@capgo/cli 7.107.0 → 7.108.2

package/dist/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@capgo/cli",
   "type": "module",
-  "version": "7.107.0",
+  "version": "7.108.2",
   "description": "A CLI to upload to capgo servers",
   "author": "Martin martin@capgo.app",
   "license": "Apache 2.0",
@@ -75,8 +75,10 @@
     "test:checksum": "bun test/test-checksum-algorithm.mjs",
     "test:build-needed": "bun test/test-build-needed.mjs",
     "test:ci-prompts": "bun test/test-ci-prompts.mjs",
+    "test:ci-secrets": "bun test/test-ci-secrets.mjs",
     "test:posthog-exception": "bun test/test-posthog-exception.mjs",
     "test:onboarding-recovery": "bun test/test-onboarding-recovery.mjs",
+    "test:onboarding-progress": "bun test/test-onboarding-progress.mjs",
     "test:onboarding-run-targets": "bun test/test-onboarding-run-targets.mjs",
     "test:run-device-command": "bun test/test-run-device-command.mjs",
     "test:init-app-conflict": "bun test/test-init-app-conflict.mjs",
@@ -91,7 +93,7 @@
     "test:macos-signing": "bun test/test-macos-signing.mjs",
     "test:apple-api-import-helpers": "bun test/test-apple-api-import-helpers.mjs",
     "test:manifest-path-encoding": "bun test/test-manifest-path-encoding.mjs",
-    "test": "bun run build && bun run test:version-detection:setup && bun run test:bundle && bun run test:functional && bun run test:semver && bun run test:version-edge-cases && bun run test:regex && bun run test:upload && bun run test:credentials && bun run test:credentials-validation && bun run test:build-zip-filter && bun run test:checksum && bun run test:build-needed && bun run test:ci-prompts && bun run test:posthog-exception && bun run test:build-platform-selection && bun run test:onboarding-recovery && bun run test:onboarding-run-targets && bun run test:run-device-command && bun run test:init-app-conflict && bun run test:init-guardrails && bun run test:prompt-preferences && bun run test:esm-sdk && bun run test:mcp && bun run test:version-detection && bun run test:platform-paths && bun run test:payload-split && bun run test:manifest-path-encoding && bun run test:macos-signing && bun run test:apple-api-import-helpers && bun run test:ai-log-capture && bun run test:ai-analyze-flow && bun run test:ai-render-markdown",
+    "test": "bun run build && bun run test:version-detection:setup && bun run test:bundle && bun run test:functional && bun run test:semver && bun run test:version-edge-cases && bun run test:regex && bun run test:upload && bun run test:credentials && bun run test:credentials-validation && bun run test:build-zip-filter && bun run test:checksum && bun run test:build-needed && bun run test:ci-prompts && bun run test:ci-secrets && bun run test:posthog-exception && bun run test:build-platform-selection && bun run test:onboarding-recovery && bun run test:onboarding-progress && bun run test:onboarding-run-targets && bun run test:run-device-command && bun run test:init-app-conflict && bun run test:init-guardrails && bun run test:prompt-preferences && bun run test:esm-sdk && bun run test:mcp && bun run test:version-detection && bun run test:platform-paths && bun run test:payload-split && bun run test:manifest-path-encoding && bun run test:macos-signing && bun run test:apple-api-import-helpers && bun run test:ai-log-capture && bun run test:ai-analyze-flow && bun run test:ai-render-markdown",
     "test:build-platform-selection": "bun test/test-build-platform-selection.mjs",
     "test:ai-log-capture": "bun test/test-ai-log-capture.mjs",
     "test:ai-analyze-flow": "bun test/test-ai-analyze-flow.mjs",

package/dist/src/api/channels.d.ts

@@ -7,12 +7,6 @@ interface CheckVersionOptions {
     requireMatch?: boolean;
 }
 export declare function checkVersionNotUsedInChannel(supabase: SupabaseClient<Database>, appid: string, versionData: Database['public']['Tables']['app_versions']['Row'], options?: CheckVersionOptions): Promise<void>;
-interface FindUnknownOptions {
-    silent?: boolean;
-}
-export declare function findUnknownVersion(supabase: SupabaseClient<Database>, appId: string, options?: FindUnknownOptions): Promise<{
-    id: number;
-}>;
 export declare function createChannel(supabase: SupabaseClient<Database>, update: Database['public']['Tables']['channels']['Insert']): import("@supabase/postgrest-js").PostgrestBuilder<{
     PostgrestVersion: "14.1";
 }, {
@@ -35,7 +29,7 @@ export declare function createChannel(supabase: SupabaseClient<Database>, update
     public: boolean;
     rbac_id: string;
     updated_at: string;
-    version: number;
+    version: number | null;
 }, false>;
 export declare function delChannel(supabase: SupabaseClient<Database>, name: string, appId: string, _userId: string): import("@supabase/postgrest-js").PostgrestBuilder<{
     PostgrestVersion: "14.1";
@@ -62,7 +56,7 @@ export declare function findChannel(supabase: SupabaseClient<Database>, appId: s
     public: boolean;
     rbac_id: string;
     updated_at: string;
-    version: number;
+    version: number | null;
 }, false>;
 export declare function delChannelDevices(supabase: SupabaseClient<Database>, appId: string, channelId: number): import("@supabase/postgrest-js").PostgrestFilterBuilder<{
     PostgrestVersion: "14.1";
@@ -731,7 +725,7 @@ export declare function delChannelDevices(supabase: SupabaseClient<Database>, ap
                 public: boolean;
                 rbac_id: string;
                 updated_at: string;
-                version: number;
+                version: number | null;
             };
             Insert: {
                 allow_dev?: boolean;
@@ -753,7 +747,7 @@ export declare function delChannelDevices(supabase: SupabaseClient<Database>, ap
                 public?: boolean;
                 rbac_id?: string;
                 updated_at?: string;
-                version: number;
+                version?: number | null;
             };
             Update: {
                 allow_dev?: boolean;
@@ -775,7 +769,7 @@ export declare function delChannelDevices(supabase: SupabaseClient<Database>, ap
                 public?: boolean;
                 rbac_id?: string;
                 updated_at?: string;
-                version?: number;
+                version?: number | null;
             };
             Relationships: [{
                 foreignKeyName: "channels_app_id_fkey";
@@ -2956,7 +2950,7 @@ export declare function delChannelDevices(supabase: SupabaseClient<Database>, ap
             Args: {
                 appid: string;
             };
-            Returns: number;
+            Returns: number | null;
         };
         cleanup_expired_apikeys: {
             Args: never;
@@ -5217,7 +5211,7 @@ export declare function delChannelDevices(supabase: SupabaseClient<Database>, ap
 export declare function findBundleIdByChannelName(supabase: SupabaseClient<Database>, appId: string, name: string): PromiseLike<{
     id: number;
     name: string;
-} | undefined>;
+} | null | undefined>;
 export type { Channel } from '../schemas/channel';
 type Channel = import('../schemas/channel').Channel;
 export declare function displayChannels(data: Channel[], silent?: boolean): void;

package/dist/src/api/versions.d.ts

@@ -35,7 +35,7 @@ export declare function getActiveAppVersions(supabase: SupabaseClient<Database>,
     updated_at: string | null;
     user_id: string | null;
 }[]>;
-export declare function getChannelsVersion(supabase: SupabaseClient<Database>, appid: string, options?: VersionOptions): Promise<number[]>;
+export declare function getChannelsVersion(supabase: SupabaseClient<Database>, appid: string, options?: VersionOptions): Promise<(number | null)[]>;
 export declare function getVersionData(supabase: SupabaseClient<Database>, appid: string, bundle: string, options?: VersionOptions): Promise<{
     app_id: string;
     checksum: string | null;

package/dist/src/build/onboarding/android/types.d.ts

@@ -1,4 +1,4 @@
-export type AndroidOnboardingStep = 'welcome' | 'credentials-exist' | 'backing-up' | 'no-platform' | 'keystore-method-select' | 'keystore-explainer' | 'keystore-existing-path' | 'keystore-existing-picker' | 'keystore-existing-store-password' | 'keystore-existing-detecting-alias' | 'keystore-existing-alias-select' | 'keystore-existing-alias' | 'keystore-existing-key-password' | 'keystore-new-alias' | 'keystore-new-password-method' | 'keystore-new-store-password' | 'keystore-new-key-password' | 'keystore-new-cn' | 'keystore-generating' | 'google-sign-in' | 'google-sign-in-running' | 'play-developer-id-input' | 'gcp-projects-loading' | 'gcp-projects-select' | 'gcp-project-create-name' | 'android-package-select' | 'gcp-setup-running' | 'saving-credentials' | 'ask-build' | 'requesting-build' | 'build-complete' | 'error';
+export type AndroidOnboardingStep = 'welcome' | 'credentials-exist' | 'backing-up' | 'no-platform' | 'keystore-method-select' | 'keystore-explainer' | 'keystore-existing-path' | 'keystore-existing-picker' | 'keystore-existing-store-password' | 'keystore-existing-detecting-alias' | 'keystore-existing-alias-select' | 'keystore-existing-alias' | 'keystore-existing-key-password' | 'keystore-new-alias' | 'keystore-new-password-method' | 'keystore-new-store-password' | 'keystore-new-key-password' | 'keystore-new-cn' | 'keystore-generating' | 'google-sign-in' | 'google-sign-in-running' | 'play-developer-id-input' | 'gcp-projects-loading' | 'gcp-projects-select' | 'gcp-project-create-name' | 'android-package-select' | 'gcp-setup-running' | 'saving-credentials' | 'detecting-ci-secrets' | 'ci-secrets-setup' | 'ci-secrets-target-select' | 'ask-ci-secrets' | 'checking-ci-secrets' | 'confirm-ci-secret-overwrite' | 'uploading-ci-secrets' | 'ci-secrets-failed' | 'ask-build' | 'requesting-build' | 'build-complete' | 'error';
 export type KeystoreMethod = 'existing' | 'generate';
 export interface KeystoreReady {
     keystorePath: string;

package/dist/src/build/onboarding/ci-secrets.d.ts

@@ -0,0 +1,40 @@
+import type { BuildCredentials } from '../../schemas/build.js';
+export type CiSecretProvider = 'github' | 'gitlab';
+export interface CiSecretEntry {
+    key: string;
+    value: string;
+    masked: boolean;
+}
+export interface CiSecretTarget {
+    provider: CiSecretProvider;
+    label: string;
+    cli: 'gh' | 'glab';
+}
+export interface CiSecretDiscovery {
+    targets: CiSecretTarget[];
+    setup: CiSecretSetupAdvice[];
+    notes: string[];
+}
+export interface CiSecretSetupAdvice {
+    target: CiSecretTarget;
+    reason: 'not-installed' | 'not-authenticated';
+    message: string;
+    commands: string[];
+}
+interface CommandRunOptions {
+    input?: string;
+}
+export interface CommandRunResult {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+    error?: Error;
+}
+export type CommandRunner = (command: string, args: string[], options?: CommandRunOptions) => CommandRunResult;
+export declare function runCommand(command: string, args: string[], options?: CommandRunOptions): CommandRunResult;
+export declare function createCiSecretEntries(credentials: Partial<BuildCredentials>): CiSecretEntry[];
+export declare function detectCiSecretTargets(runner?: CommandRunner): CiSecretDiscovery;
+export declare function getCiSecretTargetLabel(target: CiSecretTarget | null | undefined): string;
+export declare function listExistingCiSecretKeys(target: CiSecretTarget, keys: string[], runner?: CommandRunner): string[];
+export declare function uploadCiSecrets(target: CiSecretTarget, entries: CiSecretEntry[], existingKeys?: string[], runner?: CommandRunner): void;
+export {};

package/dist/src/build/onboarding/progress.d.ts

@@ -21,3 +21,30 @@ export declare function deleteProgress(appId: string, baseDir?: string): Promise
  * the Apple 3-cert-limit error for users at the limit).
  */
 export declare function getResumeStep(progress: OnboardingProgress | null): OnboardingStep;
+/**
+ * Pure routing decision used by the `import-scanning` useEffect to skip
+ * questions the user already answered on a previous attempt.
+ *
+ * The shipped flow always sent users to `import-distribution-mode` after
+ * scanning, and the distribution-mode picker always sent app_store users to
+ * `api-key-instructions`. That re-asked the .p8 file path on resume even
+ * though `keyId` / `issuerId` / `p8Path` were already saved in progress —
+ * exposed by users seeing "✔ API Key verified — Key: X" (hydrated log)
+ * alongside "How do you want to provide the .p8 file?" on the same screen.
+ *
+ * IMPORTANT — we intentionally do NOT short-circuit on
+ * `completedSteps.apiKeyVerified`. Going through `verifying-key` on every
+ * resume is a brief network round-trip that catches two failure modes a
+ * short-circuit would silently allow:
+ *   1. The user moved/deleted the saved .p8 between runs — `verifying-key`
+ *      surfaces this via NeedP8Error and routes back to the .p8 input.
+ *   2. The key was revoked on Apple's side — `verifying-key` gets a 401 and
+ *      the user gets a clear error instead of a late failure inside
+ *      `saving-credentials` (after the Keychain ACL prompt has already
+ *      fired for the .p12 export).
+ *
+ * Exported so the routing decision can be unit-tested without rendering Ink.
+ *
+ * Returns the step to land on after a successful Keychain scan.
+ */
+export declare function getImportEntryStep(progress: OnboardingProgress | null): OnboardingStep;

package/dist/src/build/onboarding/types.d.ts

@@ -1,5 +1,5 @@
 export type Platform = 'ios' | 'android';
-export type OnboardingStep = 'welcome' | 'platform-select' | 'adding-platform' | 'credentials-exist' | 'backing-up' | 'setup-method-select' | 'import-scanning' | 'import-distribution-mode' | 'import-pick-identity' | 'import-pick-profile' | 'import-no-match-recovery' | 'import-fetching-profile' | 'import-create-profile-only' | 'import-export-warning' | 'import-compiling-helper' | 'import-exporting' | 'api-key-instructions' | 'p8-method-select' | 'input-p8-path' | 'input-key-id' | 'input-issuer-id' | 'verifying-key' | 'creating-certificate' | 'cert-limit-prompt' | 'revoking-certificate' | 'creating-profile' | 'duplicate-profile-prompt' | 'deleting-duplicate-profiles' | 'saving-credentials' | 'ask-build' | 'requesting-build' | 'build-complete' | 'no-platform' | 'error';
+export type OnboardingStep = 'welcome' | 'platform-select' | 'adding-platform' | 'credentials-exist' | 'backing-up' | 'setup-method-select' | 'import-scanning' | 'import-distribution-mode' | 'import-pick-identity' | 'import-pick-profile' | 'import-no-match-recovery' | 'import-fetching-profile' | 'import-create-profile-only' | 'import-export-warning' | 'import-compiling-helper' | 'import-exporting' | 'api-key-instructions' | 'p8-method-select' | 'input-p8-path' | 'input-key-id' | 'input-issuer-id' | 'verifying-key' | 'creating-certificate' | 'cert-limit-prompt' | 'revoking-certificate' | 'creating-profile' | 'duplicate-profile-prompt' | 'deleting-duplicate-profiles' | 'saving-credentials' | 'detecting-ci-secrets' | 'ci-secrets-setup' | 'ci-secrets-target-select' | 'ask-ci-secrets' | 'checking-ci-secrets' | 'confirm-ci-secret-overwrite' | 'uploading-ci-secrets' | 'ci-secrets-failed' | 'ask-build' | 'requesting-build' | 'build-complete' | 'no-platform' | 'error';
 export interface ApiKeyData {
     keyId: string;
     issuerId: string;

package/dist/src/channel/add.d.ts

@@ -19,6 +19,6 @@ export declare function addChannelInternal(channelId: string, appId: string, opt
     public: boolean;
     rbac_id: string;
     updated_at: string;
-    version: number;
+    version: number | null;
 }>;
 export declare function addChannel(channelId: string, appId: string, options: ChannelAddOptions): Promise<void>;