@autifyhq/aximo-cli 0.6.0 → 0.8.0

package/dist/mobile-control/ios-identity.test.js

@@ -0,0 +1,102 @@
+import { describe, expect, it } from "vitest";
+import { listSigningIdentities, selectIdentity } from "./ios-identity.js";
+// Self-signed cert with an Apple-Development-shaped subject:
+// CN=Apple Development: test@example.com (ABC123DEF4), OU=TESTTEAM99.
+const TEST_CERT_PEM = `-----BEGIN CERTIFICATE-----
+MIID9zCCAt+gAwIBAgIUOJubshaRqESC9uQhAwvzfa34H8swDQYJKoZIhvcNAQEL
+BQAwgYoxFzAVBgoJkiaJk/IsZAEBDAdURVNUVUlEMTkwNwYDVQQDDDBBcHBsZSBE
+ZXZlbG9wbWVudDogdGVzdEBleGFtcGxlLmNvbSAoQUJDMTIzREVGNCkxEzARBgNV
+BAsMClRFU1RURUFNOTkxEjAQBgNVBAoMCVRlc3QgVXNlcjELMAkGA1UEBhMCVVMw
+HhcNMjYwNzEzMDA1NDA5WhcNMzYwNzEwMDA1NDA5WjCBijEXMBUGCgmSJomT8ixk
+AQEMB1RFU1RVSUQxOTA3BgNVBAMMMEFwcGxlIERldmVsb3BtZW50OiB0ZXN0QGV4
+YW1wbGUuY29tIChBQkMxMjNERUY0KTETMBEGA1UECwwKVEVTVFRFQU05OTESMBAG
+A1UECgwJVGVzdCBVc2VyMQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAJw2xHLbanqoyZM6IbH2g5RJGnFW6IROyOiZrowGQ9IgsOOf
+LpVCT3iIwknt0pLLy0pIoGqpygW34DvtR0NNmh8sv82Ek3U4gHnp7BUcaJ7NzjbX
+xOppqP3GHBfiVCakfDmSYvwLHuPKr9kwrQyGTWzAobNHVOFAuHAvJrvlkellgBfj
+uyEoVBCX5NVwpsUpKpFgscOzuSaKsxu+aoyBJcHdXlJV2FGJoiaN8Y90Rt2apZEc
+Mom1lp1yvNV9dOhuyIrJcKox1XNn6f5Eu6V1PqIgU1CrcRpXcKEgOWzug4enqEMf
+xZbgo4rCetI5TmJm9fyLh8UfaxWrVFBwZcW6eSECAwEAAaNTMFEwHQYDVR0OBBYE
+FK3Fb+zexJRT0DpmhVneTEdjInJZMB8GA1UdIwQYMBaAFK3Fb+zexJRT0DpmhVne
+TEdjInJZMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAFaeA8NP
+hM2JS5l16lOcrjgPMWpWMKH6jRlvZ8T6+Lo2O1ehA72kXm6hZ+dO1WNV/Ry7/Hpa
+S6SdJ/HcXwJzM4aJ0tMOpN92YfL/L3l2ogA63/2P1aP9YHhuyPYnb5mRHE4/d6+g
+ZeRhjWKp+x/7T418ma+NdP73u+Tkgdp/NEGEs3UQOBSmEFGCo09QUTaE1eZlqSCw
+t1MxzdXx3+TtgyvDZnhKEF+FrDSyCaPCGCveactFi3sCiHuall7NdDu9O1xV1ASP
+HGeFYCBbAiCSRQ8RAkLqUnCfuZM5lE6JkyZuN0drsXw0WTnf/4KYDB4Hnv543mD4
+ROvQLb+7ZuM7l9o=
+-----END CERTIFICATE-----
+`;
+const HASH_A = "0B0DF9CFF90EC3358C9A2CB52F006EB83FD7748C";
+const HASH_B = "1122334455667788990011223344556677889900";
+function fakeExec(findIdentityOut, certPem = TEST_CERT_PEM) {
+    return async (file, args) => {
+        if (file === "security" && args[0] === "find-identity") {
+            return { stdout: Buffer.from(findIdentityOut), stderr: "" };
+        }
+        if (file === "security" && args[0] === "find-certificate") {
+            if (certPem instanceof Error)
+                throw certPem;
+            return { stdout: Buffer.from(certPem), stderr: "" };
+        }
+        throw new Error(`unexpected exec: ${file} ${args.join(" ")}`);
+    };
+}
+describe("listSigningIdentities", () => {
+    it("parses development identities and resolves the team id from the cert OU", async () => {
+        const out = `  1) ${HASH_A} "Apple Development: test@example.com (ABC123DEF4)"\n     1 valid identities found\n`;
+        const identities = await listSigningIdentities(fakeExec(out));
+        expect(identities).toEqual([
+            {
+                hash: HASH_A,
+                name: "Apple Development: test@example.com (ABC123DEF4)",
+                teamId: "TESTTEAM99",
+            },
+        ]);
+    });
+    it("ignores non-development identities and duplicate hashes", async () => {
+        const out = [
+            `  1) ${HASH_A} "Apple Development: test@example.com (ABC123DEF4)"`,
+            `  2) ${HASH_A} "Apple Development: test@example.com (ABC123DEF4)"`,
+            `  3) ${HASH_B} "Apple Distribution: Some Corp (TEAM000001)"`,
+            "     3 valid identities found",
+        ].join("\n");
+        const identities = await listSigningIdentities(fakeExec(out));
+        expect(identities).toHaveLength(1);
+        expect(identities[0]?.hash).toBe(HASH_A);
+    });
+    it("returns teamId null when the certificate cannot be read", async () => {
+        const out = `  1) ${HASH_A} "Apple Development: test@example.com (ABC123DEF4)"\n`;
+        const identities = await listSigningIdentities(fakeExec(out, new Error("not found")));
+        expect(identities).toEqual([
+            { hash: HASH_A, name: "Apple Development: test@example.com (ABC123DEF4)", teamId: null },
+        ]);
+    });
+    it("returns [] when security itself fails (not macOS / no keychain)", async () => {
+        const exec = async () => {
+            throw new Error("ENOENT");
+        };
+        expect(await listSigningIdentities(exec)).toEqual([]);
+    });
+    it("returns [] when no identities are listed", async () => {
+        expect(await listSigningIdentities(fakeExec("     0 valid identities found\n"))).toEqual([]);
+    });
+});
+describe("selectIdentity", () => {
+    const identities = [
+        { hash: HASH_A, name: "Apple Development: a@x.com (AAAA111111)", teamId: "TEAM_A" },
+        { hash: HASH_B, name: "Apple Development: b@x.com (BBBB222222)", teamId: "TEAM_B" },
+    ];
+    it("returns the first identity without a preferred team", () => {
+        expect(selectIdentity(identities)?.hash).toBe(HASH_A);
+    });
+    it("filters by preferred team id", () => {
+        expect(selectIdentity(identities, "TEAM_B")?.hash).toBe(HASH_B);
+    });
+    it("returns null when the preferred team has no identity", () => {
+        expect(selectIdentity(identities, "TEAM_C")).toBeNull();
+    });
+    it("returns null for an empty list", () => {
+        expect(selectIdentity([])).toBeNull();
+    });
+});

package/dist/mobile-control/ios-mint.d.ts

@@ -0,0 +1,39 @@
+import { type ExecFn } from "./exec.js";
+/**
+ * Mint (or renew) an Apple development provisioning profile without any user
+ * input, using Xcode automatic signing.
+ *
+ * Free/personal teams cannot create profiles through the developer portal API —
+ * the ONLY way is an Xcode automatic-signing build. The WebDriverAgent Xcode
+ * project that ships inside the XCUITest driver works as a generic minting rig:
+ * building its runner scheme with an arbitrary PRODUCT_BUNDLE_IDENTIFIER makes
+ * Xcode register the App ID, register the destination device, and write a fresh
+ * 7-day profile for `<bundle-id>.xctrunner` into the profiles directory.
+ *
+ * Requirements it cannot work around (surfaced as actionable errors): the Apple
+ * ID must be signed into Xcode (Settings → Accounts), free teams are capped at
+ * 10 App IDs per 7 days, and well-known bundle ids may be "taken" for personal
+ * teams.
+ */
+export interface MintProfileOptions {
+    teamId: string;
+    /** Base bundle id; the minted profile's App ID is `<bundleId>.xctrunner`. */
+    bundleId: string;
+    udid: string;
+    signingId?: string;
+    exec?: ExecFn;
+    wdaProjectPath?: string;
+    env?: NodeJS.ProcessEnv;
+}
+/** App ID the rig actually mints for a given PRODUCT_BUNDLE_IDENTIFIER. */
+export declare function mintedAppId(bundleId: string): string;
+/** Locate the WDA project inside the managed Appium home (hoisted or nested). */
+export declare function findWdaProject(appiumHome?: string): string | null;
+/** Map a raw xcodebuild failure to an actionable next step, when recognized. */
+export declare function mintFailureHint(message: string): string | undefined;
+/**
+ * Run the minting build. Resolves when xcodebuild succeeds (the fresh profile is
+ * then discoverable via ios-profiles); throws with an actionable message when it
+ * fails. Build output goes to a throwaway DerivedData dir.
+ */
+export declare function mintProfileViaWdaRig(options: MintProfileOptions): Promise<void>;

package/dist/mobile-control/ios-mint.js

@@ -0,0 +1,78 @@
+import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { getAppiumHome } from "./appium-server.js";
+import { execBinary } from "./exec.js";
+/** App ID the rig actually mints for a given PRODUCT_BUNDLE_IDENTIFIER. */
+export function mintedAppId(bundleId) {
+    return `${bundleId}.xctrunner`;
+}
+/** Locate the WDA project inside the managed Appium home (hoisted or nested). */
+export function findWdaProject(appiumHome = getAppiumHome()) {
+    const candidates = [
+        join(appiumHome, "node_modules", "appium-xcuitest-driver", "node_modules", "appium-webdriveragent", "WebDriverAgent.xcodeproj"),
+        join(appiumHome, "node_modules", "appium-webdriveragent", "WebDriverAgent.xcodeproj"),
+    ];
+    return candidates.find((p) => existsSync(p)) ?? null;
+}
+const FAILURE_HINTS = [
+    {
+        test: /no accounts|No Apple ID|requires you to be signed in|No profiles .* were found.*automatic/is,
+        hint: "Sign into Xcode with your Apple ID (Xcode → Settings → Accounts), then retry. Profile minting needs an Xcode-managed account.",
+    },
+    {
+        test: /cannot be registered to your development team|not available.*bundle|Failed Registering Bundle Identifier/is,
+        hint: "This bundle id can't be registered to your team. It will be retried with an Aximo-owned id; if that also fails, set AXIMO_IOS_WDA_BUNDLE_ID to a unique id.",
+    },
+    {
+        test: /maximum (number of )?App IDs|reached the maximum|too many App IDs/i,
+        hint: "Your free Apple team hit the 10-App-IDs-per-week cap. Wait for the cap to reset, or use a paid Apple Developer account.",
+    },
+    {
+        test: /is not installed\. Please download and install the platform|iOS [\d.]+ is not installed/i,
+        hint: "Install the iOS platform components: `xcodebuild -downloadPlatform iOS` (or Xcode → Settings → Components).",
+    },
+];
+/** Map a raw xcodebuild failure to an actionable next step, when recognized. */
+export function mintFailureHint(message) {
+    return FAILURE_HINTS.find((r) => r.test.test(message))?.hint;
+}
+/**
+ * Run the minting build. Resolves when xcodebuild succeeds (the fresh profile is
+ * then discoverable via ios-profiles); throws with an actionable message when it
+ * fails. Build output goes to a throwaway DerivedData dir.
+ */
+export async function mintProfileViaWdaRig(options) {
+    const exec = options.exec ?? execBinary;
+    const project = options.wdaProjectPath ?? findWdaProject();
+    if (!project || !existsSync(project)) {
+        throw new Error("WebDriverAgent project not found in the Appium home. Run `aximo mobile setup --platform ios` first.");
+    }
+    const scratch = mkdtempSync(join(tmpdir(), "aximo-mint-"));
+    try {
+        await exec("xcodebuild", [
+            "-project",
+            project,
+            "-scheme",
+            "WebDriverAgentRunner",
+            "-destination",
+            `id=${options.udid}`,
+            "-derivedDataPath",
+            scratch,
+            "-allowProvisioningUpdates",
+            "-allowProvisioningDeviceRegistration",
+            `DEVELOPMENT_TEAM=${options.teamId}`,
+            `PRODUCT_BUNDLE_IDENTIFIER=${options.bundleId}`,
+            `CODE_SIGN_IDENTITY=${options.signingId ?? "Apple Development"}`,
+            "build-for-testing",
+        ]);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const hint = mintFailureHint(message);
+        throw new Error(hint ? `${message} — ${hint}` : message);
+    }
+    finally {
+        rmSync(scratch, { recursive: true, force: true });
+    }
+}

package/dist/mobile-control/ios-mint.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/mobile-control/ios-mint.test.js

@@ -0,0 +1,94 @@
+import { mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { findWdaProject, mintFailureHint, mintProfileViaWdaRig, mintedAppId } from "./ios-mint.js";
+describe("mintedAppId", () => {
+    it("appends the .xctrunner suffix Xcode gives runner apps", () => {
+        expect(mintedAppId("com.aximo.resign.team1")).toBe("com.aximo.resign.team1.xctrunner");
+    });
+});
+describe("findWdaProject", () => {
+    let home;
+    beforeEach(() => {
+        home = mkdtempSync(join(tmpdir(), "aximo-mint-home-"));
+    });
+    afterEach(() => {
+        rmSync(home, { recursive: true, force: true });
+    });
+    it("finds the nested driver copy", () => {
+        const proj = join(home, "node_modules/appium-xcuitest-driver/node_modules/appium-webdriveragent/WebDriverAgent.xcodeproj");
+        mkdirSync(proj, { recursive: true });
+        expect(findWdaProject(home)).toBe(proj);
+    });
+    it("falls back to the hoisted copy and null when absent", () => {
+        const hoisted = join(home, "node_modules/appium-webdriveragent/WebDriverAgent.xcodeproj");
+        mkdirSync(hoisted, { recursive: true });
+        expect(findWdaProject(home)).toBe(hoisted);
+        rmSync(hoisted, { recursive: true, force: true });
+        expect(findWdaProject(home)).toBeNull();
+    });
+});
+describe("mintProfileViaWdaRig", () => {
+    let home;
+    let project;
+    beforeEach(() => {
+        home = mkdtempSync(join(tmpdir(), "aximo-mint-home-"));
+        project = join(home, "WebDriverAgent.xcodeproj");
+        mkdirSync(project, { recursive: true });
+    });
+    afterEach(() => {
+        rmSync(home, { recursive: true, force: true });
+    });
+    it("invokes xcodebuild with automatic-signing + registration flags", async () => {
+        let seen = [];
+        const exec = async (file, args) => {
+            seen = [file, ...args];
+            return { stdout: Buffer.from("** TEST BUILD SUCCEEDED **"), stderr: "" };
+        };
+        await mintProfileViaWdaRig({
+            teamId: "TESTTEAM99",
+            bundleId: "com.aximo.resign.testteam99",
+            udid: "UDID-1",
+            exec,
+            wdaProjectPath: project,
+        });
+        expect(seen[0]).toBe("xcodebuild");
+        expect(seen).toContain("-allowProvisioningUpdates");
+        expect(seen).toContain("-allowProvisioningDeviceRegistration");
+        expect(seen).toContain("id=UDID-1");
+        expect(seen).toContain("DEVELOPMENT_TEAM=TESTTEAM99");
+        expect(seen).toContain("PRODUCT_BUNDLE_IDENTIFIER=com.aximo.resign.testteam99");
+        expect(seen).toContain("build-for-testing");
+    });
+    it("appends an actionable hint for recognized failures", async () => {
+        const exec = async () => {
+            throw new Error("xcodebuild: error: No Accounts: Add a new account in Accounts settings.");
+        };
+        await expect(mintProfileViaWdaRig({
+            teamId: "T",
+            bundleId: "b",
+            udid: "U",
+            exec,
+            wdaProjectPath: project,
+        })).rejects.toThrow(/Sign into Xcode with your Apple ID/);
+    });
+    it("throws a setup hint when the WDA project is missing", async () => {
+        await expect(mintProfileViaWdaRig({
+            teamId: "T",
+            bundleId: "b",
+            udid: "U",
+            wdaProjectPath: "/nonexistent/WebDriverAgent.xcodeproj",
+            exec: async () => ({ stdout: Buffer.from(""), stderr: "" }),
+        })).rejects.toThrow(/aximo mobile setup/);
+    });
+});
+describe("mintFailureHint", () => {
+    it("maps the common failure families", () => {
+        expect(mintFailureHint("No Accounts: Add a new account")).toMatch(/Sign into Xcode/);
+        expect(mintFailureHint('The app identifier "X" cannot be registered to your development team')).toMatch(/can't be registered/);
+        expect(mintFailureHint("You have reached the maximum number of App IDs")).toMatch(/10-App-IDs-per-week/);
+        expect(mintFailureHint("iOS 26.5 is not installed. Please download and install the platform")).toMatch(/downloadPlatform/);
+        expect(mintFailureHint("some unrelated error")).toBeUndefined();
+    });
+});

package/dist/mobile-control/ios-profiles.d.ts

@@ -0,0 +1,46 @@
+import { type ExecFn } from "./exec.js";
+/**
+ * Discover and match installed Apple provisioning profiles.
+ *
+ * Re-signing (the app under test, or a prebuilt WebDriverAgent) needs a profile
+ * that covers the target bundle id AND the device UDID and is still valid.
+ * Profiles are scanned from disk instead of asking the user for paths:
+ * Xcode 16+ stores them under ~/Library/Developer/Xcode/UserData, older
+ * toolchains under ~/Library/MobileDevice — both are checked.
+ */
+export interface ProvisioningProfile {
+    path: string;
+    name: string;
+    teamId: string;
+    /** Bundle-id portion of the App ID; "*" (or a ".*" suffix) for wildcards. */
+    bundleId: string;
+    isWildcard: boolean;
+    expirationDate: Date;
+    /** Devices the profile embeds; null when it has no device list (enterprise). */
+    provisionedDevices: string[] | null;
+}
+export declare function profileDirs(home?: string): string[];
+/** Parse one decoded (XML plist) profile; null when required fields are missing. */
+export declare function parseProfileXml(xml: string, path: string): ProvisioningProfile | null;
+export interface ListProfilesOptions {
+    exec?: ExecFn;
+    dirs?: string[];
+}
+/** Scan both profile directories, decode each profile via `security cms -D`. */
+export declare function listProvisioningProfiles(options?: ListProfilesOptions): Promise<ProvisioningProfile[]>;
+/** True when the profile's App ID covers the bundle id (exact or wildcard). */
+export declare function coversBundleId(profile: ProvisioningProfile, bundleId: string): boolean;
+export interface SelectProfileCriteria {
+    bundleId: string;
+    udid: string;
+    teamId?: string;
+    now?: number;
+    minRemainingMs?: number;
+}
+/**
+ * Pick the best usable profile: covers the bundle id + device UDID (a missing
+ * device list means enterprise — always covered) and stays valid for at least
+ * `minRemainingMs`. Exact App IDs beat wildcards (no bundle-id surprises), then
+ * the later expiry wins.
+ */
+export declare function selectProfile(profiles: ProvisioningProfile[], criteria: SelectProfileCriteria): ProvisioningProfile | null;

package/dist/mobile-control/ios-profiles.js

@@ -0,0 +1,106 @@
+import { existsSync, readdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { execBinary } from "./exec.js";
+const DEFAULT_MIN_REMAINING_MS = 24 * 60 * 60 * 1000;
+export function profileDirs(home = homedir()) {
+    return [
+        join(home, "Library", "Developer", "Xcode", "UserData", "Provisioning Profiles"),
+        join(home, "Library", "MobileDevice", "Provisioning Profiles"),
+    ];
+}
+function extract(xml, key) {
+    const match = xml.match(new RegExp(`<key>${key}</key>\\s*<(?:string|date)>([^<]+)</(?:string|date)>`));
+    return match?.[1] ?? null;
+}
+function extractStringArray(xml, key) {
+    const block = xml.match(new RegExp(`<key>${key}</key>\\s*<array>([\\s\\S]*?)</array>`));
+    if (!block?.[1])
+        return null;
+    return [...block[1].matchAll(/<string>([^<]+)<\/string>/g)]
+        .map((m) => m[1])
+        .filter((s) => Boolean(s));
+}
+/** Parse one decoded (XML plist) profile; null when required fields are missing. */
+export function parseProfileXml(xml, path) {
+    const name = extract(xml, "Name");
+    const expiration = extract(xml, "ExpirationDate");
+    const appId = xml.match(/<key>application-identifier<\/key>\s*<string>([^<]+)<\/string>/)?.[1];
+    const teamId = extractStringArray(xml, "TeamIdentifier")?.[0];
+    if (!name || !expiration || !appId || !teamId)
+        return null;
+    const expirationDate = new Date(expiration);
+    if (Number.isNaN(expirationDate.getTime()))
+        return null;
+    const bundleId = appId.startsWith(`${teamId}.`) ? appId.slice(teamId.length + 1) : appId;
+    return {
+        path,
+        name,
+        teamId,
+        bundleId,
+        isWildcard: bundleId === "*" || bundleId.endsWith(".*"),
+        expirationDate,
+        provisionedDevices: extractStringArray(xml, "ProvisionedDevices"),
+    };
+}
+/** Scan both profile directories, decode each profile via `security cms -D`. */
+export async function listProvisioningProfiles(options = {}) {
+    const exec = options.exec ?? execBinary;
+    const dirs = options.dirs ?? profileDirs();
+    const profiles = [];
+    for (const dir of dirs) {
+        if (!existsSync(dir))
+            continue;
+        let entries;
+        try {
+            entries = readdirSync(dir);
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (!entry.endsWith(".mobileprovision"))
+                continue;
+            const path = join(dir, entry);
+            try {
+                const { stdout } = await exec("security", ["cms", "-D", "-i", path]);
+                const profile = parseProfileXml(stdout.toString("utf-8"), path);
+                if (profile)
+                    profiles.push(profile);
+            }
+            catch {
+                // Unreadable/corrupt profile — skip it rather than fail discovery.
+            }
+        }
+    }
+    return profiles;
+}
+/** True when the profile's App ID covers the bundle id (exact or wildcard). */
+export function coversBundleId(profile, bundleId) {
+    if (profile.bundleId === "*")
+        return true;
+    if (profile.isWildcard) {
+        return bundleId.startsWith(profile.bundleId.slice(0, -1)); // "com.foo.*" → "com.foo."
+    }
+    return profile.bundleId === bundleId;
+}
+/**
+ * Pick the best usable profile: covers the bundle id + device UDID (a missing
+ * device list means enterprise — always covered) and stays valid for at least
+ * `minRemainingMs`. Exact App IDs beat wildcards (no bundle-id surprises), then
+ * the later expiry wins.
+ */
+export function selectProfile(profiles, criteria) {
+    const now = criteria.now ?? Date.now();
+    const minRemainingMs = criteria.minRemainingMs ?? DEFAULT_MIN_REMAINING_MS;
+    const usable = profiles.filter((p) => (!criteria.teamId || p.teamId === criteria.teamId) &&
+        coversBundleId(p, criteria.bundleId) &&
+        (p.provisionedDevices === null || p.provisionedDevices.includes(criteria.udid)) &&
+        p.expirationDate.getTime() - now > minRemainingMs);
+    usable.sort((a, b) => {
+        if (a.isWildcard !== b.isWildcard)
+            return a.isWildcard ? 1 : -1;
+        return b.expirationDate.getTime() - a.expirationDate.getTime();
+    });
+    return usable[0] ?? null;
+}

package/dist/mobile-control/ios-profiles.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/mobile-control/ios-profiles.test.js

@@ -0,0 +1,154 @@
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { coversBundleId, listProvisioningProfiles, parseProfileXml, profileDirs, selectProfile, } from "./ios-profiles.js";
+function profileXml(opts) {
+    const devices = opts.devices === null
+        ? ""
+        : `<key>ProvisionedDevices</key><array>${(opts.devices ?? ["UDID-1"])
+            .map((d) => `<string>${d}</string>`)
+            .join("")}</array>`;
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<plist version="1.0"><dict>
+  <key>Name</key><string>${opts.name ?? "Test Profile"}</string>
+  <key>TeamIdentifier</key><array><string>${opts.teamId ?? "TESTTEAM99"}</string></array>
+  <key>Entitlements</key><dict>
+    <key>application-identifier</key><string>${opts.appId ?? "TESTTEAM99.com.example.app"}</string>
+  </dict>
+  ${devices}
+  <key>ExpirationDate</key><date>${opts.expiration ?? "2036-01-01T00:00:00Z"}</date>
+</dict></plist>`;
+}
+describe("parseProfileXml", () => {
+    it("parses an explicit app-id development profile", () => {
+        const profile = parseProfileXml(profileXml({}), "/p/a.mobileprovision");
+        expect(profile).toMatchObject({
+            path: "/p/a.mobileprovision",
+            name: "Test Profile",
+            teamId: "TESTTEAM99",
+            bundleId: "com.example.app",
+            isWildcard: false,
+            provisionedDevices: ["UDID-1"],
+        });
+    });
+    it("classifies wildcard profiles", () => {
+        const star = parseProfileXml(profileXml({ appId: "TESTTEAM99.*" }), "/p");
+        expect(star).toMatchObject({ bundleId: "*", isWildcard: true });
+        const prefix = parseProfileXml(profileXml({ appId: "TESTTEAM99.com.foo.*" }), "/p");
+        expect(prefix).toMatchObject({ bundleId: "com.foo.*", isWildcard: true });
+    });
+    it("returns null provisionedDevices when the profile embeds no device list", () => {
+        const profile = parseProfileXml(profileXml({ devices: null }), "/p");
+        expect(profile?.provisionedDevices).toBeNull();
+    });
+    it("returns null when required fields are missing", () => {
+        expect(parseProfileXml("<plist/>", "/p")).toBeNull();
+    });
+});
+describe("listProvisioningProfiles", () => {
+    let dir;
+    beforeEach(() => {
+        dir = mkdtempSync(join(tmpdir(), "aximo-profiles-"));
+    });
+    afterEach(() => {
+        rmSync(dir, { recursive: true, force: true });
+    });
+    it("decodes every .mobileprovision across the given dirs and skips failures", async () => {
+        const dirA = join(dir, "a");
+        const dirB = join(dir, "b");
+        mkdirSync(dirA);
+        mkdirSync(dirB);
+        writeFileSync(join(dirA, "one.mobileprovision"), "raw");
+        writeFileSync(join(dirA, "ignored.txt"), "raw");
+        writeFileSync(join(dirB, "two.mobileprovision"), "raw");
+        writeFileSync(join(dirB, "broken.mobileprovision"), "raw");
+        const exec = async (_file, args) => {
+            const path = args[3] ?? "";
+            if (path.endsWith("broken.mobileprovision"))
+                throw new Error("decode failed");
+            const name = path.endsWith("one.mobileprovision") ? "One" : "Two";
+            return { stdout: Buffer.from(profileXml({ name })), stderr: "" };
+        };
+        const profiles = await listProvisioningProfiles({ exec, dirs: [dirA, dirB, "/nonexistent"] });
+        expect(profiles.map((p) => p.name).sort()).toEqual(["One", "Two"]);
+    });
+});
+describe("coversBundleId", () => {
+    const base = {
+        path: "/p",
+        name: "n",
+        teamId: "T",
+        bundleId: "com.example.app",
+        isWildcard: false,
+        expirationDate: new Date("2036-01-01"),
+        provisionedDevices: null,
+    };
+    it("matches exact ids and rejects others", () => {
+        expect(coversBundleId(base, "com.example.app")).toBe(true);
+        expect(coversBundleId(base, "com.example.other")).toBe(false);
+    });
+    it("matches '*' and prefix wildcards", () => {
+        expect(coversBundleId({ ...base, bundleId: "*", isWildcard: true }, "anything.at.all")).toBe(true);
+        const prefix = { ...base, bundleId: "com.foo.*", isWildcard: true };
+        expect(coversBundleId(prefix, "com.foo.bar")).toBe(true);
+        expect(coversBundleId(prefix, "com.other.bar")).toBe(false);
+    });
+});
+describe("selectProfile", () => {
+    const NOW = new Date("2026-07-13T00:00:00Z").getTime();
+    const make = (over) => ({
+        path: "/p",
+        name: "n",
+        teamId: "TESTTEAM99",
+        bundleId: "com.example.app",
+        isWildcard: false,
+        expirationDate: new Date("2026-07-20T00:00:00Z"),
+        provisionedDevices: ["UDID-1"],
+        ...over,
+    });
+    it("requires bundle-id + udid coverage and validity margin", () => {
+        const expired = make({ expirationDate: new Date("2026-07-13T06:00:00Z") }); // <1 day left
+        const wrongDevice = make({ provisionedDevices: ["UDID-2"] });
+        const good = make({});
+        expect(selectProfile([expired, wrongDevice, good], {
+            bundleId: "com.example.app",
+            udid: "UDID-1",
+            now: NOW,
+        })).toBe(good);
+    });
+    it("treats a missing device list (enterprise) as covering any udid", () => {
+        const enterprise = make({ provisionedDevices: null });
+        expect(selectProfile([enterprise], { bundleId: "com.example.app", udid: "ANY", now: NOW })).toBe(enterprise);
+    });
+    it("prefers exact app-ids over wildcards, then later expiry", () => {
+        const wildcard = make({
+            bundleId: "*",
+            isWildcard: true,
+            expirationDate: new Date("2036-01-01T00:00:00Z"),
+        });
+        const exactSoon = make({});
+        const exactLater = make({ expirationDate: new Date("2026-08-01T00:00:00Z") });
+        expect(selectProfile([wildcard, exactSoon, exactLater], {
+            bundleId: "com.example.app",
+            udid: "UDID-1",
+            now: NOW,
+        })).toBe(exactLater);
+    });
+    it("filters by team id when given and returns null when nothing matches", () => {
+        const otherTeam = make({ teamId: "OTHERTEAM0" });
+        expect(selectProfile([otherTeam], {
+            bundleId: "com.example.app",
+            udid: "UDID-1",
+            teamId: "TESTTEAM99",
+            now: NOW,
+        })).toBeNull();
+    });
+});
+describe("profileDirs", () => {
+    it("returns the Xcode 16+ UserData dir before the legacy MobileDevice dir", () => {
+        const dirs = profileDirs("/Users/me");
+        expect(dirs[0]).toContain("Library/Developer/Xcode/UserData/Provisioning Profiles");
+        expect(dirs[1]).toContain("Library/MobileDevice/Provisioning Profiles");
+    });
+});

package/dist/mobile-control/ios-resign.d.ts

@@ -0,0 +1,37 @@
+import { type ExecFn } from "./exec.js";
+import { type ProvisioningProfile } from "./ios-profiles.js";
+/**
+ * Mechanics of inspecting and re-signing iOS .ipa files.
+ *
+ * An IPA only installs on a device its embedded profile covers, so BYOD needs
+ * the same move AWS Device Farm makes server-side: strip the original signature
+ * and re-sign with a local identity + profile. applesign (node-applesign) does
+ * the heavy lifting — nested-framework signing order, profile embedding, and
+ * bundle-id remapping — and was verified on-device (see
+ * docs/ios-resign-e2e-verification.md).
+ */
+export interface IpaInfo {
+    /** CFBundleIdentifier of the top-level app. */
+    bundleId: string;
+    /** Embedded provisioning profile, when present (missing on store builds). */
+    profile: ProvisioningProfile | null;
+    /** Main-binary FairPlay state: true = encrypted (cannot be re-signed). */
+    encrypted: boolean | null;
+}
+/** Inspect an IPA's identity/signature surface without a full extraction. */
+export declare function inspectIpa(ipaPath: string, exec?: ExecFn): Promise<IpaInfo>;
+/** True when the IPA (per its embedded profile) can install on `udid` as-is. */
+export declare function isInstallableOn(info: IpaInfo, udid: string, now?: number): boolean;
+export interface ResignIpaOptions {
+    ipaPath: string;
+    outPath: string;
+    /** Signing identity SHA-1 hash (from ios-identity). */
+    identityHash: string;
+    /** Provisioning profile to embed. */
+    profilePath: string;
+    /** Remap CFBundleIdentifier (required with explicit-App-ID profiles). */
+    bundleId?: string;
+    exec?: ExecFn;
+}
+/** Re-sign an IPA via the bundled applesign (never PATH-dependent). */
+export declare function resignIpa(options: ResignIpaOptions): Promise<void>;