@limrun/ui 0.14.0-rc.3 → 0.14.0-rc.4

package/dist/browser-storage-BnO-Ma-e.mjs

@@ -0,0 +1,219 @@
+import { f as D } from "./index-YDu8K9a4.mjs";
+const P = "limbuild-device-pairing", x = 1, d = "pairRecords", y = "limbuild-device-signing", A = 1, c = "signingAssets";
+function l(e) {
+  return (e ?? "").replace(/-/g, "").replace(/[^a-fA-F0-9]/g, "");
+}
+function f(e) {
+  return (e ?? "").trim();
+}
+async function j(e) {
+  const t = l(e);
+  if (!t) return;
+  const r = await p(P, x, d, "udid");
+  return g(
+    r.transaction(d, "readonly").objectStore(d).get(t)
+  );
+}
+async function G(e, t = {}) {
+  const r = l(e.udid);
+  if (!r) throw new Error("Cannot store pair record without a UDID.");
+  const n = {
+    ...e,
+    udid: r,
+    productName: t.productName,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  }, i = await p(P, x, d, "udid");
+  return await g(
+    i.transaction(d, "readwrite").objectStore(d).put(n)
+  ), n;
+}
+async function M({
+  deviceUDID: e,
+  bundleID: t,
+  signingMode: r = "development"
+}) {
+  const n = f(t);
+  if (!n) return;
+  const i = l(e), o = await h(I("bundle", n, r));
+  if (o) return o;
+  if (i) {
+    const s = await h(I(i, n, r));
+    if (s) return s;
+  }
+  return (await T(n, r))[0];
+}
+async function k(e = "development") {
+  return (await b()).filter((r) => (r.signingMode ?? "development") === e).sort((r, n) => new Date(n.updatedAt).getTime() - new Date(r.updatedAt).getTime())[0];
+}
+async function V(e, t = "development") {
+  return (await b()).filter((n) => !n.certificateID || !n.certificateP12Base64 || (n.signingMode ?? "development") !== t ? !1 : !e || !n.teamID || n.teamID === e).sort((n, i) => new Date(i.updatedAt).getTime() - new Date(n.updatedAt).getTime())[0];
+}
+async function F(e) {
+  const t = f(e.bundleID);
+  if (!t)
+    throw new Error("Cannot store signing assets without a bundle ID.");
+  const r = l(e.deviceUDID), n = e.signingMode ?? "development", i = I("bundle", t, n), o = {
+    ...e,
+    id: i,
+    deviceUDID: r || void 0,
+    signingMode: n,
+    bundleID: t,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  }, a = await p(y, A, c, "id");
+  return await g(
+    a.transaction(c, "readwrite").objectStore(c).put(o)
+  ), o;
+}
+async function T(e, t = "development") {
+  const r = f(e);
+  return r ? (await b()).filter(
+    (i) => i.bundleID === r && (i.signingMode ?? "development") === t
+  ) : [];
+}
+function W(e, t) {
+  const r = l(t);
+  return !!r && e.provisionedDevices.some((n) => l(n) === r);
+}
+function $(e, t) {
+  const r = f(t), n = f(e.bundleID);
+  if (!r || !n) return !1;
+  if (n === r || n === "*") return !0;
+  if (!n.endsWith(".*")) return !1;
+  const i = n.slice(0, -1);
+  return r.startsWith(i);
+}
+async function q(e) {
+  return E(new Uint8Array(await e.arrayBuffer()));
+}
+function L(e) {
+  const t = atob(e), r = new Uint8Array(t.length);
+  for (let n = 0; n < t.length; n += 1)
+    r[n] = t.charCodeAt(n);
+  return E(r);
+}
+function E(e) {
+  const t = new TextDecoder("latin1").decode(e), r = t.indexOf("<?xml"), n = t.indexOf("</plist>");
+  if (r < 0 || n < r)
+    throw new Error("Provisioning profile plist not found.");
+  const i = t.slice(r, n + 8);
+  if (/<!ENTITY/i.test(i))
+    throw new Error("Provisioning profile plist contains a disallowed ENTITY declaration.");
+  const o = new DOMParser().parseFromString(i, "application/xml");
+  if (o.querySelector("parsererror"))
+    throw new Error("Provisioning profile plist could not be parsed.");
+  const a = o.querySelector("plist > dict");
+  if (!a)
+    throw new Error("Provisioning profile plist dictionary not found.");
+  const s = v(a);
+  if (!N(s))
+    throw new Error("Provisioning profile plist has an unexpected shape.");
+  const m = N(s.Entitlements) ? s.Entitlements : {}, S = u(m["application-identifier"]), B = _(S);
+  return {
+    name: u(s.Name),
+    uuid: u(s.UUID),
+    teamID: u(m["com.apple.developer.team-identifier"]) ?? w(s.TeamIdentifier)[0],
+    applicationIdentifier: S,
+    bundleID: B,
+    provisionedDevices: w(s.ProvisionedDevices),
+    certificateSerialNumbers: O(w(s.DeveloperCertificates)),
+    getTaskAllow: R(m["get-task-allow"]),
+    expirationDate: u(s.ExpirationDate)
+  };
+}
+function z(e) {
+  return (e ?? "").replace(/^0+/, "").toUpperCase() || void 0;
+}
+function O(e) {
+  const t = [];
+  for (const r of e)
+    try {
+      const n = atob(r.replace(/\s+/g, "")), i = D.pki.certificateFromAsn1(D.asn1.fromDer(D.util.createBuffer(n))), o = z(i.serialNumber);
+      o && !t.includes(o) && t.push(o);
+    } catch {
+    }
+  return t;
+}
+async function h(e) {
+  if (!e) return;
+  const t = await p(y, A, c, "id");
+  return g(
+    t.transaction(c, "readonly").objectStore(c).get(e)
+  );
+}
+async function b() {
+  const e = await p(y, A, c, "id");
+  return g(
+    e.transaction(c, "readonly").objectStore(c).getAll()
+  );
+}
+function I(e, t, r) {
+  return `${r}:${e}:${t}`;
+}
+function _(e) {
+  if (!e) return;
+  const t = e.indexOf(".");
+  return t >= 0 ? e.slice(t + 1) : void 0;
+}
+function v(e) {
+  switch (e.tagName) {
+    case "dict":
+      return C(e);
+    case "array":
+      return Array.from(e.children).map(v);
+    case "string":
+    case "date":
+      return e.textContent ?? "";
+    default:
+      return e.textContent ?? "";
+  }
+}
+function C(e) {
+  const t = {}, r = Array.from(e.children);
+  for (let n = 0; n < r.length; n += 2) {
+    const i = r[n], o = r[n + 1];
+    !i || i.tagName !== "key" || !o || (t[i.textContent ?? ""] = v(o));
+  }
+  return t;
+}
+function u(e) {
+  return typeof e == "string" && e ? e : void 0;
+}
+function w(e) {
+  return Array.isArray(e) ? e.filter((t) => typeof t == "string") : [];
+}
+function R(e) {
+  return typeof e == "boolean" ? e : void 0;
+}
+function N(e) {
+  return typeof e == "object" && e !== null && !Array.isArray(e);
+}
+function p(e, t, r, n) {
+  return new Promise((i, o) => {
+    const a = indexedDB.open(e, t);
+    a.onupgradeneeded = () => {
+      const s = a.result;
+      s.objectStoreNames.contains(r) || s.createObjectStore(r, { keyPath: n });
+    }, a.onsuccess = () => i(a.result), a.onerror = () => o(a.error ?? new Error("Open IndexedDB failed"));
+  });
+}
+function g(e) {
+  return new Promise((t, r) => {
+    e.onsuccess = () => t(e.result), e.onerror = () => r(e.error ?? new Error("IndexedDB request failed"));
+  });
+}
+export {
+  F as a,
+  $ as b,
+  W as c,
+  V as d,
+  M as e,
+  L as f,
+  k as g,
+  E as h,
+  f as i,
+  j,
+  G as k,
+  z as l,
+  l as n,
+  q as p
+};

package/dist/browser-storage-DLxIqZk5.js

@@ -0,0 +1 @@
+"use strict";const m=require("./index-ChhtuQ7e.js"),B="limbuild-device-pairing",x=1,l="pairRecords",A="limbuild-device-signing",y=1,c="signingAssets";function d(e){return(e??"").replace(/-/g,"").replace(/[^a-fA-F0-9]/g,"")}function u(e){return(e??"").trim()}async function C(e){const t=d(e);if(!t)return;const r=await g(B,x,l,"udid");return p(r.transaction(l,"readonly").objectStore(l).get(t))}async function T(e,t={}){const r=d(e.udid);if(!r)throw new Error("Cannot store pair record without a UDID.");const n={...e,udid:r,productName:t.productName,updatedAt:new Date().toISOString()},i=await g(B,x,l,"udid");return await p(i.transaction(l,"readwrite").objectStore(l).put(n)),n}async function R({deviceUDID:e,bundleID:t,signingMode:r="development"}){const n=u(t);if(!n)return;const i=d(e),o=await h(I("bundle",n,r));if(o)return o;if(i){const s=await h(I(i,n,r));if(s)return s}return(await M(n,r))[0]}async function O(e="development"){return(await S()).filter(r=>(r.signingMode??"development")===e).sort((r,n)=>new Date(n.updatedAt).getTime()-new Date(r.updatedAt).getTime())[0]}async function U(e,t="development"){return(await S()).filter(n=>!n.certificateID||!n.certificateP12Base64||(n.signingMode??"development")!==t?!1:!e||!n.teamID||n.teamID===e).sort((n,i)=>new Date(i.updatedAt).getTime()-new Date(n.updatedAt).getTime())[0]}async function _(e){const t=u(e.bundleID);if(!t)throw new Error("Cannot store signing assets without a bundle ID.");const r=d(e.deviceUDID),n=e.signingMode??"development",i=I("bundle",t,n),o={...e,id:i,deviceUDID:r||void 0,signingMode:n,bundleID:t,updatedAt:new Date().toISOString()},a=await g(A,y,c,"id");return await p(a.transaction(c,"readwrite").objectStore(c).put(o)),o}async function M(e,t="development"){const r=u(e);return r?(await S()).filter(i=>i.bundleID===r&&(i.signingMode??"development")===t):[]}function G(e,t){const r=d(t);return!!r&&e.provisionedDevices.some(n=>d(n)===r)}function j(e,t){const r=u(t),n=u(e.bundleID);if(!r||!n)return!1;if(n===r||n==="*")return!0;if(!n.endsWith(".*"))return!1;const i=n.slice(0,-1);return r.startsWith(i)}async function V(e){return v(new Uint8Array(await e.arrayBuffer()))}function k(e){const t=atob(e),r=new Uint8Array(t.length);for(let n=0;n<t.length;n+=1)r[n]=t.charCodeAt(n);return v(r)}function v(e){const t=new TextDecoder("latin1").decode(e),r=t.indexOf("<?xml"),n=t.indexOf("</plist>");if(r<0||n<r)throw new Error("Provisioning profile plist not found.");const i=t.slice(r,n+8);if(/<!ENTITY/i.test(i))throw new Error("Provisioning profile plist contains a disallowed ENTITY declaration.");const o=new DOMParser().parseFromString(i,"application/xml");if(o.querySelector("parsererror"))throw new Error("Provisioning profile plist could not be parsed.");const a=o.querySelector("plist > dict");if(!a)throw new Error("Provisioning profile plist dictionary not found.");const s=b(a);if(!N(s))throw new Error("Provisioning profile plist has an unexpected shape.");const D=N(s.Entitlements)?s.Entitlements:{},P=f(D["application-identifier"]),z=L(P);return{name:f(s.Name),uuid:f(s.UUID),teamID:f(D["com.apple.developer.team-identifier"])??w(s.TeamIdentifier)[0],applicationIdentifier:P,bundleID:z,provisionedDevices:w(s.ProvisionedDevices),certificateSerialNumbers:F(w(s.DeveloperCertificates)),getTaskAllow:q(D["get-task-allow"]),expirationDate:f(s.ExpirationDate)}}function E(e){return(e??"").replace(/^0+/,"").toUpperCase()||void 0}function F(e){const t=[];for(const r of e)try{const n=atob(r.replace(/\s+/g,"")),i=m.forge.pki.certificateFromAsn1(m.forge.asn1.fromDer(m.forge.util.createBuffer(n))),o=E(i.serialNumber);o&&!t.includes(o)&&t.push(o)}catch{}return t}async function h(e){if(!e)return;const t=await g(A,y,c,"id");return p(t.transaction(c,"readonly").objectStore(c).get(e))}async function S(){const e=await g(A,y,c,"id");return p(e.transaction(c,"readonly").objectStore(c).getAll())}function I(e,t,r){return`${r}:${e}:${t}`}function L(e){if(!e)return;const t=e.indexOf(".");return t>=0?e.slice(t+1):void 0}function b(e){switch(e.tagName){case"dict":return W(e);case"array":return Array.from(e.children).map(b);case"string":case"date":return e.textContent??"";default:return e.textContent??""}}function W(e){const t={},r=Array.from(e.children);for(let n=0;n<r.length;n+=2){const i=r[n],o=r[n+1];!i||i.tagName!=="key"||!o||(t[i.textContent??""]=b(o))}return t}function f(e){return typeof e=="string"&&e?e:void 0}function w(e){return Array.isArray(e)?e.filter(t=>typeof t=="string"):[]}function q(e){return typeof e=="boolean"?e:void 0}function N(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function g(e,t,r,n){return new Promise((i,o)=>{const a=indexedDB.open(e,t);a.onupgradeneeded=()=>{const s=a.result;s.objectStoreNames.contains(r)||s.createObjectStore(r,{keyPath:n})},a.onsuccess=()=>i(a.result),a.onerror=()=>o(a.error??new Error("Open IndexedDB failed"))})}function p(e){return new Promise((t,r)=>{e.onsuccess=()=>t(e.result),e.onerror=()=>r(e.error??new Error("IndexedDB request failed"))})}exports.getLatestSigningAssets=O;exports.getLatestSigningAssetsWithCertificate=U;exports.getPairRecord=C;exports.getSigningAssets=R;exports.normalizeBundleID=u;exports.normalizeCertificateSerial=E;exports.normalizeUDID=d;exports.parseProvisioningProfile=V;exports.parseProvisioningProfileBase64=k;exports.parseProvisioningProfileBytes=v;exports.profileContainsDevice=G;exports.profileMatchesBundleID=j;exports.putPairRecord=T;exports.putSigningAssets=_;

package/dist/client-D1drDXxE.js

@@ -0,0 +1 @@
+"use strict";const F=require("./gsa-srp-CCIfUz7Y.js");class g{constructor(t,r,o){this.apiUrl=t,this.token=r,this.organizationId=o}socket;nextId=1;pending=new Map;async connect(){if(this.socket&&this.socket.readyState===WebSocket.OPEN)return;const t=new WebSocket(E(this.apiUrl,this.token,this.organizationId));this.socket=t,t.onmessage=r=>this.handleMessage(r),t.onclose=()=>this.rejectPending(new Error("Apple relay WebSocket closed")),t.onerror=()=>this.rejectPending(new Error("Apple relay WebSocket failed")),await new Promise((r,o)=>{t.onopen=()=>r(),t.onerror=()=>o(new Error("Apple relay WebSocket connection failed"))})}request(t,r){const o=this.socket;if(!o||o.readyState!==WebSocket.OPEN)throw new Error("Apple relay WebSocket is not connected.");const a=String(this.nextId++),n=new Promise((p,i)=>{this.pending.set(a,{resolve:h=>p(q(h)),reject:i})});return o.send(JSON.stringify({id:a,type:t,...r===void 0?{}:{payload:r}})),n}close(){this.rejectPending(new Error("Apple relay WebSocket closed")),this.socket?.close(),this.socket=void 0}handleMessage(t){const r=JSON.parse(String(t.data)),o=this.pending.get(r.id);if(o){if(this.pending.delete(r.id),!r.ok){o.reject(new Error(r.error||"Apple relay request failed"));return}if(!r.response){o.reject(new Error("Apple relay response was empty."));return}o.resolve(r.response)}}rejectPending(t){for(const r of this.pending.values())r.reject(t);this.pending.clear()}}async function m(e,t,r){const o=new g(e,t,r);return await o.connect(),o}async function S(e,t){return e.request("srpInit",t)}async function A(e,t){return e.request("srpComplete",t)}async function P(e){return e.request("triggerTrustedDevice2FA")}async function b(e,t,r="sms"){return e.request("triggerPhone2FA",{phoneNumberId:t,mode:r})}async function k(e,t){return e.request("submitTrustedDevice2FA",{code:t})}async function T(e,t,r,o="sms"){return e.request("submitPhone2FA",{phoneNumberId:t,mode:o,code:r})}async function v(e){return e.request("finalize")}async function R(e,t){return e.request("provisioning",t)}function q(e){if(e.body!==void 0||!e.rawBody)return e;try{return{...e,body:JSON.parse(e.rawBody)}}catch{return e}}function E(e,t,r){const o=new URL(e);return o.protocol=o.protocol==="https:"?"wss:":"ws:",o.pathname=`${o.pathname.replace(/\/$/,"")}/ios/appstoreconnect/ws`,t&&o.searchParams.set("token",t),r&&o.searchParams.set("organization",r),o.toString()}async function N({registryApiUrl:e,accountName:t,password:r,token:o,organizationId:a}){const n=await m(e,o,a);try{const p=new F.AppleGsaSrpClient(t),i=await S(n,await p.init());if(i.status<200||i.status>=300)throw new Error(`Apple SRP init failed: HTTP ${i.status} ${i.rawBody??""}`.trim());if(!i.body)throw new Error("Apple SRP init response did not include a body.");const h=await p.complete(r,i.body),u=await A(n,{...h,rememberMe:!1,trustTokens:[]}),y=u.status===409;let s,d={type:"trustedDevice"};if(y){s=await P(n);const c=x(s.body);if(s.status===412){if(!c)throw new Error("Apple requested phone verification but did not include a trusted phone number.");d={type:"phone",phoneNumberId:c.id,mode:c.pushMode??"sms"},s=await b(n,c.id,c.pushMode??"sms")}if(s.status<200||s.status>=300)throw new Error(`Apple two-factor challenge failed: HTTP ${s.status} ${s.rawBody??""}`.trim())}else if(u.status<200||u.status>=300)throw new Error(`Apple SRP complete failed: HTTP ${u.status} ${u.rawBody??""}`.trim());return{relay:n,completeResponse:u,twoFactorChallengeResponse:s,requiresTwoFactor:y,finishTwoFactor:async c=>{const l=d.type==="phone"?await T(n,d.phoneNumberId,c,d.mode):await k(n,c);if(l.status<200||l.status>=300)throw new Error(`Apple two-factor code failed: HTTP ${l.status} ${l.rawBody??""}`.trim());return l},finalize:async()=>v(n),close:async()=>n.close()}}catch(p){throw n.close(),p}}function x(e){if(!f(e))return;const t=f(e.phoneNumberVerification)?e.phoneNumberVerification:void 0,r=w(t?.trustedPhoneNumber)??w(e.trustedPhoneNumber)??w(e.phoneNumber);if(!r)return;const o=r.id;if(typeof o!="number")return;const a=typeof r.pushMode=="string"?r.pushMode:typeof e.mode=="string"?e.mode:void 0;return{id:o,pushMode:a}}function w(e){return f(e)?e:void 0}function f(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}exports.AppleRelayWebSocketClient=g;exports.fetchAppleAccountSession=v;exports.openAppleRelayWebSocket=m;exports.proxyPhoneTwoFactorCode=T;exports.proxyProvisioningRequest=R;exports.proxySrpComplete=A;exports.proxySrpInit=S;exports.proxyTwoFactorCode=k;exports.startBrowserOwnedAppleIDLogin=N;exports.triggerPhoneTwoFactor=b;exports.triggerTrustedDeviceTwoFactor=P;

package/dist/{client-C8ZDEjtD.mjs → client-DSuNtWDv.mjs}

@@ -1,4 +1,4 @@
-import { A as m } from "./index-DFdCvi2_.mjs";
+import { A as m } from "./gsa-srp-Bme3JLEi.mjs";
 class g {
   constructor(t, r, o) {
     this.apiUrl = t, this.token = r, this.organizationId = o;

package/dist/components/remote-control.d.ts

@@ -14,6 +14,18 @@ interface RemoteControlProps {
     openUrl?: string;
     showFrame?: boolean;
     autoReconnect?: boolean;
+    /**
+     * Fires once when the component concludes the instance is permanently
+     * gone rather than suffering a recoverable connection blip.
+     *
+     * After a drop, the component probes the instance endpoint over HTTP;
+     * a 404 means the instance no longer exists (terminated/deleted). When
+     * that happens the component stops reconnecting and renders a built-in
+     * "terminated" message in place of the "Retry" button, and invokes this
+     * callback so the host can react (navigate away, surface its own UI,
+     * etc.). It is not called for ordinary network drops.
+     */
+    onTerminated?: () => void;
     /**
      * Enable the inspect overlay. When set, the component starts polling the
      * accessibility tree and draws boxes over each element on top of the
@@ -93,6 +105,150 @@ interface RemoteControlProps {
      * @default 2000
      */
     axMaxBackoffMs?: number;
+    /**
+     * Fires whenever the iOS simulator's camera demand state changes —
+     * i.e. an app inside the sim called
+     * `[AVCaptureSession startRunning]` or `[stopRunning]`. The
+     * component handles the `navigator.mediaDevices.getUserMedia` prompt
+     * and SDP plumbing internally; this callback is purely so the host
+     * UI can render a status indicator ("simulator is using your
+     * camera", etc.).
+     *
+     * `active` reflects whether the sim is currently asking for
+     * frames. `granted` is set only on the call that follows a
+     * `getUserMedia` attempt: `true` when the user accepted the
+     * browser prompt, `false` when they denied or the call failed
+     * (in which case the limulator side switches to a black-frame
+     * fallback so the app keeps ticking).
+     *
+     * `camera` (optional, only meaningful when `granted === true`)
+     * carries what `MediaStreamTrack.getSettings()` reported for the
+     * active capture: resolution, framerate, device label, facing
+     * mode. Use it to render a richer status indicator (e.g.
+     * "Camera · 1920×1080 · 30 fps · FaceTime HD").
+     *
+     * Only iOS instances ever fire this callback; Android instances
+     * have no camera-injector path and stay silent.
+     */
+    onCameraDemandChange?: (active: boolean, granted?: boolean, camera?: CameraCaptureInfo) => void;
+    /**
+     * Periodically (~1Hz) fires with a snapshot of the outbound
+     * camera stream's live WebRTC stats — codec, encoder
+     * implementation, hardware acceleration, encoded fps, bitrate,
+     * round-trip-time, and the encoder's
+     * `qualityLimitationReason` (which is what Meet/Zoom use to
+     * decide whether to show "Bandwidth limited" or "CPU limited"
+     * banners).
+     *
+     * Only fires while the simulator is actively pulling the
+     * camera AND `getUserMedia` was granted. `null` is emitted
+     * once when the stream goes back to idle so consumers can
+     * clear their UI without having to maintain their own
+     * timeout. The host app does not need to poll `getStats()`
+     * itself — this is the canonical place.
+     */
+    onCameraStats?: (stats: CameraStreamStats | null) => void;
+    /**
+     * Optional resolution cap for outbound camera capture.
+     *
+     * - `'auto'` (default): no extra constraint. The browser captures
+     *   at its webcam's native max; WebRTC's quality scaler may step
+     *   down resolution on the encoder side under bandwidth pressure
+     *   while still feeding the simulator at the pool's native size.
+     * - `'1080p'` / `'720p'` / `'480p'`: hard cap applied via
+     *   `getUserMedia` constraints (for new captures) and
+     *   `track.applyConstraints` (for the currently-active track),
+     *   matching the way Meet/Zoom expose a "Send resolution" picker.
+     *
+     * Bumping or lowering the cap mid-stream is supported; the
+     * change takes effect within a frame or two as the webcam
+     * re-negotiates.
+     */
+    cameraResolutionCap?: CameraResolutionCap;
+    /**
+     * Aspect ratio the simulator's virtual camera should report to apps.
+     * Picking a value here triggers a `cameraAspect` WS message to the
+     * host, which rebuilds its IOSurface ring at the matching dimensions
+     * (16:9 → 1920×1080, 4:3 → 1440×1080, 1:1 → 1080×1080, 9:16 →
+     * 1080×1920) and signals the in-sim dylib to re-handshake. iOS apps
+     * see CMSampleBuffers at the new dimensions within a frame or two.
+     *
+     * The browser still captures whatever the webcam offers; the host
+     * aspect-fills (cover, center-crop) into the new pool. Switching
+     * aspect at runtime is intentionally cheap so users can A/B preview
+     * styles without restarting the simulator.
+     *
+     * `undefined` leaves the pool untouched (the host's boot default —
+     * 16:9 / 1920×1080 — applies).
+     */
+    cameraAspect?: CameraAspect;
+}
+/**
+ * Resolution caps a host app can request on the outbound camera.
+ * `'auto'` is "let the browser decide" (no constraints beyond the
+ * 30 fps ceiling); the other options clamp width/height to the
+ * named target. Aspect ratio is preserved.
+ */
+export type CameraResolutionCap = 'auto' | '1080p' | '720p' | '480p';
+/**
+ * Aspect ratios exposed to the operator for the simulated camera.
+ * The host maps each label to concrete IOSurface dimensions; values
+ * the host doesn't recognise are silently ignored.
+ */
+export type CameraAspect = '16:9' | '4:3' | '1:1' | '9:16';
+/**
+ * Snapshot of the browser's webcam capture, mirrored from
+ * `MediaStreamTrack.getSettings()`. Forwarded to the host alongside
+ * `cameraResult` and exposed to the host app via
+ * `onCameraDemandChange` so it can render a status indicator without
+ * having to call `getStats()` itself.
+ */
+export interface CameraCaptureInfo {
+    width?: number;
+    height?: number;
+    frameRate?: number;
+    deviceId?: string;
+    label?: string;
+    facingMode?: string;
+}
+/**
+ * Live outbound-camera quality snapshot. Derived from
+ * `RTCPeerConnection.getStats()` and rate-derived deltas, sampled
+ * once per second while the camera is sending. All fields optional:
+ * some browsers omit fields (Safari rarely reports
+ * `encoderImplementation`), and the first sample after camera start
+ * has no delta-derived numbers yet.
+ */
+export interface CameraStreamStats {
+    /** "H264", "HEVC"/"H265", "VP9", "VP8", "AV1", etc. (uppercased). */
+    codec?: string;
+    /** e.g. "VideoToolbox" (hw), "OpenH264" (sw), "ExternalEncoder". */
+    encoderImplementation?: string;
+    /**
+     * Browser-reported hardware-acceleration hint. Some Chromium
+     * versions expose this via `powerEfficientEncoder`; we mirror it
+     * here so consumers don't have to know the spec quirk.
+     */
+    hardwareAccelerated?: boolean;
+    /** Outbound encoded fps over the last sample window. */
+    framesPerSecond?: number;
+    /** Cumulative encoded frame count. */
+    framesEncoded?: number;
+    /** Outbound encoded bitrate (bits/s) over the last window. */
+    bitrateBps?: number;
+    /** Width/height the encoder is currently producing. */
+    width?: number;
+    height?: number;
+    /**
+     * One of `'none' | 'cpu' | 'bandwidth' | 'other'`. Mirrors
+     * Meet/Zoom's "limited by …" banners. Anything other than
+     * `'none'` means the encoder dropped resolution to keep up.
+     */
+    qualityLimitationReason?: string;
+    /** Round-trip time in milliseconds, from the matching RTCP. */
+    rttMs?: number;
+    /** Packet-loss percentage over the last sample window (0..100). */
+    packetsLostPct?: number;
 }
 interface ScreenshotData {
     dataUri: string;

package/dist/core/device-install/storage/browser-storage.d.ts

@@ -23,6 +23,7 @@ export declare function parseProvisioningProfile(file: File): Promise<{
     applicationIdentifier: string | undefined;
     bundleID: string | undefined;
     provisionedDevices: string[];
+    certificateSerialNumbers: string[];
     getTaskAllow: boolean | undefined;
     expirationDate: string | undefined;
 }>;
@@ -33,6 +34,7 @@ export declare function parseProvisioningProfileBase64(base64: string): {
     applicationIdentifier: string | undefined;
     bundleID: string | undefined;
     provisionedDevices: string[];
+    certificateSerialNumbers: string[];
     getTaskAllow: boolean | undefined;
     expirationDate: string | undefined;
 };
@@ -43,6 +45,12 @@ export declare function parseProvisioningProfileBytes(bytes: Uint8Array): {
     applicationIdentifier: string | undefined;
     bundleID: string | undefined;
     provisionedDevices: string[];
+    certificateSerialNumbers: string[];
     getTaskAllow: boolean | undefined;
     expirationDate: string | undefined;
 };
+/**
+ * Normalizes a certificate serial number for comparison: uppercase hex
+ * without leading zeros, the format Apple's portal reports in serialNum.
+ */
+export declare function normalizeCertificateSerial(serial?: string): string | undefined;

package/dist/core/device-install/storage/index.d.ts

@@ -1 +1,2 @@
 export * from './browser-storage';
+export * from './secret-store';

package/dist/core/device-install/storage/secret-store.d.ts

@@ -0,0 +1,101 @@
+/**
+ * A pluggable store for Apple signing secrets.
+ *
+ * Credential material always lands in the browser first (the Apple relay
+ * only proxies); the browser then writes it into a store implementing this
+ * interface. Limrun's org secret store is the default implementation, an
+ * IndexedDB-backed one keeps everything local, and customers can bring
+ * their own store by implementing the same interface.
+ */
+export declare const APPLE_CERTIFICATE_SECRET_TYPE = "appleCertificate";
+export declare const APPLE_PROVISIONING_PROFILE_SECRET_TYPE = "appleProvisioningProfile";
+export type SigningSecretType = typeof APPLE_CERTIFICATE_SECRET_TYPE | typeof APPLE_PROVISIONING_PROFILE_SECRET_TYPE;
+export type SigningSecretMetadata = {
+    type: string;
+    name: string;
+    createdAt?: string;
+};
+/** Type-specific flat key-value payload of a signing secret. */
+export type SigningSecretData = Record<string, string>;
+export type SigningSecret = SigningSecretMetadata & {
+    data: SigningSecretData;
+};
+export interface SigningSecretStore {
+    /**
+     * Stores a secret. When a secret with the same type and name already
+     * exists its data is overwritten. Returns the stored secret; callers
+     * should use the returned data.
+     */
+    put(type: SigningSecretType, name: string, data: SigningSecretData): Promise<SigningSecret>;
+    /** Returns the secret including its data, or undefined when absent. */
+    get(type: SigningSecretType, name: string): Promise<SigningSecret | undefined>;
+    /** Lists metadata of all stored signing secrets, never their data. */
+    list(): Promise<SigningSecretMetadata[]>;
+    /** Deletes a secret; resolves even when the secret does not exist. */
+    delete(type: SigningSecretType, name: string): Promise<void>;
+}
+/**
+ * Apple's certificate types as defined by the App Store Connect API
+ * (https://developer.apple.com/documentation/appstoreconnectapi/certificatetype).
+ */
+export type AppleCertificateType = 'DEVELOPMENT' | 'DISTRIBUTION' | 'IOS_DEVELOPMENT' | 'IOS_DISTRIBUTION' | 'MAC_APP_DEVELOPMENT' | 'MAC_APP_DISTRIBUTION' | 'MAC_INSTALLER_DISTRIBUTION' | 'DEVELOPER_ID_APPLICATION' | 'DEVELOPER_ID_INSTALLER' | 'DEVELOPER_ID_KEXT' | 'PASS_TYPE_ID' | 'PASS_TYPE_ID_WITH_NFC';
+/** Data payload of an appleCertificate secret. */
+export type AppleCertificateSecretData = {
+    certificateP12Base64: string;
+    /** Which of Apple's certificate types the p12 holds. */
+    certificateType: AppleCertificateType;
+    certificatePassword?: string;
+    teamID?: string;
+    /** Apple's portal certificate id, never a Limrun DB id. */
+    certificateID?: string;
+    /** The certificate's serial number: uppercase hex, no leading zeros. */
+    serialNumber?: string;
+    expirationDate?: string;
+};
+/**
+ * Data payload of an appleProvisioningProfile secret. The
+ * certificateSerialNumbers, bundleIDs and deviceIDs fields duplicate what
+ * the signed profile binds (as comma-separated lists) so profiles can be
+ * filtered by certificate, bundle ID or device without parsing every
+ * entry. Certificates are referenced by serial number, the identifier
+ * Apple embeds in the profile itself.
+ */
+export type AppleProvisioningProfileSecretData = {
+    provisioningProfileBase64: string;
+    certificateSerialNumbers?: string;
+    bundleIDs?: string;
+    deviceIDs?: string;
+    teamID?: string;
+    profileName?: string;
+    uuid?: string;
+    expirationDate?: string;
+};
+/** Stores an Apple certificate bundle, conventionally named `${teamID}/${certificateType}`. */
+export declare function putAppleCertificateSecret(store: SigningSecretStore, name: string, data: AppleCertificateSecretData): Promise<SigningSecret>;
+/**
+ * Stores a provisioning profile, conventionally named `${teamID}/${uuid}`
+ * so a team can hold many profiles for the same bundle ID and certificate
+ * set; consumers select by the reference fields, not by name.
+ */
+export declare function putAppleProvisioningProfileSecret(store: SigningSecretStore, name: string, data: AppleProvisioningProfileSecretData): Promise<SigningSecret>;
+export type LimrunSecretStoreOptions = {
+    /** Base URL of the Limrun backend API, e.g. https://api.limrun.com */
+    apiUrl: string;
+    /** Bearer token: a user or organization token. */
+    token: string;
+    /** Organization TID owning the secrets. */
+    organizationId: string;
+    /** Custom fetch, mainly for tests. */
+    fetch?: typeof fetch;
+};
+/**
+ * A SigningSecretStore backed by Limrun's organization secret store
+ * (`/v1/organizations/{org}/secrets`). Secrets are stored server-side and
+ * shared across the organization.
+ */
+export declare function createLimrunSecretStore(options: LimrunSecretStoreOptions): SigningSecretStore;
+/**
+ * A SigningSecretStore keeping everything in the browser's IndexedDB.
+ * Nothing leaves the machine; secrets are per-browser-profile.
+ */
+export declare function createBrowserSecretStore(): SigningSecretStore;

package/dist/core/device-install/types.d.ts

@@ -30,6 +30,12 @@ export type ProvisioningProfileInfo = {
     applicationIdentifier?: string;
     bundleID?: string;
     provisionedDevices: string[];
+    /**
+     * Serial numbers (uppercase hex, no leading zeros) of the developer
+     * certificates embedded in the profile; the profile is only usable for
+     * signing with one of these certificates.
+     */
+    certificateSerialNumbers: string[];
     getTaskAllow?: boolean;
     expirationDate?: string;
 };

package/dist/core/errors.d.ts

@@ -0,0 +1 @@
+export declare function errorMessage(error: unknown): string;

package/dist/core/play-publish/google.d.ts

@@ -10,4 +10,4 @@ export type RequestGoogleAccessTokenInput = {
  * call loadGoogleIdentityServices beforehand (e.g. when the surrounding
  * dialog opens) to keep this call synchronous with the click.
  */
-export declare function requestGoogleAccessToken({ clientId, scope, }: RequestGoogleAccessTokenInput): Promise<string>;
+export declare function requestGoogleAccessToken(input: RequestGoogleAccessTokenInput): Promise<string>;

package/dist/device-build/index.cjs

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const a=require("../limbuild-client-CVDwq54z.js");require("../index-CMeQfhYy.js");const c=require("../provisioning-Va0PH4Kk.js"),i=require("../browser-storage-jJaIht4K.js");async function v({certificateFile:t,provisioningProfileFile:e,certificatePassword:n,bundleId:s,deviceUDID:r,teamId:d,signingMode:f="development",certificateId:p}){const[u,A,o]=await Promise.all([l(t),l(e),i.parseProvisioningProfile(e)]);return g({profile:o,bundleId:s,deviceUDID:r,signingMode:f}),i.putSigningAssets({bundleID:s??o.bundleID??o.applicationIdentifier??e.name,deviceUDID:r,teamID:d??o.teamID,signingMode:f,certificateID:p,certificateP12Base64:u,certificateFileName:t.name,certificatePassword:n||void 0,provisioningProfileBase64:A,profileFileName:e.name,profile:o})}function S(t,e={}){g({profile:t.profile,bundleId:e.bundleId,deviceUDID:e.deviceUDID,signingMode:e.signingMode??t.signingMode})}function g({profile:t,bundleId:e,deviceUDID:n,signingMode:s}){if(e&&!i.profileMatchesBundleID(t,e))throw new Error(`Provisioning profile does not match bundle ID ${e}.`);if(n&&!i.profileContainsDevice(t,n))throw new Error("Provisioning profile does not include the selected iPhone.");if(s==="adhoc"&&t.getTaskAllow)throw new Error("Ad Hoc mode requires an Ad Hoc provisioning profile, not a development profile.")}async function l(t){const e=await t.arrayBuffer();let n="";const s=new Uint8Array(e);for(const r of s)n+=String.fromCharCode(r);return btoa(n)}exports.fetchLimbuildInfo=a.fetchLimbuildInfo;exports.getIOSOTAInstall=a.getIOSOTAInstall;exports.startSignedDeviceBuild=a.startSignedDeviceBuild;exports.watchBuildLogEvents=a.watchBuildLogEvents;exports.getReusableAppleSigningAssets=c.getReusableAppleSigningAssets;exports.putAppleGeneratedSigningAssets=c.putAppleGeneratedSigningAssets;exports.getLatestSigningAssets=i.getLatestSigningAssets;exports.getLatestSigningAssetsWithCertificate=i.getLatestSigningAssetsWithCertificate;exports.getSigningAssets=i.getSigningAssets;exports.parseProvisioningProfile=i.parseProvisioningProfile;exports.parseProvisioningProfileBase64=i.parseProvisioningProfileBase64;exports.parseProvisioningProfileBytes=i.parseProvisioningProfileBytes;exports.profileContainsDevice=i.profileContainsDevice;exports.profileMatchesBundleID=i.profileMatchesBundleID;exports.putSigningAssets=i.putSigningAssets;exports.fileToBase64=l;exports.importSigningAssetsFromFiles=v;exports.validateProvisioningProfileForInstall=g;exports.validateSigningAssetsForInstall=S;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const a=require("../limbuild-client-CVDwq54z.js");require("../gsa-srp-CCIfUz7Y.js");require("../index-ChhtuQ7e.js");const c=require("../provisioning-BlQMccX_.js"),i=require("../browser-storage-DLxIqZk5.js");async function v({certificateFile:t,provisioningProfileFile:e,certificatePassword:n,bundleId:s,deviceUDID:o,teamId:d,signingMode:f="development",certificateId:p}){const[u,A,r]=await Promise.all([l(t),l(e),i.parseProvisioningProfile(e)]);return g({profile:r,bundleId:s,deviceUDID:o,signingMode:f}),i.putSigningAssets({bundleID:s??r.bundleID??r.applicationIdentifier??e.name,deviceUDID:o,teamID:d??r.teamID,signingMode:f,certificateID:p,certificateP12Base64:u,certificateFileName:t.name,certificatePassword:n||void 0,provisioningProfileBase64:A,profileFileName:e.name,profile:r})}function S(t,e={}){g({profile:t.profile,bundleId:e.bundleId,deviceUDID:e.deviceUDID,signingMode:e.signingMode??t.signingMode})}function g({profile:t,bundleId:e,deviceUDID:n,signingMode:s}){if(e&&!i.profileMatchesBundleID(t,e))throw new Error(`Provisioning profile does not match bundle ID ${e}.`);if(n&&!i.profileContainsDevice(t,n))throw new Error("Provisioning profile does not include the selected iPhone.");if(s==="adhoc"&&t.getTaskAllow)throw new Error("Ad Hoc mode requires an Ad Hoc provisioning profile, not a development profile.")}async function l(t){const e=await t.arrayBuffer();let n="";const s=new Uint8Array(e);for(const o of s)n+=String.fromCharCode(o);return btoa(n)}exports.fetchLimbuildInfo=a.fetchLimbuildInfo;exports.getIOSOTAInstall=a.getIOSOTAInstall;exports.startSignedDeviceBuild=a.startSignedDeviceBuild;exports.watchBuildLogEvents=a.watchBuildLogEvents;exports.getReusableAppleSigningAssets=c.getReusableAppleSigningAssets;exports.putAppleGeneratedSigningAssets=c.putAppleGeneratedSigningAssets;exports.getLatestSigningAssets=i.getLatestSigningAssets;exports.getLatestSigningAssetsWithCertificate=i.getLatestSigningAssetsWithCertificate;exports.getSigningAssets=i.getSigningAssets;exports.parseProvisioningProfile=i.parseProvisioningProfile;exports.parseProvisioningProfileBase64=i.parseProvisioningProfileBase64;exports.parseProvisioningProfileBytes=i.parseProvisioningProfileBytes;exports.profileContainsDevice=i.profileContainsDevice;exports.profileMatchesBundleID=i.profileMatchesBundleID;exports.putSigningAssets=i.putSigningAssets;exports.fileToBase64=l;exports.importSigningAssetsFromFiles=v;exports.validateProvisioningProfileForInstall=g;exports.validateSigningAssetsForInstall=S;

package/dist/device-build/index.js

@@ -1,9 +1,10 @@
-import { f as b, g as B, s as D, w as y } from "../limbuild-client-BagK_FWE.mjs";
-import "../index-DFdCvi2_.mjs";
-import { g as C, p as E } from "../provisioning-BmsEnF6X.mjs";
-import { p as d, a as m, b as u, c as A } from "../browser-storage-Cx9eW-bm.mjs";
-import { g as M, d as T, e as F, f as H, h as N } from "../browser-storage-Cx9eW-bm.mjs";
-async function w({
+import { f as B, g as D, s as y, w as x } from "../limbuild-client-BagK_FWE.mjs";
+import "../gsa-srp-Bme3JLEi.mjs";
+import "../index-YDu8K9a4.mjs";
+import { g as E, p as L } from "../provisioning-B_DefBEp.mjs";
+import { p as d, a as m, b as u, c as A } from "../browser-storage-BnO-Ma-e.mjs";
+import { g as T, d as F, e as H, f as N, h as O } from "../browser-storage-BnO-Ma-e.mjs";
+async function I({
   certificateFile: i,
   provisioningProfileFile: e,
   certificatePassword: t,
@@ -32,7 +33,7 @@ async function w({
     profile: s
   });
 }
-function I(i, e = {}) {
+function P(i, e = {}) {
   f({
     profile: i.profile,
     bundleId: e.bundleId,
@@ -62,23 +63,23 @@ async function a(i) {
   return btoa(t);
 }
 export {
-  b as fetchLimbuildInfo,
+  B as fetchLimbuildInfo,
   a as fileToBase64,
-  B as getIOSOTAInstall,
-  M as getLatestSigningAssets,
-  T as getLatestSigningAssetsWithCertificate,
-  C as getReusableAppleSigningAssets,
-  F as getSigningAssets,
-  w as importSigningAssetsFromFiles,
+  D as getIOSOTAInstall,
+  T as getLatestSigningAssets,
+  F as getLatestSigningAssetsWithCertificate,
+  E as getReusableAppleSigningAssets,
+  H as getSigningAssets,
+  I as importSigningAssetsFromFiles,
   d as parseProvisioningProfile,
-  H as parseProvisioningProfileBase64,
-  N as parseProvisioningProfileBytes,
+  N as parseProvisioningProfileBase64,
+  O as parseProvisioningProfileBytes,
   A as profileContainsDevice,
   u as profileMatchesBundleID,
-  E as putAppleGeneratedSigningAssets,
+  L as putAppleGeneratedSigningAssets,
   m as putSigningAssets,
-  D as startSignedDeviceBuild,
+  y as startSignedDeviceBuild,
   f as validateProvisioningProfileForInstall,
-  I as validateSigningAssetsForInstall,
-  y as watchBuildLogEvents
+  P as validateSigningAssetsForInstall,
+  x as watchBuildLogEvents
 };