@capgo/cli 8.43.0 → 8.45.0

package/dist/src/shared/two-factor-compliance.d.ts

@@ -1,4 +1,6 @@
 export declare const TWO_FACTOR_COMPLIANCE_NETWORK_MESSAGE = "Cannot reach Capgo to verify 2FA compliance. Check your network connection and try again.";
+export declare const TWO_FACTOR_PREFLIGHT_NETWORK_WARNING = "Could not verify 2FA compliance due to a network error. Continuing \u2014 Capgo will still enforce 2FA on this action if required.";
+export declare const TWO_FACTOR_PREFLIGHT_MAX_ATTEMPTS = 3;
 /**
  * User-facing 2FA compliance connectivity failure. Unlike CliUserError, this
  * remains eligible for PostHog `$exception` capture so operational connectivity
@@ -7,6 +9,23 @@ export declare const TWO_FACTOR_COMPLIANCE_NETWORK_MESSAGE = "Cannot reach Capgo
 export declare class TwoFactorComplianceNetworkError extends Error {
     constructor(message?: string);
 }
+/** Retries transient transport failures before the preflight fail-open path runs. */
+export declare function callTwoFactorComplianceRpcWithRetry<T>(rpcCall: () => PromiseLike<{
+    data: T | null;
+    error: {
+        message?: string;
+    } | null;
+}>): Promise<{
+    data: T | null;
+    error: {
+        message?: string;
+    } | null;
+}>;
+/** Warn, capture telemetry, and let the command continue when the preflight probe is unreachable. */
+export declare function warnAndContinueTwoFactorPreflightNetworkFailure(options: {
+    silent?: boolean;
+    telemetryFunctionName: string;
+}): Promise<void>;
 /** Maps Supabase RPC transport failures to user-facing 2FA compliance errors. */
 export declare function throwTwoFactorComplianceRpcError(error: {
     message?: string;

package/dist/src/utils.d.ts

@@ -142,6 +142,8 @@ interface CapgoConfig {
     hostWeb: string;
     hostFilesApi: string;
     hostApi: string;
+    minCliVersion?: string;
+    minCliVersionReason?: string;
 }
 export declare function getRemoteConfig(silent?: boolean, signal?: AbortSignal): Promise<{
     supaHost?: string;
@@ -150,6 +152,8 @@ export declare function getRemoteConfig(silent?: boolean, signal?: AbortSignal):
     hostWeb: string;
     hostFilesApi: string;
     hostApi: string;
+    minCliVersion?: string;
+    minCliVersionReason?: string;
 }>;
 interface CapgoFilesConfig {
     partialUpload: boolean;
@@ -384,9 +388,7 @@ export declare function createSupabaseClient(apikey: string, supaHost?: string,
                 external_url?: string | null;
                 id?: number;
                 key_id?: string | null;
-                link
-                /** Stable PostHog fingerprint for incomplete Capgo server config before Supabase client creation. */
-                ?: string | null;
+                link?: string | null;
                 manifest?: Database["public"]["CompositeTypes"]["manifest_entry"][] | null;
                 manifest_count?: number;
                 min_update_version?: string | null;
@@ -522,7 +524,10 @@ export declare function createSupabaseClient(apikey: string, supaHost?: string,
                 onboarding_completed_at?: string | null;
                 owner_org: string;
                 retention?: number;
-                stats_refresh_requested_at?: string | null;
+                stats_refresh_requested_at? /**
+                 * Channel name
+                 * example: "waitlist"
+                 */: string | null;
                 stats_updated_at?: string | null;
                 transfer_history?: import("./types/supabase.types").Json[] | null;
                 updated_at?: string | null;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@capgo/cli",
   "type": "module",
-  "version": "8.43.0",
+  "version": "8.45.0",
   "description": "A CLI to upload to capgo servers",
   "author": "Martin martin@capgo.app",
   "license": "Apache 2.0",
@@ -65,6 +65,7 @@
     "check-posix-paths": "node test/check-posix-paths.js",
     "generate-docs": "node dist/index.js generate-docs README.md",
     "test:bundle": "bun test/test-bundle.mjs",
+    "test:bundle-validation": "bun test test/bundle/",
     "test:prescan": "bun test test/prescan/",
     "test:functional": "bun test/test-functional.mjs",
     "test:semver": "bun test/test-semver-validation.mjs",
@@ -75,6 +76,7 @@
     "test:native-dependencies": "bun test/test-native-dependencies.mjs && bun test/test-get-remote-dependencies.mjs",
     "test:package-json-guard": "bun test/test-package-json-guard.mjs",
     "test:credentials": "bun test/test-credentials.mjs",
+    "test:credentials-export": "bun test/test-credentials-export.mjs",
     "test:asc-key-protocol": "bun test/test-asc-key-protocol.mjs",
     "test:credentials-validation": "bun test/test-credentials-validation.mjs",
     "test:android-service-account-validation": "bun test/test-android-service-account-validation.mjs",
@@ -88,6 +90,7 @@
     "test:v2-event-migration": "bun test/test-v2-event-migration.mjs",
     "test:analytics": "bun test/test-analytics.mjs",
     "test:cli-headers": "bun test/test-cli-headers.mjs",
+    "test:min-cli-version": "bun test/test-min-cli-version.mjs",
     "test:authenticated-command-invocation": "bun test/test-authenticated-command-invocation.mjs",
     "test:analytics-error-category": "bun test/test-analytics-error-category.mjs",
     "test:analytics-org-resolver": "bun test/test-analytics-org-resolver.mjs",
@@ -109,6 +112,7 @@
     "test:app-list-output-text": "bun test/test-app-list-output-text.mjs",
     "test:doctor-analytics": "bun test/test-doctor-analytics.mjs",
     "test:posthog-exception": "bun test/test-posthog-exception.mjs",
+    "test:cli-recovery": "bun test/test-cli-recovery.mjs",
     "test:create-supabase-client": "bun test/test-create-supabase-client.mjs",
     "test:onboarding-recovery": "bun test/test-onboarding-recovery.mjs",
     "test:onboarding-progress": "bun test/test-onboarding-progress.mjs",
@@ -170,7 +174,7 @@
     "test:android-version": "bun test/test-android-version.mjs",
     "test:platform-flow-contract": "bun test/test-platform-flow-contract.mjs",
     "test:tail-engine-shared": "bun test/test-tail-engine-shared.mjs",
-    "test": "bun run build && bun run test:helper-dce && bun run test:version-detection:setup && bun run test:bundle && bun run test:functional && bun run test:semver && bun run test:auto-bump-version && bun run test:auto-bump-ai-diff && bun run test:version-edge-cases && bun run test:regex && bun run test:upload && bun run test:fail-on-incompatible && bun run test:native-dependencies && bun run test:package-json-guard && bun run test:credentials && bun run test:credentials-validation && bun run test:android-service-account-validation && bun run test:build-zip-filter && bun run test:checksum && bun run test:build-needed && bun run test:ci-prompts && bun run test:ci-secrets && bun run test:android-onboarding-progress && bun run test:onboarding-telemetry && bun run test:v2-event-migration && bun run test:analytics && bun run test:cli-headers && bun run test:authenticated-command-invocation && bun run test:analytics-error-category && bun run test:analytics-org-resolver && bun run test:supabase-perf && bun run test:preview-qr && bun run test:app-set-options && bun run test:mcp-analytics && bun run test:mcp-instructions && bun run test:mcp-live-update-onboarding && bun run test:mcp-stdout-guard && bun run test:mcp-platform-select && bun run test:mcp-explain-scopes && bun run test:mcp-oauth-reopen && bun run test:mcp-broker-oauth && bun run test:mcp-broker-session && bun run test:mcp-credentials-manage && bun run test:mcp-resume-prompt && bun run test:mcp-build-job && bun run test:mcp-build-tools && bun run test:app-created-source && bun run test:app-list-output-text && bun run test:doctor-analytics && bun run test:posthog-exception && bun run test:create-supabase-client && bun run test:build-platform-selection && bun run test:builder-project-discovery && bun run test:onboarding-recovery && bun run test:onboarding-progress && bun run test:onboarding-run-targets && bun run test:run-device-command && bun run test:init-monorepo-targeting && bun run test:init-app-conflict && bun run test:channel-add-exists && bun run test:wait-log && bun run test:init-guardrails && bun run test:init-replay && bun run test:init-telemetry && bun run test:prompt-preferences && bun run test:esm-sdk && bun run test:mcp && bun run test:mcp-no-key-handshake && bun run test:auth-session && bun run test:version-detection && bun run test:platform-paths && bun run test:project-type-detection && bun run test:payload-split && bun run test:manifest-path-encoding && bun run test:macos-signing && bun run test:asc-key-protocol && bun run test:apple-api-import-helpers && bun run test:apple-api-verify-key && bun run test:bundle-id-detector && bun run test:apple-api-app-list && bun run test:app-verification && bun run test:pbxproj-parser && bun run test:ai-log-capture && bun run test:ai-analyze-flow && bun run test:cicd-failure-help && bun run test:ai-sse-parser && bun run test:ai-render-markdown && bun run test:ai-stream-markdown && bun run test:ai-onboarding-mode && bun run test:ai-fit && bun run test:platform-layout && bun run test:frame-fit && bun run test:onboarding-min-size && bun run test:min-size-gate && bun run test:shell-size-gate && bun run test:build-log-sanitize && bun run test:build-output-viewport && bun run test:diff-viewer-viewport && bun run test:build-complete-exit && bun run test:ai-analyze-stream && bun run test:support-mailto && bun run test:support-redact && bun run test:support-internal-log && bun run test:support-help-menu && bun run test:support-contact && bun run test:support-upload-prompt && bun run test:support-bundle-files && bun run test:self-update && bun run test:update-prompt && bun run test:apple-api-cert-create && bun run test:android-tail-engine && bun run test:android-tail-render && bun run test:android-tail-routing && bun run test:dev-gate-stripped && bun run test:frame-fit-ios-shared && bun run test:ios-confirm-app-id && bun run test:ios-create-new && bun run test:ios-e2e && bun run test:ios-flow-contract && bun run test:ios-import-discovery && bun run test:ios-import-export && bun run test:ios-import-pickers && bun run test:ios-import-recovery && bun run test:ios-recovery && bun run test:ios-resume && bun run test:ios-tail-handoff && bun run test:ios-tui-render && bun run test:p8-error && bun run test:ios-tui-routing && bun run test:ios-updater-sync-validation && bun run test:ios-verify-app && bun run test:ios-marketing-version && bun run test:android-version && bun run test:platform-flow-contract && bun run test:tail-engine-shared && bun run test:prescan && bun run test:android-reporting-api && bun run test:android-app-verification && bun run test:android-rename && bun run test:appflow-auth && bun run test:appflow-api-map && bun run test:appflow-validate && bun run test:appflow-flow && bun run test:appflow-gapfill && bun run test:appflow-engine && bun run test:appflow-tail && bun run test:appflow-fetch && bun run test:appflow-sa-decode && bun run test:app-permission-helper && bun run test:2fa-compliance-network && bun run test:organization-set-api-host && bun run test:trial-warning && bun run test:plan-validation",
+    "test": "bun run build && bun run test:helper-dce && bun run test:version-detection:setup && bun run test:bundle && bun run test:bundle-validation && bun run test:functional && bun run test:semver && bun run test:auto-bump-version && bun run test:auto-bump-ai-diff && bun run test:version-edge-cases && bun run test:regex && bun run test:upload && bun run test:fail-on-incompatible && bun run test:native-dependencies && bun run test:package-json-guard && bun run test:credentials && bun run test:credentials-export && bun run test:credentials-validation && bun run test:android-service-account-validation && bun run test:build-zip-filter && bun run test:checksum && bun run test:build-needed && bun run test:ci-prompts && bun run test:ci-secrets && bun run test:android-onboarding-progress && bun run test:onboarding-telemetry && bun run test:v2-event-migration && bun run test:analytics && bun run test:cli-headers && bun run test:min-cli-version && bun run test:authenticated-command-invocation && bun run test:analytics-error-category && bun run test:analytics-org-resolver && bun run test:supabase-perf && bun run test:preview-qr && bun run test:app-set-options && bun run test:mcp-analytics && bun run test:mcp-instructions && bun run test:mcp-live-update-onboarding && bun run test:mcp-stdout-guard && bun run test:mcp-platform-select && bun run test:mcp-explain-scopes && bun run test:mcp-oauth-reopen && bun run test:mcp-broker-oauth && bun run test:mcp-broker-session && bun run test:mcp-credentials-manage && bun run test:mcp-resume-prompt && bun run test:mcp-build-job && bun run test:mcp-build-tools && bun run test:app-created-source && bun run test:app-list-output-text && bun run test:doctor-analytics && bun run test:posthog-exception && bun run test:cli-recovery && bun run test:create-supabase-client && bun run test:build-platform-selection && bun run test:builder-project-discovery && bun run test:onboarding-recovery && bun run test:onboarding-progress && bun run test:onboarding-run-targets && bun run test:run-device-command && bun run test:init-monorepo-targeting && bun run test:init-app-conflict && bun run test:channel-add-exists && bun run test:wait-log && bun run test:init-guardrails && bun run test:init-replay && bun run test:init-telemetry && bun run test:prompt-preferences && bun run test:esm-sdk && bun run test:mcp && bun run test:mcp-no-key-handshake && bun run test:auth-session && bun run test:version-detection && bun run test:platform-paths && bun run test:project-type-detection && bun run test:payload-split && bun run test:manifest-path-encoding && bun run test:macos-signing && bun run test:asc-key-protocol && bun run test:apple-api-import-helpers && bun run test:apple-api-verify-key && bun run test:bundle-id-detector && bun run test:apple-api-app-list && bun run test:app-verification && bun run test:pbxproj-parser && bun run test:ai-log-capture && bun run test:ai-analyze-flow && bun run test:cicd-failure-help && bun run test:ai-sse-parser && bun run test:ai-render-markdown && bun run test:ai-stream-markdown && bun run test:ai-onboarding-mode && bun run test:ai-fit && bun run test:platform-layout && bun run test:frame-fit && bun run test:onboarding-min-size && bun run test:min-size-gate && bun run test:shell-size-gate && bun run test:build-log-sanitize && bun run test:build-output-viewport && bun run test:diff-viewer-viewport && bun run test:build-complete-exit && bun run test:ai-analyze-stream && bun run test:support-mailto && bun run test:support-redact && bun run test:support-internal-log && bun run test:support-help-menu && bun run test:support-contact && bun run test:support-upload-prompt && bun run test:support-bundle-files && bun run test:self-update && bun run test:update-prompt && bun run test:apple-api-cert-create && bun run test:android-tail-engine && bun run test:android-tail-render && bun run test:android-tail-routing && bun run test:dev-gate-stripped && bun run test:frame-fit-ios-shared && bun run test:ios-confirm-app-id && bun run test:ios-create-new && bun run test:ios-e2e && bun run test:ios-flow-contract && bun run test:ios-import-discovery && bun run test:ios-import-export && bun run test:ios-import-pickers && bun run test:ios-import-recovery && bun run test:ios-recovery && bun run test:ios-resume && bun run test:ios-tail-handoff && bun run test:ios-tui-render && bun run test:p8-error && bun run test:ios-tui-routing && bun run test:ios-updater-sync-validation && bun run test:ios-verify-app && bun run test:ios-marketing-version && bun run test:android-version && bun run test:platform-flow-contract && bun run test:tail-engine-shared && bun run test:prescan && bun run test:android-reporting-api && bun run test:android-app-verification && bun run test:android-rename && bun run test:appflow-auth && bun run test:appflow-api-map && bun run test:appflow-validate && bun run test:appflow-flow && bun run test:appflow-gapfill && bun run test:appflow-engine && bun run test:appflow-tail && bun run test:appflow-fetch && bun run test:appflow-sa-decode && bun run test:app-permission-helper && bun run test:2fa-compliance-network && bun run test:organization-set-api-host && bun run test:trial-warning && bun run test:plan-validation",
     "test:build-platform-selection": "bun test/test-build-platform-selection.mjs",
     "test:builder-project-discovery": "bun test/test-builder-project-discovery.mjs",
     "test:ai-log-capture": "bun test/test-ai-log-capture.mjs",

package/skills/native-builds/SKILL.md

@@ -261,6 +261,25 @@ npx @capgo/cli build credentials save --platform android \
   - `--skip-build-number-bump`, `--no-skip-build-number-bump`
 - Supports the same iOS and Android credential fields as `build credentials save`.
 
+### `build credentials export <VARIABLE>`
+
+- Exports one value from saved Builder credentials only; environment variables are never used.
+- Requires `--app-id <APP_ID>`.
+- Requires exactly one output mode:
+  - `--raw` writes only the exact stored value to stdout, with no trailing newline. Failures go to stderr and exit with status `1`.
+  - `--file <PATH>` creates a new `0600` file and never overwrites an existing path. Interactive runs prompt before decoding values that look like Base64; `--decode-base64` forces decoding. A negative response or non-interactive run preserves the stored text.
+- Use `--local` or `--global` when the app has saved credentials in both stores. Use `--platform ios|android` when the value is ambiguous across platforms.
+
+```bash
+# Exact value for a CI secret or pipe: no newline is added.
+npx @capgo/cli@latest build credentials export P12_PASSWORD \
+  --app-id com.example.app --platform ios --raw
+
+# Create a new decoded keystore file; existing paths are refused.
+npx @capgo/cli@latest build credentials export ANDROID_KEYSTORE_FILE \
+  --app-id com.example.app --platform android --file ./release.keystore --decode-base64
+```
+
 ### `build credentials migrate`
 
 - Example: `npx @capgo/cli build credentials migrate --platform ios`