stallkit 0.1.0

First public release.

Added

• Setup that checks as it goes. stallkit init writes .env with the shared secret
  typed hidden and verifies the credential against Etsy. stallkit setup walks every
  prerequisite and names the single next command; stallkit doctor runs the same
  checklist without asking anything, for scripts.
• OAuth 2.0 with PKCE. A one-shot localhost listener catches the redirect, or you
  paste the address back. Tokens live in ~/.stallkit/token.json with 0600
  permissions and refresh themselves, including mid-batch.
• Bulk listings from a spreadsheet. listings template, listings pull and
  listings push. An empty listing_id creates a draft, a filled one updates. The whole
  file is validated before anything is sent — titles, the 13-tag and 20-character rules,
  enum values, prices, image count, format and size — and one bad row stops the run
  unless --partial is given. New listings are always drafts.
• Orders and tracking. orders pull exports orders to CSV (--since, --unshipped),
  orders carriers lists valid carrier names per country, and orders ship uploads
  tracking in bulk after a dry run and a confirmation.
• SEO. seo audit scores every listing out of 100, worst first, plus shop-level
  checks for listings competing for the same searches. seo keywords samples what
  actually ranks for a term — tags, title phrases, price band — with only a keystring.
  seo suggest combines both for one listing.
• Designs in, drafts out. drop init creates a workspace folder; drop template
  copies business settings from a listing you built by hand; drop run composites
  loose artwork onto your mockups, researches each concept, writes titles and tags
  within Etsy's limits and produces a review.csv without sending anything; drop auto
  uploads folders of finished photos as drafts, with an upload history that prevents
  duplicates.
• Print-area calibration. drop calibrate sets where a design lands on each mockup,
  shares it with every mockup of the same size, imports a pixel-based file, and draws
  the rectangle on the mockup so it can be checked before it is saved.
• Images that match what the seller sees. Phone photos are turned upright from their
  EXIF orientation, colour profiles are converted to sRGB, transparent templates are
  flattened onto white, 16-bit greyscale keeps its tone, and JPEGs keep full colour
  resolution. Formats Etsy refuses are converted, and the row says so.
• --anonymise hides shop name, ids, titles, URLs and tags in terminal output so a
  screenshot can be shared.

Notes on Etsy's API

Recorded here and in the code so nobody has to re-derive them:

• x-api-key must carry both the keystring and the shared secret, colon-joined, on
  every request including unauthenticated ones. PKCE removes the client secret from the
  token exchange only — not from this header.
• Callback URLs may be http:// or https://, and the host must be a domain name.
  localhost is accepted; 127.0.0.1 is rejected. Etsy's prose docs say https-only,
  which is narrower than what is enforced and leads you to build the wrong flow.
• Rate limits are per app. A Personal Access app gets 5 requests/second and 5,000
  per day — not the 10/sec and 10,000/day the general documentation quotes.
• Array form fields such as tags and materials are comma-joined strings, not
  repeated keys. Repeated keys silently drop all but one value.
• createDraftListing takes form encoding; createReceiptShipment takes JSON.
• Listing images must be JPG, PNG or GIF, at most 20MB, and at most ten per listing.
• There is no idempotency key, so non-idempotent writes are never retried on a timeout
  or a 5xx — a repeat would mean a duplicate listing, or a second email to a buyer.