@limrun/ui 0.14.0-rc.3 → 0.14.0-rc.5

package/dist/browser-storage-BnO-Ma-e.mjs

@@ -0,0 +1,219 @@
+import { f as D } from "./index-YDu8K9a4.mjs";
+const P = "limbuild-device-pairing", x = 1, d = "pairRecords", y = "limbuild-device-signing", A = 1, c = "signingAssets";
+function l(e) {
+  return (e ?? "").replace(/-/g, "").replace(/[^a-fA-F0-9]/g, "");
+}
+function f(e) {
+  return (e ?? "").trim();
+}
+async function j(e) {
+  const t = l(e);
+  if (!t) return;
+  const r = await p(P, x, d, "udid");
+  return g(
+    r.transaction(d, "readonly").objectStore(d).get(t)
+  );
+}
+async function G(e, t = {}) {
+  const r = l(e.udid);
+  if (!r) throw new Error("Cannot store pair record without a UDID.");
+  const n = {
+    ...e,
+    udid: r,
+    productName: t.productName,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  }, i = await p(P, x, d, "udid");
+  return await g(
+    i.transaction(d, "readwrite").objectStore(d).put(n)
+  ), n;
+}
+async function M({
+  deviceUDID: e,
+  bundleID: t,
+  signingMode: r = "development"
+}) {
+  const n = f(t);
+  if (!n) return;
+  const i = l(e), o = await h(I("bundle", n, r));
+  if (o) return o;
+  if (i) {
+    const s = await h(I(i, n, r));
+    if (s) return s;
+  }
+  return (await T(n, r))[0];
+}
+async function k(e = "development") {
+  return (await b()).filter((r) => (r.signingMode ?? "development") === e).sort((r, n) => new Date(n.updatedAt).getTime() - new Date(r.updatedAt).getTime())[0];
+}
+async function V(e, t = "development") {
+  return (await b()).filter((n) => !n.certificateID || !n.certificateP12Base64 || (n.signingMode ?? "development") !== t ? !1 : !e || !n.teamID || n.teamID === e).sort((n, i) => new Date(i.updatedAt).getTime() - new Date(n.updatedAt).getTime())[0];
+}
+async function F(e) {
+  const t = f(e.bundleID);
+  if (!t)
+    throw new Error("Cannot store signing assets without a bundle ID.");
+  const r = l(e.deviceUDID), n = e.signingMode ?? "development", i = I("bundle", t, n), o = {
+    ...e,
+    id: i,
+    deviceUDID: r || void 0,
+    signingMode: n,
+    bundleID: t,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  }, a = await p(y, A, c, "id");
+  return await g(
+    a.transaction(c, "readwrite").objectStore(c).put(o)
+  ), o;
+}
+async function T(e, t = "development") {
+  const r = f(e);
+  return r ? (await b()).filter(
+    (i) => i.bundleID === r && (i.signingMode ?? "development") === t
+  ) : [];
+}
+function W(e, t) {
+  const r = l(t);
+  return !!r && e.provisionedDevices.some((n) => l(n) === r);
+}
+function $(e, t) {
+  const r = f(t), n = f(e.bundleID);
+  if (!r || !n) return !1;
+  if (n === r || n === "*") return !0;
+  if (!n.endsWith(".*")) return !1;
+  const i = n.slice(0, -1);
+  return r.startsWith(i);
+}
+async function q(e) {
+  return E(new Uint8Array(await e.arrayBuffer()));
+}
+function L(e) {
+  const t = atob(e), r = new Uint8Array(t.length);
+  for (let n = 0; n < t.length; n += 1)
+    r[n] = t.charCodeAt(n);
+  return E(r);
+}
+function E(e) {
+  const t = new TextDecoder("latin1").decode(e), r = t.indexOf("<?xml"), n = t.indexOf("</plist>");
+  if (r < 0 || n < r)
+    throw new Error("Provisioning profile plist not found.");
+  const i = t.slice(r, n + 8);
+  if (/<!ENTITY/i.test(i))
+    throw new Error("Provisioning profile plist contains a disallowed ENTITY declaration.");
+  const o = new DOMParser().parseFromString(i, "application/xml");
+  if (o.querySelector("parsererror"))
+    throw new Error("Provisioning profile plist could not be parsed.");
+  const a = o.querySelector("plist > dict");
+  if (!a)
+    throw new Error("Provisioning profile plist dictionary not found.");
+  const s = v(a);
+  if (!N(s))
+    throw new Error("Provisioning profile plist has an unexpected shape.");
+  const m = N(s.Entitlements) ? s.Entitlements : {}, S = u(m["application-identifier"]), B = _(S);
+  return {
+    name: u(s.Name),
+    uuid: u(s.UUID),
+    teamID: u(m["com.apple.developer.team-identifier"]) ?? w(s.TeamIdentifier)[0],
+    applicationIdentifier: S,
+    bundleID: B,
+    provisionedDevices: w(s.ProvisionedDevices),
+    certificateSerialNumbers: O(w(s.DeveloperCertificates)),
+    getTaskAllow: R(m["get-task-allow"]),
+    expirationDate: u(s.ExpirationDate)
+  };
+}
+function z(e) {
+  return (e ?? "").replace(/^0+/, "").toUpperCase() || void 0;
+}
+function O(e) {
+  const t = [];
+  for (const r of e)
+    try {
+      const n = atob(r.replace(/\s+/g, "")), i = D.pki.certificateFromAsn1(D.asn1.fromDer(D.util.createBuffer(n))), o = z(i.serialNumber);
+      o && !t.includes(o) && t.push(o);
+    } catch {
+    }
+  return t;
+}
+async function h(e) {
+  if (!e) return;
+  const t = await p(y, A, c, "id");
+  return g(
+    t.transaction(c, "readonly").objectStore(c).get(e)
+  );
+}
+async function b() {
+  const e = await p(y, A, c, "id");
+  return g(
+    e.transaction(c, "readonly").objectStore(c).getAll()
+  );
+}
+function I(e, t, r) {
+  return `${r}:${e}:${t}`;
+}
+function _(e) {
+  if (!e) return;
+  const t = e.indexOf(".");
+  return t >= 0 ? e.slice(t + 1) : void 0;
+}
+function v(e) {
+  switch (e.tagName) {
+    case "dict":
+      return C(e);
+    case "array":
+      return Array.from(e.children).map(v);
+    case "string":
+    case "date":
+      return e.textContent ?? "";
+    default:
+      return e.textContent ?? "";
+  }
+}
+function C(e) {
+  const t = {}, r = Array.from(e.children);
+  for (let n = 0; n < r.length; n += 2) {
+    const i = r[n], o = r[n + 1];
+    !i || i.tagName !== "key" || !o || (t[i.textContent ?? ""] = v(o));
+  }
+  return t;
+}
+function u(e) {
+  return typeof e == "string" && e ? e : void 0;
+}
+function w(e) {
+  return Array.isArray(e) ? e.filter((t) => typeof t == "string") : [];
+}
+function R(e) {
+  return typeof e == "boolean" ? e : void 0;
+}
+function N(e) {
+  return typeof e == "object" && e !== null && !Array.isArray(e);
+}
+function p(e, t, r, n) {
+  return new Promise((i, o) => {
+    const a = indexedDB.open(e, t);
+    a.onupgradeneeded = () => {
+      const s = a.result;
+      s.objectStoreNames.contains(r) || s.createObjectStore(r, { keyPath: n });
+    }, a.onsuccess = () => i(a.result), a.onerror = () => o(a.error ?? new Error("Open IndexedDB failed"));
+  });
+}
+function g(e) {
+  return new Promise((t, r) => {
+    e.onsuccess = () => t(e.result), e.onerror = () => r(e.error ?? new Error("IndexedDB request failed"));
+  });
+}
+export {
+  F as a,
+  $ as b,
+  W as c,
+  V as d,
+  M as e,
+  L as f,
+  k as g,
+  E as h,
+  f as i,
+  j,
+  G as k,
+  z as l,
+  l as n,
+  q as p
+};

package/dist/browser-storage-DLxIqZk5.js

@@ -0,0 +1 @@
+"use strict";const m=require("./index-ChhtuQ7e.js"),B="limbuild-device-pairing",x=1,l="pairRecords",A="limbuild-device-signing",y=1,c="signingAssets";function d(e){return(e??"").replace(/-/g,"").replace(/[^a-fA-F0-9]/g,"")}function u(e){return(e??"").trim()}async function C(e){const t=d(e);if(!t)return;const r=await g(B,x,l,"udid");return p(r.transaction(l,"readonly").objectStore(l).get(t))}async function T(e,t={}){const r=d(e.udid);if(!r)throw new Error("Cannot store pair record without a UDID.");const n={...e,udid:r,productName:t.productName,updatedAt:new Date().toISOString()},i=await g(B,x,l,"udid");return await p(i.transaction(l,"readwrite").objectStore(l).put(n)),n}async function R({deviceUDID:e,bundleID:t,signingMode:r="development"}){const n=u(t);if(!n)return;const i=d(e),o=await h(I("bundle",n,r));if(o)return o;if(i){const s=await h(I(i,n,r));if(s)return s}return(await M(n,r))[0]}async function O(e="development"){return(await S()).filter(r=>(r.signingMode??"development")===e).sort((r,n)=>new Date(n.updatedAt).getTime()-new Date(r.updatedAt).getTime())[0]}async function U(e,t="development"){return(await S()).filter(n=>!n.certificateID||!n.certificateP12Base64||(n.signingMode??"development")!==t?!1:!e||!n.teamID||n.teamID===e).sort((n,i)=>new Date(i.updatedAt).getTime()-new Date(n.updatedAt).getTime())[0]}async function _(e){const t=u(e.bundleID);if(!t)throw new Error("Cannot store signing assets without a bundle ID.");const r=d(e.deviceUDID),n=e.signingMode??"development",i=I("bundle",t,n),o={...e,id:i,deviceUDID:r||void 0,signingMode:n,bundleID:t,updatedAt:new Date().toISOString()},a=await g(A,y,c,"id");return await p(a.transaction(c,"readwrite").objectStore(c).put(o)),o}async function M(e,t="development"){const r=u(e);return r?(await S()).filter(i=>i.bundleID===r&&(i.signingMode??"development")===t):[]}function G(e,t){const r=d(t);return!!r&&e.provisionedDevices.some(n=>d(n)===r)}function j(e,t){const r=u(t),n=u(e.bundleID);if(!r||!n)return!1;if(n===r||n==="*")return!0;if(!n.endsWith(".*"))return!1;const i=n.slice(0,-1);return r.startsWith(i)}async function V(e){return v(new Uint8Array(await e.arrayBuffer()))}function k(e){const t=atob(e),r=new Uint8Array(t.length);for(let n=0;n<t.length;n+=1)r[n]=t.charCodeAt(n);return v(r)}function v(e){const t=new TextDecoder("latin1").decode(e),r=t.indexOf("<?xml"),n=t.indexOf("</plist>");if(r<0||n<r)throw new Error("Provisioning profile plist not found.");const i=t.slice(r,n+8);if(/<!ENTITY/i.test(i))throw new Error("Provisioning profile plist contains a disallowed ENTITY declaration.");const o=new DOMParser().parseFromString(i,"application/xml");if(o.querySelector("parsererror"))throw new Error("Provisioning profile plist could not be parsed.");const a=o.querySelector("plist > dict");if(!a)throw new Error("Provisioning profile plist dictionary not found.");const s=b(a);if(!N(s))throw new Error("Provisioning profile plist has an unexpected shape.");const D=N(s.Entitlements)?s.Entitlements:{},P=f(D["application-identifier"]),z=L(P);return{name:f(s.Name),uuid:f(s.UUID),teamID:f(D["com.apple.developer.team-identifier"])??w(s.TeamIdentifier)[0],applicationIdentifier:P,bundleID:z,provisionedDevices:w(s.ProvisionedDevices),certificateSerialNumbers:F(w(s.DeveloperCertificates)),getTaskAllow:q(D["get-task-allow"]),expirationDate:f(s.ExpirationDate)}}function E(e){return(e??"").replace(/^0+/,"").toUpperCase()||void 0}function F(e){const t=[];for(const r of e)try{const n=atob(r.replace(/\s+/g,"")),i=m.forge.pki.certificateFromAsn1(m.forge.asn1.fromDer(m.forge.util.createBuffer(n))),o=E(i.serialNumber);o&&!t.includes(o)&&t.push(o)}catch{}return t}async function h(e){if(!e)return;const t=await g(A,y,c,"id");return p(t.transaction(c,"readonly").objectStore(c).get(e))}async function S(){const e=await g(A,y,c,"id");return p(e.transaction(c,"readonly").objectStore(c).getAll())}function I(e,t,r){return`${r}:${e}:${t}`}function L(e){if(!e)return;const t=e.indexOf(".");return t>=0?e.slice(t+1):void 0}function b(e){switch(e.tagName){case"dict":return W(e);case"array":return Array.from(e.children).map(b);case"string":case"date":return e.textContent??"";default:return e.textContent??""}}function W(e){const t={},r=Array.from(e.children);for(let n=0;n<r.length;n+=2){const i=r[n],o=r[n+1];!i||i.tagName!=="key"||!o||(t[i.textContent??""]=b(o))}return t}function f(e){return typeof e=="string"&&e?e:void 0}function w(e){return Array.isArray(e)?e.filter(t=>typeof t=="string"):[]}function q(e){return typeof e=="boolean"?e:void 0}function N(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function g(e,t,r,n){return new Promise((i,o)=>{const a=indexedDB.open(e,t);a.onupgradeneeded=()=>{const s=a.result;s.objectStoreNames.contains(r)||s.createObjectStore(r,{keyPath:n})},a.onsuccess=()=>i(a.result),a.onerror=()=>o(a.error??new Error("Open IndexedDB failed"))})}function p(e){return new Promise((t,r)=>{e.onsuccess=()=>t(e.result),e.onerror=()=>r(e.error??new Error("IndexedDB request failed"))})}exports.getLatestSigningAssets=O;exports.getLatestSigningAssetsWithCertificate=U;exports.getPairRecord=C;exports.getSigningAssets=R;exports.normalizeBundleID=u;exports.normalizeCertificateSerial=E;exports.normalizeUDID=d;exports.parseProvisioningProfile=V;exports.parseProvisioningProfileBase64=k;exports.parseProvisioningProfileBytes=v;exports.profileContainsDevice=G;exports.profileMatchesBundleID=j;exports.putPairRecord=T;exports.putSigningAssets=_;

package/dist/client-C9z_sgOf.js

@@ -0,0 +1 @@
+"use strict";const R=require("./gsa-srp-CCIfUz7Y.js");class g{constructor(t,r,o){this.apiUrl=t,this.token=r,this.organizationId=o}socket;nextId=1;pending=new Map;async connect(){if(this.socket&&this.socket.readyState===WebSocket.OPEN)return;const t=new WebSocket(E(this.apiUrl,this.token,this.organizationId));this.socket=t,t.onmessage=r=>this.handleMessage(r),t.onclose=()=>this.rejectPending(new Error("Apple relay WebSocket closed")),t.onerror=()=>this.rejectPending(new Error("Apple relay WebSocket failed")),await new Promise((r,o)=>{t.onopen=()=>r(),t.onerror=()=>o(new Error("Apple relay WebSocket connection failed"))})}request(t,r){const o=this.socket;if(!o||o.readyState!==WebSocket.OPEN)throw new Error("Apple relay WebSocket is not connected.");const a=String(this.nextId++),n=new Promise((p,i)=>{this.pending.set(a,{resolve:w=>p(x(w)),reject:i})});return o.send(JSON.stringify({id:a,type:t,...r===void 0?{}:{payload:r}})),n}close(){this.rejectPending(new Error("Apple relay WebSocket closed")),this.socket?.close(),this.socket=void 0}handleMessage(t){const r=JSON.parse(String(t.data)),o=this.pending.get(r.id);if(o){if(this.pending.delete(r.id),!r.ok){o.reject(new Error(r.error||"Apple relay request failed"));return}if(!r.response){o.reject(new Error("Apple relay response was empty."));return}o.resolve(r.response)}}rejectPending(t){for(const r of this.pending.values())r.reject(t);this.pending.clear()}}async function m(e,t,r){const o=new g(e,t,r);return await o.connect(),o}async function S(e,t){return e.request("srpInit",t)}async function A(e,t){return e.request("srpComplete",t)}async function P(e){return e.request("triggerTrustedDevice2FA")}async function b(e,t,r="sms"){return e.request("triggerPhone2FA",{phoneNumberId:t,mode:r})}async function k(e,t){return e.request("submitTrustedDevice2FA",{code:t})}async function T(e,t,r,o="sms"){return e.request("submitPhone2FA",{phoneNumberId:t,mode:o,code:r})}async function v(e){return e.request("finalize")}async function q(e,t){return e.request("provisioning",t)}async function F(e,t){return e.request("appstoreconnect",t)}function x(e){if(e.body!==void 0||!e.rawBody)return e;try{return{...e,body:JSON.parse(e.rawBody)}}catch{return e}}function E(e,t,r){const o=new URL(e);return o.protocol=o.protocol==="https:"?"wss:":"ws:",o.pathname=`${o.pathname.replace(/\/$/,"")}/ios/appstoreconnect/ws`,t&&o.searchParams.set("token",t),r&&o.searchParams.set("organization",r),o.toString()}async function N({registryApiUrl:e,accountName:t,password:r,token:o,organizationId:a}){const n=await m(e,o,a);try{const p=new R.AppleGsaSrpClient(t),i=await S(n,await p.init());if(i.status<200||i.status>=300)throw new Error(`Apple SRP init failed: HTTP ${i.status} ${i.rawBody??""}`.trim());if(!i.body)throw new Error("Apple SRP init response did not include a body.");const w=await p.complete(r,i.body),u=await A(n,{...w,rememberMe:!1,trustTokens:[]}),y=u.status===409;let s,d={type:"trustedDevice"};if(y){s=await P(n);const c=W(s.body);if(s.status===412||C(s.body)){if(!c)throw new Error("Apple requested phone verification but did not include a trusted phone number.");d={type:"phone",phoneNumberId:c.id,mode:c.pushMode??"sms"},s=await b(n,c.id,c.pushMode??"sms")}if(s.status<200||s.status>=300)throw new Error(`Apple two-factor challenge failed: HTTP ${s.status} ${s.rawBody??""}`.trim())}else if(u.status<200||u.status>=300)throw new Error(`Apple SRP complete failed: HTTP ${u.status} ${u.rawBody??""}`.trim());return{relay:n,completeResponse:u,twoFactorChallengeResponse:s,requiresTwoFactor:y,finishTwoFactor:async c=>{const l=d.type==="phone"?await T(n,d.phoneNumberId,c,d.mode):await k(n,c);if(l.status<200||l.status>=300)throw new Error(`Apple two-factor code failed: HTTP ${l.status} ${l.rawBody??""}`.trim());return l},finalize:async()=>v(n),close:async()=>n.close()}}catch(p){throw n.close(),p}}function C(e){return h(e)&&e.noTrustedDevices===!0}function W(e){if(!h(e))return;const t=h(e.phoneNumberVerification)?e.phoneNumberVerification:void 0,r=f(t?.trustedPhoneNumber)??f(e.trustedPhoneNumber)??f(e.phoneNumber);if(!r)return;const o=r.id;if(typeof o!="number")return;const a=typeof r.pushMode=="string"?r.pushMode:typeof e.mode=="string"?e.mode:void 0;return{id:o,pushMode:a}}function f(e){return h(e)?e:void 0}function h(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}exports.AppleRelayWebSocketClient=g;exports.fetchAppleAccountSession=v;exports.openAppleRelayWebSocket=m;exports.proxyAppStoreConnectRequest=F;exports.proxyPhoneTwoFactorCode=T;exports.proxyProvisioningRequest=q;exports.proxySrpComplete=A;exports.proxySrpInit=S;exports.proxyTwoFactorCode=k;exports.startBrowserOwnedAppleIDLogin=N;exports.triggerPhoneTwoFactor=b;exports.triggerTrustedDeviceTwoFactor=P;

package/dist/{client-C8ZDEjtD.mjs → client-CFDB4mX5.mjs}

@@ -1,4 +1,4 @@
-import { A as m } from "./index-DFdCvi2_.mjs";
+import { A as m } from "./gsa-srp-Bme3JLEi.mjs";
 class g {
   constructor(t, r, o) {
     this.apiUrl = t, this.token = r, this.organizationId = o;
@@ -8,7 +8,7 @@ class g {
   pending = /* @__PURE__ */ new Map();
   async connect() {
     if (this.socket && this.socket.readyState === WebSocket.OPEN) return;
-    const t = new WebSocket(R(this.apiUrl, this.token, this.organizationId));
+    const t = new WebSocket(N(this.apiUrl, this.token, this.organizationId));
     this.socket = t, t.onmessage = (r) => this.handleMessage(r), t.onclose = () => this.rejectPending(new Error("Apple relay WebSocket closed")), t.onerror = () => this.rejectPending(new Error("Apple relay WebSocket failed")), await new Promise((r, o) => {
       t.onopen = () => r(), t.onerror = () => o(new Error("Apple relay WebSocket connection failed"));
     });
@@ -19,7 +19,7 @@ class g {
       throw new Error("Apple relay WebSocket is not connected.");
     const c = String(this.nextId++), n = new Promise((p, i) => {
       this.pending.set(c, {
-        resolve: (h) => p(N(h)),
+        resolve: (f) => p(E(f)),
         reject: i
       });
     });
@@ -48,11 +48,11 @@ class g {
     this.pending.clear();
   }
 }
-async function b(e, t, r) {
+async function A(e, t, r) {
   const o = new g(e, t, r);
   return await o.connect(), o;
 }
-async function A(e, t) {
+async function b(e, t) {
   return e.request("srpInit", t);
 }
 async function P(e, t) {
@@ -70,13 +70,16 @@ async function T(e, t) {
 async function v(e, t, r, o = "sms") {
   return e.request("submitPhone2FA", { phoneNumberId: t, mode: o, code: r });
 }
-async function E(e) {
+async function q(e) {
   return e.request("finalize");
 }
-async function W(e, t) {
+async function x(e, t) {
   return e.request("provisioning", t);
 }
-function N(e) {
+async function M(e, t) {
+  return e.request("appstoreconnect", t);
+}
+function E(e) {
   if (e.body !== void 0 || !e.rawBody)
     return e;
   try {
@@ -88,36 +91,36 @@ function N(e) {
     return e;
   }
 }
-function R(e, t, r) {
+function N(e, t, r) {
   const o = new URL(e);
   return o.protocol = o.protocol === "https:" ? "wss:" : "ws:", o.pathname = `${o.pathname.replace(/\/$/, "")}/ios/appstoreconnect/ws`, t && o.searchParams.set("token", t), r && o.searchParams.set("organization", r), o.toString();
 }
-async function M({
+async function $({
   registryApiUrl: e,
   accountName: t,
   password: r,
   token: o,
   organizationId: c
 }) {
-  const n = await b(e, o, c);
+  const n = await A(e, o, c);
   try {
-    const p = new m(t), i = await A(n, await p.init());
+    const p = new m(t), i = await b(n, await p.init());
     if (i.status < 200 || i.status >= 300)
       throw new Error(
         `Apple SRP init failed: HTTP ${i.status} ${i.rawBody ?? ""}`.trim()
       );
     if (!i.body)
       throw new Error("Apple SRP init response did not include a body.");
-    const h = await p.complete(r, i.body), u = await P(n, {
-      ...h,
+    const f = await p.complete(r, i.body), u = await P(n, {
+      ...f,
       rememberMe: !1,
       trustTokens: []
     }), y = u.status === 409;
     let s, l = { type: "trustedDevice" };
     if (y) {
       s = await S(n);
-      const a = q(s.body);
-      if (s.status === 412) {
+      const a = F(s.body);
+      if (s.status === 412 || R(s.body)) {
         if (!a)
           throw new Error("Apple requested phone verification but did not include a trusted phone number.");
         l = {
@@ -147,16 +150,19 @@ async function M({
           );
         return d;
       },
-      finalize: async () => E(n),
+      finalize: async () => q(n),
       close: async () => n.close()
     };
   } catch (p) {
     throw n.close(), p;
   }
 }
-function q(e) {
-  if (!f(e)) return;
-  const t = f(e.phoneNumberVerification) ? e.phoneNumberVerification : void 0, r = w(t?.trustedPhoneNumber) ?? w(e.trustedPhoneNumber) ?? w(e.phoneNumber);
+function R(e) {
+  return h(e) && e.noTrustedDevices === !0;
+}
+function F(e) {
+  if (!h(e)) return;
+  const t = h(e.phoneNumberVerification) ? e.phoneNumberVerification : void 0, r = w(t?.trustedPhoneNumber) ?? w(e.trustedPhoneNumber) ?? w(e.phoneNumber);
   if (!r) return;
   const o = r.id;
   if (typeof o != "number") return;
@@ -164,21 +170,22 @@ function q(e) {
   return { id: o, pushMode: c };
 }
 function w(e) {
-  return f(e) ? e : void 0;
+  return h(e) ? e : void 0;
 }
-function f(e) {
+function h(e) {
   return typeof e == "object" && e !== null && !Array.isArray(e);
 }
 export {
   g as A,
-  v as a,
-  P as b,
-  A as c,
-  T as d,
-  S as e,
-  E as f,
-  b as o,
-  W as p,
-  M as s,
+  M as a,
+  v as b,
+  P as c,
+  b as d,
+  T as e,
+  q as f,
+  S as g,
+  A as o,
+  x as p,
+  $ as s,
   k as t
 };

package/dist/components/remote-control.d.ts

@@ -14,6 +14,18 @@ interface RemoteControlProps {
     openUrl?: string;
     showFrame?: boolean;
     autoReconnect?: boolean;
+    /**
+     * Fires once when the component concludes the instance is permanently
+     * gone rather than suffering a recoverable connection blip.
+     *
+     * After a drop, the component probes the instance endpoint over HTTP;
+     * a 404 means the instance no longer exists (terminated/deleted). When
+     * that happens the component stops reconnecting and renders a built-in
+     * "terminated" message in place of the "Retry" button, and invokes this
+     * callback so the host can react (navigate away, surface its own UI,
+     * etc.). It is not called for ordinary network drops.
+     */
+    onTerminated?: () => void;
     /**
      * Enable the inspect overlay. When set, the component starts polling the
      * accessibility tree and draws boxes over each element on top of the
@@ -93,6 +105,150 @@ interface RemoteControlProps {
      * @default 2000
      */
     axMaxBackoffMs?: number;
+    /**
+     * Fires whenever the iOS simulator's camera demand state changes —
+     * i.e. an app inside the sim called
+     * `[AVCaptureSession startRunning]` or `[stopRunning]`. The
+     * component handles the `navigator.mediaDevices.getUserMedia` prompt
+     * and SDP plumbing internally; this callback is purely so the host
+     * UI can render a status indicator ("simulator is using your
+     * camera", etc.).
+     *
+     * `active` reflects whether the sim is currently asking for
+     * frames. `granted` is set only on the call that follows a
+     * `getUserMedia` attempt: `true` when the user accepted the
+     * browser prompt, `false` when they denied or the call failed
+     * (in which case the limulator side switches to a black-frame
+     * fallback so the app keeps ticking).
+     *
+     * `camera` (optional, only meaningful when `granted === true`)
+     * carries what `MediaStreamTrack.getSettings()` reported for the
+     * active capture: resolution, framerate, device label, facing
+     * mode. Use it to render a richer status indicator (e.g.
+     * "Camera · 1920×1080 · 30 fps · FaceTime HD").
+     *
+     * Only iOS instances ever fire this callback; Android instances
+     * have no camera-injector path and stay silent.
+     */
+    onCameraDemandChange?: (active: boolean, granted?: boolean, camera?: CameraCaptureInfo) => void;
+    /**
+     * Periodically (~1Hz) fires with a snapshot of the outbound
+     * camera stream's live WebRTC stats — codec, encoder
+     * implementation, hardware acceleration, encoded fps, bitrate,
+     * round-trip-time, and the encoder's
+     * `qualityLimitationReason` (which is what Meet/Zoom use to
+     * decide whether to show "Bandwidth limited" or "CPU limited"
+     * banners).
+     *
+     * Only fires while the simulator is actively pulling the
+     * camera AND `getUserMedia` was granted. `null` is emitted
+     * once when the stream goes back to idle so consumers can
+     * clear their UI without having to maintain their own
+     * timeout. The host app does not need to poll `getStats()`
+     * itself — this is the canonical place.
+     */
+    onCameraStats?: (stats: CameraStreamStats | null) => void;
+    /**
+     * Optional resolution cap for outbound camera capture.
+     *
+     * - `'auto'` (default): no extra constraint. The browser captures
+     *   at its webcam's native max; WebRTC's quality scaler may step
+     *   down resolution on the encoder side under bandwidth pressure
+     *   while still feeding the simulator at the pool's native size.
+     * - `'1080p'` / `'720p'` / `'480p'`: hard cap applied via
+     *   `getUserMedia` constraints (for new captures) and
+     *   `track.applyConstraints` (for the currently-active track),
+     *   matching the way Meet/Zoom expose a "Send resolution" picker.
+     *
+     * Bumping or lowering the cap mid-stream is supported; the
+     * change takes effect within a frame or two as the webcam
+     * re-negotiates.
+     */
+    cameraResolutionCap?: CameraResolutionCap;
+    /**
+     * Aspect ratio the simulator's virtual camera should report to apps.
+     * Picking a value here triggers a `cameraAspect` WS message to the
+     * host, which rebuilds its IOSurface ring at the matching dimensions
+     * (16:9 → 1920×1080, 4:3 → 1440×1080, 1:1 → 1080×1080, 9:16 →
+     * 1080×1920) and signals the in-sim dylib to re-handshake. iOS apps
+     * see CMSampleBuffers at the new dimensions within a frame or two.
+     *
+     * The browser still captures whatever the webcam offers; the host
+     * aspect-fills (cover, center-crop) into the new pool. Switching
+     * aspect at runtime is intentionally cheap so users can A/B preview
+     * styles without restarting the simulator.
+     *
+     * `undefined` leaves the pool untouched (the host's boot default —
+     * 16:9 / 1920×1080 — applies).
+     */
+    cameraAspect?: CameraAspect;
+}
+/**
+ * Resolution caps a host app can request on the outbound camera.
+ * `'auto'` is "let the browser decide" (no constraints beyond the
+ * 30 fps ceiling); the other options clamp width/height to the
+ * named target. Aspect ratio is preserved.
+ */
+export type CameraResolutionCap = 'auto' | '1080p' | '720p' | '480p';
+/**
+ * Aspect ratios exposed to the operator for the simulated camera.
+ * The host maps each label to concrete IOSurface dimensions; values
+ * the host doesn't recognise are silently ignored.
+ */
+export type CameraAspect = '16:9' | '4:3' | '1:1' | '9:16';
+/**
+ * Snapshot of the browser's webcam capture, mirrored from
+ * `MediaStreamTrack.getSettings()`. Forwarded to the host alongside
+ * `cameraResult` and exposed to the host app via
+ * `onCameraDemandChange` so it can render a status indicator without
+ * having to call `getStats()` itself.
+ */
+export interface CameraCaptureInfo {
+    width?: number;
+    height?: number;
+    frameRate?: number;
+    deviceId?: string;
+    label?: string;
+    facingMode?: string;
+}
+/**
+ * Live outbound-camera quality snapshot. Derived from
+ * `RTCPeerConnection.getStats()` and rate-derived deltas, sampled
+ * once per second while the camera is sending. All fields optional:
+ * some browsers omit fields (Safari rarely reports
+ * `encoderImplementation`), and the first sample after camera start
+ * has no delta-derived numbers yet.
+ */
+export interface CameraStreamStats {
+    /** "H264", "HEVC"/"H265", "VP9", "VP8", "AV1", etc. (uppercased). */
+    codec?: string;
+    /** e.g. "VideoToolbox" (hw), "OpenH264" (sw), "ExternalEncoder". */
+    encoderImplementation?: string;
+    /**
+     * Browser-reported hardware-acceleration hint. Some Chromium
+     * versions expose this via `powerEfficientEncoder`; we mirror it
+     * here so consumers don't have to know the spec quirk.
+     */
+    hardwareAccelerated?: boolean;
+    /** Outbound encoded fps over the last sample window. */
+    framesPerSecond?: number;
+    /** Cumulative encoded frame count. */
+    framesEncoded?: number;
+    /** Outbound encoded bitrate (bits/s) over the last window. */
+    bitrateBps?: number;
+    /** Width/height the encoder is currently producing. */
+    width?: number;
+    height?: number;
+    /**
+     * One of `'none' | 'cpu' | 'bandwidth' | 'other'`. Mirrors
+     * Meet/Zoom's "limited by …" banners. Anything other than
+     * `'none'` means the encoder dropped resolution to keep up.
+     */
+    qualityLimitationReason?: string;
+    /** Round-trip time in milliseconds, from the matching RTCP. */
+    rttMs?: number;
+    /** Packet-loss percentage over the last sample window (0..100). */
+    packetsLostPct?: number;
 }
 interface ScreenshotData {
     dataUri: string;

package/dist/core/device-install/apple/provisioning.d.ts

@@ -94,6 +94,11 @@ export declare function findAdHocProfilesRequest({ bundleID, teamID, }: Pick<App
     path: string;
     payload: Record<string, unknown>;
 };
+export declare function findAppStoreProfilesRequest({ bundleID, teamID, }: Pick<AppleProvisioningContext, 'bundleID' | 'teamID'>): {
+    method: "POST";
+    path: string;
+    payload: Record<string, unknown>;
+};
 export declare function registerDeviceRequest({ deviceUDID, teamID, name, }: Pick<AppleProvisioningContext, 'deviceUDID' | 'teamID'> & {
     name?: string;
 }): {
@@ -197,6 +202,26 @@ export declare function createAdHocProfileRequest({ bundleID, teamID, appIDID, c
         subPlatform: string;
     };
 };
+/**
+ * App Store distribution profiles bind no devices, and the name is required
+ * because implementors brand profiles themselves; there is no default.
+ */
+export declare function createAppStoreProfileRequest({ teamID, appIDID, certificateID, name, }: Pick<AppleProvisioningContext, 'teamID'> & {
+    appIDID: string;
+    certificateID: string;
+    name: string;
+}): {
+    method: "POST";
+    path: string;
+    payload: {
+        teamId: string;
+        provisioningProfileName: string;
+        certificateIds: string[];
+        appIdId: string;
+        distributionType: string;
+        subPlatform: string;
+    };
+};
 export declare function downloadProfileRequest(profileID: string, teamID?: string): {
     method: "GET";
     path: string;

package/dist/core/device-install/apple/relay.d.ts

@@ -12,6 +12,18 @@ export type AppleProvisioningRequest = {
     path: string;
     payload?: unknown;
 };
+/**
+ * A session-authenticated App Store Connect request proxied by the relay.
+ * Unlike provisioning requests, payloads pass through as JSON and GET
+ * parameters go into an explicit query map because the App Store Connect
+ * API uses bracketed JSON:API keys like fields[apiKeys].
+ */
+export type AppStoreConnectRequest = {
+    method?: 'GET' | 'POST';
+    path: string;
+    query?: Record<string, string>;
+    payload?: unknown;
+};
 export declare class AppleRelayWebSocketClient {
     private readonly apiUrl;
     private readonly token?;
@@ -38,3 +50,4 @@ export declare function proxyTwoFactorCode(relay: AppleRelayWebSocketClient, cod
 export declare function proxyPhoneTwoFactorCode(relay: AppleRelayWebSocketClient, phoneNumberId: number, code: string, mode?: string): Promise<AppleRelayResponse<unknown>>;
 export declare function fetchAppleAccountSession(relay: AppleRelayWebSocketClient): Promise<AppleRelayResponse<unknown>>;
 export declare function proxyProvisioningRequest<T = unknown>(relay: AppleRelayWebSocketClient, request: AppleProvisioningRequest): Promise<AppleRelayResponse<T>>;
+export declare function proxyAppStoreConnectRequest<T = unknown>(relay: AppleRelayWebSocketClient, request: AppStoreConnectRequest): Promise<AppleRelayResponse<T>>;

package/dist/core/device-install/storage/browser-storage.d.ts

@@ -23,6 +23,7 @@ export declare function parseProvisioningProfile(file: File): Promise<{
     applicationIdentifier: string | undefined;
     bundleID: string | undefined;
     provisionedDevices: string[];
+    certificateSerialNumbers: string[];
     getTaskAllow: boolean | undefined;
     expirationDate: string | undefined;
 }>;
@@ -33,6 +34,7 @@ export declare function parseProvisioningProfileBase64(base64: string): {
     applicationIdentifier: string | undefined;
     bundleID: string | undefined;
     provisionedDevices: string[];
+    certificateSerialNumbers: string[];
     getTaskAllow: boolean | undefined;
     expirationDate: string | undefined;
 };
@@ -43,6 +45,12 @@ export declare function parseProvisioningProfileBytes(bytes: Uint8Array): {
     applicationIdentifier: string | undefined;
     bundleID: string | undefined;
     provisionedDevices: string[];
+    certificateSerialNumbers: string[];
     getTaskAllow: boolean | undefined;
     expirationDate: string | undefined;
 };
+/**
+ * Normalizes a certificate serial number for comparison: uppercase hex
+ * without leading zeros, the format Apple's portal reports in serialNum.
+ */
+export declare function normalizeCertificateSerial(serial?: string): string | undefined;

package/dist/core/device-install/storage/index.d.ts

@@ -1 +1,2 @@
 export * from './browser-storage';
+export * from './secret-store';