stim 1.32.0 → 1.34.0

package/dist/ios-signing-BJzvDPfU.mjs

@@ -1,489 +0,0 @@
-import { c as throwIfCancelled, t as getExecutor } from "./exec-aULwtNly.mjs";
-import { a as killOnAbort, r as childEnvironment } from "./operation-exec-Dp4FuIGR.mjs";
-import { X509Certificate } from "node:crypto";
-import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-//#region src/engine/ios-profile.ts
-const TAG = /<(\/?)\s*([A-Za-z0-9_]+)(?:\s[^>]*?)?(\/?)>/g;
-const ENTITIES = {
-	amp: "&",
-	lt: "<",
-	gt: ">",
-	quot: "\"",
-	apos: "'"
-};
-var PlistError = class extends Error {};
-function codePoint(value) {
-	if (!Number.isInteger(value) || value < 0 || value > 1114111 || value >= 55296 && value <= 57343) throw new PlistError(`character reference out of range: ${value}`);
-	return String.fromCodePoint(value);
-}
-function decodeEntities(raw) {
-	return raw.replace(/&(#x?[0-9A-Fa-f]+|[a-z]+);/g, (match, body) => {
-		if (body.startsWith("#x") || body.startsWith("#X")) return codePoint(Number.parseInt(body.slice(2), 16));
-		if (body.startsWith("#")) return codePoint(Number.parseInt(body.slice(1), 10));
-		return ENTITIES[body] ?? match;
-	});
-}
-function peekTag(cursor) {
-	TAG.lastIndex = cursor.pos;
-	const match = TAG.exec(cursor.xml);
-	if (!match) return null;
-	return {
-		name: (match[2] ?? "").toLowerCase(),
-		closing: match[1] === "/",
-		selfClosing: match[3] === "/",
-		end: TAG.lastIndex
-	};
-}
-function takeTag(cursor) {
-	const tag = peekTag(cursor);
-	if (tag) cursor.pos = tag.end;
-	return tag;
-}
-function takeText(cursor, name) {
-	const close = cursor.xml.indexOf(`</${name}>`, cursor.pos);
-	if (close < 0) {
-		cursor.pos = cursor.xml.length;
-		return "";
-	}
-	const raw = cursor.xml.slice(cursor.pos, close);
-	cursor.pos = close + name.length + 3;
-	return raw;
-}
-function parseValue(cursor) {
-	const peeked = peekTag(cursor);
-	if (!peeked || peeked.closing) return void 0;
-	const tag = takeTag(cursor);
-	if (tag.selfClosing) {
-		if (tag.name === "true") return true;
-		if (tag.name === "false") return false;
-		if (tag.name === "array") return [];
-		if (tag.name === "dict") return {};
-		return "";
-	}
-	switch (tag.name) {
-		case "plist": return parseValue(cursor);
-		case "dict": {
-			const out = {};
-			for (;;) {
-				const next = peekTag(cursor);
-				if (!next) break;
-				if (next.closing) {
-					cursor.pos = next.end;
-					break;
-				}
-				cursor.pos = next.end;
-				if (next.name !== "key") continue;
-				const key = decodeEntities(next.selfClosing ? "" : takeText(cursor, "key"));
-				const value = parseValue(cursor);
-				if (value !== void 0) out[key] = value;
-			}
-			return out;
-		}
-		case "array": {
-			const out = [];
-			for (;;) {
-				const next = peekTag(cursor);
-				if (!next) break;
-				if (next.closing) {
-					cursor.pos = next.end;
-					break;
-				}
-				const value = parseValue(cursor);
-				if (value === void 0) break;
-				out.push(value);
-			}
-			return out;
-		}
-		case "string":
-		case "key": return decodeEntities(takeText(cursor, tag.name));
-		case "integer": return Number.parseInt(takeText(cursor, "integer").trim(), 10);
-		case "real": return Number.parseFloat(takeText(cursor, "real").trim());
-		case "date": return new Date(takeText(cursor, "date").trim());
-		case "data": return Buffer.from(takeText(cursor, "data").replace(/\s+/g, ""), "base64");
-		case "true":
-			takeText(cursor, "true");
-			return true;
-		case "false":
-			takeText(cursor, "false");
-			return false;
-		default:
-			takeText(cursor, tag.name);
-			return "";
-	}
-}
-function parsePlist(xml) {
-	if (typeof xml !== "string" || xml.trim() === "") return null;
-	const stripped = xml.replace(/<!--[\s\S]*?-->/g, "");
-	const start = stripped.indexOf("<plist");
-	const cursor = {
-		xml: stripped,
-		pos: start < 0 ? 0 : start
-	};
-	try {
-		const value = parseValue(cursor);
-		return value === void 0 ? null : value;
-	} catch {
-		return null;
-	}
-}
-function isDict(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && !Buffer.isBuffer(value) && !(value instanceof Date);
-}
-function stringsOf(value) {
-	if (!Array.isArray(value)) return null;
-	return value.filter((v) => typeof v === "string");
-}
-function parseProvisioningProfilePlist(xml) {
-	const root = parsePlist(xml);
-	if (!isDict(root)) return null;
-	const entitlements = isDict(root.Entitlements ?? null) ? root.Entitlements : {};
-	const teamIdentifier = stringsOf(root.TeamIdentifier);
-	const expiration = root.ExpirationDate;
-	const certificates = Array.isArray(root.DeveloperCertificates) ? root.DeveloperCertificates.filter((v) => Buffer.isBuffer(v)) : [];
-	return {
-		name: typeof root.Name === "string" ? root.Name : null,
-		uuid: typeof root.UUID === "string" ? root.UUID : null,
-		teamIdentifier: teamIdentifier?.[0] ?? null,
-		expirationDate: expiration instanceof Date && !Number.isNaN(expiration.getTime()) ? expiration : null,
-		provisionedDevices: stringsOf(root.ProvisionedDevices),
-		provisionsAllDevices: root.ProvisionsAllDevices === true,
-		getTaskAllow: entitlements["get-task-allow"] === true,
-		certificates
-	};
-}
-function provisioningProfileKind(profile) {
-	if (profile.provisionedDevices) return profile.getTaskAllow ? "development" : "ad hoc";
-	return profile.provisionsAllDevices ? "enterprise" : "App Store";
-}
-function certificateCommonName(der) {
-	if (!Buffer.isBuffer(der) || der.length === 0) return null;
-	let subject;
-	try {
-		subject = new X509Certificate(der).subject;
-	} catch {
-		return null;
-	}
-	for (const part of String(subject).split(/\r?\n/)) {
-		const trimmed = part.trim();
-		if (trimmed.startsWith("CN=")) return trimmed.slice(3).trim() || null;
-	}
-	return /(?:^|,)\s*CN=([^,]+)/.exec(String(subject))?.[1]?.trim() || null;
-}
-const IDENTITY_LINE = /^\s*\d+\)\s+([0-9A-Fa-f]{40})\s+"(.+)"\s*$/;
-function parseSigningIdentities(text) {
-	if (typeof text !== "string") return [];
-	const out = [];
-	for (const line of text.split(/\r?\n/)) {
-		const match = IDENTITY_LINE.exec(line);
-		if (!match) continue;
-		out.push({
-			sha1: match[1].toUpperCase(),
-			name: match[2]
-		});
-	}
-	return out;
-}
-const SIGNING_CODES = {
-	noProfile: "STIM_NO_PROFILE",
-	profileMismatch: "STIM_PROFILE_MISMATCH",
-	noIdentity: "STIM_NO_SIGNING_IDENTITY",
-	codesignFailed: "STIM_CODESIGN_FAILED"
-};
-const XCODE_STEP = "run `stim device provision ios`, which asks before it registers the device or creates the profile (agents run it only with the user's go-ahead), or build once from Xcode to install it. A build never does this, because registering a device or minting a profile changes your Apple Developer account.";
-const KEYCHAIN_REMEDY = "Open Xcode > Settings > Accounts and download your certificates, or unlock the login keychain with `security unlock-keychain`. `security find-identity -v -p codesigning` should list `Apple Development: ...`.";
-function signingConfiguration(input) {
-	return input.configuration ?? "Debug";
-}
-function profileGate(input) {
-	const now = input.now ?? Date.now();
-	if (!input.profilePresent) return {
-		ok: false,
-		code: SIGNING_CODES.noProfile,
-		reason: "The app bundle has no embedded.mobileprovision, so it was built unsigned or for the simulator.",
-		remedy: `Set a team and profile for the target's ${signingConfiguration(input)} configuration in Xcode > Signing & Capabilities, then ${XCODE_STEP}`
-	};
-	if (!input.profile) return {
-		ok: false,
-		code: SIGNING_CODES.noProfile,
-		reason: "`openssl smime` could not decode the app bundle's embedded.mobileprovision.",
-		remedy: `The profile inside the app is corrupt. Delete the build cache entry with \`stim gc --delete\`, then ${XCODE_STEP}`
-	};
-	const profile = input.profile;
-	const named = profile.name ? `"${profile.name}"` : "the embedded profile";
-	if (!profile.expirationDate || profile.expirationDate.getTime() <= now) return {
-		ok: false,
-		code: SIGNING_CODES.profileMismatch,
-		reason: profile.expirationDate ? `The ${provisioningProfileKind(profile)} profile ${named} expired on ${profile.expirationDate.toISOString()}.` : `The ${provisioningProfileKind(profile)} profile ${named} carries no ExpirationDate, so Stim cannot prove it is still valid.`,
-		remedy: `Renew the profile under Signing & Capabilities, then ${XCODE_STEP}`
-	};
-	if (!profile.provisionedDevices) {
-		const kind = provisioningProfileKind(profile);
-		return {
-			ok: false,
-			code: SIGNING_CODES.profileMismatch,
-			reason: `${named} is an ${kind} profile, which carries no ProvisionedDevices list, so Stim cannot prove ${input.udid ?? "the target device"} is admitted.`,
-			remedy: `Local device runs need a development profile. Select one under Signing & Capabilities, then ${XCODE_STEP}`
-		};
-	}
-	const udid = input.udid;
-	if (!udid || !profile.provisionedDevices.some((d) => d.toLowerCase() === udid.toLowerCase())) return {
-		ok: false,
-		code: SIGNING_CODES.profileMismatch,
-		reason: `The ${provisioningProfileKind(profile)} profile ${named} lists ${profile.provisionedDevices.length} device(s) and ${udid ?? "the target device"} is not one of them.`,
-		remedy: `Run \`stim device provision ios${udid ? ` ${udid}` : ""}\`, which asks before it registers the device and refreshes the profile (agents run it only with the user's go-ahead), or register it at developer.apple.com, regenerate the profile and build once from Xcode. A build never does this, because registering a device or minting a profile changes your Apple Developer account.`
-	};
-	return {
-		ok: true,
-		profile
-	};
-}
-function signingGate(input) {
-	const gated = profileGate(input);
-	if (!gated.ok) return gated;
-	const profile = gated.profile;
-	const named = profile.name ? `"${profile.name}"` : "the embedded profile";
-	const identities = Array.isArray(input.identities) ? input.identities : [];
-	if (identities.length === 0) return {
-		ok: false,
-		code: SIGNING_CODES.noIdentity,
-		reason: "`security find-identity -v -p codesigning` lists no codesigning identity on this machine.",
-		remedy: KEYCHAIN_REMEDY
-	};
-	if (input.pinnedSha1) {
-		const wanted = input.pinnedSha1.trim().toUpperCase();
-		const match = identities.find((i) => i.sha1 === wanted);
-		if (match) return {
-			ok: true,
-			identity: match
-		};
-		return {
-			ok: false,
-			code: SIGNING_CODES.noIdentity,
-			reason: `ios.signingIdentitySha1 is ${wanted}, which is not in the keychain. Available: ${identities.map((i) => `${i.sha1} "${i.name}"`).join(", ")}.`,
-			remedy: KEYCHAIN_REMEDY
-		};
-	}
-	const wantedName = input.pinnedName?.trim() || certificateCommonName(profile.certificates[0] ?? null);
-	if (!wantedName) return {
-		ok: false,
-		code: SIGNING_CODES.noIdentity,
-		reason: `Stim could not read a signing-identity name out of ${named}: its DeveloperCertificates entry has no readable subject CN.`,
-		remedy: "Set ios.signingIdentity in .stim.json to the identity name to re-sign with, or ios.signingIdentitySha1 to its SHA-1 hash."
-	};
-	const matches = identities.filter((i) => i.name === wantedName);
-	if (matches.length === 1) return {
-		ok: true,
-		identity: matches[0]
-	};
-	if (matches.length === 0) return {
-		ok: false,
-		code: SIGNING_CODES.noIdentity,
-		reason: `The app was signed by "${wantedName}", which is not in this machine's keychain. Available: ${identities.map((i) => `"${i.name}"`).join(", ")}.`,
-		remedy: `${KEYCHAIN_REMEDY} Or set ios.signingIdentity in .stim.json to one of the identities listed above.`
-	};
-	return {
-		ok: false,
-		code: SIGNING_CODES.noIdentity,
-		reason: `${matches.length} keychain identities share the name "${wantedName}", so Stim cannot pick one: ${matches.map((i) => i.sha1).join(", ")}.`,
-		remedy: "Set ios.signingIdentitySha1 in .stim.json to the SHA-1 hash of the certificate to sign with."
-	};
-}
-//#endregion
-//#region src/engine/ios-signing.ts
-const EMBEDDED_PROFILE = "embedded.mobileprovision";
-const SIGNING_TIMEOUT_MS = 12e4;
-function lastLines(text, count = 5) {
-	return String(text ?? "").split(/\r?\n/).map((line) => line.trimEnd()).filter((line) => line.trim() !== "").slice(-count);
-}
-function errorText(error) {
-	const withOutput = error;
-	const stderr = String(withOutput?.stderr ?? "").trim();
-	const stdout = String(withOutput?.stdout ?? "").trim();
-	return stderr || stdout || String(withOutput?.message ?? error);
-}
-async function signingCommand(file, args, { exec, env, signal }) {
-	throwIfCancelled(signal, "iOS signing");
-	try {
-		const output = await (exec || getExecutor()).runFileAsync(file, args, {
-			timeoutMs: SIGNING_TIMEOUT_MS,
-			...env ? childEnvironment(env) : {},
-			onSpawn: killOnAbort(signal)
-		});
-		throwIfCancelled(signal, "iOS signing");
-		return output;
-	} catch (error) {
-		throwIfCancelled(signal, "iOS signing");
-		throw error;
-	}
-}
-async function readEmbeddedProfile(appPath, options = {}) {
-	throwIfCancelled(options.signal, "iOS signing");
-	const path = join(appPath, EMBEDDED_PROFILE);
-	if (!existsSync(path)) return {
-		present: false,
-		profile: null
-	};
-	const plist = await decodeProvisioningProfile(path, options);
-	return {
-		present: true,
-		profile: plist === null ? null : parseProvisioningProfilePlist(plist)
-	};
-}
-async function decodeProvisioningProfile(path, options = {}) {
-	try {
-		return await signingCommand("/usr/bin/openssl", [
-			"smime",
-			"-verify",
-			"-noverify",
-			"-inform",
-			"DER",
-			"-in",
-			path
-		], options);
-	} catch {
-		throwIfCancelled(options.signal, "iOS signing");
-		return null;
-	}
-}
-async function findSigningIdentities(options = {}) {
-	return await probeSigningIdentities(options) ?? [];
-}
-/** The keychain's code signing identities, or null when `security find-identity` itself failed. */
-async function probeSigningIdentities(options = {}) {
-	try {
-		return parseSigningIdentities(await signingCommand("security", [
-			"find-identity",
-			"-v",
-			"-p",
-			"codesigning"
-		], options));
-	} catch {
-		throwIfCancelled(options.signal, "iOS signing");
-		return null;
-	}
-}
-async function gateProfileForDevice(options) {
-	const read = await readEmbeddedProfile(options.appPath, options);
-	return profileGate({
-		profilePresent: read.present,
-		profile: read.profile,
-		identities: [],
-		udid: options.udid,
-		configuration: options.configuration ?? null,
-		...options.now === void 0 ? {} : { now: options.now }
-	});
-}
-async function gateAppForDevice(options) {
-	const read = await readEmbeddedProfile(options.appPath, options);
-	return signingGate({
-		profilePresent: read.present,
-		profile: read.profile,
-		identities: read.present ? await findSigningIdentities(options) : [],
-		udid: options.udid,
-		configuration: options.configuration ?? null,
-		pinnedName: options.pinnedName ?? null,
-		pinnedSha1: options.pinnedSha1 ?? null,
-		...options.now === void 0 ? {} : { now: options.now }
-	});
-}
-async function extractEntitlements(appPath, options) {
-	try {
-		return String(await signingCommand("codesign", [
-			"-d",
-			"--entitlements",
-			"-",
-			"--xml",
-			appPath
-		], options)).trim();
-	} catch {
-		throwIfCancelled(options.signal, "iOS signing");
-		return "";
-	}
-}
-async function resealBundle({ appPath, identity, ...options }) {
-	const signAs = identity.sha1 || identity.name;
-	let mode = "preserve-metadata";
-	let preserveError = null;
-	try {
-		await signingCommand("codesign", [
-			"--force",
-			"--sign",
-			signAs,
-			"--preserve-metadata=identifier,entitlements,flags,runtime",
-			appPath
-		], options);
-	} catch (error) {
-		throwIfCancelled(options.signal, "iOS signing");
-		preserveError = error;
-	}
-	let tempDir = null;
-	if (preserveError) {
-		const entitlements = await extractEntitlements(appPath, options);
-		const args = [
-			"--force",
-			"--sign",
-			signAs
-		];
-		if (entitlements !== "") {
-			tempDir = mkdtempSync(join(tmpdir(), "stim-entitlements-"));
-			const plist = join(tempDir, "entitlements.plist");
-			writeFileSync(plist, `${entitlements}\n`, "utf-8");
-			args.push("--entitlements", plist);
-			mode = "entitlements";
-		} else mode = "no-entitlements";
-		args.push(appPath);
-		try {
-			await signingCommand("codesign", args, options);
-		} catch (error) {
-			throwIfCancelled(options.signal, "iOS signing");
-			return {
-				ok: false,
-				code: SIGNING_CODES.codesignFailed,
-				reason: `codesign could not re-seal ${appPath} with "${identity.name}": ${errorText(error)}`,
-				remedy: `Unlock the login keychain (\`security unlock-keychain\`) and confirm exactly one identity matches "${identity.name}".`,
-				lastLines: [...lastLines(errorText(preserveError)), ...lastLines(errorText(error))]
-			};
-		} finally {
-			if (tempDir) rmSync(tempDir, {
-				recursive: true,
-				force: true
-			});
-		}
-	}
-	try {
-		await signingCommand("codesign", [
-			"--verify",
-			"--strict",
-			appPath
-		], options);
-	} catch (error) {
-		throwIfCancelled(options.signal, "iOS signing");
-		return {
-			ok: false,
-			code: SIGNING_CODES.codesignFailed,
-			reason: `codesign --verify --strict rejected ${appPath} after re-sealing it with "${identity.name}": ${errorText(error)}`,
-			remedy: "The bundle signed but did not seal. Delete the cached artifact with `stim gc --delete` and build fresh, then retry.",
-			lastLines: lastLines(errorText(error))
-		};
-	}
-	return {
-		ok: true,
-		identity,
-		mode
-	};
-}
-async function sealAppForDevice(options) {
-	const gate = await gateAppForDevice(options);
-	if (!gate.ok) return {
-		...gate,
-		lastLines: []
-	};
-	return resealBundle({
-		...options,
-		identity: gate.identity
-	});
-}
-//#endregion
-export { sealAppForDevice as a, probeSigningIdentities as i, findSigningIdentities as n, parsePlist as o, gateProfileForDevice as r, parseProvisioningProfilePlist as s, decodeProvisioningProfile as t };

package/dist/server-expo-DwR3eD-a.mjs

@@ -1,2 +0,0 @@
-import { m as startExpoServer } from "./server-expo-BLxcN2x2.mjs";
-export { startExpoServer };

package/dist/trigger-DBZ-GBrl.mjs

@@ -1,2 +0,0 @@
-import { t as triggerMaintenance } from "./trigger-CfnOfpDd.mjs";
-export { triggerMaintenance };

package/dist/web-DwuluWJt.mjs

@@ -1,2 +0,0 @@
-import { n as webCommand, t as runWeb } from "./web-BdWG8b5_.mjs";
-export { webCommand as default, runWeb };