@nomac/cli 0.2.3 → 0.2.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nomac/cli",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Ship iOS apps to TestFlight and the App Store without a Mac — built for agents.",
   "license": "UNLICENSED",
   "type": "module",

package/skill/SKILL.md

@@ -18,9 +18,9 @@ via MCP tools (preferred) or the `nomac` CLI.
 ## Setup check
 
 1. MCP tools available (`connect_status`, `push_project`, `build`, …)? Use them.
-2. Otherwise: `npx @nomac/cli whoami`. If not logged in, ask the human for an API
-   key from nomac.app → API keys, then `npx @nomac/cli login <nmk_…>` and
-   `claude mcp add nomac -- npx @nomac/cli mcp`.
+2. Otherwise: `npx @nomac/cli whoami`. If not logged in, run
+   `npx @nomac/cli login`; give the human the device URL and code to approve.
+   Then `claude mcp add nomac -- npx @nomac/cli mcp`.
 3. `connect_status` must show a healthy Apple connection. If not, the human
    connects at the dashboard (60 seconds, one .p8 upload). Don't guess —
    verify, then proceed.
@@ -50,8 +50,11 @@ status                         # poll ~30s until ready | failed
    (in the schema). It runs in the background: poll `get_screenshot_upload`
    until complete before publishing. A rolled-back or paused replacement
    needs the returned recovery instructions before starting another upload.
-3. `publish` (no confirm) → staged dry-run; fix any Apple blockers it returns.
-4. Ask the human explicitly before `publish confirm=true` — it's irreversible.
+3. `publish` without confirm stages real Apple drafts/build attachments but
+   does not submit. Fix the returned blockers; retain the exact build/submission IDs.
+4. `publish confirm=true` sends the app to Apple. Ensure the human authorized
+   this app/version; honor authorization already given. New versions use manual
+   release, while existing versions retain their Apple release policy.
 
 If metadata or publish returns pending, keep its `request_key` and repeat
 the original arguments with that key. `get_store_operation` recovers the key
@@ -60,6 +63,49 @@ do not use one to bypass an unconfirmed Apple request. Staging and confirmation
 remain separate invocations. For screenshots, keep the original `request_key`
 too, and use `get_screenshot_upload` to find or poll the existing operation.
 
+## Fix review rejections and release
+
+- `get_review` lists live Apple submissions, including ones created outside
+  nomac. Pass `asc_submission_id` for all item states and exact version/build IDs.
+- Apple does not expose App Review messages through its public API. Use the
+  returned App Store Connect handoff to have the human provide the actual text.
+  Never invent a rejection reason from a status code or public customer review.
+- Fix metadata/screenshots on the exact `version_string`. A binary change needs
+  push/build, then `publish` with the exact `build_id` and `asc_submission_id`.
+  `resolve_rejection:true` explicitly asserts that this version's issue is fixed.
+- `prepare_review_reply` prepares your authored text but always returns `sent:false`.
+  The human sends it and any message attachments in App Store Connect. Changing
+  review_contact.notes is not a reply; sending a reply is not resubmission.
+- `update_review` supports `resolve_item`, `remove_item`, `cancel`, `resubmit`,
+  and `release`. Preview without confirm; confirm the exact requested action.
+  Fix issues before marking items resolved. Every rejected item must be resolved
+  or removed before resubmitting. Removed items cannot be added back to that submission.
+- Poll `get_review`; approval and release are separate. Release requires an
+  app-version item in Pending Developer Release. Apple/account/legal decisions
+  and unsupported product edits still require the relevant Apple workflow.
+
+## External TestFlight
+
+`ready` from a nomac build means internal TestFlight readiness. External testing
+requires its own review and distribution:
+
+1. `get_testflight` lists groups, test information and recent Apple builds. Use
+   `asc_build_id` for a specific build's beta-review/external state, or `group_id`
+   to list testers. Never infer external approval from internal readiness.
+2. `manage_testflight action=metadata` sets app_info (description/feedbackEmail/URLs),
+   review_contact (Apple contact/demo fields), locale, and build whats_new.
+3. Select/create an external group. `invite_tester`/`remove_tester` use an explicit
+   email/tester ID and group_id. `update_group` can enable an optional public link.
+4. `distribute` requires asc_build_id and explicit group_ids. It submits beta
+   review if needed, then assigns those groups. auto_notify defaults false;
+   `notify` starts testing after approval. `remove_build` affects one group;
+   `expire` stops testing for the build across all groups.
+5. All actions preview without confirm and apply with confirm:true. Pending
+   requests use their original key/body; get_store_operation recovers them.
+6. Relay an accurate human-provided uses_non_exempt_encryption with action=encryption
+   when appropriate. Never guess. Rejected beta messages and compliance documents
+   require App Store Connect; do not blindly resubmit an unchanged rejected binary.
+
 ## When stuck
 
 `report_issue` with the failing `ref_id` files a support ticket with full

package/src/lifecycle-schemas.json

@@ -0,0 +1,215 @@
+{
+  "update_review": {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "type": "object",
+    "properties": {
+      "asc_submission_id": {
+        "type": "string",
+        "minLength": 1
+      },
+      "action": {
+        "type": "string",
+        "enum": [
+          "resolve_item",
+          "remove_item",
+          "cancel",
+          "resubmit",
+          "release"
+        ]
+      },
+      "item_id": {
+        "type": "string",
+        "minLength": 1
+      },
+      "confirm": {
+        "default": false,
+        "type": "boolean"
+      },
+      "force": {
+        "default": false,
+        "type": "boolean"
+      }
+    },
+    "required": [
+      "asc_submission_id",
+      "action"
+    ],
+    "additionalProperties": false
+  },
+  "prepare_review_reply": {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "type": "object",
+    "properties": {
+      "asc_submission_id": {
+        "type": "string",
+        "minLength": 1
+      },
+      "reply": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 4000
+      }
+    },
+    "required": [
+      "asc_submission_id",
+      "reply"
+    ],
+    "additionalProperties": false
+  },
+  "manage_testflight": {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "type": "object",
+    "properties": {
+      "action": {
+        "type": "string",
+        "enum": [
+          "metadata",
+          "create_group",
+          "update_group",
+          "invite_tester",
+          "remove_tester",
+          "remove_build",
+          "distribute",
+          "notify",
+          "expire",
+          "encryption"
+        ]
+      },
+      "asc_build_id": {
+        "type": "string",
+        "minLength": 1
+      },
+      "group_ids": {
+        "minItems": 1,
+        "maxItems": 100,
+        "type": "array",
+        "items": {
+          "type": "string",
+          "minLength": 1
+        }
+      },
+      "group_id": {
+        "type": "string",
+        "minLength": 1
+      },
+      "name": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 100
+      },
+      "email": {
+        "type": "string",
+        "format": "email",
+        "pattern": "^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+      },
+      "first_name": {
+        "type": "string",
+        "maxLength": 100
+      },
+      "last_name": {
+        "type": "string",
+        "maxLength": 100
+      },
+      "tester_id": {
+        "type": "string",
+        "minLength": 1
+      },
+      "public_link_enabled": {
+        "type": "boolean"
+      },
+      "public_link_limit": {
+        "type": "integer",
+        "minimum": 1,
+        "maximum": 10000
+      },
+      "auto_notify": {
+        "default": false,
+        "type": "boolean"
+      },
+      "uses_non_exempt_encryption": {
+        "type": "boolean"
+      },
+      "locale": {
+        "default": "en-US",
+        "type": "string",
+        "minLength": 2,
+        "maxLength": 35
+      },
+      "app_info": {
+        "type": "object",
+        "properties": {
+          "description": {
+            "type": "string",
+            "maxLength": 4000
+          },
+          "feedbackEmail": {
+            "type": "string",
+            "format": "email",
+            "pattern": "^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+          },
+          "marketingUrl": {
+            "type": "string",
+            "maxLength": 255,
+            "format": "uri"
+          },
+          "privacyPolicyUrl": {
+            "type": "string",
+            "maxLength": 255,
+            "format": "uri"
+          }
+        },
+        "additionalProperties": false
+      },
+      "review_contact": {
+        "type": "object",
+        "properties": {
+          "contactFirstName": {
+            "type": "string",
+            "maxLength": 100
+          },
+          "contactLastName": {
+            "type": "string",
+            "maxLength": 100
+          },
+          "contactPhone": {
+            "type": "string",
+            "maxLength": 100
+          },
+          "contactEmail": {
+            "type": "string",
+            "format": "email",
+            "pattern": "^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+          },
+          "demoAccountRequired": {
+            "type": "boolean"
+          },
+          "demoAccountName": {
+            "type": "string",
+            "maxLength": 100
+          },
+          "demoAccountPassword": {
+            "type": "string",
+            "maxLength": 100
+          },
+          "notes": {
+            "type": "string",
+            "maxLength": 4000
+          }
+        },
+        "additionalProperties": false
+      },
+      "whats_new": {
+        "type": "string",
+        "maxLength": 4000
+      },
+      "confirm": {
+        "default": false,
+        "type": "boolean"
+      }
+    },
+    "required": [
+      "action"
+    ],
+    "additionalProperties": false
+  }
+}

package/src/mcp.mjs

@@ -3,6 +3,8 @@
 // Works in every MCP client day one; the hosted transport is mcp.nomac.app.
 
 import { randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+const lifecycleSchemas = JSON.parse(readFileSync(new URL("./lifecycle-schemas.json", import.meta.url), "utf8"));
 import { createInterface } from "node:readline";
 import { api } from "./api.mjs";
 import { loadProjectState, saveProjectState } from "./config.mjs";
@@ -236,18 +238,21 @@ export const TOOLS = [
   },
   {
     name: "get_store_operation",
-    description: "Read saved publish/metadata requests and recover a lost response or request_key. Resume pending work by repeating the original publish/set_metadata arguments with its returned request_key. This status call performs no Apple writes.",
+    description: "Read saved publish/metadata/review/TestFlight requests and recover a lost response or request_key. Resume pending work by repeating the original tool arguments with its returned request_key. This status call performs no Apple writes.",
     inputSchema: { type: "object", properties: { project_id: { type: "string" }, request_key: { type: "string" } }, additionalProperties: false },
     handler: async args => text(await api("GET", `/api/v1/projects/${await resolveProjectId(args)}/operations${args?.request_key ? `?request_key=${encodeURIComponent(args.request_key)}` : ""}`)),
   },
   {
     name: "publish",
     description:
-      "Submit for App Store review (3-step reviewSubmissions). IRREVERSIBLE once confirmed — requires confirm:true; run once without confirm first to see the staged result + any Apple blockers. Costs nothing; the review decision takes ~1-3 days. On pending, repeat unchanged arguments with the returned request_key; get_store_operation recovers a lost response.",
+      "Submit for App Store review (3-step reviewSubmissions). Requires confirm:true with authorization for this app/version; run once without confirm first to see the staged result + any Apple blockers. Costs nothing; the review decision takes ~1-3 days. On pending, repeat unchanged arguments with the returned request_key; get_store_operation recovers a lost response.",
     inputSchema: {
       type: "object",
       properties: {
         project_id: { type: "string" },
+        build_id: { type: "string", description: "Exact nomac release build to attach" },
+        asc_submission_id: { type: "string", description: "Exact Apple submission from get_review" },
+        resolve_rejection: { type: "boolean", default: false, description: "Assert this version rejection was fixed; mark its item ready for review" },
         confirm: { type: "boolean", default: false },
         request_key: { type: "string", description: "Only supply to resume an interrupted invocation with its original unchanged arguments" },
         force: { type: "boolean", default: false, description: "override a red lint gate (not recommended)" },
@@ -264,12 +269,33 @@ export const TOOLS = [
       const idempotencyKey = args?.request_key ?? `mcp-pub-${project_id}-${mode}-${randomUUID()}`;
       return text(
         await api("POST", "/api/v1/publish", {
-          body: { project_id, confirm: args?.confirm ?? false, force: args?.force ?? false },
+          body: { project_id, ...(args?.build_id ? { build_id: args.build_id } : {}), ...(args?.asc_submission_id ? { asc_submission_id: args.asc_submission_id } : {}), ...(args?.resolve_rejection !== undefined ? { resolve_rejection: args.resolve_rejection } : {}), confirm: args?.confirm ?? false, force: args?.force ?? false },
           idempotencyKey,
         }),
       );
     },
   },
+  ...[
+    ["get_review", "reviews", "asc_submission_id", "Read live App Review submissions including those created outside nomac. Pass asc_submission_id for all items, version/build/contact details. Reviewer messages require the App Store Connect handoff in the result."],
+    ["get_testflight", "testflight", "asc_build_id", "Read external/internal groups and test metadata. Pass asc_build_id for exact beta review and distribution state. Internal readiness does not imply external approval."],
+  ].map(([name, path, filter, description]) => ({
+    name, description,
+    inputSchema: { type: "object", properties: { project_id: { type: "string" }, [filter]: { type: "string" }, ...(name === "get_testflight" ? { group_id: { type: "string" } } : {}) }, additionalProperties: false },
+    handler: async args => text(await api("GET", `/api/v1/projects/${encodeURIComponent(await resolveProjectId(args))}/${path}${args?.[filter] || args?.group_id ? `?${new URLSearchParams({ ...(args?.[filter] ? { [filter]: args[filter] } : {}), ...(args?.group_id ? { group_id: args.group_id } : {}) })}` : ""}`)),
+  })),
+  ...[
+    ["update_review", "reviews", "Resolve a fixed rejected item, remove an item, cancel review, resubmit ready items or release an approved version. Use exact IDs from get_review. Preview without confirm; confirm:true performs the action. Removal cannot be undone in that submission. Fix actual issues before resolving. On pending, repeat unchanged arguments with request_key; get_store_operation recovers it."],
+    ["manage_testflight", "testflight", "Set beta metadata/contact/demo credentials, create/update external groups/public links, invite/remove an explicit tester, distribute a specific Apple build to explicit groups and Beta App Review, notify after approval, expire testing, or relay a human-provided encryption answer. Preview without confirm; confirm:true applies. auto_notify defaults false. Never guess attestations. On pending, repeat unchanged arguments with request_key."],
+    ["prepare_review_reply", "reviews/reply", "Prepare YOUR authored reply with an App Store Connect handoff. Always returns sent:false: Apple's public API cannot read or send reviewer messages. The human must paste and send it. This does not change reviewer notes or public customer reviews."],
+  ].map(([name, path, description]) => ({
+    name, description,
+    inputSchema: { ...lifecycleSchemas[name], properties: { project_id: { type: "string" }, ...lifecycleSchemas[name].properties, ...(name !== "prepare_review_reply" ? { request_key: { type: "string" } } : {}) } },
+    handler: async args => {
+      const projectId = await resolveProjectId(args);
+      const { project_id: _project, request_key, ...body } = args;
+      return text(await api("POST", `/api/v1/projects/${encodeURIComponent(projectId)}/${path}`, { body, idempotencyKey: request_key ?? randomUUID() }));
+    },
+  })),
   {
     name: "get_feedback",
     description: