@limrun/ui 0.14.0-rc.4 → 0.14.0-rc.5

package/src/apple-credentials/index.ts

@@ -7,12 +7,19 @@
  */
 import {
   createAppleCertificate,
+  createAppStoreConnectApiKey,
   downloadAppleCertificate,
   downloadAppleProfile,
+  downloadAppStoreConnectApiKeyPrivateKey,
   exportAppleCertificateP12,
   generateAppleSigningKeyAndCSR,
   listAppleCertificates,
   listAppleProfiles,
+  listAppStoreConnectApiKeys,
+  switchAppStoreConnectProvider,
+  type AppleCertificateKind,
+  type AppleProfileKind,
+  type AppStoreConnectApiKeyRole,
 } from '../app-store-relay';
 import type { AppleRelayWebSocketClient } from '../core/device-install/apple';
 import {
@@ -20,25 +27,31 @@ import {
   parseProvisioningProfileBase64,
 } from '../core/device-install/storage/browser-storage';
 import {
+  APP_STORE_CONNECT_API_KEY_SECRET_TYPE,
   APPLE_CERTIFICATE_SECRET_TYPE,
   putAppleCertificateSecret,
   putAppleProvisioningProfileSecret,
+  putAppStoreConnectApiKeySecret,
   type AppleCertificateSecretData,
   type AppleCertificateType,
+  type AppStoreConnectApiKeySecretData,
   type SigningSecret,
   type SigningSecretStore,
 } from '../core/device-install/storage/secret-store';
 
 export {
+  APP_STORE_CONNECT_API_KEY_SECRET_TYPE,
   APPLE_CERTIFICATE_SECRET_TYPE,
   APPLE_PROVISIONING_PROFILE_SECRET_TYPE,
   createBrowserSecretStore,
   createLimrunSecretStore,
   putAppleCertificateSecret,
   putAppleProvisioningProfileSecret,
+  putAppStoreConnectApiKeySecret,
   type AppleCertificateSecretData,
   type AppleCertificateType,
   type AppleProvisioningProfileSecretData,
+  type AppStoreConnectApiKeySecretData,
   type LimrunSecretStoreOptions,
   type SigningSecret,
   type SigningSecretData,
@@ -61,6 +74,11 @@ export type EnsureAppleCertificateInput = {
   relay: AppleRelayWebSocketClient;
   teamId: string;
   secretStore: SigningSecretStore;
+  /**
+   * Which portal certificate kind to ensure. Ad-hoc and App Store signing
+   * both use the distribution certificate. Defaults to development.
+   */
+  certificateKind?: AppleCertificateKind;
   /** Common name used when minting a new certificate. */
   commonName?: string;
   log?: (message: string, detail?: string) => void;
@@ -74,10 +92,11 @@ export type EnsureAppleCertificateResult = {
 };
 
 /**
- * Returns a usable development certificate secret for the team, reusing the
- * stored one when its certificate is still on the team and minting a new
- * one otherwise. Apple caps development certificates at 2 and never returns
- * private keys, so reuse of the stored p12 is strongly preferred.
+ * Returns a usable certificate secret of the requested kind for the team,
+ * reusing the stored one when its certificate is still on the team and
+ * minting a new one otherwise. Apple caps certificates per kind (2 for
+ * development, 3 for distribution) and never returns private keys, so
+ * reuse of the stored p12 is strongly preferred.
  *
  * Durability of the stored material is the secret store's concern:
  * implementors who want retries or fallbacks build them into their
@@ -87,14 +106,16 @@ export async function ensureAppleCertificateSecret({
   relay,
   teamId,
   secretStore,
+  certificateKind = 'development',
   commonName,
   log = () => {},
 }: EnsureAppleCertificateInput): Promise<EnsureAppleCertificateResult> {
-  // The browser flow mints via the portal's development kind, which is
-  // the DEVELOPMENT certificate type in Apple's App Store Connect enum.
-  const certificateType: AppleCertificateType = 'DEVELOPMENT';
+  // The portal kinds map onto Apple's App Store Connect certificate type
+  // enum, which is what consumers of the stored secret filter on.
+  const certificateType: AppleCertificateType =
+    certificateKind === 'distribution' ? 'DISTRIBUTION' : 'DEVELOPMENT';
   const secretName = appleCertificateSecretName(teamId, certificateType);
-  const current = await listAppleCertificates({ relay, teamId, certificateKind: 'development' });
+  const current = await listAppleCertificates({ relay, teamId, certificateKind });
   const findOnTeam = (certificateId: string | undefined) =>
     certificateId === undefined ? undefined : (
       current.find(
@@ -125,7 +146,7 @@ export async function ensureAppleCertificateSecret({
   const certificate = await createAppleCertificate({
     relay,
     teamId,
-    certificateKind: 'development',
+    certificateKind,
     csrPEM: key.csrPEM,
   });
   const certificateId =
@@ -136,7 +157,7 @@ export async function ensureAppleCertificateSecret({
   const downloaded = await downloadAppleCertificate({
     relay,
     teamId,
-    certificateKind: 'development',
+    certificateKind,
     certificateId,
   });
   if (!downloaded.rawBodyBase64) {
@@ -147,7 +168,7 @@ export async function ensureAppleCertificateSecret({
       privateKeyPKCS8Base64: key.privateKeyPKCS8Base64,
       certificateBase64: downloaded.rawBodyBase64,
       password: '',
-      friendlyName: `Apple Development ${teamId}`,
+      friendlyName: `Apple ${certificateKind === 'distribution' ? 'Distribution' : 'Development'} ${teamId}`,
     }),
     certificateType,
     teamID: teamId,
@@ -222,14 +243,140 @@ export async function saveAppleProfileSecret({
   return secret;
 }
 
+/**
+ * Conventional secret name of a team's App Store Connect API key: one
+ * shared key per team.
+ */
+export function appStoreConnectApiKeySecretName(teamId: string) {
+  return `${teamId}/APP_STORE_CONNECT_API_KEY`;
+}
+
+export type EnsureAppStoreConnectApiKeyInput = {
+  relay: AppleRelayWebSocketClient;
+  teamId: string;
+  /**
+   * Numeric provider ID of the team from the Apple team list. When given,
+   * the App Store Connect session is switched to this provider first;
+   * required for accounts that belong to multiple teams.
+   */
+  providerId?: string | number;
+  secretStore: SigningSecretStore;
+  /** Display name for a newly minted key. Required; there is no default. */
+  nickname: string;
+  /** Roles of a newly minted key. Defaults to APP_MANAGER. */
+  roles?: AppStoreConnectApiKeyRole[];
+  log?: (message: string, detail?: string) => void;
+};
+
+export type EnsureAppStoreConnectApiKeyResult = {
+  secret: SigningSecret;
+  keyId: string;
+  /** True when a new key was minted instead of reusing the stored one. */
+  created: boolean;
+};
+
+/**
+ * Returns a usable App Store Connect API key secret for the team, reusing
+ * the stored one when its key is still active and minting a new one
+ * otherwise. Apple serves a key's private half exactly once (at creation
+ * time through the sparse fieldset download), so reuse of the stored .p8
+ * is strongly preferred.
+ *
+ * The session user must be a team Admin to list or create keys.
+ */
+export async function ensureAppStoreConnectApiKeySecret({
+  relay,
+  teamId,
+  providerId,
+  secretStore,
+  nickname,
+  roles,
+  log = () => {},
+}: EnsureAppStoreConnectApiKeyInput): Promise<EnsureAppStoreConnectApiKeyResult> {
+  if (!nickname) {
+    throw new Error('A nickname is required to ensure an App Store Connect API key.');
+  }
+  if (providerId !== undefined) {
+    await switchAppStoreConnectProvider({ relay, providerId });
+  }
+  const secretName = appStoreConnectApiKeySecretName(teamId);
+  // Listing also primes the session's CSRF context, which Apple requires
+  // on the creation POST below.
+  const current = await listAppStoreConnectApiKeys({ relay });
+
+  const stored = await secretStore.get(APP_STORE_CONNECT_API_KEY_SECRET_TYPE, secretName);
+  const storedKeyId = stringField(stored?.data, 'keyId');
+  if (stored && storedKeyId && stored.data.privateKeyP8Base64) {
+    const matched = current.find((item) => item.id === storedKeyId && !keyRevoked(item.attributes));
+    if (matched) {
+      log('Reusing stored App Store Connect API key', storedKeyId);
+      return { secret: stored, keyId: storedKeyId, created: false };
+    }
+    log('Stored App Store Connect API key is no longer active', 'Minting a new one.');
+  }
+
+  const created = await createAppStoreConnectApiKey({ relay, nickname, roles });
+  const keyId = created.id!;
+  const downloaded = await downloadAppStoreConnectApiKeyPrivateKey({ relay, keyId });
+  const data: AppStoreConnectApiKeySecretData = {
+    privateKeyP8Base64: base64FromText(downloaded.privateKeyPem),
+    keyId,
+    issuerId: downloaded.issuerId,
+    nickname,
+    teamID: teamId,
+  };
+
+  let secret: SigningSecret;
+  try {
+    secret = await putAppStoreConnectApiKeySecret(secretStore, secretName, data);
+  } catch (error) {
+    // Apple never serves the private key again; once this throw unwinds
+    // the downloaded copy is gone and the portal key is unusable.
+    throw new Error(
+      `App Store Connect API key ${keyId} was created but saving its private key to the secret ` +
+        `store failed: ${errorText(error)}. The key cannot be downloaded again; revoke key ` +
+        `${keyId} in App Store Connect before retrying, or the retry will mint another key.`,
+    );
+  }
+  log('App Store Connect API key stored', keyId);
+  return { secret, keyId, created: true };
+}
+
+function keyRevoked(attributes: Record<string, unknown> | undefined) {
+  if (!attributes) return false;
+  if (attributes.isActive === false) return true;
+  const revokingDate = attributes.revokingDate ?? attributes.revocationDate;
+  return typeof revokingDate === 'string' && revokingDate !== '';
+}
+
+function base64FromText(text: string) {
+  const bytes = new TextEncoder().encode(text);
+  let binary = '';
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary);
+}
+
 export type ListTeamProfilesInput = {
   relay: AppleRelayWebSocketClient;
   teamId: string;
+  /**
+   * Which portal profile listing to use. The development listing is
+   * unfiltered on the portal side and returns profiles of every
+   * distribution method; adhoc narrows to ad-hoc profiles. Defaults to
+   * development.
+   */
+  profileKind?: AppleProfileKind;
 };
 
-/** Lists the team's development provisioning profiles from the portal. */
-export async function listTeamAppleProfiles({ relay, teamId }: ListTeamProfilesInput) {
-  return listAppleProfiles({ relay, teamId, profileKind: 'development' });
+/** Lists the team's provisioning profiles from the portal. */
+export async function listTeamAppleProfiles({
+  relay,
+  teamId,
+  profileKind = 'development',
+}: ListTeamProfilesInput) {
+  return listAppleProfiles({ relay, teamId, profileKind });
 }
 
 /** Read a string-ish value from a loosely typed portal record. */

package/src/core/device-install/apple/client.ts

@@ -63,12 +63,15 @@ export async function startBrowserOwnedAppleIDLogin({
     if (requiresTwoFactor) {
       twoFactorChallengeResponse = await triggerTrustedDeviceTwoFactor(relay);
       const phone = trustedPhoneNumberFromChallenge(twoFactorChallengeResponse.body);
-      // Only route codes through the phone/SMS endpoint when Apple actually
-      // falls back to phone verification (HTTP 412). The trusted-device
-      // challenge body frequently includes trusted-phone metadata even for a
-      // normal device push; routing those codes to the phone endpoint breaks
-      // trusted-device login.
-      if (twoFactorChallengeResponse.status === 412) {
+      // Route codes through the phone/SMS endpoint only when Apple actually
+      // falls back to phone verification: HTTP 412 on the trusted-device
+      // trigger, or a 2xx challenge whose body says noTrustedDevices (seen on
+      // managed Apple accounts). The trusted-device challenge body frequently
+      // includes trusted-phone metadata even for a normal device push;
+      // routing those codes to the phone endpoint breaks trusted-device
+      // login, while submitting an SMS-fallback code to the trusted-device
+      // endpoint returns 201 without completing authentication.
+      if (twoFactorChallengeResponse.status === 412 || challengeHasNoTrustedDevices(twoFactorChallengeResponse.body)) {
         if (!phone) {
           throw new Error('Apple requested phone verification but did not include a trusted phone number.');
         }
@@ -117,6 +120,10 @@ export async function startBrowserOwnedAppleIDLogin({
   }
 }
 
+function challengeHasNoTrustedDevices(body: unknown) {
+  return isRecord(body) && body.noTrustedDevices === true;
+}
+
 function trustedPhoneNumberFromChallenge(body: unknown) {
   if (!isRecord(body)) return undefined;
   const verification = isRecord(body.phoneNumberVerification) ? body.phoneNumberVerification : undefined;

package/src/core/device-install/apple/provisioning.test.ts

@@ -3,9 +3,11 @@
 import { describe, expect, test } from 'vitest';
 import {
   createAdHocProfileRequest,
+  createAppStoreProfileRequest,
   createDevelopmentProfileRequest,
   downloadDistributionCertificateRequest,
   findAdHocProfilesRequest,
+  findAppStoreProfilesRequest,
   findDevelopmentCertificatesRequest,
   findDistributionCertificatesRequest,
   submitDistributionCSRRequest,
@@ -81,4 +83,32 @@ describe('Apple provisioning request helpers', () => {
       distributionType: 'adhoc',
     });
   });
+
+  test('builds App Store profile payloads without devices and with the caller-provided name', () => {
+    expect(
+      createAppStoreProfileRequest({
+        teamID: 'TEAM',
+        appIDID: 'APP',
+        certificateID: 'CERT',
+        name: 'Acme App Store com.example.app',
+      }).payload,
+    ).toEqual({
+      teamId: 'TEAM',
+      provisioningProfileName: 'Acme App Store com.example.app',
+      certificateIds: ['CERT'],
+      appIdId: 'APP',
+      distributionType: 'store',
+      subPlatform: 'ios',
+    });
+  });
+
+  test('filters App Store profile list requests by store distribution type', () => {
+    expect(
+      findAppStoreProfilesRequest({ bundleID: 'com.example.app', teamID: 'TEAM' }).payload,
+    ).toMatchObject({
+      teamId: 'TEAM',
+      search: 'com.example.app',
+      distributionType: 'store',
+    });
+  });
 });

package/src/core/device-install/apple/provisioning.ts

@@ -141,6 +141,17 @@ export function findAdHocProfilesRequest({
   });
 }
 
+export function findAppStoreProfilesRequest({
+  bundleID,
+  teamID = '',
+}: Pick<AppleProvisioningContext, 'bundleID' | 'teamID'>) {
+  return pagedRequest('/account/ios/profile/listProvisioningProfiles.action', teamID, {
+    search: bundleID,
+    sort: 'name=asc',
+    distributionType: 'store',
+  });
+}
+
 export function registerDeviceRequest({
   deviceUDID,
   teamID = '',
@@ -280,6 +291,34 @@ export function createAdHocProfileRequest({
   } satisfies AppleProvisioningRequest;
 }
 
+/**
+ * App Store distribution profiles bind no devices, and the name is required
+ * because implementors brand profiles themselves; there is no default.
+ */
+export function createAppStoreProfileRequest({
+  teamID = '',
+  appIDID,
+  certificateID,
+  name,
+}: Pick<AppleProvisioningContext, 'teamID'> & {
+  appIDID: string;
+  certificateID: string;
+  name: string;
+}) {
+  return {
+    method: 'POST',
+    path: '/account/ios/profile/createProvisioningProfile.action',
+    payload: {
+      teamId: teamID,
+      provisioningProfileName: name,
+      certificateIds: [certificateID],
+      appIdId: appIDID,
+      distributionType: 'store',
+      subPlatform: 'ios',
+    },
+  } satisfies AppleProvisioningRequest;
+}
+
 export function downloadProfileRequest(profileID: string, teamID = '') {
   return {
     method: 'GET',

package/src/core/device-install/apple/relay.ts

@@ -15,6 +15,19 @@ export type AppleProvisioningRequest = {
   payload?: unknown;
 };
 
+/**
+ * A session-authenticated App Store Connect request proxied by the relay.
+ * Unlike provisioning requests, payloads pass through as JSON and GET
+ * parameters go into an explicit query map because the App Store Connect
+ * API uses bracketed JSON:API keys like fields[apiKeys].
+ */
+export type AppStoreConnectRequest = {
+  method?: 'GET' | 'POST';
+  path: string;
+  query?: Record<string, string>;
+  payload?: unknown;
+};
+
 type AppleRelayWebSocketMessage<T = unknown> = {
   id: string;
   ok: boolean;
@@ -154,6 +167,13 @@ export async function proxyProvisioningRequest<T = unknown>(
   return relay.request<T>('provisioning', request);
 }
 
+export async function proxyAppStoreConnectRequest<T = unknown>(
+  relay: AppleRelayWebSocketClient,
+  request: AppStoreConnectRequest,
+) {
+  return relay.request<T>('appstoreconnect', request);
+}
+
 function normalizeAppleProxyResponse<T>(response: AppleRelayResponse<T>) {
   if (response.body !== undefined || !response.rawBody) {
     return response;

package/src/core/device-install/operations/operations.ts

@@ -180,7 +180,12 @@ async function claimBestUsbmuxCandidate(target: DeviceRelayTarget, log: DeviceIn
       }
     }
   }
-  throw lastError instanceof Error ? lastError : new Error('Unable to claim any Apple usbmux interface.');
+  const detail = lastError ? ` (${errorMessage(lastError)})` : '';
+  throw new Error(
+    'Could not get exclusive USB access to the iPhone' +
+      `${detail}. Another app on this computer is likely connected to it. ` +
+      'Close other browser tabs that use this device, quit iPhone Mirroring, Xcode, eject iPhone in Finder windows showing the phone and try again.',
+  );
 }
 
 function pickUsbmuxCandidate(device: USBDevice) {

package/src/core/device-install/storage/secret-store.ts

@@ -10,10 +10,12 @@
 
 export const APPLE_CERTIFICATE_SECRET_TYPE = 'appleCertificate';
 export const APPLE_PROVISIONING_PROFILE_SECRET_TYPE = 'appleProvisioningProfile';
+export const APP_STORE_CONNECT_API_KEY_SECRET_TYPE = 'appStoreConnectApiKey';
 
 export type SigningSecretType =
   | typeof APPLE_CERTIFICATE_SECRET_TYPE
-  | typeof APPLE_PROVISIONING_PROFILE_SECRET_TYPE;
+  | typeof APPLE_PROVISIONING_PROFILE_SECRET_TYPE
+  | typeof APP_STORE_CONNECT_API_KEY_SECRET_TYPE;
 
 export type SigningSecretMetadata = {
   type: string;
@@ -94,6 +96,24 @@ export type AppleProvisioningProfileSecretData = {
   expirationDate?: string;
 };
 
+/**
+ * Data payload of an appStoreConnectApiKey secret: the private half of an
+ * App Store Connect API key plus the identifiers needed to sign JWTs with
+ * it. Apple serves the private key exactly once, so the stored copy is the
+ * only one.
+ */
+export type AppStoreConnectApiKeySecretData = {
+  /** Base64 of the .p8 private key PEM. */
+  privateKeyP8Base64: string;
+  /** Apple's key ID, e.g. 2X9R4HXF34. */
+  keyId: string;
+  /** Issuer ID for team keys. Absent for individual keys. */
+  issuerId?: string;
+  nickname?: string;
+  teamID?: string;
+  expirationDate?: string;
+};
+
 function compactData(data: Record<string, string | undefined>): SigningSecretData {
   const result: SigningSecretData = {};
   for (const [key, value] of Object.entries(data)) {
@@ -124,6 +144,18 @@ export async function putAppleProvisioningProfileSecret(
   return store.put(APPLE_PROVISIONING_PROFILE_SECRET_TYPE, name, compactData(data));
 }
 
+/**
+ * Stores an App Store Connect API key, conventionally named
+ * `${teamID}/APP_STORE_CONNECT_API_KEY`: one shared key per team.
+ */
+export async function putAppStoreConnectApiKeySecret(
+  store: SigningSecretStore,
+  name: string,
+  data: AppStoreConnectApiKeySecretData,
+) {
+  return store.put(APP_STORE_CONNECT_API_KEY_SECRET_TYPE, name, compactData(data));
+}
+
 export type LimrunSecretStoreOptions = {
   /** Base URL of the Limrun backend API, e.g. https://api.limrun.com */
   apiUrl: string;
@@ -200,7 +232,9 @@ export function createLimrunSecretStore(options: LimrunSecretStoreOptions): Sign
       return result
         .filter(
           (s) =>
-            s.type === APPLE_CERTIFICATE_SECRET_TYPE || s.type === APPLE_PROVISIONING_PROFILE_SECRET_TYPE,
+            s.type === APPLE_CERTIFICATE_SECRET_TYPE ||
+            s.type === APPLE_PROVISIONING_PROFILE_SECRET_TYPE ||
+            s.type === APP_STORE_CONNECT_API_KEY_SECRET_TYPE,
         )
         .map((s) => ({ type: s.type, name: s.name, createdAt: s.createdAt }));
     },

package/dist/client-D1drDXxE.js

@@ -1 +0,0 @@
-"use strict";const F=require("./gsa-srp-CCIfUz7Y.js");class g{constructor(t,r,o){this.apiUrl=t,this.token=r,this.organizationId=o}socket;nextId=1;pending=new Map;async connect(){if(this.socket&&this.socket.readyState===WebSocket.OPEN)return;const t=new WebSocket(E(this.apiUrl,this.token,this.organizationId));this.socket=t,t.onmessage=r=>this.handleMessage(r),t.onclose=()=>this.rejectPending(new Error("Apple relay WebSocket closed")),t.onerror=()=>this.rejectPending(new Error("Apple relay WebSocket failed")),await new Promise((r,o)=>{t.onopen=()=>r(),t.onerror=()=>o(new Error("Apple relay WebSocket connection failed"))})}request(t,r){const o=this.socket;if(!o||o.readyState!==WebSocket.OPEN)throw new Error("Apple relay WebSocket is not connected.");const a=String(this.nextId++),n=new Promise((p,i)=>{this.pending.set(a,{resolve:h=>p(q(h)),reject:i})});return o.send(JSON.stringify({id:a,type:t,...r===void 0?{}:{payload:r}})),n}close(){this.rejectPending(new Error("Apple relay WebSocket closed")),this.socket?.close(),this.socket=void 0}handleMessage(t){const r=JSON.parse(String(t.data)),o=this.pending.get(r.id);if(o){if(this.pending.delete(r.id),!r.ok){o.reject(new Error(r.error||"Apple relay request failed"));return}if(!r.response){o.reject(new Error("Apple relay response was empty."));return}o.resolve(r.response)}}rejectPending(t){for(const r of this.pending.values())r.reject(t);this.pending.clear()}}async function m(e,t,r){const o=new g(e,t,r);return await o.connect(),o}async function S(e,t){return e.request("srpInit",t)}async function A(e,t){return e.request("srpComplete",t)}async function P(e){return e.request("triggerTrustedDevice2FA")}async function b(e,t,r="sms"){return e.request("triggerPhone2FA",{phoneNumberId:t,mode:r})}async function k(e,t){return e.request("submitTrustedDevice2FA",{code:t})}async function T(e,t,r,o="sms"){return e.request("submitPhone2FA",{phoneNumberId:t,mode:o,code:r})}async function v(e){return e.request("finalize")}async function R(e,t){return e.request("provisioning",t)}function q(e){if(e.body!==void 0||!e.rawBody)return e;try{return{...e,body:JSON.parse(e.rawBody)}}catch{return e}}function E(e,t,r){const o=new URL(e);return o.protocol=o.protocol==="https:"?"wss:":"ws:",o.pathname=`${o.pathname.replace(/\/$/,"")}/ios/appstoreconnect/ws`,t&&o.searchParams.set("token",t),r&&o.searchParams.set("organization",r),o.toString()}async function N({registryApiUrl:e,accountName:t,password:r,token:o,organizationId:a}){const n=await m(e,o,a);try{const p=new F.AppleGsaSrpClient(t),i=await S(n,await p.init());if(i.status<200||i.status>=300)throw new Error(`Apple SRP init failed: HTTP ${i.status} ${i.rawBody??""}`.trim());if(!i.body)throw new Error("Apple SRP init response did not include a body.");const h=await p.complete(r,i.body),u=await A(n,{...h,rememberMe:!1,trustTokens:[]}),y=u.status===409;let s,d={type:"trustedDevice"};if(y){s=await P(n);const c=x(s.body);if(s.status===412){if(!c)throw new Error("Apple requested phone verification but did not include a trusted phone number.");d={type:"phone",phoneNumberId:c.id,mode:c.pushMode??"sms"},s=await b(n,c.id,c.pushMode??"sms")}if(s.status<200||s.status>=300)throw new Error(`Apple two-factor challenge failed: HTTP ${s.status} ${s.rawBody??""}`.trim())}else if(u.status<200||u.status>=300)throw new Error(`Apple SRP complete failed: HTTP ${u.status} ${u.rawBody??""}`.trim());return{relay:n,completeResponse:u,twoFactorChallengeResponse:s,requiresTwoFactor:y,finishTwoFactor:async c=>{const l=d.type==="phone"?await T(n,d.phoneNumberId,c,d.mode):await k(n,c);if(l.status<200||l.status>=300)throw new Error(`Apple two-factor code failed: HTTP ${l.status} ${l.rawBody??""}`.trim());return l},finalize:async()=>v(n),close:async()=>n.close()}}catch(p){throw n.close(),p}}function x(e){if(!f(e))return;const t=f(e.phoneNumberVerification)?e.phoneNumberVerification:void 0,r=w(t?.trustedPhoneNumber)??w(e.trustedPhoneNumber)??w(e.phoneNumber);if(!r)return;const o=r.id;if(typeof o!="number")return;const a=typeof r.pushMode=="string"?r.pushMode:typeof e.mode=="string"?e.mode:void 0;return{id:o,pushMode:a}}function w(e){return f(e)?e:void 0}function f(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}exports.AppleRelayWebSocketClient=g;exports.fetchAppleAccountSession=v;exports.openAppleRelayWebSocket=m;exports.proxyPhoneTwoFactorCode=T;exports.proxyProvisioningRequest=R;exports.proxySrpComplete=A;exports.proxySrpInit=S;exports.proxyTwoFactorCode=k;exports.startBrowserOwnedAppleIDLogin=N;exports.triggerPhoneTwoFactor=b;exports.triggerTrustedDeviceTwoFactor=P;

package/dist/provisioning-BlQMccX_.js

@@ -1 +0,0 @@
-"use strict";const a=require("./browser-storage-DLxIqZk5.js");function c(){return{method:"POST",path:"/account/listTeams.action",payload:{}}}function u({bundleID:e,teamID:t=""}){return s("/account/ios/identifiers/listAppIds.action",t,{sort:"name=asc"})}function d({deviceUDID:e,teamID:t=""}){return s("/account/ios/device/listDevices.action",t,{sort:"name=asc",includeRemovedDevices:!1})}function f(e=""){return s("/account/ios/certificate/listCertRequests.action",e,{sort:"name=asc",types:"83Q87W3TGH,5QPB9NHCEI"})}function l(e=""){return s("/account/ios/certificate/listCertRequests.action",e,{sort:"name=asc",types:"WXV89964HE,R58UK2EWSO"})}function p({bundleID:e,teamID:t=""}){return s("/account/ios/profile/listProvisioningProfiles.action",t,{search:e,sort:"name=asc"})}function m({bundleID:e,teamID:t=""}){return s("/account/ios/profile/listProvisioningProfiles.action",t,{search:e,sort:"name=asc",distributionType:"adhoc"})}function R({deviceUDID:e,teamID:t="",name:i="Limrun iPhone"}){return{method:"POST",path:"/account/ios/device/addDevices.action",payload:{teamId:t,deviceNames:i,deviceNumbers:a.normalizeUDID(e),deviceClasses:"iphone",register:"single"}}}function g({bundleID:e,teamID:t="",name:i}){return{method:"POST",path:"/account/ios/identifiers/addAppId.action",payload:{teamId:t,name:i??e,identifier:e,type:"explicit"}}}function q({csrPEM:e,teamID:t=""}){return{method:"POST",path:"/account/ios/certificate/submitCertificateRequest.action",payload:{teamId:t,type:"83Q87W3TGH",csrContent:e}}}function v({csrPEM:e,teamID:t=""}){return{method:"POST",path:"/account/ios/certificate/submitCertificateRequest.action",payload:{teamId:t,type:"WXV89964HE",csrContent:e}}}function P(e,t=""){return{method:"GET",path:"/account/ios/certificate/downloadCertificateContent.action",payload:{teamId:t,certificateId:e,type:"83Q87W3TGH"}}}function D(e,t=""){return{method:"GET",path:"/account/ios/certificate/downloadCertificateContent.action",payload:{teamId:t,certificateId:e,type:"WXV89964HE"}}}function I({bundleID:e,teamID:t="",appIDID:i,certificateID:o,deviceIDs:n,name:r}){return{method:"POST",path:"/account/ios/profile/createProvisioningProfile.action",payload:{teamId:t,provisioningProfileName:r??`Limrun ${e}`,certificateIds:[o],appIdId:i,deviceIds:n,distributionType:"limited",subPlatform:"ios"}}}function h({bundleID:e,teamID:t="",appIDID:i,certificateID:o,deviceIDs:n,name:r}){return{method:"POST",path:"/account/ios/profile/createProvisioningProfile.action",payload:{teamId:t,provisioningProfileName:r??`Limrun Ad Hoc ${e}`,certificateIds:[o],appIdId:i,deviceIds:n,distributionType:"adhoc",subPlatform:"ios"}}}function C(e,t=""){return{method:"GET",path:"/account/ios/profile/downloadProfileContent",payload:{teamId:t,provisioningProfileId:e}}}async function b({bundleID:e,deviceUDID:t,teamID:i,signingMode:o}){const n=await a.getSigningAssets({bundleID:e,deviceUDID:t,signingMode:o});if(!(!n||!S(n,{bundleID:e,deviceUDID:t,teamID:i,signingMode:o})))return n}async function y(e){return a.putSigningAssets({...e,certificateFileName:e.certificateID?`${e.certificateID}.p12`:`apple-${e.signingMode??"development"}.p12`,certificatePassword:e.certificatePassword||void 0,signingMode:e.signingMode,profileFileName:e.profile.uuid?`${e.profile.uuid}.mobileprovision`:`${e.signingMode??"development"}.mobileprovision`})}function S(e,{bundleID:t,deviceUDID:i,teamID:o,signingMode:n="development"}){return(e.signingMode??"development")!==n||!a.profileMatchesBundleID(e.profile,t)||o&&e.teamID&&e.teamID!==o||i&&!a.profileContainsDevice(e.profile,i)||e.profile.expirationDate&&new Date(e.profile.expirationDate).getTime()<=Date.now()?!1:a.normalizeBundleID(e.bundleID)===a.normalizeBundleID(t)}function s(e,t,i={}){const o={pageNumber:1,pageSize:200,...i};return t&&(o.teamId=t),{method:"POST",path:e,payload:o}}exports.createAdHocProfileRequest=h;exports.createBundleIDRequest=g;exports.createDevelopmentProfileRequest=I;exports.downloadCertificateRequest=P;exports.downloadDistributionCertificateRequest=D;exports.downloadProfileRequest=C;exports.findAdHocProfilesRequest=m;exports.findBundleIDRequest=u;exports.findDevelopmentCertificatesRequest=f;exports.findDevelopmentProfilesRequest=p;exports.findDeviceRequest=d;exports.findDistributionCertificatesRequest=l;exports.getReusableAppleSigningAssets=b;exports.listTeamsRequest=c;exports.putAppleGeneratedSigningAssets=y;exports.registerDeviceRequest=R;exports.submitDevelopmentCSRRequest=q;exports.submitDistributionCSRRequest=v;