@sitepong/fastnode 0.1.0

package/dist/client/index.cjs

@@ -0,0 +1,2592 @@
+'use strict';
+
+var jose = require('jose');
+var crypto = require('crypto');
+var readline = require('readline');
+
+// src/client/auth.ts
+var MAX_TOKEN_DURATION = 1200;
+var DEFAULT_TOKEN_DURATION = 500;
+var TokenManager = class {
+  config;
+  currentToken = null;
+  expiresAt = 0;
+  constructor(config) {
+    this.config = config;
+  }
+  async getToken() {
+    const now = Math.floor(Date.now() / 1e3);
+    if (this.currentToken && now < this.expiresAt - 30) {
+      return this.currentToken;
+    }
+    return this.refresh();
+  }
+  async refresh() {
+    const duration = Math.min(
+      this.config.duration ?? DEFAULT_TOKEN_DURATION,
+      MAX_TOKEN_DURATION
+    );
+    const audience = this.config.enterprise ? "apple-developer-enterprise-v1" : "appstoreconnect-v1";
+    const key = await jose.importPKCS8(this.config.privateKey, "ES256");
+    const now = Math.floor(Date.now() / 1e3);
+    let jwt = new jose.SignJWT(this.config.issuerId ? {} : { sub: "user" }).setProtectedHeader({
+      alg: "ES256",
+      kid: this.config.keyId,
+      typ: "JWT"
+    }).setIssuedAt(now - 60).setExpirationTime(now + duration).setAudience(audience);
+    if (this.config.issuerId) {
+      jwt = jwt.setIssuer(this.config.issuerId);
+    }
+    this.currentToken = await jwt.sign(key);
+    this.expiresAt = now + duration;
+    return this.currentToken;
+  }
+  invalidate() {
+    this.currentToken = null;
+    this.expiresAt = 0;
+  }
+};
+var N_2048 = BigInt(
+  "0xAC6BDB41324A9A9BF166DE5E1389582FAF72B6651987EE07FC3192943DB56050A37329CBB4A099ED8193E0757767A13DD52312AB4B03310DCD7F48A9DA04FD50E8083969EDB767B0CF6095179A163AB3661A05FBD5FAAAE82918A9962F0B93B855F97993EC975EEAA80D740ADBF4FF747359D041D5C33EA71D281E446B14773BCA97B43A23FB801676BD207A436C6481F1D2B9078717461A5B9D32E688F87748544523B524B0D57D5EA77A2775D2ECFA032CFBDBF52FB3786160279004E57AE6AF874E7303CE53299CCC041C7BC308D82A5698F3A8D0C38271AE35F8E9DBFBB694B5C803D89F7AE435DE236D525F54759B65E372FCD68EF20FA7111F9E4AFF73"
+);
+var g_2048 = 2n;
+function numToHex(num) {
+  let hex = num.toString(16);
+  if (hex.length % 2 !== 0) hex = "0" + hex;
+  return hex.toLowerCase();
+}
+function hexToBytes(hex) {
+  return Buffer.from(hex, "hex");
+}
+function shaHex(h, algorithm) {
+  return crypto.createHash(algorithm).update(hexToBytes(h)).digest("hex");
+}
+function shaStr(s, algorithm) {
+  return crypto.createHash(algorithm).update(s).digest("hex");
+}
+function modExp(base, exp, mod) {
+  if (mod === 1n) return 0n;
+  let result = 1n;
+  base = base % mod;
+  while (exp > 0n) {
+    if (exp % 2n === 1n) {
+      result = result * base % mod;
+    }
+    exp = exp / 2n;
+    base = base * base % mod;
+  }
+  return result;
+}
+function H(algorithm, n, ...args) {
+  const nHex = numToHex(n);
+  const nlen = 2 * (nHex.length * 4 + 7 >> 3);
+  let hashin = "";
+  for (const s of args) {
+    if (s === void 0) continue;
+    const shex = typeof s === "string" ? s : numToHex(s);
+    if (shex.length > nlen) {
+      throw new Error("Bit width does not match - client uses different prime");
+    }
+    hashin += "0".repeat(nlen - shex.length) + shex;
+  }
+  const hashed = shaHex(hashin, algorithm);
+  return BigInt("0x" + hashed) % n;
+}
+var SRPClient = class {
+  N;
+  g;
+  hashAlg;
+  k;
+  a;
+  A;
+  S = null;
+  K = null;
+  M = null;
+  H_AMK = null;
+  constructor(group = 2048) {
+    if (group !== 2048) throw new Error("Only 2048-bit group is supported");
+    this.N = N_2048;
+    this.g = g_2048;
+    this.hashAlg = "sha256";
+    this.k = H(this.hashAlg, this.N, this.N, this.g);
+    this.a = BigInt("0x" + crypto.randomBytes(256).toString("hex"));
+    this.A = numToHex(modExp(this.g, this.a, this.N));
+  }
+  startAuthentication() {
+    return this.A;
+  }
+  processChallenge(username, password, xsalt, xbb, isPasswordEncrypted = false) {
+    const bb = BigInt("0x" + xbb);
+    if (bb % this.N === 0n) return false;
+    let x;
+    if (isPasswordEncrypted) {
+      x = this.calcXHex(password, xsalt);
+    } else {
+      x = this.calcX(username, password, xsalt);
+    }
+    const u = H(this.hashAlg, this.N, this.A, xbb);
+    if (u === 0n) return false;
+    const gx = modExp(this.g, x, this.N);
+    let base = (bb - this.k * gx) % this.N;
+    if (base < 0n) base += this.N;
+    const exp = this.a + x * u;
+    this.S = numToHex(modExp(base, exp, this.N));
+    this.K = shaHex(this.S, this.hashAlg);
+    const hxor = H(this.hashAlg, this.N, this.N) ^ H(this.hashAlg, this.N, this.g);
+    const buf = numToHex(hxor) + shaStr(username, this.hashAlg) + xsalt + this.A + xbb + this.K;
+    const bytes = hexToBytes(buf);
+    this.M = crypto.createHash(this.hashAlg).update(bytes).digest("hex");
+    const amkBytes = hexToBytes(this.A + this.M + this.K);
+    this.H_AMK = numToHex(
+      BigInt("0x" + crypto.createHash(this.hashAlg).update(amkBytes).digest("hex"))
+    );
+    return this.M;
+  }
+  calcX(username, password, xsalt) {
+    const spad = xsalt.length % 2 !== 0 ? "0" : "";
+    const inner = shaStr(`${username}:${password}`, this.hashAlg);
+    return BigInt("0x" + shaHex(spad + xsalt + inner, this.hashAlg));
+  }
+  calcXHex(xpassword, xsalt) {
+    const colonHex = ":".charCodeAt(0).toString(16);
+    const inner = shaHex(colonHex + xpassword, this.hashAlg);
+    return BigInt("0x" + shaHex(xsalt + inner, this.hashAlg));
+  }
+};
+function applePbkdf2(password, salt, iterations, keyLength, protocol) {
+  if (!["s2k", "s2k_fo"].includes(protocol)) {
+    throw new Error(`Unsupported protocol '${protocol}' for pbkdf2`);
+  }
+  let passwordBytes = crypto.createHash("sha256").update(password).digest();
+  if (protocol === "s2k_fo") {
+    passwordBytes = passwordBytes.toString("hex");
+  }
+  return crypto.pbkdf2Sync(passwordBytes, salt, iterations, keyLength, "sha256");
+}
+
+// src/client/apple-session.ts
+var AUTH_BASE = "https://idmsa.apple.com/appleauth/auth";
+var OLYMPUS_SESSION = "https://appstoreconnect.apple.com/olympus/v1/session";
+var WIDGET_KEY_URL = "https://appstoreconnect.apple.com/olympus/v1/app/config?hostname=itunesconnect.apple.com";
+var ProgramLicenseAgreementError = class extends Error {
+  constructor(message, agreements) {
+    super(message);
+    this.agreements = agreements;
+    this.name = "ProgramLicenseAgreementError";
+  }
+  agreements;
+};
+function checkPortalResponse(body, session) {
+  if (!body || typeof body !== "object") return;
+  if (body.resultCode === 4100) {
+    const userMsg = body.userString ?? "The selected team does not have an eligible program membership.";
+    const agreements = session?.pendingAgreements ?? [];
+    if (agreements.length > 0) {
+      throw new ProgramLicenseAgreementError(
+        `${userMsg}
+
+\u26A0 Pending agreement: ${agreements[0].subject}
+${agreements[0].message.replace(/<[^>]+>/g, "")}
+
+Please accept the agreement at https://developer.apple.com/account before continuing.`,
+        agreements
+      );
+    }
+    throw new Error(userMsg);
+  }
+  if ((body.userString ?? "").includes("Program License Agreement")) {
+    throw new ProgramLicenseAgreementError(
+      `${body.userString} Please manually log into your Apple Developer account to review and accept the updated agreement.`,
+      session?.pendingAgreements ?? []
+    );
+  }
+  if (body.resultCode && body.resultCode !== 0) {
+    const msg = body.userString || body.resultString || `Portal API error (code ${body.resultCode})`;
+    throw new Error(msg);
+  }
+}
+async function loginWithAppleId(config) {
+  const log = config.onLog ?? console.log;
+  const promptFn = config.onPrompt ?? defaultPrompt;
+  log("Fetching Apple service key...");
+  const serviceKey = await fetchServiceKey();
+  const initRes = await fetch(`${AUTH_BASE}/signin?widgetKey=${serviceKey}`, {
+    headers: { "User-Agent": "Spaceship 2.225.0" }
+  });
+  const initCookies = parseCookies(initRes.headers);
+  const hcBits = initRes.headers.get("X-Apple-HC-Bits");
+  const hcChallenge = initRes.headers.get("X-Apple-HC-Challenge");
+  let hashcash;
+  if (hcBits && hcChallenge) {
+    log("Computing hashcash...");
+    hashcash = computeHashcash(parseInt(hcBits, 10), hcChallenge);
+  }
+  const cookieStr = Object.entries(initCookies).map(([k, v]) => k.startsWith("DES") ? `${k}="${v}"` : `${k}=${v}`).join("; ");
+  log("Starting SIRP Apple ID login...");
+  const response = await doSirp(config.email, config.password, serviceKey, cookieStr, hashcash);
+  const session = {
+    cookies: { ...initCookies, ...response.cookies },
+    sessionId: response.sessionId,
+    scnt: response.scnt,
+    serviceKey,
+    userEmail: config.email,
+    pendingAgreements: []
+  };
+  if (response.status === 403) {
+    throw new Error(`Invalid username and password combination. Used '${config.email}' as the username.`);
+  } else if (response.status === 200) {
+    log("Login successful.");
+    await fetchOlympusSession(session);
+  } else if (response.status === 409) {
+    await handleTwoStepOrFactor(session, log, promptFn);
+    await fetchOlympusSession(session);
+  } else if (response.status === 412) {
+    throw new Error("Need to acknowledge Apple's Apple ID and Privacy statement. Please manually log into https://appleid.apple.com.");
+  } else {
+    throw new Error(`Unexpected login response (${response.status}): ${JSON.stringify(response.body).slice(0, 500)}`);
+  }
+  const agreements = await fetchContractMessages(session);
+  if (agreements.length > 0) {
+    for (const msg of agreements) {
+      log(`\u26A0 ${msg.subject}: ${msg.message.replace(/<[^>]+>/g, "")}`);
+    }
+  }
+  session.pendingAgreements = agreements;
+  log(`Logged in as ${session.userEmail}`);
+  return session;
+}
+async function doSirp(user, password, serviceKey, cookieStr, hashcash) {
+  const client = new SRPClient(2048);
+  const A = client.startAuthentication();
+  const aBase64 = Buffer.from(A, "hex").toString("base64");
+  const baseHeaders = {
+    "Content-Type": "application/json",
+    "X-Requested-With": "XMLHttpRequest",
+    "X-Apple-Widget-Key": serviceKey,
+    Accept: "application/json, text/javascript"
+  };
+  if (cookieStr) baseHeaders["Cookie"] = cookieStr;
+  const initRes = await fetch(`${AUTH_BASE}/signin/init`, {
+    method: "POST",
+    headers: baseHeaders,
+    body: JSON.stringify({ a: aBase64, accountName: user, protocols: ["s2k", "s2k_fo"] }),
+    redirect: "manual"
+  });
+  const initBody = await initRes.json();
+  if (initBody.serviceErrors) throw new Error(`Apple auth error: ${JSON.stringify(initBody.serviceErrors)}`);
+  const { iteration: iterations, salt: saltB64, b: bB64, c, protocol } = initBody;
+  const salt = Buffer.from(saltB64, "base64");
+  const b = Buffer.from(bB64, "base64");
+  const encryptedPassword = applePbkdf2(password, salt, iterations, 32, protocol);
+  const m1 = client.processChallenge(user, encryptedPassword.toString("hex"), salt.toString("hex"), b.toString("hex"), true);
+  if (m1 === false) throw new Error("Error processing SIRP challenge");
+  const m2 = client.H_AMK;
+  const completeHeaders = { ...baseHeaders };
+  if (hashcash) completeHeaders["X-Apple-HC"] = hashcash;
+  const completeRes = await fetch(`${AUTH_BASE}/signin/complete?isRememberMeEnabled=false`, {
+    method: "POST",
+    headers: completeHeaders,
+    body: JSON.stringify({
+      accountName: user,
+      c,
+      m1: Buffer.from(m1, "hex").toString("base64"),
+      m2: m2 ? Buffer.from(m2, "hex").toString("base64") : "",
+      rememberMe: false
+    }),
+    redirect: "manual"
+  });
+  let body;
+  try {
+    body = await completeRes.json();
+  } catch {
+    body = "";
+  }
+  return {
+    status: completeRes.status,
+    body,
+    cookies: parseCookies(completeRes.headers),
+    sessionId: completeRes.headers.get("x-apple-id-session-id") ?? "",
+    scnt: completeRes.headers.get("scnt") ?? ""
+  };
+}
+async function handleTwoStepOrFactor(session, log, promptFn) {
+  const r = await fetch(`${AUTH_BASE}`, { headers: buildAuthHeaders(session) });
+  const body = await r.json();
+  if (body.trustedDevices?.length > 0) {
+    await handleTwoStep(session, body, log, promptFn);
+  } else if (body.trustedPhoneNumbers?.length > 0) {
+    await handleTwoFactor(session, body, log, promptFn);
+  } else {
+    throw new Error("2FA required but no trusted devices or phone numbers found.");
+  }
+}
+async function handleTwoFactor(session, authBody, log, promptFn) {
+  log("Two-factor Authentication (6 digit code) is enabled for this account");
+  const codeLength = authBody.securityCode?.length ?? 6;
+  const phones = authBody.trustedPhoneNumbers ?? [];
+  const noTrusted = authBody.noTrustedDevices === true;
+  let codeType;
+  let reqBody;
+  if (noTrusted && phones.length === 1) {
+    const phone = phones[0];
+    log(`Code automatically sent to ${phone.numberWithDialCode}`);
+    const code = await promptFn(`Please enter the ${codeLength} digit code you received at ${phone.numberWithDialCode}: `);
+    codeType = "phone";
+    reqBody = JSON.stringify({ securityCode: { code }, phoneNumber: { id: phone.id }, mode: phone.pushMode ?? "sms" });
+  } else if (noTrusted) {
+    const phone = await choosePhone(phones, log, promptFn);
+    await requestPhoneCode(session, phone);
+    log(`Successfully requested text message to ${phone.numberWithDialCode}`);
+    const code = await promptFn(`Please enter the ${codeLength} digit code: `);
+    codeType = "phone";
+    reqBody = JSON.stringify({ securityCode: { code }, phoneNumber: { id: phone.id }, mode: phone.pushMode ?? "sms" });
+  } else {
+    log("(Input 'sms' to escape this prompt and select a trusted phone number to send the code as a text message)");
+    const input = await promptFn(`Please enter the ${codeLength} digit code: `);
+    if (input.toLowerCase() === "sms") {
+      const phone = await choosePhone(phones, log, promptFn);
+      await requestPhoneCode(session, phone);
+      const code = await promptFn(`Please enter the ${codeLength} digit code sent to ${phone.numberWithDialCode}: `);
+      codeType = "phone";
+      reqBody = JSON.stringify({ securityCode: { code }, phoneNumber: { id: phone.id }, mode: phone.pushMode ?? "sms" });
+    } else {
+      codeType = "trusteddevice";
+      reqBody = JSON.stringify({ securityCode: { code: input } });
+    }
+  }
+  log("Requesting session...");
+  const verifyRes = await fetch(`${AUTH_BASE}/verify/${codeType}/securitycode`, {
+    method: "POST",
+    headers: { ...buildAuthHeaders(session), "Content-Type": "application/json" },
+    body: reqBody
+  });
+  if (!verifyRes.ok) {
+    const err = await verifyRes.json().catch(() => ({}));
+    const msgs = (err?.service_errors ?? err?.serviceErrors ?? []).map((e) => e.message).filter(Boolean);
+    throw new Error(msgs.join("; ") || `Verification failed (${verifyRes.status})`);
+  }
+  Object.assign(session.cookies, parseCookies(verifyRes.headers));
+  await trustSession(session);
+}
+async function handleTwoStep(session, authBody, log, promptFn) {
+  log("Two-step Verification (4 digit code) is enabled for this account");
+  const devices = authBody.trustedDevices ?? [];
+  log("Please select a trusted device:");
+  for (let i = 0; i < devices.length; i++) {
+    log(`  ${i + 1}. ${devices[i].name}	${devices[i].modelName ?? "SMS"}	(${devices[i].id})`);
+  }
+  const choice = await promptFn("Enter device number: ");
+  const device = devices[Math.max(0, parseInt(choice, 10) - 1)] ?? devices[0];
+  await fetch(`${AUTH_BASE}/verify/device/${device.id}/securitycode`, { method: "PUT", headers: buildAuthHeaders(session) });
+  log("Successfully requested notification");
+  const code = await promptFn("Please enter the 4 digit code: ");
+  const verifyRes = await fetch(`${AUTH_BASE}/verify/phone/securitycode`, {
+    method: "POST",
+    headers: { ...buildAuthHeaders(session), "Content-Type": "application/json" },
+    body: JSON.stringify({ phoneNumber: { id: device.id }, securityCode: { code }, mode: "sms" })
+  });
+  if (!verifyRes.ok) throw new Error("Incorrect verification code.");
+  Object.assign(session.cookies, parseCookies(verifyRes.headers));
+  await trustSession(session);
+}
+async function choosePhone(phones, log, promptFn) {
+  log("Please select a trusted phone number:");
+  for (let i = 0; i < phones.length; i++) log(`  ${i + 1}. ${phones[i].numberWithDialCode}`);
+  const choice = await promptFn("Enter number: ");
+  return phones[Math.max(0, parseInt(choice, 10) - 1)] ?? phones[0];
+}
+async function requestPhoneCode(session, phone) {
+  await fetch(`${AUTH_BASE}/verify/phone`, {
+    method: "PUT",
+    headers: { ...buildAuthHeaders(session), "Content-Type": "application/json" },
+    body: JSON.stringify({ phoneNumber: { id: phone.id }, mode: phone.pushMode ?? "sms" })
+  });
+}
+async function trustSession(session) {
+  const r = await fetch(`${AUTH_BASE}/2sv/trust`, { headers: buildAuthHeaders(session) });
+  Object.assign(session.cookies, parseCookies(r.headers));
+}
+async function fetchOlympusSession(session) {
+  const cookieStr = Object.entries(session.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+  const res = await fetch(OLYMPUS_SESSION, { headers: { Cookie: cookieStr, Accept: "application/json" } });
+  if (res.ok) {
+    const body = await res.json();
+    if (body?.user?.emailAddress) session.userEmail = body.user.emailAddress;
+    if (body?.provider?.providerId) session.teamId = String(body.provider.providerId);
+  }
+}
+async function fetchContractMessages(session) {
+  const cookieStr = Object.entries(session.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+  try {
+    const res = await fetch("https://appstoreconnect.apple.com/olympus/v1/contractMessages", {
+      headers: { Cookie: cookieStr, Accept: "application/json" }
+    });
+    if (!res.ok) return [];
+    const body = await res.json();
+    return (body ?? []).map((m) => ({
+      id: m.id ?? "",
+      group: m.group ?? "",
+      subject: m.subject ?? "",
+      message: m.message ?? ""
+    }));
+  } catch {
+    return [];
+  }
+}
+async function fetchServiceKey() {
+  const res = await fetch(WIDGET_KEY_URL);
+  const body = await res.json();
+  if (!body?.authServiceKey) throw new Error("Could not fetch Apple service key");
+  return body.authServiceKey;
+}
+function buildAuthHeaders(session) {
+  const h = { "X-Apple-Widget-Key": session.serviceKey, Accept: "application/json" };
+  if (session.sessionId) h["X-Apple-Id-Session-Id"] = session.sessionId;
+  if (session.scnt) h["scnt"] = session.scnt;
+  const c = Object.entries(session.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+  if (c) h["Cookie"] = c;
+  return h;
+}
+function parseCookies(headers) {
+  const cookies = {};
+  for (const raw of headers.getSetCookie?.() ?? []) {
+    const m = raw.match(/^([^=]+)=([^;]*)/);
+    if (m) cookies[m[1]] = m[2];
+  }
+  return cookies;
+}
+function computeHashcash(bits, challenge) {
+  const date = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:T]/g, "").slice(0, 12);
+  let counter = 0;
+  while (true) {
+    const stamp = `1:${bits}:${date}:${challenge}::${counter.toString(36)}:`;
+    const hash = crypto.createHash("sha1").update(stamp).digest();
+    let zeroBits = 0;
+    for (const byte of hash) {
+      if (byte === 0) {
+        zeroBits += 8;
+      } else {
+        zeroBits += Math.clz32(byte) - 24;
+        break;
+      }
+      if (zeroBits >= bits) break;
+    }
+    if (zeroBits >= bits) return stamp;
+    counter++;
+  }
+}
+async function defaultPrompt(message) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((r) => {
+    rl.question(message, (a) => {
+      rl.close();
+      r(a.trim());
+    });
+  });
+}
+
+// src/client/request.ts
+var PRODUCTION_BASE = "https://api.appstoreconnect.apple.com";
+var ENTERPRISE_BASE = "https://api.enterprise.developer.apple.com";
+var MAX_RETRIES = 5;
+var INITIAL_BACKOFF_MS = 1e3;
+var MAX_BACKOFF_MS = 6e4;
+var MAX_RATE_LIMIT_BACKOFF_MS = 36e5;
+var AppStoreConnectError = class extends Error {
+  constructor(message, status, errors = []) {
+    super(message);
+    this.status = status;
+    this.errors = errors;
+    this.name = "AppStoreConnectError";
+  }
+  status;
+  errors;
+};
+var RateLimitError = class extends AppStoreConnectError {
+  constructor(retryAfter) {
+    super(`Rate limited. Retry after ${retryAfter}s`, 429);
+    this.retryAfter = retryAfter;
+    this.name = "RateLimitError";
+  }
+  retryAfter;
+};
+var RequestClient = class {
+  baseUrl;
+  tokenManager;
+  constructor(tokenManager, enterprise = false) {
+    this.tokenManager = tokenManager;
+    this.baseUrl = enterprise ? ENTERPRISE_BASE : PRODUCTION_BASE;
+  }
+  async request(path, options = {}) {
+    const { method = "GET", body, params, headers: extraHeaders } = options;
+    let url = `${this.baseUrl}${path}`;
+    if (params) {
+      const searchParams = new URLSearchParams();
+      for (const [key, value] of Object.entries(params)) {
+        if (value === void 0) continue;
+        if (Array.isArray(value)) {
+          searchParams.set(key, value.join(","));
+        } else {
+          searchParams.set(key, String(value));
+        }
+      }
+      const qs = searchParams.toString();
+      if (qs) url += `?${qs}`;
+    }
+    let lastError = null;
+    let rateLimitBackoffMs = INITIAL_BACKOFF_MS;
+    for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+      const token = await this.tokenManager.getToken();
+      const headers = {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json",
+        ...extraHeaders
+      };
+      const res = await fetch(url, {
+        method,
+        headers,
+        body: body ? JSON.stringify(body) : void 0
+      });
+      if (res.ok) {
+        if (res.status === 204) return void 0;
+        return await res.json();
+      }
+      if (res.status === 401 && attempt === 0) {
+        this.tokenManager.invalidate();
+        continue;
+      }
+      if (res.status === 429) {
+        if (rateLimitBackoffMs > MAX_RATE_LIMIT_BACKOFF_MS) {
+          throw new RateLimitError(Math.floor(rateLimitBackoffMs / 1e3));
+        }
+        const retryAfterHeader = res.headers.get("Retry-After");
+        const sleepMs = retryAfterHeader ? parseInt(retryAfterHeader, 10) * 1e3 : rateLimitBackoffMs;
+        await sleep(sleepMs);
+        rateLimitBackoffMs *= 2;
+        continue;
+      }
+      const errorBody = await res.json().catch(() => null);
+      const errors = errorBody?.errors || [];
+      if (res.status === 403) {
+        const firstCode = errors[0]?.code;
+        if (firstCode === "FORBIDDEN.REQUIRED_AGREEMENTS_MISSING_OR_EXPIRED") {
+          const detail2 = errors.map((e) => e.detail || e.title).join("; ") || "Required agreements are missing or expired.";
+          throw new ProgramLicenseAgreementError(
+            `${detail2} Please manually log into your Apple Developer account to review and accept the updated agreement.`,
+            []
+          );
+        }
+      }
+      if (res.status === 502 && attempt < MAX_RETRIES) {
+        const bodyText = errorBody ? JSON.stringify(errorBody) : "";
+        if (bodyText.includes("Could not process this request")) {
+          const backoff = Math.min(
+            INITIAL_BACKOFF_MS * Math.pow(2, attempt),
+            MAX_BACKOFF_MS
+          );
+          await sleep(backoff + Math.random() * 500);
+          continue;
+        }
+      }
+      if (res.status >= 500 && attempt < MAX_RETRIES) {
+        const backoff = Math.min(
+          INITIAL_BACKOFF_MS * Math.pow(2, attempt),
+          MAX_BACKOFF_MS
+        );
+        await sleep(backoff + Math.random() * 500);
+        continue;
+      }
+      const detail = errors.map((e) => e.detail || e.title).join("; ") || `HTTP ${res.status}`;
+      lastError = new AppStoreConnectError(detail, res.status, errors);
+      break;
+    }
+    throw lastError || new Error("Request failed after retries");
+  }
+  async get(path, params) {
+    return this.request(path, { method: "GET", params });
+  }
+  async post(path, body) {
+    return this.request(path, { method: "POST", body });
+  }
+  async patch(path, body) {
+    return this.request(path, { method: "PATCH", body });
+  }
+  async delete(path) {
+    await this.request(path, { method: "DELETE" });
+  }
+  // Build query params from ListParams
+  buildListParams(params) {
+    const result = {};
+    if (params.filter) {
+      for (const [key, value] of Object.entries(params.filter)) {
+        result[`filter[${key}]`] = Array.isArray(value) ? value.join(",") : value;
+      }
+    }
+    if (params.include) {
+      result["include"] = params.include;
+    }
+    if (params.fields) {
+      for (const [key, value] of Object.entries(params.fields)) {
+        result[`fields[${key}]`] = value;
+      }
+    }
+    if (params.limit !== void 0) {
+      result["limit"] = String(params.limit);
+    }
+    if (params.sort) {
+      result["sort"] = params.sort;
+    }
+    if (params.cursor) {
+      result["page[after]"] = params.cursor;
+    }
+    return result;
+  }
+  async list(path, params = {}) {
+    const queryParams = this.buildListParams(params);
+    return this.get(path, queryParams);
+  }
+  async *paginate(path, params = {}) {
+    let cursor = params.cursor;
+    while (true) {
+      const response = await this.list(path, { ...params, cursor });
+      for (const item of response.data) {
+        yield item;
+      }
+      const nextLink = response.links?.next;
+      if (!nextLink) break;
+      const nextUrl = new URL(nextLink);
+      cursor = nextUrl.searchParams.get("page[after]") || void 0;
+      if (!cursor) break;
+    }
+  }
+  async all(path, params = {}) {
+    const results = [];
+    for await (const item of this.paginate(path, params)) {
+      results.push(item);
+    }
+    return results;
+  }
+};
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/resources/certificates.ts
+var CertificatesResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async list(params) {
+    const listParams = {
+      filter: params?.filter,
+      limit: params?.limit ?? 200,
+      sort: params?.sort
+    };
+    if (params?.fields) {
+      listParams.fields = { certificates: params.fields.join(",") };
+    }
+    return this.http.all("/v1/certificates", listParams);
+  }
+  async get(id) {
+    const response = await this.http.get(
+      `/v1/certificates/${id}`
+    );
+    return response.data;
+  }
+  async create(params) {
+    const response = await this.http.post(
+      "/v1/certificates",
+      {
+        data: {
+          type: "certificates",
+          attributes: {
+            certificateType: params.certificateType,
+            csrContent: params.csrContent
+          }
+        }
+      }
+    );
+    return response.data;
+  }
+  async revoke(id) {
+    await this.http.delete(`/v1/certificates/${id}`);
+  }
+  async *paginate(params) {
+    const listParams = {
+      filter: params?.filter,
+      limit: params?.limit ?? 200
+    };
+    yield* this.http.paginate("/v1/certificates", listParams);
+  }
+};
+
+// src/resources/profiles.ts
+var ProfilesResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async list(params) {
+    const listParams = {
+      filter: params?.filter,
+      include: params?.include,
+      limit: params?.limit ?? 200,
+      sort: params?.sort
+    };
+    if (params?.fields) {
+      listParams.fields = {};
+      for (const [key, value] of Object.entries(params.fields)) {
+        if (value) listParams.fields[key] = value.join(",");
+      }
+    }
+    return this.http.all("/v1/profiles", listParams);
+  }
+  async get(id, params) {
+    const queryParams = {};
+    if (params?.include) queryParams["include"] = params.include;
+    const response = await this.http.get(
+      `/v1/profiles/${id}`,
+      queryParams
+    );
+    return response.data;
+  }
+  async create(params) {
+    const relationships = {
+      bundleId: {
+        data: { type: "bundleIds", id: params.bundleIdId }
+      },
+      certificates: {
+        data: params.certificateIds.map((id) => ({
+          type: "certificates",
+          id
+        }))
+      }
+    };
+    if (params.deviceIds && params.deviceIds.length > 0) {
+      relationships.devices = {
+        data: params.deviceIds.map((id) => ({
+          type: "devices",
+          id
+        }))
+      };
+    }
+    const response = await this.http.post(
+      "/v1/profiles",
+      {
+        data: {
+          type: "profiles",
+          attributes: {
+            name: params.name,
+            profileType: params.profileType
+          },
+          relationships
+        }
+      }
+    );
+    return response.data;
+  }
+  async delete(id) {
+    await this.http.delete(`/v1/profiles/${id}`);
+  }
+  async getCertificates(profileId) {
+    return this.http.all(
+      `/v1/profiles/${profileId}/certificates`
+    );
+  }
+  async getDevices(profileId) {
+    return this.http.all(`/v1/profiles/${profileId}/devices`);
+  }
+  async getBundleId(profileId) {
+    const response = await this.http.get(
+      `/v1/profiles/${profileId}/bundleId`
+    );
+    return response.data;
+  }
+};
+
+// src/resources/bundle-ids.ts
+var BundleIdsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async list(params) {
+    const listParams = {
+      filter: params?.filter,
+      include: params?.include,
+      limit: params?.limit ?? 200,
+      sort: params?.sort
+    };
+    if (params?.fields) {
+      listParams.fields = {};
+      for (const [key, value] of Object.entries(params.fields)) {
+        if (value) listParams.fields[key] = value.join(",");
+      }
+    }
+    return this.http.all("/v1/bundleIds", listParams);
+  }
+  async get(id, params) {
+    const queryParams = {};
+    if (params?.include) queryParams["include"] = params.include;
+    const response = await this.http.get(
+      `/v1/bundleIds/${id}`,
+      queryParams
+    );
+    return response.data;
+  }
+  async create(params) {
+    const attributes = {
+      identifier: params.identifier,
+      name: params.name,
+      platform: params.platform
+    };
+    if (params.seedId) attributes.seedId = params.seedId;
+    const response = await this.http.post(
+      "/v1/bundleIds",
+      {
+        data: {
+          type: "bundleIds",
+          attributes
+        }
+      }
+    );
+    return response.data;
+  }
+  async find(identifier) {
+    const results = await this.list({
+      filter: { identifier },
+      limit: 1
+    });
+    return results[0] ?? null;
+  }
+  async getCapabilities(bundleIdId) {
+    return this.http.all(
+      `/v1/bundleIds/${bundleIdId}/bundleIdCapabilities`
+    );
+  }
+};
+
+// src/resources/devices.ts
+var DevicesResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async list(params) {
+    const listParams = {
+      filter: params?.filter,
+      limit: params?.limit ?? 200,
+      sort: params?.sort
+    };
+    if (params?.fields) {
+      listParams.fields = { devices: params.fields.join(",") };
+    }
+    return this.http.all("/v1/devices", listParams);
+  }
+  async get(id) {
+    const response = await this.http.get(
+      `/v1/devices/${id}`
+    );
+    return response.data;
+  }
+  async register(params) {
+    const response = await this.http.post(
+      "/v1/devices",
+      {
+        data: {
+          type: "devices",
+          attributes: {
+            name: params.name,
+            platform: params.platform,
+            udid: params.udid
+          }
+        }
+      }
+    );
+    return response.data;
+  }
+  async update(id, params) {
+    const response = await this.http.patch(
+      `/v1/devices/${id}`,
+      {
+        data: {
+          type: "devices",
+          id,
+          attributes: params
+        }
+      }
+    );
+    return response.data;
+  }
+  async findByUdid(udid) {
+    const results = await this.list({ filter: { udid }, limit: 1 });
+    return results[0] ?? null;
+  }
+};
+
+// src/resources/apps.ts
+var AppsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async list(params) {
+    const listParams = {
+      filter: params?.filter,
+      include: params?.include,
+      limit: params?.limit ?? 200,
+      sort: params?.sort
+    };
+    if (params?.fields) {
+      listParams.fields = {};
+      for (const [key, value] of Object.entries(params.fields)) {
+        if (value) listParams.fields[key] = value.join(",");
+      }
+    }
+    return this.http.all("/v1/apps", listParams);
+  }
+  async get(id, params) {
+    const queryParams = {};
+    if (params?.include) queryParams["include"] = params.include;
+    const response = await this.http.get(
+      `/v1/apps/${id}`,
+      queryParams
+    );
+    return response.data;
+  }
+  async findByBundleId(bundleId) {
+    const results = await this.list({
+      filter: { bundleId },
+      limit: 1
+    });
+    return results[0] ?? null;
+  }
+};
+
+// src/resources/builds.ts
+var BuildsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async list(params) {
+    const listParams = {
+      filter: params?.filter,
+      include: params?.include,
+      limit: params?.limit ?? 200,
+      sort: params?.sort
+    };
+    if (params?.fields) {
+      listParams.fields = {};
+      for (const [key, value] of Object.entries(params.fields)) {
+        if (value) listParams.fields[key] = value.join(",");
+      }
+    }
+    return this.http.all("/v1/builds", listParams);
+  }
+  async get(id, params) {
+    const queryParams = {};
+    if (params?.include) queryParams["include"] = params.include;
+    const response = await this.http.get(
+      `/v1/builds/${id}`,
+      queryParams
+    );
+    return response.data;
+  }
+  async getBetaDetail(buildId) {
+    const response = await this.http.get(
+      `/v1/builds/${buildId}/buildBetaDetail`
+    );
+    return response.data;
+  }
+  async getLocalizations(buildId) {
+    return this.http.all(
+      `/v1/builds/${buildId}/betaBuildLocalizations`
+    );
+  }
+  async createLocalization(params) {
+    const response = await this.http.post("/v1/betaBuildLocalizations", {
+      data: {
+        type: "betaBuildLocalizations",
+        attributes: {
+          locale: params.locale,
+          whatsNew: params.whatsNew
+        },
+        relationships: {
+          build: {
+            data: { type: "builds", id: params.buildId }
+          }
+        }
+      }
+    });
+    return response.data;
+  }
+  async updateLocalization(localizationId, params) {
+    const response = await this.http.patch(`/v1/betaBuildLocalizations/${localizationId}`, {
+      data: {
+        type: "betaBuildLocalizations",
+        id: localizationId,
+        attributes: {
+          whatsNew: params.whatsNew
+        }
+      }
+    });
+    return response.data;
+  }
+  async getPreReleaseVersion(buildId) {
+    try {
+      const response = await this.http.get(
+        `/v1/builds/${buildId}/preReleaseVersion`
+      );
+      return response.data;
+    } catch {
+      return null;
+    }
+  }
+  async submitForBetaReview(buildId) {
+    await this.http.post("/v1/betaAppReviewSubmissions", {
+      data: {
+        type: "betaAppReviewSubmissions",
+        relationships: {
+          build: {
+            data: { type: "builds", id: buildId }
+          }
+        }
+      }
+    });
+  }
+  async expireBuild(buildId) {
+    await this.http.patch(`/v1/builds/${buildId}`, {
+      data: {
+        type: "builds",
+        id: buildId,
+        attributes: {
+          expired: true
+        }
+      }
+    });
+  }
+};
+
+// src/resources/beta-groups.ts
+var BetaGroupsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async list(params) {
+    const listParams = {
+      filter: params?.filter,
+      limit: params?.limit ?? 200,
+      sort: params?.sort
+    };
+    if (params?.fields) {
+      listParams.fields = { betaGroups: params.fields.join(",") };
+    }
+    return this.http.all("/v1/betaGroups", listParams);
+  }
+  async get(id) {
+    const response = await this.http.get(
+      `/v1/betaGroups/${id}`
+    );
+    return response.data;
+  }
+  async listForApp(appId) {
+    return this.http.all(`/v1/apps/${appId}/betaGroups`);
+  }
+  async addBuilds(groupId, buildIds) {
+    await this.http.post(`/v1/betaGroups/${groupId}/relationships/builds`, {
+      data: buildIds.map((id) => ({ type: "builds", id }))
+    });
+  }
+  async removeBuilds(groupId, buildIds) {
+    await this.http.request(
+      `/v1/betaGroups/${groupId}/relationships/builds`,
+      {
+        method: "DELETE",
+        body: {
+          data: buildIds.map((id) => ({ type: "builds", id }))
+        }
+      }
+    );
+  }
+  async findByName(appId, name) {
+    const groups = await this.listForApp(appId);
+    return groups.find((g) => g.attributes.name === name) ?? null;
+  }
+};
+
+// src/resources/capabilities.ts
+var CapabilitiesResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async listForBundleId(bundleIdId) {
+    return this.http.all(
+      `/v1/bundleIds/${bundleIdId}/bundleIdCapabilities`
+    );
+  }
+  async enable(params) {
+    const attributes = {
+      capabilityType: params.capabilityType
+    };
+    if (params.settings) {
+      attributes.settings = params.settings;
+    }
+    const response = await this.http.post("/v1/bundleIdCapabilities", {
+      data: {
+        type: "bundleIdCapabilities",
+        attributes,
+        relationships: {
+          bundleId: {
+            data: { type: "bundleIds", id: params.bundleIdId }
+          }
+        }
+      }
+    });
+    return response.data;
+  }
+  async update(capabilityId, params) {
+    const attributes = {
+      capabilityType: params.capabilityType
+    };
+    if (params.settings) {
+      attributes.settings = params.settings;
+    }
+    const response = await this.http.patch(`/v1/bundleIdCapabilities/${capabilityId}`, {
+      data: {
+        type: "bundleIdCapabilities",
+        id: capabilityId,
+        attributes
+      }
+    });
+    return response.data;
+  }
+  async disable(capabilityId) {
+    await this.http.delete(`/v1/bundleIdCapabilities/${capabilityId}`);
+  }
+};
+
+// src/resources/app-store-versions.ts
+var AppStoreVersionsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async listForApp(appId, params) {
+    const listParams = {
+      filter: params?.filter,
+      include: params?.include,
+      limit: params?.limit ?? 200
+    };
+    return this.http.all(
+      `/v1/apps/${appId}/appStoreVersions`,
+      listParams
+    );
+  }
+  async get(id, params) {
+    const queryParams = {};
+    if (params?.include) queryParams["include"] = params.include;
+    const response = await this.http.get(
+      `/v1/appStoreVersions/${id}`,
+      queryParams
+    );
+    return response.data;
+  }
+  async create(params) {
+    const attributes = {
+      versionString: params.versionString,
+      platform: params.platform
+    };
+    if (params.releaseType) attributes.releaseType = params.releaseType;
+    if (params.earliestReleaseDate) attributes.earliestReleaseDate = params.earliestReleaseDate;
+    if (params.copyright) attributes.copyright = params.copyright;
+    const response = await this.http.post(
+      "/v1/appStoreVersions",
+      {
+        data: {
+          type: "appStoreVersions",
+          attributes,
+          relationships: {
+            app: {
+              data: { type: "apps", id: params.appId }
+            }
+          }
+        }
+      }
+    );
+    return response.data;
+  }
+  async update(id, params) {
+    const response = await this.http.patch(
+      `/v1/appStoreVersions/${id}`,
+      {
+        data: {
+          type: "appStoreVersions",
+          id,
+          attributes: params
+        }
+      }
+    );
+    return response.data;
+  }
+  async setBuild(versionId, buildId) {
+    await this.http.patch(`/v1/appStoreVersions/${versionId}/relationships/build`, {
+      data: { type: "builds", id: buildId }
+    });
+  }
+  async getLocalizations(versionId) {
+    return this.http.all(
+      `/v1/appStoreVersions/${versionId}/appStoreVersionLocalizations`
+    );
+  }
+  async createLocalization(params) {
+    const { versionId, ...attributes } = params;
+    const response = await this.http.post("/v1/appStoreVersionLocalizations", {
+      data: {
+        type: "appStoreVersionLocalizations",
+        attributes,
+        relationships: {
+          appStoreVersion: {
+            data: { type: "appStoreVersions", id: versionId }
+          }
+        }
+      }
+    });
+    return response.data;
+  }
+  async updateLocalization(localizationId, params) {
+    const response = await this.http.patch(`/v1/appStoreVersionLocalizations/${localizationId}`, {
+      data: {
+        type: "appStoreVersionLocalizations",
+        id: localizationId,
+        attributes: params
+      }
+    });
+    return response.data;
+  }
+};
+
+// src/resources/app-screenshots.ts
+var AppScreenshotsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async listSetsForLocalization(localizationId) {
+    return this.http.all(
+      `/v1/appStoreVersionLocalizations/${localizationId}/appScreenshotSets`
+    );
+  }
+  async createSet(params) {
+    const response = await this.http.post("/v1/appScreenshotSets", {
+      data: {
+        type: "appScreenshotSets",
+        attributes: {
+          screenshotDisplayType: params.screenshotDisplayType
+        },
+        relationships: {
+          appStoreVersionLocalization: {
+            data: {
+              type: "appStoreVersionLocalizations",
+              id: params.localizationId
+            }
+          }
+        }
+      }
+    });
+    return response.data;
+  }
+  async listScreenshots(setId) {
+    return this.http.all(
+      `/v1/appScreenshotSets/${setId}/appScreenshots`
+    );
+  }
+  async reserveScreenshot(params) {
+    const response = await this.http.post("/v1/appScreenshots", {
+      data: {
+        type: "appScreenshots",
+        attributes: {
+          fileName: params.fileName,
+          fileSize: params.fileSize
+        },
+        relationships: {
+          appScreenshotSet: {
+            data: { type: "appScreenshotSets", id: params.setId }
+          }
+        }
+      }
+    });
+    return response.data;
+  }
+  async commitScreenshot(screenshotId, params) {
+    const response = await this.http.patch(`/v1/appScreenshots/${screenshotId}`, {
+      data: {
+        type: "appScreenshots",
+        id: screenshotId,
+        attributes: {
+          sourceFileChecksum: params.sourceFileChecksum,
+          uploaded: params.uploaded
+        }
+      }
+    });
+    return response.data;
+  }
+  async deleteScreenshot(screenshotId) {
+    await this.http.delete(`/v1/appScreenshots/${screenshotId}`);
+  }
+  async deleteSet(setId) {
+    await this.http.delete(`/v1/appScreenshotSets/${setId}`);
+  }
+};
+
+// src/resources/review-submissions.ts
+var ReviewSubmissionsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async submitVersion(versionId) {
+    const response = await this.http.post("/v1/appStoreVersionSubmissions", {
+      data: {
+        type: "appStoreVersionSubmissions",
+        relationships: {
+          appStoreVersion: {
+            data: { type: "appStoreVersions", id: versionId }
+          }
+        }
+      }
+    });
+    return response.data;
+  }
+  async createReviewSubmission(params) {
+    const response = await this.http.post("/v1/reviewSubmissions", {
+      data: {
+        type: "reviewSubmissions",
+        attributes: {
+          platform: params.platform
+        },
+        relationships: {
+          app: {
+            data: { type: "apps", id: params.appId }
+          }
+        }
+      }
+    });
+    return response.data;
+  }
+  async confirmReviewSubmission(submissionId) {
+    const response = await this.http.patch(`/v1/reviewSubmissions/${submissionId}`, {
+      data: {
+        type: "reviewSubmissions",
+        id: submissionId,
+        attributes: {
+          submitted: true
+        }
+      }
+    });
+    return response.data;
+  }
+};
+
+// src/resources/app-info.ts
+var AppInfosResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async listForApp(appId, params) {
+    const listParams = {
+      limit: params?.limit ?? 200,
+      include: params?.include
+    };
+    return this.http.all(`/v1/apps/${appId}/appInfos`, listParams);
+  }
+  async get(id, params) {
+    const queryParams = {};
+    if (params?.include) queryParams["include"] = params.include;
+    const response = await this.http.get(
+      `/v1/appInfos/${id}`,
+      queryParams
+    );
+    return response.data;
+  }
+  async update(id, relationships) {
+    const response = await this.http.patch(
+      `/v1/appInfos/${id}`,
+      {
+        data: {
+          type: "appInfos",
+          id,
+          ...relationships ? {
+            relationships: Object.fromEntries(
+              Object.entries(relationships).map(([k, v]) => [k, { data: v }])
+            )
+          } : {}
+        }
+      }
+    );
+    return response.data;
+  }
+  async delete(id) {
+    await this.http.delete(`/v1/appInfos/${id}`);
+  }
+};
+
+// src/resources/app-info-localizations.ts
+var AppInfoLocalizationsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async listForAppInfo(appInfoId, params) {
+    const listParams = {
+      limit: params?.limit ?? 200
+    };
+    return this.http.all(
+      `/v1/appInfos/${appInfoId}/appInfoLocalizations`,
+      listParams
+    );
+  }
+  async get(id) {
+    const response = await this.http.get(
+      `/v1/appInfoLocalizations/${id}`
+    );
+    return response.data;
+  }
+  async create(params) {
+    const response = await this.http.post(
+      "/v1/appInfoLocalizations",
+      {
+        data: {
+          type: "appInfoLocalizations",
+          attributes: params.attributes,
+          relationships: {
+            appInfo: { data: { type: "appInfos", id: params.appInfoId } }
+          }
+        }
+      }
+    );
+    return response.data;
+  }
+  async update(id, attributes) {
+    const response = await this.http.patch(
+      `/v1/appInfoLocalizations/${id}`,
+      { data: { type: "appInfoLocalizations", id, attributes } }
+    );
+    return response.data;
+  }
+  async delete(id) {
+    await this.http.delete(`/v1/appInfoLocalizations/${id}`);
+  }
+};
+
+// src/resources/app-store-review-details.ts
+var AppStoreReviewDetailsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async getForAppStoreVersion(appStoreVersionId) {
+    const response = await this.http.get(`/v1/appStoreVersions/${appStoreVersionId}/appStoreReviewDetail`);
+    return response.data;
+  }
+  async get(id) {
+    const response = await this.http.get(`/v1/appStoreReviewDetails/${id}`);
+    return response.data;
+  }
+  async create(params) {
+    const response = await this.http.post("/v1/appStoreReviewDetails", {
+      data: {
+        type: "appStoreReviewDetails",
+        attributes: params.attributes,
+        relationships: {
+          appStoreVersion: {
+            data: { type: "appStoreVersions", id: params.appStoreVersionId }
+          }
+        }
+      }
+    });
+    return response.data;
+  }
+  async update(id, attributes) {
+    const response = await this.http.patch(`/v1/appStoreReviewDetails/${id}`, {
+      data: { type: "appStoreReviewDetails", id, attributes }
+    });
+    return response.data;
+  }
+};
+
+// src/resources/beta-testers.ts
+var BetaTestersResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async list(params) {
+    const listParams = {
+      filter: params?.filter,
+      include: params?.include,
+      limit: params?.limit ?? 200,
+      sort: params?.sort
+    };
+    return this.http.all("/v1/betaTesters", listParams);
+  }
+  async get(id) {
+    const response = await this.http.get(
+      `/v1/betaTesters/${id}`
+    );
+    return response.data;
+  }
+  async create(params) {
+    const attributes = {
+      email: params.email,
+      firstName: params.firstName,
+      lastName: params.lastName
+    };
+    const relationships = {};
+    if (params.betaGroupIds?.length) {
+      relationships.betaGroups = {
+        data: params.betaGroupIds.map((id) => ({ type: "betaGroups", id }))
+      };
+    }
+    if (params.appIds?.length) {
+      relationships.apps = {
+        data: params.appIds.map((id) => ({ type: "apps", id }))
+      };
+    }
+    const response = await this.http.post(
+      "/v1/betaTesters",
+      {
+        data: {
+          type: "betaTesters",
+          attributes,
+          ...Object.keys(relationships).length ? { relationships } : {}
+        }
+      }
+    );
+    return response.data;
+  }
+  async delete(id) {
+    await this.http.delete(`/v1/betaTesters/${id}`);
+  }
+  async findByEmail(email) {
+    const results = await this.list({ filter: { email }, limit: 1 });
+    return results[0] ?? null;
+  }
+};
+
+// src/resources/beta-app-review-submissions.ts
+var BetaAppReviewSubmissionsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async list(params) {
+    const listParams = {
+      filter: params?.filter,
+      limit: params?.limit ?? 200
+    };
+    return this.http.all(
+      "/v1/betaAppReviewSubmissions",
+      listParams
+    );
+  }
+  async get(id) {
+    const response = await this.http.get(
+      `/v1/betaAppReviewSubmissions/${id}`
+    );
+    return response.data;
+  }
+  async create(buildId) {
+    const response = await this.http.post(
+      "/v1/betaAppReviewSubmissions",
+      {
+        data: {
+          type: "betaAppReviewSubmissions",
+          relationships: {
+            build: { data: { type: "builds", id: buildId } }
+          }
+        }
+      }
+    );
+    return response.data;
+  }
+};
+
+// src/resources/beta-app-review-details.ts
+var BetaAppReviewDetailsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async getForApp(appId) {
+    const response = await this.http.get(
+      `/v1/apps/${appId}/betaAppReviewDetail`
+    );
+    return response.data;
+  }
+  async get(id) {
+    const response = await this.http.get(
+      `/v1/betaAppReviewDetails/${id}`
+    );
+    return response.data;
+  }
+  async update(id, attributes) {
+    const response = await this.http.patch(
+      `/v1/betaAppReviewDetails/${id}`,
+      { data: { type: "betaAppReviewDetails", id, attributes } }
+    );
+    return response.data;
+  }
+};
+
+// src/resources/beta-invitations.ts
+var BetaInvitationsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /** Send a TestFlight invitation email for an existing tester + app. */
+  async send(params) {
+    const response = await this.http.post(
+      "/v1/betaTesterInvitations",
+      {
+        data: {
+          type: "betaTesterInvitations",
+          relationships: {
+            app: { data: { type: "apps", id: params.appId } },
+            betaTester: { data: { type: "betaTesters", id: params.betaTesterId } }
+          }
+        }
+      }
+    );
+    return response.data;
+  }
+};
+
+// src/resources/beta-licenses.ts
+var BetaLicensesResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async list(params) {
+    const listParams = {
+      limit: params?.limit ?? 200
+    };
+    return this.http.all(
+      "/v1/betaLicenseAgreements",
+      listParams
+    );
+  }
+  async get(id) {
+    const response = await this.http.get(
+      `/v1/betaLicenseAgreements/${id}`
+    );
+    return response.data;
+  }
+  async getForApp(appId) {
+    const response = await this.http.get(
+      `/v1/apps/${appId}/betaLicenseAgreement`
+    );
+    return response.data;
+  }
+  async update(id, attributes) {
+    const response = await this.http.patch(`/v1/betaLicenseAgreements/${id}`, {
+      data: { type: "betaLicenseAgreements", id, attributes }
+    });
+    return response.data;
+  }
+};
+
+// src/resources/app-previews.ts
+var AppPreviewsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async get(id) {
+    const response = await this.http.get(
+      `/v1/appPreviews/${id}`
+    );
+    return response.data;
+  }
+  async create(params) {
+    const { appPreviewSetId, ...rest } = params;
+    const response = await this.http.post(
+      "/v1/appPreviews",
+      {
+        data: {
+          type: "appPreviews",
+          attributes: rest,
+          relationships: {
+            appPreviewSet: {
+              data: { type: "appPreviewSets", id: appPreviewSetId }
+            }
+          }
+        }
+      }
+    );
+    return response.data;
+  }
+  async update(id, attributes) {
+    const response = await this.http.patch(
+      `/v1/appPreviews/${id}`,
+      { data: { type: "appPreviews", id, attributes } }
+    );
+    return response.data;
+  }
+  async delete(id) {
+    await this.http.delete(`/v1/appPreviews/${id}`);
+  }
+};
+
+// src/resources/app-preview-sets.ts
+var AppPreviewSetsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async listForLocalization(localizationId, params) {
+    const listParams = {
+      limit: params?.limit ?? 200,
+      include: params?.include
+    };
+    return this.http.all(
+      `/v1/appStoreVersionLocalizations/${localizationId}/appPreviewSets`,
+      listParams
+    );
+  }
+  async get(id, params) {
+    const queryParams = {};
+    if (params?.include) queryParams["include"] = params.include;
+    const response = await this.http.get(
+      `/v1/appPreviewSets/${id}`,
+      queryParams
+    );
+    return response.data;
+  }
+  async create(params) {
+    const response = await this.http.post(
+      "/v1/appPreviewSets",
+      {
+        data: {
+          type: "appPreviewSets",
+          attributes: { previewType: params.previewType },
+          relationships: {
+            appStoreVersionLocalization: {
+              data: {
+                type: "appStoreVersionLocalizations",
+                id: params.appStoreVersionLocalizationId
+              }
+            }
+          }
+        }
+      }
+    );
+    return response.data;
+  }
+  async delete(id) {
+    await this.http.delete(`/v1/appPreviewSets/${id}`);
+  }
+};
+
+// src/resources/app-prices.ts
+var AppPricesResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async listForApp(appId, params) {
+    const listParams = {
+      limit: params?.limit ?? 200,
+      include: params?.include
+    };
+    return this.http.all(`/v1/apps/${appId}/prices`, listParams);
+  }
+  async get(id, params) {
+    const queryParams = {};
+    if (params?.include) queryParams["include"] = params.include;
+    const response = await this.http.get(
+      `/v1/appPrices/${id}`,
+      queryParams
+    );
+    return response.data;
+  }
+};
+
+// src/resources/territories.ts
+var TerritoriesResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async list(params) {
+    const listParams = {
+      limit: params?.limit ?? 200
+    };
+    return this.http.all("/v1/territories", listParams);
+  }
+  async get(id) {
+    const response = await this.http.get(
+      `/v1/territories/${id}`
+    );
+    return response.data;
+  }
+};
+
+// src/resources/age-rating-declarations.ts
+var AgeRatingDeclarationsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async get(id) {
+    const response = await this.http.get(
+      `/v1/ageRatingDeclarations/${id}`
+    );
+    return response.data;
+  }
+  async update(id, attributes) {
+    const response = await this.http.patch(`/v1/ageRatingDeclarations/${id}`, {
+      data: { type: "ageRatingDeclarations", id, attributes }
+    });
+    return response.data;
+  }
+};
+
+// src/resources/app-categories.ts
+var AppCategoriesResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async list(params) {
+    const listParams = {
+      filter: params?.filter,
+      include: params?.include,
+      limit: params?.limit ?? 200
+    };
+    return this.http.all("/v1/appCategories", listParams);
+  }
+  async get(id, params) {
+    const queryParams = {};
+    if (params?.include) queryParams["include"] = params.include;
+    const response = await this.http.get(
+      `/v1/appCategories/${id}`,
+      queryParams
+    );
+    return response.data;
+  }
+};
+
+// src/resources/app-encryption-declarations.ts
+var AppEncryptionDeclarationsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async list(params) {
+    const listParams = {
+      filter: params?.filter,
+      limit: params?.limit ?? 200
+    };
+    return this.http.all(
+      "/v1/appEncryptionDeclarations",
+      listParams
+    );
+  }
+  async get(id) {
+    const response = await this.http.get(`/v1/appEncryptionDeclarations/${id}`);
+    return response.data;
+  }
+  async assignToBuild(params) {
+    await this.http.post(
+      `/v1/appEncryptionDeclarations/${params.declarationId}/relationships/builds`,
+      { data: params.buildIds.map((id) => ({ type: "builds", id })) }
+    );
+  }
+};
+
+// src/resources/idfa-declarations.ts
+var IdfaDeclarationsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async getForAppStoreVersion(appStoreVersionId) {
+    const response = await this.http.get(
+      `/v1/appStoreVersions/${appStoreVersionId}/idfaDeclaration`
+    );
+    return response.data;
+  }
+  async get(id) {
+    const response = await this.http.get(
+      `/v1/idfaDeclarations/${id}`
+    );
+    return response.data;
+  }
+  async create(params) {
+    const response = await this.http.post(
+      "/v1/idfaDeclarations",
+      {
+        data: {
+          type: "idfaDeclarations",
+          attributes: params.attributes,
+          relationships: {
+            appStoreVersion: {
+              data: { type: "appStoreVersions", id: params.appStoreVersionId }
+            }
+          }
+        }
+      }
+    );
+    return response.data;
+  }
+  async update(id, attributes) {
+    const response = await this.http.patch(
+      `/v1/idfaDeclarations/${id}`,
+      { data: { type: "idfaDeclarations", id, attributes } }
+    );
+    return response.data;
+  }
+  async delete(id) {
+    await this.http.delete(`/v1/idfaDeclarations/${id}`);
+  }
+};
+
+// src/resources/pre-release-versions.ts
+var PreReleaseVersionsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async list(params) {
+    const listParams = {
+      filter: params?.filter,
+      include: params?.include,
+      limit: params?.limit ?? 200,
+      sort: params?.sort
+    };
+    return this.http.all(
+      "/v1/preReleaseVersions",
+      listParams
+    );
+  }
+  async get(id, params) {
+    const queryParams = {};
+    if (params?.include) queryParams["include"] = params.include;
+    const response = await this.http.get(
+      `/v1/preReleaseVersions/${id}`,
+      queryParams
+    );
+    return response.data;
+  }
+  async findByVersion(params) {
+    const filter = {
+      app: params.appId,
+      version: params.version
+    };
+    if (params.platform) filter.platform = params.platform;
+    const results = await this.list({ filter, limit: 1 });
+    return results[0] ?? null;
+  }
+};
+
+// src/resources/review-submission-items.ts
+var ReviewSubmissionItemsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async listForSubmission(reviewSubmissionId, params) {
+    const listParams = {
+      include: params?.include,
+      limit: params?.limit ?? 200
+    };
+    return this.http.all(
+      `/v1/reviewSubmissions/${reviewSubmissionId}/items`,
+      listParams
+    );
+  }
+  async get(id) {
+    const response = await this.http.get(
+      `/v1/reviewSubmissionItems/${id}`
+    );
+    return response.data;
+  }
+  async create(params) {
+    const relationships = {
+      reviewSubmission: {
+        data: { type: "reviewSubmissions", id: params.reviewSubmissionId }
+      }
+    };
+    if (params.appStoreVersionId) {
+      relationships.appStoreVersion = {
+        data: { type: "appStoreVersions", id: params.appStoreVersionId }
+      };
+    }
+    if (params.appCustomProductPageVersionId) {
+      relationships.appCustomProductPageVersion = {
+        data: {
+          type: "appCustomProductPageVersions",
+          id: params.appCustomProductPageVersionId
+        }
+      };
+    }
+    if (params.appStoreVersionExperimentId) {
+      relationships.appStoreVersionExperiment = {
+        data: {
+          type: "appStoreVersionExperiments",
+          id: params.appStoreVersionExperimentId
+        }
+      };
+    }
+    const response = await this.http.post(
+      "/v1/reviewSubmissionItems",
+      {
+        data: {
+          type: "reviewSubmissionItems",
+          relationships
+        }
+      }
+    );
+    return response.data;
+  }
+  async update(id, attributes) {
+    const response = await this.http.patch(
+      `/v1/reviewSubmissionItems/${id}`,
+      { data: { type: "reviewSubmissionItems", id, attributes } }
+    );
+    return response.data;
+  }
+  async delete(id) {
+    await this.http.delete(`/v1/reviewSubmissionItems/${id}`);
+  }
+};
+
+// src/resources/users.ts
+var UsersResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async list(params) {
+    const listParams = {
+      filter: params?.filter,
+      include: params?.include,
+      limit: params?.limit ?? 200,
+      sort: params?.sort
+    };
+    return this.http.all("/v1/users", listParams);
+  }
+  async get(id) {
+    const response = await this.http.get(`/v1/users/${id}`);
+    return response.data;
+  }
+  async update(id, attributes, visibleAppIds) {
+    const relationships = visibleAppIds ? {
+      visibleApps: {
+        data: visibleAppIds.map((id2) => ({ type: "apps", id: id2 }))
+      }
+    } : void 0;
+    const response = await this.http.patch(
+      `/v1/users/${id}`,
+      {
+        data: {
+          type: "users",
+          id,
+          attributes,
+          ...relationships ? { relationships } : {}
+        }
+      }
+    );
+    return response.data;
+  }
+  async delete(id) {
+    await this.http.delete(`/v1/users/${id}`);
+  }
+};
+
+// src/resources/user-invitations.ts
+var UserInvitationsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async list(params) {
+    const listParams = {
+      filter: params?.filter,
+      include: params?.include,
+      limit: params?.limit ?? 200,
+      sort: params?.sort
+    };
+    return this.http.all("/v1/userInvitations", listParams);
+  }
+  async get(id) {
+    const response = await this.http.get(
+      `/v1/userInvitations/${id}`
+    );
+    return response.data;
+  }
+  async create(params) {
+    const relationships = params.visibleAppIds ? {
+      visibleApps: {
+        data: params.visibleAppIds.map((id) => ({ type: "apps", id }))
+      }
+    } : void 0;
+    const response = await this.http.post(
+      "/v1/userInvitations",
+      {
+        data: {
+          type: "userInvitations",
+          attributes: params.attributes,
+          ...relationships ? { relationships } : {}
+        }
+      }
+    );
+    return response.data;
+  }
+  async delete(id) {
+    await this.http.delete(`/v1/userInvitations/${id}`);
+  }
+  async findByEmail(email) {
+    const results = await this.list({ filter: { email }, limit: 1 });
+    return results[0] ?? null;
+  }
+};
+
+// src/resources/in-app-purchases.ts
+var InAppPurchasesResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async listForApp(appId, params) {
+    const listParams = {
+      filter: params?.filter,
+      include: params?.include,
+      limit: params?.limit ?? 200,
+      sort: params?.sort
+    };
+    return this.http.all(
+      `/v2/apps/${appId}/inAppPurchasesV2`,
+      listParams
+    );
+  }
+  async get(id, params) {
+    const queryParams = {};
+    if (params?.include) queryParams["include"] = params.include;
+    const response = await this.http.get(
+      `/v2/inAppPurchases/${id}`,
+      queryParams
+    );
+    return response.data;
+  }
+};
+
+// src/resources/game-center-detail.ts
+var GameCenterDetailResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async getForApp(appId) {
+    const response = await this.http.get(
+      `/v1/apps/${appId}/gameCenterDetail`
+    );
+    return response.data;
+  }
+  async get(id) {
+    const response = await this.http.get(
+      `/v1/gameCenterDetails/${id}`
+    );
+    return response.data;
+  }
+  async update(id, attributes) {
+    const response = await this.http.patch(
+      `/v1/gameCenterDetails/${id}`,
+      { data: { type: "gameCenterDetails", id, attributes } }
+    );
+    return response.data;
+  }
+};
+
+// src/resources/xcode-metrics.ts
+var XcodeMetricsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async getPerfPowerMetrics(buildId) {
+    const response = await this.http.get(
+      `/v1/builds/${buildId}/perfPowerMetrics`
+    );
+    return response.data;
+  }
+  async getDiagnosticSignatures(buildId) {
+    const response = await this.http.get(
+      `/v1/builds/${buildId}/diagnosticSignatures`
+    );
+    return response.data;
+  }
+  async getPerfPowerMetric(id) {
+    const response = await this.http.get(
+      `/v1/perfPowerMetrics/${id}`
+    );
+    return response.data;
+  }
+  async getDiagnosticSignature(id) {
+    const response = await this.http.get(
+      `/v1/diagnosticSignatures/${id}`
+    );
+    return response.data;
+  }
+};
+
+// src/client/portal.ts
+var PORTAL_BASE = "https://developer.apple.com/services-account/QH65B2";
+var PortalClient = class _PortalClient {
+  session;
+  teamId;
+  csrf = "";
+  csrfTs = "";
+  cookieStr;
+  constructor(session, teamId) {
+    this.session = session;
+    this.teamId = teamId;
+    this.cookieStr = Object.entries(session.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+  }
+  /** Initialize CSRF tokens — must be called before mutations */
+  async init() {
+    await this.post("account/listTeams.action", {});
+  }
+  async post(path, params) {
+    const body = new URLSearchParams();
+    for (const [k, v] of Object.entries(params)) {
+      if (Array.isArray(v)) {
+        for (const item of v) body.append(k, item);
+      } else body.set(k, v);
+    }
+    const bodyStr = body.toString();
+    const headers = {
+      Cookie: this.cookieStr,
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    };
+    if (this.csrf) {
+      headers["csrf"] = this.csrf;
+      headers["csrf_ts"] = this.csrfTs;
+    }
+    if (process.env.FASTNODE_DEBUG) console.log(`[portal] POST ${path} body=${bodyStr.slice(0, 200)}`);
+    const res = await fetch(`${PORTAL_BASE}/${path}`, { method: "POST", headers, body: bodyStr });
+    if (res.headers.get("csrf")) {
+      this.csrf = res.headers.get("csrf");
+      this.csrfTs = res.headers.get("csrf_ts") ?? "";
+    }
+    for (const raw of res.headers.getSetCookie?.() ?? []) {
+      const m = raw.match(/^([^=]+)=([^;]*)/);
+      if (m && !this.cookieStr.includes(m[1] + "=")) this.cookieStr += "; " + m[1] + "=" + m[2];
+    }
+    const text = await res.text();
+    let data;
+    try {
+      data = JSON.parse(text);
+    } catch {
+      throw new Error(`Portal returned non-JSON: ${text.slice(0, 200)}`);
+    }
+    checkPortalResponse(data, this.session);
+    return data;
+  }
+  // ── Teams ──────────────────────────────────────────────────────────────
+  async listTeams() {
+    const data = await this.post("account/listTeams.action", {});
+    return data.teams ?? [];
+  }
+  // ── App IDs / Bundle IDs ───────────────────────────────────────────────
+  async listAppIds() {
+    const data = await this.post("account/ios/identifiers/listAppIds.action", {
+      teamId: this.teamId,
+      pageSize: "500",
+      pageNumber: "1",
+      sort: "name=asc"
+    });
+    return data.appIds ?? [];
+  }
+  async createAppId(params) {
+    const reqParams = {
+      teamId: this.teamId,
+      type: "explicit",
+      identifier: params.identifier,
+      name: params.name
+    };
+    if (params.enablePush) reqParams.push = "on";
+    if (params.enableIAP !== false) reqParams.inAppPurchase = "on";
+    const data = await this.post("account/ios/identifiers/addAppId.action", reqParams);
+    return data.appId;
+  }
+  async deleteAppId(appIdId) {
+    await this.post("account/ios/identifiers/deleteAppId.action", { teamId: this.teamId, appIdId });
+  }
+  // ── Certificates ───────────────────────────────────────────────────────
+  async listCertificates(types) {
+    const iosTypes = types ?? [
+      _PortalClient.CERT_TYPES.IOS_DEVELOPMENT,
+      _PortalClient.CERT_TYPES.IOS_DISTRIBUTION,
+      ..._PortalClient.OLDER_IOS_CERTIFICATE_TYPES
+    ];
+    const data = await this.post("account/ios/certificate/listCertRequests.action", {
+      teamId: this.teamId,
+      pageSize: "500",
+      pageNumber: "1",
+      sort: "certRequestStatusCode=asc",
+      types: iosTypes.join(",")
+    });
+    return data.certRequests ?? [];
+  }
+  async listPushCertificates() {
+    const data = await this.post("account/ios/certificate/listCertRequests.action", {
+      teamId: this.teamId,
+      pageSize: "500",
+      pageNumber: "1",
+      sort: "certRequestStatusCode=asc",
+      types: [_PortalClient.CERT_TYPES.IOS_PRODUCTION_PUSH, _PortalClient.CERT_TYPES.IOS_DEVELOPMENT_PUSH].join(",")
+    });
+    return data.certRequests ?? [];
+  }
+  async createCertificate(params) {
+    const reqParams = {
+      teamId: this.teamId,
+      type: params.type,
+      csrContent: params.csrContent
+    };
+    if (params.appIdId) reqParams.appIdId = params.appIdId;
+    const data = await this.post("account/ios/certificate/submitCertificateRequest.action", reqParams);
+    return data.certRequest;
+  }
+  async downloadCertificate(certId, type) {
+    const headers = { Cookie: this.cookieStr, Accept: "application/json" };
+    const res = await fetch(
+      `${PORTAL_BASE}/account/ios/certificate/downloadCertificateContent.action?teamId=${this.teamId}&certificateId=${certId}&type=${type}`,
+      { headers }
+    );
+    return Buffer.from(await res.arrayBuffer());
+  }
+  async revokeCertificate(certId, type) {
+    await this.post("account/ios/certificate/revokeCertificate.action", {
+      teamId: this.teamId,
+      certificateId: certId,
+      type
+    });
+  }
+  // ── Devices ────────────────────────────────────────────────────────────
+  async listDevices() {
+    const data = await this.post("account/ios/device/listDevices.action", {
+      teamId: this.teamId,
+      pageSize: "500",
+      pageNumber: "1",
+      sort: "name=asc",
+      includeRemovedDevices: "false"
+    });
+    return data.devices ?? [];
+  }
+  async registerDevice(params) {
+    const data = await this.post("account/ios/device/addDevices.action", {
+      teamId: this.teamId,
+      deviceNames: params.name,
+      deviceNumbers: params.udid,
+      register: "single",
+      deviceClasses: params.deviceClass ?? "iphone"
+    });
+    return (data.devices ?? [])[0];
+  }
+  // ── Provisioning Profiles ──────────────────────────────────────────────
+  async listProfiles() {
+    const data = await this.post("account/ios/profile/listProvisioningProfiles.action", {
+      teamId: this.teamId,
+      includeInactiveProfiles: "true",
+      pageSize: "500",
+      pageNumber: "1",
+      sort: "name=asc"
+    });
+    return data.provisioningProfiles ?? [];
+  }
+  async createProfile(params) {
+    const reqParams = {
+      teamId: this.teamId,
+      appIdId: params.appIdId,
+      distributionType: params.distributionType,
+      provisioningProfileName: params.name,
+      certificateIds: params.certificateIds
+    };
+    if (params.deviceIds?.length) reqParams.deviceIds = params.deviceIds;
+    const data = await this.post("account/ios/profile/createProvisioningProfile.action", reqParams);
+    return data.provisioningProfile;
+  }
+  async deleteProfile(profileId) {
+    await this.post("account/ios/profile/deleteProvisioningProfile.action", {
+      teamId: this.teamId,
+      provisioningProfileId: profileId
+    });
+  }
+  async downloadProfile(profileId) {
+    const headers = { Cookie: this.cookieStr };
+    const res = await fetch(
+      `${PORTAL_BASE}/account/ios/profile/downloadProfileContent?teamId=${this.teamId}&provisioningProfileId=${profileId}`,
+      { headers }
+    );
+    return Buffer.from(await res.arrayBuffer());
+  }
+  // ── Certificate Type Constants (matching Fastlane) ─────────────────────
+  /**
+   * Apple certificate type codes — copied 1:1 from Fastlane's
+   * spaceship/portal/certificate.rb IOS_CERTIFICATE_TYPE_IDS / MAC_CERTIFICATE_TYPE_IDS
+   */
+  static CERT_TYPES = {
+    // iOS
+    IOS_DEVELOPMENT: "5QPB9NHCEI",
+    IOS_DISTRIBUTION: "R58UK2EWSO",
+    // App Store Production
+    IOS_IN_HOUSE: "9RQEK7MSXA",
+    IOS_DEVELOPMENT_PUSH: "JKG5JZ54H7",
+    IOS_PRODUCTION_PUSH: "UPV3DW712I",
+    APPLE_PUSH_PRODUCTION: "UPV3DW712I",
+    // alias
+    APPLE_PUSH_SANDBOX: "JKG5JZ54H7",
+    // alias
+    PASSBOOK: "Y3B2F3TYSI",
+    WEBSITE_PUSH: "3T2ZP62QW8",
+    VOIP_PUSH: "E5D663CMZW",
+    APPLE_PAY: "4APLUP237T",
+    APPLE_PAY_MERCHANT_IDENTITY: "MD8Q2VRT6A",
+    // Universal (Apple Development/Distribution)
+    APPLE_DEVELOPMENT: "83Q87W3TGH",
+    APPLE_DISTRIBUTION: "WXV89964HE",
+    // Mac
+    MAC_DEVELOPMENT: "749Y1QAGU7",
+    MAC_APP_DISTRIBUTION: "HXZEUKP0FP",
+    MAC_INSTALLER_DISTRIBUTION: "2PQI8IDXNH",
+    MAC_PRODUCTION_PUSH: "CDZ7EMXIZ1",
+    MAC_DEVELOPMENT_PUSH: "HQ4KP3I34R",
+    DEVELOPER_ID_APPLICATION: "DIVN2GW3XT",
+    DEVELOPER_ID_INSTALLER: "OYVN2GW35E"
+  };
+  /**
+   * Legacy iOS certificate type codes that can still appear in the portal
+   * responses. Port of Fastlane's Spaceship::Portal::Certificate
+   * OLDER_IOS_CERTIFICATE_TYPES list (certificate.rb lines 180-189).
+   */
+  static OLDER_IOS_CERTIFICATE_TYPES = [
+    "3BQKVH9I2X",
+    // old ProductionPush
+    "BKLRAVXMGM",
+    // old DevelopmentPush
+    // Also sent by the browser, but not sure what they represent:
+    "T44PTHVNID",
+    "DZQUP8189Y",
+    "FGQUP4785Z",
+    "S5WE21TULA",
+    "FUOY7LWJET"
+  ];
+};
+
+// src/client/index.ts
+var AppStoreConnectClient = class {
+  http;
+  certificates;
+  profiles;
+  bundleIds;
+  devices;
+  apps;
+  builds;
+  betaGroups;
+  capabilities;
+  appStoreVersions;
+  appScreenshots;
+  reviewSubmissions;
+  appInfos;
+  appInfoLocalizations;
+  appStoreReviewDetails;
+  betaTesters;
+  betaAppReviewSubmissions;
+  betaAppReviewDetails;
+  betaInvitations;
+  betaLicenses;
+  appPreviews;
+  appPreviewSets;
+  appPrices;
+  territories;
+  ageRatingDeclarations;
+  appCategories;
+  appEncryptionDeclarations;
+  idfaDeclarations;
+  preReleaseVersions;
+  reviewSubmissionItems;
+  users;
+  userInvitations;
+  inAppPurchases;
+  gameCenterDetail;
+  xcodeMetrics;
+  constructor(config) {
+    const tokenManager = new TokenManager({
+      keyId: config.keyId,
+      issuerId: config.issuerId,
+      privateKey: config.privateKey,
+      enterprise: config.enterprise,
+      duration: config.tokenDuration
+    });
+    this.http = new RequestClient(tokenManager, config.enterprise);
+    this.certificates = new CertificatesResource(this.http);
+    this.profiles = new ProfilesResource(this.http);
+    this.bundleIds = new BundleIdsResource(this.http);
+    this.devices = new DevicesResource(this.http);
+    this.apps = new AppsResource(this.http);
+    this.builds = new BuildsResource(this.http);
+    this.betaGroups = new BetaGroupsResource(this.http);
+    this.capabilities = new CapabilitiesResource(this.http);
+    this.appStoreVersions = new AppStoreVersionsResource(this.http);
+    this.appScreenshots = new AppScreenshotsResource(this.http);
+    this.reviewSubmissions = new ReviewSubmissionsResource(this.http);
+    this.appInfos = new AppInfosResource(this.http);
+    this.appInfoLocalizations = new AppInfoLocalizationsResource(this.http);
+    this.appStoreReviewDetails = new AppStoreReviewDetailsResource(this.http);
+    this.betaTesters = new BetaTestersResource(this.http);
+    this.betaAppReviewSubmissions = new BetaAppReviewSubmissionsResource(this.http);
+    this.betaAppReviewDetails = new BetaAppReviewDetailsResource(this.http);
+    this.betaInvitations = new BetaInvitationsResource(this.http);
+    this.betaLicenses = new BetaLicensesResource(this.http);
+    this.appPreviews = new AppPreviewsResource(this.http);
+    this.appPreviewSets = new AppPreviewSetsResource(this.http);
+    this.appPrices = new AppPricesResource(this.http);
+    this.territories = new TerritoriesResource(this.http);
+    this.ageRatingDeclarations = new AgeRatingDeclarationsResource(this.http);
+    this.appCategories = new AppCategoriesResource(this.http);
+    this.appEncryptionDeclarations = new AppEncryptionDeclarationsResource(this.http);
+    this.idfaDeclarations = new IdfaDeclarationsResource(this.http);
+    this.preReleaseVersions = new PreReleaseVersionsResource(this.http);
+    this.reviewSubmissionItems = new ReviewSubmissionItemsResource(this.http);
+    this.users = new UsersResource(this.http);
+    this.userInvitations = new UserInvitationsResource(this.http);
+    this.inAppPurchases = new InAppPurchasesResource(this.http);
+    this.gameCenterDetail = new GameCenterDetailResource(this.http);
+    this.xcodeMetrics = new XcodeMetricsResource(this.http);
+  }
+  async request(path, options) {
+    return this.http.request(path, options);
+  }
+};
+
+exports.AppStoreConnectClient = AppStoreConnectClient;
+exports.AppStoreConnectError = AppStoreConnectError;
+exports.PortalClient = PortalClient;
+exports.ProgramLicenseAgreementError = ProgramLicenseAgreementError;
+exports.RateLimitError = RateLimitError;
+exports.RequestClient = RequestClient;
+exports.TokenManager = TokenManager;
+exports.checkPortalResponse = checkPortalResponse;
+exports.loginWithAppleId = loginWithAppleId;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map