@capgo/cli 8.31.3 → 8.31.5

package/dist/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@capgo/cli",
   "type": "module",
-  "version": "8.31.3",
+  "version": "8.31.5",
   "description": "A CLI to upload to capgo servers",
   "author": "Martin martin@capgo.app",
   "license": "Apache 2.0",
@@ -160,7 +160,7 @@
     "test:ios-marketing-version": "bun test/test-ios-marketing-version.mjs",
     "test:platform-flow-contract": "bun test/test-platform-flow-contract.mjs",
     "test:tail-engine-shared": "bun test/test-tail-engine-shared.mjs",
-    "test": "bun run build && bun run test:helper-dce && bun run test:version-detection:setup && bun run test:bundle && bun run test:functional && bun run test:semver && bun run test:version-edge-cases && bun run test:regex && bun run test:upload && bun run test:fail-on-incompatible && bun run test:native-dependencies && bun run test:credentials && bun run test:credentials-validation && bun run test:android-service-account-validation && bun run test:build-zip-filter && bun run test:checksum && bun run test:build-needed && bun run test:ci-prompts && bun run test:ci-secrets && bun run test:android-onboarding-progress && bun run test:onboarding-telemetry && bun run test:v2-event-migration && bun run test:analytics && bun run test:analytics-error-category && bun run test:analytics-org-resolver && bun run test:supabase-perf && bun run test:preview-qr && bun run test:app-set-options && bun run test:mcp-analytics && bun run test:mcp-instructions && bun run test:mcp-live-update-onboarding && bun run test:mcp-stdout-guard && bun run test:mcp-platform-select && bun run test:mcp-explain-scopes && bun run test:mcp-oauth-reopen && bun run test:mcp-broker-oauth && bun run test:mcp-broker-session && bun run test:mcp-credentials-manage && bun run test:mcp-resume-prompt && bun run test:mcp-build-job && bun run test:mcp-build-tools && bun run test:app-created-source && bun run test:doctor-analytics && bun run test:posthog-exception && bun run test:build-platform-selection && bun run test:onboarding-recovery && bun run test:onboarding-progress && bun run test:onboarding-run-targets && bun run test:run-device-command && bun run test:init-monorepo-targeting && bun run test:init-app-conflict && bun run test:init-guardrails && bun run test:init-replay && bun run test:prompt-preferences && bun run test:esm-sdk && bun run test:mcp && bun run test:mcp-no-key-handshake && bun run test:auth-session && bun run test:version-detection && bun run test:platform-paths && bun run test:project-type-detection && bun run test:payload-split && bun run test:manifest-path-encoding && bun run test:macos-signing && bun run test:asc-key-protocol && bun run test:apple-api-import-helpers && bun run test:apple-api-verify-key && bun run test:bundle-id-detector && bun run test:apple-api-app-list && bun run test:app-verification && bun run test:pbxproj-parser && bun run test:ai-log-capture && bun run test:ai-analyze-flow && bun run test:cicd-failure-help && bun run test:ai-sse-parser && bun run test:ai-render-markdown && bun run test:ai-stream-markdown && bun run test:ai-onboarding-mode && bun run test:ai-fit && bun run test:platform-layout && bun run test:frame-fit && bun run test:onboarding-min-size && bun run test:min-size-gate && bun run test:shell-size-gate && bun run test:build-log-sanitize && bun run test:build-output-viewport && bun run test:diff-viewer-viewport && bun run test:build-complete-exit && bun run test:ai-analyze-stream && bun run test:support-mailto && bun run test:support-redact && bun run test:support-internal-log && bun run test:support-help-menu && bun run test:support-contact && bun run test:support-upload-prompt && bun run test:support-bundle-files && bun run test:self-update && bun run test:update-prompt && bun run test:apple-api-cert-create && bun run test:android-tail-engine && bun run test:android-tail-render && bun run test:android-tail-routing && bun run test:dev-gate-stripped && bun run test:frame-fit-ios-shared && bun run test:ios-confirm-app-id && bun run test:ios-create-new && bun run test:ios-e2e && bun run test:ios-flow-contract && bun run test:ios-import-discovery && bun run test:ios-import-export && bun run test:ios-import-pickers && bun run test:ios-import-recovery && bun run test:ios-recovery && bun run test:ios-resume && bun run test:ios-tail-handoff && bun run test:ios-tui-render && bun run test:p8-error && bun run test:ios-tui-routing && bun run test:ios-updater-sync-validation && bun run test:ios-verify-app && bun run test:ios-marketing-version && bun run test:platform-flow-contract && bun run test:tail-engine-shared && bun run test:prescan && bun run test:android-reporting-api && bun run test:android-app-verification && bun run test:android-rename && bun run test:appflow-auth && bun run test:appflow-api-map && bun run test:appflow-validate && bun run test:appflow-flow && bun run test:appflow-gapfill && bun run test:appflow-engine && bun run test:appflow-tail && bun run test:appflow-fetch && bun run test:appflow-sa-decode && bun run test:app-permission-helper && bun run test:organization-set-api-host && bun run test:trial-warning",
+    "test": "bun run build && bun run test:helper-dce && bun run test:version-detection:setup && bun run test:bundle && bun run test:functional && bun run test:semver && bun run test:version-edge-cases && bun run test:regex && bun run test:upload && bun run test:fail-on-incompatible && bun run test:native-dependencies && bun run test:credentials && bun run test:credentials-validation && bun run test:android-service-account-validation && bun run test:build-zip-filter && bun run test:checksum && bun run test:build-needed && bun run test:ci-prompts && bun run test:ci-secrets && bun run test:android-onboarding-progress && bun run test:onboarding-telemetry && bun run test:v2-event-migration && bun run test:analytics && bun run test:analytics-error-category && bun run test:analytics-org-resolver && bun run test:supabase-perf && bun run test:preview-qr && bun run test:app-set-options && bun run test:mcp-analytics && bun run test:mcp-instructions && bun run test:mcp-live-update-onboarding && bun run test:mcp-stdout-guard && bun run test:mcp-platform-select && bun run test:mcp-explain-scopes && bun run test:mcp-oauth-reopen && bun run test:mcp-broker-oauth && bun run test:mcp-broker-session && bun run test:mcp-credentials-manage && bun run test:mcp-resume-prompt && bun run test:mcp-build-job && bun run test:mcp-build-tools && bun run test:app-created-source && bun run test:doctor-analytics && bun run test:posthog-exception && bun run test:build-platform-selection && bun run test:onboarding-recovery && bun run test:onboarding-progress && bun run test:onboarding-run-targets && bun run test:run-device-command && bun run test:init-monorepo-targeting && bun run test:init-app-conflict && bun run test:init-guardrails && bun run test:init-replay && bun run test:prompt-preferences && bun run test:esm-sdk && bun run test:mcp && bun run test:mcp-no-key-handshake && bun run test:auth-session && bun run test:version-detection && bun run test:platform-paths && bun run test:project-type-detection && bun run test:payload-split && bun run test:manifest-path-encoding && bun run test:macos-signing && bun run test:asc-key-protocol && bun run test:apple-api-import-helpers && bun run test:apple-api-verify-key && bun run test:bundle-id-detector && bun run test:apple-api-app-list && bun run test:app-verification && bun run test:pbxproj-parser && bun run test:ai-log-capture && bun run test:ai-analyze-flow && bun run test:cicd-failure-help && bun run test:ai-sse-parser && bun run test:ai-render-markdown && bun run test:ai-stream-markdown && bun run test:ai-onboarding-mode && bun run test:ai-fit && bun run test:platform-layout && bun run test:frame-fit && bun run test:onboarding-min-size && bun run test:min-size-gate && bun run test:shell-size-gate && bun run test:build-log-sanitize && bun run test:build-output-viewport && bun run test:diff-viewer-viewport && bun run test:build-complete-exit && bun run test:ai-analyze-stream && bun run test:support-mailto && bun run test:support-redact && bun run test:support-internal-log && bun run test:support-help-menu && bun run test:support-contact && bun run test:support-upload-prompt && bun run test:support-bundle-files && bun run test:self-update && bun run test:update-prompt && bun run test:apple-api-cert-create && bun run test:android-tail-engine && bun run test:android-tail-render && bun run test:android-tail-routing && bun run test:dev-gate-stripped && bun run test:frame-fit-ios-shared && bun run test:ios-confirm-app-id && bun run test:ios-create-new && bun run test:ios-e2e && bun run test:ios-flow-contract && bun run test:ios-import-discovery && bun run test:ios-import-export && bun run test:ios-import-pickers && bun run test:ios-import-recovery && bun run test:ios-recovery && bun run test:ios-resume && bun run test:ios-tail-handoff && bun run test:ios-tui-render && bun run test:p8-error && bun run test:ios-tui-routing && bun run test:ios-updater-sync-validation && bun run test:ios-verify-app && bun run test:ios-marketing-version && bun run test:platform-flow-contract && bun run test:tail-engine-shared && bun run test:prescan && bun run test:android-reporting-api && bun run test:android-app-verification && bun run test:android-rename && bun run test:appflow-auth && bun run test:appflow-api-map && bun run test:appflow-validate && bun run test:appflow-flow && bun run test:appflow-gapfill && bun run test:appflow-engine && bun run test:appflow-tail && bun run test:appflow-fetch && bun run test:appflow-sa-decode && bun run test:app-permission-helper && bun run test:organization-set-api-host && bun run test:trial-warning && bun run test:plan-validation",
     "test:build-platform-selection": "bun test/test-build-platform-selection.mjs",
     "test:ai-log-capture": "bun test/test-ai-log-capture.mjs",
     "test:ai-analyze-flow": "bun test/test-ai-analyze-flow.mjs",
@@ -203,7 +203,8 @@
     "test:appflow-sa-decode": "bun test/test-appflow-sa-decode.mjs",
     "test:app-permission-helper": "bun test/test-app-permission-helper.mjs",
     "test:organization-set-api-host": "bun test/test-organization-set-api-host.mjs",
-    "test:trial-warning": "bun test/test-trial-warning.mjs"
+    "test:trial-warning": "bun test/test-trial-warning.mjs",
+    "test:plan-validation": "bun test/test-plan-validation.mjs"
   },
   "dependencies": {
     "@inkjs/ui": "^2.0.0",

package/dist/src/build/mobileprovision-parser.d.ts

@@ -23,7 +23,20 @@ export interface MobileprovisionDetail extends MobileprovisionInfo {
     profileType: 'app_store' | 'ad_hoc' | 'development' | 'enterprise' | 'unknown';
     /** SHA1 (40-char lowercase hex) of each DeveloperCertificate embedded in the profile */
     certificateSha1s: string[];
+    /**
+     * The capability-bearing keys parsed from the profile's `<key>Entitlements</key>`
+     * dict, keyed by entitlement name. String/bool entitlements map to their value;
+     * array entitlements (application-groups, associated-domains, keychain-access-groups,
+     * iCloud container ids, etc.) map to the list of `<string>` members. Only keys
+     * actually present in the profile are included, so a caller can both test
+     * presence (`key in profileEntitlements`) and read the granted value/members.
+     * No credential material is included — these are capability KEY names + their
+     * declared identifiers, the same data the entitlement-coverage checks surface.
+     */
+    profileEntitlements: ProfileEntitlements;
 }
+export type ProfileEntitlementValue = string | string[] | boolean;
+export type ProfileEntitlements = Record<string, ProfileEntitlementValue>;
 export declare function parseMobileprovision(filePath: string): MobileprovisionInfo;
 export declare function parseMobileprovisionFromBase64(base64Content: string): MobileprovisionInfo;
 /**

package/dist/src/build/prescan/capacitor-version.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Major version of the Capacitor runtime declared in package.json, or null.
+ *
+ * Checks `@capacitor/core` first (the platform-agnostic runtime), then the
+ * platform packages `@capacitor/ios` and `@capacitor/android`, so both the iOS
+ * and Android prescan checks resolve the same major from one shared place.
+ * Reads dev+prod dependencies, returns null on a missing/malformed package.json
+ * (never throws).
+ */
+export declare function capacitorMajor(projectDir: string): number | null;

package/dist/src/build/prescan/checks/ios-capacitor-config.d.ts

@@ -0,0 +1,4 @@
+import type { PrescanCheck } from '../types';
+export declare const serverUrlShipped: PrescanCheck;
+export declare const serverCleartext: PrescanCheck;
+export declare const allowNavigationWildcard: PrescanCheck;

package/dist/src/build/prescan/checks/ios-entitlements-checks.d.ts

@@ -0,0 +1,5 @@
+import type { PrescanCheck } from '../types';
+export declare const entitlementsVsProfileCapability: PrescanCheck;
+export declare const apsEnvironmentVsMode: PrescanCheck;
+export declare const associatedDomainsFormat: PrescanCheck;
+export declare const appGroupsFormat: PrescanCheck;

package/dist/src/build/prescan/checks/ios-plist-checks.d.ts

@@ -0,0 +1,11 @@
+import type { PrescanCheck } from '../types';
+export declare const plistBundleIdFormat: PrescanCheck;
+export declare const plistVersionShortFormat: PrescanCheck;
+export declare const plistVersionBuildFormat: PrescanCheck;
+export declare const plistEncryptionCompliance: PrescanCheck;
+export declare const plistAtsArbitraryLoads: PrescanCheck;
+export declare const plistLaunchStoryboard: PrescanCheck;
+export declare const plistOrientationsMultitasking: PrescanCheck;
+export declare const plistOrientationsPresent: PrescanCheck;
+export declare const plistDisplayName: PrescanCheck;
+export declare const plistBackgroundModesSanity: PrescanCheck;

package/dist/src/build/prescan/checks/ios-plist-read.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Top-level `<key>K</key><string>V</string>` value, or null when absent.
+ * V is returned verbatim, including an unresolved `$(VAR)` build-variable
+ * reference — callers run it through resolvePlistValue before validating.
+ */
+export declare function plistString(raw: string, key: string): string | null;
+/**
+ * Boolean for `<key>K</key>\s*<true/>|<false/>`. Returns null when the key is
+ * absent OR maps to a non-bool value — null is meaningfully distinct from false
+ * (e.g. UIRequiresFullScreen absent vs. explicitly false).
+ */
+export declare function plistBool(raw: string, key: string): boolean | null;
+/** Presence-only check for a `<key>K</key>` element. */
+export declare function plistHasKey(raw: string, key: string): boolean;
+/**
+ * The `<string>` children of `<key>K</key>\s*<array>...</array>`, or [] when the
+ * key is absent / not an array. Non-greedy so the first `</array>` wins. Note
+ * that the key match is anchored on `</key>`, so a suffixed key such as
+ * `K~ipad` is NOT matched by a request for the plain `K` (and vice-versa).
+ */
+export declare function plistArrayStrings(raw: string, key: string): string[];
+/**
+ * Inner text of `<key>K</key>\s*<dict>...</dict>`, or null when the key is
+ * absent. Returns the FULL balanced dict: it scans `<dict>` / `</dict>` depth
+ * from the opening dict to its matching close, so arbitrarily nested dicts are
+ * captured intact. This matters for keys like NSAppTransportSecurity, where a
+ * nested NSExceptionDomains dict appearing BEFORE a sibling such as
+ * NSAllowsArbitraryLoads would otherwise truncate the block at the first
+ * `</dict>` and hide the sibling. Used to scope reads such as
+ * NSAppTransportSecurity. Pure; returns null on a missing key or an unbalanced
+ * (malformed) dict.
+ */
+export declare function plistDictBlock(raw: string, key: string): string | null;

package/dist/src/build/prescan/checks/ios-pods-assets.d.ts

@@ -0,0 +1,55 @@
+import type { PrescanCheck } from '../types';
+/**
+ * Podfile present but `Pods/` or `App.xcworkspace` missing. The cloud builder
+ * runs `pod install` (regenerating both), so this is a WARNING, not an error -
+ * it slows the first build and breaks local Xcode opens, but the server recovers.
+ */
+export declare const podsNotInstalled: PrescanCheck;
+/** Podfile present but Podfile.lock absent - non-reproducible pod resolution. */
+export declare const podsLockMissing: PrescanCheck;
+/**
+ * Podfile does not wire the Capacitor pod. `pod install` cannot inject a missing
+ * declaration, but the standard Capacitor Podfile uses the `capacitor_pods`
+ * helper / `require_relative` rather than a literal `pod 'Capacitor'`, so the
+ * literal-match heuristic is high false-positive. WARNING, not error.
+ */
+export declare const podsCapacitorMissing: PrescanCheck;
+/**
+ * SPM project with no Package.resolved in either known location. `build_app`
+ * (xcodebuild) resolves packages during the build, so this is a WARNING - a
+ * committed Package.resolved just makes resolution reproducible and faster.
+ */
+export declare const spmPackageResolvedMissing: PrescanCheck;
+/**
+ * Package.swift does not declare the capacitor-swift-pm dependency / the
+ * Capacitor product. The builder never runs `cap sync`, but Package.swift is
+ * CLI-managed ("DO NOT MODIFY") and the regex is high false-positive on valid
+ * variants, so this is a WARNING, not an error.
+ */
+export declare const spmCapacitorDependencyMissing: PrescanCheck;
+/**
+ * AppIcon.appiconset directory missing, Contents.json missing/malformed, or no
+ * icon images declared. The directory-missing and malformed-Contents cases are
+ * always errors (the asset catalog is structurally broken). The "no images"
+ * case is a WARNING by default (actool tolerates it for ad_hoc/dev) and
+ * ESCALATES to error when uploading to the App Store (ITMS-90704 blocks upload).
+ */
+export declare const appiconEmptyOrPlaceholder: PrescanCheck;
+/**
+ * A Contents.json image entry references a filename that is missing from disk.
+ * `actool` FAILS server-side in this case, so this KEEPS error severity.
+ */
+export declare const appiconReferencedFileMissing: PrescanCheck;
+/**
+ * App Store marketing icon (1024x1024 / role=marketing) missing. Upload-gated:
+ * ad_hoc/dev builds do not need it, but App Store upload requires it
+ * (ITMS-90704). KEEPS error severity.
+ */
+export declare const appiconMarketingMissing: PrescanCheck;
+/**
+ * SPM project where the pbxproj IPHONEOS_DEPLOYMENT_TARGET is LOWER than the
+ * Package.swift platform minimum (`.iOS(.vN)`) - the dangerous direction: the
+ * package requires a newer floor than the app builds against. Warning only;
+ * skipped entirely when IPHONEOS_DEPLOYMENT_TARGET is absent (inherited/unknown).
+ */
+export declare const spmDeploymentTargetConsistency: PrescanCheck;

package/dist/src/build/prescan/checks/ios-xcode.d.ts

@@ -0,0 +1,8 @@
+import type { PrescanCheck } from '../types';
+export declare const deploymentTargetCapacitor: PrescanCheck;
+export declare const signingTeam: PrescanCheck;
+export declare const bundleIdMismatchAcrossConfigs: PrescanCheck;
+export declare const enableBitcodeLeftover: PrescanCheck;
+export declare const swiftVersionSanity: PrescanCheck;
+export declare const noAppTarget: PrescanCheck;
+export declare const multipleAppTargets: PrescanCheck;

package/dist/src/build/prescan/command.d.ts

@@ -11,6 +11,8 @@ export interface PrescanCommandOptions {
     verbose?: boolean;
     supaHost?: string;
     supaAnon?: string;
+    /** Test seam for hard-coded rollout deadlines; defaults to the current time. */
+    now?: Date;
     /**
      * pre-merged credentials (CLI flags + env + saved file) when invoked from
      * build request's gate — the scan must validate the exact set the build
@@ -19,7 +21,7 @@ export interface PrescanCommandOptions {
     credentials?: Record<string, string>;
 }
 export declare function validateFlags(opts: Pick<PrescanCommandOptions, 'failOnWarnings' | 'ignoreFatal'>): void;
-export declare function exitCodeFor(counts: Record<Severity, number>, opts: OutcomeOptions): number;
+export declare function exitCodeFor(counts: Record<Severity, number>, opts: OutcomeOptions, findings?: PrescanReport['findings']): number;
 export interface PrescanExecution {
     report: PrescanReport;
     /** apikey actually used for the scan (flag or saved key); undefined when remote checks were skipped */
@@ -35,6 +37,8 @@ export interface PrescanGateOptions {
     /** test seam; defaults to canPromptInteractively() (via resolveWarningGate) at call time */
     interactive?: boolean;
     silent?: boolean;
+    /** Test seam for hard-coded rollout deadlines; defaults to the current time. */
+    now?: Date;
     /**
      * Output sink for the report / crash notice. Callers that own the terminal
      * (Ink onboarding, SDK, MCP stdio) pass their BuildLogger here; raw clack
@@ -49,6 +53,7 @@ export interface PrescanGateResult {
     /** null when the gate was disabled or the scan crashed (no scan ran) */
     report: PrescanReport | null;
     crashed: boolean;
+    informationOnlyFindings: number;
 }
 /**
  * Used by build request. Runs the scan via the provided thunk, prints the report,

package/dist/src/build/prescan/enforcement.d.ts

@@ -0,0 +1,7 @@
+import type { Finding, PrescanReport, Severity } from './types';
+type EnforcementReport = Pick<PrescanReport, 'counts' | 'findings'>;
+export declare function isFindingEnforced(finding: Finding, now?: Date): boolean;
+export declare function informationOnlyFindings(report: EnforcementReport, now?: Date): Finding[];
+export declare function enforcedCounts(report: EnforcementReport, now?: Date): Record<Severity, number>;
+export declare function formatEnforcementDeadline(iso: string): string;
+export {};

package/dist/src/build/prescan/engine.d.ts

@@ -3,5 +3,5 @@ interface EngineOptions {
     checkTimeoutMs?: number;
 }
 export declare function runPrescan(ctx: ScanContext, checks: PrescanCheck[], options?: EngineOptions): Promise<PrescanReport>;
-export declare function decideOutcome(report: Pick<PrescanReport, 'counts'>, options: OutcomeOptions): PrescanOutcome;
+export declare function decideOutcome(report: Pick<PrescanReport, 'counts' | 'findings'>, options: OutcomeOptions): PrescanOutcome;
 export {};

package/dist/src/build/prescan/ios-appicon.d.ts

@@ -0,0 +1,33 @@
+export interface AppIconImage {
+    idiom?: string;
+    size?: string;
+    scale?: string;
+    filename?: string;
+    platform?: string;
+    role?: string;
+}
+export interface AssetContents {
+    images?: AppIconImage[];
+    info?: {
+        version?: number;
+        author?: string;
+    };
+}
+/**
+ * Parse an asset-catalog Contents.json. Returns null on a missing file OR a
+ * parse error — the asset catalog is the one place an invalid hand-edit can
+ * crash a naive reader, so this is the shared safety net for the appicon checks.
+ * Never throws.
+ */
+export declare function readContentsJson(path: string): AssetContents | null;
+/**
+ * Absolute path to the project's `<IconName>.appiconset` directory. The icon
+ * name comes from the pbxproj ASSETCATALOG_COMPILER_APPICON_NAME build setting
+ * (Release-preferred) and defaults to `AppIcon` for standard Capacitor layouts.
+ */
+export declare function appIconSetDir(projectDir: string, pbxContent?: string): string;
+/**
+ * Whether the icon set declares the App Store marketing icon: a `1024x1024`
+ * size (whitespace-trimmed) or an image whose `role` is `marketing`.
+ */
+export declare function hasMarketingIcon(c: AssetContents | null): boolean;

package/dist/src/build/prescan/ios-entitlements.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Read the app target's CODE_SIGN_ENTITLEMENTS file, falling back to the
+ * Capacitor-convention path only when that build setting is absent.
+ */
+export declare function readAppEntitlements(projectDir: string, appId?: string): {
+    raw: string;
+} | null;
+/** String entitlement value (e.g. aps-environment), or null when absent. */
+export declare function entString(raw: string, key: string): string | null;
+/** Array entitlement members (e.g. application-groups), or [] when absent. */
+export declare function entArray(raw: string, key: string): string[];
+/** Boolean entitlement (e.g. get-task-allow), or null when absent. */
+export declare function entBool(raw: string, key: string): boolean | null;

package/dist/src/build/prescan/ios-pbxsettings.d.ts

@@ -0,0 +1,40 @@
+import type { PbxTarget } from '../pbxproj-parser';
+export interface BuildConfig {
+    name: string;
+    settings: Record<string, string>;
+    isProjectLevel: boolean;
+}
+export interface TargetConfigs {
+    target: PbxTarget;
+    configs: {
+        name: string;
+        settings: Record<string, string>;
+    }[];
+}
+/**
+ * Per-config build settings (Debug/Release/...) plus an isProjectLevel flag for
+ * the configs referenced by the PBXProject configuration list.
+ */
+export declare function readBuildConfigs(pbxContent: string): BuildConfig[];
+/**
+ * Release-preferred scalar lookup across every build config. Returns the value
+ * from a config named Release if one carries the key, else the first config
+ * that carries it (fallback), else null. SCALAR keys only.
+ */
+export declare function readBuildSetting(pbxContent: string, name: string): string | null;
+/**
+ * If rawValue is EXACTLY one `$(VAR)` or `${VAR}` reference, substitute it via
+ * readBuildSetting(VAR); otherwise return rawValue unchanged. When the variable
+ * has no pbxproj match the raw `$()` string is returned so callers can treat a
+ * still-unresolved reference as "skip / cannot judge". A value that merely
+ * contains a `$()` among other text is left untouched (not a clean reference).
+ */
+export declare function resolvePlistValue(rawValue: string, pbxContent: string): string;
+/**
+ * Per signable target, the full scalar settings dict of each of its configs.
+ * Reuses findSignableTargets for the target identity and re-walks the native
+ * target blocks to associate each target name with its configuration list.
+ */
+export declare function readTargetConfigs(pbxContent: string): TargetConfigs[];
+/** Lowest explicit iOS deployment target across linked project and application configs. */
+export declare function readMinimumIosDeploymentTarget(pbxContent: string): number | null;

package/dist/src/build/prescan/registry.d.ts

@@ -1,2 +1,4 @@
 import type { PrescanCheck } from './types';
+/** New iOS expansion checks become build-blocking at this UTC instant. */
+export declare const IOS_PRESCAN_EXPANSION_ENFORCE_AFTER = "2026-08-14T00:00:00.000Z";
 export declare const ALL_CHECKS: PrescanCheck[];

package/dist/src/build/prescan/report.d.ts

@@ -2,5 +2,6 @@ import type { PrescanReport } from './types';
 export declare function renderTerminalReport(report: PrescanReport, opts?: {
     verbose?: boolean;
     color?: boolean;
+    now?: Date;
 }): string;
 export declare function renderJsonReport(report: PrescanReport): string;

package/dist/src/build/prescan/types.d.ts

@@ -6,6 +6,8 @@ export type Platform = 'ios' | 'android';
 export interface Finding {
     id: string;
     severity: Severity;
+    /** Finding stays visible but is information-only until this UTC instant. */
+    enforceAfter?: string;
     /**
      * detail/fix/title are printed to the terminal and serialized into --json reports
      * (routinely captured in CI logs): they must NEVER contain credential material
@@ -31,6 +33,8 @@ export interface ScanContext {
 export interface PrescanCheck {
     id: string;
     platforms: Platform[];
+    /** Findings from this check stay information-only until this UTC instant. */
+    enforceAfter?: string;
     /** requires ctx.supabase; skipped (with notice) when absent */
     remote?: boolean;
     appliesTo?: (ctx: ScanContext) => boolean;
@@ -47,4 +51,6 @@ export type PrescanOutcome = 'proceed' | 'ask' | 'block';
 export interface OutcomeOptions {
     failOnWarnings?: boolean;
     ignoreFatal?: boolean;
+    /** Test seam for hard-coded rollout deadlines; defaults to the current time. */
+    now?: Date;
 }