git:20260319.d1e05ff to git:20261011.86834d4

87 added, 74 removed. Audit A to A.

---

name: capacitor-apple-review-preflight

- description: Guides the agent through an Apple App Store preflight review for Capacitor apps before submission or after rejection. Covers guideline checklist selection, App Store metadata review, Capacitor and iOS project inspection, privacy manifests, Sign in with Apple, entitlements, and common rejection patterns. Do not use for Google Play review, generic store publishing only, or non-Apple mobile runtimes.

+ description: Audits a Capacitor iOS app against Apple App Review Guidelines before submission or after a rejection. Use when the user pastes a rejection (Guideline 4.2 Minimum Functionality, 4.8 Login Services / Sign in with Apple, 5.1.1 data collection or account deletion, 5.1.2(i) sharing data with third-party AI, 3.1.1 in-app purchase, 2.1 app completeness, 2.3 metadata, 4.3 spam), an upload warning (ITMS-91053 missing API declaration, ITMS-91061 missing privacy manifest, ITMS-90683 missing purpose string), or wants a preflight of metadata, PrivacyInfo.xcprivacy, Info.plist usage strings, entitlements, subscriptions, reviewer notes, live-update disclosure, and Xcode 27 / UIScene readiness. Do not use for Google Play review, upload mechanics, screenshots and listing setup (capacitor-app-store), building a web wrapper from scratch (webapp-to-capacitor), or non-Capacitor runtimes.

+ allowed-tools:

+ - Bash(node -e *)

+ - Bash(find *)

---

# Capacitor Apple Review Preflight

- Run a pre-submission or post-rejection Apple review audit for a Capacitor app.

+ Run a pre-submission or post-rejection Apple review audit for a Capacitor app and return a prioritized, evidence-backed report.

This skill adapts the Apple guideline and rejection-rule corpus from [truongduy2611/app-store-preflight-skills](https://github.com/truongduy2611/app-store-preflight-skills) and narrows the workflow to Capacitor-specific project inspection.

- ## When to Use This Skill

+ ## When to Use

- - User wants an Apple App Store review preflight for a Capacitor app

- - User received an Apple rejection and wants the project audited against likely guideline failures

- - User wants to check metadata, entitlements, privacy manifests, Sign in with Apple, subscriptions, or minimum functionality before submission

- - User wants reviewer-notes guidance for a Capacitor iOS submission

+ TRIGGER when:

+ - The user wants an App Store review preflight for a Capacitor app.

+ - The user received an App Review rejection or an App Store Connect upload warning email and wants the project audited.

+ - The user asks whether metadata, entitlements, privacy manifests, Sign in with Apple, subscriptions, AI features, or minimum functionality will pass.

+ - The user wants reviewer notes for a Capacitor submission (demo accounts, live updates, hardware features).

+ Do not use for:

+ - Google Play policy or Data safety -> `capacitor-app-store` (Android reference).

+ - Archiving, uploading, screenshots, TestFlight -> `capacitor-app-store`.

+ - Making a website feel native from scratch -> `webapp-to-capacitor`.

+ - Security hardening beyond review rules -> `capacitor-security`.

## Live Project Snapshot

Detected Capacitor, auth, subscription, analytics, and privacy-related packages:

- !`node -e "const fs=require('fs');if(!fs.existsSync('package.json'))process.exit(0);const pkg=JSON.parse(fs.readFileSync('package.json','utf8'));const sections=['dependencies','devDependencies'];const out=[];for(const section of sections){for(const [name,version] of Object.entries(pkg[section]||{})){if(name.startsWith('@capacitor/')||name.startsWith('@capgo/')||name.includes('firebase')||name.includes('sentry')||name.includes('revenuecat')||name.includes('purchase')||name.includes('subscription')||name.includes('auth')||name.includes('analytics')||name.includes('segment')||name.includes('amplitude')||name.includes('mixpanel'))out.push(section+'.'+name+'='+version)}}console.log(out.sort().join('\n'))"`

+ !`node -e "const fs=require('fs');if(!fs.existsSync('package.json'))process.exit(0);const pkg=JSON.parse(fs.readFileSync('package.json','utf8'));const sections=['dependencies','devDependencies'];const out=[];for(const section of sections){for(const [name,version] of Object.entries(pkg[section]||{})){if(name.startsWith('@capacitor/')||name.startsWith('@capgo/')||name.includes('firebase')||name.includes('sentry')||name.includes('revenuecat')||name.includes('purchase')||name.includes('subscription')||name.includes('auth')||name.includes('analytics')||name.includes('segment')||name.includes('amplitude')||name.includes('mixpanel')||name.includes('openai')||name.includes('anthropic')||name.includes('gemini'))out.push(section+'.'+name+'='+version)}}console.log(out.sort().join('\n'))"`

Relevant Apple review file paths:

- !`find . -maxdepth 6 \( -name 'package.json' -o -name 'capacitor.config.json' -o -name 'capacitor.config.ts' -o -name 'capacitor.config.js' -o -name 'Info.plist' -o -name '*.entitlements' -o -name 'PrivacyInfo.xcprivacy' -o -name 'project.pbxproj' -o -path './ios' -o -path './fastlane/metadata' -o -path './metadata' \)`

- ## Procedure

+ !`find . -maxdepth 6 -not -path '*/node_modules/*' \( -name 'package.json' -o -name 'capacitor.config.json' -o -name 'capacitor.config.ts' -o -name 'capacitor.config.js' -o -name 'Info.plist' -o -name '*.entitlements' -o -name 'PrivacyInfo.xcprivacy' -o -name 'SceneDelegate.swift' -o -name 'project.pbxproj' -o -path './ios' -o -path './fastlane/metadata' -o -path './metadata' \)`

- ### Step 1: Confirm This Is the Right Review Scope

+ ## Current Apple Requirements (October 2026)

- Use this skill for Apple-facing review work, not for generic publishing.

+ Check these first; they cause upload failures before review even starts:

+ - SDK: uploads must be built with Xcode 26+ / iOS 26 SDK (since April 28, 2026). From April 2027 the iOS 27 SDK (Xcode 27) is required.

+ - UIScene: Xcode 27 builds require the scene lifecycle. Capacitor 8.5+ supports it; the app needs `SceneDelegate.swift`, `UIApplicationSceneManifest` in `Info.plist`, and `configurationForConnecting` in `AppDelegate`. After adoption, AppDelegate `application(_:open:options:)`, `continue userActivity`, and foreground/background callbacks stop firing; custom native code there must move to the scene delegate.

+ - Privacy manifest: the app target needs its own `PrivacyInfo.xcprivacy` for required-reason APIs used by app code; SDKs on Apple's privacy-impacting list must ship their own manifests and signatures (Capacitor core and CapacitorCordova ship manifests).

+ - Age rating: the updated questionnaire (4+, 9+, 13+, 16+, 18+) must be answered or new versions cannot be submitted.

+ - AI data sharing: guideline 5.1.2(i) (Nov 2025 revision) requires clear in-app disclosure and explicit permission before personal data is sent to third-party AI services.

- If the task is mostly about screenshots, release setup, or store upload mechanics, combine this skill with `capacitor-app-store`.

+ ## Procedure

- ### Step 2: Identify App Type and Load the Right Checklist

+ ### Step 1: Confirm scope

- Always read:

+ Apple-facing review work only. If the task is mostly release mechanics, hand off to `capacitor-app-store`. If a rejection is cited, prioritize that guideline first, then expand to adjacent risks.

- - `references/guidelines/by-app-type/all_apps.md`

+ ### Step 2: Identify app type and load checklists

- Then add the checklist that matches the app:

+ Always read `references/guidelines/by-app-type/all_apps.md`. Then add the checklists that match:

- - `subscription_iap.md` for subscriptions or IAP

- - `social_ugc.md` for UGC or moderation-heavy apps

- - `kids.md` for Kids Category

- - `health_fitness.md` for health, fitness, or medical claims

- - `games.md` for games

- - `ai_apps.md` for AI or LLM features

- - `crypto_finance.md` for crypto, trading, or financial workflows

- - `vpn.md` for VPN and networking apps

- - `macos.md` only when the submission also targets macOS

+ | App has | Load |

+ |---|---|

+ | Subscriptions or IAP | `subscription_iap.md` |

+ | UGC, chat, social feeds | `social_ugc.md` |

+ | Kids Category | `kids.md` |

+ | Health, fitness, medical claims | `health_fitness.md` |

+ | Games | `games.md` |

+ | AI / LLM features | `ai_apps.md` |

+ | Crypto, trading, finance | `crypto_finance.md` |

+ | VPN / networking | `vpn.md` |

+ | Also ships to macOS | `macos.md` |

Use `references/guidelines/README.md` for the full guideline index when a rejection cites a specific section.

- ### Step 3: Inspect Capacitor and iOS Project State

- Start from the injected snapshot above, then inspect:

- - `package.json` for Capacitor, auth, analytics, subscription, and SDK dependencies

- - `capacitor.config.*` for app identifiers, app name, web asset config, and live update settings

- - `ios/App/App/Info.plist` or the project-specific `Info.plist`

- - any `*.entitlements` files

- - `PrivacyInfo.xcprivacy` if present

- - `fastlane/metadata` or other local metadata directories if they exist

- Pay special attention to Capacitor-specific Apple review risks:

+ ### Step 3: Inspect the Capacitor and iOS project

- - social login providers without a Sign in with Apple path when required

- - heavy WebView-only apps that may trigger 4.2 minimum functionality concerns

- - third-party SDKs that imply Required Reason API declarations or privacy disclosures

- - native capabilities enabled in Xcode but not justified by shipped functionality

- - Capgo, Appflow, or other live-update flows that need clear reviewer notes and compliance boundaries

- - missing or vague usage strings for camera, photo library, microphone, location, notifications, Face ID, tracking, or local network access

+ Start from the snapshot, then read:

+ - `package.json` for auth, analytics, ads, payments, AI SDKs.

+ - `capacitor.config.*` for `appId`, `server.url` (a remote `server.url` in a release build is a 4.2 / 2.5.2 risk), live-update config.

+ - `ios/App/App/Info.plist`: every `NS...UsageDescription` a plugin can trigger, `ITSAppUsesNonExemptEncryption`, `UIApplicationSceneManifest`, `UIBackgroundModes`.

+ - `*.entitlements` vs features actually shipped.

+ - `PrivacyInfo.xcprivacy` (app target membership, required-reason APIs, tracking domains).

+ - `fastlane/metadata` or `metadata/` if present.

- ### Step 4: Run Rule-Based Review Passes

+ Capacitor-specific risks:

+ - WebView-only experience with no native value or mobile UX -> 4.2.

+ - Remote `server.url` loading a website -> 4.2 and 2.5.2.

+ - Social login without Sign in with Apple or an equivalent private option -> 4.8.

+ - Web checkout for digital goods visible in the iOS build -> 3.1.1.

+ - Live updates used to change app purpose or add features beyond what was reviewed -> guideline 2.5.2 and the Apple Developer Program License Agreement interpreted-code terms; disclose the mechanism and keep updates to web-asset fixes.

+ - Plugin permissions present in `Info.plist` with vague or copied strings -> 5.1.1.

+ - Capabilities enabled in Xcode but unused (Push, iCloud, HealthKit, Associated Domains).

- Use the upstream rule files as the source of truth:

+ ### Step 4: Run rule-based passes

+ Rule files are the source of truth:

- metadata: `references/rules/metadata/*.md`

- subscription: `references/rules/subscription/*.md`

- privacy: `references/rules/privacy/*.md`

- design: `references/rules/design/*.md`

- entitlements: `references/rules/entitlements/*.md`

- Map them onto the Capacitor app:

- - metadata rules against App Store text, screenshots, preview videos, and review notes

- - privacy rules against `Info.plist`, privacy manifests, SDK usage, and data collection flows

- - design rules against app navigation, native value, login flows, and reviewer accessibility

- - entitlements rules against enabled capabilities in the iOS project

+ - build: `references/rules/build/sdk_and_scene_lifecycle.md` (Xcode/SDK minimums, UIScene)

- If App Store metadata is not stored locally and `asc` is available, pull it with `asc metadata pull --output-dir ./metadata`. If not, audit local metadata sources and state what remains unverified.

+ Map metadata rules to App Store text, screenshots, previews, and review notes; privacy rules to `Info.plist`, manifests, SDKs, and data flows; design rules to navigation, native value, and login; entitlement rules to enabled capabilities.

- ### Step 5: Produce a Capacitor-Focused Preflight Report

+ If metadata is not local and the `asc` CLI is configured, pull it with `asc metadata pull --output-dir ./metadata`. Otherwise audit local sources and mark metadata checks partial.

- Use this format:

+ ### Step 5: Report

```markdown

## Apple Review Preflight

### Rejections Found

- [GUIDELINE X.X.X] Issue summary

- - Evidence: file or metadata location

+ - Evidence: file:line or metadata field

- Why it matters for this Capacitor app

- Fix: exact remediation

### Warnings

- [GUIDELINE X.X.X] Potential issue

### Passed

- [Category] Checks that looked clean

### Missing Inputs

- - Metadata or review assets that were not available locally

+ - Metadata or assets not available locally

```

- Order findings by severity and make each fix concrete.

+ Order by severity. Report before making invasive changes (removing features, changing auth or billing); ask the user at those decision points.

- ### Step 6: Suggest Reviewer Notes and Submission Follow-Ups

+ ### Step 6: Reviewer notes and follow-ups

- When relevant, draft reviewer notes for:

+ Draft notes for: demo account, hidden or hardware-dependent features, subscription test path, AI moderation and data-sharing consent, live-update behaviour (web assets only; no native changes), and reasons for special entitlements or background modes.

- - demo accounts or test credentials

- - hidden or non-obvious features

- - hardware dependencies

- - subscription test flows

- - AI moderation or content controls

- - live-update behavior and what code can change post-review

- - reasons for special entitlements or network behavior

+ ## Verification

+ - Every rejection finding has a concrete fix applied or an explicit owner/decision.

+ - `plutil -lint ios/App/App/Info.plist ios/App/App/PrivacyInfo.xcprivacy` passes.

+ - `PrivacyInfo.xcprivacy` is a member of the App target (check `project.pbxproj` contains it in the Resources build phase).

+ - `grep -c "UsageDescription" ios/App/App/Info.plist` matches the permissions your plugins can request.

+ - Release build archives and validates in Xcode Organizer with no ITMS warnings.

+ - Demo account logs in on a clean install against production backend.

## Error Handling

- - If app metadata is unavailable locally and `asc` is not configured, continue with the code and project audit and clearly mark metadata checks as partial.

- - If the app is mostly a thin web wrapper, call out guideline 4.2 risk directly rather than burying it in warnings.

- - If social login is present, verify whether guideline 4.8 requires Sign in with Apple before concluding the auth flow is review-safe.

- - If third-party SDKs suggest Required Reason API usage, inspect `PrivacyInfo.xcprivacy` before assuming privacy compliance.

- - If the user is asking how to fix a specific rejection, prioritize the cited guideline and only then expand to adjacent risks.

+ | Input | Action |

+ |---|---|

+ | ITMS-91053 "Missing API declaration" with a category name | Add that `NSPrivacyAccessedAPIType` + approved reason to the app manifest (`references/rules/privacy/privacy_manifest.md`) |

+ | ITMS-91061 "Missing privacy manifest" naming an SDK | Update the SDK/plugin to a version with a bundled manifest; do not paste SDK practices into the app manifest |

+ | ITMS-90683 "Missing purpose string" | Add the named key with a specific purpose string |

+ | Guideline 4.2 rejection on a wrapper app | Treat as top severity; list concrete native features and UX gaps; never answer with reviewer notes alone |

+ | Guideline 4.8 | Add Sign in with Apple (`@capgo/capacitor-social-login` supports `apple`) or an equivalent option meeting 4.8 criteria |

+ | Guideline 5.1.1(v) | Add in-app account deletion (not just a support email) |

+ | Metadata unavailable and `asc` missing | Continue with code audit; mark metadata checks partial |

+ | Third-party SDKs suggest required-reason APIs | Inspect each SDK's bundled manifest before assuming compliance |