@ai-development-environment/control-agent 0.0.34 → 0.0.35

package/dist/control-agent.js

@@ -842,6 +842,18 @@ var AgentGraphQLClient = class {
     );
     return data.claimAgentJob;
   }
+  async claimSigningSecretTransfer(transferId) {
+    const data = await this.request(
+      `mutation ClaimSigningSecretTransfer($transferId: ID!) {
+        claimSigningSecretTransfer(transferId: $transferId) {
+          p12Base64
+          passphrase
+        }
+      }`,
+      { transferId }
+    );
+    return data.claimSigningSecretTransfer;
+  }
   appendLog(jobId, log) {
     return this.request(
       `mutation AppendLog($jobId: ID!, $logs: [AgentJobLogInput!]!) {
@@ -2651,7 +2663,11 @@ function parseBuildSourceParsePayload(value) {
   return {
     ...worktreeIdentity(input),
     source: parseBuildSource(input.source),
-    scheme: nullableString4(input.scheme, "source parse payload.scheme")
+    scheme: nullableString4(input.scheme, "source parse payload.scheme"),
+    configuration: nullableString4(
+      input.configuration,
+      "source parse payload.configuration"
+    )
   };
 }
 function parseBuildDestinationsPayload(value) {
@@ -2870,6 +2886,23 @@ function parseBuildExportSettings(value) {
     testFlightInternalTestingOnly: booleanValue2(
       input.testFlightInternalTestingOnly,
       "export settings.testFlightInternalTestingOnly"
+    ),
+    stripSwiftSymbols: input.stripSwiftSymbols === void 0 ? true : booleanValue2(
+      input.stripSwiftSymbols,
+      "export settings.stripSwiftSymbols"
+    ),
+    thinning: nullableString4(
+      input.thinning ?? null,
+      "export settings.thinning"
+    ),
+    iCloudContainerEnvironment: input.iCloudContainerEnvironment === null || input.iCloudContainerEnvironment === void 0 ? null : enumValue3(
+      input.iCloudContainerEnvironment,
+      ["Development", "Production"],
+      "export settings.iCloudContainerEnvironment"
+    ),
+    distributionBundleIdentifier: nullableString4(
+      input.distributionBundleIdentifier ?? null,
+      "export settings.distributionBundleIdentifier"
     )
   };
 }
@@ -2914,6 +2947,81 @@ function parseBuildSigningInspectPayload(value) {
   };
 }
 
+// ../agent-contract/src/signing-assets.ts
+var SIGNING_ASSETS_SCAN_JOB_KIND = "ios.signing.assets.scan";
+var SIGNING_PROFILE_READ_JOB_KIND = "ios.signing.profile.read";
+var SIGNING_PROFILE_INSTALL_JOB_KIND = "ios.signing.profile.install";
+var SIGNING_PROFILE_DELETE_JOB_KIND = "ios.signing.profile.delete";
+var SIGNING_IDENTITY_IMPORT_JOB_KIND = "ios.signing.identity.import";
+var SIGNING_IDENTITY_DELETE_JOB_KIND = "ios.signing.identity.delete";
+var SIGNING_ASSET_JOB_KINDS = [
+  SIGNING_ASSETS_SCAN_JOB_KIND,
+  SIGNING_PROFILE_READ_JOB_KIND,
+  SIGNING_PROFILE_INSTALL_JOB_KIND,
+  SIGNING_PROFILE_DELETE_JOB_KIND,
+  SIGNING_IDENTITY_IMPORT_JOB_KIND,
+  SIGNING_IDENTITY_DELETE_JOB_KIND
+];
+function objectValue7(value, name) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${name} must be an object`);
+  }
+  return value;
+}
+function stringValue7(value, name) {
+  if (typeof value !== "string" || !value.trim() || value.includes("\0")) {
+    throw new Error(`${name} must be a non-empty string`);
+  }
+  return value;
+}
+function exactKeys2(value, allowed, name) {
+  const unexpected = Object.keys(value).find((key) => !allowed.includes(key));
+  if (unexpected) throw new Error(`Unexpected ${name} field: ${unexpected}`);
+}
+function signingScanPayload(value) {
+  const input = objectValue7(value, "signing scan payload");
+  exactKeys2(input, [], "signing scan payload");
+  return {};
+}
+function signingProfileKeyPayload(value) {
+  const input = objectValue7(value, "signing profile payload");
+  exactKeys2(input, ["uuid"], "signing profile payload");
+  return { uuid: stringValue7(input.uuid, "signing profile payload.uuid") };
+}
+function signingProfileInstallPayload(value) {
+  const input = objectValue7(value, "signing profile install payload");
+  exactKeys2(input, ["contentBase64"], "signing profile install payload");
+  const contentBase64 = stringValue7(
+    input.contentBase64,
+    "signing profile install payload.contentBase64"
+  );
+  if (contentBase64.length > 2 * 1024 * 1024) {
+    throw new Error("Provisioning profile payload is too large");
+  }
+  return { contentBase64 };
+}
+function signingIdentityImportPayload(value) {
+  const input = objectValue7(value, "signing identity import payload");
+  exactKeys2(input, ["transferId", "sha256"], "signing identity import payload");
+  const sha256 = stringValue7(input.sha256, "signing identity import sha256");
+  if (!/^[A-Fa-f0-9]{64}$/.test(sha256)) {
+    throw new Error("Signing identity import SHA-256 is invalid");
+  }
+  return {
+    transferId: stringValue7(input.transferId, "signing identity transfer ID"),
+    sha256: sha256.toUpperCase()
+  };
+}
+function signingIdentityDeletePayload(value) {
+  const input = objectValue7(value, "signing identity delete payload");
+  exactKeys2(input, ["sha1"], "signing identity delete payload");
+  const sha1 = stringValue7(input.sha1, "signing identity SHA-1");
+  if (!/^[A-Fa-f0-9]{40}$/.test(sha1)) {
+    throw new Error("Signing identity SHA-1 is invalid");
+  }
+  return { sha1: sha1.toUpperCase() };
+}
+
 // src/inventory.ts
 var AGENT_VERSION = "0.1.0";
 var AGENT_CAPABILITIES = [
@@ -2924,7 +3032,8 @@ var AGENT_CAPABILITIES = [
   CODEBASE_RECONCILE_EVENT_CAPABILITY,
   ...WORKTREE_JOB_KINDS,
   ...SKILL_JOB_KINDS,
-  ...IOS_BUILD_JOB_KINDS
+  ...IOS_BUILD_JOB_KINDS,
+  ...SIGNING_ASSET_JOB_KINDS
 ];
 function collectInventory() {
   const disk = statfsSync("/", { bigint: true });
@@ -3054,9 +3163,17 @@ function runCloudflared(payload, timeoutMs, signal, onLog) {
 }
 
 // src/handlers/signing.ts
-import { createHash as createHash2 } from "node:crypto";
-import { readdir, stat as stat2 } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
+import { createHash as createHash2, randomUUID, X509Certificate } from "node:crypto";
+import {
+  mkdir as mkdir2,
+  mkdtemp,
+  readFile as readFile2,
+  readdir,
+  rm,
+  stat as stat2,
+  writeFile as writeFile2
+} from "node:fs/promises";
+import { homedir as homedir2, tmpdir } from "node:os";
 import { basename, join as join2, relative, sep } from "node:path";
 
 // ../agent-contract/src/plist.ts
@@ -3294,7 +3411,7 @@ function text(value) {
 function stringList(value) {
   return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
 }
-async function decodeProfile(path, timeoutMs, signal) {
+async function decodeProfile(path, timeoutMs, signal, strict = false) {
   try {
     const result = await captureCommand({
       command: "/usr/bin/security",
@@ -3302,16 +3419,29 @@ async function decodeProfile(path, timeoutMs, signal) {
       timeoutMs: Math.min(timeoutMs, 1e4),
       signal
     });
+    if (strict) assertCommandSucceeded(result, `Reading profile ${path}`);
     if (result.exitCode !== 0 || !result.stdout.trim()) return null;
     const parsed = parsePlist(result.stdout);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      if (strict) throw new Error(`Profile ${path} did not contain a plist`);
       return null;
     }
     return parsed;
-  } catch {
+  } catch (error) {
+    if (strict) throw error;
     return null;
   }
 }
+function assertCommandSucceeded(result, action) {
+  if (result.cancelled) throw new Error(`${action} was cancelled`);
+  if (result.timedOut) throw new Error(`${action} timed out`);
+  if (result.exitCode !== 0) {
+    const detail = result.stderr.trim();
+    throw new Error(
+      `${action} failed${detail ? `: ${detail}` : ` with exit code ${String(result.exitCode)}`}`
+    );
+  }
+}
 function toProfile(uuid, raw, now) {
   const name = text(raw.Name);
   if (!name) return null;
@@ -3381,6 +3511,66 @@ async function readProfiles(timeoutMs, signal) {
     (left, right) => left.name.localeCompare(right.name)
   );
 }
+async function decodedProfiles(timeoutMs, signal, strict = false) {
+  const profiles = [];
+  if (strict) signal.throwIfAborted();
+  for (const directory of PROFILE_DIRECTORIES) {
+    let entries;
+    try {
+      entries = await readdir(directory);
+    } catch (error) {
+      if (strict && error.code !== "ENOENT") {
+        throw error;
+      }
+      continue;
+    }
+    for (const entry of entries) {
+      if (!PROFILE_EXTENSIONS.some((suffix) => entry.endsWith(suffix))) {
+        continue;
+      }
+      signal.throwIfAborted();
+      const path = join2(directory, entry);
+      const raw = await decodeProfile(path, timeoutMs, signal, strict);
+      if (!raw) continue;
+      let content;
+      try {
+        content = await readFile2(path);
+      } catch (error) {
+        if (strict) throw error;
+        continue;
+      }
+      profiles.push({
+        path,
+        content,
+        raw,
+        uuid: text(raw.UUID) ?? basename(entry).replace(/\.[^.]+$/, "")
+      });
+    }
+  }
+  return profiles;
+}
+function profileAsset(decoded, now) {
+  const profile = toProfile(decoded.uuid, decoded.raw, now);
+  if (!profile) return null;
+  const createdAt = text(decoded.raw.CreationDate);
+  return {
+    uuid: profile.uuid,
+    contentHash: createHash2("sha256").update(decoded.content).digest("hex").toUpperCase(),
+    name: profile.name,
+    profileType: profile.type,
+    bundleId: profile.bundleId,
+    teamId: profile.teamId,
+    teamName: profile.teamName,
+    platforms: profile.platforms,
+    deviceCount: stringList(decoded.raw.ProvisionedDevices).length,
+    deviceUdids: stringList(decoded.raw.ProvisionedDevices),
+    certificateSha1s: profile.certificateSha1s,
+    createdAt,
+    expiresAt: profile.expiresAt,
+    expired: profile.expired,
+    xcodeManaged: profile.xcodeManaged
+  };
+}
 function dedupeProfiles(profiles) {
   const best = /* @__PURE__ */ new Map();
   for (const profile of profiles) {
@@ -3401,7 +3591,7 @@ function dedupeProfiles(profiles) {
   return [...best.values()];
 }
 var IDENTITY_PATTERN = /^\s*\d+\)\s+([0-9A-F]{40})\s+"(.+)"\s*$/i;
-async function readIdentities(timeoutMs, signal) {
+async function readIdentities(timeoutMs, signal, strict = false) {
   try {
     const result = await captureCommand({
       command: "/usr/bin/security",
@@ -3409,6 +3599,7 @@ async function readIdentities(timeoutMs, signal) {
       timeoutMs: Math.min(timeoutMs, 1e4),
       signal
     });
+    if (strict) assertCommandSucceeded(result, "Reading signing identities");
     if (result.exitCode !== 0) return [];
     const identities = /* @__PURE__ */ new Map();
     for (const line of result.stdout.split("\n")) {
@@ -3419,10 +3610,80 @@ async function readIdentities(timeoutMs, signal) {
       identities.set(sha1, { sha1, name, teamId: team?.[1] ?? null });
     }
     return [...identities.values()];
-  } catch {
+  } catch (error) {
+    if (strict) throw error;
     return [];
   }
 }
+function commonName(certificate) {
+  return certificate.subject.split(/\n|,\s*/).find((part) => part.startsWith("CN="))?.slice(3) ?? certificate.subject;
+}
+function certificateType(name) {
+  const known = [
+    "Apple Development",
+    "Apple Distribution",
+    "iPhone Developer",
+    "iPhone Distribution",
+    "iOS Developer",
+    "iOS Distribution",
+    "Mac Developer",
+    "Mac App Distribution",
+    "Developer ID Application",
+    "Developer ID Installer"
+  ];
+  return known.find((prefix) => name.startsWith(prefix)) ?? null;
+}
+function pemCertificates(value) {
+  return value.match(
+    /-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g
+  ) ?? [];
+}
+async function readCertificates(timeoutMs, signal, strict = false) {
+  const [certificateResult, identities] = await Promise.all([
+    captureCommand({
+      command: "/usr/bin/security",
+      args: ["find-certificate", "-a", "-p"],
+      timeoutMs: Math.min(timeoutMs, 2e4),
+      signal
+    }),
+    readIdentities(timeoutMs, signal, strict)
+  ]);
+  if (strict) {
+    assertCommandSucceeded(certificateResult, "Reading signing certificates");
+  }
+  if (certificateResult.exitCode !== 0) return [];
+  const identityHashes = new Set(
+    identities.map((identity) => identity.sha1.toUpperCase())
+  );
+  const assets = /* @__PURE__ */ new Map();
+  for (const pem of pemCertificates(certificateResult.stdout)) {
+    try {
+      const certificate = new X509Certificate(pem);
+      const name = commonName(certificate);
+      const type = certificateType(name);
+      if (!type) continue;
+      const sha1 = certificate.fingerprint.replaceAll(":", "").toUpperCase();
+      const expiresAt = new Date(certificate.validTo);
+      const team = /\(([A-Z0-9]{10})\)\s*$/.exec(name);
+      assets.set(sha1, {
+        sha1,
+        sha256: certificate.fingerprint256.replaceAll(":", "").toUpperCase(),
+        name,
+        teamId: team?.[1] ?? null,
+        certificateType: type,
+        notBefore: new Date(certificate.validFrom).toISOString(),
+        expiresAt: expiresAt.toISOString(),
+        expired: expiresAt.getTime() < Date.now(),
+        hasPrivateKey: identityHashes.has(sha1)
+      });
+    } catch {
+      continue;
+    }
+  }
+  return [...assets.values()].sort(
+    (left, right) => left.name.localeCompare(right.name)
+  );
+}
 async function readArchiveBundles(archivePath, timeoutMs, signal) {
   const products = join2(archivePath, "Products");
   const bundles = [];
@@ -3543,6 +3804,139 @@ var inspectIosSigning = async (payload, timeoutMs, signal) => {
     ...inspection
   };
 };
+var successfulProcess = {
+  exitCode: 0,
+  signal: null,
+  timedOut: false,
+  cancelled: false
+};
+var scanSigningAssets = async (payload, timeoutMs, signal) => {
+  signingScanPayload(payload);
+  const [decoded, certificates] = await Promise.all([
+    decodedProfiles(timeoutMs, signal, true),
+    readCertificates(timeoutMs, signal, true)
+  ]);
+  const byUuid = /* @__PURE__ */ new Map();
+  for (const profile of decoded) {
+    const asset = profileAsset(profile, Date.now());
+    if (!asset) continue;
+    const existing = byUuid.get(asset.uuid);
+    if (!existing || (asset.expiresAt ?? "") > (existing.expiresAt ?? "")) {
+      byUuid.set(asset.uuid, asset);
+    }
+  }
+  return {
+    ...successfulProcess,
+    profiles: [...byUuid.values()].sort(
+      (left, right) => left.name.localeCompare(right.name)
+    ),
+    certificates,
+    warnings: []
+  };
+};
+async function findDecodedProfile(uuid, timeoutMs, signal) {
+  const profile = (await decodedProfiles(timeoutMs, signal)).find(
+    (entry) => entry.uuid === uuid
+  );
+  if (!profile) throw new Error("Provisioning profile is no longer installed");
+  return profile;
+}
+var readSigningProfile = async (payload, timeoutMs, signal) => {
+  const { uuid } = signingProfileKeyPayload(payload);
+  const profile = await findDecodedProfile(uuid, timeoutMs, signal);
+  return {
+    ...successfulProcess,
+    uuid,
+    contentBase64: profile.content.toString("base64"),
+    sha256: createHash2("sha256").update(profile.content).digest("hex").toUpperCase()
+  };
+};
+var installSigningProfile = async (payload, timeoutMs, signal) => {
+  const { contentBase64 } = signingProfileInstallPayload(payload);
+  const content = Buffer.from(contentBase64, "base64");
+  if (!content.length) throw new Error("Provisioning profile is empty");
+  const temporaryRoot = await mkdtemp(join2(tmpdir(), "ade-profile-"));
+  const temporaryPath = join2(temporaryRoot, `${randomUUID()}.mobileprovision`);
+  try {
+    await writeFile2(temporaryPath, content, { mode: 384 });
+    const raw = await decodeProfile(temporaryPath, timeoutMs, signal);
+    if (!raw) throw new Error("Provisioning profile is invalid or unsigned");
+    const uuid = text(raw.UUID);
+    if (!uuid) throw new Error("Provisioning profile UUID is missing");
+    const directory = PROFILE_DIRECTORIES[0];
+    await mkdir2(directory, { recursive: true, mode: 448 });
+    const destination = join2(directory, `${uuid}.mobileprovision`);
+    await writeFile2(destination, content, { mode: 384 });
+    return { ...successfulProcess, uuid };
+  } finally {
+    await rm(temporaryRoot, { recursive: true, force: true });
+  }
+};
+var deleteSigningProfile = async (payload, timeoutMs, signal) => {
+  const { uuid } = signingProfileKeyPayload(payload);
+  const matches = (await decodedProfiles(timeoutMs, signal)).filter(
+    (entry) => entry.uuid === uuid
+  );
+  for (const profile of matches) {
+    signal.throwIfAborted();
+    await rm(profile.path, { force: false });
+  }
+  return { ...successfulProcess, uuid, deleted: matches.length };
+};
+var importSigningIdentity = async (payload, timeoutMs, signal, _onLog, context) => {
+  const input = signingIdentityImportPayload(payload);
+  if (!context?.claimSigningSecretTransfer) {
+    throw new Error("This agent cannot claim signing secret transfers");
+  }
+  const secret = await context.claimSigningSecretTransfer(input.transferId);
+  const p12 = Buffer.from(secret.p12Base64, "base64");
+  const hash = createHash2("sha256").update(p12).digest("hex").toUpperCase();
+  if (hash !== input.sha256)
+    throw new Error("Signing identity transfer changed");
+  const temporaryRoot = await mkdtemp(join2(tmpdir(), "ade-identity-"));
+  const path = join2(temporaryRoot, "identity.p12");
+  try {
+    await writeFile2(path, p12, { mode: 384 });
+    const result = await captureCommand({
+      command: "/usr/bin/security",
+      args: [
+        "import",
+        path,
+        "-P",
+        secret.passphrase,
+        "-T",
+        "/usr/bin/codesign",
+        "-T",
+        "/usr/bin/security"
+      ],
+      timeoutMs: Math.min(timeoutMs, 6e4),
+      signal
+    });
+    if (result.exitCode !== 0) {
+      throw new Error(
+        result.stderr.trim() || "Could not import signing identity"
+      );
+    }
+    return { ...successfulProcess, sha256: input.sha256 };
+  } finally {
+    await rm(temporaryRoot, { recursive: true, force: true });
+  }
+};
+var deleteSigningIdentity = async (payload, timeoutMs, signal) => {
+  const { sha1 } = signingIdentityDeletePayload(payload);
+  const result = await captureCommand({
+    command: "/usr/bin/security",
+    args: ["delete-identity", "-Z", sha1],
+    timeoutMs: Math.min(timeoutMs, 3e4),
+    signal
+  });
+  if (result.exitCode !== 0) {
+    throw new Error(
+      result.stderr.trim() || "Could not delete signing identity"
+    );
+  }
+  return { ...successfulProcess, sha1 };
+};
 
 // src/handlers/ccusage.ts
 import { Buffer as Buffer2 } from "node:buffer";
@@ -3599,10 +3993,10 @@ async function runCcusage(payload, timeoutMs, signal, onLog) {
 }
 
 // src/handlers/build-data.ts
-import { lstat, opendir, readdir as readdir2, realpath, rm } from "node:fs/promises";
+import { lstat, opendir, readdir as readdir2, realpath, rm as rm2 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
 import { basename as basename2, dirname as dirname2, isAbsolute, join as join3, resolve } from "node:path";
-var successfulProcess = {
+var successfulProcess2 = {
   exitCode: 0,
   signal: null,
   timedOut: false,
@@ -3695,6 +4089,43 @@ async function scanRoot(configuredRoot, timeoutMs, signal) {
   entries.sort((first, second) => first.name.localeCompare(second.name));
   return { entries, warning: null };
 }
+async function scanDeviceSupport(signal) {
+  const configuredRoot = join3(
+    process.env.ADE_IOS_DEVICE_SUPPORT_DIRECTORY ?? homedir3(),
+    ...process.env.ADE_IOS_DEVICE_SUPPORT_DIRECTORY ? [] : ["Library", "Developer", "Xcode", "iOS DeviceSupport"]
+  );
+  signal.throwIfAborted();
+  let rootPath2;
+  try {
+    rootPath2 = await realpath(configuredRoot);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return { entries: [], warning: null };
+    }
+    return {
+      entries: [],
+      warning: `${configuredRoot}: ${errorMessage(error)}`
+    };
+  }
+  try {
+    const children = await readdir2(rootPath2, { withFileTypes: true });
+    return {
+      entries: children.filter((child) => child.isDirectory() && !child.isSymbolicLink()).map((child) => ({
+        path: join3(rootPath2, child.name),
+        rootPath: rootPath2,
+        name: child.name,
+        kind: "DEVICE_SUPPORT",
+        workspacePath: null
+      })).sort((first, second) => first.name.localeCompare(second.name)),
+      warning: null
+    };
+  } catch (error) {
+    return {
+      entries: [],
+      warning: `${rootPath2}: ${errorMessage(error)}`
+    };
+  }
+}
 var scanBuildData = async (rawPayload, timeoutMs, signal) => {
   const payload = buildDataScanPayload(rawPayload);
   const roots = await configuredRoots(payload);
@@ -3714,7 +4145,10 @@ var scanBuildData = async (rawPayload, timeoutMs, signal) => {
     entries.push(...result.entries);
     if (result.warning) warnings.push(result.warning);
   }
-  return { ...successfulProcess, entries, warnings };
+  const deviceSupport = await scanDeviceSupport(signal);
+  entries.push(...deviceSupport.entries);
+  if (deviceSupport.warning) warnings.push(deviceSupport.warning);
+  return { ...successfulProcess2, entries, warnings };
 };
 function assertDirectChild(rootPath2, path) {
   if (!isAbsolute(rootPath2) || !isAbsolute(path)) {
@@ -3772,7 +4206,7 @@ var sizeBuildData = async (rawPayload, _timeoutMs, signal) => {
       });
     }
   }
-  return { ...successfulProcess, sizes };
+  return { ...successfulProcess2, sizes };
 };
 var deleteBuildData = async (rawPayload, _timeoutMs, signal) => {
   const payload = buildDataTargetsPayload(rawPayload);
@@ -3789,7 +4223,7 @@ var deleteBuildData = async (rawPayload, _timeoutMs, signal) => {
       if (!stats.isDirectory() || stats.isSymbolicLink()) {
         throw new Error("Build Data target is not a directory");
       }
-      await rm(target2.path, { recursive: true, force: false, maxRetries: 3 });
+      await rm2(target2.path, { recursive: true, force: false, maxRetries: 3 });
       deleted.push({ path: target2.path, deleted: true, error: null });
     } catch (error) {
       signal.throwIfAborted();
@@ -3800,14 +4234,14 @@ var deleteBuildData = async (rawPayload, _timeoutMs, signal) => {
       });
     }
   }
-  return { ...successfulProcess, deleted };
+  return { ...successfulProcess2, deleted };
 };
 
 // src/handlers/codebases.ts
 import { readdir as readdir3, realpath as realpath2, stat as stat3 } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
 import { dirname as dirname3, join as join4, resolve as resolve2 } from "node:path";
-var successfulProcess2 = {
+var successfulProcess3 = {
   exitCode: 0,
   signal: null,
   timedOut: false,
@@ -3898,7 +4332,7 @@ async function inspectCodebaseProcess(selectedFolder, timeoutMs, signal, expecte
       throw new Error("Folder is not a directory");
   } catch (error) {
     return {
-      ...successfulProcess2,
+      ...successfulProcess3,
       snapshot: {
         ...base,
         availability: "MISSING",
@@ -3915,7 +4349,7 @@ async function inspectCodebaseProcess(selectedFolder, timeoutMs, signal, expecte
     );
     if (rootResult.exitCode !== 0) {
       return {
-        ...successfulProcess2,
+        ...successfulProcess3,
         snapshot: {
           ...base,
           folder: selected,
@@ -3935,7 +4369,7 @@ async function inspectCodebaseProcess(selectedFolder, timeoutMs, signal, expecte
     );
     if (bare.stdout.trim() === "true") {
       return {
-        ...successfulProcess2,
+        ...successfulProcess3,
         snapshot: {
           ...base,
           folder,
@@ -3967,7 +4401,7 @@ async function inspectCodebaseProcess(selectedFolder, timeoutMs, signal, expecte
     ]);
     if (originResult.exitCode !== 0) {
       return {
-        ...successfulProcess2,
+        ...successfulProcess3,
         snapshot: {
           ...base,
           folder,
@@ -4014,7 +4448,7 @@ async function inspectCodebaseProcess(selectedFolder, timeoutMs, signal, expecte
     const syncState = !branch ? "DETACHED" : !upstream ? "NO_UPSTREAM" : ahead === null || behind === null ? "UNKNOWN" : ahead > 0 && behind > 0 ? "DIVERGED" : ahead > 0 ? "AHEAD" : behind > 0 ? "BEHIND" : "IN_SYNC";
     const mismatch = expectedOrigin !== void 0 && origin2.canonicalOrigin !== expectedOrigin;
     return {
-      ...successfulProcess2,
+      ...successfulProcess3,
       snapshot: {
         folder,
         observedOrigin: origin2.sanitizedOrigin,
@@ -4036,7 +4470,7 @@ async function inspectCodebaseProcess(selectedFolder, timeoutMs, signal, expecte
   } catch (error) {
     if (error instanceof InterruptedGitInspection) return error.result;
     return {
-      ...successfulProcess2,
+      ...successfulProcess3,
       snapshot: {
         ...base,
         folder: selected,
@@ -4097,7 +4531,7 @@ var browseCodebaseDirectories = async (payload) => {
     entries: entries.slice(0, 1e3),
     truncated: entries.length > 1e3
   };
-  return { ...successfulProcess2, listing };
+  return { ...successfulProcess3, listing };
 };
 var inspectCodebaseFolder = async (payload, timeoutMs, signal) => {
   const input = codebaseJobPayload(payload);
@@ -4183,7 +4617,7 @@ var fetchCodebase = async (payload, timeoutMs, signal) => {
   if (!("snapshot" in beforeResult)) return beforeResult;
   const before = beforeResult.snapshot;
   if (before.availability !== "AVAILABLE") {
-    return { ...successfulProcess2, exitCode: 1, snapshot: before };
+    return { ...successfulProcess3, exitCode: 1, snapshot: before };
   }
   let result;
   try {
@@ -4379,7 +4813,7 @@ var inspectCodebaseGit = async (payload, timeoutMs, signal) => {
   );
   if (input.action === "STATE") {
     return {
-      ...successfulProcess2,
+      ...successfulProcess3,
       state: await inspectCodebaseGitState(folder, timeoutMs, signal)
     };
   }
@@ -4404,7 +4838,7 @@ var inspectCodebaseGit = async (payload, timeoutMs, signal) => {
   );
   const patch = truncateUtf8(result.stdout, MAX_CODEBASE_STASH_PATCH_BYTES);
   return {
-    ...successfulProcess2,
+    ...successfulProcess3,
     diff: {
       oid: input.stashOid,
       patch: patch.value,
@@ -4623,7 +5057,7 @@ var operateCodebaseGit = async (payload, timeoutMs, signal) => {
     }
   }
   return {
-    ...successfulProcess2,
+    ...successfulProcess3,
     snapshot: await inspectCodebase(
       folder,
       Math.min(timeoutMs, 3e4),
@@ -4640,25 +5074,25 @@ var operateCodebaseGit = async (payload, timeoutMs, signal) => {
 
 // src/handlers/skills.ts
 import { execFile } from "node:child_process";
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 import {
   access,
   chmod as chmod2,
   lstat as lstat2,
-  mkdir as mkdir2,
-  readFile as readFile2,
+  mkdir as mkdir3,
+  readFile as readFile3,
   realpath as realpath3,
   readdir as readdir4,
   rename as rename2,
-  rm as rm2,
+  rm as rm3,
   stat as stat4,
-  writeFile as writeFile2
+  writeFile as writeFile3
 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
 import { dirname as dirname4, isAbsolute as isAbsolute2, join as join5, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
 import { promisify } from "node:util";
 var executeFile = promisify(execFile);
-var successfulProcess3 = {
+var successfulProcess4 = {
   exitCode: 0,
   signal: null,
   timedOut: false,
@@ -4767,7 +5201,7 @@ async function listPackageFiles(skillDirectory) {
         throw new Error("Skill exceeds the package size limit");
       files.push({
         path: relative2(skillDirectory, path).split(sep2).join("/"),
-        contentsBase64: (await readFile2(path)).toString("base64"),
+        contentsBase64: (await readFile3(path)).toString("base64"),
         executable: (metadata.mode & 73) !== 0
       });
     }
@@ -4889,7 +5323,7 @@ var scanSkills = async (payload) => {
     )
   )).flat();
   return {
-    ...successfulProcess3,
+    ...successfulProcess4,
     configuredTools: observations,
     installations,
     warnings: warnings.slice(0, 500)
@@ -4914,7 +5348,7 @@ var readSkills = async (payload) => {
       package: await readPackage(join5(root, request.skillName))
     });
   }
-  return { ...successfulProcess3, packages };
+  return { ...successfulProcess4, packages };
 };
 async function gitExcludePath(folder) {
   const result = await executeFile("git", [
@@ -4929,10 +5363,10 @@ async function gitExcludePath(folder) {
 }
 async function updateManagedExclude(folder, relativeSkillPath, present) {
   const excludePath = await gitExcludePath(folder);
-  await mkdir2(dirname4(excludePath), { recursive: true });
+  await mkdir3(dirname4(excludePath), { recursive: true });
   let existing = "";
   try {
-    existing = await readFile2(excludePath, "utf8");
+    existing = await readFile3(excludePath, "utf8");
   } catch {
   }
   const start = existing.indexOf(MANAGED_EXCLUDE_START);
@@ -4952,7 +5386,7 @@ async function updateManagedExclude(folder, relativeSkillPath, present) {
   const block = managed.size ? `${MANAGED_EXCLUDE_START}
 ${[...managed].sort().join("\n")}
 ${MANAGED_EXCLUDE_END}` : "";
-  await writeFile2(
+  await writeFile3(
     excludePath,
     `${[before, block, after].filter(Boolean).join("\n\n")}
 `,
@@ -4975,17 +5409,17 @@ async function writePackage(location, skillPackage) {
   const root = rootPath(location);
   const destination = join5(root, skillPackage.name);
   await assertUntracked(location, destination);
-  await mkdir2(root, { recursive: true });
-  const temporary = join5(root, `.${skillPackage.name}.${randomUUID()}.tmp`);
-  const backup = join5(root, `.${skillPackage.name}.${randomUUID()}.bak`);
-  await mkdir2(temporary, { recursive: true });
+  await mkdir3(root, { recursive: true });
+  const temporary = join5(root, `.${skillPackage.name}.${randomUUID2()}.tmp`);
+  const backup = join5(root, `.${skillPackage.name}.${randomUUID2()}.bak`);
+  await mkdir3(temporary, { recursive: true });
   try {
     for (const file of skillPackage.files) {
       const path = resolve3(temporary, ...file.path.split("/"));
       if (!path.startsWith(`${temporary}${sep2}`))
         throw new Error("Skill file escaped temporary directory");
-      await mkdir2(dirname4(path), { recursive: true });
-      await writeFile2(path, Buffer.from(file.contentsBase64, "base64"));
+      await mkdir3(dirname4(path), { recursive: true });
+      await writeFile3(path, Buffer.from(file.contentsBase64, "base64"));
       await chmod2(path, file.executable ? 493 : 420);
     }
     let hadDestination = false;
@@ -4998,14 +5432,14 @@ async function writePackage(location, skillPackage) {
     }
     try {
       await rename2(temporary, destination);
-      if (hadDestination) await rm2(backup, { recursive: true, force: true });
+      if (hadDestination) await rm3(backup, { recursive: true, force: true });
     } catch (error) {
       if (hadDestination) await rename2(backup, destination);
       throw error;
     }
   } finally {
-    await rm2(temporary, { recursive: true, force: true });
-    await rm2(backup, { recursive: true, force: true });
+    await rm3(temporary, { recursive: true, force: true });
+    await rm3(backup, { recursive: true, force: true });
   }
   return destination;
 }
@@ -5025,7 +5459,7 @@ var applySkills = async (payload) => {
         packageHash: operation.package.packageHash
       });
     } else {
-      await rm2(destination, { recursive: true, force: true });
+      await rm3(destination, { recursive: true, force: true });
       results.push({
         kind: operation.kind,
         path: destination,
@@ -5040,13 +5474,13 @@ var applySkills = async (payload) => {
       );
     }
   }
-  return { ...successfulProcess3, results };
+  return { ...successfulProcess4, results };
 };
 
 // src/handlers/worktrees.ts
 import { createWriteStream, watch } from "node:fs";
-import { mkdtemp, open, readFile as readFile3, realpath as realpath4, rm as rm3, stat as stat5 } from "node:fs/promises";
-import { tmpdir } from "node:os";
+import { mkdtemp as mkdtemp2, open, readFile as readFile4, realpath as realpath4, rm as rm4, stat as stat5 } from "node:fs/promises";
+import { tmpdir as tmpdir2 } from "node:os";
 import { basename as basename3, dirname as dirname5, join as join6, relative as relative4 } from "node:path";
 import { spawn as spawn4 } from "node:child_process";
 
@@ -5242,7 +5676,7 @@ async function worktreeCodeStateHash(folder, timeoutMs, signal) {
 }
 
 // src/handlers/worktrees.ts
-var successfulProcess4 = {
+var successfulProcess5 = {
   exitCode: 0,
   signal: null,
   timedOut: false,
@@ -5686,7 +6120,7 @@ async function untrackedLines(folder, path) {
   try {
     const file = await stat5(`${folder}/${path}`);
     if (!file.isFile() || file.size > 1024 * 1024) return null;
-    const contents = await readFile3(`${folder}/${path}`);
+    const contents = await readFile4(`${folder}/${path}`);
     if (contents.includes(0)) return null;
     const text2 = contents.toString("utf8");
     return text2 ? text2.split("\n").length - (text2.endsWith("\n") ? 1 : 0) : 0;
@@ -6137,7 +6571,7 @@ var inspectWorktreeDiff = async (payload, timeoutMs, signal) => {
   const input = worktreeDiffPayload(payload);
   const folder = await validateWorktree(input, timeoutMs, signal);
   return {
-    ...successfulProcess4,
+    ...successfulProcess5,
     diff: await inspectRequestedDiff(input, folder, timeoutMs, signal)
   };
 };
@@ -6239,7 +6673,7 @@ var downloadWorktreeDiffAsset = async (payload, timeoutMs, signal, _onLog, conte
       if (!/^\d+$/.test(size) || Number(size) > 20 * 1024 * 1024) {
         throw new Error("Diff image exceeds the 20 MiB limit");
       }
-      temporaryDirectory = await mkdtemp(join6(tmpdir(), "ade-diff-image-"));
+      temporaryDirectory = await mkdtemp2(join6(tmpdir2(), "ade-diff-image-"));
       uploadPath = join6(temporaryDirectory, basename3(input.path));
       await writeGitObject(
         folder,
@@ -6259,10 +6693,10 @@ var downloadWorktreeDiffAsset = async (payload, timeoutMs, signal, _onLog, conte
       filename: basename3(input.path),
       contentType: imageContentType(input.path)
     });
-    return successfulProcess4;
+    return successfulProcess5;
   } finally {
     if (temporaryDirectory) {
-      await rm3(temporaryDirectory, { recursive: true, force: true });
+      await rm4(temporaryDirectory, { recursive: true, force: true });
     }
   }
 };
@@ -6274,11 +6708,11 @@ var watchWorktree = async (payload, timeoutMs, signal, _onLog, context) => {
       closeWorktreeWatch(current);
       activeWorktreeWatches.delete(input.gitDirectory);
     }
-    return successfulProcess4;
+    return successfulProcess5;
   }
   if (!context) throw new Error("Worktree activity reporting is unavailable");
   const folder = await validateWorktree(input, timeoutMs, signal);
-  if (current?.watchId === input.watchId) return successfulProcess4;
+  if (current?.watchId === input.watchId) return successfulProcess5;
   if (current) {
     closeWorktreeWatch(current);
     activeWorktreeWatches.delete(input.gitDirectory);
@@ -6320,14 +6754,14 @@ var watchWorktree = async (payload, timeoutMs, signal, _onLog, context) => {
     activeWorktreeWatches.delete(input.gitDirectory);
     throw error;
   }
-  return successfulProcess4;
+  return successfulProcess5;
 };
 var inspectWorktree = async (payload, timeoutMs, signal) => {
   const input = worktreeJobPayload(payload);
   const folder = await validateWorktree(input, timeoutMs, signal);
   if (!input.baseBranch) throw new Error("A base branch is required");
   return {
-    ...successfulProcess4,
+    ...successfulProcess5,
     detail: await inspectWorktreeDetail(
       folder,
       input.baseBranch,
@@ -6558,7 +6992,7 @@ var branchWorktree = async (payload, timeoutMs, signal) => {
     throw new Error(worktree.error || "Could not inspect the updated worktree");
   }
   return {
-    ...successfulProcess4,
+    ...successfulProcess5,
     worktree,
     branch,
     baseBranch: input.baseBranch,
@@ -6613,7 +7047,7 @@ var pushMovedWorktree = async (payload, timeoutMs, signal) => {
     throw new Error("The source branch changed while it was being pushed");
   }
   return {
-    ...successfulProcess4,
+    ...successfulProcess5,
     moveId: input.moveId,
     branch,
     headSha: pushedHeadSha
@@ -6813,7 +7247,7 @@ var checkoutMovedWorktree = async (payload, timeoutMs, signal) => {
     if (switched.exitCode !== 0) {
       if (!input.stashOnFailure && hasChanges(targetChanges)) {
         return {
-          ...successfulProcess4,
+          ...successfulProcess5,
           moveId: input.moveId,
           outcome: "NEEDS_STASH",
           message: cleanError2(
@@ -6858,7 +7292,7 @@ var checkoutMovedWorktree = async (payload, timeoutMs, signal) => {
     );
   }
   return {
-    ...successfulProcess4,
+    ...successfulProcess5,
     moveId: input.moveId,
     outcome: "CHECKED_OUT",
     worktree,
@@ -6956,7 +7390,7 @@ var deleteWorktree = async (payload, timeoutMs, signal) => {
     );
   }
   return {
-    ...successfulProcess4,
+    ...successfulProcess5,
     moveId: input.moveId,
     deleted: true,
     branch,
@@ -7050,7 +7484,7 @@ var operateWorktree = async (payload, timeoutMs, signal) => {
       break;
   }
   return {
-    ...successfulProcess4,
+    ...successfulProcess5,
     worktree: await inspectWorktreeItem(
       folder,
       folder,
@@ -7063,22 +7497,22 @@ var operateWorktree = async (payload, timeoutMs, signal) => {
 };
 
 // src/handlers/builds.ts
-import { createHash as createHash4, randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash4, randomUUID as randomUUID3 } from "node:crypto";
 import {
   cp,
-  mkdir as mkdir3,
-  mkdtemp as mkdtemp2,
+  mkdir as mkdir4,
+  mkdtemp as mkdtemp3,
   open as open2,
   readdir as readdir5,
-  readFile as readFile4,
+  readFile as readFile5,
   realpath as realpath5,
   rename as rename3,
-  rm as rm4,
+  rm as rm5,
   stat as stat6,
-  writeFile as writeFile3
+  writeFile as writeFile4
 } from "node:fs/promises";
 import { createReadStream as createReadStream3, createWriteStream as createWriteStream2 } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
+import { tmpdir as tmpdir3 } from "node:os";
 import { pipeline } from "node:stream/promises";
 import {
   basename as basename4,
@@ -7090,7 +7524,7 @@ import {
   sep as sep4
 } from "node:path";
 import { spawn as spawn5 } from "node:child_process";
-var successfulProcess5 = {
+var successfulProcess6 = {
   exitCode: 0,
   signal: null,
   timedOut: false,
@@ -7283,7 +7717,7 @@ async function workspaceProjectPaths(workspacePath2, folder) {
   const contentsPath = join7(workspacePath2, "contents.xcworkspacedata");
   let contents;
   try {
-    contents = await readFile4(contentsPath, "utf8");
+    contents = await readFile5(contentsPath, "utf8");
   } catch {
     return [];
   }
@@ -7384,11 +7818,211 @@ async function testPlans(source, absolutePath, folder, scheme, timeoutMs, signal
   }
   return [];
 }
+function buildSetting(settings, key) {
+  const value = settings[key];
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function signingPlatform(settings) {
+  const platform = buildSetting(settings, "PLATFORM_NAME");
+  if (platform === "iphoneos") return "iOS";
+  if (platform === "watchos") return "watchOS";
+  if (platform === "appletvos") return "tvOS";
+  if (platform === "xros") return "visionOS";
+  if (platform === "macosx") return "macOS";
+  return platform;
+}
+function requiresProvisioningProfile(productType) {
+  return typeof productType === "string" && (productType.includes("application") || productType.includes("app-extension") || productType.includes("watchkit"));
+}
+function pbxObject(objects, id) {
+  if (typeof id !== "string") return null;
+  const value = objects[id];
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function dependentSigningTargetNamesFromPbxProject(value, rootTargetNames) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return [];
+  const rawObjects = value.objects;
+  if (!rawObjects || typeof rawObjects !== "object" || Array.isArray(rawObjects))
+    return [];
+  const objects = rawObjects;
+  const roots = new Set(rootTargetNames);
+  const targetEntries = Object.entries(objects).filter(([, target2]) => {
+    if (!target2 || typeof target2 !== "object" || Array.isArray(target2)) {
+      return false;
+    }
+    const record = target2;
+    return (record.isa === "PBXNativeTarget" || record.isa === "PBXAggregateTarget") && typeof record.name === "string";
+  });
+  const queue = targetEntries.filter(
+    ([, target2]) => roots.has(target2.name)
+  ).map(([id]) => id);
+  const visited = new Set(queue);
+  const signingTargets = [];
+  while (queue.length) {
+    const target2 = pbxObject(objects, queue.shift());
+    if (!target2 || !Array.isArray(target2.dependencies)) continue;
+    for (const dependencyId of target2.dependencies) {
+      const dependency = pbxObject(objects, dependencyId);
+      const dependentTargetId = dependency?.target;
+      if (typeof dependentTargetId !== "string") continue;
+      const dependentTarget = pbxObject(objects, dependentTargetId);
+      if (!dependentTarget) continue;
+      if (!visited.has(dependentTargetId)) {
+        visited.add(dependentTargetId);
+        queue.push(dependentTargetId);
+      }
+      const name = dependentTarget.name;
+      if (typeof name === "string" && !roots.has(name) && requiresProvisioningProfile(dependentTarget.productType)) {
+        signingTargets.push(name);
+      }
+    }
+  }
+  return uniqueSorted(signingTargets);
+}
+function signingRequirementsFromBuildSettings(value) {
+  if (!Array.isArray(value)) return [];
+  const requirements = /* @__PURE__ */ new Map();
+  for (const entry of value) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const record = entry;
+    const rawSettings = record.buildSettings;
+    if (!rawSettings || typeof rawSettings !== "object" || Array.isArray(rawSettings)) {
+      continue;
+    }
+    const settings = rawSettings;
+    const bundleId = buildSetting(settings, "PRODUCT_BUNDLE_IDENTIFIER");
+    if (!bundleId || buildSetting(settings, "CODE_SIGNING_ALLOWED") === "NO") {
+      continue;
+    }
+    const productType = buildSetting(settings, "PRODUCT_TYPE") ?? "";
+    if (productType && !requiresProvisioningProfile(productType)) {
+      continue;
+    }
+    const target2 = typeof record.target === "string" && record.target.trim() || bundleId;
+    const requirement = {
+      bundleId,
+      name: buildSetting(settings, "PRODUCT_NAME") ?? buildSetting(settings, "FULL_PRODUCT_NAME") ?? target2,
+      target: target2,
+      platform: signingPlatform(settings),
+      teamId: buildSetting(settings, "DEVELOPMENT_TEAM"),
+      provisioningProfileSpecifier: buildSetting(settings, "PROVISIONING_PROFILE_SPECIFIER") ?? buildSetting(settings, "PROVISIONING_PROFILE")
+    };
+    const existing = requirements.get(bundleId);
+    if (!existing || !existing.provisioningProfileSpecifier && requirement.provisioningProfileSpecifier) {
+      requirements.set(bundleId, requirement);
+    }
+  }
+  return [...requirements.values()].sort(
+    (left, right) => left.name.localeCompare(right.name)
+  );
+}
+function mergeSigningRequirements(requirements) {
+  const merged = /* @__PURE__ */ new Map();
+  for (const requirement of requirements) {
+    const existing = merged.get(requirement.bundleId);
+    if (!existing || !existing.provisioningProfileSpecifier && requirement.provisioningProfileSpecifier) {
+      merged.set(requirement.bundleId, requirement);
+    }
+  }
+  return [...merged.values()].sort(
+    (left, right) => left.name.localeCompare(right.name)
+  );
+}
+async function dependentSigningRequirements(source, absolutePath, folder, rootTargetNames, configuration, timeoutMs, signal) {
+  const projects = source.kind === "PROJECT" ? [absolutePath] : source.kind === "WORKSPACE" ? await workspaceProjectPaths(absolutePath, folder) : [];
+  const targets = [];
+  for (const project of projects.slice(0, 50)) {
+    const converted = await command2(
+      "plutil",
+      ["-convert", "json", "-o", "-", join7(project, "project.pbxproj")],
+      Math.min(timeoutMs, 15e3),
+      signal,
+      folder
+    );
+    if (converted.exitCode !== 0) continue;
+    const names = dependentSigningTargetNamesFromPbxProject(
+      parseJson(converted.stdout, "Xcode project graph"),
+      rootTargetNames
+    );
+    targets.push(...names.map((name) => ({ project, name })));
+  }
+  const requirements = [];
+  for (const target2 of targets.slice(0, 50)) {
+    const result = await command2(
+      "xcrun",
+      [
+        "xcodebuild",
+        "-project",
+        target2.project,
+        "-target",
+        target2.name,
+        "-configuration",
+        configuration,
+        "-showBuildSettings",
+        "-json"
+      ],
+      Math.min(timeoutMs, 6e4),
+      signal,
+      folder
+    );
+    if (result.exitCode !== 0) continue;
+    try {
+      requirements.push(
+        ...signingRequirementsFromBuildSettings(JSON.parse(result.stdout))
+      );
+    } catch {
+    }
+  }
+  return requirements;
+}
+async function inspectSigningRequirements(source, absolutePath, folder, scheme, configuration, timeoutMs, signal) {
+  if (!scheme || !configuration) return [];
+  const result = requireSuccess3(
+    await command2(
+      "xcrun",
+      [
+        "xcodebuild",
+        ...sourceArguments(source, absolutePath),
+        "-scheme",
+        scheme,
+        "-configuration",
+        configuration,
+        "-destination",
+        "generic/platform=iOS",
+        "-showBuildSettings",
+        "-json"
+      ],
+      Math.min(timeoutMs, 6e4),
+      signal,
+      folder
+    ),
+    "Could not inspect signing requirements"
+  );
+  try {
+    const direct = signingRequirementsFromBuildSettings(
+      JSON.parse(result.stdout)
+    );
+    const dependent = await dependentSigningRequirements(
+      source,
+      absolutePath,
+      folder,
+      direct.map((requirement) => requirement.target),
+      configuration,
+      timeoutMs,
+      signal
+    );
+    return mergeSigningRequirements([...direct, ...dependent]);
+  } catch (error) {
+    throw new Error(
+      `Could not parse Xcode signing requirements: ${cleanError3(error)}`
+    );
+  }
+}
 var discoverBuildSources = async (payload, timeoutMs, signal) => {
   const input = parseBuildSourceDiscoverPayload(payload);
   const folder = await validateWorktree2(input, timeoutMs, signal);
   return {
-    ...successfulProcess5,
+    ...successfulProcess6,
     sources: await discoverSourcesInFolder(folder)
   };
 };
@@ -7402,11 +8036,8 @@ var parseBuildSourceMetadata = async (payload, timeoutMs, signal) => {
   ]);
   const metadata = metadataFromList(list);
   const configurations = input.source.kind === "PACKAGE" ? ["Debug", "Release"] : input.source.kind === "WORKSPACE" && metadata.configurations.length === 0 ? await workspaceConfigurations(absolutePath, folder, timeoutMs, signal) : metadata.configurations;
-  return {
-    ...successfulProcess5,
-    schemes: uniqueSorted(metadata.schemes),
-    configurations: uniqueSorted(configurations),
-    testPlans: await testPlans(
+  const [plans, signingRequirements] = await Promise.all([
+    testPlans(
       input.source,
       absolutePath,
       folder,
@@ -7414,6 +8045,22 @@ var parseBuildSourceMetadata = async (payload, timeoutMs, signal) => {
       timeoutMs,
       signal
     ),
+    inspectSigningRequirements(
+      input.source,
+      absolutePath,
+      folder,
+      input.scheme,
+      input.configuration,
+      timeoutMs,
+      signal
+    )
+  ]);
+  return {
+    ...successfulProcess6,
+    schemes: uniqueSorted(metadata.schemes),
+    configurations: uniqueSorted(configurations),
+    testPlans: plans,
+    signingRequirements,
     xcodeVersion: version.exitCode === 0 ? version.stdout.trim().replace(/\n+/g, " \xB7 ") : null,
     headSha: input.headSha
   };
@@ -7524,7 +8171,7 @@ function genericBuildDestinations(action) {
   ];
 }
 async function listPhysicalDevices(timeoutMs, signal) {
-  const directory = await mkdtemp2(join7(tmpdir2(), "ade-devices-"));
+  const directory = await mkdtemp3(join7(tmpdir3(), "ade-devices-"));
   const output = join7(directory, "devices.json");
   try {
     const result = await command2(
@@ -7543,9 +8190,9 @@ async function listPhysicalDevices(timeoutMs, signal) {
       signal
     );
     if (result.exitCode !== 0) return [];
-    return physicalDestinations(JSON.parse(await readFile4(output, "utf8")));
+    return physicalDestinations(JSON.parse(await readFile5(output, "utf8")));
   } finally {
-    await rm4(directory, { recursive: true, force: true });
+    await rm5(directory, { recursive: true, force: true });
   }
 }
 var inspectBuildDestinations = async (payload, timeoutMs, signal) => {
@@ -7580,7 +8227,7 @@ var inspectBuildDestinations = async (payload, timeoutMs, signal) => {
     listPhysicalDevices(timeoutMs, signal)
   ]);
   return {
-    ...successfulProcess5,
+    ...successfulProcess6,
     destinations: [
       ...genericBuildDestinations(input.action),
       ...simulators.exitCode === 0 ? simulatorDestinations(JSON.parse(simulators.stdout)) : [],
@@ -7601,12 +8248,12 @@ var inspectBuildRunDestinations = async (payload, timeoutMs, signal) => {
     );
     requireSuccess3(simulators, "Could not inspect available simulators");
     return {
-      ...successfulProcess5,
+      ...successfulProcess6,
       destinations: simulatorDestinations(JSON.parse(simulators.stdout))
     };
   }
   return {
-    ...successfulProcess5,
+    ...successfulProcess6,
     destinations: await listPhysicalDevices(timeoutMs, signal)
   };
 };
@@ -8025,16 +8672,16 @@ async function runHook(options) {
   const log = join7(directory, `${prefix}.log`);
   const started = Date.now();
   try {
-    await mkdir3(directory, { recursive: true, mode: 448 });
-    await writeFile3(file, `${options.source}
+    await mkdir4(directory, { recursive: true, mode: 448 });
+    await writeFile4(file, `${options.source}
 `, { mode: 384 });
-    await writeFile3(
+    await writeFile4(
       options.contextPath,
       `${JSON.stringify(options.hookContext, null, 2)}
 `,
       { mode: 384 }
     );
-    await writeFile3(
+    await writeFile4(
       runner,
       `import { readFile } from "node:fs/promises";
 const hookModule = await import(${JSON.stringify(`./${basename4(file)}`)});
@@ -8312,7 +8959,7 @@ async function writeJsonReport(input, kind, timeoutMs, signal) {
   const resultBundle = join7(input.artifactDirectory, "result.xcresult");
   const filename = kind === "TEST_RESULTS" ? "test-results.json" : "code-coverage.json";
   const destination = join7(input.artifactDirectory, filename);
-  const temporary = `${destination}.tmp-${randomUUID2()}`;
+  const temporary = `${destination}.tmp-${randomUUID3()}`;
   try {
     if (!await pathExists(resultBundle)) {
       throw new Error("The build result bundle is unavailable");
@@ -8339,7 +8986,7 @@ async function writeJsonReport(input, kind, timeoutMs, signal) {
       ),
       `Could not generate ${filename}`
     );
-    const serialized = await readFile4(temporary, "utf8");
+    const serialized = await readFile5(temporary, "utf8");
     const parsed = JSON.parse(serialized);
     const normalized = kind === "TEST_RESULTS" ? normalizeTestResults(parsed) : normalizeCoverage(parsed);
     await rename3(temporary, destination);
@@ -8355,7 +9002,7 @@ async function writeJsonReport(input, kind, timeoutMs, signal) {
       error: null
     };
   } catch (error) {
-    await rm4(temporary, { force: true });
+    await rm5(temporary, { force: true });
     return {
       kind,
       status: "FAILED",
@@ -8446,7 +9093,7 @@ async function snapshotCoverageChanges(input, folder, timeoutMs, signal) {
   const types = changeTypesFromStatus(status2.stdout);
   for (const path of untracked.stdout.split("\0").filter(Boolean)) {
     try {
-      const contents = await readFile4(join7(folder, path));
+      const contents = await readFile5(join7(folder, path));
       if (contents.includes(0)) continue;
       const lineCount = contents.length ? contents.toString("utf8").split("\n").length - (contents.toString("utf8").endsWith("\n") ? 1 : 0) : 0;
       lines.set(
@@ -8482,7 +9129,7 @@ async function addChangedCoverage(report, changes, input, folder, timeoutMs, sig
     if (coveragePath && change.lines.length) {
       const temporary2 = join7(
         input.artifactDirectory,
-        `.changed-coverage-${randomUUID2()}.json`
+        `.changed-coverage-${randomUUID3()}.json`
       );
       try {
         const result = await commandToFile(
@@ -8504,7 +9151,7 @@ async function addChangedCoverage(report, changes, input, folder, timeoutMs, sig
         );
         if (result.exitCode === 0 && !result.cancelled && !result.timedOut) {
           const parsed = jsonObject(
-            JSON.parse(await readFile4(temporary2, "utf8"))
+            JSON.parse(await readFile5(temporary2, "utf8"))
           );
           const lineData = parsed?.[coveragePath];
           if (Array.isArray(lineData)) {
@@ -8521,7 +9168,7 @@ async function addChangedCoverage(report, changes, input, folder, timeoutMs, sig
           }
         }
       } finally {
-        await rm4(temporary2, { force: true });
+        await rm5(temporary2, { force: true });
       }
     }
     changedCoveredLines += covered;
@@ -8542,8 +9189,8 @@ async function addChangedCoverage(report, changes, input, folder, timeoutMs, sig
   };
   const data = { ...report.data, changedFiles };
   const destination = join7(input.artifactDirectory, "worktree-coverage.json");
-  const temporary = `${destination}.tmp-${randomUUID2()}`;
-  await writeFile3(temporary, JSON.stringify({ summary, data }, null, 2), {
+  const temporary = `${destination}.tmp-${randomUUID3()}`;
+  await writeFile4(temporary, JSON.stringify({ summary, data }, null, 2), {
     mode: 384
   });
   await rename3(temporary, destination);
@@ -8659,8 +9306,8 @@ async function captureArtifacts(input, folder, signal, includeProducts = true) {
     if (source && await pathExists(source)) {
       const productDirectory = join7(input.artifactDirectory, "products");
       const destination = join7(productDirectory, basename4(source));
-      await mkdir3(productDirectory, { recursive: true, mode: 448 });
-      await rm4(destination, { recursive: true, force: true });
+      await mkdir4(productDirectory, { recursive: true, mode: 448 });
+      await rm5(destination, { recursive: true, force: true });
       await cp(source, destination, {
         recursive: true,
         preserveTimestamps: true
@@ -8725,7 +9372,7 @@ var runIosBuild = async (payload, timeoutMs, signal, onLog, context) => {
     Math.min(timeoutMs, 6e4),
     signal
   );
-  await mkdir3(input.artifactDirectory, { recursive: true, mode: 448 });
+  await mkdir4(input.artifactDirectory, { recursive: true, mode: 448 });
   const rawLog = join7(input.artifactDirectory, "build.log");
   const logger = new BuildLogger(input.buildId, context, rawLog, process.env);
   try {
@@ -8967,7 +9614,7 @@ var generateIosBuildReport = async (payload, timeoutMs, signal, onLog) => {
   if (!isAbsolute4(input.artifactDirectory) || basename4(input.artifactDirectory) !== input.buildId) {
     throw new Error("Build artifact directory is invalid");
   }
-  if (signal.aborted) return { ...successfulProcess5, cancelled: true };
+  if (signal.aborted) return { ...successfulProcess6, cancelled: true };
   const report = await writeJsonReport(
     input,
     input.reportKind,
@@ -8981,22 +9628,22 @@ var generateIosBuildReport = async (payload, timeoutMs, signal, onLog) => {
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   });
   return {
-    ...successfulProcess5,
+    ...successfulProcess6,
     report,
     artifacts: report.artifact ? [report.artifact] : []
   };
 };
 var deleteIosBuild = async (payload, _timeoutMs, signal, onLog) => {
   const input = parseBuildDeletePayload(payload);
-  if (signal.aborted) return { ...successfulProcess5, cancelled: true };
-  await rm4(input.artifactDirectory, { recursive: true, force: true });
+  if (signal.aborted) return { ...successfulProcess6, cancelled: true };
+  await rm5(input.artifactDirectory, { recursive: true, force: true });
   await onLog({
     sequence: 0,
     stream: "SYSTEM",
     message: `Deleted build folder ${input.artifactDirectory}`,
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   });
-  return successfulProcess5;
+  return successfulProcess6;
 };
 var downloadIosBuildArtifact = async (payload, timeoutMs, signal, onLog, context) => {
   const input = parseBuildArtifactDownloadPayload(payload);
@@ -9019,8 +9666,8 @@ var downloadIosBuildArtifact = async (payload, timeoutMs, signal, onLog, context
   try {
     if (information.isDirectory()) {
       temporaryArchive = join7(
-        tmpdir2(),
-        `ade-build-artifact-${randomUUID2()}.tar.gz`
+        tmpdir3(),
+        `ade-build-artifact-${randomUUID3()}.tar.gz`
       );
       requireSuccess3(
         await command2(
@@ -9049,10 +9696,10 @@ var downloadIosBuildArtifact = async (payload, timeoutMs, signal, onLog, context
       filename,
       contentType
     });
-    return successfulProcess5;
+    return successfulProcess6;
   } finally {
     if (temporaryArchive) {
-      await rm4(temporaryArchive, { force: true });
+      await rm5(temporaryArchive, { force: true });
     }
   }
 };
@@ -9089,7 +9736,7 @@ var deployIosBuild = async (payload, timeoutMs, signal, _onLog, context) => {
     throw new Error("Runnable app artifact is missing");
   }
   const deploymentsDirectory = join7(input.artifactDirectory, "deployments");
-  await mkdir3(deploymentsDirectory, { recursive: true, mode: 448 });
+  await mkdir4(deploymentsDirectory, { recursive: true, mode: 448 });
   const logger = new BuildLogger(
     input.buildId,
     context,
@@ -9104,7 +9751,7 @@ var deployIosBuild = async (payload, timeoutMs, signal, _onLog, context) => {
         "deployments",
         deployment.id
       );
-      await mkdir3(directory, { recursive: true, mode: 448 });
+      await mkdir4(directory, { recursive: true, mode: 448 });
       const logPath = join7(directory, "deployment.log");
       const started = Date.now();
       let failure = null;
@@ -9288,8 +9935,16 @@ function exportPlist(settings) {
     signingStyle: settings.signingStyle.toLowerCase(),
     uploadSymbols: settings.uploadSymbols,
     manageAppVersionAndBuildNumber: settings.manageAppVersionAndBuildNumber,
-    testFlightInternalTestingOnly: settings.testFlightInternalTestingOnly
+    testFlightInternalTestingOnly: settings.testFlightInternalTestingOnly,
+    stripSwiftSymbols: settings.stripSwiftSymbols
   };
+  if (settings.thinning) values.thinning = settings.thinning;
+  if (settings.iCloudContainerEnvironment) {
+    values.iCloudContainerEnvironment = settings.iCloudContainerEnvironment;
+  }
+  if (settings.distributionBundleIdentifier) {
+    values.distributionBundleIdentifier = settings.distributionBundleIdentifier;
+  }
   if (settings.teamId) values.teamID = settings.teamId;
   if (settings.signingCertificate)
     values.signingCertificate = settings.signingCertificate;
@@ -9317,10 +9972,10 @@ var exportIosArchive = async (payload, timeoutMs, signal, _onLog, context) => {
     "exports",
     input.exportId
   );
-  await mkdir3(exportDirectory, { recursive: true, mode: 448 });
+  await mkdir4(exportDirectory, { recursive: true, mode: 448 });
   const plistPath = join7(exportDirectory, "ExportOptions.plist");
   const logPath = join7(exportDirectory, "export.log");
-  await writeFile3(plistPath, exportPlist(input.settings), { mode: 384 });
+  await writeFile4(plistPath, exportPlist(input.settings), { mode: 384 });
   const logger = new BuildLogger(input.buildId, context, logPath, process.env);
   try {
     const result = await runLoggedCommand({
@@ -9412,7 +10067,13 @@ var handlers = {
   [IOS_EXPORT_JOB_KIND]: exportIosArchive,
   [IOS_TEST_RESULTS_JOB_KIND]: generateIosBuildReport,
   [IOS_COVERAGE_REPORT_JOB_KIND]: generateIosBuildReport,
-  [IOS_SIGNING_INSPECT_JOB_KIND]: inspectIosSigning
+  [IOS_SIGNING_INSPECT_JOB_KIND]: inspectIosSigning,
+  [SIGNING_ASSETS_SCAN_JOB_KIND]: scanSigningAssets,
+  [SIGNING_PROFILE_READ_JOB_KIND]: readSigningProfile,
+  [SIGNING_PROFILE_INSTALL_JOB_KIND]: installSigningProfile,
+  [SIGNING_PROFILE_DELETE_JOB_KIND]: deleteSigningProfile,
+  [SIGNING_IDENTITY_IMPORT_JOB_KIND]: importSigningIdentity,
+  [SIGNING_IDENTITY_DELETE_JOB_KIND]: deleteSigningIdentity
 };
 
 // src/repository-coordinator.ts
@@ -9491,7 +10152,8 @@ var JobExecutor = class {
           reportWorktreeActivity: (input) => this.client.reportWorktreeActivity(input),
           reportBuildProgress: (input) => this.client.reportBuildProgress(input),
           appendBuildLogs: (buildId, events) => this.client.appendBuildLogs(buildId, events),
-          uploadBuildArtifact: (input) => this.client.uploadBuildArtifact(input)
+          uploadBuildArtifact: (input) => this.client.uploadBuildArtifact(input),
+          claimSigningSecretTransfer: (transferId) => this.client.claimSigningSecretTransfer(transferId)
         }
       );
       const codebaseId = claimed.payload && typeof claimed.payload === "object" && !Array.isArray(claimed.payload) && typeof claimed.payload.codebaseId === "string" ? String(claimed.payload.codebaseId) : null;