@limrun/ui 0.14.0-rc.3 → 0.14.0-rc.5

package/src/core/device-install/apple/client.ts

@@ -63,12 +63,15 @@ export async function startBrowserOwnedAppleIDLogin({
     if (requiresTwoFactor) {
       twoFactorChallengeResponse = await triggerTrustedDeviceTwoFactor(relay);
       const phone = trustedPhoneNumberFromChallenge(twoFactorChallengeResponse.body);
-      // Only route codes through the phone/SMS endpoint when Apple actually
-      // falls back to phone verification (HTTP 412). The trusted-device
-      // challenge body frequently includes trusted-phone metadata even for a
-      // normal device push; routing those codes to the phone endpoint breaks
-      // trusted-device login.
-      if (twoFactorChallengeResponse.status === 412) {
+      // Route codes through the phone/SMS endpoint only when Apple actually
+      // falls back to phone verification: HTTP 412 on the trusted-device
+      // trigger, or a 2xx challenge whose body says noTrustedDevices (seen on
+      // managed Apple accounts). The trusted-device challenge body frequently
+      // includes trusted-phone metadata even for a normal device push;
+      // routing those codes to the phone endpoint breaks trusted-device
+      // login, while submitting an SMS-fallback code to the trusted-device
+      // endpoint returns 201 without completing authentication.
+      if (twoFactorChallengeResponse.status === 412 || challengeHasNoTrustedDevices(twoFactorChallengeResponse.body)) {
         if (!phone) {
           throw new Error('Apple requested phone verification but did not include a trusted phone number.');
         }
@@ -117,6 +120,10 @@ export async function startBrowserOwnedAppleIDLogin({
   }
 }
 
+function challengeHasNoTrustedDevices(body: unknown) {
+  return isRecord(body) && body.noTrustedDevices === true;
+}
+
 function trustedPhoneNumberFromChallenge(body: unknown) {
   if (!isRecord(body)) return undefined;
   const verification = isRecord(body.phoneNumberVerification) ? body.phoneNumberVerification : undefined;

package/src/core/device-install/apple/provisioning.test.ts

@@ -3,9 +3,11 @@
 import { describe, expect, test } from 'vitest';
 import {
   createAdHocProfileRequest,
+  createAppStoreProfileRequest,
   createDevelopmentProfileRequest,
   downloadDistributionCertificateRequest,
   findAdHocProfilesRequest,
+  findAppStoreProfilesRequest,
   findDevelopmentCertificatesRequest,
   findDistributionCertificatesRequest,
   submitDistributionCSRRequest,
@@ -81,4 +83,32 @@ describe('Apple provisioning request helpers', () => {
       distributionType: 'adhoc',
     });
   });
+
+  test('builds App Store profile payloads without devices and with the caller-provided name', () => {
+    expect(
+      createAppStoreProfileRequest({
+        teamID: 'TEAM',
+        appIDID: 'APP',
+        certificateID: 'CERT',
+        name: 'Acme App Store com.example.app',
+      }).payload,
+    ).toEqual({
+      teamId: 'TEAM',
+      provisioningProfileName: 'Acme App Store com.example.app',
+      certificateIds: ['CERT'],
+      appIdId: 'APP',
+      distributionType: 'store',
+      subPlatform: 'ios',
+    });
+  });
+
+  test('filters App Store profile list requests by store distribution type', () => {
+    expect(
+      findAppStoreProfilesRequest({ bundleID: 'com.example.app', teamID: 'TEAM' }).payload,
+    ).toMatchObject({
+      teamId: 'TEAM',
+      search: 'com.example.app',
+      distributionType: 'store',
+    });
+  });
 });

package/src/core/device-install/apple/provisioning.ts

@@ -141,6 +141,17 @@ export function findAdHocProfilesRequest({
   });
 }
 
+export function findAppStoreProfilesRequest({
+  bundleID,
+  teamID = '',
+}: Pick<AppleProvisioningContext, 'bundleID' | 'teamID'>) {
+  return pagedRequest('/account/ios/profile/listProvisioningProfiles.action', teamID, {
+    search: bundleID,
+    sort: 'name=asc',
+    distributionType: 'store',
+  });
+}
+
 export function registerDeviceRequest({
   deviceUDID,
   teamID = '',
@@ -280,6 +291,34 @@ export function createAdHocProfileRequest({
   } satisfies AppleProvisioningRequest;
 }
 
+/**
+ * App Store distribution profiles bind no devices, and the name is required
+ * because implementors brand profiles themselves; there is no default.
+ */
+export function createAppStoreProfileRequest({
+  teamID = '',
+  appIDID,
+  certificateID,
+  name,
+}: Pick<AppleProvisioningContext, 'teamID'> & {
+  appIDID: string;
+  certificateID: string;
+  name: string;
+}) {
+  return {
+    method: 'POST',
+    path: '/account/ios/profile/createProvisioningProfile.action',
+    payload: {
+      teamId: teamID,
+      provisioningProfileName: name,
+      certificateIds: [certificateID],
+      appIdId: appIDID,
+      distributionType: 'store',
+      subPlatform: 'ios',
+    },
+  } satisfies AppleProvisioningRequest;
+}
+
 export function downloadProfileRequest(profileID: string, teamID = '') {
   return {
     method: 'GET',

package/src/core/device-install/apple/relay.ts

@@ -15,6 +15,19 @@ export type AppleProvisioningRequest = {
   payload?: unknown;
 };
 
+/**
+ * A session-authenticated App Store Connect request proxied by the relay.
+ * Unlike provisioning requests, payloads pass through as JSON and GET
+ * parameters go into an explicit query map because the App Store Connect
+ * API uses bracketed JSON:API keys like fields[apiKeys].
+ */
+export type AppStoreConnectRequest = {
+  method?: 'GET' | 'POST';
+  path: string;
+  query?: Record<string, string>;
+  payload?: unknown;
+};
+
 type AppleRelayWebSocketMessage<T = unknown> = {
   id: string;
   ok: boolean;
@@ -154,6 +167,13 @@ export async function proxyProvisioningRequest<T = unknown>(
   return relay.request<T>('provisioning', request);
 }
 
+export async function proxyAppStoreConnectRequest<T = unknown>(
+  relay: AppleRelayWebSocketClient,
+  request: AppStoreConnectRequest,
+) {
+  return relay.request<T>('appstoreconnect', request);
+}
+
 function normalizeAppleProxyResponse<T>(response: AppleRelayResponse<T>) {
   if (response.body !== undefined || !response.rawBody) {
     return response;

package/src/core/device-install/operations/operations.ts

@@ -4,6 +4,7 @@ import type { DeviceHello, DeviceInstallLog, PairRecordPayload } from '../types'
 import { RelayClient } from './relay-client';
 import { closeUsbmuxSession, createUsbmuxSession, type UsbmuxSession } from './usbmux';
 import { claimUsbmux, findUsbmuxCandidates, requestAppleDevice, type UsbmuxCandidate } from './webusb';
+import { errorMessage } from '../../errors';
 
 export type DeviceRelayTarget = {
   device: USBDevice;
@@ -179,7 +180,12 @@ async function claimBestUsbmuxCandidate(target: DeviceRelayTarget, log: DeviceIn
       }
     }
   }
-  throw lastError instanceof Error ? lastError : new Error('Unable to claim any Apple usbmux interface.');
+  const detail = lastError ? ` (${errorMessage(lastError)})` : '';
+  throw new Error(
+    'Could not get exclusive USB access to the iPhone' +
+      `${detail}. Another app on this computer is likely connected to it. ` +
+      'Close other browser tabs that use this device, quit iPhone Mirroring, Xcode, eject iPhone in Finder windows showing the phone and try again.',
+  );
 }
 
 function pickUsbmuxCandidate(device: USBDevice) {
@@ -210,10 +216,6 @@ export function deviceRelayWebSocketUrl(registryApiUrl: string, token?: string,
   return url.toString();
 }
 
-function errorMessage(error: unknown) {
-  return error instanceof Error ? error.message : String(error);
-}
-
 async function resetUSBDevice(target: DeviceRelayTarget) {
   if (target.claimedInterfaceNumber !== undefined) {
     try {

package/src/core/device-install/storage/browser-storage.test.ts

@@ -0,0 +1,65 @@
+import forge from 'node-forge';
+import { describe, expect, test } from 'vitest';
+import { normalizeCertificateSerial, parseProvisioningProfileBase64 } from './browser-storage';
+
+function selfSignedCertificateBase64(serialNumber: string) {
+  const keys = forge.pki.rsa.generateKeyPair(1024);
+  const cert = forge.pki.createCertificate();
+  cert.publicKey = keys.publicKey;
+  cert.serialNumber = serialNumber;
+  cert.validity.notBefore = new Date();
+  cert.validity.notAfter = new Date(Date.now() + 24 * 60 * 60 * 1000);
+  const attrs = [{ name: 'commonName', value: 'Apple Development Test' }];
+  cert.setSubject(attrs);
+  cert.setIssuer(attrs);
+  cert.sign(keys.privateKey);
+  return forge.util.encode64(forge.asn1.toDer(forge.pki.certificateToAsn1(cert)).getBytes());
+}
+
+function profileBase64(certificatesBase64: string[]) {
+  const xml = `<?xml version="1.0" encoding="UTF-8"?>
+<plist version="1.0">
+<dict>
+  <key>Name</key><string>Limrun Dev</string>
+  <key>UUID</key><string>11111111-2222-3333-4444-555555555555</string>
+  <key>TeamIdentifier</key><array><string>TEAM123</string></array>
+  <key>ProvisionedDevices</key><array><string>00008030-000A</string></array>
+  <key>DeveloperCertificates</key>
+  <array>${certificatesBase64.map((c) => `<data>${c}</data>`).join('')}</array>
+  <key>Entitlements</key>
+  <dict>
+    <key>application-identifier</key><string>TEAM123.com.example.app</string>
+    <key>com.apple.developer.team-identifier</key><string>TEAM123</string>
+  </dict>
+</dict>
+</plist>`;
+  return btoa(xml);
+}
+
+describe('parseProvisioningProfileBase64', () => {
+  test('extracts embedded certificate serial numbers in normalized form', () => {
+    const parsed = parseProvisioningProfileBase64(
+      profileBase64([selfSignedCertificateBase64('00ab12cd'), selfSignedCertificateBase64('7f')]),
+    );
+    expect(parsed.certificateSerialNumbers).toEqual(['AB12CD', '7F']);
+    expect(parsed.bundleID).toBe('com.example.app');
+    expect(parsed.teamID).toBe('TEAM123');
+    expect(parsed.provisionedDevices).toEqual(['00008030-000A']);
+  });
+
+  test('skips unparseable certificates instead of failing the profile', () => {
+    const parsed = parseProvisioningProfileBase64(
+      profileBase64([btoa('not a certificate'), selfSignedCertificateBase64('1a')]),
+    );
+    expect(parsed.certificateSerialNumbers).toEqual(['1A']);
+  });
+});
+
+describe('normalizeCertificateSerial', () => {
+  test('uppercases and strips leading zeros', () => {
+    expect(normalizeCertificateSerial('00ab12')).toBe('AB12');
+    expect(normalizeCertificateSerial('AB12')).toBe('AB12');
+    expect(normalizeCertificateSerial('')).toBeUndefined();
+    expect(normalizeCertificateSerial(undefined)).toBeUndefined();
+  });
+});

package/src/core/device-install/storage/browser-storage.ts

@@ -1,3 +1,4 @@
+import forge from 'node-forge';
 import type {
   DeviceInstallSigningMode,
   ProvisioningProfileInfo,
@@ -198,11 +199,43 @@ export function parseProvisioningProfileBytes(bytes: Uint8Array) {
     applicationIdentifier,
     bundleID,
     provisionedDevices: stringArrayValue(value.ProvisionedDevices),
+    certificateSerialNumbers: certificateSerialNumbers(stringArrayValue(value.DeveloperCertificates)),
     getTaskAllow: booleanValue(entitlements['get-task-allow']),
     expirationDate: stringValue(value.ExpirationDate),
   } satisfies ProvisioningProfileInfo;
 }
 
+/**
+ * Normalizes a certificate serial number for comparison: uppercase hex
+ * without leading zeros, the format Apple's portal reports in serialNum.
+ */
+export function normalizeCertificateSerial(serial?: string) {
+  const normalized = (serial ?? '').replace(/^0+/, '').toUpperCase();
+  return normalized || undefined;
+}
+
+/**
+ * Reads the serial numbers of the DER certificates embedded in a profile's
+ * DeveloperCertificates array. Unparseable entries are skipped: a profile
+ * with an exotic certificate should degrade to weaker filtering, not fail
+ * the whole parse.
+ */
+function certificateSerialNumbers(developerCertificatesBase64: string[]) {
+  const serials: string[] = [];
+  for (const entry of developerCertificatesBase64) {
+    try {
+      // Plist <data> payloads wrap base64 across lines; atob rejects whitespace.
+      const der = atob(entry.replace(/\s+/g, ''));
+      const certificate = forge.pki.certificateFromAsn1(forge.asn1.fromDer(forge.util.createBuffer(der)));
+      const serial = normalizeCertificateSerial(certificate.serialNumber);
+      if (serial && !serials.includes(serial)) serials.push(serial);
+    } catch {
+      // Skip certificates forge cannot parse.
+    }
+  }
+  return serials;
+}
+
 async function getSigningAssetsByID(id?: string) {
   if (!id) return undefined;
   const db = await openDB(SIGNING_DB_NAME, SIGNING_DB_VERSION, SIGNING_STORE_NAME, 'id');

package/src/core/device-install/storage/index.ts

@@ -1 +1,2 @@
 export * from './browser-storage';
+export * from './secret-store';

package/src/core/device-install/storage/secret-store.ts

@@ -0,0 +1,332 @@
+/**
+ * A pluggable store for Apple signing secrets.
+ *
+ * Credential material always lands in the browser first (the Apple relay
+ * only proxies); the browser then writes it into a store implementing this
+ * interface. Limrun's org secret store is the default implementation, an
+ * IndexedDB-backed one keeps everything local, and customers can bring
+ * their own store by implementing the same interface.
+ */
+
+export const APPLE_CERTIFICATE_SECRET_TYPE = 'appleCertificate';
+export const APPLE_PROVISIONING_PROFILE_SECRET_TYPE = 'appleProvisioningProfile';
+export const APP_STORE_CONNECT_API_KEY_SECRET_TYPE = 'appStoreConnectApiKey';
+
+export type SigningSecretType =
+  | typeof APPLE_CERTIFICATE_SECRET_TYPE
+  | typeof APPLE_PROVISIONING_PROFILE_SECRET_TYPE
+  | typeof APP_STORE_CONNECT_API_KEY_SECRET_TYPE;
+
+export type SigningSecretMetadata = {
+  type: string;
+  name: string;
+  createdAt?: string;
+};
+
+/** Type-specific flat key-value payload of a signing secret. */
+export type SigningSecretData = Record<string, string>;
+
+export type SigningSecret = SigningSecretMetadata & {
+  data: SigningSecretData;
+};
+
+export interface SigningSecretStore {
+  /**
+   * Stores a secret. When a secret with the same type and name already
+   * exists its data is overwritten. Returns the stored secret; callers
+   * should use the returned data.
+   */
+  put(type: SigningSecretType, name: string, data: SigningSecretData): Promise<SigningSecret>;
+  /** Returns the secret including its data, or undefined when absent. */
+  get(type: SigningSecretType, name: string): Promise<SigningSecret | undefined>;
+  /** Lists metadata of all stored signing secrets, never their data. */
+  list(): Promise<SigningSecretMetadata[]>;
+  /** Deletes a secret; resolves even when the secret does not exist. */
+  delete(type: SigningSecretType, name: string): Promise<void>;
+}
+
+/**
+ * Apple's certificate types as defined by the App Store Connect API
+ * (https://developer.apple.com/documentation/appstoreconnectapi/certificatetype).
+ */
+export type AppleCertificateType =
+  | 'DEVELOPMENT'
+  | 'DISTRIBUTION'
+  | 'IOS_DEVELOPMENT'
+  | 'IOS_DISTRIBUTION'
+  | 'MAC_APP_DEVELOPMENT'
+  | 'MAC_APP_DISTRIBUTION'
+  | 'MAC_INSTALLER_DISTRIBUTION'
+  | 'DEVELOPER_ID_APPLICATION'
+  | 'DEVELOPER_ID_INSTALLER'
+  | 'DEVELOPER_ID_KEXT'
+  | 'PASS_TYPE_ID'
+  | 'PASS_TYPE_ID_WITH_NFC';
+
+/** Data payload of an appleCertificate secret. */
+export type AppleCertificateSecretData = {
+  certificateP12Base64: string;
+  /** Which of Apple's certificate types the p12 holds. */
+  certificateType: AppleCertificateType;
+  certificatePassword?: string;
+  teamID?: string;
+  /** Apple's portal certificate id, never a Limrun DB id. */
+  certificateID?: string;
+  /** The certificate's serial number: uppercase hex, no leading zeros. */
+  serialNumber?: string;
+  expirationDate?: string;
+};
+
+/**
+ * Data payload of an appleProvisioningProfile secret. The
+ * certificateSerialNumbers, bundleIDs and deviceIDs fields duplicate what
+ * the signed profile binds (as comma-separated lists) so profiles can be
+ * filtered by certificate, bundle ID or device without parsing every
+ * entry. Certificates are referenced by serial number, the identifier
+ * Apple embeds in the profile itself.
+ */
+export type AppleProvisioningProfileSecretData = {
+  provisioningProfileBase64: string;
+  certificateSerialNumbers?: string;
+  bundleIDs?: string;
+  deviceIDs?: string;
+  teamID?: string;
+  profileName?: string;
+  uuid?: string;
+  expirationDate?: string;
+};
+
+/**
+ * Data payload of an appStoreConnectApiKey secret: the private half of an
+ * App Store Connect API key plus the identifiers needed to sign JWTs with
+ * it. Apple serves the private key exactly once, so the stored copy is the
+ * only one.
+ */
+export type AppStoreConnectApiKeySecretData = {
+  /** Base64 of the .p8 private key PEM. */
+  privateKeyP8Base64: string;
+  /** Apple's key ID, e.g. 2X9R4HXF34. */
+  keyId: string;
+  /** Issuer ID for team keys. Absent for individual keys. */
+  issuerId?: string;
+  nickname?: string;
+  teamID?: string;
+  expirationDate?: string;
+};
+
+function compactData(data: Record<string, string | undefined>): SigningSecretData {
+  const result: SigningSecretData = {};
+  for (const [key, value] of Object.entries(data)) {
+    if (value) result[key] = value;
+  }
+  return result;
+}
+
+/** Stores an Apple certificate bundle, conventionally named `${teamID}/${certificateType}`. */
+export async function putAppleCertificateSecret(
+  store: SigningSecretStore,
+  name: string,
+  data: AppleCertificateSecretData,
+) {
+  return store.put(APPLE_CERTIFICATE_SECRET_TYPE, name, compactData(data));
+}
+
+/**
+ * Stores a provisioning profile, conventionally named `${teamID}/${uuid}`
+ * so a team can hold many profiles for the same bundle ID and certificate
+ * set; consumers select by the reference fields, not by name.
+ */
+export async function putAppleProvisioningProfileSecret(
+  store: SigningSecretStore,
+  name: string,
+  data: AppleProvisioningProfileSecretData,
+) {
+  return store.put(APPLE_PROVISIONING_PROFILE_SECRET_TYPE, name, compactData(data));
+}
+
+/**
+ * Stores an App Store Connect API key, conventionally named
+ * `${teamID}/APP_STORE_CONNECT_API_KEY`: one shared key per team.
+ */
+export async function putAppStoreConnectApiKeySecret(
+  store: SigningSecretStore,
+  name: string,
+  data: AppStoreConnectApiKeySecretData,
+) {
+  return store.put(APP_STORE_CONNECT_API_KEY_SECRET_TYPE, name, compactData(data));
+}
+
+export type LimrunSecretStoreOptions = {
+  /** Base URL of the Limrun backend API, e.g. https://api.limrun.com */
+  apiUrl: string;
+  /** Bearer token: a user or organization token. */
+  token: string;
+  /** Organization TID owning the secrets. */
+  organizationId: string;
+  /** Custom fetch, mainly for tests. */
+  fetch?: typeof fetch;
+};
+
+type BackendSecretResult = {
+  id: string;
+  type: string;
+  name: string;
+  organizationId: string;
+  data: SigningSecretData;
+  createdAt: string;
+};
+
+/**
+ * A SigningSecretStore backed by Limrun's organization secret store
+ * (`/v1/organizations/{org}/secrets`). Secrets are stored server-side and
+ * shared across the organization.
+ */
+export function createLimrunSecretStore(options: LimrunSecretStoreOptions): SigningSecretStore {
+  const doFetch = options.fetch ?? fetch.bind(globalThis);
+  const base = options.apiUrl.replace(/\/+$/, '');
+  const secretUrl = (type: string, name: string) =>
+    `${base}/v1/organizations/${encodeURIComponent(options.organizationId)}/secrets/${encodeURIComponent(
+      type,
+    )}/${encodeURIComponent(name)}`;
+  const headers = {
+    Authorization: `Bearer ${options.token}`,
+    'Content-Type': 'application/json',
+  };
+
+  async function fail(response: Response, action: string): Promise<never> {
+    let message = `${response.status}`;
+    try {
+      const body = (await response.json()) as { message?: string };
+      if (body.message) message = body.message;
+    } catch {
+      // Non-JSON error body; the status code is the best we have.
+    }
+    throw new Error(`Failed to ${action} secret: ${message}`);
+  }
+
+  return {
+    async put(type, name, data) {
+      const response = await doFetch(secretUrl(type, name), {
+        method: 'PUT',
+        headers,
+        body: JSON.stringify({ data, replace: true }),
+      });
+      if (!response.ok) await fail(response, 'store');
+      const result = (await response.json()) as BackendSecretResult;
+      return { type: result.type, name: result.name, createdAt: result.createdAt, data: result.data };
+    },
+    async get(type, name) {
+      const response = await doFetch(secretUrl(type, name), { method: 'GET', headers });
+      if (response.status === 404) return undefined;
+      if (!response.ok) await fail(response, 'fetch');
+      const result = (await response.json()) as BackendSecretResult;
+      return { type: result.type, name: result.name, createdAt: result.createdAt, data: result.data };
+    },
+    async list() {
+      const response = await doFetch(
+        `${base}/v1/organizations/${encodeURIComponent(options.organizationId)}/secrets`,
+        { method: 'GET', headers },
+      );
+      if (!response.ok) await fail(response, 'list');
+      const result = (await response.json()) as Omit<BackendSecretResult, 'data'>[];
+      return result
+        .filter(
+          (s) =>
+            s.type === APPLE_CERTIFICATE_SECRET_TYPE ||
+            s.type === APPLE_PROVISIONING_PROFILE_SECRET_TYPE ||
+            s.type === APP_STORE_CONNECT_API_KEY_SECRET_TYPE,
+        )
+        .map((s) => ({ type: s.type, name: s.name, createdAt: s.createdAt }));
+    },
+    async delete(type, name) {
+      const response = await doFetch(secretUrl(type, name), { method: 'DELETE', headers });
+      if (response.status === 404) return;
+      if (!response.ok) await fail(response, 'delete');
+    },
+  };
+}
+
+const SECRETS_DB_NAME = 'limrun-signing-secrets';
+const SECRETS_DB_VERSION = 1;
+const SECRETS_STORE_NAME = 'secrets';
+
+type BrowserStoredSecret = {
+  id: string;
+  type: string;
+  name: string;
+  data: SigningSecretData;
+  createdAt: string;
+};
+
+/**
+ * A SigningSecretStore keeping everything in the browser's IndexedDB.
+ * Nothing leaves the machine; secrets are per-browser-profile.
+ */
+export function createBrowserSecretStore(): SigningSecretStore {
+  const idOf = (type: string, name: string) => `${type}:${name}`;
+
+  function open() {
+    return new Promise<IDBDatabase>((resolve, reject) => {
+      const request = indexedDB.open(SECRETS_DB_NAME, SECRETS_DB_VERSION);
+      request.onupgradeneeded = () => {
+        const db = request.result;
+        if (!db.objectStoreNames.contains(SECRETS_STORE_NAME)) {
+          db.createObjectStore(SECRETS_STORE_NAME, { keyPath: 'id' });
+        }
+      };
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error ?? new Error('Open IndexedDB failed'));
+    });
+  }
+
+  function toPromise<T = unknown>(request: IDBRequest<T>) {
+    return new Promise<T>((resolve, reject) => {
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error ?? new Error('IndexedDB request failed'));
+    });
+  }
+
+  return {
+    async put(type, name, data) {
+      const db = await open();
+      const existing = await toPromise<BrowserStoredSecret | undefined>(
+        db.transaction(SECRETS_STORE_NAME, 'readonly').objectStore(SECRETS_STORE_NAME).get(idOf(type, name)),
+      );
+      const stored: BrowserStoredSecret = {
+        id: idOf(type, name),
+        type,
+        name,
+        data,
+        createdAt: existing?.createdAt ?? new Date().toISOString(),
+      };
+      await toPromise(
+        db.transaction(SECRETS_STORE_NAME, 'readwrite').objectStore(SECRETS_STORE_NAME).put(stored),
+      );
+      return { type, name, createdAt: stored.createdAt, data };
+    },
+    async get(type, name) {
+      const db = await open();
+      const stored = await toPromise<BrowserStoredSecret | undefined>(
+        db.transaction(SECRETS_STORE_NAME, 'readonly').objectStore(SECRETS_STORE_NAME).get(idOf(type, name)),
+      );
+      if (!stored) return undefined;
+      return { type: stored.type, name: stored.name, createdAt: stored.createdAt, data: stored.data };
+    },
+    async list() {
+      const db = await open();
+      const all = await toPromise<BrowserStoredSecret[]>(
+        db.transaction(SECRETS_STORE_NAME, 'readonly').objectStore(SECRETS_STORE_NAME).getAll(),
+      );
+      return all.map((s) => ({ type: s.type, name: s.name, createdAt: s.createdAt }));
+    },
+    async delete(type, name) {
+      const db = await open();
+      await toPromise(
+        db
+          .transaction(SECRETS_STORE_NAME, 'readwrite')
+          .objectStore(SECRETS_STORE_NAME)
+          .delete(idOf(type, name)),
+      );
+    },
+  };
+}

package/src/core/device-install/types.ts

@@ -40,6 +40,12 @@ export type ProvisioningProfileInfo = {
   applicationIdentifier?: string;
   bundleID?: string;
   provisionedDevices: string[];
+  /**
+   * Serial numbers (uppercase hex, no leading zeros) of the developer
+   * certificates embedded in the profile; the profile is only usable for
+   * signing with one of these certificates.
+   */
+  certificateSerialNumbers: string[];
   getTaskAllow?: boolean;
   expirationDate?: string;
 };

package/src/core/errors.ts

@@ -0,0 +1,3 @@
+export function errorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}