react-native-acoustic-connect-beta 18.0.39 → 18.0.40

package/AcousticConnectRN.podspec

@@ -51,6 +51,28 @@ iOSVersion = connectConfig["Connect"]["iOSVersion"]
 sdkFloor = '>= 2.1.12'
 dependencyRequirements = iOSVersion.to_s.empty? ? [sdkFloor] : [sdkFloor, iOSVersion]
 
+# Normalize Connect.PushEnabled to a STRICT boolean before writing the native
+# config bundle. A nil/absent value otherwise serializes as JSON `null`, and the
+# iOS SDK then initializes push-off (ConnectSDK.shared.push == nil) — silently
+# breaking push on the very first build (CA-144135 §7). Coercing here guarantees
+# the bundle never ships `null`; the native lenient parser defends the runtime
+# path, but this prevents shipping a non-boolean value in the first place.
+#
+# This NEVER raises: PushEnabled is the single push gate, so a config that has
+# push infrastructure (e.g. an App Group) but PushEnabled false/absent is a
+# perfectly valid push-off integration and must install cleanly. We only coerce,
+# and warn when the value isn't a canonical boolean so a typo is visible.
+connectSection = (connectConfig["Connect"] ||= {})
+rawPush = connectSection["PushEnabled"]
+pushEnabledBool =
+  rawPush == true || (rawPush.is_a?(String) && rawPush.strip.downcase == "true")
+if rawPush.nil?
+  puts "WARNING: Connect.PushEnabled was absent/null in ConnectConfig.json — treating it as false in ios/AcousticConnectRNConfig.json. Set \"PushEnabled\": true (boolean) to enable iOS push."
+elsif rawPush != true && rawPush != false
+  puts "WARNING: Connect.PushEnabled was #{rawPush.inspect} (not a JSON boolean) in ConnectConfig.json — coercing to #{pushEnabledBool}. Use a boolean true/false."
+end
+connectSection["PushEnabled"] = pushEnabledBool
+
 # Write the merged consumer config to the resource-bundle source path AT POD INSTALL TIME.
 # This MUST happen before CocoaPods builds the AcousticConnectRNConfig bundle target,
 # which it does as a dependency of the parent target — too early for any build-time

package/CHANGELOG.md

@@ -1,3 +1,4 @@
+## [18.0.40](https://github.com/aipoweredmarketer/react-native-acoustic-connect-beta/compare/18.0.39...18.0.40) (2026-06-24)
 ## [18.0.39](https://github.com/aipoweredmarketer/react-native-acoustic-connect-beta/compare/18.0.38...18.0.39) (2026-06-23)
 ## [18.0.38](https://github.com/aipoweredmarketer/react-native-acoustic-connect-beta/compare/18.0.37...18.0.38) (2026-06-22)
 ## [18.0.37](https://github.com/aipoweredmarketer/react-native-acoustic-connect-beta/compare/18.0.36...18.0.37) (2026-06-22)

package/README.md

@@ -119,7 +119,11 @@ npm install react-native-acoustic-connect-beta react-native-nitro-modules
 
 1. Put `ConnectConfig.json` at the project root — the same file documented in
    [Installation](#installation). For push, set `PushEnabled`, `iOSPushMode`,
-   and `iOSAppGroupIdentifier` in the `Connect` block.
+   `iOSAppGroupIdentifier`, and `iOSDevelopmentTeam` (your 10-char Apple Team
+   ID) in the `Connect` block. Run `npx acoustic-connect doctor` to validate it
+   — when `PushEnabled` is `true`, the doctor **fails** (exits non-zero) on any
+   missing push input (collector URLs, App Group, signing team,
+   `google-services.json`, app ids); when push is off it needs only `AppKey`.
 
 2. Add the plugin to `app.json`:
 
@@ -131,11 +135,11 @@ npm install react-native-acoustic-connect-beta react-native-nitro-modules
 }
 ```
 
-The plugin reads the App Group from `Connect.iOSAppGroupIdentifier` in
-`ConnectConfig.json` — the same value the SDK reads at runtime, so the
-entitlement and the runtime config agree by construction. To use a different
-value for the entitlement only (rarely needed), pass a plugin prop; the prop
-takes precedence over `ConnectConfig.json`:
+The plugin reads the App Group from `Connect.iOSAppGroupIdentifier` and the
+signing team from `Connect.iOSDevelopmentTeam` in `ConnectConfig.json` — the
+same values the SDK reads at runtime, so the entitlement and the runtime config
+agree by construction. To override either for the native project only (rarely
+needed), pass plugin props; props take precedence over `ConnectConfig.json`:
 
 ```json
 {
@@ -143,21 +147,41 @@ takes precedence over `ConnectConfig.json`:
     "plugins": [
       [
         "react-native-acoustic-connect-beta",
-        { "iosAppGroupIdentifier": "group.com.example.myapp" }
+        {
+          "iosAppGroupIdentifier": "group.com.example.myapp",
+          "iosDevelopmentTeam": "ABCDE12345"
+        }
       ]
     ]
   }
 }
 ```
 
+`iosDevelopmentTeam` is **required for push**: during `expo prebuild` the plugin
+stamps `DEVELOPMENT_TEAM` onto the host app and both push extensions. Without a
+team, a CLI build falls back to ad-hoc signing, which drops the `aps-environment`
+entitlement — so iOS issues no APNs token and push silently fails.
+
 ### Build
 
 ```bash
 npx expo prebuild
-npx expo run:ios        # or: eas build --profile development --platform ios
+npx expo run:ios -- --extra-params "-allowProvisioningUpdates"   # or: eas build --profile development --platform ios
 npx expo run:android    # or: eas build --profile development --platform android
 ```
 
+**iOS push needs provisioning.** Setting `iOSDevelopmentTeam` lets the plugin
+stamp the team, but `xcodebuild` still has to fetch/create the Development
+certificate and provisioning profiles (the host + both extension App IDs, with
+the Push Notifications and App Groups capabilities). Pass
+`-allowProvisioningUpdates` so it does that automatically — it requires your
+Apple ID to be added once in **Xcode → Settings → Accounts**. `eas build`
+manages the whole signing chain itself, so no flag is needed there; CI/headless
+runs can use an App Store Connect API key
+(`-authenticationKeyPath/-authenticationKeyID/-authenticationKeyIssuerID` with
+`-allowProvisioningUpdates`). For the bare workflow, the equivalent is
+`react-native run-ios --extra-params "-allowProvisioningUpdates"`.
+
 During `expo prebuild` the plugin automatically:
 
 - adds a `ConnectNSE` Notification Service Extension target to the Xcode
@@ -308,9 +332,15 @@ Stops data capture, flushes pending messages, releases push state. Idempotent.
 | --- | --- | --- | --- |
 | `PushEnabled` | boolean | `false` | Cross-platform master switch. On Android, drives `connect-push-fcm` artifact inclusion at build time. |
 | `iOSPushMode` | `"automatic"` / `"manual"` | `"automatic"` | iOS-only. Ignored when `PushEnabled` is `false`. |
-| `iOSAppGroupIdentifier` | string \| null | `null` | iOS App Group shared with NSE / NCE for rich push payloads. |
+| `iOSAppGroupIdentifier` | string \| null | `null` | iOS App Group shared with NSE / NCE for rich push payloads. Required when push is on. |
+| `iOSDevelopmentTeam` | string \| null | `null` | 10-char Apple Team ID used to sign the host + push extensions. Required for iOS push — without it the build drops `aps-environment` and the OS issues no APNs token. |
 | `AndroidNotificationIconResName` | string \| null | `null` | Drawable resource name for the Android notification small icon. |
 
+> When `PushEnabled` is `true`, `npx acoustic-connect doctor` treats the
+> push-required inputs above (plus collector URLs, `google-services.json`, and
+> the app ids) as **hard failures** and exits non-zero. When push is off it
+> validates only `AppKey` — a non-push integration needs nothing more.
+
 #### iOS push modes
 
 - `"automatic"` — the iOS Connect SDK manages APNs token registration internally. The host app only requests user permission via `UNUserNotificationCenter`; token delivery and forwarding to the Connect backend are handled by the SDK.
@@ -377,6 +407,35 @@ init-time `ClassNotFoundException`), and bypassing means **you take on that
 risk** — we cannot guard against breaking changes in arbitrary Nitro patch
 releases. Match the version rather than bypass it.
 
+### iOS — push session reaches the collector but no notifications arrive (no APNs token)
+
+A CLI build (`expo run:ios` / `react-native run-ios` / `xcodebuild`) doesn't
+auto-pick a signing team the way the Xcode GUI does. With no team, it signs
+ad-hoc and **drops the `aps-environment` entitlement**, so iOS issues no APNs
+token — the app still launches and analytics reach the collector, but no
+`pushRegistration` (with a `mobileToken`) is ever sent. Fix:
+
+1. Set `Connect.iOSDevelopmentTeam` (10-char Apple Team ID) in
+   `ConnectConfig.json` (or pass the `iosDevelopmentTeam` plugin prop). Re-run
+   `expo prebuild` / `npx acoustic-connect setup-ios-push` so the team is
+   stamped on the host + extensions.
+2. Build with `-allowProvisioningUpdates` (see [Build](#build)) and your Apple
+   ID added in Xcode → Settings → Accounts, so a Development certificate +
+   profiles are provisioned.
+
+`npx acoustic-connect doctor` fails with this exact remedy when push is on and
+the team is missing (or when no Development certificate is in your keychain).
+
+### iOS — Expo Android build fails: `No matching client found for package name …`
+
+Your `app.json` `android.package` isn't registered in the active
+`google-services.json` (FCM matches by package). The config plugin and
+`acoustic-connect doctor` now catch this up front. Register that exact package
+in the same Firebase project and re-download `google-services.json` — and note
+that **changing `android.package` requires a clean prebuild**
+(`npx expo prebuild --platform android --clean`); an incremental prebuild keeps
+the stale `applicationId`.
+
 ### iOS — `pod install` fails with `[Connect] requires AcousticConnect >= 2.0.5`
 
 You've pinned an older `iOSVersion` in `ConnectConfig.json`. Bump it to a

package/android/src/main/assets/ConnectBasicConfig.properties

@@ -1,4 +1,4 @@
-#Tue Jun 23 01:25:25 PDT 2026
+#Wed Jun 24 09:52:20 PDT 2026
 UseWhiteList=true
 PrintScreen=3
 UseRandomSample=false

package/cli/doctor.mjs

@@ -23,6 +23,7 @@ import path from 'node:path'
 
 import {
   Reporter,
+  capture,
   color,
   copyIfMissing,
   fileExists,
@@ -41,6 +42,29 @@ const APP_GROUP_PATTERN = /^group\.[A-Za-z0-9.-]+$/
 // still on the placeholder so it isn't shipped by accident.
 const PLACEHOLDER_ID_PREFIX = 'com.example.'
 
+// Sentinels shipped in ConnectConfig.example.json — a value still on one of
+// these means the consumer hasn't filled it in.
+const PLACEHOLDER_APP_KEY = 'YOUR_CONNECT_APP_KEY_HERE'
+const PLACEHOLDER_APP_GROUP = 'YOUR_APP_GROUP_ID_HERE'
+const PLACEHOLDER_TEAM = 'YOUR_TEAM_ID'
+// Host of the placeholder collector URLs in the bare sample's example config.
+const PLACEHOLDER_COLLECTOR_HOST = 'collector.example.com'
+// Apple Team IDs are 10 uppercase-alphanumeric characters.
+const TEAM_PATTERN = /^[A-Z0-9]{10}$/
+
+// A usable collector endpoint: a parseable https URL whose host isn't the
+// example placeholder. Used for PostMessageUrl / KillSwitchUrl.
+function isValidCollectorUrl(value) {
+  if (!value || typeof value !== 'string') return false
+  let u
+  try {
+    u = new URL(value)
+  } catch {
+    return false
+  }
+  return u.protocol === 'https:' && u.hostname !== PLACEHOLDER_COLLECTOR_HOST
+}
+
 // Java reserved words (+ literals) that cannot appear as a package segment.
 // Expo uses android.package as the Java/Kotlin namespace, so any segment that
 // is a keyword breaks the Gradle build ("not a valid Java package name").
@@ -91,23 +115,55 @@ function ensureConnectConfig(reporter, dir) {
   else reporter.fail('ConnectConfig.json', 'ConnectConfig.example.json missing')
 }
 
-// Validate the App Group identifier (when set). A bad value fails the Config
-// Plugin during `expo prebuild` / the iOS extensions at build time, not here,
-// so catch it early. Returns { appGroup, pushEnabled } for downstream checks.
-function checkConnectConfigValues(reporter, dir) {
+// Validate the ConnectConfig.json values. The push-required inputs (collector
+// URLs, App Group, iOS signing team) are only HARD failures when push is on —
+// or when `--require-push` forces it. A client that doesn't use push needs
+// nothing beyond AppKey, so off-push these stay advisory and never block.
+//
+// A bad value otherwise fails the Config Plugin during `expo prebuild` / the
+// iOS extensions at build time, not here, so catch it early. Returns
+// { appGroup, pushEnabled, strict } for downstream checks.
+function checkConnectConfigValues(reporter, dir, {requirePush} = {}) {
   const cfg = readJson(path.join(dir, 'ConnectConfig.json'))
   if (cfg === undefined) {
     // Missing/failed was already reported by ensureConnectConfig; only flag a
     // present-but-broken file here.
     if (fileExists(path.join(dir, 'ConnectConfig.json')))
       reporter.fail('ConnectConfig.json', 'present but not valid JSON')
-    return {}
+    return {strict: requirePush === true}
   }
   const connect = (cfg && cfg.Connect) || {}
   const appGroup = connect.iOSAppGroupIdentifier
   const pushEnabled = connect.PushEnabled === true
+  // Push-required inputs are strict iff push is on (or forced via flag).
+  const strict = pushEnabled || requirePush === true
+  const gate = (label, detail) =>
+    strict ? reporter.fail(label, detail) : reporter.warn(label, detail)
+
+  // AppKey — the one value the SDK always needs to reach the collector. Under
+  // push it's a hard gate; off push it stays advisory (a non-push client may
+  // simply not have wired it yet — but it still needs it to send anything).
+  const appKey = connect.AppKey
+  if (appKey && appKey !== PLACEHOLDER_APP_KEY) reporter.pass('AppKey', 'set')
+  else
+    gate(
+      'AppKey',
+      `not set (empty or still "${PLACEHOLDER_APP_KEY}") — required to send to the collector`,
+    )
 
-  if (appGroup) {
+  // Collector URLs — the push registration (and every event) posts here. The
+  // example ships unfilled placeholders, so reject those under push.
+  for (const key of ['PostMessageUrl', 'KillSwitchUrl']) {
+    if (isValidCollectorUrl(connect[key])) reporter.pass(key, 'set')
+    else
+      gate(
+        key,
+        `"${connect[key] ?? ''}" is not a valid https collector URL (host must not be ${PLACEHOLDER_COLLECTOR_HOST})`,
+      )
+  }
+
+  // App Group — the shared store the iOS NSE/NCE rich-push extensions read/write.
+  if (appGroup && appGroup !== PLACEHOLDER_APP_GROUP) {
     if (APP_GROUP_PATTERN.test(appGroup))
       reporter.pass('iOSAppGroupIdentifier', appGroup)
     else
@@ -115,13 +171,29 @@ function checkConnectConfigValues(reporter, dir) {
         'iOSAppGroupIdentifier',
         `"${appGroup}" is invalid — must match group.<reverse-dns> (letters/digits/dots/hyphens)`,
       )
-  } else if (pushEnabled) {
-    reporter.warn(
+  } else {
+    gate(
       'iOSAppGroupIdentifier',
-      'PushEnabled is true but no App Group set — required for the NSE/NCE rich-push extensions',
+      appGroup
+        ? `still the placeholder "${appGroup}" — set your own App Group`
+        : 'not set — required for the iOS NSE/NCE rich-push extensions',
     )
   }
-  return {appGroup, pushEnabled}
+
+  // iOS signing team — without it a CLI build drops aps-environment to ad-hoc
+  // signing and the OS issues no APNs token (silent on the Simulator).
+  const team = connect.iOSDevelopmentTeam
+  if (team && team !== PLACEHOLDER_TEAM && TEAM_PATTERN.test(team))
+    reporter.pass('iOSDevelopmentTeam', team)
+  else
+    gate(
+      'iOSDevelopmentTeam',
+      team && team !== PLACEHOLDER_TEAM
+        ? `"${team}" is not a 10-char Apple Team ID`
+        : 'not set — required so the iOS build embeds aps-environment (no APNs token without it)',
+    )
+
+  return {appGroup, pushEnabled, strict}
 }
 
 function validateAndroidPackage(reporter, label, pkg) {
@@ -138,8 +210,12 @@ function validateAndroidPackage(reporter, label, pkg) {
   else reporter.pass(label, pkg)
 }
 
-// Expo: identifiers live in app.json's expo block.
-function checkAppJson(reporter, dir) {
+// Expo: identifiers live in app.json's expo block. Under push (`strict`) the
+// ids must be set and off the sample placeholder, because android.package must
+// match a client in google-services.json (Gradle fails otherwise) and
+// ios.bundleIdentifier drives APNs. Off push these stay advisory. Returns the
+// resolved android.package and the configured googleServicesFile (if any).
+function checkAppJson(reporter, dir, {strict} = {}) {
   const appJson = readJson(path.join(dir, 'app.json'))
   if (!appJson || !appJson.expo) {
     reporter.fail('app.json', 'missing or has no "expo" block')
@@ -148,24 +224,68 @@ function checkAppJson(reporter, dir) {
   const expo = appJson.expo
   const androidPackage = expo.android && expo.android.package
   const iosBundleId = expo.ios && expo.ios.bundleIdentifier
-  validateAndroidPackage(reporter, 'android.package', androidPackage)
-  if (iosBundleId) reporter.pass('ios.bundleIdentifier', iosBundleId)
-  else reporter.warn('ios.bundleIdentifier', 'not set in app.json')
-
-  // The sample ships placeholder ids; warn if they haven't been replaced. We
-  // only flag — setting them is the standard Expo step, owned by the developer
-  // (or injected by the test-automation pipeline), not rewritten by the SDK.
-  for (const [label, value] of [
-    ['ios.bundleIdentifier', iosBundleId],
-    ['android.package', androidPackage],
-  ]) {
-    if (value && value.startsWith(PLACEHOLDER_ID_PREFIX))
-      reporter.warn(
-        label,
-        `still the sample placeholder "${value}" — set your own in app.json before building (standard Expo step)`,
-      )
+  const gsFile = expo.android && expo.android.googleServicesFile
+  const gate = (label, detail) =>
+    strict ? reporter.fail(label, detail) : reporter.warn(label, detail)
+
+  // android.package: must be set + non-placeholder under push; always
+  // keyword-checked when present (a Java keyword segment breaks the build).
+  if (!androidPackage)
+    gate('android.package', 'not set in app.json — required for the Android build / FCM')
+  else if (androidPackage.startsWith(PLACEHOLDER_ID_PREFIX))
+    gate(
+      'android.package',
+      `still the sample placeholder "${androidPackage}" — set your own (must match a client in google-services.json)`,
+    )
+  else validateAndroidPackage(reporter, 'android.package', androidPackage)
+
+  // ios.bundleIdentifier: must be set + non-placeholder under push (drives APNs).
+  if (!iosBundleId) gate('ios.bundleIdentifier', 'not set in app.json')
+  else if (iosBundleId.startsWith(PLACEHOLDER_ID_PREFIX))
+    gate(
+      'ios.bundleIdentifier',
+      `still the sample placeholder "${iosBundleId}" — set your own in app.json before building`,
+    )
+  else reporter.pass('ios.bundleIdentifier', iosBundleId)
+
+  return {androidPackage, iosBundleId, gsFile}
+}
+
+// Expo only: an incremental `expo prebuild` does NOT propagate an app.json
+// android.package change into an already-generated android/app/build.gradle
+// (prebuild is non-destructive). Catch the stale applicationId so the developer
+// doesn't hit a confusing google-services mismatch on a config they "already
+// fixed".
+function checkExpoCleanPrebuild(reporter, dir, {androidPackage, strict} = {}) {
+  if (!androidPackage) return
+  const gradle = readText(path.join(dir, 'android', 'app', 'build.gradle'))
+  if (!gradle) return // not prebuilt yet — nothing stale to catch
+  const appId = gradle.match(/applicationId\s+["']([^"']+)["']/)?.[1]
+  if (appId && appId !== androidPackage) {
+    const detail = `generated applicationId "${appId}" ≠ app.json android.package "${androidPackage}" — run \`npx expo prebuild --platform android --clean\` to regenerate`
+    if (strict) reporter.fail('android/ (stale prebuild)', detail)
+    else reporter.warn('android/ (stale prebuild)', detail)
   }
-  return {androidPackage, iosBundleId}
+}
+
+// iOS only, macOS only, best-effort hint — NEVER a hard failure. A *local dev*
+// CLI build with no Development certificate falls back to ad-hoc signing, which
+// drops aps-environment → no APNs token. But a CI/release machine that signs
+// with an Apple Distribution certificate (and has no Development cert) is a
+// perfectly valid configuration, so blocking it would be wrong — this stays a
+// warning either way. Skips silently when `security` is unavailable (non-mac /
+// locked keychain).
+function checkIosSigningIdentity(reporter) {
+  if (process.platform !== 'darwin') return
+  const {ok, stdout} = capture('security find-identity -p codesigning -v')
+  if (!ok) return
+  if (/Apple Development|iPhone Developer/.test(stdout))
+    reporter.pass('iOS signing identity', 'Apple Development certificate present')
+  else
+    reporter.warn(
+      'iOS signing identity',
+      'no Apple Development certificate in the keychain — fine for CI/release (Distribution signing), but a local dev push build needs one, else ad-hoc signing drops aps-environment (no APNs token). Add your Apple ID in Xcode → Accounts and build once with -allowProvisioningUpdates.',
+    )
 }
 
 // Bare: read identifiers from android/app/build.gradle. Two distinct fields:
@@ -190,10 +310,10 @@ function checkBareAndroidId(reporter, dir) {
 // google-services.json must contain a client whose package_name matches the
 // Android package (FCM matches by package); the gradle plugin fails otherwise
 // ("No matching client found for package name").
-function checkGoogleServices(reporter, {gsPath, androidPackage, pushEnabled}) {
+function checkGoogleServices(reporter, {gsPath, androidPackage, strict}) {
   if (!fileExists(gsPath)) {
-    if (pushEnabled)
-      reporter.warn(
+    if (strict)
+      reporter.fail(
         'google-services.json',
         'missing — required for Android FCM builds (add the Firebase Android app, then download it here)',
       )
@@ -211,12 +331,11 @@ function checkGoogleServices(reporter, {gsPath, androidPackage, pushEnabled}) {
   const packages = (gs.client || [])
     .map((c) => c.client_info?.android_client_info?.package_name)
     .filter(Boolean)
-  if (isPlaceholder)
-    reporter.warn(
-      'google-services.json',
-      `placeholder values — replace with your real Firebase config (register package '${androidPackage}')`,
-    )
-  else if (androidPackage && !packages.includes(androidPackage))
+  if (isPlaceholder) {
+    const detail = `placeholder values — replace with your real Firebase config (register package '${androidPackage}')`
+    if (strict) reporter.fail('google-services.json', detail)
+    else reporter.warn('google-services.json', detail)
+  } else if (androidPackage && !packages.includes(androidPackage))
     reporter.fail(
       'google-services.json',
       `no client matches '${androidPackage}' (has: ${packages.join(', ') || 'none'}). Register that package in Firebase and re-download.`,
@@ -271,7 +390,8 @@ function checkBareIosEntitlements(reporter, dir) {
 
 // Run all relevant checks for `dir`. Returns the Reporter (caller decides how
 // to print the summary / exit).
-export function runDoctor(dir, {reporter = new Reporter()} = {}) {
+export function runDoctor(dir, {reporter = new Reporter(), flags = {}} = {}) {
+  const requirePush = flags.requirePush === true
   const type = detectProjectType(dir)
   console.log(
     color.bold('\nAcoustic Connect doctor') +
@@ -283,12 +403,15 @@ export function runDoctor(dir, {reporter = new Reporter()} = {}) {
 
   section('Configuration')
   ensureConnectConfig(reporter, dir)
-  const {pushEnabled} = checkConnectConfigValues(reporter, dir)
+  const {strict = requirePush} = checkConnectConfigValues(reporter, dir, {
+    requirePush,
+  })
 
   section('Identifiers')
   let androidPackage
+  let gsFile
   if (type === 'expo') {
-    ;({androidPackage} = checkAppJson(reporter, dir))
+    ;({androidPackage, gsFile} = checkAppJson(reporter, dir, {strict}))
   } else if (type === 'bare') {
     ;({androidPackage} = checkBareAndroidId(reporter, dir))
   } else {
@@ -301,14 +424,18 @@ export function runDoctor(dir, {reporter = new Reporter()} = {}) {
   section('Android push (FCM)')
   const gsPath =
     type === 'expo'
-      ? path.join(dir, 'google-services.json')
+      ? path.join(dir, gsFile || 'google-services.json')
       : path.join(dir, 'android', 'app', 'google-services.json')
-  checkGoogleServices(reporter, {gsPath, androidPackage, pushEnabled})
+  checkGoogleServices(reporter, {gsPath, androidPackage, strict})
+  if (type === 'expo') checkExpoCleanPrebuild(reporter, dir, {androidPackage, strict})
 
-  if (type === 'bare') {
-    section('iOS push')
-    checkBareIosEntitlements(reporter, dir)
-  }
+  section('iOS push')
+  if (type === 'bare') checkBareIosEntitlements(reporter, dir)
+  // Signing-identity hint is only relevant to push (it's about the
+  // aps-environment drop). Skip it for non-push projects to avoid noise; it's
+  // always a warning when it does run, so it never blocks a Distribution-only
+  // CI/release machine.
+  if (strict) checkIosSigningIdentity(reporter)
 
   return reporter
 }

package/cli/index.mjs

@@ -4,11 +4,16 @@
 // Ships in the published package so client apps don't have to re-implement the
 // integration plumbing our own sample apps used to carry. Subcommands:
 //
-//   acoustic-connect doctor [dir]          Validate config + scaffold ConnectConfig.json
-//   acoustic-connect setup-ios-push [dir]  Create/repair the iOS NSE + NCE push extensions
+//   acoustic-connect doctor [dir] [--require-push]  Validate config + scaffold ConnectConfig.json
+//   acoustic-connect setup-ios-push [dir]           Create/repair the iOS NSE + NCE push extensions
 //
 // `dir` defaults to the current working directory (npm passes $INIT_CWD when
 // run as a script). All commands are idempotent and safe to re-run.
+//
+// `doctor` treats the push-required inputs (collector URLs, App Group, iOS
+// signing team, google-services, Expo ids) as HARD failures only when push is
+// enabled (Connect.PushEnabled === true) or `--require-push` is passed. A
+// non-push client needs nothing beyond AppKey and never trips these.
 
 import path from 'node:path'
 
@@ -19,10 +24,13 @@ import {Reporter, color} from './lib.mjs'
 const USAGE = `acoustic-connect — React Native Acoustic Connect SDK setup
 
 Usage:
-  acoustic-connect doctor [dir]          Validate config + scaffold ConnectConfig.json
-  acoustic-connect setup-ios-push [dir]  Create/repair the iOS NSE + NCE push extensions
+  acoustic-connect doctor [dir] [--require-push]  Validate config + scaffold ConnectConfig.json
+  acoustic-connect setup-ios-push [dir]           Create/repair the iOS NSE + NCE push extensions
+
+dir defaults to the current directory.
 
-dir defaults to the current directory.`
+  --require-push   Treat the push-required inputs as hard failures even when
+                   Connect.PushEnabled is not true (push is otherwise the gate).`
 
 // Resolve the target directory: explicit arg > $INIT_CWD (npm) > cwd.
 function targetDir(arg) {
@@ -32,18 +40,22 @@ function targetDir(arg) {
 }
 
 async function main() {
-  const [command, maybeDir] = process.argv.slice(2)
+  const args = process.argv.slice(2)
+  const command = args[0]
 
   if (!command || command === '--help' || command === '-h' || command === 'help') {
     console.log(USAGE)
     process.exit(command ? 0 : 1)
   }
 
-  const dir = targetDir(maybeDir)
+  // First non-flag argument after the command is the target dir.
+  const dirArg = args.slice(1).find((a) => !a.startsWith('-'))
+  const dir = targetDir(dirArg)
+  const requirePush = args.includes('--require-push')
 
   switch (command) {
     case 'doctor': {
-      const reporter = runDoctor(dir)
+      const reporter = runDoctor(dir, {flags: {requirePush}})
       process.exit(reporter.summary())
     }
     case 'setup-ios-push': {

package/cli/ios/add_push_extensions.rb

@@ -29,6 +29,11 @@
 #                              PRODUCT_BUNDLE_IDENTIFIER)
 #   ACOUSTIC_DEPLOYMENT_TARGET iOS deployment target (default 15.1)
 #   ACOUSTIC_SWIFT_VERSION     Swift version        (default 5.0)
+#   ACOUSTIC_DEVELOPMENT_TEAM  Apple Team ID (10-char)           (optional —
+#                              when set, stamped onto the host + both extension
+#                              targets so all three sign consistently. Without a
+#                              team a CLI build falls back to ad-hoc signing,
+#                              which drops aps-environment → no APNs token.)
 #
 # Requires the `xcodeproj` gem (ships with CocoaPods).
 
@@ -45,6 +50,9 @@ PROJECT_PATH = env!('ACOUSTIC_PROJECT_PATH')
 APP_TARGET_NAME = env!('ACOUSTIC_APP_TARGET')
 DEPLOYMENT_TARGET = ENV.fetch('ACOUSTIC_DEPLOYMENT_TARGET', '15.1')
 SWIFT_VERSION = ENV.fetch('ACOUSTIC_SWIFT_VERSION', '5.0')
+# Optional — only stamped when provided (and non-empty / not the placeholder).
+DEVELOPMENT_TEAM = ENV['ACOUSTIC_DEVELOPMENT_TEAM'].to_s.strip
+TEAM_SET = !DEVELOPMENT_TEAM.empty? && DEVELOPMENT_TEAM != 'YOUR_TEAM_ID'
 
 EXTENSIONS = [
   {
@@ -91,10 +99,12 @@ APP_BUNDLE_ID = resolve_bundle_id(app_target)
 raise 'Could not determine the host bundle id; pass ACOUSTIC_APP_BUNDLE_ID' unless APP_BUNDLE_ID
 
 # 1. Wire the host app's entitlements (App Group + aps-environment) onto both
-#    build configurations. Safe to re-run.
+#    build configurations. Safe to re-run. Stamp the signing team too (when
+#    provided) so the host doesn't fall back to ad-hoc signing.
 app_target.build_configurations.each do |config|
   config.build_settings['CODE_SIGN_ENTITLEMENTS'] =
     "#{APP_TARGET_NAME}/#{APP_TARGET_NAME}.entitlements"
+  config.build_settings['DEVELOPMENT_TEAM'] = DEVELOPMENT_TEAM if TEAM_SET
 end
 
 # Make the host entitlements file visible in the project navigator.
@@ -186,6 +196,16 @@ EXTENSIONS.each do |ext|
       puts "#{ext[:name]}: linked #{fw}.framework."
     end
   end
+
+  # Stamp the signing team (when provided) on the extension's build configs —
+  # runs over new AND pre-existing targets so all three (host + NSE + NCE) sign
+  # consistently. Idempotent.
+  next unless TEAM_SET
+
+  target.build_configurations.each do |config|
+    config.build_settings['DEVELOPMENT_TEAM'] = DEVELOPMENT_TEAM
+  end
+  puts "#{ext[:name]}: DEVELOPMENT_TEAM set to #{DEVELOPMENT_TEAM}."
 end
 
 project.save

package/cli/ios/setup-push.mjs

@@ -182,10 +182,15 @@ export async function setupIosPush(dir, {reporter}) {
   // Pass the project path / target name as real environment variables (the
   // Ruby script reads them via ENV[…]) rather than interpolating them into the
   // command line — a path with shell metacharacters must not be re-parsed.
+  // The signing team (when configured) is forwarded so the scaffolder stamps
+  // DEVELOPMENT_TEAM on the host + both extensions; without it a CLI build
+  // drops aps-environment to ad-hoc and yields no APNs token.
+  const team = cfg?.Connect?.iOSDevelopmentTeam
   const rubyEnv = {
     ACOUSTIC_PROJECT_PATH: projectPath,
     ACOUSTIC_APP_TARGET: appTarget,
   }
+  if (team) rubyEnv.ACOUSTIC_DEVELOPMENT_TEAM = team
   if (run(`ruby "${rubyScript}"`, {cwd: iosDir, env: rubyEnv}))
     reporter.pass('Push extensions wired (NSE + NCE)')
   else

package/ios/AcousticConnectRNConfig.json

@@ -7,6 +7,7 @@
     "PushEnabled": true,
     "iOSPushMode": "automatic",
     "iOSAppGroupIdentifier": "group.co.acoustic.mobile.connect.rn.expodemo",
+    "iOSDevelopmentTeam": "YOUR_TEAM_ID",
     "AndroidNotificationIconResName": "ic_notification",
     "iOSVersion": "",
     "useRelease": false

package/package.json

@@ -214,7 +214,7 @@
     "source": "src/index",
     "summary": "react-native ios android tealeaf connect cxa wxca er enhanced-replay",
     "types": "./lib/typescript/src/index.d.ts",
-    "version": "18.0.39",
+    "version": "18.0.40",
     "workspaces": [
         "example",
         "Examples/bare-workflow"