@capgo/cli 8.23.4 → 8.24.1

package/dist/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@capgo/cli",
   "type": "module",
-  "version": "8.23.4",
+  "version": "8.24.1",
   "description": "A CLI to upload to capgo servers",
   "author": "Martin martin@capgo.app",
   "license": "Apache 2.0",
@@ -157,7 +157,7 @@
     "test:ios-verify-app": "bun test/test-ios-verify-app.mjs",
     "test:platform-flow-contract": "bun test/test-platform-flow-contract.mjs",
     "test:tail-engine-shared": "bun test/test-tail-engine-shared.mjs",
-    "test": "bun run build && bun run test:helper-dce && bun run test:version-detection:setup && bun run test:bundle && bun run test:functional && bun run test:semver && bun run test:version-edge-cases && bun run test:regex && bun run test:upload && bun run test:fail-on-incompatible && bun run test:native-dependencies && bun run test:credentials && bun run test:credentials-validation && bun run test:android-service-account-validation && bun run test:build-zip-filter && bun run test:checksum && bun run test:build-needed && bun run test:ci-prompts && bun run test:ci-secrets && bun run test:android-onboarding-progress && bun run test:onboarding-telemetry && bun run test:v2-event-migration && bun run test:analytics && bun run test:analytics-error-category && bun run test:analytics-org-resolver && bun run test:supabase-perf && bun run test:preview-qr && bun run test:app-set-options && bun run test:mcp-analytics && bun run test:mcp-instructions && bun run test:mcp-live-update-onboarding && bun run test:mcp-stdout-guard && bun run test:mcp-platform-select && bun run test:mcp-explain-scopes && bun run test:mcp-oauth-reopen && bun run test:mcp-broker-oauth && bun run test:mcp-broker-session && bun run test:mcp-credentials-manage && bun run test:mcp-resume-prompt && bun run test:mcp-build-job && bun run test:mcp-build-tools && bun run test:app-created-source && bun run test:doctor-analytics && bun run test:posthog-exception && bun run test:build-platform-selection && bun run test:onboarding-recovery && bun run test:onboarding-progress && bun run test:onboarding-run-targets && bun run test:run-device-command && bun run test:init-app-conflict && bun run test:init-guardrails && bun run test:init-replay && bun run test:prompt-preferences && bun run test:esm-sdk && bun run test:mcp && bun run test:mcp-no-key-handshake && bun run test:auth-session && bun run test:version-detection && bun run test:platform-paths && bun run test:project-type-detection && bun run test:payload-split && bun run test:manifest-path-encoding && bun run test:macos-signing && bun run test:asc-key-protocol && bun run test:apple-api-import-helpers && bun run test:apple-api-verify-key && bun run test:bundle-id-detector && bun run test:apple-api-app-list && bun run test:app-verification && bun run test:pbxproj-parser && bun run test:ai-log-capture && bun run test:ai-analyze-flow && bun run test:cicd-failure-help && bun run test:ai-sse-parser && bun run test:ai-render-markdown && bun run test:ai-stream-markdown && bun run test:ai-onboarding-mode && bun run test:ai-fit && bun run test:platform-layout && bun run test:frame-fit && bun run test:onboarding-min-size && bun run test:min-size-gate && bun run test:shell-size-gate && bun run test:build-log-sanitize && bun run test:build-output-viewport && bun run test:diff-viewer-viewport && bun run test:build-complete-exit && bun run test:ai-analyze-stream && bun run test:support-mailto && bun run test:support-redact && bun run test:support-internal-log && bun run test:support-help-menu && bun run test:support-contact && bun run test:support-upload-prompt && bun run test:support-bundle-files && bun run test:self-update && bun run test:update-prompt && bun run test:apple-api-cert-create && bun run test:android-tail-engine && bun run test:android-tail-render && bun run test:android-tail-routing && bun run test:dev-gate-stripped && bun run test:frame-fit-ios-shared && bun run test:ios-confirm-app-id && bun run test:ios-create-new && bun run test:ios-e2e && bun run test:ios-flow-contract && bun run test:ios-import-discovery && bun run test:ios-import-export && bun run test:ios-import-pickers && bun run test:ios-import-recovery && bun run test:ios-recovery && bun run test:ios-resume && bun run test:ios-tail-handoff && bun run test:ios-tui-render && bun run test:p8-error && bun run test:ios-tui-routing && bun run test:ios-updater-sync-validation && bun run test:ios-verify-app && bun run test:platform-flow-contract && bun run test:tail-engine-shared && bun run test:prescan && bun run test:android-reporting-api && bun run test:android-app-verification && bun run test:android-rename",
+    "test": "bun run build && bun run test:helper-dce && bun run test:version-detection:setup && bun run test:bundle && bun run test:functional && bun run test:semver && bun run test:version-edge-cases && bun run test:regex && bun run test:upload && bun run test:fail-on-incompatible && bun run test:native-dependencies && bun run test:credentials && bun run test:credentials-validation && bun run test:android-service-account-validation && bun run test:build-zip-filter && bun run test:checksum && bun run test:build-needed && bun run test:ci-prompts && bun run test:ci-secrets && bun run test:android-onboarding-progress && bun run test:onboarding-telemetry && bun run test:v2-event-migration && bun run test:analytics && bun run test:analytics-error-category && bun run test:analytics-org-resolver && bun run test:supabase-perf && bun run test:preview-qr && bun run test:app-set-options && bun run test:mcp-analytics && bun run test:mcp-instructions && bun run test:mcp-live-update-onboarding && bun run test:mcp-stdout-guard && bun run test:mcp-platform-select && bun run test:mcp-explain-scopes && bun run test:mcp-oauth-reopen && bun run test:mcp-broker-oauth && bun run test:mcp-broker-session && bun run test:mcp-credentials-manage && bun run test:mcp-resume-prompt && bun run test:mcp-build-job && bun run test:mcp-build-tools && bun run test:app-created-source && bun run test:doctor-analytics && bun run test:posthog-exception && bun run test:build-platform-selection && bun run test:onboarding-recovery && bun run test:onboarding-progress && bun run test:onboarding-run-targets && bun run test:run-device-command && bun run test:init-app-conflict && bun run test:init-guardrails && bun run test:init-replay && bun run test:prompt-preferences && bun run test:esm-sdk && bun run test:mcp && bun run test:mcp-no-key-handshake && bun run test:auth-session && bun run test:version-detection && bun run test:platform-paths && bun run test:project-type-detection && bun run test:payload-split && bun run test:manifest-path-encoding && bun run test:macos-signing && bun run test:asc-key-protocol && bun run test:apple-api-import-helpers && bun run test:apple-api-verify-key && bun run test:bundle-id-detector && bun run test:apple-api-app-list && bun run test:app-verification && bun run test:pbxproj-parser && bun run test:ai-log-capture && bun run test:ai-analyze-flow && bun run test:cicd-failure-help && bun run test:ai-sse-parser && bun run test:ai-render-markdown && bun run test:ai-stream-markdown && bun run test:ai-onboarding-mode && bun run test:ai-fit && bun run test:platform-layout && bun run test:frame-fit && bun run test:onboarding-min-size && bun run test:min-size-gate && bun run test:shell-size-gate && bun run test:build-log-sanitize && bun run test:build-output-viewport && bun run test:diff-viewer-viewport && bun run test:build-complete-exit && bun run test:ai-analyze-stream && bun run test:support-mailto && bun run test:support-redact && bun run test:support-internal-log && bun run test:support-help-menu && bun run test:support-contact && bun run test:support-upload-prompt && bun run test:support-bundle-files && bun run test:self-update && bun run test:update-prompt && bun run test:apple-api-cert-create && bun run test:android-tail-engine && bun run test:android-tail-render && bun run test:android-tail-routing && bun run test:dev-gate-stripped && bun run test:frame-fit-ios-shared && bun run test:ios-confirm-app-id && bun run test:ios-create-new && bun run test:ios-e2e && bun run test:ios-flow-contract && bun run test:ios-import-discovery && bun run test:ios-import-export && bun run test:ios-import-pickers && bun run test:ios-import-recovery && bun run test:ios-recovery && bun run test:ios-resume && bun run test:ios-tail-handoff && bun run test:ios-tui-render && bun run test:p8-error && bun run test:ios-tui-routing && bun run test:ios-updater-sync-validation && bun run test:ios-verify-app && bun run test:platform-flow-contract && bun run test:tail-engine-shared && bun run test:prescan && bun run test:android-reporting-api && bun run test:android-app-verification && bun run test:android-rename && bun run test:appflow-auth && bun run test:appflow-api-map && bun run test:appflow-validate && bun run test:appflow-flow && bun run test:appflow-gapfill && bun run test:appflow-engine && bun run test:appflow-tail && bun run test:appflow-fetch && bun run test:appflow-sa-decode",
     "test:build-platform-selection": "bun test/test-build-platform-selection.mjs",
     "test:ai-log-capture": "bun test/test-ai-log-capture.mjs",
     "test:ai-analyze-flow": "bun test/test-ai-analyze-flow.mjs",
@@ -185,10 +185,19 @@
     "test:support-upload-prompt": "bun test/test-support-upload-prompt.mjs",
     "test:support-bundle-files": "bun test/test-support-bundle-files.mjs",
     "test:mcp-live-update-onboarding": "bun test/test-mcp-live-update-onboarding.mjs",
+    "test:app-set-options": "bun test/test-app-set-options.mjs",
     "test:android-reporting-api": "bun test/test-android-reporting-api.mjs",
     "test:android-app-verification": "bun test/test-android-app-verification.mjs",
     "test:android-rename": "bun test/test-android-rename.mjs",
-    "test:app-set-options": "bun test/test-app-set-options.mjs"
+    "test:appflow-auth": "bun test/test-appflow-auth.mjs",
+    "test:appflow-api-map": "bun test/test-appflow-api-map.mjs",
+    "test:appflow-validate": "bun test/test-appflow-validate.mjs",
+    "test:appflow-flow": "bun test/test-appflow-flow.mjs",
+    "test:appflow-gapfill": "bun test/test-appflow-gapfill.mjs",
+    "test:appflow-engine": "bun test/test-appflow-engine.mjs",
+    "test:appflow-tail": "bun test/test-appflow-tail.mjs",
+    "test:appflow-fetch": "bun test/test-appflow-fetch.mjs",
+    "test:appflow-sa-decode": "bun test/test-appflow-sa-decode.mjs"
   },
   "dependencies": {
     "@inkjs/ui": "^2.0.0",

package/dist/src/build/onboarding/appflow/api.d.ts

@@ -0,0 +1,59 @@
+export declare const stripDataUri: (s: string) => string;
+export declare const bundleIdFromAppIdentifier: (ai: string) => string;
+/** Thrown by rest()/gql() on any non-2xx, GraphQL error payload, or parse failure. */
+export declare class AppflowApiError extends Error {
+    readonly status: number | string;
+    constructor(message: string, status: number | string);
+}
+interface RawIosProvisioningProfile {
+    application_identifier?: string;
+    name?: string;
+    provisioning_profile_file?: string;
+}
+interface RawIosSigning {
+    cert_file?: string;
+    cert_password?: string;
+    provisioning_profiles?: RawIosProvisioningProfile[];
+}
+interface RawIosDistribution {
+    user_name?: string;
+    app_specific_password?: string;
+    apple_app_id?: string | number;
+    team_id?: string;
+}
+interface RawAndroidSigning {
+    keystore_file?: string;
+    keystore_password?: string;
+    key_password?: string;
+    key_alias?: string;
+}
+interface RawAndroidDistribution {
+    json_key_file?: string;
+}
+export declare function mapIosSigning(raw: RawIosSigning | null | undefined): Record<string, string>;
+export declare function mapIosDistribution(raw: RawIosDistribution | null | undefined): Record<string, string>;
+export declare function mapAndroidSigning(raw: RawAndroidSigning | null | undefined): Record<string, string>;
+export declare function mapAndroidDistribution(raw: RawAndroidDistribution | null | undefined): Record<string, string>;
+export declare const redactTrace: (method: string, url: string, status: number | string, shapeKeys: string[]) => string;
+export interface AppflowOrg {
+    id?: string;
+    name?: string;
+    slug: string;
+}
+export interface AppflowApp {
+    id: string;
+    name?: string;
+    slug?: string;
+    nativeType?: string;
+}
+export declare function createAppflowApi(token: string, log?: (s: string) => void): {
+    listOrgs(): Promise<AppflowOrg[]>;
+    listApps(slug: string): Promise<AppflowApp[]>;
+    listCertificates(appId: string): Promise<any[]>;
+    listDistribution(appId: string): Promise<any[]>;
+    fetchIosSigning(appId: string, tag: string): Promise<Record<string, string>>;
+    fetchAndroidSigning(appId: string, tag: string): Promise<Record<string, string>>;
+    fetchIosDistribution(appId: string, id: number | string): Promise<Record<string, string>>;
+    fetchAndroidDistribution(appId: string, id: number | string): Promise<Record<string, string>>;
+};
+export {};

package/dist/src/build/onboarding/appflow/auth.d.ts

@@ -0,0 +1,19 @@
+export interface AppflowToken {
+    access_token: string;
+    refresh_token?: string;
+    expires_in: number;
+    id_token?: string;
+    capturedAtMs: number;
+}
+export declare function pkce(): {
+    verifier: string;
+    challenge: string;
+};
+export declare function buildAuthorizeUrl(challenge: string, state: string, nonce: string): string;
+export declare function isExpired(t: Pick<AppflowToken, 'expires_in' | 'capturedAtMs'>, marginMs?: number): boolean;
+export declare function sanitizeOauthError(raw: string | null | undefined): string;
+export declare function loginWithBrowser(opts?: {
+    openBrowser?: (url: string) => void;
+    signal?: AbortSignal;
+}): Promise<AppflowToken>;
+export declare function refresh(token: AppflowToken): Promise<AppflowToken>;

package/dist/src/build/onboarding/appflow/deps.d.ts

@@ -0,0 +1,43 @@
+import { Buffer } from 'node:buffer';
+import type { AppflowEffectDeps } from './flow.js';
+import type { AppflowProgress } from './types.js';
+import type { AppflowToken } from './auth.js';
+/** Load a cached Appflow token, or null when absent/unreadable. Never throws. */
+export declare function loadAppflowToken(): AppflowToken | null;
+/** Persist an Appflow token to the credentials dir (0700 dir / best-effort). Never throws. */
+/** Persist an Appflow token to the credentials dir atomically (0700 dir / 0600
+ * file, temp+rename). Best-effort and never throws: a failure just means the next
+ * run re-auths. Uses the shared safe-write helpers (symlink-guarded, atomic). */
+export declare function saveAppflowToken(token: AppflowToken): void;
+/**
+ * PLAY_CONFIG_JSON is stored base64-encoded (the same convention the native
+ * android flow uses — see android/types.ts). Decode it to the raw service-account
+ * JSON bytes for validation; if the value is already raw JSON (starts with '{'),
+ * pass it through as utf8. Exported for unit testing the encoding contract.
+ */
+export declare function serviceAccountJsonBytes(value: string): Buffer;
+/**
+ * Reader: load a user-provided App Store Connect API key (.p8) file and return
+ * its base64-encoded bytes, ready to store as APPLE_KEY_CONTENT (the same
+ * encoding the native iOS flow and the generate path use). Reads the raw bytes
+ * (a .p8 is PEM text, but we base64 the file as-is to match the generate path).
+ * Advisory: returns null on any error (missing / unreadable file), never throws.
+ */
+export declare function readP8File(path: string): Promise<string | null>;
+/**
+ * Build the production AppflowEffectDeps for a given app id. The `packageName`
+ * (the Play package, when known) sharpens the service-account probe; pass the
+ * appId as a fallback. Token cache, browser, logger, and validators are all
+ * wired here so the engine and the TUI share one source of truth.
+ */
+export declare function buildAppflowEffectDeps(opts?: {
+    appId?: string;
+    packageName?: string;
+}): AppflowEffectDeps;
+/**
+ * Persist the collected per-platform Capgo creds into the REAL credential store
+ * (the same path the native flows use), so the build/validate/CI tail cannot
+ * tell migrated creds from natively-set-up ones. Writes only the platforms that
+ * actually collected creds. Returns the platforms written.
+ */
+export declare function persistAppflowCredentials(appId: string, progress: AppflowProgress, local?: boolean): Promise<('ios' | 'android')[]>;

package/dist/src/build/onboarding/appflow/flow.d.ts

@@ -0,0 +1,94 @@
+import type { PlatformFlow, StepView } from '../flow/contract';
+import type { AppflowInput, AppflowProgress, AppflowStep } from './types';
+import type { AppflowToken } from './auth';
+import type { TailStep } from '../tail/flow.js';
+import type { AppflowTailDepsOptions } from './tail.js';
+export interface AppflowEffectResult {
+    progress: AppflowProgress;
+    next?: AppflowStep;
+    transient?: Record<string, unknown>;
+}
+export interface AppflowValidationResult {
+    id: 'sa' | 'keystore' | 'app-password' | 'p12';
+    status: 'pass' | 'warn' | 'skipped';
+    message: string;
+}
+export interface AppflowGenerateResult {
+    ok: boolean;
+    creds?: Record<string, string>;
+    message?: string;
+}
+export interface AppflowEffectDeps {
+    appId?: string;
+    log?: (s: string) => void;
+    loadToken?: () => AppflowToken | null;
+    saveToken?: (t: AppflowToken) => void;
+    openBrowser?: (url: string) => void;
+    validateServiceAccountJson?: (json: string, packageName?: string) => Promise<{
+        ok: boolean;
+        reason?: string;
+    }>;
+    tryUnlockPrivateKey?: (keystoreB64: string, storePass: string, alias: string) => Promise<boolean>;
+    validateAppleAppPassword?: (user: string, pw: string) => Promise<{
+        valid: boolean;
+        message?: string;
+        kind?: 'authenticated' | 'rejected' | 'unreachable';
+    }>;
+    validateP12?: (p12B64: string, password: string) => Promise<boolean>;
+    generateIosP8Key?: () => Promise<AppflowGenerateResult>;
+    generateAndroidServiceAccount?: (opts: {
+        packageName?: string;
+    }) => Promise<AppflowGenerateResult>;
+    readP8File?: (path: string) => Promise<string | null>;
+    carried?: Record<string, unknown>;
+    tailOptions?: AppflowTailDepsOptions;
+}
+export declare function isAppflowTailStep(step: AppflowStep): step is TailStep;
+export declare function autoSelect<T>(items: T[]): T | 'prompt' | null;
+export interface AppflowCert {
+    tag?: string;
+    name?: string;
+    type?: string;
+    credentials?: {
+        ios?: unknown;
+        android?: unknown;
+    };
+}
+export interface AppflowDistCred {
+    id?: number | string;
+    type?: string;
+    name?: string;
+}
+export declare function decideAfterFetchSigning(progress: Pick<AppflowProgress, 'scope' | 'migratable'>): AppflowStep;
+export declare function platformsToBuild(progress: Pick<AppflowProgress, 'scope' | 'ios' | 'android'>): ('ios' | 'android')[];
+export declare function runValidations(progress: AppflowProgress, deps?: AppflowEffectDeps): Promise<AppflowValidationResult[]>;
+export declare function appflowViewForStep(step: AppflowStep, progress: AppflowProgress, ctx?: Record<string, unknown>): StepView;
+/**
+ * Decode the `email` claim from an Appflow token's id_token JWT WITHOUT verifying
+ * the signature (jsonwebtoken.decode) — we only need the human-readable account
+ * identity to surface which Appflow account is being migrated, not to trust it.
+ * Returns undefined when there is no id_token or no string email claim.
+ */
+export declare function appflowAccountEmail(token: {
+    id_token?: string;
+} | null | undefined): string | undefined;
+export declare function applyAppflowInput(step: AppflowStep, progress: AppflowProgress, input: AppflowInput): AppflowProgress;
+export declare function getAppflowResumeStep(progress: AppflowProgress | null): AppflowStep;
+/**
+ * Resume the inline build phase after the user chose 'build'. The migration is
+ * single-platform, so the build enters the shared tail at saving-credentials for
+ * the migrated platform and finishes ('done') once that build run completes.
+ */
+export declare function getAppflowBuildResumeStep(progress: AppflowProgress): AppflowStep;
+export declare function nextTailStep(step: TailStep, value: string | undefined, progress: AppflowProgress): TailStep;
+/**
+ * Record the migration's single inline tail run as complete (reached at
+ * build-complete via any path — built, skipped, or failed). Returns the next
+ * overall appflow step, which is always 'done' for a single-platform migration.
+ */
+export declare function markTailRunComplete(progress: AppflowProgress): {
+    progress: AppflowProgress;
+    next: AppflowStep;
+};
+export declare function runAppflowEffect(step: AppflowStep, progress: AppflowProgress, deps: AppflowEffectDeps): Promise<AppflowEffectResult>;
+export declare const appflowFlow: PlatformFlow<AppflowStep, AppflowProgress, AppflowInput>;

package/dist/src/build/onboarding/appflow/tail.d.ts

@@ -0,0 +1,44 @@
+import type { TailEffectDeps } from '../tail/flow.js';
+import type { AppflowProgress } from './types.js';
+/**
+ * The tail-facing progress shape. The shared tail reads `appId` (required),
+ * plus the tail-input fields the appflow driver records on `AppflowProgress`
+ * (setupMode / ciSecretTarget / selectedPackageManager / buildScriptChoice /
+ * envExportTargetPath). `AppflowProgress` carries every one of those as an
+ * optional field, so it satisfies `TailEffectProgress` once `appId` is present.
+ */
+export type AppflowTailProgress = AppflowProgress & {
+    appId: string;
+};
+/**
+ * Build the saved-credential SHAPE for the chosen platform from the migrated
+ * Capgo creds. The migration already mapped Appflow's signing/distribution into
+ * the Capgo field names (progress.ios / progress.android are Record<string,string>),
+ * so the "build" here is just selecting the right platform map. Throws on an empty
+ * map — the same fail-fast guard the native builders use.
+ */
+export declare function buildAppflowSavedCredentials(progress: AppflowTailProgress, platform: 'ios' | 'android'): Record<string, string>;
+export interface AppflowTailDepsOptions {
+    /** Capgo API key flag (overrides the saved key, like the native drivers). */
+    apikey?: string;
+    /** Gateway override threaded into the build request options. */
+    supaHost?: string;
+    /** Builder journey id threaded into the build request options. */
+    journeyId?: string;
+    /** Build VIEWER sink — every requesting-build line streams here (fullscreen pane). */
+    onBuildOutput?: (line: string) => void;
+    /** Side-log sink (✔ Credentials saved, ✔ Uploaded …). */
+    onLog?: (message: string, color?: string) => void;
+    /** The driver-held transient threaded back into each effect (NEVER persisted). */
+    carried?: TailEffectDeps<AppflowTailProgress>['carried'];
+    signal?: AbortSignal;
+}
+/**
+ * Adapt the appflow flow's collected state into a platform-neutral
+ * `TailEffectDeps` for `platform`, reusing the SAME shared CLI building blocks
+ * the iOS/Android drivers inject. Mirrors ios/flow.ts's `toTailDeps` 1:1; the
+ * only appflow-specific pieces are the credential SHAPE (selected straight from
+ * the migrated maps) and the thin no-disk persistence (the migration keeps no
+ * progress.json).
+ */
+export declare function toAppflowTailDeps(platform: 'ios' | 'android', options?: AppflowTailDepsOptions): TailEffectDeps<AppflowTailProgress>;

package/dist/src/build/onboarding/appflow/types.d.ts

@@ -0,0 +1,50 @@
+import type { AppflowToken } from './auth';
+import type { TailStep } from '../tail/flow.js';
+import type { BuildScriptChoice, PackageManager } from '../workflow-generator.js';
+import type { CiSecretTarget } from '../ci-secrets.js';
+export type AppflowOwnStep = 'explain' | 'authenticating' | 'fetch-orgs' | 'select-org' | 'fetch-apps' | 'select-app' | 'fetch-signing' | 'select-ios-cert' | 'select-android-cert' | 'no-signing-submenu' | 'fetch-distribution' | 'select-ios-dist' | 'select-android-dist' | 'ios-dist-gapfill' | 'android-dist-gapfill' | 'p8-source-select' | 'input-p8-path' | 'input-p8-key-id' | 'input-p8-issuer-id' | 'load-provided-p8' | 'ios-p8-generate' | 'android-sa-generate' | 'validate' | 'validate-results' | 'p8-upgrade-prompt' | 'handoff-build' | 'done' | 'error';
+export type AppflowStep = AppflowOwnStep | TailStep;
+export type MigrationScope = 'ios' | 'android';
+export type NoSigningScope = 'ios' | 'android';
+export interface AppflowProgress {
+    scope: MigrationScope;
+    token?: AppflowToken;
+    appflowAccount?: string;
+    orgSlug?: string;
+    appId?: string;
+    capgoAppId?: string;
+    appSlug?: string;
+    ios?: Record<string, string>;
+    android?: Record<string, string>;
+    migratable: {
+        ios: boolean;
+        android: boolean;
+    };
+    noSigningScope?: NoSigningScope;
+    iosCertTag?: string;
+    androidCertTag?: string;
+    iosDistId?: string;
+    androidDistId?: string;
+    iosDistGapfill?: 'generate' | 'skip';
+    androidDistGapfill?: 'generate' | 'skip';
+    p8Upgrade?: 'convert' | 'skip';
+    p8Source?: 'generate' | 'provide';
+    p8Path?: string;
+    p8KeyId?: string;
+    p8IssuerId?: string;
+    notes?: string[];
+    completedSteps: AppflowStep[];
+    handoffChoice?: 'build' | 'skip';
+    built?: boolean;
+    setupMode?: 'undecided' | 'with-workflow' | 'secrets-only' | 'declined';
+    ciSecretTarget?: CiSecretTarget | null;
+    selectedPackageManager?: PackageManager | null;
+    buildScriptChoice?: BuildScriptChoice | null;
+    envExportTargetPath?: string;
+}
+export type AppflowInput = {
+    value?: string;
+    field?: string;
+    text?: string;
+    ciSecretTargets?: CiSecretTarget[];
+};

package/dist/src/build/onboarding/flow/appflow-flow.d.ts

@@ -0,0 +1,2 @@
+export { appflowFlow } from '../appflow/flow.js';
+export type { AppflowEffectDeps, AppflowEffectResult, AppflowValidationResult } from '../appflow/flow.js';

package/dist/src/build/onboarding/ios/validate-app-password.d.ts

@@ -0,0 +1,8 @@
+export type AppPasswordResultKind = 'authenticated' | 'rejected' | 'unreachable';
+export interface AppPasswordResult {
+    valid: boolean;
+    kind: AppPasswordResultKind;
+    code?: unknown;
+    message?: string;
+}
+export declare function validateAppleAppPassword(username: string, appPassword: string, fetchImpl?: typeof fetch): Promise<AppPasswordResult>;

package/dist/src/build/onboarding/mcp/engine.d.ts

@@ -100,6 +100,10 @@ interface OnboardingInput {
     profilePath?: string;
     /** Answer to import-export-warning: 'go' exports from the Keychain (the one macOS permission dialog), 'back' re-picks the profile, 'exit' stops. */
     exportConfirm?: 'go' | 'back' | 'exit';
+    /** Generic choice value for the Appflow migration flow's neutral steps (org/app/cert pick, submenu, gap-fill, p8-upgrade, handoff-build). */
+    value?: string;
+    /** Answer to the one-time single-platform "Are you migrating from Ionic Appflow?" gate. */
+    migratingFromAppflow?: 'yes' | 'no';
 }
 /** Decide the first/again step for a fresh or resumed session. */
 export declare function decideStart(facts: PreflightFacts, progress: OnboardingProgress | null, deps: EngineDeps): Promise<NextStepResult>;
@@ -138,6 +142,16 @@ export declare function mapAndroidView(view: ReturnType<typeof androidViewForSte
     keystorePath?: string;
     keystorePassword?: string;
 }): NextStepResult;
+/**
+ * Drive the Appflow migration flow.
+ *
+ * `scope` is the migration scope ('ios' | 'android'), from the single-platform
+ * "migrating from Appflow?" gate.
+ * `input` carries the user's last answer (a choice value, or {} to advance an
+ * info / human_gate). The bounded loop runs auto effects until it lands on an
+ * interactive step or the build hand-off.
+ */
+export declare function decideAppflow(facts: PreflightFacts, deps: EngineDeps, scope: 'ios' | 'android', input?: OnboardingInput): Promise<NextStepResult>;
 export declare function decideAndroid(facts: PreflightFacts, deps: EngineDeps, opts?: {
     signInProceed?: boolean;
     /** Drop any in-flight Google OAuth session and (re)open the browser for a fresh

package/dist/src/build/onboarding/mcp/session-state.d.ts

@@ -3,6 +3,7 @@ import type { IosEffectDeps } from '../ios/flow.js';
 import type { TailEffectDeps } from '../tail/flow.js';
 import type { OnboardingStep } from '../types.js';
 import type { Platform } from './contract.js';
+import type { AppflowProgress } from '../appflow/types.js';
 /**
  * The iOS driver-held transient state — the exact `IosEffectDeps['carried']`
  * shape, plus the MCP-only `parkedImportStep` (S12): the interactive import
@@ -82,6 +83,25 @@ export interface OnboardingSessionState {
      * onboarding" always re-asks.
      */
     resumeResolvedFor?: Platform;
+    /**
+     * The Appflow migration's in-flight progress (token, org/app selection, the
+     * per-platform mapped Capgo creds collected so far, completed steps, and the
+     * migration-entry gate answer). The appflow flow is driven through the neutral
+     * PlatformFlow contract and — unlike ios/android — has no on-disk progress
+     * loader, so its cross-call state lives here, process-local, exactly like the
+     * iOS/tail carried transients. HOLDS SECRETS (token, cert/keystore bytes,
+     * service-account JSON, app-specific password): it must NEVER serialize into a
+     * tool result / progress.json / log. A server restart loses it and the
+     * migration re-runs from the explain step (the flow self-heals via the token
+     * cache). NON-PERSISTED by design.
+     */
+    appflowProgress?: AppflowProgress;
+    /**
+     * The one-time "Are you migrating from Ionic Appflow?" gate answer for a
+     * single-platform (ios/android) entry. Set once the user answers so a resume /
+     * bare next_step never re-prompts. NON-SECRET (a yes/no decision).
+     */
+    appflowGate?: 'asked-yes' | 'asked-no';
 }
 /**
  * Get the session state for `appId`, creating an empty one on demand.
@@ -116,6 +136,14 @@ export declare function getResumeResolvedFor(appId: string): Platform | undefine
  * or skipped as unnecessary; cleared by runStart so a fresh start re-asks.
  */
 export declare function setResumeResolvedFor(appId: string, platform: Platform | undefined): void;
+/** Read the in-flight Appflow migration progress for `appId`, or undefined when none. */
+export declare function getAppflowProgress(appId: string): AppflowProgress | undefined;
+/** Store (or, with `undefined`, clear) the in-flight Appflow migration progress for `appId`. */
+export declare function setAppflowProgress(appId: string, progress: AppflowProgress | undefined): void;
+/** Read the one-time "migrating from Appflow?" gate answer for `appId`, or undefined when unasked. */
+export declare function getAppflowGate(appId: string): 'asked-yes' | 'asked-no' | undefined;
+/** Record the one-time "migrating from Appflow?" gate answer for `appId`. */
+export declare function setAppflowGate(appId: string, gate: 'asked-yes' | 'asked-no' | undefined): void;
 /**
  * Drop the per-flow carried transients (iOS carried, tail carried, tail park)
  * for `appId` while PRESERVING the session-level decisions (activePlatform,

package/dist/src/build/onboarding/types.d.ts

@@ -1,5 +1,5 @@
 import type { TailProgress } from './tail-types.js';
-export type Platform = 'ios' | 'android';
+export type Platform = 'ios' | 'android' | 'appflow';
 export interface OnboardingCompletionSummary {
     /** The Capgo dashboard build URL, when a build was kicked off. */
     buildUrl?: string;

package/dist/src/build/onboarding/ui/appflow-app.d.ts

@@ -0,0 +1,17 @@
+import type { FC } from 'react';
+import type { OnboardingResult } from '../types.js';
+import type { MigrationScope } from '../appflow/types.js';
+import type { OnboardingBeforeExit } from './exit.js';
+export interface AppflowAppProps {
+    appId: string;
+    /** Migration scope ('ios' | 'android') from the single-platform "migrating from Appflow?" gate. */
+    scope: MigrationScope;
+    apikey?: string;
+    supaHost?: string;
+    journeyId: string;
+    onStep?: (step: string) => void;
+    onResult?: (result: OnboardingResult) => void;
+    onBeforeExit?: OnboardingBeforeExit;
+}
+declare const AppflowApp: FC<AppflowAppProps>;
+export default AppflowApp;

package/dist/src/build/onboarding/ui/platform-picker.d.ts

@@ -1,8 +1,11 @@
-import type { FC } from 'react';
+import type { FC, ReactNode } from 'react';
 import type { Platform } from '../types.js';
 import type { PlatformPickerLayout } from './frame-fit.js';
 export type PlatformKeyAction = {
-    type: 'select';
+    type: 'move';
+    delta: number;
+} | {
+    type: 'jump';
     platform: Platform;
 } | {
     type: 'confirm';
@@ -12,8 +15,52 @@ export declare function platformKeyAction(input: string, key: {
     rightArrow?: boolean;
     return?: boolean;
 }): PlatformKeyAction;
+interface PlatformCardProps {
+    emoji: string;
+    name: string;
+    hint: string;
+    selected: boolean;
+}
+export declare const PlatformCard: FC<PlatformCardProps>;
 export interface PlatformPickerProps {
     layout: PlatformPickerLayout;
     onSelect: (platform: Platform) => void;
+    /** Rendered directly below the legend (flush, no gap). */
+    footer?: ReactNode;
 }
 export declare const PlatformPicker: FC<PlatformPickerProps>;
+export interface CardChoice {
+    value: string;
+    emoji: string;
+    name: string;
+    hint: string;
+}
+export type CardKeyAction = {
+    type: 'move';
+    delta: number;
+} | {
+    type: 'jump';
+    index: number;
+} | {
+    type: 'confirm';
+} | null;
+export declare function cardKeyAction(input: string, key: {
+    leftArrow?: boolean;
+    rightArrow?: boolean;
+    return?: boolean;
+}, count: number): CardKeyAction;
+export interface CardChooserProps {
+    layout: PlatformPickerLayout;
+    question: string;
+    subtitle?: string;
+    options: CardChoice[];
+    /** Index of the card highlighted on first render (default 0 = leftmost). */
+    defaultIndex?: number;
+    /** Rendered directly below the legend (flush, no gap). */
+    footer?: ReactNode;
+    onSelect: (value: string) => void;
+}
+/** A heading + bordered cards (←/→/Enter) — or a Select on narrow terminals —
+ *  for any small choice. Reuses PlatformCard so the boxes match the platform picker. */
+export declare const CardChooser: FC<CardChooserProps>;
+export {};

package/dist/src/build/onboarding/ui/update-prompt.d.ts

@@ -1,4 +1,4 @@
-import type { FC } from 'react';
+import type { FC, ReactNode } from 'react';
 import type { PlatformPickerLayout } from './frame-fit.js';
 export type UpdateChoice = 'update' | 'skip';
 export type UpdateKeyAction = {
@@ -17,5 +17,7 @@ export interface UpdatePromptProps {
     currentVersion: string;
     latestVersion: string;
     onDecide: (choice: UpdateChoice) => void;
+    /** Rendered directly below the legend (flush, no gap). */
+    footer?: ReactNode;
 }
 export declare const UpdatePrompt: FC<UpdatePromptProps>;