@rightkit/release 0.4.0 → 0.5.0

package/advisory-exceptions.mjs

@@ -0,0 +1,371 @@
+// Advisory exception gate. ci/advisory-exceptions.json is the single source; deny.toml
+// [advisories].ignore and .cargo/audit.toml must match it exactly, every entry needs an owner,
+// evidence and an unexpired absolute reviewBy date, and the entry's versions must match what
+// Cargo.lock actually holds, `dependents` must equal the exact set of direct reverse
+// dependencies of the affected versions in Cargo.lock, and every hop of `path` must be a real
+// dependency edge (scope drift fails in both directions). Policy: Astra 2026-10-22.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const EXCEPTIONS_FILE = 'ci/advisory-exceptions.json';
+export const DENY_FILE = 'deny.toml';
+export const AUDIT_FILE = '.cargo/audit.toml';
+export const LOCK_FILE = 'Cargo.lock';
+
+const REQUIRED = ['id', 'crate', 'path', 'owner', 'rationale', 'evidence', 'reviewBy', 'approvedBy'];
+const ID_RE = /^RUSTSEC-\d{4}-\d{4}$/;
+const DATE_RE = /^(\d{4})-(\d{2})-(\d{2})$/;
+
+// ---- minimal TOML subset: tables, key = value, strings, arrays, inline tables, bare scalars ----
+
+export function parseToml(text) {
+  let i = 0;
+  const n = text.length;
+  const root = {};
+  let table = root;
+  const fail = msg => { throw new Error(`TOML parse error at offset ${i}: ${msg}`); };
+  const skipWs = (newlines) => {
+    for (;;) {
+      const c = text[i];
+      if (c === ' ' || c === '\t' || c === '\r') i++;
+      else if (c === '\n' && newlines) i++;
+      else if (c === '#') { while (i < n && text[i] !== '\n') i++; }
+      else break;
+    }
+  };
+  const parseString = () => {
+    const q = text[i++];
+    let out = '';
+    if (q === "'") {
+      while (i < n && text[i] !== "'") { if (text[i] === '\n') fail('newline in string'); out += text[i++]; }
+      if (i >= n) fail('unterminated string');
+      i++;
+      return out;
+    }
+    if (text.startsWith('""', i)) fail('multiline strings are not supported');
+    while (i < n && text[i] !== '"') {
+      const c = text[i++];
+      if (c === '\n') fail('newline in string');
+      if (c !== '\\') { out += c; continue; }
+      const e = text[i++];
+      const map = { n: '\n', t: '\t', r: '\r', '"': '"', '\\': '\\', b: '\b', f: '\f' };
+      if (e in map) out += map[e];
+      else if (e === 'u' || e === 'U') {
+        const len = e === 'u' ? 4 : 8;
+        const hex = text.slice(i, i + len);
+        if (!/^[0-9a-fA-F]+$/.test(hex) || hex.length !== len) fail('bad unicode escape');
+        out += String.fromCodePoint(parseInt(hex, 16));
+        i += len;
+      } else fail(`bad escape \\${e}`);
+    }
+    if (i >= n) fail('unterminated string');
+    i++;
+    return out;
+  };
+  const parseKey = () => {
+    if (text[i] === '"' || text[i] === "'") return parseString();
+    const m = /^[A-Za-z0-9_-]+/.exec(text.slice(i, i + 200));
+    if (!m) fail('bad key');
+    i += m[0].length;
+    return m[0];
+  };
+  const parseValue = () => {
+    skipWs(false);
+    const c = text[i];
+    if (c === '"' || c === "'") return parseString();
+    if (c === '[') {
+      i++;
+      const arr = [];
+      for (;;) {
+        skipWs(true);
+        if (text[i] === ']') { i++; return arr; }
+        arr.push(parseValue());
+        skipWs(true);
+        if (text[i] === ',') i++;
+        else if (text[i] !== ']') fail('expected , or ] in array');
+      }
+    }
+    if (c === '{') {
+      i++;
+      const obj = {};
+      for (;;) {
+        skipWs(false);
+        if (text[i] === '}') { i++; return obj; }
+        const k = parseKey();
+        skipWs(false);
+        if (text[i++] !== '=') fail('expected = in inline table');
+        obj[k] = parseValue();
+        skipWs(false);
+        if (text[i] === ',') i++;
+        else if (text[i] !== '}') fail('expected , or } in inline table');
+      }
+    }
+    const m = /^[^\s,\]}#]+/.exec(text.slice(i, i + 200));
+    if (!m) fail('bad value');
+    i += m[0].length;
+    const raw = m[0];
+    if (raw === 'true') return true;
+    if (raw === 'false') return false;
+    if (/^[+-]?\d[\d_]*(\.\d+)?$/.test(raw)) return Number(raw.replace(/_/g, ''));
+    return fail(`unsupported value ${raw}`);
+  };
+  for (;;) {
+    skipWs(true);
+    if (i >= n) break;
+    if (text[i] === '[') {
+      const array = text[i + 1] === '[';
+      i += array ? 2 : 1;
+      const parts = [];
+      for (;;) {
+        skipWs(false);
+        parts.push(parseKey());
+        skipWs(false);
+        if (text[i] === '.') { i++; continue; }
+        break;
+      }
+      const close = array ? ']]' : ']';
+      if (!text.startsWith(close, i)) fail('bad table header');
+      i += close.length;
+      let t = root;
+      parts.forEach((p, idx) => {
+        const last = idx === parts.length - 1;
+        if (last && array) { (t[p] ||= []).push({}); t = t[p][t[p].length - 1]; }
+        else { const next = t[p] ||= {}; t = Array.isArray(next) ? next[next.length - 1] : next; }
+      });
+      table = t;
+    } else {
+      const k = parseKey();
+      skipWs(false);
+      if (text[i++] !== '=') fail('expected =');
+      if (Object.hasOwn(table, k)) fail(`duplicate key ${k}`);
+      table[k] = parseValue();
+    }
+    skipWs(false);
+    if (i < n && text[i] !== '\n') fail('unexpected trailing characters');
+  }
+  return root;
+}
+
+// ---- Cargo.lock ----
+
+export function lockedVersions(lockText) {
+  const map = new Map();
+  for (const block of lockText.split('[[package]]').slice(1)) {
+    const name = /^name = "([^"]+)"/m.exec(block)?.[1];
+    const version = /^version = "([^"]+)"/m.exec(block)?.[1];
+    if (!name || !version) continue;
+    if (!map.has(name)) map.set(name, new Set());
+    map.get(name).add(version);
+  }
+  return map;
+}
+
+// Full package graph: Map "name version" -> { name, version, deps: Set of "name version" }.
+// A dependency ref is "name" (unambiguous) or "name version" [(source)]; an ambiguous bare
+// name or an unknown ref is recorded in `unresolved` so the check fails closed.
+export function lockedGraph(lockText) {
+  const pkgs = [];
+  for (const block of lockText.split('[[package]]').slice(1)) {
+    const name = /^name = "([^"]+)"/m.exec(block)?.[1];
+    const version = /^version = "([^"]+)"/m.exec(block)?.[1];
+    if (!name || !version) continue;
+    const dm = /^dependencies = \[([\s\S]*?)^\]/m.exec(block);
+    const refs = dm ? [...dm[1].matchAll(/"([^"]+)"/g)].map(m => m[1]) : [];
+    pkgs.push({ name, version, refs });
+  }
+  const byName = new Map();
+  for (const p of pkgs) {
+    if (!byName.has(p.name)) byName.set(p.name, []);
+    byName.get(p.name).push(p.version);
+  }
+  const graph = new Map();
+  const unresolved = [];
+  for (const p of pkgs) {
+    const deps = new Set();
+    for (const ref of p.refs) {
+      const [dn, dv] = ref.split(' ');
+      const versions = byName.get(dn) ?? [];
+      const v = dv ?? (versions.length === 1 ? versions[0] : undefined);
+      if (!v || !versions.includes(v)) { unresolved.push(`${p.name} ${p.version} -> ${ref}`); continue; }
+      deps.add(`${dn} ${v}`);
+    }
+    graph.set(`${p.name} ${p.version}`, { name: p.name, version: p.version, deps });
+  }
+  return { graph, unresolved };
+}
+
+// A path hop is "name" or "name version"; returns the matching graph node ids.
+function hopNodes(graph, hop) {
+  const [n, v] = hop.trim().split(/\s+/);
+  return [...graph.keys()].filter(id => {
+    const node = graph.get(id);
+    return node.name === n && (v === undefined || node.version === v);
+  });
+}
+
+// ---- the check ----
+
+const isNonEmptyString = v => typeof v === 'string' && v.trim() !== '';
+const isStringArray = v => Array.isArray(v) && v.length > 0 && v.every(isNonEmptyString);
+
+function dateProblem(entryLabel, value, now) {
+  const m = DATE_RE.exec(value);
+  if (!m) return `${entryLabel}: reviewBy ${JSON.stringify(value)} is not an absolute YYYY-MM-DD date`;
+  const [y, mo, d] = [Number(m[1]), Number(m[2]), Number(m[3])];
+  const dt = new Date(Date.UTC(y, mo - 1, d));
+  if (dt.getUTCFullYear() !== y || dt.getUTCMonth() !== mo - 1 || dt.getUTCDate() !== d) {
+    return `${entryLabel}: reviewBy ${value} is not a real calendar date`;
+  }
+  const today = new Date(now);
+  if (Number.isNaN(today.getTime())) return `${entryLabel}: the gate clock is invalid`;
+  const todayUtc = Date.UTC(today.getUTCFullYear(), today.getUTCMonth(), today.getUTCDate());
+  if (todayUtc > dt.getTime()) return `${entryLabel}: reviewBy ${value} has expired; renew only with fresh evidence`;
+  return null;
+}
+
+export function checkAdvisoryExceptions({ root = process.cwd(), now = new Date(), readFile, allowPending = false } = {}) {
+  const read = readFile ?? (p => fs.readFileSync(path.join(root, p), 'utf8'));
+  const problems = [];
+  const load = (file, parse) => {
+    try { return parse(read(file)); } catch (err) { problems.push(`${file}: cannot read or parse (${err.message})`); return null; }
+  };
+
+  const doc = load(EXCEPTIONS_FILE, JSON.parse);
+  const deny = load(DENY_FILE, parseToml);
+  const audit = load(AUDIT_FILE, parseToml);
+  const lockPair = load(LOCK_FILE, t => ({ versions: lockedVersions(t), ...lockedGraph(t) }));
+  if (!doc || !deny || !audit || !lockPair) return problems;
+  const lock = lockPair.versions;
+  const { graph } = lockPair;
+  for (const u of lockPair.unresolved) problems.push(`${LOCK_FILE}: dependency ${u} does not resolve to exactly one locked package`);
+
+  if (doc.schema !== 1) problems.push(`${EXCEPTIONS_FILE}: schema must be 1`);
+  if (!Array.isArray(doc.exceptions)) {
+    problems.push(`${EXCEPTIONS_FILE}: exceptions must be an array`);
+    return problems;
+  }
+
+  // Entries.
+  const byId = new Map();
+  const valid = [];
+  doc.exceptions.forEach((e, idx) => {
+    const label = `${EXCEPTIONS_FILE} entry ${e?.id ?? `#${idx}`}`;
+    if (!e || typeof e !== 'object' || Array.isArray(e)) { problems.push(`${label}: not an object`); return; }
+    let ok = true;
+    for (const f of REQUIRED) {
+      if (!isNonEmptyString(e[f])) { problems.push(`${label}: missing field ${f}`); ok = false; }
+    }
+    if (!isStringArray(e.affectedVersions)) { problems.push(`${label}: missing field affectedVersions (non-empty array of exact versions)`); ok = false; }
+    if (e.unaffectedVersions !== undefined && !isStringArray(e.unaffectedVersions)) { problems.push(`${label}: unaffectedVersions must be a non-empty array when present`); ok = false; }
+    if (isNonEmptyString(e.id)) {
+      if (!ID_RE.test(e.id)) { problems.push(`${label}: id is not a RUSTSEC id`); ok = false; }
+      if (byId.has(e.id)) { problems.push(`${label}: duplicate id`); ok = false; } else byId.set(e.id, e);
+    }
+    if (isNonEmptyString(e.reviewBy)) {
+      const p = dateProblem(label, e.reviewBy, now);
+      if (p) { problems.push(p); ok = false; }
+    }
+    if (isNonEmptyString(e.approvedBy) && !allowPending && /pending/i.test(e.approvedBy)) {
+      problems.push(`${label}: approval is pending (${e.approvedBy})`);
+      ok = false;
+    }
+    if (ok) valid.push(e);
+    // Consumer scope: the exact reverse-dependency set, machine-checked from Cargo.lock.
+    if (isNonEmptyString(e.crate) && Array.isArray(e.affectedVersions)) {
+      if (!isStringArray(e.dependents)) {
+        problems.push(`${label}: missing field dependents (non-empty array of "name version" direct reverse dependencies)`);
+      } else {
+        const affected = new Set(e.affectedVersions.map(v => `${e.crate} ${v}`));
+        const actual = new Set();
+        for (const [id, node] of graph) for (const d of node.deps) if (affected.has(d)) actual.add(id);
+        const declared = new Set(e.dependents);
+        if (declared.size !== e.dependents.length) problems.push(`${label}: dependents has duplicates`);
+        for (const id of actual) if (!declared.has(id)) problems.push(`${label}: ${id} depends on ${e.crate} in ${LOCK_FILE} but is not in dependents (new consumer widens the suppression; needs fresh approval)`);
+        for (const id of declared) if (!actual.has(id)) problems.push(`${label}: dependents lists ${id}, which does not depend on an affected ${e.crate} in ${LOCK_FILE} (stale)`);
+      }
+    }
+    // Path documentation: every hop must be a real dependency edge, ending at the advisory crate.
+    if (isNonEmptyString(e.path) && isNonEmptyString(e.crate)) {
+      const hops = e.path.split('->').map(s => s.trim());
+      if (hops.length < 2 || hops.some(h => h === '')) problems.push(`${label}: path must have at least two hops separated by "->"`);
+      else {
+        if (hops[hops.length - 1].split(/\s+/)[0] !== e.crate) problems.push(`${label}: path must end at ${e.crate}`);
+        for (let h = 0; h + 1 < hops.length; h++) {
+          const from = hopNodes(graph, hops[h]);
+          const to = new Set(hopNodes(graph, hops[h + 1]));
+          if (!from.some(id => [...graph.get(id).deps].some(d => to.has(d)))) {
+            problems.push(`${label}: path hop "${hops[h]} -> ${hops[h + 1]}" is not a dependency edge in ${LOCK_FILE}`);
+          }
+        }
+      }
+    }
+    // Version scope applies even to an entry that failed another rule.
+    if (isNonEmptyString(e.crate) && Array.isArray(e.affectedVersions)) {
+      const locked = lock.get(e.crate);
+      const listed = new Set([...e.affectedVersions, ...(Array.isArray(e.unaffectedVersions) ? e.unaffectedVersions : [])]);
+      for (const v of listed) {
+        if (!locked || !locked.has(v)) problems.push(`${label}: version ${e.crate} ${v} is not in ${LOCK_FILE} (scope drift)`);
+      }
+      for (const v of locked ?? []) {
+        if (!listed.has(v)) problems.push(`${label}: ${LOCK_FILE} holds ${e.crate} ${v}, which the entry does not list (scope drift; the advisory may apply to it)`);
+      }
+      for (const v of e.affectedVersions) {
+        if ((e.unaffectedVersions ?? []).includes(v)) problems.push(`${label}: version ${v} is both affected and unaffected`);
+      }
+    }
+  });
+
+  // deny.toml.
+  const adv = deny.advisories;
+  const denyIgnore = adv && Array.isArray(adv.ignore) ? adv.ignore : null;
+  if (!denyIgnore) problems.push(`${DENY_FILE}: [advisories].ignore is missing`);
+  else {
+    const seen = new Set();
+    for (const item of denyIgnore) {
+      const id = typeof item === 'string' ? item : item?.id;
+      const reason = typeof item === 'string' ? undefined : item?.reason;
+      if (!isNonEmptyString(id)) { problems.push(`${DENY_FILE}: ignore item without an id`); continue; }
+      if (seen.has(id)) problems.push(`${DENY_FILE}: duplicate ignore ${id}`);
+      seen.add(id);
+      const entry = byId.get(id);
+      if (!entry) { problems.push(`${DENY_FILE}: ignore ${id} has no entry in ${EXCEPTIONS_FILE}`); continue; }
+      if (reason !== entry.rationale) problems.push(`${DENY_FILE}: ignore ${id} reason differs from the rationale in ${EXCEPTIONS_FILE}`);
+    }
+    for (const id of byId.keys()) if (!seen.has(id)) problems.push(`${EXCEPTIONS_FILE}: entry ${id} has no ignore in ${DENY_FILE}`);
+  }
+  if (adv) {
+    if (adv.yanked !== 'deny') problems.push(`${DENY_FILE}: [advisories] yanked must be "deny"`);
+    if (adv.unmaintained !== 'workspace') problems.push(`${DENY_FILE}: [advisories] unmaintained must be "workspace"`);
+  } else problems.push(`${DENY_FILE}: [advisories] section is missing`);
+
+  // audit.toml.
+  const auditIgnore = audit.advisories?.ignore;
+  if (!Array.isArray(auditIgnore) || !auditIgnore.every(x => typeof x === 'string')) {
+    problems.push(`${AUDIT_FILE}: [advisories].ignore must be an array of string ids`);
+  } else {
+    const set = new Set();
+    for (const id of auditIgnore) {
+      if (set.has(id)) problems.push(`${AUDIT_FILE}: duplicate ignore ${id}`);
+      set.add(id);
+      if (!byId.has(id)) problems.push(`${AUDIT_FILE}: ignore ${id} has no entry in ${EXCEPTIONS_FILE}`);
+    }
+    for (const id of byId.keys()) if (!set.has(id)) problems.push(`${AUDIT_FILE}: entry ${id} from ${EXCEPTIONS_FILE} is not ignored here (sets differ)`);
+  }
+
+  return problems;
+}
+
+// ---- CLI ----
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const args = process.argv.slice(2);
+  const root = path.resolve(import.meta.dirname, '..', '..');
+  const problems = checkAdvisoryExceptions({ root, allowPending: args.includes('--allow-pending') });
+  if (problems.length) {
+    for (const p of problems) console.error(`advisory-exceptions: ${p}`);
+    console.error(`advisory-exceptions: ${problems.length} problem(s)`);
+    process.exit(1);
+  }
+  console.log('advisory-exceptions: ok');
+}

package/apple-profile-create.mjs

@@ -4,7 +4,7 @@ import os from "node:os";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawnSync } from "./background-process.mjs";
-import { appleProfileAuth, decodeAppleProfile, signAppleApiJwt } from "./apple-profile-renew.mjs";
+import { appleProfileAuth, decodeAppleProfile, findAppleSigningCertificate, signAppleApiJwt } from "./apple-profile-renew.mjs";
 
 // right-release apple-profile-create: issue a Mac Development provisioning profile
 // (MAC_APP_DEVELOPMENT) for one explicit bundle id with the ICLOUD/CloudKit capability,
@@ -14,6 +14,7 @@ import { appleProfileAuth, decodeAppleProfile, signAppleApiJwt } from "./apple-p
 
 const ASC = "https://api.appstoreconnect.apple.com";
 const PROFILE_TYPE = "MAC_APP_DEVELOPMENT";
+const DIRECT_TYPE = "MAC_APP_DIRECT";
 export class AppleProfileCreateError extends Error {
   constructor(code, message) { super(message); this.name = "AppleProfileCreateError"; this.code = code; }
 }
@@ -56,7 +57,7 @@ const UDID_PATTERN = /^[A-Fa-f0-9-]{8,64}$/;
 
 export function parseCreateArgs(args) {
   const out = { configPath: undefined, bundleId: "", name: "", containers: [], type: PROFILE_TYPE, certificate: "create", out: "", dryRun: true, apply: false, registerDevices: [], keyOut: "" };
-  const values = { "--config": "configPath", "--bundle-id": "bundleId", "--name": "name", "--type": "type", "--certificate": "certificate", "--out": "out", "--key-out": "keyOut" };
+  const values = { "--config": "configPath", "--bundle-id": "bundleId", "--name": "name", "--type": "type", "--certificate": "certificate", "--out": "out", "--key-out": "keyOut", "--expected-team": "expectedTeam", "--expected-keychain-group": "expectedKeychainGroup" };
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
     if (arg === "--dry-run") out.dryRun = true;
@@ -71,10 +72,10 @@ export function parseCreateArgs(args) {
   }
   if (out.apply && args.includes("--dry-run")) fail("APPLE_PROFILE_USAGE", "--dry-run and --apply are mutually exclusive.");
   out.dryRun = !out.apply;
-  if (out.type !== PROFILE_TYPE) fail("APPLE_PROFILE_USAGE", `--type must be ${PROFILE_TYPE} (the only supported value).`);
+  validateProfileMode(out);
   if (!BUNDLE_PATTERN.test(out.bundleId)) fail("APPLE_PROFILE_USAGE", "--bundle-id must be an explicit bundle identifier (no wildcard).");
   if (!out.name.trim()) fail("APPLE_PROFILE_USAGE", "--name is required.");
-  if (!out.containers.length) fail("APPLE_PROFILE_USAGE", "At least one --icloud-container is required.");
+  if (out.type === PROFILE_TYPE && !out.containers.length) fail("APPLE_PROFILE_USAGE", "At least one --icloud-container is required.");
   for (const container of out.containers) if (!CONTAINER_PATTERN.test(container)) fail("APPLE_PROFILE_USAGE", `Invalid iCloud container identifier: ${container}`);
   for (const udid of out.registerDevices) if (!UDID_PATTERN.test(udid)) fail("APPLE_PROFILE_USAGE", `Invalid device UDID: ${udid}`);
   if (!out.out) fail("APPLE_PROFILE_USAGE", "--out <profile path> is required.");
@@ -82,6 +83,15 @@ export function parseCreateArgs(args) {
   return out;
 }
 
+function validateProfileMode({ type, certificate, containers = [], registerDevices = [], keyOut, expectedTeam, expectedKeychainGroup }) {
+  if (![PROFILE_TYPE, DIRECT_TYPE].includes(type)) fail("APPLE_PROFILE_USAGE", `--type must be ${PROFILE_TYPE} or ${DIRECT_TYPE}.`);
+  if (type !== DIRECT_TYPE) return;
+  if (!/^[A-Z0-9]{10}$/.test(expectedTeam ?? "")) fail("APPLE_PROFILE_USAGE", "Direct profiles require --expected-team <10-character team id>.");
+  if (typeof expectedKeychainGroup !== "string" || !expectedKeychainGroup.startsWith(`${expectedTeam}.`) || !BUNDLE_PATTERN.test(expectedKeychainGroup.slice(expectedTeam.length + 1))) fail("APPLE_PROFILE_USAGE", "Direct profiles require one exact --expected-keychain-group prefixed by expected team (no wildcard).");
+  if (!/^[A-Za-z0-9]{4,40}$/.test(certificate ?? "") || certificate === "create") fail("APPLE_PROFILE_USAGE", "Direct profiles require --certificate <existing ASC certificate id>.");
+  if (containers.length || registerDevices.length || keyOut) fail("APPLE_PROFILE_USAGE", "Direct profiles refuse iCloud containers, device registration & key output.");
+}
+
 // Key material must never ride in config, the environment or arguments. Unlike the
 // renew command this refusal applies on every host.
 export function assertNoInlinePem(env, config, extra = []) {
@@ -113,10 +123,11 @@ function localDevelopmentIdentities(run, now, { tolerant }) {
 
 // ---- main flow ---------------------------------------------------------------------
 
-export async function createAppleProfile({ root, config = {}, bundleId, name, containers, type = PROFILE_TYPE, certificate = "create", out, dryRun = true, registerDevices = [], keyOut = "", env = process.env, run = spawnSync, fetch: fetchApi = globalThis.fetch, jwtSigner = signAppleApiJwt, now = new Date(), log = console.log, platform = process.platform, home = os.homedir() }) {
-  if (type !== PROFILE_TYPE) fail("APPLE_PROFILE_USAGE", `--type must be ${PROFILE_TYPE}.`);
+export async function createAppleProfile({ root, config = {}, bundleId, name, containers = [], type = PROFILE_TYPE, certificate = "create", out, dryRun = true, registerDevices = [], keyOut = "", expectedTeam, expectedKeychainGroup, env = process.env, run = spawnSync, fetch: fetchApi = globalThis.fetch, jwtSigner = signAppleApiJwt, now = new Date(), log = console.log, platform = process.platform, home = os.homedir() }) {
+  validateProfileMode({ type, certificate, containers, registerDevices, keyOut, expectedTeam, expectedKeychainGroup });
   if (!BUNDLE_PATTERN.test(bundleId ?? "")) fail("APPLE_PROFILE_USAGE", "bundleId must be an explicit bundle identifier.");
-  if (!containers?.length) fail("APPLE_PROFILE_USAGE", "At least one iCloud container is required.");
+  if (!name?.trim() || !out) fail("APPLE_PROFILE_USAGE", "Profile name & output path are required.");
+  if (type === PROFILE_TYPE && !containers?.length) fail("APPLE_PROFILE_USAGE", "At least one iCloud container is required.");
   assertNoInlinePem(env, config, [["--certificate", certificate], ["--name", name]]);
   if (!dryRun && platform !== "darwin") fail("APPLE_PROFILE_PLATFORM", "A real run decodes the issued profile and uses the Keychain; run it on the macOS host.");
   const outFile = path.resolve(root, out);
@@ -155,12 +166,14 @@ export async function createAppleProfile({ root, config = {}, bundleId, name, co
     }
     return items;
   };
-  const plan = { dryRun, command: "apple-profile-create", profileType: PROFILE_TYPE, out: outFile, name, calls, planned };
+  const plan = { dryRun, command: "apple-profile-create", profileType: type, out: outFile, name, calls, planned };
   const mutate = async (method, endpoint, body) => {
     if (dryRun) { planned.push({ method, path: endpoint, ...(body ? { body } : {}) }); log(`PLANNED ${method} ${endpoint}${body ? ` ${JSON.stringify(body)}` : ""}`); return null; }
     return request(method, endpoint, body);
   };
 
+  if (type === DIRECT_TYPE) return createDirectProfile({ bundleId, name, certificate, expectedTeam, expectedKeychainGroup, outFile, dryRun, env, run, now, log, request, list, mutate, plan });
+
   // (1) bundle id
   const bundles = await list(query("/v1/bundleIds", { "filter[identifier]": bundleId, limit: "200" }));
   let bundle = bundles.find((item) => item.attributes?.identifier === bundleId && ["MAC_OS", "UNIVERSAL"].includes(item.attributes?.platform));
@@ -290,6 +303,96 @@ export async function createAppleProfile({ root, config = {}, bundleId, name, co
   return { ...plan, profileId: profile.id, identitySha1: certificateSha1 };
 }
 
+// Direct profiles authorize one selected existing Developer ID identity. No device,
+// capability, certificate or key creation is reachable from this branch.
+async function createDirectProfile({ bundleId, name, certificate, expectedTeam, expectedKeychainGroup, outFile, dryRun, env, run, now, log, request, list, mutate, plan }) {
+  const ascCert = (await request("GET", `/v1/certificates/${enc(certificate)}`)).data;
+  if (!ascCert?.id || ascCert.id !== certificate) fail("APPLE_PROFILE_CERT_NOT_IN_ASC", "Selected certificate is absent from ASC.");
+  if (!["DEVELOPER_ID_APPLICATION", "DEVELOPER_ID_APPLICATION_G2"].includes(ascCert.attributes?.certificateType)) fail("APPLE_PROFILE_CERT_TYPE", "Direct profiles require an existing DEVELOPER_ID_APPLICATION or DEVELOPER_ID_APPLICATION_G2 certificate.");
+  if (!(Date.parse(ascCert.attributes?.expirationDate) > now.getTime())) fail("APPLE_PROFILE_CERT_EXPIRED", "Selected ASC certificate is expired.");
+  let leaf;
+  try { leaf = new X509Certificate(Buffer.from(ascCert.attributes?.certificateContent ?? "", "base64")); }
+  catch { fail("APPLE_PROFILE_API_INVALID", "Selected ASC certificate has no valid public DER certificate."); }
+  const certificateSha1 = sha1(leaf.raw);
+  const identity = findAppleSigningCertificate({ type: DIRECT_TYPE, team: expectedTeam }, { env: { ...env, APPLE_SIGNING_IDENTITY: certificateSha1 }, run, now });
+  if (identity.sha1 !== certificateSha1 || serial(identity.serialNumber) !== serial(ascCert.attributes?.serialNumber)) fail("APPLE_PROFILE_CERT_MISMATCH", "Selected ASC certificate does not match local Developer ID identity.");
+  plan.teamIdentifier = expectedTeam;
+  plan.expectedKeychainGroup = expectedKeychainGroup;
+  plan.certificate = { ...identity, id: ascCert.id, mode: "explicit", privateKeyInKeychain: true };
+
+  const bundles = await list(query("/v1/bundleIds", { "filter[identifier]": bundleId, limit: "200" }));
+  const matching = bundles.filter((item) => item.attributes?.identifier === bundleId);
+  if (matching.length > 1 || (matching.length && !["MAC_OS", "UNIVERSAL"].includes(matching[0].attributes?.platform))) fail("APPLE_PROFILE_BUNDLE_CONFLICT", "Existing bundle identifier has conflicting platform or duplicate resources.");
+  let bundle = matching[0];
+  // Look across types so a dedicated name is never silently duplicated.
+  const profiles = (await list(query("/v1/profiles", { "filter[name]": name, limit: "200" }))).filter((item) => item.attributes?.name === name);
+  if (profiles.length > 1) fail("APPLE_PROFILE_NAME_CONFLICT", "More than one profile already uses this dedicated name.");
+  let profile = profiles[0];
+  if (profile) {
+    const [bundleRel, certRel] = await Promise.all([request("GET", `/v1/profiles/${enc(profile.id)}/bundleId`), list(`/v1/profiles/${enc(profile.id)}/certificates`)]);
+    if (!bundle?.id || profile.attributes?.profileType !== DIRECT_TYPE || profile.attributes?.profileState !== "ACTIVE" || !(Date.parse(profile.attributes?.expirationDate) > now.getTime())
+      || bundleRel.data?.id !== bundle.id || certRel.length !== 1 || certRel[0].id !== ascCert.id) fail("APPLE_PROFILE_NAME_CONFLICT", "Existing named profile does not match direct type, bundle & selected certificate.");
+  }
+  plan.bundleId = { identifier: bundleId, id: bundle?.id ?? null, action: bundle ? "reuse" : "create" };
+  if (!bundle) {
+    const result = await mutate("POST", "/v1/bundleIds", { data: { type: "bundleIds", attributes: { identifier: bundleId, name: name.replace(/[^A-Za-z0-9 ]/g, " ").trim() || bundleId, platform: "MAC_OS" } } });
+    if (result) {
+      bundle = result.data;
+      if (!bundle?.id || bundle.attributes?.identifier !== bundleId || !["MAC_OS", "UNIVERSAL"].includes(bundle.attributes?.platform)) fail("APPLE_PROFILE_API_INVALID", "ASC returned an unexpected created bundle identifier.");
+      plan.bundleId.id = bundle.id;
+    }
+  }
+  plan.profile = { id: profile?.id ?? null, action: profile ? "reuse" : "create" };
+  if (!profile) {
+    const body = { data: { type: "profiles", attributes: { name, profileType: DIRECT_TYPE }, relationships: {
+      bundleId: { data: { type: "bundleIds", id: bundle?.id ?? "<new bundleId>" } }, certificates: { data: [{ type: "certificates", id: ascCert.id }] } } } };
+    const result = await mutate("POST", "/v1/profiles", body);
+    if (result) {
+      profile = result.data;
+      if (!profile?.id) fail("APPLE_PROFILE_API_INVALID", "ASC did not return a created profile id.");
+      plan.profile.id = profile.id;
+    }
+  }
+  plan.verification = "Exact team, application identifier, OSX, expiry, all devices, debugging disabled, selected DER fingerprint & exact keychain group authorization; app must request only its exact group.";
+  log(JSON.stringify({ ...plan, calls: undefined }, null, 2));
+  if (dryRun) { plan.writes = `would write ${outFile} (0600)`; return plan; }
+  const content = profile.attributes?.profileContent ?? (await request("GET", `/v1/profiles/${enc(profile.id)}`)).data?.attributes?.profileContent;
+  if (typeof content !== "string" || !content || !/^[A-Za-z0-9+/]+={0,2}$/.test(content)) fail("APPLE_PROFILE_API_INVALID", "ASC profileContent is missing or invalid.");
+  mkdirSync(path.dirname(outFile), { recursive: true });
+  const temporary = `${outFile}.create-${randomUUID()}.tmp`;
+  try {
+    writeFileSync(temporary, Buffer.from(content, "base64"), { flag: "wx", mode: 0o600 });
+    verifyDirectProfile(decodeAppleProfile(temporary, { run }), { bundleId, name, expectedTeam, expectedKeychainGroup, certificateSha1, now });
+    if (existsSync(outFile)) copyFileSync(outFile, `${outFile}.backup-${now.toISOString().replace(/[:.]/g, "-")}-${randomUUID()}`, constants.COPYFILE_EXCL);
+    renameSync(temporary, outFile);
+    chmodSync(outFile, 0o600);
+  } finally { rmSync(temporary, { force: true }); }
+  log(`Wrote ${outFile}; Developer ID identity SHA-1 ${certificateSha1}`);
+  return { ...plan, profileId: profile.id, identitySha1: certificateSha1 };
+}
+
+export function verifyDirectProfile(decoded, { bundleId, name, expectedTeam, expectedKeychainGroup, certificateSha1, now }) {
+  const problems = [], entitlements = decoded.Entitlements ?? {};
+  if (decoded.Name !== name) problems.push("profile name mismatch");
+  if (!Array.isArray(decoded.TeamIdentifier) || decoded.TeamIdentifier.length !== 1 || decoded.TeamIdentifier[0] !== expectedTeam) problems.push("team mismatch");
+  if (entitlements["com.apple.developer.team-identifier"] !== expectedTeam) problems.push("entitlement team mismatch");
+  const appKeys = ["com.apple.application-identifier", "application-identifier"].filter((key) => Object.hasOwn(entitlements, key));
+  if (!appKeys.length || appKeys.some((key) => entitlements[key] !== `${expectedTeam}.${bundleId}`)) problems.push("application identifier mismatch");
+  if (!Array.isArray(decoded.Platform) || !decoded.Platform.includes("OSX")) problems.push("not a macOS profile");
+  if (!(Date.parse(decoded.ExpirationDate) > now.getTime())) problems.push("expired or missing expiration");
+  if (decoded.ProvisionsAllDevices !== true) problems.push("not an all-devices direct profile");
+  const debugKeys = ["get-task-allow", "com.apple.security.get-task-allow"].filter((key) => Object.hasOwn(entitlements, key));
+  // Profiles carry an entitlement allowlist (Apple TN3125). Direct profiles may
+  // omit debugging entirely; every present alias must still be boolean false.
+  if (debugKeys.some((key) => entitlements[key] !== false)) problems.push("debugging is not disabled");
+  if (!certificateSha1 || !(decoded.DeveloperCertificates ?? []).some((data) => sha1(Buffer.from(data, "base64")) === certificateSha1)) problems.push("selected certificate not authorized");
+  const groups = entitlements["keychain-access-groups"];
+  // Apple-issued terminal wildcards may authorize an exact app group. This never
+  // changes the app's requested entitlements or permits wildcard CLI input.
+  if (!Array.isArray(groups) || !groups.some((group) => group === expectedKeychainGroup || (typeof group === "string" && group.startsWith(`${expectedTeam}.`) && /^[^*]+\*$/u.test(group) && expectedKeychainGroup.startsWith(group.slice(0, -1))))) problems.push("keychain group not authorized");
+  if (problems.length) fail("APPLE_PROFILE_VERIFY_FAILED", `Direct profile failed verification: ${problems.join("; ")}.`);
+}
+
 export function verifyIssuedProfile(decoded, { bundleId, containers, certificateSha1, deviceUdids, now }) {
   const other = [], missing = [];
   const entitlements = decoded.Entitlements ?? {};
@@ -345,7 +448,7 @@ async function createCertificate({ commonName, request, run, keyOut, home, log }
 
 export async function main(args = process.argv.slice(2), options = {}) {
   if (args.includes("--help") || args.includes("-h")) {
-    (options.log ?? console.log)("right-release apple-profile-create --bundle-id <id> --name <profile name> --icloud-container <iCloud.x> [--icloud-container ...] --out <profile path>\n  [--config <file>] [--type MAC_APP_DEVELOPMENT] [--certificate <asc cert id>|create] [--register-device <UDID>]... [--key-out <file>] [--dry-run | --apply]\nDefault is --dry-run (GET discovery only). Uses APPLE_API_ISSUER, APPLE_API_KEY & APPLE_API_KEY_PATH or appStoreConnect.* in the config; inline PEM is refused.\nThe ASC API cannot create or assign iCloud containers; the issued profile is verified and the command prints manual steps if the container is missing.");
+    (options.log ?? console.log)("right-release apple-profile-create --bundle-id <id> --name <profile name> --out <profile path>\n  [--config <file>] [--type MAC_APP_DEVELOPMENT|MAC_APP_DIRECT] [--certificate <asc cert id>|create] [--dry-run | --apply]\nDevelopment: --icloud-container <iCloud.x>... [--register-device <UDID>]... [--key-out <file>]\nDirect: --certificate <existing ASC Developer ID cert id> --expected-team <team id> --expected-keychain-group <exact group>; refuses iCloud, devices & key output.\nDefault is --dry-run (GET discovery only). Uses APPLE_API_ISSUER, APPLE_API_KEY & APPLE_API_KEY_PATH or appStoreConnect.* in the config; inline PEM is refused.\nThe ASC API cannot create or assign iCloud containers; the issued profile is verified and the command prints manual steps if the container is missing.");
     return;
   }
   const parsed = parseCreateArgs(args);
@@ -354,7 +457,7 @@ export async function main(args = process.argv.slice(2), options = {}) {
   let config = {};
   if (existsSync(absolute)) { const loaded = await import(pathToFileURL(absolute)); config = loaded.default ?? loaded.config ?? loaded; }
   else if (parsed.configPath) fail("APPLE_PROFILE_USAGE", `Config file not found: ${parsed.configPath}`);
-  return createAppleProfile({ ...options, root: path.dirname(absolute), config, bundleId: parsed.bundleId, name: parsed.name, containers: parsed.containers, type: parsed.type, certificate: parsed.certificate, out: parsed.out, dryRun: parsed.dryRun, registerDevices: parsed.registerDevices, keyOut: parsed.keyOut });
+  return createAppleProfile({ ...options, root: path.dirname(absolute), config, ...parsed });
 }
 
 const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };