@capgo/cli 7.124.13 → 7.125.0

package/dist/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@capgo/cli",
   "type": "module",
-  "version": "7.124.13",
+  "version": "7.125.0",
   "description": "A CLI to upload to capgo servers",
   "author": "Martin martin@capgo.app",
   "license": "Apache 2.0",
@@ -106,8 +106,11 @@
     "test:macos-signing": "bun test/test-macos-signing.mjs",
     "test:apple-api-import-helpers": "bun test/test-apple-api-import-helpers.mjs",
     "test:bundle-id-detector": "bun test/test-bundle-id-detector.mjs",
+    "test:apple-api-app-list": "bun test/test-apple-api-app-list.mjs",
+    "test:app-verification": "bun test/test-app-verification.mjs",
+    "test:pbxproj-parser": "bun test/test-pbxproj-parser.mjs",
     "test:manifest-path-encoding": "bun test/test-manifest-path-encoding.mjs",
-    "test": "bun run build && bun run test:version-detection:setup && bun run test:bundle && bun run test:functional && bun run test:semver && bun run test:version-edge-cases && bun run test:regex && bun run test:upload && bun run test:fail-on-incompatible && bun run test:credentials && bun run test:credentials-validation && bun run test:android-service-account-validation && bun run test:build-zip-filter && bun run test:checksum && bun run test:build-needed && bun run test:ci-prompts && bun run test:ci-secrets && bun run test:android-onboarding-progress && bun run test:onboarding-telemetry && bun run test:v2-event-migration && bun run test:analytics && bun run test:analytics-error-category && bun run test:analytics-org-resolver && bun run test:supabase-perf && bun run test:mcp-analytics && bun run test:app-created-source && bun run test:doctor-analytics && bun run test:posthog-exception && bun run test:build-platform-selection && bun run test:onboarding-recovery && bun run test:onboarding-progress && bun run test:onboarding-run-targets && bun run test:run-device-command && bun run test:init-app-conflict && bun run test:init-guardrails && bun run test:prompt-preferences && bun run test:esm-sdk && bun run test:mcp && bun run test:version-detection && bun run test:platform-paths && bun run test:payload-split && bun run test:manifest-path-encoding && bun run test:macos-signing && bun run test:apple-api-import-helpers && bun run test:bundle-id-detector && bun run test:ai-log-capture && bun run test:ai-analyze-flow && bun run test:ai-render-markdown && bun run test:ai-onboarding-mode && bun run test:ai-fit && bun run test:platform-layout && bun run test:frame-fit && bun run test:onboarding-min-size && bun run test:min-size-gate && bun run test:shell-size-gate && bun run test:build-log-sanitize && bun run test:build-output-viewport && bun run test:diff-viewer-viewport && bun run test:build-complete-exit",
+    "test": "bun run build && bun run test:version-detection:setup && bun run test:bundle && bun run test:functional && bun run test:semver && bun run test:version-edge-cases && bun run test:regex && bun run test:upload && bun run test:fail-on-incompatible && bun run test:credentials && bun run test:credentials-validation && bun run test:android-service-account-validation && bun run test:build-zip-filter && bun run test:checksum && bun run test:build-needed && bun run test:ci-prompts && bun run test:ci-secrets && bun run test:android-onboarding-progress && bun run test:onboarding-telemetry && bun run test:v2-event-migration && bun run test:analytics && bun run test:analytics-error-category && bun run test:analytics-org-resolver && bun run test:supabase-perf && bun run test:mcp-analytics && bun run test:app-created-source && bun run test:doctor-analytics && bun run test:posthog-exception && bun run test:build-platform-selection && bun run test:onboarding-recovery && bun run test:onboarding-progress && bun run test:onboarding-run-targets && bun run test:run-device-command && bun run test:init-app-conflict && bun run test:init-guardrails && bun run test:prompt-preferences && bun run test:esm-sdk && bun run test:mcp && bun run test:version-detection && bun run test:platform-paths && bun run test:payload-split && bun run test:manifest-path-encoding && bun run test:macos-signing && bun run test:apple-api-import-helpers && bun run test:bundle-id-detector && bun run test:apple-api-app-list && bun run test:app-verification && bun run test:pbxproj-parser && bun run test:ai-log-capture && bun run test:ai-analyze-flow && bun run test:ai-render-markdown && bun run test:ai-onboarding-mode && bun run test:ai-fit && bun run test:platform-layout && bun run test:frame-fit && bun run test:onboarding-min-size && bun run test:min-size-gate && bun run test:shell-size-gate && bun run test:build-log-sanitize && bun run test:build-output-viewport && bun run test:diff-viewer-viewport && bun run test:build-complete-exit",
     "test:build-platform-selection": "bun test/test-build-platform-selection.mjs",
     "test:ai-log-capture": "bun test/test-ai-log-capture.mjs",
     "test:ai-analyze-flow": "bun test/test-ai-analyze-flow.mjs",

package/dist/src/build/onboarding/app-verification.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Pure decision logic for the iOS "verify App Store app" onboarding step.
+ *
+ * No filesystem, network, or React access — every input (the local Release
+ * build ID, the remote App Store Connect apps, and the registered bundle IDs)
+ * is passed in so the module stays synchronous and unit-testable, mirroring
+ * `decideBuilderCtaSurface` / `shouldBlockIncompatibleUpload` in
+ * `cli/src/bundle/builder-cta.ts`.
+ *
+ * The single invariant the step enforces (always `app_store` mode): an App
+ * Store Connect app must exist whose `bundleId` equals the Release build ID.
+ */
+/**
+ * Classification of why (and whether) the verification invariant is met.
+ *
+ * - `exact-match`            — an ASC app's bundle ID == the Release build ID. Pass.
+ * - `wrong-build-id`         — apps exist but none match → likely a wrong build ID (Path A).
+ * - `no-app-identifier-exists` — no apps at all, but the identifier is already
+ *                              registered in the Developer portal (Path B; the
+ *                              ASC new-app form can select the existing id).
+ * - `no-app-unregistered`    — no apps at all and the identifier is not yet
+ *                              registered (Path B; register first, then create).
+ *
+ * `no-apps-in-account` is the umbrella for the `apps.length === 0` cases. We
+ * keep it in the union because the analytics/step layer surfaces it as a
+ * coarse result, but `classifyAppVerification` deliberately returns the finer
+ * registered/unregistered split because that distinction is what changes the
+ * actionable Path B wording ("identifier already exists" vs "will be
+ * registered"). The umbrella value is therefore never returned by the
+ * classifier itself.
+ */
+export type AppVerifyResult = 'exact-match' | 'wrong-build-id' | 'no-app-identifier-exists' | 'no-app-unregistered' | 'no-apps-in-account';
+/** Minimal shape of an App Store Connect app needed for verification. */
+export interface AscAppLike {
+    bundleId: string;
+    name: string;
+}
+export interface ClassifyAppVerificationInput {
+    /** The authoritative Release `PRODUCT_BUNDLE_IDENTIFIER` from the project. */
+    releaseBundleId: string;
+    /** Apps that actually exist in the user's App Store Connect account. */
+    apps: AscAppLike[];
+    /** Bundle IDs registered in the Apple Developer portal (diagnostic only). */
+    registeredBundleIds: string[];
+}
+export interface ClassifyAppVerificationResult {
+    result: AppVerifyResult;
+    /** The matched ASC app when `result === 'exact-match'`, else `null`. */
+    matchedApp: AscAppLike | null;
+}
+/**
+ * Pure classification of the verification invariant.
+ *
+ * 1. An app whose `bundleId === releaseBundleId` → `exact-match` (+ that app).
+ * 2. Otherwise, if any apps exist → `wrong-build-id` (the build signs an id that
+ *    matches none of the account's apps).
+ * 3. Otherwise (no apps), if `releaseBundleId` is already registered →
+ *    `no-app-identifier-exists`.
+ * 4. Otherwise (no apps, not registered) → `no-app-unregistered`.
+ */
+export declare function classifyAppVerification(input: ClassifyAppVerificationInput): ClassifyAppVerificationResult;
+/** Which resolution path the verification gate is enforcing. */
+export type GatePath = 'fix-build-id' | 'create-app';
+export interface EvaluateGateInput {
+    /** Whether the invariant now holds (re-checked live on each Continue). */
+    satisfied: boolean;
+    /** 1-based count of blocked Continue attempts so far. */
+    attempt: number;
+}
+export interface EvaluateGateResult {
+    /** Whether the user may proceed past the step. */
+    proceed: boolean;
+    /**
+     * How loud the (still-blocked) warning box should be. `0` when satisfied;
+     * otherwise the attempt count clamped to `3` so the escalation tops out
+     * instead of growing unbounded.
+     */
+    escalationLevel: number;
+}
+/**
+ * Pure gate decision. When the invariant is satisfied the user proceeds with no
+ * escalation; otherwise they are blocked and the escalation level is the attempt
+ * count capped at {@link MAX_ESCALATION_LEVEL} so the warning box can ramp its
+ * treatment without overflowing.
+ */
+export declare function evaluateGate(input: EvaluateGateInput): EvaluateGateResult;

package/dist/src/build/onboarding/apple-api.d.ts

@@ -159,6 +159,37 @@ export declare function createCertificate(token: string, csrPem: string): Promis
 export declare function ensureBundleId(token: string, identifier: string): Promise<{
     bundleIdResourceId: string;
 }>;
+/**
+ * An App Store Connect app record. Used by the iOS app-verification step to
+ * check whether an app exists whose `bundleId` matches the project's Release
+ * `PRODUCT_BUNDLE_IDENTIFIER`.
+ */
+export interface AscApp {
+    id: string;
+    bundleId: string;
+    name: string;
+}
+/**
+ * Parse a `GET /v1/apps` response into {@link AscApp} records. Tolerant of
+ * missing `data`, missing `attributes`, and missing individual fields — Apple
+ * omits attributes the API key isn't entitled to see rather than nulling them.
+ */
+export declare function parseAppsResponse(json: any): AscApp[];
+/**
+ * Parse a `GET /v1/bundleIds` response into the list of registered identifier
+ * strings, dropping any falsy entries (missing `attributes`/`identifier`).
+ */
+export declare function parseBundleIdsResponse(json: any): string[];
+/**
+ * List every App Store Connect app visible to the API key, following
+ * pagination. Uses the existing {@link ascFetch} — no separate fetch path.
+ */
+export declare function listApps(token: string): Promise<AscApp[]>;
+/**
+ * List every registered bundle ID identifier visible to the API key, following
+ * pagination. Uses the existing {@link ascFetch} — no separate fetch path.
+ */
+export declare function listBundleIds(token: string): Promise<string[]>;
 /**
  * Get the profile name we use for a given appId.
  */

package/dist/src/build/onboarding/bundle-id-detector.d.ts

@@ -1,4 +1,4 @@
-export type BundleIdSource = 'pbxproj-release' | 'pbxproj-fallback' | 'plist' | 'capacitor-config';
+export type BundleIdSource = 'pbxproj-release' | 'pbxproj-debug' | 'pbxproj-fallback' | 'plist' | 'capacitor-config';
 export interface BundleIdCandidate {
     value: string;
     source: BundleIdSource;
@@ -8,6 +8,12 @@ export interface BundleIdCandidate {
 export interface DetectedBundleIds {
     /** PRODUCT_BUNDLE_IDENTIFIER from project.pbxproj, preferring Release config. */
     pbxproj: BundleIdCandidate | null;
+    /**
+     * The Debug-config PRODUCT_BUNDLE_IDENTIFIER from project.pbxproj, when a
+     * literal value exists. Exposed for the awareness note only — never used to
+     * gate. Null when no Debug-config literal value is present.
+     */
+    debug: BundleIdCandidate | null;
     /**
      * Info.plist CFBundleIdentifier when it's a literal value (not the common
      * `$(PRODUCT_BUNDLE_IDENTIFIER)` placeholder, which we drop because it
@@ -24,20 +30,57 @@ export interface DetectedBundleIds {
     recommended: BundleIdCandidate;
     /**
      * True when the recommended value differs from capacitor.config.appId.
-     * Used by the confirm-app-id step to decide whether to surface a question
-     * at all — when they match, nothing's worth asking about.
+     * Used by redirectIfMismatch to decide whether to adopt the Release id —
+     * when they match, capacitor.config.appId is already the build id.
      */
     mismatch: boolean;
+    /**
+     * True only when BOTH a Release-config and a Debug-config literal bundle id
+     * were found AND they differ. Drives the "Debug ≠ Release" awareness note;
+     * never gates. False when either value is missing or they match.
+     */
+    debugReleaseDiffer: boolean;
+    /**
+     * True when a Release-config PRODUCT_BUNDLE_IDENTIFIER was resolved from
+     * pbxproj. When false, the authoritative build ID could not be determined
+     * from Release and callers should warn/skip gating rather than gate on a
+     * Debug or plist fallback.
+     */
+    releaseResolved: boolean;
     /**
      * Deduplicated, ordered list of candidates ready to render as Select
      * options. Empty list is impossible (capacitor is always included).
      */
     candidates: BundleIdCandidate[];
 }
+/**
+ * Parse `PRODUCT_BUNDLE_IDENTIFIER = "..."` lines from pbxproj content,
+ * returning the Release and Debug candidates separately.
+ *
+ * Release is authoritative: when ANY Release-config value exists, `release`
+ * is populated and `releaseResolved` is true. The Debug value (when present)
+ * is returned alongside via `debug` for the awareness note — it is never
+ * promoted to `release`.
+ *
+ * When no Release config exists, `release` is null and `releaseResolved` is
+ * false so callers can detect the no-Release case.
+ */
+export declare function parsePbxprojBundleIds(pbxprojContent: string): {
+    release: BundleIdCandidate | null;
+    debug: BundleIdCandidate | null;
+    releaseResolved: boolean;
+};
 /**
  * Parse `PRODUCT_BUNDLE_IDENTIFIER = "..."` lines from pbxproj content.
- * Returns the Release-config value if present, else the first non-Release
- * value. Returns null when no bundle id can be extracted.
+ * Returns the Release-config value if present, else the shortest non-Release
+ * value as a `pbxproj-fallback`. Returns null when no bundle id can be
+ * extracted.
+ *
+ * Release stays authoritative here: a Release value is never overridden by a
+ * Debug value. The no-Release fallback is preserved for backward
+ * compatibility — callers that need to distinguish "Release resolved" from
+ * "fell back to Debug" should use `parsePbxprojBundleIds` (or the
+ * `releaseResolved` flag on `detectIosBundleIds`).
  *
  * Looks like a re-implementation of pbxproj-parser.ts's resolveBundleId, but
  * that one needs an XCConfigurationList id (it walks from a target). This

package/dist/src/build/onboarding/types.d.ts

@@ -16,7 +16,7 @@ export interface OnboardingResult {
     /** Present only when outcome === 'completed'. */
     summary?: OnboardingCompletionSummary;
 }
-export type OnboardingStep = 'welcome' | 'resume-prompt' | 'platform-select' | 'adding-platform' | 'credentials-exist' | 'backing-up' | 'setup-method-select' | 'confirm-app-id' | 'import-scanning' | 'import-distribution-mode' | 'import-pick-identity' | 'import-pick-profile' | 'import-validating-all-certs' | 'import-checking-apple-cert' | 'import-no-match-recovery' | 'import-portal-explanation' | 'import-provide-profile-path' | 'import-create-profile-only' | 'import-export-warning' | 'import-compiling-helper' | 'import-exporting' | 'api-key-instructions' | 'p8-method-select' | 'input-p8-path' | 'input-key-id' | 'input-issuer-id' | 'verifying-key' | 'creating-certificate' | 'cert-limit-prompt' | 'revoking-certificate' | 'creating-profile' | 'duplicate-profile-prompt' | 'deleting-duplicate-profiles' | 'saving-credentials' | 'detecting-ci-secrets' | 'ci-secrets-setup' | 'ci-secrets-target-select' | 'ask-ci-secrets' | 'checking-ci-secrets' | 'confirm-ci-secret-overwrite' | 'uploading-ci-secrets' | 'ci-secrets-failed' | 'ask-github-actions-setup' | 'confirm-secrets-push' | 'ask-export-env' | 'exporting-env' | 'confirm-env-export-overwrite' | 'overwrite-and-export-env' | 'pick-package-manager' | 'pick-build-script' | 'pick-build-script-custom' | 'preview-workflow-file' | 'view-workflow-diff' | 'writing-workflow-file' | 'ask-build' | 'requesting-build' | 'ai-analysis-prompt' | 'ai-analysis-running' | 'ai-analysis-result' | 'ai-analysis-result-scroll' | 'build-complete' | 'no-platform' | 'error';
+export type OnboardingStep = 'welcome' | 'resume-prompt' | 'platform-select' | 'adding-platform' | 'credentials-exist' | 'backing-up' | 'setup-method-select' | 'import-scanning' | 'import-distribution-mode' | 'import-pick-identity' | 'import-pick-profile' | 'import-validating-all-certs' | 'import-checking-apple-cert' | 'import-no-match-recovery' | 'import-portal-explanation' | 'import-provide-profile-path' | 'import-create-profile-only' | 'import-export-warning' | 'import-compiling-helper' | 'import-exporting' | 'api-key-instructions' | 'p8-method-select' | 'input-p8-path' | 'input-key-id' | 'input-issuer-id' | 'verifying-key' | 'verify-app' | 'creating-certificate' | 'cert-limit-prompt' | 'revoking-certificate' | 'creating-profile' | 'duplicate-profile-prompt' | 'deleting-duplicate-profiles' | 'saving-credentials' | 'detecting-ci-secrets' | 'ci-secrets-setup' | 'ci-secrets-target-select' | 'ask-ci-secrets' | 'checking-ci-secrets' | 'confirm-ci-secret-overwrite' | 'uploading-ci-secrets' | 'ci-secrets-failed' | 'ask-github-actions-setup' | 'confirm-secrets-push' | 'ask-export-env' | 'exporting-env' | 'confirm-env-export-overwrite' | 'overwrite-and-export-env' | 'pick-package-manager' | 'pick-build-script' | 'pick-build-script-custom' | 'preview-workflow-file' | 'view-workflow-diff' | 'writing-workflow-file' | 'ask-build' | 'requesting-build' | 'ai-analysis-prompt' | 'ai-analysis-running' | 'ai-analysis-result' | 'ai-analysis-result-scroll' | 'build-complete' | 'no-platform' | 'error';
 export type OnboardingErrorCategory = 'apple_api_unauthorized' | 'apple_api_rate_limited' | 'cert_limit_reached' | 'profile_creation_failed' | 'p8_invalid' | 'keychain_no_identities' | 'keychain_export_failed' | 'keychain_helper_compile_failed' | 'profile_no_match' | 'profile_read_failed' | 'unknown';
 export interface ApiKeyData {
     keyId: string;
@@ -105,25 +105,26 @@ export interface OnboardingProgress {
      */
     importDistribution?: 'app_store' | 'ad_hoc';
     /**
-     * When set, the user explicitly confirmed an iOS bundle id different from
-     * `capacitor.config.appId`. Used for Apple-side operations (cert lookup,
-     * profile filtering, `ensureBundleId`, `createProfile`) and as the key in
-     * the provisioning_map. The progress-file key and Capgo SaaS API calls
-     * still use `appId` so existing build commands continue to find these
-     * credentials without forcing the user to edit `capacitor.config`.
+     * The resolved iOS bundle id (the authoritative Release
+     * `PRODUCT_BUNDLE_IDENTIFIER`) when it differs from `capacitor.config.appId`.
+     * Used for Apple-side operations (cert lookup, profile filtering,
+     * `ensureBundleId`, `createProfile`) and as the key in the provisioning_map.
+     * The progress-file key and Capgo SaaS API calls still use `appId` so existing
+     * build commands keep finding these credentials without editing
+     * `capacitor.config`.
      *
-     * Persisted so the confirm-app-id step doesn't re-ask on resume — once
-     * confirmed, the override sticks unless the configuration context (see
+     * Persisted so verify-app / redirectIfMismatch don't re-resolve on resume —
+     * once set, the override sticks unless the configuration context (see
      * `iosBundleIdContextAppId`) changes between CLI runs.
      */
     iosBundleIdOverride?: string;
     /**
-     * Snapshot of `config.appId` at the time the user confirmed the
-     * `iosBundleIdOverride`. On the next run we compare this to the current
-     * `config.appId`; if it changed (user renamed the app, added/removed a
-     * dev-tunnel suffix, etc.) the saved override is stale and we re-ask
-     * via the confirm-app-id step. Without this we'd silently keep using a
-     * bundle id the user already moved on from.
+     * Snapshot of `config.appId` at the time the `iosBundleIdOverride` was
+     * resolved. On the next run we compare this to the current `config.appId`;
+     * if it changed (user renamed the app, added/removed a dev-tunnel suffix,
+     * etc.) the saved override is stale and we re-resolve / re-verify via the
+     * verify-app step. Without this we'd silently keep using a bundle id the
+     * user already moved on from.
      */
     iosBundleIdContextAppId?: string;
     completedSteps: {

package/dist/src/build/onboarding/ui/app.d.ts

@@ -15,9 +15,10 @@ interface AppProps {
      * (cert lookup, profile filtering, ensureBundleId, createProfile, and the
      * provisioning_map key). Sourced from `config.appId` directly — what
      * `cap sync` writes into project.pbxproj's PRODUCT_BUNDLE_IDENTIFIER.
-     * The user can override at the `confirm-app-id` step when pbxproj and
-     * config.appId disagree. command.ts falls back to `appId` if config.appId
-     * is missing, so this prop is always a valid string.
+     * When pbxproj's Release id and config.appId disagree, the wizard adopts the
+     * authoritative Release id (verify-app confirms it remotely). command.ts
+     * falls back to `appId` if config.appId is missing, so this prop is always a
+     * valid string.
      */
     iosBundleIdInitial: string;
     initialProgress: OnboardingProgress | null;

package/dist/src/build/pbxproj-parser.d.ts

@@ -20,3 +20,29 @@ export declare function findXcodeProject(searchDir: string): string | null;
  * Returns null if no project is found.
  */
 export declare function readPbxproj(projectDir: string): string | null;
+/**
+ * Replace every `PRODUCT_BUNDLE_IDENTIFIER = <fromId>;` assignment in pbxproj
+ * content with `<toId>` (tolerates optional quotes and surrounding whitespace).
+ * Pure — returns the new content and the number of replacements made.
+ *
+ * Matching by exact value (rather than by config block) is deliberate: callers
+ * pass the resolved Release build id as `fromId`, and real Capacitor/RN projects
+ * give extensions a SUFFIXED id (com.app.ext), so only the main target's
+ * assignment(s) match. A Debug config that shares the exact same value is
+ * updated too (keeping Debug == Release); a Debug config with a different value
+ * is left untouched.
+ */
+export declare function replaceBundleIdInPbxproj(content: string, fromId: string, toId: string): {
+    content: string;
+    changed: number;
+};
+/**
+ * Locate the project's pbxproj (same search order as detectIosBundleIds) and
+ * rewrite its `PRODUCT_BUNDLE_IDENTIFIER = <fromId>;` assignments to `<toId>`,
+ * writing the file back only when something changed. Returns the number of
+ * replacements (0 when no project or no matching assignment was found). Throws
+ * only on a filesystem read/write error.
+ */
+export declare function writeReleaseBundleId(cwd: string, iosDir: string, fromId: string, toId: string): {
+    changed: number;
+};