cloudkit-schema-source-of-truthlisted

Use when a CloudKit-backed app's persistence layer adds or edits a record type, field, or index and the schema needs to reach a container, or when asked "how do I push CloudKit schema to Production", "why can't cktool deploy to prod", or "why is a field silently missing in Production". Covers one committed `.ckdb` per app as the schema source of truth, `xcrun cktool` export/validate/deploy against Development (management token from an env file, passed positionally since cktool rejects piped stdin, purged after use), Production promotion as an irreversible Console-button-only gate `cktool` cannot reach, Production fields/indexes being add-only, and Just-In-Time schema existing only in Development — a field the code writes that Production was never seeded with fails silently.
wei18/apple-dev-skills · ★ 0 · DevOps & Infrastructure · score 70

Install: claude install-skill wei18/apple-dev-skills

# CloudKit Schema Source of Truth CloudKit has no migration-file system like a SQL database. The schema lives in Apple's CloudKit Dashboard/Console, and `xcrun cktool` (Apple's official CLI, ships with Xcode) can export, validate, and import it — but only against the **Development** environment. Production promotion is a manual, irreversible Console action. This skill makes the Development side of that workflow scriptable and commit-trackable while keeping the Production gate correctly user-owned. ## When to invoke - A persistence change adds, renames, or edits a CloudKit record type, field, or index. - You need to push schema to a container (Development or Production). - Before any Production schema deploy — read the safety gate below first. - Asked why a `.ckdb` file is committed to the repo, or why a field the app writes is missing from Production data. ## Scope Owns: the `.ckdb`-as-source-of-truth workflow, `cktool` invocations against Development, and the Production promotion gate. Does **not** own: the Swift-side persistence/service code that reads and writes CloudKit records → `swift-dependency-injection` for how that seam is injected and faked in tests; secret storage for the management token itself → `apple-public-repo-security` / `build-time-secret-injection`. ## Prerequisites (one-time, user-owned) Two credentials, kept in a gitignored env file (e.g. `secrets/.env`, with a committed `.env.example` template): - **A CloudKit management token** — generated b