fix(packaging): iOS privacy manifest, JNA ≥5.15, plist version truth (V2-642, V2-652)

[Nic-dorman]

Packaging slice of the 0.0.8 bundle (milestone ②) — store-gate fixes. Independent of #219/#220/#221.

V2-642 — iOS privacy manifest (ITMS-91053 store gate)

build-swift.sh now embeds a PrivacyInfo.xcprivacy into every framework slice (flat iOS/simulator bundles at the root, macOS under Versions/A/Resources). The shipped binary links required-reason APIs — nm shows stat/fstat (→ FileTimestamp, reason C617.1: files inside the app container) and statvfs (→ DiskSpace, reason 85F4.1: the sufficient-disk-space pre-flight behind InsufficientDiskSpace). Without the manifest, every consumer app's App Store upload gets rejected. Declares no data collection and no tracking. Manifest is plutil -lint clean.

V2-652 — JNA ≥5.15 (16KB-page crash)

net.java.dev.jna:jna 5.14.0 → 5.17.0 in ffi/android (@aar — the one that ships) and ffi/kotlin (JVM, kept in lockstep). 5.14's x86_64 libjnidispatch.so is 4KB-aligned and crashes on 16KB-page devices/emulator images (Play compliance requirement). jna-5.17.0.aar confirmed live on Maven Central.

V2-658 residual — plist version truth

CFBundleShortVersionString was hardcoded 0.2.0; now derived from the ant-ffi crate version at build time (with a fail-fast if unreadable). Pairs with #221's crate-version reconcile to 0.0.8 — after both merge, the framework plist reports the real SDK version.

Validation

bash -n clean, manifest plutil -lint OK, version extraction tested. These are release-pipeline changes — the full artifact proof (manifest present in slices, JNA alignment, plist version) lands with the first 0.0.8 release build, which the release checklist should eyeball.

Holding merge pending review + Nic's go-ahead.

🤖 Generated with Claude Code

[dirvine]

Hermes review — ant-sdk PR #222

Head: c81de9023596 (1 commit on main, feat/ffi-packaging-0.0.8 → main).
Verdict: comment (advisory, no severe blockers). Three store-gate / packaging fixes, all clean. Note: no CI ran on this branch — see caveat below.

What this PR does

1. V2-642 — iOS privacy manifest (ITMS-91053 store gate). New file ffi/scripts/PrivacyInfo.xcprivacy declares FileTimestamp (reason C617.1) for stat/fstat and DiskSpace (reason 85F4.1) for statvfs. NSPrivacyTracking = false, NSPrivacyCollectedDataTypes = [], NSPrivacyTrackingDomains = []. Verified locally: plutil -lint reports OK; the manifest's first 50 lines match Apple's plist schema.
2. V2-652 — JNA 5.14.0 → 5.17.0. Both pinned files updated in lockstep:
   • ffi/android/build.gradle.kts:80 → api("net.java.dev.jna:jna:5.17.0@aar") (the @aar that ships)
   • ffi/kotlin/AntFfi/build.gradle.kts:14 → implementation("net.java.dev.jna:jna:5.17.0") (JVM lockstep)
   • jna-5.17.0.aar / .jar / .pom all return HTTP 200 on repo1.maven.org (Maven Central). The 4KB-aligned libjnidispatch.so (5.14) → 16KB-page-safe (5.17) claim is consistent with the Play Store 16KB-page compliance requirement.
3. V2-658 residual — plist version truth. CFBundleShortVersionString is now derived from the ant-ffi crate version at build time via sed -n 's/^version = "\(.*\)"/\1/p' "$RUST_DIR/ant-ffi/Cargo.toml" | head -1. Fail-fast if empty. Pairs with feat(ffi): PartialUpload error, private-download + estimate-progress variants, version accessor (V2-644, V2-611, V2-654, V2-658) #221's Cargo.toml version reconcile to 0.0.8 so post-merge the framework plist reports 0.0.8.

Verified locally

• Detached worktree at /tmp/pr-222-wt.SkQ3ki (head c81de9023596).
• bash -n ffi/scripts/build-swift.sh — OK (no syntax errors).
• plutil -lint ffi/scripts/PrivacyInfo.xcprivacy — OK.
• Maven Central: curl -sI https://repo1.maven.org/maven2/net/java/dev/jna/jna/5.17.0/jna-5.17.0.aar → HTTP/2 200, content-length 522,249 bytes.
• build-swift.sh reads the PrivacyInfo source, then cp into:
  • ios-arm64/$FW_NAME.framework/PrivacyInfo.xcprivacy (flat iOS bundle root)
  • ios-arm64-simulator/$FW_NAME.framework/PrivacyInfo.xcprivacy (flat simulator bundle root)
  • macos-arm64/$FW_NAME.framework/Versions/A/Resources/PrivacyInfo.xcprivacy (macOS versioned bundle)
    All three slices covered. ✓

Non-blocking caveat — no CI ran on this branch

gh pr checks 222 returns "no checks reported on the 'feat/ffi-packaging-0.0.8' branch". Reason: .github/workflows/ffi-ci.yml only triggers on paths: ["ffi/rust/**", ".github/workflows/ffi-ci.yml"]. This PR only touches:

• ffi/scripts/build-swift.sh
• ffi/scripts/PrivacyInfo.xcprivacy
• ffi/android/build.gradle.kts
• ffi/kotlin/AntFfi/build.gradle.kts

None under ffi/rust/**, so neither ffi-ci.yml nor ci.yml fires. Same for the only other candidate workflow (release.yml) — none of them run on this path set.

This means the three fixes ship with zero automated verification. Locally:

• The JNA bump cannot be smoke-tested in this repo (no Gradle invocation in CI for ffi/android or ffi/kotlin).
• The plist version truth cannot be verified end-to-end without actually running build-swift.sh, which needs cargo, xcodebuild, uniffi-bindgen, and Apple cross-compile targets — not present on the Linux CI runners anyway.
• The privacy manifest cannot be verified beyond plutil -lint (which only checks plist syntax, not whether it actually ends up in the shipped xcframework).

Suggestion (non-blocking for this PR): add a follow-up PR to .github/workflows/ffi-ci.yml that triggers on ffi/scripts/**, ffi/android/**, ffi/kotlin/** for at least:

• a manifest lint step (plutil -lint) — but plutil is macOS-only, so this needs a runner that has it or a YAML plist parser
• a Gradle dependency-resolution smoke (./gradlew :ffi:android:dependencies --configuration releaseRuntimeClasspath on ffi/android) — confirms JNA actually resolves to 5.17.0
• a bash -n on build-swift.sh (free; works on Linux)
• a static check that the file paths in build-swift.sh (the three slice PrivacyInfo cp calls) line up with the three target framework slices

Until that lands, the release-checklist eyeball the PR body mentions is the only verification — which is fine for a one-off 0.0.8 cut but should not become permanent.

Recommendation

Approve — the three fixes are individually correct (privacy manifest is well-formed, JNA pin is real on Maven Central, version extraction mechanism + fail-fast are sound) and the absence of CI is a tooling gap rather than a code defect. File the CI-coverage follow-up separately.

— Hermes Agent (panel review for #222 of the 0.0.8 break-window bundle)

[Nic-dorman]

The CI-coverage gap is folded into V2-651 (the PR-CI ticket) as a scope comment: extend triggers to ffi/scripts/** + ffi/android/** + ffi/kotlin/**, gradle dependency-resolution smoke, bash -n, and a manifest lint (plutil needs a mac runner or a YAML plist parser). Until that lands, the 0.0.8 release-build eyeball per the PR body is the verification.