# Changelog

## Score

- CAI 60 → 62 (+2.4)

## Lenses

- Code Health 82 → 83 (+0.5)
- Architecture 91 → 90 (-1.2)
- Maturity 50 → 55 (+5.1)
- Readiness 55 → 56 (+0.3)
- Security 81 → 81 (+0.0)
- Performance 75 → 74 (-0.6)

## Resolved (14)

- Duplicate type intent. `DeveloperServicesAPIVersionLegacy` exists alongside `DeveloperServicesAPIVersion` without a clear inheritance or protocol-based relationship in the signature list. If they serve the same conceptual purpose (defining API versioning), having two distinct types suggests a lack of abstraction or a pending migration that leaves the API surface cluttered.
- Duplicated block (5 lines × 2) (Sources/XToolSupport/SDKBuilder.swift)
- FixmeComment (Sources/XKit/GrandSlam/Anisette/DeviceInfo+Fetching.swift)
- Inconsistent progress reporting types and operation scope. `AppInstaller` uses a `Stage` enum for progress, while `IPAInstaller` uses a generic `RequestProgress` (likely Double/percentage). Additionally, `AppInstaller` takes a URL and UDID directly, whereas `IPAInstaller` requires a pre-uploaded `UploadedIPA` object, splitting the install workflow into two different classes with different progress models.
- MethodTooLong: SDKBuilder.installToolset (Sources/XToolSupport/SDKBuilder.swift)
- Outdated: async-http-client
- Outdated: swift-concurrency-extras
- Outdated: swift-crypto
- Outdated: swift-nio
- Outdated: swift-openapi-urlsession
- Outdated: swift-subprocess
- PR-triggered workflow without a permissions block
- Redundant HTTP client abstractions with inconsistent method names. `DeveloperServicesClient` uses a generic `send` method, while `HTTPClientProtocol` exposes both `send` and `makeRequest`. The existence of two methods on the protocol for similar HTTP operations, combined with a separate client wrapper using a different signature, creates confusion about the primary entry point for HTTP requests.
- TodoComment (Sources/XKit/GrandSlam/Anisette/XADIProvider.swift)

## New (6)

- Outdated: swift-certificates
- PR-triggered workflow without a permissions block (.github/workflows/build.yml)
- PR-triggered workflow without a permissions block (.github/workflows/integration.yml)
- PR-triggered workflow without a permissions block (.github/workflows/swiftlint.yml)
- TodoComment (Examples/DemoTCA/Package.swift)
- Workflow token grant is wider than its jobs use (.github/workflows/release.yml)

## Changes since last survey

- 14 commits — 13 feature/other, 1 fixes

## By area

- Sources/XKit — 6 commits
- Sources/XToolSupport — 3 commits
- (root) — 2 commits
- Examples/DemoSimple — 1 commit
- Examples/DemoTCA — 1 commit
- Sources/PackLib — 1 commit

## Notable commits

- fix: sdk: fix cross-import overlays with SwiftBuild (#361)
- change: auth: clean up Anisette handling (#367)
- change: build: update to Xcode 27.1, Swift 6.4.1 (#382)
- change: certs: match certificates whose serial starts with 0 (#306)
- change: deps: bump dependencies (#381)
- change: deps: force OpenCombine in the DemoTCA lockfile (#391)
- change: entitlements: support Sign in with Apple (#377)
- change: gsa: fall back to a trusted-device code when SMS 2FA fails (#349)
- change: gsa: update user agent (#406)
- change: gsa: use macOS Omnisette (#380)
- change: pack: link edited dependencies into the builder package (#390)
- change: sdk: accept directories for tarball overrides (#385)
- change: sdk: support env overrides for tarballs (#372)
- change: sdk: update OpenAppleMacros to v1.4.1 (#371)