@capgo/cli 8.3.0 → 8.4.0

package/dist/src/build/onboarding/types.d.ts

@@ -1,3 +1,4 @@
+import type { TailProgress } from './tail-types.js';
 export type Platform = 'ios' | 'android';
 export interface OnboardingCompletionSummary {
     /** The Capgo dashboard build URL, when a build was kicked off. */
@@ -73,7 +74,21 @@ export interface ProfileData {
     profileName: string;
     profileBase64: string;
 }
-export interface OnboardingProgress {
+export interface IosCredentialsSaved {
+    /** ISO timestamp credentials.json was written — purely informational. */
+    savedAt: string;
+}
+export interface IosBuildRequested {
+    /** The build dashboard URL surfaced after the queue request succeeded. */
+    buildUrl: string;
+}
+export interface IosCiSecretsUploaded {
+    /** Provider the secrets were pushed to (matches the chosen ciSecretTarget). */
+    provider: 'github' | 'gitlab';
+    /** How many env vars were pushed — informational. */
+    count: number;
+}
+export interface OnboardingProgress extends TailProgress {
     platform: Platform;
     appId: string;
     startedAt: string;
@@ -127,10 +142,76 @@ export interface OnboardingProgress {
      * user already moved on from.
      */
     iosBundleIdContextAppId?: string;
+    /**
+     * LEGACY (engine-era confirm-app-id gate, removed by PR #2397). Older CLI
+     * versions persisted this when the user confirmed the bundle id at the
+     * now-removed `confirm-app-id` step. No code reads it anymore — the driver
+     * silently adopts the authoritative Release bundle id and the remote
+     * `verify-app` step owns the bundle-id invariant (see `iosBundleIdOverride`).
+     * Kept in the type only so older progress files keep parsing; resume IGNORES
+     * it (see test-ios-confirm-app-id.mjs).
+     */
+    appIdConfirmed?: boolean;
+    /**
+     * LEGACY (engine-era confirm-app-id gate, removed by PR #2397). The router
+     * target the removed `confirm-app-id` step would have returned to. No code
+     * reads it anymore; resume IGNORES it so a stale value can never park the
+     * wizard on a step that no longer renders (see test-ios-confirm-app-id.mjs).
+     */
+    pendingAppIdNext?: OnboardingStep;
+    /**
+     * Lifecycle of the iOS data-safety gate that runs BEFORE the setup-method
+     * fork when saved iOS credentials already exist for this appId. Mirrors the
+     * android `_credentialsExistGate` marker so the gate is resume-derivable
+     * instead of living only in the TUI's `setStep` calls:
+     *   - 'pending' → saved iOS credentials exist; awaiting the user's
+     *                 backup-or-cancel choice (the `credentials-exist` step)
+     *   - 'backup'  → user chose backup; the `backing-up` effect must still run
+     *   - 'done'    → backup performed (or source absent); proceed to setup
+     *   - 'cancel'  → user chose to stop; onboarding halts to protect the
+     *                 existing credentials
+     *
+     * Absent on legacy/in-flight progress files → treated as "no gate", so the
+     * resume routing is unchanged for every existing progress file.
+     *
+     * ADDITIVE (BATCH 0): only consumed by `getIosResumeStep`'s Phase-0 gate.
+     */
+    _credentialsExistGate?: 'pending' | 'backup' | 'done' | 'cancel';
+    /**
+     * Which step triggered the `duplicate-profile-prompt`, so the post-deletion
+     * effect (`deleting-duplicate-profiles`) can route back to the right place on
+     * resume. The prompt is dual-origin: `creating-profile` reaches it on the
+     * create-new path, and `import-create-profile-only` reaches it on the import
+     * path. Persisting the origin prevents an import user from being routed back
+     * into the create-new `creating-profile` step (the exact class of resume bug
+     * the `setupMethod` branch was added to prevent).
+     *
+     * ADDITIVE (BATCH 0): persisted now so the engine surface is total; the
+     * effect that reads it is wired in a later batch.
+     */
+    duplicateProfileOrigin?: 'creating-profile' | 'import-create-profile-only';
+    /**
+     * Deferred recovery branch after the import `.p8` input chain. When the user
+     * picks "create" in `import-no-match-recovery` but has no ASC API key yet, the
+     * flow detours through `api-key-instructions` → `verifying-key` and must
+     * return to `import-create-profile-only` afterwards. Persisting the pending
+     * action (e.g. `'create-profile-only'`) lets resume restore that deferred
+     * target instead of dropping the user at the picker.
+     *
+     * ADDITIVE (BATCH 0): persisted now so the engine surface is total; the
+     * routing that reads it is wired in a later batch.
+     */
+    pendingRecoveryAction?: string;
     completedSteps: {
         apiKeyVerified?: ApiKeyData;
         certificateCreated?: CertificateData;
         profileCreated?: ProfileData;
+        /** Set once `saving-credentials` wrote credentials.json. Gates tail entry. */
+        credentialsSaved?: IosCredentialsSaved;
+        /** Set once `requesting-build` queued a build. Guards a double build-request. */
+        buildRequested?: IosBuildRequested;
+        /** Set once `uploading-ci-secrets` pushed the secrets. Guards a re-upload. */
+        ciSecretsUploaded?: IosCiSecretsUploaded;
     };
     /** Temporary — wiped after .p12 creation */
     _privateKeyPem?: string;

package/dist/src/build/onboarding/ui/p8-error.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Pure classifier for the .p8 submit handlers' catch blocks (ui/app.tsx —
+ * the api-key-instructions onPathSubmit and input-p8-path onSubmit handlers).
+ *
+ * Those handlers' try blocks span more than the readFile: savePartialProgress
+ * and loadProgress run AFTER the read succeeded, so the catch must not rewrite
+ * every failure to "File not found: <path>". Only a genuinely missing file
+ * (ENOENT) earns the friendly not-found message; everything else (EACCES,
+ * persistence I/O failures, programming errors, non-Error throwables) is
+ * 'other' and the handler surfaces the REAL error instead.
+ */
+export type P8SubmitErrorKind = 'not-found' | 'other';
+export declare function classifyP8SubmitError(err: unknown): P8SubmitErrorKind;

package/dist/src/build/output-record.d.ts

@@ -28,3 +28,20 @@ export interface WriteBuildOutputRecordInput {
  * record's `qrCodePngPath` field is null when the PNG could not be produced.
  */
 export declare function writeBuildOutputRecord(recordPath: string, input: WriteBuildOutputRecordInput, onWarn?: (msg: string) => void): Promise<BuildOutputRecord>;
+/**
+ * Returns a deterministic temp-file path for the build output record for a
+ * given (appId, platform) pair. Both the build hand-off (command emit) and
+ * the confirm (record read) call this helper so that the path is never passed
+ * back and forth across an MCP boundary.
+ *
+ * appId is sanitized: all `/` and `\` characters are replaced with `_`, and
+ * any `..` sequences are replaced with `_`, to prevent path traversal.
+ */
+export declare function defaultBuildRecordPath(appId: string, platform: 'ios' | 'android'): string;
+/**
+ * Read a build output record from `path`. Returns the parsed `BuildOutputRecord`
+ * if the file exists, is valid JSON, and the parsed object contains a string
+ * `jobId` property. Returns `null` in all other cases (missing file, parse
+ * error, missing/wrong-type jobId).
+ */
+export declare function readBuildOutputRecord(path: string): Promise<BuildOutputRecord | null>;

package/dist/src/schemas/onboarding.d.ts

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+export declare const onboardingNextStepSchema: z.ZodObject<{
+    platform: z.ZodOptional<z.ZodEnum<{
+        android: "android";
+        ios: "ios";
+    }>>;
+    serviceAccountJsonPath: z.ZodOptional<z.ZodString>;
+    runBuild: z.ZodOptional<z.ZodBoolean>;
+    keyId: z.ZodOptional<z.ZodString>;
+    issuerId: z.ZodOptional<z.ZodString>;
+    p8Path: z.ZodOptional<z.ZodString>;
+    serviceAccountMethod: z.ZodOptional<z.ZodEnum<{
+        generate: "generate";
+        existing: "existing";
+    }>>;
+    playDeveloperId: z.ZodOptional<z.ZodString>;
+    gcpProjectId: z.ZodOptional<z.ZodString>;
+    gcpProjectName: z.ZodOptional<z.ZodString>;
+    androidPackage: z.ZodOptional<z.ZodString>;
+    saMethodChoice: z.ZodOptional<z.ZodEnum<{
+        retry: "retry";
+        oauth: "oauth";
+        "save-anyway": "save-anyway";
+    }>>;
+    checkBuild: z.ZodOptional<z.ZodBoolean>;
+    keystoreMethod: z.ZodOptional<z.ZodEnum<{
+        generate: "generate";
+        existing: "existing";
+    }>>;
+    keystorePath: z.ZodOptional<z.ZodString>;
+    keystoreStorePassword: z.ZodOptional<z.ZodString>;
+    keystoreAlias: z.ZodOptional<z.ZodString>;
+    keystoreKeyPassword: z.ZodOptional<z.ZodString>;
+    keystoreNewAlias: z.ZodOptional<z.ZodString>;
+    keystorePasswordMethod: z.ZodOptional<z.ZodEnum<{
+        random: "random";
+        manual: "manual";
+    }>>;
+    keystoreCommonName: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type OnboardingNextStepInput = z.infer<typeof onboardingNextStepSchema>;