@invarn/cibuild 2.8.0 → 2.8.1

package/dist/src/commands/a-properties-stand-in-declares-the-keys-the-build-reads.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=a-properties-stand-in-declares-the-keys-the-build-reads.test.d.ts.map

package/dist/src/commands/a-properties-stand-in-declares-the-keys-the-build-reads.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a-properties-stand-in-declares-the-keys-the-build-reads.test.d.ts","sourceRoot":"","sources":["../../../src/commands/a-properties-stand-in-declares-the-keys-the-build-reads.test.ts"],"names":[],"mappings":""}

package/dist/src/commands/a-properties-stand-in-declares-the-keys-the-build-reads.test.js

@@ -0,0 +1,218 @@
+/**
+ * An empty properties file fixes "file missing", not "field missing".
+ *
+ * The Secrets Gradle plugin turns each key of the properties file it loads
+ * into a `BuildConfig` constant and a manifest placeholder. A checkout without
+ * that file gets neither, so handing the build an empty stand-in clears the
+ * plugin's own throw and then fails one step later, inside Gradle, at the first
+ * reference to a constant that was never generated.
+ *
+ * `missingPropertyKeys` is the list a stand-in has to declare for that
+ * reference to resolve: what the build reads, read off the build files and the
+ * source under the modules that apply the plugin.
+ */
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { scanAndroidProject } from "./android-scanner.js";
+let root;
+beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), "cibuild-props-"));
+});
+afterEach(() => {
+    rmSync(root, { recursive: true, force: true });
+});
+function write(relative, content) {
+    const path = join(root, relative);
+    mkdirSync(join(path, ".."), { recursive: true });
+    writeFileSync(path, content);
+}
+async function keys() {
+    return (await scanAndroidProject(root)).missingPropertyKeys;
+}
+/**
+ * The shape the whole thing is for: one module applying the plugin, no
+ * properties file anywhere, and the root declaring the plugin without
+ * applying it — which is where a version catalog alias is nearly always named.
+ */
+function projectApplyingTheSecretsPlugin(appBuildFileExtra = "") {
+    write("settings.gradle.kts", 'include(":app")\n');
+    write("build.gradle.kts", "plugins {\n  alias(libs.plugins.secrets) apply false\n}\n");
+    write("app/build.gradle.kts", `plugins {\n  id("com.android.application")\n  alias(libs.plugins.secrets)\n}\n\nandroid {\n  namespace = "com.example.app"\n${appBuildFileExtra}}\n`);
+    write(".gitignore", "local.properties\n");
+}
+describe("the keys a generated properties file has to declare", () => {
+    test("names a BuildConfig field referenced from Kotlin source", async () => {
+        projectApplyingTheSecretsPlugin();
+        write("app/src/main/java/com/example/app/Maps.kt", "package com.example.app\n\nval key: String = BuildConfig.MAPS_API_KEY\n");
+        expect(await keys()).toEqual(["MAPS_API_KEY"]);
+    });
+    test("names one referenced from Java source", async () => {
+        projectApplyingTheSecretsPlugin();
+        write("app/src/main/java/com/example/app/Maps.java", "package com.example.app;\n\nclass Maps { String k = BuildConfig.MAPS_API_KEY; }\n");
+        expect(await keys()).toEqual(["MAPS_API_KEY"]);
+    });
+    test("names a manifestPlaceholders key — Kotlin DSL, indexed", async () => {
+        projectApplyingTheSecretsPlugin('  defaultConfig {\n    manifestPlaceholders["mapsApiKey"] = "unused"\n  }\n');
+        expect(await keys()).toEqual(["mapsApiKey"]);
+    });
+    test("names a manifestPlaceholders key — Kotlin DSL, whole map", async () => {
+        projectApplyingTheSecretsPlugin('  defaultConfig {\n    manifestPlaceholders += mapOf("mapsApiKey" to "u", "adsAppId" to "u")\n  }\n');
+        expect(await keys()).toEqual(["adsAppId", "mapsApiKey"]);
+    });
+    test("names a manifestPlaceholders key — Groovy map literal", async () => {
+        write("settings.gradle", "include ':app'\n");
+        write("build.gradle", "// root\n");
+        write("app/build.gradle", "plugins {\n  id 'com.google.android.libraries.mapsplatform.secrets-gradle-plugin'\n}\n" +
+            "android {\n  defaultConfig {\n" +
+            "    manifestPlaceholders = [mapsApiKey: \"unused\", 'adsAppId': \"unused\"]\n" +
+            "  }\n}\n");
+        expect(await keys()).toEqual(["adsAppId", "mapsApiKey"]);
+    });
+    test("names a manifestPlaceholders key — Groovy put", async () => {
+        write("settings.gradle", "include ':app'\n");
+        write("build.gradle", "// root\n");
+        write("app/build.gradle", "plugins {\n  id 'com.google.android.libraries.mapsplatform.secrets-gradle-plugin'\n}\n" +
+            "android {\n  defaultConfig {\n" +
+            "    manifestPlaceholders.put('mapsApiKey', 'unused')\n" +
+            "  }\n}\n");
+        expect(await keys()).toEqual(["mapsApiKey"]);
+    });
+    test("merges both sources, sorted and deduplicated", async () => {
+        projectApplyingTheSecretsPlugin('  defaultConfig {\n    manifestPlaceholders["MAPS_API_KEY"] = "u"\n  }\n');
+        write("app/src/main/java/com/example/app/Keys.kt", "val a = BuildConfig.MAPS_API_KEY\nval b = BuildConfig.ADS_APP_ID\nval c = BuildConfig.MAPS_API_KEY\n");
+        expect(await keys()).toEqual(["ADS_APP_ID", "MAPS_API_KEY"]);
+    });
+});
+describe("what it deliberately leaves out", () => {
+    /**
+     * `BuildConfig.DEBUG` is the most-referenced constant in Android source, and
+     * AGP generates it whether or not a properties file exists. Declaring it
+     * would make the Secrets plugin generate a `String DEBUG` beside AGP's
+     * `boolean DEBUG` — the file meant to rescue the build breaking it instead.
+     */
+    test("the fields AGP generates by itself", async () => {
+        projectApplyingTheSecretsPlugin();
+        write("app/src/main/java/com/example/app/Env.kt", [
+            "val d = BuildConfig.DEBUG",
+            "val a = BuildConfig.APPLICATION_ID",
+            "val t = BuildConfig.BUILD_TYPE",
+            "val f = BuildConfig.FLAVOR",
+            "val fd = BuildConfig.FLAVOR_environment",
+            "val vc = BuildConfig.VERSION_CODE",
+            "val vn = BuildConfig.VERSION_NAME",
+            "val lp = BuildConfig.LIBRARY_PACKAGE_NAME",
+            "val mine = BuildConfig.MAPS_API_KEY",
+        ].join("\n"));
+        expect(await keys()).toEqual(["MAPS_API_KEY"]);
+    });
+    test("a project that applies no Secrets plugin", async () => {
+        write("settings.gradle.kts", 'include(":app")\n');
+        write("build.gradle.kts", "// root\n");
+        write("app/build.gradle.kts", 'plugins {\n  id("com.android.application")\n}\n');
+        write("app/src/main/java/com/example/app/Maps.kt", "val k = BuildConfig.MAPS_API_KEY\n");
+        expect(await keys()).toEqual([]);
+    });
+    /**
+     * `apply false` names the plugin's version for the modules that will apply
+     * it; the root project loads no properties file of its own. Reading it as an
+     * application would aim the source walk at the whole repository — every
+     * module's source, on the strength of a line that applies nothing.
+     */
+    test("a root that declares the plugin with apply false", async () => {
+        write("settings.gradle.kts", 'include(":app", ":other")\n');
+        write("build.gradle.kts", "plugins {\n  alias(libs.plugins.secrets) apply false\n}\n");
+        write("app/build.gradle.kts", 'plugins {\n  id("com.android.application")\n}\n');
+        write("other/build.gradle.kts", "// nothing\n");
+        write("other/src/main/java/Other.kt", "val k = BuildConfig.ELSEWHERE\n");
+        expect(await keys()).toEqual([]);
+    });
+    test("generated sources under build/", async () => {
+        projectApplyingTheSecretsPlugin();
+        write("app/build/generated/source/buildConfig/debug/com/example/app/BuildConfig.java", "public final class BuildConfig { public static final String STALE = BuildConfig.STALE; }\n");
+        write("app/src/main/java/com/example/app/Maps.kt", "val k = BuildConfig.MAPS_API_KEY\n");
+        expect(await keys()).toEqual(["MAPS_API_KEY"]);
+    });
+});
+describe("the module boundary", () => {
+    test("reads source of the module that applies the plugin, not its siblings", async () => {
+        write("settings.gradle.kts", 'include(":app", ":other")\n');
+        write("build.gradle.kts", "// root\n");
+        write("app/build.gradle.kts", 'plugins {\n  alias(libs.plugins.secrets)\n}\n');
+        write("app/src/main/java/App.kt", "val k = BuildConfig.MAPS_API_KEY\n");
+        write("other/build.gradle.kts", "// nothing\n");
+        write("other/src/main/java/Other.kt", "val k = BuildConfig.ELSEWHERE\n");
+        expect(await keys()).toEqual(["MAPS_API_KEY"]);
+    });
+    test("a root module that really applies the plugin covers the whole tree", async () => {
+        write("settings.gradle.kts", 'include(":app")\n');
+        write("build.gradle.kts", 'plugins {\n  id("com.android.application")\n  alias(libs.plugins.secrets)\n}\n');
+        write("app/build.gradle.kts", "// nothing\n");
+        write("app/src/main/java/App.kt", "val k = BuildConfig.MAPS_API_KEY\n");
+        expect(await keys()).toEqual(["MAPS_API_KEY"]);
+    });
+});
+/**
+ * The warnings a customer already sees. This scan adds a field and reads more
+ * files; it must not add, drop or reword a single warning, so the two paths
+ * that emit a `secrets-plugin` warning are asserted whole.
+ */
+describe("the Secrets-plugin warning path is unchanged", () => {
+    test("with no companion defaults file, the one file-absent warning", async () => {
+        projectApplyingTheSecretsPlugin();
+        write("app/src/main/java/com/example/app/Maps.kt", "val k = BuildConfig.MAPS_API_KEY\n");
+        const result = await scanAndroidProject(root);
+        expect(result.warnings.filter((w) => w.category === "secrets-plugin")).toEqual([
+            {
+                category: "secrets-plugin",
+                severity: "warning",
+                message: "Google Secrets Gradle Plugin reads 'local.properties' which is absent in CI",
+                hint: "Inject 'local.properties' as a file step using a secret variable",
+                // The root build file, which is where the version-catalog alias is
+                // named with `apply false`. The warning path counts that as an
+                // application and always has; `missingPropertyKeys` does not, which is
+                // why the two ask the question through different functions.
+                location: "build.gradle.kts",
+            },
+        ]);
+        // And the new field is populated in the same scan, from the same files.
+        expect(result.missingPropertyKeys).toEqual(["MAPS_API_KEY"]);
+    });
+    test("with a companion defaults file, one warning per expected key", async () => {
+        projectApplyingTheSecretsPlugin();
+        write("secrets.defaults.properties", "MAPS_API_KEY=\nADS_APP_ID=\n");
+        write("app/src/main/java/com/example/app/Maps.kt", "val k = BuildConfig.MAPS_API_KEY\n");
+        const result = await scanAndroidProject(root);
+        expect(result.warnings.filter((w) => w.category === "secrets-plugin")).toEqual([
+            {
+                category: "secrets-plugin",
+                severity: "warning",
+                message: "Secrets plugin key: MAPS_API_KEY",
+                hint: "Add via: ci secrets add MAPS_API_KEY",
+                location: "local.properties",
+            },
+            {
+                category: "secrets-plugin",
+                severity: "warning",
+                message: "Secrets plugin key: ADS_APP_ID",
+                hint: "Add via: ci secrets add ADS_APP_ID",
+                location: "local.properties",
+            },
+        ]);
+    });
+    test("a properties file that is present but not gitignored warns about neither", async () => {
+        write("settings.gradle.kts", 'include(":app")\n');
+        write("build.gradle.kts", "// root\n");
+        write("app/build.gradle.kts", "plugins {\n  alias(libs.plugins.secrets)\n}\n");
+        write("local.properties", "sdk.dir=/opt/android\n");
+        write("app/src/main/java/App.kt", "val k = BuildConfig.MAPS_API_KEY\n");
+        const result = await scanAndroidProject(root);
+        expect(result.warnings.filter((w) => w.category === "secrets-plugin")).toEqual([]);
+        // The keys are still reported. `invarn`-style callers run this scan on a
+        // developer's own checkout, where the file is nearly always present and
+        // holds nothing but `sdk.dir` — gating the keys on its absence would
+        // return nothing in exactly the case they are needed for.
+        expect(result.missingPropertyKeys).toEqual(["MAPS_API_KEY"]);
+    });
+});
+//# sourceMappingURL=a-properties-stand-in-declares-the-keys-the-build-reads.test.js.map

package/dist/src/commands/android-scanner.d.ts

@@ -25,6 +25,28 @@ export interface ScanResult {
     detectedGradleVersion?: string;
     /** Build types, product flavors, and all variant combinations detected in Gradle files. */
     buildVariants: BuildVariants;
+    /**
+     * The property names the build reads out of the properties file the Secrets
+     * Gradle plugin loads — sorted, deduplicated, empty when no module applies
+     * the plugin.
+     *
+     * **An empty properties file fixes "file missing", not "field missing".**
+     * The plugin turns each key of that file into a `BuildConfig` constant and a
+     * manifest placeholder, so a checkout without the file compiles neither.
+     * Supplying an empty stand-in gets the build past the plugin's own throw and
+     * then fails one step later, inside Gradle, at the first reference to a field
+     * that was never generated. These are those names: what a stand-in has to
+     * declare for the reference to resolve.
+     *
+     * Data, not prose — deliberately not more `warnings`. A warning is a sentence
+     * for a human to read; this is a list for a generator to consume, and sharing
+     * one channel between them means the generator has to parse English.
+     *
+     * Coarse on purpose. A name here that some other plugin turns out to
+     * generate costs one unused line in a properties file; a name missing from
+     * here costs the build.
+     */
+    missingPropertyKeys: string[];
 }
 export interface BuildVariants {
     /** Build types found, e.g. ["debug", "release", "staging"]. Always includes debug + release. */

package/dist/src/commands/android-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"android-scanner.d.ts","sourceRoot":"","sources":["../../../src/commands/android-scanner.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC;AAEjD,MAAM,MAAM,eAAe,GACvB,cAAc,GACd,SAAS,GACT,iBAAiB,GACjB,gBAAgB,GAChB,cAAc,GACd,UAAU,GACV,gBAAgB,CAAC;AAErB,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,uFAAuF;IACvF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,2FAA2F;IAC3F,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,gGAAgG;IAChG,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,wFAAwF;IACxF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAwKD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAcnE;AAyKD,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAO7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,GACX;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8CjD;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG7E;AAQD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAsBvF;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIrF;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,uBAAuB,UAAsB,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,QAAuC,CAAC;AAElF,yEAAyE;AACzE,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,WAAW,GACX,mBAAmB,GACnB,eAAe,GACf,uBAAuB,CAAC;AAE5B,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,IAAI,EAAE,eAAe,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,iBAAiB,CAC/B,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,iBAAiB,CAkCnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,GAAG,SAAS,CAEpB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,GAAG,SAAS,CAwBpB;AAwLD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,aAAa,CAsCxE;AAMD,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAiRjF;AAgBD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAqE3D"}
+{"version":3,"file":"android-scanner.d.ts","sourceRoot":"","sources":["../../../src/commands/android-scanner.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC;AAEjD,MAAM,MAAM,eAAe,GACvB,cAAc,GACd,SAAS,GACT,iBAAiB,GACjB,gBAAgB,GAChB,cAAc,GACd,UAAU,GACV,gBAAgB,CAAC;AAErB,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,uFAAuF;IACvF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,2FAA2F;IAC3F,aAAa,EAAE,aAAa,CAAC;IAC7B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,gGAAgG;IAChG,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,wFAAwF;IACxF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAkaD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAcnE;AAyKD,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAO7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,GACX;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8CjD;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG7E;AAQD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAsBvF;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIrF;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,uBAAuB,UAAsB,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,QAAuC,CAAC;AAElF,yEAAyE;AACzE,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,WAAW,GACX,mBAAmB,GACnB,eAAe,GACf,uBAAuB,CAAC;AAE5B,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,IAAI,EAAE,eAAe,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,iBAAiB,CAC/B,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,iBAAiB,CAkCnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,GAAG,SAAS,CAEpB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,GAAG,SAAS,CAwBpB;AAwLD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,aAAa,CAsCxE;AAMD,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA8RjF;AAgBD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAqE3D"}

package/dist/src/commands/android-scanner.js

@@ -138,6 +138,259 @@ function extractSecretsPropertiesFile(content) {
     const m = /propertiesFileName\s*=\s*["']([^"']+)["']/.exec(block);
     return m ? m[1] : "local.properties";
 }
+// ---------------------------------------------------------------------------
+// Property keys the build reads out of the Secrets plugin's properties file
+// ---------------------------------------------------------------------------
+/**
+ * True when this build file *applies* the Secrets plugin, as opposed to merely
+ * declaring its version for other modules.
+ *
+ * A root build file almost always carries
+ * `alias(libs.plugins.secrets) apply false` — the plugin is named there so a
+ * module can apply it without repeating the version, and the root project
+ * itself never loads a properties file. Reading that as "the root module
+ * applies it" would aim the source walk below at the whole repository on the
+ * strength of a line that applies nothing.
+ *
+ * Separate from `detectSecretsPlugin` on purpose: that one decides which
+ * warnings are emitted, and this must not change them.
+ */
+function appliesSecretsPlugin(content) {
+    const applied = content
+        .split("\n")
+        .filter((line) => !/\bapply\s+false\b/.test(line))
+        .join("\n");
+    return detectSecretsPlugin(applied);
+}
+/**
+ * The `BuildConfig` fields the Android Gradle Plugin generates by itself.
+ *
+ * `BuildConfig.DEBUG` is the most-referenced constant in Android source, and
+ * every one of these is generated whether or not a properties file exists — so
+ * naming them costs more than the unused line the rest of this scan tolerates.
+ * A property named `DEBUG` would make the Secrets plugin generate a `String
+ * DEBUG` beside AGP's `boolean DEBUG`, and the build that was going to compile
+ * stops compiling because of the file meant to rescue it.
+ *
+ * `FLAVOR_<dimension>` is generated once per flavor dimension, so it is matched
+ * by prefix rather than listed.
+ */
+const AGP_GENERATED_BUILD_CONFIG_FIELDS = new Set([
+    "DEBUG",
+    "APPLICATION_ID",
+    "BUILD_TYPE",
+    "FLAVOR",
+    "VERSION_CODE",
+    "VERSION_NAME",
+    "LIBRARY_PACKAGE_NAME",
+]);
+function isAgpGeneratedField(name) {
+    return AGP_GENERATED_BUILD_CONFIG_FIELDS.has(name) || name.startsWith("FLAVOR_");
+}
+/**
+ * `BuildConfig.SOME_FIELD` references in a source file.
+ *
+ * Screaming snake case only: that is the convention for a generated constant,
+ * and widening it to any identifier would pull in `BuildConfig.javaClass` and
+ * every other member access on the class itself.
+ */
+function extractBuildConfigFieldRefs(content) {
+    const names = [];
+    const re = /\bBuildConfig\.([A-Z][A-Z0-9_]*)\b/g;
+    let m;
+    while ((m = re.exec(content)) !== null) {
+        if (!isAgpGeneratedField(m[1]))
+            names.push(m[1]);
+    }
+    return names;
+}
+/**
+ * The index of the character closing the bracket or parenthesis at `open`,
+ * ignoring anything inside a string literal. -1 when it is never closed.
+ */
+function matchingClose(content, open) {
+    const closing = content[open] === "[" ? "]" : ")";
+    let depth = 0;
+    let quote = "";
+    for (let i = open; i < content.length; i++) {
+        const ch = content[i];
+        if (quote) {
+            if (ch === "\\")
+                i++;
+            else if (ch === quote)
+                quote = "";
+            continue;
+        }
+        if (ch === '"' || ch === "'")
+            quote = ch;
+        else if (ch === "[" || ch === "(")
+            depth++;
+        else if (ch === "]" || ch === ")") {
+            depth--;
+            if (depth === 0)
+                return content[i] === closing ? i : -1;
+        }
+    }
+    return -1;
+}
+/** Split a map-literal body on its top-level commas — not ones nested or quoted. */
+function splitTopLevel(body) {
+    const parts = [];
+    let depth = 0;
+    let quote = "";
+    let start = 0;
+    for (let i = 0; i < body.length; i++) {
+        const ch = body[i];
+        if (quote) {
+            if (ch === "\\")
+                i++;
+            else if (ch === quote)
+                quote = "";
+            continue;
+        }
+        if (ch === '"' || ch === "'")
+            quote = ch;
+        else if (ch === "[" || ch === "(" || ch === "{")
+            depth++;
+        else if (ch === "]" || ch === ")" || ch === "}")
+            depth--;
+        else if (ch === "," && depth === 0) {
+            parts.push(body.slice(start, i));
+            start = i + 1;
+        }
+    }
+    parts.push(body.slice(start));
+    return parts;
+}
+/**
+ * The keys of a map literal, in either language's spelling:
+ * Groovy `[key: v, "key": v]`, Kotlin `mapOf("key" to v)`.
+ */
+function mapLiteralKeys(body) {
+    const names = [];
+    for (const entry of splitTopLevel(body)) {
+        const kotlin = /^\s*["']([^"']+)["']\s+to\s/.exec(entry);
+        if (kotlin) {
+            names.push(kotlin[1]);
+            continue;
+        }
+        const groovy = /^\s*(?:["']([^"']+)["']|([A-Za-z_]\w*))\s*:/.exec(entry);
+        if (groovy)
+            names.push(groovy[1] ?? groovy[2]);
+    }
+    return names;
+}
+/**
+ * Keys named in a `manifestPlaceholders` map in a build file.
+ *
+ * The Secrets plugin fills a placeholder from the property of the same name,
+ * so a placeholder the build declares is a property the build reads. Every
+ * spelling the two DSLs offer for the same map:
+ *
+ *     manifestPlaceholders["mapsApiKey"] = …        // both
+ *     manifestPlaceholders.put("mapsApiKey", …)     // Groovy
+ *     manifestPlaceholders = [mapsApiKey: …]        // Groovy
+ *     manifestPlaceholders += mapOf("mapsApiKey" to …)   // Kotlin
+ */
+function extractManifestPlaceholderKeys(content) {
+    const names = [];
+    for (const re of [
+        /manifestPlaceholders\s*\[\s*["']([^"']+)["']\s*\]/g,
+        /manifestPlaceholders\s*\.\s*put\s*\(\s*["']([^"']+)["']/g,
+    ]) {
+        let m;
+        while ((m = re.exec(content)) !== null)
+            names.push(m[1]);
+    }
+    // A whole map assigned, added or put at once. The opening bracket the regex
+    // ends on is where the literal starts; its match is where it ends.
+    const assigned = /manifestPlaceholders\s*(?:\.\s*putAll\s*\(\s*)?(?:\+?=\s*)?(?:mapOf\s*|mutableMapOf\s*)?[[(]/g;
+    let m;
+    while ((m = assigned.exec(content)) !== null) {
+        const open = m.index + m[0].length - 1;
+        const close = matchingClose(content, open);
+        if (close === -1)
+            continue;
+        names.push(...mapLiteralKeys(content.slice(open + 1, close)));
+        assigned.lastIndex = close;
+    }
+    return names;
+}
+// Bounds on the source walk, the way `findGradleFiles` bounds itself to the
+// files a build actually declares. A repository is an unbounded tree and this
+// runs on every scan of one.
+const SOURCE_EXTENSIONS = [".kt", ".kts", ".java"];
+const SOURCE_SKIP_DIRS = new Set(["build", "node_modules"]);
+const SOURCE_FILE_CAP = 1500;
+const SOURCE_DEPTH_CAP = 12;
+/** Source files under `dir`, up to the shared file budget. */
+function findSourceFiles(dir, budget, depth = 0) {
+    if (depth > SOURCE_DEPTH_CAP || budget.left <= 0)
+        return [];
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const files = [];
+    const subdirs = [];
+    for (const entry of entries) {
+        // Dot directories hold caches and VCS state, never source: `.git`,
+        // `.gradle`, `.idea`, `.kotlin`.
+        if (entry.name.startsWith("."))
+            continue;
+        if (entry.isDirectory()) {
+            if (!SOURCE_SKIP_DIRS.has(entry.name))
+                subdirs.push(join(dir, entry.name));
+        }
+        else if (SOURCE_EXTENSIONS.some((ext) => entry.name.endsWith(ext))) {
+            if (budget.left <= 0)
+                break;
+            budget.left--;
+            files.push(join(dir, entry.name));
+        }
+    }
+    for (const sub of subdirs)
+        files.push(...findSourceFiles(sub, budget, depth + 1));
+    return files;
+}
+/** The directories of `dirs` that no other member of `dirs` contains. */
+function outermost(dirs) {
+    return dirs.filter((dir) => !dirs.some((other) => other !== dir && dir.startsWith(other + "/")));
+}
+/**
+ * The property names the build reads out of the Secrets plugin's properties
+ * file — see `ScanResult.missingPropertyKeys`.
+ *
+ * Bounded to the modules that apply the plugin, because that is where its
+ * generated fields are visible and where the references to them live.
+ */
+function collectPropertyKeys(gradleFiles) {
+    // A module with both a `build.gradle` and a `build.gradle.kts` yields its
+    // directory twice, and walking it twice would spend the file budget twice.
+    const moduleDirs = new Set();
+    const keys = new Set();
+    for (const filePath of gradleFiles) {
+        const content = safeRead(filePath);
+        if (!appliesSecretsPlugin(content))
+            continue;
+        moduleDirs.add(dirname(filePath));
+        for (const key of extractManifestPlaceholderKeys(content))
+            keys.add(key);
+    }
+    if (moduleDirs.size === 0)
+        return [];
+    const budget = { left: SOURCE_FILE_CAP };
+    for (const dir of outermost([...moduleDirs])) {
+        for (const file of findSourceFiles(dir, budget)) {
+            for (const name of extractBuildConfigFieldRefs(safeRead(file)))
+                keys.add(name);
+        }
+    }
+    return [...keys].sort();
+}
 /** Parse property keys from a standard .properties file, skipping comments and blank lines. */
 function parsePropertyKeys(propertiesContent) {
     return propertiesContent
@@ -1070,6 +1323,16 @@ export async function scanAndroidProject(projectRoot) {
         }
     }
     // ------------------------------------------------------------------
+    // 4b. Which keys that properties file has to declare
+    // ------------------------------------------------------------------
+    //
+    // Section 4 says the file is absent; this says what is in it. The two are
+    // separate because they answer different questions for different readers —
+    // the warnings above tell a person a file is missing, and this tells a
+    // generator what a stand-in for it has to contain.
+    // ------------------------------------------------------------------
+    const missingPropertyKeys = collectPropertyKeys(gradleFiles);
+    // ------------------------------------------------------------------
     // 5. Firebase / GMS — check google-services.json after scanning all files
     // ------------------------------------------------------------------
     if (gmsDetected) {
@@ -1121,6 +1384,7 @@ export async function scanAndroidProject(projectRoot) {
         detectedJavaVersionSource,
         detectedGradleVersion,
         buildVariants,
+        missingPropertyKeys,
     };
 }
 // ---------------------------------------------------------------------------

package/dist/src/commands/index.d.ts

@@ -23,6 +23,7 @@ export { handleBuildCommand } from "./build.js";
 export { handleResetCommand } from "./reset.js";
 export { detectMobileProjectRoot } from "../shared/detect-project.js";
 export type { MobileProjectType } from "../shared/detect-project.js";
+export { isXcodeContainer, xcodeContainersIn } from "../shared/detect-project.js";
 export { scanIosProject, formatIosScanResult } from "./ios-scanner.js";
 export type { IosScanResult, IosWarning, IosWarningCategory, IosWarningSeverity, } from "./ios-scanner.js";
 export { scanAndroidProject, formatScanResult, detectBuildVariants, } from "./android-scanner.js";

package/dist/src/commands/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAOrE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvE,YAAY,EACV,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,UAAU,IAAI,iBAAiB,EAC/B,aAAa,EACb,YAAY,EACZ,eAAe,EACf,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,GACd,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAGrE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAOlF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvE,YAAY,EACV,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,UAAU,IAAI,iBAAiB,EAC/B,aAAa,EACb,YAAY,EACZ,eAAe,EACf,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,GACd,MAAM,4BAA4B,CAAC"}

package/dist/src/commands/index.js

@@ -19,6 +19,9 @@ export { handleBuildCommand } from "./build.js";
 export { handleResetCommand } from "./reset.js";
 // Helpers useful for callers that implement their own variations.
 export { detectMobileProjectRoot } from "../shared/detect-project.js";
+// The one answer to "is this `.xcodeproj` a project", exported so the Invarn
+// CLI's own scans cannot drift from cibuild's.
+export { isXcodeContainer, xcodeContainersIn } from "../shared/detect-project.js";
 // Project scanners — pure, toolchain-free file-content detectors. Exposed
 // so external callers (the Invarn CLI) can detect build variables and
 // secret-bearing files from a checkout and push them to the backend,

package/dist/src/commands/ios-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ios-scanner.d.ts","sourceRoot":"","sources":["../../../src/commands/ios-scanner.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG,SAAS,GAAG,gBAAgB,GAAG,WAAW,CAAC;AAE7F,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB;;;OAGG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,YAAY,EAAE,OAAO,CAAC;IACtB,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;IAChB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iFAAiF;IACjF,eAAe,EAAE,MAAM,CAAC;CACzB;AAuFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EAAE,GAChB,MAAM,EAAE,CAEV;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EAAE,GAChB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA8CxC;AAmLD,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAgGhF;AAaD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAkDjE"}
+{"version":3,"file":"ios-scanner.d.ts","sourceRoot":"","sources":["../../../src/commands/ios-scanner.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG,SAAS,GAAG,gBAAgB,GAAG,WAAW,CAAC;AAE7F,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB;;;OAGG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,YAAY,EAAE,OAAO,CAAC;IACtB,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;IAChB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iFAAiF;IACjF,eAAe,EAAE,MAAM,CAAC;CACzB;AAiFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EAAE,GAChB,MAAM,EAAE,CAEV;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EAAE,GAChB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA8CxC;AAkLD,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAgGhF;AAaD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAkDjE"}

package/dist/src/commands/ios-scanner.js

@@ -1,5 +1,6 @@
 import { resolve, relative } from "node:path";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { xcodeContainersIn } from "../shared/detect-project.js";
 // ---------------------------------------------------------------------------
 // File discovery
 // ---------------------------------------------------------------------------
@@ -18,17 +19,16 @@ function relPath(root, filePath) {
  * Finds the primary Xcode project path.
  * Prefers .xcworkspace over .xcodeproj (CocoaPods projects use workspace).
  * Returns the relative path from root, or empty string if not found.
+ *
+ * A candidate must be a real container — `isXcodeContainer` — and not merely
+ * a directory with the right suffix. `Uwi0/Oakane` ships `iosApp.xcodeproj`
+ * with no `project.pbxproj` beside the `oakane.xcodeproj` that has one, and
+ * this function returned the husk because it was first.
  */
 function findXcodeProjectPath(root) {
-    let entries;
-    try {
-        entries = readdirSync(root);
-    }
-    catch {
-        return "";
-    }
-    const workspaces = entries.filter((e) => e.endsWith(".xcworkspace"));
-    const projects = entries.filter((e) => e.endsWith(".xcodeproj"));
+    const containers = xcodeContainersIn(root);
+    const workspaces = containers.filter((e) => e.endsWith(".xcworkspace"));
+    const projects = containers.filter((e) => e.endsWith(".xcodeproj"));
     // Prefer workspace (CocoaPods / multi-package setups use these)
     if (workspaces.length > 0)
         return workspaces[0];
@@ -43,14 +43,7 @@ function findXcodeProjectPath(root) {
  */
 const COMPANION_SCHEME = /(extension|widget|clip|intents?|notification|tvos|macos|watchos|visionos|tests?|screenshots?|staging|prototype|codegen)/i;
 function readSchemeFacts(root, name) {
-    let entries;
-    try {
-        entries = readdirSync(root);
-    }
-    catch {
-        return undefined;
-    }
-    for (const entry of entries) {
+    for (const entry of xcodeContainersIn(root)) {
         if (!entry.endsWith(".xcodeproj"))
             continue;
         const path = resolve(root, entry, "xcshareddata", "xcschemes", `${name}.xcscheme`);
@@ -194,13 +187,11 @@ export function rankSchemesWithReason(root, projectPath, schemes) {
  */
 function detectSchemes(root) {
     const schemes = new Set();
-    let entries;
-    try {
-        entries = readdirSync(root);
-    }
-    catch {
-        return [];
-    }
+    // Real projects only. The fallback below invents a scheme from the
+    // directory's name, so a husk with no shared schemes contributes a scheme
+    // named after a project that cannot be opened — which is how `Uwi0/Oakane`
+    // got `IOS_SCHEME: iosApp` as well as `IOS_PROJECT_PATH: iosApp.xcodeproj`.
+    const entries = xcodeContainersIn(root);
     for (const entry of entries) {
         if (!entry.endsWith(".xcodeproj"))
             continue;