ipa-resign 0.0.5 → 0.0.7

package/LICENSE

@@ -0,0 +1,47 @@
+Copyright (c) 2026 650 Industries, Inc. All rights reserved.
+
+PROPRIETARY SOFTWARE LICENSE
+
+This software, including the package published as "ipa-resign" and all of its
+source code, compiled bundles, native helper binaries, and accompanying files
+(the "Software"), is the confidential and proprietary property of 650
+Industries, Inc. ("650 Industries").
+
+1. No license granted. No license or right to the Software is granted to you,
+   whether by implication, estoppel, or otherwise, except under a separate
+   written agreement signed by 650 Industries. Absent such an agreement, you may
+   not use, copy, install, execute, or retain the Software.
+
+2. Restrictions. You may not, and may not permit any third party to:
+   (a) reverse engineer, decompile, disassemble, deobfuscate, or otherwise
+       attempt to derive the source code, structure, algorithms, or protocols of
+       the Software, in whole or in part;
+   (b) copy, distribute, republish, sublicense, sell, rent, lease, or otherwise
+       make the Software available to any third party;
+   (c) modify, adapt, translate, or create derivative works of the Software; or
+   (d) remove, obscure, or alter any proprietary notice in the Software.
+
+   Any circumvention or attempted circumvention of the technical protection
+   measures in the Software (including its obfuscation) is a material breach of
+   this license and may violate applicable law.
+
+3. Third-party components. The Software bundles third-party open-source
+   components that remain licensed under their own respective terms. Those terms,
+   and the required copyright and permission notices, are reproduced in
+   dist/THIRD-PARTY-LICENSES.txt. Nothing in this license limits your rights, or
+   enlarges your obligations, under those third-party licenses with respect to
+   those components. The restrictions in Section 2 apply only to the proprietary
+   portions of the Software authored by 650 Industries.
+
+4. Reservation of rights. All rights not expressly granted are reserved by 650
+   Industries. This license does not transfer any ownership, title, or
+   intellectual property right in the Software.
+
+5. No warranty. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+   EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT.
+
+6. Limitation of liability. IN NO EVENT SHALL 650 INDUSTRIES BE LIABLE FOR ANY
+   CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR
+   OTHERWISE, ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE
+   OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -81,9 +81,10 @@ The protocol is transport-agnostic — it depends only on a small injected `Plat
 - **`ipa-resign/sign-browser`** — browser-side IPA re-signing via zsign compiled to WASM
   (the `zsign-wasm` package; its glue is served same-origin by the host app). Browser-only; the web
   counterpart to the Node `zsign` binary path.
-- **`ipa-resign/assets/anisette`** — the vendored [anisette-js](https://github.com/lbr77/anisette-js)
-  + Unicorn WASM the browser generator fetches at runtime (source of truth; the web app syncs
-  these into its `public/`).
+- **`ipa-resign/assets/anisette`** — the anisette ADI emulator (Rust→WASM + a TS API) the
+  browser generator fetches at runtime. Built from the source under `anisette/wasm/` (not
+  committed — run `yarn build:anisette`, or the release workflow rebuilds it before publishing;
+  see [RELEASING.md](RELEASING.md)). The web app syncs it into its `public/`.
 
 Internally the Node protocol modules (`src/auth/gsa.ts`, `src/devPortal.ts`, `src/auth/srp.ts`,
 `src/sign/csr.ts`) are thin adapters that wrap `core` with the Node `Platform` (`src/platform.ts`)
@@ -95,33 +96,36 @@ and re-wrap bytes as `Buffer` for the CLI. Full design:
 
 ```bash
 yarn install
-yarn build   # dist/: bytecode CLI bundle (index.jsc) + the ipa-resign/core and
+yarn build   # dist/: obfuscated CLI bundle (index.js) + the ipa-resign/core and
              # ipa-resign/anisette-browser subpath builds + bundled .d.ts
 ```
 
-`yarn build` is platform-agnostic — it just bundles TypeScript (via esbuild). It runs
-three steps: the bytecode CLI build, then `build:core` and `build:anisette-browser` (the
-two browser-consumable subpaths, which you can also run on their own). The native helper
-binaries are built separately because they require platform-specific toolchains:
+`yarn build` is platform-agnostic — it bundles TypeScript (via esbuild) and runs each
+bundle through `javascript-obfuscator` (`scripts/obfuscate.mjs`). It runs several
+steps: the obfuscated CLI build, then `build:core`, `build:anisette-browser`,
+`build:sign-browser`, and `build:browser` (the browser-consumable subpaths, which you
+can also run on their own). The native helper binaries are built separately because
+they require platform-specific toolchains:
 
 ```bash
 # Build the macOS anisette helper (only works on macOS — needs swiftc, i.e. Xcode CLT).
 # Produces bin/anisette as a universal arm64 + x86_64 Mach-O.
 yarn build:helper:macos
 
-# Cross-compile the Rust anisette helper for Windows + Linux from any host.
-# Produces bin/anisette-{linux,win}-{x64,arm64}{.exe}. Requires zig + cargo-zigbuild
-# for the Linux targets and cross + Docker for the Windows targets. See
-# anisette/orbit-anisette-rs/README.md for setup.
-yarn build:helper:rust
+# Rebuild the anisette WASM assets (assets/anisette/) from the anisette/wasm
+# source. This is the Windows/Linux anisette provider. Needs emsdk + Rust nightly
+# + the Unicorn fork; the release workflow runs it. See RELEASING.md.
+yarn build:anisette
 ```
 
 End users installing the package via npm don't run any of the helper scripts —
-the published package ships the macOS binaries already built (`bin/anisette`
-for OTP headers, `bin/zsign` for code signing). On Windows and Linux, use the
-WASM subpath exports (`ipa-resign/browser`, `ipa-resign/sign-browser`); the
-cross-compiled native helpers are not published. `src/auth/anisette.ts` and
-`src/sign/codesign.ts` pick the right binary at runtime by inspecting
+the published package ships the macOS binary (`bin/anisette` for OTP headers) and
+`bin/zsign` for code signing, plus the anisette WASM assets. **Anisette** uses the
+native Swift helper on macOS and the anisette WASM emulator
+(`src/auth/anisette-wasm.ts`, running the `assets/anisette/` build) on Windows and
+Linux — no native helper is cross-compiled anymore. **Code signing** on Windows and
+Linux uses the WASM subpath exports (`ipa-resign/sign-browser`). `src/auth/anisette.ts`
+and `src/sign/codesign.ts` pick the right path at runtime by inspecting
 `process.platform` + `process.arch`.
 
 Releasing a new version: see [RELEASING.md](./RELEASING.md).