@better-update/cli 0.38.0 → 0.39.0

package/dist/index.mjs

@@ -20,6 +20,7 @@ import chalk from "chalk";
 import { promisify } from "node:util";
 import ignore from "ignore";
 import os, { tmpdir } from "node:os";
+import { fileURLToPath } from "node:url";
 import { maxBy, uniqBy } from "es-toolkit";
 import forge from "node-forge";
 import { AndroidConfig } from "@expo/config-plugins";
@@ -28,14 +29,13 @@ import { ExpoRunFormatter } from "@expo/xcpretty";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { getFormattedSerialNumber, getX509Certificate, parsePKCS12 } from "@expo/pkcs12";
 import qrcode from "qrcode-terminal";
-import { fileURLToPath } from "node:url";
 
 //#region \0rolldown/runtime.js
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 //#endregion
 //#region package.json
-var version = "0.38.0";
+var version = "0.39.0";
 
 //#endregion
 //#region src/lib/interactive-mode.ts
@@ -20135,6 +20135,279 @@ const acquireBuildTempDir = Effect.gen(function* () {
 	return dir;
 });
 
+//#endregion
+//#region src/lib/google-play.ts
+var GooglePlayAuthError = class extends Schema.TaggedError()("GooglePlayAuthError", {
+	message: Schema.String,
+	cause: Schema.optional(Schema.Unknown)
+}) {};
+var GooglePlayApiError = class extends Schema.TaggedError()("GooglePlayApiError", {
+	message: Schema.String,
+	httpStatus: Schema.optional(Schema.Number),
+	cause: Schema.optional(Schema.Unknown)
+}) {};
+const ANDROID_PUBLISHER_SCOPE = "https://www.googleapis.com/auth/androidpublisher";
+const GOOGLE_OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";
+const ANDROID_PUBLISHER_BASE = "https://androidpublisher.googleapis.com";
+const ANDROID_UPLOAD_BASE = "https://androidpublisher.googleapis.com/upload";
+const ServiceAccountJsonSchema = Schema.Struct({
+	type: Schema.String,
+	client_email: Schema.String,
+	private_key: Schema.String,
+	token_uri: Schema.optional(Schema.String)
+});
+const TokenResponseSchema = Schema.Struct({
+	access_token: Schema.String,
+	expires_in: Schema.optional(Schema.Number)
+});
+const stripPemHeaders = (pem) => pem.replace(/-----BEGIN [A-Z ]+-----/u, "").replace(/-----END [A-Z ]+-----/u, "").replaceAll(/\s+/gu, "");
+const asArrayBuffer$1 = (bytes) => {
+	const buffer = new ArrayBuffer(bytes.byteLength);
+	new Uint8Array(buffer).set(bytes);
+	return buffer;
+};
+const importPrivateKey = (pem) => Effect.tryPromise({
+	try: async () => {
+		const pkcs8 = fromBase64(stripPemHeaders(pem));
+		return crypto.subtle.importKey("pkcs8", asArrayBuffer$1(pkcs8), {
+			name: "RSASSA-PKCS1-v1_5",
+			hash: "SHA-256"
+		}, false, ["sign"]);
+	},
+	catch: (cause) => new GooglePlayAuthError({
+		message: "Failed to import service account private key",
+		cause
+	})
+});
+const buildJwtAssertion = (params) => {
+	const header = {
+		alg: "RS256",
+		typ: "JWT"
+	};
+	const claims = {
+		iss: params.clientEmail,
+		scope: ANDROID_PUBLISHER_SCOPE,
+		aud: params.tokenUri,
+		exp: params.nowSeconds + 3600,
+		iat: params.nowSeconds
+	};
+	return `${toBase64Url(new TextEncoder().encode(JSON.stringify(header)))}.${toBase64Url(new TextEncoder().encode(JSON.stringify(claims)))}`;
+};
+const signJwt = (key, payload) => Effect.tryPromise({
+	try: async () => {
+		const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, new TextEncoder().encode(payload));
+		return `${payload}.${toBase64Url(new Uint8Array(signature))}`;
+	},
+	catch: (cause) => new GooglePlayAuthError({
+		message: "Failed to sign JWT",
+		cause
+	})
+});
+const postTokenRequest = (tokenUri, jwt) => Effect.tryPromise({
+	try: async () => {
+		const body = new URLSearchParams({
+			grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+			assertion: jwt
+		});
+		const response = await fetch(tokenUri, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body
+		});
+		const text = await response.text();
+		return {
+			ok: response.ok,
+			status: response.status,
+			text
+		};
+	},
+	catch: (cause) => new GooglePlayAuthError({
+		message: "Failed to exchange JWT for access token",
+		cause
+	})
+});
+const exchangeJwtForAccessToken = (tokenUri, jwt) => Effect.gen(function* () {
+	const result = yield* postTokenRequest(tokenUri, jwt);
+	if (!result.ok) return yield* new GooglePlayAuthError({ message: `OAuth token exchange failed: ${String(result.status)} ${result.text}` });
+	const json = yield* Effect.try({
+		try: () => JSON.parse(result.text),
+		catch: (cause) => new GooglePlayAuthError({
+			message: "OAuth token response is not JSON",
+			cause
+		})
+	});
+	return (yield* Schema.decodeUnknown(TokenResponseSchema)(json).pipe(Effect.mapError((cause) => new GooglePlayAuthError({
+		message: "OAuth token response missing access_token",
+		cause
+	})))).access_token;
+});
+const acquireGooglePlayAccessToken = (serviceAccountJson) => Effect.gen(function* () {
+	const raw = yield* Effect.try({
+		try: () => JSON.parse(serviceAccountJson),
+		catch: (cause) => new GooglePlayAuthError({
+			message: "Service account JSON is not valid JSON",
+			cause
+		})
+	});
+	const parsed = yield* Schema.decodeUnknown(ServiceAccountJsonSchema)(raw).pipe(Effect.mapError((cause) => new GooglePlayAuthError({
+		message: "Service account JSON missing required fields (type, client_email, private_key)",
+		cause
+	})));
+	if (parsed.type !== "service_account") return yield* new GooglePlayAuthError({ message: `Service account JSON has wrong type: ${parsed.type}` });
+	const tokenUri = parsed.token_uri ?? GOOGLE_OAUTH_TOKEN_URL;
+	return {
+		accessToken: yield* exchangeJwtForAccessToken(tokenUri, yield* signJwt(yield* importPrivateKey(parsed.private_key), buildJwtAssertion({
+			clientEmail: parsed.client_email,
+			tokenUri,
+			nowSeconds: Math.floor(Date.now() / 1e3)
+		}))),
+		clientEmail: parsed.client_email
+	};
+});
+const authHeaders = (accessToken) => ({ Authorization: `Bearer ${accessToken}` });
+const performFetch = (params) => Effect.tryPromise({
+	try: async () => {
+		const init = params.body === void 0 ? {
+			method: params.method,
+			headers: authHeaders(params.accessToken)
+		} : {
+			method: params.method,
+			headers: {
+				...authHeaders(params.accessToken),
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify(params.body)
+		};
+		const response = await fetch(params.url, init);
+		const text = await response.text();
+		return {
+			ok: response.ok,
+			status: response.status,
+			text
+		};
+	},
+	catch: (cause) => new GooglePlayApiError({
+		message: `${params.label} request failed`,
+		cause
+	})
+});
+const callJsonRaw = (params) => Effect.gen(function* () {
+	const result = yield* performFetch(params);
+	if (!result.ok) return yield* new GooglePlayApiError({
+		message: `${params.label} failed: ${String(result.status)} ${result.text}`,
+		httpStatus: result.status
+	});
+	return yield* Effect.try({
+		try: () => result.text === "" ? {} : JSON.parse(result.text),
+		catch: (cause) => new GooglePlayApiError({
+			message: `${params.label} response is not JSON`,
+			cause
+		})
+	});
+});
+const AppEditSchema = Schema.Struct({
+	id: Schema.String,
+	expiryTimeSeconds: Schema.optional(Schema.String)
+});
+const insertEdit = (params) => Effect.gen(function* () {
+	const raw = yield* callJsonRaw({
+		url: `${ANDROID_PUBLISHER_BASE}/androidpublisher/v3/applications/${encodeURIComponent(params.packageName)}/edits`,
+		method: "POST",
+		accessToken: params.accessToken,
+		body: {},
+		label: "edits.insert"
+	});
+	return yield* Schema.decodeUnknown(AppEditSchema)(raw).pipe(Effect.mapError((cause) => new GooglePlayApiError({
+		message: "edits.insert response missing id",
+		cause
+	})));
+});
+const UploadedBundleSchema = Schema.Struct({
+	versionCode: Schema.Number,
+	sha256: Schema.optional(Schema.String)
+});
+const performBundleUpload = (params) => Effect.tryPromise({
+	try: async () => {
+		const url = `${ANDROID_UPLOAD_BASE}/androidpublisher/v3/applications/${encodeURIComponent(params.packageName)}/edits/${encodeURIComponent(params.editId)}/bundles?uploadType=media`;
+		const response = await fetch(url, {
+			method: "POST",
+			headers: {
+				...authHeaders(params.accessToken),
+				"Content-Type": "application/octet-stream"
+			},
+			body: new Uint8Array(params.aabBytes)
+		});
+		const text = await response.text();
+		return {
+			ok: response.ok,
+			status: response.status,
+			text
+		};
+	},
+	catch: (cause) => new GooglePlayApiError({
+		message: "edits.bundles.upload request failed",
+		cause
+	})
+});
+const uploadBundle = (params) => Effect.gen(function* () {
+	const result = yield* performBundleUpload(params);
+	if (!result.ok) return yield* new GooglePlayApiError({
+		message: `edits.bundles.upload failed: ${String(result.status)} ${result.text}`,
+		httpStatus: result.status
+	});
+	const raw = yield* Effect.try({
+		try: () => JSON.parse(result.text),
+		catch: (cause) => new GooglePlayApiError({
+			message: "edits.bundles.upload response is not JSON",
+			cause
+		})
+	});
+	return yield* Schema.decodeUnknown(UploadedBundleSchema)(raw).pipe(Effect.mapError((cause) => new GooglePlayApiError({
+		message: "Bundle upload response missing versionCode",
+		cause
+	})));
+});
+/**
+* Build the track release object. Google Play accepts `userFraction` only for a
+* staged (`inProgress`) rollout and rejects it for `completed`/`draft`/`halted`,
+* so the fraction is gated on the status rather than passed through blindly.
+*/
+const buildTrackRelease = (params) => ({
+	status: params.releaseStatus,
+	versionCodes: [String(params.versionCode)],
+	...compact({
+		userFraction: params.releaseStatus === "inProgress" ? toOptional(params.rollout) : void 0,
+		releaseNotes: params.releaseNotes ? [{
+			language: "en-US",
+			text: params.releaseNotes
+		}] : void 0
+	})
+});
+const updateTrack = (params) => {
+	const release = buildTrackRelease({
+		releaseStatus: params.releaseStatus,
+		versionCode: params.versionCode,
+		rollout: params.rollout,
+		releaseNotes: params.releaseNotes
+	});
+	return callJsonRaw({
+		url: `${ANDROID_PUBLISHER_BASE}/androidpublisher/v3/applications/${encodeURIComponent(params.packageName)}/edits/${encodeURIComponent(params.editId)}/tracks/${encodeURIComponent(params.track)}`,
+		method: "PUT",
+		accessToken: params.accessToken,
+		body: {
+			track: params.track,
+			releases: [release]
+		},
+		label: "edits.tracks.update"
+	});
+};
+const commitEdit = (params) => callJsonRaw({
+	url: `${ANDROID_PUBLISHER_BASE}/androidpublisher/v3/applications/${encodeURIComponent(params.packageName)}/edits/${encodeURIComponent(params.editId)}:commit?changesNotSentForReview=${String(params.changesNotSentForReview)}`,
+	method: "POST",
+	accessToken: params.accessToken,
+	label: "edits.commit"
+});
+
 //#endregion
 //#region src/lib/asc-credentials.ts
 /**
@@ -20168,265 +20441,589 @@ const fetchAscCredentials = (api, ascApiKeyId) => Effect.gen(function* () {
 });
 
 //#endregion
-//#region src/lib/google-play.ts
-var GooglePlayAuthError = class extends Schema.TaggedError()("GooglePlayAuthError", {
-	message: Schema.String,
-	cause: Schema.optional(Schema.Unknown)
-}) {};
-var GooglePlayApiError = class extends Schema.TaggedError()("GooglePlayApiError", {
-	message: Schema.String,
-	httpStatus: Schema.optional(Schema.Number),
-	cause: Schema.optional(Schema.Unknown)
-}) {};
-const ANDROID_PUBLISHER_SCOPE = "https://www.googleapis.com/auth/androidpublisher";
-const GOOGLE_OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";
-const ANDROID_PUBLISHER_BASE = "https://androidpublisher.googleapis.com";
-const ANDROID_UPLOAD_BASE = "https://androidpublisher.googleapis.com/upload";
-const ServiceAccountJsonSchema = Schema.Struct({
-	type: Schema.String,
-	client_email: Schema.String,
-	private_key: Schema.String,
-	token_uri: Schema.optional(Schema.String)
-});
-const TokenResponseSchema = Schema.Struct({
-	access_token: Schema.String,
-	expires_in: Schema.optional(Schema.Number)
-});
-const stripPemHeaders = (pem) => pem.replace(/-----BEGIN [A-Z ]+-----/u, "").replace(/-----END [A-Z ]+-----/u, "").replaceAll(/\s+/gu, "");
-const asArrayBuffer$1 = (bytes) => {
+//#region src/lib/apple-pem.ts
+const PEM_HEADER = "-----BEGIN PRIVATE KEY-----";
+const PEM_FOOTER = "-----END PRIVATE KEY-----";
+const pemToPkcs8Der = (pem) => {
+	const normalized = pem.replaceAll("\r\n", "\n").trim();
+	const start = normalized.indexOf(PEM_HEADER);
+	const end = normalized.indexOf(PEM_FOOTER);
+	if (start === -1 || end === -1 || end <= start) return null;
+	const body = normalized.slice(start + 27, end).replaceAll(/\s+/gu, "").trim();
+	if (body.length === 0) return null;
+	try {
+		return fromBase64(body);
+	} catch {
+		return null;
+	}
+};
+
+//#endregion
+//#region src/lib/apple-asc-jwt.ts
+var AppleAuthError = class extends Data.TaggedError("AppleAuthError") {};
+const MAX_JWT_LIFETIME_SECONDS = 1200;
+const asArrayBuffer = (bytes) => {
 	const buffer = new ArrayBuffer(bytes.byteLength);
 	new Uint8Array(buffer).set(bytes);
 	return buffer;
 };
-const importPrivateKey = (pem) => Effect.tryPromise({
-	try: async () => {
-		const pkcs8 = fromBase64(stripPemHeaders(pem));
-		return crypto.subtle.importKey("pkcs8", asArrayBuffer$1(pkcs8), {
-			name: "RSASSA-PKCS1-v1_5",
-			hash: "SHA-256"
-		}, false, ["sign"]);
-	},
-	catch: (cause) => new GooglePlayAuthError({
-		message: "Failed to import service account private key",
-		cause
-	})
-});
-const buildJwtAssertion = (params) => {
+const signAscJwt = (credentials) => Effect.gen(function* () {
+	const der = pemToPkcs8Der(credentials.p8Pem);
+	if (der === null) return yield* new AppleAuthError({ cause: /* @__PURE__ */ new Error("Invalid .p8 PEM") });
 	const header = {
-		alg: "RS256",
+		alg: "ES256",
+		kid: credentials.keyId,
 		typ: "JWT"
 	};
-	const claims = {
-		iss: params.clientEmail,
-		scope: ANDROID_PUBLISHER_SCOPE,
-		aud: params.tokenUri,
-		exp: params.nowSeconds + 3600,
-		iat: params.nowSeconds
+	const now = Math.floor(Date.now() / 1e3);
+	const payload = {
+		iss: credentials.issuerId,
+		iat: now,
+		exp: now + MAX_JWT_LIFETIME_SECONDS,
+		aud: "appstoreconnect-v1"
 	};
-	return `${toBase64Url(new TextEncoder().encode(JSON.stringify(header)))}.${toBase64Url(new TextEncoder().encode(JSON.stringify(claims)))}`;
-};
-const signJwt = (key, payload) => Effect.tryPromise({
-	try: async () => {
-		const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, new TextEncoder().encode(payload));
-		return `${payload}.${toBase64Url(new Uint8Array(signature))}`;
-	},
-	catch: (cause) => new GooglePlayAuthError({
-		message: "Failed to sign JWT",
-		cause
-	})
-});
-const postTokenRequest = (tokenUri, jwt) => Effect.tryPromise({
-	try: async () => {
-		const body = new URLSearchParams({
-			grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
-			assertion: jwt
-		});
-		const response = await fetch(tokenUri, {
-			method: "POST",
-			headers: { "Content-Type": "application/x-www-form-urlencoded" },
-			body
-		});
-		const text = await response.text();
-		return {
-			ok: response.ok,
-			status: response.status,
-			text
-		};
-	},
-	catch: (cause) => new GooglePlayAuthError({
-		message: "Failed to exchange JWT for access token",
-		cause
-	})
-});
-const exchangeJwtForAccessToken = (tokenUri, jwt) => Effect.gen(function* () {
-	const result = yield* postTokenRequest(tokenUri, jwt);
-	if (!result.ok) return yield* new GooglePlayAuthError({ message: `OAuth token exchange failed: ${String(result.status)} ${result.text}` });
-	const json = yield* Effect.try({
-		try: () => JSON.parse(result.text),
-		catch: (cause) => new GooglePlayAuthError({
-			message: "OAuth token response is not JSON",
-			cause
-		})
+	const signingInput = `${toBase64Url(new TextEncoder().encode(JSON.stringify(header)))}.${toBase64Url(new TextEncoder().encode(JSON.stringify(payload)))}`;
+	const key = yield* Effect.tryPromise({
+		try: async () => crypto.subtle.importKey("pkcs8", asArrayBuffer(der), {
+			name: "ECDSA",
+			namedCurve: "P-256"
+		}, false, ["sign"]),
+		catch: (cause) => new AppleAuthError({ cause })
 	});
-	return (yield* Schema.decodeUnknown(TokenResponseSchema)(json).pipe(Effect.mapError((cause) => new GooglePlayAuthError({
-		message: "OAuth token response missing access_token",
-		cause
-	})))).access_token;
-});
-const acquireGooglePlayAccessToken = (serviceAccountJson) => Effect.gen(function* () {
-	const raw = yield* Effect.try({
-		try: () => JSON.parse(serviceAccountJson),
-		catch: (cause) => new GooglePlayAuthError({
-			message: "Service account JSON is not valid JSON",
-			cause
-		})
+	const signature = yield* Effect.tryPromise({
+		try: async () => crypto.subtle.sign({
+			name: "ECDSA",
+			hash: "SHA-256"
+		}, key, new TextEncoder().encode(signingInput)),
+		catch: (cause) => new AppleAuthError({ cause })
 	});
-	const parsed = yield* Schema.decodeUnknown(ServiceAccountJsonSchema)(raw).pipe(Effect.mapError((cause) => new GooglePlayAuthError({
-		message: "Service account JSON missing required fields (type, client_email, private_key)",
-		cause
-	})));
-	if (parsed.type !== "service_account") return yield* new GooglePlayAuthError({ message: `Service account JSON has wrong type: ${parsed.type}` });
-	const tokenUri = parsed.token_uri ?? GOOGLE_OAUTH_TOKEN_URL;
-	return {
-		accessToken: yield* exchangeJwtForAccessToken(tokenUri, yield* signJwt(yield* importPrivateKey(parsed.private_key), buildJwtAssertion({
-			clientEmail: parsed.client_email,
-			tokenUri,
-			nowSeconds: Math.floor(Date.now() / 1e3)
-		}))),
-		clientEmail: parsed.client_email
-	};
+	return `${signingInput}.${toBase64Url(new Uint8Array(signature))}`;
 });
-const authHeaders = (accessToken) => ({ Authorization: `Bearer ${accessToken}` });
-const performFetch = (params) => Effect.tryPromise({
-	try: async () => {
-		const init = params.body === void 0 ? {
-			method: params.method,
-			headers: authHeaders(params.accessToken)
-		} : {
-			method: params.method,
+
+//#endregion
+//#region src/lib/apple-asc-client.ts
+/**
+* App Store Connect REST client authenticated with an ASC **API key** — a JWT
+* signed from a `.p8` private key (see `apple-asc-jwt.ts`). Credentials are
+* resolved non-interactively from the server (`fetchAscCredentials`), so this
+* powers headless flows: build-credential resolution, provisioning-profile
+* generation, and device sync.
+*
+* Intentionally NOT built on `@expo/apple-utils`: that library authenticates
+* via an interactive Apple-ID **cookie session** (username/password + 2FA, see
+* `services/apple-auth.ts`) and exposes a cookie-based `RequestContext`. That is
+* a different auth model that would force an interactive login here. The two
+* coexist by design — apple-utils backs `apple login`; this client backs
+* non-interactive ASC API-key access.
+*/
+var AscApiError = class extends Data.TaggedError("AscApiError") {};
+var AscNetworkError = class extends Data.TaggedError("AscNetworkError") {};
+const API_BASE = "https://api.appstoreconnect.apple.com";
+const extractErrors = (body) => {
+	if (!isRecord$1(body) || !Array.isArray(body["errors"])) return [];
+	return body["errors"].filter((value) => isRecord$1(value));
+};
+const parseApiError = (response, body, raw) => {
+	const [first] = extractErrors(body);
+	return new AscApiError({
+		status: response.status,
+		message: first?.detail ?? first?.title ?? response.statusText,
+		code: first?.code,
+		raw
+	});
+};
+const fetchRaw = (jwt, path, init) => Effect.gen(function* () {
+	const response = yield* Effect.tryPromise({
+		try: async () => fetch(`${API_BASE}${path}`, compact({
+			method: init?.method ?? "GET",
+			body: init?.body,
 			headers: {
-				...authHeaders(params.accessToken),
-				"Content-Type": "application/json"
-			},
-			body: JSON.stringify(params.body)
-		};
-		const response = await fetch(params.url, init);
-		const text = await response.text();
-		return {
-			ok: response.ok,
-			status: response.status,
-			text
-		};
-	},
-	catch: (cause) => new GooglePlayApiError({
-		message: `${params.label} request failed`,
-		cause
-	})
-});
-const callJsonRaw = (params) => Effect.gen(function* () {
-	const result = yield* performFetch(params);
-	if (!result.ok) return yield* new GooglePlayApiError({
-		message: `${params.label} failed: ${String(result.status)} ${result.text}`,
-		httpStatus: result.status
+				authorization: `Bearer ${jwt}`,
+				"content-type": "application/json",
+				accept: "application/json"
+			}
+		})),
+		catch: (cause) => new AscNetworkError({ cause })
 	});
-	return yield* Effect.try({
-		try: () => result.text === "" ? {} : JSON.parse(result.text),
-		catch: (cause) => new GooglePlayApiError({
-			message: `${params.label} response is not JSON`,
-			cause
-		})
+	const text = yield* Effect.tryPromise({
+		try: async () => response.text(),
+		catch: (cause) => new AscNetworkError({ cause })
 	});
-});
-const AppEditSchema = Schema.Struct({
-	id: Schema.String,
-	expiryTimeSeconds: Schema.optional(Schema.String)
-});
-const insertEdit = (params) => Effect.gen(function* () {
-	const raw = yield* callJsonRaw({
-		url: `${ANDROID_PUBLISHER_BASE}/androidpublisher/v3/applications/${encodeURIComponent(params.packageName)}/edits`,
-		method: "POST",
-		accessToken: params.accessToken,
-		body: {},
-		label: "edits.insert"
+	const body = yield* Effect.try({
+		try: () => text.length === 0 ? {} : JSON.parse(text),
+		catch: (cause) => new AscNetworkError({ cause })
 	});
-	return yield* Schema.decodeUnknown(AppEditSchema)(raw).pipe(Effect.mapError((cause) => new GooglePlayApiError({
-		message: "edits.insert response missing id",
-		cause
-	})));
+	if (!response.ok) return yield* parseApiError(response, body, text);
+	return body;
 });
-const UploadedBundleSchema = Schema.Struct({
-	versionCode: Schema.Number,
-	sha256: Schema.optional(Schema.String)
+const toAscCertificate = (value) => {
+	if (!isRecord$1(value)) return null;
+	const { id, attributes } = value;
+	if (typeof id !== "string" || !isRecord$1(attributes)) return null;
+	const { serialNumber, certificateType, expirationDate, certificateContent, displayName } = attributes;
+	if (typeof serialNumber !== "string" || typeof certificateType !== "string" || typeof expirationDate !== "string") return null;
+	return {
+		id,
+		serialNumber,
+		certificateType,
+		expirationDate,
+		certificateContent: typeof certificateContent === "string" ? certificateContent : null,
+		displayName: typeof displayName === "string" ? displayName : null
+	};
+};
+const toAscBundleId = (value) => {
+	if (!isRecord$1(value)) return null;
+	const { id, attributes } = value;
+	if (typeof id !== "string" || !isRecord$1(attributes)) return null;
+	const { identifier, name } = attributes;
+	if (typeof identifier !== "string" || typeof name !== "string") return null;
+	return {
+		id,
+		identifier,
+		name
+	};
+};
+const PROFILE_TYPES = [
+	"IOS_APP_ADHOC",
+	"IOS_APP_DEVELOPMENT",
+	"IOS_APP_STORE",
+	"IOS_APP_INHOUSE"
+];
+const asProfileType = (value) => {
+	const match = PROFILE_TYPES.find((entry) => entry === value);
+	return match === void 0 ? null : match;
+};
+const toAscProfile = (value) => {
+	if (!isRecord$1(value)) return null;
+	const { id, attributes } = value;
+	if (typeof id !== "string" || !isRecord$1(attributes)) return null;
+	const { name, uuid, expirationDate, profileContent } = attributes;
+	const profileType = asProfileType(attributes["profileType"]);
+	if (typeof name !== "string" || typeof uuid !== "string" || typeof expirationDate !== "string" || typeof profileContent !== "string" || profileType === null) return null;
+	return {
+		id,
+		name,
+		uuid,
+		expirationDate,
+		profileContent,
+		profileType
+	};
+};
+const toAscDevice = (value) => {
+	if (!isRecord$1(value)) return null;
+	const { id, attributes } = value;
+	if (typeof id !== "string" || !isRecord$1(attributes)) return null;
+	const { udid, name, deviceClass } = attributes;
+	if (typeof udid !== "string" || typeof name !== "string") return null;
+	return {
+		id,
+		udid,
+		name,
+		deviceClass: typeof deviceClass === "string" ? deviceClass : null
+	};
+};
+const extractList = (body, map) => {
+	if (!isRecord$1(body) || !Array.isArray(body["data"])) return [];
+	return body["data"].map(map).filter((value) => value !== null);
+};
+const extractSingle = (body, map) => {
+	if (!isRecord$1(body)) return null;
+	return map(body["data"]);
+};
+/**
+* App Store Connect paginates list responses (default 200/page) and returns the
+* absolute URL of the next page under `links.next`. Strip the base so it can be
+* fed back into `fetchRaw`; return null when there is no further page.
+*/
+const nextPagePath = (body) => {
+	if (!isRecord$1(body)) return null;
+	const { links } = body;
+	if (!isRecord$1(links) || typeof links["next"] !== "string") return null;
+	const { next } = links;
+	return next.startsWith(API_BASE) ? next.slice(37) : next;
+};
+const malformed = (resource) => new AscApiError({
+	status: 500,
+	message: `Malformed ${resource} response`,
+	code: void 0,
+	raw: ""
 });
-const performBundleUpload = (params) => Effect.tryPromise({
-	try: async () => {
-		const url = `${ANDROID_UPLOAD_BASE}/androidpublisher/v3/applications/${encodeURIComponent(params.packageName)}/edits/${encodeURIComponent(params.editId)}/bundles?uploadType=media`;
-		const response = await fetch(url, {
-			method: "POST",
-			headers: {
-				...authHeaders(params.accessToken),
-				"Content-Type": "application/octet-stream"
+const withJwt = (credentials, fn) => Effect.gen(function* () {
+	return yield* fn(yield* signAscJwt(credentials));
+});
+const listCertificates = (credentials, params) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	return extractList(yield* fetchRaw(jwt, `/v1/certificates${params?.certificateType ? `?filter[certificateType]=${params.certificateType}&limit=200` : "?limit=200"}`), toAscCertificate);
+}));
+const createCertificate = (credentials, params) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	const csrContent = params.csrPem.replaceAll("-----BEGIN CERTIFICATE REQUEST-----", "").replaceAll("-----END CERTIFICATE REQUEST-----", "").replaceAll(/\s+/gu, "");
+	const resource = extractSingle(yield* fetchRaw(jwt, "/v1/certificates", {
+		method: "POST",
+		body: JSON.stringify({ data: {
+			type: "certificates",
+			attributes: {
+				csrContent,
+				certificateType: params.certificateType
+			}
+		} })
+	}), toAscCertificate);
+	if (resource === null) return yield* malformed("certificate");
+	return resource;
+}));
+const deleteCertificate = (credentials, id) => withJwt(credentials, (jwt) => Effect.asVoid(fetchRaw(jwt, `/v1/certificates/${encodeURIComponent(id)}`, { method: "DELETE" })));
+const listBundleIds = (credentials) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	return extractList(yield* fetchRaw(jwt, "/v1/bundleIds?limit=200"), toAscBundleId);
+}));
+const createBundleId = (credentials, params) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	const resource = extractSingle(yield* fetchRaw(jwt, "/v1/bundleIds", {
+		method: "POST",
+		body: JSON.stringify({ data: {
+			type: "bundleIds",
+			attributes: {
+				identifier: params.identifier,
+				name: params.name,
+				platform: "IOS"
+			}
+		} })
+	}), toAscBundleId);
+	if (resource === null) return yield* malformed("bundleId");
+	return resource;
+}));
+const listDevices = (credentials) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	const devices = [];
+	let path = "/v1/devices?limit=200";
+	while (path !== null) {
+		const body = yield* fetchRaw(jwt, path);
+		devices.push(...extractList(body, toAscDevice));
+		path = nextPagePath(body);
+	}
+	return devices;
+}));
+const createDevice = (credentials, params) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	const resource = extractSingle(yield* fetchRaw(jwt, "/v1/devices", {
+		method: "POST",
+		body: JSON.stringify({ data: {
+			type: "devices",
+			attributes: {
+				name: params.name,
+				udid: params.udid,
+				platform: "IOS"
+			}
+		} })
+	}), toAscDevice);
+	if (resource === null) return yield* malformed("device");
+	return resource;
+}));
+const createProvisioningProfile = (credentials, params) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	const relationships = {
+		bundleId: { data: {
+			type: "bundleIds",
+			id: params.bundleIdAscId
+		} },
+		certificates: { data: params.certificateAscIds.map((id) => ({
+			type: "certificates",
+			id
+		})) },
+		...params.deviceAscIds.length > 0 ? { devices: { data: params.deviceAscIds.map((id) => ({
+			type: "devices",
+			id
+		})) } } : {}
+	};
+	const resource = extractSingle(yield* fetchRaw(jwt, "/v1/profiles", {
+		method: "POST",
+		body: JSON.stringify({ data: {
+			type: "profiles",
+			attributes: {
+				name: params.profileName,
+				profileType: params.profileType
 			},
-			body: new Uint8Array(params.aabBytes)
+			relationships
+		} })
+	}), toAscProfile);
+	if (resource === null) return yield* malformed("profile");
+	return resource;
+}));
+const isCertificateLimitError = (error) => {
+	if (error._tag !== "AscApiError") return false;
+	return /already have a current.*certificate|pending certificate request/iu.test(error.message);
+};
+
+//#endregion
+//#region src/lib/apple-asc-testflight.ts
+/**
+* App Store Connect TestFlight operations layered on the ASC API-key client
+* ({@link ./apple-asc-client}). Used by the iOS submit flow to configure a build
+* *after* `altool` uploads it: set the "What to Test" text and assign the build
+* to internal beta groups — matching `eas submit`'s post-upload behaviour.
+*/
+const toAscApp = (value) => {
+	if (!isRecord$1(value)) return null;
+	const { id, attributes } = value;
+	if (typeof id !== "string") return null;
+	const attrs = isRecord$1(attributes) ? attributes : {};
+	return {
+		id,
+		bundleId: typeof attrs["bundleId"] === "string" ? attrs["bundleId"] : null,
+		name: typeof attrs["name"] === "string" ? attrs["name"] : null
+	};
+};
+const toAscBuild = (value) => {
+	if (!isRecord$1(value)) return null;
+	const { id, attributes } = value;
+	if (typeof id !== "string") return null;
+	const attrs = isRecord$1(attributes) ? attributes : {};
+	return {
+		id,
+		version: typeof attrs["version"] === "string" ? attrs["version"] : null,
+		uploadedDate: typeof attrs["uploadedDate"] === "string" ? attrs["uploadedDate"] : null,
+		processingState: typeof attrs["processingState"] === "string" ? attrs["processingState"] : null
+	};
+};
+const toAscBetaGroup = (value) => {
+	if (!isRecord$1(value)) return null;
+	const { id, attributes } = value;
+	if (typeof id !== "string" || !isRecord$1(attributes)) return null;
+	const { name, isInternalGroup } = attributes;
+	if (typeof name !== "string") return null;
+	return {
+		id,
+		name,
+		isInternal: isInternalGroup === true
+	};
+};
+const toAscBetaBuildLocalization = (value) => {
+	if (!isRecord$1(value)) return null;
+	const { id, attributes } = value;
+	if (typeof id !== "string" || !isRecord$1(attributes)) return null;
+	const { locale, whatsNew } = attributes;
+	if (typeof locale !== "string") return null;
+	return {
+		id,
+		locale,
+		whatsNew: typeof whatsNew === "string" ? whatsNew : null
+	};
+};
+/** Classify a raw `processingState`. Unknown/absent states stay `processing`
+* so the poller keeps waiting rather than failing early. */
+const classifyProcessingState = (state) => {
+	if (state === "VALID") return "valid";
+	if (state === "FAILED" || state === "INVALID") return "failed";
+	return "processing";
+};
+/**
+* Identify the build produced by *our* upload. `listRecentBuilds` returns builds
+* newest-first; the freshly-uploaded build is the newest one whose id differs
+* from the baseline captured before upload. Comparing ids (not timestamps) avoids
+* both clock-skew misses and accidentally matching a pre-existing build.
+*/
+const pickNewBuild = (builds, baselineLatestBuildId) => {
+	const [newest] = builds;
+	if (newest === void 0 || newest.id === baselineLatestBuildId) return null;
+	return newest;
+};
+const matchBetaGroupsByName = (groups, names) => {
+	const byName = new Map(groups.map((group) => [group.name, group]));
+	const matched = [];
+	const missing = [];
+	for (const name of names) {
+		const group = byName.get(name);
+		if (group === void 0) missing.push(name);
+		else matched.push(group);
+	}
+	return {
+		matched,
+		missing
+	};
+};
+/** Resolve the ASC app record for a bundle identifier, or null when none exists. */
+const getAppByBundleId = (credentials, bundleId) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	const [first] = extractList(yield* fetchRaw(jwt, `/v1/apps?filter[bundleId]=${encodeURIComponent(bundleId)}&limit=1`), toAscApp);
+	return first === void 0 ? null : first;
+}));
+/** Builds for an app, newest upload first. */
+const listRecentBuilds = (credentials, appId, limit = 20) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	return extractList(yield* fetchRaw(jwt, `/v1/builds?filter[app]=${encodeURIComponent(appId)}&sort=-uploadedDate&limit=${String(limit)}`), toAscBuild);
+}));
+const listBetaGroups = (credentials, appId) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	const groups = [];
+	let path = `/v1/betaGroups?filter[app]=${encodeURIComponent(appId)}&limit=200`;
+	while (path !== null) {
+		const body = yield* fetchRaw(jwt, path);
+		groups.push(...extractList(body, toAscBetaGroup));
+		path = nextPagePath(body);
+	}
+	return groups;
+}));
+const listBuildBetaLocalizations = (credentials, buildId) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	return extractList(yield* fetchRaw(jwt, `/v1/builds/${encodeURIComponent(buildId)}/betaBuildLocalizations?limit=200`), toAscBetaBuildLocalization);
+}));
+const createBetaBuildLocalization = (credentials, params) => withJwt(credentials, (jwt) => Effect.asVoid(fetchRaw(jwt, "/v1/betaBuildLocalizations", {
+	method: "POST",
+	body: JSON.stringify({ data: {
+		type: "betaBuildLocalizations",
+		attributes: {
+			locale: params.locale,
+			whatsNew: params.whatsNew
+		},
+		relationships: { build: { data: {
+			type: "builds",
+			id: params.buildId
+		} } }
+	} })
+})));
+const updateBetaBuildLocalization = (credentials, params) => withJwt(credentials, (jwt) => Effect.asVoid(fetchRaw(jwt, `/v1/betaBuildLocalizations/${encodeURIComponent(params.id)}`, {
+	method: "PATCH",
+	body: JSON.stringify({ data: {
+		type: "betaBuildLocalizations",
+		id: params.id,
+		attributes: { whatsNew: params.whatsNew }
+	} })
+})));
+const addBuildToBetaGroups = (credentials, buildId, groupIds) => withJwt(credentials, (jwt) => Effect.asVoid(fetchRaw(jwt, `/v1/builds/${encodeURIComponent(buildId)}/relationships/betaGroups`, {
+	method: "POST",
+	body: JSON.stringify({ data: groupIds.map((id) => ({
+		type: "betaGroups",
+		id
+	})) })
+})));
+
+//#endregion
+//#region src/application/ios-testflight-config.ts
+/**
+* Post-upload TestFlight configuration for iOS submissions. After `altool`
+* uploads the `.ipa`, App Store Connect spends several minutes *processing* the
+* binary before it can be configured. This module waits for that processing to
+* finish, then sets the build's "What to Test" text and assigns it to internal
+* TestFlight groups — the same follow-up `eas submit` performs server-side.
+*
+* Auth reuses the ASC **API key** already decrypted for the upload (no second
+* credential prompt). Failures surface as {@link TestFlightConfigError} so the
+* caller can mark the submission ERRORED with a precise reason.
+*/
+var TestFlightConfigError = class extends Data.TaggedError("TestFlightConfigError") {};
+const DEFAULT_POLL_TIMEOUT_MS = 15 * 6e4;
+const DEFAULT_POLL_INTERVAL_MS = 3e4;
+const DEFAULT_LOCALE = "en-US";
+const ascErrorMessage$1 = (error) => {
+	if (error._tag === "AscApiError") return `App Store Connect API error ${String(error.status)}: ${error.message}`;
+	if (error._tag === "AscNetworkError") return `App Store Connect network error: ${String(error.cause)}`;
+	return `App Store Connect auth error: ${String(error.cause)}`;
+};
+const wrapAsc = (code) => (error) => new TestFlightConfigError({
+	code,
+	message: ascErrorMessage$1(error)
+});
+/**
+* Resolve the ASC app id (preferring the explicit `ascAppId`) and snapshot the
+* latest existing build. Run this *before* `altool` so the freshly-uploaded
+* build can be distinguished from prior ones.
+*/
+const captureTestFlightContext = (params) => Effect.gen(function* () {
+	const appId = params.ascAppId ?? (yield* Effect.gen(function* () {
+		const app = yield* getAppByBundleId(params.credentials, params.bundleIdentifier).pipe(Effect.mapError(wrapAsc("TESTFLIGHT_APP_LOOKUP_FAILED")));
+		if (app === null) return yield* new TestFlightConfigError({
+			code: "TESTFLIGHT_APP_NOT_FOUND",
+			message: `No App Store Connect app found for bundle id ${params.bundleIdentifier}. Set ascAppId in the eas.json submit profile.`
 		});
-		const text = await response.text();
-		return {
-			ok: response.ok,
-			status: response.status,
-			text
-		};
-	},
-	catch: (cause) => new GooglePlayApiError({
-		message: "edits.bundles.upload request failed",
-		cause
-	})
+		return app.id;
+	}));
+	return {
+		appId,
+		baselineLatestBuildId: toDbNull((yield* listRecentBuilds(params.credentials, appId, 1).pipe(Effect.mapError(wrapAsc("TESTFLIGHT_LIST_BUILDS_FAILED"))))[0]?.id)
+	};
 });
-const uploadBundle = (params) => Effect.gen(function* () {
-	const result = yield* performBundleUpload(params);
-	if (!result.ok) return yield* new GooglePlayApiError({
-		message: `edits.bundles.upload failed: ${String(result.status)} ${result.text}`,
-		httpStatus: result.status
-	});
-	const raw = yield* Effect.try({
-		try: () => JSON.parse(result.text),
-		catch: (cause) => new GooglePlayApiError({
-			message: "edits.bundles.upload response is not JSON",
-			cause
+const pollForProcessedBuild = (params) => Effect.gen(function* () {
+	const deadline = Date.now() + params.pollTimeoutMs;
+	const final = yield* Effect.iterate({
+		build: null,
+		attempt: 0
+	}, {
+		while: (state) => state.build === null,
+		body: (state) => Effect.gen(function* () {
+			if (state.attempt > 0) yield* Effect.sleep(Duration.millis(params.pollIntervalMs));
+			const candidate = pickNewBuild(yield* listRecentBuilds(params.credentials, params.context.appId, 20).pipe(Effect.mapError(wrapAsc("TESTFLIGHT_LIST_BUILDS_FAILED"))), params.context.baselineLatestBuildId);
+			if (candidate !== null) {
+				const processing = classifyProcessingState(candidate.processingState);
+				if (processing === "failed") return yield* new TestFlightConfigError({
+					code: "TESTFLIGHT_BUILD_PROCESSING_FAILED",
+					message: `App Store Connect rejected build ${candidate.version ?? candidate.id} during processing (state ${candidate.processingState ?? "unknown"}).`
+				});
+				if (processing === "valid") return {
+					build: candidate,
+					attempt: state.attempt + 1
+				};
+			}
+			if (Date.now() > deadline) return yield* new TestFlightConfigError({
+				code: "TESTFLIGHT_BUILD_PROCESSING_TIMEOUT",
+				message: `Timed out after ${String(Math.round(params.pollTimeoutMs / 6e4))} min waiting for the uploaded build to finish processing on App Store Connect. The binary uploaded successfully — re-run the TestFlight configuration later.`
+			});
+			yield* printHuman(candidate === null ? "Waiting for the uploaded build to appear on App Store Connect..." : "Build is processing on App Store Connect...");
+			return {
+				build: null,
+				attempt: state.attempt + 1
+			};
 		})
 	});
-	return yield* Schema.decodeUnknown(UploadedBundleSchema)(raw).pipe(Effect.mapError((cause) => new GooglePlayApiError({
-		message: "Bundle upload response missing versionCode",
-		cause
-	})));
-});
-const updateTrack = (params) => {
-	const release = {
-		status: params.releaseStatus,
-		versionCodes: [String(params.versionCode)],
-		...compact({
-			userFraction: toOptional(params.rollout),
-			releaseNotes: params.releaseNotes ? [{
-				language: "en-US",
-				text: params.releaseNotes
-			}] : void 0
-		})
+	if (final.build === null) return yield* new TestFlightConfigError({
+		code: "TESTFLIGHT_BUILD_NOT_FOUND",
+		message: "Could not locate the uploaded build on App Store Connect."
+	});
+	return final.build;
+});
+const applyWhatToTest = (params) => Effect.gen(function* () {
+	const existing = (yield* listBuildBetaLocalizations(params.credentials, params.buildId).pipe(Effect.mapError(wrapAsc("TESTFLIGHT_LIST_LOCALIZATIONS_FAILED")))).find((loc) => loc.locale === params.locale);
+	yield* (existing === void 0 ? createBetaBuildLocalization(params.credentials, {
+		buildId: params.buildId,
+		locale: params.locale,
+		whatsNew: params.whatToTest
+	}) : updateBetaBuildLocalization(params.credentials, {
+		id: existing.id,
+		whatsNew: params.whatToTest
+	})).pipe(Effect.mapError(wrapAsc("TESTFLIGHT_SET_WHAT_TO_TEST_FAILED")));
+});
+const applyGroups = (params) => Effect.gen(function* () {
+	const allGroups = yield* listBetaGroups(params.credentials, params.appId).pipe(Effect.mapError(wrapAsc("TESTFLIGHT_LIST_GROUPS_FAILED")));
+	const { matched, missing } = matchBetaGroupsByName(allGroups, params.groups);
+	if (missing.length > 0) {
+		const available = allGroups.map((group) => group.name).join(", ") || "(none)";
+		return yield* new TestFlightConfigError({
+			code: "TESTFLIGHT_GROUP_NOT_FOUND",
+			message: `TestFlight group(s) not found: ${missing.join(", ")}. Available groups: ${available}.`
+		});
+	}
+	yield* addBuildToBetaGroups(params.credentials, params.buildId, matched.map((group) => group.id)).pipe(Effect.mapError(wrapAsc("TESTFLIGHT_ADD_TO_GROUPS_FAILED")));
+});
+/** Whether a profile has any TestFlight config that warrants the processing wait. */
+const needsTestFlightConfig = (params) => params.whatToTest !== void 0 || params.groups.length > 0;
+const applyTestFlightConfig = (inputs) => Effect.gen(function* () {
+	yield* printHuman("Configuring TestFlight (waiting for build processing)...");
+	const build = yield* pollForProcessedBuild({
+		credentials: inputs.credentials,
+		context: inputs.context,
+		pollTimeoutMs: inputs.pollTimeoutMs ?? DEFAULT_POLL_TIMEOUT_MS,
+		pollIntervalMs: inputs.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS
+	});
+	if (inputs.whatToTest !== void 0) {
+		yield* applyWhatToTest({
+			credentials: inputs.credentials,
+			buildId: build.id,
+			locale: inputs.language ?? DEFAULT_LOCALE,
+			whatToTest: inputs.whatToTest
+		});
+		yield* printHuman(`Set "What to Test" on build ${build.version ?? build.id}.`);
+	}
+	if (inputs.groups.length > 0) {
+		yield* applyGroups({
+			credentials: inputs.credentials,
+			appId: inputs.context.appId,
+			buildId: build.id,
+			groups: inputs.groups
+		});
+		yield* printHuman(`Assigned build to TestFlight group(s): ${inputs.groups.join(", ")}.`);
+	}
+	return {
+		buildId: build.id,
+		buildVersion: build.version
 	};
-	return callJsonRaw({
-		url: `${ANDROID_PUBLISHER_BASE}/androidpublisher/v3/applications/${encodeURIComponent(params.packageName)}/edits/${encodeURIComponent(params.editId)}/tracks/${encodeURIComponent(params.track)}`,
-		method: "PUT",
-		accessToken: params.accessToken,
-		body: {
-			track: params.track,
-			releases: [release]
-		},
-		label: "edits.tracks.update"
-	});
-};
-const commitEdit = (params) => callJsonRaw({
-	url: `${ANDROID_PUBLISHER_BASE}/androidpublisher/v3/applications/${encodeURIComponent(params.packageName)}/edits/${encodeURIComponent(params.editId)}:commit?changesNotSentForReview=${String(params.changesNotSentForReview)}`,
-	method: "POST",
-	accessToken: params.accessToken,
-	label: "edits.commit"
 });
 
 //#endregion
@@ -20495,65 +21092,15 @@ const pollSubmissionUntilTerminal = (api, submissionId, pollIntervalMs = 5e3) =>
 	code: "SUBMISSION_POLL_NO_RESULT",
 	message: "Polling completed without producing a submission"
 })) : Effect.succeed(final)));
-const writeAscApiKeyP8 = (api, ascApiKeyId) => Effect.gen(function* () {
-	const creds = yield* fetchAscCredentials(api, ascApiKeyId).pipe(Effect.mapError(() => new CliSubmitError({
-		code: "SUBMISSION_ASC_KEY_FETCH_FAILED",
-		message: `Failed to fetch or decrypt ASC API key ${ascApiKeyId}`
-	})));
-	const target = path.join(tmpdir(), `better-update-submit-AuthKey_${creds.keyId}.p8`);
-	yield* Effect.promise(async () => writeFile(target, creds.p8Pem, "utf8"));
-	return {
-		p8Path: target,
-		keyId: creds.keyId,
-		issuerId: creds.issuerId
-	};
-});
-const runIosAltoolUpload = (inputs) => Effect.gen(function* () {
-	const creds = yield* writeAscApiKeyP8(inputs.api, inputs.ascApiKeyId);
-	const apiKeyDir = path.dirname(creds.p8Path);
-	yield* inputs.api.submissions.updateStatus({
-		path: { id: inputs.submissionId },
-		payload: { status: "IN_PROGRESS" }
-	}).pipe(Effect.mapError(() => new CliSubmitError({
-		code: "SUBMISSION_PATCH_FAILED",
-		message: "Failed to PATCH submission status to IN_PROGRESS"
-	})));
-	const result = yield* runAltool([
-		"--upload-app",
-		"--type",
-		"ios",
-		"--apiKey",
-		creds.keyId,
-		"--apiIssuer",
-		creds.issuerId,
-		"--apiKeyDir",
-		apiKeyDir,
-		"--file",
-		inputs.ipaPath,
-		"--output-format",
-		"xml"
-	]);
-	const terminalStatus = result.exitCode === 0 ? "FINISHED" : "ERRORED";
-	const errorMessage = result.exitCode === 0 ? null : `xcrun altool exited ${String(result.exitCode)}: ${result.stderr}`;
-	yield* inputs.api.submissions.updateStatus({
-		path: { id: inputs.submissionId },
-		payload: {
-			status: terminalStatus,
-			...errorMessage ? {
-				errorCode: "SUBMISSION_SERVICE_IOS_ALTOOL_FAILED",
-				errorMessage
-			} : {}
-		}
-	}).pipe(Effect.mapError(() => new CliSubmitError({
-		code: "SUBMISSION_PATCH_FAILED",
-		message: "Failed to PATCH submission terminal status"
-	})));
-	return {
-		status: terminalStatus,
-		stdout: result.stdout,
-		stderr: result.stderr
-	};
-});
+const patchSubmissionStatus = (api, submissionId, payload) => api.submissions.updateStatus({
+	path: { id: submissionId },
+	payload
+}).pipe(Effect.mapError(() => new CliSubmitError({
+	code: "SUBMISSION_PATCH_FAILED",
+	message: `Failed to PATCH submission status to ${payload.status}`
+})));
+/** A local `path` archive may be given as a plain path or a `file://` URL. */
+const localPathFromArchiveValue = (value) => value.startsWith("file://") ? fileURLToPath(value) : value;
 const readLocalFile = (filePath, errorCode, errorMessageFmt) => Effect.tryPromise({
 	try: async () => readFile(filePath),
 	catch: (cause) => new CliSubmitError({
@@ -20574,7 +21121,7 @@ const fetchArchiveOverHttp = (url) => Effect.gen(function* () {
 		},
 		catch: (cause) => new CliSubmitError({
 			code: "SUBMISSION_ARCHIVE_DOWNLOAD_FAILED",
-			message: `Failed to download AAB from ${url}: ${cause instanceof Error ? cause.message : String(cause)}`
+			message: `Failed to download archive from ${url}: ${cause instanceof Error ? cause.message : String(cause)}`
 		})
 	});
 	if (!result.ok || result.bytes === null) return yield* new CliSubmitError({
@@ -20583,7 +21130,153 @@ const fetchArchiveOverHttp = (url) => Effect.gen(function* () {
 	});
 	return result.bytes;
 });
-const readArchiveBytes = (archive) => archive.source === "path" ? Effect.map(readLocalFile(archive.value, "SUBMISSION_ARCHIVE_READ_FAILED", (cause) => `Failed to read AAB at ${archive.value}: ${cause instanceof Error ? cause.message : String(cause)}`), (buf) => new Uint8Array(buf)) : fetchArchiveOverHttp(archive.value);
+const readArchiveBytes = (archive) => archive.source === "path" ? Effect.map(readLocalFile(localPathFromArchiveValue(archive.value), "SUBMISSION_ARCHIVE_READ_FAILED", (cause) => `Failed to read archive at ${archive.value}: ${cause instanceof Error ? cause.message : String(cause)}`), (buf) => new Uint8Array(buf)) : fetchArchiveOverHttp(archive.value);
+const downloadArchiveToTempFile = (url, extension) => Effect.gen(function* () {
+	const bytes = yield* fetchArchiveOverHttp(url);
+	const target = path.join(tmpdir(), `better-update-submit-${crypto.randomUUID()}${extension}`);
+	yield* Effect.tryPromise({
+		try: async () => writeFile(target, bytes),
+		catch: (cause) => new CliSubmitError({
+			code: "SUBMISSION_ARCHIVE_WRITE_FAILED",
+			message: `Failed to stage archive to ${target}: ${cause instanceof Error ? cause.message : String(cause)}`
+		})
+	});
+	return target;
+});
+/**
+* Resolve an archive to a **local file path** on disk, downloading remote
+* (`build`/`url`) sources first. Store upload tools (`altool`) require a path
+* they can open — handing them an https URL fails.
+*/
+const resolveLocalArchivePath = (archive, extension) => archive.source === "path" ? Effect.succeed(localPathFromArchiveValue(archive.value)) : downloadArchiveToTempFile(archive.value, extension);
+/** EAS-compatible env var carrying the Apple ID app-specific password. */
+const APPLE_APP_SPECIFIC_PASSWORD_ENV = "EXPO_APPLE_APP_SPECIFIC_PASSWORD";
+const hasAppleAppSpecificPassword = () => {
+	const value = process.env[APPLE_APP_SPECIFIC_PASSWORD_ENV];
+	return value !== void 0 && value !== "";
+};
+/**
+* Resolve the upload auth, matching `eas submit` precedence: an app-specific
+* password (env var + `appleId`) wins when usable; otherwise fall back to the
+* ASC API key. Returns null when neither is configured.
+*/
+const resolveIosUploadAuth = (params) => {
+	if (params.hasAppSpecificPassword && params.appleId !== void 0) return {
+		kind: "app-specific-password",
+		appleId: params.appleId
+	};
+	if (params.ascApiKeyId !== void 0) return {
+		kind: "asc-api-key",
+		ascApiKeyId: params.ascApiKeyId
+	};
+	return null;
+};
+const resolveAscCredentials = (api, ascApiKeyId) => fetchAscCredentials(api, ascApiKeyId).pipe(Effect.mapError(() => new CliSubmitError({
+	code: "SUBMISSION_ASC_KEY_FETCH_FAILED",
+	message: `Failed to fetch or decrypt ASC API key ${ascApiKeyId}`
+})));
+/** `altool` reads the API key from `--apiKeyDir`; write the decrypted `.p8` there. */
+const writeP8ForAltool = (credentials) => Effect.gen(function* () {
+	const target = path.join(tmpdir(), `better-update-submit-AuthKey_${credentials.keyId}.p8`);
+	yield* Effect.promise(async () => writeFile(target, credentials.p8Pem, "utf8"));
+	return target;
+});
+const baseAltoolArgs = (ipaPath) => [
+	"--upload-app",
+	"--type",
+	"ios",
+	"--file",
+	ipaPath,
+	"--output-format",
+	"xml"
+];
+/** Build `altool` args for the chosen auth. The app-specific password is passed
+* as `@env:` so it never enters argv; `altool` reads it from the inherited env. */
+const buildAltoolArgs = (params) => Effect.gen(function* () {
+	if (params.auth.kind === "app-specific-password") return [
+		...baseAltoolArgs(params.ipaPath),
+		"--username",
+		params.auth.appleId,
+		"--password",
+		`@env:${APPLE_APP_SPECIFIC_PASSWORD_ENV}`
+	];
+	if (params.ascCredentials === null) return yield* new CliSubmitError({
+		code: "SUBMISSION_ASC_KEY_FETCH_FAILED",
+		message: "ASC API key is required for an asc-api-key upload but was not resolved."
+	});
+	const p8Path = yield* writeP8ForAltool(params.ascCredentials);
+	return [
+		...baseAltoolArgs(params.ipaPath),
+		"--apiKey",
+		params.ascCredentials.keyId,
+		"--apiIssuer",
+		params.ascCredentials.issuerId,
+		"--apiKeyDir",
+		path.dirname(p8Path)
+	];
+});
+const runIosSubmit = (inputs) => Effect.gen(function* () {
+	const wantsConfig = needsTestFlightConfig({
+		whatToTest: inputs.config.whatToTest,
+		groups: inputs.config.groups
+	});
+	const credsKeyId = inputs.auth.kind === "asc-api-key" ? inputs.auth.ascApiKeyId : inputs.ascApiKeyId;
+	const ascCredentials = (inputs.auth.kind === "asc-api-key" || wantsConfig) && credsKeyId !== void 0 ? yield* resolveAscCredentials(inputs.api, credsKeyId) : null;
+	const ipaPath = yield* resolveLocalArchivePath(inputs.archive, ".ipa");
+	let tfContext = null;
+	if (wantsConfig && ascCredentials !== null) tfContext = yield* captureTestFlightContext({
+		credentials: ascCredentials,
+		ascAppId: inputs.config.ascAppId,
+		bundleIdentifier: inputs.config.bundleIdentifier
+	}).pipe(Effect.mapError((error) => new CliSubmitError({
+		code: error.code,
+		message: error.message
+	})));
+	else if (wantsConfig) yield* printHuman("Note: \"What to Test\" and TestFlight groups require an ASC API key (ascApiKeyId) — skipping that step for the app-specific-password upload.");
+	const altoolArgs = yield* buildAltoolArgs({
+		auth: inputs.auth,
+		ascCredentials,
+		ipaPath
+	});
+	yield* patchSubmissionStatus(inputs.api, inputs.submissionId, { status: "IN_PROGRESS" });
+	const result = yield* runAltool(altoolArgs);
+	if (result.exitCode !== 0) {
+		yield* patchSubmissionStatus(inputs.api, inputs.submissionId, {
+			status: "ERRORED",
+			errorCode: "SUBMISSION_SERVICE_IOS_ALTOOL_FAILED",
+			errorMessage: `xcrun altool exited ${String(result.exitCode)}: ${result.stderr}`
+		});
+		return { status: "ERRORED" };
+	}
+	yield* printHuman("altool upload complete.");
+	if (tfContext !== null && ascCredentials !== null) yield* applyTestFlightConfig({
+		credentials: ascCredentials,
+		context: tfContext,
+		language: inputs.config.language,
+		whatToTest: inputs.config.whatToTest,
+		groups: inputs.config.groups
+	}).pipe(Effect.catchTag("TestFlightConfigError", (configError) => Effect.gen(function* () {
+		yield* patchSubmissionStatus(inputs.api, inputs.submissionId, {
+			status: "ERRORED",
+			errorCode: configError.code,
+			errorMessage: configError.message
+		});
+		return yield* new CliSubmitError({
+			code: configError.code,
+			message: configError.message
+		});
+	})));
+	yield* patchSubmissionStatus(inputs.api, inputs.submissionId, { status: "FINISHED" });
+	return { status: "FINISHED" };
+});
+
+//#endregion
+//#region src/application/android-play-submit.ts
+/**
+* Client-side Google Play submission: decrypt the service account key, then run
+* the Play Developer API edit pipeline (insert → upload bundle → assign track →
+* commit) — the same steps `eas submit` performs server-side.
+*/
 const fetchServiceAccountKeyById = (api, id) => Effect.gen(function* () {
 	const data = yield* api.googleServiceAccountKeys.download({ path: { id } }).pipe(Effect.mapError(() => new CliSubmitError({
 		code: "SUBMISSION_ANDROID_SA_KEY_FETCH_FAILED",
@@ -20606,25 +21299,35 @@ const fetchServiceAccountKeyById = (api, id) => Effect.gen(function* () {
 	});
 	return json;
 });
+const readServiceAccountFile = (filePath) => Effect.tryPromise({
+	try: async () => new TextDecoder().decode(await readFile(filePath)),
+	catch: (cause) => new CliSubmitError({
+		code: "SUBMISSION_ANDROID_SA_KEY_LOCAL_READ_FAILED",
+		message: `Failed to read service account JSON at ${filePath}: ${cause instanceof Error ? cause.message : String(cause)}`
+	})
+});
 const resolveServiceAccountJson = (params) => {
 	if (params.serviceAccountKeyId !== void 0) return fetchServiceAccountKeyById(params.api, params.serviceAccountKeyId);
-	if (params.serviceAccountKeyPath !== void 0) return Effect.map(readLocalFile(params.serviceAccountKeyPath, "SUBMISSION_ANDROID_SA_KEY_LOCAL_READ_FAILED", (cause) => `Failed to read service account JSON at ${String(params.serviceAccountKeyPath)}: ${cause instanceof Error ? cause.message : String(cause)}`), (buf) => new TextDecoder().decode(buf));
+	if (params.serviceAccountKeyPath !== void 0) return readServiceAccountFile(params.serviceAccountKeyPath);
 	return Effect.fail(new CliSubmitError({
 		code: "SUBMISSION_ANDROID_SA_KEY_MISSING",
 		message: "Android submission requires a service account key. Pass --service-account-key-id <id>, set serviceAccountKeyId in eas.json submit profile, or set serviceAccountKeyPath to a local JSON file."
 	}));
 };
-const patchSubmissionStatus = (api, submissionId, payload) => api.submissions.updateStatus({
-	path: { id: submissionId },
-	payload
-}).pipe(Effect.mapError(() => new CliSubmitError({
-	code: "SUBMISSION_PATCH_FAILED",
-	message: `Failed to PATCH submission status to ${payload.status}`
-})));
 const wrapGooglePlayError = (label) => (cause) => new CliSubmitError({
 	code: `SUBMISSION_ANDROID_${label}`,
 	message: cause.message
 });
+/**
+* EAS/Google Play rule: a staged rollout fraction is required for — and only
+* valid with — releaseStatus `inProgress`. Returns an error message, or null
+* when the combination is valid.
+*/
+const androidRolloutError = (releaseStatus, rollout) => {
+	if (releaseStatus === "inProgress" && rollout === null) return "rollout is required when releaseStatus is 'inProgress' — set submit.<profile>.android.rollout to a 0–1 fraction.";
+	if (releaseStatus !== "inProgress" && rollout !== null) return `rollout is only allowed when releaseStatus is 'inProgress', not '${releaseStatus}'.`;
+	return null;
+};
 const runGooglePlayPipeline = (params) => Effect.gen(function* () {
 	const edit = yield* insertEdit({
 		accessToken: params.accessToken,
@@ -20659,6 +21362,20 @@ const runAndroidGooglePlayUpload = (inputs) => Effect.gen(function* () {
 		code: "SUBMISSION_ANDROID_APP_ID_MISSING",
 		message: "Android submit profile requires applicationId — set submit.<profile>.android.applicationId in eas.json"
 	});
+	const releaseStatus = inputs.androidProfile.releaseStatus ?? "completed";
+	const rollout = toDbNull(inputs.androidProfile.rollout);
+	const rolloutError = androidRolloutError(releaseStatus, rollout);
+	if (rolloutError !== null) {
+		yield* patchSubmissionStatus(inputs.api, inputs.submissionId, {
+			status: "ERRORED",
+			errorCode: "SUBMISSION_ANDROID_ROLLOUT_INVALID",
+			errorMessage: rolloutError
+		});
+		return yield* new CliSubmitError({
+			code: "SUBMISSION_ANDROID_ROLLOUT_INVALID",
+			message: rolloutError
+		});
+	}
 	const serviceAccountJson = yield* resolveServiceAccountJson({
 		api: inputs.api,
 		serviceAccountKeyId: inputs.serviceAccountKeyId,
@@ -20673,9 +21390,9 @@ const runAndroidGooglePlayUpload = (inputs) => Effect.gen(function* () {
 			applicationId,
 			aab,
 			track: inputs.androidProfile.track ?? "internal",
-			releaseStatus: inputs.androidProfile.releaseStatus ?? "completed",
+			releaseStatus,
 			changesNotSentForReview: inputs.androidProfile.changesNotSentForReview ?? false,
-			rollout: toDbNull(inputs.androidProfile.rollout)
+			rollout
 		});
 	}).pipe(Effect.catchTag("CliSubmitError", (engineError) => Effect.gen(function* () {
 		yield* patchSubmissionStatus(inputs.api, inputs.submissionId, {
@@ -20737,13 +21454,45 @@ const runAutoSubmit = (input) => Effect.gen(function* () {
 		})
 	});
 	yield* printHuman(`Submission created: ${submission.id} (${submission.status})`);
-	if (input.platform === "ios" && easProfile.ios?.ascApiKeyId !== void 0) {
-		yield* printHuman("Running xcrun altool upload...");
-		yield* runIosAltoolUpload({
+	if (input.platform === "ios" && iosConfig !== void 0) {
+		const auth = resolveIosUploadAuth({
+			appleId: easProfile.ios?.appleId,
+			ascApiKeyId: easProfile.ios?.ascApiKeyId,
+			hasAppSpecificPassword: hasAppleAppSpecificPassword()
+		});
+		if (auth === null) yield* printHuman("Skipping iOS upload: configure ascApiKeyId or set EXPO_APPLE_APP_SPECIFIC_PASSWORD (+ appleId).");
+		else {
+			yield* printHuman(auth.kind === "app-specific-password" ? "Running xcrun altool upload (Apple ID app-specific password)..." : "Running xcrun altool upload (ASC API key)...");
+			yield* runIosSubmit({
+				api: input.api,
+				submissionId: submission.id,
+				archive: {
+					source: "build",
+					value: archiveUrl
+				},
+				auth,
+				ascApiKeyId: easProfile.ios?.ascApiKeyId,
+				config: {
+					bundleIdentifier: iosConfig.bundleIdentifier,
+					ascAppId: easProfile.ios?.ascAppId,
+					language: easProfile.ios?.language,
+					whatToTest: input.whatToTest,
+					groups: easProfile.ios?.groups ?? []
+				}
+			});
+		}
+	}
+	if (input.platform === "android" && androidConfig !== void 0 && easProfile.android !== void 0) {
+		yield* printHuman("Uploading bundle to Google Play...");
+		yield* runAndroidGooglePlayUpload({
 			api: input.api,
 			submissionId: submission.id,
-			ipaPath: archiveUrl,
-			ascApiKeyId: easProfile.ios.ascApiKeyId
+			archive: {
+				source: "build",
+				value: archiveUrl
+			},
+			androidProfile: easProfile.android,
+			serviceAccountKeyId: easProfile.android.serviceAccountKeyId
 		});
 	}
 	yield* printHuman(`Submission final status: ${(yield* pollSubmissionUntilTerminal(input.api, submission.id)).status}`);
@@ -20914,313 +21663,6 @@ const generateAndroidKeystore = (input) => Command.exitCode(Command.make("keytoo
 	message: `generate android keystore exited with code ${code}`
 }))));
 
-//#endregion
-//#region src/lib/apple-pem.ts
-const PEM_HEADER = "-----BEGIN PRIVATE KEY-----";
-const PEM_FOOTER = "-----END PRIVATE KEY-----";
-const pemToPkcs8Der = (pem) => {
-	const normalized = pem.replaceAll("\r\n", "\n").trim();
-	const start = normalized.indexOf(PEM_HEADER);
-	const end = normalized.indexOf(PEM_FOOTER);
-	if (start === -1 || end === -1 || end <= start) return null;
-	const body = normalized.slice(start + 27, end).replaceAll(/\s+/gu, "").trim();
-	if (body.length === 0) return null;
-	try {
-		return fromBase64(body);
-	} catch {
-		return null;
-	}
-};
-
-//#endregion
-//#region src/lib/apple-asc-jwt.ts
-var AppleAuthError = class extends Data.TaggedError("AppleAuthError") {};
-const MAX_JWT_LIFETIME_SECONDS = 1200;
-const asArrayBuffer = (bytes) => {
-	const buffer = new ArrayBuffer(bytes.byteLength);
-	new Uint8Array(buffer).set(bytes);
-	return buffer;
-};
-const signAscJwt = (credentials) => Effect.gen(function* () {
-	const der = pemToPkcs8Der(credentials.p8Pem);
-	if (der === null) return yield* new AppleAuthError({ cause: /* @__PURE__ */ new Error("Invalid .p8 PEM") });
-	const header = {
-		alg: "ES256",
-		kid: credentials.keyId,
-		typ: "JWT"
-	};
-	const now = Math.floor(Date.now() / 1e3);
-	const payload = {
-		iss: credentials.issuerId,
-		iat: now,
-		exp: now + MAX_JWT_LIFETIME_SECONDS,
-		aud: "appstoreconnect-v1"
-	};
-	const signingInput = `${toBase64Url(new TextEncoder().encode(JSON.stringify(header)))}.${toBase64Url(new TextEncoder().encode(JSON.stringify(payload)))}`;
-	const key = yield* Effect.tryPromise({
-		try: async () => crypto.subtle.importKey("pkcs8", asArrayBuffer(der), {
-			name: "ECDSA",
-			namedCurve: "P-256"
-		}, false, ["sign"]),
-		catch: (cause) => new AppleAuthError({ cause })
-	});
-	const signature = yield* Effect.tryPromise({
-		try: async () => crypto.subtle.sign({
-			name: "ECDSA",
-			hash: "SHA-256"
-		}, key, new TextEncoder().encode(signingInput)),
-		catch: (cause) => new AppleAuthError({ cause })
-	});
-	return `${signingInput}.${toBase64Url(new Uint8Array(signature))}`;
-});
-
-//#endregion
-//#region src/lib/apple-asc-client.ts
-/**
-* App Store Connect REST client authenticated with an ASC **API key** — a JWT
-* signed from a `.p8` private key (see `apple-asc-jwt.ts`). Credentials are
-* resolved non-interactively from the server (`fetchAscCredentials`), so this
-* powers headless flows: build-credential resolution, provisioning-profile
-* generation, and device sync.
-*
-* Intentionally NOT built on `@expo/apple-utils`: that library authenticates
-* via an interactive Apple-ID **cookie session** (username/password + 2FA, see
-* `services/apple-auth.ts`) and exposes a cookie-based `RequestContext`. That is
-* a different auth model that would force an interactive login here. The two
-* coexist by design — apple-utils backs `apple login`; this client backs
-* non-interactive ASC API-key access.
-*/
-var AscApiError = class extends Data.TaggedError("AscApiError") {};
-var AscNetworkError = class extends Data.TaggedError("AscNetworkError") {};
-const API_BASE = "https://api.appstoreconnect.apple.com";
-const extractErrors = (body) => {
-	if (!isRecord$1(body) || !Array.isArray(body["errors"])) return [];
-	return body["errors"].filter((value) => isRecord$1(value));
-};
-const parseApiError = (response, body, raw) => {
-	const [first] = extractErrors(body);
-	return new AscApiError({
-		status: response.status,
-		message: first?.detail ?? first?.title ?? response.statusText,
-		code: first?.code,
-		raw
-	});
-};
-const fetchRaw = (jwt, path, init) => Effect.gen(function* () {
-	const response = yield* Effect.tryPromise({
-		try: async () => fetch(`${API_BASE}${path}`, compact({
-			method: init?.method ?? "GET",
-			body: init?.body,
-			headers: {
-				authorization: `Bearer ${jwt}`,
-				"content-type": "application/json",
-				accept: "application/json"
-			}
-		})),
-		catch: (cause) => new AscNetworkError({ cause })
-	});
-	const text = yield* Effect.tryPromise({
-		try: async () => response.text(),
-		catch: (cause) => new AscNetworkError({ cause })
-	});
-	const body = yield* Effect.try({
-		try: () => text.length === 0 ? {} : JSON.parse(text),
-		catch: (cause) => new AscNetworkError({ cause })
-	});
-	if (!response.ok) return yield* parseApiError(response, body, text);
-	return body;
-});
-const toAscCertificate = (value) => {
-	if (!isRecord$1(value)) return null;
-	const { id, attributes } = value;
-	if (typeof id !== "string" || !isRecord$1(attributes)) return null;
-	const { serialNumber, certificateType, expirationDate, certificateContent, displayName } = attributes;
-	if (typeof serialNumber !== "string" || typeof certificateType !== "string" || typeof expirationDate !== "string") return null;
-	return {
-		id,
-		serialNumber,
-		certificateType,
-		expirationDate,
-		certificateContent: typeof certificateContent === "string" ? certificateContent : null,
-		displayName: typeof displayName === "string" ? displayName : null
-	};
-};
-const toAscBundleId = (value) => {
-	if (!isRecord$1(value)) return null;
-	const { id, attributes } = value;
-	if (typeof id !== "string" || !isRecord$1(attributes)) return null;
-	const { identifier, name } = attributes;
-	if (typeof identifier !== "string" || typeof name !== "string") return null;
-	return {
-		id,
-		identifier,
-		name
-	};
-};
-const PROFILE_TYPES = [
-	"IOS_APP_ADHOC",
-	"IOS_APP_DEVELOPMENT",
-	"IOS_APP_STORE",
-	"IOS_APP_INHOUSE"
-];
-const asProfileType = (value) => {
-	const match = PROFILE_TYPES.find((entry) => entry === value);
-	return match === void 0 ? null : match;
-};
-const toAscProfile = (value) => {
-	if (!isRecord$1(value)) return null;
-	const { id, attributes } = value;
-	if (typeof id !== "string" || !isRecord$1(attributes)) return null;
-	const { name, uuid, expirationDate, profileContent } = attributes;
-	const profileType = asProfileType(attributes["profileType"]);
-	if (typeof name !== "string" || typeof uuid !== "string" || typeof expirationDate !== "string" || typeof profileContent !== "string" || profileType === null) return null;
-	return {
-		id,
-		name,
-		uuid,
-		expirationDate,
-		profileContent,
-		profileType
-	};
-};
-const toAscDevice = (value) => {
-	if (!isRecord$1(value)) return null;
-	const { id, attributes } = value;
-	if (typeof id !== "string" || !isRecord$1(attributes)) return null;
-	const { udid, name, deviceClass } = attributes;
-	if (typeof udid !== "string" || typeof name !== "string") return null;
-	return {
-		id,
-		udid,
-		name,
-		deviceClass: typeof deviceClass === "string" ? deviceClass : null
-	};
-};
-const extractList = (body, map) => {
-	if (!isRecord$1(body) || !Array.isArray(body["data"])) return [];
-	return body["data"].map(map).filter((value) => value !== null);
-};
-const extractSingle = (body, map) => {
-	if (!isRecord$1(body)) return null;
-	return map(body["data"]);
-};
-/**
-* App Store Connect paginates list responses (default 200/page) and returns the
-* absolute URL of the next page under `links.next`. Strip the base so it can be
-* fed back into `fetchRaw`; return null when there is no further page.
-*/
-const nextPagePath = (body) => {
-	if (!isRecord$1(body)) return null;
-	const { links } = body;
-	if (!isRecord$1(links) || typeof links["next"] !== "string") return null;
-	const { next } = links;
-	return next.startsWith(API_BASE) ? next.slice(37) : next;
-};
-const malformed = (resource) => new AscApiError({
-	status: 500,
-	message: `Malformed ${resource} response`,
-	code: void 0,
-	raw: ""
-});
-const withJwt = (credentials, fn) => Effect.gen(function* () {
-	return yield* fn(yield* signAscJwt(credentials));
-});
-const listCertificates = (credentials, params) => withJwt(credentials, (jwt) => Effect.gen(function* () {
-	return extractList(yield* fetchRaw(jwt, `/v1/certificates${params?.certificateType ? `?filter[certificateType]=${params.certificateType}&limit=200` : "?limit=200"}`), toAscCertificate);
-}));
-const createCertificate = (credentials, params) => withJwt(credentials, (jwt) => Effect.gen(function* () {
-	const csrContent = params.csrPem.replaceAll("-----BEGIN CERTIFICATE REQUEST-----", "").replaceAll("-----END CERTIFICATE REQUEST-----", "").replaceAll(/\s+/gu, "");
-	const resource = extractSingle(yield* fetchRaw(jwt, "/v1/certificates", {
-		method: "POST",
-		body: JSON.stringify({ data: {
-			type: "certificates",
-			attributes: {
-				csrContent,
-				certificateType: params.certificateType
-			}
-		} })
-	}), toAscCertificate);
-	if (resource === null) return yield* malformed("certificate");
-	return resource;
-}));
-const deleteCertificate = (credentials, id) => withJwt(credentials, (jwt) => Effect.asVoid(fetchRaw(jwt, `/v1/certificates/${encodeURIComponent(id)}`, { method: "DELETE" })));
-const listBundleIds = (credentials) => withJwt(credentials, (jwt) => Effect.gen(function* () {
-	return extractList(yield* fetchRaw(jwt, "/v1/bundleIds?limit=200"), toAscBundleId);
-}));
-const createBundleId = (credentials, params) => withJwt(credentials, (jwt) => Effect.gen(function* () {
-	const resource = extractSingle(yield* fetchRaw(jwt, "/v1/bundleIds", {
-		method: "POST",
-		body: JSON.stringify({ data: {
-			type: "bundleIds",
-			attributes: {
-				identifier: params.identifier,
-				name: params.name,
-				platform: "IOS"
-			}
-		} })
-	}), toAscBundleId);
-	if (resource === null) return yield* malformed("bundleId");
-	return resource;
-}));
-const listDevices = (credentials) => withJwt(credentials, (jwt) => Effect.gen(function* () {
-	const devices = [];
-	let path = "/v1/devices?limit=200";
-	while (path !== null) {
-		const body = yield* fetchRaw(jwt, path);
-		devices.push(...extractList(body, toAscDevice));
-		path = nextPagePath(body);
-	}
-	return devices;
-}));
-const createDevice = (credentials, params) => withJwt(credentials, (jwt) => Effect.gen(function* () {
-	const resource = extractSingle(yield* fetchRaw(jwt, "/v1/devices", {
-		method: "POST",
-		body: JSON.stringify({ data: {
-			type: "devices",
-			attributes: {
-				name: params.name,
-				udid: params.udid,
-				platform: "IOS"
-			}
-		} })
-	}), toAscDevice);
-	if (resource === null) return yield* malformed("device");
-	return resource;
-}));
-const createProvisioningProfile = (credentials, params) => withJwt(credentials, (jwt) => Effect.gen(function* () {
-	const relationships = {
-		bundleId: { data: {
-			type: "bundleIds",
-			id: params.bundleIdAscId
-		} },
-		certificates: { data: params.certificateAscIds.map((id) => ({
-			type: "certificates",
-			id
-		})) },
-		...params.deviceAscIds.length > 0 ? { devices: { data: params.deviceAscIds.map((id) => ({
-			type: "devices",
-			id
-		})) } } : {}
-	};
-	const resource = extractSingle(yield* fetchRaw(jwt, "/v1/profiles", {
-		method: "POST",
-		body: JSON.stringify({ data: {
-			type: "profiles",
-			attributes: {
-				name: params.profileName,
-				profileType: params.profileType
-			},
-			relationships
-		} })
-	}), toAscProfile);
-	if (resource === null) return yield* malformed("profile");
-	return resource;
-}));
-const isCertificateLimitError = (error) => {
-	if (error._tag !== "AscApiError") return false;
-	return /already have a current.*certificate|pending certificate request/iu.test(error.message);
-};
-
 //#endregion
 //#region src/lib/apple-cert-to-p12.ts
 var CertParseError = class extends Data.TaggedError("CertParseError") {};
@@ -33431,17 +33873,33 @@ const runFlow = (api, projectId, args) => Effect.gen(function* () {
 	});
 	yield* printHuman(`Submission created: ${submission.id} (${submission.status})`);
 	if (args.platform === "ios" && iosConfig !== void 0) {
-		const ascApiKeyId = args.easProfile.ios?.ascApiKeyId;
-		if (ascApiKeyId === void 0) {
-			yield* printHuman("iOS submission queued. Resolve ascApiKeyId in eas.json submit profile to enable client-side altool upload.");
+		const iosProfile = args.easProfile.ios;
+		const auth = resolveIosUploadAuth({
+			appleId: iosProfile?.appleId,
+			ascApiKeyId: iosProfile?.ascApiKeyId,
+			hasAppSpecificPassword: hasAppleAppSpecificPassword()
+		});
+		if (auth === null) {
+			yield* printHuman("iOS submission queued. Add ascApiKeyId to the eas.json submit profile, or set appleId + the EXPO_APPLE_APP_SPECIFIC_PASSWORD env var, to enable client-side altool upload.");
 			return submission;
 		}
-		yield* printHuman("Running xcrun altool upload locally...");
-		yield* runIosAltoolUpload({
+		yield* printHuman(auth.kind === "app-specific-password" ? "Running xcrun altool upload (Apple ID app-specific password)..." : "Running xcrun altool upload (ASC API key)...");
+		yield* runIosSubmit({
 			api,
 			submissionId: submission.id,
-			ipaPath: args.archive.archiveUrl,
-			ascApiKeyId
+			archive: {
+				source: args.archive.archiveSource,
+				value: args.archive.archiveUrl
+			},
+			auth,
+			ascApiKeyId: iosProfile?.ascApiKeyId,
+			config: {
+				bundleIdentifier: iosConfig.bundleIdentifier,
+				ascAppId: iosProfile?.ascAppId,
+				language: iosProfile?.language,
+				whatToTest: args.whatToTest,
+				groups: iosProfile?.groups ?? []
+			}
 		});
 	}
 	if (args.platform === "android" && args.easProfile.android !== void 0) {