Review rulepack (public)

The rulepack bundle is the content that drives the forvibe review CLI's static rule engine: the Apple guideline rules, the SDK registry, the rejection story corpus, and the guideline index, all for one store. This endpoint is public and unauthenticated on purpose - CLI users may not have a Forvibe account, and the same content ships inside the @forvibe/cli npm package as a bundled fallback.

Why this endpoint exists

The CLI never blocks a review on the network. Every run tries this endpoint first (with If-None-Match), falls back to a cached copy from a previous run, and falls back again to the snapshot bundled inside the npm package if both the network and the cache are unavailable. That means Forvibe can improve rules, add SDKs, or add rejection stories at any time without waiting on developers to upgrade their CLI version, while the CLI still works fully offline.

Request

GET /api/v1/review-rulepack?store=appstore

# No authentication, no API key, no scope required.
# store defaults to "appstore" if omitted.

Store availability

• appstore: published. Returns the full bundle below.
• play: recognized but not yet published. Returns 404 until Play rules ship.
• Any other value: 400 with { "error": "Invalid store. Supported: appstore" }.

// 404 response body when store is valid but unpublished (e.g. "play")
{ "error": "Rule pack not published for this store yet" }

Caching: ETag and 304

The response carries a strong ETag (a quoted sha256 hex digest of the canonicalized bundle) and a Cache-Control header of public, max-age=300, s-maxage=86400, stale-while-revalidate=604800. Send the ETag back as If-None-Match on the next request; a match returns 304 with no body and the same headers. The bundle is only recomputed on deploy, not per request, so the ETag is stable between content releases.

Response shape (schema_version 1)

• schema_version: always 1 for this bundle format. The CLI treats any other value as an unreadable response and falls back to cache or the bundled snapshot.
• store, version, updated_at: which store this bundle covers, its content version, and when it was last regenerated.
• rules: the deterministic rule definitions the static engine evaluates against a scanned codebase.
• sdk_registry: known SDK coordinates (npm / pub / pods / gradle / UPM) mapped to category, required permission strings, and privacy-manifest flags.
• stories: the rejection story corpus, grouped by guideline area, used to calibrate the AI reviewer pass and to link findings to real precedent.
• guidelines: an index of Apple App Store Review Guideline numbers to their name and section, keyed by guideline number.

CLI usage

You don't call this endpoint directly in normal use - npx @forvibe/cli review polls it automatically before every scan. Override the base URL for local development with --rulepack-url, or point it at a different API host with --api-url.

npx @forvibe/cli review --send

# Loading review rulepack...
# Rulepack v2.2.2 (remote)      <- fetched fresh, cache updated
# Rulepack v2.2.2 (cache)       <- 304 Not Modified, served from local cache
# Rulepack v2.2.2 (bundled)     <- offline or unreachable, served from the npm package