@donotuse/eas-cli 18.5.0-rc.1

package/build/credentials/ios/appstore/ensureTestFlightGroup.js

@@ -0,0 +1,175 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureTestFlightGroupExistsAsync = ensureTestFlightGroupExistsAsync;
+const tslib_1 = require("tslib");
+const apple_utils_1 = require("@expo/apple-utils");
+const ensureAppExists_1 = require("./ensureAppExists");
+const log_1 = tslib_1.__importDefault(require("../../../log"));
+const ora_1 = require("../../../ora");
+const prompts_1 = require("../../../prompts");
+// The name of the internal TestFlight group, this should probably never change.
+const AUTO_GROUP_NAME = 'Team (Expo)';
+/**
+ * Ensure a TestFlight internal group with access to all builds exists for the app and has all admin users invited to it.
+ * This allows users to instantly access their builds from TestFlight after it finishes processing.
+ */
+async function ensureTestFlightGroupExistsAsync(app) {
+    if (process.env.EAS_NO_AUTO_TESTFLIGHT_SETUP) {
+        log_1.default.debug('EAS_NO_AUTO_TESTFLIGHT_SETUP is set, skipping TestFlight setup');
+        return;
+    }
+    const groups = await app.getBetaGroupsAsync({
+        query: {
+            includes: ['betaTesters'],
+        },
+    });
+    if (groups.length > 0) {
+        log_1.default.debug(`Found ${groups.length} TestFlight groups`);
+        log_1.default.debug('Skipping creating a new TestFlight group');
+        return;
+    }
+    const group = await ensureInternalGroupAsync({
+        app,
+        groups,
+    });
+    const users = await apple_utils_1.User.getAsync(app.context);
+    const admins = users.filter(user => user.attributes.roles?.includes(apple_utils_1.UserRole.ADMIN));
+    await addAllUsersToInternalGroupAsync(group, admins);
+}
+async function ensureInternalGroupAsync({ groups, app, }) {
+    let betaGroup = groups.find(group => group.attributes.name === AUTO_GROUP_NAME);
+    if (!betaGroup) {
+        const spinner = (0, ora_1.ora)().start('Creating TestFlight group...');
+        try {
+            // Apple throw an error if you create the group too quickly after creating the app. We'll retry a few times.
+            await pollRetryAsync(async () => {
+                betaGroup = await app.createBetaGroupAsync({
+                    name: AUTO_GROUP_NAME,
+                    isInternalGroup: true,
+                    // Automatically add latest builds to the group without needing to run the command.
+                    hasAccessToAllBuilds: true,
+                });
+            }, {
+                shouldRetry(error) {
+                    if ((0, ensureAppExists_1.isAppleError)(error)) {
+                        spinner.text = `TestFlight still preparing, retrying in 10 seconds...`;
+                        return error.data.errors.some(error => error.code === 'ENTITY_ERROR.RELATIONSHIP.INVALID');
+                    }
+                    return false;
+                },
+            });
+            spinner.succeed(`TestFlight group created: ${AUTO_GROUP_NAME}`);
+        }
+        catch (error) {
+            spinner.fail('Failed to create TestFlight group...');
+            throw error;
+        }
+    }
+    if (!betaGroup) {
+        throw new Error('Failed to create internal TestFlight group');
+    }
+    // `hasAccessToAllBuilds` is a newer feature that allows the group to automatically have access to all builds. This cannot be patched so we need to recreate the group.
+    if (!betaGroup.attributes.hasAccessToAllBuilds) {
+        if (await (0, prompts_1.confirmAsync)({
+            message: 'Regenerate internal TestFlight group to allow automatic access to all builds?',
+        })) {
+            await apple_utils_1.BetaGroup.deleteAsync(app.context, { id: betaGroup.id });
+            return await ensureInternalGroupAsync({
+                app,
+                groups: await app.getBetaGroupsAsync({
+                    query: {
+                        includes: ['betaTesters'],
+                    },
+                }),
+            });
+        }
+    }
+    return betaGroup;
+}
+async function addAllUsersToInternalGroupAsync(group, users) {
+    let emails = users
+        .filter(user => user.attributes.email)
+        .map(user => ({
+        email: user.attributes.email,
+        firstName: user.attributes.firstName ?? '',
+        lastName: user.attributes.lastName ?? '',
+    }));
+    const { betaTesters } = group.attributes;
+    const existingEmails = betaTesters?.map(tester => tester.attributes.email).filter(Boolean) ?? [];
+    // Filter out existing beta testers.
+    if (betaTesters) {
+        emails = emails.filter(user => !existingEmails.find(existingEmail => existingEmail === user.email));
+    }
+    // No new users to add to the internal group.
+    if (!emails.length) {
+        // No need to log which users are here on subsequent runs as devs already know the drill at this point.
+        log_1.default.debug(`All current admins are already added to the group: ${group.attributes.name}`);
+        return;
+    }
+    log_1.default.debug(`Adding ${emails.length} users to internal group: ${group.attributes.name}`);
+    log_1.default.debug(`Users: ${emails.map(user => user.email).join(', ')}`);
+    const data = await group.createBulkBetaTesterAssignmentsAsync(emails);
+    const success = data.attributes.betaTesters.every(tester => {
+        if (tester.assignmentResult === 'FAILED') {
+            if (tester.errors && Array.isArray(tester.errors) && tester.errors.length) {
+                if (tester.errors.length === 1 &&
+                    tester.errors[0].key === 'Halliday.tester.already.exists') {
+                    return true;
+                }
+                for (const error of tester.errors) {
+                    log_1.default.error(`Error adding user ${tester.email} to TestFlight group "${group.attributes.name}": ${error.key}`);
+                }
+            }
+            return false;
+        }
+        if (tester.assignmentResult === 'NOT_QUALIFIED_FOR_INTERNAL_GROUP') {
+            return false;
+        }
+        return true;
+    });
+    if (!success) {
+        const groupUrl = await getTestFlightGroupUrlAsync(group);
+        log_1.default.error(`Unable to add all admins to TestFlight group "${group.attributes.name}". You can add them manually in App Store Connect. ${groupUrl ?? ''}`);
+    }
+    else {
+        log_1.default.log(`TestFlight access enabled for: ` +
+            data.attributes.betaTesters
+                .map(tester => tester.email)
+                .filter(Boolean)
+                .join(', '));
+        // TODO: When we have more TestFlight functionality, we can link to it from here.
+    }
+}
+async function getTestFlightGroupUrlAsync(group) {
+    if (group.context.providerId) {
+        try {
+            const session = await apple_utils_1.Session.getSessionForProviderIdAsync(group.context.providerId);
+            return `https://appstoreconnect.apple.com/teams/${session.provider.publicProviderId}/apps/6741088859/testflight/groups/${group.id}`;
+        }
+        catch (error) {
+            // Avoid crashing if we can't get the session.
+            log_1.default.debug('Failed to get session for provider ID', error);
+        }
+    }
+    return null;
+}
+async function pollRetryAsync(fn, { shouldRetry, retries = 15, 
+// 25 seconds was the minium interval I calculated when measuring against 5 second intervals.
+// Switching to 10 seconds to account for days where Apple APIs are faster.
+interval = 10000, } = {}) {
+    let lastError = null;
+    for (let i = 0; i < retries; i++) {
+        try {
+            return await fn();
+        }
+        catch (error) {
+            if (shouldRetry && !shouldRetry(error)) {
+                throw error;
+            }
+            lastError = error;
+            await new Promise(resolve => setTimeout(resolve, interval));
+        }
+    }
+    // eslint-disable-next-line @typescript-eslint/no-throw-literal
+    throw lastError;
+}

package/build/credentials/ios/appstore/keychain.d.ts

@@ -0,0 +1,10 @@
+export declare const EXPO_NO_KEYCHAIN: string | undefined;
+interface Credentials {
+    serviceName: string;
+    username: string;
+    password: string;
+}
+export declare function deletePasswordAsync({ username, serviceName, }: Pick<Credentials, 'username' | 'serviceName'>): Promise<boolean>;
+export declare function getPasswordAsync({ username, serviceName, }: Pick<Credentials, 'serviceName' | 'username'>): Promise<string | null>;
+export declare function setPasswordAsync({ serviceName, username, password, }: Credentials): Promise<boolean>;
+export {};

package/build/credentials/ios/appstore/keychain.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXPO_NO_KEYCHAIN = void 0;
+exports.deletePasswordAsync = deletePasswordAsync;
+exports.getPasswordAsync = getPasswordAsync;
+exports.setPasswordAsync = setPasswordAsync;
+const tslib_1 = require("tslib");
+const keychain_1 = tslib_1.__importDefault(require("keychain"));
+const KEYCHAIN_TYPE = 'internet';
+const NO_PASSWORD_REGEX = /Could not find password/;
+const IS_MAC = process.platform === 'darwin';
+// When enabled, the password will not only be skipped but also deleted.
+// This makes it easier to completely opt-out of Keychain functionality.
+exports.EXPO_NO_KEYCHAIN = process.env['EXPO_NO_KEYCHAIN'];
+async function deletePasswordAsync({ username, serviceName, }) {
+    if (!IS_MAC) {
+        return await Promise.resolve(false);
+    }
+    return await new Promise((resolve, reject) => {
+        keychain_1.default.deletePassword({ account: username, service: serviceName, type: KEYCHAIN_TYPE }, (error) => {
+            if (error) {
+                if (error.message.match(NO_PASSWORD_REGEX)) {
+                    resolve(false);
+                    return;
+                }
+                reject(error);
+            }
+            else {
+                resolve(true);
+            }
+        });
+    });
+}
+async function getPasswordAsync({ username, serviceName, }) {
+    if (!IS_MAC) {
+        return null;
+    }
+    return await new Promise((resolve, reject) => {
+        keychain_1.default.getPassword({ account: username, service: serviceName, type: KEYCHAIN_TYPE }, (error, password) => {
+            if (error) {
+                if (error.message.match(NO_PASSWORD_REGEX)) {
+                    resolve(null);
+                    return;
+                }
+                reject(error);
+            }
+            else {
+                resolve(password);
+            }
+        });
+    });
+}
+async function setPasswordAsync({ serviceName, username, password, }) {
+    if (!IS_MAC) {
+        return await Promise.resolve(false);
+    }
+    return await new Promise((resolve, reject) => {
+        keychain_1.default.setPassword({ account: username, service: serviceName, password, type: KEYCHAIN_TYPE }, (error) => {
+            if (error) {
+                reject(error);
+            }
+            else {
+                resolve(true);
+            }
+        });
+    });
+}

package/build/credentials/ios/appstore/provisioningProfile.d.ts

@@ -0,0 +1,11 @@
+import { DistributionCertificate, ProvisioningProfile, ProvisioningProfileStoreInfo } from './Credentials.types';
+import { AuthCtx } from './authenticateTypes';
+import { ApplePlatform } from './constants';
+export declare enum ProfileClass {
+    Adhoc = "ad_hoc",
+    General = "general"
+}
+export declare function useExistingProvisioningProfileAsync(authCtx: AuthCtx, bundleIdentifier: string, provisioningProfile: ProvisioningProfile, distCert: DistributionCertificate): Promise<ProvisioningProfile>;
+export declare function listProvisioningProfilesAsync(authCtx: AuthCtx, bundleIdentifier: string, applePlatform: ApplePlatform, profileClass?: ProfileClass): Promise<ProvisioningProfileStoreInfo[]>;
+export declare function createProvisioningProfileAsync(authCtx: AuthCtx, bundleIdentifier: string, distCert: DistributionCertificate, profileName: string, applePlatform: ApplePlatform, profileClass?: ProfileClass): Promise<ProvisioningProfile>;
+export declare function revokeProvisioningProfileAsync(authCtx: AuthCtx, bundleIdentifier: string, applePlatform: ApplePlatform, profileClass?: ProfileClass): Promise<void>;

package/build/credentials/ios/appstore/provisioningProfile.js

@@ -0,0 +1,181 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProfileClass = void 0;
+exports.useExistingProvisioningProfileAsync = useExistingProvisioningProfileAsync;
+exports.listProvisioningProfilesAsync = listProvisioningProfilesAsync;
+exports.createProvisioningProfileAsync = createProvisioningProfileAsync;
+exports.revokeProvisioningProfileAsync = revokeProvisioningProfileAsync;
+const apple_utils_1 = require("@expo/apple-utils");
+const authenticate_1 = require("./authenticate");
+const bundleId_1 = require("./bundleId");
+const constants_1 = require("./constants");
+const distributionCertificate_1 = require("./distributionCertificate");
+const ora_1 = require("../../../ora");
+const authType_1 = require("../utils/authType");
+const p12Certificate_1 = require("../utils/p12Certificate");
+var ProfileClass;
+(function (ProfileClass) {
+    ProfileClass["Adhoc"] = "ad_hoc";
+    ProfileClass["General"] = "general";
+})(ProfileClass || (exports.ProfileClass = ProfileClass = {}));
+function resolveProfileType(applePlatform, profileClass, isEnterprise) {
+    switch (applePlatform) {
+        case constants_1.ApplePlatform.IOS:
+            return resolveProfileTypeIos(profileClass, isEnterprise);
+        case constants_1.ApplePlatform.TV_OS:
+            return resolveProfileTypeAppleTv(profileClass, isEnterprise);
+        case constants_1.ApplePlatform.VISION_OS:
+        case constants_1.ApplePlatform.MAC_OS:
+            throw new Error(`${applePlatform} profiles are not supported`);
+    }
+}
+function resolveProfileTypeAppleTv(profileClass, isEnterprise) {
+    if (isEnterprise) {
+        return profileClass === ProfileClass.Adhoc
+            ? apple_utils_1.ProfileType.TVOS_APP_ADHOC
+            : apple_utils_1.ProfileType.TVOS_APP_INHOUSE;
+    }
+    else {
+        return profileClass === ProfileClass.Adhoc
+            ? apple_utils_1.ProfileType.TVOS_APP_ADHOC
+            : apple_utils_1.ProfileType.TVOS_APP_STORE;
+    }
+}
+function resolveProfileTypeIos(profileClass, isEnterprise) {
+    if (isEnterprise) {
+        return profileClass === ProfileClass.Adhoc
+            ? apple_utils_1.ProfileType.IOS_APP_ADHOC
+            : apple_utils_1.ProfileType.IOS_APP_INHOUSE;
+    }
+    else {
+        return profileClass === ProfileClass.Adhoc
+            ? apple_utils_1.ProfileType.IOS_APP_ADHOC
+            : apple_utils_1.ProfileType.IOS_APP_STORE;
+    }
+}
+async function transformProfileAsync(cert, authCtx) {
+    return {
+        provisioningProfileId: cert.id,
+        name: cert.attributes.name,
+        status: cert.attributes.profileState,
+        expires: new Date(cert.attributes.expirationDate).getTime() / 1000,
+        distributionMethod: cert.attributes.profileType,
+        // @ts-expect-error -- this can be null when the profile has expired.
+        provisioningProfile: cert.attributes.profileContent,
+        certificates: (await cert.getCertificatesAsync()).map(distributionCertificate_1.transformCertificate),
+        teamId: authCtx.team.id,
+        teamName: authCtx.team.name,
+    };
+}
+async function addCertificateToProfileAsync(context, { serialNumber, profileId, bundleIdentifier, }) {
+    const cert = await (0, distributionCertificate_1.getCertificateBySerialNumberAsync)(context, serialNumber);
+    const profiles = await (0, bundleId_1.getProfilesForBundleIdAsync)(context, bundleIdentifier);
+    const profile = profiles.find(profile => profile.id === profileId);
+    if (!profile) {
+        throw new Error(`Failed to find profile for bundle identifier "${bundleIdentifier}" with profile id "${profileId}"`);
+    }
+    // Assign the new certificate
+    profile.attributes.certificates = [cert];
+    // Experimentally regenerate the provisioning profile using App Store Connect API.
+    if ((0, authType_1.isAppStoreConnectTokenOnlyContext)(profile.context)) {
+        return await profile.regenerateManuallyAsync();
+    }
+    // This method does not support App Store Connect API.
+    return await profile.regenerateAsync();
+}
+async function useExistingProvisioningProfileAsync(authCtx, bundleIdentifier, provisioningProfile, distCert) {
+    if (!provisioningProfile.provisioningProfileId) {
+        throw new Error('Provisioning profile: cannot use existing profile, insufficient id');
+    }
+    const certIdTag = distCert.certId ? ` (${distCert.certId})` : '';
+    const spinner = (0, ora_1.ora)(`Updating provisioning profile (${provisioningProfile.provisioningProfileId}) with distribution certificate${certIdTag}`).start();
+    try {
+        if (!distCert.distCertSerialNumber) {
+            distCert.distCertSerialNumber = (0, p12Certificate_1.findP12CertSerialNumber)(distCert.certP12, distCert.certPassword);
+        }
+        const context = (0, authenticate_1.getRequestContext)(authCtx);
+        const profile = await addCertificateToProfileAsync(context, {
+            serialNumber: distCert.distCertSerialNumber,
+            profileId: provisioningProfile.provisioningProfileId,
+            bundleIdentifier,
+        });
+        const content = profile.attributes.profileContent;
+        if (!content) {
+            // this should never happen because of the regen.
+            throw new Error(`Provisioning profile "${profile.attributes.name}" (${profile.id}) is expired!`);
+        }
+        const result = {
+            provisioningProfileId: profile.id,
+            provisioningProfile: content,
+            teamId: authCtx.team.id,
+            teamName: authCtx.team.name,
+        };
+        spinner.succeed(`Updated provisioning profile (${profile.id}) with distribution certificate${certIdTag}`);
+        return {
+            ...result,
+            teamId: authCtx.team.id,
+            teamName: authCtx.team.name,
+        };
+    }
+    catch (error) {
+        spinner.fail(`Failed to update provisioning profile (${provisioningProfile.provisioningProfileId}) with distribution certificate${certIdTag}`);
+        throw error;
+    }
+}
+async function listProvisioningProfilesAsync(authCtx, bundleIdentifier, applePlatform, profileClass = ProfileClass.General) {
+    const spinner = (0, ora_1.ora)(`Fetching Apple provisioning profiles`).start();
+    try {
+        const context = (0, authenticate_1.getRequestContext)(authCtx);
+        const profileType = resolveProfileType(applePlatform, profileClass, authCtx.team.inHouse);
+        const profiles = (await (0, bundleId_1.getProfilesForBundleIdAsync)(context, bundleIdentifier)).filter(profile => profile.attributes.profileType === profileType);
+        const result = await Promise.all(profiles.map(profile => transformProfileAsync(profile, authCtx)));
+        spinner.succeed(`Fetched Apple provisioning profiles`);
+        return result;
+    }
+    catch (error) {
+        spinner.fail(`Failed to fetch Apple provisioning profiles`);
+        throw error;
+    }
+}
+async function createProvisioningProfileAsync(authCtx, bundleIdentifier, distCert, profileName, applePlatform, profileClass = ProfileClass.General) {
+    const spinner = (0, ora_1.ora)(`Creating Apple provisioning profile`).start();
+    try {
+        if (!distCert.distCertSerialNumber) {
+            distCert.distCertSerialNumber = (0, p12Certificate_1.findP12CertSerialNumber)(distCert.certP12, distCert.certPassword);
+        }
+        const context = (0, authenticate_1.getRequestContext)(authCtx);
+        const profileType = resolveProfileType(applePlatform, profileClass, authCtx.team.inHouse);
+        const certificate = await (0, distributionCertificate_1.getCertificateBySerialNumberAsync)(context, distCert.distCertSerialNumber);
+        const bundleIdItem = await (0, bundleId_1.getBundleIdForIdentifierAsync)(context, bundleIdentifier);
+        const profile = await apple_utils_1.Profile.createAsync(context, {
+            bundleId: bundleIdItem.id,
+            name: profileName,
+            certificates: [certificate.id],
+            devices: [],
+            profileType,
+        });
+        const result = await transformProfileAsync(profile, authCtx);
+        spinner.succeed('Created Apple provisioning profile');
+        return result;
+    }
+    catch (error) {
+        spinner.fail('Failed to create Apple provisioning profile');
+        throw error;
+    }
+}
+async function revokeProvisioningProfileAsync(authCtx, bundleIdentifier, applePlatform, profileClass = ProfileClass.General) {
+    const spinner = (0, ora_1.ora)(`Revoking Apple provisioning profile`).start();
+    try {
+        const context = (0, authenticate_1.getRequestContext)(authCtx);
+        const profiles = await (0, bundleId_1.getProfilesForBundleIdAsync)(context, bundleIdentifier);
+        const profileType = resolveProfileType(applePlatform, profileClass, authCtx.team.inHouse);
+        await Promise.all(profiles
+            .filter(profile => profile.attributes.profileType === profileType)
+            .map(profile => apple_utils_1.Profile.deleteAsync(context, { id: profile.id })));
+        spinner.succeed('Revoked Apple provisioning profile');
+    }
+    catch (error) {
+        spinner.fail('Failed to revoke Apple provisioning profile');
+        throw error;
+    }
+}

package/build/credentials/ios/appstore/provisioningProfileAdhoc.d.ts

@@ -0,0 +1,4 @@
+import { ProfileType } from '@expo/apple-utils';
+import { ProvisioningProfile } from './Credentials.types';
+import { AuthCtx } from './authenticateTypes';
+export declare function createOrReuseAdhocProvisioningProfileAsync(authCtx: AuthCtx, udids: string[], bundleIdentifier: string, distCertSerialNumber: string, profileType: ProfileType): Promise<ProvisioningProfile>;

package/build/credentials/ios/appstore/provisioningProfileAdhoc.js

@@ -0,0 +1,192 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createOrReuseAdhocProvisioningProfileAsync = createOrReuseAdhocProvisioningProfileAsync;
+const apple_utils_1 = require("@expo/apple-utils");
+const authenticate_1 = require("./authenticate");
+const bundleId_1 = require("./bundleId");
+const distributionCertificate_1 = require("./distributionCertificate");
+const ora_1 = require("../../../ora");
+const authType_1 = require("../utils/authType");
+function uniqueItems(items) {
+    const set = new Set(items);
+    return [...set];
+}
+async function registerMissingDevicesAsync(context, udids) {
+    const allDevices = await apple_utils_1.Device.getAsync(context);
+    const alreadyAdded = allDevices.filter(device => udids.includes(device.attributes.udid));
+    const alreadyAddedUdids = alreadyAdded.map(i => i.attributes.udid);
+    await Promise.all(udids.map(async (udid) => {
+        if (!alreadyAddedUdids.includes(udid)) {
+            const device = await apple_utils_1.Device.createAsync(context, {
+                name: 'iOS Device (added by Expo)',
+                udid,
+            });
+            alreadyAdded.push(device);
+        }
+    }));
+    return alreadyAdded;
+}
+async function findProfileAsync(context, { bundleId, certSerialNumber, profileType, }) {
+    const expoProfiles = (await (0, bundleId_1.getProfilesForBundleIdAsync)(context, bundleId)).filter(profile => {
+        return (profile.attributes.profileType === profileType &&
+            profile.attributes.name.startsWith('*[expo]') &&
+            profile.attributes.profileState !== apple_utils_1.ProfileState.EXPIRED);
+    });
+    const expoProfilesWithCertificate = [];
+    // find profiles associated with our development cert
+    for (const profile of expoProfiles) {
+        const certificates = await profile.getCertificatesAsync();
+        if (certificates.some(cert => cert.attributes.serialNumber === certSerialNumber)) {
+            expoProfilesWithCertificate.push(profile);
+        }
+    }
+    if (expoProfilesWithCertificate) {
+        // there is an expo managed profile with our desired certificate
+        // return the profile that will be valid for the longest duration
+        return {
+            profile: expoProfilesWithCertificate.sort(sortByExpiration)[expoProfilesWithCertificate.length - 1],
+            didUpdate: false,
+        };
+    }
+    else if (expoProfiles) {
+        // there is an expo managed profile, but it doesn't have our desired certificate
+        // append the certificate and update the profile
+        const distributionCertificate = await (0, distributionCertificate_1.getDistributionCertificateAsync)(context, certSerialNumber);
+        if (!distributionCertificate) {
+            throw new Error(`Certificate for serial number "${certSerialNumber}" does not exist`);
+        }
+        const profile = expoProfiles.sort(sortByExpiration)[expoProfiles.length - 1];
+        profile.attributes.certificates = [distributionCertificate];
+        return {
+            profile: (0, authType_1.isAppStoreConnectTokenOnlyContext)(profile.context)
+                ? // Experimentally regenerate the provisioning profile using App Store Connect API.
+                    await profile.regenerateManuallyAsync()
+                : // This method does not support App Store Connect API.
+                    await profile.regenerateAsync(),
+            didUpdate: true,
+        };
+    }
+    // there is no valid provisioning profile available
+    return { profile: null, didUpdate: false };
+}
+function sortByExpiration(a, b) {
+    return (new Date(a.attributes.expirationDate).getTime() -
+        new Date(b.attributes.expirationDate).getTime());
+}
+async function findProfileByIdAsync(context, profileId, bundleId) {
+    let profiles = await (0, bundleId_1.getProfilesForBundleIdAsync)(context, bundleId);
+    profiles = profiles.filter(profile => profile.attributes.profileType === apple_utils_1.ProfileType.IOS_APP_ADHOC);
+    return profiles.find(profile => profile.id === profileId) ?? null;
+}
+async function manageAdHocProfilesAsync(context, { udids, bundleId, certSerialNumber, profileId, profileType, }) {
+    // We register all missing devices on the Apple Developer Portal. They are identified by UDIDs.
+    const devices = await registerMissingDevicesAsync(context, udids);
+    let existingProfile;
+    let didUpdate = false;
+    if (profileId) {
+        existingProfile = await findProfileByIdAsync(context, profileId, bundleId);
+        // Fail if we cannot find the profile that was specifically requested
+        if (!existingProfile) {
+            throw new Error(`Could not find profile with profile id "${profileId}" for bundle id "${bundleId}"`);
+        }
+    }
+    else {
+        // If no profile id is passed, try to find a suitable provisioning profile for the App ID.
+        const results = await findProfileAsync(context, { bundleId, certSerialNumber, profileType });
+        existingProfile = results.profile;
+        didUpdate = results.didUpdate;
+    }
+    if (existingProfile) {
+        // We need to verify whether the existing profile includes all user's devices.
+        let deviceUdidsInProfile = existingProfile?.attributes?.devices?.map?.(i => i.attributes.udid) ?? [];
+        deviceUdidsInProfile = uniqueItems(deviceUdidsInProfile.filter(Boolean));
+        const allDeviceUdids = uniqueItems(udids);
+        const hasEqualUdids = deviceUdidsInProfile.length === allDeviceUdids.length &&
+            deviceUdidsInProfile.every(udid => allDeviceUdids.includes(udid));
+        if (hasEqualUdids && existingProfile.isValid()) {
+            const result = {
+                profileName: existingProfile?.attributes?.name,
+                provisioningProfileId: existingProfile?.id,
+                provisioningProfile: existingProfile?.attributes.profileContent,
+            };
+            if (didUpdate) {
+                result.didUpdate = true;
+            }
+            return result;
+        }
+        // We need to add new devices to the list and create a new provisioning profile.
+        existingProfile.attributes.devices = devices;
+        if ((0, authType_1.isAppStoreConnectTokenOnlyContext)(existingProfile.context)) {
+            // Experimentally regenerate the provisioning profile using App Store Connect API.
+            await existingProfile.regenerateManuallyAsync();
+        }
+        else {
+            // This method does not support App Store Connect API.
+            await existingProfile.regenerateAsync();
+        }
+        const updatedProfile = (await findProfileAsync(context, { bundleId, certSerialNumber, profileType })).profile;
+        if (!updatedProfile) {
+            throw new Error(`Failed to locate updated profile for bundle identifier "${bundleId}" and serial number "${certSerialNumber}"`);
+        }
+        return {
+            didUpdate: true,
+            profileName: updatedProfile.attributes.name,
+            provisioningProfileId: updatedProfile.id,
+            provisioningProfile: updatedProfile.attributes.profileContent,
+        };
+    }
+    // No existing profile...
+    // We need to find user's distribution certificate to make a provisioning profile for it.
+    const distributionCertificate = await (0, distributionCertificate_1.getDistributionCertificateAsync)(context, certSerialNumber);
+    if (!distributionCertificate) {
+        // If the distribution certificate doesn't exist, the user must have deleted it, we can't do anything here :(
+        throw new Error(`No distribution certificate for serial number "${certSerialNumber}" is available to make a provisioning profile against`);
+    }
+    const bundleIdItem = await (0, bundleId_1.getBundleIdForIdentifierAsync)(context, bundleId);
+    // If the provisioning profile for the App ID doesn't exist, we just need to create a new one!
+    const newProfile = await apple_utils_1.Profile.createAsync(context, {
+        bundleId: bundleIdItem.id,
+        // apple drops [ if its the first char (!!),
+        name: `*[expo] ${bundleId} AdHoc ${Date.now()}`,
+        certificates: [distributionCertificate.id],
+        devices: devices.map(device => device.id),
+        profileType,
+    });
+    return {
+        didUpdate: true,
+        didCreate: true,
+        profileName: newProfile.attributes.name,
+        provisioningProfileId: newProfile.id,
+        provisioningProfile: newProfile.attributes.profileContent,
+    };
+}
+async function createOrReuseAdhocProvisioningProfileAsync(authCtx, udids, bundleIdentifier, distCertSerialNumber, profileType) {
+    const spinner = (0, ora_1.ora)(`Handling Apple ad hoc provisioning profiles`).start();
+    try {
+        const context = (0, authenticate_1.getRequestContext)(authCtx);
+        const { didUpdate, didCreate, profileName, ...adhocProvisioningProfile } = await manageAdHocProfilesAsync(context, {
+            udids,
+            bundleId: bundleIdentifier,
+            certSerialNumber: distCertSerialNumber,
+            profileType,
+        });
+        if (didCreate) {
+            spinner.succeed(`Created new profile: ${profileName}`);
+        }
+        else if (didUpdate) {
+            spinner.succeed(`Updated existing profile: ${profileName}`);
+        }
+        else {
+            spinner.succeed(`Used existing profile: ${profileName}`);
+        }
+        return {
+            ...adhocProvisioningProfile,
+            teamId: authCtx.team.id,
+            teamName: authCtx.team.name,
+        };
+    }
+    catch (error) {
+        spinner.fail(`Failed to handle Apple profiles`);
+        throw error;
+    }
+}

package/build/credentials/ios/appstore/pushKey.d.ts

@@ -0,0 +1,18 @@
+import { PushKey, PushKeyStoreInfo } from './Credentials.types';
+import { UserAuthCtx } from './authenticateTypes';
+export declare const APPLE_KEYS_TOO_MANY_GENERATED_ERROR: string;
+/**
+ * List all existing push keys on Apple servers.
+ * **Does not support App Store Connect API (CI).**
+ */
+export declare function listPushKeysAsync(userAuthCtx: UserAuthCtx): Promise<PushKeyStoreInfo[]>;
+/**
+ * Create a new push key on Apple servers.
+ * **Does not support App Store Connect API (CI).**
+ */
+export declare function createPushKeyAsync(userAuthCtx: UserAuthCtx, name?: string): Promise<PushKey>;
+/**
+ * Revoke an existing push key on Apple servers.
+ * **Does not support App Store Connect API (CI).**
+ */
+export declare function revokePushKeyAsync(userAuthCtx: UserAuthCtx, ids: string[]): Promise<void>;