ios-qa: guard DebugBridgeTouch.m on DEBUG, not just TARGET_OS_IOS

[Bastea]

The problem

DebugBridgeTouch.m and its header both promise the code never ships:

Uses these private UIKit selectors (DEBUG-only; never shipped to App Store)
DEBUG-only — never link in Release.

Nothing enforced it. The only guard was #if TARGET_OS_IOS, so a Release build for iOS compiles the whole implementation in — private API included.

Measured on a real app, nm -j against an iOS Release binary:

	count
DebugBridge symbols	15
IOHIDEventCreateDigitizer	2
AXSSetAutomationEnabled	1 symbol, 2 strings
IOKit.framework	4 strings

Including +[DebugBridgeTouch sendTapAtPoint:inWindow:] and _OBJC_CLASS_$_DebugBridgeTouch.

That is a Guideline 2.5.1 private-API exposure in a shippable binary, and it fails Package.swift's own stated CI invariant:

nm -j build/Release/<binary> | grep -q DebugBridge && exit 1

Why the documented guard doesn't cover it

Package.swift describes the protection as .when(configuration: .debug) on the consuming target's dependency. That works for SwiftPM consumers.

It cannot be expressed by an app integrating DebugBridge as a local package inside an .xcodeproj. Xcode's Filters column under Frameworks, Libraries, and Embedded Content offers platform conditions only — iOS, macOS, visionOS — never build configuration. So for xcodeproj consumers the documented guard silently does nothing, which is exactly the case measured above.

The Swift targets were already safe: all four .swift files are #if DEBUG guarded and Package.swift defines DEBUG for them via swiftSettings. Only the Objective-C target — the one that actually links private API — was unguarded.

The fix

1. DebugBridgeTouch.m.template branches on #if !defined(DEBUG) first and emits nothing in Release, falling through to the existing iOS / non-iOS branches only in Debug.
2. Package.swift.template declares DEBUG explicitly for the ObjC target:

   cSettings: [.define("DEBUG", .when(configuration: .debug))]

   The two Swift targets already did this. Relying on SwiftPM's implicit DEBUG for C-family targets isn't worth betting a private-API exposure on.

Putting the guard in the source means it holds regardless of how the package is integrated, rather than depending on the consumer getting it right.

Verification

Compiled the generated file for iOS both ways:

xcrun -sdk iphoneos clang -c DebugBridgeTouch.m -arch arm64 -I include -fobjc-arc [-DDEBUG=1]

config	DebugBridge symbols	private-API symbols	object size
Release (no -DDEBUG)	0	0	448 B
Debug (-DDEBUG=1)	7	6	13,104 B

The harness is unchanged in Debug. Release emits an empty translation unit.

Note for maintainers

The comments in both templates now record the measured failure, so the guard isn't removed later as redundant. Happy to adjust wording or split the two changes if you'd prefer them separately.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[garrytan]

Thank you — this landed in v1.67.0.0 (credited in the CHANGELOG), plus a release-guard tripwire added in v1.67.1.0. Closing since the fix is on main. 🙏