apple submit --build <n> (first submission, the resubmit steps; plan table with --json under serve); desktop owner actions to send for review: owner.apple_submit, owner.apple_resubmit, owner.apple_iap_submit, owner.play_production, and the price gate owner actions (owner.prices_play_products / _play_subscriptions / _apple_subscriptions; owner.prices_import passes --allow-price-changes after the dialog); OWNER_ALLOWED_ARGS ties each forbidden flag to its one action, dry runs never carry owner flags, MCP still has no submit or production release; submit dialog text in the host; system.tools androidSdk, project.inspect playRelease, declarations dataDeletion

apps/desktop/src-tauri/src/policy.rs

@@ -53,7 +53,8 @@ pub enum Kind {
     Session,
     /// Account-scoped store reads (apps.list, account.check): the host runs them with one account's key.
     Account,
-    /// Owner actions (rollout share, phased release, sending one approved reply): like writes, a dry run from the
+    /// Owner actions (rollout share, phased release, sending one approved reply, submit for review, the Play production
+    /// release, price changes): like writes, a dry run from the
     /// window; the real run only through `write_with_confirm`, whose dialog says that users see it at once.
     Owner,
 }
@@ -106,6 +107,11 @@ pub fn sanitize_js_call(method: &str, kind: Option<Kind>, params: &Value) -> Res
     Ok(Value::Object(out))
 }
 
+/// Owner actions that send the app to review or to production (cli/serve.ts OWNER_SUBMIT): App Store submit, resubmit
+/// after a rejection, in-app purchases to App Review, the Play production release. Like every owner action they run
+/// for real only through `write_with_confirm`; their dialog says that the app goes to review and may go live by itself.
+pub const SUBMIT_METHODS: &[&str] = &["owner.apple_submit", "owner.apple_resubmit", "owner.apple_iap_submit", "owner.play_production"];
+
 /// Write methods whose project is a new folder without a config (the host picks it in a native dialog and runs them
 /// in its own commands: `project_init`, `project_import_fastlane`); `write_with_confirm` never runs them.
 pub const NEW_FOLDER_METHODS: &[&str] = &["project.init", "import.fastlane"];