catalyst-core 1.1.0 → 1.2.0-canary.2

package/dist/native/buildIos/index.js

@@ -6,6 +6,7 @@ const {
   spawn
 } = require("child_process");
 const fs = require("fs");
+const os = require("os");
 const path = require("path");
 const {
   displayPath
@@ -14,6 +15,38 @@ const TerminalProgress = require("../terminalProgress.js").default;
 const {
   buildFailure
 } = require("../../cli/diagnostic.js");
+const {
+  nativeError
+} = require("../utils.js");
+const {
+  resolveNativeConfig
+} = require("../nativeConfig.js");
+const {
+  resolveCredentials
+} = require("../credentials.js");
+const {
+  isReleaseBuildType,
+  resolveExportMethod,
+  readIosCredentials,
+  planIosSigning,
+  xcodeAuthArgs,
+  setupP12Signing,
+  buildExportOptions,
+  writeExportOptionsPlist,
+  isSigningFailure,
+  signingSetupError
+} = require("./signing.js");
+const {
+  generateLocalhostP12
+} = require("./localhostCert.js");
+const {
+  artifactBaseName,
+  releaseOutputDir
+} = require("./output.js");
+const {
+  DEFAULT_VERSION_NAME,
+  assertReleaseFolderFree
+} = require("../releaseOutput.js");
 const createConfigPhase = require("./config.js");
 const createPluginsPhase = require("./plugins.js");
 const createAssetsPhase = require("./assets.js");
@@ -26,11 +59,124 @@ const pwd = path.join(catalystCorePath, "dist/native");
 const MANAGED_BASELINE_SUFFIX = ".catalyst-base";
 const shellCommand = process.platform === "win32" ? "cmd.exe" : "sh";
 const shellArgs = command => process.platform === "win32" ? ["/d", "/s", "/c", command] : ["-c", command];
-function createIosBuild(config) {
+
+// The steps of `catalyst buildApp:ios`. buildAppIos.js creates the progress
+// with these, so the toolchain and target steps show before the build exists.
+const IOS_BUILD_STEPS = {
+  toolchain: "Check Xcode",
+  target: "Choose simulator or iPhone",
+  server: "Start dev server",
+  signing: "Resolve signing",
+  config: "Generate build configuration",
+  launchSimulator: "Launch iOS simulator",
+  clean: "Clean build artifacts",
+  assets: "Process notification assets",
+  build: "Build iOS project",
+  findApp: "Locate built application",
+  install: "Install application",
+  launch: "Launch application",
+  archive: "Archive release build",
+  export: "Export IPA"
+};
+
+/**
+ * @param {object} config - { WEBVIEW_CONFIG, BUILD_OUTPUT_PATH } from config.json
+ * @param {object} [options]
+ * @param {object} [options.progress] - an existing TerminalProgress to continue (buildAppIos.js passes one made with IOS_BUILD_STEPS)
+ * @param {boolean} [options.release] - `--release`: archive and export the store IPA whatever ios.buildType says
+ * @param {string} [options.url] - `--url`: the release's production URL, over WEBVIEW_CONFIG.url
+ * @param {string} [options.devHost] - debug: the host the app reaches the dev server on (localhost for the simulator, the Mac's `.local` name or LAN IP for an iPhone)
+ * @param {{ target: "simulator", name?: string, udid?: string } | { target: "device", name: string, udid: string }} [options.target] - debug: from buildAppIos.js; without it, the configured simulator
+ * @param {string} [options.appRoot] - the app root, for credentials/ and build-output/
+ * @param {Record<string, string | undefined>} [options.env]
+ */
+function createIosBuild(config, {
+  progress: existingProgress,
+  release: releaseFlag = false,
+  url: urlFlag,
+  devHost,
+  target,
+  appRoot = process.cwd(),
+  env = process.env
+} = {}) {
   const {
-    WEBVIEW_CONFIG,
     BUILD_OUTPUT_PATH
   } = config;
+  const release = Boolean(releaseFlag || isReleaseBuildType(config.WEBVIEW_CONFIG?.ios?.buildType));
+  const progress = existingProgress || new TerminalProgress(IOS_BUILD_STEPS, "catalyst buildApp", {
+    subject: "ios"
+  });
+  const log = (message, type) => progress.log(message, type);
+
+  // ─── Config resolution, before anything reads the config ──────────────────
+  // nativeConfig.js turns url/appId/appName into the legacy keys this shell
+  // reads, points a debug build at the dev server, and for a release guards
+  // the start URL and the app id. All of it fails here, before Xcode runs.
+
+  const resolved = resolveNativeConfig("ios", {
+    release,
+    url: urlFlag,
+    devHost,
+    config,
+    cwd: appRoot,
+    env,
+    log
+  });
+  // iOS reads the resolved config in memory; Gradle is the one that needs the file.
+  resolved.cleanup();
+  const WEBVIEW_CONFIG = resolved.WEBVIEW_CONFIG;
+  const {
+    version,
+    usesDevServer
+  } = resolved;
+  // Before signing files are read or Xcode runs: a second release in the
+  // same minute would overwrite the first one's IPA.
+  if (release) assertReleaseFolderFree(releaseOutputDir(appRoot, version), [".ipa"]);
+  const exportMethod = release ? resolveExportMethod(WEBVIEW_CONFIG.ios || {}, {
+    log
+  }) : undefined;
+
+  // Signing files come from credentials/ios/, or in CI from
+  // CATALYST_IOS_CREDENTIALS unpacked to a temp folder that cleanup()
+  // removes. A release reads them up front; a debug build only when it
+  // signs for an iPhone (a simulator build never signs).
+  let credentials = null;
+  function loadCredentials() {
+    if (credentials) return credentials;
+    const found = resolveCredentials("ios", {
+      cwd: appRoot,
+      env,
+      log
+    });
+    try {
+      credentials = {
+        ...readIosCredentials(found.dir, {
+          env
+        }),
+        source: found.source,
+        cleanup: found.cleanup
+      };
+    } catch (error) {
+      found.cleanup();
+      throw error;
+    }
+    return credentials;
+  }
+  if (release) loadCredentials();
+  const signingPlan = planIosSigning({
+    iosConfig: WEBVIEW_CONFIG.ios || {},
+    credentials,
+    release,
+    exportMethod
+  });
+  // Automatic signing uses the API key when there is one: cloud signing
+  // for a release, development signing for an iPhone.
+  const resolveApiKey = () => signingPlan.style === "automatic" ? loadCredentials().apiKey : null;
+  const apiKey = release ? resolveApiKey() : null;
+  if (release && signingPlan.style === "automatic" && !signingPlan.teamId) {
+    credentials?.cleanup();
+    throw nativeError("IOS-010", "a signed release with automatic signing needs WEBVIEW_CONFIG.ios.developmentTeam");
+  }
   const iosConfig = WEBVIEW_CONFIG.ios;
   const isGoogleSignInEnabled = WEBVIEW_CONFIG.googleSignIn?.enabled ?? false;
   const protocol = WEBVIEW_CONFIG.useHttps ? "https" : "http";
@@ -41,22 +187,10 @@ function createIosBuild(config) {
   const PROJECT_DIR = `${pwd}/iosnativeWebView`;
   const SCHEME_NAME = iosConfig.scheme || "iosnativeWebView";
   const APP_BUNDLE_ID = iosConfig.appBundleId || "com.debug.webview";
+  // What Shared.xcconfig sets as PRODUCT_BUNDLE_IDENTIFIER (generateXCConfig).
+  const PRODUCT_BUNDLE_ID = iosConfig.bundleIdentifier || iosConfig.appBundleId || "com.catalyst.framework.app";
   const PROJECT_NAME = path.basename(PROJECT_DIR);
-  const IPHONE_MODEL = iosConfig.simulatorName;
-  const steps = {
-    config: "Generate build configuration",
-    deviceDetection: "Detect physical device",
-    launchSimulator: "Launch iOS simulator",
-    clean: "Clean build artifacts",
-    assets: "Process notification assets",
-    build: "Build iOS project",
-    findApp: "Locate built application",
-    install: "Install application",
-    launch: "Launch application"
-  };
-  const progress = new TerminalProgress(steps, "catalyst buildApp", {
-    subject: "ios"
-  });
+  const IPHONE_MODEL = target?.target === "simulator" && target.name || iosConfig.simulatorName || "Catalyst iPhone";
 
   // ─── Low-level helpers shared across modules ──────────────────────────────
 
@@ -107,12 +241,16 @@ function createIosBuild(config) {
    * on the spinner's own row. The full output is still resolved for callers
    * that parse it.
    */
-  function runCommandStreaming(command) {
+  function runCommandStreaming(command, args) {
     return new Promise((resolve, reject) => {
       progress.pause();
 
+      // With `args`, the program runs directly with that argv (no shell
+      // quoting to get wrong); without, `command` is a shell string.
       // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process - Internal build command strings, same source as runCommand.
-      const child = spawn(shellCommand, shellArgs(command), {
+      const child = Array.isArray(args) ? spawn(command, args, {
+        stdio: ["ignore", "pipe", "pipe"]
+      }) : spawn(shellCommand, shellArgs(command), {
         stdio: ["ignore", "pipe", "pipe"]
       });
       let output = "";
@@ -204,7 +342,7 @@ function createIosBuild(config) {
     WEBVIEW_CONFIG,
     BUILD_OUTPUT_PATH,
     // Captured before the build chdirs into the Xcode project.
-    appRoot: process.cwd(),
+    appRoot,
     iosConfig,
     isGoogleSignInEnabled,
     PROJECT_DIR,
@@ -215,6 +353,15 @@ function createIosBuild(config) {
     url,
     PUBLIC_PATH,
     progress,
+    release,
+    version,
+    target,
+    // Debug Info.plist gets NSAllowsLocalNetworking when the app loads the dev server.
+    localNetworking: !release && usesDevServer,
+    signingPlan,
+    apiKey,
+    resolveApiKey,
+    apsEnvironment: signingPlan.apsEnvironment,
     runCommand,
     runCommandStreaming,
     getXcodeProjectFilePath,
@@ -248,9 +395,7 @@ function createIosBuild(config) {
     buildXcodeProject,
     buildProjectForTesting,
     findAppPath,
-    moveAppToBuildOutput,
     installAndLaunchApp,
-    detectPhysicalDevices,
     buildProjectForPhysicalDevice,
     findPhysicalDeviceAppPath,
     installAndLaunchOnPhysicalDevice,
@@ -258,6 +403,19 @@ function createIosBuild(config) {
     getBootedSimulatorUUID
   } = createBuildPhase(ctx);
 
+  /** A fresh self-signed localhost identity for the in-app HTTPS server, every build. */
+  function generateLocalhostCertificate() {
+    generateLocalhostP12(path.join(PROJECT_DIR, PROJECT_NAME, "localhost.p12"));
+  }
+
+  /** Remove a leftover file at this path (e.g. dSYMs from a failed export) before writing it. */
+  function clearArtifact(file) {
+    fs.rmSync(file, {
+      recursive: true,
+      force: true
+    });
+  }
+
   // ─── Orchestrated build flows ─────────────────────────────────────────────
 
   async function buildForIOS(pluginComposition = {}) {
@@ -272,11 +430,16 @@ function createIosBuild(config) {
       await generateXCConfig();
       await copySplashscreenAssets();
       await copyAppIcon();
+      generateLocalhostCertificate();
       process.chdir(PROJECT_DIR);
-      const physicalDevice = await detectPhysicalDevices();
+      // buildAppIos.js chose the target before the config was resolved,
+      // so the dev server host fits it. No target means the simulator.
+      const physicalDevice = target?.target === "device" ? {
+        name: target.name,
+        udid: target.udid
+      } : null;
       let APP_PATH, targetInfo;
       if (physicalDevice) {
-        progress.log("Building for physical device workflow", "success");
         targetInfo = {
           type: "physical",
           name: physicalDevice.name,
@@ -285,14 +448,17 @@ function createIosBuild(config) {
         await cleanBuildArtifacts();
         progress.start("build");
         try {
+          if (!ctx.apiKey) ctx.apiKey = ctx.resolveApiKey();
           await buildProjectForPhysicalDevice(SCHEME_NAME, APP_BUNDLE_ID, path.join(process.env.HOME, "Library/Developer/Xcode/DerivedData"), PROJECT_NAME, physicalDevice);
           progress.complete("build");
         } catch (error) {
           // The diagnostic in the catch below shows what xcodebuild
-          // said, with a signing hint when that is the cause; a fixed
-          // checklist here only guessed.
-          error.stage = error.stage || "Building for the device";
-          throw error;
+          // said. A signing failure gets IOS-010, which names both
+          // ways to set signing up. Not checked up front: an Apple
+          // account signed in to Xcode signs fine without either.
+          const failure = isSigningFailure(error.output) ? signingSetupError("Xcode could not sign the device build", error) : error;
+          failure.stage = failure.stage || "Building for the device";
+          throw failure;
         }
         progress.start("findApp");
         try {
@@ -315,23 +481,22 @@ function createIosBuild(config) {
         APP_PATH = await findAppPath();
         progress.log("Found app at: " + APP_PATH, "success");
         await installAndLaunchApp(APP_PATH);
-        const MOVED_APP_PATH = await moveAppToBuildOutput(APP_PATH);
-        APP_PATH = MOVED_APP_PATH;
       }
       // Same aligned key/value shape as the Android summary and the
-      // Config tree the setup commands print.
+      // Config tree the setup commands print. The .app stays in
+      // DerivedData: a debug build copies nothing into the app.
       const deviceName = `${targetInfo.name}${targetInfo.type === "physical" ? "" : " simulator"}`;
       progress.printTreeContent("Build", [{
         text: `device     ${deviceName}`,
         color: "gray"
       }, {
-        text: `artifact   ${displayPath(APP_PATH, originalDir)}`,
+        text: `app        ${displayPath(APP_PATH, originalDir)}`,
         color: "gray"
       }, {
         text: `loads      ${url}`,
         color: "gray"
       }]);
-      progress.summary(`Installed on ${deviceName}`, "Run catalyst start to serve the app");
+      progress.summary(`Installed on ${deviceName}`, usesDevServer ? "Edit your code; the app reloads from the dev server" : "Open the app");
       return {
         success: true,
         targetInfo,
@@ -352,6 +517,152 @@ function createIosBuild(config) {
       process.chdir(originalDir);
     }
   }
+
+  /**
+   * The store build: `xcodebuild archive` in Release for a generic iOS
+   * device, then `-exportArchive` to an IPA, with the IPA and zipped dSYMs
+   * written to build-output/ios/<version>-<build>/.
+   */
+  async function buildReleaseForIOS(pluginComposition = {}) {
+    const originalDir = process.cwd();
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - fixed prefix under the OS temp dir.
+    const workDir = fs.mkdtempSync(path.join(os.tmpdir(), "catalyst-ios-release-"));
+    let p12Signing = null;
+    try {
+      await generatePackageSwift(pluginComposition.iosDependencies);
+      await updateXcodeProjectPackageDependencies();
+      progress.start("assets");
+      await processNotificationAssets(WEBVIEW_CONFIG);
+      await copyOfflinePage();
+      progress.complete("assets");
+      progress.start("signing");
+      const signing = {
+        ...signingPlan
+      };
+      if (signingPlan.p12) {
+        p12Signing = setupP12Signing({
+          p12: credentials.p12,
+          bundleId: PRODUCT_BUNDLE_ID,
+          env,
+          log
+        });
+        signing.provisioningProfile = p12Signing.profile.name;
+        signing.identity = p12Signing.identity.sha1;
+        signing.teamId = p12Signing.profile.teamId || signing.teamId;
+      } else if (signing.style === "manual" && exportMethod !== "debugging") {
+        signing.identity = "iPhone Distribution";
+      }
+      const from = credentials?.source === "env" ? "CATALYST_IOS_CREDENTIALS" : "credentials/ios";
+      if (signingPlan.p12) {
+        progress.log(`Local signing with the .p12 and profile from ${from}`, "info");
+      } else if (signing.style === "manual") {
+        progress.log(`Manual signing with profile "${signing.provisioningProfile}"`, "info");
+      } else {
+        progress.log(ctx.apiKey ? `Cloud signing for team ${signing.teamId} with App Store Connect key ${ctx.apiKey.keyId} from ${from}` : `Automatic signing for team ${signing.teamId} with the Apple account signed in to Xcode`, "info");
+      }
+      progress.complete("signing");
+      await generateXCConfig({
+        signing,
+        version
+      });
+      await copySplashscreenAssets();
+      await copyAppIcon({
+        release: true
+      });
+      generateLocalhostCertificate();
+      process.chdir(PROJECT_DIR);
+      const outDir = releaseOutputDir(appRoot, version);
+      fs.mkdirSync(outDir, {
+        recursive: true
+      });
+      const name = artifactBaseName(iosConfig.appName);
+      const archivePath = path.join(workDir, `${name}.xcarchive`);
+      const signingArgs = signing.style === "automatic" ? xcodeAuthArgs(ctx.apiKey) : [];
+      progress.start("archive");
+      try {
+        await runCommandStreaming("xcodebuild", ["archive", "-project", `${PROJECT_NAME}.xcodeproj`, "-scheme", SCHEME_NAME, "-configuration", "Release", "-destination", "generic/platform=iOS", "-archivePath", archivePath, ...signingArgs]);
+      } catch (error) {
+        const failure = isSigningFailure(error.output) ? signingSetupError("Xcode could not sign the release archive", error) : error;
+        failure.stage = "Archiving the release build";
+        throw failure;
+      }
+      progress.complete("archive");
+      progress.start("export");
+      const exportPath = path.join(workDir, "export");
+      const optionsPlist = writeExportOptionsPlist(buildExportOptions({
+        method: exportMethod,
+        teamId: signing.teamId,
+        signingStyle: signing.style,
+        bundleId: PRODUCT_BUNDLE_ID,
+        profileName: signing.provisioningProfile,
+        signingCertificate: signing.p12 ? signing.identity : undefined
+      }), path.join(workDir, "ExportOptions.plist"));
+      try {
+        await runCommandStreaming("xcodebuild", ["-exportArchive", "-archivePath", archivePath, "-exportPath", exportPath, "-exportOptionsPlist", optionsPlist, ...(signing.style === "automatic" ? xcodeAuthArgs(ctx.apiKey) : [])]);
+      } catch (error) {
+        const failure = isSigningFailure(error.output) ? signingSetupError("Xcode could not sign the IPA for export", error) : error;
+        failure.stage = "Exporting the IPA";
+        throw failure;
+      }
+      const exported = fs.readdirSync(exportPath).find(file => file.endsWith(".ipa"));
+      if (!exported) throw new Error(`xcodebuild -exportArchive wrote no .ipa to ${exportPath}`);
+      const ipaPath = path.join(outDir, `${name}.ipa`);
+      clearArtifact(ipaPath);
+      fs.copyFileSync(path.join(exportPath, exported), ipaPath);
+      const dsymsDir = path.join(archivePath, "dSYMs");
+      const dsymsZip = path.join(outDir, `${name}-dSYMs.zip`);
+      clearArtifact(dsymsZip);
+      if (fs.existsSync(dsymsDir) && fs.readdirSync(dsymsDir).length > 0) {
+        execFileSync("ditto", ["-c", "-k", "--keepParent", dsymsDir, dsymsZip]);
+      }
+      progress.complete("export");
+      const rows = [{
+        text: `artifact   ${displayPath(ipaPath, originalDir)}`,
+        color: "gray"
+      }];
+      if (fs.existsSync(dsymsZip)) {
+        rows.push({
+          text: `dSYMs      ${displayPath(dsymsZip, originalDir)}`,
+          color: "gray"
+        });
+      }
+      rows.push({
+        text: `version    ${version.versionName || DEFAULT_VERSION_NAME} (${version.buildNumber})`,
+        color: "gray"
+      });
+      rows.push({
+        text: `signing    ${signing.style}, ${exportMethod}`,
+        color: "gray"
+      });
+      rows.push({
+        text: `loads      ${url}`,
+        color: "gray"
+      });
+      progress.printTreeContent("Build", rows);
+      progress.summary("Built the signed IPA", "Upload it to App Store Connect with Transporter");
+      return {
+        success: true,
+        ipaPath,
+        dsymsZip: fs.existsSync(dsymsZip) ? dsymsZip : null
+      };
+    } catch (error) {
+      if (progress.currentStep) progress.fail(progress.currentStep.id);
+      process.stderr.write(buildFailure({
+        error,
+        stage: error.stage || "iOS release build",
+        code: "IOS-000",
+        cwd: originalDir
+      }));
+      throw error;
+    } finally {
+      p12Signing?.cleanup();
+      fs.rmSync(workDir, {
+        recursive: true,
+        force: true
+      });
+      process.chdir(originalDir);
+    }
+  }
   async function buildIosForTesting(pluginComposition = {}) {
     const originalDir = process.cwd();
     try {
@@ -366,6 +677,7 @@ function createIosBuild(config) {
       await generateXCConfig();
       await copySplashscreenAssets();
       await copyAppIcon();
+      generateLocalhostCertificate();
       progress.log("Changing directory to: " + PROJECT_DIR, "info");
       process.chdir(PROJECT_DIR);
       await cleanBuildArtifacts();
@@ -409,14 +721,22 @@ function createIosBuild(config) {
     copySplashscreenAssets,
     copyAppIcon,
     buildForIOS,
+    buildReleaseForIOS,
     buildIosForTesting,
     progress,
+    release,
+    version,
     WEBVIEW_CONFIG,
+    /** Debug: the app loads the dev server, which buildAppIos.js makes sure answers. */
+    usesDevServer,
     PROJECT_DIR,
-    SCHEME_NAME
+    SCHEME_NAME,
+    /** Removes the credentials unpacked from CATALYST_IOS_CREDENTIALS. */
+    cleanup: () => credentials?.cleanup()
   };
 }
 module.exports = {
   createIosBuild,
+  IOS_BUILD_STEPS,
   pwd
 };

package/dist/native/buildIos/localhostCert.js

@@ -0,0 +1,87 @@
+"use strict";
+
+// The shell's in-app HTTPS server (FrameworkServerUtils.swift) serves on
+// localhost with the identity in localhost.p12, imported with an empty
+// passphrase. WKWebView accepts it because WebViewNavigationDelegate trusts
+// any server certificate for localhost/127.0.0.1 (no pinning), so a fresh
+// self-signed pair per build works and no private key has to live in git.
+//
+// The PKCS#12 uses SHA1-3DES and a SHA-1 MAC: the format SecPKCS12Import has
+// always read, and one OpenSSL 3 writes without its legacy provider and
+// LibreSSL (/usr/bin/openssl on macOS) writes by default.
+//
+// Also runnable for CI or a manual Xcode build:
+//   node src/native/buildIos/localhostCert.js [destination.p12]
+const {
+  execFileSync
+} = require("child_process");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const DEFAULT_DESTINATION = path.join(__dirname, "..", "iosnativeWebView", "iosnativeWebView", "localhost.p12");
+const VALIDITY_DAYS = 3650;
+function defaultRun(command, args) {
+  return execFileSync(command, args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+}
+
+/** openssl from PATH, else the one macOS ships. */
+function opensslCandidates() {
+  return ["openssl", "/usr/bin/openssl"];
+}
+
+/**
+ * Write a new self-signed localhost identity to `destination`.
+ *
+ * @param {string} [destination]
+ * @param {object} [options]
+ * @param {(command: string, args: string[]) => string} [options.run]
+ * @returns {string} the destination
+ */
+function generateLocalhostP12(destination = DEFAULT_DESTINATION, {
+  run = defaultRun
+} = {}) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "catalyst-localhost-cert-"));
+  fs.chmodSync(dir, 0o700);
+  const keyFile = path.join(dir, "key.pem");
+  const certFile = path.join(dir, "cert.pem");
+  const p12File = path.join(dir, "localhost.p12");
+  try {
+    let lastError = null;
+    for (const openssl of opensslCandidates()) {
+      try {
+        run(openssl, ["req", "-x509", "-newkey", "rsa:2048", "-nodes", "-keyout", keyFile, "-out", certFile, "-days", String(VALIDITY_DAYS), "-subj", "/O=Catalyst/CN=localhost", "-addext", "subjectAltName=DNS:localhost,IP:127.0.0.1", "-addext", "extendedKeyUsage=serverAuth"]);
+        run(openssl, ["pkcs12", "-export", "-inkey", keyFile, "-in", certFile, "-name", "localhost", "-out", p12File, "-passout", "pass:", "-certpbe", "PBE-SHA1-3DES", "-keypbe", "PBE-SHA1-3DES", "-macalg", "sha1"]);
+        lastError = null;
+        break;
+      } catch (error) {
+        lastError = error;
+      }
+    }
+    if (lastError) {
+      const detail = String(lastError.stderr || lastError.message || "").trim().split("\n").pop();
+      throw new Error(`Could not create the localhost certificate with openssl: ${detail}`);
+    }
+    fs.mkdirSync(path.dirname(destination), {
+      recursive: true
+    });
+    fs.copyFileSync(p12File, destination);
+    return destination;
+  } finally {
+    fs.rmSync(dir, {
+      recursive: true,
+      force: true
+    });
+  }
+}
+module.exports = {
+  generateLocalhostP12,
+  DEFAULT_DESTINATION
+};
+if (require.main === module) {
+  const destination = path.resolve(process.argv[2] || DEFAULT_DESTINATION);
+  generateLocalhostP12(destination);
+  console.log(`Wrote ${destination}`);
+}

package/dist/native/buildIos/output.js

@@ -0,0 +1,28 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+Object.defineProperty(exports, "artifactBaseName", {
+  enumerable: true,
+  get: function () {
+    return _releaseOutput.artifactBaseName;
+  }
+});
+exports.releaseOutputDir = releaseOutputDir;
+var _path = _interopRequireDefault(require("path"));
+var _releaseOutput = require("../releaseOutput.js");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+/**
+ * Where a release writes its IPA and dSYMs: <app>/build-output/ios/<version>-<build>,
+ * with the version from package.json and the build number from
+ * nativeConfig.js resolveAppVersion (the same pair as CFBundleShortVersionString
+ * and CFBundleVersion). Outside build/, which `catalyst build` deletes.
+ *
+ * @param {string} appRoot
+ * @param {{ versionName?: string, buildNumber: number }} version
+ */
+function releaseOutputDir(appRoot, version) {
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - appRoot is the local app; the folder name is sanitised.
+  return _path.default.resolve(appRoot, "build-output", "ios", (0, _releaseOutput.releaseFolderName)(version));
+}