@mpgd/cli 0.34.0 → 0.36.0

package/dist/ios-ipa-inspection.js

@@ -0,0 +1,151 @@
+// tools/target/native-ios-inspection.ts
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdtempSync, readFileSync, rmSync, statSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+// tools/target/native-inspection-environment.ts
+var allowedInspectionEnvironmentNames = [
+  "PATH",
+  "Path",
+  "HOME",
+  "TMPDIR",
+  "TMP",
+  "TEMP",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "JAVA_HOME",
+  "ANDROID_HOME",
+  "ANDROID_SDK_ROOT",
+  "DEVELOPER_DIR",
+  "SDKROOT",
+  "SystemRoot",
+  "windir",
+  "PATHEXT",
+  "USERPROFILE"
+];
+function nativeInspectionEnvironment(source = process.env) {
+  const result = {};
+  for (const name of allowedInspectionEnvironmentNames) {
+    const value = source[name];
+    if (value !== void 0) {
+      result[name] = value;
+    }
+  }
+  return result;
+}
+
+// tools/target/native-ios-inspection.ts
+function inspectSignedIosArchive(archive, input) {
+  return inspectSignedIosApplication(path.join(archive, "Products/Applications/App.app"), input);
+}
+function inspectSignedIosIpa(ipa, input) {
+  if (!existsSync(ipa) || !statSync(ipa).isFile()) {
+    throw new Error("iOS store IPA is missing.");
+  }
+  const runner = input.runner ?? { run: runCommand };
+  const listing = runner.run("unzip", ["-Z1", ipa]);
+  if (listing.status !== 0) {
+    throw new Error("iOS store IPA could not be listed.");
+  }
+  const entries = listing.stdout.split(/\r?\n/u).filter(Boolean);
+  if (entries.some((entry) => entry.startsWith("/") || entry.includes("\\") || entry.split("/").some((segment) => segment === ".." || segment === "."))) {
+    throw new Error("iOS store IPA has an unsafe path.");
+  }
+  const appManifests = entries.filter((entry) => /^Payload\/[^/]+\.app\/Info\.plist$/u.test(entry));
+  if (appManifests.length !== 1) {
+    throw new Error("iOS store IPA must contain exactly one app manifest.");
+  }
+  const appRelative = path.dirname(appManifests[0] ?? "");
+  const extracted = mkdtempSync(path.join(tmpdir(), "mpgd-ios-inspection-"));
+  try {
+    const result = runner.run("unzip", ["-q", ipa, "-d", extracted]);
+    if (result.status !== 0) {
+      throw new Error("iOS store IPA could not be extracted.");
+    }
+    return inspectSignedIosApplication(path.join(extracted, appRelative), input);
+  } finally {
+    rmSync(extracted, { recursive: true, force: true });
+  }
+}
+function inspectSignedIosApplication(appPath, input) {
+  const plist = path.join(appPath, "Info.plist");
+  if (!existsSync(plist) || !statSync(plist).isFile()) {
+    throw new Error("Signed iOS app manifest is missing.");
+  }
+  if (!existsSync(path.join(appPath, "Assets.car")) || existsSync(path.join(appPath, "Info-Smoke.plist"))) {
+    throw new Error("Signed iOS app contains smoke assets or omits release icons.");
+  }
+  const runner = input.runner ?? { run: runCommand };
+  const signature = runner.run("codesign", ["--verify", "--deep", "--strict", appPath]);
+  if (signature.status !== 0) {
+    throw new Error("iOS app code signature could not be verified.");
+  }
+  const signingInfo = runner.run("codesign", ["-dv", "--verbose=4", appPath]);
+  const signingText = `${signingInfo.stdout}
+${signingInfo.stderr}`;
+  const expectedTeamLine = `TeamIdentifier=${input.expectedTeamId}`;
+  if (signingInfo.status !== 0 || /Signature=adhoc/iu.test(signingText) || !signingText.split(/\r?\n/u).some((line) => line.trim() === expectedTeamLine)) {
+    throw new Error("iOS app is not signed for the expected development team.");
+  }
+  const fields = [
+    ["bundleId", "CFBundleIdentifier", input.expectedBundleId],
+    ["marketingVersion", "CFBundleShortVersionString", input.expectedMarketingVersion],
+    ["buildNumber", "CFBundleVersion", input.expectedBuildNumber]
+  ];
+  const observed = Object.fromEntries(
+    fields.map(([name, key, expected]) => {
+      const result = runner.run("/usr/libexec/PlistBuddy", ["-c", `Print :${key}`, plist]);
+      if (result.status !== 0 || result.stdout.trim() !== expected) {
+        throw new Error(`iOS app ${name} does not match release identity.`);
+      }
+      return [name, expected];
+    })
+  );
+  const configFiles = [
+    path.join(appPath, "capacitor.config.json"),
+    path.join(appPath, "public/capacitor.config.json")
+  ];
+  if (!configFiles.some((file) => existsSync(file))) {
+    throw new Error("Signed iOS app Capacitor configuration is missing.");
+  }
+  for (const configFile of configFiles) {
+    if (existsSync(configFile)) {
+      assertNoDebugServer(configFile);
+    }
+  }
+  return { ...observed, teamId: input.expectedTeamId, signed: true };
+}
+function assertNoDebugServer(file) {
+  const value = JSON.parse(readFileSync(file, "utf8"));
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new Error("Signed iOS app has malformed Capacitor configuration.");
+  }
+  const config = value;
+  const server = config.server;
+  const ios = config.ios;
+  if (typeof server === "object" && server !== null && "url" in server || typeof ios === "object" && ios !== null && "webContentsDebuggingEnabled" in ios && ios.webContentsDebuggingEnabled === true) {
+    throw new Error("Signed iOS app retains a live-reload or debug bridge configuration.");
+  }
+}
+function runCommand(command, args) {
+  const result = spawnSync(command, [...args], {
+    encoding: "utf8",
+    env: nativeInspectionEnvironment(),
+    maxBuffer: 4 * 1024 * 1024
+  });
+  if (result.error !== void 0) {
+    throw new Error(`Required iOS inspection command is unavailable: ${command}.`);
+  }
+  return {
+    status: result.status,
+    stdout: result.stdout,
+    stderr: result.stderr
+  };
+}
+export {
+  inspectSignedIosApplication,
+  inspectSignedIosArchive,
+  inspectSignedIosIpa
+};

package/dist/ios-keychain-import.swift

@@ -0,0 +1,92 @@
+import CryptoKit
+import Foundation
+import Security
+
+func requiredEnvironment(_ name: String) throws -> String {
+  guard let value = ProcessInfo.processInfo.environment[name], !value.isEmpty else {
+    throw NSError(domain: "mpgd.ios.signing", code: 1, userInfo: [
+      NSLocalizedDescriptionKey: "Missing iOS signing input: \(name)",
+    ])
+  }
+  return value
+}
+
+do {
+  let keychainPath = try requiredEnvironment("MPGD_IOS_SESSION_KEYCHAIN")
+  let keychainPassword = try requiredEnvironment("MPGD_IOS_SESSION_KEYCHAIN_PASSWORD")
+  let certificatePath = try requiredEnvironment("MPGD_IOS_SIGNING_P12")
+  let certificatePassword = try requiredEnvironment("MPGD_IOS_SIGNING_P12_PASSWORD")
+  let certificateData = try Data(contentsOf: URL(fileURLWithPath: certificatePath))
+
+  var keychain: SecKeychain?
+  let createStatus = keychainPath.withCString { path in
+    keychainPassword.withCString { password in
+      SecKeychainCreate(path, UInt32(keychainPassword.utf8.count), password, false, nil, &keychain)
+    }
+  }
+  guard createStatus == errSecSuccess, let keychain else {
+    throw NSError(domain: "mpgd.ios.signing", code: Int(createStatus), userInfo: [
+      NSLocalizedDescriptionKey: "Could not create an isolated iOS signing keychain.",
+    ])
+  }
+
+  var trustedCodesign: SecTrustedApplication?
+  let trustedStatus = SecTrustedApplicationCreateFromPath(
+    "/usr/bin/codesign", &trustedCodesign)
+  guard trustedStatus == errSecSuccess, let trustedCodesign else {
+    throw NSError(domain: "mpgd.ios.signing", code: Int(trustedStatus), userInfo: [
+      NSLocalizedDescriptionKey: "Could not grant code signing access to the isolated identity.",
+    ])
+  }
+  var access: SecAccess?
+  let accessStatus = SecAccessCreate(
+    "mpgd isolated code signing" as CFString,
+    [trustedCodesign] as CFArray,
+    &access)
+  guard accessStatus == errSecSuccess, let access else {
+    throw NSError(domain: "mpgd.ios.signing", code: Int(accessStatus), userInfo: [
+      NSLocalizedDescriptionKey: "Could not create isolated code signing access controls.",
+    ])
+  }
+
+  let options: [String: Any] = [
+    kSecImportExportPassphrase as String: certificatePassword,
+    kSecImportExportKeychain as String: keychain,
+    kSecImportExportAccess as String: access,
+  ]
+  var imported: CFArray?
+  let importStatus = SecPKCS12Import(certificateData as CFData, options as CFDictionary, &imported)
+  guard importStatus == errSecSuccess,
+    let items = imported as? [[String: Any]],
+    items.count == 1,
+    let rawIdentity = items[0][kSecImportItemIdentity as String],
+    CFGetTypeID(rawIdentity as CFTypeRef) == SecIdentityGetTypeID() else {
+    throw NSError(domain: "mpgd.ios.signing", code: Int(importStatus), userInfo: [
+      NSLocalizedDescriptionKey: "Could not import one iOS signing identity into its keychain.",
+    ])
+  }
+  let identity = rawIdentity as! SecIdentity
+
+  var certificate: SecCertificate?
+  let certificateStatus = SecIdentityCopyCertificate(identity, &certificate)
+  guard certificateStatus == errSecSuccess, let certificate else {
+    throw NSError(domain: "mpgd.ios.signing", code: Int(certificateStatus), userInfo: [
+      NSLocalizedDescriptionKey: "Imported iOS signing identity has no certificate.",
+    ])
+  }
+  let certificateBytes = SecCertificateCopyData(certificate) as Data
+  let sha256 = SHA256.hash(data: certificateBytes)
+    .map { String(format: "%02X", $0) }.joined()
+  let sha1 = Insecure.SHA1.hash(data: certificateBytes)
+    .map { String(format: "%02X", $0) }.joined()
+  let response = ["certificateSha256": sha256, "certificateSha1": sha1]
+  let json = try JSONSerialization.data(withJSONObject: response, options: [.sortedKeys])
+  FileHandle.standardOutput.write(json)
+  FileHandle.standardOutput.write(Data([0x0A]))
+} catch {
+  let failure = error as NSError
+  let detail = failure.domain == "mpgd.ios.signing"
+    ? failure.localizedDescription : "Could not load the signing input."
+  FileHandle.standardError.write(Data("iOS signing identity import failed: \(detail)\n".utf8))
+  exit(1)
+}

package/dist/ios-plist.d.ts

@@ -0,0 +1,2 @@
+/** Parse the bounded XML representation produced by plutil for profile preflight. */
+export declare function parseIosProfilePlist(source: string): unknown;

package/dist/ios-plist.js

@@ -0,0 +1,75 @@
+import { DOMParser } from '@xmldom/xmldom';
+/** Parse the bounded XML representation produced by plutil for profile preflight. */
+export function parseIosProfilePlist(source) {
+    if (Buffer.byteLength(source) > 1024 * 1024) {
+        throw new Error('iOS provisioning profile plist exceeds 1 MiB.');
+    }
+    const document = new DOMParser({
+        onError: () => {
+            throw new Error('iOS provisioning profile plist is malformed.');
+        },
+    }).parseFromString(source, 'application/xml');
+    const root = document.documentElement;
+    if (root === null || root.tagName !== 'plist') {
+        throw new Error('iOS provisioning profile plist has no plist root.');
+    }
+    const children = elements(root);
+    if (children.length !== 1) {
+        throw new Error('iOS provisioning profile plist must contain one value.');
+    }
+    return parseValue(children[0]);
+}
+function parseValue(element) {
+    switch (element.tagName) {
+        case 'dict': {
+            const children = elements(element);
+            if (children.length % 2 !== 0) {
+                throw new Error('iOS provisioning profile plist dictionary is malformed.');
+            }
+            const result = Object.create(null);
+            for (let index = 0; index < children.length; index += 2) {
+                const key = children[index];
+                const value = children[index + 1];
+                const name = (key.textContent ?? '').trim();
+                if (key.tagName !== 'key' || name === '' || Object.hasOwn(result, name)) {
+                    throw new Error('iOS provisioning profile plist key is malformed or duplicated.');
+                }
+                result[name] = parseValue(value);
+            }
+            return result;
+        }
+        case 'array':
+            return elements(element).map((child) => parseValue(child));
+        case 'string':
+        case 'date':
+            return (element.textContent ?? '').trim();
+        case 'data':
+            return (element.textContent ?? '').replace(/\s+/gu, '');
+        case 'true':
+            return true;
+        case 'false':
+            return false;
+        case 'integer': {
+            const text = (element.textContent ?? '').trim();
+            if (!/^-?\d+$/u.test(text)) {
+                throw new Error('iOS provisioning profile plist integer is invalid.');
+            }
+            const value = Number(text);
+            if (!Number.isSafeInteger(value)) {
+                throw new Error('iOS provisioning profile plist integer is invalid.');
+            }
+            return value;
+        }
+        default:
+            throw new Error(`Unsupported iOS provisioning profile plist value ${element.tagName}.`);
+    }
+}
+function elements(parent) {
+    const result = [];
+    for (let child = parent.firstChild; child !== null; child = child.nextSibling) {
+        if (child.nodeType === 1) {
+            result.push(child);
+        }
+    }
+    return result;
+}

package/dist/ios-signing-profile.d.ts

@@ -0,0 +1,12 @@
+export interface IosDistributionProfile {
+  readonly uuid: string;
+  readonly name: string;
+  readonly expiresAt: string;
+}
+/** Preflight only: the signed archive and IPA are still inspected after Xcode export. */
+export declare function inspectIosDistributionProfile(value: unknown, input: {
+  readonly bundleId: string;
+  readonly teamId: string;
+  readonly certificateSha256: string;
+  readonly now?: Date;
+}): IosDistributionProfile;

package/dist/ios-signing-profile.js

@@ -0,0 +1,60 @@
+import { createHash } from 'node:crypto';
+const profileUuidPattern = /^[0-9A-F]{8}-(?:[0-9A-F]{4}-){3}[0-9A-F]{12}$/iu;
+const certFingerprintPattern = /^[0-9A-F]{64}$/u;
+/** Preflight only: the signed archive and IPA are still inspected after Xcode export. */
+export function inspectIosDistributionProfile(value, input) {
+    if (!isRecord(value)) {
+        throw new Error('iOS provisioning profile is malformed.');
+    }
+    const uuid = value.UUID;
+    const name = value.Name;
+    const expiresAt = value.ExpirationDate;
+    const expiration = typeof expiresAt === 'string' ? Date.parse(expiresAt) : Number.NaN;
+    if (typeof uuid !== 'string' || !profileUuidPattern.test(uuid)
+        || typeof name !== 'string' || name.trim() === ''
+        || typeof expiresAt !== 'string'
+        || !Number.isFinite(expiration) || expiration <= (input.now ?? new Date()).getTime()) {
+        throw new Error('iOS provisioning profile is malformed or expired.');
+    }
+    if (!/^[A-Z0-9]{10}$/u.test(input.teamId)
+        || !certFingerprintPattern.test(input.certificateSha256)
+        || !Array.isArray(value.TeamIdentifier)
+        || !value.TeamIdentifier.includes(input.teamId)) {
+        throw new Error('iOS provisioning profile does not match the signing team.');
+    }
+    const appIdPrefixes = value.ApplicationIdentifierPrefix;
+    if (!Array.isArray(appIdPrefixes)
+        || appIdPrefixes.length !== 1
+        || typeof appIdPrefixes[0] !== 'string'
+        || !/^[A-Z0-9]{10}$/u.test(appIdPrefixes[0])) {
+        throw new Error('iOS provisioning profile has an invalid App ID prefix.');
+    }
+    if (!isRecord(value.Entitlements)
+        || value.Entitlements['application-identifier'] !== `${appIdPrefixes[0]}.${input.bundleId}`
+        || value.Entitlements['get-task-allow'] === true
+        || (value.Entitlements['com.apple.developer.team-identifier'] !== undefined
+            && value.Entitlements['com.apple.developer.team-identifier'] !== input.teamId)) {
+        throw new Error('iOS provisioning profile does not match the app ID or distribution rights.');
+    }
+    if (!Array.isArray(value.DeveloperCertificates)
+        || !value.DeveloperCertificates.some((certificate) => {
+            if (typeof certificate !== 'string' || certificate === '') {
+                return false;
+            }
+            const observed = createHash('sha256')
+                .update(Buffer.from(certificate, 'base64'))
+                .digest('hex')
+                .toUpperCase();
+            return observed === input.certificateSha256;
+        })) {
+        throw new Error('iOS provisioning profile does not contain the signing certificate.');
+    }
+    if (value.ProvisionsAllDevices === true
+        || (Array.isArray(value.ProvisionedDevices) && value.ProvisionedDevices.length > 0)) {
+        throw new Error('iOS provisioning profile is not an App Store distribution profile.');
+    }
+    return { uuid, name, expiresAt };
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}

package/dist/ios-signing-session.d.ts

@@ -0,0 +1,22 @@
+export interface IosSigningSessionInput {
+  readonly p12File: string;
+  readonly p12Password: string;
+  readonly provisioningProfileFile: string;
+  readonly bundleId: string;
+  readonly teamId: string;
+  readonly environment?: NodeJS.ProcessEnv;
+  readonly signal?: AbortSignal;
+  readonly temporaryParent?: string;
+}
+export interface IosSigningSession {
+  readonly environment: NodeJS.ProcessEnv;
+  readonly certificateSha256: string;
+  readonly keychainFile: string;
+  readonly profileUuid: string;
+  readonly exportOptionsPlist: string;
+  dispose(): void;
+}
+/** Import one identity into an owned keychain and pair it with an App Store profile. */
+export declare function prepareIosSigningSession(input: IosSigningSessionInput): Promise<IosSigningSession>;
+/** Preserve build errors when temporary signing material cleanup also fails. */
+export declare function withIosSigningSession<T>(input: IosSigningSessionInput, action: (session: IosSigningSession) => Promise<T>): Promise<T>;

package/dist/ios-signing-session.js

@@ -0,0 +1,256 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { chmodSync, constants, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { runReleaseProcess } from './deploy-process.js';
+import { parseIosProfilePlist } from './ios-plist.js';
+import { inspectIosDistributionProfile } from './ios-signing-profile.js';
+const certificatePattern = /^[0-9A-F]{64}$/u;
+const identityPattern = /^[0-9A-F]{40}$/u;
+const maximumCredentialBytes = 64 * 1024 * 1024;
+/** Import one identity into an owned keychain and pair it with an App Store profile. */
+export async function prepareIosSigningSession(input) {
+    if (process.platform !== 'darwin') {
+        throw new Error('iOS signing sessions require macOS.');
+    }
+    if (input.p12Password === '' || !/^[A-Z0-9]{10}$/u.test(input.teamId)
+        || !/^[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+$/u.test(input.bundleId)) {
+        throw new Error('iOS signing requires a P12 password, team ID and explicit bundle ID.');
+    }
+    const p12File = requiredCredentialFile(input.p12File, 'iOS P12');
+    const profileFile = requiredCredentialFile(input.provisioningProfileFile, 'iOS profile');
+    const ownedRoot = mkdtempSync(path.join(input.temporaryParent ?? tmpdir(), 'mpgd-ios-signing-'));
+    const keychainFile = path.join(ownedRoot, 'signing.keychain-db');
+    const decodedProfile = path.join(ownedRoot, 'profile.plist');
+    const decodedXml = path.join(ownedRoot, 'profile.xml');
+    const exportOptionsPlist = path.join(ownedRoot, 'ExportOptions.plist');
+    const keychainPassword = randomBytes(32).toString('hex');
+    const environment = {
+        ...(input.environment ?? process.env),
+        HOME: ownedRoot,
+        CFFIXED_USER_HOME: ownedRoot,
+        MPGD_IOS_SESSION_KEYCHAIN: keychainFile,
+        MPGD_IOS_SESSION_KEYCHAIN_PASSWORD: keychainPassword,
+        MPGD_IOS_SIGNING_P12: p12File,
+        MPGD_IOS_SIGNING_P12_PASSWORD: input.p12Password,
+        MPGD_IOS_TEAM_ID: input.teamId,
+        MPGD_IOS_SIGNING_STYLE: 'Manual',
+        MPGD_IOS_EXPORT_OPTIONS_PLIST: exportOptionsPlist,
+    };
+    let installedProfile;
+    try {
+        chmodSync(ownedRoot, 0o700);
+        mkdirSync(path.join(ownedRoot, 'Library', 'Preferences'), {
+            recursive: true,
+            mode: 0o700,
+        });
+        const helper = path.join(path.dirname(fileURLToPath(import.meta.url)), 'ios-keychain-import.swift');
+        if (!existsSync(helper)) {
+            throw new Error('The installed CLI is missing its iOS signing helper.');
+        }
+        const imported = await runReleaseProcess({
+            command: 'swift',
+            args: [helper],
+            cwd: ownedRoot,
+            environment,
+            timeoutMs: 120_000,
+            maxOutputBytes: 1024 * 1024,
+            captureMachineStdout: true,
+            signal: input.signal,
+        });
+        const identity = JSON.parse(imported.machineStdout ?? '');
+        const certificateSha256 = identity.certificateSha256;
+        const certificateSha1 = identity.certificateSha1;
+        if (imported.truncated || typeof certificateSha256 !== 'string'
+            || !certificatePattern.test(certificateSha256)
+            || typeof certificateSha1 !== 'string' || !identityPattern.test(certificateSha1)) {
+            throw new Error('iOS signing identity helper returned an invalid certificate fingerprint.');
+        }
+        await runReleaseProcess({
+            command: 'security',
+            args: ['set-key-partition-list', '-S', 'apple:', '-s', keychainFile],
+            cwd: ownedRoot,
+            environment,
+            stdin: `${keychainPassword}\n`,
+            timeoutMs: 30_000,
+            signal: input.signal,
+        });
+        await runReleaseProcess({
+            command: 'security',
+            args: ['list-keychains', '-d', 'user', '-s', keychainFile],
+            cwd: ownedRoot,
+            environment,
+            timeoutMs: 10_000,
+            signal: input.signal,
+        });
+        const searchList = await runReleaseProcess({
+            command: 'security',
+            args: ['list-keychains', '-d', 'user'],
+            cwd: ownedRoot,
+            environment,
+            timeoutMs: 10_000,
+            captureMachineStdout: true,
+            signal: input.signal,
+        });
+        if (searchList.truncated || !searchList.machineStdout?.includes(keychainFile)) {
+            throw new Error('Isolated iOS signing keychain is not in its session search list.');
+        }
+        delete environment.MPGD_IOS_SIGNING_P12;
+        delete environment.MPGD_IOS_SIGNING_P12_PASSWORD;
+        delete environment.MPGD_IOS_SESSION_KEYCHAIN_PASSWORD;
+        const decodeEnvironment = { ...(input.environment ?? process.env) };
+        delete decodeEnvironment.MPGD_IOS_SIGNING_P12;
+        delete decodeEnvironment.MPGD_IOS_SIGNING_P12_PASSWORD;
+        delete decodeEnvironment.MPGD_IOS_SESSION_KEYCHAIN_PASSWORD;
+        await runReleaseProcess({
+            command: 'security',
+            args: ['cms', '-D', '-i', profileFile, '-o', decodedProfile],
+            cwd: ownedRoot,
+            environment: decodeEnvironment,
+            timeoutMs: 30_000,
+            signal: input.signal,
+        });
+        await runReleaseProcess({
+            command: 'plutil',
+            args: ['-convert', 'xml1', '-o', decodedXml, decodedProfile],
+            cwd: ownedRoot,
+            environment: decodeEnvironment,
+            timeoutMs: 30_000,
+            signal: input.signal,
+        });
+        const profile = inspectIosDistributionProfile(parseIosProfilePlist(readFileSync(decodedXml, 'utf8')), { bundleId: input.bundleId, teamId: input.teamId, certificateSha256 });
+        const profileDirectory = path.join(ownedRoot, 'Library', 'Developer', 'Xcode', 'UserData', 'Provisioning Profiles');
+        mkdirSync(profileDirectory, { recursive: true, mode: 0o700 });
+        const destination = path.join(profileDirectory, `${profile.uuid}.mobileprovision`);
+        if (isSymlink(destination)) {
+            throw new Error('The iOS provisioning profile destination must not be a symlink.');
+        }
+        if (existsSync(destination)) {
+            if (!readFileSync(destination).equals(readFileSync(profileFile))) {
+                throw new Error('An existing iOS provisioning profile has the same UUID but different bytes.');
+            }
+        }
+        else {
+            const profileSha256 = fileDigest(profileFile);
+            copyFileSync(profileFile, destination, constants.COPYFILE_EXCL);
+            installedProfile = { path: destination, sha256: profileSha256 };
+            chmodSync(destination, 0o600);
+        }
+        writeFileSync(exportOptionsPlist, exportPlist(input.teamId, input.bundleId, profile.uuid, certificateSha1), { mode: 0o600, flag: 'wx' });
+        environment.MPGD_IOS_PROVISIONING_PROFILE_SPECIFIER = profile.uuid;
+        environment.MPGD_IOS_SIGNING_IDENTITY = certificateSha1;
+        environment.MPGD_IOS_SIGNING_KEYCHAIN = keychainFile;
+        let disposed = false;
+        return {
+            environment,
+            certificateSha256,
+            keychainFile,
+            profileUuid: profile.uuid,
+            exportOptionsPlist,
+            dispose() {
+                if (disposed) {
+                    return;
+                }
+                removeOwnedSigningMaterial(ownedRoot, installedProfile);
+                disposed = true;
+            },
+        };
+    }
+    catch (error) {
+        try {
+            removeOwnedSigningMaterial(ownedRoot, installedProfile);
+        }
+        catch (cleanupError) {
+            throw new AggregateError([error, cleanupError], 'iOS signing setup and cleanup failed.');
+        }
+        throw error;
+    }
+}
+/** Preserve build errors when temporary signing material cleanup also fails. */
+export async function withIosSigningSession(input, action) {
+    const session = await prepareIosSigningSession(input);
+    let outcome;
+    try {
+        outcome = { ok: true, value: await action(session) };
+    }
+    catch (error) {
+        outcome = { ok: false, error };
+    }
+    try {
+        session.dispose();
+    }
+    catch (cleanupError) {
+        if (!outcome.ok) {
+            throw new AggregateError([outcome.error, cleanupError], 'iOS signing build and cleanup both failed.');
+        }
+        throw cleanupError;
+    }
+    if (!outcome.ok) {
+        throw outcome.error;
+    }
+    return outcome.value;
+}
+function removeOwnedSigningMaterial(root, profile) {
+    const errors = [];
+    if (profile !== undefined) {
+        try {
+            if (existsSync(profile.path) || isSymlink(profile.path)) {
+                if (isSymlink(profile.path) || fileDigest(profile.path) !== profile.sha256) {
+                    throw new Error('Owned iOS provisioning profile changed before cleanup.');
+                }
+                rmSync(profile.path);
+            }
+        }
+        catch (error) {
+            errors.push(error);
+        }
+    }
+    try {
+        rmSync(root, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+    }
+    catch (error) {
+        errors.push(error);
+    }
+    if (errors.length === 1) {
+        throw errors[0];
+    }
+    if (errors.length > 1) {
+        throw new AggregateError(errors, 'iOS signing cleanup failed.');
+    }
+}
+function fileDigest(file) {
+    return createHash('sha256').update(readFileSync(file)).digest('hex');
+}
+function requiredCredentialFile(file, label) {
+    const absolute = path.resolve(file);
+    let stat;
+    try {
+        stat = lstatSync(absolute);
+    }
+    catch {
+        throw new Error(`${label} is missing or unreadable.`);
+    }
+    if (!stat.isFile() || stat.size < 1 || stat.size > maximumCredentialBytes) {
+        throw new Error(`${label} must be a nonempty regular file under 64 MiB.`);
+    }
+    return absolute;
+}
+function isSymlink(file) {
+    try {
+        return lstatSync(file).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+function exportPlist(teamId, bundleId, profileUuid, certificateSha1) {
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<plist version="1.0"><dict>
+<key>method</key><string>app-store-connect</string>
+<key>signingStyle</key><string>manual</string>
+<key>teamID</key><string>${teamId}</string>
+<key>signingCertificate</key><string>${certificateSha1}</string>
+<key>provisioningProfiles</key><dict><key>${bundleId}</key><string>${profileUuid}</string></dict>
+</dict></plist>\n`;
+}