@limrun/ui 0.14.0-rc.4 → 0.14.0-rc.5

package/dist/app-store-relay/react.cjs

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const t=require("react"),y=require("../client-D1drDXxE.js");require("../index-ChhtuQ7e.js");require("../gsa-srp-CCIfUz7Y.js");const w=require("../errors-BSkqS7U-.js");function m({registryApiUrl:i,token:u,organizationId:l}){const[g,o]=t.useState("idle"),[h,a]=t.useState(),[v,d]=t.useState(),[f,p]=t.useState(),[S,n]=t.useState(),r=t.useRef(void 0),b=t.useCallback(async()=>{await r.current?.close().catch(()=>{}),r.current=void 0,a(void 0),d(void 0),p(void 0),n(void 0),o("idle")},[]);t.useEffect(()=>()=>{r.current?.close(),r.current=void 0},[]);const C=t.useCallback(async({accountName:s,password:c})=>{o("authenticating"),n(void 0),await r.current?.close().catch(()=>{});try{const e=await y.startBrowserOwnedAppleIDLogin({registryApiUrl:i,token:u,organizationId:l,accountName:s,password:c});return r.current=e,a(e),d(e.completeResponse),p(e.twoFactorChallengeResponse),o(e.requiresTwoFactor?"two-factor-required":"authenticated"),e}catch(e){a(void 0),r.current=void 0,n(w.errorMessage(e)),o("error");return}},[i,l,u]),R=t.useCallback(async s=>{const c=r.current;if(!c)throw new Error("Start Apple ID login before submitting a two-factor code.");o("authenticating"),n(void 0);try{const e=await c.finishTwoFactor(s);return o("authenticated"),e}catch(e){n(w.errorMessage(e)),o("error");return}},[]),q=t.useCallback(async()=>{const s=r.current;if(!s)throw new Error("Start Apple ID login before finalizing the Apple session.");return s.finalize()},[]);return{status:g,session:h,completeResponse:v,twoFactorChallengeResponse:f,error:S,startLogin:C,submitTwoFactorCode:R,finalize:q,close:b}}exports.useAppleIDLogin=m;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const t=require("react"),y=require("../client-C9z_sgOf.js");require("../index-ChhtuQ7e.js");require("../gsa-srp-CCIfUz7Y.js");const w=require("../errors-BSkqS7U-.js");function m({registryApiUrl:i,token:u,organizationId:l}){const[g,o]=t.useState("idle"),[h,a]=t.useState(),[v,d]=t.useState(),[f,p]=t.useState(),[S,n]=t.useState(),r=t.useRef(void 0),b=t.useCallback(async()=>{await r.current?.close().catch(()=>{}),r.current=void 0,a(void 0),d(void 0),p(void 0),n(void 0),o("idle")},[]);t.useEffect(()=>()=>{r.current?.close(),r.current=void 0},[]);const C=t.useCallback(async({accountName:s,password:c})=>{o("authenticating"),n(void 0),await r.current?.close().catch(()=>{});try{const e=await y.startBrowserOwnedAppleIDLogin({registryApiUrl:i,token:u,organizationId:l,accountName:s,password:c});return r.current=e,a(e),d(e.completeResponse),p(e.twoFactorChallengeResponse),o(e.requiresTwoFactor?"two-factor-required":"authenticated"),e}catch(e){a(void 0),r.current=void 0,n(w.errorMessage(e)),o("error");return}},[i,l,u]),R=t.useCallback(async s=>{const c=r.current;if(!c)throw new Error("Start Apple ID login before submitting a two-factor code.");o("authenticating"),n(void 0);try{const e=await c.finishTwoFactor(s);return o("authenticated"),e}catch(e){n(w.errorMessage(e)),o("error");return}},[]),q=t.useCallback(async()=>{const s=r.current;if(!s)throw new Error("Start Apple ID login before finalizing the Apple session.");return s.finalize()},[]);return{status:g,session:h,completeResponse:v,twoFactorChallengeResponse:f,error:S,startLogin:C,submitTwoFactorCode:R,finalize:q,close:b}}exports.useAppleIDLogin=m;

package/dist/app-store-relay/react.js

@@ -1,5 +1,5 @@
 import { useState as n, useRef as S, useCallback as i, useEffect as A } from "react";
-import { s as D } from "../client-DSuNtWDv.mjs";
+import { s as D } from "../client-CFDB4mX5.mjs";
 import "../index-YDu8K9a4.mjs";
 import "../gsa-srp-Bme3JLEi.mjs";
 import { e as w } from "../errors-gy8yQJos.mjs";

package/dist/apple-credentials/index.cjs

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const S=require("../app-store-relay/index.cjs"),E=require("../browser-storage-DLxIqZk5.js"),A="appleCertificate",P="appleProvisioningProfile";function b(r){const e={};for(const[o,i]of Object.entries(r))i&&(e[o]=i);return e}async function T(r,e,o){return r.put(A,e,b(o))}async function I(r,e,o){return r.put(P,e,b(o))}function R(r){const e=r.fetch??fetch.bind(globalThis),o=r.apiUrl.replace(/\/+$/,""),i=(t,s)=>`${o}/v1/organizations/${encodeURIComponent(r.organizationId)}/secrets/${encodeURIComponent(t)}/${encodeURIComponent(s)}`,c={Authorization:`Bearer ${r.token}`,"Content-Type":"application/json"};async function a(t,s){let n=`${t.status}`;try{const d=await t.json();d.message&&(n=d.message)}catch{}throw new Error(`Failed to ${s} secret: ${n}`)}return{async put(t,s,n){const d=await e(i(t,s),{method:"PUT",headers:c,body:JSON.stringify({data:n,replace:!0})});d.ok||await a(d,"store");const f=await d.json();return{type:f.type,name:f.name,createdAt:f.createdAt,data:f.data}},async get(t,s){const n=await e(i(t,s),{method:"GET",headers:c});if(n.status===404)return;n.ok||await a(n,"fetch");const d=await n.json();return{type:d.type,name:d.name,createdAt:d.createdAt,data:d.data}},async list(){const t=await e(`${o}/v1/organizations/${encodeURIComponent(r.organizationId)}/secrets`,{method:"GET",headers:c});return t.ok||await a(t,"list"),(await t.json()).filter(n=>n.type===A||n.type===P).map(n=>({type:n.type,name:n.name,createdAt:n.createdAt}))},async delete(t,s){const n=await e(i(t,s),{method:"DELETE",headers:c});n.status!==404&&(n.ok||await a(n,"delete"))}}}const B="limrun-signing-secrets",$=1,p="secrets";function _(){const r=(i,c)=>`${i}:${c}`;function e(){return new Promise((i,c)=>{const a=indexedDB.open(B,$);a.onupgradeneeded=()=>{const t=a.result;t.objectStoreNames.contains(p)||t.createObjectStore(p,{keyPath:"id"})},a.onsuccess=()=>i(a.result),a.onerror=()=>c(a.error??new Error("Open IndexedDB failed"))})}function o(i){return new Promise((c,a)=>{i.onsuccess=()=>c(i.result),i.onerror=()=>a(i.error??new Error("IndexedDB request failed"))})}return{async put(i,c,a){const t=await e(),s=await o(t.transaction(p,"readonly").objectStore(p).get(r(i,c))),n={id:r(i,c),type:i,name:c,data:a,createdAt:s?.createdAt??new Date().toISOString()};return await o(t.transaction(p,"readwrite").objectStore(p).put(n)),{type:i,name:c,createdAt:n.createdAt,data:a}},async get(i,c){const a=await e(),t=await o(a.transaction(p,"readonly").objectStore(p).get(r(i,c)));if(t)return{type:t.type,name:t.name,createdAt:t.createdAt,data:t.data}},async list(){const i=await e();return(await o(i.transaction(p,"readonly").objectStore(p).getAll())).map(a=>({type:a.type,name:a.name,createdAt:a.createdAt}))},async delete(i,c){const a=await e();await o(a.transaction(p,"readwrite").objectStore(p).delete(r(i,c)))}}}function h(r,e){return`${r}/${e}`}async function N({relay:r,teamId:e,secretStore:o,commonName:i,log:c=()=>{}}){const a="DEVELOPMENT",t=h(e,a),s=await S.listAppleCertificates({relay:r,teamId:e,certificateKind:"development"}),n=u=>u===void 0?void 0:s.find(m=>l(m,"certificateId")===u||l(m,"certRequestId")===u),d=await o.get(A,t),f=l(d?.data,"certificateID");if(d&&f&&d.data.certificateP12Base64){const u=n(f);if(u){const m=l(u,"certificateId")??f;return c("Reusing stored Apple certificate",m),{secret:d,certificateId:m,created:!1}}c("Stored certificate is no longer on the team","Minting a new one.")}const g=await S.generateAppleSigningKeyAndCSR({commonName:i??`Limrun ${e}`}),y=await S.createAppleCertificate({relay:r,teamId:e,certificateKind:"development",csrPEM:g.csrPEM}),w=l(y,"certificateId")??l(y,"certRequestId");if(!w)throw new Error("Apple certificate creation did not return a certificate ID.");const v=await S.downloadAppleCertificate({relay:r,teamId:e,certificateKind:"development",certificateId:w});if(!v.rawBodyBase64)throw new Error("Apple certificate download returned no bytes.");const D={certificateP12Base64:S.exportAppleCertificateP12({privateKeyPKCS8Base64:g.privateKeyPKCS8Base64,certificateBase64:v.rawBodyBase64,password:"",friendlyName:`Apple Development ${e}`}),certificateType:a,teamID:e,certificateID:w,serialNumber:E.normalizeCertificateSerial(l(y,"serialNum")),expirationDate:l(y,"expirationDateString")};let C;try{C=await T(o,t,D)}catch(u){throw new Error(`Certificate ${w} was created on the Apple Developer portal but saving its private key to the secret store failed: ${O(u)}. The key cannot be recovered; revoke certificate ${w} at developer.apple.com before retrying, or the retry will mint another certificate against Apple's limit.`)}return c("Apple certificate stored",w),{secret:C,certificateId:w,created:!0}}function O(r){return r instanceof Error?r.message:String(r)}async function j({relay:r,teamId:e,profileId:o,secretStore:i,log:c=()=>{}}){const t=(await S.downloadAppleProfile({relay:r,teamId:e,profileId:o})).rawBodyBase64;if(!t)throw new Error("Apple provisioning profile download returned no bytes.");const s=E.parseProvisioningProfileBase64(t),n=`${e}/${s.uuid??o}`,d=await I(i,n,{provisioningProfileBase64:t,certificateSerialNumbers:s.certificateSerialNumbers.join(","),bundleIDs:s.bundleID,deviceIDs:s.provisionedDevices.join(","),teamID:s.teamID??e,profileName:s.name,uuid:s.uuid,expirationDate:s.expirationDate});return c("Apple provisioning profile stored",n),d}async function k({relay:r,teamId:e}){return S.listAppleProfiles({relay:r,teamId:e,profileKind:"development"})}function l(r,e){const o=r?.[e];if(typeof o=="string")return o;if(typeof o=="number"||typeof o=="boolean")return String(o)}exports.normalizeCertificateSerial=E.normalizeCertificateSerial;exports.APPLE_CERTIFICATE_SECRET_TYPE=A;exports.APPLE_PROVISIONING_PROFILE_SECRET_TYPE=P;exports.appleCertificateSecretName=h;exports.createBrowserSecretStore=_;exports.createLimrunSecretStore=R;exports.ensureAppleCertificateSecret=N;exports.listTeamAppleProfiles=k;exports.putAppleCertificateSecret=T;exports.putAppleProvisioningProfileSecret=I;exports.saveAppleProfileSecret=j;exports.stringField=l;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const u=require("../app-store-relay/index.cjs"),T=require("../browser-storage-DLxIqZk5.js"),v="appleCertificate",b="appleProvisioningProfile",I="appStoreConnectApiKey";function h(e){const t={};for(const[o,r]of Object.entries(e))r&&(t[o]=r);return t}async function _(e,t,o){return e.put(v,t,h(o))}async function R(e,t,o){return e.put(b,t,h(o))}async function D(e,t,o){return e.put(I,t,h(o))}function B(e){const t=e.fetch??fetch.bind(globalThis),o=e.apiUrl.replace(/\/+$/,""),r=(n,s)=>`${o}/v1/organizations/${encodeURIComponent(e.organizationId)}/secrets/${encodeURIComponent(n)}/${encodeURIComponent(s)}`,c={Authorization:`Bearer ${e.token}`,"Content-Type":"application/json"};async function a(n,s){let i=`${n.status}`;try{const p=await n.json();p.message&&(i=p.message)}catch{}throw new Error(`Failed to ${s} secret: ${i}`)}return{async put(n,s,i){const p=await t(r(n,s),{method:"PUT",headers:c,body:JSON.stringify({data:i,replace:!0})});p.ok||await a(p,"store");const d=await p.json();return{type:d.type,name:d.name,createdAt:d.createdAt,data:d.data}},async get(n,s){const i=await t(r(n,s),{method:"GET",headers:c});if(i.status===404)return;i.ok||await a(i,"fetch");const p=await i.json();return{type:p.type,name:p.name,createdAt:p.createdAt,data:p.data}},async list(){const n=await t(`${o}/v1/organizations/${encodeURIComponent(e.organizationId)}/secrets`,{method:"GET",headers:c});return n.ok||await a(n,"list"),(await n.json()).filter(i=>i.type===v||i.type===b||i.type===I).map(i=>({type:i.type,name:i.name,createdAt:i.createdAt}))},async delete(n,s){const i=await t(r(n,s),{method:"DELETE",headers:c});i.status!==404&&(i.ok||await a(i,"delete"))}}}const O="limrun-signing-secrets",K=1,l="secrets";function j(){const e=(r,c)=>`${r}:${c}`;function t(){return new Promise((r,c)=>{const a=indexedDB.open(O,K);a.onupgradeneeded=()=>{const n=a.result;n.objectStoreNames.contains(l)||n.createObjectStore(l,{keyPath:"id"})},a.onsuccess=()=>r(a.result),a.onerror=()=>c(a.error??new Error("Open IndexedDB failed"))})}function o(r){return new Promise((c,a)=>{r.onsuccess=()=>c(r.result),r.onerror=()=>a(r.error??new Error("IndexedDB request failed"))})}return{async put(r,c,a){const n=await t(),s=await o(n.transaction(l,"readonly").objectStore(l).get(e(r,c))),i={id:e(r,c),type:r,name:c,data:a,createdAt:s?.createdAt??new Date().toISOString()};return await o(n.transaction(l,"readwrite").objectStore(l).put(i)),{type:r,name:c,createdAt:i.createdAt,data:a}},async get(r,c){const a=await t(),n=await o(a.transaction(l,"readonly").objectStore(l).get(e(r,c)));if(n)return{type:n.type,name:n.name,createdAt:n.createdAt,data:n.data}},async list(){const r=await t();return(await o(r.transaction(l,"readonly").objectStore(l).getAll())).map(a=>({type:a.type,name:a.name,createdAt:a.createdAt}))},async delete(r,c){const a=await t();await o(a.transaction(l,"readwrite").objectStore(l).delete(e(r,c)))}}}function N(e,t){return`${e}/${t}`}async function x({relay:e,teamId:t,secretStore:o,certificateKind:r="development",commonName:c,log:a=()=>{}}){const n=r==="distribution"?"DISTRIBUTION":"DEVELOPMENT",s=N(t,n),i=await u.listAppleCertificates({relay:e,teamId:t,certificateKind:r}),p=S=>S===void 0?void 0:i.find(C=>f(C,"certificateId")===S||f(C,"certRequestId")===S),d=await o.get(v,s),m=f(d?.data,"certificateID");if(d&&m&&d.data.certificateP12Base64){const S=p(m);if(S){const C=f(S,"certificateId")??m;return a("Reusing stored Apple certificate",C),{secret:d,certificateId:C,created:!1}}a("Stored certificate is no longer on the team","Minting a new one.")}const y=await u.generateAppleSigningKeyAndCSR({commonName:c??`Limrun ${t}`}),w=await u.createAppleCertificate({relay:e,teamId:t,certificateKind:r,csrPEM:y.csrPEM}),A=f(w,"certificateId")??f(w,"certRequestId");if(!A)throw new Error("Apple certificate creation did not return a certificate ID.");const E=await u.downloadAppleCertificate({relay:e,teamId:t,certificateKind:r,certificateId:A});if(!E.rawBodyBase64)throw new Error("Apple certificate download returned no bytes.");const g={certificateP12Base64:u.exportAppleCertificateP12({privateKeyPKCS8Base64:y.privateKeyPKCS8Base64,certificateBase64:E.rawBodyBase64,password:"",friendlyName:`Apple ${r==="distribution"?"Distribution":"Development"} ${t}`}),certificateType:n,teamID:t,certificateID:A,serialNumber:T.normalizeCertificateSerial(f(w,"serialNum")),expirationDate:f(w,"expirationDateString")};let P;try{P=await _(o,s,g)}catch(S){throw new Error(`Certificate ${A} was created on the Apple Developer portal but saving its private key to the secret store failed: ${k(S)}. The key cannot be recovered; revoke certificate ${A} at developer.apple.com before retrying, or the retry will mint another certificate against Apple's limit.`)}return a("Apple certificate stored",A),{secret:P,certificateId:A,created:!0}}function k(e){return e instanceof Error?e.message:String(e)}async function L({relay:e,teamId:t,profileId:o,secretStore:r,log:c=()=>{}}){const n=(await u.downloadAppleProfile({relay:e,teamId:t,profileId:o})).rawBodyBase64;if(!n)throw new Error("Apple provisioning profile download returned no bytes.");const s=T.parseProvisioningProfileBase64(n),i=`${t}/${s.uuid??o}`,p=await R(r,i,{provisioningProfileBase64:n,certificateSerialNumbers:s.certificateSerialNumbers.join(","),bundleIDs:s.bundleID,deviceIDs:s.provisionedDevices.join(","),teamID:s.teamID??t,profileName:s.name,uuid:s.uuid,expirationDate:s.expirationDate});return c("Apple provisioning profile stored",i),p}function $(e){return`${e}/APP_STORE_CONNECT_API_KEY`}async function F({relay:e,teamId:t,providerId:o,secretStore:r,nickname:c,roles:a,log:n=()=>{}}){if(!c)throw new Error("A nickname is required to ensure an App Store Connect API key.");o!==void 0&&await u.switchAppStoreConnectProvider({relay:e,providerId:o});const s=$(t),i=await u.listAppStoreConnectApiKeys({relay:e}),p=await r.get(I,s),d=f(p?.data,"keyId");if(p&&d&&p.data.privateKeyP8Base64){if(i.find(P=>P.id===d&&!Y(P.attributes)))return n("Reusing stored App Store Connect API key",d),{secret:p,keyId:d,created:!1};n("Stored App Store Connect API key is no longer active","Minting a new one.")}const y=(await u.createAppStoreConnectApiKey({relay:e,nickname:c,roles:a})).id,w=await u.downloadAppStoreConnectApiKeyPrivateKey({relay:e,keyId:y}),A={privateKeyP8Base64:z(w.privateKeyPem),keyId:y,issuerId:w.issuerId,nickname:c,teamID:t};let E;try{E=await D(r,s,A)}catch(g){throw new Error(`App Store Connect API key ${y} was created but saving its private key to the secret store failed: ${k(g)}. The key cannot be downloaded again; revoke key ${y} in App Store Connect before retrying, or the retry will mint another key.`)}return n("App Store Connect API key stored",y),{secret:E,keyId:y,created:!0}}function Y(e){if(!e)return!1;if(e.isActive===!1)return!0;const t=e.revokingDate??e.revocationDate;return typeof t=="string"&&t!==""}function z(e){const t=new TextEncoder().encode(e);let o="";for(const r of t)o+=String.fromCharCode(r);return btoa(o)}async function M({relay:e,teamId:t,profileKind:o="development"}){return u.listAppleProfiles({relay:e,teamId:t,profileKind:o})}function f(e,t){const o=e?.[t];if(typeof o=="string")return o;if(typeof o=="number"||typeof o=="boolean")return String(o)}exports.normalizeCertificateSerial=T.normalizeCertificateSerial;exports.APPLE_CERTIFICATE_SECRET_TYPE=v;exports.APPLE_PROVISIONING_PROFILE_SECRET_TYPE=b;exports.APP_STORE_CONNECT_API_KEY_SECRET_TYPE=I;exports.appStoreConnectApiKeySecretName=$;exports.appleCertificateSecretName=N;exports.createBrowserSecretStore=j;exports.createLimrunSecretStore=B;exports.ensureAppStoreConnectApiKeySecret=F;exports.ensureAppleCertificateSecret=x;exports.listTeamAppleProfiles=M;exports.putAppStoreConnectApiKeySecret=D;exports.putAppleCertificateSecret=_;exports.putAppleProvisioningProfileSecret=R;exports.saveAppleProfileSecret=L;exports.stringField=f;

package/dist/apple-credentials/index.d.ts

@@ -1,6 +1,7 @@
+import { AppleCertificateKind, AppleProfileKind, AppStoreConnectApiKeyRole } from '../app-store-relay';
 import { AppleRelayWebSocketClient } from '../core/device-install/apple';
 import { AppleCertificateType, SigningSecret, SigningSecretStore } from '../core/device-install/storage/secret-store';
-export { APPLE_CERTIFICATE_SECRET_TYPE, APPLE_PROVISIONING_PROFILE_SECRET_TYPE, createBrowserSecretStore, createLimrunSecretStore, putAppleCertificateSecret, putAppleProvisioningProfileSecret, type AppleCertificateSecretData, type AppleCertificateType, type AppleProvisioningProfileSecretData, type LimrunSecretStoreOptions, type SigningSecret, type SigningSecretData, type SigningSecretMetadata, type SigningSecretStore, type SigningSecretType, } from '../core/device-install/storage/secret-store';
+export { APP_STORE_CONNECT_API_KEY_SECRET_TYPE, APPLE_CERTIFICATE_SECRET_TYPE, APPLE_PROVISIONING_PROFILE_SECRET_TYPE, createBrowserSecretStore, createLimrunSecretStore, putAppleCertificateSecret, putAppleProvisioningProfileSecret, putAppStoreConnectApiKeySecret, type AppleCertificateSecretData, type AppleCertificateType, type AppleProvisioningProfileSecretData, type AppStoreConnectApiKeySecretData, type LimrunSecretStoreOptions, type SigningSecret, type SigningSecretData, type SigningSecretMetadata, type SigningSecretStore, type SigningSecretType, } from '../core/device-install/storage/secret-store';
 export { normalizeCertificateSerial } from '../core/device-install/storage/browser-storage';
 /**
  * Conventional secret name of a team's certificate bundle. One bundle per
@@ -12,6 +13,11 @@ export type EnsureAppleCertificateInput = {
     relay: AppleRelayWebSocketClient;
     teamId: string;
     secretStore: SigningSecretStore;
+    /**
+     * Which portal certificate kind to ensure. Ad-hoc and App Store signing
+     * both use the distribution certificate. Defaults to development.
+     */
+    certificateKind?: AppleCertificateKind;
     /** Common name used when minting a new certificate. */
     commonName?: string;
     log?: (message: string, detail?: string) => void;
@@ -23,16 +29,17 @@ export type EnsureAppleCertificateResult = {
     created: boolean;
 };
 /**
- * Returns a usable development certificate secret for the team, reusing the
- * stored one when its certificate is still on the team and minting a new
- * one otherwise. Apple caps development certificates at 2 and never returns
- * private keys, so reuse of the stored p12 is strongly preferred.
+ * Returns a usable certificate secret of the requested kind for the team,
+ * reusing the stored one when its certificate is still on the team and
+ * minting a new one otherwise. Apple caps certificates per kind (2 for
+ * development, 3 for distribution) and never returns private keys, so
+ * reuse of the stored p12 is strongly preferred.
  *
  * Durability of the stored material is the secret store's concern:
  * implementors who want retries or fallbacks build them into their
  * SigningSecretStore.
  */
-export declare function ensureAppleCertificateSecret({ relay, teamId, secretStore, commonName, log, }: EnsureAppleCertificateInput): Promise<EnsureAppleCertificateResult>;
+export declare function ensureAppleCertificateSecret({ relay, teamId, secretStore, certificateKind, commonName, log, }: EnsureAppleCertificateInput): Promise<EnsureAppleCertificateResult>;
 export type SaveAppleProfileInput = {
     relay: AppleRelayWebSocketClient;
     teamId: string;
@@ -49,11 +56,55 @@ export type SaveAppleProfileInput = {
  * consumers filter on.
  */
 export declare function saveAppleProfileSecret({ relay, teamId, profileId, secretStore, log, }: SaveAppleProfileInput): Promise<SigningSecret>;
+/**
+ * Conventional secret name of a team's App Store Connect API key: one
+ * shared key per team.
+ */
+export declare function appStoreConnectApiKeySecretName(teamId: string): string;
+export type EnsureAppStoreConnectApiKeyInput = {
+    relay: AppleRelayWebSocketClient;
+    teamId: string;
+    /**
+     * Numeric provider ID of the team from the Apple team list. When given,
+     * the App Store Connect session is switched to this provider first;
+     * required for accounts that belong to multiple teams.
+     */
+    providerId?: string | number;
+    secretStore: SigningSecretStore;
+    /** Display name for a newly minted key. Required; there is no default. */
+    nickname: string;
+    /** Roles of a newly minted key. Defaults to APP_MANAGER. */
+    roles?: AppStoreConnectApiKeyRole[];
+    log?: (message: string, detail?: string) => void;
+};
+export type EnsureAppStoreConnectApiKeyResult = {
+    secret: SigningSecret;
+    keyId: string;
+    /** True when a new key was minted instead of reusing the stored one. */
+    created: boolean;
+};
+/**
+ * Returns a usable App Store Connect API key secret for the team, reusing
+ * the stored one when its key is still active and minting a new one
+ * otherwise. Apple serves a key's private half exactly once (at creation
+ * time through the sparse fieldset download), so reuse of the stored .p8
+ * is strongly preferred.
+ *
+ * The session user must be a team Admin to list or create keys.
+ */
+export declare function ensureAppStoreConnectApiKeySecret({ relay, teamId, providerId, secretStore, nickname, roles, log, }: EnsureAppStoreConnectApiKeyInput): Promise<EnsureAppStoreConnectApiKeyResult>;
 export type ListTeamProfilesInput = {
     relay: AppleRelayWebSocketClient;
     teamId: string;
+    /**
+     * Which portal profile listing to use. The development listing is
+     * unfiltered on the portal side and returns profiles of every
+     * distribution method; adhoc narrows to ad-hoc profiles. Defaults to
+     * development.
+     */
+    profileKind?: AppleProfileKind;
 };
-/** Lists the team's development provisioning profiles from the portal. */
-export declare function listTeamAppleProfiles({ relay, teamId }: ListTeamProfilesInput): Promise<Record<string, unknown>[]>;
+/** Lists the team's provisioning profiles from the portal. */
+export declare function listTeamAppleProfiles({ relay, teamId, profileKind, }: ListTeamProfilesInput): Promise<Record<string, unknown>[]>;
 /** Read a string-ish value from a loosely typed portal record. */
 export declare function stringField(record: Record<string, unknown> | undefined, key: string): string | undefined;

package/dist/apple-credentials/index.js

@@ -1,227 +1,291 @@
-import { listAppleCertificates as h, generateAppleSigningKeyAndCSR as C, createAppleCertificate as D, downloadAppleCertificate as I, exportAppleCertificateP12 as T, downloadAppleProfile as $, listAppleProfiles as B } from "../app-store-relay/index.js";
-import { l as R, f as N } from "../browser-storage-BnO-Ma-e.mjs";
-const A = "appleCertificate", v = "appleProvisioningProfile";
-function P(r) {
-  const e = {};
-  for (const [o, n] of Object.entries(r))
-    n && (e[o] = n);
-  return e;
-}
-async function j(r, e, o) {
-  return r.put(A, e, P(o));
-}
-async function O(r, e, o) {
-  return r.put(v, e, P(o));
-}
-function z(r) {
-  const e = r.fetch ?? fetch.bind(globalThis), o = r.apiUrl.replace(/\/+$/, ""), n = (t, s) => `${o}/v1/organizations/${encodeURIComponent(r.organizationId)}/secrets/${encodeURIComponent(
-    t
+import { listAppleCertificates as T, generateAppleSigningKeyAndCSR as D, createAppleCertificate as k, downloadAppleCertificate as $, exportAppleCertificateP12 as B, downloadAppleProfile as N, switchAppStoreConnectProvider as R, listAppStoreConnectApiKeys as _, createAppStoreConnectApiKey as O, downloadAppStoreConnectApiKeyPrivateKey as j, listAppleProfiles as K } from "../app-store-relay/index.js";
+import { l as x, f as U } from "../browser-storage-BnO-Ma-e.mjs";
+const C = "appleCertificate", I = "appleProvisioningProfile", v = "appStoreConnectApiKey";
+function b(e) {
+  const t = {};
+  for (const [o, r] of Object.entries(e))
+    r && (t[o] = r);
+  return t;
+}
+async function L(e, t, o) {
+  return e.put(C, t, b(o));
+}
+async function M(e, t, o) {
+  return e.put(I, t, b(o));
+}
+async function z(e, t, o) {
+  return e.put(v, t, b(o));
+}
+function W(e) {
+  const t = e.fetch ?? fetch.bind(globalThis), o = e.apiUrl.replace(/\/+$/, ""), r = (n, s) => `${o}/v1/organizations/${encodeURIComponent(e.organizationId)}/secrets/${encodeURIComponent(
+    n
   )}/${encodeURIComponent(s)}`, c = {
-    Authorization: `Bearer ${r.token}`,
+    Authorization: `Bearer ${e.token}`,
     "Content-Type": "application/json"
   };
-  async function a(t, s) {
-    let i = `${t.status}`;
+  async function a(n, s) {
+    let i = `${n.status}`;
     try {
-      const d = await t.json();
+      const d = await n.json();
       d.message && (i = d.message);
     } catch {
     }
     throw new Error(`Failed to ${s} secret: ${i}`);
   }
   return {
-    async put(t, s, i) {
-      const d = await e(n(t, s), {
+    async put(n, s, i) {
+      const d = await t(r(n, s), {
         method: "PUT",
         headers: c,
         body: JSON.stringify({ data: i, replace: !0 })
       });
       d.ok || await a(d, "store");
-      const l = await d.json();
-      return { type: l.type, name: l.name, createdAt: l.createdAt, data: l.data };
+      const p = await d.json();
+      return { type: p.type, name: p.name, createdAt: p.createdAt, data: p.data };
     },
-    async get(t, s) {
-      const i = await e(n(t, s), { method: "GET", headers: c });
+    async get(n, s) {
+      const i = await t(r(n, s), { method: "GET", headers: c });
       if (i.status === 404) return;
       i.ok || await a(i, "fetch");
       const d = await i.json();
       return { type: d.type, name: d.name, createdAt: d.createdAt, data: d.data };
     },
     async list() {
-      const t = await e(
-        `${o}/v1/organizations/${encodeURIComponent(r.organizationId)}/secrets`,
+      const n = await t(
+        `${o}/v1/organizations/${encodeURIComponent(e.organizationId)}/secrets`,
         { method: "GET", headers: c }
       );
-      return t.ok || await a(t, "list"), (await t.json()).filter(
-        (i) => i.type === A || i.type === v
+      return n.ok || await a(n, "list"), (await n.json()).filter(
+        (i) => i.type === C || i.type === I || i.type === v
       ).map((i) => ({ type: i.type, name: i.name, createdAt: i.createdAt }));
     },
-    async delete(t, s) {
-      const i = await e(n(t, s), { method: "DELETE", headers: c });
+    async delete(n, s) {
+      const i = await t(r(n, s), { method: "DELETE", headers: c });
       i.status !== 404 && (i.ok || await a(i, "delete"));
     }
   };
 }
-const _ = "limrun-signing-secrets", k = 1, p = "secrets";
-function M() {
-  const r = (n, c) => `${n}:${c}`;
-  function e() {
-    return new Promise((n, c) => {
-      const a = indexedDB.open(_, k);
+const F = "limrun-signing-secrets", Y = 1, f = "secrets";
+function X() {
+  const e = (r, c) => `${r}:${c}`;
+  function t() {
+    return new Promise((r, c) => {
+      const a = indexedDB.open(F, Y);
       a.onupgradeneeded = () => {
-        const t = a.result;
-        t.objectStoreNames.contains(p) || t.createObjectStore(p, { keyPath: "id" });
-      }, a.onsuccess = () => n(a.result), a.onerror = () => c(a.error ?? new Error("Open IndexedDB failed"));
+        const n = a.result;
+        n.objectStoreNames.contains(f) || n.createObjectStore(f, { keyPath: "id" });
+      }, a.onsuccess = () => r(a.result), a.onerror = () => c(a.error ?? new Error("Open IndexedDB failed"));
     });
   }
-  function o(n) {
+  function o(r) {
     return new Promise((c, a) => {
-      n.onsuccess = () => c(n.result), n.onerror = () => a(n.error ?? new Error("IndexedDB request failed"));
+      r.onsuccess = () => c(r.result), r.onerror = () => a(r.error ?? new Error("IndexedDB request failed"));
     });
   }
   return {
-    async put(n, c, a) {
-      const t = await e(), s = await o(
-        t.transaction(p, "readonly").objectStore(p).get(r(n, c))
+    async put(r, c, a) {
+      const n = await t(), s = await o(
+        n.transaction(f, "readonly").objectStore(f).get(e(r, c))
       ), i = {
-        id: r(n, c),
-        type: n,
+        id: e(r, c),
+        type: r,
         name: c,
         data: a,
         createdAt: s?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
       };
       return await o(
-        t.transaction(p, "readwrite").objectStore(p).put(i)
-      ), { type: n, name: c, createdAt: i.createdAt, data: a };
+        n.transaction(f, "readwrite").objectStore(f).put(i)
+      ), { type: r, name: c, createdAt: i.createdAt, data: a };
     },
-    async get(n, c) {
-      const a = await e(), t = await o(
-        a.transaction(p, "readonly").objectStore(p).get(r(n, c))
+    async get(r, c) {
+      const a = await t(), n = await o(
+        a.transaction(f, "readonly").objectStore(f).get(e(r, c))
       );
-      if (t)
-        return { type: t.type, name: t.name, createdAt: t.createdAt, data: t.data };
+      if (n)
+        return { type: n.type, name: n.name, createdAt: n.createdAt, data: n.data };
     },
     async list() {
-      const n = await e();
+      const r = await t();
       return (await o(
-        n.transaction(p, "readonly").objectStore(p).getAll()
+        r.transaction(f, "readonly").objectStore(f).getAll()
       )).map((a) => ({ type: a.type, name: a.name, createdAt: a.createdAt }));
     },
-    async delete(n, c) {
-      const a = await e();
+    async delete(r, c) {
+      const a = await t();
       await o(
-        a.transaction(p, "readwrite").objectStore(p).delete(r(n, c))
+        a.transaction(f, "readwrite").objectStore(f).delete(e(r, c))
       );
     }
   };
 }
-function x(r, e) {
-  return `${r}/${e}`;
+function G(e, t) {
+  return `${e}/${t}`;
 }
-async function F({
-  relay: r,
-  teamId: e,
+async function Z({
+  relay: e,
+  teamId: t,
   secretStore: o,
-  commonName: n,
-  log: c = () => {
+  certificateKind: r = "development",
+  commonName: c,
+  log: a = () => {
   }
 }) {
-  const a = "DEVELOPMENT", t = x(e, a), s = await h({ relay: r, teamId: e, certificateKind: "development" }), i = (f) => f === void 0 ? void 0 : s.find(
-    (m) => u(m, "certificateId") === f || u(m, "certRequestId") === f
-  ), d = await o.get(A, t), l = u(d?.data, "certificateID");
-  if (d && l && d.data.certificateP12Base64) {
-    const f = i(l);
-    if (f) {
-      const m = u(f, "certificateId") ?? l;
-      return c("Reusing stored Apple certificate", m), { secret: d, certificateId: m, created: !1 };
+  const n = r === "distribution" ? "DISTRIBUTION" : "DEVELOPMENT", s = G(t, n), i = await T({ relay: e, teamId: t, certificateKind: r }), d = (w) => w === void 0 ? void 0 : i.find(
+    (E) => y(E, "certificateId") === w || y(E, "certRequestId") === w
+  ), p = await o.get(C, s), P = y(p?.data, "certificateID");
+  if (p && P && p.data.certificateP12Base64) {
+    const w = d(P);
+    if (w) {
+      const E = y(w, "certificateId") ?? P;
+      return a("Reusing stored Apple certificate", E), { secret: p, certificateId: E, created: !1 };
     }
-    c("Stored certificate is no longer on the team", "Minting a new one.");
+    a("Stored certificate is no longer on the team", "Minting a new one.");
   }
-  const S = await C({ commonName: n ?? `Limrun ${e}` }), y = await D({
-    relay: r,
-    teamId: e,
-    certificateKind: "development",
-    csrPEM: S.csrPEM
-  }), w = u(y, "certificateId") ?? u(y, "certRequestId");
-  if (!w)
+  const l = await D({ commonName: c ?? `Limrun ${t}` }), A = await k({
+    relay: e,
+    teamId: t,
+    certificateKind: r,
+    csrPEM: l.csrPEM
+  }), u = y(A, "certificateId") ?? y(A, "certRequestId");
+  if (!u)
     throw new Error("Apple certificate creation did not return a certificate ID.");
-  const g = await I({
-    relay: r,
-    teamId: e,
-    certificateKind: "development",
-    certificateId: w
+  const S = await $({
+    relay: e,
+    teamId: t,
+    certificateKind: r,
+    certificateId: u
   });
-  if (!g.rawBodyBase64)
+  if (!S.rawBodyBase64)
     throw new Error("Apple certificate download returned no bytes.");
-  const b = {
-    certificateP12Base64: T({
-      privateKeyPKCS8Base64: S.privateKeyPKCS8Base64,
-      certificateBase64: g.rawBodyBase64,
+  const g = {
+    certificateP12Base64: B({
+      privateKeyPKCS8Base64: l.privateKeyPKCS8Base64,
+      certificateBase64: S.rawBodyBase64,
       password: "",
-      friendlyName: `Apple Development ${e}`
+      friendlyName: `Apple ${r === "distribution" ? "Distribution" : "Development"} ${t}`
     }),
-    certificateType: a,
-    teamID: e,
-    certificateID: w,
+    certificateType: n,
+    teamID: t,
+    certificateID: u,
     // Normalized so it equals the serials profiles reference.
-    serialNumber: R(u(y, "serialNum")),
-    expirationDate: u(y, "expirationDateString")
+    serialNumber: x(y(A, "serialNum")),
+    expirationDate: y(A, "expirationDateString")
   };
-  let E;
+  let m;
   try {
-    E = await j(o, t, b);
-  } catch (f) {
+    m = await L(o, s, g);
+  } catch (w) {
     throw new Error(
-      `Certificate ${w} was created on the Apple Developer portal but saving its private key to the secret store failed: ${K(f)}. The key cannot be recovered; revoke certificate ${w} at developer.apple.com before retrying, or the retry will mint another certificate against Apple's limit.`
+      `Certificate ${u} was created on the Apple Developer portal but saving its private key to the secret store failed: ${h(w)}. The key cannot be recovered; revoke certificate ${u} at developer.apple.com before retrying, or the retry will mint another certificate against Apple's limit.`
     );
   }
-  return c("Apple certificate stored", w), { secret: E, certificateId: w, created: !0 };
+  return a("Apple certificate stored", u), { secret: m, certificateId: u, created: !0 };
 }
-function K(r) {
-  return r instanceof Error ? r.message : String(r);
+function h(e) {
+  return e instanceof Error ? e.message : String(e);
 }
-async function G({
-  relay: r,
-  teamId: e,
+async function ee({
+  relay: e,
+  teamId: t,
   profileId: o,
-  secretStore: n,
+  secretStore: r,
   log: c = () => {
   }
 }) {
-  const t = (await $({ relay: r, teamId: e, profileId: o })).rawBodyBase64;
-  if (!t)
+  const n = (await N({ relay: e, teamId: t, profileId: o })).rawBodyBase64;
+  if (!n)
     throw new Error("Apple provisioning profile download returned no bytes.");
-  const s = N(t), i = `${e}/${s.uuid ?? o}`, d = await O(n, i, {
-    provisioningProfileBase64: t,
+  const s = U(n), i = `${t}/${s.uuid ?? o}`, d = await M(r, i, {
+    provisioningProfileBase64: n,
     certificateSerialNumbers: s.certificateSerialNumbers.join(","),
     bundleIDs: s.bundleID,
     deviceIDs: s.provisionedDevices.join(","),
-    teamID: s.teamID ?? e,
+    teamID: s.teamID ?? t,
     profileName: s.name,
     uuid: s.uuid,
     expirationDate: s.expirationDate
   });
   return c("Apple provisioning profile stored", i), d;
 }
-async function V({ relay: r, teamId: e }) {
-  return B({ relay: r, teamId: e, profileKind: "development" });
+function V(e) {
+  return `${e}/APP_STORE_CONNECT_API_KEY`;
+}
+async function te({
+  relay: e,
+  teamId: t,
+  providerId: o,
+  secretStore: r,
+  nickname: c,
+  roles: a,
+  log: n = () => {
+  }
+}) {
+  if (!c)
+    throw new Error("A nickname is required to ensure an App Store Connect API key.");
+  o !== void 0 && await R({ relay: e, providerId: o });
+  const s = V(t), i = await _({ relay: e }), d = await r.get(v, s), p = y(d?.data, "keyId");
+  if (d && p && d.data.privateKeyP8Base64) {
+    if (i.find((m) => m.id === p && !q(m.attributes)))
+      return n("Reusing stored App Store Connect API key", p), { secret: d, keyId: p, created: !1 };
+    n("Stored App Store Connect API key is no longer active", "Minting a new one.");
+  }
+  const l = (await O({ relay: e, nickname: c, roles: a })).id, A = await j({ relay: e, keyId: l }), u = {
+    privateKeyP8Base64: J(A.privateKeyPem),
+    keyId: l,
+    issuerId: A.issuerId,
+    nickname: c,
+    teamID: t
+  };
+  let S;
+  try {
+    S = await z(r, s, u);
+  } catch (g) {
+    throw new Error(
+      `App Store Connect API key ${l} was created but saving its private key to the secret store failed: ${h(g)}. The key cannot be downloaded again; revoke key ${l} in App Store Connect before retrying, or the retry will mint another key.`
+    );
+  }
+  return n("App Store Connect API key stored", l), { secret: S, keyId: l, created: !0 };
+}
+function q(e) {
+  if (!e) return !1;
+  if (e.isActive === !1) return !0;
+  const t = e.revokingDate ?? e.revocationDate;
+  return typeof t == "string" && t !== "";
+}
+function J(e) {
+  const t = new TextEncoder().encode(e);
+  let o = "";
+  for (const r of t)
+    o += String.fromCharCode(r);
+  return btoa(o);
+}
+async function re({
+  relay: e,
+  teamId: t,
+  profileKind: o = "development"
+}) {
+  return K({ relay: e, teamId: t, profileKind: o });
 }
-function u(r, e) {
-  const o = r?.[e];
+function y(e, t) {
+  const o = e?.[t];
   if (typeof o == "string") return o;
   if (typeof o == "number" || typeof o == "boolean") return String(o);
 }
 export {
-  A as APPLE_CERTIFICATE_SECRET_TYPE,
-  v as APPLE_PROVISIONING_PROFILE_SECRET_TYPE,
-  x as appleCertificateSecretName,
-  M as createBrowserSecretStore,
-  z as createLimrunSecretStore,
-  F as ensureAppleCertificateSecret,
-  V as listTeamAppleProfiles,
-  R as normalizeCertificateSerial,
-  j as putAppleCertificateSecret,
-  O as putAppleProvisioningProfileSecret,
-  G as saveAppleProfileSecret,
-  u as stringField
+  C as APPLE_CERTIFICATE_SECRET_TYPE,
+  I as APPLE_PROVISIONING_PROFILE_SECRET_TYPE,
+  v as APP_STORE_CONNECT_API_KEY_SECRET_TYPE,
+  V as appStoreConnectApiKeySecretName,
+  G as appleCertificateSecretName,
+  X as createBrowserSecretStore,
+  W as createLimrunSecretStore,
+  te as ensureAppStoreConnectApiKeySecret,
+  Z as ensureAppleCertificateSecret,
+  re as listTeamAppleProfiles,
+  x as normalizeCertificateSerial,
+  z as putAppStoreConnectApiKeySecret,
+  L as putAppleCertificateSecret,
+  M as putAppleProvisioningProfileSecret,
+  ee as saveAppleProfileSecret,
+  y as stringField
 };

package/dist/client-C9z_sgOf.js

@@ -0,0 +1 @@
+"use strict";const R=require("./gsa-srp-CCIfUz7Y.js");class g{constructor(t,r,o){this.apiUrl=t,this.token=r,this.organizationId=o}socket;nextId=1;pending=new Map;async connect(){if(this.socket&&this.socket.readyState===WebSocket.OPEN)return;const t=new WebSocket(E(this.apiUrl,this.token,this.organizationId));this.socket=t,t.onmessage=r=>this.handleMessage(r),t.onclose=()=>this.rejectPending(new Error("Apple relay WebSocket closed")),t.onerror=()=>this.rejectPending(new Error("Apple relay WebSocket failed")),await new Promise((r,o)=>{t.onopen=()=>r(),t.onerror=()=>o(new Error("Apple relay WebSocket connection failed"))})}request(t,r){const o=this.socket;if(!o||o.readyState!==WebSocket.OPEN)throw new Error("Apple relay WebSocket is not connected.");const a=String(this.nextId++),n=new Promise((p,i)=>{this.pending.set(a,{resolve:w=>p(x(w)),reject:i})});return o.send(JSON.stringify({id:a,type:t,...r===void 0?{}:{payload:r}})),n}close(){this.rejectPending(new Error("Apple relay WebSocket closed")),this.socket?.close(),this.socket=void 0}handleMessage(t){const r=JSON.parse(String(t.data)),o=this.pending.get(r.id);if(o){if(this.pending.delete(r.id),!r.ok){o.reject(new Error(r.error||"Apple relay request failed"));return}if(!r.response){o.reject(new Error("Apple relay response was empty."));return}o.resolve(r.response)}}rejectPending(t){for(const r of this.pending.values())r.reject(t);this.pending.clear()}}async function m(e,t,r){const o=new g(e,t,r);return await o.connect(),o}async function S(e,t){return e.request("srpInit",t)}async function A(e,t){return e.request("srpComplete",t)}async function P(e){return e.request("triggerTrustedDevice2FA")}async function b(e,t,r="sms"){return e.request("triggerPhone2FA",{phoneNumberId:t,mode:r})}async function k(e,t){return e.request("submitTrustedDevice2FA",{code:t})}async function T(e,t,r,o="sms"){return e.request("submitPhone2FA",{phoneNumberId:t,mode:o,code:r})}async function v(e){return e.request("finalize")}async function q(e,t){return e.request("provisioning",t)}async function F(e,t){return e.request("appstoreconnect",t)}function x(e){if(e.body!==void 0||!e.rawBody)return e;try{return{...e,body:JSON.parse(e.rawBody)}}catch{return e}}function E(e,t,r){const o=new URL(e);return o.protocol=o.protocol==="https:"?"wss:":"ws:",o.pathname=`${o.pathname.replace(/\/$/,"")}/ios/appstoreconnect/ws`,t&&o.searchParams.set("token",t),r&&o.searchParams.set("organization",r),o.toString()}async function N({registryApiUrl:e,accountName:t,password:r,token:o,organizationId:a}){const n=await m(e,o,a);try{const p=new R.AppleGsaSrpClient(t),i=await S(n,await p.init());if(i.status<200||i.status>=300)throw new Error(`Apple SRP init failed: HTTP ${i.status} ${i.rawBody??""}`.trim());if(!i.body)throw new Error("Apple SRP init response did not include a body.");const w=await p.complete(r,i.body),u=await A(n,{...w,rememberMe:!1,trustTokens:[]}),y=u.status===409;let s,d={type:"trustedDevice"};if(y){s=await P(n);const c=W(s.body);if(s.status===412||C(s.body)){if(!c)throw new Error("Apple requested phone verification but did not include a trusted phone number.");d={type:"phone",phoneNumberId:c.id,mode:c.pushMode??"sms"},s=await b(n,c.id,c.pushMode??"sms")}if(s.status<200||s.status>=300)throw new Error(`Apple two-factor challenge failed: HTTP ${s.status} ${s.rawBody??""}`.trim())}else if(u.status<200||u.status>=300)throw new Error(`Apple SRP complete failed: HTTP ${u.status} ${u.rawBody??""}`.trim());return{relay:n,completeResponse:u,twoFactorChallengeResponse:s,requiresTwoFactor:y,finishTwoFactor:async c=>{const l=d.type==="phone"?await T(n,d.phoneNumberId,c,d.mode):await k(n,c);if(l.status<200||l.status>=300)throw new Error(`Apple two-factor code failed: HTTP ${l.status} ${l.rawBody??""}`.trim());return l},finalize:async()=>v(n),close:async()=>n.close()}}catch(p){throw n.close(),p}}function C(e){return h(e)&&e.noTrustedDevices===!0}function W(e){if(!h(e))return;const t=h(e.phoneNumberVerification)?e.phoneNumberVerification:void 0,r=f(t?.trustedPhoneNumber)??f(e.trustedPhoneNumber)??f(e.phoneNumber);if(!r)return;const o=r.id;if(typeof o!="number")return;const a=typeof r.pushMode=="string"?r.pushMode:typeof e.mode=="string"?e.mode:void 0;return{id:o,pushMode:a}}function f(e){return h(e)?e:void 0}function h(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}exports.AppleRelayWebSocketClient=g;exports.fetchAppleAccountSession=v;exports.openAppleRelayWebSocket=m;exports.proxyAppStoreConnectRequest=F;exports.proxyPhoneTwoFactorCode=T;exports.proxyProvisioningRequest=q;exports.proxySrpComplete=A;exports.proxySrpInit=S;exports.proxyTwoFactorCode=k;exports.startBrowserOwnedAppleIDLogin=N;exports.triggerPhoneTwoFactor=b;exports.triggerTrustedDeviceTwoFactor=P;