@wix/himalaya-cli 0.1625.0 → 0.1626.0

package/dist/cli.mjs

@@ -3051,6 +3051,7 @@ __export(dist_jobs_exports, {
   ANDROID_FORMAT_WRONG_SIGNER: () => ANDROID_FORMAT_WRONG_SIGNER,
   ANDROID_SIGNING_ALIASES: () => ANDROID_SIGNING_ALIASES,
   ANDROID_SIGNING_POLICIES: () => ANDROID_SIGNING_POLICIES,
+  APPLE_ERROR_CODES_MAX: () => APPLE_ERROR_CODES_MAX,
   CUSTOMER_UPLOAD_ABANDONED: () => CUSTOMER_UPLOAD_ABANDONED,
   CUSTOMER_UPLOAD_LEASE_MS: () => CUSTOMER_UPLOAD_LEASE_MS,
   CUSTOMER_UPLOAD_MAX_ATTEMPTS: () => CUSTOMER_UPLOAD_MAX_ATTEMPTS,
@@ -3062,6 +3063,7 @@ __export(dist_jobs_exports, {
   DEFAULT_DIST_SHELL: () => DEFAULT_DIST_SHELL,
   DEFAULT_DIST_SIGNING: () => DEFAULT_DIST_SIGNING,
   DEFAULT_GIT_URL: () => DEFAULT_GIT_URL,
+  DIST_ERROR_CODES: () => DIST_ERROR_CODES,
   DIST_PACKAGE_NAME: () => DIST_PACKAGE_NAME,
   DIST_PARAMS_FLAG: () => DIST_PARAMS_FLAG,
   DIST_SHELLS: () => DIST_SHELLS,
@@ -3073,12 +3075,15 @@ __export(dist_jobs_exports, {
   SCOPE_READ: () => SCOPE_READ,
   WIX_MANAGED_SIGNING_ALIASES: () => WIX_MANAGED_SIGNING_ALIASES,
   androidFormatSkewFailed: () => androidFormatSkewFailed,
+  appleErrorCodesOf: () => appleErrorCodesOf,
   borrowableIosIds: () => borrowableIosIds,
   credsFromConfig: () => credsFromConfig,
   customerUploadClaimable: () => customerUploadClaimable,
   customerUploadFailure: () => customerUploadFailure,
+  distErrorCodeOf: () => distErrorCodeOf,
   distJobSpec: () => distJobSpec,
   encodeDistParams: () => encodeDistParams,
+  failureCodesOf: () => failureCodesOf,
   isBorrowableIosId: () => isBorrowableIosId,
   isSuccess: () => isSuccess,
   isTerminal: () => isTerminal,
@@ -3285,6 +3290,22 @@ function resolveAndroidSigning(requested) {
 function androidFormatSkewFailed(record3) {
   return record3.platform === "android" && typeof record3.error === "string" && [ANDROID_FORMAT_NOT_BUILT, ANDROID_FORMAT_WRONG_SIGNER, ANDROID_FORMAT_NOT_REQUESTED, ANDROID_BUILD_TYPE_NOT_BUILT].some((code) => record3.error.includes(`${code}:`));
 }
+function distErrorCodeOf(error) {
+  if (typeof error !== "string") return void 0;
+  const code = /^[a-z][a-z0-9_]*/.exec(error)?.[0];
+  return DIST_ERROR_CODES.includes(code ?? "") ? code : void 0;
+}
+function appleErrorCodesOf(diagnostics) {
+  if (typeof diagnostics !== "string") return void 0;
+  const codes = [...new Set(diagnostics.match(/\bITMS-\d{4,5}\b/g) ?? [])].slice(0, APPLE_ERROR_CODES_MAX);
+  return codes.length > 0 ? codes : void 0;
+}
+function failureCodesOf(record3, body) {
+  const errorCode = distErrorCodeOf(body.error);
+  if (errorCode === "customer_signing_fetch_failed" && record3.errorCode) return {};
+  const validation = errorCode === "customer_app_store_validation_failed";
+  return { errorCode, appleErrorCodes: validation ? appleErrorCodesOf(body.diagnostics) : void 0 };
+}
 function resolveAndroidFormat(requested) {
   if (requested === void 0 || requested === null || requested === "") return { format: DEFAULT_ANDROID_FORMAT };
   if (typeof requested === "string" && ANDROID_FORMATS.includes(requested)) {
@@ -3400,10 +3421,42 @@ function distJobSpec(req) {
     ...req.xcodeVersion ? { xcodeVersion: req.xcodeVersion } : {}
   };
 }
-var IN_FLIGHT, SCOPE_CREATE, SCOPE_READ, SCOPE_CANCEL, DEFAULT_BASE_URL, DEFAULT_OAUTH_URL, TOKEN_TTL_MS, JobServiceError, JobServiceBroker, CUSTOMER_UPLOAD_LEASE_MS, CUSTOMER_UPLOAD_RETRY_DELAYS_MS, CUSTOMER_UPLOAD_MAX_ATTEMPTS, CUSTOMER_UPLOAD_ABANDONED, MAX_MEASURABLE_IDENTITY_WINDOW, DIST_SHELLS, DEFAULT_DIST_SHELL, DEFAULT_BORROWABLE_IOS_IDS, BUNDLE_ID_RE, DEFAULT_DIST_SIGNING, WIX_MANAGED_SIGNING_ALIASES, DEFAULT_ANDROID_SIGNING, ANDROID_SIGNING_POLICIES, ANDROID_SIGNING_ALIASES, DEFAULT_ANDROID_FORMAT, ANDROID_FORMATS, ANDROID_FORMAT_NOT_BUILT, ANDROID_FORMAT_WRONG_SIGNER, ANDROID_FORMAT_NOT_REQUESTED, DEFAULT_ANDROID_BUILD_TYPE, ANDROID_BUILD_TYPES, ANDROID_BUILD_TYPE_NOT_BUILT, DEFAULT_GIT_URL, DIST_PACKAGE_NAME, DIST_PARAMS_FLAG, MAX_COMMAND_CHARS;
+var DIST_ERROR_CODES, APPLE_ERROR_CODES_MAX, IN_FLIGHT, SCOPE_CREATE, SCOPE_READ, SCOPE_CANCEL, DEFAULT_BASE_URL, DEFAULT_OAUTH_URL, TOKEN_TTL_MS, JobServiceError, JobServiceBroker, CUSTOMER_UPLOAD_LEASE_MS, CUSTOMER_UPLOAD_RETRY_DELAYS_MS, CUSTOMER_UPLOAD_MAX_ATTEMPTS, CUSTOMER_UPLOAD_ABANDONED, MAX_MEASURABLE_IDENTITY_WINDOW, DIST_SHELLS, DEFAULT_DIST_SHELL, DEFAULT_BORROWABLE_IOS_IDS, BUNDLE_ID_RE, DEFAULT_DIST_SIGNING, WIX_MANAGED_SIGNING_ALIASES, DEFAULT_ANDROID_SIGNING, ANDROID_SIGNING_POLICIES, ANDROID_SIGNING_ALIASES, DEFAULT_ANDROID_FORMAT, ANDROID_FORMATS, ANDROID_FORMAT_NOT_BUILT, ANDROID_FORMAT_WRONG_SIGNER, ANDROID_FORMAT_NOT_REQUESTED, DEFAULT_ANDROID_BUILD_TYPE, ANDROID_BUILD_TYPES, ANDROID_BUILD_TYPE_NOT_BUILT, DEFAULT_GIT_URL, DIST_PACKAGE_NAME, DIST_PARAMS_FLAG, MAX_COMMAND_CHARS;
 var init_dist_jobs = __esm({
   "../../core/serve-control/src/dist-jobs.ts"() {
     init_define_HHP_CATALOG();
+    DIST_ERROR_CODES = [
+      "customer_agent_keychain_unavailable",
+      "customer_app_store_ipa_unreadable",
+      "customer_app_store_validation_failed",
+      "customer_app_store_validation_key_missing",
+      "customer_archive_invalid",
+      "customer_artifact_identity_mismatch",
+      "customer_build_failed",
+      "customer_entitlement_not_granted",
+      "customer_entitlements_unresolved",
+      "customer_firebase_binding_missing",
+      "customer_firebase_config_missing",
+      "customer_firebase_fetch_failed",
+      "customer_identity_preexisting",
+      "customer_ipa_invalid",
+      "customer_profile_invalid",
+      "customer_profile_push_missing",
+      "customer_signing_ambient_identity_unavailable",
+      "customer_signing_binding_mismatch",
+      "customer_signing_binding_missing",
+      "customer_signing_cleanup_failed",
+      "customer_signing_command_failed",
+      "customer_signing_expired",
+      "customer_signing_fetch_failed",
+      "customer_signing_identity_unavailable",
+      "customer_signing_install_failed",
+      "customer_signing_noninteractive_unavailable",
+      "customer_signing_policy_mismatch",
+      "customer_signing_project_ambiguous",
+      "customer_signing_runner_identity_unavailable"
+    ];
+    APPLE_ERROR_CODES_MAX = 5;
     IN_FLIGHT = /* @__PURE__ */ new Set(["CREATED", "QUEUED", "WORKING"]);
     SCOPE_CREATE = "MRE.JOB_CREATE";
     SCOPE_READ = "MRE.JOB_READ";
@@ -29421,7 +29474,6 @@ function resolveIdiom(tokens2, ctx = {}) {
 var IDIOM_CONTEXTS, UNSAFE_KEYS;
 var init_idiom = __esm({
   "../../core/ts/src/idiom.ts"() {
-    "use strict";
     init_define_HHP_CATALOG();
     IDIOM_CONTEXTS = {
       ios: { native: ["ios"] },

package/guides/qa-builds.md

@@ -359,6 +359,28 @@ read it only once `status` is `FAILURE`. A Job Service retry clears it once its
 minted, or when it ends `SUCCESS`. It misses a signing error raised on the Mac after the identity
 arrived (a keychain or profile install), which then reads as a plain failure.
 
+### Why a customer-signed build failed — `errorCode` and `appleErrorCodes`
+
+A customer-signed build (`signing: byo`, a Containers App Store build among them) fails on the Mac
+with a code of the pool's own, which the pool reports as the start of `error`. Serve keeps it, typed,
+as `errorCode` when it is one of the pool's known codes; a surface branches on that, never on
+`error`. Read it once `status` is `FAILURE`; `SUCCESS` clears it; absent means an
+unknown reason. For example:
+
+- **`customer_app_store_validation_failed`** — Apple refused the package when the pool validated it.
+  Apple's codes ride beside it as `appleErrorCodes` (`["ITMS-90062"]`, at most five): a version Apple
+  won't take, or an icon it refuses, read differently.
+- **`customer_signing_expired`** — the build waited past its signing window (one hour from the
+  dispatch) before the Mac asked for its signing files. Serve writes it when it refuses that fetch;
+  the pool's own report then says only `customer_signing_fetch_failed (403)`, which does not replace
+  it. Sending the build again opens a new window.
+- **`customer_identity_preexisting`** / **`customer_signing_install_failed`** — the signing identity
+  could not go into the Mac's keychain, for example because another build of the same owner was
+  running there.
+
+A Job Service retry of a failed customer job is refused its signing files, so it fails with
+`customer_signing_fetch_failed`; that leaves the first attempt's `errorCode` as it was.
+
 A build that throws after the build step — an S3 upload, say — reports `FAILURE` too, with
 `error: "dist failed: …"`. Before, the pool exited 0 having reported nothing, and the job ended
 `SUCCESS` with no artifact. When a failure report cannot be delivered at all, the job exits

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1625.0",
+  "version": "0.1626.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -72,5 +72,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "8efc7d4ff22286fcedefe6b5bd1a4fe40061fe077450dbe34b459022"
+  "falconPackageHash": "869790bb3cee9edb5ddd63f3befb4a65c1999a3ba9f388e5ad711509"
 }