@lowdefy/shell 3.23.2 → 7.2.0

package/app.config.ts

@@ -0,0 +1,183 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { execFileSync } from 'node:child_process';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+
+import type { ConfigContext, ExpoConfig } from 'expo/config';
+
+import { getAppLinkIntentFilters, getAssociatedDomains } from './appLinks.js';
+import applyShellPlugins from './applyShellPlugins.js';
+import { getAuthCallbackIntentFilters } from './authCallbackIntentFilters.js';
+import checkShellPlugins from './checkShellPlugins.js';
+import getPrivacyManifest from './getPrivacyManifest.js';
+import { pluginName } from './profiles.js';
+import readShellConfig from './readShellConfig.js';
+import resolveShellPlugins from './resolveShellPlugins.js';
+import getRuntimeVersion from './runtimeVersion.js';
+import { getExclusions, getShellProfile, getShellVariant } from './shellVariant.js';
+import withExcludedNativeModules from './withExcludedNativeModules.js';
+
+// The shell's config is its shell.json (readShellConfig.js). Its capability profile is added here,
+// at build, so the app reads one object (src/config/getShellConfig.js). The shell's version and
+// type manifest are not: they travel in the JavaScript bundle (src/version/shellVersion.js,
+// src/plugins/typeManifest.js), since an embedded launch reads the Expo config of the native build,
+// not that of the JavaScript it runs.
+//
+// Three versions: `version` is the store version (shell.json `version`, set per build by
+// `lowdefy mobile`), kept out of `extra.shell`; the shell version is the @lowdefy/shell package
+// version, which the runtime sends as `x-lowdefy-shell`; `runtimeVersion` is
+// `<nativeVersion>-<profile>[-<plugins hash>]` (runtimeVersion.js), which decides which
+// over-the-air updates a binary takes.
+const shellRoot = __dirname;
+
+function readJson(filePath: string) {
+  return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+}
+
+// The shell's icon (shell.json `icon`, a 1024×1024 PNG, relative to shell.json) and its Android
+// adaptive-icon foreground: the icon padded into the launcher's safe zone, written beside shell.json
+// once per icon (scripts/createShellAssets.mjs) and reused while the icon is unchanged.
+function createShellIcons({ configPath, shell }) {
+  const directory = path.dirname(configPath);
+  const icon = path.resolve(directory, shell.icon);
+  const iconHash = crypto
+    .createHash('sha256')
+    .update(fs.readFileSync(icon))
+    .digest('hex')
+    .slice(0, 12);
+  const adaptiveForeground = path.join(directory, `adaptive-icon-${iconHash}.png`);
+  if (!fs.existsSync(adaptiveForeground)) {
+    execFileSync(process.execPath, [
+      path.join(shellRoot, 'scripts/createShellAssets.mjs'),
+      icon,
+      adaptiveForeground,
+    ]);
+  }
+  return { adaptiveForeground, icon };
+}
+
+// The splash shows the shell's icon on its colour.
+function withSplash({ color, icon, plugins }) {
+  return plugins.map((plugin) =>
+    pluginName(plugin) === 'expo-splash-screen'
+      ? ['expo-splash-screen', { image: icon, imageWidth: 200, backgroundColor: color }]
+      : plugin
+  );
+}
+
+export default function appConfig({ config }: ConfigContext): ExpoConfig {
+  const { configPath, shell } = readShellConfig();
+  const { version: storeVersion, ...shellExtra } = shell;
+  const variant = getShellVariant();
+  const { nativeVersion } = readJson(path.join(shellRoot, 'package.json'));
+  // The shell carries only its capability profile's native modules (profiles.js). The rest, and
+  // Lowdefy Dev's developer features in a release shell, are left out: not linked, their config
+  // plugins and permissions not applied (scripts/checkReleaseBundle.mjs checks it).
+  // Its shell plugins (shell.json `plugins`, installed in the shell project by `lowdefy mobile
+  // config`) add their own modules, config plugins, permissions, privacy reasons and data on top.
+  // Their modules are never excluded: the exclusions name only modules of the shell's own profiles.
+  const shellPlugins = resolveShellPlugins({
+    shell,
+    require: createRequire(path.join(shellRoot, 'package.json')),
+  });
+  checkShellPlugins({ shell, variant, plugins: shellPlugins });
+  const profile = applyShellPlugins({
+    profile: getShellProfile({ shell, variant }),
+    plugins: shellPlugins,
+  });
+  const excluded = getExclusions({ shell, variant });
+  // Lowdefy Dev has no icon of its own and keeps Expo's.
+  const icons = shell.icon === undefined ? null : createShellIcons({ configPath, shell });
+  const color = shell.color ?? '#FFFFFF';
+  const appConfigResult: ExpoConfig = {
+    ...config,
+    name: shell.name,
+    slug: shell.id,
+    // Lowdefy Dev has no store version of its own here.
+    version: storeVersion ?? '0.0.0',
+    runtimeVersion: getRuntimeVersion({
+      nativeVersion,
+      profile: profile.name,
+      plugins: shell.plugins,
+      extensions: shell.extensions,
+    }),
+    platforms: ['ios', 'android'],
+    scheme: shell.scheme,
+    orientation: 'default',
+    userInterfaceStyle: 'automatic',
+    ...(icons ? { icon: icons.icon } : {}),
+    ios: {
+      bundleIdentifier: shell.ios?.bundleIdentifier,
+      supportsTablet: true,
+      // The shell uses only the encryption the OS provides (HTTPS, the Keychain), so App Store
+      // Connect asks no export compliance question on upload.
+      config: { usesNonExemptEncryption: false },
+      // The profile's purpose texts no config plugin writes (profiles.js `infoPlist`).
+      // expo-dev-menu's floating tools button sits over the header's trailing actions in a
+      // development build; the dev menu stays a shake away (DevMenuPreferences.swift reads this).
+      infoPlist: { ...profile.infoPlist, EXDevMenuShowFloatingActionButton: false },
+      // Links to the app's pages open in the shell (appLinks.js).
+      associatedDomains: getAssociatedDomains({ shell }),
+      privacyManifests: getPrivacyManifest({ privacyReasons: profile.privacyReasons }),
+    },
+    android: {
+      package: shell.android?.package,
+      ...(icons
+        ? { adaptiveIcon: { foregroundImage: icons.adaptiveForeground, backgroundColor: color } }
+        : {}),
+      // The sign-in sheet returns by a verified app link on Android (src/auth/signInWithSheet.js).
+      // Links to the app's pages open in the shell too (appLinks.js).
+      intentFilters: [
+        ...getAuthCallbackIntentFilters({ shell }),
+        ...getAppLinkIntentFilters({ shell }),
+      ],
+      // Google Maps draws the Map block on Android. Its key is a build secret, never in
+      // lowdefy.yaml or the bundle.
+      ...(profile.capabilities.includes('maps') && process.env.LOWDEFY_GOOGLE_MAPS_API_KEY
+        ? { config: { googleMaps: { apiKey: process.env.LOWDEFY_GOOGLE_MAPS_API_KEY } } }
+        : {}),
+      blockedPermissions: excluded.permissions.filter((permission) =>
+        permission.startsWith('android.permission.')
+      ),
+    },
+    plugins: icons
+      ? withSplash({ color, icon: icons.icon, plugins: profile.plugins })
+      : profile.plugins,
+    // A shell built for the stores is its own EAS project, which serves its over-the-air updates.
+    // Lowdefy Dev's shell.dev.json has none.
+    ...(shell.eas
+      ? {
+          owner: shell.eas.owner,
+          updates: { url: `https://u.expo.dev/${shell.eas.projectId}` },
+        }
+      : {}),
+    extra: {
+      ...(shell.eas ? { eas: { projectId: shell.eas.projectId } } : {}),
+      shell: {
+        ...shellExtra,
+        profile: profile.name,
+        // The profile's and its extensions' capabilities, with any shell.json lists beside them.
+        capabilities: [...new Set([...(shell.capabilities ?? []), ...profile.capabilities])],
+        variant,
+      },
+    },
+  };
+  return withExcludedNativeModules(appConfigResult, Object.keys(excluded.modules));
+}

package/appLinks.js

@@ -0,0 +1,65 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// The app's links that open in the shell: https links to any page of the app (universal links on
+// iOS, verified app links on Android). The server's apple-app-site-association and assetlinks.json
+// name the shell for every page path under basePath and leave /api to the server; the shell
+// declares the domain (iOS) and the host and path prefix (Android) of its app's url for its
+// environment. Both platforms verify https links only, so an http url (a local dev server) gets
+// none.
+function getAppUrl({ shell }) {
+  const url = shell.app.urls[shell.environment];
+  if (!url.startsWith('https://')) {
+    return null;
+  }
+  return new URL(url);
+}
+
+// iOS: the Associated Domains entitlement, `applinks:<host>` (with its port when it has one).
+function getAssociatedDomains({ shell }) {
+  const url = getAppUrl({ shell });
+  if (url === null) {
+    return [];
+  }
+  return [`applinks:${url.host}`];
+}
+
+// Android: one autoVerify filter for the app's host under its basePath. The sign-in callback has its
+// own filter (authCallbackIntentFilters.js); the router hands that path to the sign-in sheet.
+function getAppLinkIntentFilters({ shell }) {
+  const url = getAppUrl({ shell });
+  if (url === null) {
+    return [];
+  }
+  const basePath = url.pathname.replace(/\/$/, '');
+  const data = { scheme: 'https', host: url.hostname };
+  if (basePath !== '') {
+    data.pathPrefix = basePath;
+  }
+  if (url.port !== '') {
+    data.port = url.port;
+  }
+  return [
+    {
+      action: 'VIEW',
+      autoVerify: true,
+      data: [data],
+      category: ['BROWSABLE', 'DEFAULT'],
+    },
+  ];
+}
+
+module.exports = { getAppLinkIntentFilters, getAssociatedDomains };

package/applyShellPlugins.js

@@ -0,0 +1,43 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+const { mergeProfiles } = require('./profiles.js');
+
+/**
+ * A shell's resolved profile with its plugins' `./shell` entries folded in (resolveShellPlugins.js):
+ * their capabilities, modules, config plugins, permissions, privacy reasons and data join the
+ * profile's. The profile keeps its name, and its JavaScript entries are its own.
+ *
+ * @param {Object} params
+ * @param {Object} params.profile The shell's resolved profile (getShellProfile in shellVariant.js).
+ * @param {{ entry: Object }[]} params.plugins The resolved shell plugins.
+ */
+function applyShellPlugins({ profile, plugins }) {
+  return plugins.reduce(
+    (merged, { entry }) =>
+      mergeProfiles(merged, {
+        capabilities: entry.capabilities,
+        modules: entry.modules,
+        plugins: entry.plugins,
+        permissions: entry.permissions,
+        privacyReasons: entry.privacyReasons,
+        dataCollected: entry.dataCollected,
+      }),
+    profile
+  );
+}
+
+module.exports = applyShellPlugins;

package/authCallbackIntentFilters.js

@@ -0,0 +1,46 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// The Android app link the sign-in sheet returns by: the app server sends the one-time token to
+// https://<app domain><basePath>/auth/mobile/callback, and Android opens that link only in the
+// shell the app's assetlinks.json names (autoVerify), never in another app. A shell opens one app
+// (checkShellConfig), so there is one filter, at the app's url for the shell's environment.
+// Android verifies https links only, so an http url (a local dev server) gets none.
+function getAuthCallbackIntentFilters({ shell }) {
+  const url = shell.app.urls[shell.environment];
+  if (!url.startsWith('https://')) {
+    return [];
+  }
+  const { hostname, pathname, port } = new URL(url);
+  const data = {
+    scheme: 'https',
+    host: hostname,
+    pathPrefix: `${pathname.replace(/\/$/, '')}/auth/mobile/callback`,
+  };
+  if (port !== '') {
+    data.port = port;
+  }
+  return [
+    {
+      action: 'VIEW',
+      autoVerify: true,
+      data: [data],
+      category: ['BROWSABLE', 'DEFAULT'],
+    },
+  ];
+}
+
+module.exports = { getAuthCallbackIntentFilters };

package/babel.config.js

@@ -0,0 +1,25 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// intl-messageformat (through @lowdefy/helpers translate) ships static class blocks, which
+// babel-preset-expo leaves alone; Metro and Jest transform node_modules with this config too.
+module.exports = function babelConfig(api) {
+  api.cache(true);
+  return {
+    presets: ['babel-preset-expo'],
+    plugins: ['@babel/plugin-transform-class-static-block'],
+  };
+};

package/checkShellConfig.js

@@ -0,0 +1,172 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+const { EXTENSIONS } = require('./profiles.js');
+
+function isObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+// A shell opens exactly one Lowdefy app: every app's `_js` runs in the shell's one JavaScript realm,
+// so two apps in one shell would share its session tokens, storage and cache. app.config.ts (and
+// so `expo prebuild` and `expo export`) refuses a shell.json that lists `apps`, or that does not
+// name one app with a url for the shell's environment.
+function checkShellConfig({ configPath, shell }) {
+  const where = `Shell config "${configPath}"`;
+  if (!isObject(shell)) {
+    throw new Error(`${where} should be an object.`);
+  }
+  if (Object.prototype.hasOwnProperty.call(shell, 'apps')) {
+    throw new Error(
+      `${where} lists "apps". A shell opens exactly one app: replace "apps" with "app": { id, name, urls: { <environment>: url } }.`
+    );
+  }
+  if (Array.isArray(shell.app)) {
+    throw new Error(
+      `${where} names ${shell.app.length} apps in "app". A shell opens exactly one app: "app" should be one { id, name, urls } object.`
+    );
+  }
+  if (!isObject(shell.app)) {
+    throw new Error(
+      `${where} should name the app it opens as "app": { id, name, urls: { <environment>: url } }. Received ${JSON.stringify(
+        shell.app
+      )}.`
+    );
+  }
+  if (typeof shell.app.id !== 'string' || shell.app.id.length === 0) {
+    throw new Error(
+      `${where} "app.id" should be a string. Received ${JSON.stringify(shell.app.id)}.`
+    );
+  }
+  const url = isObject(shell.app.urls) ? shell.app.urls[shell.environment] : undefined;
+  if (typeof url !== 'string' || url.length === 0) {
+    throw new Error(
+      `${where} "app.urls" should have a url for the shell's environment "${
+        shell.environment
+      }". Received ${JSON.stringify(shell.app.urls)}.`
+    );
+  }
+  // The shell reads the server's origin from this url (src/host/getOrigin.js).
+  if (!/^[a-z][a-z0-9+.-]*:\/\/[^/?#]+/i.test(url)) {
+    throw new Error(
+      `${where} "app.urls.${
+        shell.environment
+      }" should be an absolute URL, like "https://app.example.com". Received ${JSON.stringify(
+        url
+      )}.`
+    );
+  }
+  if (shell.profile !== undefined && typeof shell.profile !== 'string') {
+    throw new Error(
+      `${where} "profile" should be the name of a capability profile. Received ${JSON.stringify(
+        shell.profile
+      )}.`
+    );
+  }
+  // The store version, major.minor.patch; `lowdefy mobile build` sets the patch.
+  if (shell.version !== undefined && typeof shell.version !== 'string') {
+    throw new Error(
+      `${where} "version" should be a string. Received ${JSON.stringify(shell.version)}.`
+    );
+  }
+  // The icon is a path relative to shell.json; `lowdefy mobile config` copies it there.
+  if (shell.icon !== undefined && (typeof shell.icon !== 'string' || shell.icon.length === 0)) {
+    throw new Error(
+      `${where} "icon" should be the path of a PNG, relative to the shell config. Received ${JSON.stringify(
+        shell.icon
+      )}.`
+    );
+  }
+  if (shell.color !== undefined && !/^#[0-9a-fA-F]{6}$/.test(shell.color)) {
+    throw new Error(
+      `${where} "color" should be a colour like "#0B5FFF". Received ${JSON.stringify(shell.color)}.`
+    );
+  }
+  if (shell.eas !== undefined) {
+    if (!isObject(shell.eas) || typeof shell.eas.projectId !== 'string') {
+      throw new Error(
+        `${where} "eas" should be { owner, projectId }, the shell's Expo account and project. Received ${JSON.stringify(
+          shell.eas
+        )}.`
+      );
+    }
+    if (shell.eas.owner !== undefined && typeof shell.eas.owner !== 'string') {
+      throw new Error(
+        `${where} "eas.owner" should be a string. Received ${JSON.stringify(shell.eas.owner)}.`
+      );
+    }
+  }
+  // The opt-in extensions (EXTENSIONS in profiles.js), each named once.
+  if (shell.extensions !== undefined) {
+    const known = Object.keys(EXTENSIONS);
+    if (
+      !Array.isArray(shell.extensions) ||
+      !shell.extensions.every((name) => known.includes(name)) ||
+      new Set(shell.extensions).size !== shell.extensions.length
+    ) {
+      throw new Error(
+        `${where} "extensions" should list each of ${known.join(
+          ', '
+        )} at most once. Received ${JSON.stringify(shell.extensions)}.`
+      );
+    }
+  }
+  // The shell plugins `lowdefy mobile config` installs into the shell project
+  // (resolveShellPlugins.js).
+  if (shell.plugins !== undefined) {
+    checkPlugins({ plugins: shell.plugins, where });
+  }
+  return shell;
+}
+
+function checkPlugins({ plugins, where }) {
+  if (!Array.isArray(plugins)) {
+    throw new Error(
+      `${where} "plugins" should be an array of { name, version, typePrefix?, options? }. Received ${JSON.stringify(
+        plugins
+      )}.`
+    );
+  }
+  plugins.forEach((plugin, index) => {
+    const at = `${where} "plugins[${index}]"`;
+    if (!isObject(plugin)) {
+      throw new Error(
+        `${at} should be { name, version, typePrefix?, options? }. Received ${JSON.stringify(
+          plugin
+        )}.`
+      );
+    }
+    ['name', 'version'].forEach((key) => {
+      if (typeof plugin[key] !== 'string' || plugin[key].length === 0) {
+        throw new Error(
+          `${at} "${key}" should be a string. Received ${JSON.stringify(plugin[key])}.`
+        );
+      }
+    });
+    if (plugin.typePrefix !== undefined && typeof plugin.typePrefix !== 'string') {
+      throw new Error(
+        `${at} "typePrefix" should be a string. Received ${JSON.stringify(plugin.typePrefix)}.`
+      );
+    }
+    if (plugin.options !== undefined && !isObject(plugin.options)) {
+      throw new Error(
+        `${at} "options" should be an object. Received ${JSON.stringify(plugin.options)}.`
+      );
+    }
+  });
+}
+
+module.exports = checkShellConfig;

package/checkShellPlugins.js

@@ -0,0 +1,74 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+const { PROFILES, RELEASE_PROFILES, resolveProfile } = require('./profiles.js');
+const { getProfileName, getShellProfile } = require('./shellVariant.js');
+
+// Release profiles first, lowest first, so an error names the smallest profile a shell can pick.
+const PROFILE_ORDER = [
+  ...RELEASE_PROFILES,
+  ...Object.keys(PROFILES).filter((name) => !RELEASE_PROFILES.includes(name)),
+];
+
+function findProfile(carries) {
+  return PROFILE_ORDER.find((name) => carries(resolveProfile(name)));
+}
+
+/**
+ * Refuses shell plugins that would carry native code around the capability profiles, so plugins
+ * never become a way past profile review. Throws, naming the plugin and the profile to pick, when
+ * a plugin's `./shell` entry:
+ * - links a module @lowdefy/shell depends on itself (one of any profile's, such as expo-camera); or
+ * - asks for a permission some profile carries and this shell's profile leaves out (the camera on
+ *   `basic`).
+ *
+ * `lowdefy mobile config` runs it from the copied shell, and app.config.ts runs it again, so a
+ * hand-edited shell.json is refused at prebuild.
+ *
+ * @param {Object} params
+ * @param {Object} params.shell The shell config (shell.json).
+ * @param {string} params.variant The shell variant, dev or release.
+ * @param {{ name: string, entry: Object }[]} params.plugins The resolved shell plugins
+ *   (resolveShellPlugins.js).
+ */
+function checkShellPlugins({ shell, variant, plugins }) {
+  const profileName = getProfileName({ shell, variant });
+  const profile = getShellProfile({ shell, variant });
+  plugins.forEach(({ name, entry }) => {
+    Object.keys(entry.modules ?? {}).forEach((module) => {
+      const carrier = findProfile((candidate) => module in candidate.modules);
+      if (carrier !== undefined) {
+        throw new Error(
+          `Shell plugin "${name}" links "${module}", which @lowdefy/shell carries in the "${carrier}" profile. Pick the profile that carries it instead of adding it with a plugin.`
+        );
+      }
+    });
+    (entry.permissions ?? []).forEach((permission) => {
+      if (profile.permissions.includes(permission)) {
+        return;
+      }
+      const carrier = findProfile((candidate) => candidate.permissions.includes(permission));
+      if (carrier !== undefined) {
+        throw new Error(
+          `Shell plugin "${name}" asks for "${permission}", which the "${profileName}" profile leaves out. Pick the "${carrier}" profile, which carries it.`
+        );
+      }
+    });
+  });
+  return plugins;
+}
+
+module.exports = checkShellPlugins;

package/getPrivacyManifest.js

@@ -0,0 +1,39 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+/**
+ * The iOS privacy manifest (`ios.privacyManifests`) of a shell on a capability profile: the
+ * required-reason APIs its modules use (profiles.js `privacyReasons`, where `basic` holds React
+ * Native's and expo-sqlite's, so every profile carries them), each category listed once. App Store
+ * Connect refuses an upload whose binary uses one of these APIs without a declared reason.
+ *
+ * @param {Object} params
+ * @param {{ category: string, reasons: string[] }[]} params.privacyReasons The resolved profile's.
+ */
+function getPrivacyManifest({ privacyReasons }) {
+  const byCategory = new Map();
+  privacyReasons.forEach(({ category, reasons }) => {
+    byCategory.set(category, [...new Set([...(byCategory.get(category) ?? []), ...reasons])]);
+  });
+  return {
+    NSPrivacyAccessedAPITypes: [...byCategory.entries()].map(([category, reasons]) => ({
+      NSPrivacyAccessedAPIType: category,
+      NSPrivacyAccessedAPITypeReasons: reasons,
+    })),
+  };
+}
+
+module.exports = getPrivacyManifest;