@limrun/ui 0.14.0-rc.5 → 0.14.0

package/src/app-store-relay/react.ts

@@ -1,131 +0,0 @@
-import { useCallback, useEffect, useRef, useState } from 'react';
-import {
-  startBrowserOwnedAppleIDLogin,
-  type AppleIDLoginInput,
-  type AppleIDLoginResult,
-  type AppleRelayResponse,
-} from './index';
-import { errorMessage } from '../core/errors';
-
-export type UseAppleIDLoginOptions = Pick<AppleIDLoginInput, 'registryApiUrl' | 'token' | 'organizationId'>;
-
-export type AppleIDLoginStatus =
-  | 'idle'
-  | 'authenticating'
-  | 'two-factor-required'
-  | 'authenticated'
-  | 'error';
-
-export type UseAppleIDLoginResult = {
-  status: AppleIDLoginStatus;
-  session?: AppleIDLoginResult;
-  completeResponse?: AppleRelayResponse;
-  twoFactorChallengeResponse?: AppleRelayResponse;
-  error?: string;
-  startLogin: (
-    input: Pick<AppleIDLoginInput, 'accountName' | 'password'>,
-  ) => Promise<AppleIDLoginResult | undefined>;
-  submitTwoFactorCode: (code: string) => Promise<AppleRelayResponse | undefined>;
-  finalize: () => Promise<AppleRelayResponse | undefined>;
-  close: () => Promise<void>;
-};
-
-export function useAppleIDLogin({
-  registryApiUrl,
-  token,
-  organizationId,
-}: UseAppleIDLoginOptions): UseAppleIDLoginResult {
-  const [status, setStatus] = useState<AppleIDLoginStatus>('idle');
-  const [session, setSession] = useState<AppleIDLoginResult | undefined>();
-  const [completeResponse, setCompleteResponse] = useState<AppleRelayResponse | undefined>();
-  const [twoFactorChallengeResponse, setTwoFactorChallengeResponse] = useState<
-    AppleRelayResponse | undefined
-  >();
-  const [error, setError] = useState<string | undefined>();
-  const sessionRef = useRef<AppleIDLoginResult | undefined>(undefined);
-
-  const close = useCallback(async () => {
-    await sessionRef.current?.close().catch(() => undefined);
-    sessionRef.current = undefined;
-    setSession(undefined);
-    setCompleteResponse(undefined);
-    setTwoFactorChallengeResponse(undefined);
-    setError(undefined);
-    setStatus('idle');
-  }, []);
-
-  useEffect(() => {
-    return () => {
-      void sessionRef.current?.close();
-      sessionRef.current = undefined;
-    };
-  }, []);
-
-  const startLogin = useCallback(
-    async ({ accountName, password }: Pick<AppleIDLoginInput, 'accountName' | 'password'>) => {
-      setStatus('authenticating');
-      setError(undefined);
-      await sessionRef.current?.close().catch(() => undefined);
-      try {
-        const next = await startBrowserOwnedAppleIDLogin({
-          registryApiUrl,
-          token,
-          organizationId,
-          accountName,
-          password,
-        });
-        sessionRef.current = next;
-        setSession(next);
-        setCompleteResponse(next.completeResponse);
-        setTwoFactorChallengeResponse(next.twoFactorChallengeResponse);
-        setStatus(next.requiresTwoFactor ? 'two-factor-required' : 'authenticated');
-        return next;
-      } catch (caught) {
-        setSession(undefined);
-        sessionRef.current = undefined;
-        setError(errorMessage(caught));
-        setStatus('error');
-        return undefined;
-      }
-    },
-    [registryApiUrl, organizationId, token],
-  );
-
-  const submitTwoFactorCode = useCallback(async (code: string) => {
-    const current = sessionRef.current;
-    if (!current) {
-      throw new Error('Start Apple ID login before submitting a two-factor code.');
-    }
-    setStatus('authenticating');
-    setError(undefined);
-    try {
-      const response = await current.finishTwoFactor(code);
-      setStatus('authenticated');
-      return response;
-    } catch (caught) {
-      setError(errorMessage(caught));
-      setStatus('error');
-      return undefined;
-    }
-  }, []);
-
-  const finalize = useCallback(async () => {
-    const current = sessionRef.current;
-    if (!current) {
-      throw new Error('Start Apple ID login before finalizing the Apple session.');
-    }
-    return current.finalize();
-  }, []);
-
-  return {
-    status,
-    session,
-    completeResponse,
-    twoFactorChallengeResponse,
-    error,
-    startLogin,
-    submitTwoFactorCode,
-    finalize,
-    close,
-  };
-}

package/src/apple-credentials/index.test.ts

@@ -1,180 +0,0 @@
-// @vitest-environment node
-
-import forge from 'node-forge';
-import { describe, expect, test } from 'vitest';
-import type { AppleRelayWebSocketClient } from '../core/device-install/apple';
-import {
-  APPLE_CERTIFICATE_SECRET_TYPE,
-  appleCertificateSecretName,
-  ensureAppleCertificateSecret,
-  type SigningSecret,
-  type SigningSecretMetadata,
-  type SigningSecretStore,
-  type SigningSecretType,
-} from './index';
-
-/**
- * A self-signed certificate is enough for exportAppleCertificateP12: the
- * p12 bundling never verifies that the key matches the certificate.
- */
-function selfSignedCertificateBase64() {
-  const keys = forge.pki.rsa.generateKeyPair(1024);
-  const cert = forge.pki.createCertificate();
-  cert.publicKey = keys.publicKey;
-  cert.serialNumber = '01';
-  cert.validity.notBefore = new Date();
-  cert.validity.notAfter = new Date(Date.now() + 24 * 60 * 60 * 1000);
-  const attrs = [{ name: 'commonName', value: 'Apple Development Test' }];
-  cert.setSubject(attrs);
-  cert.setIssuer(attrs);
-  cert.sign(keys.privateKey);
-  return forge.util.encode64(forge.asn1.toDer(forge.pki.certificateToAsn1(cert)).getBytes());
-}
-
-function memorySecretStore(options: { failPuts?: () => boolean } = {}) {
-  const entries = new Map<string, SigningSecret>();
-  const store: SigningSecretStore = {
-    async put(type: SigningSecretType, name: string, data: Record<string, string>) {
-      if (options.failPuts?.()) {
-        throw new Error('secret store unavailable');
-      }
-      const secret: SigningSecret = { type, name, data, createdAt: new Date().toISOString() };
-      entries.set(`${type}:${name}`, secret);
-      return secret;
-    },
-    async get(type: SigningSecretType, name: string) {
-      return entries.get(`${type}:${name}`);
-    },
-    async list() {
-      return [...entries.values()].map(({ data: _data, ...metadata }): SigningSecretMetadata => metadata);
-    },
-    async delete(type: SigningSecretType, name: string) {
-      entries.delete(`${type}:${name}`);
-    },
-  };
-  return { store, entries };
-}
-
-type PortalState = { mintedCertificateIds: string[]; certificateBase64: string };
-
-/**
- * Fakes the relay's provisioning proxy: minting appends to
- * mintedCertificateIds, listing reflects what has been minted so far.
- */
-function fakePortalRelay(state: PortalState): AppleRelayWebSocketClient {
-  return {
-    async request(_type: string, payload: unknown) {
-      const request = payload as { path: string };
-      if (request.path.includes('listCertRequests')) {
-        return portalOK({
-          certRequests: state.mintedCertificateIds.map((certificateId) => ({ certificateId })),
-        });
-      }
-      if (request.path.includes('submitCertificateRequest')) {
-        const certificateId = `CERT${state.mintedCertificateIds.length + 1}`;
-        state.mintedCertificateIds.push(certificateId);
-        return portalOK({
-          certRequest: {
-            certificateId,
-            serialNum: '01',
-            expirationDateString: '2027-01-01',
-          },
-        });
-      }
-      if (request.path.includes('downloadCertificateContent')) {
-        return { status: 200, statusText: 'OK', rawBodyBase64: state.certificateBase64 };
-      }
-      throw new Error(`unexpected portal path: ${request.path}`);
-    },
-  } as unknown as AppleRelayWebSocketClient;
-}
-
-function portalOK(body: Record<string, unknown>) {
-  return { status: 200, statusText: 'OK', body: { resultCode: 0, ...body } };
-}
-
-describe('ensureAppleCertificateSecret', () => {
-  const teamId = 'TEAM1';
-  const secretName = appleCertificateSecretName(teamId, 'DEVELOPMENT');
-
-  test('surfaces an actionable error when the store write fails after minting', async () => {
-    const state: PortalState = {
-      mintedCertificateIds: [],
-      certificateBase64: selfSignedCertificateBase64(),
-    };
-    const broken = memorySecretStore({ failPuts: () => true });
-
-    await expect(
-      ensureAppleCertificateSecret({
-        relay: fakePortalRelay(state),
-        teamId,
-        secretStore: broken.store,
-      }),
-    ).rejects.toThrow(/revoke certificate CERT1/);
-    expect(state.mintedCertificateIds).toEqual(['CERT1']);
-  });
-
-  test('mints and stores the certificate with its type in the secret name', async () => {
-    const state: PortalState = {
-      mintedCertificateIds: [],
-      certificateBase64: selfSignedCertificateBase64(),
-    };
-    const org = memorySecretStore();
-
-    const result = await ensureAppleCertificateSecret({
-      relay: fakePortalRelay(state),
-      teamId,
-      secretStore: org.store,
-    });
-    expect(result.created).toBe(true);
-    expect(result.certificateId).toBe('CERT1');
-    const stored = await org.store.get(APPLE_CERTIFICATE_SECRET_TYPE, secretName);
-    expect(stored?.data.certificateID).toBe('CERT1');
-    expect(stored?.data.certificateType).toBe('DEVELOPMENT');
-    expect(stored?.data.certificateP12Base64).toBeTruthy();
-  });
-
-  test('mints distribution certificates under their own secret name', async () => {
-    const state: PortalState = {
-      mintedCertificateIds: [],
-      certificateBase64: selfSignedCertificateBase64(),
-    };
-    const org = memorySecretStore();
-
-    const result = await ensureAppleCertificateSecret({
-      relay: fakePortalRelay(state),
-      teamId,
-      secretStore: org.store,
-      certificateKind: 'distribution',
-    });
-    expect(result.created).toBe(true);
-    const stored = await org.store.get(
-      APPLE_CERTIFICATE_SECRET_TYPE,
-      appleCertificateSecretName(teamId, 'DISTRIBUTION'),
-    );
-    expect(stored?.data.certificateType).toBe('DISTRIBUTION');
-    expect(stored?.data.certificateP12Base64).toBeTruthy();
-  });
-
-  test('reuses the stored certificate when it is still on the team', async () => {
-    const state: PortalState = {
-      mintedCertificateIds: ['CERT1'],
-      certificateBase64: selfSignedCertificateBase64(),
-    };
-    const org = memorySecretStore();
-    await org.store.put(APPLE_CERTIFICATE_SECRET_TYPE, secretName, {
-      certificateP12Base64: 'cDEy',
-      certificateID: 'CERT1',
-      teamID: teamId,
-    });
-
-    const result = await ensureAppleCertificateSecret({
-      relay: fakePortalRelay(state),
-      teamId,
-      secretStore: org.store,
-    });
-    expect(result.created).toBe(false);
-    expect(result.certificateId).toBe('CERT1');
-    expect(state.mintedCertificateIds).toEqual(['CERT1']);
-  });
-});

package/src/apple-credentials/index.ts

@@ -1,388 +0,0 @@
-/**
- * Headless helpers that turn an authenticated Apple relay session into
- * signing credentials persisted in a SigningSecretStore. The Apple relay
- * only proxies: certificate and profile bytes always land in the browser
- * first, and the browser writes them into the configured store (Limrun's
- * org secret store by default, or a customer-provided one).
- */
-import {
-  createAppleCertificate,
-  createAppStoreConnectApiKey,
-  downloadAppleCertificate,
-  downloadAppleProfile,
-  downloadAppStoreConnectApiKeyPrivateKey,
-  exportAppleCertificateP12,
-  generateAppleSigningKeyAndCSR,
-  listAppleCertificates,
-  listAppleProfiles,
-  listAppStoreConnectApiKeys,
-  switchAppStoreConnectProvider,
-  type AppleCertificateKind,
-  type AppleProfileKind,
-  type AppStoreConnectApiKeyRole,
-} from '../app-store-relay';
-import type { AppleRelayWebSocketClient } from '../core/device-install/apple';
-import {
-  normalizeCertificateSerial,
-  parseProvisioningProfileBase64,
-} from '../core/device-install/storage/browser-storage';
-import {
-  APP_STORE_CONNECT_API_KEY_SECRET_TYPE,
-  APPLE_CERTIFICATE_SECRET_TYPE,
-  putAppleCertificateSecret,
-  putAppleProvisioningProfileSecret,
-  putAppStoreConnectApiKeySecret,
-  type AppleCertificateSecretData,
-  type AppleCertificateType,
-  type AppStoreConnectApiKeySecretData,
-  type SigningSecret,
-  type SigningSecretStore,
-} from '../core/device-install/storage/secret-store';
-
-export {
-  APP_STORE_CONNECT_API_KEY_SECRET_TYPE,
-  APPLE_CERTIFICATE_SECRET_TYPE,
-  APPLE_PROVISIONING_PROFILE_SECRET_TYPE,
-  createBrowserSecretStore,
-  createLimrunSecretStore,
-  putAppleCertificateSecret,
-  putAppleProvisioningProfileSecret,
-  putAppStoreConnectApiKeySecret,
-  type AppleCertificateSecretData,
-  type AppleCertificateType,
-  type AppleProvisioningProfileSecretData,
-  type AppStoreConnectApiKeySecretData,
-  type LimrunSecretStoreOptions,
-  type SigningSecret,
-  type SigningSecretData,
-  type SigningSecretMetadata,
-  type SigningSecretStore,
-  type SigningSecretType,
-} from '../core/device-install/storage/secret-store';
-export { normalizeCertificateSerial } from '../core/device-install/storage/browser-storage';
-
-/**
- * Conventional secret name of a team's certificate bundle. One bundle per
- * team and Apple certificate type; the type is in the name so development
- * and distribution material never collide.
- */
-export function appleCertificateSecretName(teamId: string, certificateType: AppleCertificateType) {
-  return `${teamId}/${certificateType}`;
-}
-
-export type EnsureAppleCertificateInput = {
-  relay: AppleRelayWebSocketClient;
-  teamId: string;
-  secretStore: SigningSecretStore;
-  /**
-   * Which portal certificate kind to ensure. Ad-hoc and App Store signing
-   * both use the distribution certificate. Defaults to development.
-   */
-  certificateKind?: AppleCertificateKind;
-  /** Common name used when minting a new certificate. */
-  commonName?: string;
-  log?: (message: string, detail?: string) => void;
-};
-
-export type EnsureAppleCertificateResult = {
-  secret: SigningSecret;
-  certificateId: string;
-  /** True when a new certificate was minted instead of reusing the stored one. */
-  created: boolean;
-};
-
-/**
- * Returns a usable certificate secret of the requested kind for the team,
- * reusing the stored one when its certificate is still on the team and
- * minting a new one otherwise. Apple caps certificates per kind (2 for
- * development, 3 for distribution) and never returns private keys, so
- * reuse of the stored p12 is strongly preferred.
- *
- * Durability of the stored material is the secret store's concern:
- * implementors who want retries or fallbacks build them into their
- * SigningSecretStore.
- */
-export async function ensureAppleCertificateSecret({
-  relay,
-  teamId,
-  secretStore,
-  certificateKind = 'development',
-  commonName,
-  log = () => {},
-}: EnsureAppleCertificateInput): Promise<EnsureAppleCertificateResult> {
-  // The portal kinds map onto Apple's App Store Connect certificate type
-  // enum, which is what consumers of the stored secret filter on.
-  const certificateType: AppleCertificateType =
-    certificateKind === 'distribution' ? 'DISTRIBUTION' : 'DEVELOPMENT';
-  const secretName = appleCertificateSecretName(teamId, certificateType);
-  const current = await listAppleCertificates({ relay, teamId, certificateKind });
-  const findOnTeam = (certificateId: string | undefined) =>
-    certificateId === undefined ? undefined : (
-      current.find(
-        (item) =>
-          stringField(item, 'certificateId') === certificateId ||
-          stringField(item, 'certRequestId') === certificateId,
-      )
-    );
-
-  const stored = await secretStore.get(APPLE_CERTIFICATE_SECRET_TYPE, secretName);
-  const storedCertificateId = stringField(stored?.data, 'certificateID');
-  if (stored && storedCertificateId && stored.data.certificateP12Base64) {
-    // The stored value may be a certRequestId; resolve the canonical
-    // certificateId the profile API expects. If the cert is no longer on
-    // the team (revoked), fall through and mint a new one.
-    const matched = findOnTeam(storedCertificateId);
-    if (matched) {
-      const certificateId = stringField(matched, 'certificateId') ?? storedCertificateId;
-      log('Reusing stored Apple certificate', certificateId);
-      return { secret: stored, certificateId, created: false };
-    }
-    log('Stored certificate is no longer on the team', 'Minting a new one.');
-  }
-
-  // The private key is generated and kept in this browser; Apple only ever
-  // sees the CSR. Without this key the downloaded cert cannot sign anything.
-  const key = await generateAppleSigningKeyAndCSR({ commonName: commonName ?? `Limrun ${teamId}` });
-  const certificate = await createAppleCertificate({
-    relay,
-    teamId,
-    certificateKind,
-    csrPEM: key.csrPEM,
-  });
-  const certificateId =
-    stringField(certificate, 'certificateId') ?? stringField(certificate, 'certRequestId');
-  if (!certificateId) {
-    throw new Error('Apple certificate creation did not return a certificate ID.');
-  }
-  const downloaded = await downloadAppleCertificate({
-    relay,
-    teamId,
-    certificateKind,
-    certificateId,
-  });
-  if (!downloaded.rawBodyBase64) {
-    throw new Error('Apple certificate download returned no bytes.');
-  }
-  const data: AppleCertificateSecretData = {
-    certificateP12Base64: exportAppleCertificateP12({
-      privateKeyPKCS8Base64: key.privateKeyPKCS8Base64,
-      certificateBase64: downloaded.rawBodyBase64,
-      password: '',
-      friendlyName: `Apple ${certificateKind === 'distribution' ? 'Distribution' : 'Development'} ${teamId}`,
-    }),
-    certificateType,
-    teamID: teamId,
-    certificateID: certificateId,
-    // Normalized so it equals the serials profiles reference.
-    serialNumber: normalizeCertificateSerial(stringField(certificate, 'serialNum')),
-    expirationDate: stringField(certificate, 'expirationDateString'),
-  };
-
-  let secret: SigningSecret;
-  try {
-    secret = await putAppleCertificateSecret(secretStore, secretName, data);
-  } catch (error) {
-    // The key existed only in this browser's memory; once this throw
-    // unwinds it is gone, and the portal certificate is unusable.
-    throw new Error(
-      `Certificate ${certificateId} was created on the Apple Developer portal but saving its private ` +
-        `key to the secret store failed: ${errorText(error)}. The key cannot be recovered; revoke ` +
-        `certificate ${certificateId} at developer.apple.com before retrying, or the retry will mint ` +
-        `another certificate against Apple's limit.`,
-    );
-  }
-  log('Apple certificate stored', certificateId);
-  return { secret, certificateId, created: true };
-}
-
-function errorText(error: unknown) {
-  return error instanceof Error ? error.message : String(error);
-}
-
-export type SaveAppleProfileInput = {
-  relay: AppleRelayWebSocketClient;
-  teamId: string;
-  profileId: string;
-  secretStore: SigningSecretStore;
-  log?: (message: string, detail?: string) => void;
-};
-
-/**
- * Downloads the provisioning profile and stores it as an
- * appleProvisioningProfile secret named `${teamId}/${uuid}`. The UUID is
- * unique per profile, so a team can hold many profiles for the same
- * bundle ID and certificate set; the reference fields (certificate
- * serials, bundle IDs, device IDs parsed out of the profile) are what
- * consumers filter on.
- */
-export async function saveAppleProfileSecret({
-  relay,
-  teamId,
-  profileId,
-  secretStore,
-  log = () => {},
-}: SaveAppleProfileInput): Promise<SigningSecret> {
-  const downloaded = await downloadAppleProfile({ relay, teamId, profileId });
-  const profileBase64 = downloaded.rawBodyBase64;
-  if (!profileBase64) {
-    throw new Error('Apple provisioning profile download returned no bytes.');
-  }
-  const info = parseProvisioningProfileBase64(profileBase64);
-  const name = `${teamId}/${info.uuid ?? profileId}`;
-  const secret = await putAppleProvisioningProfileSecret(secretStore, name, {
-    provisioningProfileBase64: profileBase64,
-    certificateSerialNumbers: info.certificateSerialNumbers.join(','),
-    bundleIDs: info.bundleID,
-    deviceIDs: info.provisionedDevices.join(','),
-    teamID: info.teamID ?? teamId,
-    profileName: info.name,
-    uuid: info.uuid,
-    expirationDate: info.expirationDate,
-  });
-  log('Apple provisioning profile stored', name);
-  return secret;
-}
-
-/**
- * Conventional secret name of a team's App Store Connect API key: one
- * shared key per team.
- */
-export function appStoreConnectApiKeySecretName(teamId: string) {
-  return `${teamId}/APP_STORE_CONNECT_API_KEY`;
-}
-
-export type EnsureAppStoreConnectApiKeyInput = {
-  relay: AppleRelayWebSocketClient;
-  teamId: string;
-  /**
-   * Numeric provider ID of the team from the Apple team list. When given,
-   * the App Store Connect session is switched to this provider first;
-   * required for accounts that belong to multiple teams.
-   */
-  providerId?: string | number;
-  secretStore: SigningSecretStore;
-  /** Display name for a newly minted key. Required; there is no default. */
-  nickname: string;
-  /** Roles of a newly minted key. Defaults to APP_MANAGER. */
-  roles?: AppStoreConnectApiKeyRole[];
-  log?: (message: string, detail?: string) => void;
-};
-
-export type EnsureAppStoreConnectApiKeyResult = {
-  secret: SigningSecret;
-  keyId: string;
-  /** True when a new key was minted instead of reusing the stored one. */
-  created: boolean;
-};
-
-/**
- * Returns a usable App Store Connect API key secret for the team, reusing
- * the stored one when its key is still active and minting a new one
- * otherwise. Apple serves a key's private half exactly once (at creation
- * time through the sparse fieldset download), so reuse of the stored .p8
- * is strongly preferred.
- *
- * The session user must be a team Admin to list or create keys.
- */
-export async function ensureAppStoreConnectApiKeySecret({
-  relay,
-  teamId,
-  providerId,
-  secretStore,
-  nickname,
-  roles,
-  log = () => {},
-}: EnsureAppStoreConnectApiKeyInput): Promise<EnsureAppStoreConnectApiKeyResult> {
-  if (!nickname) {
-    throw new Error('A nickname is required to ensure an App Store Connect API key.');
-  }
-  if (providerId !== undefined) {
-    await switchAppStoreConnectProvider({ relay, providerId });
-  }
-  const secretName = appStoreConnectApiKeySecretName(teamId);
-  // Listing also primes the session's CSRF context, which Apple requires
-  // on the creation POST below.
-  const current = await listAppStoreConnectApiKeys({ relay });
-
-  const stored = await secretStore.get(APP_STORE_CONNECT_API_KEY_SECRET_TYPE, secretName);
-  const storedKeyId = stringField(stored?.data, 'keyId');
-  if (stored && storedKeyId && stored.data.privateKeyP8Base64) {
-    const matched = current.find((item) => item.id === storedKeyId && !keyRevoked(item.attributes));
-    if (matched) {
-      log('Reusing stored App Store Connect API key', storedKeyId);
-      return { secret: stored, keyId: storedKeyId, created: false };
-    }
-    log('Stored App Store Connect API key is no longer active', 'Minting a new one.');
-  }
-
-  const created = await createAppStoreConnectApiKey({ relay, nickname, roles });
-  const keyId = created.id!;
-  const downloaded = await downloadAppStoreConnectApiKeyPrivateKey({ relay, keyId });
-  const data: AppStoreConnectApiKeySecretData = {
-    privateKeyP8Base64: base64FromText(downloaded.privateKeyPem),
-    keyId,
-    issuerId: downloaded.issuerId,
-    nickname,
-    teamID: teamId,
-  };
-
-  let secret: SigningSecret;
-  try {
-    secret = await putAppStoreConnectApiKeySecret(secretStore, secretName, data);
-  } catch (error) {
-    // Apple never serves the private key again; once this throw unwinds
-    // the downloaded copy is gone and the portal key is unusable.
-    throw new Error(
-      `App Store Connect API key ${keyId} was created but saving its private key to the secret ` +
-        `store failed: ${errorText(error)}. The key cannot be downloaded again; revoke key ` +
-        `${keyId} in App Store Connect before retrying, or the retry will mint another key.`,
-    );
-  }
-  log('App Store Connect API key stored', keyId);
-  return { secret, keyId, created: true };
-}
-
-function keyRevoked(attributes: Record<string, unknown> | undefined) {
-  if (!attributes) return false;
-  if (attributes.isActive === false) return true;
-  const revokingDate = attributes.revokingDate ?? attributes.revocationDate;
-  return typeof revokingDate === 'string' && revokingDate !== '';
-}
-
-function base64FromText(text: string) {
-  const bytes = new TextEncoder().encode(text);
-  let binary = '';
-  for (const byte of bytes) {
-    binary += String.fromCharCode(byte);
-  }
-  return btoa(binary);
-}
-
-export type ListTeamProfilesInput = {
-  relay: AppleRelayWebSocketClient;
-  teamId: string;
-  /**
-   * Which portal profile listing to use. The development listing is
-   * unfiltered on the portal side and returns profiles of every
-   * distribution method; adhoc narrows to ad-hoc profiles. Defaults to
-   * development.
-   */
-  profileKind?: AppleProfileKind;
-};
-
-/** Lists the team's provisioning profiles from the portal. */
-export async function listTeamAppleProfiles({
-  relay,
-  teamId,
-  profileKind = 'development',
-}: ListTeamProfilesInput) {
-  return listAppleProfiles({ relay, teamId, profileKind });
-}
-
-/** Read a string-ish value from a loosely typed portal record. */
-export function stringField(record: Record<string, unknown> | undefined, key: string) {
-  const value = record?.[key];
-  if (typeof value === 'string') return value;
-  if (typeof value === 'number' || typeof value === 'boolean') return String(value);
-  return undefined;
-}