ios-app-review-plugin 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (205) hide show
  1. package/.claude/settings.local.json +42 -0
  2. package/.github/actions/ios-review/action.yml +106 -0
  3. package/.github/workflows/ci.yml +103 -0
  4. package/.github/workflows/publish.yml +57 -0
  5. package/CHANGELOG.md +66 -0
  6. package/CONTRIBUTING.md +175 -0
  7. package/LICENSE +21 -0
  8. package/README.md +205 -0
  9. package/bitrise/step.sh +128 -0
  10. package/bitrise/step.yml +101 -0
  11. package/dist/analyzer.d.ts.map +1 -0
  12. package/dist/analyzers/asc-iap.d.ts.map +1 -0
  13. package/dist/analyzers/asc-metadata.d.ts.map +1 -0
  14. package/dist/analyzers/asc-screenshots.d.ts.map +1 -0
  15. package/dist/analyzers/asc-version.d.ts.map +1 -0
  16. package/dist/analyzers/code-scanner.d.ts.map +1 -0
  17. package/dist/analyzers/deprecated-api.d.ts.map +1 -0
  18. package/dist/analyzers/entitlements.d.ts.map +1 -0
  19. package/dist/analyzers/index.d.ts.map +1 -0
  20. package/dist/analyzers/info-plist.d.ts.map +1 -0
  21. package/dist/analyzers/privacy.d.ts.map +1 -0
  22. package/dist/analyzers/private-api.d.ts.map +1 -0
  23. package/dist/analyzers/security.d.ts.map +1 -0
  24. package/dist/analyzers/ui-ux.d.ts.map +1 -0
  25. package/dist/asc/auth.d.ts.map +1 -0
  26. package/dist/asc/client.d.ts.map +1 -0
  27. package/dist/asc/endpoints/apps.d.ts.map +1 -0
  28. package/dist/asc/endpoints/iap.d.ts.map +1 -0
  29. package/dist/asc/endpoints/screenshots.d.ts.map +1 -0
  30. package/dist/asc/endpoints/versions.d.ts.map +1 -0
  31. package/dist/asc/errors.d.ts.map +1 -0
  32. package/dist/asc/index.d.ts.map +1 -0
  33. package/dist/asc/types.d.ts.map +1 -0
  34. package/dist/badge/generator.d.ts.map +1 -0
  35. package/dist/badge/index.d.ts.map +1 -0
  36. package/dist/badge/types.d.ts.map +1 -0
  37. package/dist/cache/file-cache.d.ts.map +1 -0
  38. package/dist/cache/index.d.ts.map +1 -0
  39. package/dist/cache/types.d.ts.map +1 -0
  40. package/dist/cli/commands/help.d.ts.map +1 -0
  41. package/dist/cli/commands/scan.d.ts.map +1 -0
  42. package/dist/cli/commands/version.d.ts.map +1 -0
  43. package/dist/cli/index.d.ts.map +1 -0
  44. package/dist/cli/types.d.ts.map +1 -0
  45. package/dist/git/diff.d.ts.map +1 -0
  46. package/dist/git/index.d.ts.map +1 -0
  47. package/dist/git/types.d.ts.map +1 -0
  48. package/dist/guidelines/database.d.ts.map +1 -0
  49. package/dist/guidelines/index.d.ts.map +1 -0
  50. package/dist/guidelines/matcher.d.ts.map +1 -0
  51. package/dist/guidelines/types.d.ts.map +1 -0
  52. package/dist/history/comparator.d.ts.map +1 -0
  53. package/dist/history/index.d.ts.map +1 -0
  54. package/dist/history/store.d.ts.map +1 -0
  55. package/dist/history/types.d.ts.map +1 -0
  56. package/dist/index.d.ts.map +1 -0
  57. package/dist/index.js +994 -0
  58. package/dist/parsers/index.d.ts.map +1 -0
  59. package/dist/parsers/plist.d.ts.map +1 -0
  60. package/dist/parsers/xcodeproj.d.ts.map +1 -0
  61. package/dist/progress/index.d.ts.map +1 -0
  62. package/dist/progress/reporter.d.ts.map +1 -0
  63. package/dist/progress/types.d.ts.map +1 -0
  64. package/dist/reports/html.d.ts.map +1 -0
  65. package/dist/reports/index.d.ts.map +1 -0
  66. package/dist/reports/json.d.ts.map +1 -0
  67. package/dist/reports/markdown.d.ts.map +1 -0
  68. package/dist/reports/types.d.ts.map +1 -0
  69. package/dist/rules/engine.d.ts.map +1 -0
  70. package/dist/rules/index.d.ts.map +1 -0
  71. package/dist/rules/loader.d.ts.map +1 -0
  72. package/dist/rules/types.d.ts.map +1 -0
  73. package/dist/types/index.d.ts.map +1 -0
  74. package/docs/ANALYZERS.md +237 -0
  75. package/docs/API.md +308 -0
  76. package/docs/BADGES.md +130 -0
  77. package/docs/CI_CD.md +283 -0
  78. package/docs/CLI.md +140 -0
  79. package/docs/REPORTS.md +212 -0
  80. package/docs/ROADMAP.md +267 -0
  81. package/docs/RULES.md +182 -0
  82. package/docs/SECURITY.md +89 -0
  83. package/docs/TROUBLESHOOTING.md +227 -0
  84. package/docs/tutorials/ASC_SETUP.md +188 -0
  85. package/docs/tutorials/CI_INTEGRATION.md +292 -0
  86. package/docs/tutorials/CUSTOM_RULES.md +291 -0
  87. package/docs/tutorials/GETTING_STARTED.md +226 -0
  88. package/docs/video-scripts/01-introduction.md +106 -0
  89. package/docs/video-scripts/02-cli-usage.md +120 -0
  90. package/docs/video-scripts/03-ci-integration.md +198 -0
  91. package/eslint.config.js +33 -0
  92. package/examples/.ios-review-rules.json +82 -0
  93. package/examples/bitrise-workflow.yml +129 -0
  94. package/examples/fastlane-lane.rb +71 -0
  95. package/examples/github-action.yml +147 -0
  96. package/fastlane/Fastfile.example +114 -0
  97. package/fastlane/README.md +99 -0
  98. package/jest.config.js +36 -0
  99. package/package.json +65 -0
  100. package/scripts/benchmark.ts +112 -0
  101. package/scripts/debug-parser.ts +37 -0
  102. package/scripts/debug-pbxproj.ts +36 -0
  103. package/scripts/debug-specific.ts +47 -0
  104. package/scripts/test-analyze.ts +67 -0
  105. package/scripts/xcode-cloud-review.sh +167 -0
  106. package/src/analyzer.ts +227 -0
  107. package/src/analyzers/asc-iap.ts +300 -0
  108. package/src/analyzers/asc-metadata.ts +326 -0
  109. package/src/analyzers/asc-screenshots.ts +310 -0
  110. package/src/analyzers/asc-version.ts +368 -0
  111. package/src/analyzers/code-scanner.ts +408 -0
  112. package/src/analyzers/deprecated-api.ts +390 -0
  113. package/src/analyzers/entitlements.ts +345 -0
  114. package/src/analyzers/index.ts +12 -0
  115. package/src/analyzers/info-plist.ts +409 -0
  116. package/src/analyzers/privacy.ts +376 -0
  117. package/src/analyzers/private-api.ts +377 -0
  118. package/src/analyzers/security.ts +327 -0
  119. package/src/analyzers/ui-ux.ts +509 -0
  120. package/src/asc/auth.ts +204 -0
  121. package/src/asc/client.ts +258 -0
  122. package/src/asc/endpoints/apps.ts +115 -0
  123. package/src/asc/endpoints/iap.ts +171 -0
  124. package/src/asc/endpoints/screenshots.ts +164 -0
  125. package/src/asc/endpoints/versions.ts +174 -0
  126. package/src/asc/errors.ts +109 -0
  127. package/src/asc/index.ts +108 -0
  128. package/src/asc/types.ts +369 -0
  129. package/src/badge/generator.ts +48 -0
  130. package/src/badge/index.ts +2 -0
  131. package/src/badge/types.ts +5 -0
  132. package/src/cache/file-cache.ts +75 -0
  133. package/src/cache/index.ts +2 -0
  134. package/src/cache/types.ts +10 -0
  135. package/src/cli/commands/help.ts +41 -0
  136. package/src/cli/commands/scan.ts +44 -0
  137. package/src/cli/commands/version.ts +12 -0
  138. package/src/cli/index.ts +92 -0
  139. package/src/cli/types.ts +17 -0
  140. package/src/git/diff.ts +21 -0
  141. package/src/git/index.ts +2 -0
  142. package/src/git/types.ts +5 -0
  143. package/src/guidelines/database.ts +344 -0
  144. package/src/guidelines/index.ts +4 -0
  145. package/src/guidelines/matcher.ts +84 -0
  146. package/src/guidelines/types.ts +28 -0
  147. package/src/history/comparator.ts +114 -0
  148. package/src/history/index.ts +3 -0
  149. package/src/history/store.ts +135 -0
  150. package/src/history/types.ts +40 -0
  151. package/src/index.ts +1113 -0
  152. package/src/parsers/index.ts +3 -0
  153. package/src/parsers/plist.ts +253 -0
  154. package/src/parsers/xcodeproj.ts +265 -0
  155. package/src/progress/index.ts +2 -0
  156. package/src/progress/reporter.ts +65 -0
  157. package/src/progress/types.ts +9 -0
  158. package/src/reports/html.ts +322 -0
  159. package/src/reports/index.ts +20 -0
  160. package/src/reports/json.ts +92 -0
  161. package/src/reports/markdown.ts +187 -0
  162. package/src/reports/types.ts +26 -0
  163. package/src/rules/engine.ts +121 -0
  164. package/src/rules/index.ts +3 -0
  165. package/src/rules/loader.ts +83 -0
  166. package/src/rules/types.ts +25 -0
  167. package/src/types/index.ts +247 -0
  168. package/tests/analyzer.test.ts +142 -0
  169. package/tests/analyzers/asc-iap.test.ts +228 -0
  170. package/tests/analyzers/asc-metadata.test.ts +210 -0
  171. package/tests/analyzers/asc-screenshots.test.ts +135 -0
  172. package/tests/analyzers/asc-version.test.ts +259 -0
  173. package/tests/analyzers/code-scanner.test.ts +745 -0
  174. package/tests/analyzers/deprecated-api.test.ts +286 -0
  175. package/tests/analyzers/entitlements.test.ts +411 -0
  176. package/tests/analyzers/info-plist.test.ts +148 -0
  177. package/tests/analyzers/privacy.test.ts +623 -0
  178. package/tests/analyzers/private-api.test.ts +255 -0
  179. package/tests/analyzers/security.test.ts +300 -0
  180. package/tests/analyzers/ui-ux.test.ts +357 -0
  181. package/tests/asc/auth.test.ts +189 -0
  182. package/tests/asc/client.test.ts +207 -0
  183. package/tests/asc/endpoints.test.ts +1359 -0
  184. package/tests/badge/generator.test.ts +73 -0
  185. package/tests/cache/file-cache.test.ts +124 -0
  186. package/tests/cli/cli-index.test.ts +510 -0
  187. package/tests/cli/commands.test.ts +67 -0
  188. package/tests/cli/scan.test.ts +152 -0
  189. package/tests/git/diff.test.ts +69 -0
  190. package/tests/guidelines/matcher.test.ts +209 -0
  191. package/tests/history/comparator.test.ts +272 -0
  192. package/tests/history/store.test.ts +200 -0
  193. package/tests/integration/cli.test.ts +95 -0
  194. package/tests/integration/e2e.test.ts +130 -0
  195. package/tests/parsers/plist.test.ts +240 -0
  196. package/tests/parsers/xcodeproj.test.ts +289 -0
  197. package/tests/progress/reporter.test.ts +117 -0
  198. package/tests/reports/html.test.ts +176 -0
  199. package/tests/reports/json.test.ts +235 -0
  200. package/tests/reports/markdown.test.ts +196 -0
  201. package/tests/rules/engine.test.ts +229 -0
  202. package/tests/rules/loader.test.ts +187 -0
  203. package/tests/setup.ts +15 -0
  204. package/tsconfig.json +27 -0
  205. package/tsconfig.test.json +9 -0
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/parsers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"plist.d.ts","sourceRoot":"","sources":["../../src/parsers/plist.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,wBAAsB,UAAU,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAY1F;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOnE;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEhE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAiCxD;AAwJD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"xcodeproj.d.ts","sourceRoot":"","sources":["../../src/parsers/xcodeproj.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAA2B,MAAM,mBAAmB,CAAC;AAE/E;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAclF"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/progress/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"reporter.d.ts","sourceRoot":"","sources":["../../src/progress/reporter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EAAiB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAElE,qBAAa,gBAAiB,SAAQ,YAAY;IAChD,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,CAA+B;gBAEpC,QAAQ,CAAC,EAAE,gBAAgB;IAKvC,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;IAYvC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAWjC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAatD,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI;IAWzC,IAAI,UAAU,IAAI,MAAM,CAGvB;CACF"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/progress/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,YAAY,GAAG,eAAe,CAAC;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../src/reports/html.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,sBAAsB,EAAwB,MAAM,YAAY,CAAC;AA8DhG,qBAAa,aAAc,YAAW,eAAe;IACnD,MAAM,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM;IA8I9C,OAAO,CAAC,eAAe;IA0BvB,OAAO,CAAC,wBAAwB;IAuBhC,OAAO,CAAC,qBAAqB;CAmE9B"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/reports/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC9G,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAKhE,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,eAAe,CASrE"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../src/reports/json.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AA2C1E,qBAAa,aAAc,YAAW,eAAe;IACnD,MAAM,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM;CA+C/C"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/reports/markdown.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,sBAAsB,EAAwB,MAAM,YAAY,CAAC;AA2BhG,qBAAa,iBAAkB,YAAW,eAAe;IACvD,MAAM,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM;IAqB9C,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,iBAAiB;IAazB,OAAO,CAAC,YAAY;IAgBpB,OAAO,CAAC,eAAe;IAyBvB,OAAO,CAAC,wBAAwB;IAiBhC,OAAO,CAAC,qBAAqB;CAqD9B"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/reports/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE5D,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;AAExD,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,KAAK,EAAE,CAAC;IACnB,cAAc,EAAE,KAAK,EAAE,CAAC;IACxB,aAAa,EAAE,KAAK,EAAE,CAAC;IACvB,KAAK,EAAE,WAAW,GAAG,WAAW,GAAG,QAAQ,CAAC;CAC7C;AAED,MAAM,WAAW,sBAAuB,SAAQ,cAAc;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;CAC/C;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAAC;CAChD"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/rules/engine.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAS,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAKjE,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,aAAa,CAAc;IACnC,OAAO,CAAC,iBAAiB,CAA2B;gBAExC,MAAM,CAAC,EAAE,gBAAgB;IAKrC,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAIvC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS;IAInD,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC;CA8FrF"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rules/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/rules/loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAwBjE,qBAAa,UAAU;IACrB;;OAEG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAgB1D;;OAEG;IACG,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAM/D;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,gBAAgB,GAAG,YAAY,EAAE;IAYtD;;OAEG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,gBAAgB,CAAC;QAAC,KAAK,EAAE,YAAY,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CAQ/G"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/rules/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEjE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,QAAQ,CAAC,EAAE,aAAa,GAAG,QAAQ,GAAG,SAAS,CAAC;CACjD;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,SAAS,CAAC;CAC1D;AAED,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,KAAK,EAAE,MAAM,CAAC;CACf"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEpD;;GAEG;AACH,MAAM,WAAW,KAAK;IACpB,2CAA2C;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,4BAA4B;IAC5B,QAAQ,EAAE,aAAa,CAAC;IACxB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,0CAA0C;IAC1C,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GACrB,YAAY,GACZ,SAAS,GACT,cAAc,GACd,MAAM,GACN,UAAU,GACV,UAAU,GACV,aAAa,GACb,SAAS,GACT,KAAK,GACL,KAAK,GACL,gBAAgB,GAChB,aAAa,GACb,OAAO,GACP,QAAQ,CAAC;AAEb;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,MAAM,EAAE,OAAO,CAAC;IAChB,2BAA2B;IAC3B,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,yBAAyB;IACzB,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,2BAA2B;IAC3B,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,IAAI,EAAE,UAAU,CAAC;IACjB,wBAAwB;IACxB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,yBAAyB;IACzB,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,gCAAgC;IAChC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,gCAAgC;IAChC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,mBAAmB;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,MAAM,UAAU,GAClB,aAAa,GACb,WAAW,GACX,eAAe,GACf,gBAAgB,GAChB,cAAc,GACd,UAAU,GACV,gBAAgB,GAChB,aAAa,GACb,UAAU,GACV,QAAQ,GACR,SAAS,CAAC;AAEd;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,wBAAwB;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0BAA0B;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oCAAoC;IACpC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,0BAA0B;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iCAAiC;IACjC,CAAC,GAAG,EAAE,KAAK,MAAM,kBAAkB,GAAG,MAAM,GAAG,SAAS,CAAC;IACzD,sCAAsC;IACtC,sBAAsB,CAAC,EAAE;QACvB,sBAAsB,CAAC,EAAE,OAAO,CAAC;QACjC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC9C,CAAC;IACF,2BAA2B;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,+BAA+B;IAC/B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,uBAAuB;IACvB,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,2BAA2B;IAC3B,2BAA2B,CAAC,EAAE,wBAAwB,EAAE,CAAC;IACzD,yBAAyB;IACzB,yBAAyB,CAAC,EAAE,sBAAsB,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,wBAAwB;IACvC,0BAA0B,EAAE,MAAM,CAAC;IACnC,gCAAgC,EAAE,OAAO,CAAC;IAC1C,kCAAkC,EAAE,OAAO,CAAC;IAC5C,kCAAkC,EAAE,MAAM,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,sBAAsB;IACrC,wBAAwB,EAAE,MAAM,CAAC;IACjC,+BAA+B,EAAE,MAAM,EAAE,CAAC;CAC3C;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgB7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,eAAe;IAC9B,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CACrC"}
@@ -0,0 +1,237 @@
1
+ # Analyzers Reference
2
+
3
+ The plugin ships with 8 core analyzers and 4 App Store Connect (ASC) analyzers. All run in parallel via `Promise.allSettled` so a failure in one does not block the rest.
4
+
5
+ ---
6
+
7
+ ## Core Analyzers
8
+
9
+ ### info-plist
10
+
11
+ **Name:** Info.plist Analyzer
12
+ **Category:** `info-plist`
13
+
14
+ Validates Info.plist files for the main app target.
15
+
16
+ **Checks performed:**
17
+
18
+ | Issue ID | Severity | What it checks |
19
+ |----------|----------|----------------|
20
+ | `no-app-target` | error | No application target found in project |
21
+ | `missing-info-plist-path` | error | Target has no INFOPLIST_FILE build setting |
22
+ | `info-plist-not-found` | error | Info.plist file does not exist at configured path |
23
+ | `info-plist-parse-error` | error | Plist is malformed or unreadable |
24
+ | `missing-cfbundleidentifier` | error | Missing CFBundleIdentifier |
25
+ | `missing-cfbundlename` | error | Missing CFBundleName |
26
+ | `missing-cfbundleversion` | error | Missing CFBundleVersion |
27
+ | `missing-cfbundleshortversionstring` | error | Missing CFBundleShortVersionString |
28
+ | `missing-cfbundleexecutable` | error | Missing CFBundleExecutable |
29
+ | `missing-cfbundlepackagetype` | error | Missing CFBundlePackageType |
30
+ | `invalid-bundle-identifier` | error | Bundle ID contains invalid characters |
31
+ | `invalid-version-format` | warning | Version does not follow MAJOR.MINOR.PATCH |
32
+ | `ats-allows-arbitrary-loads` | warning | ATS disabled globally |
33
+ | `missing-launch-screen` | warning | No UILaunchStoryboardName or UILaunchScreen |
34
+ | `placeholder-*` | error | Privacy description contains placeholder text |
35
+ | `short-*` | warning | Privacy description under 10 characters |
36
+ | `limiting-capability-*` | info | UIRequiredDeviceCapabilities restricts devices |
37
+
38
+ **Common findings:** Missing privacy usage descriptions, ATS disabled, placeholder strings in permission prompts.
39
+
40
+ ---
41
+
42
+ ### privacy
43
+
44
+ **Name:** Privacy Manifest Analyzer
45
+ **Category:** `privacy`
46
+
47
+ Validates PrivacyInfo.xcprivacy for iOS 17+ Required Reason API declarations.
48
+
49
+ **Required Reason API categories tracked:**
50
+
51
+ - `NSPrivacyAccessedAPICategoryFileTimestamp` -- File timestamp APIs
52
+ - `NSPrivacyAccessedAPICategorySystemBootTime` -- System boot time APIs
53
+ - `NSPrivacyAccessedAPICategoryDiskSpace` -- Disk space APIs
54
+ - `NSPrivacyAccessedAPICategoryActiveKeyboards` -- Active keyboards APIs
55
+ - `NSPrivacyAccessedAPICategoryUserDefaults` -- UserDefaults with suite name
56
+
57
+ | Issue ID | Severity | What it checks |
58
+ |----------|----------|----------------|
59
+ | `missing-privacy-manifest` | error | Code uses Required Reason APIs but no manifest exists |
60
+ | `privacy-manifest-not-found` | error | Manifest path does not exist |
61
+ | `privacy-manifest-parse-error` | error | Manifest is malformed |
62
+ | `tracking-no-domains` | warning | NSPrivacyTracking=true but no domains listed |
63
+ | `undeclared-api-*` | error | API usage detected in code but not declared in manifest |
64
+ | `no-reasons-*` | error | API category declared with no reasons |
65
+ | `invalid-reason-*` | error | Reason code not in Apple's valid list |
66
+ | `no-purpose-*` | warning | Collected data type has no purposes declared |
67
+
68
+ ---
69
+
70
+ ### entitlements
71
+
72
+ **Name:** Entitlements Analyzer
73
+ **Category:** `entitlements`
74
+
75
+ Validates `.entitlements` plist files against capabilities.
76
+
77
+ | Issue ID | Severity | What it checks |
78
+ |----------|----------|----------------|
79
+ | `no-entitlements-file` | info | Target has no entitlements (may be fine) |
80
+ | `entitlements-not-found` | error | Referenced entitlements file does not exist |
81
+ | `entitlements-parse-error` | error | Cannot parse entitlements plist |
82
+ | `debug-entitlement-get-task-allow` | warning | get-task-allow=true in release config |
83
+ | `invalid-aps-environment` | error | Push environment not "development" or "production" |
84
+ | `invalid-app-group-format` | error | App Group ID missing "group." prefix |
85
+ | `invalid-associated-domain-format` | error | Domain missing applinks:/webcredentials: prefix |
86
+ | `invalid-keychain-group-format` | warning | Keychain group missing team ID prefix |
87
+ | `invalid-icloud-container-format` | error | iCloud container missing "iCloud." prefix |
88
+ | `siwa-missing-default` | warning | Sign in with Apple missing "Default" value |
89
+ | `entitlements-summary` | info | Lists all declared entitlements |
90
+
91
+ ---
92
+
93
+ ### code
94
+
95
+ **Name:** Code Scanner
96
+ **Category:** `code`
97
+
98
+ Regex-based scan of Swift and Objective-C source files.
99
+
100
+ | Issue ID | Severity | What it checks |
101
+ |----------|----------|----------------|
102
+ | `hardcoded-ipv4` | warning | IPv4 address strings (IPv6 compliance) |
103
+ | `hardcoded-api-key` | error | API key or secret in source |
104
+ | `aws-key` | error | AWS AKIA access key |
105
+ | `test-server-url` | warning | localhost/staging/test URLs |
106
+ | `print-statement` | info | print/NSLog/debugPrint calls |
107
+ | `todo-comment` | info | TODO/FIXME/HACK/XXX comments |
108
+ | `force-unwrap` | info | Force unwrap operator (!) |
109
+ | `hardcoded-password` | error | Password strings in source |
110
+ | `insecure-http` | warning | HTTP URLs (non-HTTPS) |
111
+ | `placeholder-text` | warning | Lorem ipsum / placeholder strings |
112
+ | `debug-ifdef` | info | #if DEBUG blocks |
113
+ | `deprecated-uiwebview` | error | UIWebView usage (ITMS-90809) |
114
+ | `deprecated-addressbook` | warning | ABAddressBook framework usage |
115
+
116
+ Limits: max 5 issues per pattern per file. Skips commented lines and test imports. Ignores Pods, Carthage, build, and DerivedData directories.
117
+
118
+ ---
119
+
120
+ ### deprecated-api
121
+
122
+ **Name:** Deprecated API Scanner
123
+ **Category:** `deprecated-api`
124
+
125
+ Detects 20+ deprecated iOS APIs. Severity is `error` when the API is removed at your deployment target and `warning` when merely deprecated.
126
+
127
+ **Key APIs tracked:** UIWebView, UIAlertView, UIActionSheet, UIPopoverController, UISearchDisplayController, UITableViewRowAction, NSURLConnection, ABAddressBook, MPMoviePlayerController, ALAssetsLibrary, UILocalNotification, UIAccelerometer, openURL (sync), statusBarStyle, statusBarOrientation, sizeWithFont.
128
+
129
+ ---
130
+
131
+ ### private-api
132
+
133
+ **Name:** Private API Scanner
134
+ **Category:** `private-api`
135
+
136
+ Detects private API usage that causes immediate App Store rejection.
137
+
138
+ **Checks:**
139
+
140
+ - Underscore-prefixed selectors via NSSelectorFromString
141
+ - Private class access via NSClassFromString (`_UI*`, `_NS*`, etc.)
142
+ - performSelector with private selectors
143
+ - valueForKey with underscore-prefixed keys
144
+ - dlopen of PrivateFrameworks
145
+ - dlsym usage
146
+ - Direct objc_msgSend calls
147
+ - IOKit private APIs
148
+ - Private status bar APIs
149
+ - Sandbox escape file paths
150
+ - Import of private frameworks (GraphicsServices, BackBoardServices, SpringBoardServices, etc.)
151
+ - Private URL schemes (cydia://, prefs://, app-prefs://, etc.)
152
+
153
+ ---
154
+
155
+ ### security
156
+
157
+ **Name:** Security Analyzer
158
+ **Category:** `security`
159
+
160
+ Detects security vulnerabilities in source code.
161
+
162
+ | Issue ID | Severity | What it checks |
163
+ |----------|----------|----------------|
164
+ | `security-md5` | warning | MD5 hash usage |
165
+ | `security-sha1` | warning | SHA-1 hash usage |
166
+ | `security-des` | error | DES/3DES encryption |
167
+ | `security-ecb-mode` | error | ECB encryption mode |
168
+ | `security-userdefaults-sensitive` | error | Sensitive data in UserDefaults |
169
+ | `security-userdefaults-sensitive-set` | error | .set() with sensitive key names |
170
+ | `security-insecure-random` | warning | rand()/srand() usage |
171
+ | `security-keychain-accessible-always` | error | kSecAttrAccessibleAlways |
172
+ | `security-keychain-accessible-always-this-device` | error | kSecAttrAccessibleAlwaysThisDeviceOnly |
173
+ | `security-clipboard-sensitive` | warning | Sensitive data on UIPasteboard |
174
+ | `security-sql-injection` | error | String interpolation in SQL |
175
+ | `security-logging-sensitive` | warning | Logging passwords/tokens |
176
+ | `security-hardcoded-encryption-key` | error | Encryption key in source |
177
+ | `security-webview-js-injection` | warning | evaluateJavaScript with interpolation |
178
+ | `security-disabled-ssl` | warning | Disabled certificate validation |
179
+
180
+ ---
181
+
182
+ ### ui-ux
183
+
184
+ **Name:** UI/UX Compliance
185
+ **Category:** `ui-ux`
186
+
187
+ Checks user interface requirements for App Store compliance.
188
+
189
+ | Issue ID | Severity | What it checks |
190
+ |----------|----------|----------------|
191
+ | `uiux-no-target` | info | No application target found |
192
+ | `uiux-no-launch-screen` | error | No LaunchScreen.storyboard or plist entry |
193
+ | `uiux-no-app-icon` | error | No AppIcon.appiconset |
194
+ | `uiux-missing-appstore-icon` | error | Missing 1024x1024 App Store icon |
195
+ | `uiux-missing-iphone-icon` | warning | Missing iPhone icon size/scale |
196
+ | `uiux-missing-ipad-icon` | warning | Missing iPad icon size/scale |
197
+ | `uiux-invalid-icon-contents` | warning | Cannot parse Contents.json |
198
+ | `uiux-ipad-missing-orientations` | error | iPad app missing required orientations |
199
+ | `uiux-placeholder-text` | warning | Placeholder/default text in storyboards |
200
+ | `uiux-no-accessibility-labels` | warning | Images present but no accessibility labels |
201
+ | `uiux-no-dynamic-type` | info | Hardcoded fonts without Dynamic Type |
202
+
203
+ ---
204
+
205
+ ## ASC Analyzers
206
+
207
+ All ASC analyzers require these environment variables:
208
+
209
+ ```
210
+ ASC_KEY_ID=<your-key-id>
211
+ ASC_ISSUER_ID=<your-issuer-id>
212
+ ASC_PRIVATE_KEY_PATH=<path-to-AuthKey.p8>
213
+ ```
214
+
215
+ ### asc-metadata
216
+
217
+ Validates App Store Connect metadata: app name length, subtitle, description, keywords, privacy policy URL, support URL, marketing URL.
218
+
219
+ ### asc-screenshots
220
+
221
+ Validates screenshots: required device sizes present, minimum/maximum counts per locale, processing status (no failed uploads).
222
+
223
+ ### asc-version
224
+
225
+ Compares local version/build with App Store Connect: checks version bumps, build number increments, submission state, and release notes presence.
226
+
227
+ ### asc-iap
228
+
229
+ Validates in-app purchases: localized name and description present, review screenshot uploaded and not failed, IAP status ready for submission.
230
+
231
+ ---
232
+
233
+ ## Custom Rules Engine
234
+
235
+ In addition to the built-in analyzers, the custom rules engine runs rules defined in `.ios-review-rules.json`. See [RULES.md](./RULES.md) for the configuration format.
236
+
237
+ Custom rule issues use category `custom` by default. Rules support `// ios-review-disable-next-line <rule-id>` inline suppression comments.
package/docs/API.md ADDED
@@ -0,0 +1,308 @@
1
+ # MCP Tools API Reference
2
+
3
+ iOS App Review Plugin v1.0.0 exposes 18 MCP tools. Each tool returns content as `{ type: "text", text: string }`. On error, the response includes `isError: true`.
4
+
5
+ ---
6
+
7
+ ## analyze_ios_app
8
+
9
+ Run a full project analysis across all (or selected) analyzers.
10
+
11
+ **Input Schema:**
12
+
13
+ | Parameter | Type | Required | Description |
14
+ |-----------|------|----------|-------------|
15
+ | `projectPath` | string | yes | Path to `.xcodeproj` or `.xcworkspace` |
16
+ | `analyzers` | string[] | no | Subset of analyzers to run (default: all core analyzers) |
17
+ | `targetName` | string | no | Specific build target (default: main app target) |
18
+ | `includeASC` | boolean | no | Run ASC validators (requires env credentials) |
19
+ | `bundleId` | string | no | Override auto-detected bundle ID for ASC calls |
20
+
21
+ Valid analyzer names: `all`, `info-plist`, `privacy`, `entitlements`, `code`, `deprecated-api`, `private-api`, `security`, `ui-ux`, `asc-metadata`, `asc-screenshots`, `asc-version`, `asc-iap`.
22
+
23
+ **Example call:**
24
+
25
+ ```json
26
+ {
27
+ "name": "analyze_ios_app",
28
+ "arguments": {
29
+ "projectPath": "/Users/dev/MyApp/MyApp.xcodeproj",
30
+ "analyzers": ["info-plist", "privacy", "code"],
31
+ "includeASC": false
32
+ }
33
+ }
34
+ ```
35
+
36
+ **Output:** Markdown-formatted report with a readiness score, summary table, and issue details grouped by category.
37
+
38
+ ---
39
+
40
+ ## check_info_plist
41
+
42
+ Validate a single Info.plist file for required keys, privacy descriptions, ATS configuration, and launch screen.
43
+
44
+ | Parameter | Type | Required | Description |
45
+ |-----------|------|----------|-------------|
46
+ | `plistPath` | string | yes | Absolute path to Info.plist |
47
+
48
+ **Example call:**
49
+
50
+ ```json
51
+ {
52
+ "name": "check_info_plist",
53
+ "arguments": {
54
+ "plistPath": "/Users/dev/MyApp/MyApp/Info.plist"
55
+ }
56
+ }
57
+ ```
58
+
59
+ **Output example (truncated):**
60
+
61
+ ```
62
+ # Info.plist Analyzer Analysis
63
+
64
+ **Status:** ISSUES FOUND
65
+ **Duration:** 12ms
66
+
67
+ ## Issues (2)
68
+
69
+ ### [ERROR] Missing required key: CFBundleExecutable
70
+ The Info.plist is missing the required key "CFBundleExecutable".
71
+
72
+ **Location:** `/Users/dev/MyApp/MyApp/Info.plist`
73
+ **Suggestion:** Add the "CFBundleExecutable" key to your Info.plist
74
+
75
+ ### [WARN] App Transport Security allows arbitrary loads
76
+ NSAllowsArbitraryLoads is set to true...
77
+ ```
78
+
79
+ ---
80
+
81
+ ## check_privacy_manifest
82
+
83
+ Validate a PrivacyInfo.xcprivacy file for iOS 17+ compliance. Optionally cross-references API usage in project source files.
84
+
85
+ | Parameter | Type | Required | Description |
86
+ |-----------|------|----------|-------------|
87
+ | `manifestPath` | string | yes | Path to PrivacyInfo.xcprivacy |
88
+ | `projectPath` | string | no | Project path for cross-referencing API usage |
89
+
90
+ ---
91
+
92
+ ## scan_code
93
+
94
+ Scan Swift/Objective-C source code for hardcoded IPs, secrets, debug code, deprecated UIWebView, placeholder text, and more.
95
+
96
+ | Parameter | Type | Required | Description |
97
+ |-----------|------|----------|-------------|
98
+ | `path` | string | yes | File or directory to scan |
99
+ | `patterns` | string[] | no | Specific pattern IDs to check (default: all) |
100
+
101
+ Available pattern IDs: `hardcoded-ipv4`, `hardcoded-api-key`, `aws-key`, `test-server-url`, `print-statement`, `todo-comment`, `force-unwrap`, `hardcoded-password`, `insecure-http`, `placeholder-text`, `debug-ifdef`, `deprecated-uiwebview`, `deprecated-addressbook`.
102
+
103
+ ---
104
+
105
+ ## check_deprecated_apis
106
+
107
+ Scan code for deprecated iOS API usage relative to a deployment target.
108
+
109
+ | Parameter | Type | Required | Description |
110
+ |-----------|------|----------|-------------|
111
+ | `path` | string | yes | File or directory to scan |
112
+ | `deploymentTarget` | string | no | iOS version string, e.g. `"15.0"` (default: `"13.0"`) |
113
+
114
+ APIs removed at your deployment target surface as errors. Deprecated but still available APIs surface as warnings.
115
+
116
+ ---
117
+
118
+ ## check_private_apis
119
+
120
+ Detect private/undocumented iOS API usage that causes App Store rejection. Checks underscore selectors, private frameworks, private URL schemes, IOKit, dlopen of PrivateFrameworks, and sandbox escape patterns.
121
+
122
+ | Parameter | Type | Required | Description |
123
+ |-----------|------|----------|-------------|
124
+ | `path` | string | yes | File or directory to scan |
125
+
126
+ ---
127
+
128
+ ## check_security
129
+
130
+ Scan for security vulnerabilities: weak crypto (MD5, SHA-1, DES, ECB), insecure storage (UserDefaults for secrets), insecure Keychain accessibility, SQL injection, hardcoded encryption keys, and disabled certificate validation.
131
+
132
+ | Parameter | Type | Required | Description |
133
+ |-----------|------|----------|-------------|
134
+ | `path` | string | yes | File or directory to scan |
135
+
136
+ ---
137
+
138
+ ## check_ui_ux
139
+
140
+ Check UI/UX compliance: launch screen, app icons (all sizes), iPad orientation support, placeholder text in storyboards, and accessibility basics (labels, Dynamic Type).
141
+
142
+ | Parameter | Type | Required | Description |
143
+ |-----------|------|----------|-------------|
144
+ | `projectPath` | string | yes | Path to project directory or .xcodeproj |
145
+
146
+ ---
147
+
148
+ ## validate_asc_metadata
149
+
150
+ Validate app metadata in App Store Connect (name, subtitle, description, keywords, privacy policy URL, support URL). Requires ASC credentials via environment variables.
151
+
152
+ | Parameter | Type | Required | Description |
153
+ |-----------|------|----------|-------------|
154
+ | `bundleId` | string | yes | Bundle identifier of the app |
155
+
156
+ **Required environment variables:** `ASC_KEY_ID`, `ASC_ISSUER_ID`, `ASC_PRIVATE_KEY_PATH`.
157
+
158
+ ---
159
+
160
+ ## validate_asc_screenshots
161
+
162
+ Validate screenshots in App Store Connect: required device sizes, counts, and processing status.
163
+
164
+ | Parameter | Type | Required | Description |
165
+ |-----------|------|----------|-------------|
166
+ | `bundleId` | string | yes | Bundle identifier |
167
+
168
+ ---
169
+
170
+ ## compare_versions
171
+
172
+ Compare local version/build numbers with the App Store Connect version. Checks submission status and release notes.
173
+
174
+ | Parameter | Type | Required | Description |
175
+ |-----------|------|----------|-------------|
176
+ | `bundleId` | string | yes | Bundle identifier |
177
+ | `localVersion` | string | no | Local version string, e.g. `"1.2.0"` |
178
+ | `localBuild` | string | no | Local build number, e.g. `"42"` |
179
+
180
+ ---
181
+
182
+ ## validate_iap
183
+
184
+ Validate in-app purchases: localizations, review screenshots, and submission readiness.
185
+
186
+ | Parameter | Type | Required | Description |
187
+ |-----------|------|----------|-------------|
188
+ | `bundleId` | string | yes | Bundle identifier |
189
+
190
+ ---
191
+
192
+ ## full_asc_validation
193
+
194
+ Run all four ASC validators in parallel (metadata, screenshots, versions, IAP). Returns a combined report with summary.
195
+
196
+ | Parameter | Type | Required | Description |
197
+ |-----------|------|----------|-------------|
198
+ | `bundleId` | string | yes | Bundle identifier |
199
+
200
+ ---
201
+
202
+ ## generate_report
203
+
204
+ Run full analysis and produce a formatted report with readiness score, guideline cross-references, and optional historical comparison.
205
+
206
+ | Parameter | Type | Required | Description |
207
+ |-----------|------|----------|-------------|
208
+ | `projectPath` | string | yes | Path to .xcodeproj or .xcworkspace |
209
+ | `format` | string | no | `markdown`, `html`, or `json` (default: `markdown`) |
210
+ | `includeHistory` | boolean | no | Compare against the most recent saved scan |
211
+ | `saveToHistory` | boolean | no | Persist this scan for future comparisons |
212
+
213
+ ---
214
+
215
+ ## compare_scans
216
+
217
+ Compare the current scan with a previous scan to identify new, resolved, and ongoing issues.
218
+
219
+ | Parameter | Type | Required | Description |
220
+ |-----------|------|----------|-------------|
221
+ | `projectPath` | string | yes | Path to .xcodeproj or .xcworkspace |
222
+ | `previousScanId` | string | no | Specific previous scan ID (default: latest) |
223
+
224
+ ---
225
+
226
+ ## view_scan_history
227
+
228
+ List past scan records with scores and trend analysis.
229
+
230
+ | Parameter | Type | Required | Description |
231
+ |-----------|------|----------|-------------|
232
+ | `projectPath` | string | yes | Path to project directory |
233
+ | `limit` | number | no | Max scans to return (default: 10) |
234
+
235
+ **Output example:**
236
+
237
+ ```
238
+ # Scan History
239
+
240
+ | # | Date | Score | Git Branch | Git Commit |
241
+ |---|------|-------|------------|------------|
242
+ | 1 | 1/15/2025, 3:42 PM | 85/100 | main | a1b2c3d |
243
+ | 2 | 1/10/2025, 11:20 AM | 72/100 | feature/x | e4f5g6h |
244
+
245
+ **Trend:** Improving (+13 over 2 scans)
246
+ ```
247
+
248
+ ---
249
+
250
+ ## lookup_guideline
251
+
252
+ Look up an Apple App Store Review Guideline by section number.
253
+
254
+ | Parameter | Type | Required | Description |
255
+ |-----------|------|----------|-------------|
256
+ | `section` | string | yes | Section number, e.g. `"2.5.1"`, `"5.1.1"` |
257
+
258
+ Available sections: `1.2`, `1.4.1`, `2.1`, `2.3`, `2.3.1`, `2.3.7`, `2.4.1`, `2.5.1`, `2.5.4`, `2.5.6`, `3.1.1`, `3.1.2`, `3.1.3`, `3.2.2`, `4.0`, `4.1`, `4.2`, `4.6`, `5.1.1`, `5.1.2`, `5.1.4`, `5.2.1`, `hig-accessibility`, `hig-app-icons`, `hig-launch-screens`.
259
+
260
+ **Output example:**
261
+
262
+ ```
263
+ # Guideline 2.5.1: Software Requirements
264
+
265
+ **Category:** performance
266
+ **Severity Weight:** 9/10
267
+
268
+ Apps must use public APIs and run on the currently shipping OS. Apps that use
269
+ non-public APIs, private frameworks, or deprecated technologies will be rejected.
270
+ Apps must support IPv6 networking.
271
+
272
+ **Reference:** https://developer.apple.com/app-store/review/guidelines/#software-requirements
273
+ ```
274
+
275
+ ---
276
+
277
+ ## validate_custom_rules
278
+
279
+ Validate and preview a `.ios-review-rules.json` custom rules configuration.
280
+
281
+ | Parameter | Type | Required | Description |
282
+ |-----------|------|----------|-------------|
283
+ | `projectPath` | string | yes | Project directory path |
284
+ | `configPath` | string | no | Explicit path to rules file (default: auto-discover by walking up directories) |
285
+
286
+ ---
287
+
288
+ ## Error Handling
289
+
290
+ All tools share a common error wrapper. When an exception occurs, the response looks like:
291
+
292
+ ```json
293
+ {
294
+ "content": [{ "type": "text", "text": "Error: <message>" }],
295
+ "isError": true
296
+ }
297
+ ```
298
+
299
+ Common error scenarios:
300
+
301
+ | Condition | Message pattern |
302
+ |-----------|----------------|
303
+ | Unknown tool name | `Unknown tool: <name>` |
304
+ | Missing required parameter | Zod validation error message |
305
+ | File not found | `ENOENT: no such file or directory` |
306
+ | Invalid plist format | `Could not parse Info.plist: ...` |
307
+ | ASC credentials missing | `ASC_KEY_ID environment variable is required` |
308
+ | Invalid custom rules | `Custom rules validation FAILED: ...` |