@better-update/cli 0.12.0 → 0.13.0

package/dist/index.mjs

@@ -7,7 +7,7 @@ import { Command, FetchHttpClient, FileSystem, HttpApi, HttpApiClient, HttpApiEn
 import { NodeContext } from "@effect/platform-node";
 import path, { join } from "node:path";
 import process$1 from "node:process";
-import * as AppleUtils from "@expo/apple-utils";
+import AppleUtils from "@expo/apple-utils";
 import { cancel, confirm, isCancel, multiselect, password, select, text } from "@clack/prompts";
 import { once } from "node:events";
 import { createServer } from "node:http";
@@ -28,7 +28,7 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 //#endregion
 //#region package.json
-var version = "0.12.0";
+var version = "0.13.0";
 
 //#endregion
 //#region src/lib/interactive-mode.ts
@@ -5278,17 +5278,30 @@ const DISTRIBUTION_TO_CERTIFICATE_TYPE = {
 	DEVELOPMENT: AppleUtils.CertificateType.IOS_DEVELOPMENT
 };
 var AppleIdGenerateFailedError = class extends Data.TaggedError("AppleIdGenerateFailedError") {};
+const CERT_LIMIT_PATTERN = /already have a current.*certificate|pending certificate request/iu;
+const messageOf = (cause) => cause instanceof Error ? cause.message : String(cause);
 const wrap = (step, run) => Effect.tryPromise({
 	try: run,
 	catch: (cause) => new AppleIdGenerateFailedError({
 		step,
-		message: cause instanceof Error ? cause.message : String(cause)
+		message: messageOf(cause)
 	})
 });
+const wrapCertificateCreate = (run) => Effect.tryPromise({
+	try: run,
+	catch: (cause) => {
+		const message = messageOf(cause);
+		if (CERT_LIMIT_PATTERN.test(message)) return new CertificateLimitError({ message });
+		return new AppleIdGenerateFailedError({
+			step: "apple-create-certificate",
+			message
+		});
+	}
+});
 const generateAndUploadDistributionCertificateViaAppleId = (api, input) => Effect.gen(function* () {
 	const ctx = input.context;
 	const certificateType = input.certificateType === "IOS_DEVELOPMENT" ? AppleUtils.CertificateType.IOS_DEVELOPMENT : AppleUtils.CertificateType.IOS_DISTRIBUTION;
-	const result = yield* wrap("apple-create-certificate", async () => AppleUtils.createCertificateAndP12Async(ctx, { certificateType }));
+	const result = yield* wrapCertificateCreate(async () => AppleUtils.createCertificateAndP12Async(ctx, { certificateType }));
 	const metadata = yield* extractMetadataFromP12({
 		p12Base64: result.certificateP12,
 		password: result.password
@@ -5312,6 +5325,16 @@ const generateAndUploadDistributionCertificateViaAppleId = (api, input) => Effec
 		developerPortalIdentifier: result.certificate.id
 	};
 });
+const listDistributionCertsViaAppleId = (ctx, certificateType = "IOS_DISTRIBUTION") => Effect.gen(function* () {
+	const filter = certificateType === "IOS_DEVELOPMENT" ? AppleUtils.CertificateType.IOS_DEVELOPMENT : AppleUtils.CertificateType.IOS_DISTRIBUTION;
+	return (yield* wrap("apple-list-certificates", async () => AppleUtils.Certificate.getAsync(ctx, { query: { filter: { certificateType: filter } } }))).map((entry) => ({
+		developerPortalIdentifier: entry.id,
+		serialNumber: entry.attributes.serialNumber,
+		displayName: entry.attributes.displayName,
+		expirationDate: entry.attributes.expirationDate
+	}));
+});
+const revokeDistributionCertViaAppleId = (ctx, developerPortalIdentifier) => wrap("apple-revoke-certificate", async () => AppleUtils.Certificate.deleteAsync(ctx, { id: developerPortalIdentifier }));
 const findOrCreateBundleId = (ctx, bundleIdentifier) => Effect.gen(function* () {
 	const existing = yield* wrap("apple-find-bundle-id", async () => AppleUtils.BundleId.findAsync(ctx, { identifier: bundleIdentifier }));
 	if (existing !== null) return existing.id;
@@ -5393,13 +5416,66 @@ const chooseIosSetupPath = (api) => Effect.gen(function* () {
 		label: "Use an App Store Connect API key"
 	}]);
 });
+const interactiveAppleIdCertLimitRecover = (ctx) => Effect.gen(function* () {
+	yield* Console.log("");
+	yield* Console.log("Apple reports the certificate limit was hit (max 3 distribution certs per team).");
+	const certs = yield* listDistributionCertsViaAppleId(ctx, "IOS_DISTRIBUTION");
+	if (certs.length === 0) return yield* new AppleIdGenerateFailedError({
+		step: "limit-recover",
+		message: "Apple says the certificate limit is hit but no existing certificates were returned."
+	});
+	const toRevoke = yield* promptMultiSelect("Select one or more certificates to revoke before retrying", certs.map((entry) => ({
+		value: entry.developerPortalIdentifier,
+		label: `${entry.serialNumber.slice(0, 12)}… (${entry.displayName}, exp ${entry.expirationDate.slice(0, 10)})`
+	})), { required: true });
+	yield* Effect.forEach(toRevoke, (id) => revokeDistributionCertViaAppleId(ctx, id), { concurrency: "inherit" });
+	yield* Console.log(`Revoked ${toRevoke.length} certificate(s); retrying generation...`);
+});
+const generateDistributionCertViaAppleIdInteractive = (api, ctx) => Effect.gen(function* () {
+	yield* Console.log("Generating distribution certificate via Apple ID...");
+	const generate = generateAndUploadDistributionCertificateViaAppleId(api, { context: ctx });
+	return yield* generate.pipe(Effect.catchTag("CertificateLimitError", () => interactiveAppleIdCertLimitRecover(ctx).pipe(Effect.flatMap(() => generate))));
+});
+const GENERATE_NEW = "__generate__";
+const chooseDistributionCertViaAppleId = (api, ctx, appleTeamId) => Effect.gen(function* () {
+	const items = (yield* api.appleDistributionCertificates.list()).items.filter((cert) => cert.appleTeamId === appleTeamId);
+	if (items.length === 0) {
+		const created = yield* generateDistributionCertViaAppleIdInteractive(api, ctx);
+		return {
+			id: created.id,
+			appleTeamId: created.appleTeamId
+		};
+	}
+	const choice = yield* promptSelect("Select a distribution certificate (or 'generate' for a fresh one)", [{
+		value: GENERATE_NEW,
+		label: "Generate a new distribution certificate"
+	}, ...items.map((cert) => ({
+		value: cert.id,
+		label: `${cert.serialNumber.slice(0, 12)}… (team ${cert.appleTeamId})`
+	}))]);
+	if (choice === GENERATE_NEW) {
+		const created = yield* generateDistributionCertViaAppleIdInteractive(api, ctx);
+		return {
+			id: created.id,
+			appleTeamId: created.appleTeamId
+		};
+	}
+	const cert = items.find((entry) => entry.id === choice);
+	if (cert === void 0) return yield* new AppleIdGenerateFailedError({
+		step: "pick-certificate",
+		message: `Selected certificate ${choice} not found after listing`
+	});
+	return {
+		id: cert.id,
+		appleTeamId: cert.appleTeamId
+	};
+});
 const setupIosViaAppleId = (api, input) => Effect.gen(function* () {
 	const auth = yield* AppleAuth;
 	const session = yield* auth.ensureLoggedIn();
 	const ctx = auth.buildRequestContext(session);
 	yield* Console.log(`Logged in as ${session.username}. Team: ${session.teamName ?? session.teamId} (${session.teamId}).`);
-	yield* Console.log("Generating distribution certificate via Apple ID...");
-	const cert = yield* generateAndUploadDistributionCertificateViaAppleId(api, { context: ctx });
+	const cert = yield* chooseDistributionCertViaAppleId(api, ctx, session.teamId);
 	const distributionType = IOS_DISTRIBUTION_TO_TYPE[input.distribution];
 	yield* Console.log("Generating provisioning profile via Apple ID...");
 	const profile = yield* generateAndUploadProvisioningProfileViaAppleId(api, {