@autifyhq/aximo-cli 0.6.0 → 0.8.0

package/dist/mobile-control/ios-auto-resign.js

@@ -0,0 +1,108 @@
+import { randomBytes } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { envFlag } from "./env-flags.js";
+import { listSigningIdentities, selectIdentity } from "./ios-identity.js";
+import { mintedAppId, mintProfileViaWdaRig } from "./ios-mint.js";
+import { listProvisioningProfiles, selectProfile, } from "./ios-profiles.js";
+import { inspectIpa, isInstallableOn, resignIpa } from "./ios-resign.js";
+/** Stable per-team bundle id used for remapped resigns (minted once, reused). */
+export function aximoResignBundleId(teamId) {
+    return `com.aximo.resign.${teamId.toLowerCase()}`;
+}
+export async function ensureInstallableIpa(options) {
+    const env = options.env ?? process.env;
+    const log = options.log ?? (() => { });
+    const now = options.now ?? Date.now();
+    const inspect = options.inspect ?? inspectIpa;
+    // Opt-out first, before any structural requirements on the .ipa.
+    if (envFlag(env, "AXIMO_IOS_NO_RESIGN")) {
+        const optOutInfo = await inspect(options.ipaPath).catch(() => null);
+        const id = optOutInfo?.bundleId ?? "";
+        return {
+            ipaPath: options.ipaPath,
+            resigned: false,
+            originalBundleId: id,
+            installedBundleId: id,
+        };
+    }
+    // An .ipa whose layout inspectIpa can't parse falls through to a plain install
+    // attempt (the pre-resign behavior) instead of failing before the device sees it.
+    let info;
+    try {
+        info = await inspect(options.ipaPath);
+    }
+    catch (err) {
+        log(`Skipping auto-resign (${err instanceof Error ? err.message : String(err)}).`);
+        return {
+            ipaPath: options.ipaPath,
+            resigned: false,
+            originalBundleId: "",
+            installedBundleId: "",
+        };
+    }
+    const asIs = {
+        ipaPath: options.ipaPath,
+        resigned: false,
+        originalBundleId: info.bundleId,
+        installedBundleId: info.bundleId,
+    };
+    if (isInstallableOn(info, options.udid, now))
+        return asIs;
+    if (info.encrypted === true) {
+        throw new Error(`${options.ipaPath} is FairPlay-encrypted (an App Store download) and cannot be re-signed. ` +
+            "Use a development/ad-hoc build — the same .ipa you upload to a device farm works.");
+    }
+    const identity = selectIdentity(await (options.listIdentities ?? listSigningIdentities)(), pickEnvTeam(env));
+    if (!identity) {
+        throw new Error("This .ipa is not signed for this device, and no Apple Development signing identity " +
+            "was found in the keychain to re-sign it. Open Xcode → Settings → Accounts, add your " +
+            "Apple ID, then Manage Certificates → + → Apple Development (or import your team's .p12).");
+    }
+    const teamId = pickEnvTeam(env) ?? identity.teamId;
+    if (!teamId) {
+        throw new Error(`Could not determine the Apple Team ID from certificate "${identity.name}". ` +
+            "Set AXIMO_IOS_TEAM_ID to your team id and retry.");
+    }
+    const listProfiles = options.listProfiles ?? listProvisioningProfiles;
+    let profiles = await listProfiles();
+    const select = (bundleId, list) => selectProfile(list, { bundleId, udid: options.udid, teamId, now });
+    // Preferred: a profile covering the app's own bundle id (keeps identity stable).
+    let profile = select(info.bundleId, profiles);
+    let installedBundleId = info.bundleId;
+    if (!profile) {
+        const dedicatedAppId = mintedAppId(aximoResignBundleId(teamId));
+        profile = select(dedicatedAppId, profiles);
+        if (!profile) {
+            log("No usable provisioning profile found — minting one via Xcode automatic signing " +
+                "(first run; takes a minute or two)…");
+            await (options.mint ?? mintProfileViaWdaRig)({
+                teamId,
+                bundleId: aximoResignBundleId(teamId),
+                udid: options.udid,
+            });
+            profiles = await listProfiles();
+            profile = select(dedicatedAppId, profiles);
+            if (!profile) {
+                throw new Error("Profile minting succeeded but the fresh profile was not found on disk. " +
+                    "Check Xcode → Settings → Accounts and retry.");
+            }
+        }
+        installedBundleId = dedicatedAppId;
+    }
+    const outPath = join(tmpdir(), `aximo-resigned-${randomBytes(6).toString("hex")}.ipa`);
+    log(installedBundleId === info.bundleId
+        ? `Re-signing ${info.bundleId} for this device (team ${teamId})…`
+        : `Re-signing ${info.bundleId} for this device as ${installedBundleId} (team ${teamId})…`);
+    await (options.resign ?? resignIpa)({
+        ipaPath: options.ipaPath,
+        outPath,
+        identityHash: identity.hash,
+        profilePath: profile.path,
+        ...(installedBundleId !== info.bundleId ? { bundleId: installedBundleId } : {}),
+    });
+    return { ipaPath: outPath, resigned: true, originalBundleId: info.bundleId, installedBundleId };
+}
+function pickEnvTeam(env) {
+    return env["AXIMO_IOS_TEAM_ID"]?.trim() || env["XCODE_TEAM_ID"]?.trim() || undefined;
+}

package/dist/mobile-control/ios-auto-resign.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/mobile-control/ios-auto-resign.test.js

@@ -0,0 +1,150 @@
+import { describe, expect, it, vi } from "vitest";
+import { aximoResignBundleId, ensureInstallableIpa, } from "./ios-auto-resign.js";
+const NOW = new Date("2026-07-13T00:00:00Z").getTime();
+const UDID = "00008030-TESTUDID";
+const identity = {
+    hash: "0B0DF9CFF90EC3358C9A2CB52F006EB83FD7748C",
+    name: "Apple Development: test@example.com (ABC123DEF4)",
+    teamId: "TESTTEAM99",
+};
+function profile(over) {
+    return {
+        path: "/profiles/p.mobileprovision",
+        name: "p",
+        teamId: "TESTTEAM99",
+        bundleId: "com.example.app",
+        isWildcard: false,
+        expirationDate: new Date("2026-07-20T00:00:00Z"),
+        provisionedDevices: [UDID],
+        ...over,
+    };
+}
+function ipaInfo(over = {}) {
+    return { bundleId: "com.example.app", profile: null, encrypted: false, ...over };
+}
+function makeOptions(over = {}) {
+    return {
+        ipaPath: "/apps/app.ipa",
+        udid: UDID,
+        env: {},
+        now: NOW,
+        inspect: vi.fn(async () => ipaInfo()),
+        listIdentities: vi.fn(async () => [identity]),
+        listProfiles: vi.fn(async () => []),
+        mint: vi.fn(async () => { }),
+        resign: vi.fn(async () => { }),
+        ...over,
+    };
+}
+describe("ensureInstallableIpa", () => {
+    it("returns the IPA untouched when its profile already covers the device", async () => {
+        const opts = makeOptions({
+            inspect: vi.fn(async () => ipaInfo({ profile: profile({ bundleId: "com.example.app" }) })),
+        });
+        const result = await ensureInstallableIpa(opts);
+        expect(result).toEqual({
+            ipaPath: "/apps/app.ipa",
+            resigned: false,
+            originalBundleId: "com.example.app",
+            installedBundleId: "com.example.app",
+        });
+        expect(opts.resign).not.toHaveBeenCalled();
+    });
+    it("respects AXIMO_IOS_NO_RESIGN", async () => {
+        const opts = makeOptions({ env: { AXIMO_IOS_NO_RESIGN: "1" } });
+        const result = await ensureInstallableIpa(opts);
+        expect(result.resigned).toBe(false);
+        expect(opts.resign).not.toHaveBeenCalled();
+    });
+    it("rejects FairPlay-encrypted binaries with an actionable error", async () => {
+        const opts = makeOptions({ inspect: vi.fn(async () => ipaInfo({ encrypted: true })) });
+        await expect(ensureInstallableIpa(opts)).rejects.toThrow(/FairPlay-encrypted/);
+    });
+    it("re-signs keeping the original bundle id when a covering profile exists", async () => {
+        const covering = profile({ bundleId: "com.example.app" });
+        const opts = makeOptions({ listProfiles: vi.fn(async () => [covering]) });
+        const result = await ensureInstallableIpa(opts);
+        expect(result.resigned).toBe(true);
+        expect(result.installedBundleId).toBe("com.example.app");
+        expect(result.ipaPath).toMatch(/aximo-resigned-.*\.ipa$/);
+        expect(opts.resign).toHaveBeenCalledWith(expect.objectContaining({
+            ipaPath: "/apps/app.ipa",
+            identityHash: identity.hash,
+            profilePath: covering.path,
+        }));
+        // No bundleId remap when the profile covers the app's own id.
+        expect(vi.mocked(opts.resign).mock.calls[0]?.[0]?.bundleId).toBeUndefined();
+        expect(opts.mint).not.toHaveBeenCalled();
+    });
+    it("re-signs via a wildcard profile without remapping", async () => {
+        const wildcard = profile({ bundleId: "*", isWildcard: true });
+        const opts = makeOptions({ listProfiles: vi.fn(async () => [wildcard]) });
+        const result = await ensureInstallableIpa(opts);
+        expect(result.installedBundleId).toBe("com.example.app");
+        expect(vi.mocked(opts.resign).mock.calls[0]?.[0]?.bundleId).toBeUndefined();
+    });
+    it("falls back to the dedicated Aximo profile and remaps", async () => {
+        const dedicated = profile({
+            bundleId: `${aximoResignBundleId("TESTTEAM99")}.xctrunner`,
+        });
+        const opts = makeOptions({ listProfiles: vi.fn(async () => [dedicated]) });
+        const result = await ensureInstallableIpa(opts);
+        expect(result.installedBundleId).toBe("com.aximo.resign.testteam99.xctrunner");
+        expect(vi.mocked(opts.resign).mock.calls[0]?.[0]?.bundleId).toBe("com.aximo.resign.testteam99.xctrunner");
+        expect(opts.mint).not.toHaveBeenCalled();
+    });
+    it("mints the dedicated profile when nothing usable exists, then re-signs", async () => {
+        const dedicated = profile({
+            bundleId: `${aximoResignBundleId("TESTTEAM99")}.xctrunner`,
+        });
+        const listProfiles = vi
+            .fn(async () => [])
+            .mockResolvedValueOnce([]) // before minting
+            .mockResolvedValueOnce([dedicated]); // after minting
+        const log = vi.fn();
+        const opts = makeOptions({ listProfiles, log });
+        const result = await ensureInstallableIpa(opts);
+        expect(opts.mint).toHaveBeenCalledWith({
+            teamId: "TESTTEAM99",
+            bundleId: "com.aximo.resign.testteam99",
+            udid: UDID,
+        });
+        expect(result.installedBundleId).toBe("com.aximo.resign.testteam99.xctrunner");
+        expect(log).toHaveBeenCalledWith(expect.stringMatching(/minting one via Xcode/i));
+    });
+    it("excludes expired and wrong-device profiles from selection", async () => {
+        const expired = profile({ expirationDate: new Date("2026-07-13T06:00:00Z") });
+        const wrongDevice = profile({ provisionedDevices: ["OTHER-UDID"] });
+        const dedicated = profile({
+            bundleId: `${aximoResignBundleId("TESTTEAM99")}.xctrunner`,
+        });
+        const listProfiles = vi
+            .fn(async () => [])
+            .mockResolvedValueOnce([expired, wrongDevice]) // before minting: nothing usable
+            .mockResolvedValueOnce([expired, wrongDevice, dedicated]); // after minting
+        const opts = makeOptions({ listProfiles });
+        await ensureInstallableIpa(opts);
+        expect(opts.mint).toHaveBeenCalled(); // had to mint despite two on-disk profiles
+    });
+    it("errors actionably when the keychain has no development identity", async () => {
+        const opts = makeOptions({ listIdentities: vi.fn(async () => []) });
+        await expect(ensureInstallableIpa(opts)).rejects.toThrow(/Xcode → Settings → Accounts/);
+    });
+    it("errors when the certificate has no readable team id and no override is set", async () => {
+        const opts = makeOptions({
+            listIdentities: vi.fn(async () => [{ ...identity, teamId: null }]),
+        });
+        await expect(ensureInstallableIpa(opts)).rejects.toThrow(/AXIMO_IOS_TEAM_ID/);
+    });
+    it("uses the env team override to pick among identities", async () => {
+        const other = { ...identity, hash: "F".repeat(40), teamId: "OTHERTEAM0" };
+        const covering = profile({ teamId: "OTHERTEAM0", bundleId: "com.example.app" });
+        const opts = makeOptions({
+            env: { AXIMO_IOS_TEAM_ID: "OTHERTEAM0" },
+            listIdentities: vi.fn(async () => [identity, other]),
+            listProfiles: vi.fn(async () => [covering]),
+        });
+        await ensureInstallableIpa(opts);
+        expect(vi.mocked(opts.resign).mock.calls[0]?.[0]?.identityHash).toBe("F".repeat(40));
+    });
+});

package/dist/mobile-control/ios-devicectl.d.ts

@@ -0,0 +1,39 @@
+import { type ExecFn } from "./exec.js";
+/**
+ * CoreDevice (`xcrun devicectl`) access to physical iOS devices.
+ *
+ * devicectl ships with Xcode (which iOS BYOD requires anyway), so it replaces
+ * the idb dependency for discovery and app install. It is also the authoritative
+ * source for onboarding state — Developer Mode and pairing — which lets preflight
+ * tell the user exactly which on-device toggle is missing instead of failing
+ * later with an opaque error. devicectl only writes JSON to a file
+ * (`--json-output`), so results go through a temp file.
+ */
+export interface IosDeviceInfo {
+    udid: string;
+    name: string | null;
+    /** Marketing name, e.g. "iPhone SE". */
+    model: string | null;
+    /** e.g. "26.5". */
+    osVersion: string | null;
+    developerModeEnabled: boolean | null;
+    paired: boolean | null;
+}
+/**
+ * List currently-attached physical iPhones/iPads. `devicectl list devices` also
+ * remembers past devices; `bootState === "booted"` filters to live connections.
+ * Returns [] when devicectl is unavailable (caller can fall back to idb).
+ */
+export declare function listIosDevicesViaDevicectl(exec?: ExecFn): Promise<IosDeviceInfo[]>;
+/** Details for one device (from the list call), or null when not found. */
+export declare function getIosDeviceInfo(udid: string, exec?: ExecFn): Promise<IosDeviceInfo | null>;
+/** Major version from an osVersion string ("26.5" → 26), null when unknown. */
+export declare function iosMajorVersion(osVersion: string | null): number | null;
+/** Install an .ipa (already signed for this device) via CoreDevice. */
+export declare function installAppViaDevicectl(udid: string, ipaPath: string, exec?: ExecFn): Promise<string>;
+/**
+ * Install an .ipa, preferring devicectl but falling back to `idb install`:
+ * CoreDevice cannot address iOS ≤16 devices, which idb still handles. When both
+ * fail, the devicectl error is thrown — its messages match our hint patterns.
+ */
+export declare function installIosApp(udid: string, ipaPath: string, exec?: ExecFn): Promise<string>;

package/dist/mobile-control/ios-devicectl.js

@@ -0,0 +1,87 @@
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { execBinary } from "./exec.js";
+async function devicectlJson(exec, args) {
+    const scratch = mkdtempSync(join(tmpdir(), "aximo-devicectl-"));
+    const outPath = join(scratch, "out.json");
+    try {
+        await exec("xcrun", ["devicectl", ...args, "--json-output", outPath]);
+        return JSON.parse(readFileSync(outPath, "utf-8"));
+    }
+    catch {
+        return null; // devicectl missing (no Xcode) or command failed
+    }
+    finally {
+        rmSync(scratch, { recursive: true, force: true });
+    }
+}
+function mapDevice(device) {
+    const developerMode = device.deviceProperties?.developerModeStatus;
+    const pairing = device.connectionProperties?.pairingState;
+    return {
+        udid: device.hardwareProperties?.udid ?? "",
+        name: device.deviceProperties?.name ?? null,
+        model: device.hardwareProperties?.marketingName ?? null,
+        osVersion: device.deviceProperties?.osVersionNumber ?? null,
+        developerModeEnabled: developerMode ? developerMode === "enabled" : null,
+        paired: pairing ? pairing === "paired" : null,
+    };
+}
+/**
+ * List currently-attached physical iPhones/iPads. `devicectl list devices` also
+ * remembers past devices; `bootState === "booted"` filters to live connections.
+ * Returns [] when devicectl is unavailable (caller can fall back to idb).
+ */
+export async function listIosDevicesViaDevicectl(exec = execBinary) {
+    const json = (await devicectlJson(exec, ["list", "devices"]));
+    const devices = json?.result?.devices ?? [];
+    return devices
+        .filter((d) => d.hardwareProperties?.platform === "iOS" &&
+        d.hardwareProperties?.reality === "physical" &&
+        d.deviceProperties?.bootState === "booted" &&
+        d.hardwareProperties?.udid)
+        .map(mapDevice);
+}
+/** Details for one device (from the list call), or null when not found. */
+export async function getIosDeviceInfo(udid, exec = execBinary) {
+    const devices = await listIosDevicesViaDevicectl(exec);
+    return devices.find((d) => d.udid === udid) ?? null;
+}
+/** Major version from an osVersion string ("26.5" → 26), null when unknown. */
+export function iosMajorVersion(osVersion) {
+    const major = osVersion?.match(/^(\d+)/)?.[1];
+    return major ? Number(major) : null;
+}
+/** Install an .ipa (already signed for this device) via CoreDevice. */
+export async function installAppViaDevicectl(udid, ipaPath, exec = execBinary) {
+    const { stdout } = await exec("xcrun", [
+        "devicectl",
+        "device",
+        "install",
+        "app",
+        "--device",
+        udid,
+        ipaPath,
+    ]);
+    return stdout.toString("utf-8").trim();
+}
+/**
+ * Install an .ipa, preferring devicectl but falling back to `idb install`:
+ * CoreDevice cannot address iOS ≤16 devices, which idb still handles. When both
+ * fail, the devicectl error is thrown — its messages match our hint patterns.
+ */
+export async function installIosApp(udid, ipaPath, exec = execBinary) {
+    try {
+        return await installAppViaDevicectl(udid, ipaPath, exec);
+    }
+    catch (devicectlErr) {
+        try {
+            const { stdout } = await exec("idb", ["install", "--udid", udid, ipaPath]);
+            return stdout.toString("utf-8").trim();
+        }
+        catch {
+            throw devicectlErr;
+        }
+    }
+}

package/dist/mobile-control/ios-devicectl.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/mobile-control/ios-devicectl.test.js

@@ -0,0 +1,110 @@
+import { writeFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+import { getIosDeviceInfo, installAppViaDevicectl, iosMajorVersion, listIosDevicesViaDevicectl, } from "./ios-devicectl.js";
+function deviceJson(over = {}) {
+    return {
+        hardwareProperties: {
+            udid: "00008030-TESTUDID",
+            platform: "iOS",
+            reality: "physical",
+            marketingName: "iPhone SE",
+        },
+        deviceProperties: {
+            name: "Test iPhone",
+            osVersionNumber: "26.5",
+            developerModeStatus: "enabled",
+            bootState: "booted",
+        },
+        connectionProperties: { pairingState: "paired" },
+        ...over,
+    };
+}
+/** Fake exec that writes the fixture to devicectl's --json-output path. */
+function fakeDevicectl(devices) {
+    return async (file, args) => {
+        if (file !== "xcrun")
+            throw new Error(`unexpected: ${file}`);
+        const outIdx = args.indexOf("--json-output");
+        const outPath = args[outIdx + 1];
+        if (outIdx === -1 || !outPath)
+            throw new Error("no --json-output");
+        writeFileSync(outPath, JSON.stringify({ result: { devices } }));
+        return { stdout: Buffer.from(""), stderr: "" };
+    };
+}
+describe("listIosDevicesViaDevicectl", () => {
+    it("maps booted physical iOS devices", async () => {
+        const devices = await listIosDevicesViaDevicectl(fakeDevicectl([deviceJson()]));
+        expect(devices).toEqual([
+            {
+                udid: "00008030-TESTUDID",
+                name: "Test iPhone",
+                model: "iPhone SE",
+                osVersion: "26.5",
+                developerModeEnabled: true,
+                paired: true,
+            },
+        ]);
+    });
+    it("filters out simulators, remembered-offline, and non-iOS entries", async () => {
+        const simulator = deviceJson({
+            hardwareProperties: { udid: "SIM", platform: "iOS", reality: "virtual" },
+        });
+        const remembered = deviceJson({
+            deviceProperties: { name: "Old", bootState: undefined },
+        });
+        const devices = await listIosDevicesViaDevicectl(fakeDevicectl([deviceJson(), simulator, remembered]));
+        expect(devices).toHaveLength(1);
+    });
+    it("reports null for unknown developer-mode / pairing states", async () => {
+        const bare = deviceJson({
+            deviceProperties: { name: "Bare", osVersionNumber: "16.4", bootState: "booted" },
+            connectionProperties: {},
+        });
+        const [device] = await listIosDevicesViaDevicectl(fakeDevicectl([bare]));
+        expect(device?.developerModeEnabled).toBeNull();
+        expect(device?.paired).toBeNull();
+    });
+    it("returns [] when devicectl is unavailable", async () => {
+        const exec = async () => {
+            throw new Error("ENOENT");
+        };
+        expect(await listIosDevicesViaDevicectl(exec)).toEqual([]);
+    });
+});
+describe("getIosDeviceInfo", () => {
+    it("finds a device by udid and returns null otherwise", async () => {
+        const exec = fakeDevicectl([deviceJson()]);
+        expect((await getIosDeviceInfo("00008030-TESTUDID", exec))?.model).toBe("iPhone SE");
+        expect(await getIosDeviceInfo("MISSING", exec)).toBeNull();
+    });
+});
+describe("iosMajorVersion", () => {
+    it("parses major versions and handles unknowns", () => {
+        expect(iosMajorVersion("26.5")).toBe(26);
+        expect(iosMajorVersion("16.4.1")).toBe(16);
+        expect(iosMajorVersion(null)).toBeNull();
+        expect(iosMajorVersion("beta")).toBeNull();
+    });
+});
+describe("installAppViaDevicectl", () => {
+    it("invokes devicectl device install app", async () => {
+        let seen = [];
+        const exec = async (file, args) => {
+            seen = [file, ...args];
+            return { stdout: Buffer.from("App installed:\n"), stderr: "" };
+        };
+        const out = await installAppViaDevicectl("UDID-1", "/tmp/app.ipa", exec);
+        expect(seen).toEqual([
+            "xcrun",
+            "devicectl",
+            "device",
+            "install",
+            "app",
+            "--device",
+            "UDID-1",
+            "/tmp/app.ipa",
+        ]);
+        expect(out).toBe("App installed:");
+    });
+});

package/dist/mobile-control/ios-identity.d.ts

@@ -0,0 +1,27 @@
+import { type ExecFn } from "./exec.js";
+/**
+ * Zero-config discovery of Apple code-signing identities from the login keychain.
+ *
+ * Physical-iPhone automation needs a development signing identity (for WDA and
+ * for re-signing the app under test). Instead of requiring AXIMO_IOS_TEAM_ID to
+ * be exported, the identity and its Team ID are discovered from the keychain:
+ * `security find-identity` lists the certs, and the Team ID is the certificate
+ * subject's OU (NOT the parenthetical in the CN, which is a machine id). Env
+ * vars remain as overrides for CI and multi-team hosts.
+ */
+export interface SigningIdentity {
+    /** SHA-1 hash accepted by codesign/applesign as the signing identity. */
+    hash: string;
+    /** Certificate common name, e.g. "Apple Development: dev@example.com (ABC123DEF4)". */
+    name: string;
+    /** Apple Developer Team ID (certificate subject OU), when resolvable. */
+    teamId: string | null;
+}
+/** List valid development signing identities (Apple Development / iPhone Developer). */
+export declare function listSigningIdentities(exec?: ExecFn): Promise<SigningIdentity[]>;
+/**
+ * Pick the identity to sign with. An explicit team id (env override) filters the
+ * candidates; otherwise the first development identity wins. Returns null when
+ * the keychain has no usable identity (the caller decides how to degrade).
+ */
+export declare function selectIdentity(identities: SigningIdentity[], preferredTeamId?: string): SigningIdentity | null;

package/dist/mobile-control/ios-identity.js

@@ -0,0 +1,49 @@
+import { X509Certificate } from "node:crypto";
+import { execBinary } from "./exec.js";
+const IDENTITY_LINE = /^\s*\d+\)\s+([0-9A-F]{40})\s+"([^"]+)"/;
+const DEVELOPMENT_CERT = /^(Apple Development|iPhone Developer)\b/;
+/** List valid development signing identities (Apple Development / iPhone Developer). */
+export async function listSigningIdentities(exec = execBinary) {
+    let stdout;
+    try {
+        ({ stdout } = await exec("security", ["find-identity", "-v", "-p", "codesigning"]).then((r) => ({ stdout: r.stdout.toString("utf-8") })));
+    }
+    catch {
+        return []; // no keychain access / not macOS → no identities
+    }
+    const identities = [];
+    const seen = new Set();
+    for (const line of stdout.split("\n")) {
+        const match = line.match(IDENTITY_LINE);
+        const hash = match?.[1];
+        const name = match?.[2];
+        if (!hash || !name || !DEVELOPMENT_CERT.test(name) || seen.has(hash))
+            continue;
+        seen.add(hash);
+        identities.push({ hash, name, teamId: await readTeamId(name, exec) });
+    }
+    return identities;
+}
+/** Team ID = subject OU of the signing certificate. */
+async function readTeamId(certName, exec) {
+    try {
+        const { stdout } = await exec("security", ["find-certificate", "-c", certName, "-p"]);
+        const subject = new X509Certificate(stdout).subject;
+        const ou = subject.match(/(?:^|\n)OU=([^\n]+)/);
+        return ou?.[1]?.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Pick the identity to sign with. An explicit team id (env override) filters the
+ * candidates; otherwise the first development identity wins. Returns null when
+ * the keychain has no usable identity (the caller decides how to degrade).
+ */
+export function selectIdentity(identities, preferredTeamId) {
+    if (preferredTeamId) {
+        return identities.find((i) => i.teamId === preferredTeamId) ?? null;
+    }
+    return identities[0] ?? null;
+}

package/dist/mobile-control/ios-identity.test.d.ts

@@ -0,0 +1 @@
+export {};