@capgo/cli 7.110.0 → 7.111.0

package/dist/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@capgo/cli",
   "type": "module",
-  "version": "7.110.0",
+  "version": "7.111.0",
   "description": "A CLI to upload to capgo servers",
   "author": "Martin martin@capgo.app",
   "license": "Apache 2.0",
@@ -77,6 +77,8 @@
     "test:build-needed": "bun test/test-build-needed.mjs",
     "test:ci-prompts": "bun test/test-ci-prompts.mjs",
     "test:ci-secrets": "bun test/test-ci-secrets.mjs",
+    "test:android-onboarding-progress": "bun test/test-android-onboarding-progress.mjs",
+    "test:onboarding-telemetry": "bun test/test-onboarding-telemetry.mjs",
     "test:posthog-exception": "bun test/test-posthog-exception.mjs",
     "test:onboarding-recovery": "bun test/test-onboarding-recovery.mjs",
     "test:onboarding-progress": "bun test/test-onboarding-progress.mjs",
@@ -94,7 +96,7 @@
     "test:macos-signing": "bun test/test-macos-signing.mjs",
     "test:apple-api-import-helpers": "bun test/test-apple-api-import-helpers.mjs",
     "test:manifest-path-encoding": "bun test/test-manifest-path-encoding.mjs",
-    "test": "bun run build && bun run test:version-detection:setup && bun run test:bundle && bun run test:functional && bun run test:semver && bun run test:version-edge-cases && bun run test:regex && bun run test:upload && bun run test:credentials && bun run test:credentials-validation && bun run test:android-service-account-validation && bun run test:build-zip-filter && bun run test:checksum && bun run test:build-needed && bun run test:ci-prompts && bun run test:ci-secrets && bun run test:posthog-exception && bun run test:build-platform-selection && bun run test:onboarding-recovery && bun run test:onboarding-progress && bun run test:onboarding-run-targets && bun run test:run-device-command && bun run test:init-app-conflict && bun run test:init-guardrails && bun run test:prompt-preferences && bun run test:esm-sdk && bun run test:mcp && bun run test:version-detection && bun run test:platform-paths && bun run test:payload-split && bun run test:manifest-path-encoding && bun run test:macos-signing && bun run test:apple-api-import-helpers && bun run test:ai-log-capture && bun run test:ai-analyze-flow && bun run test:ai-render-markdown",
+    "test": "bun run build && bun run test:version-detection:setup && bun run test:bundle && bun run test:functional && bun run test:semver && bun run test:version-edge-cases && bun run test:regex && bun run test:upload && bun run test:credentials && bun run test:credentials-validation && bun run test:android-service-account-validation && bun run test:build-zip-filter && bun run test:checksum && bun run test:build-needed && bun run test:ci-prompts && bun run test:ci-secrets && bun run test:android-onboarding-progress && bun run test:onboarding-telemetry && bun run test:posthog-exception && bun run test:build-platform-selection && bun run test:onboarding-recovery && bun run test:onboarding-progress && bun run test:onboarding-run-targets && bun run test:run-device-command && bun run test:init-app-conflict && bun run test:init-guardrails && bun run test:prompt-preferences && bun run test:esm-sdk && bun run test:mcp && bun run test:version-detection && bun run test:platform-paths && bun run test:payload-split && bun run test:manifest-path-encoding && bun run test:macos-signing && bun run test:apple-api-import-helpers && bun run test:ai-log-capture && bun run test:ai-analyze-flow && bun run test:ai-render-markdown",
     "test:build-platform-selection": "bun test/test-build-platform-selection.mjs",
     "test:ai-log-capture": "bun test/test-ai-log-capture.mjs",
     "test:ai-analyze-flow": "bun test/test-ai-analyze-flow.mjs",

package/dist/src/build/env-render.d.ts

@@ -0,0 +1,8 @@
+import type { BuildCredentials } from '../schemas/build';
+export declare function renderEnvFile(args: {
+    appId: string;
+    local: boolean;
+    platform: 'ios' | 'android';
+    creds: Partial<BuildCredentials>;
+}): string;
+export declare function escapeDotenvValue(value: string): string;

package/dist/src/build/onboarding/analytics.d.ts

@@ -0,0 +1,23 @@
+import type { DiffLine } from './diff-utils.js';
+import type { BuildScriptChoice, PackageManager } from './workflow-generator.js';
+export type BuildOnboardingWorkflowEvent = 'workflow-preview-prepared' | 'workflow-preview-action' | 'workflow-diff-opened' | 'workflow-diff-closed' | 'workflow-file-written';
+export type BuildOnboardingWorkflowDecision = 'write' | 'view' | 'cancel' | 'escape' | 'close';
+export type BuildOnboardingWorkflowState = 'new' | 'replace' | 'identical';
+export interface WorkflowDiffTelemetry {
+    workflowState: BuildOnboardingWorkflowState;
+    diffLines: number;
+    diffAdded: number;
+    diffRemoved: number;
+}
+interface TrackBuildOnboardingWorkflowOptions extends WorkflowDiffTelemetry {
+    event: BuildOnboardingWorkflowEvent;
+    appId: string;
+    platform: 'ios' | 'android';
+    apikey?: string;
+    decision?: BuildOnboardingWorkflowDecision;
+    packageManager?: PackageManager;
+    buildScriptType?: BuildScriptChoice['type'];
+}
+export declare function getWorkflowDiffTelemetry(lines: DiffLine[], isNew: boolean): WorkflowDiffTelemetry;
+export declare function trackBuildOnboardingWorkflowEvent(options: TrackBuildOnboardingWorkflowOptions): void;
+export {};

package/dist/src/build/onboarding/android/progress.d.ts

@@ -2,6 +2,7 @@ import type { AndroidOnboardingProgress, AndroidOnboardingStep } from './types.j
 export declare function loadAndroidProgress(appId: string, baseDir?: string): Promise<AndroidOnboardingProgress | null>;
 export declare function saveAndroidProgress(appId: string, progress: AndroidOnboardingProgress, baseDir?: string): Promise<void>;
 export declare function deleteAndroidProgress(appId: string, baseDir?: string): Promise<void>;
+export declare function hasAnyOAuthProgress(progress: AndroidOnboardingProgress): boolean;
 /**
  * Determine the first incomplete step for the Android flow.
  *

package/dist/src/build/onboarding/android/types.d.ts

@@ -1,4 +1,4 @@
-export type AndroidOnboardingStep = 'welcome' | 'credentials-exist' | 'backing-up' | 'no-platform' | 'keystore-method-select' | 'keystore-explainer' | 'keystore-existing-path' | 'keystore-existing-picker' | 'keystore-existing-store-password' | 'keystore-existing-detecting-alias' | 'keystore-existing-alias-select' | 'keystore-existing-alias' | 'keystore-existing-key-password' | 'keystore-new-alias' | 'keystore-new-password-method' | 'keystore-new-store-password' | 'keystore-new-key-password' | 'keystore-new-cn' | 'keystore-generating' | 'service-account-method-select' | 'sa-json-existing-path' | 'sa-json-existing-picker' | 'sa-json-validating' | 'sa-json-validation-failed' | 'google-sign-in' | 'google-sign-in-running' | 'play-developer-id-input' | 'gcp-projects-loading' | 'gcp-projects-select' | 'gcp-project-create-name' | 'android-package-select' | 'gcp-setup-running' | 'saving-credentials' | 'detecting-ci-secrets' | 'ci-secrets-setup' | 'ci-secrets-target-select' | 'ask-ci-secrets' | 'checking-ci-secrets' | 'confirm-ci-secret-overwrite' | 'uploading-ci-secrets' | 'ci-secrets-failed' | 'ask-build' | 'requesting-build' | 'build-complete' | 'error';
+export type AndroidOnboardingStep = 'welcome' | 'credentials-exist' | 'backing-up' | 'no-platform' | 'keystore-method-select' | 'keystore-explainer' | 'keystore-existing-path' | 'keystore-existing-picker' | 'keystore-existing-store-password' | 'keystore-existing-detecting-alias' | 'keystore-existing-alias-select' | 'keystore-existing-alias' | 'keystore-existing-key-password' | 'keystore-new-alias' | 'keystore-new-password-method' | 'keystore-new-store-password' | 'keystore-new-key-password' | 'keystore-new-cn' | 'keystore-generating' | 'service-account-method-select' | 'sa-json-existing-path' | 'sa-json-existing-picker' | 'sa-json-validating' | 'sa-json-validation-failed' | 'google-sign-in' | 'google-sign-in-running' | 'play-developer-id-input' | 'gcp-projects-loading' | 'gcp-projects-select' | 'gcp-project-create-name' | 'android-package-select' | 'gcp-setup-running' | 'saving-credentials' | 'detecting-ci-secrets' | 'ci-secrets-setup' | 'ci-secrets-target-select' | 'ask-ci-secrets' | 'checking-ci-secrets' | 'confirm-ci-secret-overwrite' | 'uploading-ci-secrets' | 'ci-secrets-failed' | 'ask-github-actions-setup' | 'confirm-secrets-push' | 'ask-export-env' | 'exporting-env' | 'confirm-env-export-overwrite' | 'overwrite-and-export-env' | 'pick-package-manager' | 'pick-build-script' | 'pick-build-script-custom' | 'preview-workflow-file' | 'view-workflow-diff' | 'writing-workflow-file' | 'ask-build' | 'requesting-build' | 'build-complete' | 'error';
 export type AndroidOnboardingErrorCategory = 'keystore_invalid' | 'google_oauth_failed' | 'play_account_id_invalid' | 'sa_json_shape_invalid' | 'sa_json_token_rejected' | 'sa_json_no_app_access' | 'sa_json_network_error' | 'unknown';
 export type KeystoreMethod = 'existing' | 'generate';
 export type ServiceAccountMethod = 'existing' | 'generate';
@@ -48,6 +48,7 @@ export interface AndroidOnboardingProgress {
     keystoreStorePassword?: string;
     keystoreKeyPassword?: string;
     keystoreCommonName?: string;
+    serviceAccountForkSeen?: true;
     serviceAccountMethod?: ServiceAccountMethod;
     serviceAccountJsonPath?: string;
     serviceAccountValidationSkipped?: boolean;

package/dist/src/build/onboarding/android/ui/app.d.ts

@@ -6,6 +6,7 @@ interface AppProps {
     androidDir: string;
     /** Optional Capgo API key passed via -a/--apikey flag; takes precedence over saved key. */
     apikey?: string;
+    terminalRows?: number;
 }
 declare const AndroidOnboardingApp: FC<AppProps>;
 export default AndroidOnboardingApp;

package/dist/src/build/onboarding/ci-secrets.d.ts

@@ -31,10 +31,57 @@ export interface CommandRunResult {
     error?: Error;
 }
 export type CommandRunner = (command: string, args: string[], options?: CommandRunOptions) => CommandRunResult;
+/**
+ * Async runner. Used by the wizard so spawned `gh` / `glab` calls don't block
+ * the Node event loop — without this, `ink-spinner`'s animation freezes for
+ * the entire duration of every shell-out, which feels like the wizard has hung.
+ *
+ * Tests can pass either a sync (CommandRunner) or async runner — every helper
+ * that calls runner.* does so via `await` so a sync runner returning a plain
+ * result still works (Promise.resolve coerces it).
+ */
+export type AsyncCommandRunner = (command: string, args: string[], options?: CommandRunOptions) => CommandRunResult | Promise<CommandRunResult>;
 export declare function runCommand(command: string, args: string[], options?: CommandRunOptions): CommandRunResult;
-export declare function createCiSecretEntries(credentials: Partial<BuildCredentials>): CiSecretEntry[];
+/**
+ * Non-blocking shell-out. Mirrors `runCommand`'s shape but uses `spawn` so
+ * the Node event loop is free to tick spinners and process input while gh /
+ * glab work. Default for any wizard-side helper that needs to render UI
+ * during the call.
+ */
+export declare function runCommandAsync(command: string, args: string[], options?: CommandRunOptions): Promise<CommandRunResult>;
+export declare function createCiSecretEntries(credentials: Partial<BuildCredentials>, apiKey?: string): CiSecretEntry[];
 export declare function detectCiSecretTargets(runner?: CommandRunner): CiSecretDiscovery;
 export declare function getCiSecretTargetLabel(target: CiSecretTarget | null | undefined): string;
+/**
+ * Resolve the concrete `owner/repo` (GitHub) or `group/project` (GitLab) the
+ * `gh` / `glab` CLI will target from the current working directory.
+ *
+ * Returns null when the CLI can't determine the repo (e.g. cwd is not a git
+ * repo, multiple remotes with no `gh-resolved` config, auth scopes missing).
+ *
+ * The wizard MUST show this string to the user and require explicit
+ * confirmation before any `gh secret set` / `glab variable set` runs — those
+ * commands silently overwrite without backup, so the user has to know which
+ * repo they're about to mutate.
+ */
+export declare function getCiSecretRepoLabel(target: CiSecretTarget, runner?: CommandRunner): string | null;
+/**
+ * Non-blocking variant of `getCiSecretRepoLabel`. Identical logic, but
+ * `await`s the runner so the event loop can tick during the gh/glab call —
+ * lets Ink spinners actually animate during the resolution.
+ */
+export declare function getCiSecretRepoLabelAsync(target: CiSecretTarget, runner?: AsyncCommandRunner): Promise<string | null>;
 export declare function listExistingCiSecretKeys(target: CiSecretTarget, keys: string[], runner?: CommandRunner): string[];
+/** Non-blocking variant of `listExistingCiSecretKeys`. */
+export declare function listExistingCiSecretKeysAsync(target: CiSecretTarget, keys: string[], runner?: AsyncCommandRunner): Promise<string[]>;
 export declare function uploadCiSecrets(target: CiSecretTarget, entries: CiSecretEntry[], existingKeys?: string[], runner?: CommandRunner): void;
+/**
+ * Non-blocking variant of `uploadCiSecrets`. Calls `onProgress(current, total,
+ * keyName)` before every `gh secret set` / `glab variable set` so the wizard
+ * can render "Pushing N of M: <KEY>…" instead of a frozen spinner.
+ *
+ * Pushes are still sequential — gh/glab don't have a bulk-set API, and
+ * parallelising would risk rate limits + makes failure semantics ambiguous.
+ */
+export declare function uploadCiSecretsAsync(target: CiSecretTarget, entries: CiSecretEntry[], existingKeys?: string[], runner?: AsyncCommandRunner, onProgress?: (current: number, total: number, keyName: string) => void): Promise<void>;
 export {};

package/dist/src/build/onboarding/diff-utils.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Line-by-line diff utilities for the workflow-file preview viewer.
+ *
+ * Uses a textbook longest-common-subsequence algorithm. O(m·n) time/space
+ * which is fine for the workflow-file scale we expect (≤200 lines either
+ * side); no dep needed.
+ */
+export type DiffKind = 'add' | 'del' | 'eq';
+export interface DiffLine {
+    kind: DiffKind;
+    text: string;
+}
+/**
+ * Compute a line-level diff between `before` and `after`.
+ *
+ * Returns an ordered list of lines where:
+ *   - `kind: 'eq'`  → present in both, unchanged
+ *   - `kind: 'add'` → present only in `after` (will be added by the write)
+ *   - `kind: 'del'` → present only in `before` (will be removed by the write)
+ *
+ * When `before` is the empty string, every line in `after` is returned as
+ * `add` — the natural "new file" rendering.
+ */
+export declare function diffLines(before: string, after: string): DiffLine[];

package/dist/src/build/onboarding/env-export.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Build-onboarding helper to write a single-platform .env file with the build
+ * credentials the user just saved. Used on the "No to GitHub Actions setup, but
+ * yes to .env export" branch of the wizard.
+ *
+ * Reuses the renderer from `build credentials manage` so the file format
+ * (section comments, .gitignore reminder, provisioning-map base64 fallback)
+ * stays identical between the two paths.
+ */
+import type { BuildCredentials } from '../../schemas/build.js';
+export interface EnvExportOpts {
+    appId: string;
+    platform: 'ios' | 'android';
+    credentials: Partial<BuildCredentials>;
+    /** Default false — onboarding writes into the global store, not local. */
+    local?: boolean;
+    /** If absent, defaults to `<cwd>/.env.capgo.<appId>.<platform>`. */
+    targetPath?: string;
+    /** When true, write even if the file already exists. */
+    overwrite?: boolean;
+}
+export type EnvExportResult = {
+    kind: 'written';
+    path: string;
+    fieldCount: number;
+} | {
+    kind: 'exists';
+    path: string;
+} | {
+    kind: 'empty';
+};
+/**
+ * Resolve where the .env file should land for the given app + platform. Pure —
+ * callable before deciding to actually write, so the wizard can show the path
+ * in a confirm prompt without committing to write yet.
+ */
+export declare function defaultExportPath(appId: string, platform: 'ios' | 'android'): string;
+/**
+ * Write the credentials to a .env file. Caller is responsible for deciding
+ * whether the user has consented (no prompts in here — pure file I/O so the
+ * Ink wizard owns the UX).
+ *
+ * Returns `kind: 'exists'` if the target file is already present and
+ * `overwrite` was not set — caller can prompt the user and retry.
+ */
+export declare function exportCredentialsToEnv(opts: EnvExportOpts): EnvExportResult;

package/dist/src/build/onboarding/telemetry.d.ts

@@ -12,4 +12,15 @@ export interface TrackBuilderOnboardingStepInput {
     /** Pre-computed category. Takes precedence over `error` if both are present. */
     errorCategory?: OnboardingErrorCategory | AndroidOnboardingErrorCategory;
 }
+export type BuilderOnboardingAction = 'android_sa_method_selected' | 'android_sa_validation_recovery_selected' | 'android_sa_validation_result';
+export interface TrackBuilderOnboardingActionInput {
+    apikey: string;
+    appId: string;
+    orgId: string;
+    platform: Platform;
+    step: OnboardingStep | AndroidOnboardingStep;
+    action: BuilderOnboardingAction;
+    tags?: Record<string, boolean | number | string>;
+}
 export declare function trackBuilderOnboardingStep(input: TrackBuilderOnboardingStepInput): Promise<void>;
+export declare function trackBuilderOnboardingAction(input: TrackBuilderOnboardingActionInput): Promise<void>;

package/dist/src/build/onboarding/types.d.ts

@@ -1,5 +1,5 @@
 export type Platform = 'ios' | 'android';
-export type OnboardingStep = 'welcome' | 'platform-select' | 'adding-platform' | 'credentials-exist' | 'backing-up' | 'setup-method-select' | 'import-scanning' | 'import-distribution-mode' | 'import-pick-identity' | 'import-pick-profile' | 'import-no-match-recovery' | 'import-fetching-profile' | 'import-create-profile-only' | 'import-export-warning' | 'import-compiling-helper' | 'import-exporting' | 'api-key-instructions' | 'p8-method-select' | 'input-p8-path' | 'input-key-id' | 'input-issuer-id' | 'verifying-key' | 'creating-certificate' | 'cert-limit-prompt' | 'revoking-certificate' | 'creating-profile' | 'duplicate-profile-prompt' | 'deleting-duplicate-profiles' | 'saving-credentials' | 'detecting-ci-secrets' | 'ci-secrets-setup' | 'ci-secrets-target-select' | 'ask-ci-secrets' | 'checking-ci-secrets' | 'confirm-ci-secret-overwrite' | 'uploading-ci-secrets' | 'ci-secrets-failed' | 'ask-build' | 'requesting-build' | 'build-complete' | 'no-platform' | 'error';
+export type OnboardingStep = 'welcome' | 'platform-select' | 'adding-platform' | 'credentials-exist' | 'backing-up' | 'setup-method-select' | 'import-scanning' | 'import-distribution-mode' | 'import-pick-identity' | 'import-pick-profile' | 'import-no-match-recovery' | 'import-fetching-profile' | 'import-create-profile-only' | 'import-export-warning' | 'import-compiling-helper' | 'import-exporting' | 'api-key-instructions' | 'p8-method-select' | 'input-p8-path' | 'input-key-id' | 'input-issuer-id' | 'verifying-key' | 'creating-certificate' | 'cert-limit-prompt' | 'revoking-certificate' | 'creating-profile' | 'duplicate-profile-prompt' | 'deleting-duplicate-profiles' | 'saving-credentials' | 'detecting-ci-secrets' | 'ci-secrets-setup' | 'ci-secrets-target-select' | 'ask-ci-secrets' | 'checking-ci-secrets' | 'confirm-ci-secret-overwrite' | 'uploading-ci-secrets' | 'ci-secrets-failed' | 'ask-github-actions-setup' | 'confirm-secrets-push' | 'ask-export-env' | 'exporting-env' | 'confirm-env-export-overwrite' | 'overwrite-and-export-env' | 'pick-package-manager' | 'pick-build-script' | 'pick-build-script-custom' | 'preview-workflow-file' | 'view-workflow-diff' | 'writing-workflow-file' | 'ask-build' | 'requesting-build' | 'build-complete' | 'no-platform' | 'error';
 export type OnboardingErrorCategory = 'apple_api_unauthorized' | 'apple_api_rate_limited' | 'cert_limit_reached' | 'profile_creation_failed' | 'p8_invalid' | 'keychain_no_identities' | 'keychain_export_failed' | 'keychain_helper_compile_failed' | 'profile_no_match' | 'profile_read_failed' | 'unknown';
 export interface ApiKeyData {
     keyId: string;

package/dist/src/build/onboarding/ui/app.d.ts

@@ -7,6 +7,7 @@ interface AppProps {
     iosDir: string;
     /** Optional Capgo API key passed via -a/--apikey flag; takes precedence over saved key */
     apikey?: string;
+    terminalRows?: number;
 }
 declare const OnboardingApp: FC<AppProps>;
 export default OnboardingApp;

package/dist/src/build/onboarding/ui/components.d.ts

@@ -1,4 +1,5 @@
 import type { FC } from 'react';
+import type { DiffLine } from '../diff-utils.js';
 export declare const Divider: FC<{
     width?: number;
 }>;
@@ -24,3 +25,35 @@ export declare const FilteredTextInput: FC<{
     onSubmit: (value: string) => void;
 }>;
 export declare const Header: FC;
+/**
+ * Minimal bordered table component for the confirm-secrets-push step.
+ *
+ * Rolled in-house instead of pulling `ink-table` because that package is
+ * CommonJS-only and Ink 5 uses top-level await — bun can't bundle the combo.
+ * Replicates the visual style (box-drawing borders, aligned columns) with
+ * ~50 lines of Ink primitives, lets us color the Status column per-row, and
+ * leaves nothing to maintain outside this repo.
+ */
+export interface SecretRow {
+    name: string;
+    status: 'NEW' | 'REPLACE';
+}
+export declare const DiffSummary: FC<{
+    title: string;
+    subtitle?: string;
+    lines: DiffLine[];
+}>;
+export declare const FullscreenDiffViewer: FC<{
+    title: string;
+    subtitle?: string;
+    lines: DiffLine[];
+    terminalRows: number;
+    onExit: () => void;
+}>;
+/**
+ * Render the secrets table inline. Keep this dynamic so the onboarding header
+ * and prompt stay in one live Ink frame.
+ */
+export declare const SecretsTable: FC<{
+    rows: SecretRow[];
+}>;

package/dist/src/build/onboarding/workflow-generator.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Pure generator for a GitHub Actions workflow file that runs `capgo build
+ * request` against credentials uploaded as repository secrets.
+ *
+ * No I/O — caller decides where to write the resulting file. This keeps the
+ * generator trivially testable: feed it opts, get a `{ path, content }` back.
+ *
+ * v1 deliberately limited: GitHub-only (no GitLab YAML), single `workflow_dispatch`
+ * trigger (no push/pr triggers), one platform per dispatch (no matrix), no
+ * monorepo subdirectory handling. Each of these is a follow-up.
+ */
+export type PackageManager = 'bun' | 'npm' | 'pnpm' | 'yarn';
+export type BuildScriptChoice = {
+    type: 'npm-script';
+    name: string;
+} | {
+    type: 'custom';
+    command: string;
+} | {
+    type: 'skip';
+};
+export interface WorkflowGeneratorOpts {
+    /** The app's bundle ID, e.g. com.example.app */
+    appId: string;
+    /** Default platform when the user dispatches the workflow without overriding the input. */
+    defaultPlatform: 'ios' | 'android';
+    /** Detected via getPMAndCommand(). Drives setup actions and the `npx`/`bunx`/etc runner. */
+    packageManager: PackageManager;
+    /** What runs to produce the web bundle before `capgo build request` fires. */
+    buildScript: BuildScriptChoice;
+    /** Exact secret names that were pushed to GitHub (drives the env: block). */
+    secretKeys: string[];
+}
+export interface GeneratedWorkflow {
+    /** Relative path inside the repo where the file should live. */
+    path: string;
+    /** Full file content, ready to write. */
+    content: string;
+}
+/** Default path inside the repo. */
+export declare const WORKFLOW_PATH = ".github/workflows/capgo-build.yml";
+/**
+ * Build the GitHub Actions workflow YAML.
+ *
+ * The shape is intentionally simple: one job, one platform per dispatch,
+ * `workflow_dispatch` trigger only. Power users can fork it after the fact.
+ */
+export declare function generateWorkflow(opts: WorkflowGeneratorOpts): GeneratedWorkflow;

package/dist/src/build/onboarding/workflow-ui-helpers.d.ts

@@ -0,0 +1,18 @@
+import type { PackageManager } from './workflow-generator.js';
+export interface BuildScriptOption {
+    label: string;
+    value: string;
+}
+/**
+ * `getPMAndCommand()` returns the literal string 'unknown' when no recognizable
+ * lockfile is present. The workflow generator only knows the four real ones —
+ * fall back to 'npm' for the generator template.
+ */
+export declare function normalizePackageManager(pm: string): PackageManager;
+/**
+ * Build the picker options for `pick-build-script`. Shows ALL scripts from
+ * package.json (the user picks; we don't auto-guess), with the project-type
+ * recommendation surfaced at the top, plus escape hatches for custom commands
+ * and "skip build entirely" (raw HTML Capacitor apps).
+ */
+export declare function buildScriptPickerOptions(scripts: Record<string, string>, recommended: string | null): BuildScriptOption[];

package/dist/src/build/onboarding/workflow-writer.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Thin wrapper that turns the pure `generateWorkflow` output into actual files
+ * on disk. Kept separate from `workflow-generator.ts` so the generator stays
+ * trivially unit-testable without mocking fs.
+ *
+ * The wizard's Ink layer owns all prompts (overwrite confirmation, etc.); this
+ * module only handles "does it exist?" and "write it".
+ */
+import type { WorkflowGeneratorOpts } from './workflow-generator.js';
+import { WORKFLOW_PATH } from './workflow-generator.js';
+export { WORKFLOW_PATH };
+export interface WorkflowWriteOptions {
+    /** When true, overwrite an existing file. Default: false. */
+    overwrite?: boolean;
+    /** Optional base dir override. Defaults to cwd(). */
+    baseDir?: string;
+}
+export type WorkflowWriteResult = {
+    kind: 'written';
+    absolutePath: string;
+    content: string;
+} | {
+    kind: 'exists';
+    absolutePath: string;
+    existingContent: string;
+    newContent: string;
+};
+/**
+ * Generate the workflow YAML and write it to `.github/workflows/capgo-build.yml`.
+ * Creates the `.github/workflows/` directory if it doesn't exist.
+ *
+ * If the file already exists and `overwrite` is false, returns `kind: 'exists'`
+ * with both the existing and proposed content so the caller can render a diff
+ * and ask for explicit confirmation before clobbering.
+ */
+export declare function writeWorkflowFile(opts: WorkflowGeneratorOpts, writeOptions?: WorkflowWriteOptions): WorkflowWriteResult;