@hearthlog/native 0.0.0-stage → 0.1.1

package/src/project.ts

@@ -0,0 +1,365 @@
+/**
+ * Writes Stor.xcodeproj into the tenant's `.apple-build/project/`: the iOS app's Xcode project, from the
+ * Swift files in this package (`swift/Shared` and `swift/iOS`, referenced by absolute path). The project
+ * is generated, so adding a Swift file needs no project edit. Everything that differs per site (bundle id,
+ * version, team, icon, Info.plist) lives in `.apple-build/project/Generated`, written by ios.ts.
+ *
+ * The Mac app does not use Xcode: mac.ts builds it with swiftc.
+ */
+
+import { createHash } from "node:crypto";
+import { mkdirSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import path from "node:path";
+
+import { PROJECT_ROOT, SWIFT_DIRECTORY } from "./site.js";
+
+export const PROJECT_DIRECTORY = path.join(PROJECT_ROOT, "Stor.xcodeproj");
+export const SCHEME = "Stor iOS";
+export const PRODUCT = "Stor.app";
+const DEPLOYMENT_TARGET = "17.0";
+
+/** Xcode wants 24 hex digits; derive them from a name so the project is the same every time. */
+function id(name: string): string {
+    return createHash("sha1").update(`stor-apple:${name}`).digest("hex").slice(0, 24).toUpperCase();
+}
+
+const quote = (value: string) => (/^[A-Za-z0-9_./]+$/.test(value) ? value : `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`);
+
+interface Settings { [key: string]: string | string[] }
+
+function settingsBlock(settings: Settings, indent: string): string {
+    return Object.entries(settings)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([key, value]) =>
+            Array.isArray(value)
+                ? `${indent}${key} = (\n${value.map((item) => `${indent}\t${quote(item)},`).join("\n")}\n${indent});`
+                : `${indent}${key} = ${quote(value)};`,
+        )
+        .join("\n");
+}
+
+function swiftFiles(directory: string): string[] {
+    return readdirSync(path.join(SWIFT_DIRECTORY, directory)).filter((file) => file.endsWith(".swift")).sort();
+}
+
+export function writeXcodeProject(): string {
+    const groups = [
+        { name: "Shared", files: swiftFiles("Shared") },
+        { name: "iOS", files: swiftFiles("iOS") },
+    ];
+    const sources = groups.flatMap((group) => group.files.map((file) => ({ group: group.name, file })));
+    const ref = (group: string, file: string) => id(`ref:${group}/${file}`);
+    const build = (group: string, file: string) => id(`build:${group}/${file}`);
+
+    const target = id("target");
+    const project = id("project");
+    const mainGroup = id("group:main");
+    const productsGroup = id("group:products");
+    const generatedGroup = id("group:generated");
+    const productRef = id("ref:product");
+    const plistRef = id("ref:Generated/Info-iOS.plist");
+    const xcconfigRef = id("ref:Generated/Site.xcconfig");
+    const assetsRef = id("ref:Generated/Assets.xcassets");
+    const assetsBuild = id("build:Generated/Assets.xcassets");
+    const sourcesPhase = id("phase:sources");
+    const frameworksPhase = id("phase:frameworks");
+    const resourcesPhase = id("phase:resources");
+    const projectConfigs = id("configs:project");
+    const targetConfigs = id("configs:target");
+
+    const shared: Settings = {
+        ALWAYS_SEARCH_USER_PATHS: "NO",
+        CLANG_ENABLE_MODULES: "YES",
+        CLANG_ENABLE_OBJC_ARC: "YES",
+        COPY_PHASE_STRIP: "NO",
+        ENABLE_STRICT_OBJC_MSGSEND: "YES",
+        ENABLE_USER_SCRIPT_SANDBOXING: "YES",
+        GCC_NO_COMMON_BLOCKS: "YES",
+        IPHONEOS_DEPLOYMENT_TARGET: DEPLOYMENT_TARGET,
+        SDKROOT: "iphoneos",
+        SWIFT_VERSION: "5.0",
+    };
+    const debug: Settings = {
+        ...shared,
+        DEBUG_INFORMATION_FORMAT: "dwarf",
+        ENABLE_TESTABILITY: "YES",
+        GCC_OPTIMIZATION_LEVEL: "0",
+        GCC_PREPROCESSOR_DEFINITIONS: ["DEBUG=1", "$(inherited)"],
+        ONLY_ACTIVE_ARCH: "YES",
+        SWIFT_ACTIVE_COMPILATION_CONDITIONS: "DEBUG $(inherited)",
+        SWIFT_OPTIMIZATION_LEVEL: "-Onone",
+    };
+    const release: Settings = {
+        ...shared,
+        DEBUG_INFORMATION_FORMAT: "dwarf-with-dsym",
+        ENABLE_NS_ASSERTIONS: "NO",
+        SWIFT_COMPILATION_MODE: "wholemodule",
+        VALIDATE_PRODUCT: "YES",
+    };
+    // Per-site values (bundle id, version, team) come from Generated/Site.xcconfig, so they are not set here.
+    const targetSettings: Settings = {
+        ASSETCATALOG_COMPILER_APPICON_NAME: "AppIcon",
+        CODE_SIGN_STYLE: "Automatic",
+        GENERATE_INFOPLIST_FILE: "NO",
+        INFOPLIST_FILE: "Generated/Info-iOS.plist",
+        LD_RUNPATH_SEARCH_PATHS: ["$(inherited)", "@executable_path/Frameworks"],
+        PRODUCT_NAME: "Stor",
+        SUPPORTS_MAC_DESIGNED_FOR_IPHONE_IPAD: "NO",
+        SUPPORTS_MACCATALYST: "NO",
+        SUPPORTS_XR_DESIGNED_FOR_IPHONE_IPAD: "NO",
+        SWIFT_EMIT_LOC_STRINGS: "YES",
+        TARGETED_DEVICE_FAMILY: "1,2",
+    };
+
+    const config = (name: string, settings: Settings, base?: string) =>
+        `\t\t${id(`config:${name}`)} /* ${name.split(":")[1]} */ = {\n\t\t\tisa = XCBuildConfiguration;\n${
+            base ? `\t\t\tbaseConfigurationReference = ${base} /* Site.xcconfig */;\n` : ""
+        }\t\t\tbuildSettings = {\n${settingsBlock(settings, "\t\t\t\t")}\n\t\t\t};\n\t\t\tname = ${name.split(":")[1]};\n\t\t};\n`;
+
+    const text = `// !$*UTF8*$!
+{
+	archiveVersion = 1;
+	classes = {
+	};
+	objectVersion = 56;
+	objects = {
+
+/* Begin PBXBuildFile section */
+${sources.map(({ group, file }) => `\t\t${build(group, file)} /* ${file} in Sources */ = {isa = PBXBuildFile; fileRef = ${ref(group, file)} /* ${file} */; };`).join("\n")}
+\t\t${assetsBuild} /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = ${assetsRef} /* Assets.xcassets */; };
+/* End PBXBuildFile section */
+
+/* Begin PBXFileReference section */
+${sources.map(({ group, file }) => `\t\t${ref(group, file)} /* ${file} */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ${quote(file)}; sourceTree = "<group>"; };`).join("\n")}
+\t\t${plistRef} /* Info-iOS.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = "Info-iOS.plist"; sourceTree = "<group>"; };
+\t\t${xcconfigRef} /* Site.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = Site.xcconfig; sourceTree = "<group>"; };
+\t\t${assetsRef} /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = "<group>"; };
+\t\t${productRef} /* ${PRODUCT} */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = ${PRODUCT}; sourceTree = BUILT_PRODUCTS_DIR; };
+/* End PBXFileReference section */
+
+/* Begin PBXFrameworksBuildPhase section */
+\t\t${frameworksPhase} /* Frameworks */ = {
+\t\t\tisa = PBXFrameworksBuildPhase;
+\t\t\tbuildActionMask = 2147483647;
+\t\t\tfiles = (
+\t\t\t);
+\t\t\trunOnlyForDeploymentPostprocessing = 0;
+\t\t};
+/* End PBXFrameworksBuildPhase section */
+
+/* Begin PBXGroup section */
+\t\t${mainGroup} = {
+\t\t\tisa = PBXGroup;
+\t\t\tchildren = (
+${groups.map((group) => `\t\t\t\t${id(`group:${group.name}`)} /* ${group.name} */,`).join("\n")}
+\t\t\t\t${generatedGroup} /* Generated */,
+\t\t\t\t${productsGroup} /* Products */,
+\t\t\t);
+\t\t\tsourceTree = "<group>";
+\t\t};
+${groups.map((group) => `\t\t${id(`group:${group.name}`)} /* ${group.name} */ = {
+\t\t\tisa = PBXGroup;
+\t\t\tchildren = (
+${group.files.map((file) => `\t\t\t\t${ref(group.name, file)} /* ${file} */,`).join("\n")}
+\t\t\t);
+\t\t\tpath = ${quote(path.join(SWIFT_DIRECTORY, group.name))};
+\t\t\tsourceTree = "<absolute>";
+\t\t};`).join("\n")}
+\t\t${generatedGroup} /* Generated */ = {
+\t\t\tisa = PBXGroup;
+\t\t\tchildren = (
+\t\t\t\t${plistRef} /* Info-iOS.plist */,
+\t\t\t\t${xcconfigRef} /* Site.xcconfig */,
+\t\t\t\t${assetsRef} /* Assets.xcassets */,
+\t\t\t);
+\t\t\tpath = Generated;
+\t\t\tsourceTree = "<group>";
+\t\t};
+\t\t${productsGroup} /* Products */ = {
+\t\t\tisa = PBXGroup;
+\t\t\tchildren = (
+\t\t\t\t${productRef} /* ${PRODUCT} */,
+\t\t\t);
+\t\t\tname = Products;
+\t\t\tsourceTree = "<group>";
+\t\t};
+/* End PBXGroup section */
+
+/* Begin PBXNativeTarget section */
+\t\t${target} /* ${SCHEME} */ = {
+\t\t\tisa = PBXNativeTarget;
+\t\t\tbuildConfigurationList = ${targetConfigs} /* Build configuration list for PBXNativeTarget "${SCHEME}" */;
+\t\t\tbuildPhases = (
+\t\t\t\t${sourcesPhase} /* Sources */,
+\t\t\t\t${frameworksPhase} /* Frameworks */,
+\t\t\t\t${resourcesPhase} /* Resources */,
+\t\t\t);
+\t\t\tbuildRules = (
+\t\t\t);
+\t\t\tdependencies = (
+\t\t\t);
+\t\t\tname = "${SCHEME}";
+\t\t\tproductName = "${SCHEME}";
+\t\t\tproductReference = ${productRef} /* ${PRODUCT} */;
+\t\t\tproductType = "com.apple.product-type.application";
+\t\t};
+/* End PBXNativeTarget section */
+
+/* Begin PBXProject section */
+\t\t${project} /* Project object */ = {
+\t\t\tisa = PBXProject;
+\t\t\tattributes = {
+\t\t\t\tBuildIndependentTargetsInParallel = 1;
+\t\t\t\tLastSwiftUpdateCheck = 1600;
+\t\t\t\tLastUpgradeCheck = 1600;
+\t\t\t\tTargetAttributes = {
+\t\t\t\t\t${target} = {
+\t\t\t\t\t\tCreatedOnToolsVersion = 16.0;
+\t\t\t\t\t};
+\t\t\t\t};
+\t\t\t};
+\t\t\tbuildConfigurationList = ${projectConfigs} /* Build configuration list for PBXProject "Stor" */;
+\t\t\tcompatibilityVersion = "Xcode 14.0";
+\t\t\tdevelopmentRegion = en;
+\t\t\thasScannedForEncodings = 0;
+\t\t\tknownRegions = (
+\t\t\t\ten,
+\t\t\t\tBase,
+\t\t\t);
+\t\t\tmainGroup = ${mainGroup};
+\t\t\tproductRefGroup = ${productsGroup} /* Products */;
+\t\t\tprojectDirPath = "";
+\t\t\tprojectRoot = "";
+\t\t\ttargets = (
+\t\t\t\t${target} /* ${SCHEME} */,
+\t\t\t);
+\t\t};
+/* End PBXProject section */
+
+/* Begin PBXResourcesBuildPhase section */
+\t\t${resourcesPhase} /* Resources */ = {
+\t\t\tisa = PBXResourcesBuildPhase;
+\t\t\tbuildActionMask = 2147483647;
+\t\t\tfiles = (
+\t\t\t\t${assetsBuild} /* Assets.xcassets in Resources */,
+\t\t\t);
+\t\t\trunOnlyForDeploymentPostprocessing = 0;
+\t\t};
+/* End PBXResourcesBuildPhase section */
+
+/* Begin PBXSourcesBuildPhase section */
+\t\t${sourcesPhase} /* Sources */ = {
+\t\t\tisa = PBXSourcesBuildPhase;
+\t\t\tbuildActionMask = 2147483647;
+\t\t\tfiles = (
+${sources.map(({ group, file }) => `\t\t\t\t${build(group, file)} /* ${file} in Sources */,`).join("\n")}
+\t\t\t);
+\t\t\trunOnlyForDeploymentPostprocessing = 0;
+\t\t};
+/* End PBXSourcesBuildPhase section */
+
+/* Begin XCBuildConfiguration section */
+${config("project:Debug", debug)}${config("project:Release", release)}${config("target:Debug", targetSettings, xcconfigRef)}${config("target:Release", targetSettings, xcconfigRef)}/* End XCBuildConfiguration section */
+
+/* Begin XCConfigurationList section */
+\t\t${projectConfigs} /* Build configuration list for PBXProject "Stor" */ = {
+\t\t\tisa = XCConfigurationList;
+\t\t\tbuildConfigurations = (
+\t\t\t\t${id("config:project:Debug")} /* Debug */,
+\t\t\t\t${id("config:project:Release")} /* Release */,
+\t\t\t);
+\t\t\tdefaultConfigurationIsVisible = 0;
+\t\t\tdefaultConfigurationName = Release;
+\t\t};
+\t\t${targetConfigs} /* Build configuration list for PBXNativeTarget "${SCHEME}" */ = {
+\t\t\tisa = XCConfigurationList;
+\t\t\tbuildConfigurations = (
+\t\t\t\t${id("config:target:Debug")} /* Debug */,
+\t\t\t\t${id("config:target:Release")} /* Release */,
+\t\t\t);
+\t\t\tdefaultConfigurationIsVisible = 0;
+\t\t\tdefaultConfigurationName = Release;
+\t\t};
+/* End XCConfigurationList section */
+\t};
+\trootObject = ${project} /* Project object */;
+}
+`;
+
+    const reference = `<BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "${target}"
+               BuildableName = "${PRODUCT}"
+               BlueprintName = "${SCHEME}"
+               ReferencedContainer = "container:Stor.xcodeproj">
+            </BuildableReference>`;
+    const scheme = `<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "1600"
+   version = "1.7">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            ${reference}
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES">
+      <Testables>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Release"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         ${reference}
+      </BuildableProductRunnable>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         ${reference}
+      </BuildableProductRunnable>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>
+`;
+
+    mkdirSync(PROJECT_ROOT, { recursive: true });
+    rmSync(PROJECT_DIRECTORY, { recursive: true, force: true });
+    const schemes = path.join(PROJECT_DIRECTORY, "xcshareddata", "xcschemes");
+    mkdirSync(schemes, { recursive: true });
+    writeFileSync(path.join(PROJECT_DIRECTORY, "project.pbxproj"), text);
+    writeFileSync(path.join(schemes, `${SCHEME}.xcscheme`), scheme);
+    return PROJECT_DIRECTORY;
+}

package/src/resign.ts

@@ -0,0 +1,280 @@
+#!/usr/bin/env npx tsx
+/**
+ * Keep free-signed iPhone builds alive. Profiles from a free Apple ID (Xcode
+ * "Personal Team") expire after seven days; this rebuilds each site with a fresh
+ * profile and installs it over the old copy, which keeps the app's data.
+ *
+ * Usage:
+ *   hearthlog apple:resign             rebuild and install sites whose profile expires soon
+ *   hearthlog apple:resign --force     rebuild and install every site now
+ *   hearthlog apple:resign --dry-run   report what is due without building
+ *   hearthlog apple:resign status      show each site's installed profile expiry
+ *   hearthlog apple:resign install     run daily at 03:30 through a LaunchAgent
+ *   hearthlog apple:resign uninstall   remove the LaunchAgent
+ *
+ * Settings live in resign.local.json (git-ignored); see
+ * resign.example.json (in @hearthlog/native) and docs/ios-free-signing.md. Each site's app is prepared first
+ * (ios.ts), so a build always carries that site's bundle id, icon and team.
+ */
+
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir, userInfo } from "node:os";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { prepareIosSite } from "./ios.js";
+import {
+    AppleError as ResignError,
+    BUILD_ROOT as APPLE_BUILD_ROOT,
+    loadAppleSettings,
+    loadAppleSite,
+    run,
+    type AppleSettings,
+} from "./site.js";
+import { REPOSITORY_ROOT } from "@hearthlog/tooling/tenants/tenant-config.js";
+
+interface InstallState {
+    bundleId: string;
+    expiresAt: string;
+    installedAt: string;
+}
+
+interface ProvisioningProfile {
+    file: string;
+    name: string;
+    applicationIdentifier: string;
+    expiresAt: Date;
+}
+
+const DAY_MS = 86_400_000;
+const BUILD_ROOT = path.join(APPLE_BUILD_ROOT, "ios");
+/** One agent per tenant: the label follows the bundle prefix, so tenant repositories never share one. */
+const labelFor = (settings: AppleSettings) => `${settings.bundlePrefix}.resign`;
+const launchAgentFor = (settings: AppleSettings) => path.join(homedir(), "Library", "LaunchAgents", `${labelFor(settings)}.plist`);
+const logFileFor = (settings: AppleSettings) => path.join(homedir(), "Library", "Logs", `${labelFor(settings)}.log`);
+/** Xcode 16 keeps managed profiles in the first folder; older versions used the second. */
+const PROFILE_DIRECTORIES = [
+    path.join(homedir(), "Library", "Developer", "Xcode", "UserData", "Provisioning Profiles"),
+    path.join(homedir(), "Library", "MobileDevice", "Provisioning Profiles"),
+];
+
+function log(message: string) {
+    console.log(`[${new Date().toISOString()}] ${message}`);
+}
+
+function notify(title: string, message: string) {
+    const quote = (value: string) => JSON.stringify(value);
+    spawnSync("osascript", ["-e", `display notification ${quote(message)} with title ${quote(title)}`]);
+}
+
+function requireXcode() {
+    const developerDirectory = run("xcode-select", ["-p"], { quiet: true }).trim();
+    if (developerDirectory.includes("CommandLineTools")) {
+        throw new ResignError("Xcode is required. Install it, then run: sudo xcode-select -s /Applications/Xcode.app");
+    }
+}
+
+/** devicectl and xcodebuild both accept the hardware UDID, so resolve names to it. */
+function resolveDevice(device: string): { udid: string; name: string } {
+    const output = path.join(BUILD_ROOT, "devices.json");
+    mkdirSync(BUILD_ROOT, { recursive: true });
+    run("xcrun", ["devicectl", "list", "devices", "--json-output", output], { quiet: true });
+    const listing = JSON.parse(readFileSync(output, "utf8")) as {
+        result?: { devices?: Array<{ hardwareProperties?: { udid?: string; platform?: string }; deviceProperties?: { name?: string } }> };
+    };
+    for (const candidate of listing.result?.devices ?? []) {
+        const udid = candidate.hardwareProperties?.udid;
+        const name = candidate.deviceProperties?.name;
+        if (udid && (udid === device || name === device)) return { udid, name: name ?? udid };
+    }
+    throw new ResignError(`No paired device named "${device}". Pair it once in Xcode and turn on "Connect via network".`);
+}
+
+/** Read one value; profiles hold binary data that a whole-file JSON conversion rejects. */
+function plistValue(keyPath: string, file: string, input?: string): string {
+    return run("plutil", ["-extract", keyPath, "raw", "-o", "-", input === undefined ? file : "-"], { input, quiet: true }).trim();
+}
+
+/** Profiles are CMS-signed plists; security decodes them to XML first. */
+function readProfile(file: string): ProvisioningProfile | null {
+    try {
+        const xml = run("security", ["cms", "-D", "-i", file], { quiet: true });
+        const expiresAt = new Date(plistValue("ExpirationDate", file, xml));
+        if (Number.isNaN(expiresAt.getTime())) return null;
+        return {
+            file,
+            name: plistValue("Name", file, xml),
+            applicationIdentifier: plistValue("Entitlements.application-identifier", file, xml),
+            expiresAt,
+        };
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * Xcode reuses a cached profile until it expires, so a rebuild two days early would
+ * install a build that still dies on the old date. Remove only the Xcode-managed
+ * team profiles for this bundle id; Xcode downloads a fresh seven-day one.
+ */
+function removeCachedProfiles(bundleId: string) {
+    for (const directory of PROFILE_DIRECTORIES) {
+        if (!existsSync(directory)) continue;
+        for (const entry of readdirSync(directory)) {
+            if (!entry.endsWith(".mobileprovision")) continue;
+            const profile = readProfile(path.join(directory, entry));
+            if (!profile) continue;
+            const managed = profile.name.startsWith("iOS Team Provisioning Profile:");
+            if (managed && profile.applicationIdentifier.endsWith(`.${bundleId}`)) {
+                rmSync(profile.file);
+                log(`Removed cached profile ${entry} for ${bundleId}`);
+            }
+        }
+    }
+}
+
+function statePath(site: string) {
+    return path.join(BUILD_ROOT, site, "installed.json");
+}
+
+function readState(site: string): InstallState | null {
+    try {
+        return JSON.parse(readFileSync(statePath(site), "utf8")) as InstallState;
+    } catch {
+        return null;
+    }
+}
+
+function daysLeft(state: InstallState | null, now: number) {
+    return state ? (Date.parse(state.expiresAt) - now) / DAY_MS : -Infinity;
+}
+
+function buildSite(settings: AppleSettings, site: string, udid: string): { app: string; bundleId: string; expiresAt: Date } {
+    const derivedData = path.join(BUILD_ROOT, site);
+    run("xcodebuild", [
+        "-project", settings.project,
+        "-scheme", settings.scheme,
+        "-configuration", "Release",
+        "-destination", `platform=iOS,id=${udid}`,
+        "-derivedDataPath", derivedData,
+        "-allowProvisioningUpdates",
+        "-allowProvisioningDeviceRegistration",
+        "-quiet",
+        "build",
+    ]);
+    const products = path.join(derivedData, "Build", "Products", "Release-iphoneos");
+    const app = readdirSync(products).find((entry) => entry.endsWith(".app"));
+    if (!app) throw new ResignError(`No .app in ${products}`);
+    const appPath = path.join(products, app);
+    const bundleId = plistValue("CFBundleIdentifier", path.join(appPath, "Info.plist"));
+    if (!bundleId) throw new ResignError(`${app} has no bundle identifier`);
+    const profile = readProfile(path.join(appPath, "embedded.mobileprovision"));
+    if (!profile) throw new ResignError(`${app} has no readable provisioning profile`);
+    return { app: appPath, bundleId, expiresAt: profile.expiresAt };
+}
+
+async function installWithRetry(udid: string, app: string) {
+    for (let attempt = 1; ; attempt += 1) {
+        try {
+            run("xcrun", ["devicectl", "device", "install", "app", "--device", udid, app], { quiet: true });
+            return;
+        } catch (error) {
+            if (attempt === 3) throw error;
+            log(`Install attempt ${attempt} failed; retrying in a minute (is the iPhone on this network?)`);
+            await new Promise((resolve) => setTimeout(resolve, 60_000));
+        }
+    }
+}
+
+async function resign({ force, dryRun }: { force: boolean; dryRun: boolean }) {
+    const settings = loadAppleSettings({ requireDevice: true });
+    // An unknown site id should fail now, not halfway through a build.
+    for (const site of settings.sites) await loadAppleSite(site, settings);
+    const now = Date.now();
+    const due = settings.sites.filter((site) => force || daysLeft(readState(site), now) < settings.renewWithinDays);
+    for (const site of settings.sites) {
+        const left = daysLeft(readState(site), now);
+        log(`${site}: ${Number.isFinite(left) ? `${left.toFixed(1)} days left` : "not installed by this script"}${due.includes(site) ? ", due" : ""}`);
+    }
+    if (due.length === 0 || dryRun) return;
+
+    requireXcode();
+    const device = resolveDevice(settings.device);
+    const renewed: string[] = [];
+    for (const site of due) {
+        const definition = await loadAppleSite(site, settings);
+        removeCachedProfiles(definition.bundleId);
+        log(`${site}: preparing ${definition.bundleId}, then building for ${device.name}`);
+        await prepareIosSite(definition, settings, { requireTeam: true });
+        const build = buildSite(settings, site, device.udid);
+        if (build.expiresAt.getTime() - Date.now() < 6 * DAY_MS) {
+            throw new ResignError(`${site}: Xcode signed with a profile that expires ${build.expiresAt.toISOString()}; remove it from Xcode's profile folder and run with --force.`);
+        }
+        await installWithRetry(device.udid, build.app);
+        const state: InstallState = { bundleId: build.bundleId, expiresAt: build.expiresAt.toISOString(), installedAt: new Date().toISOString() };
+        writeFileSync(statePath(site), `${JSON.stringify(state, null, 4)}\n`);
+        log(`${site}: installed ${build.bundleId}, runs until ${build.expiresAt.toLocaleString()}`);
+        renewed.push(site);
+    }
+    notify("stor re-signed", `${renewed.join(", ")} installed on ${device.name} for another 7 days.`);
+}
+
+function launchAgentPlist(settings: AppleSettings) {
+    const escape = (value: string) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+    // The PATH entry survives `brew upgrade node`; process.execPath points into a versioned Cellar folder.
+    const node = spawnSync("/usr/bin/which", ["node"], { encoding: "utf8" }).stdout.trim() || process.execPath;
+    // The tenant's installed `hearthlog` bin runs the command (and the build before it) the way a terminal does.
+    const bin = path.join(path.dirname(createRequire(path.join(REPOSITORY_ROOT, "package.json")).resolve("@hearthlog/tooling/package.json")), "bin", "hearthlog.mjs");
+    const programArguments = [node, bin, "apple:resign"];
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key><string>${labelFor(settings)}</string>
+    <key>ProgramArguments</key>
+    <array>
+${programArguments.map((argument) => `        <string>${escape(argument)}</string>`).join("\n")}
+    </array>
+    <key>WorkingDirectory</key><string>${escape(REPOSITORY_ROOT)}</string>
+    <key>EnvironmentVariables</key>
+    <dict><key>PATH</key><string>/usr/bin:/bin:/usr/sbin:/sbin:/opt/homebrew/bin</string></dict>
+    <!-- Missed runs during sleep fire on the next wake. -->
+    <key>StartCalendarInterval</key>
+    <dict><key>Hour</key><integer>3</integer><key>Minute</key><integer>30</integer></dict>
+    <key>StandardOutPath</key><string>${escape(logFileFor(settings))}</string>
+    <key>StandardErrorPath</key><string>${escape(logFileFor(settings))}</string>
+</dict>
+</plist>
+`;
+}
+
+function installAgent() {
+    const settings = loadAppleSettings({ requireDevice: false });
+    const agent = launchAgentFor(settings);
+    mkdirSync(path.dirname(agent), { recursive: true });
+    writeFileSync(agent, launchAgentPlist(settings));
+    const domain = `gui/${userInfo().uid}`;
+    spawnSync("launchctl", ["bootout", `${domain}/${labelFor(settings)}`]);
+    run("launchctl", ["bootstrap", domain, agent]);
+    log(`Installed ${agent}; runs daily at 03:30, log at ${logFileFor(settings)}`);
+}
+
+function uninstallAgent() {
+    const settings = loadAppleSettings({ requireDevice: false });
+    spawnSync("launchctl", ["bootout", `gui/${userInfo().uid}/${labelFor(settings)}`]);
+    rmSync(launchAgentFor(settings), { force: true });
+    log(`Removed ${launchAgentFor(settings)}`);
+}
+
+const args = process.argv.slice(2);
+try {
+    if (args[0] === "install") installAgent();
+    else if (args[0] === "uninstall") uninstallAgent();
+    else if (args[0] === "status") await resign({ force: false, dryRun: true });
+    else await resign({ force: args.includes("--force"), dryRun: args.includes("--dry-run") });
+} catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    log(`Failed: ${message}`);
+    notify("stor re-sign failed", message);
+    process.exitCode = 1;
+}