Store operations: TestFlight wait / expire, IAP review submissions, listing pulls, release notes per language, offers, custom product pages, in-app events, reports, triage, keyword ranks, AdAttributionKit scan

- apple testflight wait --build N (progress, timeout, exit 0/1/7) and expire --keep N | --older-than D (dry run, asks)
- apple iap-submit: IAP / subscription / group versions into a review submission; first of a type only with the app
  version (--with-version), --no-submit keeps the draft; read-only MCP plan
- apple listing pull, play listing pull (diff, --write), catalog pull (config proposal, never rewritten)
- whats-new --languages / check / apply: one file per language, agent or hook translation, per-store limits
- apple offer-codes, win-back, promoted, preorder; Play pre-registration as a guide (no API)
- apple cpp and apple events: list, create, upload, submit (asks)
- reports: Apple sales / finance, Play earnings / sales into .storebound/reports with summary and CSV
- triage: TestFlight crash / feedback and Play error reports grouped by signature, device, OS
- aso rank: iTunes Search API ranks and competitors, rate limited
- ads scan: AdAttributionKit / SKAdNetwork Info.plist and source checks
- tests against recorded, sanitized answers; skills, README, CHANGELOG

skills/ads-mediation-checks/SKILL.md

@@ -1,12 +1,12 @@
 ---
 name: ads-mediation-checks
-description: Diagnose and verify ad mediation in a mobile app or game before and after store release - Google AdMob (Ad Inspector), AppLovin MAX (Mediation Debugger) and Unity LevelPlay / ironSource (validateIntegration) with their networks - app ids and ad unit ids, adapter versions, test devices, no-fill before launch, app-ads.txt on the developer website, SKAdNetwork ids, ATT, privacy manifests, consent, COPPA and Data safety / App Privacy answers. Use when ads do not load, a network reports invalid ids, the user adds an ad SDK, or prepares ads for launch.
+description: Diagnose and verify ad mediation in a mobile app or game before and after store release - Google AdMob (Ad Inspector), AppLovin MAX (Mediation Debugger) and Unity LevelPlay / ironSource (validateIntegration) with their networks - app ids and ad unit ids, adapter versions, test devices, no-fill before launch, app-ads.txt on the developer website, SKAdNetwork ids, AdAttributionKit (ad network ids, postback copies, attribution windows; storebound ads scan), ATT, privacy manifests, consent, COPPA and Data safety / App Privacy answers. Use when ads do not load, a network reports invalid ids, the user adds an ad SDK, or prepares ads for launch.
 ---
 
 # Ad mediation checks (AdMob, AppLovin MAX, LevelPlay)
 
-No CLI needed apart from `storebound validate --play` (app-ads.txt) and `storebound privacy-manifest`; these are checks
-to run and read. Ask the owner before changing any dashboard setting. Most apps without ads can skip this skill.
+CLI: `storebound ads scan --ios <path>` (AdAttributionKit / SKAdNetwork configuration, below), `storebound validate
+--play` (app-ads.txt) and `storebound privacy-manifest`; the rest are checks to run and read. Ask the owner before changing any dashboard setting. Most apps without ads can skip this skill.
 
 ## Every mediation platform
 1. **Ids per platform**: iOS and Android have different app ids / keys and ad unit ids. Production ids only in release
@@ -32,6 +32,30 @@ to run and read. Ask the owner before changing any dashboard setting. Most apps
 8. **Placement**: no ads at launch, on exit or mid-task / mid-round; close buttons visible; rewarded ads always
    optional. Reviewers test the first minutes.
 
+## AdAttributionKit and SKAdNetwork (iOS)
+`storebound ads scan --ios ios/App [--json]` (MCP: `ads_scan`; local, read-only, exit 1 on a blocker) reads the app's
+Info.plist (Pods, build output, tests and extensions left out), `Podfile.lock` / `Package.resolved` and the Swift /
+Objective-C sources. What it checks, with Apple's documentation (links in `cli/lib/adattribution.ts`):
+- **Publisher app** (shows ads): every network's ids in `SKAdNetworkItems` (dictionaries with `SKAdNetworkIdentifier`)
+  and, for AdAttributionKit, in `AdNetworkIdentifiers` (array of strings). Apple: lowercase, "otherwise, the system
+  doesn't recognize it as a valid network" (capital letters = blocker). `.skadnetwork` and `.adattributionkit` ids work
+  for both frameworks, so the same list can go into both keys; ids only in `SKAdNetworkItems` are flagged for
+  AdAttributionKit. Ad SDKs without any ids = blocker (installs from those ads cannot be attributed).
+- **Advertised app** (runs ad campaigns): copies of winning postbacks with `AttributionCopyEndpoint` ("AdAttributionKit -
+  Postback Copy URL" in Xcode; storebound reads it inside an `AdAttributionKit` dictionary or at the top level), an
+  https URL whose registrable domain gets POSTs at `/.well-known/appattribution/report-attribution/` (a path is
+  ignored); re-engagement copies with `EligibleForAdAttributionKitReengagementPostbackCopies` = YES (needs the copy
+  endpoint); SKAdNetwork copies (and Private Click Measurement) with `NSAdvertisingAttributionReportEndpoint`. The app
+  must call `updateConversionValue` (AdAttributionKit) or `updatePostbackConversionValue` (SKAdNetwork) at least once,
+  best at first launch, or an attribution SDK (AppsFlyer, Adjust, Branch, Singular, Kochava) must do it.
+- **Attribution rules**: `AdAttributionKitConfigurations` > `AttributionWindows` > `global` or an ad network id >
+  `install` > `click` 1-30 days, `view` 1-7 days, `ignoreInteractionType` view | click (ad network entries only);
+  `AttributionCooldown` > `install-cooldown-hours` / `re-engagement-cooldown-hours` 0-720.
+- AdAttributionKit and SKAdNetwork need **no ATT prompt**; keep `NSUserTrackingUsageDescription` only when the app
+  really tracks across apps (store-declarations).
+Test attribution with Developer Mode and the postback testing in Settings > Developer (Apple: "Testing ad
+attributions with Developer Mode"); the scan only checks the configuration, not delivery.
+
 ## Google AdMob
 - Ad Inspector (SDK 20.0.0+, test devices only) shows each ad unit's mediation waterfall, adapter status and errors:
   https://developers.google.com/admob/android/ad-inspector (iOS: the same page under /admob/ios/).