@imagina-build/ias-cli 0.2.1 → 0.3.0

package/src/commands/credentials/apple.mjs

@@ -0,0 +1,1118 @@
+// ias credentials generate ios, apple_distribution_certificate and apple_provisioning_profile (docs/plans/gaps/01-certificado-ios.md
+// and 02-perfil-app-store.md): the iOS signing material, made on this Mac because the server never sees a private key.
+// The App Store Connect key of the vault is opened in memory here, the RSA-2048 key and the CSR are made here, and only
+// the CSR travels to Apple; the certificate Apple answers comes back as the .p12 of one identity (inspectP12), is sealed
+// in ias-vault-2 for the recovery key and the signed runners, and the App Store profile of the bundle id is made or
+// reused with it. Order matters:
+//   1. read the vault's certificates and profiles and Apple's, and show the inventory before touching anything;
+//   2. reuse the certificate whose private key is in the vault and Apple still lists, unless --rotate or it expires
+//      within --if-expiring days; several usable ones need --certificate, never a silent pick;
+//   3. make the certificate (POST /v1/certificates), keep a recovery copy in 1Password and seal it in the vault first, so
+//      a failure later leaves it usable and the next run only makes what is missing;
+//   4. reuse a valid App Store profile of the bundle id that holds the certificate, or make one (IOS_APP_STORE, one
+//      certificate, no devices relationship at all) and seal it as the next version of the profile credential;
+//   5. nothing here revokes a certificate or deletes a profile: Apple's limit stops it and the message says so.
+// --dry-run makes no POST/DELETE, no 1Password item and no vault write. Nothing prints a password or a token.
+import { randomUUID } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { VERSION } from '../../cli.mjs';
+import { loadProject, readExpo } from '../../config.mjs';
+import { ApiError, IasError } from '../../errors.mjs';
+import { applicationOf, connect, openUrl, sleep, waitForApproval } from '../../manage.mjs';
+import { createItem, itemOf, readField, setAttachment, setField } from '../../op.mjs';
+import { credentials as inspect } from '../../shared.mjs';
+import { signedRunners, vaultItem } from '../../team-vault.mjs';
+import { OPENSSL, appleSigningMaterial } from '../../apple/signing.mjs';
+import { capabilityPlan, currentCapabilities, missingCapabilities, portalUrl } from '../../apple/capabilities.mjs';
+import { certificateSummary, daysUntil, expiredAt, profileSummary } from '../../apple/inventory.mjs';
+import { ascClient } from '../devices/asc.mjs';
+import { openAscKey, sync } from '../devices/sync.mjs';
+import { confirm, teamKeys } from '../vault/team.mjs';
+import { expiryWarning, metadataOf, plaintextOf, sealCredential } from './seal.mjs';
+
+const PROFILE_TYPE = { 'app-store': 'IOS_APP_STORE', 'ad-hoc': 'IOS_APP_ADHOC' };
+
+/** The date Apple's name of a profile carries: 20261028-101500. */
+const stamp = (now = new Date()) => now.toISOString().replace(/[-:]/g, '').replace(/\..*$/, '').replace('T', '-');
+
+const latestExpiring = (list) => [...list].sort((a, b) => (Date.parse(b.expires_at ?? b.metadata?.expires ?? '9999') || 0) - (Date.parse(a.expires_at ?? a.metadata?.expires ?? '9999') || 0))[0] ?? null;
+
+const sameSha1 = (first, second) => String(first ?? '').toUpperCase() === String(second ?? '').toUpperCase();
+
+const sameUuid = (first, second) => String(first ?? '').toUpperCase() === String(second ?? '').toUpperCase();
+
+/** The old material of an approval of a certificate change, from the metadata of the stored one. */
+export function oldCertificate(metadata = {}) {
+  return {
+    ...(metadata.appleCertificateId ? { apple_certificate_id: metadata.appleCertificateId } : {}),
+    ...(metadata.serial ? { serial: metadata.serial } : {}),
+    sha1: String(metadata.sha1 ?? '').toUpperCase(),
+    ...(metadata.expires ? { expires: metadata.expires } : {}),
+  };
+}
+
+/** What the person compares with the panel before the passkey: the old certificate and the new material. */
+export function approvalLines({ what, old, team, material, applications }) {
+  return [
+    `${what}: certificate serial ${old.serial ?? '—'}, SHA-1 ${old.sha1}${old.expires ? `, until ${String(old.expires).slice(0, 10)}` : ''}`,
+    material ? `new material: ${material}` : 'no new certificate: the team is left without a distribution certificate',
+    `Apple team ${team}${applications.length > 0 ? `; applications affected: ${applications.join(', ')}` : ''}`,
+  ];
+}
+
+/**
+ * Asks an owner for the approval of a change of the team's certificate and waits for it: the passkey is the
+ * authorization the server keeps. A rejection or an expiry throws before the caller touches Apple, so nothing is
+ * deleted or replaced. Returns the id of the approval, which the PUT of the new material names.
+ */
+export async function approveCertificateChange(context, client, payload, lines) {
+  const { output } = context;
+  for (const line of lines) output.progress(`  · ${line}`);
+  const { status, data } = await client.request('POST', '/team/apple-certificates/authorize', { json: payload });
+  const approval = data?.approval ?? null;
+  if (status !== 202 || approval === null) throw new IasError('the server did not ask for an owner\'s approval of the certificate change', { fix: 'nothing was done in Apple: ias credentials show <id> checks the credential, then run it again', code: 'approval_missing' });
+  const opened = (context.openUrl ?? ((url) => openUrl(url, context.env)))(approval.url);
+  output.progress(`${opened ? 'Opened' : 'Open'} ${approval.url}: an owner compares the serial, the SHA-1 and the new material there and approves with a passkey (approval ${approval.id}, until ${approval.expires_at}).`);
+  await waitForApproval(client, approval, { wait: context.sleep ?? sleep, output });
+  output.progress('The owner approved the certificate change: the passkey is the authorization the server keeps.');
+  return approval.id;
+}
+
+/**
+ * The applications whose App Store profile holds `sha1`: the one of this app when its inventory says so, and the rest
+ * by the profile credentials the server has. Informative only, for the approval's summary.
+ */
+async function applicationsUsing(environment, sha1, inventory) {
+  const codes = new Set();
+  if ((inventory?.profiles ?? []).some((profile) => (profile.certificates ?? []).some((value) => sameSha1(value, sha1)))) codes.add(environment.code);
+  try {
+    const { data } = await environment.client.request('GET', '/apps');
+    for (const app of data.data ?? []) {
+      if (codes.has(app.code) || !app.ios?.bundle_id) continue;
+      const { data: found } = await environment.client.request('GET', `/apps/${encodeURIComponent(app.code)}/credentials`);
+      const holds = (found.data ?? []).some((credential) => !credential.retired_at && credential.type === 'apple_provisioning_profile' && (credential.metadata?.certificates ?? []).some((value) => sameSha1(value, sha1)));
+      if (holds) codes.add(app.code);
+    }
+  } catch (error) {
+    if (!(error instanceof ApiError) || error.status !== 404) throw error;
+  }
+  return [...codes];
+}
+
+/** `--type` of the profile, checked: app-store (default) or ad-hoc. */
+function profileTypeOf(values) {
+  const type = values.type ?? 'app-store';
+  if (!(type in PROFILE_TYPE)) throw new IasError(`«${type}» is not a profile type`, { fix: 'use --type app-store (the default) or --type ad-hoc (which runs ias devices sync)', code: 'profile_type_invalid' });
+  return type;
+}
+
+/** `--if-expiring`: the days within which the certificate is renewed (30 by default; 0 never). */
+function ifExpiringOf(values) {
+  if (values['if-expiring'] === undefined) return 30;
+  const days = Number(values['if-expiring']);
+  if (!Number.isInteger(days) || days < 0 || days > 3650) throw new IasError(`--if-expiring «${values['if-expiring']}» is not a number of days`, { fix: '0 to 3650; 30 by default, 0 never renews' });
+  return days;
+}
+
+const expired = (credential, now = Date.now()) => Boolean(credential.expires_at) && !(Date.parse(credential.expires_at) > now);
+
+/** The team's App Store Connect key: the newest one that is not retired nor expired. */
+function ascKeyOf(team) {
+  return team
+    .filter((credential) => credential.type === 'asc_api_key' && !credential.retired_at && !expired(credential))
+    .sort((a, b) => (b.updated_at ?? '').localeCompare(a.updated_at ?? ''))[0] ?? null;
+}
+
+/** The ad hoc profile is ias devices sync's: it owns the device list, and it shows and asks before writing. */
+function adHocProfile(context, project) {
+  for (const flag of ['profile', 'delete-previous', 'sync-capabilities']) {
+    if (context.values[flag] !== undefined) throw new IasError(`--${flag} is for the App Store profile`, { fix: 'the ad hoc profile and its devices are ias devices sync\'s: run it without that flag', code: 'option_not_supported' });
+  }
+  if (context.values['dry-run']) throw new IasError('--dry-run is not available for the ad hoc profile', { fix: 'ias devices sync prints the device list and asks before writing; run it to decide', code: 'dry_run_unsupported' });
+  context.output.progress('--type ad-hoc: the ad hoc profile and its devices are ias devices sync\'s job');
+  return sync(context, project);
+}
+
+/** Everything a command of this file reads: the app, the vault's keys and credentials, and the client of Apple. */
+async function appleEnvironment(context) {
+  const { env, output } = context;
+  const project = loadProject(resolve(context.cwd, context.values.project ?? '.'));
+  const client = connect(context, project);
+  const code = applicationOf(context, project);
+  const { data: app } = await client.request('GET', `/apps/${encodeURIComponent(code)}`);
+  const bundleId = String(context.values['bundle-id'] ?? app.ios?.bundle_id ?? '').trim();
+  if (!bundleId) throw new IasError(`${code} has no iOS bundle id`, { fix: 'set it in the panel (the application › Settings), or pass --bundle-id', code: 'application_without_ios' });
+  if (bundleId.includes('*')) throw new IasError(`«${bundleId}» is a wildcard App ID`, { fix: 'an App Store profile needs an explicit App ID: pass --bundle-id with the one of the app', code: 'bundle_id_wildcard' });
+
+  const item = vaultItem(context, project, client.server);
+  const { vault, keys, signingKey, recoveryKey } = await teamKeys(client, item, env, { recovery: true });
+  const team = (await client.request('GET', '/team/credentials')).data.data.filter((credential) => !credential.retired_at);
+  const own = (await client.request('GET', `/apps/${encodeURIComponent(code)}/credentials`)).data.data.filter((credential) => !credential.retired_at);
+  const ascKey = ascKeyOf(team);
+  if (!ascKey) {
+    throw new IasError('the vault has no App Store Connect API key', { fix: 'import the team\'s with ias credentials import asc_api_key --p8 <AuthKey_….p8> --key-id <id> --issuer-id <uuid>', code: 'credentials_missing' });
+  }
+  const { runners } = signedRunners(vault, keys.signing, output);
+  const key = await openAscKey(client, ascKey, { recoveryKey, keys });
+  return {
+    project,
+    client,
+    code,
+    app,
+    bundleId,
+    item,
+    vault,
+    keys,
+    signingKey,
+    team,
+    own,
+    ascKey,
+    key,
+    asc: ascClient(key, { env, fetch: context.fetch ?? fetch }),
+    teamId: String(context.values['team-id'] ?? app.ios?.team_id ?? ascKey.metadata?.teamId ?? '').trim() || null,
+    sealing: { recipients: [keys.recovery, ...runners], signingKey, keys },
+    base: `ias ${VERSION}`.slice(0, 64),
+    output,
+  };
+}
+
+/** Runs `work` with the environment and wipes the key however it ends. */
+async function withApple(context, work) {
+  const environment = await appleEnvironment(context);
+  try {
+    return await work(environment);
+  } finally {
+    environment.key.p8?.fill?.(0);
+  }
+}
+
+/** The distribution certificates of the team that the vault holds (the caller leaves retired ones out). */
+const vaultCertificates = (environment) =>
+  environment.team.filter((credential) => credential.type === 'apple_distribution_certificate' && credential.metadata?.kind === 'distribution' && (!environment.teamId || credential.metadata?.team === environment.teamId));
+
+/** What Apple has now, and the bundle id of the app: { bundle, certificates, profiles, bySha1, resources }. */
+async function inventoryOf(environment) {
+  const certificates = (await environment.asc.certificatesOfTeam()).map((certificate) => certificateSummary(certificate));
+  const bundle = await environment.asc.bundleId(environment.bundleId);
+  const resources = bundle ? await environment.asc.profilesOf(bundle.id) : [];
+  const profiles = resources.map((profile) => profileSummary(profile));
+  return { bundle, certificates, profiles, resources, profilesOf: new Map(resources.map((resource) => [String(resource.attributes?.uuid ?? '').toUpperCase(), resource])), bySha1: new Map(certificates.filter((entry) => entry.sha1).map((entry) => [entry.sha1, entry])) };
+}
+
+/** A vault certificate with what Apple says of it: { credential, sha1, apple, expires, problem }. */
+function vaultEntry(credential, inventory, now = Date.now()) {
+  const sha1 = String(credential.metadata?.sha1 ?? '').toUpperCase();
+  const apple = inventory.bySha1.get(sha1) ?? null;
+  const expires = credential.metadata?.expires ?? credential.expires_at ?? null;
+  let problem = null;
+  if (!apple) problem = 'Apple does not have it: it was revoked, or it is of another team';
+  else if (apple.status === 'inactive') problem = 'Apple does not have it active';
+  else if (apple.status === 'expired' || expiredAt(expires, now)) problem = `it expired on ${apple.expires ?? expires}`;
+  return { credential, sha1, apple, expires: apple?.expires ?? expires, problem };
+}
+
+/**
+ * Picks the certificate among the usable ones: --certificate (SHA-1, credential id or Apple's id) when there are
+ * several; the only one otherwise. Never the first of a list. Throws when --certificate names one that cannot be used.
+ */
+function selectCertificate(environment, inventory, { certificate, output }) {
+  const entries = vaultCertificates(environment).map((credential) => vaultEntry(credential, inventory));
+  if (certificate !== undefined) {
+    const wanted = String(certificate).trim();
+    const found = entries.find((entry) => entry.credential.id === wanted || sameSha1(entry.sha1, wanted) || entry.credential.metadata?.appleCertificateId === wanted || entry.apple?.id === wanted);
+    if (!found) {
+      throw new IasError(`there is no distribution certificate «${wanted}» in the vault of team ${environment.teamId ?? '—'} and in Apple`, {
+        fix: 'ias credentials list shows the team\'s certificates; ias credentials generate ios lists the ones Apple has and how to choose',
+        code: 'certificate_not_found',
+        details: { certificates: inventory.certificates },
+      });
+    }
+    if (!found.apple) throw new IasError(`the certificate ${found.sha1} of the vault is not in Apple any more: ${found.problem}`, { fix: 'make a new one with ias credentials generate ios --rotate, or import the current one with ias credentials import apple_distribution_certificate', code: 'certificate_not_in_apple', details: { certificate: found.sha1 } });
+    if (found.problem) throw new IasError(`the certificate ${found.sha1} cannot be used: ${found.problem}`, { fix: 'make a new one with ias credentials generate ios --rotate (revoking the current one needs the approval of gap 06)', code: 'certificate_unusable', details: { certificate: found.sha1 } });
+    return found;
+  }
+  const usable = entries.filter((entry) => !entry.problem);
+  if (usable.length > 1) {
+    for (const entry of usable) output.log(`  ${entry.sha1}  ${entry.credential.name}  serial ${entry.credential.metadata?.serial ?? '—'}  until ${entry.expires ?? '—'}  (credential ${entry.credential.id})`);
+    throw new IasError(`there are ${usable.length} usable distribution certificates of the team`, {
+      fix: 'choose one with --certificate <sha1|credential id>; ias never picks one of several for you',
+      code: 'certificate_ambiguous',
+      details: { certificates: usable.map((entry) => ({ id: entry.credential.id, sha1: entry.sha1, name: entry.credential.name, serial: entry.credential.metadata?.serial ?? null, expires: entry.expires })) },
+    });
+  }
+  return usable[0] ?? null;
+}
+
+/** The inventory for people: what Apple has, which of it the vault can sign with, and the state of each one. */
+function printInventory(environment, inventory, output) {
+  output.log(`${environment.app.name} (${environment.bundleId}), Apple team ${environment.teamId ?? '—'}`);
+  output.log(`  distribution certificates in Apple${inventory.certificates.length === 0 ? ': none' : ':'}`);
+  const vault = new Map(vaultCertificates(environment).map((credential) => [String(credential.metadata?.sha1 ?? '').toUpperCase(), credential]));
+  for (const certificate of inventory.certificates) {
+    const held = vault.get(certificate.sha1);
+    output.log(`    ${certificate.id}  ${certificate.name ?? '—'}  serial ${certificate.serial ?? '—'}  SHA-1 ${certificate.sha1 ?? '—'}  until ${certificate.expires?.slice(0, 10) ?? '—'}  ${certificate.type ?? '—'}  ${certificate.status}  ${held ? `in the vault (${held.id})` : 'no private key in the vault'}`);
+  }
+  for (const credential of vault.values()) {
+    if (!inventory.bySha1.has(String(credential.metadata?.sha1 ?? '').toUpperCase())) output.log(`    —  ${credential.name}  SHA-1 ${credential.metadata?.sha1 ?? '—'}  not in Apple any more  (credential ${credential.id})`);
+  }
+  output.log(`  profiles of ${environment.bundleId}${inventory.profiles.length === 0 ? ': none' : ':'}`);
+  for (const profile of inventory.profiles) {
+    output.log(`    ${profile.uuid ?? profile.id}  ${profile.name ?? '—'}  ${profile.type ?? '—'}  ${profile.state ?? '—'}  until ${profile.expires?.slice(0, 10) ?? '—'}  certificate ${profile.certificates.join(', ') || '—'}  ${profile.devices === null ? 'no content' : `${profile.devices} device${profile.devices === 1 ? '' : 's'}`}  ${profile.status}`);
+  }
+  if (!inventory.bundle) output.log(`  Apple has no App ID ${environment.bundleId}: register it with ias apps store ${environment.code} --register-bundle-id`);
+}
+
+/**
+ * The iOS entitlements of the project: app.json › expo › ios › entitlements, which is the source `ios.entitlements` names
+ * (packages/sdk writes them into the build). An app.config.* is code, so ias says it cannot read it instead of guessing.
+ */
+function projectEntitlements(environment) {
+  const { output, project } = environment;
+  const expo = readExpo(project.dir);
+  if (!expo) {
+    output.log(`no app.json in ${project.dir}: ias reads the iOS entitlements from app.json › expo › ios › entitlements, and an app.config.* is code it cannot read; nothing is synced`);
+    return null;
+  }
+  const entitlements = expo.ios?.entitlements;
+  if (!entitlements || typeof entitlements !== 'object' || Array.isArray(entitlements)) {
+    output.log('app.json has no expo.ios.entitlements: nothing to sync with the App ID capabilities');
+    return null;
+  }
+  return entitlements;
+}
+
+/**
+ * --sync-capabilities: enables in the App ID the capabilities the app's entitlements ask for and Apple lacks, one by one,
+ * and re-reads them. It never disables one. Apple invalidates every profile of the App ID when one changes, so the caller
+ * makes the App Store profile again and tells the person to run ias devices sync --force. A dry run enables nothing.
+ * Returns { requested, missing, enabled }; the unsupported entitlements stop it before any write, with the portal link.
+ */
+async function syncCapabilities(environment, inventory, context) {
+  if (context.values['sync-capabilities'] !== true) return { requested: [], missing: [], enabled: [] };
+  const { output } = environment;
+  const entitlements = projectEntitlements(environment);
+  if (!entitlements) return { requested: [], missing: [], enabled: [] };
+  const portal = portalUrl(inventory.bundle.id);
+  const plan = capabilityPlan(entitlements);
+  if (plan.unsupported.length > 0) {
+    const listed = plan.unsupported.map((entry) => `${entry.entitlement}: ${entry.why}`).join('; ');
+    throw new IasError(`capabilities of the App ID ${environment.bundleId} that the App Store Connect API does not enable: ${listed}`, {
+      fix: `enable them by hand for the App ID in Apple Developer › Identifiers (${portal}) and run it again; ias did not change the App ID`,
+      code: 'capability_unsupported',
+      details: { unsupported: plan.unsupported, portal },
+    });
+  }
+  const current = currentCapabilities(await environment.asc.bundleIdCapabilities(inventory.bundle.id));
+  const missing = missingCapabilities(plan.requested, current);
+  output.progress(`App ID ${inventory.bundle.id} of ${environment.bundleId}: ${current.size} capabilit${current.size === 1 ? 'y' : 'ies'}, ${missing.length === 0 ? 'nothing to enable' : `${missing.length} to enable (${missing.map((entry) => entry.capabilityType).join(', ')})`}`);
+  if (missing.length === 0) {
+    output.log('the App ID has every capability the entitlements of app.json ask for: nothing to sync');
+    return { requested: plan.requested, missing, enabled: [] };
+  }
+  if (context.values.profile !== undefined) {
+    throw new IasError('--profile reuses an App Store profile, and --sync-capabilities invalidates every profile of the App ID', { fix: 'leave --profile out so ias makes a new App Store profile after enabling the capabilities', code: 'profile_unusable' });
+  }
+  output.warn(`Enabling a capability invalidates EVERY provisioning profile of the App ID ${environment.bundleId}, including the ad hoc one that ias devices sync keeps: Apple asks for them to be made again.`);
+  for (const entry of missing) output.progress(`  enable ${entry.capabilityType}  (${entry.entitlements.join(', ')})`);
+  if (context.values['dry-run'] === true) {
+    output.progress('dry run: nothing was enabled in Apple');
+    return { requested: plan.requested, missing, enabled: [] };
+  }
+  await confirm(context, `Enable ${missing.length} capabilit${missing.length === 1 ? 'y' : 'ies'} in the App ID ${environment.bundleId} (every profile of it is invalidated)?`);
+  for (const entry of missing) {
+    try {
+      await environment.asc.enableCapability(inventory.bundle.id, entry.capabilityType);
+    } catch (error) {
+      if (!(error instanceof IasError) || error.code !== 'apple_api_error') throw error;
+      throw new IasError(`Apple did not enable ${entry.capabilityType}: ${error.message}`, {
+        fix: `nothing else was enabled: the App Store Connect key needs the Admin role (or App Manager with Certificates) and the account the capability; enable it by hand in ${portal}`,
+        code: 'capability_refused',
+        details: { capability: entry.capabilityType, portal, status: error.details?.status ?? null },
+      });
+    }
+    output.progress(`  enabled ${entry.capabilityType}`);
+  }
+  const after = currentCapabilities(await environment.asc.bundleIdCapabilities(inventory.bundle.id));
+  const left = missingCapabilities(plan.requested, after);
+  if (left.length > 0) {
+    throw new IasError(`Apple does not list ${left.map((entry) => entry.capabilityType).join(', ')} in the App ID after enabling it`, { fix: `check the App ID in ${portal}; the App Store profile was not made`, code: 'capability_refused', details: { capabilities: left.map((entry) => entry.capabilityType), portal } });
+  }
+  const enabled = missing.map((entry) => entry.capabilityType);
+  output.log(`enabled ${enabled.join(', ')} in the App ID ${inventory.bundle.id}: the App Store profile is made again with them`);
+  output.warn('every profile of the App ID is invalid now: run ias devices sync --force so the internal builds get a valid ad hoc profile');
+  return { requested: plan.requested, missing, enabled };
+}
+
+/** The report of --json, with the same keys with and without changes. Never a secret. */
+function reportOf(environment, { changed, dryRun = false, certificate = null, profile = null, inventory, action = 'none', next = undefined, capabilities = null }) {
+  return {
+    status: dryRun ? 'dry_run' : changed ? 'changed' : 'unchanged',
+    changed,
+    app: environment.code,
+    bundle_id: environment.bundleId,
+    team: environment.teamId,
+    action: changed || dryRun ? action : 'none',
+    certificate: certificate
+      ? {
+          source: certificate.source ?? null,
+          credential: certificate.credential?.id ?? null,
+          id: certificate.apple?.id ?? null,
+          sha1: certificate.sha1 ?? null,
+          serial: certificate.apple?.serial ?? certificate.metadata?.serial ?? null,
+          name: certificate.credential?.name ?? null,
+          expires: certificate.apple?.expires ?? certificate.metadata?.expires ?? null,
+        }
+      : null,
+    profile: profile
+      ? { action: profile.action ?? null, credential: profile.credential?.id ?? null, version: profile.credential?.version ?? null, uuid: profile.summary?.uuid ?? null, name: profile.summary?.name ?? null, expires: profile.summary?.expires ?? null, devices: profile.summary?.devices ?? null, previous: profile.previous ?? null }
+      : null,
+    ...(capabilities ? { capabilities: { enabled: capabilities.enabled ?? [], missing: (capabilities.missing ?? []).map((entry) => entry.capabilityType) } } : {}),
+    certificates: inventory.certificates,
+    profiles: inventory.profiles,
+    next: next ?? (changed ? 'ias build --platform ios --profile production' : null),
+  };
+}
+
+/** Whether Apple's refusal is its certificate limit, in the words it uses. */
+function limitReached(error) {
+  const text = (error.details?.errors ?? []).map((entry) => [entry.code, entry.title, entry.detail].filter(Boolean).join(' ')).join(' ');
+  return /already have|already exists|maximum|limit|too many|current .*certificate|pending certificate/i.test(text);
+}
+
+/** The body of POST /v1/certificates: PEM first (and base64 once if Apple refuses the text). No revocation, ever. */
+async function requestCertificate(environment, material, inventory) {
+  const csr = material.csrPem;
+  const map = (error) => {
+    if (error.code !== 'apple_api_error') return error;
+    const status = error.details?.status;
+    if (status === 403) return new IasError('the App Store Connect key cannot make certificates', { fix: 'the Team API key needs the Admin role in App Store Connect (or App Manager with Access to Certificates, Identifiers & Profiles); an Individual Key does not work for provisioning', code: 'asc_key_forbidden', details: error.details });
+    if (status === 401) return new IasError('App Store Connect did not take the key of the vault', { fix: 'import a valid team key with ias credentials import asc_api_key', code: 'asc_key_invalid' });
+    if (status === 409 || (status === 422 && limitReached(error))) {
+      return new IasError(`Apple did not make the certificate: the team already has one, or the limit is reached (${status})`, {
+        fix: 'ias did not revoke anything: look at the certificates above, revoke the one to replace in Apple Developer › Certificates, Identifiers & Profiles, and run this again',
+        code: 'certificate_limit_reached',
+        details: { certificates: inventory.certificates },
+      });
+    }
+    return new IasError(`Apple did not make the certificate: ${error.message}`, { fix: 'nothing was stored: check the role of the key and the CSR, and run it again', code: 'certificate_refused', details: error.details });
+  };
+  try {
+    return await environment.asc.createCertificate({ certificateType: 'DISTRIBUTION', csr });
+  } catch (first) {
+    if (first.code === 'apple_api_error' && first.details?.status === 422 && !limitReached(first) && !/^[A-Za-z0-9+/=\s]+$/.test(csr)) {
+      environment.output.warn('Apple did not take the CSR as PEM text: trying it in base64 once');
+      try {
+        const bytes = Buffer.from(csr.replace(/-----[^-]+-----/g, '').replace(/\s+/g, ''), 'base64');
+        return await environment.asc.createCertificate({ certificateType: 'DISTRIBUTION', csr: bytes.toString('base64') });
+      } catch (second) {
+        throw map(second);
+      }
+    }
+    throw map(first);
+  }
+}
+
+/** Keeps the .p12 and its password in 1Password; never replaces another item without --force. */
+function copyToOnePassword(context, item, material, done) {
+  const existing = readField(item, 'serial', context.env);
+  const fields = [
+    { label: 'p12-password', value: done.password, type: 'CONCEALED' },
+    { label: 'serial', value: done.metadata.serial, type: 'CONCEALED' },
+    { label: 'sha1', value: done.metadata.sha1, type: 'CONCEALED' },
+    { label: 'sha256', value: done.metadata.sha256, type: 'CONCEALED' },
+    { label: 'expires', value: done.metadata.expires, type: 'CONCEALED' },
+    { label: 'csr-sha256', value: material.csrSha256, type: 'CONCEALED' },
+    { label: 'team', value: done.metadata.team ?? '' },
+  ];
+  if (existing !== undefined) {
+    if (context.values.force !== true) throw new IasError(`${item} already has a certificate`, { fix: 'the old .p12 is the plan B if the new one fails: pass --item with another item, or --force to replace it' });
+    for (const field of fields) setField(item, field.label, field.value, context.env);
+    setAttachment(item, 'certificate.p12', done.p12, context.env);
+    return;
+  }
+  createItem(item, {
+    notes: `The distribution certificate ${done.metadata.commonName} (${done.metadata.team}) and its private key, made on this Mac by ias credentials generate. The .p12 is the attachment; the password is the concealed field. It is sealed in the IAS vault too; this item is the recovery copy.`,
+    fields,
+    attachments: [{ label: 'certificate.p12', path: done.p12 }],
+  }, context.env);
+}
+
+/**
+ * Makes the certificate: the CSR (already made) to Apple, the .p12 here, its recovery copy in 1Password, and the sealed
+ * credential of the team. Returns it as the server answers it, with what Apple said.
+ */
+async function makeCertificate(environment, material, inventory, context, { replaceWith = null, approval = null } = {}) {
+  const { output } = environment;
+  if (context.values.item) itemOf(context.values.item);
+  const issued = await requestCertificate(environment, material, inventory);
+  output.progress(`  Apple issued ${issued.id}: ${issued.attributes?.serialNumber ?? 'no serial'}, until ${String(issued.attributes?.expirationDate ?? '').slice(0, 10)}`);
+  let safe = false;
+  try {
+    const done = material.complete(issued.attributes?.certificateContent);
+    const metadata = {
+      ...done.metadata,
+      appleCertificateId: issued.id,
+      csrSha256: material.csrSha256,
+      generatedAt: new Date().toISOString(),
+      generatedBy: environment.base,
+    };
+    const item = context.values.item ?? `op://IAS/${environment.teamId ?? 'Apple'} Apple Distribution ${done.metadata.serial}`;
+    itemOf(item);
+    try {
+      copyToOnePassword(context, item, material, done);
+      safe = true;
+      output.progress(`  1Password: ${item} has the .p12 and its password (recovery copy)`);
+    } catch (error) {
+      output.warn(`no recovery copy in 1Password (${error.message}): the .p12 goes to the vault, which is the source of truth`);
+    }
+    // A rotation keeps the id of the credential and seals the next version: the owner's approval names that new
+    // material, and the server only takes the changed SHA-1 with it.
+    const id = replaceWith?.id ?? randomUUID();
+    const version = (replaceWith?.version ?? 0) + 1;
+    const plaintext = plaintextOf('apple_distribution_certificate', { fields: { p12: readFileSync(done.p12), password: done.password } }, metadata, environment.code);
+    const envelope = sealCredential(plaintext, { id, type: 'apple_distribution_certificate', version }, environment.sealing);
+    const { data: stored } = replaceWith
+      ? await environment.client.request('PUT', `/credentials/${id}`, { json: { metadata, envelope, ...(approval ? { approval } : {}) } })
+      : await environment.client.request('POST', '/team/credentials', { json: { id, type: 'apple_distribution_certificate', name: metadata.commonName ?? `Apple certificate ${metadata.serial}`, metadata, envelope } });
+    safe = true;
+    output.log(`${replaceWith ? 'replaced' : 'stored'} «${stored.name}» (${stored.id}) version ${stored.version}, sealed for ${envelope.recipients.length} key${envelope.recipients.length === 1 ? '' : 's'}`);
+    expiryWarning(`«${stored.name}»`, metadata, output);
+    return { source: 'generated', credential: stored, apple: certificateSummary(issued), metadata, sha1: metadata.sha1 };
+  } catch (error) {
+    if (!safe) {
+      // Apple has the certificate: deleting the key now would leave it unusable and counting against the limit.
+      const kept = material.preserve();
+      output.warn(`the certificate ${issued.id} is in Apple but nothing stored its key: the key and the CSR stay in ${kept} (0700, 0600); its CSR SHA-256 is ${material.csrSha256}`);
+      if (material.password) output.warn(`if the .p12 was made, its password is in ${join(kept, 'password')}: seal it with ias credentials import apple_distribution_certificate --p12 ${join(kept, 'certificate.p12')} --password - < ${join(kept, 'password')}`);
+    }
+    throw error;
+  }
+}
+
+/** The app's App Store profile credential to replace, if any: the one of this bundle that expires last. */
+const storeProfileCredential = (environment) =>
+  latestExpiring(environment.own.filter((credential) => credential.type === 'apple_provisioning_profile' && credential.metadata?.type === 'app-store' && credential.metadata?.bundleId === environment.bundleId));
+
+/** The App Store profiles Apple lists for the bundle id: the ones that --profile may name. */
+const storeProfiles = (environment, inventory) =>
+  inventory.profiles.filter((profile) => profile.type === 'app-store' && (!profile.bundleId || profile.bundleId === environment.bundleId));
+
+/** A profile of the inventory in one line: UUID, name, type, state, expiry, certificate, bundle id and devices. */
+export function profileLine(profile) {
+  const devices = profile.devices === null || profile.devices === undefined ? 'no content' : `${profile.devices} device${profile.devices === 1 ? '' : 's'}`;
+  return `${profile.uuid ?? profile.id ?? '—'}  «${profile.name ?? '—'}»  ${profile.type ?? '—'}  ${profile.state ?? '—'}  until ${String(profile.expires ?? '—').slice(0, 10)}  certificate ${(profile.certificates ?? []).join(', ') || '—'}  ${profile.bundleId ?? '—'}  ${devices}  ${profile.status}`;
+}
+
+/**
+ * Why the App Store profile `profile` cannot be used with `certificate`, or null when it can: its type, bundle id, state,
+ * expiry, devices and the certificate it holds. The fix names the exact option or command.
+ */
+function storeProfileProblem(environment, certificate, profile, now = Date.now()) {
+  const held = (profile.certificates ?? []).map((value) => String(value).toUpperCase());
+  if (profile.type !== 'app-store') {
+    return { problem: `it is ${profile.type ? `a ${profile.type}` : 'an unknown type of'} profile, not an App Store one`, fix: 'an ad-hoc or development profile lists devices: leave --profile out so ias makes the App Store one, and keep ias devices sync for the ad hoc' };
+  }
+  if (profile.bundleId && profile.bundleId !== environment.bundleId) {
+    return { problem: `it is for ${profile.bundleId}, not ${environment.bundleId}`, fix: 'choose a profile of this bundle id: ias credentials generate apple_provisioning_profile --bundle-id <id> works on another one' };
+  }
+  if (profile.state && profile.state !== 'ACTIVE') {
+    return { problem: `Apple has it ${profile.state}`, fix: `its App ID changed (capabilities or identifiers) and Apple invalidated it: leave --profile out so ias makes a new one${profile.state === 'INVALID' ? '; if an entitlement is behind it, run it with --sync-capabilities' : ''}` };
+  }
+  if (expiredAt(profile.expires, now)) {
+    return { problem: `it expired on ${String(profile.expires).slice(0, 10)}`, fix: 'leave --profile out so ias makes a new one with the certificate of the vault' };
+  }
+  if (profile.devices !== null && profile.devices !== undefined && profile.devices !== 0) {
+    return { problem: `it lists ${profile.devices} device${profile.devices === 1 ? '' : 's'}`, fix: 'an App Store profile lists none: leave --profile out so ias makes the right one, and ias devices sync keeps the ad hoc profile' };
+  }
+  if (held.length > 0 && !held.includes(certificate.sha1)) {
+    return { problem: `it holds the certificate ${held.join(', ')}, not ${certificate.sha1}`, fix: `reuse it with the certificate it holds (--certificate ${held[0]}) if that one is in the vault, or leave --profile out so ias makes a new profile with ${certificate.sha1}` };
+  }
+  return null;
+}
+
+/**
+ * What to do with the App Store profile: unchanged (Apple's and the vault's are the same), seal (reuse Apple's) or create.
+ * `--profile` (a UUID or an exact name) chooses one and validates it; without it, several usable profiles are an error
+ * and never a silent pick, and one usable one is reused as always. `invalidated` leaves every profile of the App ID out,
+ * because the capabilities are about to change and Apple invalidates them all.
+ */
+function profileDecision(environment, certificate, inventory, { profile, invalidated = false, output = environment.output } = {}) {
+  const existing = storeProfileCredential(environment);
+  const candidates = invalidated ? [] : storeProfiles(environment, inventory);
+  if (profile !== undefined) {
+    const wanted = String(profile).trim();
+    const named = candidates.filter((candidate) => sameUuid(candidate.uuid, wanted) || String(candidate.name ?? '') === wanted);
+    if (named.length === 0) {
+      for (const candidate of candidates) output.log(`  ${profileLine(candidate)}`);
+      throw new IasError(`Apple has no App Store profile «${wanted}» for ${environment.bundleId}`, {
+        fix: candidates.length === 0 ? 'make one without --profile (or enable the missing capability first, with --sync-capabilities)' : 'pass its UUID or its exact name, from the list above',
+        code: 'profile_not_found',
+        details: { profiles: candidates },
+      });
+    }
+    if (named.length > 1) {
+      for (const candidate of named) output.log(`  ${profileLine(candidate)}`);
+      throw new IasError(`«${wanted}» names ${named.length} App Store profiles of ${environment.bundleId}`, { fix: 'use the UUID of one: --profile <uuid>', code: 'profile_ambiguous', details: { profiles: named } });
+    }
+    const [chosen] = named;
+    const problem = storeProfileProblem(environment, certificate, chosen);
+    if (problem) throw new IasError(`the App Store profile ${chosen.uuid ?? chosen.id} cannot be used: ${problem.problem}`, { fix: problem.fix, code: 'profile_unusable', details: { profile: chosen } });
+    return { decision: existing && sameUuid(existing.metadata?.uuid, chosen.uuid) ? 'unchanged' : 'seal', reused: chosen, existing, candidates };
+  }
+  const usable = candidates.filter((candidate) => !storeProfileProblem(environment, certificate, candidate));
+  if (usable.length > 1) {
+    for (const candidate of candidates) output.log(`  ${profileLine(candidate)}`);
+    throw new IasError(`Apple has ${usable.length} usable App Store profiles for ${environment.bundleId}`, {
+      fix: 'choose one with --profile <uuid|name>; ias never picks one of several for you',
+      code: 'profile_ambiguous',
+      details: { profiles: candidates },
+    });
+  }
+  const reused = usable[0] ?? null;
+  return { decision: reused && existing && sameUuid(existing.metadata?.uuid, reused.uuid) ? 'unchanged' : reused ? 'seal' : 'create', reused, existing, candidates };
+}
+
+/** Whether another IAS credential still holds the profile `uuid`: one of those is never deleted in Apple. */
+async function profileReferencedElsewhere(environment, uuid, { except = [] } = {}) {
+  const holds = (credential) => credential.type === 'apple_provisioning_profile' && !credential.retired_at && sameUuid(credential.metadata?.uuid, uuid) && !except.includes(credential.id);
+  const local = [...environment.team, ...environment.own].filter(holds);
+  if (local.length > 0) return local.map((credential) => credential.id);
+  const found = [];
+  try {
+    const { data } = await environment.client.request('GET', '/apps');
+    for (const app of data.data ?? []) {
+      if (app.code === environment.code) continue;
+      const { data: credentials } = await environment.client.request('GET', `/apps/${encodeURIComponent(app.code)}/credentials`);
+      for (const credential of credentials.data ?? []) if (holds(credential)) found.push(`${credential.id} of ${app.code}`);
+    }
+  } catch (error) {
+    if (!(error instanceof ApiError) || error.status !== 404) throw error;
+  }
+  return found;
+}
+
+/**
+ * --delete-previous: deletes in Apple the App Store profile the new one replaces, and only that one. After the new one
+ * is sealed and uploaded (the caller only gets here then) and only with the flag: the UUID comes from the credential of
+ * the vault that was just replaced, so a profile of another tool is never touched; an ad hoc profile, a profile another
+ * IAS credential still holds and a dry run are left alone. The default is to leave the old profile in Apple.
+ */
+async function deletePreviousProfile(environment, inventory, context, { previousUuid, newUuid, existing }) {
+  const { output } = environment;
+  if (context.values['delete-previous'] !== true) return null;
+  if (!previousUuid || sameUuid(previousUuid, newUuid)) {
+    output.log('--delete-previous: there is no previous App Store profile of the vault to delete');
+    return null;
+  }
+  const profile = inventory.profiles.find((candidate) => sameUuid(candidate.uuid, previousUuid)) ?? null;
+  if (!profile) {
+    output.log(`--delete-previous: Apple does not list the previous profile ${previousUuid} any more: already gone`);
+    return { uuid: previousUuid, deleted: false, reason: 'absent' };
+  }
+  if (profile.type !== 'app-store' || (profile.bundleId && profile.bundleId !== environment.bundleId)) {
+    output.warn(`--delete-previous: ${previousUuid} is not an App Store profile of ${environment.bundleId}: it stays in Apple`);
+    return { uuid: previousUuid, deleted: false, reason: 'not-app-store' };
+  }
+  const holders = await profileReferencedElsewhere(environment, previousUuid, { except: existing ? [existing.id] : [] });
+  if (holders.length > 0) {
+    output.warn(`--delete-previous: ${previousUuid} is still in the vault as ${holders.join(', ')}: it stays in Apple`);
+    return { uuid: previousUuid, deleted: false, reason: 'referenced' };
+  }
+  output.progress(`--delete-previous: DELETE /v1/profiles/${profile.id} removes «${profile.name ?? '—'}» (${previousUuid}) of ${environment.bundleId} in Apple. Nothing uses it now, and Apple cannot give it back.`);
+  try {
+    await confirm(context, `Delete the previous App Store profile ${previousUuid} in Apple?`);
+  } catch (error) {
+    if (error instanceof IasError && ['not_confirmed', 'confirmation_required'].includes(error.code)) {
+      output.warn(`the previous profile ${previousUuid} stays in Apple`);
+      return { uuid: previousUuid, deleted: false, reason: 'not-confirmed' };
+    }
+    throw error;
+  }
+  try {
+    await environment.asc.deleteProfile(profile.id);
+    output.log(`deleted the previous App Store profile ${previousUuid} (${profile.id}) in Apple`);
+    return { id: profile.id, uuid: previousUuid, deleted: true };
+  } catch (error) {
+    if (error instanceof IasError && error.code === 'apple_api_error' && error.details?.status === 404) {
+      output.warn(`Apple does not have ${profile.id} any more: it was already gone, so nothing was deleted`);
+      return { id: profile.id, uuid: previousUuid, deleted: false, reason: 'absent' };
+    }
+    throw error;
+  }
+}
+
+/**
+ * The App Store profile: reuses the valid one of Apple that holds the certificate (the one --profile names), or makes one
+ * (IOS_APP_STORE, that one certificate, no devices), and seals it as the next version of the profile credential. In a dry
+ * run it says what it would do and writes nothing. --delete-previous removes the replaced one in Apple at the end.
+ */
+async function ensureStoreProfile(environment, certificate, inventory, context, { invalidated = false } = {}) {
+  const { output } = environment;
+  const { decision, reused, existing } = profileDecision(environment, certificate, inventory, { profile: context.values.profile, invalidated, output });
+  const dryRun = context.values['dry-run'] === true;
+  if (decision === 'unchanged') {
+    output.log(`the App Store profile ${reused.uuid} of ${environment.bundleId} is valid and holds the certificate: nothing to do with it`);
+    return { action: 'unchanged', summary: reused, credential: existing, made: false };
+  }
+  if (dryRun) {
+    output.log(decision === 'seal'
+      ? `  would reuse the App Store profile ${reused.uuid} of Apple and seal it as version ${(existing?.version ?? 0) + 1} of its credential`
+      : `  would make the App Store profile «IAS tienda ${environment.bundleId} ${stamp()}» in Apple: one certificate (${certificate.sha1 ?? 'the new one'}), no devices, and seal it as version ${(existing?.version ?? 0) + 1}`);
+    return { action: decision, summary: reused, credential: existing, made: false };
+  }
+  let summary = reused;
+  let resource = reused ? inventory.profilesOf.get(String(reused.uuid).toUpperCase()) : null;
+  if (reused && !resource?.attributes?.profileContent) resource = await environment.asc.profile(reused.id);
+  if (reused) {
+    output.progress(`  reusing the App Store profile ${reused.uuid} of Apple`);
+  } else {
+    const certificateId = certificate.apple?.id ?? certificate.metadata?.appleCertificateId;
+    if (!certificateId) throw new IasError('Apple did not say the id of the certificate to make the profile with', { fix: 'run it again: the certificate of the vault may lack its Apple id; import it again or make a new one', code: 'certificate_not_in_apple' });
+    resource = await environment.asc.createProfile({ name: `IAS tienda ${environment.bundleId} ${stamp()}`, type: 'IOS_APP_STORE', bundleIdId: inventory.bundle.id, certificateId, deviceIds: [] });
+    summary = profileSummary(resource);
+    output.progress(`  Apple made the App Store profile ${summary.uuid ?? resource.id}`);
+  }
+  const bytes = Buffer.from(resource?.attributes?.profileContent ?? '', 'base64');
+  if (bytes.length === 0) throw new IasError(`Apple did not give the content of the profile ${summary?.uuid ?? ''}`.trim(), { fix: 'nothing was stored: run it again, and if it goes on check the profile in Apple Developer', code: 'profile_unreadable' });
+  const metadata = metadataOf('apple_provisioning_profile', { inspect: { mobileprovision: bytes } });
+  const problems = inspect.checkIos({ certificate: certificate.metadata, profile: metadata }, { type: 'app-store', teamId: environment.teamId ?? undefined, bundleId: environment.bundleId });
+  if (metadata.devices !== 0) problems.push(`it lists ${metadata.devices} devices: an App Store profile lists none`);
+  if (metadata.bundleId !== environment.bundleId) problems.push(`it is for ${metadata.bundleId}, not ${environment.bundleId}`);
+  if (problems.length > 0) throw new IasError(`the profile Apple gave is not the one asked for: ${problems.join('; ')}`, { fix: 'nothing was stored: check the App ID and the certificate in Apple Developer', code: 'profile_unexpected' });
+  const id = existing?.id ?? randomUUID();
+  const version = (existing?.version ?? 0) + 1;
+  const plaintext = plaintextOf('apple_provisioning_profile', { fields: { mobileprovision: bytes } }, metadata, environment.code);
+  const envelope = sealCredential(plaintext, { id, type: 'apple_provisioning_profile', version }, environment.sealing);
+  const { data: stored } = existing
+    ? await environment.client.request('PUT', `/credentials/${id}`, { json: { metadata, envelope } })
+    : await environment.client.request('POST', `/apps/${encodeURIComponent(environment.code)}/credentials`, { json: { id, type: 'apple_provisioning_profile', name: `Perfil de tienda de ${environment.app.name}`, metadata, envelope } });
+  output.log(`stored «${stored.name}» (${stored.id}) version ${stored.version}, profile ${metadata.uuid} until ${metadata.expires?.slice(0, 10) ?? '—'}, sealed for ${envelope.recipients.length} key${envelope.recipients.length === 1 ? '' : 's'}`);
+  if (existing && existing.metadata?.uuid && !sameSha1(existing.metadata.uuid, metadata.uuid)) {
+    if (context.values['delete-previous'] === true) output.progress(`the profile of the vault was ${existing.metadata.uuid}: --delete-previous removes it in Apple after this`);
+    else output.warn(`the profile of the vault was ${existing.metadata.uuid}: it stays in Apple and nothing uses it now`);
+  }
+  expiryWarning(`«${stored.name}»`, metadata, output);
+  const made = !reused;
+  const previous = made ? await deletePreviousProfile(environment, inventory, context, { previousUuid: existing?.metadata?.uuid ?? null, newUuid: metadata.uuid, existing }) : null;
+  return { action: made ? (existing ? 'updated' : 'created') : 'sealed', summary: profileSummary({ id: resource.id, attributes: { ...resource.attributes, profileContent: bytes.toString('base64') } }), credential: stored, made, previous };
+}
+
+/** A profile that was not touched: either it was already the right one, or --no-profiles left it for later. */
+function skippedProfile(environment, certificate, inventory, output, { invalidated = false } = {}) {
+  const { decision, reused, existing } = profileDecision(environment, certificate, inventory, { profile: undefined, invalidated, output });
+  if (decision === 'unchanged') {
+    output.log(`the App Store profile ${reused.uuid} of ${environment.bundleId} is valid and holds the certificate: nothing to do with it`);
+    return { action: 'unchanged', summary: reused, credential: existing, made: false };
+  }
+  output.log(`--no-profiles: the App Store profile of ${environment.bundleId} is not ${decision === 'seal' ? 'sealed' : 'made'}. A store build needs it: run ias credentials generate ios (or ias credentials generate apple_provisioning_profile) before the next store build.`);
+  return { action: 'skipped', summary: reused, credential: existing, made: false };
+}
+
+/** Says what is going to happen in Apple and the vault, then asks (--yes skips the question, never the API errors). */
+async function confirmMutations(context, plan) {
+  const { output } = context;
+  output.progress('What this will do:');
+  for (const line of plan) output.progress(`  · ${line}`);
+  output.progress('Affected: the next store build of this app uses the new material; nothing already published in the App Store changes, and the internal ad hoc builds keep their own profile (run ias devices sync --force after a new certificate).');
+  output.progress('To undo it: revoke the certificate in Apple Developer › Certificates, Identifiers & Profiles and retire the credential in the panel; the previous .p12 stays in 1Password.');
+  await confirm(context, 'Make these changes in Apple and the vault?');
+}
+
+/** The plan lines of making a certificate. */
+const certificatePlan = (material, environment) => [
+  `POST /v1/certificates in App Store Connect with the CSR ${material.csrSha256} (subject ${material.subject}), team ${environment.teamId}`,
+  'seal the new .p12 and its password in the vault as the team\'s apple_distribution_certificate',
+  `keep a recovery copy in 1Password (op://IAS/${environment.teamId ?? 'Apple'} Apple Distribution <serial>)`,
+];
+
+/** The plan lines of the profile part, from what has to be done with it. */
+const profilePlan = (decision, environment, certificate) => [
+  decision === 'seal'
+    ? 'seal the App Store profile Apple already has in the vault as the next version of the app\'s profile'
+    : `make the App Store profile «IAS tienda ${environment.bundleId} ${stamp()}» in Apple (one certificate ${certificate.sha1 ?? '— the new one —'}, no devices) and seal it`,
+];
+
+/**
+ * ias credentials generate ios: the certificate and the App Store profile in one command. It reuses what is valid and
+ * makes only what is missing, so running it again after a failure finishes the work and never duplicates anything.
+ */
+export async function generateIos(context) {
+  const type = profileTypeOf(context.values);
+  if (type === 'ad-hoc') return adHocProfile(context, loadProject(resolve(context.cwd, context.values.project ?? '.')));
+  if (context.values.reuse && context.values.rotate) throw new IasError('--reuse and --rotate ask for different things', { fix: 'leave one out: --reuse never makes a certificate, --rotate always makes one' });
+  const days = ifExpiringOf(context.values);
+  const noProfiles = context.values['no-profiles'] === true;
+  return withApple(context, async (environment) => {
+    const { output } = environment;
+    output.progress(`App Store Connect: key ${environment.key.key_id}, from the vault (${environment.ascKey.id} v${environment.ascKey.version})`);
+    let inventory = await inventoryOf(environment);
+    printInventory(environment, inventory, output);
+    if (!inventory.bundle) throw new IasError(`Apple has no App ID ${environment.bundleId}`, { fix: `register it with ias apps store ${environment.code} --register-bundle-id, or in Apple Developer › Identifiers; after that: ias credentials generate ios`, code: 'bundle_id_not_in_apple' });
+    const capabilities = await syncCapabilities(environment, inventory, context);
+    if (capabilities.enabled.length > 0) inventory = await inventoryOf(environment);
+    const invalidated = capabilities.missing.length > 0;
+    const chosen = selectCertificate(environment, inventory, { certificate: context.values.certificate, output });
+    if (context.values.reuse && !chosen) throw new IasError('--reuse needs a usable distribution certificate of the team in the vault and in Apple', { fix: 'import the current one with ias credentials import apple_distribution_certificate, or leave --reuse out so ias makes one', code: 'certificate_not_found' });
+    const renew = !context.values.reuse && (context.values.rotate === true || !chosen || (days > 0 && daysUntil(chosen.expires) < days));
+    if (renew && context.values.profile !== undefined) throw new IasError('--profile reuses the App Store profile of the current certificate, and this run makes a new certificate', { fix: 'leave --profile out: the App Store profile of the new certificate is made from scratch', code: 'option_not_supported' });
+    if (chosen && !renew) output.log(`the certificate ${chosen.sha1} is in the vault and Apple still lists it: reusing it (it expires on ${String(chosen.expires).slice(0, 10)})`);
+    if (renew && !environment.teamId) throw new IasError('the Apple team of the app is unknown', { fix: 'give it in the panel (the application › Settings) or with --team-id', code: 'team_missing' });
+    if (noProfiles && context.values.profile !== undefined) throw new IasError('--profile names an App Store profile and --no-profiles leaves it for later', { fix: 'leave one out: --profile reuses the profile of Apple, --no-profiles does not touch it', code: 'option_not_supported' });
+    if (noProfiles && context.values['sync-capabilities'] === true) throw new IasError('--sync-capabilities invalidates every profile of the App ID and --no-profiles would leave the App Store one unmade', { fix: 'run it without --no-profiles, or enable the capabilities in Apple Developer › Identifiers first', code: 'option_not_supported' });
+    const dryRun = context.values['dry-run'] === true;
+    const material = renew ? appleSigningMaterial({ name: context.values.name ?? environment.app.name, team: environment.teamId, openssl: context.env.IAS_OPENSSL ?? OPENSSL }) : null;
+    const profileStep = (certificate) => (noProfiles
+      ? skippedProfile(environment, certificate, inventory, output, { invalidated })
+      : ensureStoreProfile(environment, certificate, inventory, context, { invalidated }));
+    try {
+      const certificate = renew ? { source: 'generated', sha1: material ? null : '—', metadata: chosen?.metadata ?? {} } : { source: 'vault', sha1: chosen.sha1, apple: chosen.apple, credential: chosen.credential, metadata: chosen.credential.metadata };
+      const { decision } = renew ? { decision: 'create' } : profileDecision(environment, certificate, inventory, { profile: context.values.profile, invalidated, output });
+      if (dryRun && renew) output.log(`  would make the certificate from the CSR ${material.csrSha256} (subject ${material.subject}) and seal its .p12: no POST /v1/certificates in a dry run`);
+      if (!renew && (decision === 'unchanged' || noProfiles)) {
+        output.log(decision === 'unchanged'
+          ? 'nothing to do: the distribution certificate and the App Store profile are valid and in the vault. --rotate makes a new certificate.'
+          : 'nothing to do with the certificate: --no-profiles leaves the App Store profile for later (ias credentials generate ios finishes it).');
+        const profile = await profileStep(certificate);
+        return reportOf(environment, { changed: false, dryRun, certificate, profile, inventory, capabilities, next: noProfiles && decision !== 'unchanged' ? 'ias credentials generate ios' : undefined });
+      }
+      if (dryRun) {
+        const profile = await profileStep(certificate);
+        return reportOf(environment, { changed: false, dryRun: true, action: renew ? 'certificate' : 'profile', certificate, profile, inventory, capabilities, next: noProfiles ? 'ias credentials generate ios' : undefined });
+      }
+      const willCreate = renew || decision === 'create';
+      await confirmMutations(context, [...(renew ? certificatePlan(material, environment) : []), ...(noProfiles && decision !== 'unchanged' ? ['leave the App Store profile for later (--no-profiles)'] : profilePlan(decision, environment, certificate)), ...(context.values['delete-previous'] === true && willCreate ? ['delete in Apple the App Store profile the new one replaces, once it is sealed and uploaded (--delete-previous asks again)'] : [])]);
+      let made = certificate;
+      if (renew) {
+        // The new material replaces the stored one: an owner approves the change first, and the approval names the
+        // old SHA-1, the Apple team and the CSR. A rejection or an expiry stops before Apple is touched.
+        const replaces = chosen?.credential ?? null;
+        const applications = replaces ? await applicationsUsing(environment, chosen.sha1, inventory) : [];
+        const old = replaces ? oldCertificate(replaces.metadata) : null;
+        const approval = replaces
+          ? await approveCertificateChange(
+            context,
+            environment.client,
+            {
+              action: 'replace',
+              credential: replaces.id,
+              team: environment.teamId,
+              old,
+              new: { csr_sha256: material.csrSha256, key: 'RSA-2048' },
+              revoke_before_create: false,
+              applications,
+            },
+            approvalLines({ what: 'replace the distribution certificate', old, team: environment.teamId, material: `SHA-256 of the CSR ${material.csrSha256} · RSA-2048 key`, applications }),
+          )
+          : null;
+        made = await makeCertificate(environment, material, inventory, context, { replaceWith: replaces, approval });
+      }
+      const profile = await profileStep(made);
+      if (renew) output.warn('a new distribution certificate: the next store build uses the new profile; run ias devices sync --force so the internal builds have an ad hoc profile with it too');
+      return reportOf(environment, { changed: true, action: renew ? 'certificate' : 'profile', certificate: made, profile, inventory, capabilities, next: capabilities.enabled.length > 0 ? 'ias devices sync --force' : noProfiles && profile.action !== 'unchanged' ? 'ias credentials generate ios' : undefined });
+    } finally {
+      material?.cleanup();
+    }
+  });
+}
+
+/**
+ * ias credentials generate apple_distribution_certificate: only the certificate, for repeating or resolving a case.
+ * It refuses when a usable one exists (that is what ios reuses) unless --rotate.
+ */
+export async function generateDistributionCertificate(context) {
+  if (context.values.reuse) throw new IasError('--reuse is for ias credentials generate ios', { fix: 'this command only makes a certificate; ias credentials generate ios reuses the valid one' });
+  return withApple(context, async (environment) => {
+    const { output } = environment;
+    output.progress(`App Store Connect: key ${environment.key.key_id}, from the vault (${environment.ascKey.id} v${environment.ascKey.version})`);
+    const inventory = await inventoryOf(environment);
+    printInventory(environment, inventory, output);
+    const chosen = selectCertificate(environment, inventory, { certificate: context.values.certificate, output });
+    if (chosen && !context.values.rotate) {
+      throw new IasError(`there is already a usable distribution certificate (${chosen.sha1}, until ${String(chosen.expires).slice(0, 10)})`, { fix: 'ias credentials generate ios reuses it and makes the App Store profile; --rotate makes a new one (Apple may refuse until the current one is revoked)', code: 'certificate_exists', details: { certificate: chosen.sha1 } });
+    }
+    if (!environment.teamId) throw new IasError('the Apple team of the app is unknown', { fix: 'give it in the panel (the application › Settings) or with --team-id', code: 'team_missing' });
+    const material = appleSigningMaterial({ name: context.values.name ?? environment.app.name, team: environment.teamId, openssl: context.env.IAS_OPENSSL ?? OPENSSL });
+    try {
+      if (context.values['dry-run'] === true) {
+        output.log(`dry run: would POST /v1/certificates with the CSR ${material.csrSha256} (subject ${material.subject}), seal the .p12 in the vault and keep its recovery copy in 1Password; nothing sent`);
+        return { status: 'dry_run', changed: false, action: 'certificate', certificate: { source: 'generated', sha1: null, csr_sha256: material.csrSha256 }, certificates: inventory.certificates, next: null };
+      }
+      await confirmMutations(context, [...certificatePlan(material, environment), 'no App Store profile is made here: ias credentials generate ios or apple_provisioning_profile does that']);
+      const replaces = chosen?.credential ?? null;
+      const applications = replaces ? await applicationsUsing(environment, chosen.sha1, inventory) : [];
+      const old = replaces ? oldCertificate(replaces.metadata) : null;
+      const approval = replaces
+        ? await approveCertificateChange(
+          context,
+          environment.client,
+          { action: 'replace', credential: replaces.id, team: environment.teamId, old, new: { csr_sha256: material.csrSha256, key: 'RSA-2048' }, revoke_before_create: false, applications },
+          approvalLines({ what: 'replace the distribution certificate', old, team: environment.teamId, material: `SHA-256 of the CSR ${material.csrSha256} · RSA-2048 key`, applications }),
+        )
+        : null;
+      const certificate = await makeCertificate(environment, material, inventory, context, { replaceWith: replaces, approval });
+      output.log(`the App Store profile is next: ias credentials generate apple_provisioning_profile --certificate ${certificate.sha1} (or ias credentials generate ios)`);
+      return { status: 'changed', changed: true, action: 'certificate', certificate: { source: 'generated', credential: certificate.credential.id, id: certificate.apple.id, sha1: certificate.sha1, serial: certificate.apple.serial, name: certificate.credential.name, expires: certificate.apple.expires }, certificates: inventory.certificates, next: 'ias credentials generate ios' };
+    } finally {
+      material.cleanup();
+    }
+  });
+}
+
+/**
+ * ias credentials generate apple_provisioning_profile: only the App Store profile, with the certificate the vault has
+ * (--certificate picks among several). --type ad-hoc delegates to ias devices sync, which owns the device list.
+ */
+export async function generateProvisioningProfile(context) {
+  const type = profileTypeOf(context.values);
+  if (type === 'ad-hoc') return adHocProfile(context, loadProject(resolve(context.cwd, context.values.project ?? '.')));
+  return withApple(context, async (environment) => {
+    const { output } = environment;
+    output.progress(`App Store Connect: key ${environment.key.key_id}, from the vault (${environment.ascKey.id} v${environment.ascKey.version})`);
+    let inventory = await inventoryOf(environment);
+    printInventory(environment, inventory, output);
+    if (!inventory.bundle) throw new IasError(`Apple has no App ID ${environment.bundleId}`, { fix: `register it with ias apps store ${environment.code} --register-bundle-id, or in Apple Developer › Identifiers; after that: ias credentials generate apple_provisioning_profile`, code: 'bundle_id_not_in_apple' });
+    const chosen = selectCertificate(environment, inventory, { certificate: context.values.certificate, output });
+    if (!chosen) throw new IasError(`the vault has no usable distribution certificate of the team ${environment.teamId ?? ''}`.trim(), { fix: 'make one with ias credentials generate ios (certificate and profile) or import the current one with ias credentials import apple_distribution_certificate', code: 'credentials_missing' });
+    const capabilities = await syncCapabilities(environment, inventory, context);
+    if (capabilities.enabled.length > 0) inventory = await inventoryOf(environment);
+    const invalidated = capabilities.missing.length > 0;
+    const certificate = { source: 'vault', sha1: chosen.sha1, apple: chosen.apple, credential: chosen.credential, metadata: chosen.credential.metadata };
+    output.log(`the profile will hold the certificate ${chosen.sha1} (${chosen.credential.name}, until ${String(chosen.expires).slice(0, 10)})`);
+    const dryRun = context.values['dry-run'] === true;
+    if (!dryRun) {
+      const { decision } = profileDecision(environment, certificate, inventory, { profile: context.values.profile, invalidated, output });
+      if (decision !== 'unchanged') {
+        await confirmMutations(context, [
+          ...profilePlan(decision, environment, certificate),
+          ...(context.values['delete-previous'] === true && decision === 'create' ? ['delete in Apple the App Store profile the new one replaces, once it is sealed and uploaded (--delete-previous asks again)'] : []),
+        ]);
+      }
+    }
+    const profile = await ensureStoreProfile(environment, certificate, inventory, context, { invalidated });
+    return reportOf(environment, { changed: !dryRun && profile.action !== 'unchanged', dryRun, action: 'profile', certificate, profile, inventory, capabilities, next: capabilities.enabled.length > 0 ? 'ias devices sync --force' : undefined });
+  });
+}
+
+/**
+ * Everything ias credentials revoke reads: the server's applications, the vault's keys and signing key, the team's
+ * App Store Connect key (opened in memory) and the Apple team. It does not need the bundle id of the app.
+ */
+async function teamAppleEnvironment(context) {
+  const { env, output } = context;
+  const project = loadProject(resolve(context.cwd, context.values.project ?? '.'));
+  const client = connect(context, project);
+  const apps = (await client.request('GET', '/apps')).data.data;
+  const code = context.values.app ?? project?.config?.app ?? null;
+  const app = code ? apps.find((application) => application.code === code) ?? null : null;
+  const item = vaultItem(context, project, client.server);
+  const { vault, keys, signingKey, recoveryKey } = await teamKeys(client, item, env, { recovery: true });
+  const team = (await client.request('GET', '/team/credentials')).data.data;
+  const ascKey = ascKeyOf(team);
+  if (!ascKey) {
+    throw new IasError('the vault has no App Store Connect API key', { fix: 'import the team\'s with ias credentials import asc_api_key --p8 <AuthKey_….p8> --key-id <id> --issuer-id <uuid>', code: 'credentials_missing' });
+  }
+  const { runners } = signedRunners(vault, keys.signing, output);
+  const key = await openAscKey(client, ascKey, { recoveryKey, keys });
+  return {
+    project,
+    client,
+    apps,
+    app,
+    code,
+    item,
+    vault,
+    keys,
+    signingKey,
+    team,
+    ascKey,
+    key,
+    asc: ascClient(key, { env, fetch: context.fetch ?? fetch }),
+    teamId: String(context.values['team-id'] ?? app?.ios?.team_id ?? ascKey.metadata?.teamId ?? '').trim() || null,
+    sealing: { recipients: [keys.recovery, ...runners], signingKey, keys },
+    base: `ias ${VERSION}`.slice(0, 64),
+    output,
+  };
+}
+
+/** Runs `work` with the team's environment and wipes the Apple key however it ends. */
+async function withTeamApple(context, work) {
+  const environment = await teamAppleEnvironment(context);
+  try {
+    return await work(environment);
+  } finally {
+    environment.key.p8?.fill?.(0);
+  }
+}
+
+/** The profiles of the team's apps that hold `sha1`, with their application: { …profileSummary, app, bundleId }. */
+async function profilesUsing(environment, sha1) {
+  const found = new Map();
+  for (const app of environment.apps) {
+    const bundleId = app.ios?.bundle_id;
+    if (!bundleId) continue;
+    if (environment.teamId && app.ios?.team_id && app.ios.team_id !== environment.teamId) continue;
+    const bundle = await environment.asc.bundleId(bundleId);
+    if (!bundle) continue;
+    for (const resource of await environment.asc.profilesOf(bundle.id)) {
+      let summary = profileSummary(resource);
+      if ((summary.certificates ?? []).length === 0) {
+        // Apple's list may not carry the profileContent: the certificate of the profile comes from it.
+        try {
+          summary = profileSummary(await environment.asc.profile(resource.id));
+        } catch {
+          summary = profileSummary(resource);
+        }
+      }
+      if (!(summary.certificates ?? []).some((value) => sameSha1(value, sha1))) continue;
+      if (environment.teamId && summary.team && summary.team !== environment.teamId) continue;
+      found.set(summary.uuid ?? summary.id, { ...summary, bundleId: summary.bundleId ?? bundleId, app: app.code });
+    }
+  }
+  return [...found.values()];
+}
+
+/** The report of ias credentials revoke: the same keys with and without a change, never a secret. */
+function revokeReport(environment, { changed, action = 'revoke', credential, sha1, appleId, apple, retired, profiles, applications, approval = null, dryRun = false }) {
+  return {
+    status: dryRun ? 'dry_run' : changed ? 'changed' : 'unchanged',
+    changed,
+    action,
+    app: environment.code,
+    team: environment.teamId,
+    credential: credential.id,
+    certificate: { id: appleId, serial: credential.metadata?.serial ?? null, sha1, expires: credential.metadata?.expires ?? null },
+    apple,
+    retired,
+    profiles: profiles.map((profile) => ({ app: profile.app, bundle_id: profile.bundleId, uuid: profile.uuid, name: profile.name, type: profile.type })),
+    applications,
+    approval,
+    next: 'ias credentials generate ios',
+  };
+}
+
+/**
+ * ias credentials revoke: the owner-authorized way to withdraw the team's distribution certificate without a
+ * substitute (a compromised certificate). It lists what Apple has and which profiles and apps use it, asks an owner to
+ * authorize it with a passkey, then deletes it in Apple with the key of the vault and retires the credential. A
+ * rejected or expired approval stops before Apple is touched; a certificate Apple no longer has is still retired.
+ */
+export async function revokeAppleCertificate(context) {
+  const id = context.positionals[0];
+  return withTeamApple(context, async (environment) => {
+    const { output, client } = environment;
+    const credential = environment.team.find((candidate) => candidate.id === id);
+    if (!credential) {
+      throw new IasError(`there is no active credential ${id} in the team`, { fix: 'ias credentials list --all shows them; a retired one is already out of use', code: 'credential_not_found' });
+    }
+    if (credential.type !== 'apple_distribution_certificate') {
+      throw new IasError(`${id} is a ${credential.type}, not an Apple distribution certificate`, { fix: 'ias credentials show <id> says what it is; only an apple_distribution_certificate is revoked in Apple', code: 'credential_type_invalid' });
+    }
+    const sha1 = String(credential.metadata?.sha1 ?? '').toUpperCase();
+    if (!/^[0-9A-F]{40}$/.test(sha1)) {
+      throw new IasError(`${id} has no SHA-1 in its metadata`, { fix: 'ias credentials show <id> checks it; import the certificate again with ias credentials import apple_distribution_certificate', code: 'credential_unreadable' });
+    }
+    if (environment.teamId && credential.metadata?.team && credential.metadata.team !== environment.teamId) {
+      throw new IasError(`the certificate ${sha1} is of team ${credential.metadata.team}, not of ${environment.teamId}`, { fix: 'nothing was done in Apple: pass --team-id with the team of the certificate, or run it in the folder of that app', code: 'certificate_not_in_apple' });
+    }
+    if (credential.retired_at) {
+      output.log(`nothing to do: «${credential.name}» (${credential.id}) is retired since ${credential.retired_at}`);
+      return revokeReport(environment, { changed: false, credential, sha1, appleId: credential.metadata?.appleCertificateId ?? null, apple: 'unknown', retired: true, profiles: [], applications: [] });
+    }
+
+    const appleCertificates = (await environment.asc.certificatesOfTeam()).map((certificate) => certificateSummary(certificate));
+    const storedId = credential.metadata?.appleCertificateId ?? null;
+    // The SHA-1 is what the vault has and what the approval names: it is the
+    // certificate to revoke. The id in the metadata only corroborates it; if it
+    // points at another certificate, nothing is asked and nothing is deleted.
+    const bySha1 = appleCertificates.find((certificate) => sameSha1(certificate.sha1, sha1)) ?? null;
+    const byId = storedId === null ? null : appleCertificates.find((certificate) => certificate.id === storedId) ?? null;
+    if (byId && !sameSha1(byId.sha1, sha1)) {
+      throw new IasError(`the credential names the Apple certificate ${storedId} in its metadata, but Apple has it with SHA-1 ${byId.sha1}, not ${sha1}`, {
+        fix: 'nothing was asked nor deleted: ias credentials show <id> shows the metadata; import the certificate again with its right id (ias credentials import apple_distribution_certificate), or generate a new one with ias credentials generate ios --rotate',
+        code: 'approval_mismatch',
+        details: { credential: credential.id, apple_certificate_id: storedId, stored_sha1: sha1, apple_sha1: byId.sha1 ?? null },
+      });
+    }
+    const found = bySha1 ?? byId;
+    const appleId = bySha1?.id ?? storedId ?? null;
+    const profiles = await profilesUsing(environment, sha1);
+    const applications = [...new Set(profiles.map((profile) => profile.app))];
+    output.log(`«${credential.name}» (${credential.id}), Apple team ${credential.metadata?.team ?? environment.teamId ?? '—'}`);
+    output.log(`  certificate ${appleId ?? '—'}${found?.serial ?? credential.metadata?.serial ? `  serial ${found?.serial ?? credential.metadata?.serial}` : ''}  SHA-1 ${sha1}  until ${String(found?.expires ?? credential.metadata?.expires ?? '—').slice(0, 10)}  ${found ? found.status : 'not in Apple'}`);
+    output.log(`  profiles that hold it${profiles.length === 0 ? ': none in Apple' : ''}`);
+    for (const profile of profiles) output.log(`    ${profile.app}  ${profile.uuid ?? profile.id}  ${profile.type ?? '—'}  ${profile.name ?? '—'}  ${profile.state ?? '—'}  until ${String(profile.expires ?? '—').slice(0, 10)}`);
+    output.log(`  applications affected: ${applications.length === 0 ? 'none' : applications.join(', ')}`);
+    output.progress('Impact: what is already published in the App Store keeps working. Internal (ad hoc) builds signed with it stop installing, and builds uploaded to App Store Connect but not sent to review may become Invalid Binary.');
+    output.progress('The App Store profile of every application above has to be made again with another certificate: ias credentials generate ios (or apple_provisioning_profile).');
+    output.progress('This does not create a substitute: the team is left without a distribution certificate until you generate a new one.');
+    if (context.values['dry-run'] === true) {
+      output.log('dry run: nothing was asked, deleted in Apple nor retired; run it without --dry-run to do it.');
+      return revokeReport(environment, { changed: false, dryRun: true, credential, sha1, appleId, apple: found ? 'present' : 'absent', retired: false, profiles, applications });
+    }
+    await confirm(context, `Revoke the certificate ${sha1} in Apple and retire «${credential.name}»?`);
+
+    const team = String(credential.metadata?.team ?? environment.teamId ?? '').trim().toUpperCase();
+    if (!/^[A-Z0-9]{10}$/.test(team)) {
+      throw new IasError(`the certificate ${sha1} has no Apple team in its metadata`, { fix: 'nothing was done in Apple: ias credentials show <id> shows the metadata; import it again with the team in the .p12, or run in the folder of its app with --team-id', code: 'team_missing' });
+    }
+    const old = oldCertificate(credential.metadata);
+    const approval = await approveCertificateChange(
+      context,
+      client,
+      { action: 'revoke', credential: credential.id, team, old, new: null, revoke_before_create: false, applications },
+      approvalLines({ what: 'revoke the distribution certificate', old, team, material: null, applications }),
+    );
+
+    let apple = 'revoked';
+    if (appleId === null) {
+      apple = 'absent';
+      output.warn('Apple does not list it: there is nothing to delete');
+    } else {
+      // The approval names a SHA-1. Re-read the certificate by id right before
+      // deleting it: if Apple now has another one under that id, the approval
+      // does not cover it and nothing is deleted.
+      let current = null;
+      try {
+        current = certificateSummary(await environment.asc.certificate(appleId));
+      } catch (error) {
+        if (!(error instanceof IasError) || error.code !== 'apple_api_error' || error.details?.status !== 404) throw error;
+      }
+      if (current === null) {
+        apple = 'absent';
+        output.warn(`Apple does not have ${appleId} any more: it was already gone, so nothing was deleted`);
+      } else if (!sameSha1(current.sha1, sha1)) {
+        throw new IasError(`the certificate ${appleId} in Apple is now ${current.sha1}, not the approved ${sha1}`, {
+          fix: 'nothing was deleted and the credential is still active: read Apple again with ias credentials show <id>; if another certificate replaced it, renew with ias credentials generate ios --rotate instead of revoking this one',
+          code: 'approval_mismatch',
+          details: { credential: credential.id, apple_certificate_id: appleId, approved_sha1: sha1, apple_sha1: current.sha1 ?? null },
+        });
+      } else {
+        try {
+          await environment.asc.revokeCertificate(appleId);
+          output.log(`revoked ${appleId} in Apple (SHA-1 ${sha1})`);
+        } catch (error) {
+          if (error instanceof IasError && error.code === 'apple_api_error' && error.details?.status === 404) {
+            apple = 'absent';
+            output.warn(`Apple does not have ${appleId} any more: it was already gone, so nothing was deleted`);
+          } else {
+            throw error;
+          }
+        }
+      }
+    }
+    let retired
+    try {
+      ({ data: retired } = await client.request('POST', `/credentials/${credential.id}/retire`))
+    } catch (error) {
+      throw new IasError(`the certificate ${appleId ?? sha1} is already deleted in Apple (or was already gone), but the credential was not retired: ${error.message}`, {
+        fix: `the certificate is gone, so do not generate a second one: run ias credentials revoke ${credential.id} again; Apple answers 404 for a certificate that no longer exists (ias treats it as already absent) and the command only retires the credential`,
+        code: 'retire_failed',
+        details: { credential: credential.id, sha1, apple_certificate_id: appleId, apple },
+      });
+    }
+    output.log(`retired «${retired.name}» (${retired.id}) on ${retired.retired_at}: builds no longer get it, and it stays in the inventory`);
+    output.warn('the profiles that held it are invalid now: make them again with ias credentials generate ios, and run ias devices sync --force for the internal builds');
+    return revokeReport(environment, { changed: true, credential: retired, sha1, appleId, apple, retired: true, profiles, applications, approval: { id: approval, status: 'approved' } });
+  });
+}