# Tarnax build and release

Run from the project folder (scripts also work from other working directories):

```sh
./scripts/test.sh                    # Plist/script validation, contract checks, unsigned Debug build
./scripts/test.sh --contracts-only   # Fast validation and contract checks
./scripts/build.sh                   # Unsigned Debug device build
./scripts/build.sh --release         # Unsigned optimized Release device build
./scripts/build.sh --release --signed # Signed build using existing provisioning
./scripts/release.sh                 # Release archive + registered-device distribution IPA
./scripts/release.sh --method debugging # Release archive + development-signed device IPA
```

Requirements: macOS, Xcode selected with xcode-select, Xcode command-line tools and Python 3. Signed builds require the relevant certificate/private key, a provisioning profile for `net.absdev.Tarnax`, and the configured team. The default team is `39R6U3437D`; override it with `DEVELOPMENT_TEAM` if necessary.

The release configuration is optimized for both export methods. `release-testing` requires distribution signing and an ad hoc profile listing the recipient devices. `debugging` uses development signing and requires Developer Mode on recipient devices. Neither is an unrestricted public-install IPA. Install the exported IPA on a provisioned device with Xcode or Apple Configurator. Distribution to arbitrary public users requires a supported Apple distribution channel.

Provisioning updates are disabled by default. If you explicitly want Xcode to contact Apple and create/update signing certificates, app identifiers or profiles, add `--allow-provisioning-updates`. Sign in to the appropriate account in Xcode first. This flag does not upload the app to App Store Connect; export destination is local.

Outputs:

- Builds: `build/Debug/` or `build/Release/`, including `build.log` and `Tarnax.app`.
- Releases: a unique folder under `build/releases/`, containing `Tarnax.xcarchive`, `ExportOptions.plist`, logs, and `export/Tarnax.ipa` with a SHA-256 checksum.
- Override roots with `BUILD_OUTPUT_DIR` or `RELEASE_OUTPUT_DIR`.

Release export fails on any archive/export/signature/profile verification error. No unsigned ZIP is passed off as an installable IPA. Profiles include device identifiers: share only the intended IPA with testers and keep the remaining release diagnostics private.

The current contract harness exercises mocked transport and model behavior. It does not sign in to a live server or exercise the physical-device UI. This project has no XCTest target; the script compiles and runs the existing executable contract harness.

## Install on your iPhone

Connect and unlock your iPhone, trust this Mac and enable Developer Mode when required. Pair the device in Xcode's Devices and Simulators first.

```sh
./scripts/deploy.sh --list
./scripts/deploy.sh                       # Build signed Release, install and launch
./scripts/deploy.sh --device "iPhone name" # Select when multiple phones are paired
./scripts/deploy.sh --ipa /path/Tarnax.ipa # Install an already exported IPA
./scripts/deploy.sh --app /path/Tarnax.app --no-launch
```

The script selects only physical, paired iPhones; it never installs on every device. It checks the signature, app identifier, profile expiry and that the chosen phone is provisioned before installing. `TARNAX_DEVICE` can supply a default device identifier. It does not automatically modify Apple account provisioning. A locked or unreachable phone causes a clear device-tool failure; unlock/reconnect and rerun. Updating Tarnax keeps existing app data; launch replaces an already-running Tarnax process.

## Temporary files

All script-created temporary files and compiler intermediates use `~/Developer/Scratch/Tarnax/`, including DerivedData, test binaries, caches, IPA verification and deployment extraction. `TMPDIR` is also set there for child tools. Override with `TARNAX_SCRATCH_ROOT` if needed. You can delete this directory when no build, test or deploy script is running. Final apps, archives, IPAs and logs remain in the project `build/` directory. Apple services may maintain their own system caches outside this location.