@limrun/ui 0.14.0-rc.4 → 0.14.0-rc.5

package/dist/{provisioning-B_DefBEp.mjs → provisioning-CDPvxd1h.mjs}

@@ -1,18 +1,18 @@
 import { e as c, a as u, n as d, b as f, c as l, i as r } from "./browser-storage-BnO-Ma-e.mjs";
-function g() {
+function P() {
   return {
     method: "POST",
     path: "/account/listTeams.action",
     payload: {}
   };
 }
-function v({
+function g({
   bundleID: e,
   teamID: i = ""
 }) {
   return n("/account/ios/identifiers/listAppIds.action", i, { sort: "name=asc" });
 }
-function P({
+function v({
   deviceUDID: e,
   teamID: i = ""
 }) {
@@ -21,13 +21,13 @@ function P({
     includeRemovedDevices: !1
   });
 }
-function h(e = "") {
+function I(e = "") {
   return n("/account/ios/certificate/listCertRequests.action", e, {
     sort: "name=asc",
     types: "83Q87W3TGH,5QPB9NHCEI"
   });
 }
-function I(e = "") {
+function h(e = "") {
   return n("/account/ios/certificate/listCertRequests.action", e, {
     sort: "name=asc",
     types: "WXV89964HE,R58UK2EWSO"
@@ -52,7 +52,17 @@ function y({
     distributionType: "adhoc"
   });
 }
-function D({
+function q({
+  bundleID: e,
+  teamID: i = ""
+}) {
+  return n("/account/ios/profile/listProvisioningProfiles.action", i, {
+    search: e,
+    sort: "name=asc",
+    distributionType: "store"
+  });
+}
+function b({
   deviceUDID: e,
   teamID: i = "",
   name: t = "Limrun iPhone"
@@ -69,7 +79,7 @@ function D({
     }
   };
 }
-function q({
+function T({
   bundleID: e,
   teamID: i = "",
   name: t
@@ -85,7 +95,7 @@ function q({
     }
   };
 }
-function b({ csrPEM: e, teamID: i = "" }) {
+function D({ csrPEM: e, teamID: i = "" }) {
   return {
     method: "POST",
     path: "/account/ios/certificate/submitCertificateRequest.action",
@@ -107,7 +117,7 @@ function C({ csrPEM: e, teamID: i = "" }) {
     }
   };
 }
-function T(e, i = "") {
+function S(e, i = "") {
   return {
     method: "GET",
     path: "/account/ios/certificate/downloadCertificateContent.action",
@@ -118,7 +128,7 @@ function T(e, i = "") {
     }
   };
 }
-function S(e, i = "") {
+function A(e, i = "") {
   return {
     method: "GET",
     path: "/account/ios/certificate/downloadCertificateContent.action",
@@ -129,7 +139,7 @@ function S(e, i = "") {
     }
   };
 }
-function A({
+function w({
   bundleID: e,
   teamID: i = "",
   appIDID: t,
@@ -151,7 +161,7 @@ function A({
     }
   };
 }
-function w({
+function H({
   bundleID: e,
   teamID: i = "",
   appIDID: t,
@@ -173,7 +183,26 @@ function w({
     }
   };
 }
-function H(e, i = "") {
+function O({
+  teamID: e = "",
+  appIDID: i,
+  certificateID: t,
+  name: o
+}) {
+  return {
+    method: "POST",
+    path: "/account/ios/profile/createProvisioningProfile.action",
+    payload: {
+      teamId: e,
+      provisioningProfileName: o,
+      certificateIds: [t],
+      appIdId: i,
+      distributionType: "store",
+      subPlatform: "ios"
+    }
+  };
+}
+function N(e, i = "") {
   return {
     method: "GET",
     path: "/account/ios/profile/downloadProfileContent",
@@ -183,7 +212,7 @@ function H(e, i = "") {
     }
   };
 }
-async function O({
+async function E({
   bundleID: e,
   deviceUDID: i,
   teamID: t,
@@ -193,7 +222,7 @@ async function O({
   if (!(!a || !p(a, { bundleID: e, deviceUDID: i, teamID: t, signingMode: o })))
     return a;
 }
-async function E(e) {
+async function G(e) {
   return u({
     ...e,
     certificateFileName: e.certificateID ? `${e.certificateID}.p12` : `apple-${e.signingMode ?? "development"}.p12`,
@@ -218,22 +247,24 @@ function n(e, i, t = {}) {
   };
 }
 export {
-  h as a,
-  b,
-  T as c,
-  S as d,
-  v as e,
-  I as f,
-  O as g,
-  q as h,
-  P as i,
+  I as a,
+  D as b,
+  S as c,
+  A as d,
+  g as e,
+  h as f,
+  E as g,
+  T as h,
+  v as i,
   y as j,
-  R as k,
-  g as l,
-  w as m,
-  A as n,
-  H as o,
-  E as p,
-  D as r,
-  C as s
+  q as k,
+  P as l,
+  R as m,
+  N as n,
+  O as o,
+  G as p,
+  H as q,
+  b as r,
+  C as s,
+  w as t
 };

package/dist/provisioning-CbC4h--7.js

@@ -0,0 +1 @@
+"use strict";const s=require("./browser-storage-DLxIqZk5.js");function c(){return{method:"POST",path:"/account/listTeams.action",payload:{}}}function u({bundleID:e,teamID:t=""}){return r("/account/ios/identifiers/listAppIds.action",t,{sort:"name=asc"})}function d({deviceUDID:e,teamID:t=""}){return r("/account/ios/device/listDevices.action",t,{sort:"name=asc",includeRemovedDevices:!1})}function f(e=""){return r("/account/ios/certificate/listCertRequests.action",e,{sort:"name=asc",types:"83Q87W3TGH,5QPB9NHCEI"})}function l(e=""){return r("/account/ios/certificate/listCertRequests.action",e,{sort:"name=asc",types:"WXV89964HE,R58UK2EWSO"})}function p({bundleID:e,teamID:t=""}){return r("/account/ios/profile/listProvisioningProfiles.action",t,{search:e,sort:"name=asc"})}function m({bundleID:e,teamID:t=""}){return r("/account/ios/profile/listProvisioningProfiles.action",t,{search:e,sort:"name=asc",distributionType:"adhoc"})}function R({bundleID:e,teamID:t=""}){return r("/account/ios/profile/listProvisioningProfiles.action",t,{search:e,sort:"name=asc",distributionType:"store"})}function P({deviceUDID:e,teamID:t="",name:i="Limrun iPhone"}){return{method:"POST",path:"/account/ios/device/addDevices.action",payload:{teamId:t,deviceNames:i,deviceNumbers:s.normalizeUDID(e),deviceClasses:"iphone",register:"single"}}}function g({bundleID:e,teamID:t="",name:i}){return{method:"POST",path:"/account/ios/identifiers/addAppId.action",payload:{teamId:t,name:i??e,identifier:e,type:"explicit"}}}function q({csrPEM:e,teamID:t=""}){return{method:"POST",path:"/account/ios/certificate/submitCertificateRequest.action",payload:{teamId:t,type:"83Q87W3TGH",csrContent:e}}}function v({csrPEM:e,teamID:t=""}){return{method:"POST",path:"/account/ios/certificate/submitCertificateRequest.action",payload:{teamId:t,type:"WXV89964HE",csrContent:e}}}function I(e,t=""){return{method:"GET",path:"/account/ios/certificate/downloadCertificateContent.action",payload:{teamId:t,certificateId:e,type:"83Q87W3TGH"}}}function D(e,t=""){return{method:"GET",path:"/account/ios/certificate/downloadCertificateContent.action",payload:{teamId:t,certificateId:e,type:"WXV89964HE"}}}function h({bundleID:e,teamID:t="",appIDID:i,certificateID:o,deviceIDs:n,name:a}){return{method:"POST",path:"/account/ios/profile/createProvisioningProfile.action",payload:{teamId:t,provisioningProfileName:a??`Limrun ${e}`,certificateIds:[o],appIdId:i,deviceIds:n,distributionType:"limited",subPlatform:"ios"}}}function b({bundleID:e,teamID:t="",appIDID:i,certificateID:o,deviceIDs:n,name:a}){return{method:"POST",path:"/account/ios/profile/createProvisioningProfile.action",payload:{teamId:t,provisioningProfileName:a??`Limrun Ad Hoc ${e}`,certificateIds:[o],appIdId:i,deviceIds:n,distributionType:"adhoc",subPlatform:"ios"}}}function y({teamID:e="",appIDID:t,certificateID:i,name:o}){return{method:"POST",path:"/account/ios/profile/createProvisioningProfile.action",payload:{teamId:e,provisioningProfileName:o,certificateIds:[i],appIdId:t,distributionType:"store",subPlatform:"ios"}}}function S(e,t=""){return{method:"GET",path:"/account/ios/profile/downloadProfileContent",payload:{teamId:t,provisioningProfileId:e}}}async function C({bundleID:e,deviceUDID:t,teamID:i,signingMode:o}){const n=await s.getSigningAssets({bundleID:e,deviceUDID:t,signingMode:o});if(!(!n||!A(n,{bundleID:e,deviceUDID:t,teamID:i,signingMode:o})))return n}async function T(e){return s.putSigningAssets({...e,certificateFileName:e.certificateID?`${e.certificateID}.p12`:`apple-${e.signingMode??"development"}.p12`,certificatePassword:e.certificatePassword||void 0,signingMode:e.signingMode,profileFileName:e.profile.uuid?`${e.profile.uuid}.mobileprovision`:`${e.signingMode??"development"}.mobileprovision`})}function A(e,{bundleID:t,deviceUDID:i,teamID:o,signingMode:n="development"}){return(e.signingMode??"development")!==n||!s.profileMatchesBundleID(e.profile,t)||o&&e.teamID&&e.teamID!==o||i&&!s.profileContainsDevice(e.profile,i)||e.profile.expirationDate&&new Date(e.profile.expirationDate).getTime()<=Date.now()?!1:s.normalizeBundleID(e.bundleID)===s.normalizeBundleID(t)}function r(e,t,i={}){const o={pageNumber:1,pageSize:200,...i};return t&&(o.teamId=t),{method:"POST",path:e,payload:o}}exports.createAdHocProfileRequest=b;exports.createAppStoreProfileRequest=y;exports.createBundleIDRequest=g;exports.createDevelopmentProfileRequest=h;exports.downloadCertificateRequest=I;exports.downloadDistributionCertificateRequest=D;exports.downloadProfileRequest=S;exports.findAdHocProfilesRequest=m;exports.findAppStoreProfilesRequest=R;exports.findBundleIDRequest=u;exports.findDevelopmentCertificatesRequest=f;exports.findDevelopmentProfilesRequest=p;exports.findDeviceRequest=d;exports.findDistributionCertificatesRequest=l;exports.getReusableAppleSigningAssets=C;exports.listTeamsRequest=c;exports.putAppleGeneratedSigningAssets=T;exports.registerDeviceRequest=P;exports.submitDevelopmentCSRRequest=q;exports.submitDistributionCSRRequest=v;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@limrun/ui",
-  "version": "0.14.0-rc.4",
+  "version": "0.14.0-rc.5",
   "publishConfig": {
     "access": "public",
     "tag": "next"

package/src/app-store-relay/index.ts

@@ -1,17 +1,20 @@
 import {
   createAdHocProfileRequest,
+  createAppStoreProfileRequest,
   createBundleIDRequest,
   createDevelopmentProfileRequest,
   downloadCertificateRequest,
   downloadDistributionCertificateRequest,
   downloadProfileRequest,
   findAdHocProfilesRequest,
+  findAppStoreProfilesRequest,
   findBundleIDRequest,
   findDevelopmentCertificatesRequest,
   findDevelopmentProfilesRequest,
   findDeviceRequest,
   findDistributionCertificatesRequest,
   listTeamsRequest,
+  proxyAppStoreConnectRequest,
   proxyProvisioningRequest,
   registerDeviceRequest,
   submitDevelopmentCSRRequest,
@@ -35,11 +38,13 @@ export type {
   AppleDeveloperPortalTeam,
   AppleProvisioningRequest,
   AppleRelayResponse,
+  AppStoreConnectRequest,
 } from '../core/device-install/apple';
 export {
   AppleRelayWebSocketClient,
   fetchAppleAccountSession,
   openAppleRelayWebSocket,
+  proxyAppStoreConnectRequest,
   proxyPhoneTwoFactorCode,
   proxySrpComplete,
   proxySrpInit,
@@ -58,7 +63,7 @@ export type AppleTeamScopedOptions = AppleRelayClientOptions & {
 
 export type AppleCertificateKind = 'development' | 'distribution';
 
-export type AppleProfileKind = 'development' | 'adhoc';
+export type AppleProfileKind = 'development' | 'adhoc' | 'appstore';
 
 export type RequestAppleProvisioningOptions<T = unknown> = AppleRelayClientOptions & {
   request: AppleProvisioningRequest;
@@ -134,7 +139,9 @@ export type CreateAppleProfileOptions = AppleTeamScopedOptions & {
   bundleId: string;
   appIdId: string;
   certificateIds: string[];
-  deviceIds: string[];
+  /** Devices the profile binds. Ignored for App Store profiles, which bind none. */
+  deviceIds?: string[];
+  /** Profile name. Required for App Store profiles; there is no default. */
   name?: string;
 };
 
@@ -408,8 +415,8 @@ export async function listAppleProfiles({
   return requestAppleProvisioning<Array<Record<string, unknown>>>({
     ...options,
     request:
-      profileKind === 'adhoc' ?
-        findAdHocProfilesRequest({ bundleID: bundleId, teamID: teamId })
+      profileKind === 'adhoc' ? findAdHocProfilesRequest({ bundleID: bundleId, teamID: teamId })
+      : profileKind === 'appstore' ? findAppStoreProfilesRequest({ bundleID: bundleId, teamID: teamId })
       : findDevelopmentProfilesRequest({ bundleID: bundleId, teamID: teamId }),
     label: 'Apple provisioning profile list',
     mapBody: (body) => body?.provisioningProfiles ?? [],
@@ -422,7 +429,7 @@ export async function createAppleProfile({
   bundleId,
   appIdId,
   certificateIds,
-  deviceIds,
+  deviceIds = [],
   name,
   ...options
 }: CreateAppleProfileOptions) {
@@ -430,26 +437,39 @@ export async function createAppleProfile({
   if (!certificateId) {
     throw new Error('At least one certificate ID is required to create an Apple provisioning profile.');
   }
+  let request: AppleProvisioningRequest;
+  if (profileKind === 'appstore') {
+    if (!name) {
+      throw new Error('An explicit name is required to create an App Store provisioning profile.');
+    }
+    request = createAppStoreProfileRequest({
+      teamID: teamId,
+      appIDID: appIdId,
+      certificateID: certificateId,
+      name,
+    });
+  } else if (profileKind === 'adhoc') {
+    request = createAdHocProfileRequest({
+      bundleID: bundleId,
+      teamID: teamId,
+      appIDID: appIdId,
+      certificateID: certificateId,
+      deviceIDs: deviceIds,
+      name,
+    });
+  } else {
+    request = createDevelopmentProfileRequest({
+      bundleID: bundleId,
+      teamID: teamId,
+      appIDID: appIdId,
+      certificateID: certificateId,
+      deviceIDs: deviceIds,
+      name,
+    });
+  }
   return requestAppleProvisioning<Record<string, unknown> | undefined>({
     ...options,
-    request:
-      profileKind === 'adhoc' ?
-        createAdHocProfileRequest({
-          bundleID: bundleId,
-          teamID: teamId,
-          appIDID: appIdId,
-          certificateID: certificateId,
-          deviceIDs: deviceIds,
-          name,
-        })
-      : createDevelopmentProfileRequest({
-          bundleID: bundleId,
-          teamID: teamId,
-          appIDID: appIdId,
-          certificateID: certificateId,
-          deviceIDs: deviceIds,
-          name,
-        }),
+    request,
     label: 'Apple provisioning profile creation',
     mapBody: (body) => body?.provisioningProfile,
   });
@@ -482,6 +502,321 @@ export async function deleteAppleProfile({ teamId = '', profileId, ...options }:
   });
 }
 
+/**
+ * A JSON:API resource returned by the session-authenticated App Store
+ * Connect API. Kept loose on purpose: the endpoint is not a public contract
+ * and Apple adds attributes freely.
+ */
+export type AppStoreConnectResource = {
+  type?: string;
+  id?: string;
+  attributes?: Record<string, unknown>;
+  relationships?: Record<string, unknown>;
+};
+
+type AppStoreConnectEnvelope = {
+  data?: AppStoreConnectResource | AppStoreConnectResource[];
+  included?: AppStoreConnectResource[];
+  errors?: Array<{ status?: string; code?: string; title?: string; detail?: string }>;
+};
+
+export type SwitchAppStoreConnectProviderOptions = AppleRelayClientOptions & {
+  /** The numeric provider ID of the team, from the team list's providerId. */
+  providerId: string | number;
+};
+
+/**
+ * Points the App Store Connect session at the given team (provider). Must
+ * run before any other App Store Connect call when the account belongs to
+ * multiple teams, because the session carries an active provider.
+ */
+export async function switchAppStoreConnectProvider({
+  relay,
+  providerId,
+}: SwitchAppStoreConnectProviderOptions) {
+  const numericProviderId = Number(providerId);
+  const response = await proxyAppStoreConnectRequest<Record<string, unknown>>(relay, {
+    method: 'POST',
+    path: '/olympus/v1/session',
+    payload: {
+      provider: { providerId: Number.isNaN(numericProviderId) ? providerId : numericProviderId },
+    },
+  });
+  if (response.status < 200 || response.status >= 300) {
+    throw new Error(
+      `App Store Connect provider switch failed: HTTP ${response.status} ${response.rawBody ?? ''}`.trim(),
+    );
+  }
+  return response;
+}
+
+/**
+ * Roles Apple accepts on App Store Connect API keys. APP_MANAGER is enough
+ * to upload builds and manage TestFlight, which is why it is the default
+ * for keys minted by ensureAppStoreConnectApiKeySecret.
+ */
+export type AppStoreConnectApiKeyRole =
+  | 'ADMIN'
+  | 'APP_MANAGER'
+  | 'CUSTOMER_SUPPORT'
+  | 'DEVELOPER'
+  | 'FINANCE'
+  | 'MARKETING'
+  | 'SALES';
+
+export type ListAppStoreConnectApiKeysOptions = AppleRelayClientOptions;
+
+/** Lists the team's App Store Connect API keys. Requires an Admin session. */
+export async function listAppStoreConnectApiKeys({ relay }: ListAppStoreConnectApiKeysOptions) {
+  const response = await proxyAppStoreConnectRequest<AppStoreConnectEnvelope>(relay, {
+    path: '/iris/v1/apiKeys',
+  });
+  assertAppStoreConnectResponseOK(response, 'App Store Connect API key list');
+  return resourceArray(response.body?.data);
+}
+
+export type CreateAppStoreConnectApiKeyOptions = AppleRelayClientOptions & {
+  /** Display name of the key. Required; implementors brand keys themselves. */
+  nickname: string;
+  roles?: AppStoreConnectApiKeyRole[];
+  allAppsVisible?: boolean;
+};
+
+/**
+ * Creates a team App Store Connect API key through the logged-in session,
+ * the same way the App Store Connect website does. The session user must
+ * be a team Admin. The private key is NOT part of the response; download
+ * it once with downloadAppStoreConnectApiKeyPrivateKey.
+ */
+export async function createAppStoreConnectApiKey({
+  relay,
+  nickname,
+  roles = ['APP_MANAGER'],
+  allAppsVisible = true,
+}: CreateAppStoreConnectApiKeyOptions) {
+  if (!nickname) {
+    throw new Error('A nickname is required to create an App Store Connect API key.');
+  }
+  const response = await proxyAppStoreConnectRequest<AppStoreConnectEnvelope>(relay, {
+    method: 'POST',
+    path: '/iris/v1/apiKeys',
+    payload: {
+      data: {
+        type: 'apiKeys',
+        attributes: {
+          nickname,
+          allAppsVisible,
+          keyType: 'PUBLIC_API',
+          roles,
+        },
+      },
+    },
+  });
+  assertAppStoreConnectResponseOK(response, 'App Store Connect API key creation');
+  const key = singleResource(response.body?.data);
+  if (!key?.id) {
+    throw new Error('App Store Connect API key creation did not return a key ID.');
+  }
+  return key;
+}
+
+export type DownloadAppStoreConnectApiKeyOptions = AppleRelayClientOptions & {
+  keyId: string;
+};
+
+export type DownloadedAppStoreConnectApiKey = {
+  /** PEM contents of the .p8 private key. */
+  privateKeyPem: string;
+  /** Issuer ID for JWTs signed with this key, when Apple returned it. */
+  issuerId?: string;
+};
+
+/**
+ * Downloads the private half of an App Store Connect API key. Apple serves
+ * it exactly once per key; afterwards the sparse fieldset comes back empty
+ * and the key must be revoked and re-minted.
+ */
+export async function downloadAppStoreConnectApiKeyPrivateKey({
+  relay,
+  keyId,
+}: DownloadAppStoreConnectApiKeyOptions): Promise<DownloadedAppStoreConnectApiKey> {
+  const response = await proxyAppStoreConnectRequest<AppStoreConnectEnvelope>(relay, {
+    path: `/iris/v1/apiKeys/${encodeURIComponent(keyId)}`,
+    query: { 'fields[apiKeys]': 'privateKey', include: 'provider' },
+  });
+  assertAppStoreConnectResponseOK(response, 'App Store Connect API key download');
+  const key = singleResource(response.body?.data);
+  const privateKeyPem = stringField(key?.attributes, 'privateKey');
+  if (!privateKeyPem) {
+    throw new Error(
+      `App Store Connect API key ${keyId} returned no private key. Apple serves it only once; ` +
+        'revoke the key and create a new one.',
+    );
+  }
+  const provider = (response.body?.included ?? []).find((item) => item.type === 'providers');
+  const issuerId =
+    stringField(provider?.attributes, 'publicProviderId') ??
+    stringField(key?.attributes, 'issuerId') ??
+    provider?.id;
+  return { privateKeyPem, issuerId };
+}
+
+export type FindAppStoreConnectAppOptions = AppleRelayClientOptions & {
+  bundleId: string;
+};
+
+/** Looks up the App Store Connect app record for a bundle ID, if any. */
+export async function findAppStoreConnectApp({ relay, bundleId }: FindAppStoreConnectAppOptions) {
+  const response = await proxyAppStoreConnectRequest<AppStoreConnectEnvelope>(relay, {
+    path: '/iris/v1/apps',
+    query: { 'filter[bundleId]': bundleId },
+  });
+  assertAppStoreConnectResponseOK(response, 'App Store Connect app lookup');
+  return resourceArray(response.body?.data).find(
+    (app) => stringField(app.attributes, 'bundleId') === bundleId,
+  );
+}
+
+export type CreateAppStoreConnectAppOptions = AppleRelayClientOptions & {
+  bundleId: string;
+  /** App name shown on the App Store. Required; there is no default. */
+  name: string;
+  /** Unique internal identifier. Defaults to the bundle ID. */
+  sku?: string;
+  /** Primary App Store locale. Defaults to en-US. */
+  primaryLocale?: string;
+  /** Version string of the first App Store version. Defaults to 1.0. */
+  versionString?: string;
+};
+
+/**
+ * Creates the App Store Connect app record for a bundle ID. Only the
+ * session-authenticated API can create app records (the key-authenticated
+ * public API cannot), which is why this goes through the relay. The body
+ * mirrors what the App Store Connect website and fastlane's produce send.
+ */
+export async function createAppStoreConnectApp({
+  relay,
+  bundleId,
+  name,
+  sku,
+  primaryLocale = 'en-US',
+  versionString = '1.0',
+}: CreateAppStoreConnectAppOptions) {
+  if (!name) {
+    throw new Error('An app name is required to create an App Store Connect app record.');
+  }
+  const platform = 'IOS';
+  const response = await proxyAppStoreConnectRequest<AppStoreConnectEnvelope>(relay, {
+    method: 'POST',
+    path: '/iris/v1/apps',
+    payload: {
+      data: {
+        type: 'apps',
+        attributes: {
+          sku: sku || bundleId,
+          primaryLocale,
+          bundleId,
+        },
+        relationships: {
+          appStoreVersions: {
+            data: [{ type: 'appStoreVersions', id: `\${store-version-${platform}}` }],
+          },
+          appInfos: {
+            data: [{ type: 'appInfos', id: '${new-appInfo-id}' }],
+          },
+        },
+      },
+      included: [
+        {
+          type: 'appInfos',
+          id: '${new-appInfo-id}',
+          relationships: {
+            appInfoLocalizations: {
+              data: [{ type: 'appInfoLocalizations', id: '${new-appInfoLocalization-id}' }],
+            },
+          },
+        },
+        {
+          type: 'appInfoLocalizations',
+          id: '${new-appInfoLocalization-id}',
+          attributes: { locale: primaryLocale, name },
+        },
+        {
+          type: 'appStoreVersions',
+          id: `\${store-version-${platform}}`,
+          attributes: { platform, versionString },
+          relationships: {
+            appStoreVersionLocalizations: {
+              data: [
+                { type: 'appStoreVersionLocalizations', id: `\${new-${platform}VersionLocalization-id}` },
+              ],
+            },
+          },
+        },
+        {
+          type: 'appStoreVersionLocalizations',
+          id: `\${new-${platform}VersionLocalization-id}`,
+          attributes: { locale: primaryLocale },
+        },
+      ],
+    },
+  });
+  assertAppStoreConnectResponseOK(response, 'App Store Connect app creation');
+  const app = singleResource(response.body?.data);
+  if (!app?.id) {
+    throw new Error('App Store Connect app creation did not return an app ID.');
+  }
+  return app;
+}
+
+export type EnsureAppStoreConnectAppOptions = CreateAppStoreConnectAppOptions;
+
+/**
+ * Returns the App Store Connect app record for the bundle ID, creating it
+ * when it does not exist yet. A first-time IPA upload fails without an app
+ * record, so run this before the first publish of a new bundle ID.
+ */
+export async function ensureAppStoreConnectApp(options: EnsureAppStoreConnectAppOptions) {
+  const existing = await findAppStoreConnectApp({ relay: options.relay, bundleId: options.bundleId });
+  if (existing) {
+    return { app: existing, created: false };
+  }
+  return { app: await createAppStoreConnectApp(options), created: true };
+}
+
+export function assertAppStoreConnectResponseOK(
+  response: AppleRelayResponse<AppStoreConnectEnvelope>,
+  label: string,
+) {
+  const errors = response.body?.errors;
+  if (errors && errors.length > 0) {
+    const detail = errors
+      .map((error) => error.detail ?? error.title ?? error.code ?? error.status)
+      .filter(Boolean)
+      .join('; ');
+    throw new Error(`${label} failed: ${detail || `HTTP ${response.status}`}`);
+  }
+  if (response.status < 200 || response.status >= 300) {
+    throw new Error(`${label} failed: HTTP ${response.status} ${response.rawBody ?? ''}`.trim());
+  }
+}
+
+function resourceArray(data: AppStoreConnectResource | AppStoreConnectResource[] | undefined) {
+  if (!data) return [];
+  return Array.isArray(data) ? data : [data];
+}
+
+function singleResource(data: AppStoreConnectResource | AppStoreConnectResource[] | undefined) {
+  if (!data) return undefined;
+  return Array.isArray(data) ? data[0] : data;
+}
+
+function stringField(record: Record<string, unknown> | undefined, key: string) {
+  const value = record?.[key];
+  return typeof value === 'string' && value !== '' ? value : undefined;
+}
+
 export function assertAppleDeveloperPortalResponseOK(
   response: AppleDeveloperPortalResponse | undefined,
   label: string,

package/src/apple-credentials/index.test.ts

@@ -134,6 +134,28 @@ describe('ensureAppleCertificateSecret', () => {
     expect(stored?.data.certificateP12Base64).toBeTruthy();
   });
 
+  test('mints distribution certificates under their own secret name', async () => {
+    const state: PortalState = {
+      mintedCertificateIds: [],
+      certificateBase64: selfSignedCertificateBase64(),
+    };
+    const org = memorySecretStore();
+
+    const result = await ensureAppleCertificateSecret({
+      relay: fakePortalRelay(state),
+      teamId,
+      secretStore: org.store,
+      certificateKind: 'distribution',
+    });
+    expect(result.created).toBe(true);
+    const stored = await org.store.get(
+      APPLE_CERTIFICATE_SECRET_TYPE,
+      appleCertificateSecretName(teamId, 'DISTRIBUTION'),
+    );
+    expect(stored?.data.certificateType).toBe('DISTRIBUTION');
+    expect(stored?.data.certificateP12Base64).toBeTruthy();
+  });
+
   test('reuses the stored certificate when it is still on the team', async () => {
     const state: PortalState = {
       mintedCertificateIds: ['CERT1'],