vydanne 0.13.0 → 0.14.0

package/README.md

@@ -105,6 +105,7 @@ committed. A keyId or issuerId found there is refused at load, with a warning te
 | Source | Use it for |
 |---|---|
 | `ASC_KEY_ID` / `ASC_ISSUER_ID` / `PLAY_JSON_KEY_FILE` in the environment | CI secrets, one-off overrides |
+| `ASC_KEY_CONTENT` (the .p8, raw or base64) or `ASC_KEY_PATH` | CI — signs without writing the key to disk |
 | the `.env` cascade in the repo | one app that needs a different account from the rest |
 | **the user config file** | **the default for every app you ship** — one account, many repos |
 

package/SKILL.md

@@ -36,7 +36,7 @@ form does **not** exist; set `$env:VAR = "1"` first.
 **Auth resolves automatically — NEVER put credentials in the config.** That file is committed; vydanne
 refuses a keyId/issuerId found there and warns. The signing key stays at
 `~/.appstoreconnect/private_keys/AuthKey_<keyId>.p8`. The ids resolve highest-priority-first from: the
-environment (`ASC_KEY_ID` / `ASC_ISSUER_ID` / `PLAY_JSON_KEY_FILE`) → the **`.env` cascade** → the **user
+environment (`ASC_KEY_ID` / `ASC_ISSUER_ID` / `PLAY_JSON_KEY_FILE`, plus `ASC_KEY_CONTENT` or `ASC_KEY_PATH` for the signing key in CI) → the **`.env` cascade** → the **user
 config file**.
 
 The cascade is the standard one (dotenv-parsed, later file wins): `.env` → `.env.<mode>` → `.env.local` →

package/bin/vydanne.mjs

@@ -48,11 +48,16 @@ try {
     row("ASC_KEY_ID", cr.keyId, "ASC_KEY_ID", cr.keyId);
     row("ASC_ISSUER_ID", cr.issuerId, "ASC_ISSUER_ID");
     row("PLAY_JSON_KEY_FILE", cr.playJsonKeyFile, "PLAY_JSON_KEY_FILE", cr.playJsonKeyFile);
-    if (cr.keyId) {
-      const p = path.join(os.homedir(), ".appstoreconnect", "private_keys", `AuthKey_${cr.keyId}.p8`);
+    // The key can now arrive three ways; say WHICH, because "missing" pointing at a path that CI was
+    // never going to have is the least useful thing this command could print on a 401.
+    if (cr.keyContent) {
+      console.log(`  \x1b[32m✓\x1b[0m ${"signing key".padEnd(20)} <inline> ${"".padEnd(17)}← ${cr.sources.ASC_KEY_CONTENT}`);
+    } else if (cr.keyId) {
+      const p = cr.keyPath || path.join(os.homedir(), ".appstoreconnect", "private_keys", `AuthKey_${cr.keyId}.p8`);
       console.log(existsSync(p)
         ? `  \x1b[32m✓\x1b[0m ${"signing key".padEnd(20)} ${p}`
-        : `  \x1b[31m✗\x1b[0m ${"signing key".padEnd(20)} \x1b[31mmissing\x1b[0m — ${p}`);
+        : `  \x1b[31m✗\x1b[0m ${"signing key".padEnd(20)} \x1b[31mmissing\x1b[0m — ${p}\n` +
+          `      in CI set ASC_KEY_CONTENT (the .p8, raw or base64) instead of writing this file`);
     }
     console.log(cr.userFile ? `\nuser config: ${cr.userFile}` : `\nuser config: none found. Looked in:\n${cr.candidates.map((c) => `  ${c}`).join("\n")}`);
     if (!cr.keyId || !cr.issuerId) {
@@ -88,7 +93,7 @@ try {
     const spec = COMMANDS[cmd];
     const { run } = await import(`../src/commands/${spec.mod}.mjs`);
     const dryRun = Boolean(spec.writes) && !apply;
-    const client = spec.client ? new Client({ keyId: cfg.keyId, issuerId: cfg.issuerId, dryRun }) : null;
+    const client = spec.client ? new Client({ keyId: cfg.keyId, issuerId: cfg.issuerId, keyPath: cfg.keyPath, keyContent: cfg.keyContent, dryRun }) : null;
     if (dryRun) console.log(yellow(`DRY RUN — '${cmd}' will not change App Store Connect. Add --apply to write.`));
     // altool authenticates on its own rather than through our JWT, so it needs the raw ids.
     const ok = await run(cfg, client, spec.credentials ? { keyId: cfg.keyId, issuerId: cfg.issuerId } : undefined);
@@ -153,6 +158,8 @@ usage: vydanne <command> [--apply] [--config vydanne.config.mjs]
   locales         UI -> ASC locale mapping + unsupported
   auth            which credentials resolved, and from where (masked) — run this on a 401
 credentials: env > .env cascade (.env, .env.<mode>, .env.local, .env.<mode>.local) > user config
+  CI: ASC_KEY_CONTENT carries the .p8 itself (raw or base64) so no key is written to the runner disk;
+  ASC_KEY_PATH points at one. Without either, the key is read from ~/.appstoreconnect/private_keys.
   (\$VYDANNE_CONFIG_HOME, %APPDATA%\\vydanne or \$XDG_CONFIG_HOME/vydanne, ~/.appstoreconnect).
   NEVER the committed vydanne.config.mjs — run \`vydanne auth\` to see what resolved.
 toggles: VYDANNE_SKIP_METADATA / VYDANNE_SKIP_SCREENSHOTS (fill), VYDANNE_REPLACE=1 (fill/previews:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vydanne",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "App Store Connect + Google Play submission prep — the companion to zdymak (media). Native Node (no fastlane/Ruby/Python): localized listings, screenshot/preview/icon upload, ratings, review contact, accessibility & privacy labels, IAP, export docs, build upload to TestFlight / a Play closed track, a diff of local-vs-store, and a preflight verifier that encodes the store gotchas. Never submits for review. iOS/macOS via the ASC REST API; Android via the Play Developer Edits API (--store google).",
   "keywords": [
     "app-store-connect",

package/src/client.mjs

@@ -21,8 +21,8 @@ const MUTATING = new Set(["POST", "PATCH", "PUT", "DELETE"]);
 // fetched from the FULL list (get_edit filters out READY_FOR_REVIEW), and individual localization reads
 // (list endpoints return sparse/empty text).
 export class Client {
-  constructor({ keyId, issuerId, dryRun = false }) {
-    this.token = makeToken({ keyId, issuerId });
+  constructor({ keyId, issuerId, keyPath, keyContent, dryRun = false }) {
+    this.token = makeToken({ keyId, issuerId, keyPath, keyContent });
     /** No mutating request leaves this process. Set by bin/ for a write command without `--apply`. */
     this.dryRun = dryRun;
     /** What a real run WOULD have sent, in order — the dry-run report, and the count bin/ prints. */

package/src/config.mjs

@@ -50,6 +50,7 @@ export async function loadConfig(p) {
     primaryLocale: need("primaryLocale"),
     keyId: creds.keyId,
     issuerId: creds.issuerId,
+    keyPath: creds.keyPath,
     uiLocales: raw.uiLocales || [],
     // App code -> App Store locale, for codes Apple spells differently or does not know yet. Merged over
     // the built-in table rather than replacing it, so an app declares only its exceptions.
@@ -137,5 +138,8 @@ export async function loadConfig(p) {
       : null,
   };
   c.resolvedLocales = resolveLocales(c.uiLocales, c.localeMap);
+  // The signing key rides along NON-ENUMERABLE, like it does on the credentials object: a config is
+  // exactly the kind of thing someone dumps while debugging, and a private key must not be in that dump.
+  Object.defineProperty(c, "keyContent", { value: creds.keyContent, enumerable: false, writable: false });
   return c;
 }

package/src/credentials.mjs

@@ -152,13 +152,25 @@ export function resolveCredentials(raw = {}, cwd = process.cwd(), env = process.
     return undefined;
   };
 
-  return {
+  // The signing key itself, for CI. A developer machine keeps the .p8 in ~/.appstoreconnect and needs
+  // neither of these; a runner has only environment variables, and without them every workflow had to
+  // write the key to disk itself just to satisfy vydanne's path convention.
+  //
+  // NON-ENUMERABLE, deliberately: a private key must not be one careless `console.log(creds)` or
+  // `JSON.stringify(config)` away from a CI log that the whole team can read. Explicit property access
+  // still works, which is the only way it is ever read; a spread or a dump cannot see it.
+  const keyContent = pick("ASC_KEY_CONTENT", "keyContent");
+
+  const out = {
     keyId: pick("ASC_KEY_ID", "keyId"),
     issuerId: pick("ASC_ISSUER_ID", "issuerId"),
+    keyPath: expandHome(pick("ASC_KEY_PATH", "keyPath"), home),
     playJsonKeyFile: expandHome(pick("PLAY_JSON_KEY_FILE", "playJsonKeyFile"), home),
     sources,
     warnings,
     userFile,
     candidates: configCandidates(env, home),
   };
+  Object.defineProperty(out, "keyContent", { value: keyContent, enumerable: false, writable: false });
+  return out;
 }

package/src/index.mjs

@@ -13,7 +13,7 @@ export { PlayClient } from "./play/client.mjs";
 export { loadConfig, CONFIG_KEYS } from "./config.mjs";
 export { COMMANDS, PLAY_COMMANDS, COMMAND_NAMES } from "./registry.mjs";
 export { resolveLocales, toAsc, VALID, UI_TO_ASC } from "./locales.mjs";
-export { makeToken } from "./jwt.mjs";
+export { makeToken, resolveKey } from "./jwt.mjs";
 export { DEFAULT_SCREENSHOT_BASE, IOS_DEVICE, MAC_DEVICE, screenshotBase } from "./screenshots.mjs";
 export { DEFAULT_PLAY_IMAGES, PLAY_IMAGE_KIND, playImages } from "./play/images.mjs";
 
@@ -55,7 +55,7 @@ export async function runCommand(name, opts = {}) {
     return { ok: (await run(config, client)) !== false, planned: [] };
   }
 
-  const client = spec.client ? new Client({ keyId: config.keyId, issuerId: config.issuerId, dryRun }) : null;
+  const client = spec.client ? new Client({ keyId: config.keyId, issuerId: config.issuerId, keyPath: config.keyPath, keyContent: config.keyContent, dryRun }) : null;
   const { run } = await import(`./commands/${spec.mod}.mjs`);
   // altool authenticates on its own rather than through our JWT, so it needs the raw ids.
   const ok = await run(config, client, spec.credentials ? { keyId: config.keyId, issuerId: config.issuerId } : undefined);

package/src/jwt.mjs

@@ -3,12 +3,51 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
+const PEM_MARKER = "-----BEGIN";
+
+/**
+ * The .p8 itself, from whichever place this machine keeps it.
+ *
+ * A FILE is the right default on a developer's Mac, where the key sits beside the credentials in
+ * `~/.appstoreconnect`. It is the wrong and only option in CI, where a secret arrives as an
+ * environment variable and there is no home directory worth writing to — every caller was left
+ * materialising the key itself:
+ *
+ *     mkdir -p "$HOME/.appstoreconnect/private_keys"
+ *     printf '%s' "$ASC_KEY_CONTENT" | base64 --decode > ".../AuthKey_${ASC_KEY_ID}.p8"
+ *
+ * That is four lines of shell, per workflow, that must agree with vydanne's private path convention —
+ * and it silently writes a signing key to disk on a shared runner. `keyContent` removes the need.
+ *
+ * Accepts the PEM as-is or base64-encoded, because CI secrets are usually stored base64 (GitHub's own
+ * docs recommend it for multi-line values, and `ASC_KEY_CONTENT` is already base64 wherever fastlane
+ * reads it with `is_key_content_base64`).
+ */
+export function resolveKey({ keyId, keyPath, keyContent }) {
+  if (keyContent) {
+    const raw = keyContent.trim();
+    if (raw.includes(PEM_MARKER)) return raw;
+    const decoded = Buffer.from(raw, "base64").toString("utf8");
+    if (decoded.includes(PEM_MARKER)) return decoded;
+    throw new Error(
+      "vydanne: ASC_KEY_CONTENT is neither a PEM nor base64 of one — expected it to contain " +
+        `"${PEM_MARKER} PRIVATE KEY". Check the secret was stored whole, newlines included.`,
+    );
+  }
+  const file = keyPath || path.join(os.homedir(), ".appstoreconnect", "private_keys", `AuthKey_${keyId}.p8`);
+  if (!fs.existsSync(file)) {
+    throw new Error(
+      `vydanne: ASC key not found at ${file}. On a developer machine put the .p8 there; in CI set ` +
+        "ASC_KEY_CONTENT (the .p8, raw or base64) or ASC_KEY_PATH instead — no file needed.",
+    );
+  }
+  return fs.readFileSync(file, "utf8");
+}
+
 // App Store Connect JWT (ES256). Node's built-in crypto signs it — `dsaEncoding: "ieee-p1363"` returns the
 // raw r||s signature JWT/JOSE needs (the default DER encoding would be rejected). No fastlane/spaceship.
-export function makeToken({ keyId, issuerId, keyPath }) {
-  keyPath ||= path.join(os.homedir(), ".appstoreconnect", "private_keys", `AuthKey_${keyId}.p8`);
-  if (!fs.existsSync(keyPath)) throw new Error(`vydanne: ASC key not found at ${keyPath}`);
-  const p8 = fs.readFileSync(keyPath, "utf8");
+export function makeToken({ keyId, issuerId, keyPath, keyContent }) {
+  const p8 = resolveKey({ keyId, keyPath, keyContent });
   const b64u = (o) => Buffer.from(typeof o === "string" ? o : JSON.stringify(o)).toString("base64url");
   const now = Math.floor(Date.now() / 1000);
   const input = `${b64u({ alg: "ES256", kid: keyId, typ: "JWT" })}.${b64u({ iss: issuerId, iat: now, exp: now + 1200, aud: "appstoreconnect-v1" })}`;

package/types/index.d.ts

@@ -359,7 +359,7 @@ export interface VydanneConfig {
 
 /** Thin ASC REST client (native fetch + ES256 JWT). */
 export declare class Client {
-  constructor(opts: { keyId: string; issuerId: string; dryRun?: boolean });
+  constructor(opts: { keyId: string; issuerId: string; keyPath?: string; keyContent?: string; dryRun?: boolean });
   token: string;
   appId?: string;
   app?: unknown;
@@ -420,7 +420,22 @@ export declare function runCommand(
 ): Promise<{ ok: boolean; planned: Array<{ method: string; path: string; attributes: Record<string, unknown> }> }>;
 
 export declare function loadConfig(path?: string): Promise<ResolvedConfig>;
-export declare function makeToken(opts: { keyId: string; issuerId: string; keyPath?: string }): string;
+/**
+ * App Store Connect JWT (ES256).
+ *
+ * The signing key comes from ONE of three places, in order: `keyContent` (the .p8 itself, raw PEM or
+ * base64 — what CI hands over, so no key is written to a runner's disk), `keyPath`, or the default
+ * `~/.appstoreconnect/private_keys/AuthKey_<keyId>.p8`.
+ */
+export declare function makeToken(opts: {
+  keyId: string;
+  issuerId: string;
+  keyPath?: string;
+  keyContent?: string;
+}): string;
+
+/** The .p8 text itself, from `keyContent` / `keyPath` / the default location. Throws if it is neither. */
+export declare function resolveKey(opts: { keyId?: string; keyPath?: string; keyContent?: string }): string;
 export declare function resolveLocales(uiCodes: string[], extra?: Record<string, string>): ResolvedLocales;
 export declare function toAsc(code: string, extra?: Record<string, string>): string | null;
 export declare const VALID: Set<string>;