@donotuse/eas-cli 18.5.0-rc.1

package/build/credentials/ios/appstore/ascApiKey.js

@@ -0,0 +1,172 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listAscApiKeysAsync = listAscApiKeysAsync;
+exports.getAscApiKeyAsync = getAscApiKeyAsync;
+exports.downloadWithRetryAsync = downloadWithRetryAsync;
+exports.createAscApiKeyAsync = createAscApiKeyAsync;
+exports.revokeAscApiKeyAsync = revokeAscApiKeyAsync;
+exports.getAscApiKeyInfo = getAscApiKeyInfo;
+const tslib_1 = require("tslib");
+const apple_utils_1 = require("@expo/apple-utils");
+const promise_retry_1 = tslib_1.__importDefault(require("promise-retry"));
+const authenticate_1 = require("./authenticate");
+const AnalyticsManager_1 = require("../../../analytics/AnalyticsManager");
+const log_1 = tslib_1.__importStar(require("../../../log"));
+const ora_1 = require("../../../ora");
+/**
+ * List App Store Connect API Keys.
+ * **Does not support App Store Connect API (CI).**
+ */
+async function listAscApiKeysAsync(userAuthCtx) {
+    const spinner = (0, ora_1.ora)(`Fetching App Store Connect API Keys.`).start();
+    try {
+        const context = (0, authenticate_1.getRequestContext)(userAuthCtx);
+        const keys = await apple_utils_1.ApiKey.getAsync(context);
+        spinner.succeed(`Fetched App Store Connect API Keys.`);
+        return keys.map(key => getAscApiKeyInfo(key, userAuthCtx));
+    }
+    catch (error) {
+        spinner.fail(`Failed to fetch App Store Connect API Keys.`);
+        throw error;
+    }
+}
+/**
+ * Get an App Store Connect API Key.
+ * **Does not support App Store Connect API (CI).**
+ */
+async function getAscApiKeyAsync(userAuthCtx, keyId) {
+    const spinner = (0, ora_1.ora)(`Fetching App Store Connect API Key.`).start();
+    try {
+        const context = (0, authenticate_1.getRequestContext)(userAuthCtx);
+        const apiKey = await apple_utils_1.ApiKey.infoAsync(context, { id: keyId });
+        spinner.succeed(`Fetched App Store Connect API Key (ID: ${keyId}).`);
+        return getAscApiKeyInfo(apiKey, userAuthCtx);
+    }
+    catch (error) {
+        const message = error?.message ?? '';
+        if (message.includes("There is no resource of type 'apiKeys' with id")) {
+            spinner.stop();
+            return null;
+        }
+        log_1.default.error(error);
+        spinner.fail(`Failed to fetch App Store Connect API Key.`);
+        throw error;
+    }
+}
+/**
+ * There is a bug in Apple's infrastructure that does not propagate newly created objects for a
+ * while. If the key has not propagated and you try to download it, Apple will error saying that
+ * the resource does not exist. We retry with exponential backoff until the key propagates and
+ * is available for download.
+ * */
+async function downloadWithRetryAsync(analytics, key, { minTimeout = 1000, retries = 6, factor = 2, } = {}) {
+    const RESOURCE_DOES_NOT_EXIST_MESSAGE = 'The specified resource does not exist - There is no resource of type';
+    try {
+        const keyP8 = await (0, promise_retry_1.default)(async (retry, number) => {
+            try {
+                return await key.downloadAsync();
+            }
+            catch (e) {
+                if (e.name === 'UnexpectedAppleResponse' &&
+                    e.message.includes(RESOURCE_DOES_NOT_EXIST_MESSAGE)) {
+                    const secondsToRetry = Math.pow(factor, number);
+                    log_1.default.log(`Received an unexpected response from Apple, retrying in ${secondsToRetry} seconds...`);
+                    analytics.logEvent(AnalyticsManager_1.SubmissionEvent.API_KEY_DOWNLOAD_RETRY, {
+                        errorName: e.name,
+                        reason: e.message,
+                        retry: number,
+                    });
+                    return retry(e);
+                }
+                throw e;
+            }
+        }, {
+            retries,
+            factor,
+            minTimeout,
+        });
+        analytics.logEvent(AnalyticsManager_1.SubmissionEvent.API_KEY_DOWNLOAD_SUCCESS, {});
+        return keyP8;
+    }
+    catch (e) {
+        if (e.name === 'UnexpectedAppleResponse' &&
+            e.message.includes(RESOURCE_DOES_NOT_EXIST_MESSAGE)) {
+            log_1.default.warn(`Unable to download Api Key from Apple at this time. Create and upload your key manually by running 'eas credentials' ${(0, log_1.learnMore)('https://expo.fyi/creating-asc-api-key')}`);
+        }
+        analytics.logEvent(AnalyticsManager_1.SubmissionEvent.API_KEY_DOWNLOAD_FAIL, {
+            errorName: e.name,
+            reason: e.message,
+        });
+        throw e;
+    }
+}
+/**
+ * Create an App Store Connect API Key.
+ * **Does not support App Store Connect API (CI).**
+ */
+async function createAscApiKeyAsync(analytics, userAuthCtx, { nickname, allAppsVisible, roles, keyType, }) {
+    const spinner = (0, ora_1.ora)(`Creating App Store Connect API Key.`).start();
+    try {
+        const context = (0, authenticate_1.getRequestContext)(userAuthCtx);
+        const key = await apple_utils_1.ApiKey.createAsync(context, {
+            nickname: nickname ?? `[expo] ${new Date().getTime()}`,
+            allAppsVisible: allAppsVisible ?? true,
+            roles: roles ?? [apple_utils_1.UserRole.ADMIN],
+            keyType: keyType ?? apple_utils_1.ApiKeyType.PUBLIC_API,
+        });
+        const keyP8 = await downloadWithRetryAsync(analytics, key);
+        if (!keyP8) {
+            const { nickname, roles } = key.attributes;
+            const humanReadableKey = `App Store Connect Key '${nickname}' (${key.id}) with roles {${roles.join(',')}}`;
+            if (!key.attributes.canDownload) {
+                // this case would be unexpected because we just created the key
+                throw new Error(`${humanReadableKey} is not available for download from Apple.`);
+            }
+            else if (!key.attributes.isActive) {
+                throw new Error(`${humanReadableKey} is inactive and could not be downloaded.`);
+            }
+            throw new Error(`Failed to download .p8 file of ${humanReadableKey}.`);
+        }
+        // this object has more optional parameters populated
+        const fullKey = await apple_utils_1.ApiKey.infoAsync(context, { id: key.id });
+        spinner.succeed(`Created App Store Connect API Key.`);
+        return {
+            ...getAscApiKeyInfo(fullKey, userAuthCtx),
+            keyP8,
+        };
+    }
+    catch (err) {
+        spinner.fail('Failed to create App Store Connect API Key.');
+        throw err;
+    }
+}
+/**
+ * Revoke an App Store Connect API Key.
+ * **Does not support App Store Connect API (CI).**
+ */
+async function revokeAscApiKeyAsync(userAuthCtx, keyId) {
+    const spinner = (0, ora_1.ora)(`Revoking App Store Connect API Key.`).start();
+    try {
+        const context = (0, authenticate_1.getRequestContext)(userAuthCtx);
+        const apiKey = await apple_utils_1.ApiKey.infoAsync(context, { id: keyId });
+        const revokedKey = await apiKey.revokeAsync();
+        spinner.succeed(`Revoked App Store Connect API Key.`);
+        return getAscApiKeyInfo(revokedKey, userAuthCtx);
+    }
+    catch (error) {
+        log_1.default.error(error);
+        spinner.fail(`Failed to revoke App Store Connect API Key.`);
+        throw error;
+    }
+}
+function getAscApiKeyInfo(apiKey, authCtx) {
+    return {
+        name: apiKey.attributes.nickname,
+        keyId: apiKey.id,
+        issuerId: apiKey.attributes.provider?.id,
+        teamId: authCtx.team.id,
+        teamName: authCtx.team.name,
+        roles: apiKey.attributes.roles,
+        isRevoked: !!apiKey.attributes.revokingDate,
+    };
+}

package/build/credentials/ios/appstore/authenticate.d.ts

@@ -0,0 +1,20 @@
+import { RequestContext, Session } from '@expo/apple-utils';
+import { AppleTeamType, AuthCtx, AuthenticationMode, UserAuthCtx } from './authenticateTypes';
+import { MinimalAscApiKey } from '../credentials';
+export type Options = {
+    appleId?: string;
+    teamId?: string;
+    teamName?: string;
+    teamType?: AppleTeamType;
+    ascApiKey?: MinimalAscApiKey;
+    /**
+     * Can be used to restore the Apple auth state via apple-utils.
+     */
+    cookies?: Session.AuthState['cookies'];
+    /** Indicates how Apple network requests will be made. */
+    mode?: AuthenticationMode;
+};
+export declare function isUserAuthCtx(authCtx: AuthCtx | undefined): authCtx is UserAuthCtx;
+export declare function assertUserAuthCtx(authCtx: AuthCtx | undefined): UserAuthCtx;
+export declare function getRequestContext(authCtx: AuthCtx): RequestContext;
+export declare function authenticateAsync(options?: Options): Promise<AuthCtx>;

package/build/credentials/ios/appstore/authenticate.js

@@ -0,0 +1,171 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isUserAuthCtx = isUserAuthCtx;
+exports.assertUserAuthCtx = assertUserAuthCtx;
+exports.getRequestContext = getRequestContext;
+exports.authenticateAsync = authenticateAsync;
+const tslib_1 = require("tslib");
+const apple_utils_1 = require("@expo/apple-utils");
+const assert_1 = tslib_1.__importDefault(require("assert"));
+const chalk_1 = tslib_1.__importDefault(require("chalk"));
+const getenv = tslib_1.__importStar(require("getenv"));
+const authenticateTypes_1 = require("./authenticateTypes");
+const resolveCredentials_1 = require("./resolveCredentials");
+const log_1 = tslib_1.__importDefault(require("../../../log"));
+const prompts_1 = require("../../../prompts");
+const APPLE_IN_HOUSE_TEAM_TYPE = 'in-house';
+function isUserAuthCtx(authCtx) {
+    return !!authCtx && typeof authCtx.appleId === 'string';
+}
+function assertUserAuthCtx(authCtx) {
+    if (isUserAuthCtx(authCtx)) {
+        return authCtx;
+    }
+    throw new Error('Expected user authentication context (login/password).');
+}
+function getRequestContext(authCtx) {
+    (0, assert_1.default)(authCtx.authState?.context, 'Apple request context must be defined');
+    return authCtx.authState.context;
+}
+async function loginAsync(userCredentials = {}, options) {
+    // First try login with cookies JSON
+    if (userCredentials.cookies) {
+        const session = await apple_utils_1.Auth.loginWithCookiesAsync(userCredentials);
+        // If the session isn't valid, continue to the other authentication methods.
+        // Use `loginWithCookiesAsync` for a less resilient flow.
+        if (session) {
+            return session;
+        }
+    }
+    // Resolve the user credentials, optimizing for password-less login.
+    const { username, password } = await (0, resolveCredentials_1.resolveUserCredentialsAsync)(userCredentials);
+    (0, assert_1.default)(username);
+    // Clear data
+    apple_utils_1.Auth.resetInMemoryData();
+    try {
+        // Attempt to rehydrate the session.
+        const restoredSession = await apple_utils_1.Auth.tryRestoringAuthStateFromUserCredentialsAsync({
+            username,
+            providerId: userCredentials.providerId,
+            teamId: userCredentials.teamId,
+        }, options);
+        if (restoredSession) {
+            // Completed authentication!
+            return { password, ...restoredSession };
+        }
+        return await loginWithUserCredentialsAsync({
+            username,
+            password,
+            providerId: userCredentials.providerId,
+            teamId: userCredentials.teamId,
+        });
+    }
+    catch (error) {
+        if (error instanceof apple_utils_1.InvalidUserCredentialsError) {
+            log_1.default.error(error.message);
+            // Remove the invalid password so it isn't automatically used...
+            await (0, resolveCredentials_1.deletePasswordAsync)({ username });
+            if (await (0, prompts_1.toggleConfirmAsync)({ message: 'Would you like to try again?' })) {
+                // Don't pass credentials back or the method will throw
+                return await loginAsync({
+                    teamId: userCredentials.teamId,
+                    providerId: userCredentials.providerId,
+                }, options);
+            }
+            else {
+                throw new Error('ABORTED');
+            }
+        }
+        throw error;
+    }
+}
+async function loginWithUserCredentialsAsync({ username, password, teamId, providerId, }) {
+    // Start a new login flow
+    const newSession = await apple_utils_1.Auth.loginWithUserCredentialsAsync({
+        username,
+        // If the session couldn't be restored, then prompt for the password (also check if it's stored in the keychain).
+        password: password || (await (0, resolveCredentials_1.promptPasswordAsync)({ username })),
+        providerId,
+        teamId,
+    });
+    // User cancelled or something.
+    (0, assert_1.default)(newSession, 'An unexpected error occurred while completing authentication');
+    // Success!
+    return newSession;
+}
+async function authenticateAsync(options = {}) {
+    if (options.mode === authenticateTypes_1.AuthenticationMode.API_KEY) {
+        return await authenticateWithApiKeyAsync(options);
+    }
+    else {
+        return await authenticateAsUserAsync(options);
+    }
+}
+async function authenticateWithApiKeyAsync(options = {}) {
+    // Resolve the user credentials, optimizing for password-less login.
+    const ascApiKey = await (0, resolveCredentials_1.resolveAscApiKeyAsync)(options.ascApiKey);
+    const team = await (0, resolveCredentials_1.resolveAppleTeamAsync)(options);
+    const jwtDurationSeconds = 1200; // 20 minutes
+    return {
+        team,
+        authState: {
+            context: {
+                token: new apple_utils_1.Token({
+                    key: ascApiKey.keyP8,
+                    issuerId: ascApiKey.issuerId,
+                    keyId: ascApiKey.keyId,
+                    duration: jwtDurationSeconds,
+                }),
+            },
+        },
+        ascApiKey,
+    };
+}
+async function authenticateAsUserAsync(options = {}) {
+    // help keep apple login visually apart from the other operations.
+    log_1.default.addNewLineIfNone();
+    try {
+        const authState = await loginAsync({
+            cookies: options.cookies,
+            teamId: options.teamId ?? process.env.EXPO_APPLE_TEAM_ID,
+            providerId: process.env.EXPO_APPLE_PROVIDER_ID
+                ? getenv.int('EXPO_APPLE_PROVIDER_ID')
+                : undefined,
+        }, {
+            // TODO: Provide a way to disable this for users who want to mix and match teams / providers.
+            autoResolveProvider: true,
+        });
+        // Currently, this is resolved once, inside the apple-utils package.
+        const teamId = authState.context.teamId;
+        // Get all of the teams to resolve the rest of the user data.
+        // TODO: optimize this step.
+        const teams = await apple_utils_1.Teams.getTeamsAsync();
+        const team = teams.find(team => team.teamId === teamId);
+        (0, assert_1.default)(team, `Your account is not associated with Apple Team with ID: ${teamId}`);
+        // Get the JSON cookies in the custom YAML format used by Fastlane
+        const fastlaneSession = apple_utils_1.Session.getSessionAsYAML();
+        return {
+            appleId: authState.username,
+            appleIdPassword: authState.password,
+            team: formatTeam(team),
+            // Can be used to restore the auth state using apple-utils.
+            authState,
+            // Defined for legacy usage in Turtle V1 or any other places where Fastlane is used in the servers.
+            fastlaneSession,
+        };
+    }
+    catch (error) {
+        if (error.message === 'ABORTED') {
+            process.exit(1);
+        }
+        log_1.default.log(chalk_1.default.red('Authentication with Apple Developer Portal failed!'));
+        throw error;
+    }
+}
+function formatTeam({ teamId, name, type }) {
+    return {
+        id: teamId,
+        name: `${name} (${type})`,
+        inHouse: type.toLowerCase() === APPLE_IN_HOUSE_TEAM_TYPE,
+    };
+}

package/build/credentials/ios/appstore/authenticateTypes.d.ts

@@ -0,0 +1,41 @@
+import { Session } from '@expo/apple-utils';
+import { MinimalAscApiKey } from '../credentials';
+export declare enum AuthenticationMode {
+    /** App Store API requests will be made using the official API via an API key, used for CI environments where 2FA cannot be performed. */
+    API_KEY = 0,
+    /** Uses cookies based authentication and the unofficial App Store web API, this provides more functionality than the official API but cannot be reliably used in CI because it requires 2FA. */
+    USER = 1
+}
+export declare enum AppleTeamType {
+    IN_HOUSE = "IN_HOUSE",
+    COMPANY_OR_ORGANIZATION = "COMPANY_OR_ORGANIZATION",
+    INDIVIDUAL = "INDIVIDUAL"
+}
+export type Team = {
+    id: string;
+    /** Name of the development team, this is undefined when ASC API keys are used instead of cookies for authentication. */
+    name?: string;
+    inHouse?: boolean;
+};
+export type UserAuthCtx = {
+    appleId: string;
+    appleIdPassword?: string;
+    team: Team;
+    /**
+     * Defined when using Fastlane
+     */
+    fastlaneSession?: string;
+    /**
+     * Can be used to restore the Apple auth state via apple-utils.
+     */
+    authState?: Session.AuthState;
+};
+export type ApiKeyAuthCtx = {
+    ascApiKey: MinimalAscApiKey;
+    team: Team;
+    /**
+     * Can be used to restore the Apple auth state via apple-utils.
+     */
+    authState?: Partial<Session.AuthState>;
+};
+export type AuthCtx = UserAuthCtx | ApiKeyAuthCtx;

package/build/credentials/ios/appstore/authenticateTypes.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppleTeamType = exports.AuthenticationMode = void 0;
+var AuthenticationMode;
+(function (AuthenticationMode) {
+    /** App Store API requests will be made using the official API via an API key, used for CI environments where 2FA cannot be performed. */
+    AuthenticationMode[AuthenticationMode["API_KEY"] = 0] = "API_KEY";
+    /** Uses cookies based authentication and the unofficial App Store web API, this provides more functionality than the official API but cannot be reliably used in CI because it requires 2FA. */
+    AuthenticationMode[AuthenticationMode["USER"] = 1] = "USER";
+})(AuthenticationMode || (exports.AuthenticationMode = AuthenticationMode = {}));
+var AppleTeamType;
+(function (AppleTeamType) {
+    AppleTeamType["IN_HOUSE"] = "IN_HOUSE";
+    AppleTeamType["COMPANY_OR_ORGANIZATION"] = "COMPANY_OR_ORGANIZATION";
+    AppleTeamType["INDIVIDUAL"] = "INDIVIDUAL";
+})(AppleTeamType || (exports.AppleTeamType = AppleTeamType = {}));

package/build/credentials/ios/appstore/bundleId.d.ts

@@ -0,0 +1,3 @@
+import { BundleId, Profile, RequestContext } from '@expo/apple-utils';
+export declare function getProfilesForBundleIdAsync(context: RequestContext, bundleIdentifier: string): Promise<Profile[]>;
+export declare function getBundleIdForIdentifierAsync(context: RequestContext, bundleIdentifier: string): Promise<BundleId>;

package/build/credentials/ios/appstore/bundleId.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getProfilesForBundleIdAsync = getProfilesForBundleIdAsync;
+exports.getBundleIdForIdentifierAsync = getBundleIdForIdentifierAsync;
+const apple_utils_1 = require("@expo/apple-utils");
+async function getProfilesForBundleIdDangerousAsync(context, bundleIdentifier) {
+    const bundleId = await apple_utils_1.BundleId.findAsync(context, { identifier: bundleIdentifier });
+    if (bundleId) {
+        return await bundleId.getProfilesAsync();
+    }
+    return [];
+}
+async function getProfilesForBundleIdAsync(context, bundleIdentifier) {
+    // Only work with active provisioning profiles, we can't use expired or invalid profiles
+    // Once a profile expired or is marked as invalid, it cannot change back to active, making cache poisoning irrelevant here
+    const profiles = await getProfilesForBundleIdDangerousAsync(context, bundleIdentifier).then(profiles => profiles.filter(profile => profile.attributes.profileState === apple_utils_1.ProfileState.ACTIVE));
+    // users sometimes have a poisoned Apple cache and receive stale data from the API
+    // we call an arbitrary method, `getBundleIdAsync` on each profile
+    // if it errors, the profile was stale, so we remove it
+    const validProfileIds = new Set();
+    await Promise.all(profiles.map(async (profile) => {
+        try {
+            await profile.getBundleIdAsync();
+            validProfileIds.add(profile.id);
+        }
+        catch (e) {
+            if (e.name === 'UnexpectedAppleResponse' &&
+                e.message.includes('The specified resource does not exist - There is no resource of type')) {
+                // TODO: add tracking analytics here
+                return;
+            }
+            throw e;
+        }
+    }));
+    return profiles.filter(profile => validProfileIds.has(profile.id));
+}
+async function getBundleIdForIdentifierAsync(context, bundleIdentifier) {
+    const bundleId = await apple_utils_1.BundleId.findAsync(context, { identifier: bundleIdentifier });
+    if (!bundleId) {
+        throw new Error(`Failed to find Bundle ID item with identifier "${bundleIdentifier}"`);
+    }
+    return bundleId;
+}

package/build/credentials/ios/appstore/bundleIdCapabilities.d.ts

@@ -0,0 +1,27 @@
+import { BundleId } from '@expo/apple-utils';
+import { JSONObject } from '@expo/json-file';
+import { CapabilityClassifier } from './capabilityList';
+export declare const EXPO_NO_CAPABILITY_SYNC: boolean;
+/**
+ * Given an entitlements JSON object, synchronizes the remote capabilities for a bundle identifier.
+ *
+ * Example entitlements JSON:
+ * ```js
+ * {
+ *   'com.apple.developer.healthkit': true,
+ *   'com.apple.developer.in-app-payments': ['merchant.com.example.development'],
+ * }
+ * ```
+ *
+ * @param bundleId bundle identifier object
+ * @param entitlements JSON representation of the entitlements plist
+ * @param additionalOptions Additional options to consider when syncing capabilities.
+ * @returns
+ */
+export declare function syncCapabilitiesForEntitlementsAsync(bundleId: BundleId, entitlements: JSONObject | undefined, additionalOptions: {
+    usesBroadcastPushNotifications: boolean;
+}): Promise<{
+    enabled: string[];
+    disabled: string[];
+}>;
+export declare function assertValidOptions(classifier: CapabilityClassifier, value: any): asserts value;

package/build/credentials/ios/appstore/bundleIdCapabilities.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXPO_NO_CAPABILITY_SYNC = void 0;
+exports.syncCapabilitiesForEntitlementsAsync = syncCapabilitiesForEntitlementsAsync;
+exports.assertValidOptions = assertValidOptions;
+const tslib_1 = require("tslib");
+const apple_utils_1 = require("@expo/apple-utils");
+const getenv_1 = tslib_1.__importDefault(require("getenv"));
+const util_1 = require("util");
+const capabilityList_1 = require("./capabilityList");
+const log_1 = tslib_1.__importDefault(require("../../../log"));
+exports.EXPO_NO_CAPABILITY_SYNC = getenv_1.default.boolish('EXPO_NO_CAPABILITY_SYNC', false);
+/**
+ * Given an entitlements JSON object, synchronizes the remote capabilities for a bundle identifier.
+ *
+ * Example entitlements JSON:
+ * ```js
+ * {
+ *   'com.apple.developer.healthkit': true,
+ *   'com.apple.developer.in-app-payments': ['merchant.com.example.development'],
+ * }
+ * ```
+ *
+ * @param bundleId bundle identifier object
+ * @param entitlements JSON representation of the entitlements plist
+ * @param additionalOptions Additional options to consider when syncing capabilities.
+ * @returns
+ */
+async function syncCapabilitiesForEntitlementsAsync(bundleId, entitlements = {}, additionalOptions) {
+    if (exports.EXPO_NO_CAPABILITY_SYNC) {
+        return { enabled: [], disabled: [] };
+    }
+    const currentCapabilities = await bundleId.getBundleIdCapabilitiesAsync();
+    if (log_1.default.isDebug) {
+        log_1.default.log(`Current remote capabilities:\n${JSON.stringify(currentCapabilities, null, 2)}`);
+        log_1.default.log(`\nCurrent local entitlements:\n${JSON.stringify(entitlements, null, 2)}`);
+    }
+    const { enabledCapabilityNames, request, remainingCapabilities } = getCapabilitiesToEnable(currentCapabilities, entitlements, additionalOptions);
+    const { disabledCapabilityNames, request: modifiedRequest } = getCapabilitiesToDisable(bundleId, remainingCapabilities, request, entitlements);
+    if (modifiedRequest.length) {
+        log_1.default.debug(`Patch Request:`, (0, util_1.inspect)(modifiedRequest, { depth: null, colors: true }));
+        try {
+            await bundleId.updateBundleIdCapabilityAsync(modifiedRequest);
+        }
+        catch (error) {
+            if (error.message.match(/bundle '[\w\d]+' cannot be deleted. Delete all the Apps/)) {
+                log_1.default.error('Failed to patch capabilities:', (0, util_1.inspect)(modifiedRequest, { depth: null, colors: true }));
+                throw new Error(`Unexpected error occurred while attempting to update capabilities for app "${bundleId.attributes.identifier}".\nCapabilities can be modified manually in the Apple developer console at https://developer-mdn.apple.com/account/resources/identifiers/bundleId/edit/${bundleId.id}.\nAuto capability syncing can be disabled with the environment variable \`EXPO_NO_CAPABILITY_SYNC=1\`.\n${error.message}`);
+            }
+        }
+    }
+    return { enabled: enabledCapabilityNames, disabled: disabledCapabilityNames };
+}
+function getCapabilitiesToEnable(currentRemoteCapabilities, entitlements, additionalOptions) {
+    const enabledCapabilityNames = [];
+    const request = [];
+    const remainingCapabilities = [...currentRemoteCapabilities];
+    for (const [key, value] of Object.entries(entitlements)) {
+        const staticCapabilityInfo = capabilityList_1.CapabilityMapping.find(capability => capability.entitlement === key);
+        if (!staticCapabilityInfo) {
+            if (log_1.default.isDebug) {
+                log_1.default.log(`Skipping entitlement that is not supported by EAS: ${key}`);
+            }
+            continue;
+        }
+        assertValidOptions(staticCapabilityInfo, value);
+        const existingIndex = remainingCapabilities.findIndex(existing => existing.isType(staticCapabilityInfo.capability));
+        const existingRemote = existingIndex > -1 ? remainingCapabilities[existingIndex] : null;
+        const operation = staticCapabilityInfo.getSyncOperation({
+            existingRemote,
+            entitlements,
+            entitlementValue: value,
+            additionalOptions,
+        });
+        const { op } = operation;
+        if (log_1.default.isDebug) {
+            log_1.default.log(`Will ${op} remote capability: ${key} (${staticCapabilityInfo.name}).`);
+        }
+        if (op === 'enable') {
+            enabledCapabilityNames.push(staticCapabilityInfo.name);
+            request.push({
+                capabilityType: staticCapabilityInfo.capability,
+                option: operation.option,
+            });
+        }
+        else if (op === 'skip' && existingIndex >= 0) {
+            // Remove the item from the list of capabilities so we don't disable it in the next step.
+            remainingCapabilities.splice(existingIndex, 1);
+        }
+    }
+    return { enabledCapabilityNames, request, remainingCapabilities };
+}
+function assertValidOptions(classifier, value) {
+    if (!classifier.validateOptions(value)) {
+        let reason = '';
+        if (classifier.capabilityIdPrefix) {
+            // Assert string array matching prefix. ASC will throw if the IDs are invalid, this just saves some time.
+            reason = ` Expected an array of strings, where each string is prefixed with "${classifier.capabilityIdPrefix}", ex: ["${classifier.capabilityIdPrefix}myapp"]`;
+        }
+        throw new Error(`iOS entitlement "${classifier.entitlement}" has invalid value "${value}".${reason}`);
+    }
+}
+function getCapabilitiesToDisable(bundleId, currentCapabilities, request, entitlements) {
+    if (log_1.default.isDebug) {
+        log_1.default.log(`Existing to disable: `, currentCapabilities.map(({ id }) => id));
+    }
+    const disabledCapabilityNames = [];
+    // Disable any extras that aren't present, this functionality is kinda unreliable because managed apps
+    // might be enabling capabilities in modifiers.
+    for (const existingCapability of currentCapabilities) {
+        // GC and IAP are always enabled in apps by default so we should avoid modifying them.
+        if (existingCapability.isType(apple_utils_1.CapabilityType.IN_APP_PURCHASE) ||
+            existingCapability.isType(apple_utils_1.CapabilityType.GAME_CENTER)) {
+            continue;
+        }
+        if (existingCapability.attributes) {
+            const adjustedType = getAdjustedCapabilityType(existingCapability, bundleId);
+            if (adjustedType === apple_utils_1.CapabilityType.MDM_MANAGED_ASSOCIATED_DOMAINS &&
+                entitlements[capabilityList_1.associatedDomainsCapabilityType.entitlement]) {
+                // MDM Managed Associated Domains is a special case, it should not be disabled if Associated Domains is enabled.
+                continue;
+            }
+            // Only disable capabilities that we handle,
+            // this enables devs to turn on capabilities outside of EAS without worrying about us disabling them.
+            const staticCapabilityInfo = capabilityList_1.CapabilityMapping.find(capability => capability.capability === adjustedType);
+            if (staticCapabilityInfo &&
+                !request.find(request => request.capabilityType && existingCapability.isType(request.capabilityType))) {
+                request.push({
+                    // @ts-expect-error
+                    capabilityType: adjustedType,
+                    option: apple_utils_1.CapabilityTypeOption.OFF,
+                });
+                disabledCapabilityNames.push(staticCapabilityInfo.name);
+            }
+        }
+    }
+    return { disabledCapabilityNames, request };
+}
+function getAdjustedCapabilityType(existingCapability, bundleId) {
+    let adjustedType = existingCapability.attributes.capabilityType;
+    if (!adjustedType) {
+        if (process.env.NODE_ENV === 'test' && !existingCapability.id.startsWith(`${bundleId.id}_`)) {
+            throw new Error(`Capability ID "${existingCapability.id}" does not start with the bundle ID "${bundleId.id}_". This is likely a test setup issue.`);
+        }
+        adjustedType = existingCapability.id.replace(`${bundleId.id}_`, '');
+    }
+    return adjustedType;
+}

package/build/credentials/ios/appstore/capabilityIdentifiers.d.ts

@@ -0,0 +1,18 @@
+import { BundleId } from '@expo/apple-utils';
+import { JSONObject } from '@expo/json-file';
+/**
+ * Sync the capability identifiers with the bundle identifier capabilities.
+ * If a capability identifier is missing, then attempt to create it.
+ * Link all of the capability identifiers at the same time after parsing the entitlements file.
+ *
+ * **Does not support App Store Connect API (CI).**
+ *
+ * @param bundleId Bundle identifier object.
+ * @param entitlements JSON representation of the iOS entitlements plist
+ *
+ * @returns an object specifying the capabilities that were linked, and created.
+ */
+export declare function syncCapabilityIdentifiersForEntitlementsAsync(bundleId: BundleId, entitlements?: JSONObject): Promise<{
+    created: string[];
+    linked: string[];
+}>;