@capacitor-plus/cli 8.5.3 → 8.6.1

package/dist/declarations.d.ts

@@ -709,13 +709,31 @@ export interface PluginsConfig {
          *
          * This option is only supported on Android.
          *
-         * `css` = Injects CSS variables (`--safe-area-inset-*`) containing correct safe area inset values into the webview.
+         * `native` = (recommended) For older Chromium versions (< v140) this embeds the webview with padding and sets the `env(safe-area-inset-*)` variables to `0px`. For newer Chromium versions (>= v140) this makes sure the webview adheres to the `viewport-fit` meta tag. If set to `viewport-fit="cover"` this will make the webview edge-to-edge and the `env(safe-area-inset-*)` variables will contain the correct values. With those values you could set padding for example to make sure the webview is shown correctly.
          *
-         * `disable` = Disable CSS variables injection.
+         * `css` = This is the same as `native`, but it also injects CSS variables (`--safe-area-inset-*`) containing correct safe area inset values into the webview.
+         *
+         * `disable` = (not recommended) Disable safe area insets handling completely.
+         * This shifts the responsibility from Capacitor to your own code to handle the insets.
+         * Be aware that this might result in a visually broken UI if your native app code and the content loaded into the webview do not correctly handle safe area insets.
          *
          * @default "css"
          */
-        insetsHandling?: 'css' | 'disable';
+        insetsHandling?: 'native' | 'css' | 'disable';
+        /**
+         * Set an initial value for the to be detected `viewport-fit=` meta tag value.
+         * For most apps that support edge-to-edge this value will eventually be `cover`.
+         * Therefore you might want to set this value to `cover` to help prevent layout jumps and glitches.
+         * If you know the value to be `cover` initially, you can set it here.
+         * The value will always end up correctly, no matter what you set here,
+         * as long as `insetsHandling` is set to `native` or `css`.
+         * It only exists to help prevent layout jumps and glitches.
+         *
+         * This option is only supported on Android.
+         *
+         * @default undefined
+         */
+        initialViewportFitValueHint?: 'auto' | 'contain' | 'cover';
         /**
          * The style of the text and icons of the system bars.
          *

package/dist/index.js

@@ -105,24 +105,14 @@ function runProgram(config) {
         .option('--configuration <name>', 'Configuration name of the iOS Scheme')
         .option('--keystorealiaspass <keystoreAliasPass>', 'Password for the Key Alias')
         .addOption(new commander_1.Option('--androidreleasetype <androidreleasetype>', 'Android release type; APK or AAB').choices([
-        'AAB',
-        'APK',
+        ...telemetry_1.TELEMETRY_SAFE_CHOICES.androidreleasetype,
     ]))
         .addOption(new commander_1.Option('--signing-type <signingtype>', 'Program used to sign apps (default: jarsigner)').choices([
-        'apksigner',
-        'jarsigner',
+        ...telemetry_1.TELEMETRY_SAFE_CHOICES.signingType,
     ]))
         .addOption(new commander_1.Option('--xcode-team-id <xcodeTeamID>', 'The Developer team to use for building and exporting the archive'))
-        .addOption(new commander_1.Option('--xcode-export-method <xcodeExportMethod>', 'Describes how xcodebuild should export the archive (default:  app-store-connect)').choices([
-        'app-store-connect',
-        'release-testing',
-        'enterprise',
-        'debugging',
-        'developer-id',
-        'mac-application',
-        'validation',
-    ]))
-        .addOption(new commander_1.Option('--xcode-signing-style <xcodeSigningStyle>', 'The iOS signing style to use when building the app for distribution (default: automatic)').choices(['automatic', 'manual']))
+        .addOption(new commander_1.Option('--xcode-export-method <xcodeExportMethod>', 'Describes how xcodebuild should export the archive (default:  app-store-connect)').choices([...telemetry_1.TELEMETRY_SAFE_CHOICES.xcodeExportMethod]))
+        .addOption(new commander_1.Option('--xcode-signing-style <xcodeSigningStyle>', 'The iOS signing style to use when building the app for distribution (default: automatic)').choices([...telemetry_1.TELEMETRY_SAFE_CHOICES.xcodeSigningStyle]))
         .addOption(new commander_1.Option('--xcode-signing-certificate <xcodeSigningCertificate>', 'A certificate name, SHA-1 hash, or automatic selector to use for signing for iOS builds'))
         .addOption(new commander_1.Option('--xcode-provisioning-profile <xcodeProvisioningProfile>', 'A provisioning profile name or UUID for iOS builds'))
         .action((0, cli_1.wrapAction)((0, telemetry_1.telemetryAction)(config, async (platform, { scheme, flavor, keystorepath, keystorepass, keystorealias, keystorealiaspass, androidreleasetype, signingType, configuration, xcodeTeamId, xcodeExportMethod, xcodeSigningStyle, xcodeSigningCertificate, xcodeProvisioningProfile, }) => {

package/dist/ios/update.js

@@ -546,6 +546,7 @@ async function copyPluginsNativeFiles(config, cordovaPlugins) {
         const sourceFiles = (0, plugin_1.getPlatformElement)(p, platform, 'source-file');
         const headerFiles = (0, plugin_1.getPlatformElement)(p, platform, 'header-file');
         const codeFiles = sourceFiles.concat(headerFiles);
+        const pluginSuppliesAppDelegate = codeFiles.some((codeFile) => codeFile.$.src.split('/').pop() === 'AppDelegate.h');
         const frameworks = (0, plugin_1.getPlatformElement)(p, platform, 'framework');
         let sourcesFolderName = 'sources';
         if (!isSPM && (0, cordova_1.needsStaticPod)(p)) {
@@ -592,6 +593,10 @@ async function copyPluginsNativeFiles(config, cordovaPlugins) {
                         fileContent = fileContent.replace(/self.webView.superview/g, 'self.viewController.view');
                         await (0, fs_extra_1.writeFile)(fileDest, fileContent, { encoding: 'utf-8' });
                     }
+                    if (isSPM && !pluginSuppliesAppDelegate && fileContent.includes(`#import "AppDelegate.h"`)) {
+                        fileContent = fileContent.replaceAll(`#import "AppDelegate.h"`, `#import <Cordova/AppDelegate.h>`);
+                        await (0, fs_extra_1.writeFile)(fileDest, fileContent, { encoding: 'utf-8' });
+                    }
                 }
             }
         }

package/dist/tasks/copy.js

@@ -57,7 +57,9 @@ async function copy(config, platformName, inline = false) {
             usesLiveUpdates = true;
         }
         let usesSSLPinning = false;
-        if (allPlugins.filter((plugin) => plugin.id === '@ionic-enterprise/ssl-pinning' || plugin.id === '@capacitor/ssl-pinning').length > 0) {
+        if (allPlugins.filter((plugin) => plugin.id === '@ionic-enterprise/ssl-pinning' ||
+            plugin.id === '@capacitor/ssl-pinning' ||
+            plugin.id === '@capacitor-community/ssl-pinning').length > 0) {
             usesSSLPinning = true;
         }
         if (platformName === config.ios.name) {

package/dist/tasks/doctor.js

@@ -10,6 +10,7 @@ const doctor_2 = require("../ios/doctor");
 const log_1 = require("../log");
 const emoji_1 = require("../util/emoji");
 const node_1 = require("../util/node");
+const npm_1 = require("../util/npm");
 const subprocess_1 = require("../util/subprocess");
 async function doctorCommand(config, selectedPlatformName) {
     log_1.output.write(`${(0, emoji_1.emoji)('💊', '')}   ${colors_1.default.strong('Capacitor Doctor')}  ${(0, emoji_1.emoji)('💊', '')} \n\n`);
@@ -21,7 +22,7 @@ async function doctorCommand(config, selectedPlatformName) {
 }
 exports.doctorCommand = doctorCommand;
 async function doctorCore(config) {
-    const [cliVersionPlus, coreVersionPlus, androidVersionPlus, iosVersionPlus, cliVersion, coreVersion, androidVersion, iosVersion,] = await Promise.all([
+    const [cliVersionPlus, coreVersionPlus, androidVersionPlus, iosVersionPlus, cliVersion, coreVersion, androidVersion, iosVersion, blockedInstallScripts,] = await Promise.all([
         (0, subprocess_1.getCommandOutput)('npm', ['info', '@capacitor-plus/cli', 'version']),
         (0, subprocess_1.getCommandOutput)('npm', ['info', '@capacitor-plus/core', 'version']),
         (0, subprocess_1.getCommandOutput)('npm', ['info', '@capacitor-plus/android', 'version']),
@@ -30,6 +31,7 @@ async function doctorCore(config) {
         (0, subprocess_1.getCommandOutput)('npm', ['info', '@capacitor/core', 'version']),
         (0, subprocess_1.getCommandOutput)('npm', ['info', '@capacitor/android', 'version']),
         (0, subprocess_1.getCommandOutput)('npm', ['info', '@capacitor/ios', 'version']),
+        (0, npm_1.getBlockedInstallScripts)(config.app.rootDir),
     ]);
     log_1.output.write(`${colors_1.default.strong('Latest Dependencies:')}\n\n` +
         `  @capacitor-plus/cli: ${colors_1.default.weak(cliVersionPlus !== null && cliVersionPlus !== void 0 ? cliVersionPlus : 'unknown')}\n` +
@@ -43,6 +45,9 @@ async function doctorCore(config) {
         `${colors_1.default.strong('Installed Dependencies:')}\n\n`);
     await printInstalledPackages(config);
     log_1.output.write('\n');
+    if (blockedInstallScripts !== null) {
+        (0, npm_1.logBlockedInstallScripts)(blockedInstallScripts);
+    }
 }
 exports.doctorCore = doctorCore;
 async function printInstalledPackages(config) {

package/dist/tasks/migrate.js

@@ -12,6 +12,7 @@ const errors_1 = require("../errors");
 const common_2 = require("../ios/common");
 const log_1 = require("../log");
 const fs_1 = require("../util/fs");
+const npm_1 = require("../util/npm");
 const subprocess_1 = require("../util/subprocess");
 const template_1 = require("../util/template");
 const migrate_uiscene_1 = require("./migrate-uiscene");
@@ -84,8 +85,10 @@ const pluginVersion = '^8.0.0';
 const gradleVersion = '8.14.3';
 const iOSVersion = '15';
 const kotlinVersion = '2.2.20';
-let installFailed = false;
 async function migrateCommand(config, noprompt, packagemanager) {
+    let installFailed = false;
+    let scriptsBlocked = false;
+    let scriptsUnverified = false;
     if (config === null) {
         (0, errors_1.fatal)('Config data missing');
     }
@@ -153,6 +156,16 @@ async function migrateCommand(config, noprompt, packagemanager) {
                 log_1.logger.error(`${installerType} install failed. Try deleting node_modules folder and running ${colors_1.default.input(`${installerType} install --force`)} manually.`);
                 installFailed = true;
             }
+            if (runNpmInstall && !installFailed) {
+                const blocked = await (0, npm_1.getBlockedInstallScripts)(config.app.rootDir, installerType);
+                if (blocked === null) {
+                    scriptsUnverified = true;
+                }
+                else if (blocked.length > 0) {
+                    (0, npm_1.logBlockedInstallScripts)(blocked);
+                    scriptsBlocked = (0, npm_1.hasBlockedCapacitorScripts)(blocked);
+                }
+            }
             // Update iOS Projects
             if ((allDependencies['@capacitor-plus/ios'] || allDependencies['@capacitor/ios']) &&
                 (0, fs_extra_1.existsSync)(config.ios.platformDirAbs)) {
@@ -277,9 +290,12 @@ async function migrateCommand(config, noprompt, packagemanager) {
             await (0, common_1.runTask)(`Writing breaking changes.`, () => {
                 return writeBreakingChanges();
             });
-            if (!installFailed) {
+            if (!installFailed && !scriptsBlocked && !scriptsUnverified) {
                 (0, log_1.logSuccess)(`Migration to Capacitor ${coreVersion} is complete. Run and test your app!`);
             }
+            else if (scriptsBlocked) {
+                log_1.logger.warn(`Migration to Capacitor ${coreVersion} is incomplete because npm blocked install scripts. Approve them as described above, then run ${colors_1.default.input('npx cap sync')}.`);
+            }
             else {
                 log_1.logger.warn(`Migration to Capacitor ${coreVersion} is incomplete. Check the log messages for more information.`);
             }

package/dist/telemetry.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getIOSPackageManager = exports.sendMetric = exports.telemetryAction = void 0;
+exports.getIOSPackageManager = exports.sendMetric = exports.getTelemetryVersion = exports.getTelemetryArguments = exports.getTelemetryError = exports.getTelemetryOptions = exports.telemetryAction = exports.TELEMETRY_SAFE_CHOICES = void 0;
 const tslib_1 = require("tslib");
 const commander_1 = require("commander");
 const debug_1 = tslib_1.__importDefault(require("debug"));
@@ -15,6 +15,104 @@ const debug = (0, debug_1.default)('capacitor:telemetry');
 const THANK_YOU = `\nThank you for helping improve Capacitor by sharing anonymous usage data! 💖` +
     `\nInformation about the data we collect is available on our website: ${colors_1.default.strong('https://capacitorjs.com/docs/next/cli/telemetry')}` +
     `\nYou can disable telemetry at any time by using the ${colors_1.default.input('npx cap telemetry off')} command.`;
+/**
+ * The option values that are safe to report, keyed by the option's resolved
+ * name (commander's `attributeName()`, so `--signing-type` is `signingType`).
+ * This is an allowlist by design: a denylist of password-like names would leak
+ * the first sensitive option someone adds.
+ *
+ * The option declarations in `index.ts` spread these same lists into
+ * `.choices()`, so an option cannot offer a choice this does not list.
+ */
+exports.TELEMETRY_SAFE_CHOICES = {
+    androidreleasetype: ['AAB', 'APK'],
+    signingType: ['apksigner', 'jarsigner'],
+    xcodeExportMethod: [
+        'app-store-connect',
+        'release-testing',
+        'enterprise',
+        'debugging',
+        'developer-id',
+        'mac-application',
+        'validation',
+    ],
+    xcodeSigningStyle: ['automatic', 'manual'],
+};
+const telemetrySafeChoices = new Map(Object.entries(exports.TELEMETRY_SAFE_CHOICES).map(([name, choices]) => [name, new Set(choices)]));
+/**
+ * Positional argument values that are safe to report. Everything else is
+ * dropped, since arguments like `cap init`'s app name are user content.
+ */
+const TELEMETRY_ARGUMENT_ALLOWLIST = new Set(['android', 'ios', 'web']);
+/**
+ * Upper bound on the reported error, so a failed Gradle or Xcode build cannot
+ * ship its entire log as a metric.
+ */
+const TELEMETRY_ERROR_MAX_LENGTH = 500;
+const TELEMETRY_COMMAND_FAILED = 'command_failed';
+/**
+ * Lines from a failed subprocess that are safe to report. Build-setting dumps,
+ * environment echoes, and arbitrary log lines can still carry secrets after
+ * value redaction, so only tool error summaries are kept.
+ */
+function pickAllowlistedTelemetryErrorLines(redacted) {
+    const lines = redacted.split('\n').filter((line) => {
+        const trimmed = line.trim();
+        if (!trimmed) {
+            return false;
+        }
+        if (/^Build settings from command line:/i.test(trimmed)) {
+            return false;
+        }
+        if (/^\S+\s=/.test(trimmed)) {
+            return false;
+        }
+        if (/^Error:/i.test(trimmed)) {
+            return true;
+        }
+        if (/^FAILURE:/i.test(trimmed)) {
+            return true;
+        }
+        if (/platform has not been added/i.test(trimmed)) {
+            return true;
+        }
+        if (/no device matched target/i.test(trimmed)) {
+            return true;
+        }
+        if (/keystore password was not accepted/i.test(trimmed)) {
+            return true;
+        }
+        if (/^[\w.-]+: error:/i.test(trimmed)) {
+            return true;
+        }
+        if (/^jarsigner:/i.test(trimmed)) {
+            return true;
+        }
+        if (/^xcodebuild:/i.test(trimmed)) {
+            return true;
+        }
+        return false;
+    });
+    return lines.join('\n');
+}
+/**
+ * Shortest value worth scrubbing out of a reported error. An empty string would
+ * match between every character, and a one- or two-character option value--a
+ * port, a target index--appears throughout unrelated output, so redacting
+ * either destroys the error instead of sanitizing it.
+ */
+const TELEMETRY_REDACTION_MIN_LENGTH = 3;
+/**
+ * The characters a dependency spec may contain to be reported as-is. A version
+ * range has none of the `:/@` a URL or path spec needs, so specs such as
+ * `git+https://x-access-token:<token>@github.com/acme/plugin.git` and
+ * `file:/Users/<name>/dev/plugin` are reported as {@link NON_REGISTRY_VERSION}
+ * instead of shipping a credential or a local path. The pnpm and yarn workspace
+ * protocols are allowed through as the only exception, since they resolve
+ * within the repo and so cannot carry either.
+ */
+const TELEMETRY_SAFE_VERSION_PATTERN = /^(?:(?:workspace|catalog):)?[\w.\-+^~><=|* ]*$/;
+const NON_REGISTRY_VERSION = 'non-registry';
 function telemetryAction(config, action) {
     return async (...actionArgs) => {
         const start = new Date();
@@ -41,15 +139,16 @@ function telemetryAction(config, action) {
         const capacitorPackages = packages.filter(([k]) => k.startsWith('@capacitor-plus/'));
         const versions = capacitorPackages.map(([k, v]) => [
             `${k.replace(/^@capacitor-plus\//, '').replace(/-/g, '_')}_version`,
-            v,
+            getTelemetryVersion(v),
         ]);
+        const options = getTelemetryOptions(cmd);
         const data = {
             app_id: await getAppIdentifier(config),
             command,
-            arguments: cmd.args.join(' '),
-            options: JSON.stringify(cmd.opts()),
+            arguments: getTelemetryArguments(cmd),
+            options: JSON.stringify(options),
             duration,
-            error: error ? (error.message ? error.message : String(error)) : null,
+            error: getTelemetryError(cmd, error, config, options),
             node_version: process.version,
             os: config.cli.os,
             ios_package_manager: await getIOSPackageManager(config),
@@ -72,6 +171,90 @@ function telemetryAction(config, action) {
     };
 }
 exports.telemetryAction = telemetryAction;
+/**
+ * Build the reported option map: every option name the command resolved, but
+ * only the values that cannot carry a secret. Booleans are kept because they
+ * cannot encode one, allowlisted options are kept when the value is one this
+ * file lists, and every other value--keystore passwords, paths, signing
+ * identities--becomes `null`.
+ */
+function getTelemetryOptions(cmd) {
+    return Object.fromEntries(Object.entries(cmd.opts()).map(([name, value]) => [name, isTelemetrySafeValue(name, value) ? value : null]));
+}
+exports.getTelemetryOptions = getTelemetryOptions;
+function isTelemetrySafeValue(name, value) {
+    var _a, _b;
+    if (typeof value === 'boolean') {
+        return true;
+    }
+    return typeof value === 'string' && ((_b = (_a = telemetrySafeChoices.get(name)) === null || _a === void 0 ? void 0 : _a.has(value)) !== null && _b !== void 0 ? _b : false);
+}
+/**
+ * The signing credentials `capacitor.config` can supply. `cap build` falls back
+ * to the config for each of these when the flag is absent, and the resolved
+ * value still reaches the `xcodebuild` and `jarsigner` command lines--so it can
+ * come back in their output without ever having appeared in `cmd.opts()`.
+ */
+function getConfiguredCredentials(config) {
+    return [
+        config.android.buildOptions.keystorePath,
+        config.android.buildOptions.keystorePassword,
+        config.android.buildOptions.keystoreAlias,
+        config.android.buildOptions.keystoreAliasPassword,
+        config.ios.buildOptions.teamId,
+        config.ios.buildOptions.signingCertificate,
+        config.ios.buildOptions.provisioningProfile,
+    ].filter((value) => typeof value === 'string');
+}
+/**
+ * Build the reported error, scrubbed of every option value and positional
+ * argument the rest of the payload drops, plus the signing credentials the
+ * config can supply in place of a flag, then truncated.
+ *
+ * Failed subprocesses rethrow the tool's combined output, which echoes back
+ * the very values that were redacted out of the option map--`xcodebuild`
+ * prints its command-line build settings, `jarsigner` prints the keystore it
+ * was pointed at.
+ */
+function getTelemetryError(cmd, error, config, options = getTelemetryOptions(cmd)) {
+    if (!error) {
+        return null;
+    }
+    const values = cmd.opts();
+    const redacted = [
+        ...Object.entries(options)
+            .filter(([, value]) => value === null)
+            .map(([name]) => values[name]),
+        ...cmd.args.filter((arg) => !TELEMETRY_ARGUMENT_ALLOWLIST.has(arg)),
+        ...getConfiguredCredentials(config),
+    ]
+        .filter((value) => typeof value === 'string' && value.length >= TELEMETRY_REDACTION_MIN_LENGTH)
+        .sort((a, b) => b.length - a.length);
+    const scrubbed = redacted.reduce((message, value) => message.replaceAll(value, '<redacted>'), error.message ? error.message : String(error));
+    const allowlisted = pickAllowlistedTelemetryErrorLines(scrubbed);
+    if (!allowlisted) {
+        return TELEMETRY_COMMAND_FAILED;
+    }
+    return allowlisted.slice(0, TELEMETRY_ERROR_MAX_LENGTH);
+}
+exports.getTelemetryError = getTelemetryError;
+/**
+ * Build the reported positional arguments, keeping only allowlisted values.
+ */
+function getTelemetryArguments(cmd) {
+    return cmd.args.filter((arg) => TELEMETRY_ARGUMENT_ALLOWLIST.has(arg)).join(' ');
+}
+exports.getTelemetryArguments = getTelemetryArguments;
+/**
+ * Build the reported version of a Capacitor dependency, keeping the spec only
+ * when it is a version range. Specs that point somewhere--a git URL, a local
+ * path--are reported as being just that, since they can carry a token or a
+ * username.
+ */
+function getTelemetryVersion(spec) {
+    return spec && TELEMETRY_SAFE_VERSION_PATTERN.test(spec) ? spec : NON_REGISTRY_VERSION;
+}
+exports.getTelemetryVersion = getTelemetryVersion;
 /**
  * If telemetry is enabled, send a metric via IPC to a forked process for uploading.
  */

package/dist/util/npm.js

@@ -0,0 +1,197 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logBlockedInstallScripts = exports.hasBlockedCapacitorScripts = exports.parseBlockedInstallScripts = exports.getBlockedInstallScripts = exports.isNpmProject = exports.logAmbiguousLockfiles = void 0;
+const tslib_1 = require("tslib");
+const fs_extra_1 = require("fs-extra");
+const path_1 = require("path");
+const colors_1 = tslib_1.__importDefault(require("../colors"));
+const log_1 = require("../log");
+const subprocess_1 = require("./subprocess");
+const LOCKFILE_MANAGERS = [
+    ['package-lock.json', 'npm'],
+    ['npm-shrinkwrap.json', 'npm'],
+    ['pnpm-lock.yaml', 'pnpm'],
+    ['yarn.lock', 'yarn'],
+    ['bun.lock', 'bun'],
+    ['bun.lockb', 'bun'],
+];
+function detectLockfileManagers(rootDir) {
+    const managers = new Set();
+    for (const [lockfile, manager] of LOCKFILE_MANAGERS) {
+        if ((0, fs_extra_1.existsSync)((0, path_1.join)(rootDir, lockfile))) {
+            managers.add(manager);
+        }
+    }
+    return managers;
+}
+function hasNpmLockfileDisabled(rootDir) {
+    const npmrcPath = (0, path_1.join)(rootDir, '.npmrc');
+    if (!(0, fs_extra_1.existsSync)(npmrcPath)) {
+        return false;
+    }
+    try {
+        for (const line of (0, fs_extra_1.readFileSync)(npmrcPath, 'utf-8').split('\n')) {
+            const trimmed = line.trim();
+            if (trimmed === '' || trimmed.startsWith('#') || trimmed.startsWith(';')) {
+                continue;
+            }
+            const match = trimmed.match(/^package-lock\s*=\s*(false|0)\s*$/i);
+            if (match) {
+                return true;
+            }
+        }
+    }
+    catch (e) {
+        return false;
+    }
+    return false;
+}
+function logAmbiguousLockfiles(rootDir) {
+    const managers = detectLockfileManagers(rootDir);
+    if (managers.size <= 1) {
+        return;
+    }
+    try {
+        const { packageManager } = (0, fs_extra_1.readJSONSync)((0, path_1.join)(rootDir, 'package.json'));
+        if (typeof packageManager === 'string') {
+            return;
+        }
+    }
+    catch (e) {
+        // fall through
+    }
+    log_1.output.write(`${colors_1.default.strong('Ambiguous package manager:')}\n\n` +
+        `  Multiple lockfiles are present (${[...managers].join(', ')}), so blocked install scripts cannot be checked reliably.\n` +
+        `  Remove stale lockfiles or set ${colors_1.default.input('packageManager')} in package.json.\n\n`);
+}
+exports.logAmbiguousLockfiles = logAmbiguousLockfiles;
+/**
+ * `npm install-scripts ls` compares the tree against npm's own `allowScripts` map, which yarn and
+ * pnpm never write. It therefore reports every install script in a yarn or pnpm project as
+ * blocked, even when that package manager ran it, so the check has to know who did the install.
+ *
+ * Only a positive signal counts. `rootDir` is the app package, which in a workspace holds neither
+ * a lockfile nor a `packageManager` field, and guessing npm there reports blocked scripts for an
+ * install npm never performed.
+ */
+async function isNpmProject(rootDir) {
+    try {
+        const { packageManager } = await (0, fs_extra_1.readJSON)((0, path_1.join)(rootDir, 'package.json'));
+        if (typeof packageManager === 'string') {
+            return packageManager.split('@')[0] === 'npm';
+        }
+    }
+    catch (e) {
+        // no package.json, or an unreadable one: fall through to the lockfiles
+    }
+    const managers = detectLockfileManagers(rootDir);
+    if (managers.size === 1) {
+        return managers.has('npm');
+    }
+    if (managers.size > 1) {
+        return false;
+    }
+    if ((0, fs_extra_1.existsSync)((0, path_1.join)(rootDir, 'package.json')) && hasNpmLockfileDisabled(rootDir)) {
+        return true;
+    }
+    return false;
+}
+exports.isNpmProject = isNpmProject;
+/**
+ * npm 12 blocks dependency install scripts by default and still exits 0, so the only reliable
+ * signal is to ask npm directly. `npm install-scripts ls` lists every package whose scripts are
+ * still awaiting a decision, and does not exist before npm 12, where the command exits non-zero
+ * and `getCommandOutput` hands back null.
+ *
+ * Pass `packageManager` when the caller already knows which one ran the install; otherwise it is
+ * inferred from the project.
+ */
+async function getBlockedInstallScripts(rootDir, packageManager) {
+    if (packageManager === undefined) {
+        logAmbiguousLockfiles(rootDir);
+    }
+    const isNpm = packageManager === undefined ? await isNpmProject(rootDir) : packageManager.toLowerCase() === 'npm';
+    if (!isNpm) {
+        return [];
+    }
+    const npmVersionOutput = await (0, subprocess_1.getCommandOutput)('npm', ['--version'], { cwd: rootDir });
+    if (npmVersionOutput === null) {
+        log_1.output.write(`${colors_1.default.strong('Blocked install scripts:')}\n\n` +
+            `  Could not determine the npm version, so blocked install scripts were not checked.\n\n`);
+        return null;
+    }
+    const npmMajor = parseInt(npmVersionOutput.split('.')[0], 10);
+    if (!Number.isFinite(npmMajor) || npmMajor < 12) {
+        return [];
+    }
+    const commandOutput = await (0, subprocess_1.getCommandOutput)('npm', ['install-scripts', 'ls', '--json', '--all=false'], {
+        cwd: rootDir,
+    });
+    if (commandOutput === null) {
+        log_1.output.write(`${colors_1.default.strong('Blocked install scripts:')}\n\n` +
+            `  Could not query npm for blocked install scripts. ` +
+            `If ${colors_1.default.input('all=true')} is set in ${colors_1.default.input('.npmrc')}, run ${colors_1.default.input('npm install-scripts ls --all=false')} manually.\n\n`);
+        return null;
+    }
+    return parseBlockedInstallScripts(commandOutput);
+}
+exports.getBlockedInstallScripts = getBlockedInstallScripts;
+function parseBlockedInstallScripts(commandOutput) {
+    if (!commandOutput) {
+        return [];
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(commandOutput);
+    }
+    catch (e) {
+        return [];
+    }
+    if (!Array.isArray(parsed === null || parsed === void 0 ? void 0 : parsed.allowScripts)) {
+        return [];
+    }
+    const blocked = [];
+    for (const entry of parsed.allowScripts) {
+        const name = entry === null || entry === void 0 ? void 0 : entry.name;
+        if (typeof name !== 'string' || !Array.isArray(entry.changes)) {
+            continue;
+        }
+        for (const change of entry.changes) {
+            if ((change === null || change === void 0 ? void 0 : change.change) !== 'pending' || typeof change.key !== 'string') {
+                continue;
+            }
+            blocked.push({
+                name,
+                version: change.key.startsWith(`${name}@`) ? change.key.slice(name.length + 1) : change.key,
+            });
+        }
+    }
+    return blocked;
+}
+exports.parseBlockedInstallScripts = parseBlockedInstallScripts;
+/**
+ * npm 12 denies install scripts by default, so a typical project has pending entries for packages
+ * like esbuild or sharp that a Capacitor migration has no bearing on. Only Capacitor's own blocked
+ * scripts say anything about whether the migration finished.
+ */
+function hasBlockedCapacitorScripts(blocked) {
+    return blocked.some(({ name }) => name.startsWith('@capacitor-plus/') || name.startsWith('@capacitor/'));
+}
+exports.hasBlockedCapacitorScripts = hasBlockedCapacitorScripts;
+function logBlockedInstallScripts(blocked) {
+    if (blocked.length === 0) {
+        return;
+    }
+    const names = [...new Set(blocked.map(({ name }) => name))];
+    const packages = blocked.map(({ name, version }) => `    ${colors_1.default.strong(`${name}@${version}`)}\n`).join('');
+    const approvals = names.map((name) => `    ${colors_1.default.input(`npm install-scripts approve ${name}`)}\n`).join('');
+    log_1.output.write(`${colors_1.default.strong('Blocked Install Scripts:')}\n\n` +
+        `  npm blocked install scripts for ${names.length === 1 ? '1 package' : `${names.length} packages`}. ` +
+        `Features that rely on them may not work.\n\n` +
+        packages +
+        `\n  To allow them, run:\n\n` +
+        approvals +
+        `    ${colors_1.default.input('npm rebuild')}\n\n` +
+        `  ${colors_1.default.weak('Approvals are pinned to an exact version, so repeat this after upgrading the package.')}\n\n`);
+}
+exports.logBlockedInstallScripts = logBlockedInstallScripts;

package/dist/util/spm.js

@@ -125,7 +125,9 @@ let package = Package(
             const options = packageOptions[plugin.id];
             const symlink = options === null || options === void 0 ? void 0 : options.symlink;
             const symlinkFolder = (0, path_1.join)('symlinks', plugin.name);
-            const relPath = (0, fs_1.convertToUnixPath)(symlink ? symlinkFolder : (0, path_1.relative)(config.ios.nativeXcodeProjDirAbs, plugin.rootPath));
+            const relPath = symlink
+                ? (0, fs_1.convertToUnixPath)((0, path_1.join)('symlinks', plugin.name))
+                : (0, fs_1.convertToUnixPath)((0, path_1.relative)(config.ios.nativeXcodeProjDirAbs, plugin.rootPath));
             if (symlink) {
                 await (0, fs_extra_1.ensureSymlink)(plugin.rootPath, (0, path_1.resolve)(config.ios.nativeProjectDirAbs, 'CapApp-SPM', symlinkFolder));
             }
@@ -231,6 +233,51 @@ function hasSceneManifest(config) {
     return entries['UIApplicationSceneManifest'] !== undefined;
 }
 exports.hasSceneManifest = hasSceneManifest;
+function storyboardResourceExists(nativeTargetDirAbs, storyboardName) {
+    const fileName = `${storyboardName}.storyboard`;
+    const stack = [nativeTargetDirAbs];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        for (const entry of (0, fs_extra_1.readdirSync)(dir, { withFileTypes: true })) {
+            if (entry.isFile() && entry.name === fileName) {
+                return true;
+            }
+            if (entry.isDirectory()) {
+                stack.push((0, path_1.resolve)(dir, entry.name));
+            }
+        }
+    }
+    return false;
+}
+function resolvedSceneStoryboardFile(entries, nativeTargetDirAbs) {
+    const mainStoryboard = entries['UIMainStoryboardFile'];
+    if (typeof mainStoryboard === 'string' && mainStoryboard.trim() !== '') {
+        if (storyboardResourceExists(nativeTargetDirAbs, mainStoryboard)) {
+            return mainStoryboard;
+        }
+    }
+    return undefined;
+}
+function syncSceneStoryboardInManifest(entries, nativeTargetDirAbs) {
+    const manifest = entries['UIApplicationSceneManifest'];
+    if (!manifest) {
+        return false;
+    }
+    const configs = manifest['UISceneConfigurations'];
+    const roleArray = configs === null || configs === void 0 ? void 0 : configs['UIWindowSceneSessionRoleApplication'];
+    if (!(roleArray === null || roleArray === void 0 ? void 0 : roleArray.length)) {
+        return false;
+    }
+    const storyboard = resolvedSceneStoryboardFile(entries, nativeTargetDirAbs);
+    let changed = false;
+    for (const role of roleArray) {
+        if (storyboard && role['UISceneStoryboardFile'] === undefined) {
+            role['UISceneStoryboardFile'] = storyboard;
+            changed = true;
+        }
+    }
+    return changed;
+}
 async function addSceneManifestIfNeeded(config) {
     const infoPlist = (0, path_1.resolve)(config.ios.nativeTargetDirAbs, 'Info.plist');
     if (!(0, fs_extra_1.existsSync)(infoPlist)) {
@@ -239,18 +286,26 @@ async function addSceneManifestIfNeeded(config) {
     }
     const entries = (0, plist_1.parse)((0, fs_extra_1.readFileSync)(infoPlist, 'utf-8'));
     if (entries['UIApplicationSceneManifest'] !== undefined) {
-        log_1.logger.warn('Found UIApplicationSceneManifest in ' + infoPlist + ', skipping.');
+        if (syncSceneStoryboardInManifest(entries, config.ios.nativeTargetDirAbs)) {
+            (0, fs_extra_1.writeFileSync)(infoPlist, (0, plist_1.build)(entries));
+        }
+        else {
+            log_1.logger.warn('Found UIApplicationSceneManifest in ' + infoPlist + ', skipping.');
+        }
         return;
     }
+    const sceneConfiguration = {
+        UISceneConfigurationName: 'Default Configuration',
+        UISceneDelegateClassName: '$(PRODUCT_MODULE_NAME).SceneDelegate',
+    };
+    const storyboard = resolvedSceneStoryboardFile(entries, config.ios.nativeTargetDirAbs);
+    if (storyboard) {
+        sceneConfiguration['UISceneStoryboardFile'] = storyboard;
+    }
     entries['UIApplicationSceneManifest'] = {
         UIApplicationSupportsMultipleScenes: false,
         UISceneConfigurations: {
-            UIWindowSceneSessionRoleApplication: [
-                {
-                    UISceneConfigurationName: 'Default Configuration',
-                    UISceneDelegateClassName: '$(PRODUCT_MODULE_NAME).SceneDelegate',
-                },
-            ],
+            UIWindowSceneSessionRoleApplication: [sceneConfiguration],
         },
     };
     (0, fs_extra_1.writeFileSync)(infoPlist, (0, plist_1.build)(entries));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capacitor-plus/cli",
-  "version": "8.5.3",
+  "version": "8.6.1",
   "description": "Capacitor+: Enhanced Capacitor with automated upstream sync - Cross-platform apps with JavaScript and the web",
   "homepage": "https://capgo.app/docs/plugins/capacitor-plus/",
   "author": "Capgo Team <support@capgo.app> (https://capgo.app)",
@@ -60,8 +60,7 @@
     "semver": "^7.6.3",
     "tar": "^7.5.3",
     "tslib": "^2.8.1",
-    "typescript": "~5.0.2",
-    "xcode": "^3.0.1",
+    "xcode": "^4.0.0",
     "xml2js": "^0.6.2"
   },
   "devDependencies": {