apple signing ensure with automatic signing only adds capabilities (no profiles or certificates; the dry run says so) and lists unused storebound profiles with the exact delete command, never run; every capability write is read back (lag retries, timeout) and fails with the API answers when one did not stick; apple status, signing status and validate compare the App ID, apple.signing.capabilities and the iOS project's entitlements (CODE_SIGN_ENTITLEMENTS too) and name what is missing where; api writes outside a terminal say TTY by design and name the dedicated command; pitfalls 64-66; tests

cli/validate.ts

@@ -15,6 +15,7 @@
 // bad behavior threshold is a blocker, near it a warning; a store without vitals access is only noted. --no-health skips.
 import { templateBlockers } from './lib/template-answers';
 import { ascClient, type J } from './apple/asc';
+import { capabilityReport } from './apple/signing';
 import { requiredDisplayTypes } from './apple/screenshots';
 import { type Loaded, playCategoryOf, playCodes, profileOf, sellsOn } from './lib/config';
 import { reviewDemoAccount } from './lib/credentials';
@@ -112,6 +113,7 @@ export async function collectApple(ctx: Ctx): Promise<AppleSnapshot> {
     availability: !!avail?.data,
     iaps, expectedProducts: (config.products ?? []).filter(p => sellsOn(config, p, 'apple')).map(p => p.id),
     privacyUrl: await checkUrl(config.app.privacyPolicyUrl),
+    capabilityMismatches: await capabilityReport(c, config, root).then(r => r.mismatches.map(m => ({ msg: m.msg, fix: m.fix })), e => [{ msg: `capabilities not compared: ${(e as Error).message.slice(0, 200)}`, fix: 'storebound apple signing status' }]),
   };
 }