@limrun/ui 0.9.0-rc.9 → 0.13.3

package/src/core/device-install/operations/webusb.ts

@@ -39,7 +39,9 @@ export function findUsbmuxCandidates(device: USBDevice): UsbmuxCandidate[] {
   return candidates;
 }
 
-function findConfigurationUsbmuxCandidates(configuration: USBDevice['configurations'][number]): UsbmuxCandidate[] {
+function findConfigurationUsbmuxCandidates(
+  configuration: USBDevice['configurations'][number],
+): UsbmuxCandidate[] {
   const candidates: UsbmuxCandidate[] = [];
   for (const usbInterface of configuration.interfaces) {
     for (const alternate of usbInterface.alternates) {
@@ -68,9 +70,12 @@ export async function claimUsbmux(device: USBDevice, candidate: UsbmuxCandidate)
     await device.selectConfiguration(candidate.configurationValue);
   }
   await device.claimInterface(candidate.interfaceNumber);
-  if (candidate.alternateSetting !== 0) {
-    await device.selectAlternateInterface(candidate.interfaceNumber, candidate.alternateSetting);
-  }
+  // Always select the alternate (even alt 0). On macOS Chrome the
+  // interface's endpoints are not treated as active until the alternate
+  // is explicitly selected, which otherwise surfaces as
+  // "endpoint is not part of a claimed and selected alternate interface"
+  // on the first transferIn/transferOut.
+  await device.selectAlternateInterface(candidate.interfaceNumber, candidate.alternateSetting);
 }
 
 export function getBulkEndpoints(candidate: UsbmuxCandidate) {

package/src/core/device-install/storage/browser-storage.ts

@@ -1,4 +1,5 @@
 import type {
+  DeviceInstallSigningMode,
   ProvisioningProfileInfo,
   PutSigningAssetsInput,
   StoredPairRecord,
@@ -49,35 +50,43 @@ export async function putPairRecord(record: PairRecordPayload, metadata: { produ
 export async function getSigningAssets({
   deviceUDID,
   bundleID,
+  signingMode = 'development',
 }: {
   deviceUDID?: string;
   bundleID?: string;
+  signingMode?: DeviceInstallSigningMode;
 }) {
   const normalizedBundleID = normalizeBundleID(bundleID);
   if (!normalizedBundleID) return undefined;
   const normalizedUDID = normalizeUDID(deviceUDID);
-  const bundleScoped = await getSigningAssetsByID(signingAssetID('bundle', normalizedBundleID));
+  const bundleScoped = await getSigningAssetsByID(signingAssetID('bundle', normalizedBundleID, signingMode));
   if (bundleScoped) return bundleScoped;
   if (normalizedUDID) {
-    const exact = await getSigningAssetsByID(signingAssetID(normalizedUDID, normalizedBundleID));
+    const exact = await getSigningAssetsByID(signingAssetID(normalizedUDID, normalizedBundleID, signingMode));
     if (exact) return exact;
   }
-  const candidates = await findSigningAssetsForBundle(normalizedBundleID);
+  const candidates = await findSigningAssetsForBundle(normalizedBundleID, signingMode);
   return candidates[0];
 }
 
-export async function getLatestSigningAssets() {
+export async function getLatestSigningAssets(signingMode: DeviceInstallSigningMode = 'development') {
   const all = await getAllSigningAssets();
-  return all.sort(
-    (left, right) => new Date(right.updatedAt).getTime() - new Date(left.updatedAt).getTime(),
-  )[0];
+  return all
+    .filter((asset) => (asset.signingMode ?? 'development') === signingMode)
+    .sort((left, right) => new Date(right.updatedAt).getTime() - new Date(left.updatedAt).getTime())[0];
 }
 
-export async function getLatestSigningAssetsWithCertificate(teamID?: string) {
+export async function getLatestSigningAssetsWithCertificate(
+  teamID?: string,
+  signingMode: DeviceInstallSigningMode = 'development',
+) {
   const all = await getAllSigningAssets();
   return all
     .filter((asset) => {
-      if (!asset.certificateID || !asset.certificateP12Base64 || !asset.certificatePassword) {
+      if (!asset.certificateID || !asset.certificateP12Base64) {
+        return false;
+      }
+      if ((asset.signingMode ?? 'development') !== signingMode) {
         return false;
       }
       return !teamID || !asset.teamID || asset.teamID === teamID;
@@ -91,11 +100,13 @@ export async function putSigningAssets(input: PutSigningAssetsInput) {
     throw new Error('Cannot store signing assets without a bundle ID.');
   }
   const normalizedUDID = normalizeUDID(input.deviceUDID);
-  const id = signingAssetID('bundle', normalizedBundleID);
+  const signingMode = input.signingMode ?? 'development';
+  const id = signingAssetID('bundle', normalizedBundleID, signingMode);
   const stored: StoredSigningAssets = {
     ...input,
     id,
     deviceUDID: normalizedUDID || undefined,
+    signingMode,
     bundleID: normalizedBundleID,
     updatedAt: new Date().toISOString(),
   };
@@ -106,11 +117,16 @@ export async function putSigningAssets(input: PutSigningAssetsInput) {
   return stored;
 }
 
-export async function findSigningAssetsForBundle(bundleID?: string) {
+export async function findSigningAssetsForBundle(
+  bundleID?: string,
+  signingMode: DeviceInstallSigningMode = 'development',
+) {
   const normalized = normalizeBundleID(bundleID);
   if (!normalized) return [];
   const all = await getAllSigningAssets();
-  return all.filter((asset) => asset.bundleID === normalized);
+  return all.filter(
+    (asset) => asset.bundleID === normalized && (asset.signingMode ?? 'development') === signingMode,
+  );
 }
 
 export function profileContainsDevice(profile: ProvisioningProfileInfo, deviceUDID?: string) {
@@ -150,6 +166,14 @@ export function parseProvisioningProfileBytes(bytes: Uint8Array) {
     throw new Error('Provisioning profile plist not found.');
   }
   const xml = text.slice(start, end + '</plist>'.length);
+  // Defensively reject entity declarations before parsing: they are the vector
+  // for XML entity-expansion (billion-laughs) attacks and never appear in a
+  // real provisioning profile. The standard Apple `<!DOCTYPE plist PUBLIC ...>`
+  // (an external DTD reference with no internal entity subset) is benign —
+  // browsers' DOMParser does not fetch it — so it is intentionally allowed.
+  if (/<!ENTITY/i.test(xml)) {
+    throw new Error('Provisioning profile plist contains a disallowed ENTITY declaration.');
+  }
   const doc = new DOMParser().parseFromString(xml, 'application/xml');
   if (doc.querySelector('parsererror')) {
     throw new Error('Provisioning profile plist could not be parsed.');
@@ -174,6 +198,7 @@ export function parseProvisioningProfileBytes(bytes: Uint8Array) {
     applicationIdentifier,
     bundleID,
     provisionedDevices: stringArrayValue(value.ProvisionedDevices),
+    getTaskAllow: booleanValue(entitlements['get-task-allow']),
     expirationDate: stringValue(value.ExpirationDate),
   } satisfies ProvisioningProfileInfo;
 }
@@ -193,8 +218,8 @@ async function getAllSigningAssets() {
   );
 }
 
-function signingAssetID(deviceUDID: string, bundleID: string) {
-  return `${deviceUDID}:${bundleID}`;
+function signingAssetID(deviceUDID: string, bundleID: string, signingMode: DeviceInstallSigningMode) {
+  return `${signingMode}:${deviceUDID}:${bundleID}`;
 }
 
 function bundleIDFromApplicationIdentifier(applicationIdentifier?: string) {
@@ -237,6 +262,10 @@ function stringArrayValue(value: unknown) {
   return Array.isArray(value) ? value.filter((item): item is string => typeof item === 'string') : [];
 }
 
+function booleanValue(value: unknown) {
+  return typeof value === 'boolean' ? value : undefined;
+}
+
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value);
 }

package/src/core/device-install/types.ts

@@ -1,18 +1,14 @@
 export type DeviceInstallLog = (message: string, detail?: string) => void;
 
+export type DeviceInstallSigningMode = 'development' | 'adhoc';
+
 export type DeviceInstallStep = 'signing' | 'connect' | 'build' | 'install';
 
 export type DeviceInstallStepStatus = 'idle' | 'active' | 'complete' | 'error';
 
 export type DeviceInstallBusyAction = 'signing' | 'usb' | 'pair' | 'build' | 'install';
 
-export type DeviceInstallBuildStatus =
-  | 'idle'
-  | 'queued'
-  | 'running'
-  | 'succeeded'
-  | 'failed'
-  | 'cancelled';
+export type DeviceInstallBuildStatus = 'idle' | 'queued' | 'running' | 'succeeded' | 'failed' | 'cancelled';
 
 export type BuildLogLine = {
   type: 'command' | 'stdout' | 'stderr' | 'meta';
@@ -44,6 +40,7 @@ export type ProvisioningProfileInfo = {
   applicationIdentifier?: string;
   bundleID?: string;
   provisionedDevices: string[];
+  getTaskAllow?: boolean;
   expirationDate?: string;
 };
 
@@ -51,11 +48,12 @@ export type StoredSigningAssets = {
   id: string;
   deviceUDID?: string;
   teamID?: string;
+  signingMode?: DeviceInstallSigningMode;
   bundleID: string;
   certificateID?: string;
   certificateP12Base64: string;
   certificateFileName?: string;
-  certificatePassword: string;
+  certificatePassword?: string;
   provisioningProfileBase64: string;
   profileFileName?: string;
   profile: ProvisioningProfileInfo;

package/src/device-build/index.ts

@@ -0,0 +1,42 @@
+export {
+  fetchLimbuildInfo,
+  getIOSOTAInstall,
+  startSignedDeviceBuild,
+  watchBuildLogEvents,
+  type BuildLogEventsOptions,
+  type GetIOSOTAInstallOptions,
+  type IOSOTAInstall,
+  type LimbuildInfo,
+  type StartSignedDeviceBuildOptions,
+} from '../core/device-install/operations/limbuild-client';
+export {
+  getLatestSigningAssets,
+  getLatestSigningAssetsWithCertificate,
+  getReusableAppleSigningAssets,
+  getSigningAssets,
+  parseProvisioningProfile,
+  parseProvisioningProfileBase64,
+  parseProvisioningProfileBytes,
+  profileContainsDevice,
+  profileMatchesBundleID,
+  putAppleGeneratedSigningAssets,
+  putSigningAssets,
+  type AppleSigningAssetCacheInput,
+  type PutAppleGeneratedSigningAssetsInput,
+} from '../core/device-install';
+export {
+  fileToBase64,
+  importSigningAssetsFromFiles,
+  validateProvisioningProfileForInstall,
+  validateSigningAssetsForInstall,
+  type ImportSigningAssetsFromFilesInput,
+  type ValidateSigningAssetsOptions,
+} from './signing';
+export type {
+  BuildLogLine,
+  DeviceInstallBuildStatus,
+  DeviceInstallSigningMode,
+  ProvisioningProfileInfo,
+  PutSigningAssetsInput,
+  StoredSigningAssets,
+} from '../core/device-install/types';

package/src/device-build/react.ts

@@ -0,0 +1,131 @@
+import { useCallback, useEffect, useRef, useState } from 'react';
+import {
+  getIOSOTAInstall,
+  startSignedDeviceBuild,
+  watchBuildLogEvents,
+  type BuildLogLine,
+  type DeviceInstallBuildStatus,
+  type IOSOTAInstall,
+  type StoredSigningAssets,
+} from './index';
+
+export type UseDeviceBuildOptions = {
+  apiUrl?: string;
+  token?: string;
+  signingAssets?: StoredSigningAssets;
+  loadOTAInstall?: boolean;
+};
+
+export type StartDeviceBuildInput = {
+  signingAssets?: StoredSigningAssets;
+};
+
+export type UseDeviceBuildResult = {
+  status: DeviceInstallBuildStatus;
+  logs: BuildLogLine[];
+  execId?: string;
+  otaInstall?: IOSOTAInstall;
+  error?: string;
+  startBuild: (input?: StartDeviceBuildInput) => Promise<string | undefined>;
+  reset: () => void;
+};
+
+export function useDeviceBuild({
+  apiUrl,
+  token,
+  signingAssets,
+  loadOTAInstall = false,
+}: UseDeviceBuildOptions): UseDeviceBuildResult {
+  const [status, setStatus] = useState<DeviceInstallBuildStatus>('idle');
+  const [logs, setLogs] = useState<BuildLogLine[]>([]);
+  const [execId, setExecId] = useState<string | undefined>();
+  const [otaInstall, setOTAInstall] = useState<IOSOTAInstall | undefined>();
+  const [error, setError] = useState<string | undefined>();
+  const stopWatcherRef = useRef<(() => void) | undefined>(undefined);
+
+  useEffect(() => {
+    return () => {
+      stopWatcherRef.current?.();
+      stopWatcherRef.current = undefined;
+    };
+  }, []);
+
+  const reset = useCallback(() => {
+    stopWatcherRef.current?.();
+    stopWatcherRef.current = undefined;
+    setStatus('idle');
+    setLogs([]);
+    setExecId(undefined);
+    setOTAInstall(undefined);
+    setError(undefined);
+  }, []);
+
+  const startBuild = useCallback(
+    async (input: StartDeviceBuildInput = {}) => {
+      if (!apiUrl) {
+        throw new Error('apiUrl is required to start a device build.');
+      }
+      const activeSigningAssets = input.signingAssets ?? signingAssets;
+      if (!activeSigningAssets) {
+        throw new Error('Signing assets are required to start a device build.');
+      }
+      stopWatcherRef.current?.();
+      setStatus('queued');
+      setLogs([]);
+      setExecId(undefined);
+      setOTAInstall(undefined);
+      setError(undefined);
+      try {
+        const result = await startSignedDeviceBuild({
+          limbuildApiUrl: apiUrl,
+          token,
+          certificateP12Base64: activeSigningAssets.certificateP12Base64,
+          certificatePassword: activeSigningAssets.certificatePassword,
+          provisioningProfileBase64: activeSigningAssets.provisioningProfileBase64,
+        });
+        if (!result.execId) {
+          throw new Error('Build request did not return an exec ID.');
+        }
+        setExecId(result.execId);
+        stopWatcherRef.current = watchBuildLogEvents({
+          limbuildApiUrl: apiUrl,
+          token,
+          execId: result.execId,
+          onLine: (line) => setLogs((current) => [...current, line]),
+          onStatus: (nextStatus) => {
+            setStatus(nextStatus);
+            if (nextStatus === 'succeeded' && loadOTAInstall) {
+              void getIOSOTAInstall({ limbuildApiUrl: apiUrl, token, execId: result.execId! })
+                .then(setOTAInstall)
+                .catch((caught) => setError(errorMessage(caught)));
+            }
+          },
+          onError: (caught) => {
+            setStatus('failed');
+            setError(caught.message);
+          },
+        });
+        return result.execId;
+      } catch (caught) {
+        setStatus('failed');
+        setError(errorMessage(caught));
+        return undefined;
+      }
+    },
+    [apiUrl, loadOTAInstall, signingAssets, token],
+  );
+
+  return {
+    status,
+    logs,
+    execId,
+    otaInstall,
+    error,
+    startBuild,
+    reset,
+  };
+}
+
+function errorMessage(error: unknown) {
+  return error instanceof Error ? error.message : String(error);
+}

package/src/device-build/signing.ts

@@ -0,0 +1,94 @@
+import {
+  parseProvisioningProfile,
+  profileContainsDevice,
+  profileMatchesBundleID,
+  putSigningAssets,
+} from '../core/device-install/storage';
+import type { DeviceInstallSigningMode, StoredSigningAssets } from '../core/device-install/types';
+
+export type ImportSigningAssetsFromFilesInput = {
+  certificateFile: File;
+  provisioningProfileFile: File;
+  certificatePassword?: string;
+  bundleId?: string;
+  deviceUDID?: string;
+  teamId?: string;
+  signingMode?: DeviceInstallSigningMode;
+  certificateId?: string;
+};
+
+export type ValidateSigningAssetsOptions = {
+  bundleId?: string;
+  deviceUDID?: string;
+  signingMode?: DeviceInstallSigningMode;
+};
+
+export async function importSigningAssetsFromFiles({
+  certificateFile,
+  provisioningProfileFile,
+  certificatePassword,
+  bundleId,
+  deviceUDID,
+  teamId,
+  signingMode = 'development',
+  certificateId,
+}: ImportSigningAssetsFromFilesInput) {
+  const [certificateP12Base64, provisioningProfileBase64, profile] = await Promise.all([
+    fileToBase64(certificateFile),
+    fileToBase64(provisioningProfileFile),
+    parseProvisioningProfile(provisioningProfileFile),
+  ]);
+  validateProvisioningProfileForInstall({ profile, bundleId, deviceUDID, signingMode });
+  return putSigningAssets({
+    bundleID: bundleId ?? profile.bundleID ?? profile.applicationIdentifier ?? provisioningProfileFile.name,
+    deviceUDID,
+    teamID: teamId ?? profile.teamID,
+    signingMode,
+    certificateID: certificateId,
+    certificateP12Base64,
+    certificateFileName: certificateFile.name,
+    certificatePassword: certificatePassword || undefined,
+    provisioningProfileBase64,
+    profileFileName: provisioningProfileFile.name,
+    profile,
+  });
+}
+
+export function validateSigningAssetsForInstall(
+  assets: StoredSigningAssets,
+  options: ValidateSigningAssetsOptions = {},
+) {
+  validateProvisioningProfileForInstall({
+    profile: assets.profile,
+    bundleId: options.bundleId,
+    deviceUDID: options.deviceUDID,
+    signingMode: options.signingMode ?? assets.signingMode,
+  });
+}
+
+export function validateProvisioningProfileForInstall({
+  profile,
+  bundleId,
+  deviceUDID,
+  signingMode,
+}: Pick<StoredSigningAssets, 'profile'> & ValidateSigningAssetsOptions) {
+  if (bundleId && !profileMatchesBundleID(profile, bundleId)) {
+    throw new Error(`Provisioning profile does not match bundle ID ${bundleId}.`);
+  }
+  if (deviceUDID && !profileContainsDevice(profile, deviceUDID)) {
+    throw new Error('Provisioning profile does not include the selected iPhone.');
+  }
+  if (signingMode === 'adhoc' && profile.getTaskAllow) {
+    throw new Error('Ad Hoc mode requires an Ad Hoc provisioning profile, not a development profile.');
+  }
+}
+
+export async function fileToBase64(file: File) {
+  const buffer = await file.arrayBuffer();
+  let binary = '';
+  const bytes = new Uint8Array(buffer);
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary);
+}