS = ["bundleId", "primaryLocale", "asc", "platforms", "uiLocales", "metadataDir", "rating", "privacy", "iaps", "previews", "export", "ios", "google", "accessibility", "allowCrossStoreTerms"];
 
 // One `vydanne.config.mjs` per app (ESM, like zdymak.config.mjs) — nothing hard-coded. Secrets stay out:
 // credentials resolve from the environment, a gitignored .env, or ~/.appstoreconnect/config.json (see
@@ -35,6 +35,8 @@ export async function loadConfig(p) {
     privacy: raw.privacy || { collected: ["CRASH_DATA", "PERFORMANCE_DATA"], tracking: false },
     iaps: raw.iaps || [],
     metadataDir: raw.metadataDir || "fastlane/metadata",
+    // Terms the cross-store check must not flag for this app (see src/crossStore.mjs).
+    allowCrossStoreTerms: raw.allowCrossStoreTerms || [],
     previews: raw.previews || null,
     export: raw.export || { encryption: "standard" },
     // Google Play. serviceAccountKey resolves from PLAY_JSON_KEY_FILE env first (keep the secret path out