@mmerterden/dev-toolkit-mcp 2.24.1

package/tools/ios-app-store-audit/rules/privacy-manifest.js

@@ -0,0 +1,121 @@
+/**
+ * privacy-manifest - Validates PrivacyInfo.xcprivacy presence and per-key
+ * completeness against Apple's Required Reason API + Tracking schema.
+ * Direct port of PrivacyManifestRule.swift.
+ *
+ * Apple Guideline: 5.1.1.
+ */
+
+import { Severity, makeViolation } from "../models.js";
+
+export const id = "privacy-manifest";
+export const name = "Privacy Manifest";
+export const description = "Checks PrivacyInfo.xcprivacy for required keys and completeness";
+
+export function check(ctx) {
+  const violations = [];
+  const manifest = ctx.privacyManifest;
+
+  if (!manifest) {
+    violations.push(makeViolation({
+      ruleID: id, guidelineRef: "5.1.1", severity: Severity.ERROR,
+      message: "PrivacyInfo.xcprivacy not found in app bundle",
+      file: ctx.appPath,
+      suggestion: "Add a PrivacyInfo.xcprivacy file to your app target",
+    }));
+    return violations;
+  }
+
+  // NSPrivacyTracking
+  if (manifest.NSPrivacyTracking == null) {
+    violations.push(makeViolation({
+      ruleID: id, guidelineRef: "5.1.1", severity: Severity.WARNING,
+      message: "NSPrivacyTracking key not declared in privacy manifest",
+      file: "PrivacyInfo.xcprivacy",
+      suggestion: "Add NSPrivacyTracking (Boolean) to your privacy manifest",
+    }));
+  }
+  if (manifest.NSPrivacyTracking === true) {
+    const domains = Array.isArray(manifest.NSPrivacyTrackingDomains) ? manifest.NSPrivacyTrackingDomains : [];
+    if (domains.length === 0) {
+      violations.push(makeViolation({
+        ruleID: id, guidelineRef: "5.1.1", severity: Severity.ERROR,
+        message: "NSPrivacyTracking is true but NSPrivacyTrackingDomains is empty",
+        file: "PrivacyInfo.xcprivacy",
+        suggestion: "List all tracking domains in NSPrivacyTrackingDomains",
+      }));
+    }
+  }
+
+  // NSPrivacyCollectedDataTypes
+  if (manifest.NSPrivacyCollectedDataTypes == null) {
+    violations.push(makeViolation({
+      ruleID: id, guidelineRef: "5.1.1", severity: Severity.WARNING,
+      message: "NSPrivacyCollectedDataTypes not declared",
+      file: "PrivacyInfo.xcprivacy",
+      suggestion: "Declare collected data types even if empty (use empty array)",
+    }));
+  } else if (Array.isArray(manifest.NSPrivacyCollectedDataTypes)) {
+    manifest.NSPrivacyCollectedDataTypes.forEach((dataType, index) => {
+      if (dataType?.NSPrivacyCollectedDataType == null) {
+        violations.push(makeViolation({
+          ruleID: id, guidelineRef: "5.1.1", severity: Severity.ERROR,
+          message: `Collected data type at index ${index} missing NSPrivacyCollectedDataType key`,
+          file: "PrivacyInfo.xcprivacy",
+        }));
+      }
+      if (dataType?.NSPrivacyCollectedDataTypeLinked == null) {
+        violations.push(makeViolation({
+          ruleID: id, guidelineRef: "5.1.1", severity: Severity.WARNING,
+          message: `Collected data type at index ${index} missing NSPrivacyCollectedDataTypeLinked`,
+          file: "PrivacyInfo.xcprivacy",
+        }));
+      }
+      if (dataType?.NSPrivacyCollectedDataTypeTracking == null) {
+        violations.push(makeViolation({
+          ruleID: id, guidelineRef: "5.1.1", severity: Severity.WARNING,
+          message: `Collected data type at index ${index} missing NSPrivacyCollectedDataTypeTracking`,
+          file: "PrivacyInfo.xcprivacy",
+        }));
+      }
+      if (dataType?.NSPrivacyCollectedDataTypePurposes == null) {
+        violations.push(makeViolation({
+          ruleID: id, guidelineRef: "5.1.1", severity: Severity.ERROR,
+          message: `Collected data type at index ${index} missing NSPrivacyCollectedDataTypePurposes`,
+          file: "PrivacyInfo.xcprivacy",
+        }));
+      }
+    });
+  }
+
+  // NSPrivacyAccessedAPITypes
+  if (manifest.NSPrivacyAccessedAPITypes == null) {
+    violations.push(makeViolation({
+      ruleID: id, guidelineRef: "5.1.1", severity: Severity.WARNING,
+      message: "NSPrivacyAccessedAPITypes not declared",
+      file: "PrivacyInfo.xcprivacy",
+      suggestion: "Declare accessed API types with required reason codes",
+    }));
+  } else if (Array.isArray(manifest.NSPrivacyAccessedAPITypes)) {
+    manifest.NSPrivacyAccessedAPITypes.forEach((apiType, index) => {
+      if (apiType?.NSPrivacyAccessedAPIType == null) {
+        violations.push(makeViolation({
+          ruleID: id, guidelineRef: "5.1.1", severity: Severity.ERROR,
+          message: `Accessed API type at index ${index} missing NSPrivacyAccessedAPIType key`,
+          file: "PrivacyInfo.xcprivacy",
+        }));
+      }
+      const reasons = Array.isArray(apiType?.NSPrivacyAccessedAPITypeReasons) ? apiType.NSPrivacyAccessedAPITypeReasons : [];
+      if (reasons.length === 0) {
+        violations.push(makeViolation({
+          ruleID: id, guidelineRef: "5.1.1", severity: Severity.ERROR,
+          message: `Accessed API type at index ${index} has no reason codes`,
+          file: "PrivacyInfo.xcprivacy",
+          suggestion: "Each accessed API type must have at least one valid reason code",
+        }));
+      }
+    });
+  }
+
+  return violations;
+}

package/tools/ios-app-store-audit/rules/production-hygiene.js

@@ -0,0 +1,237 @@
+/**
+ * production-hygiene - Detects debug logging compiled into release binaries
+ * (print, NSLog, debugPrint, dump, CocoaLumberjack DDLog wrappers) plus
+ * test/mock/debug data files that should not ship to production.
+ * Direct port of ProductionHygieneRule.swift.
+ *
+ * Apple Guidelines: 2.1 (App Completeness), 2.5.1 (Software Requirements).
+ */
+
+import { execSync } from "child_process";
+import { existsSync, readdirSync, statSync } from "fs";
+import { join, basename, extname } from "path";
+import { Severity, makeViolation } from "../models.js";
+
+export const id = "production-hygiene";
+export const name = "Production Hygiene";
+export const description = "Detects print/NSLog statements in binary and test/mock data files that should not ship to production";
+
+const LOGGING_SYMBOLS = [
+  // Swift print family - write to stdout, leak data
+  { symbol: "Swift.print(",            label: "Swift print()",             severity: Severity.WARNING },
+  { symbol: "Swift._print(",           label: "Swift print()",             severity: Severity.WARNING },
+  { symbol: "_swift_stdlib_print",     label: "Swift print()",             severity: Severity.WARNING },
+  { symbol: "debugPrint(",             label: "debugPrint()",              severity: Severity.WARNING },
+  { symbol: "Swift.debugPrint(",       label: "Swift debugPrint()",        severity: Severity.WARNING },
+  { symbol: "Swift.dump(",             label: "Swift dump()",              severity: Severity.WARNING },
+
+  // NSLog - visible in Console.app
+  { symbol: "NSLog",                   label: "NSLog()",                   severity: Severity.WARNING },
+  { symbol: "CFLog",                   label: "CFLog()",                   severity: Severity.WARNING },
+
+  // Common debug print wrappers
+  { symbol: "DLog(",                   label: "DLog() macro",              severity: Severity.INFO },
+  { symbol: "ALog(",                   label: "ALog() macro",              severity: Severity.INFO },
+  { symbol: "DDLog",                   label: "CocoaLumberjack DDLog",     severity: Severity.INFO },
+];
+
+const DEBUG_FILE_PATTERNS = [
+  { pattern: "mock", label: "Mock data file" },
+  { pattern: "Mock", label: "Mock data file" },
+  { pattern: "MOCK", label: "Mock data file" },
+  { pattern: "stub", label: "Stub data file" },
+  { pattern: "Stub", label: "Stub data file" },
+  { pattern: "fake", label: "Fake data file" },
+  { pattern: "Fake", label: "Fake data file" },
+  { pattern: "dummy", label: "Dummy data file" },
+  { pattern: "Dummy", label: "Dummy data file" },
+  { pattern: "test", label: "Test data file" },
+  { pattern: "Test", label: "Test data file" },
+  { pattern: "sample", label: "Sample data file" },
+  { pattern: "Sample", label: "Sample data file" },
+  { pattern: "example", label: "Example data file" },
+  { pattern: "Example", label: "Example data file" },
+  { pattern: "debug", label: "Debug data file" },
+  { pattern: "Debug", label: "Debug data file" },
+  { pattern: "DEBUG", label: "Debug data file" },
+  { pattern: "dev_", label: "Development data file" },
+  { pattern: "staging", label: "Staging data file" },
+  { pattern: "Staging", label: "Staging data file" },
+  { pattern: "fixture", label: "Test fixture file" },
+  { pattern: "Fixture", label: "Test fixture file" },
+  { pattern: "seed", label: "Seed data file" },
+  { pattern: "Seed", label: "Seed data file" },
+];
+
+const DATA_FILE_EXTENSIONS = new Set(["json", "plist", "xml", "csv", "txt", "yaml", "yml", "sqlite", "db"]);
+
+const SYSTEM_FILES = new Set([
+  "Info.plist", "Root.plist", "Settings.plist",
+  "Assets.car", "PkgInfo", "CodeResources",
+  "embedded.mobileprovision", "PrivacyInfo.xcprivacy",
+  "ResourceRules.plist", "Entitlements.plist",
+]);
+
+function isSystemFile(filename, relativePath) {
+  if (SYSTEM_FILES.has(filename)) return true;
+  if (relativePath.includes(".framework/")) return true;
+  if (relativePath.includes(".appex/")) return true;
+  if (filename.endsWith(".strings") || filename.endsWith(".stringsdict")) return true;
+  if (relativePath.includes(".lproj/")) return true;
+  return false;
+}
+
+function* walk(root, prefix = "") {
+  let entries;
+  try {
+    entries = readdirSync(root);
+  } catch {
+    return;
+  }
+  for (const e of entries) {
+    const full = join(root, e);
+    const rel = prefix ? `${prefix}/${e}` : e;
+    let st;
+    try {
+      st = statSync(full);
+    } catch {
+      continue;
+    }
+    if (st.isDirectory()) {
+      yield* walk(full, rel);
+    } else if (st.isFile()) {
+      yield { rel, full };
+    }
+  }
+}
+
+function checkLoggingSymbols(ctx) {
+  const violations = [];
+  if (!ctx.executablePath || !existsSync(ctx.executablePath)) return violations;
+  let st;
+  try {
+    st = statSync(ctx.executablePath);
+  } catch {
+    return violations;
+  }
+  if (st.size > 500 * 1024 * 1024) return violations;
+
+  // Build a single regex alternation for grep - same shape as Swift impl.
+  const escapedPatterns = LOGGING_SYMBOLS.map((s) =>
+    s.symbol
+      .replace(/\(/g, "\\(")
+      .replace(/\)/g, "\\)")
+      .replace(/\./g, "\\.")
+  );
+  const grepPattern = escapedPatterns.join("|");
+  let output = "";
+  try {
+    output = execSync(
+      `/usr/bin/strings "${ctx.executablePath}" | grep -E '${grepPattern}' 2>/dev/null | head -100`,
+      { encoding: "utf-8", maxBuffer: 64 * 1024 * 1024 }
+    );
+  } catch {
+    return violations;
+  }
+
+  const reported = new Set();
+  for (const sym of LOGGING_SYMBOLS) {
+    if (output.includes(sym.symbol) && !reported.has(sym.label)) {
+      reported.add(sym.label);
+      violations.push(makeViolation({
+        ruleID: id,
+        guidelineRef: "2.1",
+        severity: sym.severity,
+        message: `${sym.label} detected in binary - may leak sensitive data to device console`,
+        suggestion: "Replace with os_log or Logger (os.Logger) with appropriate log levels, or guard with #if DEBUG",
+      }));
+    }
+  }
+  return violations;
+}
+
+function checkDebugDataFiles(ctx) {
+  const violations = [];
+  const hits = []; // { path, label }
+  for (const { rel } of walk(ctx.appPath)) {
+    const filename = basename(rel);
+    const ext = extname(filename).slice(1).toLowerCase();
+    if (!DATA_FILE_EXTENSIONS.has(ext)) continue;
+    if (isSystemFile(filename, rel)) continue;
+    const nameWithoutExt = filename.slice(0, filename.length - ext.length - 1);
+    for (const p of DEBUG_FILE_PATTERNS) {
+      if (nameWithoutExt.includes(p.pattern)) {
+        hits.push({ path: rel, label: p.label });
+        break;
+      }
+    }
+  }
+
+  if (hits.length === 0) return violations;
+
+  // Group by label
+  const grouped = new Map();
+  for (const h of hits) {
+    if (!grouped.has(h.label)) grouped.set(h.label, []);
+    grouped.get(h.label).push(h.path);
+  }
+  const sortedLabels = [...grouped.keys()].sort();
+  for (const label of sortedLabels) {
+    const files = grouped.get(label);
+    const sample = files.slice(0, 5).join(", ");
+    const extra = files.length > 5 ? ` and ${files.length - 5} more` : "";
+    violations.push(makeViolation({
+      ruleID: id,
+      guidelineRef: "2.1",
+      severity: Severity.WARNING,
+      message: `${label}(s) found in app bundle: ${sample}${extra}`,
+      file: ctx.appPath,
+      suggestion: "Remove test/mock/debug data files from the Release build target membership",
+    }));
+  }
+  return violations;
+}
+
+function checkFrameworkJSONFiles(ctx) {
+  const violations = [];
+  const frameworksDir = join(ctx.appPath, "Frameworks");
+  if (!existsSync(frameworksDir)) return violations;
+
+  let frameworks = [];
+  try {
+    frameworks = readdirSync(frameworksDir);
+  } catch {
+    return violations;
+  }
+  for (const framework of frameworks) {
+    if (!framework.endsWith(".framework")) continue;
+    const fwPath = join(frameworksDir, framework);
+    let contents = [];
+    try {
+      contents = readdirSync(fwPath);
+    } catch {
+      continue;
+    }
+    const jsonFiles = contents.filter((f) => f.endsWith(".json"));
+    if (jsonFiles.length === 0) continue;
+    const sample = jsonFiles.slice(0, 5).join(", ");
+    const extra = jsonFiles.length > 5 ? ` and ${jsonFiles.length - 5} more` : "";
+    violations.push(makeViolation({
+      ruleID: id,
+      guidelineRef: "2.1",
+      severity: Severity.WARNING,
+      message: `${framework} contains ${jsonFiles.length} JSON file(s): ${sample}${extra}`,
+      file: fwPath,
+      suggestion: "Verify these JSON files are needed in production. Mock/stub data should be excluded from Release builds",
+    }));
+  }
+  return violations;
+}
+
+export function check(ctx) {
+  return [
+    ...checkLoggingSymbols(ctx),
+    ...checkDebugDataFiles(ctx),
+    ...checkFrameworkJSONFiles(ctx),
+  ];
+}

package/tools/ios-app-store-audit/rules/provisioning-profile.js

@@ -0,0 +1,127 @@
+/**
+ * provisioning-profile - Validates embedded.mobileprovision: expiry,
+ * profile type (Distribution / Development / Enterprise / Ad Hoc).
+ * Direct port of ProvisioningProfileRule.swift.
+ *
+ * ITMS error codes: 90034, 90161
+ *
+ * The profile is a CMS-signed plist; decode it with `security cms -D -i`,
+ * then pipe through `plutil -convert json` because Apple ships a mix of
+ * binary / XML plists across Xcode versions.
+ */
+
+import { execSync } from "child_process";
+import { existsSync } from "fs";
+import { join } from "path";
+import { Severity, makeViolation } from "../models.js";
+
+export const id = "provisioning-profile";
+export const name = "Provisioning Profile";
+export const description = "Checks embedded.mobileprovision for expiry date and distribution type";
+
+const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;
+
+function decodeProfile(profilePath) {
+  try {
+    // CMS decode → produces plist bytes on stdout (XML/binary depending on Xcode).
+    const cmsXml = execSync(`/usr/bin/security cms -D -i "${profilePath}" 2>/dev/null`, {
+      encoding: "utf-8",
+      maxBuffer: 16 * 1024 * 1024,
+    });
+    if (!cmsXml.trim()) return null;
+    // Convert to JSON for predictable typed access.
+    const json = execSync(`plutil -convert json -o - -`, {
+      input: cmsXml,
+      encoding: "utf-8",
+    }).trim();
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
+
+function isoDate(input) {
+  if (!input) return null;
+  // plutil -convert json renders Date as ISO 8601 string.
+  if (typeof input === "string") {
+    const t = Date.parse(input);
+    return Number.isFinite(t) ? new Date(t) : null;
+  }
+  return null;
+}
+
+export function check(ctx) {
+  const violations = [];
+  const provPath = join(ctx.appPath, "embedded.mobileprovision");
+
+  if (!existsSync(provPath)) {
+    violations.push(makeViolation({
+      ruleID: id, guidelineRef: "ITMS-90034", severity: Severity.INFO,
+      message: "No embedded.mobileprovision found in app bundle",
+      file: ctx.appPath,
+      suggestion: "Provisioning profile may be stripped for App Store builds - verify signing is correct",
+    }));
+    return violations;
+  }
+
+  const data = decodeProfile(provPath);
+  if (!data) {
+    violations.push(makeViolation({
+      ruleID: id, guidelineRef: "ITMS-90034", severity: Severity.WARNING,
+      message: "Could not parse embedded.mobileprovision",
+      file: provPath,
+    }));
+    return violations;
+  }
+
+  // Expiration
+  const expDate = isoDate(data.ExpirationDate);
+  if (expDate) {
+    const now = Date.now();
+    if (expDate.getTime() < now) {
+      violations.push(makeViolation({
+        ruleID: id, guidelineRef: "ITMS-90034", severity: Severity.ERROR,
+        message: `Provisioning profile expired on ${expDate.toISOString()}`,
+        file: provPath,
+        suggestion: "Renew the provisioning profile in Apple Developer Portal",
+      }));
+    } else if (expDate.getTime() - now < SEVEN_DAYS_MS) {
+      violations.push(makeViolation({
+        ruleID: id, severity: Severity.WARNING,
+        message: `Provisioning profile expires soon: ${expDate.toISOString()}`,
+        file: provPath,
+        suggestion: "Consider renewing the provisioning profile before submission",
+      }));
+    }
+  }
+
+  // Development profile detection (get-task-allow=true inside Entitlements)
+  const ents = data.Entitlements;
+  if (ents && ents["get-task-allow"] === true) {
+    violations.push(makeViolation({
+      ruleID: id, guidelineRef: "ITMS-90034", severity: Severity.ERROR,
+      message: "Provisioning profile is a Development profile (not App Store Distribution)",
+      file: provPath,
+      suggestion: "Use an App Store Distribution provisioning profile for submission",
+    }));
+  }
+
+  // Enterprise (In-House) - ProvisionsAllDevices set
+  if (data.ProvisionsAllDevices != null) {
+    violations.push(makeViolation({
+      ruleID: id, severity: Severity.WARNING,
+      message: "Provisioning profile is an Enterprise (In-House) profile",
+      file: provPath,
+      suggestion: "Use an App Store Distribution profile for App Store submission",
+    }));
+  } else if (Array.isArray(data.ProvisionedDevices) && data.ProvisionedDevices.length > 0) {
+    violations.push(makeViolation({
+      ruleID: id, severity: Severity.WARNING,
+      message: `Provisioning profile is Ad Hoc (lists ${data.ProvisionedDevices.length} devices)`,
+      file: provPath,
+      suggestion: "Use an App Store Distribution profile for App Store submission",
+    }));
+  }
+
+  return violations;
+}

package/tools/ios-app-store-audit/rules/required-reason-api.js

@@ -0,0 +1,123 @@
+/**
+ * required-reason-api - Cross-references binary symbol usage with the
+ * privacy manifest's NSPrivacyAccessedAPITypes declarations.
+ * Direct port of RequiredReasonAPIRule.swift + BinaryAnalyzer category logic.
+ *
+ * Apple Guideline: 5.1.1 (Privacy Manifest - Required Reason APIs).
+ * If the binary uses an API in one of the 5 categories but no declaration
+ * is present, App Review rejects with ITMS-91065 / 91066 errors.
+ */
+
+import { execSync } from "child_process";
+import { existsSync } from "fs";
+import { Severity, makeViolation } from "../models.js";
+
+export const id = "required-reason-api";
+export const name = "Required Reason API";
+export const description = "Cross-references binary API usage with privacy manifest declarations";
+
+const CATEGORIES = [
+  {
+    category: "NSPrivacyAccessedAPICategoryFileTimestamp",
+    symbols: [
+      "creationDate", "modificationDate", "contentModificationDateKey",
+      "creationDateKey", "NSFileCreationDate", "NSFileModificationDate",
+      "getattrlist", "fgetattrlist", "stat", "fstat", "lstat",
+    ],
+    validCodes: ["C617.1", "3B52.1", "0A2A.1", "DDA9.1"],
+  },
+  {
+    category: "NSPrivacyAccessedAPICategorySystemBootTime",
+    symbols: [
+      "systemUptime", "mach_absolute_time", "kern.boottime",
+      "ProcessInfo.processInfo.systemUptime",
+    ],
+    validCodes: ["35F9.1", "8FFB.1", "3D61.1"],
+  },
+  {
+    category: "NSPrivacyAccessedAPICategoryDiskSpace",
+    symbols: [
+      "volumeAvailableCapacityKey", "volumeTotalCapacityKey",
+      "volumeAvailableCapacityForImportantUsageKey",
+      "volumeAvailableCapacityForOpportunisticUsageKey",
+      "NSFileSystemFreeSize", "NSFileSystemSize",
+      "statfs", "statvfs", "fstatfs", "fstatvfs",
+    ],
+    validCodes: ["E174.1", "85F4.1", "AB6B.1", "7D9E.1"],
+  },
+  {
+    category: "NSPrivacyAccessedAPICategoryUserDefaults",
+    symbols: ["NSUserDefaults", "UserDefaults.standard"],
+    validCodes: ["CA92.1", "1C8F.1", "C56D.1"],
+  },
+  {
+    category: "NSPrivacyAccessedAPICategoryActiveKeyboards",
+    symbols: ["activeInputModes"],
+    validCodes: ["3EC4.1", "54BD.1"],
+  },
+];
+
+function binaryStringsBlob(executablePath) {
+  try {
+    return execSync(`/usr/bin/strings "${executablePath}"`, {
+      encoding: "utf-8",
+      maxBuffer: 256 * 1024 * 1024,
+    });
+  } catch {
+    return "";
+  }
+}
+
+function declaredAPIs(manifest) {
+  const map = new Map();
+  if (!manifest || !Array.isArray(manifest.NSPrivacyAccessedAPITypes)) return map;
+  for (const apiType of manifest.NSPrivacyAccessedAPITypes) {
+    const cat = apiType?.NSPrivacyAccessedAPIType;
+    const reasons = apiType?.NSPrivacyAccessedAPITypeReasons;
+    if (typeof cat === "string" && Array.isArray(reasons)) {
+      map.set(cat, reasons.filter((r) => typeof r === "string"));
+    }
+  }
+  return map;
+}
+
+export function check(ctx) {
+  const violations = [];
+  if (!ctx.executablePath || !existsSync(ctx.executablePath)) return violations;
+
+  const blob = binaryStringsBlob(ctx.executablePath);
+  if (!blob) return violations;
+
+  const declared = declaredAPIs(ctx.privacyManifest);
+
+  for (const cat of CATEGORIES) {
+    const matchedSymbols = cat.symbols.filter((s) => blob.includes(s));
+    if (matchedSymbols.length === 0) continue;
+
+    const declaredReasons = declared.get(cat.category);
+    if (declaredReasons == null) {
+      // Used but not declared.
+      violations.push(makeViolation({
+        ruleID: id, guidelineRef: "5.1.1", severity: Severity.ERROR,
+        message: `Binary uses ${cat.category} APIs (${matchedSymbols.slice(0, 3).join(", ")}) but no declaration in privacy manifest`,
+        file: "PrivacyInfo.xcprivacy",
+        suggestion: `Add ${cat.category} with appropriate reason codes to NSPrivacyAccessedAPITypes`,
+      }));
+    } else {
+      // Declared - validate reason codes against Apple's whitelist.
+      const validSet = new Set(cat.validCodes);
+      for (const reason of declaredReasons) {
+        if (!validSet.has(reason)) {
+          violations.push(makeViolation({
+            ruleID: id, guidelineRef: "5.1.1", severity: Severity.ERROR,
+            message: `Invalid reason code '${reason}' for ${cat.category}`,
+            file: "PrivacyInfo.xcprivacy",
+            suggestion: `Valid codes: ${[...validSet].sort().join(", ")}`,
+          }));
+        }
+      }
+    }
+  }
+
+  return violations;
+}