appmates 0.1.0__tar.gz

appmates-0.1.0/.claude/launch.json

@@ -0,0 +1,17 @@
+{
+  "version": "0.0.1",
+  "configurations": [
+    {
+      "name": "appmates-web",
+      "runtimeExecutable": "python3",
+      "runtimeArgs": [
+        "-m",
+        "http.server",
+        "8123",
+        "--directory",
+        "web"
+      ],
+      "port": 8123
+    }
+  ]
+}

appmates-0.1.0/.env.example

@@ -0,0 +1,13 @@
+# Copy to .env and fill in — never commit the real file (.env is gitignored).
+
+# --- App Store Connect (optional, only for `appmates asc ...`) -------------
+#
+# Generate a key at:
+# https://appstoreconnect.apple.com/access/integrations/api
+#
+# The private key file itself never leaves your machine — see
+# core/clients/appstore_connect.py for exactly what that means. chmod 600
+# the .p8 file; `appmates asc status` warns if it is more open than that.
+LAUNCHPILOT_APP_STORE_KEY_ID=
+LAUNCHPILOT_APP_STORE_ISSUER_ID=
+LAUNCHPILOT_APP_STORE_PRIVATE_KEY_PATH=

appmates-0.1.0/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,30 @@
+---
+name: Bug report
+about: Something in AppMates isn't working as expected
+title: ""
+labels: bug
+assignees: ""
+---
+
+**What happened**
+A clear description of the bug.
+
+**What you expected**
+What you expected to happen instead.
+
+**How to reproduce**
+
+```bash
+appmates <command that triggers it>
+```
+
+Attach a minimal example file (screenshot, listing text, spec) if the bug is
+data-dependent — strip anything sensitive first.
+
+**Environment**
+- AppMates version: `appmates --version`
+- OS:
+- Python version:
+
+**Additional context**
+Anything else relevant (store, storefront, error traceback, etc).

appmates-0.1.0/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,17 @@
+---
+name: Feature request
+about: Suggest an idea or a store rule AppMates should know about
+title: ""
+labels: enhancement
+assignees: ""
+---
+
+**What's the problem**
+What's missing or annoying today. If this is a store rule change, link the
+source (App Store Connect / Play Console docs, changelog, etc).
+
+**What you'd like instead**
+What you want AppMates to do.
+
+**Alternatives considered**
+Any workaround you're using today, if any.

appmates-0.1.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,13 @@
+## What this does
+
+<!-- One or two sentences. -->
+
+## Why
+
+<!-- The problem this solves, or the source URL if this is a store rule change. -->
+
+## Checklist
+
+- [ ] `uv run ruff check . && uv run ruff format --check . && uv run mypy && uv run pytest` all pass
+- [ ] `node --test "web/test/*.test.js"` passes (if `web/` changed)
+- [ ] Scope is one change — unrelated cleanup is in a separate PR

appmates-0.1.0/.github/dependabot.yml

@@ -0,0 +1,25 @@
+version: 2
+updates:
+  # CLI + core engines (pyproject.toml)
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      python-dependencies:
+        patterns: ["*"]
+
+  # Screenshot relay Worker
+  - package-ecosystem: "npm"
+    directory: "/worker"
+    schedule:
+      interval: "weekly"
+    groups:
+      npm-dependencies:
+        patterns: ["*"]
+
+  # Action versions pinned in .github/workflows/*.yml
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

appmates-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,151 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  FORCE_COLOR: "1"
+
+jobs:
+  lint:
+    name: Lint & types
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - name: Set up Python
+        run: uv python install 3.11
+
+      - name: Install
+        run: uv sync --extra dev
+
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run mypy
+
+  test:
+    name: Tests · Python ${{ matrix.python-version }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+        os: [ubuntu-latest]
+        # Pillow behaves differently enough across platforms to be worth one
+        # non-Linux run; a full matrix would be wasteful for a pure-Python tool.
+        include:
+          - python-version: "3.12"
+            os: macos-latest
+
+    # Set for the whole job rather than passed to `uv sync` alone: a --python
+    # flag on sync does not carry over to `uv run`, which then falls back to the
+    # .python-version file, resolves a different interpreter, and cannot find
+    # pytest. UV_PYTHON keeps every uv invocation on the same interpreter.
+    env:
+      UV_PYTHON: ${{ matrix.python-version }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - name: Set up Python ${{ matrix.python-version }}
+        run: uv python install ${{ matrix.python-version }}
+
+      - name: Install
+        run: uv sync --extra dev
+
+      - name: Verify the interpreter matches the matrix
+        run: uv run python -c "import sys; assert sys.version.startswith('${{ matrix.python-version }}'), sys.version"
+
+      - name: Run tests
+        run: uv run pytest
+
+      - name: Upload coverage
+        if: matrix.python-version == '3.12' && matrix.os == 'ubuntu-latest'
+        uses: codecov/codecov-action@v5
+        with:
+          files: ./coverage.xml
+          fail_ci_if_error: false
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
+  web:
+    name: Web checker
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Install
+        run: uv sync --extra dev
+
+      # The browser engine reads generated copies of the Python-side data.
+      # If someone edits a spec YAML without regenerating, the web page would
+      # quietly apply different rules from the CLI, so treat staleness as a
+      # build failure rather than a nightly surprise.
+      - name: Generated artefacts are current
+        run: |
+          uv run python scripts/export_specs.py --check
+          uv run python scripts/export_conformance.py --check
+          uv run python scripts/export_parser_fixtures.py --check
+
+      - name: Conformance and unit tests
+        run: node --test "web/test/*.test.js" | tee /tmp/node-test.log
+
+      # Our own assertions check the bytes we meant to write; this checks that a
+      # real ZIP implementation accepts them.
+      - name: Archive opens with a real unzip
+        run: |
+          ZIP=$(grep -o 'ZIP_FIXTURE=.*' /tmp/node-test.log | head -1 | cut -d= -f2)
+          test -n "$ZIP" || { echo "::error::zip fixture path not emitted"; exit 1; }
+          unzip -t "$ZIP"
+          unzip -o "$ZIP" -d /tmp/zipcheck
+          test -f /tmp/zipcheck/locale/en-US/screen-02.jpg
+
+  smoke:
+    name: CLI smoke test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Install
+        run: uv sync --extra dev
+
+      # The commands must actually run end to end, not merely import.
+      - name: Exercise the CLI
+        run: |
+          uv run appmates --version
+          uv run appmates specs --json > /dev/null
+          uv run appmates check-testers -d 14 -t 12
+          # Exit code 1 is the documented "findings" contract; assert it holds.
+          if uv run appmates check-testers -d 3 -t 12; then
+            echo "::error::expected exit code 1 for an incomplete test period"
+            exit 1
+          fi

appmates-0.1.0/.github/workflows/codeql.yml

@@ -0,0 +1,66 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Catches newly-published CodeQL query rules against unchanged code —
+    # a Monday morning UTC run, off the hour to avoid the top-of-hour spike
+    # every other repo's cron also fires at.
+    - cron: "17 6 * * 1"
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      # codeql-action/analyze calls the Actions API for its own run
+      # metadata (unrelated to the SARIF upload below) — without this, that
+      # call comes back "Resource not accessible by integration" and the
+      # step gets marked failed on the error annotation alone, even though
+      # the process catches it, logs a warning, and exits 0. Found by
+      # reading the actual failure log rather than guessing: `upload:
+      # false` on its own did not fix this, because it was never the
+      # upload that was failing.
+      actions: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # javascript-typescript covers web/, worker/ in one pass.
+        # python covers src/appmates.
+        language: ["javascript-typescript", "python"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+
+      # `upload: false` here, not the action's own default upload: on a
+      # *private* repo, pushing results to the code-scanning API needs
+      # GitHub Advanced Security, which this repo doesn't have. That push
+      # would fail once the fix above (actions: read) is in place, so this
+      # keeps analyze itself green regardless — the separate
+      # `continue-on-error` upload below is what actually tries it, and it
+      # starts succeeding on its own the moment this repo goes public (code
+      # scanning is free for public repos) or GHAS gets turned on, with no
+      # flag to remember to flip back.
+      - uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{ matrix.language }}"
+          upload: false
+          output: sarif-results
+
+      - name: Upload SARIF (works once the repo is public, or with GitHub Advanced Security)
+        uses: github/codeql-action/upload-sarif@v4
+        if: always()
+        continue-on-error: true
+        with:
+          sarif_file: sarif-results
+          category: "/language:${{ matrix.language }}"

appmates-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,44 @@
+name: Publish to PyPI
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  build:
+    name: Build distribution
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Build sdist + wheel
+        run: uv build
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    name: Publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    # Matches the GitHub Actions environment named on PyPI's trusted-publisher
+    # form — not required for OIDC to work, but scopes the id-token
+    # permission below to only run under this environment's protection
+    # rules, if any get added later.
+    environment: pypi
+    permissions:
+      # Trusted publishing (OIDC) needs this — it's how the job proves its
+      # identity to PyPI instead of a stored API token.
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - uses: pypa/gh-action-pypi-publish@release/v1

appmates-0.1.0/.gitignore

@@ -0,0 +1,51 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+build/
+dist/
+.venv/
+venv/
+
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+coverage.xml
+htmlcov/
+
+.DS_Store
+.idea/
+.vscode/
+
+# Local project config may hold store credentials
+.env
+.env.*
+!.env.example
+appmates.local.toml
+
+# Real listing text pulled from App Store Connect via `appmates asc pull`
+# — not secret, but real business data with no reason to sit in git.
+# Both names: `pulled*.json` from earlier docs, `listing.json` from the
+# README/dashboard's own example command.
+pulled*.json
+/listing.json
+
+# Local scratch for browser-driven checks
+web/.fixtures/
+
+# Cloudflare Pages deploy state — `/.wrangler/` when deployed as
+# `wrangler pages deploy web` from the repo root, `web/.wrangler/` when run
+# as `wrangler pages deploy .` from inside web/ (both invocations have been
+# used; either leaves state in a different place).
+/.wrangler/
+web/.wrangler/
+
+# Worker: installed deps and local dev state, neither of which is source
+worker/node_modules/
+worker/.wrangler/
+
+# community/ moved to its own private repo (appmates-community) — this
+# local copy is a leftover, not part of the repo at all anymore. Ignored
+# wholesale rather than deleted, since it still holds local dev state
+# (.dev.vars, .wrangler) not worth losing by hand.
+/community/

appmates-0.1.0/.python-version

@@ -0,0 +1 @@
+3.11

appmates-0.1.0/CODE_OF_CONDUCT.md

@@ -0,0 +1,67 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics,
+gender identity and expression, level of experience, education,
+socio-economic status, nationality, personal appearance, race, religion, or
+sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our
+  mistakes, and learning from the experience
+- Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior:
+
+- The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+- Trolling, insulting or derogatory comments, and personal or political
+  attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Project maintainers are responsible for clarifying and enforcing standards
+of acceptable behavior and will take appropriate and fair corrective action
+in response to any behavior deemed inappropriate, threatening, offensive, or
+harmful.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies
+when an individual is officially representing the community in public
+spaces.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to appmates.contact@gmail.com. All complaints will be reviewed and
+investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of
+the reporter of any incident.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+https://www.contributor-covenant.org/version/2/1/code_of_conduct.html.
+
+[homepage]: https://www.contributor-covenant.org

appmates-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,50 @@
+# Contributing to AppMates
+
+Issues and PRs welcome.
+
+## Dev setup
+
+```bash
+git clone https://github.com/pP4010/appmates.git
+cd appmates
+uv sync --extra dev
+```
+
+Runs on Python 3.11+, managed with [uv](https://docs.astral.sh/uv/). The web
+frontend (`web/`) is vanilla JS with no build step — edit and reload.
+
+## Before opening a PR
+
+```bash
+uv run ruff check .
+uv run ruff format --check .
+uv run mypy
+uv run pytest
+```
+
+All four must pass; CI (`.github/workflows/ci.yml`) runs the same checks
+plus a web conformance suite and a CLI smoke test. If you touch
+`web/`, also run the JS tests:
+
+```bash
+node --test "web/test/*.test.js"
+```
+
+## Store rule changes
+
+When a store changes a rule, the fix is usually a one-line edit to
+`src/appmates/core/specs/*.yaml` plus a bump of `last_verified` — please
+include the source URL in your PR description.
+
+## Code style
+
+- Python: `ruff` (lint + format) and `mypy --strict` — both enforced in CI,
+  no separate style guide beyond what they check.
+- JS (`web/`): match the existing file's style; no framework/bundler, keep
+  it that way unless discussed first in an issue.
+- Keep PRs scoped to one change. Unrelated cleanup belongs in its own PR.
+
+## Reporting a security issue
+
+Do not open a public issue for security vulnerabilities — see
+[SECURITY.md](SECURITY.md) for the disclosure process.