Split by domain and serve every operation over MCP
The certificate work landed inside the metadata client, where it did not belong, and adding an MCP server was about to make that worse by depending on both halves at once. Six crates now: core carries the transport (JWT auth, the HTTP client, JSON:API envelopes, errors), aso carries App Metadata, signing carries certificates and CSR generation, and frontend holds what the two front ends share so they cannot disagree. aso and signing know nothing about each other, and CI builds each library on its own, because a workspace build compiles them with the server's dependencies already in the graph and proves nothing. core exists because both domains need Client and ApiKey. Calling that shared transport "aso" would have meant signing depending on App Store Optimization for its HTTP client, a misnomer that only gets worse when provisioning profiles and devices land. This breaks anyone embedding the library. Rust allows inherent impls only in the crate that defines a type, so every resource that used to be a method on Client is an extension trait now: AppsApi, CertificatesApi, and the rest, with a prelude per domain crate. The methods do not exist until the trait is in scope. The MCP server exposes 28 tools, every command line operation except certificate revocation, following the xcrs contract in smbcloud-cli: tool names come from the embedder through a macro, so a host can re-expose the same tools under its own namespace without forking the bodies. Contract tests assert the exact tool set, titles under 40 characters, all six description sections, annotation consistency, and a description on every input schema property. Revocation is not a tool, and a test fails the build if it becomes one. Revoking a signing certificate invalidates every provisioning profile embedding it, for every teammate and every CI job, at once and irreversibly, and no confirmation string a model types on a human's behalf makes that safe. Scoped deletes are exposed and annotated destructive, because a version, a localization, or a screenshot can each be recreated by re-running the tool that made it. Tool results carry no key material. certificate_create returns the path it wrote the private key to, never the key, since results are read by a model and end up in transcripts. Credentials resolve per call rather than at startup, so an unconfigured server still answers tools/list and then fails naming what is missing; one that refuses to start can tell nobody what it needs. The MCP Registry marker lives in the CLI crate's README rather than the library's, because the registry fetches the package named in server.json and greps that crate's README for it. Co-Authored-By: siGit Code <sigit@sigit.si> siGit-Code-Cloud-Agent-Session: https://code.sigit.si/cloud/sessions/d8b72f7e-fb25-45ee-a7f7-e2bf826baff3
Seto Elkahfi committed
Aug 6, 2026 at 08:21 UTC
6c2188bcdff72bd7fc3721addea9d906f1854e55
42 files changed
+3352
-290
.github/workflows/ci.yml
+10
@@ -57,6 +57,16 @@ jobs:
57
- name: Test
58
run: cargo test --workspace --locked
59
60
+ - name: Check each library builds on its own
61
+ # The layering only means something if the lower crates can be built
62
+ # without the upper ones. A workspace build would happily compile
63
+ # core with the MCP server's dependencies already in the graph and
64
+ # tell us nothing.
65
+ run: |
66
+ cargo check --package smbcloud-ascapi-core --locked
67
+ cargo check --package smbcloud-ascapi-aso --locked
68
+ cargo check --package smbcloud-ascapi-signing --locked
69
+
70
- name: Build docs
71
# Intra-doc links are load-bearing in this crate: the certificate
72
# module's warnings about lost private keys point at the csr module
.github/workflows/release-mcp-registry.yml
new
+127
@@ -0,0 +1,127 @@
1
+name: MCP Registry Release
2
+
3
+on:
4
+ workflow_dispatch:
5
+ inputs:
6
+ tag:
7
+ description: "Release tag (e.g. v0.1.0)"
8
+ required: true
9
+
10
+# OIDC is how we authenticate to the MCP Registry: the registry trusts a GitHub
11
+# Actions token issued for this repository, so no long-lived secret is needed.
12
+permissions:
13
+ id-token: write
14
+ contents: read
15
+
16
+jobs:
17
+ publish:
18
+ name: Publish the MCP server to the MCP Registry
19
+ runs-on: ubuntu-latest
20
+ steps:
21
+ - name: Checkout
22
+ uses: actions/checkout@v6
23
+ with:
24
+ ref: ${{ github.event.inputs.tag || github.ref }}
25
+
26
+ - name: Set the release version
27
+ shell: bash
28
+ run: |
29
+ release_version="${{ github.event.inputs.tag }}"
30
+ release_version="${release_version#v}"
31
+
32
+ echo "RELEASE_VERSION=${release_version}" >> "$GITHUB_ENV"
33
+
34
+ - name: Check the server name is consistent across the sources
35
+ shell: bash
36
+ run: |
37
+ server_name="$(jq -r '.name' server.json)"
38
+ echo "Server name: ${server_name}"
39
+
40
+ # The registry proves ownership by fetching the published crate and
41
+ # finding this marker in its README, so the marker has to be in the
42
+ # README of the crate named in server.json's packages — the CLI, not
43
+ # the library.
44
+ grep -q "mcp-name: ${server_name}" crates/cli/README.md
45
+ grep -q "mcp-name: ${server_name}" README.md
46
+
47
+ - name: Check the crate version matches the release
48
+ shell: bash
49
+ run: |
50
+ workspace_version="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n 1)"
51
+ if [ "${workspace_version}" != "${RELEASE_VERSION}" ]; then
52
+ echo "Workspace version ${workspace_version} does not match release version ${RELEASE_VERSION}." >&2
53
+ exit 1
54
+ fi
55
+
56
+ - name: Set the release version in server metadata
57
+ shell: bash
58
+ run: |
59
+ jq --arg v "${RELEASE_VERSION}" \
60
+ '.version = $v | .packages |= map(.version = $v)' \
61
+ server.json > server.tmp
62
+ mv server.tmp server.json
63
+ cat server.json
64
+
65
+ - name: Verify the published crate carries the ownership marker
66
+ shell: bash
67
+ run: |
68
+ # Checking the source tree is not enough: a crate published before
69
+ # the marker landed will still be missing it, and the registry reads
70
+ # the published artifact, not this checkout. The comparison is
71
+ # case-sensitive.
72
+ server_name="$(jq -r '.name' server.json)"
73
+ crate="$(jq -r '.packages[0].identifier' server.json)"
74
+
75
+ # crates.io indexes a few seconds to a few minutes after publish, and
76
+ # this workflow may run while the crate release is still in flight.
77
+ for attempt in $(seq 1 20); do
78
+ if curl -fsSL -H "User-Agent: smbcloudXYZ/smbcloud-ascapi release-workflow" \
79
+ "https://crates.io/api/v1/crates/${crate}/${RELEASE_VERSION}" >/dev/null; then
80
+ echo "${crate} ${RELEASE_VERSION} is indexed on crates.io."
81
+ break
82
+ fi
83
+ if [ "${attempt}" -eq 20 ]; then
84
+ echo "${crate} ${RELEASE_VERSION} is still not indexed on crates.io after 10 minutes." >&2
85
+ exit 1
86
+ fi
87
+ echo "Waiting for crates.io to index ${crate} ${RELEASE_VERSION} (attempt ${attempt}/20)..."
88
+ sleep 30
89
+ done
90
+
91
+ curl -fsSL -H "User-Agent: smbcloudXYZ/smbcloud-ascapi release-workflow" -o crate.crate \
92
+ "https://crates.io/api/v1/crates/${crate}/${RELEASE_VERSION}/download"
93
+ if ! tar -xOf crate.crate "${crate}-${RELEASE_VERSION}/README.md" | grep -q "mcp-name: ${server_name}"; then
94
+ echo "${crate} ${RELEASE_VERSION} README is missing the 'mcp-name: ${server_name}' marker." >&2
95
+ echo "crates.io versions are immutable — cut a new release with the marker in place." >&2
96
+ exit 1
97
+ fi
98
+ rm crate.crate
99
+
100
+ - name: Install mcp-publisher
101
+ shell: bash
102
+ run: |
103
+ curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
104
+
105
+ - name: Authenticate to the MCP Registry
106
+ shell: bash
107
+ run: ./mcp-publisher login github-oidc
108
+
109
+ - name: Publish
110
+ shell: bash
111
+ run: |
112
+ # Re-running a release should not fail the workflow: the registry
113
+ # rejects a version it already holds, which is the desired end state
114
+ # anyway.
115
+ out="$(./mcp-publisher publish 2>&1)" && { echo "${out}"; exit 0; }
116
+ echo "${out}"
117
+ if echo "${out}" | grep -q "duplicate version"; then
118
+ echo "Version already published — skipping."
119
+ exit 0
120
+ fi
121
+ exit 1
122
+
123
+ - name: Verify the server is listed
124
+ shell: bash
125
+ run: |
126
+ server_name="$(jq -r '.name' server.json)"
127
+ curl -fsSL "https://registry.modelcontextprotocol.io/v0.1/servers?search=${server_name}" | jq .
Cargo.lock
+429
-31
@@ -2,6 +2,15 @@
2
# It is not intended for manual editing.
3
version = 4
4
5
+[[package]]
6
+name = "android_system_properties"
7
+version = "0.1.6"
8
+source = "registry+https://github.com/rust-lang/crates.io-index"
9
+checksum = "ae221649c9976a6f6c56ae1facf410f3ddb33cc661c4b7b61020a912d4237fbc"
10
+dependencies = [
11
+ "libc",
12
+]
13
+
14
[[package]]
15
name = "anstream"
16
version = "1.0.0"
@@ -82,7 +91,7 @@ checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
91
dependencies = [
92
"proc-macro2",
93
"quote",
85
- "syn",
94
+ "syn 2.0.119",
95
"synstructure",
96
]
97
@@ -94,7 +103,18 @@ checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
103
dependencies = [
104
"proc-macro2",
105
"quote",
97
- "syn",
106
+ "syn 2.0.119",
107
+]
108
+
109
+[[package]]
110
+name = "async-trait"
111
+version = "0.1.91"
112
+source = "registry+https://github.com/rust-lang/crates.io-index"
113
+checksum = "ae36dc4177970ef04fde5178d3e2429882def40e57a451f919c098f72baa6cec"
114
+dependencies = [
115
+ "proc-macro2",
116
+ "quote",
117
+ "syn 3.0.3",
118
]
119
120
[[package]]
@@ -207,6 +227,18 @@ dependencies = [
227
"rand_core 0.10.1",
228
]
229
230
+[[package]]
231
+name = "chrono"
232
+version = "0.4.45"
233
+source = "registry+https://github.com/rust-lang/crates.io-index"
234
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
235
+dependencies = [
236
+ "iana-time-zone",
237
+ "num-traits",
238
+ "serde",
239
+ "windows-link",
240
+]
241
+
242
[[package]]
243
name = "clap"
244
version = "4.6.2"
@@ -238,7 +270,7 @@ dependencies = [
270
"heck",
271
"proc-macro2",
272
"quote",
241
- "syn",
273
+ "syn 2.0.119",
274
]
275
276
[[package]]
@@ -303,6 +335,40 @@ dependencies = [
335
"typenum",
336
]
337
338
+[[package]]
339
+name = "darling"
340
+version = "0.23.0"
341
+source = "registry+https://github.com/rust-lang/crates.io-index"
342
+checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
343
+dependencies = [
344
+ "darling_core",
345
+ "darling_macro",
346
+]
347
+
348
+[[package]]
349
+name = "darling_core"
350
+version = "0.23.0"
351
+source = "registry+https://github.com/rust-lang/crates.io-index"
352
+checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
353
+dependencies = [
354
+ "ident_case",
355
+ "proc-macro2",
356
+ "quote",
357
+ "strsim",
358
+ "syn 2.0.119",
359
+]
360
+
361
+[[package]]
362
+name = "darling_macro"
363
+version = "0.23.0"
364
+source = "registry+https://github.com/rust-lang/crates.io-index"
365
+checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
366
+dependencies = [
367
+ "darling_core",
368
+ "quote",
369
+ "syn 2.0.119",
370
+]
371
+
372
[[package]]
373
name = "data-encoding"
374
version = "2.11.1"
@@ -358,7 +424,7 @@ checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
424
dependencies = [
425
"proc-macro2",
426
"quote",
361
- "syn",
427
+ "syn 2.0.119",
428
]
429
430
[[package]]
@@ -367,6 +433,12 @@ version = "1.0.5"
433
source = "registry+https://github.com/rust-lang/crates.io-index"
434
checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
435
436
+[[package]]
437
+name = "dyn-clone"
438
+version = "1.0.20"
439
+source = "registry+https://github.com/rust-lang/crates.io-index"
440
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
441
+
442
[[package]]
443
name = "find-msvc-tools"
444
version = "0.1.9"
@@ -388,35 +460,90 @@ version = "1.3.0"
460
source = "registry+https://github.com/rust-lang/crates.io-index"
461
checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
462
463
+[[package]]
464
+name = "futures"
465
+version = "0.3.33"
466
+source = "registry+https://github.com/rust-lang/crates.io-index"
467
+checksum = "a88cf1f829d945f548cf8fec32c61b1f202b6d93b45848602fc02af4b12ad218"
468
+dependencies = [
469
+ "futures-channel",
470
+ "futures-core",
471
+ "futures-executor",
472
+ "futures-io",
473
+ "futures-sink",
474
+ "futures-task",
475
+ "futures-util",
476
+]
477
+
478
[[package]]
479
name = "futures-channel"
393
-version = "0.3.32"
480
+version = "0.3.33"
481
source = "registry+https://github.com/rust-lang/crates.io-index"
395
-checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
482
+checksum = "262590f4fe6afeb0bc83be1daa64e52657fe185690a958af7f3ad0e92085c5ae"
483
dependencies = [
484
"futures-core",
485
+ "futures-sink",
486
]
487
488
[[package]]
489
name = "futures-core"
402
-version = "0.3.32"
490
+version = "0.3.33"
491
+source = "registry+https://github.com/rust-lang/crates.io-index"
492
+checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
493
+
494
+[[package]]
495
+name = "futures-executor"
496
+version = "0.3.33"
497
+source = "registry+https://github.com/rust-lang/crates.io-index"
498
+checksum = "6754879cc9f2c66f88c6e5c35344bb0bdb0708b0352b1201815667c7eabc7458"
499
+dependencies = [
500
+ "futures-core",
501
+ "futures-task",
502
+ "futures-util",
503
+]
504
+
505
+[[package]]
506
+name = "futures-io"
507
+version = "0.3.33"
508
+source = "registry+https://github.com/rust-lang/crates.io-index"
509
+checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a"
510
+
511
+[[package]]
512
+name = "futures-macro"
513
+version = "0.3.33"
514
source = "registry+https://github.com/rust-lang/crates.io-index"
404
-checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
515
+checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b"
516
+dependencies = [
517
+ "proc-macro2",
518
+ "quote",
519
+ "syn 2.0.119",
520
+]
521
+
522
+[[package]]
523
+name = "futures-sink"
524
+version = "0.3.33"
525
+source = "registry+https://github.com/rust-lang/crates.io-index"
526
+checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307"
527
528
[[package]]
529
name = "futures-task"
408
-version = "0.3.32"
530
+version = "0.3.33"
531
source = "registry+https://github.com/rust-lang/crates.io-index"
410
-checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
532
+checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
533
534
[[package]]
535
name = "futures-util"
414
-version = "0.3.32"
536
+version = "0.3.33"
537
source = "registry+https://github.com/rust-lang/crates.io-index"
416
-checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
538
+checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
539
dependencies = [
540
+ "futures-channel",
541
"futures-core",
542
+ "futures-io",
543
+ "futures-macro",
544
+ "futures-sink",
545
"futures-task",
546
+ "memchr",
547
"pin-project-lite",
548
"slab",
549
]
@@ -562,6 +689,30 @@ dependencies = [
689
"tracing",
690
]
691
692
+[[package]]
693
+name = "iana-time-zone"
694
+version = "0.1.65"
695
+source = "registry+https://github.com/rust-lang/crates.io-index"
696
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
697
+dependencies = [
698
+ "android_system_properties",
699
+ "core-foundation-sys",
700
+ "iana-time-zone-haiku",
701
+ "js-sys",
702
+ "log",
703
+ "wasm-bindgen",
704
+ "windows-core",
705
+]
706
+
707
+[[package]]
708
+name = "iana-time-zone-haiku"
709
+version = "0.1.2"
710
+source = "registry+https://github.com/rust-lang/crates.io-index"
711
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
712
+dependencies = [
713
+ "cc",
714
+]
715
+
716
[[package]]
717
name = "icu_collections"
718
version = "2.2.0"
@@ -644,6 +795,12 @@ dependencies = [
795
"zerovec",
796
]
797
798
+[[package]]
799
+name = "ident_case"
800
+version = "1.0.1"
801
+source = "registry+https://github.com/rust-lang/crates.io-index"
802
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
803
+
804
[[package]]
805
name = "idna"
806
version = "1.1.0"
@@ -885,6 +1042,12 @@ version = "0.2.1"
1042
source = "registry+https://github.com/rust-lang/crates.io-index"
1043
checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
1044
1045
+[[package]]
1046
+name = "pastey"
1047
+version = "0.2.3"
1048
+source = "registry+https://github.com/rust-lang/crates.io-index"
1049
+checksum = "2ee67f1008b1ba2321834326597b8e186293b049a023cdef258527550b9935b4"
1050
+
1051
[[package]]
1052
name = "pem"
1053
version = "3.0.6"
@@ -1117,6 +1280,26 @@ dependencies = [
1280
"yasna",
1281
]
1282
1283
+[[package]]
1284
+name = "ref-cast"
1285
+version = "1.0.26"
1286
+source = "registry+https://github.com/rust-lang/crates.io-index"
1287
+checksum = "216e8f773d7923bcba9ceb86a86c93cabb3903a11872fc3f138c49630e50b96d"
1288
+dependencies = [
1289
+ "ref-cast-impl",
1290
+]
1291
+
1292
+[[package]]
1293
+name = "ref-cast-impl"
1294
+version = "1.0.26"
1295
+source = "registry+https://github.com/rust-lang/crates.io-index"
1296
+checksum = "2c9283685feec7d69af75fb0e858d5e7378f33fe4fc699383b2916ab9273e03c"
1297
+dependencies = [
1298
+ "proc-macro2",
1299
+ "quote",
1300
+ "syn 3.0.3",
1301
+]
1302
+
1303
[[package]]
1304
name = "reqwest"
1305
version = "0.12.28"
@@ -1169,6 +1352,41 @@ dependencies = [
1352
"windows-sys 0.52.0",
1353
]
1354
1355
+[[package]]
1356
+name = "rmcp"
1357
+version = "2.2.0"
1358
+source = "registry+https://github.com/rust-lang/crates.io-index"
1359
+checksum = "14db48ee17a9ba61810ab1a9c1beb7d06d8136ae39ac25a1137f10d357af01af"
1360
+dependencies = [
1361
+ "async-trait",
1362
+ "base64",
1363
+ "chrono",
1364
+ "futures",
1365
+ "pastey",
1366
+ "pin-project-lite",
1367
+ "rmcp-macros",
1368
+ "schemars",
1369
+ "serde",
1370
+ "serde_json",
1371
+ "thiserror",
1372
+ "tokio",
1373
+ "tokio-util",
1374
+ "tracing",
1375
+]
1376
+
1377
+[[package]]
1378
+name = "rmcp-macros"
1379
+version = "2.2.0"
1380
+source = "registry+https://github.com/rust-lang/crates.io-index"
1381
+checksum = "783d787bf21813b285f13019adc49e11af501c658890c1e519f31f937c68b7e3"
1382
+dependencies = [
1383
+ "darling",
1384
+ "proc-macro2",
1385
+ "quote",
1386
+ "serde_json",
1387
+ "syn 2.0.119",
1388
+]
1389
+
1390
[[package]]
1391
name = "rsa"
1392
version = "0.9.10"
@@ -1272,6 +1490,32 @@ dependencies = [
1490
"windows-sys 0.61.2",
1491
]
1492
1493
+[[package]]
1494
+name = "schemars"
1495
+version = "1.2.2"
1496
+source = "registry+https://github.com/rust-lang/crates.io-index"
1497
+checksum = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a"
1498
+dependencies = [
1499
+ "chrono",
1500
+ "dyn-clone",
1501
+ "ref-cast",
1502
+ "schemars_derive",
1503
+ "serde",
1504
+ "serde_json",
1505
+]
1506
+
1507
+[[package]]
1508
+name = "schemars_derive"
1509
+version = "1.2.2"
1510
+source = "registry+https://github.com/rust-lang/crates.io-index"
1511
+checksum = "d98c67716b46af2f0b8cf752abc930f6f9aecfbf671ecfb531db8a31dbe4e2ba"
1512
+dependencies = [
1513
+ "proc-macro2",
1514
+ "quote",
1515
+ "serde_derive_internals",
1516
+ "syn 3.0.3",
1517
+]
1518
+
1519
[[package]]
1520
name = "security-framework"
1521
version = "3.7.0"
@@ -1322,7 +1566,18 @@ checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
1566
dependencies = [
1567
"proc-macro2",
1568
"quote",
1325
- "syn",
1569
+ "syn 2.0.119",
1570
+]
1571
+
1572
+[[package]]
1573
+name = "serde_derive_internals"
1574
+version = "0.30.0"
1575
+source = "registry+https://github.com/rust-lang/crates.io-index"
1576
+checksum = "f852137cce035d6a4df67ccce505ff6b3e9fd3a10e3e52b24dc71e650bb1a9bd"
1577
+dependencies = [
1578
+ "proc-macro2",
1579
+ "quote",
1580
+ "syn 3.0.3",
1581
]
1582
1583
[[package]]
@@ -1391,21 +1646,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
1646
checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
1647
1648
[[package]]
1394
-name = "smbcloud-ascapi"
1649
+name = "smbcloud-ascapi-aso"
1650
version = "0.1.0"
1651
dependencies = [
1397
- "base64",
1398
- "jsonwebtoken",
1652
+ "async-trait",
1653
"md5",
1400
- "rand 0.8.7",
1401
- "rcgen",
1654
"reqwest",
1403
- "rsa",
1655
"serde",
1656
"serde_json",
1406
- "thiserror",
1407
- "tokio",
1408
- "zeroize",
1657
+ "smbcloud-ascapi-core",
1658
]
1659
1660
[[package]]
@@ -1417,10 +1666,69 @@ dependencies = [
1666
"clap",
1667
"serde",
1668
"serde_json",
1420
- "smbcloud-ascapi",
1669
+ "smbcloud-ascapi-aso",
1670
+ "smbcloud-ascapi-core",
1671
+ "smbcloud-ascapi-frontend",
1672
+ "smbcloud-ascapi-mcp",
1673
+ "smbcloud-ascapi-signing",
1674
"tokio",
1675
]
1676
1677
+[[package]]
1678
+name = "smbcloud-ascapi-core"
1679
+version = "0.1.0"
1680
+dependencies = [
1681
+ "jsonwebtoken",
1682
+ "reqwest",
1683
+ "serde",
1684
+ "serde_json",
1685
+ "thiserror",
1686
+]
1687
+
1688
+[[package]]
1689
+name = "smbcloud-ascapi-frontend"
1690
+version = "0.1.0"
1691
+dependencies = [
1692
+ "base64",
1693
+ "schemars",
1694
+ "serde",
1695
+ "serde_json",
1696
+ "smbcloud-ascapi-aso",
1697
+ "smbcloud-ascapi-core",
1698
+ "smbcloud-ascapi-signing",
1699
+]
1700
+
1701
+[[package]]
1702
+name = "smbcloud-ascapi-mcp"
1703
+version = "0.1.0"
1704
+dependencies = [
1705
+ "anyhow",
1706
+ "rmcp",
1707
+ "schemars",
1708
+ "serde",
1709
+ "serde_json",
1710
+ "smbcloud-ascapi-aso",
1711
+ "smbcloud-ascapi-core",
1712
+ "smbcloud-ascapi-frontend",
1713
+ "smbcloud-ascapi-signing",
1714
+ "tokio",
1715
+]
1716
+
1717
+[[package]]
1718
+name = "smbcloud-ascapi-signing"
1719
+version = "0.1.0"
1720
+dependencies = [
1721
+ "async-trait",
1722
+ "rand 0.8.7",
1723
+ "rcgen",
1724
+ "reqwest",
1725
+ "rsa",
1726
+ "serde",
1727
+ "serde_json",
1728
+ "smbcloud-ascapi-core",
1729
+ "zeroize",
1730
+]
1731
+
1732
[[package]]
1733
name = "socket2"
1734
version = "0.6.5"
@@ -1476,6 +1784,17 @@ dependencies = [
1784
"unicode-ident",
1785
]
1786
1787
+[[package]]
1788
+name = "syn"
1789
+version = "3.0.3"
1790
+source = "registry+https://github.com/rust-lang/crates.io-index"
1791
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
1792
+dependencies = [
1793
+ "proc-macro2",
1794
+ "quote",
1795
+ "unicode-ident",
1796
+]
1797
+
1798
[[package]]
1799
name = "sync_wrapper"
1800
version = "1.0.2"
@@ -1493,7 +1812,7 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
1812
dependencies = [
1813
"proc-macro2",
1814
"quote",
1496
- "syn",
1815
+ "syn 2.0.119",
1816
]
1817
1818
[[package]]
@@ -1513,7 +1832,7 @@ checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
1832
dependencies = [
1833
"proc-macro2",
1834
"quote",
1516
- "syn",
1835
+ "syn 2.0.119",
1836
]
1837
1838
[[package]]
@@ -1594,7 +1913,7 @@ checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
1913
dependencies = [
1914
"proc-macro2",
1915
"quote",
1597
- "syn",
1916
+ "syn 2.0.119",
1917
]
1918
1919
[[package]]
@@ -1607,6 +1926,20 @@ dependencies = [
1926
"tokio",
1927
]
1928
1929
+[[package]]
1930
+name = "tokio-util"
1931
+version = "0.7.19"
1932
+source = "registry+https://github.com/rust-lang/crates.io-index"
1933
+checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
1934
+dependencies = [
1935
+ "bytes",
1936
+ "futures-core",
1937
+ "futures-sink",
1938
+ "libc",
1939
+ "pin-project-lite",
1940
+ "tokio",
1941
+]
1942
+
1943
[[package]]
1944
name = "tower"
1945
version = "0.5.3"
@@ -1659,9 +1992,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
1992
checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
1993
dependencies = [
1994
"pin-project-lite",
1995
+ "tracing-attributes",
1996
"tracing-core",
1997
]
1998
1999
+[[package]]
2000
+name = "tracing-attributes"
2001
+version = "0.1.31"
2002
+source = "registry+https://github.com/rust-lang/crates.io-index"
2003
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
2004
+dependencies = [
2005
+ "proc-macro2",
2006
+ "quote",
2007
+ "syn 2.0.119",
2008
+]
2009
+
2010
[[package]]
2011
name = "tracing-core"
2012
version = "0.1.36"
@@ -1788,7 +2133,7 @@ dependencies = [
2133
"bumpalo",
2134
"proc-macro2",
2135
"quote",
1791
- "syn",
2136
+ "syn 2.0.119",
2137
"wasm-bindgen-shared",
2138
]
2139
@@ -1821,12 +2166,65 @@ dependencies = [
2166
"wasm-bindgen",
2167
]
2168
2169
+[[package]]
2170
+name = "windows-core"
2171
+version = "0.62.2"
2172
+source = "registry+https://github.com/rust-lang/crates.io-index"
2173
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
2174
+dependencies = [
2175
+ "windows-implement",
2176
+ "windows-interface",
2177
+ "windows-link",
2178
+ "windows-result",
2179
+ "windows-strings",
2180
+]
2181
+
2182
+[[package]]
2183
+name = "windows-implement"
2184
+version = "0.60.2"
2185
+source = "registry+https://github.com/rust-lang/crates.io-index"
2186
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
2187
+dependencies = [
2188
+ "proc-macro2",
2189
+ "quote",
2190
+ "syn 2.0.119",
2191
+]
2192
+
2193
+[[package]]
2194
+name = "windows-interface"
2195
+version = "0.59.3"
2196
+source = "registry+https://github.com/rust-lang/crates.io-index"
2197
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
2198
+dependencies = [
2199
+ "proc-macro2",
2200
+ "quote",
2201
+ "syn 2.0.119",
2202
+]
2203
+
2204
[[package]]
2205
name = "windows-link"
2206
version = "0.2.1"
2207
source = "registry+https://github.com/rust-lang/crates.io-index"
2208
checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
2209
2210
+[[package]]
2211
+name = "windows-result"
2212
+version = "0.4.1"
2213
+source = "registry+https://github.com/rust-lang/crates.io-index"
2214
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
2215
+dependencies = [
2216
+ "windows-link",
2217
+]
2218
+
2219
+[[package]]
2220
+name = "windows-strings"
2221
+version = "0.5.1"
2222
+source = "registry+https://github.com/rust-lang/crates.io-index"
2223
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
2224
+dependencies = [
2225
+ "windows-link",
2226
+]
2227
+
2228
[[package]]
2229
name = "windows-sys"
2230
version = "0.52.0"
@@ -1962,7 +2360,7 @@ checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
2360
dependencies = [
2361
"proc-macro2",
2362
"quote",
1965
- "syn",
2363
+ "syn 2.0.119",
2364
"synstructure",
2365
]
2366
@@ -1983,7 +2381,7 @@ checksum = "0fe976fb70c78cd64cccfe3a6fc142244e8a77b70959b30faf9d0ac37ee228eb"
2381
dependencies = [
2382
"proc-macro2",
2383
"quote",
1986
- "syn",
2384
+ "syn 2.0.119",
2385
]
2386
2387
[[package]]
@@ -2003,7 +2401,7 @@ checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
2401
dependencies = [
2402
"proc-macro2",
2403
"quote",
2006
- "syn",
2404
+ "syn 2.0.119",
2405
"synstructure",
2406
]
2407
@@ -2043,7 +2441,7 @@ checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
2441
dependencies = [
2442
"proc-macro2",
2443
"quote",
2046
- "syn",
2444
+ "syn 2.0.119",
2445
]
2446
2447
[[package]]
Cargo.toml
+16
-2
@@ -1,6 +1,13 @@
1
[workspace]
2
resolver = "2"
3
-members = ["crates/ascapi", "crates/cli"]
3
+members = [
4
+ "crates/core",
5
+ "crates/aso",
6
+ "crates/signing",
7
+ "crates/frontend",
8
+ "crates/mcp",
9
+ "crates/cli",
10
+]
11
12
[workspace.package]
13
version = "0.1.0"
@@ -10,7 +17,11 @@ license = "Apache-2.0"
17
repository = "https://github.com/smbcloudXYZ/smbcloud-ascapi"
18
19
[workspace.dependencies]
13
-smbcloud-ascapi = { version = "0.1.0", path = "crates/ascapi" }
20
+smbcloud-ascapi-core = { version = "0.1.0", path = "crates/core" }
21
+smbcloud-ascapi-aso = { version = "0.1.0", path = "crates/aso" }
22
+smbcloud-ascapi-signing = { version = "0.1.0", path = "crates/signing" }
23
+smbcloud-ascapi-frontend = { version = "0.1.0", path = "crates/frontend" }
24
+smbcloud-ascapi-mcp = { version = "0.1.0", path = "crates/mcp" }
25
anyhow = "1"
26
clap = "4"
27
jsonwebtoken = "9"
@@ -19,8 +30,11 @@ serde = "1"
30
serde_json = "1"
31
thiserror = "2.0"
32
tokio = "1"
33
+async-trait = "0.1"
34
base64 = "0.22"
35
rcgen = { version = "0.14", default-features = false, features = ["pem", "crypto", "aws_lc_rs"] }
36
rsa = "0.9"
37
rand = "0.8"
38
zeroize = { version = "1", features = ["alloc"] }
39
+rmcp = { version = "2.2.0", features = ["server", "macros", "transport-io", "schemars"] }
40
+schemars = "1"
README.md
+24
@@ -2,6 +2,30 @@
2
3
`smbcloud-ascapi` is the app stores coolest API.
4
5
+Six crates, split by domain and layered so neither front end can drift
6
+from the other:
7
+
8
+| Crate | What it is |
9
+| --- | --- |
10
+| `smbcloud-ascapi-core` | Shared transport: JWT auth, the HTTP client, JSON:API envelopes, error types |
11
+| `smbcloud-ascapi-aso` | App Metadata: apps, app infos, versions, bundle IDs, localizations, screenshots |
12
+| `smbcloud-ascapi-signing` | Code signing: certificates, plus local RSA key pair and CSR generation |
13
+| `smbcloud-ascapi-frontend` | Operations both surfaces share, so the CLI and the MCP server agree by construction |
14
+| `smbcloud-ascapi-mcp` | The MCP contract and stdio server |
15
+| `smbcloud-ascapi-cli` | The `ascapi` binary: clap command tree, plus `--mcp` |
16
+
17
+`aso` and `signing` know nothing about each other, and neither knows
18
+anything about the front ends. Both add their calls to
19
+`smbcloud_ascapi_core::Client` as **extension traits**, since Rust only
20
+allows inherent impls in the crate that defines a type:
21
+
22
+```rust
23
+use smbcloud_ascapi_core::{ApiKey, Client};
24
+use smbcloud_ascapi_aso::prelude::*; // or signing::prelude
25
+```
26
+
27
+MCP Registry name: `mcp-name: io.github.smbcloudXYZ/ascapi`
28
+
29
## Copyright
30
31
© 2026 [Splitfire AB](https://5mb.app) ([smbCloud](https://smbcloud.xyz)).
crates/ascapi/Cargo.toml
deleted
-28
@@ -1,28 +0,0 @@
1
-[package]
2
-name = "smbcloud-ascapi"
3
-version.workspace = true
4
-edition.workspace = true
5
-authors.workspace = true
6
-license.workspace = true
7
-repository.workspace = true
8
-description = "Embeddable client for the App Store Connect API's App Metadata resources (apps, app infos, app store versions, bundle IDs, and their localizations)."
9
-readme = "README.md"
10
-
11
-[lib]
12
-path = "src/ascapi.rs"
13
-
14
-[dependencies]
15
-base64 = { workspace = true }
16
-jsonwebtoken = { workspace = true }
17
-rand = { workspace = true }
18
-rcgen = { workspace = true }
19
-rsa = { workspace = true, features = ["pem"] }
20
-md5 = "0.7"
21
-reqwest = { workspace = true, features = ["json", "rustls-tls-native-roots"] }
22
-serde = { workspace = true, features = ["derive"] }
23
-serde_json = { workspace = true }
24
-thiserror = { workspace = true }
25
-zeroize = { workspace = true }
26
-
27
-[dev-dependencies]
28
-tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
crates/ascapi/src/ascapi.rs
deleted
-62
@@ -1,62 +0,0 @@
1
-//! Embeddable Rust client (and CLI, in the sibling `smbcloud-ascapi-cli`
2
-//! crate / `ascapi` binary) for two slices of the App Store Connect API:
3
-//!
4
-//! - [App Metadata](https://developer.apple.com/documentation/appstoreconnectapi/app-metadata):
5
-//! apps, app infos and their localizations, app store versions and their
6
-//! localizations, and bundle IDs.
7
-//! - Signing certificates ([`certificate`]), plus local RSA key pair and
8
-//! CSR generation ([`csr`]) so a certificate can be issued end to end
9
-//! without the developer portal.
10
-//!
11
-//! ```no_run
12
-//! use smbcloud_ascapi::{ApiKey, Client};
13
-//! use smbcloud_ascapi::app_store_version::{AppStoreVersionCreateAttributes, Platform};
14
-//!
15
-//! # async fn example() -> smbcloud_ascapi::Result<()> {
16
-//! let api_key = ApiKey::from_p8_file(
17
-//! "L84N624YQH",
18
-//! "b4e8d369-8b7d-4538-8435-643b73237575",
19
-//! "/Users/me/private_keys/AuthKey_L84N624YQH.p8",
20
-//! )?;
21
-//! let client = Client::new(api_key);
22
-//!
23
-//! let apps = client.list_apps(Some("ai.siti.Siti")).await?;
24
-//! let app = &apps[0];
25
-//!
26
-//! client
27
-//! .create_app_store_version(
28
-//! &app.id,
29
-//! AppStoreVersionCreateAttributes {
30
-//! platform: Platform::VisionOs,
31
-//! version_string: "1.0.0".to_string(),
32
-//! copyright: None,
33
-//! },
34
-//! )
35
-//! .await?;
36
-//! # Ok(())
37
-//! # }
38
-//! ```
39
-//!
40
-//! Not covered (yet): provisioning profiles and devices (the other half of
41
-//! the Provisioning surface), app preview (video) binary uploads, age
42
-//! rating declarations, in-app purchases, and TestFlight.
43
-
44
-pub mod app;
45
-pub mod app_info;
46
-pub mod app_info_localization;
47
-pub mod app_screenshot;
48
-pub mod app_screenshot_set;
49
-pub mod app_store_version;
50
-pub mod app_store_version_localization;
51
-pub mod auth;
52
-pub mod build;
53
-pub mod bundle_id;
54
-pub mod certificate;
55
-pub mod client;
56
-pub mod csr;
57
-pub mod error;
58
-pub mod jsonapi;
59
-
60
-pub use auth::ApiKey;
61
-pub use client::Client;
62
-pub use error::{Error, Result};
crates/aso/Cargo.toml
new
+19
@@ -0,0 +1,19 @@
1
+[package]
2
+name = "smbcloud-ascapi-aso"
3
+version.workspace = true
4
+edition.workspace = true
5
+authors.workspace = true
6
+license.workspace = true
7
+repository.workspace = true
8
+description = "App Store Connect App Metadata resources: apps, app infos, versions, bundle IDs, localizations, and screenshots."
9
+
10
+[lib]
11
+path = "src/lib.rs"
12
+
13
+[dependencies]
14
+async-trait = { workspace = true }
15
+md5 = "0.7"
16
+reqwest = { workspace = true }
17
+serde = { workspace = true, features = ["derive"] }
18
+serde_json = { workspace = true }
19
+smbcloud-ascapi-core = { workspace = true }
crates/aso/src/app.rs
renamed
+24
-7
@@ -6,11 +6,12 @@
6
//! platform, a build upload) is what actually provisions the `App` row.
7
//! This module only reads and updates one that already exists.
8
9
-use crate::client::Client;
10
-use crate::error::Result;
11
-use crate::jsonapi::{Document, ListDocument, Resource, UpdateBody, UpdateData};
9
+use async_trait::async_trait;
10
use reqwest::Method;
11
use serde::{Deserialize, Serialize};
12
+use smbcloud_ascapi_core::jsonapi::{Document, ListDocument, Resource, UpdateBody, UpdateData};
13
+use smbcloud_ascapi_core::Client;
14
+use smbcloud_ascapi_core::Result;
15
16
pub const RESOURCE_TYPE: &str = "apps";
17
@@ -36,11 +37,27 @@ pub struct AppUpdateAttributes {
37
pub content_rights_declaration: Option<String>,
38
}
39
39
-impl Client {
40
+/// Apps: the top-level record for a product on the store.
41
+///
42
+/// An extension trait rather than inherent methods, because `Client`
43
+/// lives in the core crate and Rust only allows inherent impls in the
44
+/// crate that defines the type. Import it, or the crate's `prelude`,
45
+/// to call these on a `Client`.
46
+#[async_trait]
47
+pub trait AppsApi {
48
/// `GET /v1/apps`, optionally narrowed with `filter[bundleId]` — the
49
/// usual way to resolve an app's ASC id from the bundle identifier
50
/// already baked into an Xcode project.
43
- pub async fn list_apps(&self, filter_bundle_id: Option<&str>) -> Result<Vec<App>> {
51
+ async fn list_apps(&self, filter_bundle_id: Option<&str>) -> Result<Vec<App>>;
52
+
53
+ async fn get_app(&self, app_id: &str) -> Result<App>;
54
+
55
+ async fn update_app(&self, app_id: &str, attributes: AppUpdateAttributes) -> Result<App>;
56
+}
57
+
58
+#[async_trait]
59
+impl AppsApi for Client {
60
+ async fn list_apps(&self, filter_bundle_id: Option<&str>) -> Result<Vec<App>> {
61
let mut query = Vec::new();
62
if let Some(bundle_id) = filter_bundle_id {
63
query.push(("filter[bundleId]", bundle_id));
@@ -51,14 +68,14 @@ impl Client {
68
Ok(doc.data)
69
}
70
54
- pub async fn get_app(&self, app_id: &str) -> Result<App> {
71
+ async fn get_app(&self, app_id: &str) -> Result<App> {
72
let path = format!("/v1/apps/{app_id}");
73
let doc: Document<AppAttributes> =
74
self.request(Method::GET, &path, &[], None::<&()>).await?;
75
Ok(doc.data)
76
}
77
61
- pub async fn update_app(&self, app_id: &str, attributes: AppUpdateAttributes) -> Result<App> {
78
+ async fn update_app(&self, app_id: &str, attributes: AppUpdateAttributes) -> Result<App> {
79
let path = format!("/v1/apps/{app_id}");
80
let body = UpdateBody {
81
data: UpdateData {
crates/aso/src/app_info.rs
renamed
+21
-6
@@ -4,11 +4,12 @@
4
//! `AppInfo` rows itself (there is no create/delete endpoint) — this module
5
//! only reads them and updates category/age-rating relationships.
6
7
-use crate::client::Client;
8
-use crate::error::Result;
9
-use crate::jsonapi::{Document, ListDocument, Resource};
7
+use async_trait::async_trait;
8
use reqwest::Method;
9
use serde::{Deserialize, Serialize};
10
+use smbcloud_ascapi_core::jsonapi::{Document, ListDocument, Resource};
11
+use smbcloud_ascapi_core::Client;
12
+use smbcloud_ascapi_core::Result;
13
14
pub const RESOURCE_TYPE: &str = "appInfos";
15
@@ -23,19 +24,33 @@ pub struct AppInfoAttributes {
24
25
pub type AppInfo = Resource<AppInfoAttributes>;
26
26
-impl Client {
27
+/// AppInfos: the container for localized names and subtitles.
28
+///
29
+/// An extension trait rather than inherent methods, because `Client`
30
+/// lives in the core crate and Rust only allows inherent impls in the
31
+/// crate that defines the type. Import it, or the crate's `prelude`,
32
+/// to call these on a `Client`.
33
+#[async_trait]
34
+pub trait AppInfosApi {
35
/// `GET /v1/apps/{app_id}/appInfos`. An app usually has one current
36
/// `AppInfo` (plus, briefly, a second pending one while an edit awaits
37
/// review) — this is the parent resource `AppInfoLocalization`s hang
38
/// off of, and the id you need for `create_app_info_localization`.
31
- pub async fn list_app_infos(&self, app_id: &str) -> Result<Vec<AppInfo>> {
39
+ async fn list_app_infos(&self, app_id: &str) -> Result<Vec<AppInfo>>;
40
+
41
+ async fn get_app_info(&self, id: &str) -> Result<AppInfo>;
42
+}
43
+
44
+#[async_trait]
45
+impl AppInfosApi for Client {
46
+ async fn list_app_infos(&self, app_id: &str) -> Result<Vec<AppInfo>> {
47
let path = format!("/v1/apps/{app_id}/appInfos");
48
let doc: ListDocument<AppInfoAttributes> =
49
self.request(Method::GET, &path, &[], None::<&()>).await?;
50
Ok(doc.data)
51
}
52
38
- pub async fn get_app_info(&self, id: &str) -> Result<AppInfo> {
53
+ async fn get_app_info(&self, id: &str) -> Result<AppInfo> {
54
let path = format!("/v1/appInfos/{id}");
55
let doc: Document<AppInfoAttributes> =
56
self.request(Method::GET, &path, &[], None::<&()>).await?;
crates/aso/src/app_info_localization.rs
renamed
+42
-12
@@ -1,11 +1,12 @@
1
-use crate::client::Client;
2
-use crate::error::Result;
3
-use crate::jsonapi::{
1
+use async_trait::async_trait;
2
+use reqwest::Method;
3
+use serde::{Deserialize, Serialize};
4
+use smbcloud_ascapi_core::jsonapi::{
5
CreateBody, CreateData, Document, ListDocument, Resource, ResourceId, ToOne, UpdateBody,
6
UpdateData,
7
};
7
-use reqwest::Method;
8
-use serde::{Deserialize, Serialize};
8
+use smbcloud_ascapi_core::Client;
9
+use smbcloud_ascapi_core::Result;
10
11
pub const RESOURCE_TYPE: &str = "appInfoLocalizations";
12
@@ -50,8 +51,39 @@ pub struct AppInfoLocalizationRelationships {
51
pub app_info: ToOne,
52
}
53
53
-impl Client {
54
- pub async fn list_app_info_localizations(
54
+/// Per-locale app name, subtitle, and privacy policy URL.
55
+///
56
+/// An extension trait rather than inherent methods, because `Client`
57
+/// lives in the core crate and Rust only allows inherent impls in the
58
+/// crate that defines the type. Import it, or the crate's `prelude`,
59
+/// to call these on a `Client`.
60
+#[async_trait]
61
+pub trait AppInfoLocalizationsApi {
62
+ async fn list_app_info_localizations(
63
+ &self,
64
+ app_info_id: &str,
65
+ ) -> Result<Vec<AppInfoLocalization>>;
66
+
67
+ /// `POST /v1/appInfoLocalizations` — adds a locale's name/subtitle to an
68
+ /// `AppInfo`.
69
+ async fn create_app_info_localization(
70
+ &self,
71
+ app_info_id: &str,
72
+ attributes: AppInfoLocalizationCreateAttributes,
73
+ ) -> Result<AppInfoLocalization>;
74
+
75
+ async fn update_app_info_localization(
76
+ &self,
77
+ id: &str,
78
+ attributes: AppInfoLocalizationUpdateAttributes,
79
+ ) -> Result<AppInfoLocalization>;
80
+
81
+ async fn delete_app_info_localization(&self, id: &str) -> Result<()>;
82
+}
83
+
84
+#[async_trait]
85
+impl AppInfoLocalizationsApi for Client {
86
+ async fn list_app_info_localizations(
87
&self,
88
app_info_id: &str,
89
) -> Result<Vec<AppInfoLocalization>> {
@@ -61,9 +93,7 @@ impl Client {
93
Ok(doc.data)
94
}
95
64
- /// `POST /v1/appInfoLocalizations` — adds a locale's name/subtitle to an
65
- /// `AppInfo`.
66
- pub async fn create_app_info_localization(
96
+ async fn create_app_info_localization(
97
&self,
98
app_info_id: &str,
99
attributes: AppInfoLocalizationCreateAttributes,
@@ -88,7 +118,7 @@ impl Client {
118
Ok(doc.data)
119
}
120
91
- pub async fn update_app_info_localization(
121
+ async fn update_app_info_localization(
122
&self,
123
id: &str,
124
attributes: AppInfoLocalizationUpdateAttributes,
@@ -106,7 +136,7 @@ impl Client {
136
Ok(doc.data)
137
}
138
109
- pub async fn delete_app_info_localization(&self, id: &str) -> Result<()> {
139
+ async fn delete_app_info_localization(&self, id: &str) -> Result<()> {
140
let path = format!("/v1/appInfoLocalizations/{id}");
141
self.request_no_content::<()>(Method::DELETE, &path, &[], None)
142
.await
crates/aso/src/app_screenshot.rs
renamed
+72
-31
@@ -10,16 +10,17 @@
10
//! 3. `PATCH /v1/appScreenshots/{id}` with `uploaded: true` and an MD5
11
//! checksum of the file commits the upload.
12
//!
13
-//! [`Client::upload_app_screenshot`] does all three steps in one call.
13
+//! [`AppScreenshotsApi::upload_app_screenshot`] does all three steps in one call.
14
15
-use crate::client::Client;
16
-use crate::error::Result;
17
-use crate::jsonapi::{
15
+use async_trait::async_trait;
16
+use reqwest::Method;
17
+use serde::{Deserialize, Deserializer, Serialize};
18
+use smbcloud_ascapi_core::jsonapi::{
19
CreateBody, CreateData, Document, ListDocument, Resource, ResourceId, ToOne, UpdateBody,
20
UpdateData,
21
};
21
-use reqwest::Method;
22
-use serde::{Deserialize, Deserializer, Serialize};
22
+use smbcloud_ascapi_core::Client;
23
+use smbcloud_ascapi_core::Result;
24
25
pub const RESOURCE_TYPE: &str = "appScreenshots";
26
@@ -105,9 +106,67 @@ pub struct AppScreenshotCommitAttributes {
106
pub source_file_checksum: Option<String>,
107
}
108
108
-impl Client {
109
+/// Screenshot image binaries within a set.
110
+///
111
+/// An extension trait rather than inherent methods, because `Client`
112
+/// lives in the core crate and Rust only allows inherent impls in the
113
+/// crate that defines the type. Import it, or the crate's `prelude`,
114
+/// to call these on a `Client`.
115
+#[async_trait]
116
+pub trait AppScreenshotsApi {
117
/// `GET /v1/appScreenshotSets/{id}/appScreenshots`.
110
- pub async fn list_app_screenshots(
118
+ async fn list_app_screenshots(&self, app_screenshot_set_id: &str)
119
+ -> Result<Vec<AppScreenshot>>;
120
+
121
+ /// `POST /v1/appScreenshots` — reserves the asset and returns
122
+ /// pre-signed `uploadOperations`. Prefer [`AppScreenshotsApi::upload_app_screenshot`]
123
+ /// unless you need to drive the upload/commit steps yourself.
124
+ async fn create_app_screenshot(
125
+ &self,
126
+ app_screenshot_set_id: &str,
127
+ attributes: AppScreenshotCreateAttributes,
128
+ ) -> Result<AppScreenshot>;
129
+
130
+ /// PUTs `bytes` to every one of `screenshot`'s reserved
131
+ /// `uploadOperations`, slicing the buffer per operation's `offset` /
132
+ /// `length`. Does not commit the upload — call
133
+ /// [`AppScreenshotsApi::commit_app_screenshot`] (or use
134
+ /// [`AppScreenshotsApi::upload_app_screenshot`]) after this succeeds.
135
+ async fn upload_app_screenshot_bytes(
136
+ &self,
137
+ screenshot: &AppScreenshot,
138
+ bytes: &[u8],
139
+ ) -> Result<()>;
140
+
141
+ /// `PATCH /v1/appScreenshots/{id}` with `uploaded: true` — tells App
142
+ /// Store Connect the binary is fully transferred so it can start
143
+ /// processing/validating the asset.
144
+ async fn commit_app_screenshot(
145
+ &self,
146
+ id: &str,
147
+ source_file_checksum: String,
148
+ ) -> Result<AppScreenshot>;
149
+
150
+ /// `DELETE /v1/appScreenshots/{id}`.
151
+ async fn delete_app_screenshot(&self, id: &str) -> Result<()>;
152
+
153
+ /// Reserve, upload, and commit an image in one call: `bytes` becomes an
154
+ /// `AppScreenshot` under `app_screenshot_set_id`, named `file_name`.
155
+ /// This is the entry point most callers want; the lower-level
156
+ /// `create_app_screenshot` / `upload_app_screenshot_bytes` /
157
+ /// `commit_app_screenshot` are exposed for callers that need to
158
+ /// checkpoint between steps (e.g. a CLI resuming a failed upload).
159
+ async fn upload_app_screenshot(
160
+ &self,
161
+ app_screenshot_set_id: &str,
162
+ file_name: String,
163
+ bytes: Vec<u8>,
164
+ ) -> Result<AppScreenshot>;
165
+}
166
+
167
+#[async_trait]
168
+impl AppScreenshotsApi for Client {
169
+ async fn list_app_screenshots(
170
&self,
171
app_screenshot_set_id: &str,
172
) -> Result<Vec<AppScreenshot>> {
@@ -117,10 +176,7 @@ impl Client {
176
Ok(doc.data)
177
}
178
120
- /// `POST /v1/appScreenshots` — reserves the asset and returns
121
- /// pre-signed `uploadOperations`. Prefer [`Client::upload_app_screenshot`]
122
- /// unless you need to drive the upload/commit steps yourself.
123
- pub async fn create_app_screenshot(
179
+ async fn create_app_screenshot(
180
&self,
181
app_screenshot_set_id: &str,
182
attributes: AppScreenshotCreateAttributes,
@@ -145,12 +201,7 @@ impl Client {
201
Ok(doc.data)
202
}
203
148
- /// PUTs `bytes` to every one of `screenshot`'s reserved
149
- /// `uploadOperations`, slicing the buffer per operation's `offset` /
150
- /// `length`. Does not commit the upload — call
151
- /// [`Client::commit_app_screenshot`] (or use
152
- /// [`Client::upload_app_screenshot`]) after this succeeds.
153
- pub async fn upload_app_screenshot_bytes(
204
+ async fn upload_app_screenshot_bytes(
205
&self,
206
screenshot: &AppScreenshot,
207
bytes: &[u8],
@@ -173,10 +224,7 @@ impl Client {
224
Ok(())
225
}
226
176
- /// `PATCH /v1/appScreenshots/{id}` with `uploaded: true` — tells App
177
- /// Store Connect the binary is fully transferred so it can start
178
- /// processing/validating the asset.
179
- pub async fn commit_app_screenshot(
227
+ async fn commit_app_screenshot(
228
&self,
229
id: &str,
230
source_file_checksum: String,
@@ -197,20 +245,13 @@ impl Client {
245
Ok(doc.data)
246
}
247
200
- /// `DELETE /v1/appScreenshots/{id}`.
201
- pub async fn delete_app_screenshot(&self, id: &str) -> Result<()> {
248
+ async fn delete_app_screenshot(&self, id: &str) -> Result<()> {
249
let path = format!("/v1/appScreenshots/{id}");
250
self.request_no_content::<()>(Method::DELETE, &path, &[], None)
251
.await
252
}
253
207
- /// Reserve, upload, and commit an image in one call: `bytes` becomes an
208
- /// `AppScreenshot` under `app_screenshot_set_id`, named `file_name`.
209
- /// This is the entry point most callers want; the lower-level
210
- /// `create_app_screenshot` / `upload_app_screenshot_bytes` /
211
- /// `commit_app_screenshot` are exposed for callers that need to
212
- /// checkpoint between steps (e.g. a CLI resuming a failed upload).
213
- pub async fn upload_app_screenshot(
254
+ async fn upload_app_screenshot(
255
&self,
256
app_screenshot_set_id: &str,
257
file_name: String,
crates/aso/src/app_screenshot_set.rs
renamed
+38
-12
@@ -3,11 +3,14 @@
3
//! `AppStoreVersion`. Screenshots themselves are a separate resource
4
//! ([`crate::app_screenshot`]) that belongs to a set.
5
6
-use crate::client::Client;
7
-use crate::error::Result;
8
-use crate::jsonapi::{CreateBody, CreateData, Document, ListDocument, Resource, ResourceId, ToOne};
6
+use async_trait::async_trait;
7
use reqwest::Method;
8
use serde::{Deserialize, Serialize};
9
+use smbcloud_ascapi_core::jsonapi::{
10
+ CreateBody, CreateData, Document, ListDocument, Resource, ResourceId, ToOne,
11
+};
12
+use smbcloud_ascapi_core::Client;
13
+use smbcloud_ascapi_core::Result;
14
15
pub const RESOURCE_TYPE: &str = "appScreenshotSets";
16
@@ -81,9 +84,37 @@ pub struct AppScreenshotSetRelationships {
84
pub app_store_version_localization: ToOne,
85
}
86
84
-impl Client {
87
+/// Per-device-class screenshot buckets.
88
+///
89
+/// An extension trait rather than inherent methods, because `Client`
90
+/// lives in the core crate and Rust only allows inherent impls in the
91
+/// crate that defines the type. Import it, or the crate's `prelude`,
92
+/// to call these on a `Client`.
93
+#[async_trait]
94
+pub trait AppScreenshotSetsApi {
95
/// `GET /v1/appStoreVersionLocalizations/{id}/appScreenshotSets`.
86
- pub async fn list_app_screenshot_sets(
96
+ async fn list_app_screenshot_sets(
97
+ &self,
98
+ app_store_version_localization_id: &str,
99
+ ) -> Result<Vec<AppScreenshotSet>>;
100
+
101
+ /// `POST /v1/appScreenshotSets` — adds a device/display class's
102
+ /// screenshot bucket to a localization. Screenshots are then added to
103
+ /// the returned set with [`AppScreenshotsApi::create_app_screenshot`](crate::app_screenshot::AppScreenshotsApi::create_app_screenshot) /
104
+ /// [`AppScreenshotsApi::upload_app_screenshot`](crate::app_screenshot::AppScreenshotsApi::upload_app_screenshot).
105
+ async fn create_app_screenshot_set(
106
+ &self,
107
+ app_store_version_localization_id: &str,
108
+ attributes: AppScreenshotSetCreateAttributes,
109
+ ) -> Result<AppScreenshotSet>;
110
+
111
+ /// `DELETE /v1/appScreenshotSets/{id}`.
112
+ async fn delete_app_screenshot_set(&self, id: &str) -> Result<()>;
113
+}
114
+
115
+#[async_trait]
116
+impl AppScreenshotSetsApi for Client {
117
+ async fn list_app_screenshot_sets(
118
&self,
119
app_store_version_localization_id: &str,
120
) -> Result<Vec<AppScreenshotSet>> {
@@ -95,11 +126,7 @@ impl Client {
126
Ok(doc.data)
127
}
128
98
- /// `POST /v1/appScreenshotSets` — adds a device/display class's
99
- /// screenshot bucket to a localization. Screenshots are then added to
100
- /// the returned set with [`Client::create_app_screenshot`] /
101
- /// [`Client::upload_app_screenshot`].
102
- pub async fn create_app_screenshot_set(
129
+ async fn create_app_screenshot_set(
130
&self,
131
app_store_version_localization_id: &str,
132
attributes: AppScreenshotSetCreateAttributes,
@@ -124,8 +151,7 @@ impl Client {
151
Ok(doc.data)
152
}
153
127
- /// `DELETE /v1/appScreenshotSets/{id}`.
128
- pub async fn delete_app_screenshot_set(&self, id: &str) -> Result<()> {
154
+ async fn delete_app_screenshot_set(&self, id: &str) -> Result<()> {
155
let path = format!("/v1/appScreenshotSets/{id}");
156
self.request_no_content::<()>(Method::DELETE, &path, &[], None)
157
.await
crates/aso/src/app_store_version.rs
renamed
+56
-20
@@ -5,14 +5,15 @@
5
//! doesn't have one for yet — e.g. adding visionOS to an app that so far
6
//! only ships on iOS/macOS — *is* how you add that platform.
7
8
-use crate::client::Client;
9
-use crate::error::Result;
10
-use crate::jsonapi::{
8
+use async_trait::async_trait;
9
+use reqwest::Method;
10
+use serde::{Deserialize, Serialize};
11
+use smbcloud_ascapi_core::jsonapi::{
12
CreateBody, CreateData, Document, ListDocument, Resource, ResourceId, ToOne,
13
UpdateRelationshipsBody, UpdateRelationshipsData,
14
};
14
-use reqwest::Method;
15
-use serde::{Deserialize, Serialize};
15
+use smbcloud_ascapi_core::Client;
16
+use smbcloud_ascapi_core::Result;
17
18
pub const RESOURCE_TYPE: &str = "appStoreVersions";
19
@@ -67,10 +68,51 @@ pub struct AppStoreVersionRelationships {
68
pub app: ToOne,
69
}
70
70
-impl Client {
71
+/// Per-platform version records, the unit the store reviews.
72
+///
73
+/// An extension trait rather than inherent methods, because `Client`
74
+/// lives in the core crate and Rust only allows inherent impls in the
75
+/// crate that defines the type. Import it, or the crate's `prelude`,
76
+/// to call these on a `Client`.
77
+#[async_trait]
78
+pub trait AppStoreVersionsApi {
79
/// `GET /v1/apps/{app_id}/appStoreVersions`, optionally narrowed to one
80
/// platform.
73
- pub async fn list_app_store_versions(
81
+ async fn list_app_store_versions(
82
+ &self,
83
+ app_id: &str,
84
+ filter_platform: Option<Platform>,
85
+ ) -> Result<Vec<AppStoreVersion>>;
86
+
87
+ async fn get_app_store_version(&self, id: &str) -> Result<AppStoreVersion>;
88
+
89
+ /// `POST /v1/appStoreVersions`.
90
+ async fn create_app_store_version(
91
+ &self,
92
+ app_id: &str,
93
+ attributes: AppStoreVersionCreateAttributes,
94
+ ) -> Result<AppStoreVersion>;
95
+
96
+ /// `DELETE /v1/appStoreVersions/{id}` — only allowed while the version
97
+ /// hasn't been submitted for review.
98
+ async fn delete_app_store_version(&self, id: &str) -> Result<()>;
99
+
100
+ /// `PATCH /v1/appStoreVersions/{id}` with a `build` relationship —
101
+ /// attaches (or replaces) the `Build` this version will submit. Needed
102
+ /// after a re-upload fixes an `INVALID_BINARY` version: the fixed
103
+ /// build must be attached here before the version can be resubmitted
104
+ /// for review (resubmission itself is outside this crate's scope — see
105
+ /// [`crate::build`]'s module doc).
106
+ async fn set_app_store_version_build(
107
+ &self,
108
+ id: &str,
109
+ build_id: &str,
110
+ ) -> Result<AppStoreVersion>;
111
+}
112
+
113
+#[async_trait]
114
+impl AppStoreVersionsApi for Client {
115
+ async fn list_app_store_versions(
116
&self,
117
app_id: &str,
118
filter_platform: Option<Platform>,
@@ -86,15 +128,14 @@ impl Client {
128
Ok(doc.data)
129
}
130
89
- pub async fn get_app_store_version(&self, id: &str) -> Result<AppStoreVersion> {
131
+ async fn get_app_store_version(&self, id: &str) -> Result<AppStoreVersion> {
132
let path = format!("/v1/appStoreVersions/{id}");
133
let doc: Document<AppStoreVersionAttributes> =
134
self.request(Method::GET, &path, &[], None::<&()>).await?;
135
Ok(doc.data)
136
}
137
96
- /// `POST /v1/appStoreVersions`.
97
- pub async fn create_app_store_version(
138
+ async fn create_app_store_version(
139
&self,
140
app_id: &str,
141
attributes: AppStoreVersionCreateAttributes,
@@ -119,21 +160,13 @@ impl Client {
160
Ok(doc.data)
161
}
162
122
- /// `DELETE /v1/appStoreVersions/{id}` — only allowed while the version
123
- /// hasn't been submitted for review.
124
- pub async fn delete_app_store_version(&self, id: &str) -> Result<()> {
163
+ async fn delete_app_store_version(&self, id: &str) -> Result<()> {
164
let path = format!("/v1/appStoreVersions/{id}");
165
self.request_no_content::<()>(Method::DELETE, &path, &[], None)
166
.await
167
}
168
130
- /// `PATCH /v1/appStoreVersions/{id}` with a `build` relationship —
131
- /// attaches (or replaces) the `Build` this version will submit. Needed
132
- /// after a re-upload fixes an `INVALID_BINARY` version: the fixed
133
- /// build must be attached here before the version can be resubmitted
134
- /// for review (resubmission itself is outside this crate's scope — see
135
- /// [`crate::build`]'s module doc).
136
- pub async fn set_app_store_version_build(
169
+ async fn set_app_store_version_build(
170
&self,
171
id: &str,
172
build_id: &str,
@@ -159,6 +192,9 @@ impl Client {
192
}
193
}
194
195
+/// The `relationships` payload for pointing an App Store Version at a
196
+/// build. Its own type because App Store Connect wants a PATCH body that
197
+/// carries relationships and no attributes.
198
#[derive(Debug, Clone, Serialize)]
199
#[serde(rename_all = "camelCase")]
200
pub struct AppStoreVersionBuildRelationship {
crates/aso/src/app_store_version_localization.rs
renamed
+42
-12
@@ -1,11 +1,12 @@
1
-use crate::client::Client;
2
-use crate::error::Result;
3
-use crate::jsonapi::{
1
+use async_trait::async_trait;
2
+use reqwest::Method;
3
+use serde::{Deserialize, Serialize};
4
+use smbcloud_ascapi_core::jsonapi::{
5
CreateBody, CreateData, Document, ListDocument, Resource, ResourceId, ToOne, UpdateBody,
6
UpdateData,
7
};
7
-use reqwest::Method;
8
-use serde::{Deserialize, Serialize};
8
+use smbcloud_ascapi_core::Client;
9
+use smbcloud_ascapi_core::Result;
10
11
pub const RESOURCE_TYPE: &str = "appStoreVersionLocalizations";
12
@@ -54,8 +55,39 @@ pub struct AppStoreVersionLocalizationRelationships {
55
pub app_store_version: ToOne,
56
}
57
57
-impl Client {
58
- pub async fn list_app_store_version_localizations(
58
+/// Per-locale description, keywords, and release notes.
59
+///
60
+/// An extension trait rather than inherent methods, because `Client`
61
+/// lives in the core crate and Rust only allows inherent impls in the
62
+/// crate that defines the type. Import it, or the crate's `prelude`,
63
+/// to call these on a `Client`.
64
+#[async_trait]
65
+pub trait AppStoreVersionLocalizationsApi {
66
+ async fn list_app_store_version_localizations(
67
+ &self,
68
+ app_store_version_id: &str,
69
+ ) -> Result<Vec<AppStoreVersionLocalization>>;
70
+
71
+ /// `POST /v1/appStoreVersionLocalizations` — adds a locale's
72
+ /// description/keywords/etc to an `AppStoreVersion`.
73
+ async fn create_app_store_version_localization(
74
+ &self,
75
+ app_store_version_id: &str,
76
+ attributes: AppStoreVersionLocalizationCreateAttributes,
77
+ ) -> Result<AppStoreVersionLocalization>;
78
+
79
+ async fn update_app_store_version_localization(
80
+ &self,
81
+ id: &str,
82
+ fields: AppStoreVersionLocalizationFields,
83
+ ) -> Result<AppStoreVersionLocalization>;
84
+
85
+ async fn delete_app_store_version_localization(&self, id: &str) -> Result<()>;
86
+}
87
+
88
+#[async_trait]
89
+impl AppStoreVersionLocalizationsApi for Client {
90
+ async fn list_app_store_version_localizations(
91
&self,
92
app_store_version_id: &str,
93
) -> Result<Vec<AppStoreVersionLocalization>> {
@@ -66,9 +98,7 @@ impl Client {
98
Ok(doc.data)
99
}
100
69
- /// `POST /v1/appStoreVersionLocalizations` — adds a locale's
70
- /// description/keywords/etc to an `AppStoreVersion`.
71
- pub async fn create_app_store_version_localization(
101
+ async fn create_app_store_version_localization(
102
&self,
103
app_store_version_id: &str,
104
attributes: AppStoreVersionLocalizationCreateAttributes,
@@ -98,7 +128,7 @@ impl Client {
128
Ok(doc.data)
129
}
130
101
- pub async fn update_app_store_version_localization(
131
+ async fn update_app_store_version_localization(
132
&self,
133
id: &str,
134
fields: AppStoreVersionLocalizationFields,
@@ -116,7 +146,7 @@ impl Client {
146
Ok(doc.data)
147
}
148
119
- pub async fn delete_app_store_version_localization(&self, id: &str) -> Result<()> {
149
+ async fn delete_app_store_version_localization(&self, id: &str) -> Result<()> {
150
let path = format!("/v1/appStoreVersionLocalizations/{id}");
151
self.request_no_content::<()>(Method::DELETE, &path, &[], None)
152
.await
crates/aso/src/build.rs
renamed
+18
-5
@@ -7,11 +7,12 @@
7
//! `AppStoreVersion`'s `appVersionState` (which only changes once a build is
8
//! attached to the version and resubmitted — outside this crate's scope).
9
10
-use crate::client::Client;
11
-use crate::error::Result;
12
-use crate::jsonapi::{ListDocument, Resource};
10
+use async_trait::async_trait;
11
use reqwest::Method;
12
use serde::{Deserialize, Serialize};
13
+use smbcloud_ascapi_core::jsonapi::{ListDocument, Resource};
14
+use smbcloud_ascapi_core::Client;
15
+use smbcloud_ascapi_core::Result;
16
17
pub const RESOURCE_TYPE: &str = "builds";
18
@@ -27,13 +28,25 @@ pub struct BuildAttributes {
28
29
pub type Build = Resource<BuildAttributes>;
30
30
-impl Client {
31
+/// Uploaded builds, which a version must have attached.
32
+///
33
+/// An extension trait rather than inherent methods, because `Client`
34
+/// lives in the core crate and Rust only allows inherent impls in the
35
+/// crate that defines the type. Import it, or the crate's `prelude`,
36
+/// to call these on a `Client`.
37
+#[async_trait]
38
+pub trait BuildsApi {
39
/// `GET /v1/apps/{app_id}/builds`, sorted newest-first by
40
/// `uploadedDate` (client-side — this endpoint's `sort` query parameter
41
/// is rejected by the API, unlike most other list endpoints), so the
42
/// build most recently uploaded (e.g. by a fixplist re-upload) is
43
/// `list_builds(app_id).await?.first()`.
36
- pub async fn list_builds(&self, app_id: &str) -> Result<Vec<Build>> {
44
+ async fn list_builds(&self, app_id: &str) -> Result<Vec<Build>>;
45
+}
46
+
47
+#[async_trait]
48
+impl BuildsApi for Client {
49
+ async fn list_builds(&self, app_id: &str) -> Result<Vec<Build>> {
50
let path = format!("/v1/apps/{app_id}/builds");
51
let doc: ListDocument<BuildAttributes> =
52
self.request(Method::GET, &path, &[], None::<&()>).await?;
crates/aso/src/bundle_id.rs
renamed
+23
-8
@@ -1,8 +1,9 @@
1
-use crate::client::Client;
2
-use crate::error::Result;
3
-use crate::jsonapi::{CreateBody, CreateData, Document, ListDocument, Resource};
1
+use async_trait::async_trait;
2
use reqwest::Method;
3
use serde::{Deserialize, Serialize};
4
+use smbcloud_ascapi_core::jsonapi::{CreateBody, CreateData, Document, ListDocument, Resource};
5
+use smbcloud_ascapi_core::Client;
6
+use smbcloud_ascapi_core::Result;
7
8
pub const RESOURCE_TYPE: &str = "bundleIds";
9
@@ -42,12 +43,28 @@ pub struct BundleIdCreateAttributes {
43
pub platform: BundleIdPlatform,
44
}
45
45
-impl Client {
46
+/// Registered reverse-DNS identifiers.
47
+///
48
+/// An extension trait rather than inherent methods, because `Client`
49
+/// lives in the core crate and Rust only allows inherent impls in the
50
+/// crate that defines the type. Import it, or the crate's `prelude`,
51
+/// to call these on a `Client`.
52
+#[async_trait]
53
+pub trait BundleIdsApi {
54
/// `GET /v1/bundleIds`, optionally filtered to an exact identifier —
55
/// check whether a bundle ID is already registered before trying to
56
/// create it, or before creating an App Store Version under an app
57
/// that uses it.
50
- pub async fn list_bundle_ids(&self, filter_identifier: Option<&str>) -> Result<Vec<BundleId>> {
58
+ async fn list_bundle_ids(&self, filter_identifier: Option<&str>) -> Result<Vec<BundleId>>;
59
+
60
+ /// `POST /v1/bundleIds` — registers a new bundle ID with the developer
61
+ /// account (Certificates, Identifiers & Profiles).
62
+ async fn create_bundle_id(&self, attributes: BundleIdCreateAttributes) -> Result<BundleId>;
63
+}
64
+
65
+#[async_trait]
66
+impl BundleIdsApi for Client {
67
+ async fn list_bundle_ids(&self, filter_identifier: Option<&str>) -> Result<Vec<BundleId>> {
68
let mut query = Vec::new();
69
if let Some(identifier) = filter_identifier {
70
query.push(("filter[identifier]", identifier));
@@ -58,9 +75,7 @@ impl Client {
75
Ok(doc.data)
76
}
77
61
- /// `POST /v1/bundleIds` — registers a new bundle ID with the developer
62
- /// account (Certificates, Identifiers & Profiles).
63
- pub async fn create_bundle_id(&self, attributes: BundleIdCreateAttributes) -> Result<BundleId> {
78
+ async fn create_bundle_id(&self, attributes: BundleIdCreateAttributes) -> Result<BundleId> {
79
let body = CreateBody {
80
data: CreateData {
81
resource_type: RESOURCE_TYPE,
crates/aso/src/lib.rs
new
+44
@@ -0,0 +1,44 @@
1
+//! App Store Connect's
2
+//! [App Metadata](https://developer.apple.com/documentation/appstoreconnectapi/app-metadata)
3
+//! resources: apps, app infos and their localizations, app store versions
4
+//! and their localizations, builds, bundle IDs, and screenshots.
5
+//!
6
+//! Everything here is an extension trait on
7
+//! [`Client`](smbcloud_ascapi_core::Client), because that type belongs to
8
+//! the core crate and Rust only allows inherent impls in the crate that
9
+//! defines a type. Import [`prelude`] to get all of them at once.
10
+//!
11
+//! ```no_run
12
+//! use smbcloud_ascapi_core::{ApiKey, Client};
13
+//! use smbcloud_ascapi_aso::prelude::*;
14
+//!
15
+//! # async fn example() -> smbcloud_ascapi_core::Result<()> {
16
+//! let api_key = ApiKey::from_p8_file("L84N624YQH", "b4e8d369-…", "AuthKey.p8")?;
17
+//! let client = Client::new(api_key);
18
+//! let apps = client.list_apps(Some("xyz.smbcloud.mailx")).await?;
19
+//! # Ok(())
20
+//! # }
21
+//! ```
22
+
23
+pub mod app;
24
+pub mod app_info;
25
+pub mod app_info_localization;
26
+pub mod app_screenshot;
27
+pub mod app_screenshot_set;
28
+pub mod app_store_version;
29
+pub mod app_store_version_localization;
30
+pub mod build;
31
+pub mod bundle_id;
32
+
33
+/// Every extension trait in this crate, for one glob import.
34
+pub mod prelude {
35
+ pub use crate::app::AppsApi;
36
+ pub use crate::app_info::AppInfosApi;
37
+ pub use crate::app_info_localization::AppInfoLocalizationsApi;
38
+ pub use crate::app_screenshot::AppScreenshotsApi;
39
+ pub use crate::app_screenshot_set::AppScreenshotSetsApi;
40
+ pub use crate::app_store_version::AppStoreVersionsApi;
41
+ pub use crate::app_store_version_localization::AppStoreVersionLocalizationsApi;
42
+ pub use crate::build::BuildsApi;
43
+ pub use crate::bundle_id::BundleIdsApi;
44
+}
crates/cli/Cargo.toml
+7
-2
@@ -5,7 +5,8 @@ edition.workspace = true
5
authors.workspace = true
6
license.workspace = true
7
repository.workspace = true
8
-description = "CLI for adding/updating App Store Connect app metadata, built on smbcloud-ascapi."
8
+description = "CLI and MCP server for App Store Connect: issue Apple signing certificates and manage app metadata."
9
+readme = "README.md"
10
11
[[bin]]
12
name = "ascapi"
@@ -17,5 +18,9 @@ base64 = { workspace = true }
18
clap = { workspace = true, features = ["derive", "env"] }
19
serde = { workspace = true }
20
serde_json = { workspace = true }
20
-smbcloud-ascapi = { workspace = true }
21
+smbcloud-ascapi-aso = { workspace = true }
22
+smbcloud-ascapi-core = { workspace = true }
23
+smbcloud-ascapi-signing = { workspace = true }
24
+smbcloud-ascapi-frontend = { workspace = true }
25
+smbcloud-ascapi-mcp = { workspace = true }
26
tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
crates/cli/README.md
new
+84
@@ -0,0 +1,84 @@
1
+# App Store Connect Signing
2
+
3
+`ascapi` issues and inspects Apple signing certificates from the terminal
4
+or as an MCP server, without a trip to the developer portal. It also
5
+covers App Store Connect's App Metadata surface: apps, app infos, app
6
+store versions, bundle IDs, screenshots, and their localizations.
7
+
8
+MCP Registry name: `mcp-name: io.github.smbcloudXYZ/ascapi`
9
+
10
+## Install
11
+
12
+```bash
13
+cargo install smbcloud-ascapi-cli
14
+```
15
+
16
+## Credentials
17
+
18
+All three come from App Store Connect → Users and Access → Integrations →
19
+App Store Connect API:
20
+
21
+```bash
22
+export ASC_API_KEY=<key id>
23
+export ASC_ISSUER_ID=<issuer id>
24
+# Optional. Defaults to ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8
25
+export ASC_PRIVATE_KEY_PATH=/path/to/AuthKey_XXXXXXXXXX.p8
26
+```
27
+
28
+## Signing certificates
29
+
30
+```bash
31
+ascapi certificates list --type distribution
32
+ascapi certificates create --type mac-installer-distribution --out-dir ~/certs
33
+```
34
+
35
+`create` generates an RSA 2048 key pair locally, sends Apple only a
36
+signing request, and writes both halves to `--out-dir`. Two things follow
37
+from that and are worth knowing before you run it:
38
+
39
+- **Apple never has your private key.** A certificate whose key file is
40
+ lost is permanently unusable, and no re-download recovers it. Back up
41
+ the output directory somewhere encrypted.
42
+- **An expired certificate cannot be renewed.** There is no such
43
+ operation; you issue a new one, and every provisioning profile that
44
+ embedded the old certificate has to be regenerated.
45
+
46
+The private key is written before the request is sent, so a failure
47
+mid-flight leaves an unused key rather than a certificate whose key was
48
+never saved.
49
+
50
+## MCP server
51
+
52
+```bash
53
+ascapi --mcp
54
+```
55
+
56
+Speaks MCP over stdio and exposes 28 tools: every operation the command
57
+line has except `certificates revoke`. That covers apps, bundle IDs, app
58
+store versions, both kinds of localization, screenshot sets, screenshot
59
+upload, and certificates.
60
+
61
+Twelve are read-only. Five delete something and are annotated
62
+`destructiveHint`, so a client can gate them: version, localization,
63
+screenshot set, and screenshot deletes, all of which can be recreated by
64
+re-running the tool that made them.
65
+
66
+Credentials resolve per call, so the server starts and answers
67
+`tools/list` even when unconfigured, then fails with a message naming what
68
+is missing.
69
+
70
+Two deliberate absences:
71
+
72
+- **No revocation tool.** Revoking a signing certificate invalidates every
73
+ provisioning profile embedding it, for every teammate and every CI job,
74
+ at once and irreversibly. That is the one delete no confirmation string a
75
+ model types on your behalf makes safe, so `ascapi certificates revoke`
76
+ stays on the command line, where a human is the one typing. A test fails
77
+ the build if it ever appears in the tool list.
78
+- **No key material in tool results.** `certificate_create` returns the
79
+ path it wrote the key to, never the key itself, because tool results are
80
+ read by a model and end up in transcripts.
81
+
82
+## Copyright
83
+
84
+© 2026 [Splitfire AB](https://5mb.app) ([smbCloud](https://smbcloud.xyz)).
crates/cli/src/main.rs
+51
-19
@@ -1,20 +1,22 @@
1
use anyhow::{Context, Result};
2
use clap::{Parser, Subcommand, ValueEnum};
3
-use smbcloud_ascapi::app::AppUpdateAttributes;
4
-use smbcloud_ascapi::app_info_localization::{
3
+use smbcloud_ascapi_aso::app::AppUpdateAttributes;
4
+use smbcloud_ascapi_aso::app_info_localization::{
5
AppInfoLocalizationCreateAttributes, AppInfoLocalizationUpdateAttributes,
6
};
7
-use smbcloud_ascapi::app_screenshot_set::{
7
+use smbcloud_ascapi_aso::app_screenshot_set::{
8
AppScreenshotSetCreateAttributes, ScreenshotDisplayType,
9
};
10
-use smbcloud_ascapi::app_store_version::{AppStoreVersionCreateAttributes, Platform};
11
-use smbcloud_ascapi::app_store_version_localization::{
10
+use smbcloud_ascapi_aso::app_store_version::{AppStoreVersionCreateAttributes, Platform};
11
+use smbcloud_ascapi_aso::app_store_version_localization::{
12
AppStoreVersionLocalizationCreateAttributes, AppStoreVersionLocalizationFields,
13
};
14
-use smbcloud_ascapi::bundle_id::{BundleIdCreateAttributes, BundleIdPlatform};
15
-use smbcloud_ascapi::certificate::{CertificateCreateAttributes, CertificateType};
16
-use smbcloud_ascapi::csr::generate_certificate_request;
17
-use smbcloud_ascapi::{ApiKey, Client};
14
+use smbcloud_ascapi_aso::bundle_id::{BundleIdCreateAttributes, BundleIdPlatform};
15
+use smbcloud_ascapi_aso::prelude::*;
16
+use smbcloud_ascapi_core::{ApiKey, Client};
17
+use smbcloud_ascapi_signing::certificate::{CertificateCreateAttributes, CertificateType};
18
+use smbcloud_ascapi_signing::csr::generate_certificate_request;
19
+use smbcloud_ascapi_signing::prelude::*;
20
use std::path::PathBuf;
21
22
/// Add/update App Store Connect app metadata (apps, app infos, app store
@@ -23,13 +25,22 @@ use std::path::PathBuf;
25
#[command(name = "ascapi", version, about)]
26
struct Cli {
27
/// App Store Connect API key ID (Users and Access → Integrations → App
26
- /// Store Connect API).
27
- #[arg(long, env = "ASC_API_KEY")]
28
- key_id: String,
28
+ /// Store Connect API). Not required with `--mcp`, which resolves
29
+ /// credentials per tool call so an unconfigured server can still list
30
+ /// its tools.
31
+ #[arg(long, env = "ASC_API_KEY", required_unless_present = "mcp")]
32
+ key_id: Option<String>,
33
34
/// App Store Connect API issuer ID (same page as the key).
31
- #[arg(long, env = "ASC_ISSUER_ID")]
32
- issuer_id: String,
35
+ #[arg(long, env = "ASC_ISSUER_ID", required_unless_present = "mcp")]
36
+ issuer_id: Option<String>,
37
+
38
+ /// Run as an MCP server over stdio instead of executing a subcommand.
39
+ ///
40
+ /// stdout carries the JSON-RPC stream in this mode, so nothing else
41
+ /// may be written to it.
42
+ #[arg(long)]
43
+ mcp: bool,
44
45
/// Path to the key's .p8 private key file. Defaults to
46
/// `~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8`, matching
@@ -43,7 +54,7 @@ struct Cli {
54
dry_run: bool,
55
56
#[command(subcommand)]
46
- command: Command,
57
+ command: Option<Command>,
58
}
59
60
#[derive(Subcommand)]
@@ -441,19 +452,38 @@ fn dry_run_guard(dry_run: bool, value: &impl serde::Serialize) -> Result<bool> {
452
async fn main() -> Result<()> {
453
let cli = Cli::parse();
454
455
+ if cli.mcp {
456
+ return smbcloud_ascapi_mcp::serve().await;
457
+ }
458
+
459
+ let key_id = cli
460
+ .key_id
461
+ .clone()
462
+ .context("--key-id is required (or set ASC_API_KEY)")?;
463
+ let issuer_id = cli
464
+ .issuer_id
465
+ .clone()
466
+ .context("--issuer-id is required (or set ASC_ISSUER_ID)")?;
467
+
468
let private_key_path = cli.private_key_path.clone().unwrap_or_else(|| {
469
let mut path = dirs_home();
470
path.push(".appstoreconnect");
471
path.push("private_keys");
448
- path.push(format!("AuthKey_{}.p8", cli.key_id));
472
+ path.push(format!("AuthKey_{key_id}.p8"));
473
path
474
});
475
452
- let api_key = ApiKey::from_p8_file(&cli.key_id, &cli.issuer_id, &private_key_path)
476
+ let api_key = ApiKey::from_p8_file(&key_id, &issuer_id, &private_key_path)
477
.with_context(|| format!("loading App Store Connect API key from {private_key_path:?}"))?;
478
let client = Client::new(api_key);
479
456
- match cli.command {
480
+ let Some(command) = cli.command else {
481
+ anyhow::bail!(
482
+ "no subcommand given; run `ascapi --help`, or `ascapi --mcp` for the MCP server"
483
+ )
484
+ };
485
+
486
+ match command {
487
Command::Apps { command } => run_apps(&client, command, cli.dry_run).await,
488
Command::BundleIds { command } => run_bundle_ids(&client, command, cli.dry_run).await,
489
Command::AppStoreVersions { command } => {
@@ -819,7 +849,9 @@ struct CertificateSummary {
849
expired: Option<bool>,
850
}
851
822
-fn summarize(certificate: &smbcloud_ascapi::certificate::Certificate) -> CertificateSummary {
852
+fn summarize(
853
+ certificate: &smbcloud_ascapi_signing::certificate::Certificate,
854
+) -> CertificateSummary {
855
let expiration_date = certificate.attributes.expiration_date.clone();
856
// Lexicographic comparison is sound for ISO-8601 UTC timestamps, which
857
// is what Apple returns, and avoids a date-parsing dependency for a
crates/core/Cargo.toml
new
+18
@@ -0,0 +1,18 @@
1
+[package]
2
+name = "smbcloud-ascapi-core"
3
+version.workspace = true
4
+edition.workspace = true
5
+authors.workspace = true
6
+license.workspace = true
7
+repository.workspace = true
8
+description = "Shared transport for the App Store Connect API: JWT auth, the HTTP client, JSON:API envelopes, and error types."
9
+
10
+[lib]
11
+path = "src/lib.rs"
12
+
13
+[dependencies]
14
+jsonwebtoken = { workspace = true }
15
+reqwest = { workspace = true, features = ["json", "rustls-tls-native-roots"] }
16
+serde = { workspace = true, features = ["derive"] }
17
+serde_json = { workspace = true }
18
+thiserror = { workspace = true }
crates/core/src/auth.rs
renamed
crates/core/src/client.rs
renamed
+11
-6
@@ -20,9 +20,14 @@ struct CachedToken {
20
21
/// Thin async HTTP client for the App Store Connect API. Handles JWT minting
22
/// (cached and refreshed automatically) and JSON:API request/response
23
-/// plumbing. Resource-specific calls (apps, app store versions, bundle IDs,
24
-/// ...) are implemented as additional `impl Client` blocks alongside each
25
-/// resource's types, in their own modules.
23
+/// plumbing.
24
+///
25
+/// Resource-specific calls live in the domain crates as extension traits on
26
+/// this type: `smbcloud-ascapi-aso` for App Metadata, `smbcloud-ascapi-signing`
27
+/// for certificates. [`Client::request`], [`Client::request_no_content`], and
28
+/// [`Client::upload_bytes`] are the low-level seam those traits build on, and
29
+/// are public for that reason rather than because callers should reach for
30
+/// them directly.
31
pub struct Client {
32
http: reqwest::Client,
33
api_key: ApiKey,
@@ -71,7 +76,7 @@ impl Client {
76
/// Send a request and decode a JSON:API response body into `T`. Use
77
/// `request_no_content` instead for calls (typically `DELETE`) that
78
/// return an empty `204` body.
74
- pub(crate) async fn request<B: Serialize, T: DeserializeOwned>(
79
+ pub async fn request<B: Serialize, T: DeserializeOwned>(
80
&self,
81
method: Method,
82
path: &str,
@@ -86,7 +91,7 @@ impl Client {
91
}
92
93
/// Send a request that returns no body on success (typically `DELETE`).
89
- pub(crate) async fn request_no_content<B: Serialize>(
94
+ pub async fn request_no_content<B: Serialize>(
95
&self,
96
method: Method,
97
path: &str,
@@ -129,7 +134,7 @@ impl Client {
134
/// upload URLs are pre-signed and carry their own auth in
135
/// `request_headers`; sending our JWT alongside would be wrong for a
136
/// host that isn't `api.appstoreconnect.apple.com`.
132
- pub(crate) async fn upload_bytes(
137
+ pub async fn upload_bytes(
138
&self,
139
method: Method,
140
url: &str,
crates/core/src/error.rs
renamed
crates/core/src/jsonapi.rs
renamed
crates/core/src/lib.rs
new
+23
@@ -0,0 +1,23 @@
1
+//! Shared transport for the App Store Connect API.
2
+//!
3
+//! Everything the domain crates need and nothing they disagree about: the
4
+//! ES256 JWT auth, the HTTP client that caches those tokens, the JSON:API
5
+//! envelope generics, and the error type.
6
+//!
7
+//! The domain crates ([`smbcloud-ascapi-aso`] for App Metadata,
8
+//! [`smbcloud-ascapi-signing`] for certificates) add their resources as
9
+//! extension traits on [`Client`], since Rust only allows inherent impls
10
+//! in the crate that defines a type. Import a domain crate's `prelude` to
11
+//! call its methods on a client.
12
+//!
13
+//! [`smbcloud-ascapi-aso`]: https://docs.rs/smbcloud-ascapi-aso
14
+//! [`smbcloud-ascapi-signing`]: https://docs.rs/smbcloud-ascapi-signing
15
+
16
+pub mod auth;
17
+pub mod client;
18
+pub mod error;
19
+pub mod jsonapi;
20
+
21
+pub use auth::ApiKey;
22
+pub use client::Client;
23
+pub use error::{Error, Result};
crates/frontend/Cargo.toml
new
+20
@@ -0,0 +1,20 @@
1
+[package]
2
+name = "smbcloud-ascapi-frontend"
3
+version.workspace = true
4
+edition.workspace = true
5
+authors.workspace = true
6
+license.workspace = true
7
+repository.workspace = true
8
+description = "Shared operations behind the ascapi command line and MCP surfaces: credential resolution, result shaping, and certificate issuance."
9
+
10
+[lib]
11
+path = "src/lib.rs"
12
+
13
+[dependencies]
14
+base64 = { workspace = true }
15
+schemars = { workspace = true }
16
+serde = { workspace = true, features = ["derive"] }
17
+serde_json = { workspace = true }
18
+smbcloud-ascapi-aso = { workspace = true }
19
+smbcloud-ascapi-core = { workspace = true }
20
+smbcloud-ascapi-signing = { workspace = true }
crates/frontend/src/certificates.rs
new
+247
@@ -0,0 +1,247 @@
1
+//! Certificate operations shared by both front ends.
2
+
3
+use serde::Serialize;
4
+use smbcloud_ascapi_core::Client;
5
+use smbcloud_ascapi_signing::certificate::CertificateType;
6
+use smbcloud_ascapi_signing::prelude::*;
7
+
8
+use crate::time::{is_expired, now_iso8601};
9
+
10
+/// Map a CLI/MCP certificate-type string onto the API enum.
11
+pub fn certificate_type_from_str(value: &str) -> Result<CertificateType, String> {
12
+ use CertificateType;
13
+ match value {
14
+ "development" => Ok(CertificateType::Development),
15
+ "distribution" => Ok(CertificateType::Distribution),
16
+ "mac_app_distribution" => Ok(CertificateType::MacAppDistribution),
17
+ "mac_installer_distribution" => Ok(CertificateType::MacInstallerDistribution),
18
+ "developer_id_application" => Ok(CertificateType::DeveloperIdApplication),
19
+ other => Err(format!(
20
+ "unknown certificate type {other:?}; expected one of development, distribution, \
21
+ mac_app_distribution, mac_installer_distribution, developer_id_application"
22
+ )),
23
+ }
24
+}
25
+
26
+/// Defines the MCP tool implementations on `$server`, with each tool's
27
+/// wire name supplied by the embedder.
28
+///
29
+/// Names are parameters rather than literals so a host that re-exposes
30
+/// this contract can namespace them without forking the bodies, exactly as
31
+/// `xcrs_mcp_tools!` allows in `smbcloud-cli`.
32
+/// A certificate as reported to callers.
33
+///
34
+/// Note what is missing: `certificateContent`. It is large, it is never
35
+/// needed to decide what to do next, and keeping it out means a tool
36
+/// result can never carry a certificate body into a model's context.
37
+#[derive(Debug, Clone, Serialize, schemars::JsonSchema)]
38
+pub struct CertificateSummary {
39
+ pub id: String,
40
+ pub name: Option<String>,
41
+ pub certificate_type: Option<String>,
42
+ pub serial_number: Option<String>,
43
+ pub expiration_date: Option<String>,
44
+ /// Computed locally: App Store Connect offers no filter for it and
45
+ /// returns expired certificates alongside valid ones.
46
+ pub expired: Option<bool>,
47
+}
48
+
49
+impl CertificateSummary {
50
+ pub fn from_resource(
51
+ certificate: &smbcloud_ascapi_signing::certificate::Certificate,
52
+ now: &str,
53
+ ) -> Self {
54
+ let expiration_date = certificate.attributes.expiration_date.clone();
55
+ let expired = expiration_date
56
+ .as_ref()
57
+ .map(|at| is_expired(at.as_str(), now));
58
+
59
+ Self {
60
+ id: certificate.id.clone(),
61
+ name: certificate.attributes.name.clone(),
62
+ certificate_type: certificate
63
+ .attributes
64
+ .certificate_type
65
+ .map(|t| t.as_api_str().to_string()),
66
+ serial_number: certificate.attributes.serial_number.clone(),
67
+ expiration_date,
68
+ expired,
69
+ }
70
+ }
71
+}
72
+
73
+/// The result of issuing a certificate.
74
+///
75
+/// Carries paths, never key material.
76
+#[derive(Debug, Clone, Serialize, schemars::JsonSchema)]
77
+pub struct IssuedCertificate {
78
+ pub certificate: CertificateSummary,
79
+ /// Path the private key was written to. The key itself is never
80
+ /// included: this is the whole point of returning a path.
81
+ pub private_key_path: String,
82
+ pub certificate_path: String,
83
+ /// Copy-pasteable commands to get the pair into a keychain.
84
+ pub next_steps: Vec<String>,
85
+}
86
+
87
+/// Generate a key pair, have Apple certify it, and write both halves.
88
+///
89
+/// Shared by the CLI and the MCP tool so the ordering guarantee (key
90
+/// written before the request is sent) has exactly one implementation.
91
+pub async fn issue_certificate(
92
+ client: &Client,
93
+ certificate_type: CertificateType,
94
+ common_name: &str,
95
+ out_dir: &std::path::Path,
96
+) -> Result<IssuedCertificate, String> {
97
+ use smbcloud_ascapi_signing::certificate::CertificateCreateAttributes;
98
+
99
+ let request = smbcloud_ascapi_signing::csr::generate_certificate_request(common_name)
100
+ .map_err(|error| format!("generating the RSA 2048 key pair and CSR: {error}"))?;
101
+
102
+ std::fs::create_dir_all(out_dir)
103
+ .map_err(|error| format!("creating {}: {error}", out_dir.display()))?;
104
+
105
+ let stem = certificate_type.as_api_str().to_lowercase();
106
+ let key_path = out_dir.join(format!("{stem}.key.pem"));
107
+
108
+ // Before the network call, deliberately. A failure after Apple has
109
+ // issued the certificate would leave a certificate whose key was never
110
+ // persisted, which is unrecoverable and has consumed one of the team's
111
+ // limited slots. A failure here leaves an unused key, which costs
112
+ // nothing.
113
+ write_private_key(&key_path, request.private_key_pem())
114
+ .map_err(|error| format!("writing the private key to {}: {error}", key_path.display()))?;
115
+
116
+ let certificate = client
117
+ .create_certificate(CertificateCreateAttributes {
118
+ csr_content: request.csr_pem().to_string(),
119
+ certificate_type,
120
+ })
121
+ .await
122
+ .map_err(|error| error.to_string())?;
123
+
124
+ let cer_path = out_dir.join(format!("{stem}.cer"));
125
+ if let Some(content) = certificate.attributes.certificate_content.as_deref() {
126
+ let der = base64_decode(content)?;
127
+ std::fs::write(&cer_path, der)
128
+ .map_err(|error| format!("writing {}: {error}", cer_path.display()))?;
129
+ }
130
+
131
+ Ok(IssuedCertificate {
132
+ certificate: CertificateSummary::from_resource(&certificate, &now_iso8601()),
133
+ private_key_path: key_path.display().to_string(),
134
+ certificate_path: cer_path.display().to_string(),
135
+ next_steps: vec![
136
+ format!(
137
+ "openssl pkcs12 -export -inkey {} -in {} -out {stem}.p12",
138
+ key_path.display(),
139
+ cer_path.display()
140
+ ),
141
+ format!(
142
+ "security import {stem}.p12 -k ~/Library/Keychains/login.keychain-db -T /usr/bin/codesign"
143
+ ),
144
+ "security find-identity -v -p codesigning".to_string(),
145
+ ],
146
+ })
147
+}
148
+
149
+/// Write a private key with owner-only permissions, set at creation time
150
+/// rather than chmod'ed afterwards so the key is never briefly readable by
151
+/// anyone else.
152
+pub fn write_private_key(path: &std::path::Path, pem: &str) -> std::io::Result<()> {
153
+ use std::io::Write;
154
+
155
+ let mut options = std::fs::OpenOptions::new();
156
+ options.write(true).create(true).truncate(true);
157
+ #[cfg(unix)]
158
+ {
159
+ use std::os::unix::fs::OpenOptionsExt;
160
+ options.mode(0o600);
161
+ }
162
+ let mut file = options.open(path)?;
163
+ file.write_all(pem.as_bytes())?;
164
+ file.sync_all()
165
+}
166
+
167
+fn base64_decode(input: &str) -> Result<Vec<u8>, String> {
168
+ use base64::Engine;
169
+ base64::engine::general_purpose::STANDARD
170
+ .decode(input.trim())
171
+ .map_err(|error| format!("decoding the certificate Apple returned: {error}"))
172
+}
173
+
174
+#[cfg(test)]
175
+mod tests {
176
+ use super::*;
177
+
178
+ #[test]
179
+ fn expiry_comparison_matches_calendar_order() {
180
+ assert!(is_expired("2026-08-05T20:56:53", "2026-08-06T04:32:19"));
181
+ assert!(!is_expired("2027-02-01T22:12:15", "2026-08-06T04:32:19"));
182
+ // Same day, hours apart: the case that decides whether a
183
+ // certificate expiring later today reads as already dead.
184
+ assert!(!is_expired("2026-08-06T04:37:57", "2026-08-06T04:32:19"));
185
+ assert!(is_expired("2026-08-06T04:31:00", "2026-08-06T04:32:19"));
186
+ }
187
+
188
+ #[test]
189
+ fn now_is_a_fixed_width_sortable_timestamp() {
190
+ let now = now_iso8601();
191
+ assert_eq!(now.len(), 19, "expected YYYY-MM-DDTHH:MM:SS, got {now:?}");
192
+ assert_eq!(&now[4..5], "-");
193
+ assert_eq!(&now[10..11], "T");
194
+ // Sanity bound: a wildly wrong civil-date conversion would land
195
+ // outside this window and silently mark every certificate expired.
196
+ assert!(
197
+ now.as_str() > "2024-01-01T00:00:00",
198
+ "clock looks wrong: {now}"
199
+ );
200
+ assert!(
201
+ now.as_str() < "2100-01-01T00:00:00",
202
+ "clock looks wrong: {now}"
203
+ );
204
+ }
205
+
206
+ #[test]
207
+ fn certificate_type_strings_are_the_documented_set() {
208
+ for value in [
209
+ "development",
210
+ "distribution",
211
+ "mac_app_distribution",
212
+ "mac_installer_distribution",
213
+ "developer_id_application",
214
+ ] {
215
+ certificate_type_from_str(value)
216
+ .unwrap_or_else(|_| panic!("{value} should be accepted"));
217
+ }
218
+ let error = certificate_type_from_str("apple_distribution").expect_err("should reject");
219
+ // The error has to list the valid values: a model that guessed
220
+ // wrong needs to correct itself without another round trip.
221
+ assert!(error.contains("distribution"), "unhelpful error: {error}");
222
+ }
223
+
224
+ #[test]
225
+ fn issued_certificate_never_serializes_key_material() {
226
+ let issued = IssuedCertificate {
227
+ certificate: CertificateSummary {
228
+ id: "ABC123".to_string(),
229
+ name: Some("Apple Distribution: Example".to_string()),
230
+ certificate_type: Some("DISTRIBUTION".to_string()),
231
+ serial_number: Some("1A2B3C".to_string()),
232
+ expiration_date: Some("2027-08-06T00:00:00".to_string()),
233
+ expired: Some(false),
234
+ },
235
+ private_key_path: "/tmp/out/distribution.key.pem".to_string(),
236
+ certificate_path: "/tmp/out/distribution.cer".to_string(),
237
+ next_steps: vec!["security find-identity -v -p codesigning".to_string()],
238
+ };
239
+
240
+ let json = serde_json::to_string(&issued).expect("serializes");
241
+ assert!(!json.contains("BEGIN PRIVATE KEY"));
242
+ assert!(!json.contains("BEGIN CERTIFICATE"));
243
+ // The path is the point: it tells the caller where to look without
244
+ // putting the secret into a transcript.
245
+ assert!(json.contains("distribution.key.pem"));
246
+ }
247
+}
crates/frontend/src/enums.rs
new
+86
@@ -0,0 +1,86 @@
1
+//! String to enum mapping for values that arrive as text from a command
2
+//! line or a tool call.
3
+//!
4
+//! Each mapper's error lists the accepted values. That matters more for
5
+//! the MCP surface than the CLI one: clap rejects a bad value before the
6
+//! program runs, but a model that guessed wrong only learns from the
7
+//! error text, and a bare "invalid value" costs it another round trip.
8
+
9
+use smbcloud_ascapi_aso::app_screenshot_set::ScreenshotDisplayType;
10
+use smbcloud_ascapi_aso::app_store_version::Platform;
11
+use smbcloud_ascapi_aso::bundle_id::BundleIdPlatform;
12
+
13
+pub fn platform_from_str(value: &str) -> Result<Platform, String> {
14
+ match value.to_ascii_lowercase().as_str() {
15
+ "ios" => Ok(Platform::Ios),
16
+ "mac_os" | "macos" => Ok(Platform::MacOs),
17
+ "tv_os" | "tvos" => Ok(Platform::TvOs),
18
+ "vision_os" | "visionos" => Ok(Platform::VisionOs),
19
+ other => Err(format!(
20
+ "unknown platform {other:?}; expected one of ios, mac_os, tv_os, vision_os"
21
+ )),
22
+ }
23
+}
24
+
25
+pub fn bundle_id_platform_from_str(value: &str) -> Result<BundleIdPlatform, String> {
26
+ match value.to_ascii_lowercase().as_str() {
27
+ // visionOS shares the iOS identifier namespace, so there is no
28
+ // separate value to offer here.
29
+ "ios" => Ok(BundleIdPlatform::Ios),
30
+ "mac_os" | "macos" => Ok(BundleIdPlatform::MacOs),
31
+ "universal" => Ok(BundleIdPlatform::Universal),
32
+ other => Err(format!(
33
+ "unknown bundle ID platform {other:?}; expected one of ios, mac_os, universal"
34
+ )),
35
+ }
36
+}
37
+
38
+/// App Store Connect's display types are already screaming snake case, so
39
+/// this accepts them verbatim and only normalizes the casing.
40
+pub fn display_type_from_str(value: &str) -> Result<ScreenshotDisplayType, String> {
41
+ let upper = value.to_ascii_uppercase();
42
+ serde_json::from_value::<ScreenshotDisplayType>(serde_json::Value::String(upper.clone()))
43
+ .map_err(|_| {
44
+ format!(
45
+ "unknown screenshot display type {value:?}; expected an App Store Connect \
46
+ display type such as APP_IPHONE_67, APP_IPAD_PRO_129, APP_APPLE_VISION_PRO, \
47
+ or APP_DESKTOP"
48
+ )
49
+ })
50
+}
51
+
52
+#[cfg(test)]
53
+mod tests {
54
+ use super::*;
55
+
56
+ #[test]
57
+ fn platform_accepts_both_spellings() {
58
+ assert_eq!(platform_from_str("visionos").unwrap(), Platform::VisionOs);
59
+ assert_eq!(platform_from_str("VISION_OS").unwrap(), Platform::VisionOs);
60
+ }
61
+
62
+ #[test]
63
+ fn errors_name_the_accepted_values() {
64
+ // A model that guessed wrong has to be able to fix itself from the
65
+ // error alone, without another call.
66
+ let error = platform_from_str("watchos").unwrap_err();
67
+ assert!(
68
+ error.contains("ios") && error.contains("vision_os"),
69
+ "{error}"
70
+ );
71
+
72
+ let error = display_type_from_str("iphone").unwrap_err();
73
+ assert!(error.contains("APP_IPHONE_67"), "{error}");
74
+
75
+ let error = bundle_id_platform_from_str("visionos").unwrap_err();
76
+ assert!(error.contains("universal"), "{error}");
77
+ }
78
+
79
+ #[test]
80
+ fn display_type_round_trips_a_real_value() {
81
+ assert_eq!(
82
+ display_type_from_str("app_iphone_67").unwrap(),
83
+ ScreenshotDisplayType::Iphone67
84
+ );
85
+ }
86
+}
crates/frontend/src/env.rs
new
+44
@@ -0,0 +1,44 @@
1
+//! Credential resolution from the environment.
2
+
3
+use smbcloud_ascapi_core::ApiKey;
4
+use smbcloud_ascapi_core::Error;
5
+
6
+/// Resolve an App Store Connect API key from the environment.
7
+///
8
+/// Deliberately per-call rather than at startup: an MCP server that
9
+/// refuses to start without credentials cannot answer `tools/list`, which
10
+/// is the first thing every client asks and the only way a user discovers
11
+/// what configuration is missing. Unconfigured servers should list their
12
+/// tools and fail with a useful message when one is called.
13
+pub fn api_key_from_env() -> Result<ApiKey, String> {
14
+ let key_id = std::env::var("ASC_API_KEY")
15
+ .map_err(|_| "ASC_API_KEY is not set (App Store Connect API key ID)".to_string())?;
16
+ let issuer_id = std::env::var("ASC_ISSUER_ID")
17
+ .map_err(|_| "ASC_ISSUER_ID is not set (App Store Connect issuer ID)".to_string())?;
18
+
19
+ let path = match std::env::var("ASC_PRIVATE_KEY_PATH") {
20
+ Ok(path) => std::path::PathBuf::from(path),
21
+ Err(_) => {
22
+ let home = std::env::var("HOME").map_err(|_| {
23
+ "neither ASC_PRIVATE_KEY_PATH nor HOME is set, so the .p8 key cannot be located"
24
+ .to_string()
25
+ })?;
26
+ std::path::PathBuf::from(home)
27
+ .join(".appstoreconnect")
28
+ .join("private_keys")
29
+ .join(format!("AuthKey_{key_id}.p8"))
30
+ }
31
+ };
32
+
33
+ ApiKey::from_p8_file(&key_id, &issuer_id, &path).map_err(|error| match error {
34
+ // The most common misconfiguration by a wide margin, and the
35
+ // default-path message needs to name the path it guessed.
36
+ Error::PrivateKeyRead { .. } => {
37
+ format!(
38
+ "could not read the App Store Connect private key at {}",
39
+ path.display()
40
+ )
41
+ }
42
+ other => other.to_string(),
43
+ })
44
+}
crates/frontend/src/lib.rs
new
+30
@@ -0,0 +1,30 @@
1
+//! Operations shared by the `ascapi` command line and its MCP server.
2
+//!
3
+//! Both surfaces need the same things: resolve credentials, call the App
4
+//! Store Connect client, and shape the result into something worth showing
5
+//! a human or handing a model. Putting that here means the two front ends
6
+//! cannot drift, and in particular that the ordering guarantee in
7
+//! [`certificates::issue_certificate`] (private key written before the
8
+//! network call) has exactly one implementation.
9
+//!
10
+//! Two rules the result types are built around, because one of the
11
+//! consumers is a language model:
12
+//!
13
+//! - **No key material in a result.** [`certificates::IssuedCertificate`]
14
+//! carries the path a key was written to, never the key. Enforced by
15
+//! construction rather than filtered at the edge, since a filter is one
16
+//! refactor away from being bypassed.
17
+//! - **No certificate bodies either.** They are large, never needed to
18
+//! decide what to do next, and would otherwise land in a transcript.
19
+
20
+pub mod certificates;
21
+pub mod enums;
22
+pub mod env;
23
+pub mod time;
24
+
25
+pub use certificates::{
26
+ certificate_type_from_str, issue_certificate, CertificateSummary, IssuedCertificate,
27
+};
28
+pub use enums::{bundle_id_platform_from_str, display_type_from_str, platform_from_str};
29
+pub use env::api_key_from_env;
30
+pub use time::{is_expired, now_iso8601};
crates/frontend/src/time.rs
new
+45
@@ -0,0 +1,45 @@
1
+//! Timestamp helpers for comparing against App Store Connect's expiry
2
+//! strings without a date-parsing dependency.
3
+
4
+/// Whether an ISO-8601 UTC timestamp is in the past.
5
+///
6
+/// Lexicographic comparison is sound for the fixed-width UTC timestamps
7
+/// App Store Connect returns, and avoids a date-parsing dependency for a
8
+/// field that is only ever compared and displayed.
9
+pub fn is_expired(expiration_date: &str, now: &str) -> bool {
10
+ expiration_date < now
11
+}
12
+
13
+/// Current UTC time as `YYYY-MM-DDTHH:MM:SS`, for comparison against
14
+/// Apple's expiry strings.
15
+pub fn now_iso8601() -> String {
16
+ let secs = std::time::SystemTime::now()
17
+ .duration_since(std::time::UNIX_EPOCH)
18
+ .unwrap_or_default()
19
+ .as_secs() as i64;
20
+
21
+ // days_from_civil, inverted. Shifting the era to March makes the leap
22
+ // day the last day of the year, which removes every special case.
23
+ let days = secs.div_euclid(86_400);
24
+ let secs_of_day = secs.rem_euclid(86_400);
25
+ let z = days + 719_468;
26
+ let era = z.div_euclid(146_097);
27
+ let doe = z.rem_euclid(146_097);
28
+ let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
29
+ let y = yoe + era * 400;
30
+ let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
31
+ let mp = (5 * doy + 2) / 153;
32
+ let d = doy - (153 * mp + 2) / 5 + 1;
33
+ let m = if mp < 10 { mp + 3 } else { mp - 9 };
34
+ let y = if m <= 2 { y + 1 } else { y };
35
+
36
+ format!(
37
+ "{:04}-{:02}-{:02}T{:02}:{:02}:{:02}",
38
+ y,
39
+ m,
40
+ d,
41
+ secs_of_day / 3600,
42
+ (secs_of_day % 3600) / 60,
43
+ secs_of_day % 60
44
+ )
45
+}
crates/mcp/Cargo.toml
new
+25
@@ -0,0 +1,25 @@
1
+[package]
2
+name = "smbcloud-ascapi-mcp"
3
+version.workspace = true
4
+edition.workspace = true
5
+authors.workspace = true
6
+license.workspace = true
7
+repository.workspace = true
8
+description = "MCP server exposing the App Store Connect operations from smbcloud-ascapi over stdio."
9
+
10
+[lib]
11
+path = "src/lib.rs"
12
+
13
+[dependencies]
14
+anyhow = { workspace = true }
15
+rmcp = { workspace = true }
16
+schemars = { workspace = true }
17
+serde = { workspace = true, features = ["derive"] }
18
+serde_json = { workspace = true }
19
+smbcloud-ascapi-aso = { workspace = true }
20
+smbcloud-ascapi-core = { workspace = true }
21
+smbcloud-ascapi-signing = { workspace = true }
22
+smbcloud-ascapi-frontend = { workspace = true }
23
+
24
+[dev-dependencies]
25
+tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
crates/mcp/src/lib.rs
new
+881
@@ -0,0 +1,881 @@
1
+//! App Store Connect MCP contract.
2
+//!
3
+//! Defines the canonical tool set exposed by `ascapi --mcp`. Each name is
4
+//! supplied by the embedder through [`crate::ascapi_mcp_tools`], so the
5
+//! standalone binary and any host that re-exposes this contract share one
6
+//! implementation and one public surface. Same arrangement `xcrs` uses in
7
+//! `smbcloud-cli`.
8
+//!
9
+//! # Two rules this server is built around
10
+//!
11
+//! **stdout belongs to the protocol.** The stdio transport carries
12
+//! JSON-RPC on stdout, so a stray `println!` anywhere beneath a tool call
13
+//! corrupts the stream, and the failure surfaces as a parse error in the
14
+//! client a long way from its cause. Nothing in this path may write to
15
+//! stdout; diagnostics go to stderr.
16
+//!
17
+//! **Tool results are read by a model.** Private keys and raw certificate
18
+//! bodies never appear in a result; see
19
+//! [`smbcloud_ascapi_frontend`] for where that is enforced.
20
+//!
21
+//! # What is deliberately absent
22
+//!
23
+//! Certificate revocation. `ascapi certificates revoke` exists on the
24
+//! command line and is intentionally not a tool: revoking a distribution
25
+//! certificate invalidates every provisioning profile embedding it, for
26
+//! every teammate and every CI job, at once and irreversibly. That is not
27
+//! an action a language model should take from a prompt, and no
28
+//! confirmation string typed by the model rather than the human makes it
29
+//! safer. Deletes that are scoped and recreatable (a version, a
30
+//! localization, a screenshot) are exposed, annotated destructive.
31
+
32
+pub mod requests;
33
+pub mod server;
34
+
35
+pub use requests::*;
36
+pub use server::{serve, AscapiMcpServer};
37
+
38
+#[macro_export]
39
+macro_rules! ascapi_mcp_tools {
40
+ (
41
+ $server:ty,
42
+ $app_list_name:literal,
43
+ $app_get_name:literal,
44
+ $app_update_name:literal,
45
+ $app_info_list_name:literal,
46
+ $build_list_name:literal,
47
+ $bundle_id_list_name:literal,
48
+ $bundle_id_create_name:literal,
49
+ $app_store_version_list_name:literal,
50
+ $app_store_version_get_name:literal,
51
+ $app_store_version_create_name:literal,
52
+ $app_store_version_delete_name:literal,
53
+ $app_store_version_set_build_name:literal,
54
+ $app_info_localization_list_name:literal,
55
+ $app_info_localization_create_name:literal,
56
+ $app_info_localization_update_name:literal,
57
+ $app_info_localization_delete_name:literal,
58
+ $app_store_version_localization_list_name:literal,
59
+ $app_store_version_localization_create_name:literal,
60
+ $app_store_version_localization_update_name:literal,
61
+ $app_store_version_localization_delete_name:literal,
62
+ $app_screenshot_set_list_name:literal,
63
+ $app_screenshot_set_create_name:literal,
64
+ $app_screenshot_set_delete_name:literal,
65
+ $app_screenshot_list_name:literal,
66
+ $app_screenshot_upload_name:literal,
67
+ $app_screenshot_delete_name:literal,
68
+ $certificate_list_name:literal,
69
+ $certificate_create_name:literal
70
+ ) => {
71
+ #[::rmcp::tool_router(router = ascapi_tool_router, vis = "pub(crate)")]
72
+ impl $server {
73
+ fn client() -> ::std::result::Result<::smbcloud_ascapi_core::Client, ::rmcp::model::ErrorData> {
74
+ let api_key = ::smbcloud_ascapi_frontend::api_key_from_env()
75
+ .map_err(|error| ::rmcp::model::ErrorData::invalid_request(error, None))?;
76
+ Ok(::smbcloud_ascapi_core::Client::new(api_key))
77
+ }
78
+
79
+ #[::rmcp::tool(
80
+ name = $app_list_name,
81
+ title = "List apps",
82
+ annotations(title = "List apps", read_only_hint = true, idempotent_hint = true),
83
+ description = "Purpose: find the App Store Connect apps on this account, and translate a bundle identifier into the numeric app id every other tool wants. When to use vs siblings: call this first when you only know a bundle identifier; use app_get once you have an id and want one app's full attributes. Behavior: returns each app's id, name, bundle identifier, SKU, and primary locale, optionally filtered to one bundle identifier. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: returns apps only, not their versions, builds, or localizations, each of which has its own tool."
84
+ )]
85
+ async fn app_list(
86
+ &self,
87
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::AppListRequest>,
88
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
89
+ #[allow(unused_imports)]
90
+ use ::smbcloud_ascapi_aso::prelude::*;
91
+ #[allow(unused_imports)]
92
+ use ::smbcloud_ascapi_signing::prelude::*;
93
+ let client = Self::client()?;
94
+ let request = parameters.0;
95
+ let value = client
96
+ .list_apps(request.bundle_id.as_deref())
97
+ .await
98
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
99
+ Ok(::rmcp::model::CallToolResult::success(vec![
100
+ ::rmcp::model::ContentBlock::json(&value)?,
101
+ ]))
102
+ }
103
+
104
+ #[::rmcp::tool(
105
+ name = $app_get_name,
106
+ title = "Get one app",
107
+ annotations(title = "Get one app", read_only_hint = true, idempotent_hint = true),
108
+ description = "Purpose: fetch one app's full attributes by its App Store Connect id. When to use vs siblings: use app_list when you have a bundle identifier rather than an id, and app_info_list when you want the AppInfo records that hold localized names. Behavior: returns the single app resource with its attributes. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: attributes only; related resources such as versions and builds are fetched with their own tools."
109
+ )]
110
+ async fn app_get(
111
+ &self,
112
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::AppIdRequest>,
113
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
114
+ #[allow(unused_imports)]
115
+ use ::smbcloud_ascapi_aso::prelude::*;
116
+ #[allow(unused_imports)]
117
+ use ::smbcloud_ascapi_signing::prelude::*;
118
+ let client = Self::client()?;
119
+ let request = parameters.0;
120
+ let value = client
121
+ .get_app(&request.app_id)
122
+ .await
123
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
124
+ Ok(::rmcp::model::CallToolResult::success(vec![
125
+ ::rmcp::model::ContentBlock::json(&value)?,
126
+ ]))
127
+ }
128
+
129
+ #[::rmcp::tool(
130
+ name = $app_update_name,
131
+ title = "Update app attributes",
132
+ annotations(title = "Update app attributes", read_only_hint = false, destructive_hint = false, idempotent_hint = true),
133
+ description = "Purpose: change an app's primary locale or content rights declaration. When to use vs siblings: this edits the app record itself; localized names and subtitles live on AppInfo localizations and are edited with app_info_localization_update. Behavior: sends only the fields provided, leaving the rest untouched, and returns the updated app. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: only these two attributes are editable through this endpoint; most app metadata belongs to a version or a localization instead."
134
+ )]
135
+ async fn app_update(
136
+ &self,
137
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::AppUpdateRequest>,
138
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
139
+ #[allow(unused_imports)]
140
+ use ::smbcloud_ascapi_aso::prelude::*;
141
+ #[allow(unused_imports)]
142
+ use ::smbcloud_ascapi_signing::prelude::*;
143
+ let client = Self::client()?;
144
+ let request = parameters.0;
145
+ let attributes = ::smbcloud_ascapi_aso::app::AppUpdateAttributes {
146
+ primary_locale: request.primary_locale,
147
+ content_rights_declaration: request.content_rights_declaration,
148
+ };
149
+ let value = client
150
+ .update_app(&request.app_id, attributes)
151
+ .await
152
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
153
+ Ok(::rmcp::model::CallToolResult::success(vec![
154
+ ::rmcp::model::ContentBlock::json(&value)?,
155
+ ]))
156
+ }
157
+
158
+ #[::rmcp::tool(
159
+ name = $app_info_list_name,
160
+ title = "List app infos",
161
+ annotations(title = "List app infos", read_only_hint = true, idempotent_hint = true),
162
+ description = "Purpose: list an app's AppInfo records, which are the containers for localized names, subtitles, and privacy policy URLs. When to use vs siblings: call this to get the app_info_id that app_info_localization_list and app_info_localization_create need. Behavior: returns each AppInfo with its state and id. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: an app typically has one editable AppInfo plus historical ones for shipped versions, and this returns all of them without saying which is editable."
163
+ )]
164
+ async fn app_info_list(
165
+ &self,
166
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::AppIdRequest>,
167
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
168
+ #[allow(unused_imports)]
169
+ use ::smbcloud_ascapi_aso::prelude::*;
170
+ #[allow(unused_imports)]
171
+ use ::smbcloud_ascapi_signing::prelude::*;
172
+ let client = Self::client()?;
173
+ let request = parameters.0;
174
+ let value = client
175
+ .list_app_infos(&request.app_id)
176
+ .await
177
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
178
+ Ok(::rmcp::model::CallToolResult::success(vec![
179
+ ::rmcp::model::ContentBlock::json(&value)?,
180
+ ]))
181
+ }
182
+
183
+ #[::rmcp::tool(
184
+ name = $build_list_name,
185
+ title = "List builds",
186
+ annotations(title = "List builds", read_only_hint = true, idempotent_hint = true),
187
+ description = "Purpose: list the builds uploaded for an app, so one can be attached to a version. When to use vs siblings: pair with app_store_version_set_build, which needs a build id from here. Behavior: returns each build's id, version string, upload date, and processing state. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: a build that is still processing cannot be attached yet, and this reports that state rather than waiting for it."
188
+ )]
189
+ async fn build_list(
190
+ &self,
191
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::AppIdRequest>,
192
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
193
+ #[allow(unused_imports)]
194
+ use ::smbcloud_ascapi_aso::prelude::*;
195
+ #[allow(unused_imports)]
196
+ use ::smbcloud_ascapi_signing::prelude::*;
197
+ let client = Self::client()?;
198
+ let request = parameters.0;
199
+ let value = client
200
+ .list_builds(&request.app_id)
201
+ .await
202
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
203
+ Ok(::rmcp::model::CallToolResult::success(vec![
204
+ ::rmcp::model::ContentBlock::json(&value)?,
205
+ ]))
206
+ }
207
+
208
+ #[::rmcp::tool(
209
+ name = $bundle_id_list_name,
210
+ title = "List bundle IDs",
211
+ annotations(title = "List bundle IDs", read_only_hint = true, idempotent_hint = true),
212
+ description = "Purpose: list the bundle identifiers registered to the team, or check whether one exists before trying to register it. When to use vs siblings: call this before bundle_id_create, which fails on an identifier that already exists. Behavior: returns each bundle ID's id, identifier, name, and platform, optionally filtered to an exact identifier. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: registration state only; whether an app exists for the identifier is a separate question answered by app_list."
213
+ )]
214
+ async fn bundle_id_list(
215
+ &self,
216
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::BundleIdListRequest>,
217
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
218
+ #[allow(unused_imports)]
219
+ use ::smbcloud_ascapi_aso::prelude::*;
220
+ #[allow(unused_imports)]
221
+ use ::smbcloud_ascapi_signing::prelude::*;
222
+ let client = Self::client()?;
223
+ let request = parameters.0;
224
+ let value = client
225
+ .list_bundle_ids(request.identifier.as_deref())
226
+ .await
227
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
228
+ Ok(::rmcp::model::CallToolResult::success(vec![
229
+ ::rmcp::model::ContentBlock::json(&value)?,
230
+ ]))
231
+ }
232
+
233
+ #[::rmcp::tool(
234
+ name = $bundle_id_create_name,
235
+ title = "Register a bundle ID",
236
+ annotations(title = "Register a bundle ID", read_only_hint = false, destructive_hint = false, idempotent_hint = false),
237
+ description = "Purpose: register a new reverse-DNS bundle identifier with the developer account. When to use vs siblings: call bundle_id_list first, since registering an identifier that already exists fails. Behavior: registers the identifier under the given platform namespace and returns the created resource. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: identifiers cannot be renamed or deleted through this API once registered, so a typo here is permanent; visionOS apps register as ios because visionOS shares the iOS namespace."
238
+ )]
239
+ async fn bundle_id_create(
240
+ &self,
241
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::BundleIdCreateRequest>,
242
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
243
+ #[allow(unused_imports)]
244
+ use ::smbcloud_ascapi_aso::prelude::*;
245
+ #[allow(unused_imports)]
246
+ use ::smbcloud_ascapi_signing::prelude::*;
247
+ let client = Self::client()?;
248
+ let request = parameters.0;
249
+ let platform = ::smbcloud_ascapi_frontend::bundle_id_platform_from_str(&request.platform)
250
+ .map_err(|error| ::rmcp::model::ErrorData::invalid_request(error, None))?;
251
+ let attributes = ::smbcloud_ascapi_aso::bundle_id::BundleIdCreateAttributes {
252
+ identifier: request.identifier,
253
+ name: request.name,
254
+ platform,
255
+ };
256
+ let value = client
257
+ .create_bundle_id(attributes)
258
+ .await
259
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
260
+ Ok(::rmcp::model::CallToolResult::success(vec![
261
+ ::rmcp::model::ContentBlock::json(&value)?,
262
+ ]))
263
+ }
264
+
265
+ #[::rmcp::tool(
266
+ name = $app_store_version_list_name,
267
+ title = "List app store versions",
268
+ annotations(title = "List app store versions", read_only_hint = true, idempotent_hint = true),
269
+ description = "Purpose: list an app's per-platform version records, which are what the store actually reviews and releases. When to use vs siblings: use this to find the version id that the localization and build tools need. Behavior: returns each version's id, platform, version string, and app store state. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: versions are per platform, so one app can have several concurrent editable versions and this returns all of them."
270
+ )]
271
+ async fn app_store_version_list(
272
+ &self,
273
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::AppStoreVersionListRequest>,
274
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
275
+ #[allow(unused_imports)]
276
+ use ::smbcloud_ascapi_aso::prelude::*;
277
+ #[allow(unused_imports)]
278
+ use ::smbcloud_ascapi_signing::prelude::*;
279
+ let client = Self::client()?;
280
+ let request = parameters.0;
281
+ let platform = match request.platform.as_deref() {
282
+ Some(value) => Some(
283
+ ::smbcloud_ascapi_frontend::platform_from_str(value)
284
+ .map_err(|error| ::rmcp::model::ErrorData::invalid_request(error, None))?,
285
+ ),
286
+ None => None,
287
+ };
288
+ let value = client
289
+ .list_app_store_versions(&request.app_id, platform)
290
+ .await
291
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
292
+ Ok(::rmcp::model::CallToolResult::success(vec![
293
+ ::rmcp::model::ContentBlock::json(&value)?,
294
+ ]))
295
+ }
296
+
297
+ #[::rmcp::tool(
298
+ name = $app_store_version_get_name,
299
+ title = "Get one app store version",
300
+ annotations(title = "Get one app store version", read_only_hint = true, idempotent_hint = true),
301
+ description = "Purpose: fetch one App Store Version's attributes by id. When to use vs siblings: use app_store_version_list when you have an app id rather than a version id. Behavior: returns the single version resource with its platform, version string, and release state. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: attributes only; its localizations and attached build are fetched with their own tools."
302
+ )]
303
+ async fn app_store_version_get(
304
+ &self,
305
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::IdRequest>,
306
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
307
+ #[allow(unused_imports)]
308
+ use ::smbcloud_ascapi_aso::prelude::*;
309
+ #[allow(unused_imports)]
310
+ use ::smbcloud_ascapi_signing::prelude::*;
311
+ let client = Self::client()?;
312
+ let request = parameters.0;
313
+ let value = client
314
+ .get_app_store_version(&request.id)
315
+ .await
316
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
317
+ Ok(::rmcp::model::CallToolResult::success(vec![
318
+ ::rmcp::model::ContentBlock::json(&value)?,
319
+ ]))
320
+ }
321
+
322
+ #[::rmcp::tool(
323
+ name = $app_store_version_create_name,
324
+ title = "Create an app store version",
325
+ annotations(title = "Create an app store version", read_only_hint = false, destructive_hint = false, idempotent_hint = false),
326
+ description = "Purpose: create a new version record for an app on a given platform, which is how a new platform such as visionOS is added to an existing app. When to use vs siblings: call app_store_version_list first, because an app can hold only one editable version per platform at a time. Behavior: creates the version and returns it. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: creating a version does not submit anything; localizations, screenshots, and a build still have to be attached before review."
327
+ )]
328
+ async fn app_store_version_create(
329
+ &self,
330
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::AppStoreVersionCreateRequest>,
331
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
332
+ #[allow(unused_imports)]
333
+ use ::smbcloud_ascapi_aso::prelude::*;
334
+ #[allow(unused_imports)]
335
+ use ::smbcloud_ascapi_signing::prelude::*;
336
+ let client = Self::client()?;
337
+ let request = parameters.0;
338
+ let platform = ::smbcloud_ascapi_frontend::platform_from_str(&request.platform)
339
+ .map_err(|error| ::rmcp::model::ErrorData::invalid_request(error, None))?;
340
+ let attributes = ::smbcloud_ascapi_aso::app_store_version::AppStoreVersionCreateAttributes {
341
+ platform,
342
+ version_string: request.version_string,
343
+ copyright: request.copyright,
344
+ };
345
+ let value = client
346
+ .create_app_store_version(&request.app_id, attributes)
347
+ .await
348
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
349
+ Ok(::rmcp::model::CallToolResult::success(vec![
350
+ ::rmcp::model::ContentBlock::json(&value)?,
351
+ ]))
352
+ }
353
+
354
+ #[::rmcp::tool(
355
+ name = $app_store_version_delete_name,
356
+ title = "Delete an app store version",
357
+ annotations(title = "Delete an app store version", read_only_hint = false, destructive_hint = true, idempotent_hint = true),
358
+ description = "Purpose: delete an editable App Store Version record. When to use vs siblings: use this to discard a version created by mistake, typically after app_store_version_list shows a duplicate. Behavior: deletes the version and everything attached to it, including its localizations and screenshots, then returns the deleted id. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: destructive and not undoable, though the version can be recreated; a version already submitted or released cannot be deleted and Apple rejects the attempt."
359
+ )]
360
+ async fn app_store_version_delete(
361
+ &self,
362
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::IdRequest>,
363
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
364
+ #[allow(unused_imports)]
365
+ use ::smbcloud_ascapi_aso::prelude::*;
366
+ #[allow(unused_imports)]
367
+ use ::smbcloud_ascapi_signing::prelude::*;
368
+ let client = Self::client()?;
369
+ let request = parameters.0;
370
+ client
371
+ .delete_app_store_version(&request.id)
372
+ .await
373
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
374
+ Ok(::rmcp::model::CallToolResult::success(vec![
375
+ ::rmcp::model::ContentBlock::json(&::serde_json::json!({ "deleted": request.id }))?,
376
+ ]))
377
+ }
378
+
379
+ #[::rmcp::tool(
380
+ name = $app_store_version_set_build_name,
381
+ title = "Attach a build to a version",
382
+ annotations(title = "Attach a build to a version", read_only_hint = false, destructive_hint = false, idempotent_hint = true),
383
+ description = "Purpose: attach an uploaded build to an App Store Version, which a version needs before it can be submitted. When to use vs siblings: get the build id from build_list and the version id from app_store_version_list. Behavior: points the version's build relationship at the given build, replacing whatever was attached. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: the build must have finished processing, and its platform must match the version's; Apple rejects the pairing otherwise."
384
+ )]
385
+ async fn app_store_version_set_build(
386
+ &self,
387
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::SetBuildRequest>,
388
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
389
+ #[allow(unused_imports)]
390
+ use ::smbcloud_ascapi_aso::prelude::*;
391
+ #[allow(unused_imports)]
392
+ use ::smbcloud_ascapi_signing::prelude::*;
393
+ let client = Self::client()?;
394
+ let request = parameters.0;
395
+ client
396
+ .set_app_store_version_build(&request.version_id, &request.build_id)
397
+ .await
398
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
399
+ Ok(::rmcp::model::CallToolResult::success(vec![
400
+ ::rmcp::model::ContentBlock::json(&::serde_json::json!({ "versionId": request.version_id, "buildId": request.build_id }))?,
401
+ ]))
402
+ }
403
+
404
+ #[::rmcp::tool(
405
+ name = $app_info_localization_list_name,
406
+ title = "List app info localizations",
407
+ annotations(title = "List app info localizations", read_only_hint = true, idempotent_hint = true),
408
+ description = "Purpose: list the localized names and subtitles attached to an AppInfo. When to use vs siblings: this covers name, subtitle, and privacy policy URL; description, keywords, and release notes live on version localizations instead. Behavior: returns each localization's id, locale, name, and subtitle. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: only the editable AppInfo accepts changes, and this does not distinguish editable from historical records."
409
+ )]
410
+ async fn app_info_localization_list(
411
+ &self,
412
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::AppInfoLocalizationListRequest>,
413
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
414
+ #[allow(unused_imports)]
415
+ use ::smbcloud_ascapi_aso::prelude::*;
416
+ #[allow(unused_imports)]
417
+ use ::smbcloud_ascapi_signing::prelude::*;
418
+ let client = Self::client()?;
419
+ let request = parameters.0;
420
+ let value = client
421
+ .list_app_info_localizations(&request.app_info_id)
422
+ .await
423
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
424
+ Ok(::rmcp::model::CallToolResult::success(vec![
425
+ ::rmcp::model::ContentBlock::json(&value)?,
426
+ ]))
427
+ }
428
+
429
+ #[::rmcp::tool(
430
+ name = $app_info_localization_create_name,
431
+ title = "Add an app info localization",
432
+ annotations(title = "Add an app info localization", read_only_hint = false, destructive_hint = false, idempotent_hint = false),
433
+ description = "Purpose: add a localized app name and subtitle for a new locale. When to use vs siblings: use app_info_localization_update when the locale already exists, since creating a duplicate fails. Behavior: creates the localization under the AppInfo and returns it. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: the subtitle is capped at 30 characters and the name at 30 by App Store Connect, which rejects longer values rather than truncating them."
434
+ )]
435
+ async fn app_info_localization_create(
436
+ &self,
437
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::AppInfoLocalizationCreateRequest>,
438
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
439
+ #[allow(unused_imports)]
440
+ use ::smbcloud_ascapi_aso::prelude::*;
441
+ #[allow(unused_imports)]
442
+ use ::smbcloud_ascapi_signing::prelude::*;
443
+ let client = Self::client()?;
444
+ let request = parameters.0;
445
+ let attributes = ::smbcloud_ascapi_aso::app_info_localization::AppInfoLocalizationCreateAttributes {
446
+ locale: request.locale,
447
+ name: request.name,
448
+ subtitle: request.subtitle,
449
+ privacy_policy_url: request.privacy_policy_url,
450
+ };
451
+ let value = client
452
+ .create_app_info_localization(&request.app_info_id, attributes)
453
+ .await
454
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
455
+ Ok(::rmcp::model::CallToolResult::success(vec![
456
+ ::rmcp::model::ContentBlock::json(&value)?,
457
+ ]))
458
+ }
459
+
460
+ #[::rmcp::tool(
461
+ name = $app_info_localization_update_name,
462
+ title = "Edit an app info localization",
463
+ annotations(title = "Edit an app info localization", read_only_hint = false, destructive_hint = false, idempotent_hint = true),
464
+ description = "Purpose: change the localized name, subtitle, or privacy policy URL for a locale that already exists. When to use vs siblings: use app_info_localization_create for a locale that has no record yet. Behavior: sends only the fields provided and leaves the others untouched, then returns the updated localization. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: the locale itself cannot be changed; delete and recreate to move copy to a different locale."
465
+ )]
466
+ async fn app_info_localization_update(
467
+ &self,
468
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::AppInfoLocalizationUpdateRequest>,
469
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
470
+ #[allow(unused_imports)]
471
+ use ::smbcloud_ascapi_aso::prelude::*;
472
+ #[allow(unused_imports)]
473
+ use ::smbcloud_ascapi_signing::prelude::*;
474
+ let client = Self::client()?;
475
+ let request = parameters.0;
476
+ let attributes = ::smbcloud_ascapi_aso::app_info_localization::AppInfoLocalizationUpdateAttributes {
477
+ name: request.name,
478
+ subtitle: request.subtitle,
479
+ privacy_policy_url: request.privacy_policy_url,
480
+ };
481
+ let value = client
482
+ .update_app_info_localization(&request.id, attributes)
483
+ .await
484
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
485
+ Ok(::rmcp::model::CallToolResult::success(vec![
486
+ ::rmcp::model::ContentBlock::json(&value)?,
487
+ ]))
488
+ }
489
+
490
+ #[::rmcp::tool(
491
+ name = $app_info_localization_delete_name,
492
+ title = "Delete an app info localization",
493
+ annotations(title = "Delete an app info localization", read_only_hint = false, destructive_hint = true, idempotent_hint = true),
494
+ description = "Purpose: remove a locale's app name and subtitle. When to use vs siblings: use this to drop a language from the product page; use app_info_localization_update to change copy rather than remove it. Behavior: deletes the localization and returns the deleted id. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: destructive but recreatable with app_info_localization_create; the app's primary locale cannot be deleted and Apple rejects the attempt."
495
+ )]
496
+ async fn app_info_localization_delete(
497
+ &self,
498
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::IdRequest>,
499
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
500
+ #[allow(unused_imports)]
501
+ use ::smbcloud_ascapi_aso::prelude::*;
502
+ #[allow(unused_imports)]
503
+ use ::smbcloud_ascapi_signing::prelude::*;
504
+ let client = Self::client()?;
505
+ let request = parameters.0;
506
+ client
507
+ .delete_app_info_localization(&request.id)
508
+ .await
509
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
510
+ Ok(::rmcp::model::CallToolResult::success(vec![
511
+ ::rmcp::model::ContentBlock::json(&::serde_json::json!({ "deleted": request.id }))?,
512
+ ]))
513
+ }
514
+
515
+ #[::rmcp::tool(
516
+ name = $app_store_version_localization_list_name,
517
+ title = "List version localizations",
518
+ annotations(title = "List version localizations", read_only_hint = true, idempotent_hint = true),
519
+ description = "Purpose: list the per-locale description, keywords, promotional text, and release notes for a version. When to use vs siblings: this is the version-scoped copy; the app name and subtitle live on AppInfo localizations instead. Behavior: returns each localization's id, locale, and copy fields. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: screenshots hang off these localizations but are listed separately with app_screenshot_set_list."
520
+ )]
521
+ async fn app_store_version_localization_list(
522
+ &self,
523
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::VersionLocalizationListRequest>,
524
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
525
+ #[allow(unused_imports)]
526
+ use ::smbcloud_ascapi_aso::prelude::*;
527
+ #[allow(unused_imports)]
528
+ use ::smbcloud_ascapi_signing::prelude::*;
529
+ let client = Self::client()?;
530
+ let request = parameters.0;
531
+ let value = client
532
+ .list_app_store_version_localizations(&request.version_id)
533
+ .await
534
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
535
+ Ok(::rmcp::model::CallToolResult::success(vec![
536
+ ::rmcp::model::ContentBlock::json(&value)?,
537
+ ]))
538
+ }
539
+
540
+ #[::rmcp::tool(
541
+ name = $app_store_version_localization_create_name,
542
+ title = "Add a version localization",
543
+ annotations(title = "Add a version localization", read_only_hint = false, destructive_hint = false, idempotent_hint = false),
544
+ description = "Purpose: add the description, keywords, and release notes for a locale on a specific version. When to use vs siblings: use the update tool when the locale already exists on this version. Behavior: creates the localization with whichever fields are provided and returns it. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: App Store Connect enforces field limits, notably 4000 characters of description, 100 for keywords, and 170 for promotional text, and rejects longer values outright."
545
+ )]
546
+ async fn app_store_version_localization_create(
547
+ &self,
548
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::VersionLocalizationCreateRequest>,
549
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
550
+ #[allow(unused_imports)]
551
+ use ::smbcloud_ascapi_aso::prelude::*;
552
+ #[allow(unused_imports)]
553
+ use ::smbcloud_ascapi_signing::prelude::*;
554
+ let client = Self::client()?;
555
+ let request = parameters.0;
556
+ let fields = ::smbcloud_ascapi_aso::app_store_version_localization::AppStoreVersionLocalizationFields {
557
+ description: request.description,
558
+ keywords: request.keywords,
559
+ marketing_url: request.marketing_url,
560
+ promotional_text: request.promotional_text,
561
+ support_url: request.support_url,
562
+ whats_new: request.whats_new,
563
+ };
564
+ let attributes = ::smbcloud_ascapi_aso::app_store_version_localization::AppStoreVersionLocalizationCreateAttributes {
565
+ locale: request.locale,
566
+ fields,
567
+ };
568
+ let value = client
569
+ .create_app_store_version_localization(&request.version_id, attributes)
570
+ .await
571
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
572
+ Ok(::rmcp::model::CallToolResult::success(vec![
573
+ ::rmcp::model::ContentBlock::json(&value)?,
574
+ ]))
575
+ }
576
+
577
+ #[::rmcp::tool(
578
+ name = $app_store_version_localization_update_name,
579
+ title = "Edit a version localization",
580
+ annotations(title = "Edit a version localization", read_only_hint = false, destructive_hint = false, idempotent_hint = true),
581
+ description = "Purpose: change the description, keywords, promotional text, or release notes for an existing locale on a version. When to use vs siblings: promotional text is the one field editable without shipping a new build, which makes this the tool for timely copy changes. Behavior: sends only the fields provided and leaves the rest untouched. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: which fields are editable depends on the version's review state, and Apple rejects edits to a version under review."
582
+ )]
583
+ async fn app_store_version_localization_update(
584
+ &self,
585
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::VersionLocalizationUpdateRequest>,
586
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
587
+ #[allow(unused_imports)]
588
+ use ::smbcloud_ascapi_aso::prelude::*;
589
+ #[allow(unused_imports)]
590
+ use ::smbcloud_ascapi_signing::prelude::*;
591
+ let client = Self::client()?;
592
+ let request = parameters.0;
593
+ let fields = ::smbcloud_ascapi_aso::app_store_version_localization::AppStoreVersionLocalizationFields {
594
+ description: request.description,
595
+ keywords: request.keywords,
596
+ marketing_url: request.marketing_url,
597
+ promotional_text: request.promotional_text,
598
+ support_url: request.support_url,
599
+ whats_new: request.whats_new,
600
+ };
601
+ let value = client
602
+ .update_app_store_version_localization(&request.id, fields)
603
+ .await
604
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
605
+ Ok(::rmcp::model::CallToolResult::success(vec![
606
+ ::rmcp::model::ContentBlock::json(&value)?,
607
+ ]))
608
+ }
609
+
610
+ #[::rmcp::tool(
611
+ name = $app_store_version_localization_delete_name,
612
+ title = "Delete a version localization",
613
+ annotations(title = "Delete a version localization", read_only_hint = false, destructive_hint = true, idempotent_hint = true),
614
+ description = "Purpose: remove a locale's copy from a version. When to use vs siblings: use the update tool to change copy; use this only to drop a language from this version entirely. Behavior: deletes the localization along with its screenshot sets and returns the deleted id. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: destructive and takes the locale's screenshots with it, though everything can be recreated; the primary locale cannot be removed."
615
+ )]
616
+ async fn app_store_version_localization_delete(
617
+ &self,
618
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::IdRequest>,
619
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
620
+ #[allow(unused_imports)]
621
+ use ::smbcloud_ascapi_aso::prelude::*;
622
+ #[allow(unused_imports)]
623
+ use ::smbcloud_ascapi_signing::prelude::*;
624
+ let client = Self::client()?;
625
+ let request = parameters.0;
626
+ client
627
+ .delete_app_store_version_localization(&request.id)
628
+ .await
629
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
630
+ Ok(::rmcp::model::CallToolResult::success(vec![
631
+ ::rmcp::model::ContentBlock::json(&::serde_json::json!({ "deleted": request.id }))?,
632
+ ]))
633
+ }
634
+
635
+ #[::rmcp::tool(
636
+ name = $app_screenshot_set_list_name,
637
+ title = "List screenshot sets",
638
+ annotations(title = "List screenshot sets", read_only_hint = true, idempotent_hint = true),
639
+ description = "Purpose: list the per-device-class screenshot buckets on a version localization. When to use vs siblings: each set holds the images for one display type, so call this to find the set id that app_screenshot_list and app_screenshot_upload need. Behavior: returns each set's id and display type. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: reports the sets, not how many images each holds or whether the set satisfies Apple's per-device requirements."
640
+ )]
641
+ async fn app_screenshot_set_list(
642
+ &self,
643
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::ScreenshotSetListRequest>,
644
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
645
+ #[allow(unused_imports)]
646
+ use ::smbcloud_ascapi_aso::prelude::*;
647
+ #[allow(unused_imports)]
648
+ use ::smbcloud_ascapi_signing::prelude::*;
649
+ let client = Self::client()?;
650
+ let request = parameters.0;
651
+ let value = client
652
+ .list_app_screenshot_sets(&request.localization_id)
653
+ .await
654
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
655
+ Ok(::rmcp::model::CallToolResult::success(vec![
656
+ ::rmcp::model::ContentBlock::json(&value)?,
657
+ ]))
658
+ }
659
+
660
+ #[::rmcp::tool(
661
+ name = $app_screenshot_set_create_name,
662
+ title = "Create a screenshot set",
663
+ annotations(title = "Create a screenshot set", read_only_hint = false, destructive_hint = false, idempotent_hint = false),
664
+ description = "Purpose: create the bucket that holds screenshots for one device class on a version localization. When to use vs siblings: call app_screenshot_set_list first, since a localization holds at most one set per display type. Behavior: creates the set for the given display type and returns it, ready for app_screenshot_upload. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: the display type must be one App Store Connect recognizes, and image dimensions are validated later at upload rather than here."
665
+ )]
666
+ async fn app_screenshot_set_create(
667
+ &self,
668
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::ScreenshotSetCreateRequest>,
669
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
670
+ #[allow(unused_imports)]
671
+ use ::smbcloud_ascapi_aso::prelude::*;
672
+ #[allow(unused_imports)]
673
+ use ::smbcloud_ascapi_signing::prelude::*;
674
+ let client = Self::client()?;
675
+ let request = parameters.0;
676
+ let display_type = ::smbcloud_ascapi_frontend::display_type_from_str(&request.display_type)
677
+ .map_err(|error| ::rmcp::model::ErrorData::invalid_request(error, None))?;
678
+ let attributes = ::smbcloud_ascapi_aso::app_screenshot_set::AppScreenshotSetCreateAttributes {
679
+ screenshot_display_type: display_type,
680
+ };
681
+ let value = client
682
+ .create_app_screenshot_set(&request.localization_id, attributes)
683
+ .await
684
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
685
+ Ok(::rmcp::model::CallToolResult::success(vec![
686
+ ::rmcp::model::ContentBlock::json(&value)?,
687
+ ]))
688
+ }
689
+
690
+ #[::rmcp::tool(
691
+ name = $app_screenshot_set_delete_name,
692
+ title = "Delete a screenshot set",
693
+ annotations(title = "Delete a screenshot set", read_only_hint = false, destructive_hint = true, idempotent_hint = true),
694
+ description = "Purpose: remove a device class's screenshot bucket and every image in it. When to use vs siblings: use app_screenshot_delete to remove a single image instead of the whole set. Behavior: deletes the set and its screenshots, then returns the deleted id. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: destructive and takes every image with it, though the set and its images can be recreated by uploading again."
695
+ )]
696
+ async fn app_screenshot_set_delete(
697
+ &self,
698
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::IdRequest>,
699
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
700
+ #[allow(unused_imports)]
701
+ use ::smbcloud_ascapi_aso::prelude::*;
702
+ #[allow(unused_imports)]
703
+ use ::smbcloud_ascapi_signing::prelude::*;
704
+ let client = Self::client()?;
705
+ let request = parameters.0;
706
+ client
707
+ .delete_app_screenshot_set(&request.id)
708
+ .await
709
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
710
+ Ok(::rmcp::model::CallToolResult::success(vec![
711
+ ::rmcp::model::ContentBlock::json(&::serde_json::json!({ "deleted": request.id }))?,
712
+ ]))
713
+ }
714
+
715
+ #[::rmcp::tool(
716
+ name = $app_screenshot_list_name,
717
+ title = "List screenshots",
718
+ annotations(title = "List screenshots", read_only_hint = true, idempotent_hint = true),
719
+ description = "Purpose: list the images in a screenshot set, with their upload and processing state. When to use vs siblings: call this after app_screenshot_upload to confirm an image finished processing, since upload returns before Apple has validated the file. Behavior: returns each screenshot's id, file name, size, and asset delivery state. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: an image that failed Apple's dimension checks appears here with an error state rather than being absent, so the state is worth reading."
720
+ )]
721
+ async fn app_screenshot_list(
722
+ &self,
723
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::ScreenshotListRequest>,
724
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
725
+ #[allow(unused_imports)]
726
+ use ::smbcloud_ascapi_aso::prelude::*;
727
+ #[allow(unused_imports)]
728
+ use ::smbcloud_ascapi_signing::prelude::*;
729
+ let client = Self::client()?;
730
+ let request = parameters.0;
731
+ let value = client
732
+ .list_app_screenshots(&request.screenshot_set_id)
733
+ .await
734
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
735
+ Ok(::rmcp::model::CallToolResult::success(vec![
736
+ ::rmcp::model::ContentBlock::json(&value)?,
737
+ ]))
738
+ }
739
+
740
+ #[::rmcp::tool(
741
+ name = $app_screenshot_upload_name,
742
+ title = "Upload a screenshot",
743
+ annotations(title = "Upload a screenshot", read_only_hint = false, destructive_hint = false, idempotent_hint = false),
744
+ description = "Purpose: upload one image into a screenshot set, running the whole three-step reservation, upload, and commit dance in a single call. When to use vs siblings: create the set with app_screenshot_set_create first, then verify with app_screenshot_list, since Apple validates asynchronously. Behavior: reads the file from this machine, reserves the asset, PUTs the bytes to the pre-signed URL, and commits it with its checksum. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: an unreadable path fails before any network call; a wrong image size is accepted here and rejected later, surfacing in app_screenshot_list. Limitations: the path is read by this process, so it must be reachable from wherever the server runs, not from the client's machine."
745
+ )]
746
+ async fn app_screenshot_upload(
747
+ &self,
748
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::ScreenshotUploadRequest>,
749
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
750
+ #[allow(unused_imports)]
751
+ use ::smbcloud_ascapi_aso::prelude::*;
752
+ #[allow(unused_imports)]
753
+ use ::smbcloud_ascapi_signing::prelude::*;
754
+ let client = Self::client()?;
755
+ let request = parameters.0;
756
+ let path = ::std::path::PathBuf::from(&request.file_path);
757
+ let bytes = ::std::fs::read(&path).map_err(|error| {
758
+ ::rmcp::model::ErrorData::invalid_request(
759
+ format!("reading {}: {error}", path.display()),
760
+ None,
761
+ )
762
+ })?;
763
+ let file_name = path
764
+ .file_name()
765
+ .map(|name| name.to_string_lossy().into_owned())
766
+ .ok_or_else(|| {
767
+ ::rmcp::model::ErrorData::invalid_request(
768
+ format!("{} has no file name", path.display()),
769
+ None,
770
+ )
771
+ })?;
772
+ let value = client
773
+ .upload_app_screenshot(&request.screenshot_set_id, file_name, bytes)
774
+ .await
775
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
776
+ Ok(::rmcp::model::CallToolResult::success(vec![
777
+ ::rmcp::model::ContentBlock::json(&value)?,
778
+ ]))
779
+ }
780
+
781
+ #[::rmcp::tool(
782
+ name = $app_screenshot_delete_name,
783
+ title = "Delete a screenshot",
784
+ annotations(title = "Delete a screenshot", read_only_hint = false, destructive_hint = true, idempotent_hint = true),
785
+ description = "Purpose: remove one uploaded screenshot. When to use vs siblings: use app_screenshot_set_delete to clear an entire device class at once. Behavior: deletes the image and returns the deleted id. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: destructive but trivially recoverable by uploading the file again, which makes it the safest of the delete tools."
786
+ )]
787
+ async fn app_screenshot_delete(
788
+ &self,
789
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::IdRequest>,
790
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
791
+ #[allow(unused_imports)]
792
+ use ::smbcloud_ascapi_aso::prelude::*;
793
+ #[allow(unused_imports)]
794
+ use ::smbcloud_ascapi_signing::prelude::*;
795
+ let client = Self::client()?;
796
+ let request = parameters.0;
797
+ client
798
+ .delete_app_screenshot(&request.id)
799
+ .await
800
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error.to_string(), None))?;
801
+ Ok(::rmcp::model::CallToolResult::success(vec![
802
+ ::rmcp::model::ContentBlock::json(&::serde_json::json!({ "deleted": request.id }))?,
803
+ ]))
804
+ }
805
+
806
+ #[::rmcp::tool(
807
+ name = $certificate_list_name,
808
+ title = "List signing certificates",
809
+ annotations(title = "List signing certificates", read_only_hint = true, idempotent_hint = true),
810
+ description = "Purpose: report every signing certificate the team holds, with the expiry of each, so an agent can tell what is usable before a build is attempted. When to use vs siblings: call this first to see whether a valid certificate already exists; use certificate_create only when none of the required type exists, or the existing one has expired. Behavior: returns id, name, type, serial number, expiry, and a computed expired flag, soonest expiry first. The flag is computed here because App Store Connect offers no filter for it and returns expired certificates alongside valid ones. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: missing or unreadable credentials return an invalid-request error naming what is absent; App Store Connect errors are returned verbatim with their status. Limitations: certificate bodies are omitted deliberately, and this reports certificates only, not provisioning profiles, so a valid certificate here does not by itself mean a build will sign."
811
+ )]
812
+ async fn certificate_list(
813
+ &self,
814
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::CertificateListRequest>,
815
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
816
+ #[allow(unused_imports)]
817
+ use ::smbcloud_ascapi_aso::prelude::*;
818
+ #[allow(unused_imports)]
819
+ use ::smbcloud_ascapi_signing::prelude::*;
820
+ let client = Self::client()?;
821
+ let request = parameters.0;
822
+ let filter = match request.certificate_type.as_deref() {
823
+ Some(value) => Some(
824
+ ::smbcloud_ascapi_frontend::certificate_type_from_str(value)
825
+ .map_err(|error| ::rmcp::model::ErrorData::invalid_request(error, None))?,
826
+ ),
827
+ None => None,
828
+ };
829
+ let mut certificates = client.list_certificates(filter).await.map_err(|error| {
830
+ ::rmcp::model::ErrorData::internal_error(error.to_string(), None)
831
+ })?;
832
+ certificates.sort_by(|a, b| {
833
+ a.attributes.expiration_date.cmp(&b.attributes.expiration_date)
834
+ });
835
+ let now = ::smbcloud_ascapi_frontend::now_iso8601();
836
+ let summaries: Vec<_> = certificates
837
+ .iter()
838
+ .map(|certificate| ::smbcloud_ascapi_frontend::CertificateSummary::from_resource(certificate, &now))
839
+ .collect();
840
+ Ok(::rmcp::model::CallToolResult::success(vec![
841
+ ::rmcp::model::ContentBlock::json(&summaries)?,
842
+ ]))
843
+ }
844
+
845
+ #[::rmcp::tool(
846
+ name = $certificate_create_name,
847
+ title = "Issue a signing certificate",
848
+ annotations(title = "Issue a signing certificate", read_only_hint = false, destructive_hint = false, idempotent_hint = false),
849
+ description = "Purpose: issue a new Apple signing certificate end to end, generating the key pair locally and writing both halves to disk, so a machine can sign without anyone visiting the developer portal. When to use vs siblings: call certificate_list first and use this only when no valid certificate of the needed type exists; an expired certificate cannot be renewed, so replacing one also means calling this. Behavior: generates an RSA 2048 key pair, the only kind Apple accepts, writes the private key with owner-only permissions, sends a signing request, then writes the issued certificate beside the key and returns both paths. The key is written before the request is sent, so a failure mid-flight leaves an unused key rather than a certificate whose key was never saved. Prerequisites: ASC_API_KEY, ASC_ISSUER_ID, and a readable .p8 key at ASC_PRIVATE_KEY_PATH or ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8. Failure modes: Apple caps how many certificates of each type a team may hold and returns an error at the cap, which is resolved by revoking one from the command line, never from here. Limitations: the response carries paths, never key material; Apple keeps no copy of the private key, so losing the file makes the certificate permanently useless."
850
+ )]
851
+ async fn certificate_create(
852
+ &self,
853
+ parameters: ::rmcp::handler::server::wrapper::Parameters<$crate::CertificateCreateRequest>,
854
+ ) -> ::std::result::Result<::rmcp::model::CallToolResult, ::rmcp::model::ErrorData> {
855
+ #[allow(unused_imports)]
856
+ use ::smbcloud_ascapi_aso::prelude::*;
857
+ #[allow(unused_imports)]
858
+ use ::smbcloud_ascapi_signing::prelude::*;
859
+ let client = Self::client()?;
860
+ let request = parameters.0;
861
+ let certificate_type = ::smbcloud_ascapi_frontend::certificate_type_from_str(&request.certificate_type)
862
+ .map_err(|error| ::rmcp::model::ErrorData::invalid_request(error, None))?;
863
+ let common_name = request
864
+ .common_name
865
+ .unwrap_or_else(|| "smbcloud-ascapi".to_string());
866
+ let out_dir = ::std::path::PathBuf::from(&request.out_dir);
867
+ let outcome = ::smbcloud_ascapi_frontend::issue_certificate(
868
+ &client,
869
+ certificate_type,
870
+ &common_name,
871
+ &out_dir,
872
+ )
873
+ .await
874
+ .map_err(|error| ::rmcp::model::ErrorData::internal_error(error, None))?;
875
+ Ok(::rmcp::model::CallToolResult::success(vec![
876
+ ::rmcp::model::ContentBlock::json(&outcome)?,
877
+ ]))
878
+ }
879
+ }
880
+ };
881
+}
crates/mcp/src/requests.rs
new
+246
@@ -0,0 +1,246 @@
1
+//! Tool parameter types.
2
+//!
3
+//! Every field carries a doc comment, because rustdoc comments become the
4
+//! JSON Schema `description` a model reads when deciding how to call a
5
+//! tool, and a parameter without one is a guess waiting to happen. The
6
+//! contract test in [`crate::server`] fails the build if any is missing.
7
+
8
+use serde::Deserialize;
9
+
10
+#[derive(Debug, Clone, Default, Deserialize, schemars::JsonSchema)]
11
+pub struct AppListRequest {
12
+ /// Only return the app with this bundle identifier, e.g.
13
+ /// xyz.smbcloud.mailx. Omit to list every app on the account.
14
+ #[serde(default)]
15
+ pub bundle_id: Option<String>,
16
+}
17
+
18
+#[derive(Debug, Clone, Deserialize, schemars::JsonSchema)]
19
+pub struct AppIdRequest {
20
+ /// App Store Connect app id, the numeric string from the app's URL in
21
+ /// App Store Connect. Not the bundle identifier; use app_list to
22
+ /// translate one into the other.
23
+ pub app_id: String,
24
+}
25
+
26
+#[derive(Debug, Clone, Deserialize, schemars::JsonSchema)]
27
+pub struct AppUpdateRequest {
28
+ /// App Store Connect app id.
29
+ pub app_id: String,
30
+ /// BCP-47 locale to make the app's primary language, e.g. en-US.
31
+ #[serde(default)]
32
+ pub primary_locale: Option<String>,
33
+ /// Content rights declaration, e.g. DOES_NOT_USE_THIRD_PARTY_CONTENT
34
+ /// or USES_THIRD_PARTY_CONTENT.
35
+ #[serde(default)]
36
+ pub content_rights_declaration: Option<String>,
37
+}
38
+
39
+#[derive(Debug, Clone, Default, Deserialize, schemars::JsonSchema)]
40
+pub struct BundleIdListRequest {
41
+ /// Only return the bundle ID matching this identifier exactly. Omit to
42
+ /// list every registered identifier.
43
+ #[serde(default)]
44
+ pub identifier: Option<String>,
45
+}
46
+
47
+#[derive(Debug, Clone, Deserialize, schemars::JsonSchema)]
48
+pub struct BundleIdCreateRequest {
49
+ /// The reverse-DNS identifier to register, e.g. xyz.smbcloud.mailx.
50
+ pub identifier: String,
51
+ /// Human-readable name shown in the developer portal.
52
+ pub name: String,
53
+ /// Platform namespace: ios, mac_os, or universal. visionOS apps
54
+ /// register as ios, because visionOS shares the iOS namespace.
55
+ pub platform: String,
56
+}
57
+
58
+#[derive(Debug, Clone, Deserialize, schemars::JsonSchema)]
59
+pub struct AppStoreVersionListRequest {
60
+ /// App Store Connect app id whose versions to list.
61
+ pub app_id: String,
62
+ /// Only return versions for this platform: ios, mac_os, tv_os, or
63
+ /// vision_os. Omit to list every platform's versions.
64
+ #[serde(default)]
65
+ pub platform: Option<String>,
66
+}
67
+
68
+#[derive(Debug, Clone, Deserialize, schemars::JsonSchema)]
69
+pub struct IdRequest {
70
+ /// App Store Connect resource id.
71
+ pub id: String,
72
+}
73
+
74
+#[derive(Debug, Clone, Deserialize, schemars::JsonSchema)]
75
+pub struct AppStoreVersionCreateRequest {
76
+ /// App Store Connect app id to add the version to.
77
+ pub app_id: String,
78
+ /// Platform for this version: ios, mac_os, tv_os, or vision_os. Adding
79
+ /// a platform to an existing app means creating a version for it here.
80
+ pub platform: String,
81
+ /// Marketing version string, e.g. 1.2.0.
82
+ pub version_string: String,
83
+ /// Copyright line, e.g. "2026 Splitfire AB". Optional.
84
+ #[serde(default)]
85
+ pub copyright: Option<String>,
86
+}
87
+
88
+#[derive(Debug, Clone, Deserialize, schemars::JsonSchema)]
89
+pub struct SetBuildRequest {
90
+ /// App Store Version id to attach the build to.
91
+ pub version_id: String,
92
+ /// Build id to attach. Use build_list to find one for the app.
93
+ pub build_id: String,
94
+}
95
+
96
+#[derive(Debug, Clone, Deserialize, schemars::JsonSchema)]
97
+pub struct AppInfoLocalizationListRequest {
98
+ /// AppInfo id whose localizations to list. Use app_info_list to find
99
+ /// the AppInfo for an app.
100
+ pub app_info_id: String,
101
+}
102
+
103
+#[derive(Debug, Clone, Deserialize, schemars::JsonSchema)]
104
+pub struct AppInfoLocalizationCreateRequest {
105
+ /// AppInfo id to add the localization to.
106
+ pub app_info_id: String,
107
+ /// BCP-47 locale, e.g. sv-SE or id-ID.
108
+ pub locale: String,
109
+ /// Localized app name shown on the product page.
110
+ pub name: String,
111
+ /// Localized subtitle, up to 30 characters.
112
+ #[serde(default)]
113
+ pub subtitle: Option<String>,
114
+ /// Localized privacy policy URL.
115
+ #[serde(default)]
116
+ pub privacy_policy_url: Option<String>,
117
+}
118
+
119
+#[derive(Debug, Clone, Deserialize, schemars::JsonSchema)]
120
+pub struct AppInfoLocalizationUpdateRequest {
121
+ /// AppInfoLocalization id to update.
122
+ pub id: String,
123
+ /// New localized app name. Omit to leave unchanged.
124
+ #[serde(default)]
125
+ pub name: Option<String>,
126
+ /// New localized subtitle. Omit to leave unchanged.
127
+ #[serde(default)]
128
+ pub subtitle: Option<String>,
129
+ /// New privacy policy URL. Omit to leave unchanged.
130
+ #[serde(default)]
131
+ pub privacy_policy_url: Option<String>,
132
+}
133
+
134
+#[derive(Debug, Clone, Deserialize, schemars::JsonSchema)]
135
+pub struct VersionLocalizationListRequest {
136
+ /// App Store Version id whose localizations to list.
137
+ pub version_id: String,
138
+}
139
+
140
+#[derive(Debug, Clone, Deserialize, schemars::JsonSchema)]
141
+pub struct VersionLocalizationCreateRequest {
142
+ /// App Store Version id to add the localization to.
143
+ pub version_id: String,
144
+ /// BCP-47 locale, e.g. sv-SE or id-ID.
145
+ pub locale: String,
146
+ /// Long description shown on the product page, up to 4000 characters.
147
+ #[serde(default)]
148
+ pub description: Option<String>,
149
+ /// Comma-separated keyword field, up to 100 characters. Apple indexes
150
+ /// it for search and never shows it.
151
+ #[serde(default)]
152
+ pub keywords: Option<String>,
153
+ /// Marketing URL.
154
+ #[serde(default)]
155
+ pub marketing_url: Option<String>,
156
+ /// Promotional text, up to 170 characters. Editable without a new
157
+ /// build, unlike the description.
158
+ #[serde(default)]
159
+ pub promotional_text: Option<String>,
160
+ /// Support URL.
161
+ #[serde(default)]
162
+ pub support_url: Option<String>,
163
+ /// Release notes for this version.
164
+ #[serde(default)]
165
+ pub whats_new: Option<String>,
166
+}
167
+
168
+#[derive(Debug, Clone, Deserialize, schemars::JsonSchema)]
169
+pub struct VersionLocalizationUpdateRequest {
170
+ /// AppStoreVersionLocalization id to update.
171
+ pub id: String,
172
+ /// New description. Omit to leave unchanged.
173
+ #[serde(default)]
174
+ pub description: Option<String>,
175
+ /// New keyword field. Omit to leave unchanged.
176
+ #[serde(default)]
177
+ pub keywords: Option<String>,
178
+ /// New marketing URL. Omit to leave unchanged.
179
+ #[serde(default)]
180
+ pub marketing_url: Option<String>,
181
+ /// New promotional text. Omit to leave unchanged.
182
+ #[serde(default)]
183
+ pub promotional_text: Option<String>,
184
+ /// New support URL. Omit to leave unchanged.
185
+ #[serde(default)]
186
+ pub support_url: Option<String>,
187
+ /// New release notes. Omit to leave unchanged.
188
+ #[serde(default)]
189
+ pub whats_new: Option<String>,
190
+}
191
+
192
+#[derive(Debug, Clone, Deserialize, schemars::JsonSchema)]
193
+pub struct ScreenshotSetListRequest {
194
+ /// AppStoreVersionLocalization id whose screenshot sets to list.
195
+ pub localization_id: String,
196
+}
197
+
198
+#[derive(Debug, Clone, Deserialize, schemars::JsonSchema)]
199
+pub struct ScreenshotSetCreateRequest {
200
+ /// AppStoreVersionLocalization id to create the set under.
201
+ pub localization_id: String,
202
+ /// Device class for this set, e.g. APP_IPHONE_67, APP_IPAD_PRO_129,
203
+ /// APP_APPLE_VISION_PRO, or APP_DESKTOP.
204
+ pub display_type: String,
205
+}
206
+
207
+#[derive(Debug, Clone, Deserialize, schemars::JsonSchema)]
208
+pub struct ScreenshotListRequest {
209
+ /// AppScreenshotSet id whose screenshots to list.
210
+ pub screenshot_set_id: String,
211
+}
212
+
213
+#[derive(Debug, Clone, Deserialize, schemars::JsonSchema)]
214
+pub struct ScreenshotUploadRequest {
215
+ /// AppScreenshotSet id to upload into.
216
+ pub screenshot_set_id: String,
217
+ /// Path to the image file on this machine. Read from disk by the
218
+ /// server, so it must be a path this process can open.
219
+ pub file_path: String,
220
+}
221
+
222
+#[derive(Debug, Clone, Default, Deserialize, schemars::JsonSchema)]
223
+pub struct CertificateListRequest {
224
+ /// Only list certificates of this type. One of development,
225
+ /// distribution, mac_app_distribution, mac_installer_distribution,
226
+ /// developer_id_application. Omit to list every type.
227
+ #[serde(default)]
228
+ pub certificate_type: Option<String>,
229
+}
230
+
231
+#[derive(Debug, Clone, Deserialize, schemars::JsonSchema)]
232
+pub struct CertificateCreateRequest {
233
+ /// The kind of certificate to issue. One of development,
234
+ /// distribution, mac_app_distribution, mac_installer_distribution,
235
+ /// developer_id_application.
236
+ pub certificate_type: String,
237
+ /// Directory to write the private key and issued certificate into. It
238
+ /// is created if missing; the key is written with owner-only
239
+ /// permissions.
240
+ pub out_dir: String,
241
+ /// Subject common name for the signing request. Apple replaces the
242
+ /// subject on the certificate it issues, so this only labels the
243
+ /// request itself. Defaults to smbcloud-ascapi.
244
+ #[serde(default)]
245
+ pub common_name: Option<String>,
246
+}
crates/mcp/src/server.rs
new
+361
@@ -0,0 +1,361 @@
1
+//! The `ascapi --mcp` server.
2
+//!
3
+//! Holds no state: every tool resolves its App Store Connect credentials
4
+//! from the environment per call, so an unconfigured server still starts
5
+//! and still answers `tools/list`, which is how a client discovers what
6
+//! configuration it needs.
7
+//!
8
+//! The tool names are supplied here rather than baked into the contract
9
+//! module, so a host that re-exposes these tools can namespace them
10
+//! without forking the implementations. Same arrangement as `xcrs` in
11
+//! `smbcloud-cli`.
12
+
13
+use crate::ascapi_mcp_tools;
14
+use anyhow::{anyhow, Result};
15
+use rmcp::{
16
+ model::{Implementation, ServerCapabilities, ServerInfo},
17
+ transport::stdio,
18
+ ServerHandler, ServiceExt,
19
+};
20
+
21
+#[derive(Debug, Clone, Default)]
22
+pub struct AscapiMcpServer;
23
+
24
+impl AscapiMcpServer {
25
+ pub fn new() -> Self {
26
+ Self
27
+ }
28
+}
29
+
30
+ascapi_mcp_tools!(
31
+ AscapiMcpServer,
32
+ "app_list",
33
+ "app_get",
34
+ "app_update",
35
+ "app_info_list",
36
+ "build_list",
37
+ "bundle_id_list",
38
+ "bundle_id_create",
39
+ "app_store_version_list",
40
+ "app_store_version_get",
41
+ "app_store_version_create",
42
+ "app_store_version_delete",
43
+ "app_store_version_set_build",
44
+ "app_info_localization_list",
45
+ "app_info_localization_create",
46
+ "app_info_localization_update",
47
+ "app_info_localization_delete",
48
+ "app_store_version_localization_list",
49
+ "app_store_version_localization_create",
50
+ "app_store_version_localization_update",
51
+ "app_store_version_localization_delete",
52
+ "app_screenshot_set_list",
53
+ "app_screenshot_set_create",
54
+ "app_screenshot_set_delete",
55
+ "app_screenshot_list",
56
+ "app_screenshot_upload",
57
+ "app_screenshot_delete",
58
+ "certificate_list",
59
+ "certificate_create"
60
+);
61
+
62
+#[rmcp::tool_handler(router = Self::ascapi_tool_router())]
63
+impl ServerHandler for AscapiMcpServer {
64
+ fn get_info(&self) -> ServerInfo {
65
+ let mut implementation = Implementation::from_build_env();
66
+ implementation.name = "ascapi".to_string();
67
+ implementation.version = env!("CARGO_PKG_VERSION").to_string();
68
+
69
+ ServerInfo::new(ServerCapabilities::builder().enable_tools().build())
70
+ .with_server_info(implementation)
71
+ .with_instructions(
72
+ "ascapi exposes App Store Connect signing certificates (certificate_list, \
73
+ certificate_create). Certificates are issued by generating an RSA 2048 key \
74
+ pair locally and sending only a signing request to Apple, so the private key \
75
+ never leaves this machine and Apple keeps no copy of it: a lost key file \
76
+ makes its certificate permanently unusable. Revocation is deliberately not \
77
+ offered here, because revoking a distribution certificate invalidates every \
78
+ provisioning profile embedding it for the whole team at once; run \
79
+ `ascapi certificates revoke` from a terminal instead. Requires ASC_API_KEY, \
80
+ ASC_ISSUER_ID, and a readable .p8 key.",
81
+ )
82
+ }
83
+}
84
+
85
+/// Serve over stdio until the client disconnects.
86
+///
87
+/// stdout carries the JSON-RPC stream from here on, so nothing in this
88
+/// path may print to it. Diagnostics belong on stderr.
89
+pub async fn serve() -> Result<()> {
90
+ let running = AscapiMcpServer::new()
91
+ .serve(stdio())
92
+ .await
93
+ .map_err(|error| anyhow!("Failed to start ascapi MCP server: {error}"))?;
94
+ running
95
+ .waiting()
96
+ .await
97
+ .map_err(|error| anyhow!("ascapi MCP server stopped unexpectedly: {error}"))?;
98
+ Ok(())
99
+}
100
+
101
+#[cfg(test)]
102
+mod tests {
103
+ use super::*;
104
+
105
+ /// The canonical tool names. Adding or renaming one is a
106
+ /// public-contract change, and this list is what makes that
107
+ /// deliberate rather than accidental.
108
+ const CANONICAL_TOOL_NAMES: [&str; 28] = [
109
+ "app_list",
110
+ "app_get",
111
+ "app_update",
112
+ "app_info_list",
113
+ "build_list",
114
+ "bundle_id_list",
115
+ "bundle_id_create",
116
+ "app_store_version_list",
117
+ "app_store_version_get",
118
+ "app_store_version_create",
119
+ "app_store_version_delete",
120
+ "app_store_version_set_build",
121
+ "app_info_localization_list",
122
+ "app_info_localization_create",
123
+ "app_info_localization_update",
124
+ "app_info_localization_delete",
125
+ "app_store_version_localization_list",
126
+ "app_store_version_localization_create",
127
+ "app_store_version_localization_update",
128
+ "app_store_version_localization_delete",
129
+ "app_screenshot_set_list",
130
+ "app_screenshot_set_create",
131
+ "app_screenshot_set_delete",
132
+ "app_screenshot_list",
133
+ "app_screenshot_upload",
134
+ "app_screenshot_delete",
135
+ "certificate_list",
136
+ "certificate_create",
137
+ ];
138
+
139
+ /// Never a tool, at any point, for any caller.
140
+ ///
141
+ /// Revoking a signing certificate invalidates every provisioning
142
+ /// profile embedding it, for every teammate and every CI job, at once
143
+ /// and irreversibly. No confirmation string a model types on a human's
144
+ /// behalf makes that safe. It lives on the command line only, where a
145
+ /// person is the one at the keyboard.
146
+ ///
147
+ /// The scoped deletes below are a different matter and *are* exposed:
148
+ /// a version, a localization, a screenshot set, or an image can all be
149
+ /// recreated by re-running the tool that made them. They carry
150
+ /// `destructive_hint` so a client can gate them on its own terms.
151
+ const FORBIDDEN_TOOL_NAMES: [&str; 4] = [
152
+ "certificate_revoke",
153
+ "certificate_delete",
154
+ "certificate_nuke",
155
+ "app_delete",
156
+ ];
157
+
158
+ #[test]
159
+ fn tool_router_exposes_exactly_the_canonical_tools() {
160
+ let tools = AscapiMcpServer::ascapi_tool_router().list_all();
161
+
162
+ assert_eq!(
163
+ tools.len(),
164
+ CANONICAL_TOOL_NAMES.len(),
165
+ "expected exactly {} canonical tools, found {}",
166
+ CANONICAL_TOOL_NAMES.len(),
167
+ tools.len()
168
+ );
169
+
170
+ let mut actual: Vec<&str> = tools.iter().map(|tool| tool.name.as_ref()).collect();
171
+ actual.sort_unstable();
172
+ let mut expected = CANONICAL_TOOL_NAMES;
173
+ expected.sort_unstable();
174
+ assert_eq!(actual, expected);
175
+ }
176
+
177
+ #[test]
178
+ fn no_irreversible_tool_is_ever_exposed() {
179
+ let tools = AscapiMcpServer::ascapi_tool_router().list_all();
180
+ for tool in &tools {
181
+ assert!(
182
+ !FORBIDDEN_TOOL_NAMES.contains(&tool.name.as_ref()),
183
+ "{} is irreversible or team-wide and must not be reachable over MCP",
184
+ tool.name
185
+ );
186
+ }
187
+ }
188
+
189
+ #[test]
190
+ fn every_delete_tool_is_annotated_destructive() {
191
+ // The naming convention is load-bearing: a client deciding whether
192
+ // to prompt reads the annotation, not the name, so the two must
193
+ // agree or a delete slips through a confirmation gate.
194
+ let tools = AscapiMcpServer::ascapi_tool_router().list_all();
195
+ let deletes: Vec<_> = tools
196
+ .iter()
197
+ .filter(|tool| tool.name.ends_with("_delete"))
198
+ .collect();
199
+ assert!(
200
+ !deletes.is_empty(),
201
+ "expected some delete tools; if they were removed, drop this test with them"
202
+ );
203
+ for tool in deletes {
204
+ let annotations = tool
205
+ .annotations
206
+ .as_ref()
207
+ .unwrap_or_else(|| panic!("{} is missing annotations", tool.name));
208
+ assert_eq!(
209
+ annotations.destructive_hint,
210
+ Some(true),
211
+ "{} deletes something and must be annotated destructive",
212
+ tool.name
213
+ );
214
+ }
215
+ }
216
+
217
+ #[test]
218
+ fn read_only_tools_are_never_annotated_destructive() {
219
+ let tools = AscapiMcpServer::ascapi_tool_router().list_all();
220
+ for tool in &tools {
221
+ let Some(annotations) = tool.annotations.as_ref() else {
222
+ continue;
223
+ };
224
+ if annotations.read_only_hint == Some(true) {
225
+ assert_ne!(
226
+ annotations.destructive_hint,
227
+ Some(true),
228
+ "{} claims to be read-only and destructive at once",
229
+ tool.name
230
+ );
231
+ }
232
+ }
233
+ }
234
+
235
+ #[test]
236
+ fn tool_names_carry_no_server_prefix() {
237
+ let tools = AscapiMcpServer::ascapi_tool_router().list_all();
238
+ for tool in &tools {
239
+ assert!(
240
+ !tool.name.starts_with("ascapi_") && !tool.name.starts_with("smb_"),
241
+ "{} should not repeat a server prefix",
242
+ tool.name
243
+ );
244
+ }
245
+ }
246
+
247
+ #[test]
248
+ fn every_tool_has_a_meaningful_concise_title() {
249
+ let tools = AscapiMcpServer::ascapi_tool_router().list_all();
250
+ for tool in &tools {
251
+ let title = tool
252
+ .title
253
+ .as_deref()
254
+ .unwrap_or_else(|| panic!("{} is missing a top-level title", tool.name));
255
+ assert!(!title.trim().is_empty(), "{} has a blank title", tool.name);
256
+ assert!(
257
+ title.len() <= 40,
258
+ "{} title should be concise (<= 40 chars), got {title:?}",
259
+ tool.name
260
+ );
261
+ assert_ne!(
262
+ title,
263
+ tool.name.as_ref(),
264
+ "{} title should be a human-readable label, not the raw tool name",
265
+ tool.name
266
+ );
267
+ }
268
+ }
269
+
270
+ #[test]
271
+ fn every_tool_has_a_front_loaded_transparent_description() {
272
+ let tools = AscapiMcpServer::ascapi_tool_router().list_all();
273
+ for tool in &tools {
274
+ let description = tool
275
+ .description
276
+ .as_deref()
277
+ .unwrap_or_else(|| panic!("{} is missing a description", tool.name));
278
+
279
+ for required in [
280
+ "Purpose:",
281
+ "When to use",
282
+ "Behavior:",
283
+ "Prerequisites:",
284
+ "Failure modes:",
285
+ "Limitations:",
286
+ ] {
287
+ assert!(
288
+ description.contains(required),
289
+ "{} description is missing the {required:?} section",
290
+ tool.name
291
+ );
292
+ }
293
+ assert!(
294
+ description.starts_with("Purpose:"),
295
+ "{} description should front-load its purpose",
296
+ tool.name
297
+ );
298
+ // Loosely bounded rather than snapshotted, so wording can
299
+ // evolve without a brittle exact-text assertion.
300
+ assert!(
301
+ description.len() >= 150,
302
+ "{} description is too terse for behavioral transparency ({} chars)",
303
+ tool.name,
304
+ description.len()
305
+ );
306
+ }
307
+ }
308
+
309
+ #[test]
310
+ fn every_tool_has_internally_consistent_annotations() {
311
+ let tools = AscapiMcpServer::ascapi_tool_router().list_all();
312
+ for tool in &tools {
313
+ let annotations = tool
314
+ .annotations
315
+ .as_ref()
316
+ .unwrap_or_else(|| panic!("{} is missing annotations", tool.name));
317
+ let annotations_title = annotations
318
+ .title
319
+ .as_deref()
320
+ .unwrap_or_else(|| panic!("{} annotations are missing a title", tool.name));
321
+ assert_eq!(
322
+ Some(annotations_title),
323
+ tool.title.as_deref(),
324
+ "{} top-level title and annotations title must agree",
325
+ tool.name
326
+ );
327
+ assert!(
328
+ !(annotations.read_only_hint == Some(true)
329
+ && annotations.destructive_hint == Some(true)),
330
+ "{} annotations contradict: read_only_hint and destructive_hint are both true",
331
+ tool.name
332
+ );
333
+ }
334
+ }
335
+
336
+ #[test]
337
+ fn every_input_schema_property_has_a_description() {
338
+ let tools = AscapiMcpServer::ascapi_tool_router().list_all();
339
+ for tool in &tools {
340
+ let Some(properties) = tool
341
+ .input_schema
342
+ .get("properties")
343
+ .and_then(|value| value.as_object())
344
+ else {
345
+ continue;
346
+ };
347
+ for (property_name, property_schema) in properties {
348
+ let description = property_schema
349
+ .get("description")
350
+ .and_then(|value| value.as_str())
351
+ .unwrap_or_default();
352
+ assert!(
353
+ !description.trim().is_empty(),
354
+ "{}.{} is missing a parameter description",
355
+ tool.name,
356
+ property_name
357
+ );
358
+ }
359
+ }
360
+ }
361
+}
crates/signing/Cargo.toml
new
+24
@@ -0,0 +1,24 @@
1
+[package]
2
+name = "smbcloud-ascapi-signing"
3
+version.workspace = true
4
+edition.workspace = true
5
+authors.workspace = true
6
+license.workspace = true
7
+repository.workspace = true
8
+description = "Apple code signing through App Store Connect: certificates, plus local RSA key pair and CSR generation."
9
+
10
+[lib]
11
+path = "src/lib.rs"
12
+
13
+[dependencies]
14
+async-trait = { workspace = true }
15
+rand = { workspace = true }
16
+rcgen = { workspace = true }
17
+reqwest = { workspace = true }
18
+rsa = { workspace = true, features = ["pem"] }
19
+serde = { workspace = true, features = ["derive"] }
20
+smbcloud-ascapi-core = { workspace = true }
21
+zeroize = { workspace = true }
22
+
23
+[dev-dependencies]
24
+serde_json = { workspace = true }
crates/signing/src/certificate.rs
renamed
+49
-26
@@ -18,13 +18,14 @@
18
//! regenerated.
19
//!
20
//! See [`crate::csr`] for producing the `csr_content` that
21
-//! [`Client::create_certificate`] wants.
21
+//! [`CertificatesApi::create_certificate`] wants.
22
23
-use crate::client::Client;
24
-use crate::error::Result;
25
-use crate::jsonapi::{CreateBody, CreateData, Document, ListDocument, Resource};
23
+use async_trait::async_trait;
24
use reqwest::Method;
25
use serde::{Deserialize, Serialize};
26
+use smbcloud_ascapi_core::jsonapi::{CreateBody, CreateData, Document, ListDocument, Resource};
27
+use smbcloud_ascapi_core::Client;
28
+use smbcloud_ascapi_core::Result;
29
30
pub const RESOURCE_TYPE: &str = "certificates";
31
@@ -123,7 +124,14 @@ pub struct CertificateCreateAttributes {
124
pub certificate_type: CertificateType,
125
}
126
126
-impl Client {
127
+/// Signing certificates.
128
+///
129
+/// An extension trait rather than inherent methods, because `Client`
130
+/// lives in the core crate and Rust only allows inherent impls in the
131
+/// crate that defines the type. Import it, or the crate's `prelude`,
132
+/// to call these on a `Client`.
133
+#[async_trait]
134
+pub trait CertificatesApi {
135
/// `GET /v1/certificates`, optionally filtered by type.
136
///
137
/// Apple returns expired certificates too, and gives no filter for
@@ -131,7 +139,40 @@ impl Client {
139
/// for yourself. That is deliberate on their side: an expired
140
/// certificate is still meaningful for identifying what a previously
141
/// shipped build was signed with.
134
- pub async fn list_certificates(
142
+ async fn list_certificates(
143
+ &self,
144
+ filter_type: Option<CertificateType>,
145
+ ) -> Result<Vec<Certificate>>;
146
+
147
+ /// `POST /v1/certificates` — issues a new certificate for a CSR.
148
+ ///
149
+ /// The response carries `certificate_content`, the only copy of the
150
+ /// signed certificate you are handed at creation time. It can be
151
+ /// fetched again later with [`CertificatesApi::list_certificates`], but the
152
+ /// private key it belongs to cannot, so store the two together
153
+ /// immediately.
154
+ ///
155
+ /// Apple caps how many certificates of each type a team may hold at
156
+ /// once (two for distribution). At the cap this returns a 409; revoke
157
+ /// something with [`CertificatesApi::revoke_certificate`] first.
158
+ async fn create_certificate(
159
+ &self,
160
+ attributes: CertificateCreateAttributes,
161
+ ) -> Result<Certificate>;
162
+
163
+ /// `DELETE /v1/certificates/{id}` — revokes a certificate.
164
+ ///
165
+ /// Irreversible, and wider-reaching than it looks: every provisioning
166
+ /// profile that embeds this certificate stops working for everyone on
167
+ /// the team at once, including builds already in CI. Revoking is for
168
+ /// reclaiming a slot at Apple's per-type cap or for a key you believe
169
+ /// is compromised, not for tidying up.
170
+ async fn revoke_certificate(&self, id: &str) -> Result<()>;
171
+}
172
+
173
+#[async_trait]
174
+impl CertificatesApi for Client {
175
+ async fn list_certificates(
176
&self,
177
filter_type: Option<CertificateType>,
178
) -> Result<Vec<Certificate>> {
@@ -149,18 +190,7 @@ impl Client {
190
Ok(doc.data)
191
}
192
152
- /// `POST /v1/certificates` — issues a new certificate for a CSR.
153
- ///
154
- /// The response carries `certificate_content`, the only copy of the
155
- /// signed certificate you are handed at creation time. It can be
156
- /// fetched again later with [`Client::list_certificates`], but the
157
- /// private key it belongs to cannot, so store the two together
158
- /// immediately.
159
- ///
160
- /// Apple caps how many certificates of each type a team may hold at
161
- /// once (two for distribution). At the cap this returns a 409; revoke
162
- /// something with [`Client::revoke_certificate`] first.
163
- pub async fn create_certificate(
193
+ async fn create_certificate(
194
&self,
195
attributes: CertificateCreateAttributes,
196
) -> Result<Certificate> {
@@ -177,14 +207,7 @@ impl Client {
207
Ok(doc.data)
208
}
209
180
- /// `DELETE /v1/certificates/{id}` — revokes a certificate.
181
- ///
182
- /// Irreversible, and wider-reaching than it looks: every provisioning
183
- /// profile that embeds this certificate stops working for everyone on
184
- /// the team at once, including builds already in CI. Revoking is for
185
- /// reclaiming a slot at Apple's per-type cap or for a key you believe
186
- /// is compromised, not for tidying up.
187
- pub async fn revoke_certificate(&self, id: &str) -> Result<()> {
210
+ async fn revoke_certificate(&self, id: &str) -> Result<()> {
211
self.request_no_content(
212
Method::DELETE,
213
&format!("/v1/certificates/{id}"),
crates/signing/src/csr.rs
renamed
+1
-1
@@ -20,10 +20,10 @@
20
//! [`rsa`] crate and is handed to rcgen as an externally supplied key
21
//! pair purely for the CSR's self-signature.
22
23
-use crate::error::{Error, Result};
23
use rcgen::{CertificateParams, DistinguishedName, DnType, KeyPair as RcgenKeyPair};
24
use rsa::pkcs8::{EncodePrivateKey, LineEnding};
25
use rsa::RsaPrivateKey;
26
+use smbcloud_ascapi_core::{Error, Result};
27
use zeroize::Zeroizing;
28
29
/// Apple rejects anything else. Not a tunable.
crates/signing/src/lib.rs
new
+22
@@ -0,0 +1,22 @@
1
+//! Apple code signing through App Store Connect.
2
+//!
3
+//! Two halves that only make sense together: [`csr`] generates an RSA key
4
+//! pair and a signing request locally, and [`certificate`] asks Apple to
5
+//! certify it.
6
+//!
7
+//! The division of labour is the whole point. Apple never receives, and
8
+//! never returns, a private key. You keep it; they vouch for its public
9
+//! half. A certificate whose key file is lost is permanently unusable, and
10
+//! an expired certificate cannot be renewed, only replaced by a new key
11
+//! pair and a new request.
12
+//!
13
+//! The API calls are an extension trait on
14
+//! [`Client`](smbcloud_ascapi_core::Client), since that type belongs to
15
+//! the core crate. Import [`prelude`] to call them.
16
+
17
+pub mod certificate;
18
+pub mod csr;
19
+
20
+pub mod prelude {
21
+ pub use crate::certificate::CertificatesApi;
22
+}
server.json
new
+72
@@ -0,0 +1,72 @@
1
+{
2
+ "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
3
+ "name": "io.github.smbcloudXYZ/ascapi",
4
+ "title": "The App Stores Cooolest API",
5
+ "description": "Forget Fastlane, this is the app stores coolest API.",
6
+ "version": "0.1.0",
7
+ "websiteUrl": "https://github.com/smbcloudXYZ/smbcloud-ascapi",
8
+ "repository": {
9
+ "url": "https://github.com/smbcloudXYZ/smbcloud-ascapi",
10
+ "source": "github",
11
+ "id": "1303134569"
12
+ },
13
+ "packages": [
14
+ {
15
+ "registryType": "cargo",
16
+ "registryBaseUrl": "https://crates.io",
17
+ "identifier": "smbcloud-ascapi-cli",
18
+ "version": "0.1.0",
19
+ "transport": {
20
+ "type": "stdio"
21
+ },
22
+ "packageArguments": [
23
+ {
24
+ "type": "named",
25
+ "name": "--mcp",
26
+ "description": "Run App Store Connect Signing as an MCP server over stdio.",
27
+ "isRequired": true
28
+ }
29
+ ],
30
+ "environmentVariables": [
31
+ {
32
+ "name": "ASC_API_KEY",
33
+ "description": "App Store Connect API key ID (Users and Access → Integrations → App Store Connect API).",
34
+ "isRequired": true,
35
+ "isSecret": false
36
+ },
37
+ {
38
+ "name": "ASC_ISSUER_ID",
39
+ "description": "App Store Connect API issuer ID, shown on the same page as the key.",
40
+ "isRequired": true,
41
+ "isSecret": false
42
+ },
43
+ {
44
+ "name": "ASC_PRIVATE_KEY_PATH",
45
+ "description": "Path to the .p8 private key for that API key. Defaults to ~/.appstoreconnect/private_keys/AuthKey_<key-id>.p8, matching Xcode's own convention.",
46
+ "isRequired": false,
47
+ "isSecret": true
48
+ }
49
+ ]
50
+ }
51
+ ],
52
+ "_meta": {
53
+ "io.modelcontextprotocol.registry/publisher-provided": {
54
+ "categories": [
55
+ "developer-tools",
56
+ "automation"
57
+ ],
58
+ "keywords": [
59
+ "code signing",
60
+ "App Store Connect",
61
+ "signing certificate",
62
+ "provisioning",
63
+ "iOS release",
64
+ "macOS release",
65
+ "certificate signing request",
66
+ "fastlane match alternative",
67
+ "Apple developer",
68
+ "CSR"
69
+ ]
70
+ }
71
+ }
72
+}