@livx.cc/appwrap 0.42.2 → 0.42.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livx.cc/appwrap",
-  "version": "0.42.2",
+  "version": "0.42.3",
   "description": "Wrap any PWA into a native app with native capabilities (appwrap runtime + @livx.cc/native-kit).",
   "license": "MIT",
   "author": "Elya Livshitz",

package/src/cli.ts

@@ -592,7 +592,11 @@ function stampTeamId(outDir: string, cfg: AppwrapConfig, ctx?: { cwd: string; co
   writeFileSync(xcconfig, src);
 }
 
-interface ProvProfile { name: string; uuid: string; teamId: string; bundleId: string; exp: number }
+/** Profile kind, derived from the .mobileprovision payload: ProvisionsAllDevices → enterprise;
+ * ProvisionedDevices + get-task-allow → development; ProvisionedDevices w/o it → adhoc; else appstore. */
+type ProvKind = 'development' | 'adhoc' | 'enterprise' | 'appstore';
+
+interface ProvProfile { name: string; uuid: string; teamId: string; bundleId: string; exp: number; kind: ProvKind }
 
 /** Discover provisioning profiles installed on this machine (both the legacy MobileDevice dir and
  * the modern Xcode UserData dir). Each is decoded with `security cms` and reduced to the fields we
@@ -623,7 +627,11 @@ function findProvisioningProfiles(): ProvProfile[] {
         if (!name || !uuid || !team || !appId || byUuid.has(uuid)) continue;
         // application-identifier is `<TEAM>.<bundle.id>`; strip the team prefix to get the bundle id.
         const bundleId = appId.startsWith(team + '.') ? appId.slice(team.length + 1) : appId;
-        byUuid.set(uuid, { name, uuid, teamId: team, bundleId, exp: expStr ? Date.parse(expStr) : 0 });
+        const kind: ProvKind = /<key>ProvisionsAllDevices<\/key>\s*<true\s*\/>/.test(raw) ? 'enterprise'
+          : /<key>ProvisionedDevices<\/key>/.test(raw)
+            ? (/<key>get-task-allow<\/key>\s*<true\s*\/>/.test(raw) ? 'development' : 'adhoc')
+            : 'appstore';
+        byUuid.set(uuid, { name, uuid, teamId: team, bundleId, exp: expStr ? Date.parse(expStr) : 0, kind });
       } catch { /* skip unreadable profile */ }
     }
   }
@@ -635,10 +643,14 @@ function findProvisioningProfiles(): ProvProfile[] {
  * pinned) → newest-expiry (headless). Returns null when nothing matches (caller warns + skips). */
 function selectSigningProfile(
   profiles: ProvProfile[], teamId: string, bundleId: string, cfg: AppwrapConfig,
-  ctx?: { configPath: string },
+  ctx?: { configPath: string }, kind: ProvKind | 'device' = 'device',
 ): string | null {
   const now = Date.now();
-  const matches = profiles.filter((p) => p.teamId === teamId && p.bundleId === bundleId && p.exp > now);
+  // 'appstore' (store archive) must sign with an App Store distribution profile; 'device' (deploy)
+  // must NOT — an appstore profile can't install on a device. Filtering here is what keeps ONE
+  // signingProfiles pin map safe: a pin of the wrong kind simply doesn't match this lane.
+  const kindOk = (p: ProvProfile): boolean => (kind === 'device' ? p.kind !== 'appstore' : p.kind === kind);
+  const matches = profiles.filter((p) => p.teamId === teamId && p.bundleId === bundleId && p.exp > now && kindOk(p));
   if (matches.length === 0) return null;
   const pinned = cfg.signingProfiles?.[bundleId];
   if (pinned && matches.some((p) => p.name === pinned)) return pinned;
@@ -678,14 +690,31 @@ function stampManualSigning(outDir: string, cfg: AppwrapConfig, ctx?: { configPa
     console.warn('  ⚠ signing: manual but teamId is unset — skipping manual signing.');
     return;
   }
+  // Store archives (`appwrap build ios --release`) sign with App Store distribution profiles +
+  // "Apple Distribution"; device deploys with development/adhoc profiles + "Apple Development".
+  // A signing-DISABLED archive that's re-signed at exportArchive gets its entitlements SYNTHESIZED
+  // from the profile (dropping app.entitlements — e.g. declared-age-range); signing the archive
+  // itself is what preserves them, so the store lane rides this same manual stamp.
+  const kind: ProvKind | 'device' = process.env.APPWRAP_SIGNING_KIND === 'appstore' ? 'appstore' : 'device';
+  const identity = kind === 'appstore' ? 'Apple Distribution' : 'Apple Development';
+  // Don't pin interactive picks from the store lane — the single signingProfiles map is keyed by
+  // bundle id only, so a store pin would clobber the device pin (and vice versa).
+  const pinCtx = kind === 'device' ? ctx : undefined;
   const profiles = findProvisioningProfiles();
   let mainProvision: string | null = null;
 
   // Main app target → build.xcconfig.
   const xcconfig = join(outDir, 'App_Resources/iOS/build.xcconfig');
   if (existsSync(xcconfig)) {
-    const name = selectSigningProfile(profiles, teamId, cfg.id, cfg, ctx);
+    const name = selectSigningProfile(profiles, teamId, cfg.id, cfg, pinCtx, kind);
     if (!name) {
+      // Store lane must NOT fall through to automatic signing: an unsigned archive gets its
+      // entitlements re-synthesized from the profile at export, silently dropping any
+      // config-stamped entitlement (the declared-age-range failure this lane exists to prevent).
+      if (kind === 'appstore') {
+        console.error(`  ✗ no valid App Store distribution profile for ${cfg.id} (team ${teamId}). Install one (ASC → Profiles) or seed via Xcode, then retry.`);
+        process.exit(1);
+      }
       console.warn(`  ⚠ no valid profile for ${cfg.id} (team ${teamId}) — automatic signing will run. Install one or seed via Xcode.`);
     } else {
       mainProvision = name;
@@ -696,10 +725,10 @@ function stampManualSigning(outDir: string, cfg: AppwrapConfig, ctx?: { configPa
           ? s.replace(new RegExp(`^\\s*${key}\\s*=\\s*[^;\\n]*;?`, 'm'), `${key} = ${val};`)
           : s + `\n${key} = ${val};`;
       src = setKey(src, 'CODE_SIGN_STYLE', 'Manual');
-      src = setKey(src, 'CODE_SIGN_IDENTITY', 'Apple Development');
+      src = setKey(src, 'CODE_SIGN_IDENTITY', identity);
       src = setKey(src, 'PROVISIONING_PROFILE_SPECIFIER', name);
       writeFileSync(xcconfig, src.endsWith('\n') ? src : src + '\n');
-      console.log(`  sign ← ${cfg.id} → "${name}" (manual)`);
+      console.log(`  sign ← ${cfg.id} → "${name}" (manual, ${identity})`);
     }
   }
 
@@ -715,7 +744,7 @@ function stampManualSigning(outDir: string, cfg: AppwrapConfig, ctx?: { configPa
       if (!ext.isDirectory()) continue;
       if (!existsSync(join(extRoot, ext.name, 'extension.json'))) continue;
       const extBundle = `${cfg.id}.${ext.name}`;
-      const name = selectSigningProfile(profiles, teamId, extBundle, cfg, ctx);
+      const name = selectSigningProfile(profiles, teamId, extBundle, cfg, pinCtx, kind);
       if (!name) { console.warn(`  ⚠ no valid profile for extension ${extBundle} — it may fail to sign.`); continue; }
       extEntries.push({ bundleId: extBundle, profile: name });
       console.log(`  sign ← ${extBundle} → "${name}" (manual, via hook)`);
@@ -725,7 +754,7 @@ function stampManualSigning(outDir: string, cfg: AppwrapConfig, ctx?: { configPa
   const hookFile = join(hookDir, 'appwrap-signing.js');
   if (extEntries.length) {
     mkdirSync(hookDir, { recursive: true });
-    writeFileSync(hookFile, SIGNING_HOOK(teamId, extEntries));
+    writeFileSync(hookFile, SIGNING_HOOK(teamId, extEntries, identity));
     // NS's exportOptions reads extension profiles from this file (extensions/provisioning.json) —
     // it maps each extension bundle id → profile name so `xcodebuild -exportArchive` can build the .ipa.
     writeFileSync(join(extRoot, 'provisioning.json'),
@@ -751,11 +780,12 @@ function stampManualSigning(outDir: string, cfg: AppwrapConfig, ctx?: { configPa
  * Self-contained (no deps), zero-arg (NS DI won't choke). Per extension it upserts DEVELOPMENT_TEAM,
  * PROVISIONING_PROFILE_SPECIFIER, CODE_SIGN_STYLE=Manual, CODE_SIGN_IDENTITY in every buildSettings
  * block whose PRODUCT_BUNDLE_IDENTIFIER matches the extension's bundle id. */
-const SIGNING_HOOK = (team: string, entries: Array<{ bundleId: string; profile: string }>) => `// Generated by \`appwrap\` — stamps manual signing onto extension targets in project.pbxproj.
+const SIGNING_HOOK = (team: string, entries: Array<{ bundleId: string; profile: string }>, identity = 'Apple Development') => `// Generated by \`appwrap\` — stamps manual signing onto extension targets in project.pbxproj.
 const fs = require('fs');
 const path = require('path');
 const TEAM = ${JSON.stringify(team)};
 const ENTRIES = ${JSON.stringify(entries)};
+const IDENTITY = ${JSON.stringify(identity)};
 module.exports = function () {
   const iosDir = path.join(__dirname, '..', '..', 'platforms', 'ios');
   if (!fs.existsSync(iosDir)) return;
@@ -781,7 +811,7 @@ module.exports = function () {
       block = block.replace(/^\\s*PROVISIONING_PROFILE\\s*=\\s*[^;\\n]*;\\n?/m, '');
       block = upsert(block, 'CODE_SIGN_STYLE', 'Manual');
       block = upsert(block, 'DEVELOPMENT_TEAM', TEAM);
-      block = upsert(block, 'CODE_SIGN_IDENTITY', q('Apple Development'));
+      block = upsert(block, 'CODE_SIGN_IDENTITY', q(IDENTITY));
       block = upsert(block, 'PROVISIONING_PROFILE_SPECIFIER', q(profile));
       return block;
     });
@@ -1918,13 +1948,29 @@ async function build(cwd: string, flags: Record<string, string>, positionals: st
     console.error(`✖ ${(e as Error).message}`);
     process.exit(1);
   }
+  const release = 'release' in flags;
+  // iOS release archive = the STORE artifact. With signing:'manual', stamp App Store distribution
+  // signing (profile kind 'appstore' + "Apple Distribution") so xcodebuild archives a SIGNED binary —
+  // an unsigned archive re-signed at exportArchive gets its entitlements SYNTHESIZED from the
+  // provisioning profile, silently dropping app.entitlements (e.g. declared-age-range).
+  if (platform === 'ios' && release) process.env.APPWRAP_SIGNING_KIND = 'appstore';
   // Make sure the wrapper reflects the latest config + PWA before compiling (also validates the config).
   await sync(cwd, flags);
 
-  const release = 'release' in flags;
   const args = ['build', platform];
   if (release) args.push('--release');
-  if (platform === 'ios' && release) args.push('--for-device');
+  if (platform === 'ios' && release) {
+    args.push('--for-device');
+    // Manual signing: pass the resolved App Store profile so NS emits a manual exportOptions.plist
+    // (app + extensions via extensions/provisioning.json) for `xcodebuild -exportArchive`. The export
+    // method comes from the archive's embedded profile (Distribution → app-store), so this yields a
+    // store .ipa whose entitlements are the archive's own (app.entitlements intact).
+    const sidecar = join(outDir, '.appwrap-signing.json');
+    if (existsSync(sidecar)) {
+      const sc = JSON.parse(readFileSync(sidecar, 'utf8')) as { provision?: string };
+      if (sc.provision) args.push('--provision', sc.provision);
+    }
+  }
   if (platform === 'android' && 'aab' in flags) args.push('--aab');
 
   if (platform === 'android' && release) {
@@ -1949,7 +1995,8 @@ async function build(cwd: string, flags: Record<string, string>, positionals: st
   console.log(`▶ ns ${args.join(' ').replace(/(--key-store-password|--key-store-alias-password) [^ ]*/g, '$1 ****')}  (cwd: ${outDir})`);
   execFileSync('ns', args, { cwd: outDir, stdio: 'inherit' });
   if (platform === 'ios' && release) {
-    console.log('ℹ App Store distribution (archive + upload) goes through the fastlane release lane (native/fastlane) — needs a paid team + ASC API key.');
+    const ipa = join(outDir, 'platforms/ios/build/Release-iphoneos');
+    console.log(`ℹ Signed store .ipa in ${ipa} — upload via \`bunx @livx.cc/mcp-appstores apple-upload\` or the fastlane release lane (native/fastlane).`);
   }
 }