@sitepong/fastnode 0.1.2 → 0.2.1

package/dist/cli/index.mjs

@@ -1783,9 +1783,9 @@ Please accept the agreement at https://developer.apple.com/account before contin
     throw new Error(msg);
   }
 }
-async function loginWithAppleId(config) {
-  const log = config.onLog ?? console.log;
-  const promptFn = config.onPrompt ?? defaultPrompt;
+async function beginLogin(config) {
+  const log = config.onLog ?? (() => {
+  });
   log("Fetching Apple service key...");
   const serviceKey = await fetchServiceKey();
   const initRes = await fetch(`${AUTH_BASE}/signin?widgetKey=${serviceKey}`, {
@@ -1802,27 +1802,94 @@ async function loginWithAppleId(config) {
   const cookieStr = Object.entries(initCookies).map(([k, v]) => k.startsWith("DES") ? `${k}="${v}"` : `${k}=${v}`).join("; ");
   log("Starting SIRP Apple ID login...");
   const response = await doSirp(config.email, config.password, serviceKey, cookieStr, hashcash);
-  const session = {
+  const baseState = {
     cookies: { ...initCookies, ...response.cookies },
     sessionId: response.sessionId,
     scnt: response.scnt,
     serviceKey,
-    userEmail: config.email,
-    pendingAgreements: []
+    userEmail: config.email
   };
   if (response.status === 403) {
     throw new Error(`Invalid username and password combination. Used '${config.email}' as the username.`);
-  } else if (response.status === 200) {
-    log("Login successful.");
-    await fetchOlympusSession(session);
-  } else if (response.status === 409) {
-    await handleTwoStepOrFactor(session, log, promptFn);
-    await fetchOlympusSession(session);
-  } else if (response.status === 412) {
+  }
+  if (response.status === 412) {
     throw new Error("Need to acknowledge Apple's Apple ID and Privacy statement. Please manually log into https://appleid.apple.com.");
+  }
+  if (response.status === 200) {
+    log("Login successful (no 2FA).");
+    const session = { ...baseState, pendingAgreements: [] };
+    await finalizeSession(session, log);
+    return { kind: "logged_in", session };
+  }
+  if (response.status === 409) {
+    log("2FA required, fetching challenge...");
+    const challenge = await fetchTwoFactorChallenge(baseState);
+    return { kind: "needs_2fa", pending: baseState, challenge };
+  }
+  throw new Error(`Unexpected login response (${response.status}): ${JSON.stringify(response.body).slice(0, 500)}`);
+}
+async function fetchTwoFactorChallenge(pending) {
+  const r = await fetch(`${AUTH_BASE}`, { headers: buildAuthHeadersFromPending(pending) });
+  const body = await r.json();
+  const trustedPhoneNumbers = (body.trustedPhoneNumbers ?? []).map((p) => ({
+    id: p.id,
+    numberWithDialCode: p.numberWithDialCode,
+    pushMode: p.pushMode
+  }));
+  const phoneOnly = body.noTrustedDevices === true;
+  const codeLength = body.securityCode?.length ?? 6;
+  return {
+    kind: phoneOnly ? "phone_only" : "device",
+    codeLength,
+    trustedPhoneNumbers
+  };
+}
+async function requestSmsCode(input) {
+  await fetch(`${AUTH_BASE}/verify/phone`, {
+    method: "PUT",
+    headers: { ...buildAuthHeadersFromPending(input.pending), "Content-Type": "application/json" },
+    body: JSON.stringify({ phoneNumber: { id: input.phoneId }, mode: input.mode ?? "sms" })
+  });
+}
+async function submitTwoFactorCode(input) {
+  const log = input.onLog ?? (() => {
+  });
+  let path;
+  let body;
+  if (input.source === "device") {
+    path = `${AUTH_BASE}/verify/trusteddevice/securitycode`;
+    body = JSON.stringify({ securityCode: { code: input.code } });
   } else {
-    throw new Error(`Unexpected login response (${response.status}): ${JSON.stringify(response.body).slice(0, 500)}`);
+    if (input.phoneId == null) throw new Error("phoneId is required when source='phone'");
+    path = `${AUTH_BASE}/verify/phone/securitycode`;
+    body = JSON.stringify({
+      securityCode: { code: input.code },
+      phoneNumber: { id: input.phoneId },
+      mode: input.mode ?? "sms"
+    });
   }
+  log("Submitting 2FA code...");
+  const verifyRes = await fetch(path, {
+    method: "POST",
+    headers: { ...buildAuthHeadersFromPending(input.pending), "Content-Type": "application/json" },
+    body
+  });
+  if (!verifyRes.ok) {
+    const err = await verifyRes.json().catch(() => ({}));
+    const msgs = (err?.service_errors ?? err?.serviceErrors ?? []).map((e) => e.message).filter(Boolean);
+    throw new Error(msgs.join("; ") || `Verification failed (${verifyRes.status})`);
+  }
+  const session = {
+    ...input.pending,
+    cookies: { ...input.pending.cookies, ...parseCookies(verifyRes.headers) },
+    pendingAgreements: []
+  };
+  await trustSession(session);
+  await finalizeSession(session, log);
+  return session;
+}
+async function finalizeSession(session, log) {
+  await fetchOlympusSession(session);
   const agreements = await fetchContractMessages(session);
   if (agreements.length > 0) {
     for (const msg of agreements) {
@@ -1831,7 +1898,53 @@ async function loginWithAppleId(config) {
   }
   session.pendingAgreements = agreements;
   log(`Logged in as ${session.userEmail}`);
-  return session;
+}
+async function loginWithAppleId(config) {
+  const log = config.onLog ?? console.log;
+  const promptFn = config.onPrompt ?? defaultPrompt;
+  const result = await beginLogin({ email: config.email, password: config.password, onLog: log });
+  if (result.kind === "logged_in") return result.session;
+  const { pending, challenge } = result;
+  const phones = challenge.trustedPhoneNumbers;
+  if (challenge.kind === "device") {
+    log("Two-factor Authentication (6 digit code) is enabled for this account");
+    log("(Input 'sms' to escape this prompt and select a trusted phone number to send the code as a text message)");
+    const input = await promptFn(`Please enter the ${challenge.codeLength} digit code: `);
+    if (input.toLowerCase() === "sms") {
+      log("Please select a trusted phone number:");
+      for (let i = 0; i < phones.length; i++) log(`  ${i + 1}. ${phones[i].numberWithDialCode}`);
+      const choice2 = await promptFn("Enter number: ");
+      const phone2 = phones[Math.max(0, parseInt(choice2, 10) - 1)] ?? phones[0];
+      await requestSmsCode({ pending, phoneId: phone2.id, mode: phone2.pushMode });
+      log(`Code sent to ${phone2.numberWithDialCode}`);
+      const code2 = await promptFn(`Please enter the ${challenge.codeLength} digit code: `);
+      return submitTwoFactorCode({ pending, code: code2, source: "phone", phoneId: phone2.id, mode: phone2.pushMode ?? "sms", onLog: log });
+    }
+    return submitTwoFactorCode({ pending, code: input, source: "device", onLog: log });
+  }
+  log("Two-factor Authentication (6 digit code) is enabled for this account");
+  if (phones.length === 1) {
+    const phone2 = phones[0];
+    log(`Code automatically sent to ${phone2.numberWithDialCode}`);
+    const code2 = await promptFn(`Please enter the ${challenge.codeLength} digit code: `);
+    return submitTwoFactorCode({ pending, code: code2, source: "phone", phoneId: phone2.id, mode: phone2.pushMode ?? "sms", onLog: log });
+  }
+  log("Please select a trusted phone number:");
+  for (let i = 0; i < phones.length; i++) log(`  ${i + 1}. ${phones[i].numberWithDialCode}`);
+  const choice = await promptFn("Enter number: ");
+  const phone = phones[Math.max(0, parseInt(choice, 10) - 1)] ?? phones[0];
+  await requestSmsCode({ pending, phoneId: phone.id, mode: phone.pushMode });
+  log(`Code sent to ${phone.numberWithDialCode}`);
+  const code = await promptFn(`Please enter the ${challenge.codeLength} digit code: `);
+  return submitTwoFactorCode({ pending, code, source: "phone", phoneId: phone.id, mode: phone.pushMode ?? "sms", onLog: log });
+}
+function buildAuthHeadersFromPending(pending) {
+  const h = { "X-Apple-Widget-Key": pending.serviceKey, Accept: "application/json" };
+  if (pending.sessionId) h["X-Apple-Id-Session-Id"] = pending.sessionId;
+  if (pending.scnt) h["scnt"] = pending.scnt;
+  const c = Object.entries(pending.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+  if (c) h["Cookie"] = c;
+  return h;
 }
 async function doSirp(user, password, serviceKey, cookieStr, hashcash) {
   const client = new SRPClient(2048);
@@ -1887,99 +2000,6 @@ async function doSirp(user, password, serviceKey, cookieStr, hashcash) {
     scnt: completeRes.headers.get("scnt") ?? ""
   };
 }
-async function handleTwoStepOrFactor(session, log, promptFn) {
-  const r = await fetch(`${AUTH_BASE}`, { headers: buildAuthHeaders(session) });
-  const body = await r.json();
-  if (body.trustedDevices?.length > 0) {
-    await handleTwoStep(session, body, log, promptFn);
-  } else if (body.trustedPhoneNumbers?.length > 0) {
-    await handleTwoFactor(session, body, log, promptFn);
-  } else {
-    throw new Error("2FA required but no trusted devices or phone numbers found.");
-  }
-}
-async function handleTwoFactor(session, authBody, log, promptFn) {
-  log("Two-factor Authentication (6 digit code) is enabled for this account");
-  const codeLength = authBody.securityCode?.length ?? 6;
-  const phones = authBody.trustedPhoneNumbers ?? [];
-  const noTrusted = authBody.noTrustedDevices === true;
-  let codeType;
-  let reqBody;
-  if (noTrusted && phones.length === 1) {
-    const phone = phones[0];
-    log(`Code automatically sent to ${phone.numberWithDialCode}`);
-    const code = await promptFn(`Please enter the ${codeLength} digit code you received at ${phone.numberWithDialCode}: `);
-    codeType = "phone";
-    reqBody = JSON.stringify({ securityCode: { code }, phoneNumber: { id: phone.id }, mode: phone.pushMode ?? "sms" });
-  } else if (noTrusted) {
-    const phone = await choosePhone(phones, log, promptFn);
-    await requestPhoneCode(session, phone);
-    log(`Successfully requested text message to ${phone.numberWithDialCode}`);
-    const code = await promptFn(`Please enter the ${codeLength} digit code: `);
-    codeType = "phone";
-    reqBody = JSON.stringify({ securityCode: { code }, phoneNumber: { id: phone.id }, mode: phone.pushMode ?? "sms" });
-  } else {
-    log("(Input 'sms' to escape this prompt and select a trusted phone number to send the code as a text message)");
-    const input = await promptFn(`Please enter the ${codeLength} digit code: `);
-    if (input.toLowerCase() === "sms") {
-      const phone = await choosePhone(phones, log, promptFn);
-      await requestPhoneCode(session, phone);
-      const code = await promptFn(`Please enter the ${codeLength} digit code sent to ${phone.numberWithDialCode}: `);
-      codeType = "phone";
-      reqBody = JSON.stringify({ securityCode: { code }, phoneNumber: { id: phone.id }, mode: phone.pushMode ?? "sms" });
-    } else {
-      codeType = "trusteddevice";
-      reqBody = JSON.stringify({ securityCode: { code: input } });
-    }
-  }
-  log("Requesting session...");
-  const verifyRes = await fetch(`${AUTH_BASE}/verify/${codeType}/securitycode`, {
-    method: "POST",
-    headers: { ...buildAuthHeaders(session), "Content-Type": "application/json" },
-    body: reqBody
-  });
-  if (!verifyRes.ok) {
-    const err = await verifyRes.json().catch(() => ({}));
-    const msgs = (err?.service_errors ?? err?.serviceErrors ?? []).map((e) => e.message).filter(Boolean);
-    throw new Error(msgs.join("; ") || `Verification failed (${verifyRes.status})`);
-  }
-  Object.assign(session.cookies, parseCookies(verifyRes.headers));
-  await trustSession(session);
-}
-async function handleTwoStep(session, authBody, log, promptFn) {
-  log("Two-step Verification (4 digit code) is enabled for this account");
-  const devices = authBody.trustedDevices ?? [];
-  log("Please select a trusted device:");
-  for (let i = 0; i < devices.length; i++) {
-    log(`  ${i + 1}. ${devices[i].name}	${devices[i].modelName ?? "SMS"}	(${devices[i].id})`);
-  }
-  const choice = await promptFn("Enter device number: ");
-  const device = devices[Math.max(0, parseInt(choice, 10) - 1)] ?? devices[0];
-  await fetch(`${AUTH_BASE}/verify/device/${device.id}/securitycode`, { method: "PUT", headers: buildAuthHeaders(session) });
-  log("Successfully requested notification");
-  const code = await promptFn("Please enter the 4 digit code: ");
-  const verifyRes = await fetch(`${AUTH_BASE}/verify/phone/securitycode`, {
-    method: "POST",
-    headers: { ...buildAuthHeaders(session), "Content-Type": "application/json" },
-    body: JSON.stringify({ phoneNumber: { id: device.id }, securityCode: { code }, mode: "sms" })
-  });
-  if (!verifyRes.ok) throw new Error("Incorrect verification code.");
-  Object.assign(session.cookies, parseCookies(verifyRes.headers));
-  await trustSession(session);
-}
-async function choosePhone(phones, log, promptFn) {
-  log("Please select a trusted phone number:");
-  for (let i = 0; i < phones.length; i++) log(`  ${i + 1}. ${phones[i].numberWithDialCode}`);
-  const choice = await promptFn("Enter number: ");
-  return phones[Math.max(0, parseInt(choice, 10) - 1)] ?? phones[0];
-}
-async function requestPhoneCode(session, phone) {
-  await fetch(`${AUTH_BASE}/verify/phone`, {
-    method: "PUT",
-    headers: { ...buildAuthHeaders(session), "Content-Type": "application/json" },
-    body: JSON.stringify({ phoneNumber: { id: phone.id }, mode: phone.pushMode ?? "sms" })
-  });
-}
 async function trustSession(session) {
   const r = await fetch(`${AUTH_BASE}/2sv/trust`, { headers: buildAuthHeaders(session) });
   Object.assign(session.cookies, parseCookies(r.headers));
@@ -6322,6 +6342,12 @@ var init_xcode_metrics = __esm({
 });
 
 // src/client/portal.ts
+function pickUniqueKeyName(base, taken) {
+  if (!taken.has(base)) return base;
+  let n = 1;
+  while (taken.has(`${base} - ${n}`)) n++;
+  return `${base} - ${n}`;
+}
 var PORTAL_BASE, PortalClient;
 var init_portal = __esm({
   "src/client/portal.ts"() {
@@ -6342,6 +6368,279 @@ var init_portal = __esm({
       async init() {
         await this.post("account/listTeams.action", {});
       }
+      /**
+       * JSON POST — different content type than the standard form-encoded
+       * `post()`. Used by the App Store Connect API key endpoints
+       * (`account/auth/key/v2/create`), which Spaceship discovered take a
+       * JSON body even though every other portal mutation is form-encoded.
+       *
+       * Like the form-encoded `post()`, this also runs the response through
+       * `checkPortalResponse` — Apple returns HTTP 200 even for errors and
+       * encodes the error in `resultCode`/`userString` fields, so a raw
+       * status check would silently miss real failures.
+       */
+      async postJson(path, body) {
+        const headers = {
+          Cookie: this.cookieStr,
+          "Content-Type": "application/json",
+          Accept: "application/json"
+        };
+        if (this.csrf) {
+          headers["csrf"] = this.csrf;
+          headers["csrf_ts"] = this.csrfTs;
+        }
+        console.log(`[portal] POST(json) ${path}`);
+        const res = await fetch(`${PORTAL_BASE}/${path}`, {
+          method: "POST",
+          headers,
+          body: JSON.stringify(body)
+        });
+        if (res.headers.get("csrf")) {
+          this.csrf = res.headers.get("csrf");
+          this.csrfTs = res.headers.get("csrf_ts") ?? "";
+        }
+        for (const raw of res.headers.getSetCookie?.() ?? []) {
+          const m = raw.match(/^([^=]+)=([^;]*)/);
+          if (m && !this.cookieStr.includes(m[1] + "=")) this.cookieStr += "; " + m[1] + "=" + m[2];
+        }
+        const text = await res.text();
+        let data = null;
+        try {
+          data = text ? JSON.parse(text) : null;
+        } catch {
+        }
+        console.log(`[portal] POST(json) ${path} \u2192 ${res.status} ${text.slice(0, 400)}`);
+        checkPortalResponse(data, this.session);
+        return { status: res.status, body: data, rawText: text };
+      }
+      /**
+       * GET helper for the portal endpoints that take query parameters
+       * (currently just `account/auth/key/download`). Returns the raw text
+       * since download endpoints can return PEMs or JSON depending on Apple's
+       * mood — caller decides how to parse.
+       */
+      async getRaw(path, params = {}) {
+        const url = new URL(`${PORTAL_BASE}/${path}`);
+        for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
+        const headers = {
+          Cookie: this.cookieStr,
+          Accept: "application/json, text/plain, application/x-pem-file, */*"
+        };
+        if (this.csrf) {
+          headers["csrf"] = this.csrf;
+          headers["csrf_ts"] = this.csrfTs;
+        }
+        console.log(`[portal] GET ${url.pathname}${url.search}`);
+        const res = await fetch(url.toString(), { headers });
+        for (const raw of res.headers.getSetCookie?.() ?? []) {
+          const m = raw.match(/^([^=]+)=([^;]*)/);
+          if (m && !this.cookieStr.includes(m[1] + "=")) this.cookieStr += "; " + m[1] + "=" + m[2];
+        }
+        const text = await res.text();
+        const contentType = res.headers.get("content-type") ?? "";
+        console.log(`[portal] GET ${url.pathname} \u2192 ${res.status} ${contentType} ${text.length}b`);
+        return { status: res.status, rawText: text, contentType };
+      }
+      // ── App Store Connect API Keys (.p8) ────────────────────────────────────
+      /**
+       * Create an App Store Connect API key via the developer portal's
+       * `account/auth/key/v2/create` endpoint. Reverse-engineered from the
+       * _current_ @expo/apple-utils npm package (v2.1.21), which is what
+       * EAS CLI uses to manage Apple credentials in production.
+       *
+       * This differs from older published reverse-engineering guides:
+       *   • URL uses the `/v2/create` suffix (Apple kept it)
+       *   • Field is `serviceConfigurations`, shape is an object keyed by
+       *     service id (NOT `serviceConfigurationsRequests: [...]` array)
+       *   • Body REQUIRES `scope: "team"`
+       *   • Needs a scope-specific CSRF warmup via the `keys` endpoint
+       *     before the create call (EAS's `ensureCSRFAsync("keys", …)`)
+       *
+       * For an App Store Connect API key (PUBLIC_API, used by altool for
+       * TestFlight uploads), `serviceConfigurations` is an empty object `{}`.
+       * For an APNs auth key, it's `{ "U27F4V844T": [] }`. For MusicKit:
+       * `{ "6A7HVUVQ3M": [musicId] }`, etc.
+       *
+       * Apple's name validator rejects parentheses, brackets, and most
+       * punctuation — sanitize to alphanumeric + space + dash + underscore
+       * + period and collapse whitespace.
+       */
+      async createApiKey(rawName, serviceConfigurations = {}) {
+        const baseName = rawName.replace(/[^A-Za-z0-9 _\-.]/g, " ").replace(/\s+/g, " ").trim().slice(0, 45);
+        if (!baseName) throw new Error("createApiKey: name is empty after sanitization");
+        let existingNames = /* @__PURE__ */ new Set();
+        try {
+          const list = await this.listApiKeys();
+          existingNames = new Set(
+            (list.keys ?? []).map((k) => String(k.keyName ?? "").trim())
+          );
+        } catch {
+        }
+        const name = pickUniqueKeyName(baseName, existingNames);
+        const body = {
+          teamId: this.teamId,
+          name,
+          serviceConfigurations,
+          scope: "team"
+        };
+        const result = await this.postJson("account/auth/key/v2/create", body);
+        const created = result.body?.keys?.[0] ?? result.body?.key ?? result.body?.data ?? result.body;
+        const keyId = created?.keyId ?? created?.id ?? created?.kid ?? created?.attributes?.kid;
+        if (!keyId) {
+          throw new Error(`createApiKey: no key id in response. Body: ${result.rawText.slice(0, 400)}`);
+        }
+        return { keyId, raw: created };
+      }
+      /**
+       * Fetch a single API key by id via `account/auth/key/get`. Reverse-
+       * engineered from Spaceship's `get_key`. Returns the raw key record so
+       * the caller can extract whatever fields it needs (e.g. issuerId).
+       *
+       * Form-encoded POST — same shape as every other PortalClient mutation
+       * except the JSON `create` endpoint.
+       */
+      async getApiKey(keyId) {
+        const data = await this.post("account/auth/key/get", {
+          teamId: this.teamId,
+          keyId
+        });
+        return data?.keys?.[0] ?? data?.key ?? data?.data ?? data;
+      }
+      /**
+       * Revoke an existing key. Form-encoded POST per Spaceship's
+       * `revoke_key!`. Used for cleaning up orphan keys created during
+       * failed wizard runs.
+       */
+      async revokeApiKey(keyId) {
+        await this.post("account/auth/key/revoke", {
+          teamId: this.teamId,
+          keyId
+        });
+      }
+      // ── APNs Authentication Keys (.p8) ──────────────────────────────────────
+      /** Apple's hardcoded service id for APNs auth keys (from Spaceship). */
+      static APNS_SERVICE_ID = "U27F4V844T";
+      /**
+       * Create an APNs Authentication Key (.p8) via the developer portal.
+       *
+       * Apple requires BOTH `serviceConfigurations` (the map) AND
+       * `serviceConfigurationsRequests` (the array of full config objects)
+       * in the v2/create body. Just sending the map alone results in
+       * "No value was provided for the parameter 'serviceConfigurations'".
+       *
+       * The exact body comes from @expo/apple-utils v2.1.21 — both fields
+       * are produced by separate functions (`d` for the map, `h` for the
+       * array) and merged into the create payload.
+       *
+       * Apple also rejects duplicate key names ("Another key with same
+       * name exists") — we dedupe by listing existing keys first and
+       * appending " (N)" until we find a free slot, mirroring the
+       * provisioning profile dedup.
+       */
+      async createApnsAuthKey(rawName) {
+        const baseName = rawName.replace(/[^A-Za-z0-9 _\-.]/g, " ").replace(/\s+/g, " ").trim().slice(0, 45);
+        if (!baseName) throw new Error("createApnsAuthKey: name is empty after sanitization");
+        let existingNames = /* @__PURE__ */ new Set();
+        try {
+          const list = await this.listApiKeys();
+          existingNames = new Set(
+            (list.keys ?? []).map((k) => String(k.keyName ?? "").trim())
+          );
+        } catch {
+        }
+        const name = pickUniqueKeyName(baseName, existingNames);
+        const body = {
+          teamId: this.teamId,
+          name,
+          serviceConfigurations: {
+            [_PortalClient.APNS_SERVICE_ID]: []
+          },
+          serviceConfigurationsRequests: [
+            {
+              isNew: true,
+              serviceId: _PortalClient.APNS_SERVICE_ID,
+              identifiers: {},
+              environment: "all",
+              scope: "team"
+            }
+          ],
+          scope: "team"
+        };
+        const result = await this.postJson("account/auth/key/v2/create", body);
+        const created = result.body?.keys?.[0];
+        if (!created?.keyId) {
+          throw new Error(`createApnsAuthKey: no key id in response. Body: ${result.rawText.slice(0, 400)}`);
+        }
+        const pem = await this.downloadApiKey(created.keyId);
+        return { keyId: created.keyId, pem, raw: created };
+      }
+      /**
+       * Find existing APNs auth keys in the team. Used by the wizard to
+       * detect "you already have one" cases and offer to reuse rather than
+       * proliferate keys.
+       */
+      async listApnsAuthKeys() {
+        const list = await this.listApiKeys();
+        return (list.keys ?? []).filter(
+          (k) => (k.services ?? []).some((s) => s.id === _PortalClient.APNS_SERVICE_ID || /apns/i.test(s.name ?? ""))
+        ).map((k) => ({
+          keyId: k.keyId,
+          keyName: k.keyName,
+          canDownload: Boolean(k.canDownload)
+        }));
+      }
+      /**
+       * Download an existing App Store Connect API key as PEM. Spaceship's
+       * `download_key` endpoint — GET with teamId + keyId in query string.
+       * Returns the raw .p8 PEM text. Apple shows the .p8 exactly once
+       * (after creation), so call this immediately after createApiKey.
+       */
+      async downloadApiKey(keyId) {
+        const { status, rawText, contentType } = await this.getRaw("account/auth/key/download", {
+          teamId: this.teamId,
+          keyId
+        });
+        if (status !== 200) {
+          throw new Error(`downloadApiKey failed (${status}): ${rawText.slice(0, 200)}`);
+        }
+        if (rawText.includes("BEGIN PRIVATE KEY")) return rawText;
+        if (contentType.includes("json")) {
+          try {
+            const parsed = JSON.parse(rawText);
+            const candidates = [
+              parsed?.privateKey,
+              parsed?.key?.privateKey,
+              parsed?.keys?.[0]?.privateKey,
+              parsed?.data?.attributes?.privateKey,
+              parsed?.value
+            ];
+            for (const c of candidates) {
+              if (typeof c === "string" && c.includes("BEGIN PRIVATE KEY")) return c;
+            }
+          } catch {
+          }
+        }
+        throw new Error(`downloadApiKey returned no PEM. Content-Type=${contentType} body=${rawText.slice(0, 300)}`);
+      }
+      /**
+       * List existing API keys via the portal. Used to discover the team's
+       * issuer id — every key in the team shares the same issuer id, and
+       * altool needs it alongside the key id and .p8 file.
+       *
+       * Form-encoded POST (NOT JSON), with pagination params, per Spaceship's
+       * `list_keys` method. JSON returned 415 from this endpoint.
+       */
+      async listApiKeys() {
+        const data = await this.post("account/auth/key/list", {
+          teamId: this.teamId,
+          pageNumber: "1",
+          pageSize: "500",
+          sort: "name=asc"
+        });
+        const keys = data?.keys ?? [];
+        const issuerId = data?.issuerId ?? data?.issuer ?? data?.team?.issuerId ?? keys[0]?.issuerId ?? keys[0]?.issuer;
+        return { keys, issuerId };
+      }
       async post(path, params) {
         const body = new URLSearchParams();
         for (const [k, v] of Object.entries(params)) {
@@ -6409,6 +6708,31 @@ var init_portal = __esm({
       async deleteAppId(appIdId) {
         await this.post("account/ios/identifiers/deleteAppId.action", { teamId: this.teamId, appIdId });
       }
+      /**
+       * Toggle a capability (a.k.a. "service") on a bundle ID. Mirrors
+       * Spaceship::Portal's `update_service` — the legacy portal endpoint
+       * still works and is the only session-cookie-authenticated way to flip
+       * capabilities like Push Notifications and Sign in with Apple from
+       * outside the Apple Developer web UI.
+       *
+       * Common service codes (from Spaceship portal/portal_client.rb):
+       *   push          → push notifications
+       *   APG3427HIY    → Sign in with Apple
+       *   IAD53UNK2F    → in-app purchase
+       *   homeKit       → HomeKit
+       *   healthKit     → HealthKit
+       *
+       * @param featureType  Apple's internal capability key (string code or short name)
+       * @param enabled      true → turn on, false → turn off
+       */
+      async setBundleCapability(params) {
+        await this.post("account/ios/identifiers/updateAppService.action", {
+          teamId: this.teamId,
+          displayId: params.appIdId,
+          featureType: params.featureType,
+          featureValue: params.enabled ? "on" : "off"
+        });
+      }
       // ── Certificates ───────────────────────────────────────────────────────
       async listCertificates(types) {
         const iosTypes = types ?? [
@@ -6426,12 +6750,21 @@ var init_portal = __esm({
         return data.certRequests ?? [];
       }
       async listPushCertificates() {
+        const types = Array.from(
+          /* @__PURE__ */ new Set([
+            _PortalClient.CERT_TYPES.IOS_PRODUCTION_PUSH,
+            _PortalClient.CERT_TYPES.IOS_DEVELOPMENT_PUSH,
+            // Legacy push codes from OLDER_IOS_CERTIFICATE_TYPES
+            "3BQKVH9I2X",
+            "BKLRAVXMGM"
+          ])
+        );
         const data = await this.post("account/ios/certificate/listCertRequests.action", {
           teamId: this.teamId,
           pageSize: "500",
           pageNumber: "1",
           sort: "certRequestStatusCode=asc",
-          types: [_PortalClient.CERT_TYPES.IOS_PRODUCTION_PUSH, _PortalClient.CERT_TYPES.IOS_DEVELOPMENT_PUSH].join(",")
+          types: types.join(",")
         });
         return data.certRequests ?? [];
       }
@@ -6573,18 +6906,332 @@ var init_portal = __esm({
   }
 });
 
+// src/client/iris.ts
+var IRIS_BASE, IrisClient, IrisAuthError;
+var init_iris = __esm({
+  "src/client/iris.ts"() {
+    IRIS_BASE = "https://appstoreconnect.apple.com/iris/v1";
+    IrisClient = class {
+      constructor(session) {
+        this.session = session;
+        this.cookieStr = Object.entries(session.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+      }
+      session;
+      cookieStr;
+      buildHeaders() {
+        return {
+          Cookie: this.cookieStr,
+          Accept: "application/vnd.api+json, application/json, text/plain, */*",
+          "Content-Type": "application/vnd.api+json",
+          "X-Requested-With": "XMLHttpRequest",
+          // Mimic the App Store Connect web UI's user agent
+          "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15"
+        };
+      }
+      /**
+       * Issue a request and absorb any new cookies (Apple rotates session
+       * cookies on a lot of iris calls).
+       */
+      async request(method, path, body) {
+        const headers = this.buildHeaders();
+        if (process.env.FASTNODE_DEBUG) {
+          console.log(`[iris] ${method} ${path}${body ? ` body=${JSON.stringify(body).slice(0, 200)}` : ""}`);
+        }
+        const res = await fetch(`${IRIS_BASE}${path}`, {
+          method,
+          headers,
+          body: body ? JSON.stringify(body) : void 0
+        });
+        for (const raw of res.headers.getSetCookie?.() ?? []) {
+          const m = raw.match(/^([^=]+)=([^;]*)/);
+          if (m) {
+            this.session.cookies[m[1]] = m[2];
+          }
+        }
+        this.cookieStr = Object.entries(this.session.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+        const text = await res.text();
+        let parsed = null;
+        try {
+          parsed = text ? JSON.parse(text) : null;
+        } catch {
+        }
+        if (process.env.FASTNODE_DEBUG) {
+          console.log(`[iris] \u2192 ${res.status} ${text.slice(0, 300)}`);
+        }
+        return { status: res.status, body: parsed, rawText: text };
+      }
+      /**
+       * List existing API keys. Used both as a sanity check (the user has
+       * permission) and to discover the team's issuer id (which is the same
+       * for every key in the team and is needed by altool).
+       *
+       * Important: Apple's iris endpoint rejects most query parameters with
+       * `PARAMETER_ERROR.INVALID`. Call with no params and let the API return
+       * its default page.
+       */
+      async listApiKeys() {
+        const { status, body, rawText } = await this.request("GET", "/apiKeys");
+        if (status === 403) {
+          throw new IrisAuthError(
+            "You don't have permission to manage App Store Connect API keys (this requires the Account Holder or Admin role)."
+          );
+        }
+        if (status >= 400 || !body) {
+          throw new Error(`iris listApiKeys failed (${status}): ${rawText.slice(0, 200)}`);
+        }
+        const issuerId = body?.meta?.issuerId ?? body?.data?.[0]?.attributes?.issuerId;
+        const keys = (body.data ?? []).map((d) => ({
+          id: d.id,
+          kid: d.attributes?.kid ?? d.id,
+          nickname: d.attributes?.nickname ?? "",
+          issuerId: d.attributes?.issuerId ?? issuerId,
+          roles: d.attributes?.roles ?? [],
+          allAppsVisible: d.attributes?.allAppsVisible ?? true
+        }));
+        return { keys, issuerId };
+      }
+      /**
+       * Create a new API key. Apple returns the .p8 PEM exactly once in the
+       * create response — capture it immediately or the key is dead weight.
+       *
+       * `keyType` is required by Apple's iris API:
+       *   • PUBLIC_API     — the standard team-wide API key (what TestFlight uploads need)
+       *   • MARKETING_API  — for App Analytics access only
+       */
+      async createApiKey(input) {
+        const requestBody = {
+          data: {
+            type: "apiKeys",
+            attributes: {
+              nickname: input.nickname,
+              roles: input.roles ?? ["APP_MANAGER"],
+              allAppsVisible: input.allAppsVisible ?? true,
+              keyType: input.keyType ?? "PUBLIC_API"
+            }
+          }
+        };
+        console.log("[iris] createApiKey request:", JSON.stringify(requestBody));
+        const { status, body, rawText } = await this.request("POST", "/apiKeys", requestBody);
+        console.log(`[iris] createApiKey response: ${status} ${rawText.slice(0, 800)}`);
+        if (status === 403) {
+          throw new IrisAuthError(
+            "You don't have permission to create App Store Connect API keys (this requires the Account Holder or Admin role)."
+          );
+        }
+        if (status >= 400 || !body) {
+          const msg = body?.errors?.[0]?.detail ?? body?.errors?.[0]?.title ?? rawText.slice(0, 300) ?? `iris createApiKey failed (${status})`;
+          throw new Error(msg);
+        }
+        const data = body.data ?? body;
+        if (!data?.id) {
+          throw new Error(`iris createApiKey returned no key id. Raw response: ${rawText.slice(0, 400)}`);
+        }
+        const key = {
+          id: data.id,
+          kid: data.attributes?.kid ?? data.id,
+          nickname: data.attributes?.nickname ?? input.nickname,
+          privateKey: data.attributes?.privateKey,
+          issuerId: data.attributes?.issuerId,
+          roles: data.attributes?.roles ?? input.roles ?? ["APP_MANAGER"],
+          allAppsVisible: data.attributes?.allAppsVisible ?? true
+        };
+        return key;
+      }
+      /**
+       * Fetch the .p8 PEM AND the team's issuer id for a previously-created
+       * ASC API key. Both come back in a single request via:
+       *
+       *   GET /iris/v1/apiKeys/{id}?fields[apiKeys]=privateKey&include=provider
+       *
+       * Sparse fieldset requesting ONLY `privateKey` is the magic that makes
+       * Apple actually include the (base64-encoded) PEM in the response —
+       * the default view returns `privateKey: null`. The `include=provider`
+       * pulls the team's contentProvider record into `included[]`, and its
+       * `id` field IS the issuer id altool needs (a UUID like
+       * `cfadaf94-44ca-4c2c-8fa6-ecc28d3c7d0d`).
+       *
+       * Reverse-engineered from @expo/apple-utils v2.1.21 (the package that
+       * powers EAS CLI), specifically the `ApiKey.downloadAsync` method
+       * combined with `ApiKey.infoAsync` reading `provider?.id`.
+       *
+       * Returns `{ pem, issuerId }`, or `null` if Apple won't return the
+       * private key (typically because the key was already downloaded once).
+       */
+      async fetchApiKeyPrivateKey(keyId) {
+        try {
+          const url = `${IRIS_BASE}/apiKeys/${keyId}?fields%5BapiKeys%5D=privateKey&include=provider`;
+          const res = await fetch(url, {
+            headers: {
+              ...this.buildHeaders(),
+              Accept: "application/vnd.api+json, application/json, text/plain, */*"
+            }
+          });
+          const text = await res.text();
+          console.log(`[iris] fetchApiKeyPrivateKey \u2192 ${res.status} (${text.length} bytes)`);
+          if (res.status !== 200) {
+            console.log(`[iris]   err: ${text.slice(0, 300)}`);
+            return null;
+          }
+          const body = JSON.parse(text);
+          const encoded = body?.data?.attributes?.privateKey;
+          if (typeof encoded !== "string" || encoded.length === 0) {
+            console.log(`[iris]   no privateKey in response`);
+            return null;
+          }
+          const pem = Buffer.from(encoded, "base64").toString("utf-8");
+          if (!pem.includes("BEGIN PRIVATE KEY")) {
+            console.log(`[iris]   decoded body didn't contain PEM marker`);
+            return null;
+          }
+          const provider = (body?.included ?? []).find((i) => i.type === "contentProviders");
+          const issuerId = provider?.id;
+          console.log(`[iris] \u2713 PEM ${pem.length} bytes, issuerId=${issuerId ?? "(missing)"}`);
+          return { pem, issuerId };
+        } catch (err) {
+          console.log(`[iris] fetchApiKeyPrivateKey error: ${err.message}`);
+          return null;
+        }
+      }
+      /**
+       * @deprecated Kept as a fallback probe for debugging. The real path
+       * is the sparse fieldset above — everything in this brute-force list
+       * returned 404 during testing. Left here so we can re-verify if Apple
+       * changes anything.
+       */
+      async fetchApiKeyPrivateKeyBruteForce(keyId) {
+        const attempts = [
+          // Sparse fieldsets — JSON-API spec lets us request specific attributes.
+          // Apple may exclude privateKey by default and return it only when asked.
+          { kind: "GET", path: `/apiKeys/${keyId}?fields[apiKeys]=privateKey,kid,issuerId,nickname,roles` },
+          { kind: "GET", path: `/apiKeys/${keyId}?include=privateKey` },
+          { kind: "GET", path: `/apiKeys/${keyId}?fields[apiKeys]=privateKey` },
+          // Custom Accept headers — maybe Apple negotiates content type
+          { kind: "GET", path: `/apiKeys/${keyId}`, accept: "application/x-pem-file" },
+          { kind: "GET", path: `/apiKeys/${keyId}`, accept: "application/octet-stream" },
+          { kind: "GET", path: `/apiKeys/${keyId}/p8`, accept: "application/x-pem-file" },
+          // POST variants — Apple sometimes uses POST to mint a download token
+          { kind: "POST", path: `/apiKeys/${keyId}/secrets`, body: {} },
+          { kind: "POST", path: `/apiKeys/${keyId}/regenerate`, body: {} },
+          { kind: "POST", path: `/apiKeys/${keyId}/p8`, body: {} },
+          // Bare GET (last) — confirms canonical fields, in case my parser missed any
+          { kind: "GET", path: `/apiKeys/${keyId}` },
+          // Different host — the legacy developer.apple.com user-and-access namespace
+          { kind: "ABSOLUTE", url: `https://appstoreconnect.apple.com/api/v1/apiKeys/${keyId}/p8` },
+          { kind: "ABSOLUTE", url: `https://appstoreconnect.apple.com/access/api/keys/${keyId}/download` }
+        ];
+        for (const attempt of attempts) {
+          try {
+            let result;
+            if (attempt.kind === "GET") {
+              result = await this.requestWithHeaders("GET", attempt.path, void 0, {
+                ...attempt.accept ? { Accept: attempt.accept } : {}
+              });
+              console.log(`[iris] fetchApiKeyPrivateKey GET ${attempt.path}${attempt.accept ? ` accept=${attempt.accept}` : ""} \u2192 ${result.status} (${result.rawText.length} bytes)`);
+            } else if (attempt.kind === "POST") {
+              result = await this.request("POST", attempt.path, attempt.body);
+              console.log(`[iris] fetchApiKeyPrivateKey POST ${attempt.path} \u2192 ${result.status} (${result.rawText.length} bytes)`);
+            } else {
+              result = await this.requestAbsolute("GET", attempt.url);
+              console.log(`[iris] fetchApiKeyPrivateKey GET ${attempt.url} \u2192 ${result.status} (${result.rawText.length} bytes)`);
+            }
+            if (result.status === 200) {
+              console.log(`[iris]   body: ${result.rawText.slice(0, 1500)}`);
+            }
+            if (result.status !== 200) continue;
+            if (result.rawText && result.rawText.includes("BEGIN PRIVATE KEY")) {
+              console.log(`[iris] \u2713 found PEM (plain text response)`);
+              return result.rawText;
+            }
+            if (result.body) {
+              const candidates = [
+                result.body?.data?.attributes?.privateKey,
+                result.body?.data?.attributes?.p8,
+                result.body?.data?.attributes?.privateKeyContent,
+                result.body?.data?.attributes?.kpem,
+                result.body?.data?.attributes?.secret,
+                result.body?.data?.attributes?.keyContent,
+                result.body?.privateKey,
+                result.body?.p8,
+                result.body?.value,
+                result.body?.secret
+              ];
+              for (const c of candidates) {
+                if (typeof c === "string" && c.includes("BEGIN PRIVATE KEY")) {
+                  console.log(`[iris] \u2713 found PEM in JSON response`);
+                  return c;
+                }
+              }
+            }
+          } catch (err) {
+            console.log(`[iris] fetchApiKeyPrivateKey attempt failed: ${err.message}`);
+          }
+        }
+        console.log(`[iris] fetchApiKeyPrivateKey: no working download path for key ${keyId}`);
+        return null;
+      }
+      /** Internal: like request() but lets us override headers. */
+      async requestWithHeaders(method, path, body, extraHeaders = {}) {
+        const headers = { ...this.buildHeaders(), ...extraHeaders };
+        const res = await fetch(`${IRIS_BASE}${path}`, {
+          method,
+          headers,
+          body: body ? JSON.stringify(body) : void 0
+        });
+        for (const raw of res.headers.getSetCookie?.() ?? []) {
+          const m = raw.match(/^([^=]+)=([^;]*)/);
+          if (m) this.session.cookies[m[1]] = m[2];
+        }
+        this.cookieStr = Object.entries(this.session.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+        const text = await res.text();
+        let parsed = null;
+        try {
+          parsed = text ? JSON.parse(text) : null;
+        } catch {
+        }
+        return { status: res.status, body: parsed, rawText: text };
+      }
+      /** Internal: fetch an absolute URL with the session cookies. */
+      async requestAbsolute(method, url) {
+        const headers = this.buildHeaders();
+        const res = await fetch(url, { method, headers });
+        const text = await res.text();
+        let parsed = null;
+        try {
+          parsed = text ? JSON.parse(text) : null;
+        } catch {
+        }
+        return { status: res.status, body: parsed, rawText: text };
+      }
+      async deleteApiKey(keyId) {
+        await this.request("DELETE", `/apiKeys/${keyId}`);
+      }
+    };
+    IrisAuthError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "IrisAuthError";
+      }
+    };
+  }
+});
+
 // src/client/index.ts
 var client_exports = {};
 __export(client_exports, {
   AppStoreConnectClient: () => AppStoreConnectClient,
   AppStoreConnectError: () => AppStoreConnectError,
+  IrisAuthError: () => IrisAuthError,
+  IrisClient: () => IrisClient,
   PortalClient: () => PortalClient,
   ProgramLicenseAgreementError: () => ProgramLicenseAgreementError,
   RateLimitError: () => RateLimitError,
   RequestClient: () => RequestClient,
   TokenManager: () => TokenManager,
+  beginLogin: () => beginLogin,
   checkPortalResponse: () => checkPortalResponse,
-  loginWithAppleId: () => loginWithAppleId
+  loginWithAppleId: () => loginWithAppleId,
+  requestSmsCode: () => requestSmsCode,
+  submitTwoFactorCode: () => submitTwoFactorCode
 });
 var AppStoreConnectClient;
 var init_client = __esm({
@@ -6629,6 +7276,7 @@ var init_client = __esm({
     init_request();
     init_apple_session();
     init_portal();
+    init_iris();
     AppStoreConnectClient = class {
       http;
       certificates;