@@ -49,7 +49,7 @@ jobs:
       CONFIGURATION: ${{ github.event.inputs.configuration || 'Release' }}
       SIGNING: ${{ github.event.inputs.signing || 'unsigned' }}
       LITE: '0'
-      BOTH: '1'
+      BOTH: '0'
       EVERYWHERE_CORE_MIN_VERSION: '2026.08.09'
 
     steps:
@@ -113,8 +113,8 @@ jobs:
         run: |
           set -euo pipefail
           chmod +x Scripts/ci_export_ipa.sh Scripts/resign_ipa.sh build.sh
-          # One archive → full VPN IPA + Lite (no PacketTunnel)
-          BOTH=1 ./Scripts/ci_export_ipa.sh
+          # One full VPN IPA for ESign / one-file install (app + PacketTunnel)
+          BOTH=0 LITE=0 ./Scripts/ci_export_ipa.sh
           ls -lah build/ipa/
 
       - name: Rename IPA with version
@@ -131,18 +131,12 @@ jobs:
             VER="v0.0.0-dev.${SHA_SHORT}"
           fi
 
-          FULL_SRC="$(ls build/ipa/DecoderSec-unsigned.ipa 2>/dev/null || true)"
-          LITE_SRC="$(ls build/ipa/DecoderSec-lite-unsigned.ipa 2>/dev/null || true)"
-          # Fallback if only one file was produced
-          if [[ -z "$FULL_SRC" && -z "$LITE_SRC" ]]; then
-            FULL_SRC="$(ls build/ipa/*.ipa | head -n1)"
-          fi
-          if [[ -n "$FULL_SRC" ]]; then
-            mv "$FULL_SRC" "build/ipa/DecoderSec-${VER}-unsigned.ipa"
-          fi
-          if [[ -n "$LITE_SRC" ]]; then
-            mv "$LITE_SRC" "build/ipa/DecoderSec-${VER}-lite-unsigned.ipa"
-          fi
+          SRC="$(ls build/ipa/DecoderSec-unsigned.ipa build/ipa/*.ipa 2>/dev/null | head -n1)"
+          [[ -n "$SRC" ]] || { echo "no IPA produced"; exit 1; }
+          # Single user-facing name + versioned copy
+          cp "$SRC" "build/ipa/DecoderSec.ipa"
+          mv "$SRC" "build/ipa/DecoderSec-${VER}.ipa"
+          rm -f build/ipa/*lite* || true
 
           echo "version=$VER" >> "$GITHUB_OUTPUT"
           PRE=false
@@ -156,7 +150,8 @@ jobs:
         with:
           name: DecoderSec-ipa-${{ steps.meta.outputs.version }}
           path: |
-            build/ipa/*.ipa
+            build/ipa/DecoderSec.ipa
+            build/ipa/DecoderSec-*.ipa
             build/*.xcarchive
           if-no-files-found: error
           retention-days: 30
@@ -165,29 +160,27 @@ jobs:
         if: startsWith(github.ref, 'refs/tags/v')
         uses: softprops/action-gh-release@v2
         with:
-          files: build/ipa/*.ipa
+          files: |
+            build/ipa/DecoderSec.ipa
+            build/ipa/DecoderSec-${{ steps.meta.outputs.version }}.ipa
           generate_release_notes: true
           prerelease: ${{ steps.meta.outputs.prerelease == 'true' }}
           name: decoder sec. ${{ steps.meta.outputs.version }}
           body: |
             ## decoder sec. `${{ steps.meta.outputs.version }}`
 
-            Two unsigned IPAs in this release (ad-hoc signed for install tools):
+            **Один файл:** [`DecoderSec.ipa`](https://github.com/decoder-dev/decoder-sec/releases/download/${{ steps.meta.outputs.version }}/DecoderSec.ipa)
 
-            1. **`DecoderSec-…-lite-unsigned.ipa`** — UI only (no Packet Tunnel). Resign once for `com.decodersec.app`.
-            2. **`DecoderSec-…-unsigned.ipa`** — full VPN. Resign with Network Extension for app + PacketTunnel (`Scripts/resign_ipa.sh`).
+            ### ESign (один раз)
+            1. Скачай `DecoderSec.ipa`
+            2. Открой в **ESign** → Импорт
+            3. Подпись сертификатом с **Network Extension / VPN** (платный)
+            4. Установи → открой → добавь конфиг → Connect
 
-            EverywhereCore is statically linked into the tunnel — it is **not** embedded as a Frameworks binary (that broke install on beta.5).
+            Внутри: приложение + PacketTunnel. Без App Groups. Bundle ID extension подхватывается после ремапа ESign автоматически.
 
-            ```bash
-            ./Scripts/resign_ipa.sh --ipa DecoderSec-…-unsigned.ipa \
-              --profile App.mobileprovision \
-              --identity "Apple Development: You (TEAMID)"
-            ```
-
-            - Bundle ID: `com.decodersec.app`
-            - Tunnel: `com.decodersec.app.PacketTunnel`
-            - Engines: Xray / sing-box / mihomo via EverywhereCore
+            - Default IDs: `com.decodersec.app` + `com.decodersec.app.PacketTunnel`
+            - Engines: Xray / sing-box / mihomo
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -199,14 +192,11 @@ jobs:
           name: decoder sec. ${{ steps.meta.outputs.version }}
           prerelease: true
           generate_release_notes: true
-          files: build/ipa/*.ipa
+          files: |
+            build/ipa/DecoderSec.ipa
+            build/ipa/DecoderSec-${{ steps.meta.outputs.version }}.ipa
           body: |
-            ## decoder sec. `${{ steps.meta.outputs.version }}` (prerelease)
-
-            Built from `${{ github.sha }}` via workflow_dispatch.
-
-            Prefer **lite** IPA if you only need the UI. Full IPA needs Network Extension when resigning.
-            Use `Scripts/resign_ipa.sh` for one-command signing.
+            Один файл: `DecoderSec.ipa` — ESign → подпись с Network Extension → установка.
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
 
@@ -9,6 +9,16 @@ All notable changes to **decoder sec.** are documented here.
 - `ru` / `en` localization
 - Signed TestFlight builds
 
+## [0.1.0-beta.7] — 2026-08-11
+
+### Changed
+- **Один файл:** релиз публикует только полный `DecoderSec.ipa` (app + PacketTunnel) для ESign
+- Tunnel bundle ID читается из встроенного `.appex` — переживает ремап Bundle ID в ESign
+- `NSExtensionPrincipalClass` = `PacketTunnelProvider` (`@objc`) без имени модуля
+
+### Notes
+- ESign: один импорт → одна подпись (серт с Network Extension) → установка → конфиг → Connect
+
 ## [0.1.0-beta.6] — 2026-08-11
 
 ### Fixed
 
@@ -12,7 +12,7 @@
 		<key>NSExtensionPointIdentifier</key>
 		<string>com.apple.networkextension.packet-tunnel</string>
 		<key>NSExtensionPrincipalClass</key>
-		<string>$(PRODUCT_MODULE_NAME).PacketTunnelProvider</string>
+		<string>PacketTunnelProvider</string>
 	</dict>
 </dict>
 </plist>
@@ -10,6 +10,7 @@ import EverywhereCore
 import Network
 import NetworkExtension
 
+@objc(PacketTunnelProvider)
 final class PacketTunnelProvider: NEPacketTunnelProvider {
     private static let tunnelMTU = 1500
 
 
@@ -38,7 +38,8 @@
 
 ## Downloads
 
-Prerelease IPAs: **[GitHub Releases](https://github.com/decoder-dev/decoder-sec/releases)** (unsigned — resign before install).
+**Один файл:** [Releases](https://github.com/decoder-dev/decoder-sec/releases) → `DecoderSec.ipa`  
+ESign: импорт → подпись (Network Extension) → установка. См. [docs/ESIGN.md](./docs/ESIGN.md).
 
 ## Build
 
 
@@ -34,7 +34,7 @@ IPA_DIR="${IPA_DIR:-$ROOT/build/ipa}"
 SIGNING="${SIGNING:-unsigned}"
 EXPORT_OPTIONS="${EXPORT_OPTIONS:-$ROOT/Config/ExportOptions-ad-hoc.plist}"
 LITE="${LITE:-0}"
-BOTH="${BOTH:-1}"
+BOTH="${BOTH:-0}"
 
 APP_ENTITLEMENTS="$ROOT/DecoderSec/DecoderSec.entitlements"
 TUNNEL_ENTITLEMENTS="$ROOT/DecoderSecTunnel/DecoderSecTunnel.entitlements"
 
@@ -10,6 +10,9 @@ enum BrandIdentity {
     static let shortName = "decoder"
     static let legalName = "Decoder Sec"
     static let tagline = "Private tunnels. Your rules."
+
+    /// Default IDs used at build time. After ESign remaps the bundle ID,
+    /// prefer ``EVCore.Identifier/networkExtension`` which reads the embedded appex.
     static let bundleID = "com.decodersec.app"
     static let networkExtensionID = "com.decodersec.app.PacketTunnel"
 }
@@ -9,9 +9,40 @@ import Foundation
 
 enum EVCore {
     enum Identifier {
-        static let bundle = BrandIdentity.bundleID
-        static let networkExtension = BrandIdentity.networkExtensionID
+        /// Host app bundle id (survives ESign remap).
+        static var bundle: String {
+            Bundle.main.bundleIdentifier ?? BrandIdentity.bundleID
+        }
+
+        /// Packet Tunnel provider id. Discovers the embedded `.appex` so ESign
+        /// can change both IDs in one sign and the app still finds the extension.
+        static var networkExtension: String {
+            if let embedded = embeddedTunnelBundleID() {
+                return embedded
+            }
+            let base = bundle
+            if base.contains("PacketTunnel") || base.lowercased().hasSuffix(".tunnel") || base.lowercased().hasSuffix(".ne") {
+                return base
+            }
+            return base + ".PacketTunnel"
+        }
+
         static let tunnelDescription = BrandIdentity.displayName
+
+        private static func embeddedTunnelBundleID() -> String? {
+            guard let plugins = Bundle.main.builtInPlugInsURL else { return nil }
+            guard let urls = try? FileManager.default.contentsOfDirectory(
+                at: plugins,
+                includingPropertiesForKeys: nil,
+                options: [.skipsHiddenFiles]
+            ) else { return nil }
+            for url in urls where url.pathExtension == "appex" {
+                if let id = Bundle(url: url)?.bundleIdentifier, !id.isEmpty {
+                    return id
+                }
+            }
+            return nil
+        }
     }
 
     static let defaultDNSServers = ["1.1.1.1", "8.8.8.8"]
 
@@ -0,0 +1,20 @@
+# ESign — один файл
+
+Скачай **`DecoderSec.ipa`** из [Releases](https://github.com/decoder-dev/decoder-sec/releases) (полный VPN, не lite).
+
+## Шаги
+
+1. Открой **ESign** на iPhone.
+2. Импорт → выбери `DecoderSec.ipa`.
+3. Подпись **платным** сертификатом с правом **Network Extension / VPN**  
+   (бесплатный Apple ID VPN не даст — это ограничение Apple, не приложения).
+4. Установи → разреши VPN-профиль при первом Connect.
+5. В приложении добавь конфиг (или `happ://` ссылку) → **Connect**.
+
+Один IPA уже содержит приложение и Packet Tunnel. App Groups не нужны.  
+После смены Bundle ID в ESign extension находится автоматически.
+
+## Если Connect не поднимает VPN
+
+Сертификат без Network Extension: приложение откроется, туннель — нет.  
+Нужен платный серт/профиль с `packet-tunnel-provider` для app + extension.