@hot-updater/apple-helper 1.2.0-rc.6 → 1.2.0-rc.7

package/dist/index.cjs

@@ -551,6 +551,23 @@ const signInToAppStoreConnect = async ({ appleId, password, prompts, fetch = glo
 	}
 };
 //#endregion
+//#region src/asc/programLicenseAgreement.ts
+/**
+* What to do when Apple holds a team's requests until the Account Holder
+* accepts the latest Apple Developer Program License Agreement: App Store
+* Connect answers 403, and xcodebuild prints "PLA Update available".
+*/
+const PROGRAM_LICENSE_AGREEMENT_HINT = ["The Account Holder must accept the latest Program License Agreement:", "https://developer.apple.com/account"].join("\n");
+/** The code App Store Connect answers a team with a pending agreement. */
+const AGREEMENT_ERROR_CODE = "FORBIDDEN.REQUIRED_AGREEMENTS_MISSING_OR_EXPIRED";
+/**
+* Whether App Store Connect's JSON:API errors say the team has a Program
+* License Agreement to accept, by its code or its detail.
+*/
+const isProgramLicenseAgreementError = (errors) => errors.some(({ code, detail, title }) => code === AGREEMENT_ERROR_CODE || /Program License Agreement/iu.test(`${detail ?? ""} ${title ?? ""}`));
+/** Whether xcodebuild's output says the team has an agreement to accept. */
+const mentionsProgramLicenseAgreement = (output) => output.includes("PLA Update available");
+//#endregion
 //#region src/asc/ascKeyIssuer.ts
 const IRIS_URL = "https://appstoreconnect.apple.com/iris/v1";
 /**
@@ -603,7 +620,7 @@ const irisDetail = (body) => {
 };
 /** What to do about a key App Store Connect would not create. */
 const createFailureHint = (status, body) => {
-	if (/agreement/iu.test(body)) return "The Account Holder must accept the new Apple Developer Program License\nAgreement at https://developer.apple.com/account, then run this again.";
+	if (/agreement/iu.test(body)) return PROGRAM_LICENSE_AGREEMENT_HINT;
 	if (/limit|maximum/iu.test(body)) return `The team has the most API keys App Store Connect allows. Revoke one at:\n${ASC_INTEGRATIONS_URL}`;
 	if (status === 403 || /account holder|admin|permission/iu.test(body)) return "Creating an API key needs the Account Holder or Admin role in the team.";
 };
@@ -1019,7 +1036,7 @@ const parseXcodeProjectInfo = async (sourceDir) => {
 const prettifyXcodebuildError = (error) => {
 	if (error instanceof _hot_updater_cli_tools.BuildFailedError) {
 		const errorLines = error.summary.join("\n");
-		const message = errorLines.includes("error: No profiles for") || errorLines.includes("error: Provisioning profile") ? "No valid provisioning profile is set in the project.\nCheck the Signing & Capabilities tab in Xcode." : error.message;
+		const message = mentionsProgramLicenseAgreement(errorLines) ? PROGRAM_LICENSE_AGREEMENT_HINT : errorLines.includes("error: No profiles for") || errorLines.includes("error: Provisioning profile") ? "No valid provisioning profile is set in the project.\nCheck the Signing & Capabilities tab in Xcode." : error.message;
 		return new _hot_updater_cli_tools.BuildFailedError(message, {
 			logPath: error.logPath,
 			summary: error.summary,
@@ -1917,7 +1934,7 @@ const createAppStoreConnectRequest = ({ apiKey, privateKey, fetch }) => {
 		if (!response.ok) {
 			const error = new AppStoreConnectError(action, response.status, await readApiErrors(response), response.headers.get("retry-after"));
 			if (response.status === 401) throw new Error("App Store Connect refused the API key.\nCheck its key ID and issuer ID, and that it isn't revoked.", { cause: error });
-			if (response.status === 403) throw new Error(`${error.message}\nUploads need a key with the Admin, App Manager, or Developer role.`, { cause: error });
+			if (response.status === 403) throw new Error(isProgramLicenseAgreementError(error.errors) ? `${action} failed (HTTP 403).\n${PROGRAM_LICENSE_AGREEMENT_HINT}` : `${error.message}\nUploads need a key with the Admin, App Manager, or Developer role.`, { cause: error });
 			throw error;
 		}
 		return response.status === 204 ? void 0 : await response.json();
@@ -2356,38 +2373,62 @@ const createSigningKeychain = async ({ security = runSecurity, directory = os.de
 	return {
 		path: keychainPath,
 		certificates: async () => {
+			const identities = new Set([...(await security([
+				"find-identity",
+				"-p",
+				"codesigning",
+				keychainPath
+			])).matchAll(/^\s*\d+\)\s+([0-9A-F]{40})\s/gm)].map((match) => match[1]));
+			if (identities.size === 0) return [];
 			return ((await security([
 				"find-certificate",
 				"-a",
 				"-p",
 				keychainPath
-			])).match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g) ?? []).map((pem) => {
+			])).match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g) ?? []).flatMap((pem) => {
 				const certificate = new crypto.default.X509Certificate(pem);
-				return {
+				if (!identities.has(certificate.fingerprint.replaceAll(":", ""))) return [];
+				return [{
 					serialNumber: normalizeSerial(certificate.serialNumber),
 					commonName: certificate.subject.match(/^CN=(.*)$/m)?.[1] ?? certificate.subject
-				};
+				}];
 			});
 		},
 		dispose
 	};
 };
+/** A request App Store Connect refused, in one line. */
+var AppStoreConnectRefusal = class extends Error {
+	/** Whether the team has a Program License Agreement to accept. */
+	agreement;
+	constructor(message, agreement) {
+		super(message);
+		this.agreement = agreement;
+	}
+};
+const refusal = async (action, response) => {
+	const body = await response.json().catch(() => void 0);
+	return new AppStoreConnectRefusal(`${action} failed (HTTP ${response.status}).`, isProgramLicenseAgreementError(Array.isArray(body?.errors) ? body.errors : []));
+};
 /**
 * Revokes the certificates Xcode created in the build's keychain, whose
 * private keys the keychain's deletion destroys: on a runner that starts
 * empty, Xcode creates a development certificate for every build, and App
 * Store Connect refuses new ones once a team has its maximum. Each is found
 * in the team's certificates by serial number. A revocation that fails is
-* reported with where to revoke it by hand, and never fails the build.
+* reported with each certificate's name and serial and where to revoke it
+* by hand, and never fails the build.
 */
 const revokeKeychainCertificates = async ({ certificates, apiKey, privateKey, fetch = globalThis.fetch }) => {
 	const revoked = [];
 	const failed = [];
+	/** Why none could be revoked: the token or the listing failed. */
+	let reason;
+	let agreement = false;
 	if (certificates.length === 0) return {
-		revoked,
-		failed
+		revoked: [],
+		failed: []
 	};
-	const describe = ({ commonName, serialNumber }) => `${commonName} (serial ${serialNumber})`;
 	try {
 		const token = createAppStoreConnectToken({
 			privateKey: privateKey ?? crypto.default.createPrivateKey(await fs.default.promises.readFile(apiKey.keyPath, "utf-8")),
@@ -2403,7 +2444,7 @@ const revokeKeychainCertificates = async ({ certificates, apiKey, privateKey, fe
 		})}`;
 		while (next) {
 			const response = await fetch(next, { headers });
-			if (!response.ok) throw new Error(`Listing the team's certificates failed (HTTP ${response.status}).`);
+			if (!response.ok) throw await refusal("Listing the team's certificates", response);
 			const body = await response.json();
 			for (const { id, attributes } of body.data ?? []) if (attributes?.serialNumber) idsBySerial.set(normalizeSerial(attributes.serialNumber), id);
 			next = body.links?.next;
@@ -2415,23 +2456,32 @@ const revokeKeychainCertificates = async ({ certificates, apiKey, privateKey, fe
 				method: "DELETE",
 				headers
 			});
-			if (response.ok || response.status === 404) revoked.push(describe(certificate));
-			else failed.push(`${describe(certificate)}: HTTP ${response.status}`);
+			if (response.ok || response.status === 404) revoked.push(certificate);
+			else {
+				agreement ||= (await refusal("Revoking", response)).agreement;
+				failed.push({
+					certificate,
+					status: response.status
+				});
+			}
 		}
 	} catch (error) {
-		const reason = error instanceof Error ? error.message : String(error);
-		for (const certificate of certificates) if (!revoked.includes(describe(certificate))) failed.push(`${describe(certificate)}: ${reason}`);
+		reason = error instanceof Error ? error.message : String(error);
+		agreement ||= error instanceof AppStoreConnectRefusal && error.agreement;
+		for (const certificate of certificates) if (!revoked.includes(certificate)) failed.push({ certificate });
 	}
-	if (revoked.length > 0) _hot_updater_cli_tools.p.log.info(["Revoked the certificates Xcode created for this build:", ...revoked].join("\n"));
+	const describe = ({ commonName, serialNumber }) => `${commonName} (serial ${serialNumber})`;
+	if (revoked.length > 0) _hot_updater_cli_tools.p.log.info(["Revoked the certificates Xcode created for this build:", ...revoked.flatMap(({ commonName, serialNumber }) => [commonName, `Serial ${serialNumber}`])].join("\n"));
 	if (failed.length > 0) _hot_updater_cli_tools.p.log.warn([
 		"Couldn't revoke the certificates Xcode created for this build.",
-		...failed,
-		"Revoke them at:",
+		...reason === void 0 ? [] : [reason],
+		...agreement ? [PROGRAM_LICENSE_AGREEMENT_HINT] : [],
+		...failed.flatMap(({ certificate, status }) => [certificate.commonName, `Serial ${certificate.serialNumber}${status === void 0 ? "" : ` (HTTP ${status})`}`]),
 		CERTIFICATES_URL
 	].join("\n"));
 	return {
-		revoked,
-		failed
+		revoked: revoked.map(describe),
+		failed: failed.map(({ certificate }) => describe(certificate))
 	};
 };
 const TERMINATION_SIGNALS = [

package/dist/index.mjs

@@ -523,6 +523,23 @@ const signInToAppStoreConnect = async ({ appleId, password, prompts, fetch = glo
 	}
 };
 //#endregion
+//#region src/asc/programLicenseAgreement.ts
+/**
+* What to do when Apple holds a team's requests until the Account Holder
+* accepts the latest Apple Developer Program License Agreement: App Store
+* Connect answers 403, and xcodebuild prints "PLA Update available".
+*/
+const PROGRAM_LICENSE_AGREEMENT_HINT = ["The Account Holder must accept the latest Program License Agreement:", "https://developer.apple.com/account"].join("\n");
+/** The code App Store Connect answers a team with a pending agreement. */
+const AGREEMENT_ERROR_CODE = "FORBIDDEN.REQUIRED_AGREEMENTS_MISSING_OR_EXPIRED";
+/**
+* Whether App Store Connect's JSON:API errors say the team has a Program
+* License Agreement to accept, by its code or its detail.
+*/
+const isProgramLicenseAgreementError = (errors) => errors.some(({ code, detail, title }) => code === AGREEMENT_ERROR_CODE || /Program License Agreement/iu.test(`${detail ?? ""} ${title ?? ""}`));
+/** Whether xcodebuild's output says the team has an agreement to accept. */
+const mentionsProgramLicenseAgreement = (output) => output.includes("PLA Update available");
+//#endregion
 //#region src/asc/ascKeyIssuer.ts
 const IRIS_URL = "https://appstoreconnect.apple.com/iris/v1";
 /**
@@ -575,7 +592,7 @@ const irisDetail = (body) => {
 };
 /** What to do about a key App Store Connect would not create. */
 const createFailureHint = (status, body) => {
-	if (/agreement/iu.test(body)) return "The Account Holder must accept the new Apple Developer Program License\nAgreement at https://developer.apple.com/account, then run this again.";
+	if (/agreement/iu.test(body)) return PROGRAM_LICENSE_AGREEMENT_HINT;
 	if (/limit|maximum/iu.test(body)) return `The team has the most API keys App Store Connect allows. Revoke one at:\n${ASC_INTEGRATIONS_URL}`;
 	if (status === 403 || /account holder|admin|permission/iu.test(body)) return "Creating an API key needs the Account Holder or Admin role in the team.";
 };
@@ -991,7 +1008,7 @@ const parseXcodeProjectInfo = async (sourceDir) => {
 const prettifyXcodebuildError = (error) => {
 	if (error instanceof BuildFailedError) {
 		const errorLines = error.summary.join("\n");
-		const message = errorLines.includes("error: No profiles for") || errorLines.includes("error: Provisioning profile") ? "No valid provisioning profile is set in the project.\nCheck the Signing & Capabilities tab in Xcode." : error.message;
+		const message = mentionsProgramLicenseAgreement(errorLines) ? PROGRAM_LICENSE_AGREEMENT_HINT : errorLines.includes("error: No profiles for") || errorLines.includes("error: Provisioning profile") ? "No valid provisioning profile is set in the project.\nCheck the Signing & Capabilities tab in Xcode." : error.message;
 		return new BuildFailedError(message, {
 			logPath: error.logPath,
 			summary: error.summary,
@@ -1889,7 +1906,7 @@ const createAppStoreConnectRequest = ({ apiKey, privateKey, fetch }) => {
 		if (!response.ok) {
 			const error = new AppStoreConnectError(action, response.status, await readApiErrors(response), response.headers.get("retry-after"));
 			if (response.status === 401) throw new Error("App Store Connect refused the API key.\nCheck its key ID and issuer ID, and that it isn't revoked.", { cause: error });
-			if (response.status === 403) throw new Error(`${error.message}\nUploads need a key with the Admin, App Manager, or Developer role.`, { cause: error });
+			if (response.status === 403) throw new Error(isProgramLicenseAgreementError(error.errors) ? `${action} failed (HTTP 403).\n${PROGRAM_LICENSE_AGREEMENT_HINT}` : `${error.message}\nUploads need a key with the Admin, App Manager, or Developer role.`, { cause: error });
 			throw error;
 		}
 		return response.status === 204 ? void 0 : await response.json();
@@ -2328,38 +2345,62 @@ const createSigningKeychain = async ({ security = runSecurity, directory = os.tm
 	return {
 		path: keychainPath,
 		certificates: async () => {
+			const identities = new Set([...(await security([
+				"find-identity",
+				"-p",
+				"codesigning",
+				keychainPath
+			])).matchAll(/^\s*\d+\)\s+([0-9A-F]{40})\s/gm)].map((match) => match[1]));
+			if (identities.size === 0) return [];
 			return ((await security([
 				"find-certificate",
 				"-a",
 				"-p",
 				keychainPath
-			])).match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g) ?? []).map((pem) => {
+			])).match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g) ?? []).flatMap((pem) => {
 				const certificate = new crypto$1.X509Certificate(pem);
-				return {
+				if (!identities.has(certificate.fingerprint.replaceAll(":", ""))) return [];
+				return [{
 					serialNumber: normalizeSerial(certificate.serialNumber),
 					commonName: certificate.subject.match(/^CN=(.*)$/m)?.[1] ?? certificate.subject
-				};
+				}];
 			});
 		},
 		dispose
 	};
 };
+/** A request App Store Connect refused, in one line. */
+var AppStoreConnectRefusal = class extends Error {
+	/** Whether the team has a Program License Agreement to accept. */
+	agreement;
+	constructor(message, agreement) {
+		super(message);
+		this.agreement = agreement;
+	}
+};
+const refusal = async (action, response) => {
+	const body = await response.json().catch(() => void 0);
+	return new AppStoreConnectRefusal(`${action} failed (HTTP ${response.status}).`, isProgramLicenseAgreementError(Array.isArray(body?.errors) ? body.errors : []));
+};
 /**
 * Revokes the certificates Xcode created in the build's keychain, whose
 * private keys the keychain's deletion destroys: on a runner that starts
 * empty, Xcode creates a development certificate for every build, and App
 * Store Connect refuses new ones once a team has its maximum. Each is found
 * in the team's certificates by serial number. A revocation that fails is
-* reported with where to revoke it by hand, and never fails the build.
+* reported with each certificate's name and serial and where to revoke it
+* by hand, and never fails the build.
 */
 const revokeKeychainCertificates = async ({ certificates, apiKey, privateKey, fetch = globalThis.fetch }) => {
 	const revoked = [];
 	const failed = [];
+	/** Why none could be revoked: the token or the listing failed. */
+	let reason;
+	let agreement = false;
 	if (certificates.length === 0) return {
-		revoked,
-		failed
+		revoked: [],
+		failed: []
 	};
-	const describe = ({ commonName, serialNumber }) => `${commonName} (serial ${serialNumber})`;
 	try {
 		const token = createAppStoreConnectToken({
 			privateKey: privateKey ?? crypto$1.createPrivateKey(await fs.promises.readFile(apiKey.keyPath, "utf-8")),
@@ -2375,7 +2416,7 @@ const revokeKeychainCertificates = async ({ certificates, apiKey, privateKey, fe
 		})}`;
 		while (next) {
 			const response = await fetch(next, { headers });
-			if (!response.ok) throw new Error(`Listing the team's certificates failed (HTTP ${response.status}).`);
+			if (!response.ok) throw await refusal("Listing the team's certificates", response);
 			const body = await response.json();
 			for (const { id, attributes } of body.data ?? []) if (attributes?.serialNumber) idsBySerial.set(normalizeSerial(attributes.serialNumber), id);
 			next = body.links?.next;
@@ -2387,23 +2428,32 @@ const revokeKeychainCertificates = async ({ certificates, apiKey, privateKey, fe
 				method: "DELETE",
 				headers
 			});
-			if (response.ok || response.status === 404) revoked.push(describe(certificate));
-			else failed.push(`${describe(certificate)}: HTTP ${response.status}`);
+			if (response.ok || response.status === 404) revoked.push(certificate);
+			else {
+				agreement ||= (await refusal("Revoking", response)).agreement;
+				failed.push({
+					certificate,
+					status: response.status
+				});
+			}
 		}
 	} catch (error) {
-		const reason = error instanceof Error ? error.message : String(error);
-		for (const certificate of certificates) if (!revoked.includes(describe(certificate))) failed.push(`${describe(certificate)}: ${reason}`);
+		reason = error instanceof Error ? error.message : String(error);
+		agreement ||= error instanceof AppStoreConnectRefusal && error.agreement;
+		for (const certificate of certificates) if (!revoked.includes(certificate)) failed.push({ certificate });
 	}
-	if (revoked.length > 0) p.log.info(["Revoked the certificates Xcode created for this build:", ...revoked].join("\n"));
+	const describe = ({ commonName, serialNumber }) => `${commonName} (serial ${serialNumber})`;
+	if (revoked.length > 0) p.log.info(["Revoked the certificates Xcode created for this build:", ...revoked.flatMap(({ commonName, serialNumber }) => [commonName, `Serial ${serialNumber}`])].join("\n"));
 	if (failed.length > 0) p.log.warn([
 		"Couldn't revoke the certificates Xcode created for this build.",
-		...failed,
-		"Revoke them at:",
+		...reason === void 0 ? [] : [reason],
+		...agreement ? [PROGRAM_LICENSE_AGREEMENT_HINT] : [],
+		...failed.flatMap(({ certificate, status }) => [certificate.commonName, `Serial ${certificate.serialNumber}${status === void 0 ? "" : ` (HTTP ${status})`}`]),
 		CERTIFICATES_URL
 	].join("\n"));
 	return {
-		revoked,
-		failed
+		revoked: revoked.map(describe),
+		failed: failed.map(({ certificate }) => describe(certificate))
 	};
 };
 const TERMINATION_SIGNALS = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hot-updater/apple-helper",
-  "version": "1.2.0-rc.6",
+  "version": "1.2.0-rc.7",
   "type": "module",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -29,8 +29,8 @@
   "dependencies": {
     "execa": "9.5.2",
     "fast-xml-parser": "5.8.0",
-    "@hot-updater/cli-tools": "1.2.0-rc.6",
-    "@hot-updater/plugin-core": "1.2.0-rc.6"
+    "@hot-updater/cli-tools": "1.2.0-rc.7",
+    "@hot-updater/plugin-core": "1.2.0-rc.7"
   },
   "devDependencies": {
     "@types/node": "^20"