@limrun/ui 0.14.0-rc.5 → 0.14.1

package/dist/app-store-relay/react.js

@@ -1,69 +0,0 @@
-import { useState as n, useRef as S, useCallback as i, useEffect as A } from "react";
-import { s as D } from "../client-CFDB4mX5.mjs";
-import "../index-YDu8K9a4.mjs";
-import "../gsa-srp-Bme3JLEi.mjs";
-import { e as w } from "../errors-gy8yQJos.mjs";
-function x({
-  registryApiUrl: u,
-  token: l,
-  organizationId: p
-}) {
-  const [h, o] = n("idle"), [v, a] = n(), [g, d] = n(), [m, f] = n(), [R, s] = n(), t = S(void 0), C = i(async () => {
-    await t.current?.close().catch(() => {
-    }), t.current = void 0, a(void 0), d(void 0), f(void 0), s(void 0), o("idle");
-  }, []);
-  A(() => () => {
-    t.current?.close(), t.current = void 0;
-  }, []);
-  const F = i(
-    async ({ accountName: r, password: c }) => {
-      o("authenticating"), s(void 0), await t.current?.close().catch(() => {
-      });
-      try {
-        const e = await D({
-          registryApiUrl: u,
-          token: l,
-          organizationId: p,
-          accountName: r,
-          password: c
-        });
-        return t.current = e, a(e), d(e.completeResponse), f(e.twoFactorChallengeResponse), o(e.requiresTwoFactor ? "two-factor-required" : "authenticated"), e;
-      } catch (e) {
-        a(void 0), t.current = void 0, s(w(e)), o("error");
-        return;
-      }
-    },
-    [u, p, l]
-  ), b = i(async (r) => {
-    const c = t.current;
-    if (!c)
-      throw new Error("Start Apple ID login before submitting a two-factor code.");
-    o("authenticating"), s(void 0);
-    try {
-      const e = await c.finishTwoFactor(r);
-      return o("authenticated"), e;
-    } catch (e) {
-      s(w(e)), o("error");
-      return;
-    }
-  }, []), y = i(async () => {
-    const r = t.current;
-    if (!r)
-      throw new Error("Start Apple ID login before finalizing the Apple session.");
-    return r.finalize();
-  }, []);
-  return {
-    status: h,
-    session: v,
-    completeResponse: g,
-    twoFactorChallengeResponse: m,
-    error: R,
-    startLogin: F,
-    submitTwoFactorCode: b,
-    finalize: y,
-    close: C
-  };
-}
-export {
-  x as useAppleIDLogin
-};

package/dist/apple-credentials/index.cjs

@@ -1 +0,0 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const u=require("../app-store-relay/index.cjs"),T=require("../browser-storage-DLxIqZk5.js"),v="appleCertificate",b="appleProvisioningProfile",I="appStoreConnectApiKey";function h(e){const t={};for(const[o,r]of Object.entries(e))r&&(t[o]=r);return t}async function _(e,t,o){return e.put(v,t,h(o))}async function R(e,t,o){return e.put(b,t,h(o))}async function D(e,t,o){return e.put(I,t,h(o))}function B(e){const t=e.fetch??fetch.bind(globalThis),o=e.apiUrl.replace(/\/+$/,""),r=(n,s)=>`${o}/v1/organizations/${encodeURIComponent(e.organizationId)}/secrets/${encodeURIComponent(n)}/${encodeURIComponent(s)}`,c={Authorization:`Bearer ${e.token}`,"Content-Type":"application/json"};async function a(n,s){let i=`${n.status}`;try{const p=await n.json();p.message&&(i=p.message)}catch{}throw new Error(`Failed to ${s} secret: ${i}`)}return{async put(n,s,i){const p=await t(r(n,s),{method:"PUT",headers:c,body:JSON.stringify({data:i,replace:!0})});p.ok||await a(p,"store");const d=await p.json();return{type:d.type,name:d.name,createdAt:d.createdAt,data:d.data}},async get(n,s){const i=await t(r(n,s),{method:"GET",headers:c});if(i.status===404)return;i.ok||await a(i,"fetch");const p=await i.json();return{type:p.type,name:p.name,createdAt:p.createdAt,data:p.data}},async list(){const n=await t(`${o}/v1/organizations/${encodeURIComponent(e.organizationId)}/secrets`,{method:"GET",headers:c});return n.ok||await a(n,"list"),(await n.json()).filter(i=>i.type===v||i.type===b||i.type===I).map(i=>({type:i.type,name:i.name,createdAt:i.createdAt}))},async delete(n,s){const i=await t(r(n,s),{method:"DELETE",headers:c});i.status!==404&&(i.ok||await a(i,"delete"))}}}const O="limrun-signing-secrets",K=1,l="secrets";function j(){const e=(r,c)=>`${r}:${c}`;function t(){return new Promise((r,c)=>{const a=indexedDB.open(O,K);a.onupgradeneeded=()=>{const n=a.result;n.objectStoreNames.contains(l)||n.createObjectStore(l,{keyPath:"id"})},a.onsuccess=()=>r(a.result),a.onerror=()=>c(a.error??new Error("Open IndexedDB failed"))})}function o(r){return new Promise((c,a)=>{r.onsuccess=()=>c(r.result),r.onerror=()=>a(r.error??new Error("IndexedDB request failed"))})}return{async put(r,c,a){const n=await t(),s=await o(n.transaction(l,"readonly").objectStore(l).get(e(r,c))),i={id:e(r,c),type:r,name:c,data:a,createdAt:s?.createdAt??new Date().toISOString()};return await o(n.transaction(l,"readwrite").objectStore(l).put(i)),{type:r,name:c,createdAt:i.createdAt,data:a}},async get(r,c){const a=await t(),n=await o(a.transaction(l,"readonly").objectStore(l).get(e(r,c)));if(n)return{type:n.type,name:n.name,createdAt:n.createdAt,data:n.data}},async list(){const r=await t();return(await o(r.transaction(l,"readonly").objectStore(l).getAll())).map(a=>({type:a.type,name:a.name,createdAt:a.createdAt}))},async delete(r,c){const a=await t();await o(a.transaction(l,"readwrite").objectStore(l).delete(e(r,c)))}}}function N(e,t){return`${e}/${t}`}async function x({relay:e,teamId:t,secretStore:o,certificateKind:r="development",commonName:c,log:a=()=>{}}){const n=r==="distribution"?"DISTRIBUTION":"DEVELOPMENT",s=N(t,n),i=await u.listAppleCertificates({relay:e,teamId:t,certificateKind:r}),p=S=>S===void 0?void 0:i.find(C=>f(C,"certificateId")===S||f(C,"certRequestId")===S),d=await o.get(v,s),m=f(d?.data,"certificateID");if(d&&m&&d.data.certificateP12Base64){const S=p(m);if(S){const C=f(S,"certificateId")??m;return a("Reusing stored Apple certificate",C),{secret:d,certificateId:C,created:!1}}a("Stored certificate is no longer on the team","Minting a new one.")}const y=await u.generateAppleSigningKeyAndCSR({commonName:c??`Limrun ${t}`}),w=await u.createAppleCertificate({relay:e,teamId:t,certificateKind:r,csrPEM:y.csrPEM}),A=f(w,"certificateId")??f(w,"certRequestId");if(!A)throw new Error("Apple certificate creation did not return a certificate ID.");const E=await u.downloadAppleCertificate({relay:e,teamId:t,certificateKind:r,certificateId:A});if(!E.rawBodyBase64)throw new Error("Apple certificate download returned no bytes.");const g={certificateP12Base64:u.exportAppleCertificateP12({privateKeyPKCS8Base64:y.privateKeyPKCS8Base64,certificateBase64:E.rawBodyBase64,password:"",friendlyName:`Apple ${r==="distribution"?"Distribution":"Development"} ${t}`}),certificateType:n,teamID:t,certificateID:A,serialNumber:T.normalizeCertificateSerial(f(w,"serialNum")),expirationDate:f(w,"expirationDateString")};let P;try{P=await _(o,s,g)}catch(S){throw new Error(`Certificate ${A} was created on the Apple Developer portal but saving its private key to the secret store failed: ${k(S)}. The key cannot be recovered; revoke certificate ${A} at developer.apple.com before retrying, or the retry will mint another certificate against Apple's limit.`)}return a("Apple certificate stored",A),{secret:P,certificateId:A,created:!0}}function k(e){return e instanceof Error?e.message:String(e)}async function L({relay:e,teamId:t,profileId:o,secretStore:r,log:c=()=>{}}){const n=(await u.downloadAppleProfile({relay:e,teamId:t,profileId:o})).rawBodyBase64;if(!n)throw new Error("Apple provisioning profile download returned no bytes.");const s=T.parseProvisioningProfileBase64(n),i=`${t}/${s.uuid??o}`,p=await R(r,i,{provisioningProfileBase64:n,certificateSerialNumbers:s.certificateSerialNumbers.join(","),bundleIDs:s.bundleID,deviceIDs:s.provisionedDevices.join(","),teamID:s.teamID??t,profileName:s.name,uuid:s.uuid,expirationDate:s.expirationDate});return c("Apple provisioning profile stored",i),p}function $(e){return`${e}/APP_STORE_CONNECT_API_KEY`}async function F({relay:e,teamId:t,providerId:o,secretStore:r,nickname:c,roles:a,log:n=()=>{}}){if(!c)throw new Error("A nickname is required to ensure an App Store Connect API key.");o!==void 0&&await u.switchAppStoreConnectProvider({relay:e,providerId:o});const s=$(t),i=await u.listAppStoreConnectApiKeys({relay:e}),p=await r.get(I,s),d=f(p?.data,"keyId");if(p&&d&&p.data.privateKeyP8Base64){if(i.find(P=>P.id===d&&!Y(P.attributes)))return n("Reusing stored App Store Connect API key",d),{secret:p,keyId:d,created:!1};n("Stored App Store Connect API key is no longer active","Minting a new one.")}const y=(await u.createAppStoreConnectApiKey({relay:e,nickname:c,roles:a})).id,w=await u.downloadAppStoreConnectApiKeyPrivateKey({relay:e,keyId:y}),A={privateKeyP8Base64:z(w.privateKeyPem),keyId:y,issuerId:w.issuerId,nickname:c,teamID:t};let E;try{E=await D(r,s,A)}catch(g){throw new Error(`App Store Connect API key ${y} was created but saving its private key to the secret store failed: ${k(g)}. The key cannot be downloaded again; revoke key ${y} in App Store Connect before retrying, or the retry will mint another key.`)}return n("App Store Connect API key stored",y),{secret:E,keyId:y,created:!0}}function Y(e){if(!e)return!1;if(e.isActive===!1)return!0;const t=e.revokingDate??e.revocationDate;return typeof t=="string"&&t!==""}function z(e){const t=new TextEncoder().encode(e);let o="";for(const r of t)o+=String.fromCharCode(r);return btoa(o)}async function M({relay:e,teamId:t,profileKind:o="development"}){return u.listAppleProfiles({relay:e,teamId:t,profileKind:o})}function f(e,t){const o=e?.[t];if(typeof o=="string")return o;if(typeof o=="number"||typeof o=="boolean")return String(o)}exports.normalizeCertificateSerial=T.normalizeCertificateSerial;exports.APPLE_CERTIFICATE_SECRET_TYPE=v;exports.APPLE_PROVISIONING_PROFILE_SECRET_TYPE=b;exports.APP_STORE_CONNECT_API_KEY_SECRET_TYPE=I;exports.appStoreConnectApiKeySecretName=$;exports.appleCertificateSecretName=N;exports.createBrowserSecretStore=j;exports.createLimrunSecretStore=B;exports.ensureAppStoreConnectApiKeySecret=F;exports.ensureAppleCertificateSecret=x;exports.listTeamAppleProfiles=M;exports.putAppStoreConnectApiKeySecret=D;exports.putAppleCertificateSecret=_;exports.putAppleProvisioningProfileSecret=R;exports.saveAppleProfileSecret=L;exports.stringField=f;

package/dist/apple-credentials/index.d.ts

@@ -1,110 +0,0 @@
-import { AppleCertificateKind, AppleProfileKind, AppStoreConnectApiKeyRole } from '../app-store-relay';
-import { AppleRelayWebSocketClient } from '../core/device-install/apple';
-import { AppleCertificateType, SigningSecret, SigningSecretStore } from '../core/device-install/storage/secret-store';
-export { APP_STORE_CONNECT_API_KEY_SECRET_TYPE, APPLE_CERTIFICATE_SECRET_TYPE, APPLE_PROVISIONING_PROFILE_SECRET_TYPE, createBrowserSecretStore, createLimrunSecretStore, putAppleCertificateSecret, putAppleProvisioningProfileSecret, putAppStoreConnectApiKeySecret, type AppleCertificateSecretData, type AppleCertificateType, type AppleProvisioningProfileSecretData, type AppStoreConnectApiKeySecretData, type LimrunSecretStoreOptions, type SigningSecret, type SigningSecretData, type SigningSecretMetadata, type SigningSecretStore, type SigningSecretType, } from '../core/device-install/storage/secret-store';
-export { normalizeCertificateSerial } from '../core/device-install/storage/browser-storage';
-/**
- * Conventional secret name of a team's certificate bundle. One bundle per
- * team and Apple certificate type; the type is in the name so development
- * and distribution material never collide.
- */
-export declare function appleCertificateSecretName(teamId: string, certificateType: AppleCertificateType): string;
-export type EnsureAppleCertificateInput = {
-    relay: AppleRelayWebSocketClient;
-    teamId: string;
-    secretStore: SigningSecretStore;
-    /**
-     * Which portal certificate kind to ensure. Ad-hoc and App Store signing
-     * both use the distribution certificate. Defaults to development.
-     */
-    certificateKind?: AppleCertificateKind;
-    /** Common name used when minting a new certificate. */
-    commonName?: string;
-    log?: (message: string, detail?: string) => void;
-};
-export type EnsureAppleCertificateResult = {
-    secret: SigningSecret;
-    certificateId: string;
-    /** True when a new certificate was minted instead of reusing the stored one. */
-    created: boolean;
-};
-/**
- * Returns a usable certificate secret of the requested kind for the team,
- * reusing the stored one when its certificate is still on the team and
- * minting a new one otherwise. Apple caps certificates per kind (2 for
- * development, 3 for distribution) and never returns private keys, so
- * reuse of the stored p12 is strongly preferred.
- *
- * Durability of the stored material is the secret store's concern:
- * implementors who want retries or fallbacks build them into their
- * SigningSecretStore.
- */
-export declare function ensureAppleCertificateSecret({ relay, teamId, secretStore, certificateKind, commonName, log, }: EnsureAppleCertificateInput): Promise<EnsureAppleCertificateResult>;
-export type SaveAppleProfileInput = {
-    relay: AppleRelayWebSocketClient;
-    teamId: string;
-    profileId: string;
-    secretStore: SigningSecretStore;
-    log?: (message: string, detail?: string) => void;
-};
-/**
- * Downloads the provisioning profile and stores it as an
- * appleProvisioningProfile secret named `${teamId}/${uuid}`. The UUID is
- * unique per profile, so a team can hold many profiles for the same
- * bundle ID and certificate set; the reference fields (certificate
- * serials, bundle IDs, device IDs parsed out of the profile) are what
- * consumers filter on.
- */
-export declare function saveAppleProfileSecret({ relay, teamId, profileId, secretStore, log, }: SaveAppleProfileInput): Promise<SigningSecret>;
-/**
- * Conventional secret name of a team's App Store Connect API key: one
- * shared key per team.
- */
-export declare function appStoreConnectApiKeySecretName(teamId: string): string;
-export type EnsureAppStoreConnectApiKeyInput = {
-    relay: AppleRelayWebSocketClient;
-    teamId: string;
-    /**
-     * Numeric provider ID of the team from the Apple team list. When given,
-     * the App Store Connect session is switched to this provider first;
-     * required for accounts that belong to multiple teams.
-     */
-    providerId?: string | number;
-    secretStore: SigningSecretStore;
-    /** Display name for a newly minted key. Required; there is no default. */
-    nickname: string;
-    /** Roles of a newly minted key. Defaults to APP_MANAGER. */
-    roles?: AppStoreConnectApiKeyRole[];
-    log?: (message: string, detail?: string) => void;
-};
-export type EnsureAppStoreConnectApiKeyResult = {
-    secret: SigningSecret;
-    keyId: string;
-    /** True when a new key was minted instead of reusing the stored one. */
-    created: boolean;
-};
-/**
- * Returns a usable App Store Connect API key secret for the team, reusing
- * the stored one when its key is still active and minting a new one
- * otherwise. Apple serves a key's private half exactly once (at creation
- * time through the sparse fieldset download), so reuse of the stored .p8
- * is strongly preferred.
- *
- * The session user must be a team Admin to list or create keys.
- */
-export declare function ensureAppStoreConnectApiKeySecret({ relay, teamId, providerId, secretStore, nickname, roles, log, }: EnsureAppStoreConnectApiKeyInput): Promise<EnsureAppStoreConnectApiKeyResult>;
-export type ListTeamProfilesInput = {
-    relay: AppleRelayWebSocketClient;
-    teamId: string;
-    /**
-     * Which portal profile listing to use. The development listing is
-     * unfiltered on the portal side and returns profiles of every
-     * distribution method; adhoc narrows to ad-hoc profiles. Defaults to
-     * development.
-     */
-    profileKind?: AppleProfileKind;
-};
-/** Lists the team's provisioning profiles from the portal. */
-export declare function listTeamAppleProfiles({ relay, teamId, profileKind, }: ListTeamProfilesInput): Promise<Record<string, unknown>[]>;
-/** Read a string-ish value from a loosely typed portal record. */
-export declare function stringField(record: Record<string, unknown> | undefined, key: string): string | undefined;

package/dist/apple-credentials/index.js

@@ -1,291 +0,0 @@
-import { listAppleCertificates as T, generateAppleSigningKeyAndCSR as D, createAppleCertificate as k, downloadAppleCertificate as $, exportAppleCertificateP12 as B, downloadAppleProfile as N, switchAppStoreConnectProvider as R, listAppStoreConnectApiKeys as _, createAppStoreConnectApiKey as O, downloadAppStoreConnectApiKeyPrivateKey as j, listAppleProfiles as K } from "../app-store-relay/index.js";
-import { l as x, f as U } from "../browser-storage-BnO-Ma-e.mjs";
-const C = "appleCertificate", I = "appleProvisioningProfile", v = "appStoreConnectApiKey";
-function b(e) {
-  const t = {};
-  for (const [o, r] of Object.entries(e))
-    r && (t[o] = r);
-  return t;
-}
-async function L(e, t, o) {
-  return e.put(C, t, b(o));
-}
-async function M(e, t, o) {
-  return e.put(I, t, b(o));
-}
-async function z(e, t, o) {
-  return e.put(v, t, b(o));
-}
-function W(e) {
-  const t = e.fetch ?? fetch.bind(globalThis), o = e.apiUrl.replace(/\/+$/, ""), r = (n, s) => `${o}/v1/organizations/${encodeURIComponent(e.organizationId)}/secrets/${encodeURIComponent(
-    n
-  )}/${encodeURIComponent(s)}`, c = {
-    Authorization: `Bearer ${e.token}`,
-    "Content-Type": "application/json"
-  };
-  async function a(n, s) {
-    let i = `${n.status}`;
-    try {
-      const d = await n.json();
-      d.message && (i = d.message);
-    } catch {
-    }
-    throw new Error(`Failed to ${s} secret: ${i}`);
-  }
-  return {
-    async put(n, s, i) {
-      const d = await t(r(n, s), {
-        method: "PUT",
-        headers: c,
-        body: JSON.stringify({ data: i, replace: !0 })
-      });
-      d.ok || await a(d, "store");
-      const p = await d.json();
-      return { type: p.type, name: p.name, createdAt: p.createdAt, data: p.data };
-    },
-    async get(n, s) {
-      const i = await t(r(n, s), { method: "GET", headers: c });
-      if (i.status === 404) return;
-      i.ok || await a(i, "fetch");
-      const d = await i.json();
-      return { type: d.type, name: d.name, createdAt: d.createdAt, data: d.data };
-    },
-    async list() {
-      const n = await t(
-        `${o}/v1/organizations/${encodeURIComponent(e.organizationId)}/secrets`,
-        { method: "GET", headers: c }
-      );
-      return n.ok || await a(n, "list"), (await n.json()).filter(
-        (i) => i.type === C || i.type === I || i.type === v
-      ).map((i) => ({ type: i.type, name: i.name, createdAt: i.createdAt }));
-    },
-    async delete(n, s) {
-      const i = await t(r(n, s), { method: "DELETE", headers: c });
-      i.status !== 404 && (i.ok || await a(i, "delete"));
-    }
-  };
-}
-const F = "limrun-signing-secrets", Y = 1, f = "secrets";
-function X() {
-  const e = (r, c) => `${r}:${c}`;
-  function t() {
-    return new Promise((r, c) => {
-      const a = indexedDB.open(F, Y);
-      a.onupgradeneeded = () => {
-        const n = a.result;
-        n.objectStoreNames.contains(f) || n.createObjectStore(f, { keyPath: "id" });
-      }, a.onsuccess = () => r(a.result), a.onerror = () => c(a.error ?? new Error("Open IndexedDB failed"));
-    });
-  }
-  function o(r) {
-    return new Promise((c, a) => {
-      r.onsuccess = () => c(r.result), r.onerror = () => a(r.error ?? new Error("IndexedDB request failed"));
-    });
-  }
-  return {
-    async put(r, c, a) {
-      const n = await t(), s = await o(
-        n.transaction(f, "readonly").objectStore(f).get(e(r, c))
-      ), i = {
-        id: e(r, c),
-        type: r,
-        name: c,
-        data: a,
-        createdAt: s?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
-      };
-      return await o(
-        n.transaction(f, "readwrite").objectStore(f).put(i)
-      ), { type: r, name: c, createdAt: i.createdAt, data: a };
-    },
-    async get(r, c) {
-      const a = await t(), n = await o(
-        a.transaction(f, "readonly").objectStore(f).get(e(r, c))
-      );
-      if (n)
-        return { type: n.type, name: n.name, createdAt: n.createdAt, data: n.data };
-    },
-    async list() {
-      const r = await t();
-      return (await o(
-        r.transaction(f, "readonly").objectStore(f).getAll()
-      )).map((a) => ({ type: a.type, name: a.name, createdAt: a.createdAt }));
-    },
-    async delete(r, c) {
-      const a = await t();
-      await o(
-        a.transaction(f, "readwrite").objectStore(f).delete(e(r, c))
-      );
-    }
-  };
-}
-function G(e, t) {
-  return `${e}/${t}`;
-}
-async function Z({
-  relay: e,
-  teamId: t,
-  secretStore: o,
-  certificateKind: r = "development",
-  commonName: c,
-  log: a = () => {
-  }
-}) {
-  const n = r === "distribution" ? "DISTRIBUTION" : "DEVELOPMENT", s = G(t, n), i = await T({ relay: e, teamId: t, certificateKind: r }), d = (w) => w === void 0 ? void 0 : i.find(
-    (E) => y(E, "certificateId") === w || y(E, "certRequestId") === w
-  ), p = await o.get(C, s), P = y(p?.data, "certificateID");
-  if (p && P && p.data.certificateP12Base64) {
-    const w = d(P);
-    if (w) {
-      const E = y(w, "certificateId") ?? P;
-      return a("Reusing stored Apple certificate", E), { secret: p, certificateId: E, created: !1 };
-    }
-    a("Stored certificate is no longer on the team", "Minting a new one.");
-  }
-  const l = await D({ commonName: c ?? `Limrun ${t}` }), A = await k({
-    relay: e,
-    teamId: t,
-    certificateKind: r,
-    csrPEM: l.csrPEM
-  }), u = y(A, "certificateId") ?? y(A, "certRequestId");
-  if (!u)
-    throw new Error("Apple certificate creation did not return a certificate ID.");
-  const S = await $({
-    relay: e,
-    teamId: t,
-    certificateKind: r,
-    certificateId: u
-  });
-  if (!S.rawBodyBase64)
-    throw new Error("Apple certificate download returned no bytes.");
-  const g = {
-    certificateP12Base64: B({
-      privateKeyPKCS8Base64: l.privateKeyPKCS8Base64,
-      certificateBase64: S.rawBodyBase64,
-      password: "",
-      friendlyName: `Apple ${r === "distribution" ? "Distribution" : "Development"} ${t}`
-    }),
-    certificateType: n,
-    teamID: t,
-    certificateID: u,
-    // Normalized so it equals the serials profiles reference.
-    serialNumber: x(y(A, "serialNum")),
-    expirationDate: y(A, "expirationDateString")
-  };
-  let m;
-  try {
-    m = await L(o, s, g);
-  } catch (w) {
-    throw new Error(
-      `Certificate ${u} was created on the Apple Developer portal but saving its private key to the secret store failed: ${h(w)}. The key cannot be recovered; revoke certificate ${u} at developer.apple.com before retrying, or the retry will mint another certificate against Apple's limit.`
-    );
-  }
-  return a("Apple certificate stored", u), { secret: m, certificateId: u, created: !0 };
-}
-function h(e) {
-  return e instanceof Error ? e.message : String(e);
-}
-async function ee({
-  relay: e,
-  teamId: t,
-  profileId: o,
-  secretStore: r,
-  log: c = () => {
-  }
-}) {
-  const n = (await N({ relay: e, teamId: t, profileId: o })).rawBodyBase64;
-  if (!n)
-    throw new Error("Apple provisioning profile download returned no bytes.");
-  const s = U(n), i = `${t}/${s.uuid ?? o}`, d = await M(r, i, {
-    provisioningProfileBase64: n,
-    certificateSerialNumbers: s.certificateSerialNumbers.join(","),
-    bundleIDs: s.bundleID,
-    deviceIDs: s.provisionedDevices.join(","),
-    teamID: s.teamID ?? t,
-    profileName: s.name,
-    uuid: s.uuid,
-    expirationDate: s.expirationDate
-  });
-  return c("Apple provisioning profile stored", i), d;
-}
-function V(e) {
-  return `${e}/APP_STORE_CONNECT_API_KEY`;
-}
-async function te({
-  relay: e,
-  teamId: t,
-  providerId: o,
-  secretStore: r,
-  nickname: c,
-  roles: a,
-  log: n = () => {
-  }
-}) {
-  if (!c)
-    throw new Error("A nickname is required to ensure an App Store Connect API key.");
-  o !== void 0 && await R({ relay: e, providerId: o });
-  const s = V(t), i = await _({ relay: e }), d = await r.get(v, s), p = y(d?.data, "keyId");
-  if (d && p && d.data.privateKeyP8Base64) {
-    if (i.find((m) => m.id === p && !q(m.attributes)))
-      return n("Reusing stored App Store Connect API key", p), { secret: d, keyId: p, created: !1 };
-    n("Stored App Store Connect API key is no longer active", "Minting a new one.");
-  }
-  const l = (await O({ relay: e, nickname: c, roles: a })).id, A = await j({ relay: e, keyId: l }), u = {
-    privateKeyP8Base64: J(A.privateKeyPem),
-    keyId: l,
-    issuerId: A.issuerId,
-    nickname: c,
-    teamID: t
-  };
-  let S;
-  try {
-    S = await z(r, s, u);
-  } catch (g) {
-    throw new Error(
-      `App Store Connect API key ${l} was created but saving its private key to the secret store failed: ${h(g)}. The key cannot be downloaded again; revoke key ${l} in App Store Connect before retrying, or the retry will mint another key.`
-    );
-  }
-  return n("App Store Connect API key stored", l), { secret: S, keyId: l, created: !0 };
-}
-function q(e) {
-  if (!e) return !1;
-  if (e.isActive === !1) return !0;
-  const t = e.revokingDate ?? e.revocationDate;
-  return typeof t == "string" && t !== "";
-}
-function J(e) {
-  const t = new TextEncoder().encode(e);
-  let o = "";
-  for (const r of t)
-    o += String.fromCharCode(r);
-  return btoa(o);
-}
-async function re({
-  relay: e,
-  teamId: t,
-  profileKind: o = "development"
-}) {
-  return K({ relay: e, teamId: t, profileKind: o });
-}
-function y(e, t) {
-  const o = e?.[t];
-  if (typeof o == "string") return o;
-  if (typeof o == "number" || typeof o == "boolean") return String(o);
-}
-export {
-  C as APPLE_CERTIFICATE_SECRET_TYPE,
-  I as APPLE_PROVISIONING_PROFILE_SECRET_TYPE,
-  v as APP_STORE_CONNECT_API_KEY_SECRET_TYPE,
-  V as appStoreConnectApiKeySecretName,
-  G as appleCertificateSecretName,
-  X as createBrowserSecretStore,
-  W as createLimrunSecretStore,
-  te as ensureAppStoreConnectApiKeySecret,
-  Z as ensureAppleCertificateSecret,
-  re as listTeamAppleProfiles,
-  x as normalizeCertificateSerial,
-  z as putAppStoreConnectApiKeySecret,
-  L as putAppleCertificateSecret,
-  M as putAppleProvisioningProfileSecret,
-  ee as saveAppleProfileSecret,
-  y as stringField
-};