asc-analytics-reports

asc analytics reports

Collect a complete set of analytics report segments and verify the compressed files before handing them to a separate analysis workflow. Do not interpret, aggregate, or present the report contents as part of this skill.

Guardrails

• Treat report inventories, signed URLs, downloaded segments, and identifiers as confidential business data.
• Prefer an existing request. Creating a request changes App Store Connect state and requires an Admin-authorized profile; obtain explicit user approval before running asc analytics request.
• Never delete or replace a request as part of collection.
• Use asc analytics download; do not fetch or persist signed segment URLs separately.
• Store private files outside the source repository with owner-only permissions.
• Do not claim the collection is complete if any expected segment is missing or fails verification.

1. Verify the CLI contract

Inspect the installed command before authentication or collection:

asc analytics view --help

Continue only when help lists --processing-date, --granularity, --paginate, and --include-segments. These filters require asc 3.5.0 or newer. If either filter is absent, ask the user to upgrade. Do not substitute the deprecated --date flag because it uses legacy local matching rather than Apple's server-side processing-date filter.

2. Prepare private storage

Create a private temporary directory outside the repository before capturing JSON or downloading segments:

umask 077
ASC_ANALYTICS_DIR="$(mktemp -d "${TMPDIR:-/tmp}/asc-analytics.XXXXXX")"
mkdir -m 700 "$ASC_ANALYTICS_DIR/segments"

Redirect command output and errors into this directory. Do not paste raw inventory JSON or error output into chat, commits, issues, or pull requests.

3. Find an existing request

Resolve the app ID and selected asc profile, then list every request:

asc --profile "$PROFILE" analytics requests \
  --app "$APP_ID" \
  --paginate \
  --output json \
  > "$ASC_ANALYTICS_DIR/requests.json" \
  2> "$ASC_ANALYTICS_DIR/requests.stderr"

Inspect the JSON structurally and select an existing usable request. Do not rely on --state when discovery works without it. If no usable request exists, stop and ask whether the user wants to create ONGOING or ONE_TIME_SNAPSHOT access. State the target app and profile before requesting approval. After approval, prefer --reuse-existing to avoid duplicates:

asc --profile "$APPROVED_PROFILE" analytics request \
  --app "$APP_ID" \
  --access-type "$ACCESS_TYPE" \
  --reuse-existing \
  --output json \
  > "$ASC_ANALYTICS_DIR/request.json" \
  2> "$ASC_ANALYTICS_DIR/request.stderr"

Do not run that command without explicit approval. Read the returned request ID from the private JSON response before continuing:

REQUEST_ID="$(jq -er '.requestId' "$ASC_ANALYTICS_DIR/request.json")"

When a request was created or reused with the approved profile, set ANALYTICS_PROFILE="$APPROVED_PROFILE". For an existing request discovered with the read-only profile, set ANALYTICS_PROFILE="$PROFILE". Use that same profile for every subsequent analytics view and analytics download call.

4. Discover and select report instances

First retrieve report and instance metadata without segment URLs:

asc --profile "$ANALYTICS_PROFILE" analytics view \
  --request-id "$REQUEST_ID" \
  --paginate \
  --output json \
  > "$ASC_ANALYTICS_DIR/discovery.json" \
  2> "$ASC_ANALYTICS_DIR/discovery.stderr"

Select an available processingDate and the granularity requested by the user. Accept DAILY, WEEKLY, and MONTHLY, individually or as a comma-separated list. Split the input on commas, trim each token, and normalize it to uppercase. Validate every token against that allowlist, including empty tokens. Report the invalid input and stop before running analytics view; never silently discard unsupported values or continue with an empty filter. After validation, remove duplicates and join the remaining values with commas. Treat processingDate as the date Apple processed the report, not necessarily the period represented by its rows.

Retrieve the filtered inventory, including all segment metadata:

asc --profile "$ANALYTICS_PROFILE" analytics view \
  --request-id "$REQUEST_ID" \
  --processing-date "$PROCESSING_DATE" \
  --granularity "$GRANULARITY" \
  --paginate \
  --include-segments \
  --output json \
  > "$ASC_ANALYTICS_DIR/inventory.json" \
  2> "$ASC_ANALYTICS_DIR/inventory.stderr"

Always use --paginate; asc follows Apple-provided report and instance next links. Do not reconstruct, alter, or follow pagination URLs manually.

5. Download every segment

Parse inventory.json structurally. For every selected instance, enumerate all segments and retain each segment's exact ID, sizeInBytes, and checksum for verification. Do not print downloadUrl.

Download each segment by its request, instance, and segment IDs. Use a filename derived only from the segment ID and keep the compressed bytes intact. Analytics reports are tab-delimited text, so use .txt.gz rather than implying CSV:

SEGMENT_FILE="$ASC_ANALYTICS_DIR/segments/$SEGMENT_ID.txt.gz"
asc --profile "$ANALYTICS_PROFILE" analytics download \
  --request-id "$REQUEST_ID" \
  --instance-id "$INSTANCE_ID" \
  --segment-id "$SEGMENT_ID" \
  --output "$SEGMENT_FILE" \
  > /dev/null \
  2>> "$ASC_ANALYTICS_DIR/download.stderr"

Do not use --decompress before verification. If an instance has multiple segments, download every one; never treat the first segment as the whole report.

6. Verify the downloaded files

For each file, compare the compressed byte count with sizeInBytes and the lowercase MD5 digest with checksum. Use local system tools such as:

actual_size="$(wc -c < "$SEGMENT_FILE" | tr -d ' ')"
actual_md5="$(openssl dgst -md5 -r "$SEGMENT_FILE" | awk '{print tolower($1)}')"
expected_md5="$(printf '%s' "$CHECKSUM" | tr '[:upper:]' '[:lower:]')"

Require actual_size to equal sizeInBytes and actual_md5 to equal expected_md5. On a mismatch, mark that segment failed, keep the raw error private, and do not claim a complete collection. asc analytics download refuses to overwrite an existing output, so retry the failed segment once to a new path such as $ASC_ANALYTICS_DIR/segments/$SEGMENT_ID.retry-1.txt.gz. Verify the retry independently and use it only if both checks pass. Keep the original failed file unless the user approves its deletion. Do not parse or analyze a file until verification succeeds.

7. Report the result

Return a concise summary containing:

• the selected processing date and granularity values;
• counts of reports, instances, expected segments, downloaded segments, and verified segments;
• whether the collection is complete;
• failed or missing segment IDs, if any, without signed URLs or report rows;
• the private output directory when appropriate for the current user session.

Do not include analytics values, signed URLs, profile names, credentials, or raw rows in a public artifact. Keep the verified files for the user's next workflow. Ask before deleting the temporary directory or any downloaded evidence.