@omega.js/manager 0.1.0

package/dist/services/certificates/lib/identifier-manager.js

@@ -0,0 +1,107 @@
+/**
+ * Bundle ID CRUD + capability management against the App Store Connect
+ * API. Apple's `platform` field on the bundle ID record is decorative — a
+ * single IOS-platform bundle ID works for all Apple platforms; the
+ * provisioning profile's profileType selects the actual platform.
+ */
+const { API_BASE } = require('./apple-api.js');
+
+/**
+ * List all bundle IDs (paginated).
+ */
+async function listBundleIds(client) {
+  return client.paginate(`${API_BASE}/bundleIds?limit=200`);
+}
+
+/**
+ * List the capabilities currently enabled on a bundle ID.
+ */
+async function listBundleIdCapabilities(client, bundleIdId) {
+  return client.paginate(`${API_BASE}/bundleIds/${bundleIdId}/bundleIdCapabilities`);
+}
+
+/**
+ * Create a bundle ID and enable the requested capabilities.
+ */
+async function createBundleId(client, identifier, name, platform = 'IOS', capabilities = []) {
+  const data = await client.request(`${API_BASE}/bundleIds`, {
+    method: 'POST',
+    body: JSON.stringify({
+      data: {
+        type: 'bundleIds',
+        attributes: { identifier, name, platform },
+      },
+    }),
+  });
+  const bundleId = data.data;
+
+  if (capabilities.length > 0) {
+    await enableCapabilities(client, bundleId.id, capabilities);
+  }
+
+  return bundleId;
+}
+
+/**
+ * Enable each capability on a bundle ID, tolerating per-capability
+ * failures (some capabilities reject benignly depending on account
+ * entitlements — the caller logs each result).
+ *
+ * APPLE_ID_AUTH (Sign in with Apple) requires a `settings` block marking
+ * the app as the primary consent app — Apple rejects it otherwise.
+ *
+ * @returns {Array<{ capability, success, error? }>}
+ */
+async function enableCapabilities(client, bundleIdId, capabilities) {
+  if (!capabilities?.length) {
+    return [];
+  }
+
+  const results = [];
+  for (const capabilityType of capabilities) {
+    const body = {
+      data: {
+        type: 'bundleIdCapabilities',
+        attributes: { capabilityType },
+        relationships: {
+          bundleId: { data: { type: 'bundleIds', id: bundleIdId } },
+        },
+      },
+    };
+
+    if (capabilityType === 'APPLE_ID_AUTH') {
+      body.data.attributes.settings = [
+        {
+          key: 'APPLE_ID_AUTH_APP_CONSENT',
+          options: [{ key: 'PRIMARY_APP_CONSENT', enabled: true }],
+        },
+      ];
+    }
+
+    try {
+      await client.request(`${API_BASE}/bundleIdCapabilities`, {
+        method: 'POST',
+        body: JSON.stringify(body),
+      });
+      results.push({ capability: capabilityType, success: true });
+    } catch (error) {
+      results.push({ capability: capabilityType, success: false, error: error.message });
+    }
+  }
+  return results;
+}
+
+/**
+ * Find an existing bundle ID matching `identifier` (case-sensitive).
+ */
+function findBundleId(existingBundleIds, identifier) {
+  return existingBundleIds.find((b) => b.attributes.identifier === identifier) || null;
+}
+
+module.exports = {
+  listBundleIds,
+  listBundleIdCapabilities,
+  createBundleId,
+  enableCapabilities,
+  findBundleId,
+};

package/dist/services/certificates/lib/keychain.js

@@ -0,0 +1,135 @@
+/**
+ * macOS keychain import for the exported .p12 files, kept fully
+ * non-interactive:
+ *
+ *   1. .p12 password — Sonoma+ rejects empty-password .p12 with "MAC
+ *      verification failed", so exports always carry CSC_KEY_PASSWORD.
+ *   2. Trusted tools (-T) — codesign/productbuild/productsign/xcodebuild
+ *      are whitelisted so they can use the key without a GUI prompt.
+ *   3. Partition list — with APPLE_KEYCHAIN_PASSWORD provided, the
+ *      "<tool> wants to use the keychain" prompt is suppressed entirely;
+ *      without it, it fires once on first signing then never again.
+ *   4. Allowed-types filter — only cert types currently in config import;
+ *      .p12 files for deprecated types stay on disk but are skipped.
+ *
+ * Failures print manual-import guidance (omega-manager auto-opened
+ * Keychain Access — the port stays non-interactive). Non-macOS platforms
+ * skip entirely.
+ */
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const jetpack = require('fs-jetpack');
+const chalk = require('chalk').default;
+
+// execFileSync gets no shell, so no ~ expansion — resolve the keychain path here
+const LOGIN_KEYCHAIN = path.join(os.homedir(), 'Library/Keychains/login.keychain-db');
+
+/**
+ * Import .p12 files into the macOS login keychain (best-effort).
+ *
+ * @param {Object} options
+ * @param {string} options.certificatesDir - Directory containing .p12 files
+ * @param {string} [options.keychainPassword] - Mac login password (unlock + partition list)
+ * @param {string} [options.certificatePassword] - Password on the .p12 files
+ * @param {string[]} [options.allowedTypes] - Cert types (filename sans .p12) to import
+ * @returns {{ imported: number, skipped: number, failed: number }}
+ */
+function importP12Files({ certificatesDir, keychainPassword = null, certificatePassword = '', allowedTypes = null }) {
+  if (process.platform !== 'darwin') {
+    console.log(`      ${chalk.dim('⊘ Keychain import skipped (not macOS)')}`);
+    return { imported: 0, skipped: 0, failed: 0 };
+  }
+
+  if (!jetpack.exists(certificatesDir)) {
+    return { imported: 0, skipped: 0, failed: 0 };
+  }
+
+  let p12Files = jetpack.find(certificatesDir, { matching: '*.p12' });
+
+  if (allowedTypes && Array.isArray(allowedTypes)) {
+    const allowSet = new Set(allowedTypes);
+    p12Files = p12Files.filter((p) => allowSet.has(p.split('/').pop().replace('.p12', '')));
+  }
+
+  if (p12Files.length === 0) {
+    return { imported: 0, skipped: 0, failed: 0 };
+  }
+
+  let imported = 0;
+  let skipped = 0;
+  const failed = [];
+
+  // Pre-unlock when the login password was provided — `security import`
+  // fails on a locked keychain.
+  if (keychainPassword) {
+    try {
+      execFileSync(
+        'security',
+        ['unlock-keychain', '-p', keychainPassword, LOGIN_KEYCHAIN],
+        { stdio: 'pipe' },
+      );
+    } catch {
+      // Continue — failures below print manual guidance.
+    }
+  }
+
+  // -T whitelists specific signing binaries (finer-grained than -A).
+  const trustedTools = [
+    '/usr/bin/codesign',
+    '/usr/bin/productbuild',
+    '/usr/bin/productsign',
+    '/usr/bin/security',
+    '/usr/bin/xcodebuild',
+  ];
+  const tFlags = trustedTools.flatMap((tool) => ['-T', tool]);
+
+  for (const p12Path of p12Files) {
+    const certType = p12Path.split('/').pop().replace('.p12', '');
+
+    try {
+      execFileSync(
+        'security',
+        ['import', p12Path, '-k', LOGIN_KEYCHAIN, '-P', certificatePassword, ...tFlags],
+        { stdio: 'pipe' },
+      );
+      console.log(`      ${chalk.green('✓')} Imported ${chalk.cyan(certType)} to Keychain`);
+      imported++;
+    } catch (error) {
+      const message = error?.message || '';
+      if (message.includes('already exists') || message.includes('duplicate')) {
+        console.log(`      ${chalk.dim(`ℹ ${certType} already in Keychain`)}`);
+        skipped++;
+      } else {
+        failed.push({ path: p12Path, type: certType, message });
+      }
+    }
+  }
+
+  // Suppress the per-signing keychain prompt (macOS Sierra+ requirement) —
+  // without this, codesign prompts for the login keychain password the
+  // first time it uses each imported private key.
+  if (imported > 0 && keychainPassword) {
+    try {
+      execFileSync(
+        'security',
+        ['set-key-partition-list', '-S', 'apple-tool:,apple:,codesign:', '-s', '-k', keychainPassword, LOGIN_KEYCHAIN],
+        { stdio: 'pipe' },
+      );
+    } catch {
+      // Non-fatal — codesign may prompt once on first use.
+    }
+  }
+
+  if (failed.length > 0) {
+    console.log(`      ${chalk.yellow('⚠')} ${failed.length} cert(s) failed keychain import — import manually:`);
+    for (const { path, type, message } of failed) {
+      console.log(`      ${chalk.gray('→')} ${chalk.cyan(type)}: ${chalk.gray(message.split('\n')[0])}`);
+      console.log(`        ${chalk.gray(`double-click ${path} (password: ${certificatePassword ? 'the CSC_KEY_PASSWORD env value' : 'empty'})`)}`);
+    }
+  }
+
+  return { imported, skipped, failed: failed.length };
+}
+
+module.exports = { importP12Files };

package/dist/services/certificates/lib/manual-walkthrough.js

@@ -0,0 +1,165 @@
+/**
+ * Interactive walkthrough for portal-only certificate types (DEVELOPER_ID_*).
+ * Apple's API can list and download these but only the Account Holder can
+ * CREATE them, in the portal UI — so the walkthrough automates everything
+ * around that one human step: it generates/reuses the pipeline's CSR (the
+ * private key stays local, so the .p12 export pairs), drops a picker-friendly
+ * copy in Downloads, opens the portal's create page (Enter-gated), then polls
+ * Downloads + the target path for the issued .cer — installing it only when
+ * it provably pairs with our key and names the expected certificate type.
+ *
+ * Restores omega-manager's interactive rescue (the port had reduced it to
+ * printed guidance) and goes further: legacy still sent the user to Keychain
+ * Access to make the CSR; here upload + download are the only human steps.
+ */
+const { homedir } = require('node:os');
+const { join, basename } = require('node:path');
+const jetpack = require('fs-jetpack');
+const chalk = require('chalk').default;
+const { openBrowserAndPoll } = require('../../../vendor/devkit/flows.js');
+
+const {
+  getCSRContent,
+  validateManualCertificate,
+  certificateMatchesKey,
+  getCertificateCommonName,
+} = require('./certificate-manager.js');
+
+const PORTAL_CREATE_URL = 'https://developer.apple.com/account/resources/certificates/add';
+
+// Portal option labels by config type prefix — the radio button the Account
+// Holder must pick on the create page, and the CN prefix Apple stamps on the
+// issued certificate (how a wrong-type download is caught).
+const PORTAL_LABELS = [
+  { prefix: 'DEVELOPER_ID_APPLICATION', label: 'Developer ID Application' },
+  { prefix: 'DEVELOPER_ID_INSTALLER', label: 'Developer ID Installer' },
+];
+
+function portalLabelOf(type) {
+  const match = PORTAL_LABELS.find((entry) => type.startsWith(entry.prefix));
+  return match ? match.label : type;
+}
+
+/**
+ * Find the issued .cer among the candidates: the target path itself (the
+ * user saved straight to the printed path) or any .cer that landed in the
+ * downloads dir since the walkthrough started. A candidate is accepted only
+ * when it pairs with the pipeline's private key (modulus match — proof it
+ * was issued from OUR CSR) and carries the expected CN prefix (catches
+ * creating the wrong Developer ID type from the right CSR). Rejections are
+ * remembered so each bad file warns once, not every poll tick.
+ *
+ * @returns {string|null} - Path of the accepted .cer, or null
+ */
+function findIssuedCert({ certPath, downloadsDir, keyPath, portalLabel, startedAt, rejected }) {
+  const candidates = [];
+
+  if (jetpack.exists(certPath)) {
+    candidates.push(certPath);
+  }
+
+  for (const name of jetpack.list(downloadsDir) || []) {
+    if (!name.toLowerCase().endsWith('.cer')) {
+      continue;
+    }
+    const candidate = join(downloadsDir, name);
+    const modified = jetpack.inspect(candidate, { times: true })?.modifyTime;
+    if (modified && modified.getTime() >= startedAt) {
+      candidates.push(candidate);
+    }
+  }
+
+  for (const candidate of candidates) {
+    if (rejected.has(candidate)) {
+      continue;
+    }
+    if (!validateManualCertificate(candidate).valid) {
+      continue;
+    }
+
+    if (!certificateMatchesKey(candidate, keyPath)) {
+      rejected.add(candidate);
+      console.log(`\n        ${chalk.yellow('⚠')} ${basename(candidate)} was not issued from the CSR I staged — create the certificate with that exact file`);
+      continue;
+    }
+
+    const cn = getCertificateCommonName(candidate);
+    if (!cn || !cn.startsWith(portalLabel)) {
+      rejected.add(candidate);
+      console.log(`\n        ${chalk.yellow('⚠')} ${basename(candidate)} is "${cn || 'unreadable'}" — expected a ${portalLabel} certificate`);
+      continue;
+    }
+
+    return candidate;
+  }
+
+  return null;
+}
+
+/**
+ * Walk the user through creating a portal-only certificate: CSR staged →
+ * portal opened → issued .cer detected → installed to certPath. The caller
+ * re-validates and continues down its normal valid-local-file path (.p12
+ * export + keychain import), exactly as if the file had always been there.
+ *
+ * @param {Object} options
+ * @param {string} options.type - Certificate type (e.g. DEVELOPER_ID_INSTALLER_G2)
+ * @param {string} options.certPath - Where the .cer must land
+ * @param {string} options.appleDir - The brand's .omega/certificates/apple dir
+ * @param {string} options.teamId - Apple team ID (CSR subject)
+ * @param {string} [options.downloadsDir] - Where downloads land (test seam)
+ * @returns {Promise<{ installed: boolean }>}
+ */
+async function runManualCertWalkthrough({ type, certPath, appleDir, teamId, downloadsDir = join(homedir(), 'Downloads') }) {
+  const portalLabel = portalLabelOf(type);
+  const startedAt = Date.now();
+
+  // The same CSR machinery as the automatable types: key + CSR generated
+  // once, reused forever — the issued cert must pair with this key or the
+  // .p12 export (and CI signing) has nothing to pair with.
+  getCSRContent(type, appleDir, teamId);
+  const keyPath = join(appleDir, 'csr', type, 'private.key');
+
+  // Picker-friendly copy: the portal's file dialog starts in Downloads, and
+  // some browsers filter for the .certSigningRequest extension.
+  const uploadName = `omega-${type}.certSigningRequest`;
+  jetpack.copy(join(appleDir, 'csr', type, 'request.csr'), join(downloadsDir, uploadName), { overwrite: true });
+
+  const g2Note = type.endsWith('_G2')
+    ? `\n           ${chalk.dim('(asked for a profile type? choose "G2 Sub-CA")')}`
+    : '';
+  const steps = [
+    `Apple only lets the ${chalk.bold('Account Holder')} create ${chalk.cyan(portalLabel)} certificates, in the portal:`,
+    `          1. Sign in as the Account Holder`,
+    `          2. Choose ${chalk.bold(portalLabel)} under Software, then Continue${g2Note}`,
+    `          3. Upload ${chalk.cyan(uploadName)} — already staged in your Downloads folder`,
+    `          4. Download the issued certificate — I'll detect it in Downloads and take it from there`,
+  ].join('\n');
+
+  const rejected = new Set();
+  const result = await openBrowserAndPoll({
+    url: PORTAL_CREATE_URL,
+    promptMessage: steps,
+    label: 'the Apple Developer portal',
+    waitMessage: `Waiting for the issued ${portalLabel} certificate`,
+    intervalMs: 3000,
+    check: async () => {
+      const found = findIssuedCert({ certPath, downloadsDir, keyPath, portalLabel, startedAt, rejected });
+      if (!found) {
+        return { done: false };
+      }
+      if (found !== certPath) {
+        jetpack.copy(found, certPath, { overwrite: true });
+      }
+      return { done: true, result: found };
+    },
+  });
+
+  if (result.success) {
+    console.log(`        ${chalk.green('✓')} Installed ${chalk.gray(certPath)}`);
+  }
+
+  return { installed: Boolean(result.success) };
+}
+
+module.exports = { runManualCertWalkthrough, PORTAL_CREATE_URL };

package/dist/services/certificates/lib/profile-manager.js

@@ -0,0 +1,115 @@
+/**
+ * Provisioning profile CRUD + the cert-type → profile-type mapping.
+ * Profiles bind a bundle ID + certificate (+ devices for development
+ * profiles), so they're per-brand even though certificates are one set
+ * per Apple Developer account.
+ */
+const jetpack = require('fs-jetpack');
+const chalk = require('chalk').default;
+
+const { API_BASE } = require('./apple-api.js');
+
+/**
+ * Cert type → the provisioning profile type that consumes it. Installer
+ * cert types need no profile (null). Both G1 and G2 Developer ID
+ * Application certs use MAC_APP_DIRECT — Apple distinguishes them by the
+ * underlying cert chain.
+ */
+const CERT_TYPE_TO_PROFILE_TYPE = {
+  DEVELOPMENT: 'IOS_APP_DEVELOPMENT',
+  IOS_DISTRIBUTION: 'IOS_APP_STORE',
+  MAC_INSTALLER_DISTRIBUTION: null,
+  MAC_APP_DISTRIBUTION: 'MAC_APP_STORE',
+  DEVELOPER_ID_APPLICATION: 'MAC_APP_DIRECT',
+  DEVELOPER_ID_APPLICATION_G2: 'MAC_APP_DIRECT',
+  DEVELOPER_ID_INSTALLER: null,
+  DEVELOPER_ID_INSTALLER_G2: null,
+};
+
+function getProfileTypeForCertType(certType) {
+  return CERT_TYPE_TO_PROFILE_TYPE[certType];
+}
+
+/**
+ * Whether a cert type applies to a platform: IOS_DISTRIBUTION → IOS only;
+ * MAC_* and DEVELOPER_ID_* → MACOS only; DEVELOPMENT → both.
+ */
+function certAppliesToPlatform(certType, platform) {
+  if (platform === 'IOS') return certType.includes('IOS') || certType === 'DEVELOPMENT';
+  if (platform === 'MACOS') return certType.includes('MAC') || certType.includes('DEVELOPER_ID') || certType === 'DEVELOPMENT';
+  return false;
+}
+
+async function listProfiles(client) {
+  return client.paginate(`${API_BASE}/profiles?limit=200`);
+}
+
+async function listDevices(client) {
+  return client.paginate(`${API_BASE}/devices?limit=200`);
+}
+
+/**
+ * Download a provisioning profile's content to disk as .mobileprovision.
+ */
+async function downloadProfile(client, profileId, outputPath) {
+  const data = await client.request(`${API_BASE}/profiles/${profileId}`);
+  const profileContent = data?.data?.attributes?.profileContent;
+  if (!profileContent) {
+    throw new Error(`Profile ${profileId} has no profileContent`);
+  }
+  jetpack.write(outputPath, Buffer.from(profileContent, 'base64'));
+  console.log(`        ${chalk.green('✓')} Downloaded ${chalk.gray(outputPath)}`);
+}
+
+/**
+ * Create a provisioning profile linking a bundle ID + cert (+ devices for
+ * development profiles).
+ */
+async function createProfile(client, name, profileType, bundleIdId, certificateIds, deviceIds = []) {
+  const body = {
+    data: {
+      type: 'profiles',
+      attributes: { name, profileType },
+      relationships: {
+        bundleId: { data: { type: 'bundleIds', id: bundleIdId } },
+        certificates: {
+          data: certificateIds.map((id) => ({ type: 'certificates', id })),
+        },
+      },
+    },
+  };
+
+  if (deviceIds.length > 0) {
+    body.data.relationships.devices = {
+      data: deviceIds.map((id) => ({ type: 'devices', id })),
+    };
+  }
+
+  const data = await client.request(`${API_BASE}/profiles`, {
+    method: 'POST',
+    body: JSON.stringify(body),
+  });
+  return data.data;
+}
+
+/**
+ * Find a non-expired profile matching the exact name + type.
+ */
+function findValidProfile(existingProfiles, profileType, profileName) {
+  const now = new Date();
+  return existingProfiles.find((profile) => {
+    return profile.attributes.profileType === profileType
+      && profile.attributes.name === profileName
+      && new Date(profile.attributes.expirationDate) > now;
+  }) || null;
+}
+
+module.exports = {
+  getProfileTypeForCertType,
+  certAppliesToPlatform,
+  listProfiles,
+  listDevices,
+  downloadProfile,
+  createProfile,
+  findValidProfile,
+};

package/dist/services/chat/data/baseline-knowledge.md

@@ -0,0 +1,96 @@
+<company>
+  <facts>
+    - Company Description: {description}
+  </facts>
+</company>
+
+<cancellation_unsubscribe>
+  <reasoning>
+    - You CANNOT cancel a user's subscription for them, they must do it themselves.
+    - Users CANNOT upgrade or downgrade their plans. They must cancel their current plan and re-subscribe to the new plan they want.
+  </reasoning>
+  <facts>
+    - Users CAN cancel by visiting their account at {website}/account#billing and clicking the "Manage Plan" button. From there, they can cancel their subscription.
+    - Users CAN change their payment method on an existing subscription by visiting their account at {website}/account#billing and clicking the "Manage Plan" button.
+  </facts>
+</cancellation_unsubscribe>
+
+<subscription>
+  <facts>
+    - Users can cancel any time within their 14-day free trial and won't be charged.
+    - If the user is outside their free trial window, they can cancel their subscription at any time and won't be charged again.
+    - Sometimes, bank statements might show a charge during the free trial, but it's just a pre-authorization and will be refunded if the user cancels within the free trial period.
+  </facts>
+</subscription>
+
+<refund>
+  <reasoning>
+    - Before requesting a refund, users must cancel their subscription.
+    - DO NOT mention anything about a refund unless the user specifically asks for one.
+  </reasoning>
+  <facts>
+    - Users can receive a partial refund by visiting {website}/refund and filling out the refund request form.
+    - Refunds are prorated based on the unused portion of the subscription.
+  </facts>
+</refund>
+
+<disputes>
+  <reasoning>
+    - DO NOT ever recommend that a user dispute their charge with their bank.
+    - Encourage the user to resolve disputes with us first.
+  </reasoning>
+</disputes>
+
+<delete_account_gdpr>
+  <facts>
+    - Users should email customer support. Direct them to {website}/contact to send an email.
+  </facts>
+</delete_account_gdpr>
+
+<sponsorships>
+  <reasoning>
+    - ALL sponsorship, guest post, link insertion, and link exchange inquiries must be handled via EMAIL, not chat.
+    - Do not discuss pricing, turnaround time, or availability over chat.
+  </reasoning>
+  <facts>
+    - Direct users to submit requests at {sponsorshipsUrl}
+  </facts>
+</sponsorships>
+
+<bug_bounty>
+  <reasoning>
+    - We ONLY reward for reports that have not been reported before.
+  </reasoning>
+  <facts>
+    - Direct users to email customer support at {website}/contact to report vulnerabilities.
+  </facts>
+</bug_bounty>
+
+<contact>
+  <reasoning>
+    - DO NOT agree to joining a phone call, video call, or any other form of communication outside of email and this chat.
+  </reasoning>
+</contact>
+
+<resources>
+  <facts>
+    - Terms of Service: {website}/terms
+    - Privacy Policy: {website}/privacy
+  </facts>
+</resources>
+
+<pricing>
+  <facts>
+{pricing}
+  </facts>
+</pricing>
+
+<something_not_working>
+  <facts>
+    - Instruct users to try basic troubleshooting steps like signing out and back in, ensuring they are using the correct account, trying again later, etc.
+    - If they are using a browser, they should try clearing their cache and cookies and try a different browser.
+    - If they are using an app, they should try uninstalling and reinstalling the app.
+    - User should be instructed to send a screenshot of the issue.
+    - Getting "out of requests" error: Users need to upgrade their plan to get more requests or make sure they are using the right API key.
+  </facts>
+</something_not_working>