@mmerterden/dev-toolkit-mcp 2.24.1

package/tools/ios-app-store-audit/context.js

@@ -0,0 +1,180 @@
+/**
+ * context.js - parses an .xcarchive into an ArchiveContext object that the
+ * 18 rules consume. Direct port of XCArchiveParser.swift +
+ * InfoPlistParser.swift + PrivacyManifestParser.swift + EntitlementParser.swift.
+ *
+ * Plist parsing is delegated to `plutil -convert json` (system binary on
+ * macOS, ships with the OS) - more reliable than any Node `plist` package
+ * across the long tail of Apple plist quirks (binary plists, XML-with-DTD,
+ * mixed array/dict roots).
+ */
+
+import { execSync } from "child_process";
+import { existsSync, readdirSync, statSync } from "fs";
+import { join, basename } from "path";
+
+/** Run a shell command, return trimmed stdout or empty string on failure. */
+function run(cmd) {
+  try {
+    return execSync(cmd, { encoding: "utf-8", maxBuffer: 64 * 1024 * 1024 }).trim();
+  } catch {
+    return "";
+  }
+}
+
+/** Parse a binary or XML plist file into a JS object via `plutil`. */
+export function parsePlist(plistPath) {
+  if (!existsSync(plistPath)) return null;
+  const json = run(`plutil -convert json -o - "${plistPath}" 2>/dev/null`);
+  if (!json) return null;
+  try {
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
+
+/** Recursively measure total size of a directory in bytes. */
+export function directorySize(path) {
+  if (!existsSync(path)) return 0;
+  let total = 0;
+  const stack = [path];
+  while (stack.length > 0) {
+    const cur = stack.pop();
+    let st;
+    try {
+      st = statSync(cur);
+    } catch {
+      continue;
+    }
+    if (st.isDirectory()) {
+      let entries = [];
+      try {
+        entries = readdirSync(cur);
+      } catch {
+        continue;
+      }
+      for (const e of entries) stack.push(join(cur, e));
+    } else if (st.isFile()) {
+      total += st.size;
+    }
+  }
+  return total;
+}
+
+/**
+ * Extract entitlements from a Mach-O binary using `codesign -d --entitlements`.
+ * Returns parsed plist as object, or null.
+ */
+export function extractEntitlements(executablePath) {
+  if (!existsSync(executablePath)) return null;
+  // codesign emits the entitlements XML to stderr in older toolchains, stdout in newer.
+  // `--xml -` forces XML output to stdout. We then convert to JSON via plutil.
+  const xml = run(`codesign -d --entitlements :- --xml "${executablePath}" 2>/dev/null`);
+  if (!xml || !xml.includes("<plist")) {
+    // Fall back to old non-xml form (pre-Xcode 14).
+    const raw = run(`codesign -d --entitlements - "${executablePath}" 2>/dev/null`);
+    if (!raw || !raw.includes("<plist")) return null;
+    return run(`echo '${raw.replace(/'/g, "'\\''")}' | plutil -convert json -o - - 2>/dev/null`)
+      ? safeJsonParse(run(`echo '${raw.replace(/'/g, "'\\''")}' | plutil -convert json -o - - 2>/dev/null`))
+      : null;
+  }
+  // Pipe XML into plutil for JSON conversion.
+  try {
+    const json = execSync(`plutil -convert json -o - -`, {
+      input: xml,
+      encoding: "utf-8",
+    }).trim();
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
+
+function safeJsonParse(s) {
+  try { return JSON.parse(s); } catch { return null; }
+}
+
+/**
+ * Parse an .xcarchive into a Context object.
+ *
+ * @param {string} archivePath  - Absolute path to the .xcarchive bundle.
+ * @returns {object}            - { archivePath, appPath, infoPlist, privacyManifest, entitlements, embeddedFrameworks, embeddedPlugins, executablePath, archiveSizeBytes, assetCatalogPath }
+ * @throws if the path doesn't exist, isn't an .xcarchive, or has no .app inside.
+ */
+export function parseArchive(archivePath) {
+  if (!existsSync(archivePath)) {
+    throw new Error(`Archive not found at ${archivePath}`);
+  }
+  if (!archivePath.endsWith(".xcarchive")) {
+    throw new Error(`Not a valid .xcarchive at ${archivePath}`);
+  }
+
+  // Locate the .app bundle inside Products/Applications/
+  const productsPath = join(archivePath, "Products/Applications");
+  let appBundles = [];
+  try {
+    appBundles = readdirSync(productsPath).filter((n) => n.endsWith(".app"));
+  } catch {
+    throw new Error(`Products/Applications/ missing in ${archivePath}`);
+  }
+  if (appBundles.length === 0) {
+    throw new Error(`No .app bundle found in archive ${archivePath}`);
+  }
+  const appName = appBundles[0];
+  const appPath = join(productsPath, appName);
+
+  // Parse Info.plist
+  const infoPlist = parsePlist(join(appPath, "Info.plist")) || {};
+
+  // Parse PrivacyInfo.xcprivacy if present (root-level, not inside frameworks)
+  const privacyManifestPath = join(appPath, "PrivacyInfo.xcprivacy");
+  const privacyManifest = parsePlist(privacyManifestPath);
+
+  // Resolve executable path
+  const executableName = infoPlist.CFBundleExecutable || appName.replace(/\.app$/, "");
+  const executablePath = join(appPath, executableName);
+  const executableExists = existsSync(executablePath);
+
+  // Entitlements via codesign
+  const entitlements = executableExists ? extractEntitlements(executablePath) : null;
+
+  // Embedded frameworks
+  const frameworksDir = join(appPath, "Frameworks");
+  let embeddedFrameworks = [];
+  if (existsSync(frameworksDir)) {
+    embeddedFrameworks = readdirSync(frameworksDir)
+      .filter((n) => n.endsWith(".framework") || n.endsWith(".xcframework"))
+      .map((n) => join(frameworksDir, n));
+  }
+
+  // Embedded plugins / extensions
+  const plugInsDir = join(appPath, "PlugIns");
+  let embeddedPlugins = [];
+  if (existsSync(plugInsDir)) {
+    embeddedPlugins = readdirSync(plugInsDir)
+      .filter((n) => n.endsWith(".appex"))
+      .map((n) => join(plugInsDir, n));
+  }
+
+  // Archive size (entire .xcarchive)
+  const archiveSizeBytes = directorySize(archivePath);
+
+  // Asset catalog (Assets.car)
+  const assetsPath = join(appPath, "Assets.car");
+  const assetCatalogPath = existsSync(assetsPath) ? assetsPath : null;
+
+  return {
+    archivePath,
+    appPath,
+    appName,
+    infoPlist,
+    privacyManifest,
+    entitlements,
+    embeddedFrameworks,
+    embeddedPlugins,
+    executablePath: executableExists ? executablePath : null,
+    archiveSizeBytes,
+    assetCatalogPath,
+  };
+}

package/tools/ios-app-store-audit/data/apple-required-sdks.json

@@ -0,0 +1,32 @@
+{
+  "_source": "https://developer.apple.com/support/third-party-SDK-requirements/",
+  "_note": "Commonly used third-party SDKs that REQUIRE both a privacy manifest AND a signature per Apple's Spring 2024 policy.",
+  "sdks": [
+    "Abseil", "AFNetworking", "Alamofire", "AppAuth",
+    "BoringSSL", "openssl_grpc",
+    "Capacitor", "Charts", "connectivity_plus", "Cordova",
+    "device_info_plus", "DKImagePickerController", "DKPhotoGallery",
+    "FBAEMKit", "FBLPromises", "FBSDKCoreKit", "FBSDKCoreKit_Basics", "FBSDKLoginKit", "FBSDKShareKit",
+    "file_picker",
+    "FirebaseABTesting", "FirebaseAuth", "FirebaseCore", "FirebaseCoreDiagnostics",
+    "FirebaseCoreExtension", "FirebaseCoreInternal", "FirebaseCrashlytics", "FirebaseDynamicLinks",
+    "FirebaseFirestore", "FirebaseInstallations", "FirebaseMessaging", "FirebaseRemoteConfig",
+    "Flutter", "flutter_inappwebview", "flutter_local_notifications", "fluttertoast",
+    "FMDB", "geolocator_apple",
+    "GoogleDataTransport", "GoogleSignIn", "GoogleToolboxForMac", "GoogleUtilities",
+    "grpcpp", "GTMAppAuth", "GTMSessionFetcher",
+    "hermes",
+    "image_picker_ios", "IQKeyboardManager", "IQKeyboardManagerSwift",
+    "Kingfisher", "leveldb", "Lottie", "MBProgressHUD", "nanopb",
+    "OneSignal", "OneSignalCore", "OneSignalExtension", "OneSignalOutcomes",
+    "OpenSSL", "OrderedSet",
+    "package_info", "package_info_plus", "path_provider", "path_provider_ios",
+    "Promises", "Protobuf", "Reachability", "RealmSwift",
+    "RxCocoa", "RxRelay", "RxSwift",
+    "SDWebImage", "share_plus", "shared_preferences_ios", "SnapKit",
+    "sqflite", "Starscream", "SVProgressHUD", "SwiftyGif", "SwiftyJSON",
+    "Toast",
+    "UnityFramework", "url_launcher", "url_launcher_ios",
+    "video_player_avfoundation", "wakelock", "webview_flutter_wkwebview"
+  ]
+}

package/tools/ios-app-store-audit/data/debug-tools-blocklist.json

@@ -0,0 +1,133 @@
+{
+  "_purpose": "Debug / development tools that must NOT ship to App Store. Apple Guidelines 2.5.1, 2.5.2.",
+  "frameworks": [
+    { "name": "netfox",            "tool": "Netfox",                   "category": "Network Debugger" },
+    { "name": "NFX",               "tool": "Netfox",                   "category": "Network Debugger" },
+    { "name": "CocoaDebug",        "tool": "CocoaDebug",               "category": "Network/Log Debugger" },
+    { "name": "Helios",            "tool": "Helios",                   "category": "Network Debugger" },
+    { "name": "HeliosTrace",       "tool": "HeliosTrace",              "category": "Network Debugger" },
+    { "name": "Wormholy",          "tool": "Wormholy",                 "category": "Network Debugger" },
+    { "name": "Bagel",             "tool": "Bagel",                    "category": "Network Debugger" },
+    { "name": "Atlantis",          "tool": "Atlantis/Proxyman",        "category": "Network Debugger" },
+    { "name": "PulseUI",           "tool": "Pulse",                    "category": "Network Logger UI" },
+    { "name": "PulseCore",         "tool": "Pulse",                    "category": "Network Logger" },
+    { "name": "ResponseDetective", "tool": "ResponseDetective",        "category": "Network Debugger" },
+    { "name": "OHHTTPStubs",       "tool": "OHHTTPStubs",              "category": "Network Stubber" },
+    { "name": "Mocker",            "tool": "Mocker",                   "category": "Network Mocker" },
+    { "name": "Swifter",           "tool": "Swifter (Local Server)",   "category": "Debug HTTP Server" },
+    { "name": "FLEX",              "tool": "FLEX",                     "category": "Runtime Debugger" },
+    { "name": "FLEXTool",          "tool": "FLEX",                     "category": "Runtime Debugger" },
+    { "name": "Reveal",            "tool": "Reveal",                   "category": "View Debugger" },
+    { "name": "LookinServer",      "tool": "Lookin",                   "category": "View Debugger" },
+    { "name": "InAppViewDebugger", "tool": "InAppViewDebugger",        "category": "View Debugger" },
+    { "name": "Sherlock",          "tool": "Sherlock",                 "category": "View Debugger" },
+    { "name": "LayoutInspector",   "tool": "LayoutInspector",          "category": "View Debugger" },
+    { "name": "Sleipnir",          "tool": "Sleipnir",                 "category": "View Debugger" },
+    { "name": "DoraemonKit",       "tool": "DoraemonKit/DoKit",        "category": "Debug Toolkit" },
+    { "name": "DoKit",             "tool": "DoKit",                    "category": "Debug Toolkit" },
+    { "name": "GodEye",            "tool": "GodEye",                   "category": "Debug Toolkit" },
+    { "name": "Woodpecker",        "tool": "Woodpecker",               "category": "Debug Toolkit" },
+    { "name": "LifetimeTracker",   "tool": "LifetimeTracker",          "category": "Memory Leak Debugger" },
+    { "name": "Chisel",            "tool": "Chisel",                   "category": "LLDB Debugger" },
+    { "name": "Hyperion",          "tool": "Hyperion",                 "category": "Debug Toolkit" },
+    { "name": "InAppDebugger",     "tool": "InAppDebugger",            "category": "Debug Toolkit" },
+    { "name": "Diagnostics",       "tool": "Diagnostics",              "category": "Debug Toolkit" },
+    { "name": "DebugSwift",        "tool": "DebugSwift",               "category": "Debug Toolkit" },
+    { "name": "FPSCounter",        "tool": "FPSCounter",               "category": "Performance Debugger" },
+    { "name": "MLeaksFinder",      "tool": "MLeaksFinder",             "category": "Memory Leak Debugger" },
+    { "name": "FBRetainCycleDetector","tool": "FBRetainCycleDetector", "category": "Memory Leak Debugger" },
+    { "name": "FBMemoryProfiler",  "tool": "FBMemoryProfiler",         "category": "Memory Profiler" },
+    { "name": "SwiftyBeaver",      "tool": "SwiftyBeaver",             "category": "Logger (review if needed in prod)" },
+    { "name": "XCGLogger",         "tool": "XCGLogger",                "category": "Logger (review if needed in prod)" }
+  ],
+  "symbols": [
+    { "symbol": "NFXListController",                    "tool": "Netfox" },
+    { "symbol": "NFXHTTPModel",                         "tool": "Netfox" },
+    { "symbol": "nfx_started",                          "tool": "Netfox" },
+    { "symbol": "CocoaDebugSettings",                   "tool": "CocoaDebug" },
+    { "symbol": "_TtC10CocoaDebug",                     "tool": "CocoaDebug" },
+    { "symbol": "FLEXManager",                          "tool": "FLEX" },
+    { "symbol": "FLEXExplorerToolbar",                  "tool": "FLEX" },
+    { "symbol": "FLEXObjectExplorer",                   "tool": "FLEX" },
+    { "symbol": "WormholyMethodSwizzling",              "tool": "Wormholy" },
+    { "symbol": "RequestModelBeWormholy",               "tool": "Wormholy" },
+    { "symbol": "HeliosLogger",                         "tool": "Helios" },
+    { "symbol": "HeliosNetworkInterceptor",             "tool": "Helios" },
+    { "symbol": "HeliosTrace.enable",                   "tool": "HeliosTrace" },
+    { "symbol": "HeliosTrace.showBubble",               "tool": "HeliosTrace" },
+    { "symbol": "HeliosTraceProtocol",                  "tool": "HeliosTrace" },
+    { "symbol": "DoraemonManager",                      "tool": "DoraemonKit" },
+    { "symbol": "DoraemonHomeViewController",           "tool": "DoraemonKit" },
+    { "symbol": "GodEyeController",                     "tool": "GodEye" },
+    { "symbol": "AtlantisHelper",                       "tool": "Atlantis/Proxyman" },
+    { "symbol": "ProxymanHelper",                       "tool": "Proxyman" },
+    { "symbol": "LookinServer",                         "tool": "Lookin" },
+    { "symbol": "Lookin_iOS",                           "tool": "Lookin" },
+    { "symbol": "IBARevealServer",                      "tool": "Reveal" },
+    { "symbol": "RevealServer",                         "tool": "Reveal" },
+    { "symbol": "LifetimeTrackerDashboard",             "tool": "LifetimeTracker" },
+    { "symbol": "BagelRequestInfo",                     "tool": "Bagel" },
+    { "symbol": "PulseUI",                              "tool": "Pulse" },
+    { "symbol": "NetworkLoggerInsights",                "tool": "Pulse" },
+    { "symbol": "NFXShakeEnabled",                      "tool": "Netfox Shake Trigger" },
+    { "symbol": "CocoaDebugShake",                      "tool": "CocoaDebug Shake Trigger" },
+    { "symbol": "showDebugPanel",                       "tool": "Custom Debug Panel" },
+    { "symbol": "debugMenuPresenter",                   "tool": "Custom Debug Menu" },
+    { "symbol": "FLEXManager.shared.showExplorer",      "tool": "FLEX Shake Trigger" },
+    { "symbol": "toggleFLEX",                           "tool": "FLEX Toggle" },
+    { "symbol": "HyperionCore",                         "tool": "Hyperion" },
+    { "symbol": "HyperionManager",                      "tool": "Hyperion" },
+    { "symbol": "InjectionClient",                      "tool": "Injection (Hot Reload)" },
+    { "symbol": "_TtC13InjectionNext",                  "tool": "Injection (Hot Reload)" },
+    { "symbol": "URLProtocolSwizzler",                  "tool": "Network Interceptor" },
+    { "symbol": "NSURLSessionSwizzle",                  "tool": "Network Interceptor" },
+    { "symbol": "NetworkInterceptor_swizzle",           "tool": "Network Interceptor" }
+  ],
+  "urlSchemes": [
+    { "scheme": "nfx",        "tool": "Netfox" },
+    { "scheme": "flex",       "tool": "FLEX" },
+    { "scheme": "cocoadebug", "tool": "CocoaDebug" },
+    { "scheme": "wormholy",   "tool": "Wormholy" },
+    { "scheme": "dokit",      "tool": "DoKit" },
+    { "scheme": "lookin",     "tool": "Lookin" }
+  ],
+  "genericPatterns": [
+    { "pattern": "URLProtocol.registerClass",            "category": "Network Interceptor (URLProtocol swizzling)" },
+    { "pattern": "URLSessionConfiguration.protocolClasses","category": "Network Interceptor (protocol injection)" },
+    { "pattern": "swizzleSessionConfiguration",          "category": "Network Interceptor (session swizzling)" },
+    { "pattern": "NetworkInterceptor",                   "category": "Network Interceptor" },
+    { "pattern": "HTTPRequestInterceptor",               "category": "HTTP Request Interceptor" },
+    { "pattern": "RequestLogger",                        "category": "Network Request Logger" },
+    { "pattern": "ResponseLogger",                       "category": "Network Response Logger" },
+    { "pattern": "NetworkLogger",                        "category": "Network Logger" },
+    { "pattern": "TrafficMonitor",                       "category": "Network Traffic Monitor" },
+    { "pattern": "PacketCapture",                        "category": "Network Packet Capture" },
+    { "pattern": "DebugWindow",                          "category": "Debug Floating Window" },
+    { "pattern": "DebugOverlay",                         "category": "Debug Overlay" },
+    { "pattern": "DebugBubble",                          "category": "Debug Bubble UI" },
+    { "pattern": "FloatingDebug",                        "category": "Floating Debug Panel" },
+    { "pattern": "DebugConsole",                         "category": "In-App Debug Console" },
+    { "pattern": "InAppConsole",                         "category": "In-App Console" },
+    { "pattern": "DebugDashboard",                       "category": "Debug Dashboard" },
+    { "pattern": "ViewHierarchyInspector",               "category": "View Hierarchy Inspector" },
+    { "pattern": "RuntimeBrowser",                       "category": "Runtime Browser" },
+    { "pattern": "ObjectInspector",                      "category": "Object Inspector" },
+    { "pattern": "PropertyInspector",                    "category": "Property Inspector" },
+    { "pattern": "DatabaseBrowser",                      "category": "Database Browser" },
+    { "pattern": "SQLiteBrowser",                        "category": "SQLite Browser" },
+    { "pattern": "CoreDataDebug",                        "category": "Core Data Debugger" },
+    { "pattern": "UserDefaultsExplorer",                 "category": "UserDefaults Explorer" },
+    { "pattern": "KeychainViewer",                       "category": "Keychain Viewer" },
+    { "pattern": "StorageInspector",                     "category": "Storage Inspector" },
+    { "pattern": "CacheBrowser",                         "category": "Cache Browser" },
+    { "pattern": "FileExplorer",                         "category": "File Explorer (Debug)" },
+    { "pattern": "SandboxBrowser",                       "category": "Sandbox Browser" },
+    { "pattern": "LogViewer",                            "category": "In-App Log Viewer" },
+    { "pattern": "ConsoleViewer",                        "category": "Console Viewer" },
+    { "pattern": "LogDashboard",                         "category": "Log Dashboard" },
+    { "pattern": "EnvironmentSwitcher",                  "category": "Environment Switcher" },
+    { "pattern": "ServerSwitcher",                       "category": "Server Switcher" },
+    { "pattern": "FeatureFlagDebug",                     "category": "Feature Flag Debugger" },
+    { "pattern": "DebugSettings",                        "category": "Debug Settings Panel" }
+  ]
+}

package/tools/ios-app-store-audit/index.js

@@ -0,0 +1,164 @@
+/**
+ * ios_app_store_audit - full 18-rule App Store compliance scanner for
+ * .xcarchive bundles, ported from the standalone ArchiveGuard Swift package.
+ *
+ * Public surface:
+ *   runAudit({ archivePath, rules })
+ *     archivePath: absolute path to a .xcarchive bundle
+ *     rules:       "all" (default) | "core" | "deep" | comma-separated list of ruleIDs
+ *   returns:
+ *     {
+ *       archive: <path>,
+ *       app:     <bundle name>,
+ *       summary: { error, warning, info, total },
+ *       verdict: "PASS" | "WARN" | "FAIL",
+ *       violations: [ { ruleID, severity, message, ... } ]
+ *     }
+ *
+ * Each rule lives in `rules/<rule-id>.js` and exports
+ *   id, name, description, check(ctx, opts)
+ * The dispatcher imports them lazily so a rule failure can never poison
+ * the rest of the scan.
+ */
+
+import { parseArchive } from "./context.js";
+import { compareSeverity } from "./models.js";
+
+// ---------- Rule registry --------------------------------------------------
+// Order is the human-friendly report order (privacy first, fs hygiene last).
+// Each entry is { id, module: dynamic-import path, group: "core"|"deep" }.
+//
+//   group "core" → checks the existing ios_archive_audit (lighter) covered.
+//                  These are safe to run on every CI invocation.
+//   group "deep" → the 18-rule full scan. Heavier (binary string scans,
+//                  embedded SDK enumeration, etc.).
+const RULE_REGISTRY = [
+  { id: "code-signing",           module: "./rules/code-signing.js",           group: "core" },
+  { id: "entitlements",           module: "./rules/entitlement.js",            group: "core" },
+  { id: "info-plist",             module: "./rules/info-plist.js",             group: "core" },
+  { id: "privacy-manifest",       module: "./rules/privacy-manifest.js",       group: "core" },
+  { id: "binary-size",            module: "./rules/binary-size.js",            group: "core" },
+  { id: "team-id-consistency",    module: "./rules/team-id.js",                group: "deep" },
+  { id: "provisioning-profile",   module: "./rules/provisioning-profile.js",   group: "deep" },
+  { id: "production-hygiene",     module: "./rules/production-hygiene.js",     group: "deep" },
+  { id: "ipv6-compliance",        module: "./rules/ipv6-compliance.js",        group: "deep" },
+  { id: "duplicate-resource",     module: "./rules/duplicate-resource.js",     group: "deep" },
+  { id: "dead-reference",         module: "./rules/dead-reference.js",         group: "deep" },
+  { id: "embedded-sdk",           module: "./rules/embedded-sdk.js",           group: "deep" },
+  { id: "required-reason-api",    module: "./rules/required-reason-api.js",    group: "deep" },
+  { id: "asset-validation",       module: "./rules/asset-validation.js",       group: "deep" },
+  { id: "swift-abi",              module: "./rules/swift-abi.js",              group: "deep" },
+  { id: "extension-signing",      module: "./rules/extension-signing.js",      group: "deep" },
+  { id: "debug-tool-leak",        module: "./rules/debug-tool-leak.js",        group: "deep" },
+  // ITMS-90725 is a hard upload rejection and costs nothing to check, so it
+  // belongs in "core" rather than the heavier deep scan.
+  { id: "sdk-floor",              module: "./rules/sdk-floor.js",              group: "core" },
+];
+// Keeping the registry the single source of truth lets the dispatcher
+// skip-with-warning when a rule module is missing - easier than touching
+// multiple imports per commit.
+
+const RULE_GROUPS = {
+  all: () => RULE_REGISTRY.map((r) => r.id),
+  deep: () => RULE_REGISTRY.map((r) => r.id),
+  core: () => RULE_REGISTRY.filter((r) => r.group === "core").map((r) => r.id),
+};
+
+function resolveRuleSelection(rules) {
+  if (!rules || rules === "all" || rules === "deep") return RULE_GROUPS.all();
+  if (rules === "core") return RULE_GROUPS.core();
+  // Comma-separated explicit list.
+  return rules.split(",").map((s) => s.trim()).filter(Boolean);
+}
+
+// ---------- Public entry ---------------------------------------------------
+
+/**
+ * Run an App Store compliance audit against an .xcarchive.
+ *
+ * @param {object} args
+ * @param {string} args.archivePath - absolute path to a .xcarchive
+ * @param {string} [args.rules]     - "all" | "core" | "deep" | csv of ruleIDs
+ * @param {object} [args.options]   - per-rule options, keyed by ruleID
+ * @returns {Promise<object>} structured audit report
+ */
+export async function runAudit({ archivePath, rules = "all", options = {} } = {}) {
+  const ctx = parseArchive(archivePath);
+
+  const selectedIDs = new Set(resolveRuleSelection(rules));
+  const toRun = RULE_REGISTRY.filter((r) => selectedIDs.has(r.id));
+
+  const violations = [];
+  const ranIDs = [];
+  const skippedIDs = [];
+
+  for (const entry of toRun) {
+    let mod;
+    try {
+      mod = await import(entry.module);
+    } catch (err) {
+      // Rule module not implemented yet (early-port commits). Skip cleanly.
+      skippedIDs.push({ id: entry.id, reason: `module not loadable: ${err.message}` });
+      continue;
+    }
+    if (typeof mod.check !== "function") {
+      skippedIDs.push({ id: entry.id, reason: "module has no check()" });
+      continue;
+    }
+    try {
+      const ruleOpts = options[entry.id] || {};
+      const out = mod.check(ctx, ruleOpts);
+      if (Array.isArray(out)) {
+        for (const v of out) violations.push(v);
+      }
+      ranIDs.push(entry.id);
+    } catch (err) {
+      // A single rule throwing must NEVER abort the whole audit. Record as info.
+      violations.push({
+        ruleID: entry.id,
+        severity: "warning",
+        message: `Rule '${entry.id}' threw: ${err.message}`,
+        suggestion: "Open an issue with the archive details - this is a tool bug, not your archive's fault.",
+      });
+    }
+  }
+
+  // Sort: error → warning → info, then by ruleID alphabetically inside each.
+  violations.sort((a, b) => {
+    const c = compareSeverity(b.severity, a.severity);
+    return c !== 0 ? c : a.ruleID.localeCompare(b.ruleID);
+  });
+
+  const summary = {
+    error: violations.filter((v) => v.severity === "error").length,
+    warning: violations.filter((v) => v.severity === "warning").length,
+    info: violations.filter((v) => v.severity === "info").length,
+    total: violations.length,
+  };
+  const verdict = summary.error > 0 ? "FAIL" : summary.warning > 0 ? "WARN" : "PASS";
+
+  return {
+    archive: archivePath,
+    app: ctx.appName,
+    rulesRun: ranIDs,
+    rulesSkipped: skippedIDs,
+    summary,
+    verdict,
+    violations,
+  };
+}
+
+// ---------- MCP tool descriptor (consumed by main index.js) ---------------
+
+export const TOOL_DESCRIPTOR = {
+  name: "ios_app_store_audit",
+  description: "Deep App Store Review compliance audit for .xcarchive bundles. 18-rule catalog covering privacy manifest, code signing, embedded SDKs, entitlements, asset hygiene, IPv6 compliance, debug-tool leak detection, Swift ABI compatibility, and more. Returns structured JSON with severity-ranked violations and ITMS error code mappings. Replaces the lighter ios_archive_audit (deprecated). Use --rules=core for the 6 baseline checks, --rules=deep|all for the full scan.",
+  inputSchema: {
+    type: "object",
+    properties: {
+      archive_path: { type: "string", description: "Absolute path to the .xcarchive bundle" },
+      rules: { type: "string", description: "'all' (default) | 'core' | 'deep' | comma-separated ruleIDs" },
+    },
+    required: ["archive_path"],
+  },
+};

package/tools/ios-app-store-audit/models.js

@@ -0,0 +1,47 @@
+/**
+ * models.js - shared types for the ios_app_store_audit tool.
+ *
+ * Mirrors the Swift Severity / Violation types from ArchiveGuard so the JSON
+ * shape we emit is byte-equivalent to what `archive-guard --format=json`
+ * used to produce. Consumers (multi-agent-pipeline apple-archive-compliance
+ * skill, manual users) keep working without code changes - only the source
+ * of the JSON moves from a Swift CLI to this MCP tool.
+ */
+
+export const Severity = Object.freeze({
+  INFO: "info",
+  WARNING: "warning",
+  ERROR: "error",
+});
+
+const SEV_RANK = { info: 0, warning: 1, error: 2 };
+
+/** Compare two severities. Higher rank wins. Returns -1 / 0 / +1. */
+export function compareSeverity(a, b) {
+  return Math.sign(SEV_RANK[a] - SEV_RANK[b]);
+}
+
+/**
+ * Create a Violation object. Mirrors `Violation.swift` field-for-field.
+ *
+ * @param {object} v
+ * @param {string} v.ruleID                  - e.g. "binary-size"
+ * @param {("info"|"warning"|"error")} v.severity
+ * @param {string} v.message                  - human-readable description
+ * @param {string} [v.guidelineRef]           - Apple guideline / ITMS code
+ * @param {string} [v.file]                   - path relative to the archive
+ * @param {string} [v.suggestion]             - fix recommendation
+ */
+export function makeViolation({ ruleID, severity, message, guidelineRef, file, suggestion }) {
+  if (!ruleID || !severity || !message) {
+    throw new Error(`makeViolation requires ruleID + severity + message; got ${JSON.stringify({ ruleID, severity, message })}`);
+  }
+  if (!Object.values(Severity).includes(severity)) {
+    throw new Error(`Invalid severity '${severity}' - must be one of ${Object.values(Severity).join(", ")}`);
+  }
+  const v = { ruleID, severity, message };
+  if (guidelineRef) v.guidelineRef = guidelineRef;
+  if (file) v.file = file;
+  if (suggestion) v.suggestion = suggestion;
+  return v;
+}

package/tools/ios-app-store-audit/rules/asset-validation.js

@@ -0,0 +1,72 @@
+/**
+ * asset-validation - Verifies app icon configuration + launch storyboard
+ * presence. Direct port of AssetValidationRule.swift.
+ *
+ * Apple Guidelines: 2.3, 2.1.
+ */
+
+import { readdirSync } from "fs";
+import { Severity, makeViolation } from "../models.js";
+
+export const id = "asset-validation";
+export const name = "Asset Validation";
+export const description = "Checks for required app icons and asset catalog presence";
+
+export function check(ctx) {
+  const violations = [];
+  const plist = ctx.infoPlist || {};
+
+  // Compiled asset catalog
+  if (!ctx.assetCatalogPath) {
+    violations.push(makeViolation({
+      ruleID: id, guidelineRef: "2.3", severity: Severity.WARNING,
+      message: "No compiled asset catalog (Assets.car) found in app bundle",
+      file: ctx.appPath,
+      suggestion: "Ensure your asset catalog is included in the target",
+    }));
+  }
+
+  // Icon configuration
+  let iconFiles = [];
+  if (plist.CFBundleIcons?.CFBundlePrimaryIcon?.CFBundleIconFiles) {
+    const arr = plist.CFBundleIcons.CFBundlePrimaryIcon.CFBundleIconFiles;
+    if (Array.isArray(arr)) iconFiles = arr;
+  } else if (typeof plist.CFBundleIconFile === "string") {
+    iconFiles = [plist.CFBundleIconFile];
+  }
+
+  let appContents = [];
+  try {
+    appContents = readdirSync(ctx.appPath);
+  } catch {
+    appContents = [];
+  }
+  const hasIconFiles = appContents.some((f) => f.startsWith("AppIcon"));
+  const hasAssetCatalog = ctx.assetCatalogPath != null;
+
+  if (iconFiles.length === 0 && !hasIconFiles && !hasAssetCatalog) {
+    violations.push(makeViolation({
+      ruleID: id, guidelineRef: "2.3", severity: Severity.ERROR,
+      message: "No app icon configuration found",
+      file: "Info.plist",
+      suggestion: "Add an AppIcon set to your asset catalog with all required sizes",
+    }));
+  }
+
+  // Launch storyboard
+  if (plist.UILaunchStoryboardName == null) {
+    const hasLaunchStoryboard = appContents.some((f) =>
+      f.includes("LaunchScreen") && (f.endsWith(".storyboardc") || f.endsWith(".nib"))
+    );
+    if (!hasLaunchStoryboard) {
+      violations.push(makeViolation({
+        ruleID: id, guidelineRef: "2.1", severity: Severity.WARNING,
+        message: "No launch storyboard found - required for full-screen support on all devices",
+        file: ctx.appPath,
+        suggestion: "Add a LaunchScreen.storyboard to your project",
+      }));
+    }
+  }
+
+  return violations;
+}