@livx.cc/appwrap 0.42.1 → 0.42.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livx.cc/appwrap",
-  "version": "0.42.1",
+  "version": "0.42.3",
   "description": "Wrap any PWA into a native app with native capabilities (appwrap runtime + @livx.cc/native-kit).",
   "license": "MIT",
   "author": "Elya Livshitz",

package/runtime/App_Resources/iOS/PrivacyInfo.xcprivacy

@@ -8,13 +8,16 @@
     - FileTimestamp (C617.1)  — NativeScript reads bundle/app file metadata at runtime
     - SystemBootTime (35F9.1) — NativeScript timers/uptime
     - DiskSpace (E174.1)      — NativeScript file I/O
-  NSPrivacyTracking is false (no IDFA, no cross-app/third-party linkage). The shell surfaces install
-  context for FIRST-PARTY analytics via kit.context():
-    - DeviceID (CRC0)  — identifierForVendor (IDFV), app-scoped, reset on uninstall; NOT IDFA.
-    - ProductInteraction (385F.1) — usage/app-environment props (platform, version, install source).
-  Both are declared NOT linked to identity and NOT used for tracking. If your PWA collects MORE
-  (account, location, contacts) or DOES track (ads/3rd-party linkage), add the matching
-  NSPrivacyCollectedDataTypes / set NSPrivacyTracking=true here — see tracking-analytics + store-readiness.
+  NSPrivacyTracking is false (no IDFA, no cross-app/third-party linkage) and NSPrivacyCollectedDataTypes
+  is EMPTY by default: the stock runtime does NOT collect or transmit any data. kit.context() merely
+  RETURNS install context (IDFV, platform, version) to the app on request — it never sends it anywhere —
+  so the default binary matches a "Data Not Collected" App Store privacy label.
+
+  If YOUR app wires analytics that actually transmits data (DeviceID/IDFV, ProductInteraction, account,
+  location, …) you MUST declare it here — replace this whole file via your app's overrides dir
+  (appwrap.overrides/App_Resources/iOS/PrivacyInfo.xcprivacy). `applyOverrides` copies overrides over
+  the generated native/ last, so your file wins. Add the matching NSPrivacyCollectedDataTypes entries
+  (and set NSPrivacyTracking=true if you track) — see tracking-analytics + store-readiness.
 -->
 <plist version="1.0">
 <dict>
@@ -23,32 +26,7 @@
 	<key>NSPrivacyTrackingDomains</key>
 	<array/>
 	<key>NSPrivacyCollectedDataTypes</key>
-	<array>
-		<dict>
-			<key>NSPrivacyCollectedDataType</key>
-			<string>NSPrivacyCollectedDataTypeDeviceID</string>
-			<key>NSPrivacyCollectedDataTypeLinked</key>
-			<false/>
-			<key>NSPrivacyCollectedDataTypeTracking</key>
-			<false/>
-			<key>NSPrivacyCollectedDataTypePurposes</key>
-			<array>
-				<string>NSPrivacyCollectedDataTypePurposeAnalytics</string>
-			</array>
-		</dict>
-		<dict>
-			<key>NSPrivacyCollectedDataType</key>
-			<string>NSPrivacyCollectedDataTypeProductInteraction</string>
-			<key>NSPrivacyCollectedDataTypeLinked</key>
-			<false/>
-			<key>NSPrivacyCollectedDataTypeTracking</key>
-			<false/>
-			<key>NSPrivacyCollectedDataTypePurposes</key>
-			<array>
-				<string>NSPrivacyCollectedDataTypePurposeAnalytics</string>
-			</array>
-		</dict>
-	</array>
+	<array/>
 	<key>NSPrivacyAccessedAPITypes</key>
 	<array>
 		<dict>

package/src/cli.ts

@@ -592,7 +592,11 @@ function stampTeamId(outDir: string, cfg: AppwrapConfig, ctx?: { cwd: string; co
   writeFileSync(xcconfig, src);
 }
 
-interface ProvProfile { name: string; uuid: string; teamId: string; bundleId: string; exp: number }
+/** Profile kind, derived from the .mobileprovision payload: ProvisionsAllDevices → enterprise;
+ * ProvisionedDevices + get-task-allow → development; ProvisionedDevices w/o it → adhoc; else appstore. */
+type ProvKind = 'development' | 'adhoc' | 'enterprise' | 'appstore';
+
+interface ProvProfile { name: string; uuid: string; teamId: string; bundleId: string; exp: number; kind: ProvKind }
 
 /** Discover provisioning profiles installed on this machine (both the legacy MobileDevice dir and
  * the modern Xcode UserData dir). Each is decoded with `security cms` and reduced to the fields we
@@ -623,7 +627,11 @@ function findProvisioningProfiles(): ProvProfile[] {
         if (!name || !uuid || !team || !appId || byUuid.has(uuid)) continue;
         // application-identifier is `<TEAM>.<bundle.id>`; strip the team prefix to get the bundle id.
         const bundleId = appId.startsWith(team + '.') ? appId.slice(team.length + 1) : appId;
-        byUuid.set(uuid, { name, uuid, teamId: team, bundleId, exp: expStr ? Date.parse(expStr) : 0 });
+        const kind: ProvKind = /<key>ProvisionsAllDevices<\/key>\s*<true\s*\/>/.test(raw) ? 'enterprise'
+          : /<key>ProvisionedDevices<\/key>/.test(raw)
+            ? (/<key>get-task-allow<\/key>\s*<true\s*\/>/.test(raw) ? 'development' : 'adhoc')
+            : 'appstore';
+        byUuid.set(uuid, { name, uuid, teamId: team, bundleId, exp: expStr ? Date.parse(expStr) : 0, kind });
       } catch { /* skip unreadable profile */ }
     }
   }
@@ -635,10 +643,14 @@ function findProvisioningProfiles(): ProvProfile[] {
  * pinned) → newest-expiry (headless). Returns null when nothing matches (caller warns + skips). */
 function selectSigningProfile(
   profiles: ProvProfile[], teamId: string, bundleId: string, cfg: AppwrapConfig,
-  ctx?: { configPath: string },
+  ctx?: { configPath: string }, kind: ProvKind | 'device' = 'device',
 ): string | null {
   const now = Date.now();
-  const matches = profiles.filter((p) => p.teamId === teamId && p.bundleId === bundleId && p.exp > now);
+  // 'appstore' (store archive) must sign with an App Store distribution profile; 'device' (deploy)
+  // must NOT — an appstore profile can't install on a device. Filtering here is what keeps ONE
+  // signingProfiles pin map safe: a pin of the wrong kind simply doesn't match this lane.
+  const kindOk = (p: ProvProfile): boolean => (kind === 'device' ? p.kind !== 'appstore' : p.kind === kind);
+  const matches = profiles.filter((p) => p.teamId === teamId && p.bundleId === bundleId && p.exp > now && kindOk(p));
   if (matches.length === 0) return null;
   const pinned = cfg.signingProfiles?.[bundleId];
   if (pinned && matches.some((p) => p.name === pinned)) return pinned;
@@ -678,14 +690,31 @@ function stampManualSigning(outDir: string, cfg: AppwrapConfig, ctx?: { configPa
     console.warn('  ⚠ signing: manual but teamId is unset — skipping manual signing.');
     return;
   }
+  // Store archives (`appwrap build ios --release`) sign with App Store distribution profiles +
+  // "Apple Distribution"; device deploys with development/adhoc profiles + "Apple Development".
+  // A signing-DISABLED archive that's re-signed at exportArchive gets its entitlements SYNTHESIZED
+  // from the profile (dropping app.entitlements — e.g. declared-age-range); signing the archive
+  // itself is what preserves them, so the store lane rides this same manual stamp.
+  const kind: ProvKind | 'device' = process.env.APPWRAP_SIGNING_KIND === 'appstore' ? 'appstore' : 'device';
+  const identity = kind === 'appstore' ? 'Apple Distribution' : 'Apple Development';
+  // Don't pin interactive picks from the store lane — the single signingProfiles map is keyed by
+  // bundle id only, so a store pin would clobber the device pin (and vice versa).
+  const pinCtx = kind === 'device' ? ctx : undefined;
   const profiles = findProvisioningProfiles();
   let mainProvision: string | null = null;
 
   // Main app target → build.xcconfig.
   const xcconfig = join(outDir, 'App_Resources/iOS/build.xcconfig');
   if (existsSync(xcconfig)) {
-    const name = selectSigningProfile(profiles, teamId, cfg.id, cfg, ctx);
+    const name = selectSigningProfile(profiles, teamId, cfg.id, cfg, pinCtx, kind);
     if (!name) {
+      // Store lane must NOT fall through to automatic signing: an unsigned archive gets its
+      // entitlements re-synthesized from the profile at export, silently dropping any
+      // config-stamped entitlement (the declared-age-range failure this lane exists to prevent).
+      if (kind === 'appstore') {
+        console.error(`  ✗ no valid App Store distribution profile for ${cfg.id} (team ${teamId}). Install one (ASC → Profiles) or seed via Xcode, then retry.`);
+        process.exit(1);
+      }
       console.warn(`  ⚠ no valid profile for ${cfg.id} (team ${teamId}) — automatic signing will run. Install one or seed via Xcode.`);
     } else {
       mainProvision = name;
@@ -696,10 +725,10 @@ function stampManualSigning(outDir: string, cfg: AppwrapConfig, ctx?: { configPa
           ? s.replace(new RegExp(`^\\s*${key}\\s*=\\s*[^;\\n]*;?`, 'm'), `${key} = ${val};`)
           : s + `\n${key} = ${val};`;
       src = setKey(src, 'CODE_SIGN_STYLE', 'Manual');
-      src = setKey(src, 'CODE_SIGN_IDENTITY', 'Apple Development');
+      src = setKey(src, 'CODE_SIGN_IDENTITY', identity);
       src = setKey(src, 'PROVISIONING_PROFILE_SPECIFIER', name);
       writeFileSync(xcconfig, src.endsWith('\n') ? src : src + '\n');
-      console.log(`  sign ← ${cfg.id} → "${name}" (manual)`);
+      console.log(`  sign ← ${cfg.id} → "${name}" (manual, ${identity})`);
     }
   }
 
@@ -715,7 +744,7 @@ function stampManualSigning(outDir: string, cfg: AppwrapConfig, ctx?: { configPa
       if (!ext.isDirectory()) continue;
       if (!existsSync(join(extRoot, ext.name, 'extension.json'))) continue;
       const extBundle = `${cfg.id}.${ext.name}`;
-      const name = selectSigningProfile(profiles, teamId, extBundle, cfg, ctx);
+      const name = selectSigningProfile(profiles, teamId, extBundle, cfg, pinCtx, kind);
       if (!name) { console.warn(`  ⚠ no valid profile for extension ${extBundle} — it may fail to sign.`); continue; }
       extEntries.push({ bundleId: extBundle, profile: name });
       console.log(`  sign ← ${extBundle} → "${name}" (manual, via hook)`);
@@ -725,7 +754,7 @@ function stampManualSigning(outDir: string, cfg: AppwrapConfig, ctx?: { configPa
   const hookFile = join(hookDir, 'appwrap-signing.js');
   if (extEntries.length) {
     mkdirSync(hookDir, { recursive: true });
-    writeFileSync(hookFile, SIGNING_HOOK(teamId, extEntries));
+    writeFileSync(hookFile, SIGNING_HOOK(teamId, extEntries, identity));
     // NS's exportOptions reads extension profiles from this file (extensions/provisioning.json) —
     // it maps each extension bundle id → profile name so `xcodebuild -exportArchive` can build the .ipa.
     writeFileSync(join(extRoot, 'provisioning.json'),
@@ -751,11 +780,12 @@ function stampManualSigning(outDir: string, cfg: AppwrapConfig, ctx?: { configPa
  * Self-contained (no deps), zero-arg (NS DI won't choke). Per extension it upserts DEVELOPMENT_TEAM,
  * PROVISIONING_PROFILE_SPECIFIER, CODE_SIGN_STYLE=Manual, CODE_SIGN_IDENTITY in every buildSettings
  * block whose PRODUCT_BUNDLE_IDENTIFIER matches the extension's bundle id. */
-const SIGNING_HOOK = (team: string, entries: Array<{ bundleId: string; profile: string }>) => `// Generated by \`appwrap\` — stamps manual signing onto extension targets in project.pbxproj.
+const SIGNING_HOOK = (team: string, entries: Array<{ bundleId: string; profile: string }>, identity = 'Apple Development') => `// Generated by \`appwrap\` — stamps manual signing onto extension targets in project.pbxproj.
 const fs = require('fs');
 const path = require('path');
 const TEAM = ${JSON.stringify(team)};
 const ENTRIES = ${JSON.stringify(entries)};
+const IDENTITY = ${JSON.stringify(identity)};
 module.exports = function () {
   const iosDir = path.join(__dirname, '..', '..', 'platforms', 'ios');
   if (!fs.existsSync(iosDir)) return;
@@ -781,7 +811,7 @@ module.exports = function () {
       block = block.replace(/^\\s*PROVISIONING_PROFILE\\s*=\\s*[^;\\n]*;\\n?/m, '');
       block = upsert(block, 'CODE_SIGN_STYLE', 'Manual');
       block = upsert(block, 'DEVELOPMENT_TEAM', TEAM);
-      block = upsert(block, 'CODE_SIGN_IDENTITY', q('Apple Development'));
+      block = upsert(block, 'CODE_SIGN_IDENTITY', q(IDENTITY));
       block = upsert(block, 'PROVISIONING_PROFILE_SPECIFIER', q(profile));
       return block;
     });
@@ -1275,10 +1305,18 @@ function stampVersionManifest(outDir: string, cfg: AppwrapConfig): void {
 
 /** Pure-native escape hatch: copy the consumer's overrides dir OVER the generated wrapper, last,
  * so it wins. For legacy/custom native code the declarative config can't express. */
-function applyOverrides(cwd: string, outDir: string, cfg: AppwrapConfig): void {
+export function applyOverrides(cwd: string, outDir: string, cfg: AppwrapConfig): void {
   const dir = resolve(cwd, cfg.overrides ?? 'appwrap.overrides');
-  if (!existsSync(dir)) return;
+  // Files the template still provides must survive an override removal (regenerateCore ran first and
+  // re-copied them) → protect them from the override prune.
+  const templateFiles = existsSync(TEMPLATE_DIR) ? collectRelFiles(TEMPLATE_DIR, templateCopyFilter) : new Set<string>();
+  if (!existsSync(dir)) {
+    // No overrides now: prune anything a PRIOR overrides run left behind (renamed/removed override files).
+    pruneStale(outDir, OVERRIDES_MANIFEST, new Set(), templateFiles);
+    return;
+  }
   cpSync(dir, outDir, { recursive: true, force: true });
+  pruneStale(outDir, OVERRIDES_MANIFEST, collectRelFiles(dir), templateFiles);
   console.log(`  over ← ${dir} (native overrides applied)`);
 }
 
@@ -1422,6 +1460,54 @@ function copyCiTemplates(cwd: string, outDir: string, cfg: AppwrapConfig, force
   console.log(ci);
 }
 
+// Manifests of what the two sync-owned sources (runtime template, consumer overrides) generated LAST run.
+// Used to prune files that were REMOVED/renamed in the source — cpSync(force) overwrites but never deletes,
+// so without this a relocated source lingers in native/ and gets re-bundled.
+const TEMPLATE_MANIFEST = '.appwrap-template-manifest.json';
+const OVERRIDES_MANIFEST = '.appwrap-overrides-manifest.json';
+
+/** Files under TEMPLATE_DIR to skip when copying/walking it (deps, build output, PWA staging, per-module
+ * native — those are handled selectively elsewhere). Shared by the cpSync filter and the prune walk so
+ * the copied set and the pruned set are defined identically. */
+const templateCopyFilter = (src: string): boolean =>
+  !/(?:^|\/)(node_modules|platforms|hooks|app\/www|modules-native)(\/|$)/.test(src.slice(TEMPLATE_DIR.length));
+
+/** File (not dir) paths under `root`, relative to it, skipping entries `accept` rejects. */
+function collectRelFiles(root: string, accept: (abs: string) => boolean = () => true): Set<string> {
+  const out = new Set<string>();
+  const rec = (dir: string, rel: string): void => {
+    let entries;
+    try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      const abs = join(dir, e.name);
+      if (!accept(abs)) continue;
+      const r = rel ? `${rel}/${e.name}` : e.name;
+      if (e.isDirectory()) rec(abs, r);
+      else out.add(r);
+    }
+  };
+  rec(root, '');
+  return out;
+}
+
+/** Prune generated files sync OWNS that vanished from their source. Deletes only paths recorded in the
+ * PRIOR manifest that are absent from the `current` source set — so it never touches user data or any
+ * region absent from a previous run's manifest. `protect` keeps paths another owned source still ships
+ * (e.g. an override was removed but the template still provides that file). */
+function pruneStale(outDir: string, manifest: string, current: Set<string>, protect?: Set<string>): void {
+  const mf = join(outDir, manifest);
+  let prev: string[] = [];
+  try { prev = JSON.parse(readFileSync(mf, 'utf8')) as string[]; } catch { /* first run — nothing to prune */ }
+  for (const rel of prev) {
+    if (current.has(rel) || protect?.has(rel)) continue;
+    const abs = join(outDir, rel);
+    try {
+      if (existsSync(abs)) { rmSync(abs, { force: true }); console.log(`  prune ✕ ${rel} (removed from source)`); }
+    } catch { /* non-fatal */ }
+  }
+  try { writeFileSync(mf, JSON.stringify([...current])); } catch { /* non-fatal */ }
+}
+
 /**
  * Reproduce native/ from source — the shared core of `init` and `sync`. Copies the runtime shell
  * template, re-stamps EVERY config artifact, and re-copies the built PWA. `native/` is disposable, so a
@@ -1441,8 +1527,10 @@ function regenerateCore(cwd: string, outDir: string, cfg: AppwrapConfig, opts: {
     // modules-native/ is copied selectively per active module (copyModuleNativeSrc), not wholesale.
     // Match RELATIVE to TEMPLATE_DIR — when installed from npm, TEMPLATE_DIR itself sits under
     // node_modules/, so testing the absolute path would wrongly exclude the entire template.
-    filter: (src) => !/(?:^|\/)(node_modules|platforms|hooks|app\/www|modules-native)(\/|$)/.test(src.slice(TEMPLATE_DIR.length)),
+    filter: templateCopyFilter,
   });
+  // Delete template files removed/renamed since the last regenerate (cpSync only overwrites, never deletes).
+  pruneStale(outDir, TEMPLATE_MANIFEST, collectRelFiles(TEMPLATE_DIR, templateCopyFilter));
   stampShellConfig(outDir, cfg);
   stampNativeScriptConfig(outDir, cfg);
   stampIOSDisplayName(outDir, cfg, req);
@@ -1860,13 +1948,29 @@ async function build(cwd: string, flags: Record<string, string>, positionals: st
     console.error(`✖ ${(e as Error).message}`);
     process.exit(1);
   }
+  const release = 'release' in flags;
+  // iOS release archive = the STORE artifact. With signing:'manual', stamp App Store distribution
+  // signing (profile kind 'appstore' + "Apple Distribution") so xcodebuild archives a SIGNED binary —
+  // an unsigned archive re-signed at exportArchive gets its entitlements SYNTHESIZED from the
+  // provisioning profile, silently dropping app.entitlements (e.g. declared-age-range).
+  if (platform === 'ios' && release) process.env.APPWRAP_SIGNING_KIND = 'appstore';
   // Make sure the wrapper reflects the latest config + PWA before compiling (also validates the config).
   await sync(cwd, flags);
 
-  const release = 'release' in flags;
   const args = ['build', platform];
   if (release) args.push('--release');
-  if (platform === 'ios' && release) args.push('--for-device');
+  if (platform === 'ios' && release) {
+    args.push('--for-device');
+    // Manual signing: pass the resolved App Store profile so NS emits a manual exportOptions.plist
+    // (app + extensions via extensions/provisioning.json) for `xcodebuild -exportArchive`. The export
+    // method comes from the archive's embedded profile (Distribution → app-store), so this yields a
+    // store .ipa whose entitlements are the archive's own (app.entitlements intact).
+    const sidecar = join(outDir, '.appwrap-signing.json');
+    if (existsSync(sidecar)) {
+      const sc = JSON.parse(readFileSync(sidecar, 'utf8')) as { provision?: string };
+      if (sc.provision) args.push('--provision', sc.provision);
+    }
+  }
   if (platform === 'android' && 'aab' in flags) args.push('--aab');
 
   if (platform === 'android' && release) {
@@ -1891,7 +1995,8 @@ async function build(cwd: string, flags: Record<string, string>, positionals: st
   console.log(`▶ ns ${args.join(' ').replace(/(--key-store-password|--key-store-alias-password) [^ ]*/g, '$1 ****')}  (cwd: ${outDir})`);
   execFileSync('ns', args, { cwd: outDir, stdio: 'inherit' });
   if (platform === 'ios' && release) {
-    console.log('ℹ App Store distribution (archive + upload) goes through the fastlane release lane (native/fastlane) — needs a paid team + ASC API key.');
+    const ipa = join(outDir, 'platforms/ios/build/Release-iphoneos');
+    console.log(`ℹ Signed store .ipa in ${ipa} — upload via \`bunx @livx.cc/mcp-appstores apple-upload\` or the fastlane release lane (native/fastlane).`);
   }
 }
 
@@ -2176,7 +2281,7 @@ function pinTeamIdToConfig(configPath: string, teamId: string): void {
  * App_Resources/ is intentionally excluded — sync() rewrites it every run, so its mtime always
  * changes and would make the fingerprint permanently stale.
  * Collision risk is acceptable — a false "match" just skips a redundant build, not a correctness bug. */
-function buildFingerprint(cwd: string, cfg: { pwaDist?: string }, _outDir: string): string {
+export function buildFingerprint(cwd: string, cfg: { pwaDist?: string; overrides?: string }, flags: Record<string, string> = {}): string {
   const mtime = (p: string): number => {
     if (!existsSync(p)) return 0;
     try {
@@ -2190,8 +2295,12 @@ function buildFingerprint(cwd: string, cfg: { pwaDist?: string }, _outDir: strin
       return s.mtimeMs;
     } catch { return 0; }
   };
+  // Fingerprint EVERY app source the build actually consumes — not just dist. Missing the overrides dir
+  // (native escape hatch) or a `.js`/`.json`/`--config` config file made edits there produce a stale
+  // "inputs unchanged" skip. Resolve the real config path (ts→js→json / --config) instead of hardcoding.
   const distDir = cfg.pwaDist ? resolve(cwd, cfg.pwaDist) : join(cwd, 'dist');
-  const parts = [mtime(distDir), mtime(join(cwd, 'appwrap.config.ts'))];
+  const overridesDir = resolve(cwd, cfg.overrides ?? 'appwrap.overrides');
+  const parts = [mtime(distDir), mtime(overridesDir), mtime(resolveConfigPath(cwd, flags))];
   // Simple djb2-style hash — good enough for a build-skip check (not cryptographic).
   let h = 5381;
   for (const n of parts) h = (((h << 5) + h) ^ (n | 0)) >>> 0;
@@ -2499,7 +2608,7 @@ async function deployAndroid(cwd: string, flags: Record<string, string>, cfgOver
   // unchanged since the last build. --force/-f always rebuilds. (Rebuilding the web above usually
   // bumps the fingerprint; pair with --no-web-build to actually hit this fast-path.)
   const force = 'force' in flags || 'f' in flags;
-  const fp = buildFingerprint(cwd, cfg, outDir);
+  const fp = buildFingerprint(cwd, cfg, flags);
   const cache = readBuildCache(outDir, 'android');
   if (!force && existsSync(apk) && cache?.fingerprint === fp && cache?.artifactPath === apk) {
     console.log(`⚡ Skipping build — inputs unchanged since last build (${apk.split('/').pop()})`);
@@ -2577,7 +2686,7 @@ async function deploy(cwd: string, flags: Record<string, string>, positionals: s
   // Auto: always checks fingerprint; never skips if sources/deps changed.
   const resume = 'resume' in flags || 'r' in flags;
   const force = 'force' in flags || 'f' in flags;
-  const fp = buildFingerprint(cwd, cfg, outDir);
+  const fp = buildFingerprint(cwd, cfg, flags);
   const cache = readBuildCache(outDir, 'ios');
   const existingIpa = existsSync(ipaDir)
     ? readdirSync(ipaDir).find((f) => f.endsWith('.ipa'))