@limrun/ui 0.14.0-rc.3 → 0.14.0-rc.5

package/src/core/play-publish/google.ts

@@ -71,11 +71,20 @@ export type RequestGoogleAccessTokenInput = {
  * call loadGoogleIdentityServices beforehand (e.g. when the surrounding
  * dialog opens) to keep this call synchronous with the click.
  */
-export async function requestGoogleAccessToken({
+export function requestGoogleAccessToken(input: RequestGoogleAccessTokenInput): Promise<string> {
+  // When GSI is already loaded the popup must open inside the caller's
+  // click turn: even an await of a resolved promise yields a microtask,
+  // which the strictest popup blockers treat as leaving the gesture.
+  if (googleOAuth2()) {
+    return openTokenPopup(input);
+  }
+  return loadGoogleIdentityServices().then(() => openTokenPopup(input));
+}
+
+function openTokenPopup({
   clientId,
   scope = ANDROID_PUBLISHER_SCOPE,
 }: RequestGoogleAccessTokenInput): Promise<string> {
-  await loadGoogleIdentityServices();
   return new Promise<string>((resolve, reject) => {
     const client = googleOAuth2()!.initTokenClient({
       client_id: clientId,

package/src/device-build/react.ts

@@ -8,6 +8,7 @@ import {
   type IOSOTAInstall,
   type StoredSigningAssets,
 } from './index';
+import { errorMessage } from '../core/errors';
 
 export type UseDeviceBuildOptions = {
   apiUrl?: string;
@@ -127,7 +128,3 @@ export function useDeviceBuild({
     reset,
   };
 }
-
-function errorMessage(error: unknown) {
-  return error instanceof Error ? error.message : String(error);
-}

package/src/device-install/demo/demo.tsx

@@ -29,6 +29,7 @@ import {
 import { useDeviceBuild } from '../../device-build/react';
 import { useDeviceInstallRelay } from '../react';
 import './demo.css';
+import { errorMessage } from '../../core/errors';
 
 type ActivityLine = {
   id: number;
@@ -1053,10 +1054,6 @@ function useLocalStorage(key: string, initialValue: string) {
   return [value, setValue] as const;
 }
 
-function errorMessage(error: unknown) {
-  return error instanceof Error ? error.message : String(error);
-}
-
 createRoot(document.getElementById('root')!).render(
   <StrictMode>
     <App />

package/src/device-install/react.ts

@@ -12,6 +12,7 @@ import {
   type RelayClient,
   type StoredPairRecord,
 } from './index';
+import { errorMessage } from '../core/errors';
 
 export type DeviceInstallRelayBusyAction = 'usb' | 'pair' | 'install';
 
@@ -192,7 +193,3 @@ export function useDeviceInstallRelay({
 function noopLog() {
   // Intentionally empty. Consumers can pass a logger for progress messages.
 }
-
-function errorMessage(error: unknown) {
-  return error instanceof Error ? error.message : String(error);
-}

package/src/play-publish/README.md

@@ -29,7 +29,8 @@ const play = usePlaystorePublish({
   googleClientId: GOOGLE_OAUTH_CLIENT_ID,
 });
 
-// On dialog open, warm the sign-in script so the click stays popup-safe:
+// On dialog open, warm the sign-in script so the click stays popup-safe.
+// Optionally await the returned promise (true = ready) to gate the button:
 play.preloadGoogle();
 
 // Button handlers:
@@ -39,9 +40,9 @@ await play.publish({ assetName: 'app-release.aab', packageName: 'com.example.app
 // Render from state: play.status, play.versionCode, play.error, play.errorCode
 ```
 
-`errorCode` values: `invalidRequest`, `assetNotFound`, `internal`, `busy`,
-`listingNotFound`, `permissionDenied`, `versionCodeExists`,
-`uploadKeyMismatch`, `unknown`. The set grows additively.
+`errorCode` carries the registry's machine-readable error code; the
+canonical value list lives on `PlaystorePublishError`'s doc comment and
+grows additively.
 
 Google access tokens expire after about an hour. A `permissionDenied`
 error long after sign-in usually means the token expired; offer "Sign in

package/src/play-publish/react.ts

@@ -1,4 +1,5 @@
-import { useCallback, useRef, useState } from 'react';
+import { useCallback, useMemo, useRef, useState } from 'react';
+import { errorMessage } from '../core/errors';
 import {
   loadGoogleIdentityServices,
   PlaystorePublishError,
@@ -29,10 +30,20 @@ export type UsePlaystorePublishResult = {
   error?: string;
   /** Registry error code driving per-cause UX, e.g. versionCodeExists. */
   errorCode?: string;
-  /** Warm up the Google sign-in script (e.g. on dialog open) so signInWithGoogle stays synchronous with the click. */
-  preloadGoogle: () => void;
+  /**
+   * Warm up the Google sign-in script (e.g. on dialog open) so
+   * signInWithGoogle stays synchronous with the click. Resolves true once
+   * the script is ready; await it to gate the sign-in button, or ignore
+   * the result and rely on the blocked-popup error plus retry.
+   */
+  preloadGoogle: () => Promise<boolean>;
   signInWithGoogle: () => Promise<boolean>;
   publish: (request: PlaystorePublishRequest) => Promise<PlaystorePublishResult | undefined>;
+  /**
+   * Clears the outcome state (keeps the Google session). Does not cancel an
+   * in-flight sign-in or publish: their completion is ignored status-wise
+   * and new calls stay refused until the in-flight one settles.
+   */
   reset: () => void;
 };
 
@@ -43,7 +54,9 @@ export function usePlaystorePublish({
   googleClientId,
 }: UsePlaystorePublishOptions): UsePlaystorePublishResult {
   const [status, setStatus] = useState<PlaystorePublishStatus>('idle');
-  const [isSignedIn, setIsSignedIn] = useState(false);
+  // isSignedIn derives from token possession so the two can never diverge,
+  // even when a reset() during the popup makes the flow's status stale.
+  const [accessToken, setAccessToken] = useState<string | undefined>();
   const [versionCode, setVersionCode] = useState<number | undefined>();
   const [error, setError] = useState<string | undefined>();
   const [errorCode, setErrorCode] = useState<string | undefined>();
@@ -55,8 +68,22 @@ export function usePlaystorePublish({
   const generationRef = useRef(0);
   const busyRef = useRef(false);
 
-  const preloadGoogle = useCallback(() => {
-    void loadGoogleIdentityServices().catch(() => undefined);
+  const preloadGoogle = useCallback(
+    () =>
+      loadGoogleIdentityServices().then(
+        () => true,
+        () => false,
+      ),
+    [],
+  );
+
+  // Guard failures replace the whole outcome, like the main paths do: a
+  // stale errorCode or versionCode must not render beside the new error.
+  const failGuard = useCallback((message: string) => {
+    setError(message);
+    setErrorCode(undefined);
+    setVersionCode(undefined);
+    setStatus('error');
   }, []);
 
   const signInWithGoogle = useCallback(async () => {
@@ -64,8 +91,7 @@ export function usePlaystorePublish({
       return false;
     }
     if (!googleClientId) {
-      setError('Google OAuth client ID is not configured.');
-      setStatus('error');
+      failGuard('Google OAuth client ID is not configured.');
       return false;
     }
     busyRef.current = true;
@@ -76,9 +102,14 @@ export function usePlaystorePublish({
     try {
       const nextToken = await requestGoogleAccessToken({ clientId: googleClientId });
       accessTokenRef.current = nextToken;
+      setAccessToken(nextToken);
       if (generation === generationRef.current) {
-        setIsSignedIn(true);
         setStatus('ready');
+      } else {
+        // A reset() during the popup ran before the token landed and left
+        // idle; upgrade it so status agrees with isSignedIn. Anything but
+        // idle belongs to a newer flow and must not be stomped.
+        setStatus((current) => (current === 'idle' ? 'ready' : current));
       }
       return true;
     } catch (caught) {
@@ -98,14 +129,12 @@ export function usePlaystorePublish({
         return undefined;
       }
       if (!registryApiUrl) {
-        setError('Registry URL is not configured.');
-        setStatus('error');
+        failGuard('Registry URL is not configured.');
         return undefined;
       }
-      const accessToken = accessTokenRef.current;
-      if (!accessToken) {
-        setError('Sign in with Google before publishing.');
-        setStatus('error');
+      const googleToken = accessTokenRef.current;
+      if (!googleToken) {
+        failGuard('Sign in with Google before publishing.');
         return undefined;
       }
       busyRef.current = true;
@@ -113,13 +142,23 @@ export function usePlaystorePublish({
       setStatus('publishing');
       setError(undefined);
       setErrorCode(undefined);
+      // A stale code from an earlier publish must not render as this
+      // attempt's success next to an error state.
+      setVersionCode(undefined);
       try {
+        // Fields picked explicitly: spreading a wider-typed request object
+        // could smuggle same-named credential fields or excess properties
+        // into the request body.
         const result = await publishToPlaystore({
           registryApiUrl,
           token,
           organizationId,
-          accessToken,
-          ...request,
+          accessToken: googleToken,
+          packageName: request.packageName,
+          assetId: request.assetId,
+          assetName: request.assetName,
+          track: request.track,
+          releaseStatus: request.releaseStatus,
         });
         if (generation === generationRef.current) {
           setVersionCode(result.versionCode);
@@ -150,19 +189,20 @@ export function usePlaystorePublish({
     setStatus(accessTokenRef.current ? 'ready' : 'idle');
   }, []);
 
-  return {
-    status,
-    isSignedIn,
-    versionCode,
-    error,
-    errorCode,
-    preloadGoogle,
-    signInWithGoogle,
-    publish,
-    reset,
-  };
-}
-
-function errorMessage(error: unknown) {
-  return error instanceof Error ? error.message : String(error);
+  // Memoized so the result works as a prop or dependency without
+  // re-rendering consumers on unrelated parent renders.
+  return useMemo(
+    () => ({
+      status,
+      isSignedIn: accessToken !== undefined,
+      versionCode,
+      error,
+      errorCode,
+      preloadGoogle,
+      signInWithGoogle,
+      publish,
+      reset,
+    }),
+    [status, accessToken, versionCode, error, errorCode, preloadGoogle, signInWithGoogle, publish, reset],
+  );
 }

package/vite.config.ts

@@ -13,6 +13,7 @@ export default defineConfig({
         index: resolve(__dirname, 'src/index.ts'),
         'app-store-relay/index': resolve(__dirname, 'src/app-store-relay/index.ts'),
         'app-store-relay/react': resolve(__dirname, 'src/app-store-relay/react.ts'),
+        'apple-credentials/index': resolve(__dirname, 'src/apple-credentials/index.ts'),
         'device-build/index': resolve(__dirname, 'src/device-build/index.ts'),
         'device-build/react': resolve(__dirname, 'src/device-build/react.ts'),
         'device-install/index': resolve(__dirname, 'src/device-install/index.ts'),

package/dist/browser-storage-Cx9eW-bm.mjs

@@ -1,205 +0,0 @@
-const v = "limbuild-device-pairing";
-const d = "pairRecords", w = "limbuild-device-signing";
-const c = "signingAssets";
-function l(e) {
-  return (e ?? "").replace(/-/g, "").replace(/[^a-fA-F0-9]/g, "");
-}
-function f(e) {
-  return (e ?? "").trim();
-}
-async function R(e) {
-  const n = l(e);
-  if (!n) return;
-  const r = await p(v, 1, d, "udid");
-  return g(
-    r.transaction(d, "readonly").objectStore(d).get(n)
-  );
-}
-async function G(e, n = {}) {
-  const r = l(e.udid);
-  if (!r) throw new Error("Cannot store pair record without a UDID.");
-  const t = {
-    ...e,
-    udid: r,
-    productName: n.productName,
-    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-  }, i = await p(v, 1, d, "udid");
-  return await g(
-    i.transaction(d, "readwrite").objectStore(d).put(t)
-  ), t;
-}
-async function O({
-  deviceUDID: e,
-  bundleID: n,
-  signingMode: r = "development"
-}) {
-  const t = f(n);
-  if (!t) return;
-  const i = l(e), s = await S(D("bundle", t, r));
-  if (s) return s;
-  if (i) {
-    const o = await S(D(i, t, r));
-    if (o) return o;
-  }
-  return (await h(t, r))[0];
-}
-async function T(e = "development") {
-  return (await m()).filter((r) => (r.signingMode ?? "development") === e).sort((r, t) => new Date(t.updatedAt).getTime() - new Date(r.updatedAt).getTime())[0];
-}
-async function V(e, n = "development") {
-  return (await m()).filter((t) => !t.certificateID || !t.certificateP12Base64 || (t.signingMode ?? "development") !== n ? !1 : !e || !t.teamID || t.teamID === e).sort((t, i) => new Date(i.updatedAt).getTime() - new Date(t.updatedAt).getTime())[0];
-}
-async function z(e) {
-  const n = f(e.bundleID);
-  if (!n)
-    throw new Error("Cannot store signing assets without a bundle ID.");
-  const r = l(e.deviceUDID), t = e.signingMode ?? "development", i = D("bundle", n, t), s = {
-    ...e,
-    id: i,
-    deviceUDID: r || void 0,
-    signingMode: t,
-    bundleID: n,
-    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-  }, a = await p(w, 1, c, "id");
-  return await g(
-    a.transaction(c, "readwrite").objectStore(c).put(s)
-  ), s;
-}
-async function h(e, n = "development") {
-  const r = f(e);
-  return r ? (await m()).filter(
-    (i) => i.bundleID === r && (i.signingMode ?? "development") === n
-  ) : [];
-}
-function U(e, n) {
-  const r = l(n);
-  return !!r && e.provisionedDevices.some((t) => l(t) === r);
-}
-function j(e, n) {
-  const r = f(n), t = f(e.bundleID);
-  if (!r || !t) return !1;
-  if (t === r || t === "*") return !0;
-  if (!t.endsWith(".*")) return !1;
-  const i = t.slice(0, -1);
-  return r.startsWith(i);
-}
-async function M(e) {
-  return E(new Uint8Array(await e.arrayBuffer()));
-}
-function C(e) {
-  const n = atob(e), r = new Uint8Array(n.length);
-  for (let t = 0; t < n.length; t += 1)
-    r[t] = n.charCodeAt(t);
-  return E(r);
-}
-function E(e) {
-  const n = new TextDecoder("latin1").decode(e), r = n.indexOf("<?xml"), t = n.indexOf("</plist>");
-  if (r < 0 || t < r)
-    throw new Error("Provisioning profile plist not found.");
-  const i = n.slice(r, t + 8);
-  if (/<!ENTITY/i.test(i))
-    throw new Error("Provisioning profile plist contains a disallowed ENTITY declaration.");
-  const s = new DOMParser().parseFromString(i, "application/xml");
-  if (s.querySelector("parsererror"))
-    throw new Error("Provisioning profile plist could not be parsed.");
-  const a = s.querySelector("plist > dict");
-  if (!a)
-    throw new Error("Provisioning profile plist dictionary not found.");
-  const o = A(a);
-  if (!b(o))
-    throw new Error("Provisioning profile plist has an unexpected shape.");
-  const I = b(o.Entitlements) ? o.Entitlements : {}, y = u(I["application-identifier"]), P = B(y);
-  return {
-    name: u(o.Name),
-    uuid: u(o.UUID),
-    teamID: u(I["com.apple.developer.team-identifier"]) ?? N(o.TeamIdentifier)[0],
-    applicationIdentifier: y,
-    bundleID: P,
-    provisionedDevices: N(o.ProvisionedDevices),
-    getTaskAllow: _(I["get-task-allow"]),
-    expirationDate: u(o.ExpirationDate)
-  };
-}
-async function S(e) {
-  if (!e) return;
-  const n = await p(w, 1, c, "id");
-  return g(
-    n.transaction(c, "readonly").objectStore(c).get(e)
-  );
-}
-async function m() {
-  const e = await p(w, 1, c, "id");
-  return g(
-    e.transaction(c, "readonly").objectStore(c).getAll()
-  );
-}
-function D(e, n, r) {
-  return `${r}:${e}:${n}`;
-}
-function B(e) {
-  if (!e) return;
-  const n = e.indexOf(".");
-  return n >= 0 ? e.slice(n + 1) : void 0;
-}
-function A(e) {
-  switch (e.tagName) {
-    case "dict":
-      return x(e);
-    case "array":
-      return Array.from(e.children).map(A);
-    case "string":
-    case "date":
-      return e.textContent ?? "";
-    default:
-      return e.textContent ?? "";
-  }
-}
-function x(e) {
-  const n = {}, r = Array.from(e.children);
-  for (let t = 0; t < r.length; t += 2) {
-    const i = r[t], s = r[t + 1];
-    !i || i.tagName !== "key" || !s || (n[i.textContent ?? ""] = A(s));
-  }
-  return n;
-}
-function u(e) {
-  return typeof e == "string" && e ? e : void 0;
-}
-function N(e) {
-  return Array.isArray(e) ? e.filter((n) => typeof n == "string") : [];
-}
-function _(e) {
-  return typeof e == "boolean" ? e : void 0;
-}
-function b(e) {
-  return typeof e == "object" && e !== null && !Array.isArray(e);
-}
-function p(e, n, r, t) {
-  return new Promise((i, s) => {
-    const a = indexedDB.open(e, n);
-    a.onupgradeneeded = () => {
-      const o = a.result;
-      o.objectStoreNames.contains(r) || o.createObjectStore(r, { keyPath: t });
-    }, a.onsuccess = () => i(a.result), a.onerror = () => s(a.error ?? new Error("Open IndexedDB failed"));
-  });
-}
-function g(e) {
-  return new Promise((n, r) => {
-    e.onsuccess = () => n(e.result), e.onerror = () => r(e.error ?? new Error("IndexedDB request failed"));
-  });
-}
-export {
-  z as a,
-  j as b,
-  U as c,
-  V as d,
-  O as e,
-  C as f,
-  T as g,
-  E as h,
-  f as i,
-  R as j,
-  G as k,
-  l as n,
-  M as p
-};

package/dist/browser-storage-jJaIht4K.js

@@ -1 +0,0 @@
-"use strict";const b="limbuild-device-pairing";const l="pairRecords",w="limbuild-device-signing";const c="signingAssets";function d(e){return(e??"").replace(/-/g,"").replace(/[^a-fA-F0-9]/g,"")}function u(e){return(e??"").trim()}async function E(e){const n=d(e);if(!n)return;const r=await g(b,1,l,"udid");return p(r.transaction(l,"readonly").objectStore(l).get(n))}async function h(e,n={}){const r=d(e.udid);if(!r)throw new Error("Cannot store pair record without a UDID.");const t={...e,udid:r,productName:n.productName,updatedAt:new Date().toISOString()},i=await g(b,1,l,"udid");return await p(i.transaction(l,"readwrite").objectStore(l).put(t)),t}async function x({deviceUDID:e,bundleID:n,signingMode:r="development"}){const t=u(n);if(!t)return;const i=d(e),s=await v(I("bundle",t,r));if(s)return s;if(i){const o=await v(I(i,t,r));if(o)return o}return(await O(t,r))[0]}async function _(e="development"){return(await A()).filter(r=>(r.signingMode??"development")===e).sort((r,t)=>new Date(t.updatedAt).getTime()-new Date(r.updatedAt).getTime())[0]}async function R(e,n="development"){return(await A()).filter(t=>!t.certificateID||!t.certificateP12Base64||(t.signingMode??"development")!==n?!1:!e||!t.teamID||t.teamID===e).sort((t,i)=>new Date(i.updatedAt).getTime()-new Date(t.updatedAt).getTime())[0]}async function G(e){const n=u(e.bundleID);if(!n)throw new Error("Cannot store signing assets without a bundle ID.");const r=d(e.deviceUDID),t=e.signingMode??"development",i=I("bundle",n,t),s={...e,id:i,deviceUDID:r||void 0,signingMode:t,bundleID:n,updatedAt:new Date().toISOString()},a=await g(w,1,c,"id");return await p(a.transaction(c,"readwrite").objectStore(c).put(s)),s}async function O(e,n="development"){const r=u(e);return r?(await A()).filter(i=>i.bundleID===r&&(i.signingMode??"development")===n):[]}function T(e,n){const r=d(n);return!!r&&e.provisionedDevices.some(t=>d(t)===r)}function z(e,n){const r=u(n),t=u(e.bundleID);if(!r||!t)return!1;if(t===r||t==="*")return!0;if(!t.endsWith(".*"))return!1;const i=t.slice(0,-1);return r.startsWith(i)}async function U(e){return m(new Uint8Array(await e.arrayBuffer()))}function V(e){const n=atob(e),r=new Uint8Array(n.length);for(let t=0;t<n.length;t+=1)r[t]=n.charCodeAt(t);return m(r)}function m(e){const n=new TextDecoder("latin1").decode(e),r=n.indexOf("<?xml"),t=n.indexOf("</plist>");if(r<0||t<r)throw new Error("Provisioning profile plist not found.");const i=n.slice(r,t+8);if(/<!ENTITY/i.test(i))throw new Error("Provisioning profile plist contains a disallowed ENTITY declaration.");const s=new DOMParser().parseFromString(i,"application/xml");if(s.querySelector("parsererror"))throw new Error("Provisioning profile plist could not be parsed.");const a=s.querySelector("plist > dict");if(!a)throw new Error("Provisioning profile plist dictionary not found.");const o=S(a);if(!P(o))throw new Error("Provisioning profile plist has an unexpected shape.");const D=P(o.Entitlements)?o.Entitlements:{},y=f(D["application-identifier"]),B=C(y);return{name:f(o.Name),uuid:f(o.UUID),teamID:f(D["com.apple.developer.team-identifier"])??N(o.TeamIdentifier)[0],applicationIdentifier:y,bundleID:B,provisionedDevices:N(o.ProvisionedDevices),getTaskAllow:j(D["get-task-allow"]),expirationDate:f(o.ExpirationDate)}}async function v(e){if(!e)return;const n=await g(w,1,c,"id");return p(n.transaction(c,"readonly").objectStore(c).get(e))}async function A(){const e=await g(w,1,c,"id");return p(e.transaction(c,"readonly").objectStore(c).getAll())}function I(e,n,r){return`${r}:${e}:${n}`}function C(e){if(!e)return;const n=e.indexOf(".");return n>=0?e.slice(n+1):void 0}function S(e){switch(e.tagName){case"dict":return M(e);case"array":return Array.from(e.children).map(S);case"string":case"date":return e.textContent??"";default:return e.textContent??""}}function M(e){const n={},r=Array.from(e.children);for(let t=0;t<r.length;t+=2){const i=r[t],s=r[t+1];!i||i.tagName!=="key"||!s||(n[i.textContent??""]=S(s))}return n}function f(e){return typeof e=="string"&&e?e:void 0}function N(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function j(e){return typeof e=="boolean"?e:void 0}function P(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function g(e,n,r,t){return new Promise((i,s)=>{const a=indexedDB.open(e,n);a.onupgradeneeded=()=>{const o=a.result;o.objectStoreNames.contains(r)||o.createObjectStore(r,{keyPath:t})},a.onsuccess=()=>i(a.result),a.onerror=()=>s(a.error??new Error("Open IndexedDB failed"))})}function p(e){return new Promise((n,r)=>{e.onsuccess=()=>n(e.result),e.onerror=()=>r(e.error??new Error("IndexedDB request failed"))})}exports.getLatestSigningAssets=_;exports.getLatestSigningAssetsWithCertificate=R;exports.getPairRecord=E;exports.getSigningAssets=x;exports.normalizeBundleID=u;exports.normalizeUDID=d;exports.parseProvisioningProfile=U;exports.parseProvisioningProfileBase64=V;exports.parseProvisioningProfileBytes=m;exports.profileContainsDevice=T;exports.profileMatchesBundleID=z;exports.putPairRecord=h;exports.putSigningAssets=G;

package/dist/client-BtC4n_qf.js

@@ -1 +0,0 @@
-"use strict";const F=require("./index-CMeQfhYy.js");class m{constructor(t,r,o){this.apiUrl=t,this.token=r,this.organizationId=o}socket;nextId=1;pending=new Map;async connect(){if(this.socket&&this.socket.readyState===WebSocket.OPEN)return;const t=new WebSocket(E(this.apiUrl,this.token,this.organizationId));this.socket=t,t.onmessage=r=>this.handleMessage(r),t.onclose=()=>this.rejectPending(new Error("Apple relay WebSocket closed")),t.onerror=()=>this.rejectPending(new Error("Apple relay WebSocket failed")),await new Promise((r,o)=>{t.onopen=()=>r(),t.onerror=()=>o(new Error("Apple relay WebSocket connection failed"))})}request(t,r){const o=this.socket;if(!o||o.readyState!==WebSocket.OPEN)throw new Error("Apple relay WebSocket is not connected.");const a=String(this.nextId++),n=new Promise((p,i)=>{this.pending.set(a,{resolve:h=>p(q(h)),reject:i})});return o.send(JSON.stringify({id:a,type:t,...r===void 0?{}:{payload:r}})),n}close(){this.rejectPending(new Error("Apple relay WebSocket closed")),this.socket?.close(),this.socket=void 0}handleMessage(t){const r=JSON.parse(String(t.data)),o=this.pending.get(r.id);if(o){if(this.pending.delete(r.id),!r.ok){o.reject(new Error(r.error||"Apple relay request failed"));return}if(!r.response){o.reject(new Error("Apple relay response was empty."));return}o.resolve(r.response)}}rejectPending(t){for(const r of this.pending.values())r.reject(t);this.pending.clear()}}async function g(e,t,r){const o=new m(e,t,r);return await o.connect(),o}async function A(e,t){return e.request("srpInit",t)}async function S(e,t){return e.request("srpComplete",t)}async function P(e){return e.request("triggerTrustedDevice2FA")}async function b(e,t,r="sms"){return e.request("triggerPhone2FA",{phoneNumberId:t,mode:r})}async function k(e,t){return e.request("submitTrustedDevice2FA",{code:t})}async function T(e,t,r,o="sms"){return e.request("submitPhone2FA",{phoneNumberId:t,mode:o,code:r})}async function v(e){return e.request("finalize")}async function R(e,t){return e.request("provisioning",t)}function q(e){if(e.body!==void 0||!e.rawBody)return e;try{return{...e,body:JSON.parse(e.rawBody)}}catch{return e}}function E(e,t,r){const o=new URL(e);return o.protocol=o.protocol==="https:"?"wss:":"ws:",o.pathname=`${o.pathname.replace(/\/$/,"")}/ios/appstoreconnect/ws`,t&&o.searchParams.set("token",t),r&&o.searchParams.set("organization",r),o.toString()}async function x({registryApiUrl:e,accountName:t,password:r,token:o,organizationId:a}){const n=await g(e,o,a);try{const p=new F.AppleGsaSrpClient(t),i=await A(n,await p.init());if(i.status<200||i.status>=300)throw new Error(`Apple SRP init failed: HTTP ${i.status} ${i.rawBody??""}`.trim());if(!i.body)throw new Error("Apple SRP init response did not include a body.");const h=await p.complete(r,i.body),u=await S(n,{...h,rememberMe:!1,trustTokens:[]}),y=u.status===409;let s,d={type:"trustedDevice"};if(y){s=await P(n);const c=N(s.body);if(s.status===412){if(!c)throw new Error("Apple requested phone verification but did not include a trusted phone number.");d={type:"phone",phoneNumberId:c.id,mode:c.pushMode??"sms"},s=await b(n,c.id,c.pushMode??"sms")}if(s.status<200||s.status>=300)throw new Error(`Apple two-factor challenge failed: HTTP ${s.status} ${s.rawBody??""}`.trim())}else if(u.status<200||u.status>=300)throw new Error(`Apple SRP complete failed: HTTP ${u.status} ${u.rawBody??""}`.trim());return{relay:n,completeResponse:u,twoFactorChallengeResponse:s,requiresTwoFactor:y,finishTwoFactor:async c=>{const l=d.type==="phone"?await T(n,d.phoneNumberId,c,d.mode):await k(n,c);if(l.status<200||l.status>=300)throw new Error(`Apple two-factor code failed: HTTP ${l.status} ${l.rawBody??""}`.trim());return l},finalize:async()=>v(n),close:async()=>n.close()}}catch(p){throw n.close(),p}}function N(e){if(!f(e))return;const t=f(e.phoneNumberVerification)?e.phoneNumberVerification:void 0,r=w(t?.trustedPhoneNumber)??w(e.trustedPhoneNumber)??w(e.phoneNumber);if(!r)return;const o=r.id;if(typeof o!="number")return;const a=typeof r.pushMode=="string"?r.pushMode:typeof e.mode=="string"?e.mode:void 0;return{id:o,pushMode:a}}function w(e){return f(e)?e:void 0}function f(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}exports.AppleRelayWebSocketClient=m;exports.fetchAppleAccountSession=v;exports.openAppleRelayWebSocket=g;exports.proxyPhoneTwoFactorCode=T;exports.proxyProvisioningRequest=R;exports.proxySrpComplete=S;exports.proxySrpInit=A;exports.proxyTwoFactorCode=k;exports.startBrowserOwnedAppleIDLogin=x;exports.triggerPhoneTwoFactor=b;exports.triggerTrustedDeviceTwoFactor=P;