@limrun/ui 0.14.0-rc.2 → 0.14.0-rc.4

package/dist/browser-storage-BnO-Ma-e.mjs

@@ -0,0 +1,219 @@
+import { f as D } from "./index-YDu8K9a4.mjs";
+const P = "limbuild-device-pairing", x = 1, d = "pairRecords", y = "limbuild-device-signing", A = 1, c = "signingAssets";
+function l(e) {
+  return (e ?? "").replace(/-/g, "").replace(/[^a-fA-F0-9]/g, "");
+}
+function f(e) {
+  return (e ?? "").trim();
+}
+async function j(e) {
+  const t = l(e);
+  if (!t) return;
+  const r = await p(P, x, d, "udid");
+  return g(
+    r.transaction(d, "readonly").objectStore(d).get(t)
+  );
+}
+async function G(e, t = {}) {
+  const r = l(e.udid);
+  if (!r) throw new Error("Cannot store pair record without a UDID.");
+  const n = {
+    ...e,
+    udid: r,
+    productName: t.productName,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  }, i = await p(P, x, d, "udid");
+  return await g(
+    i.transaction(d, "readwrite").objectStore(d).put(n)
+  ), n;
+}
+async function M({
+  deviceUDID: e,
+  bundleID: t,
+  signingMode: r = "development"
+}) {
+  const n = f(t);
+  if (!n) return;
+  const i = l(e), o = await h(I("bundle", n, r));
+  if (o) return o;
+  if (i) {
+    const s = await h(I(i, n, r));
+    if (s) return s;
+  }
+  return (await T(n, r))[0];
+}
+async function k(e = "development") {
+  return (await b()).filter((r) => (r.signingMode ?? "development") === e).sort((r, n) => new Date(n.updatedAt).getTime() - new Date(r.updatedAt).getTime())[0];
+}
+async function V(e, t = "development") {
+  return (await b()).filter((n) => !n.certificateID || !n.certificateP12Base64 || (n.signingMode ?? "development") !== t ? !1 : !e || !n.teamID || n.teamID === e).sort((n, i) => new Date(i.updatedAt).getTime() - new Date(n.updatedAt).getTime())[0];
+}
+async function F(e) {
+  const t = f(e.bundleID);
+  if (!t)
+    throw new Error("Cannot store signing assets without a bundle ID.");
+  const r = l(e.deviceUDID), n = e.signingMode ?? "development", i = I("bundle", t, n), o = {
+    ...e,
+    id: i,
+    deviceUDID: r || void 0,
+    signingMode: n,
+    bundleID: t,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  }, a = await p(y, A, c, "id");
+  return await g(
+    a.transaction(c, "readwrite").objectStore(c).put(o)
+  ), o;
+}
+async function T(e, t = "development") {
+  const r = f(e);
+  return r ? (await b()).filter(
+    (i) => i.bundleID === r && (i.signingMode ?? "development") === t
+  ) : [];
+}
+function W(e, t) {
+  const r = l(t);
+  return !!r && e.provisionedDevices.some((n) => l(n) === r);
+}
+function $(e, t) {
+  const r = f(t), n = f(e.bundleID);
+  if (!r || !n) return !1;
+  if (n === r || n === "*") return !0;
+  if (!n.endsWith(".*")) return !1;
+  const i = n.slice(0, -1);
+  return r.startsWith(i);
+}
+async function q(e) {
+  return E(new Uint8Array(await e.arrayBuffer()));
+}
+function L(e) {
+  const t = atob(e), r = new Uint8Array(t.length);
+  for (let n = 0; n < t.length; n += 1)
+    r[n] = t.charCodeAt(n);
+  return E(r);
+}
+function E(e) {
+  const t = new TextDecoder("latin1").decode(e), r = t.indexOf("<?xml"), n = t.indexOf("</plist>");
+  if (r < 0 || n < r)
+    throw new Error("Provisioning profile plist not found.");
+  const i = t.slice(r, n + 8);
+  if (/<!ENTITY/i.test(i))
+    throw new Error("Provisioning profile plist contains a disallowed ENTITY declaration.");
+  const o = new DOMParser().parseFromString(i, "application/xml");
+  if (o.querySelector("parsererror"))
+    throw new Error("Provisioning profile plist could not be parsed.");
+  const a = o.querySelector("plist > dict");
+  if (!a)
+    throw new Error("Provisioning profile plist dictionary not found.");
+  const s = v(a);
+  if (!N(s))
+    throw new Error("Provisioning profile plist has an unexpected shape.");
+  const m = N(s.Entitlements) ? s.Entitlements : {}, S = u(m["application-identifier"]), B = _(S);
+  return {
+    name: u(s.Name),
+    uuid: u(s.UUID),
+    teamID: u(m["com.apple.developer.team-identifier"]) ?? w(s.TeamIdentifier)[0],
+    applicationIdentifier: S,
+    bundleID: B,
+    provisionedDevices: w(s.ProvisionedDevices),
+    certificateSerialNumbers: O(w(s.DeveloperCertificates)),
+    getTaskAllow: R(m["get-task-allow"]),
+    expirationDate: u(s.ExpirationDate)
+  };
+}
+function z(e) {
+  return (e ?? "").replace(/^0+/, "").toUpperCase() || void 0;
+}
+function O(e) {
+  const t = [];
+  for (const r of e)
+    try {
+      const n = atob(r.replace(/\s+/g, "")), i = D.pki.certificateFromAsn1(D.asn1.fromDer(D.util.createBuffer(n))), o = z(i.serialNumber);
+      o && !t.includes(o) && t.push(o);
+    } catch {
+    }
+  return t;
+}
+async function h(e) {
+  if (!e) return;
+  const t = await p(y, A, c, "id");
+  return g(
+    t.transaction(c, "readonly").objectStore(c).get(e)
+  );
+}
+async function b() {
+  const e = await p(y, A, c, "id");
+  return g(
+    e.transaction(c, "readonly").objectStore(c).getAll()
+  );
+}
+function I(e, t, r) {
+  return `${r}:${e}:${t}`;
+}
+function _(e) {
+  if (!e) return;
+  const t = e.indexOf(".");
+  return t >= 0 ? e.slice(t + 1) : void 0;
+}
+function v(e) {
+  switch (e.tagName) {
+    case "dict":
+      return C(e);
+    case "array":
+      return Array.from(e.children).map(v);
+    case "string":
+    case "date":
+      return e.textContent ?? "";
+    default:
+      return e.textContent ?? "";
+  }
+}
+function C(e) {
+  const t = {}, r = Array.from(e.children);
+  for (let n = 0; n < r.length; n += 2) {
+    const i = r[n], o = r[n + 1];
+    !i || i.tagName !== "key" || !o || (t[i.textContent ?? ""] = v(o));
+  }
+  return t;
+}
+function u(e) {
+  return typeof e == "string" && e ? e : void 0;
+}
+function w(e) {
+  return Array.isArray(e) ? e.filter((t) => typeof t == "string") : [];
+}
+function R(e) {
+  return typeof e == "boolean" ? e : void 0;
+}
+function N(e) {
+  return typeof e == "object" && e !== null && !Array.isArray(e);
+}
+function p(e, t, r, n) {
+  return new Promise((i, o) => {
+    const a = indexedDB.open(e, t);
+    a.onupgradeneeded = () => {
+      const s = a.result;
+      s.objectStoreNames.contains(r) || s.createObjectStore(r, { keyPath: n });
+    }, a.onsuccess = () => i(a.result), a.onerror = () => o(a.error ?? new Error("Open IndexedDB failed"));
+  });
+}
+function g(e) {
+  return new Promise((t, r) => {
+    e.onsuccess = () => t(e.result), e.onerror = () => r(e.error ?? new Error("IndexedDB request failed"));
+  });
+}
+export {
+  F as a,
+  $ as b,
+  W as c,
+  V as d,
+  M as e,
+  L as f,
+  k as g,
+  E as h,
+  f as i,
+  j,
+  G as k,
+  z as l,
+  l as n,
+  q as p
+};

package/dist/browser-storage-DLxIqZk5.js

@@ -0,0 +1 @@
+"use strict";const m=require("./index-ChhtuQ7e.js"),B="limbuild-device-pairing",x=1,l="pairRecords",A="limbuild-device-signing",y=1,c="signingAssets";function d(e){return(e??"").replace(/-/g,"").replace(/[^a-fA-F0-9]/g,"")}function u(e){return(e??"").trim()}async function C(e){const t=d(e);if(!t)return;const r=await g(B,x,l,"udid");return p(r.transaction(l,"readonly").objectStore(l).get(t))}async function T(e,t={}){const r=d(e.udid);if(!r)throw new Error("Cannot store pair record without a UDID.");const n={...e,udid:r,productName:t.productName,updatedAt:new Date().toISOString()},i=await g(B,x,l,"udid");return await p(i.transaction(l,"readwrite").objectStore(l).put(n)),n}async function R({deviceUDID:e,bundleID:t,signingMode:r="development"}){const n=u(t);if(!n)return;const i=d(e),o=await h(I("bundle",n,r));if(o)return o;if(i){const s=await h(I(i,n,r));if(s)return s}return(await M(n,r))[0]}async function O(e="development"){return(await S()).filter(r=>(r.signingMode??"development")===e).sort((r,n)=>new Date(n.updatedAt).getTime()-new Date(r.updatedAt).getTime())[0]}async function U(e,t="development"){return(await S()).filter(n=>!n.certificateID||!n.certificateP12Base64||(n.signingMode??"development")!==t?!1:!e||!n.teamID||n.teamID===e).sort((n,i)=>new Date(i.updatedAt).getTime()-new Date(n.updatedAt).getTime())[0]}async function _(e){const t=u(e.bundleID);if(!t)throw new Error("Cannot store signing assets without a bundle ID.");const r=d(e.deviceUDID),n=e.signingMode??"development",i=I("bundle",t,n),o={...e,id:i,deviceUDID:r||void 0,signingMode:n,bundleID:t,updatedAt:new Date().toISOString()},a=await g(A,y,c,"id");return await p(a.transaction(c,"readwrite").objectStore(c).put(o)),o}async function M(e,t="development"){const r=u(e);return r?(await S()).filter(i=>i.bundleID===r&&(i.signingMode??"development")===t):[]}function G(e,t){const r=d(t);return!!r&&e.provisionedDevices.some(n=>d(n)===r)}function j(e,t){const r=u(t),n=u(e.bundleID);if(!r||!n)return!1;if(n===r||n==="*")return!0;if(!n.endsWith(".*"))return!1;const i=n.slice(0,-1);return r.startsWith(i)}async function V(e){return v(new Uint8Array(await e.arrayBuffer()))}function k(e){const t=atob(e),r=new Uint8Array(t.length);for(let n=0;n<t.length;n+=1)r[n]=t.charCodeAt(n);return v(r)}function v(e){const t=new TextDecoder("latin1").decode(e),r=t.indexOf("<?xml"),n=t.indexOf("</plist>");if(r<0||n<r)throw new Error("Provisioning profile plist not found.");const i=t.slice(r,n+8);if(/<!ENTITY/i.test(i))throw new Error("Provisioning profile plist contains a disallowed ENTITY declaration.");const o=new DOMParser().parseFromString(i,"application/xml");if(o.querySelector("parsererror"))throw new Error("Provisioning profile plist could not be parsed.");const a=o.querySelector("plist > dict");if(!a)throw new Error("Provisioning profile plist dictionary not found.");const s=b(a);if(!N(s))throw new Error("Provisioning profile plist has an unexpected shape.");const D=N(s.Entitlements)?s.Entitlements:{},P=f(D["application-identifier"]),z=L(P);return{name:f(s.Name),uuid:f(s.UUID),teamID:f(D["com.apple.developer.team-identifier"])??w(s.TeamIdentifier)[0],applicationIdentifier:P,bundleID:z,provisionedDevices:w(s.ProvisionedDevices),certificateSerialNumbers:F(w(s.DeveloperCertificates)),getTaskAllow:q(D["get-task-allow"]),expirationDate:f(s.ExpirationDate)}}function E(e){return(e??"").replace(/^0+/,"").toUpperCase()||void 0}function F(e){const t=[];for(const r of e)try{const n=atob(r.replace(/\s+/g,"")),i=m.forge.pki.certificateFromAsn1(m.forge.asn1.fromDer(m.forge.util.createBuffer(n))),o=E(i.serialNumber);o&&!t.includes(o)&&t.push(o)}catch{}return t}async function h(e){if(!e)return;const t=await g(A,y,c,"id");return p(t.transaction(c,"readonly").objectStore(c).get(e))}async function S(){const e=await g(A,y,c,"id");return p(e.transaction(c,"readonly").objectStore(c).getAll())}function I(e,t,r){return`${r}:${e}:${t}`}function L(e){if(!e)return;const t=e.indexOf(".");return t>=0?e.slice(t+1):void 0}function b(e){switch(e.tagName){case"dict":return W(e);case"array":return Array.from(e.children).map(b);case"string":case"date":return e.textContent??"";default:return e.textContent??""}}function W(e){const t={},r=Array.from(e.children);for(let n=0;n<r.length;n+=2){const i=r[n],o=r[n+1];!i||i.tagName!=="key"||!o||(t[i.textContent??""]=b(o))}return t}function f(e){return typeof e=="string"&&e?e:void 0}function w(e){return Array.isArray(e)?e.filter(t=>typeof t=="string"):[]}function q(e){return typeof e=="boolean"?e:void 0}function N(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function g(e,t,r,n){return new Promise((i,o)=>{const a=indexedDB.open(e,t);a.onupgradeneeded=()=>{const s=a.result;s.objectStoreNames.contains(r)||s.createObjectStore(r,{keyPath:n})},a.onsuccess=()=>i(a.result),a.onerror=()=>o(a.error??new Error("Open IndexedDB failed"))})}function p(e){return new Promise((t,r)=>{e.onsuccess=()=>t(e.result),e.onerror=()=>r(e.error??new Error("IndexedDB request failed"))})}exports.getLatestSigningAssets=O;exports.getLatestSigningAssetsWithCertificate=U;exports.getPairRecord=C;exports.getSigningAssets=R;exports.normalizeBundleID=u;exports.normalizeCertificateSerial=E;exports.normalizeUDID=d;exports.parseProvisioningProfile=V;exports.parseProvisioningProfileBase64=k;exports.parseProvisioningProfileBytes=v;exports.profileContainsDevice=G;exports.profileMatchesBundleID=j;exports.putPairRecord=T;exports.putSigningAssets=_;

package/dist/client-D1drDXxE.js

@@ -0,0 +1 @@
+"use strict";const F=require("./gsa-srp-CCIfUz7Y.js");class g{constructor(t,r,o){this.apiUrl=t,this.token=r,this.organizationId=o}socket;nextId=1;pending=new Map;async connect(){if(this.socket&&this.socket.readyState===WebSocket.OPEN)return;const t=new WebSocket(E(this.apiUrl,this.token,this.organizationId));this.socket=t,t.onmessage=r=>this.handleMessage(r),t.onclose=()=>this.rejectPending(new Error("Apple relay WebSocket closed")),t.onerror=()=>this.rejectPending(new Error("Apple relay WebSocket failed")),await new Promise((r,o)=>{t.onopen=()=>r(),t.onerror=()=>o(new Error("Apple relay WebSocket connection failed"))})}request(t,r){const o=this.socket;if(!o||o.readyState!==WebSocket.OPEN)throw new Error("Apple relay WebSocket is not connected.");const a=String(this.nextId++),n=new Promise((p,i)=>{this.pending.set(a,{resolve:h=>p(q(h)),reject:i})});return o.send(JSON.stringify({id:a,type:t,...r===void 0?{}:{payload:r}})),n}close(){this.rejectPending(new Error("Apple relay WebSocket closed")),this.socket?.close(),this.socket=void 0}handleMessage(t){const r=JSON.parse(String(t.data)),o=this.pending.get(r.id);if(o){if(this.pending.delete(r.id),!r.ok){o.reject(new Error(r.error||"Apple relay request failed"));return}if(!r.response){o.reject(new Error("Apple relay response was empty."));return}o.resolve(r.response)}}rejectPending(t){for(const r of this.pending.values())r.reject(t);this.pending.clear()}}async function m(e,t,r){const o=new g(e,t,r);return await o.connect(),o}async function S(e,t){return e.request("srpInit",t)}async function A(e,t){return e.request("srpComplete",t)}async function P(e){return e.request("triggerTrustedDevice2FA")}async function b(e,t,r="sms"){return e.request("triggerPhone2FA",{phoneNumberId:t,mode:r})}async function k(e,t){return e.request("submitTrustedDevice2FA",{code:t})}async function T(e,t,r,o="sms"){return e.request("submitPhone2FA",{phoneNumberId:t,mode:o,code:r})}async function v(e){return e.request("finalize")}async function R(e,t){return e.request("provisioning",t)}function q(e){if(e.body!==void 0||!e.rawBody)return e;try{return{...e,body:JSON.parse(e.rawBody)}}catch{return e}}function E(e,t,r){const o=new URL(e);return o.protocol=o.protocol==="https:"?"wss:":"ws:",o.pathname=`${o.pathname.replace(/\/$/,"")}/ios/appstoreconnect/ws`,t&&o.searchParams.set("token",t),r&&o.searchParams.set("organization",r),o.toString()}async function N({registryApiUrl:e,accountName:t,password:r,token:o,organizationId:a}){const n=await m(e,o,a);try{const p=new F.AppleGsaSrpClient(t),i=await S(n,await p.init());if(i.status<200||i.status>=300)throw new Error(`Apple SRP init failed: HTTP ${i.status} ${i.rawBody??""}`.trim());if(!i.body)throw new Error("Apple SRP init response did not include a body.");const h=await p.complete(r,i.body),u=await A(n,{...h,rememberMe:!1,trustTokens:[]}),y=u.status===409;let s,d={type:"trustedDevice"};if(y){s=await P(n);const c=x(s.body);if(s.status===412){if(!c)throw new Error("Apple requested phone verification but did not include a trusted phone number.");d={type:"phone",phoneNumberId:c.id,mode:c.pushMode??"sms"},s=await b(n,c.id,c.pushMode??"sms")}if(s.status<200||s.status>=300)throw new Error(`Apple two-factor challenge failed: HTTP ${s.status} ${s.rawBody??""}`.trim())}else if(u.status<200||u.status>=300)throw new Error(`Apple SRP complete failed: HTTP ${u.status} ${u.rawBody??""}`.trim());return{relay:n,completeResponse:u,twoFactorChallengeResponse:s,requiresTwoFactor:y,finishTwoFactor:async c=>{const l=d.type==="phone"?await T(n,d.phoneNumberId,c,d.mode):await k(n,c);if(l.status<200||l.status>=300)throw new Error(`Apple two-factor code failed: HTTP ${l.status} ${l.rawBody??""}`.trim());return l},finalize:async()=>v(n),close:async()=>n.close()}}catch(p){throw n.close(),p}}function x(e){if(!f(e))return;const t=f(e.phoneNumberVerification)?e.phoneNumberVerification:void 0,r=w(t?.trustedPhoneNumber)??w(e.trustedPhoneNumber)??w(e.phoneNumber);if(!r)return;const o=r.id;if(typeof o!="number")return;const a=typeof r.pushMode=="string"?r.pushMode:typeof e.mode=="string"?e.mode:void 0;return{id:o,pushMode:a}}function w(e){return f(e)?e:void 0}function f(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}exports.AppleRelayWebSocketClient=g;exports.fetchAppleAccountSession=v;exports.openAppleRelayWebSocket=m;exports.proxyPhoneTwoFactorCode=T;exports.proxyProvisioningRequest=R;exports.proxySrpComplete=A;exports.proxySrpInit=S;exports.proxyTwoFactorCode=k;exports.startBrowserOwnedAppleIDLogin=N;exports.triggerPhoneTwoFactor=b;exports.triggerTrustedDeviceTwoFactor=P;

package/dist/{client-CBX-hLnL.mjs → client-DSuNtWDv.mjs}

@@ -1,4 +1,4 @@
-import { A as m } from "./index-DFdCvi2_.mjs";
+import { A as m } from "./gsa-srp-Bme3JLEi.mjs";
 class g {
   constructor(t, r, o) {
     this.apiUrl = t, this.token = r, this.organizationId = o;
@@ -140,12 +140,7 @@ async function M({
       twoFactorChallengeResponse: s,
       requiresTwoFactor: y,
       finishTwoFactor: async (a) => {
-        const d = l.type === "phone" ? await v(
-          n,
-          l.phoneNumberId,
-          a,
-          l.mode
-        ) : await T(n, a);
+        const d = l.type === "phone" ? await v(n, l.phoneNumberId, a, l.mode) : await T(n, a);
         if (d.status < 200 || d.status >= 300)
           throw new Error(
             `Apple two-factor code failed: HTTP ${d.status} ${d.rawBody ?? ""}`.trim()

package/dist/core/device-install/operations/operations.d.ts

@@ -37,7 +37,7 @@ export type StartInstallRelayOptions = StartPairingRelayOptions & {
     installSource: InstallSource;
 };
 export declare function requestUSBAccess({ log }: RequestUSBAccessOptions): Promise<DeviceRelayTarget>;
-export declare function startPairingRelay({ registryApiUrl, token, organizationId, log, target }: StartPairingRelayOptions): Promise<{
+export declare function startPairingRelay({ registryApiUrl, token, organizationId, log, target, }: StartPairingRelayOptions): Promise<{
     relay: RelayClient;
     pairRecord: PairRecordPayload;
     target: DeviceRelayTarget;

package/dist/core/device-install/storage/browser-storage.d.ts

@@ -23,6 +23,7 @@ export declare function parseProvisioningProfile(file: File): Promise<{
     applicationIdentifier: string | undefined;
     bundleID: string | undefined;
     provisionedDevices: string[];
+    certificateSerialNumbers: string[];
     getTaskAllow: boolean | undefined;
     expirationDate: string | undefined;
 }>;
@@ -33,6 +34,7 @@ export declare function parseProvisioningProfileBase64(base64: string): {
     applicationIdentifier: string | undefined;
     bundleID: string | undefined;
     provisionedDevices: string[];
+    certificateSerialNumbers: string[];
     getTaskAllow: boolean | undefined;
     expirationDate: string | undefined;
 };
@@ -43,6 +45,12 @@ export declare function parseProvisioningProfileBytes(bytes: Uint8Array): {
     applicationIdentifier: string | undefined;
     bundleID: string | undefined;
     provisionedDevices: string[];
+    certificateSerialNumbers: string[];
     getTaskAllow: boolean | undefined;
     expirationDate: string | undefined;
 };
+/**
+ * Normalizes a certificate serial number for comparison: uppercase hex
+ * without leading zeros, the format Apple's portal reports in serialNum.
+ */
+export declare function normalizeCertificateSerial(serial?: string): string | undefined;

package/dist/core/device-install/storage/index.d.ts

@@ -1 +1,2 @@
 export * from './browser-storage';
+export * from './secret-store';

package/dist/core/device-install/storage/secret-store.d.ts

@@ -0,0 +1,101 @@
+/**
+ * A pluggable store for Apple signing secrets.
+ *
+ * Credential material always lands in the browser first (the Apple relay
+ * only proxies); the browser then writes it into a store implementing this
+ * interface. Limrun's org secret store is the default implementation, an
+ * IndexedDB-backed one keeps everything local, and customers can bring
+ * their own store by implementing the same interface.
+ */
+export declare const APPLE_CERTIFICATE_SECRET_TYPE = "appleCertificate";
+export declare const APPLE_PROVISIONING_PROFILE_SECRET_TYPE = "appleProvisioningProfile";
+export type SigningSecretType = typeof APPLE_CERTIFICATE_SECRET_TYPE | typeof APPLE_PROVISIONING_PROFILE_SECRET_TYPE;
+export type SigningSecretMetadata = {
+    type: string;
+    name: string;
+    createdAt?: string;
+};
+/** Type-specific flat key-value payload of a signing secret. */
+export type SigningSecretData = Record<string, string>;
+export type SigningSecret = SigningSecretMetadata & {
+    data: SigningSecretData;
+};
+export interface SigningSecretStore {
+    /**
+     * Stores a secret. When a secret with the same type and name already
+     * exists its data is overwritten. Returns the stored secret; callers
+     * should use the returned data.
+     */
+    put(type: SigningSecretType, name: string, data: SigningSecretData): Promise<SigningSecret>;
+    /** Returns the secret including its data, or undefined when absent. */
+    get(type: SigningSecretType, name: string): Promise<SigningSecret | undefined>;
+    /** Lists metadata of all stored signing secrets, never their data. */
+    list(): Promise<SigningSecretMetadata[]>;
+    /** Deletes a secret; resolves even when the secret does not exist. */
+    delete(type: SigningSecretType, name: string): Promise<void>;
+}
+/**
+ * Apple's certificate types as defined by the App Store Connect API
+ * (https://developer.apple.com/documentation/appstoreconnectapi/certificatetype).
+ */
+export type AppleCertificateType = 'DEVELOPMENT' | 'DISTRIBUTION' | 'IOS_DEVELOPMENT' | 'IOS_DISTRIBUTION' | 'MAC_APP_DEVELOPMENT' | 'MAC_APP_DISTRIBUTION' | 'MAC_INSTALLER_DISTRIBUTION' | 'DEVELOPER_ID_APPLICATION' | 'DEVELOPER_ID_INSTALLER' | 'DEVELOPER_ID_KEXT' | 'PASS_TYPE_ID' | 'PASS_TYPE_ID_WITH_NFC';
+/** Data payload of an appleCertificate secret. */
+export type AppleCertificateSecretData = {
+    certificateP12Base64: string;
+    /** Which of Apple's certificate types the p12 holds. */
+    certificateType: AppleCertificateType;
+    certificatePassword?: string;
+    teamID?: string;
+    /** Apple's portal certificate id, never a Limrun DB id. */
+    certificateID?: string;
+    /** The certificate's serial number: uppercase hex, no leading zeros. */
+    serialNumber?: string;
+    expirationDate?: string;
+};
+/**
+ * Data payload of an appleProvisioningProfile secret. The
+ * certificateSerialNumbers, bundleIDs and deviceIDs fields duplicate what
+ * the signed profile binds (as comma-separated lists) so profiles can be
+ * filtered by certificate, bundle ID or device without parsing every
+ * entry. Certificates are referenced by serial number, the identifier
+ * Apple embeds in the profile itself.
+ */
+export type AppleProvisioningProfileSecretData = {
+    provisioningProfileBase64: string;
+    certificateSerialNumbers?: string;
+    bundleIDs?: string;
+    deviceIDs?: string;
+    teamID?: string;
+    profileName?: string;
+    uuid?: string;
+    expirationDate?: string;
+};
+/** Stores an Apple certificate bundle, conventionally named `${teamID}/${certificateType}`. */
+export declare function putAppleCertificateSecret(store: SigningSecretStore, name: string, data: AppleCertificateSecretData): Promise<SigningSecret>;
+/**
+ * Stores a provisioning profile, conventionally named `${teamID}/${uuid}`
+ * so a team can hold many profiles for the same bundle ID and certificate
+ * set; consumers select by the reference fields, not by name.
+ */
+export declare function putAppleProvisioningProfileSecret(store: SigningSecretStore, name: string, data: AppleProvisioningProfileSecretData): Promise<SigningSecret>;
+export type LimrunSecretStoreOptions = {
+    /** Base URL of the Limrun backend API, e.g. https://api.limrun.com */
+    apiUrl: string;
+    /** Bearer token: a user or organization token. */
+    token: string;
+    /** Organization TID owning the secrets. */
+    organizationId: string;
+    /** Custom fetch, mainly for tests. */
+    fetch?: typeof fetch;
+};
+/**
+ * A SigningSecretStore backed by Limrun's organization secret store
+ * (`/v1/organizations/{org}/secrets`). Secrets are stored server-side and
+ * shared across the organization.
+ */
+export declare function createLimrunSecretStore(options: LimrunSecretStoreOptions): SigningSecretStore;
+/**
+ * A SigningSecretStore keeping everything in the browser's IndexedDB.
+ * Nothing leaves the machine; secrets are per-browser-profile.
+ */
+export declare function createBrowserSecretStore(): SigningSecretStore;

package/dist/core/device-install/types.d.ts

@@ -30,6 +30,12 @@ export type ProvisioningProfileInfo = {
     applicationIdentifier?: string;
     bundleID?: string;
     provisionedDevices: string[];
+    /**
+     * Serial numbers (uppercase hex, no leading zeros) of the developer
+     * certificates embedded in the profile; the profile is only usable for
+     * signing with one of these certificates.
+     */
+    certificateSerialNumbers: string[];
     getTaskAllow?: boolean;
     expirationDate?: string;
 };

package/dist/core/errors.d.ts

@@ -0,0 +1 @@
+export declare function errorMessage(error: unknown): string;

package/dist/core/play-publish/google.d.ts

@@ -0,0 +1,13 @@
+export declare const ANDROID_PUBLISHER_SCOPE = "https://www.googleapis.com/auth/androidpublisher";
+export declare function loadGoogleIdentityServices(): Promise<void>;
+export type RequestGoogleAccessTokenInput = {
+    clientId: string;
+    scope?: string;
+};
+/**
+ * Opens the Google consent popup and resolves with a short-lived OAuth
+ * access token. Call from a user gesture so popup blockers allow it, and
+ * call loadGoogleIdentityServices beforehand (e.g. when the surrounding
+ * dialog opens) to keep this call synchronous with the click.
+ */
+export declare function requestGoogleAccessToken(input: RequestGoogleAccessTokenInput): Promise<string>;

package/dist/core/play-publish/publish.d.ts

@@ -0,0 +1,34 @@
+export type PlaystorePublishInput = {
+    registryApiUrl: string;
+    /** Limrun API token authenticating the registry call. */
+    token?: string;
+    /** Organization tid; required when it differs from the token's default organization. */
+    organizationId?: string;
+    /** Google OAuth access token with the androidpublisher scope. Sent per request, never stored. */
+    accessToken: string;
+    packageName: string;
+    assetId?: string;
+    assetName?: string;
+    /** Play track ID, defaults to internal on the server. */
+    track?: string;
+    /** Required by the server when track is production. */
+    releaseStatus?: 'draft' | 'completed';
+};
+export type PlaystorePublishResult = {
+    versionCode: number;
+};
+/**
+ * Registry publish failure. `code` carries the registry's machine-readable
+ * error code when available: invalidRequest, assetNotFound, internal, busy,
+ * listingNotFound, permissionDenied, versionCodeExists, uploadKeyMismatch
+ * or unknown; the set grows additively.
+ */
+export declare class PlaystorePublishError extends Error {
+    readonly code?: string;
+    readonly status?: number;
+    constructor(message: string, options?: {
+        code?: string;
+        status?: number;
+    });
+}
+export declare function publishToPlaystore(input: PlaystorePublishInput): Promise<PlaystorePublishResult>;

package/dist/device-build/index.cjs

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const a=require("../limbuild-client-CVDwq54z.js");require("../index-CMeQfhYy.js");const c=require("../provisioning-Va0PH4Kk.js"),i=require("../browser-storage-jJaIht4K.js");async function v({certificateFile:t,provisioningProfileFile:e,certificatePassword:n,bundleId:s,deviceUDID:r,teamId:d,signingMode:f="development",certificateId:p}){const[u,A,o]=await Promise.all([l(t),l(e),i.parseProvisioningProfile(e)]);return g({profile:o,bundleId:s,deviceUDID:r,signingMode:f}),i.putSigningAssets({bundleID:s??o.bundleID??o.applicationIdentifier??e.name,deviceUDID:r,teamID:d??o.teamID,signingMode:f,certificateID:p,certificateP12Base64:u,certificateFileName:t.name,certificatePassword:n||void 0,provisioningProfileBase64:A,profileFileName:e.name,profile:o})}function S(t,e={}){g({profile:t.profile,bundleId:e.bundleId,deviceUDID:e.deviceUDID,signingMode:e.signingMode??t.signingMode})}function g({profile:t,bundleId:e,deviceUDID:n,signingMode:s}){if(e&&!i.profileMatchesBundleID(t,e))throw new Error(`Provisioning profile does not match bundle ID ${e}.`);if(n&&!i.profileContainsDevice(t,n))throw new Error("Provisioning profile does not include the selected iPhone.");if(s==="adhoc"&&t.getTaskAllow)throw new Error("Ad Hoc mode requires an Ad Hoc provisioning profile, not a development profile.")}async function l(t){const e=await t.arrayBuffer();let n="";const s=new Uint8Array(e);for(const r of s)n+=String.fromCharCode(r);return btoa(n)}exports.fetchLimbuildInfo=a.fetchLimbuildInfo;exports.getIOSOTAInstall=a.getIOSOTAInstall;exports.startSignedDeviceBuild=a.startSignedDeviceBuild;exports.watchBuildLogEvents=a.watchBuildLogEvents;exports.getReusableAppleSigningAssets=c.getReusableAppleSigningAssets;exports.putAppleGeneratedSigningAssets=c.putAppleGeneratedSigningAssets;exports.getLatestSigningAssets=i.getLatestSigningAssets;exports.getLatestSigningAssetsWithCertificate=i.getLatestSigningAssetsWithCertificate;exports.getSigningAssets=i.getSigningAssets;exports.parseProvisioningProfile=i.parseProvisioningProfile;exports.parseProvisioningProfileBase64=i.parseProvisioningProfileBase64;exports.parseProvisioningProfileBytes=i.parseProvisioningProfileBytes;exports.profileContainsDevice=i.profileContainsDevice;exports.profileMatchesBundleID=i.profileMatchesBundleID;exports.putSigningAssets=i.putSigningAssets;exports.fileToBase64=l;exports.importSigningAssetsFromFiles=v;exports.validateProvisioningProfileForInstall=g;exports.validateSigningAssetsForInstall=S;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const a=require("../limbuild-client-CVDwq54z.js");require("../gsa-srp-CCIfUz7Y.js");require("../index-ChhtuQ7e.js");const c=require("../provisioning-BlQMccX_.js"),i=require("../browser-storage-DLxIqZk5.js");async function v({certificateFile:t,provisioningProfileFile:e,certificatePassword:n,bundleId:s,deviceUDID:o,teamId:d,signingMode:f="development",certificateId:p}){const[u,A,r]=await Promise.all([l(t),l(e),i.parseProvisioningProfile(e)]);return g({profile:r,bundleId:s,deviceUDID:o,signingMode:f}),i.putSigningAssets({bundleID:s??r.bundleID??r.applicationIdentifier??e.name,deviceUDID:o,teamID:d??r.teamID,signingMode:f,certificateID:p,certificateP12Base64:u,certificateFileName:t.name,certificatePassword:n||void 0,provisioningProfileBase64:A,profileFileName:e.name,profile:r})}function S(t,e={}){g({profile:t.profile,bundleId:e.bundleId,deviceUDID:e.deviceUDID,signingMode:e.signingMode??t.signingMode})}function g({profile:t,bundleId:e,deviceUDID:n,signingMode:s}){if(e&&!i.profileMatchesBundleID(t,e))throw new Error(`Provisioning profile does not match bundle ID ${e}.`);if(n&&!i.profileContainsDevice(t,n))throw new Error("Provisioning profile does not include the selected iPhone.");if(s==="adhoc"&&t.getTaskAllow)throw new Error("Ad Hoc mode requires an Ad Hoc provisioning profile, not a development profile.")}async function l(t){const e=await t.arrayBuffer();let n="";const s=new Uint8Array(e);for(const o of s)n+=String.fromCharCode(o);return btoa(n)}exports.fetchLimbuildInfo=a.fetchLimbuildInfo;exports.getIOSOTAInstall=a.getIOSOTAInstall;exports.startSignedDeviceBuild=a.startSignedDeviceBuild;exports.watchBuildLogEvents=a.watchBuildLogEvents;exports.getReusableAppleSigningAssets=c.getReusableAppleSigningAssets;exports.putAppleGeneratedSigningAssets=c.putAppleGeneratedSigningAssets;exports.getLatestSigningAssets=i.getLatestSigningAssets;exports.getLatestSigningAssetsWithCertificate=i.getLatestSigningAssetsWithCertificate;exports.getSigningAssets=i.getSigningAssets;exports.parseProvisioningProfile=i.parseProvisioningProfile;exports.parseProvisioningProfileBase64=i.parseProvisioningProfileBase64;exports.parseProvisioningProfileBytes=i.parseProvisioningProfileBytes;exports.profileContainsDevice=i.profileContainsDevice;exports.profileMatchesBundleID=i.profileMatchesBundleID;exports.putSigningAssets=i.putSigningAssets;exports.fileToBase64=l;exports.importSigningAssetsFromFiles=v;exports.validateProvisioningProfileForInstall=g;exports.validateSigningAssetsForInstall=S;

package/dist/device-build/index.js

@@ -1,17 +1,18 @@
-import { f as b, g as B, s as D, w as y } from "../limbuild-client-BagK_FWE.mjs";
-import "../index-DFdCvi2_.mjs";
-import { o as C, p as E } from "../provisioning-DKbkBO-p.mjs";
-import { p as d, a as m, b as u, c as A } from "../browser-storage-Cx9eW-bm.mjs";
-import { g as M, d as T, e as F, f as H, h as N } from "../browser-storage-Cx9eW-bm.mjs";
-async function w({
+import { f as B, g as D, s as y, w as x } from "../limbuild-client-BagK_FWE.mjs";
+import "../gsa-srp-Bme3JLEi.mjs";
+import "../index-YDu8K9a4.mjs";
+import { g as E, p as L } from "../provisioning-B_DefBEp.mjs";
+import { p as d, a as m, b as u, c as A } from "../browser-storage-BnO-Ma-e.mjs";
+import { g as T, d as F, e as H, f as N, h as O } from "../browser-storage-BnO-Ma-e.mjs";
+async function I({
   certificateFile: i,
   provisioningProfileFile: e,
   certificatePassword: t,
   bundleId: n,
   deviceUDID: o,
-  teamId: l,
+  teamId: g,
   signingMode: r = "development",
-  certificateId: g
+  certificateId: l
 }) {
   const [c, p, s] = await Promise.all([
     a(i),
@@ -21,9 +22,9 @@ async function w({
   return f({ profile: s, bundleId: n, deviceUDID: o, signingMode: r }), m({
     bundleID: n ?? s.bundleID ?? s.applicationIdentifier ?? e.name,
     deviceUDID: o,
-    teamID: l ?? s.teamID,
+    teamID: g ?? s.teamID,
     signingMode: r,
-    certificateID: g,
+    certificateID: l,
     certificateP12Base64: c,
     certificateFileName: i.name,
     certificatePassword: t || void 0,
@@ -32,7 +33,7 @@ async function w({
     profile: s
   });
 }
-function I(i, e = {}) {
+function P(i, e = {}) {
   f({
     profile: i.profile,
     bundleId: e.bundleId,
@@ -62,23 +63,23 @@ async function a(i) {
   return btoa(t);
 }
 export {
-  b as fetchLimbuildInfo,
+  B as fetchLimbuildInfo,
   a as fileToBase64,
-  B as getIOSOTAInstall,
-  M as getLatestSigningAssets,
-  T as getLatestSigningAssetsWithCertificate,
-  C as getReusableAppleSigningAssets,
-  F as getSigningAssets,
-  w as importSigningAssetsFromFiles,
+  D as getIOSOTAInstall,
+  T as getLatestSigningAssets,
+  F as getLatestSigningAssetsWithCertificate,
+  E as getReusableAppleSigningAssets,
+  H as getSigningAssets,
+  I as importSigningAssetsFromFiles,
   d as parseProvisioningProfile,
-  H as parseProvisioningProfileBase64,
-  N as parseProvisioningProfileBytes,
+  N as parseProvisioningProfileBase64,
+  O as parseProvisioningProfileBytes,
   A as profileContainsDevice,
   u as profileMatchesBundleID,
-  E as putAppleGeneratedSigningAssets,
+  L as putAppleGeneratedSigningAssets,
   m as putSigningAssets,
-  D as startSignedDeviceBuild,
+  y as startSignedDeviceBuild,
   f as validateProvisioningProfileForInstall,
-  I as validateSigningAssetsForInstall,
-  y as watchBuildLogEvents
+  P as validateSigningAssetsForInstall,
+  x as watchBuildLogEvents
 };

package/dist/device-build/react.cjs

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const t=require("react"),v=require("../limbuild-client-CVDwq54z.js");require("../index-CMeQfhYy.js");function P({apiUrl:e,token:n,signingAssets:g,loadOTAInstall:I=!1}){const[w,c]=t.useState("idle"),[B,u]=t.useState([]),[h,a]=t.useState(),[x,l]=t.useState(),[E,o]=t.useState(),i=t.useRef(void 0);t.useEffect(()=>()=>{i.current?.(),i.current=void 0},[]);const m=t.useCallback(()=>{i.current?.(),i.current=void 0,c("idle"),u([]),a(void 0),l(void 0),o(void 0)},[]),q=t.useCallback(async(S={})=>{if(!e)throw new Error("apiUrl is required to start a device build.");const d=S.signingAssets??g;if(!d)throw new Error("Signing assets are required to start a device build.");i.current?.(),c("queued"),u([]),a(void 0),l(void 0),o(void 0);try{const r=await v.startSignedDeviceBuild({limbuildApiUrl:e,token:n,certificateP12Base64:d.certificateP12Base64,certificatePassword:d.certificatePassword,provisioningProfileBase64:d.provisioningProfileBase64,signedUploadUrl:S.signedUploadUrl});if(!r.execId)throw new Error("Build request did not return an exec ID.");return a(r.execId),i.current=v.watchBuildLogEvents({limbuildApiUrl:e,token:n,execId:r.execId,onLine:s=>u(f=>[...f,s]),onStatus:s=>{c(s),s==="succeeded"&&I&&v.getIOSOTAInstall({limbuildApiUrl:e,token:n,execId:r.execId}).then(l).catch(f=>o(b(f)))},onError:s=>{c("failed"),o(s.message)}}),r.execId}catch(r){c("failed"),o(b(r));return}},[e,I,g,n]);return{status:w,logs:B,execId:h,otaInstall:x,error:E,startBuild:q,reset:m}}function b(e){return e instanceof Error?e.message:String(e)}exports.useDeviceBuild=P;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const e=require("react"),f=require("../limbuild-client-CVDwq54z.js");require("../gsa-srp-CCIfUz7Y.js");require("../index-ChhtuQ7e.js");const b=require("../errors-BSkqS7U-.js");function m({apiUrl:s,token:d,signingAssets:g,loadOTAInstall:I=!1}){const[w,c]=e.useState("idle"),[B,a]=e.useState([]),[h,n]=e.useState(),[q,l]=e.useState(),[x,o]=e.useState(),t=e.useRef(void 0);e.useEffect(()=>()=>{t.current?.(),t.current=void 0},[]);const E=e.useCallback(()=>{t.current?.(),t.current=void 0,c("idle"),a([]),n(void 0),l(void 0),o(void 0)},[]),P=e.useCallback(async(S={})=>{if(!s)throw new Error("apiUrl is required to start a device build.");const u=S.signingAssets??g;if(!u)throw new Error("Signing assets are required to start a device build.");t.current?.(),c("queued"),a([]),n(void 0),l(void 0),o(void 0);try{const r=await f.startSignedDeviceBuild({limbuildApiUrl:s,token:d,certificateP12Base64:u.certificateP12Base64,certificatePassword:u.certificatePassword,provisioningProfileBase64:u.provisioningProfileBase64,signedUploadUrl:S.signedUploadUrl});if(!r.execId)throw new Error("Build request did not return an exec ID.");return n(r.execId),t.current=f.watchBuildLogEvents({limbuildApiUrl:s,token:d,execId:r.execId,onLine:i=>a(v=>[...v,i]),onStatus:i=>{c(i),i==="succeeded"&&I&&f.getIOSOTAInstall({limbuildApiUrl:s,token:d,execId:r.execId}).then(l).catch(v=>o(b.errorMessage(v)))},onError:i=>{c("failed"),o(i.message)}}),r.execId}catch(r){c("failed"),o(b.errorMessage(r));return}},[s,I,g,d]);return{status:w,logs:B,execId:h,otaInstall:q,error:x,startBuild:P,reset:E}}exports.useDeviceBuild=m;