Skip to content

v1.3.0

Choose a tag to compare

View all tags
@erayendes erayendes released this 28 Jul 06:05
Immutable release. Only release title and notes can be modified.
v1.3.0
cf25ceb

Safety and usability release: every write is now schema-checked locally, previewed before confirmation, and never silently resent.

  • Writes are never auto-retried into duplicates. Reads still retry on 408/429/5xx; writes retry only on 429 (rejected before processing). A write that dies without a response reports an explicit unknown outcome — "Apple may or may not have processed it, verify before resending" — instead of being resent. Retry-After HTTP-date form supported.
  • Fail-closed confirmation. On clients without elicitation support, writes are now blocked with an error instead of silently proceeding; opt in explicitly with --allow-unconfirmed-writes / ASC_ALLOW_UNCONFIRMED_WRITES=1.
  • Real request-body schemas. All 355 body-taking operations carry a resolved JSON Schema (attributes, relationships, enums, required fields, closed-world objects) instead of a generic "JSON:API body" hint, and every write body is validated locally — a typo'd field or wrong enum fails with a field path before anything reaches Apple.
  • Impact preview, risk levels and typed confirmation. The confirmation prompt shows the operation, target ids, account, a summary of the changes and a reversibility note. Every mutating operation carries a hand-reviewed risk level (low / public / release / revenue / destructive / infrastructure / access); revenue, destructive, infrastructure and access writes require typing CONFIRM instead of ticking a box.
  • --dry-run / ASC_DRY_RUN=1: mutating calls validate and return what would have been sent (method, path, body, risk) — nothing reaches Apple. For CI and agent rehearsals.
  • Reviews-AI hardening: reviews travel to the model as untrusted JSON data (prompt-injection defense), statistics are computed deterministically with a previous-period trend comparison, truncation is reported honestly (fetched vs analyzed), drafts reply in the review's language, and brand voice / banned phrases / support URL come from ASC_REVIEWS_* env vars. Tools hide on clients without sampling support.
  • ASC_BASE_URL points the whole server at a local fixture for testing; host-pinning follows the override.
  • asc__status gains check_expirations — certificates and provisioning profiles expiring within 30 days.
  • Actionable hints on 403 (role lacks permission) and 409 (resource-state lock) errors, alongside the existing 401 hint.
  • GUIDE: multi-account patterns with existing mechanisms (per-server env, ASC_CONFIG_DIR).

Güvenlik ve kullanılabilirlik sürümü: her yazma artık yerelde şema kontrolünden geçiyor, onaydan önce önizleniyor ve asla sessizce yeniden gönderilmiyor.

  • Yazmalar otomatik retry ile çiftlenmiyor. Okumalar 408/429/5xx'te retry olmaya devam ediyor; yazmalar yalnız 429'da (işlenmeden reddedildi). Cevapsız ölen yazma, yeniden gönderilmek yerine açık bir belirsiz-sonuç hatası veriyor — "Apple işlemiş olabilir, göndermeden önce doğrula". Retry-After HTTP-date formatı destekleniyor.
  • Fail-closed onay. Elicitation desteklemeyen client'larda yazmalar artık sessizce geçmek yerine hata ile engelleniyor; açık opt-in: --allow-unconfirmed-writes / ASC_ALLOW_UNCONFIRMED_WRITES=1.
  • Gerçek request-body şemaları. Body alan 355 operasyonun tamamı, genel bir "JSON:API body" ipucu yerine çözülmüş JSON Schema taşıyor (attribute'lar, ilişkiler, enum'lar, zorunlu alanlar, kapalı-dünya objeler) ve her yazma body'si yerelde doğrulanıyor — yazım hatalı alan veya yanlış enum, Apple'a hiçbir şey gitmeden field path ile düşüyor.
Assets 3
Loading