@sitepong/fastnode 0.1.2 → 0.2.1

package/dist/client/index.mjs

@@ -203,9 +203,9 @@ Please accept the agreement at https://developer.apple.com/account before contin
     throw new Error(msg);
   }
 }
-async function loginWithAppleId(config) {
-  const log = config.onLog ?? console.log;
-  const promptFn = config.onPrompt ?? defaultPrompt;
+async function beginLogin(config) {
+  const log = config.onLog ?? (() => {
+  });
   log("Fetching Apple service key...");
   const serviceKey = await fetchServiceKey();
   const initRes = await fetch(`${AUTH_BASE}/signin?widgetKey=${serviceKey}`, {
@@ -222,27 +222,94 @@ async function loginWithAppleId(config) {
   const cookieStr = Object.entries(initCookies).map(([k, v]) => k.startsWith("DES") ? `${k}="${v}"` : `${k}=${v}`).join("; ");
   log("Starting SIRP Apple ID login...");
   const response = await doSirp(config.email, config.password, serviceKey, cookieStr, hashcash);
-  const session = {
+  const baseState = {
     cookies: { ...initCookies, ...response.cookies },
     sessionId: response.sessionId,
     scnt: response.scnt,
     serviceKey,
-    userEmail: config.email,
-    pendingAgreements: []
+    userEmail: config.email
   };
   if (response.status === 403) {
     throw new Error(`Invalid username and password combination. Used '${config.email}' as the username.`);
-  } else if (response.status === 200) {
-    log("Login successful.");
-    await fetchOlympusSession(session);
-  } else if (response.status === 409) {
-    await handleTwoStepOrFactor(session, log, promptFn);
-    await fetchOlympusSession(session);
-  } else if (response.status === 412) {
+  }
+  if (response.status === 412) {
     throw new Error("Need to acknowledge Apple's Apple ID and Privacy statement. Please manually log into https://appleid.apple.com.");
+  }
+  if (response.status === 200) {
+    log("Login successful (no 2FA).");
+    const session = { ...baseState, pendingAgreements: [] };
+    await finalizeSession(session, log);
+    return { kind: "logged_in", session };
+  }
+  if (response.status === 409) {
+    log("2FA required, fetching challenge...");
+    const challenge = await fetchTwoFactorChallenge(baseState);
+    return { kind: "needs_2fa", pending: baseState, challenge };
+  }
+  throw new Error(`Unexpected login response (${response.status}): ${JSON.stringify(response.body).slice(0, 500)}`);
+}
+async function fetchTwoFactorChallenge(pending) {
+  const r = await fetch(`${AUTH_BASE}`, { headers: buildAuthHeadersFromPending(pending) });
+  const body = await r.json();
+  const trustedPhoneNumbers = (body.trustedPhoneNumbers ?? []).map((p) => ({
+    id: p.id,
+    numberWithDialCode: p.numberWithDialCode,
+    pushMode: p.pushMode
+  }));
+  const phoneOnly = body.noTrustedDevices === true;
+  const codeLength = body.securityCode?.length ?? 6;
+  return {
+    kind: phoneOnly ? "phone_only" : "device",
+    codeLength,
+    trustedPhoneNumbers
+  };
+}
+async function requestSmsCode(input) {
+  await fetch(`${AUTH_BASE}/verify/phone`, {
+    method: "PUT",
+    headers: { ...buildAuthHeadersFromPending(input.pending), "Content-Type": "application/json" },
+    body: JSON.stringify({ phoneNumber: { id: input.phoneId }, mode: input.mode ?? "sms" })
+  });
+}
+async function submitTwoFactorCode(input) {
+  const log = input.onLog ?? (() => {
+  });
+  let path;
+  let body;
+  if (input.source === "device") {
+    path = `${AUTH_BASE}/verify/trusteddevice/securitycode`;
+    body = JSON.stringify({ securityCode: { code: input.code } });
   } else {
-    throw new Error(`Unexpected login response (${response.status}): ${JSON.stringify(response.body).slice(0, 500)}`);
+    if (input.phoneId == null) throw new Error("phoneId is required when source='phone'");
+    path = `${AUTH_BASE}/verify/phone/securitycode`;
+    body = JSON.stringify({
+      securityCode: { code: input.code },
+      phoneNumber: { id: input.phoneId },
+      mode: input.mode ?? "sms"
+    });
   }
+  log("Submitting 2FA code...");
+  const verifyRes = await fetch(path, {
+    method: "POST",
+    headers: { ...buildAuthHeadersFromPending(input.pending), "Content-Type": "application/json" },
+    body
+  });
+  if (!verifyRes.ok) {
+    const err = await verifyRes.json().catch(() => ({}));
+    const msgs = (err?.service_errors ?? err?.serviceErrors ?? []).map((e) => e.message).filter(Boolean);
+    throw new Error(msgs.join("; ") || `Verification failed (${verifyRes.status})`);
+  }
+  const session = {
+    ...input.pending,
+    cookies: { ...input.pending.cookies, ...parseCookies(verifyRes.headers) },
+    pendingAgreements: []
+  };
+  await trustSession(session);
+  await finalizeSession(session, log);
+  return session;
+}
+async function finalizeSession(session, log) {
+  await fetchOlympusSession(session);
   const agreements = await fetchContractMessages(session);
   if (agreements.length > 0) {
     for (const msg of agreements) {
@@ -251,7 +318,53 @@ async function loginWithAppleId(config) {
   }
   session.pendingAgreements = agreements;
   log(`Logged in as ${session.userEmail}`);
-  return session;
+}
+async function loginWithAppleId(config) {
+  const log = config.onLog ?? console.log;
+  const promptFn = config.onPrompt ?? defaultPrompt;
+  const result = await beginLogin({ email: config.email, password: config.password, onLog: log });
+  if (result.kind === "logged_in") return result.session;
+  const { pending, challenge } = result;
+  const phones = challenge.trustedPhoneNumbers;
+  if (challenge.kind === "device") {
+    log("Two-factor Authentication (6 digit code) is enabled for this account");
+    log("(Input 'sms' to escape this prompt and select a trusted phone number to send the code as a text message)");
+    const input = await promptFn(`Please enter the ${challenge.codeLength} digit code: `);
+    if (input.toLowerCase() === "sms") {
+      log("Please select a trusted phone number:");
+      for (let i = 0; i < phones.length; i++) log(`  ${i + 1}. ${phones[i].numberWithDialCode}`);
+      const choice2 = await promptFn("Enter number: ");
+      const phone2 = phones[Math.max(0, parseInt(choice2, 10) - 1)] ?? phones[0];
+      await requestSmsCode({ pending, phoneId: phone2.id, mode: phone2.pushMode });
+      log(`Code sent to ${phone2.numberWithDialCode}`);
+      const code2 = await promptFn(`Please enter the ${challenge.codeLength} digit code: `);
+      return submitTwoFactorCode({ pending, code: code2, source: "phone", phoneId: phone2.id, mode: phone2.pushMode ?? "sms", onLog: log });
+    }
+    return submitTwoFactorCode({ pending, code: input, source: "device", onLog: log });
+  }
+  log("Two-factor Authentication (6 digit code) is enabled for this account");
+  if (phones.length === 1) {
+    const phone2 = phones[0];
+    log(`Code automatically sent to ${phone2.numberWithDialCode}`);
+    const code2 = await promptFn(`Please enter the ${challenge.codeLength} digit code: `);
+    return submitTwoFactorCode({ pending, code: code2, source: "phone", phoneId: phone2.id, mode: phone2.pushMode ?? "sms", onLog: log });
+  }
+  log("Please select a trusted phone number:");
+  for (let i = 0; i < phones.length; i++) log(`  ${i + 1}. ${phones[i].numberWithDialCode}`);
+  const choice = await promptFn("Enter number: ");
+  const phone = phones[Math.max(0, parseInt(choice, 10) - 1)] ?? phones[0];
+  await requestSmsCode({ pending, phoneId: phone.id, mode: phone.pushMode });
+  log(`Code sent to ${phone.numberWithDialCode}`);
+  const code = await promptFn(`Please enter the ${challenge.codeLength} digit code: `);
+  return submitTwoFactorCode({ pending, code, source: "phone", phoneId: phone.id, mode: phone.pushMode ?? "sms", onLog: log });
+}
+function buildAuthHeadersFromPending(pending) {
+  const h = { "X-Apple-Widget-Key": pending.serviceKey, Accept: "application/json" };
+  if (pending.sessionId) h["X-Apple-Id-Session-Id"] = pending.sessionId;
+  if (pending.scnt) h["scnt"] = pending.scnt;
+  const c = Object.entries(pending.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+  if (c) h["Cookie"] = c;
+  return h;
 }
 async function doSirp(user, password, serviceKey, cookieStr, hashcash) {
   const client = new SRPClient(2048);
@@ -307,99 +420,6 @@ async function doSirp(user, password, serviceKey, cookieStr, hashcash) {
     scnt: completeRes.headers.get("scnt") ?? ""
   };
 }
-async function handleTwoStepOrFactor(session, log, promptFn) {
-  const r = await fetch(`${AUTH_BASE}`, { headers: buildAuthHeaders(session) });
-  const body = await r.json();
-  if (body.trustedDevices?.length > 0) {
-    await handleTwoStep(session, body, log, promptFn);
-  } else if (body.trustedPhoneNumbers?.length > 0) {
-    await handleTwoFactor(session, body, log, promptFn);
-  } else {
-    throw new Error("2FA required but no trusted devices or phone numbers found.");
-  }
-}
-async function handleTwoFactor(session, authBody, log, promptFn) {
-  log("Two-factor Authentication (6 digit code) is enabled for this account");
-  const codeLength = authBody.securityCode?.length ?? 6;
-  const phones = authBody.trustedPhoneNumbers ?? [];
-  const noTrusted = authBody.noTrustedDevices === true;
-  let codeType;
-  let reqBody;
-  if (noTrusted && phones.length === 1) {
-    const phone = phones[0];
-    log(`Code automatically sent to ${phone.numberWithDialCode}`);
-    const code = await promptFn(`Please enter the ${codeLength} digit code you received at ${phone.numberWithDialCode}: `);
-    codeType = "phone";
-    reqBody = JSON.stringify({ securityCode: { code }, phoneNumber: { id: phone.id }, mode: phone.pushMode ?? "sms" });
-  } else if (noTrusted) {
-    const phone = await choosePhone(phones, log, promptFn);
-    await requestPhoneCode(session, phone);
-    log(`Successfully requested text message to ${phone.numberWithDialCode}`);
-    const code = await promptFn(`Please enter the ${codeLength} digit code: `);
-    codeType = "phone";
-    reqBody = JSON.stringify({ securityCode: { code }, phoneNumber: { id: phone.id }, mode: phone.pushMode ?? "sms" });
-  } else {
-    log("(Input 'sms' to escape this prompt and select a trusted phone number to send the code as a text message)");
-    const input = await promptFn(`Please enter the ${codeLength} digit code: `);
-    if (input.toLowerCase() === "sms") {
-      const phone = await choosePhone(phones, log, promptFn);
-      await requestPhoneCode(session, phone);
-      const code = await promptFn(`Please enter the ${codeLength} digit code sent to ${phone.numberWithDialCode}: `);
-      codeType = "phone";
-      reqBody = JSON.stringify({ securityCode: { code }, phoneNumber: { id: phone.id }, mode: phone.pushMode ?? "sms" });
-    } else {
-      codeType = "trusteddevice";
-      reqBody = JSON.stringify({ securityCode: { code: input } });
-    }
-  }
-  log("Requesting session...");
-  const verifyRes = await fetch(`${AUTH_BASE}/verify/${codeType}/securitycode`, {
-    method: "POST",
-    headers: { ...buildAuthHeaders(session), "Content-Type": "application/json" },
-    body: reqBody
-  });
-  if (!verifyRes.ok) {
-    const err = await verifyRes.json().catch(() => ({}));
-    const msgs = (err?.service_errors ?? err?.serviceErrors ?? []).map((e) => e.message).filter(Boolean);
-    throw new Error(msgs.join("; ") || `Verification failed (${verifyRes.status})`);
-  }
-  Object.assign(session.cookies, parseCookies(verifyRes.headers));
-  await trustSession(session);
-}
-async function handleTwoStep(session, authBody, log, promptFn) {
-  log("Two-step Verification (4 digit code) is enabled for this account");
-  const devices = authBody.trustedDevices ?? [];
-  log("Please select a trusted device:");
-  for (let i = 0; i < devices.length; i++) {
-    log(`  ${i + 1}. ${devices[i].name}	${devices[i].modelName ?? "SMS"}	(${devices[i].id})`);
-  }
-  const choice = await promptFn("Enter device number: ");
-  const device = devices[Math.max(0, parseInt(choice, 10) - 1)] ?? devices[0];
-  await fetch(`${AUTH_BASE}/verify/device/${device.id}/securitycode`, { method: "PUT", headers: buildAuthHeaders(session) });
-  log("Successfully requested notification");
-  const code = await promptFn("Please enter the 4 digit code: ");
-  const verifyRes = await fetch(`${AUTH_BASE}/verify/phone/securitycode`, {
-    method: "POST",
-    headers: { ...buildAuthHeaders(session), "Content-Type": "application/json" },
-    body: JSON.stringify({ phoneNumber: { id: device.id }, securityCode: { code }, mode: "sms" })
-  });
-  if (!verifyRes.ok) throw new Error("Incorrect verification code.");
-  Object.assign(session.cookies, parseCookies(verifyRes.headers));
-  await trustSession(session);
-}
-async function choosePhone(phones, log, promptFn) {
-  log("Please select a trusted phone number:");
-  for (let i = 0; i < phones.length; i++) log(`  ${i + 1}. ${phones[i].numberWithDialCode}`);
-  const choice = await promptFn("Enter number: ");
-  return phones[Math.max(0, parseInt(choice, 10) - 1)] ?? phones[0];
-}
-async function requestPhoneCode(session, phone) {
-  await fetch(`${AUTH_BASE}/verify/phone`, {
-    method: "PUT",
-    headers: { ...buildAuthHeaders(session), "Content-Type": "application/json" },
-    body: JSON.stringify({ phoneNumber: { id: phone.id }, mode: phone.pushMode ?? "sms" })
-  });
-}
 async function trustSession(session) {
   const r = await fetch(`${AUTH_BASE}/2sv/trust`, { headers: buildAuthHeaders(session) });
   Object.assign(session.cookies, parseCookies(r.headers));
@@ -2247,6 +2267,12 @@ var XcodeMetricsResource = class {
 
 // src/client/portal.ts
 var PORTAL_BASE = "https://developer.apple.com/services-account/QH65B2";
+function pickUniqueKeyName(base, taken) {
+  if (!taken.has(base)) return base;
+  let n = 1;
+  while (taken.has(`${base} - ${n}`)) n++;
+  return `${base} - ${n}`;
+}
 var PortalClient = class _PortalClient {
   session;
   teamId;
@@ -2262,6 +2288,279 @@ var PortalClient = class _PortalClient {
   async init() {
     await this.post("account/listTeams.action", {});
   }
+  /**
+   * JSON POST — different content type than the standard form-encoded
+   * `post()`. Used by the App Store Connect API key endpoints
+   * (`account/auth/key/v2/create`), which Spaceship discovered take a
+   * JSON body even though every other portal mutation is form-encoded.
+   *
+   * Like the form-encoded `post()`, this also runs the response through
+   * `checkPortalResponse` — Apple returns HTTP 200 even for errors and
+   * encodes the error in `resultCode`/`userString` fields, so a raw
+   * status check would silently miss real failures.
+   */
+  async postJson(path, body) {
+    const headers = {
+      Cookie: this.cookieStr,
+      "Content-Type": "application/json",
+      Accept: "application/json"
+    };
+    if (this.csrf) {
+      headers["csrf"] = this.csrf;
+      headers["csrf_ts"] = this.csrfTs;
+    }
+    console.log(`[portal] POST(json) ${path}`);
+    const res = await fetch(`${PORTAL_BASE}/${path}`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body)
+    });
+    if (res.headers.get("csrf")) {
+      this.csrf = res.headers.get("csrf");
+      this.csrfTs = res.headers.get("csrf_ts") ?? "";
+    }
+    for (const raw of res.headers.getSetCookie?.() ?? []) {
+      const m = raw.match(/^([^=]+)=([^;]*)/);
+      if (m && !this.cookieStr.includes(m[1] + "=")) this.cookieStr += "; " + m[1] + "=" + m[2];
+    }
+    const text = await res.text();
+    let data = null;
+    try {
+      data = text ? JSON.parse(text) : null;
+    } catch {
+    }
+    console.log(`[portal] POST(json) ${path} \u2192 ${res.status} ${text.slice(0, 400)}`);
+    checkPortalResponse(data, this.session);
+    return { status: res.status, body: data, rawText: text };
+  }
+  /**
+   * GET helper for the portal endpoints that take query parameters
+   * (currently just `account/auth/key/download`). Returns the raw text
+   * since download endpoints can return PEMs or JSON depending on Apple's
+   * mood — caller decides how to parse.
+   */
+  async getRaw(path, params = {}) {
+    const url = new URL(`${PORTAL_BASE}/${path}`);
+    for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
+    const headers = {
+      Cookie: this.cookieStr,
+      Accept: "application/json, text/plain, application/x-pem-file, */*"
+    };
+    if (this.csrf) {
+      headers["csrf"] = this.csrf;
+      headers["csrf_ts"] = this.csrfTs;
+    }
+    console.log(`[portal] GET ${url.pathname}${url.search}`);
+    const res = await fetch(url.toString(), { headers });
+    for (const raw of res.headers.getSetCookie?.() ?? []) {
+      const m = raw.match(/^([^=]+)=([^;]*)/);
+      if (m && !this.cookieStr.includes(m[1] + "=")) this.cookieStr += "; " + m[1] + "=" + m[2];
+    }
+    const text = await res.text();
+    const contentType = res.headers.get("content-type") ?? "";
+    console.log(`[portal] GET ${url.pathname} \u2192 ${res.status} ${contentType} ${text.length}b`);
+    return { status: res.status, rawText: text, contentType };
+  }
+  // ── App Store Connect API Keys (.p8) ────────────────────────────────────
+  /**
+   * Create an App Store Connect API key via the developer portal's
+   * `account/auth/key/v2/create` endpoint. Reverse-engineered from the
+   * _current_ @expo/apple-utils npm package (v2.1.21), which is what
+   * EAS CLI uses to manage Apple credentials in production.
+   *
+   * This differs from older published reverse-engineering guides:
+   *   • URL uses the `/v2/create` suffix (Apple kept it)
+   *   • Field is `serviceConfigurations`, shape is an object keyed by
+   *     service id (NOT `serviceConfigurationsRequests: [...]` array)
+   *   • Body REQUIRES `scope: "team"`
+   *   • Needs a scope-specific CSRF warmup via the `keys` endpoint
+   *     before the create call (EAS's `ensureCSRFAsync("keys", …)`)
+   *
+   * For an App Store Connect API key (PUBLIC_API, used by altool for
+   * TestFlight uploads), `serviceConfigurations` is an empty object `{}`.
+   * For an APNs auth key, it's `{ "U27F4V844T": [] }`. For MusicKit:
+   * `{ "6A7HVUVQ3M": [musicId] }`, etc.
+   *
+   * Apple's name validator rejects parentheses, brackets, and most
+   * punctuation — sanitize to alphanumeric + space + dash + underscore
+   * + period and collapse whitespace.
+   */
+  async createApiKey(rawName, serviceConfigurations = {}) {
+    const baseName = rawName.replace(/[^A-Za-z0-9 _\-.]/g, " ").replace(/\s+/g, " ").trim().slice(0, 45);
+    if (!baseName) throw new Error("createApiKey: name is empty after sanitization");
+    let existingNames = /* @__PURE__ */ new Set();
+    try {
+      const list = await this.listApiKeys();
+      existingNames = new Set(
+        (list.keys ?? []).map((k) => String(k.keyName ?? "").trim())
+      );
+    } catch {
+    }
+    const name = pickUniqueKeyName(baseName, existingNames);
+    const body = {
+      teamId: this.teamId,
+      name,
+      serviceConfigurations,
+      scope: "team"
+    };
+    const result = await this.postJson("account/auth/key/v2/create", body);
+    const created = result.body?.keys?.[0] ?? result.body?.key ?? result.body?.data ?? result.body;
+    const keyId = created?.keyId ?? created?.id ?? created?.kid ?? created?.attributes?.kid;
+    if (!keyId) {
+      throw new Error(`createApiKey: no key id in response. Body: ${result.rawText.slice(0, 400)}`);
+    }
+    return { keyId, raw: created };
+  }
+  /**
+   * Fetch a single API key by id via `account/auth/key/get`. Reverse-
+   * engineered from Spaceship's `get_key`. Returns the raw key record so
+   * the caller can extract whatever fields it needs (e.g. issuerId).
+   *
+   * Form-encoded POST — same shape as every other PortalClient mutation
+   * except the JSON `create` endpoint.
+   */
+  async getApiKey(keyId) {
+    const data = await this.post("account/auth/key/get", {
+      teamId: this.teamId,
+      keyId
+    });
+    return data?.keys?.[0] ?? data?.key ?? data?.data ?? data;
+  }
+  /**
+   * Revoke an existing key. Form-encoded POST per Spaceship's
+   * `revoke_key!`. Used for cleaning up orphan keys created during
+   * failed wizard runs.
+   */
+  async revokeApiKey(keyId) {
+    await this.post("account/auth/key/revoke", {
+      teamId: this.teamId,
+      keyId
+    });
+  }
+  // ── APNs Authentication Keys (.p8) ──────────────────────────────────────
+  /** Apple's hardcoded service id for APNs auth keys (from Spaceship). */
+  static APNS_SERVICE_ID = "U27F4V844T";
+  /**
+   * Create an APNs Authentication Key (.p8) via the developer portal.
+   *
+   * Apple requires BOTH `serviceConfigurations` (the map) AND
+   * `serviceConfigurationsRequests` (the array of full config objects)
+   * in the v2/create body. Just sending the map alone results in
+   * "No value was provided for the parameter 'serviceConfigurations'".
+   *
+   * The exact body comes from @expo/apple-utils v2.1.21 — both fields
+   * are produced by separate functions (`d` for the map, `h` for the
+   * array) and merged into the create payload.
+   *
+   * Apple also rejects duplicate key names ("Another key with same
+   * name exists") — we dedupe by listing existing keys first and
+   * appending " (N)" until we find a free slot, mirroring the
+   * provisioning profile dedup.
+   */
+  async createApnsAuthKey(rawName) {
+    const baseName = rawName.replace(/[^A-Za-z0-9 _\-.]/g, " ").replace(/\s+/g, " ").trim().slice(0, 45);
+    if (!baseName) throw new Error("createApnsAuthKey: name is empty after sanitization");
+    let existingNames = /* @__PURE__ */ new Set();
+    try {
+      const list = await this.listApiKeys();
+      existingNames = new Set(
+        (list.keys ?? []).map((k) => String(k.keyName ?? "").trim())
+      );
+    } catch {
+    }
+    const name = pickUniqueKeyName(baseName, existingNames);
+    const body = {
+      teamId: this.teamId,
+      name,
+      serviceConfigurations: {
+        [_PortalClient.APNS_SERVICE_ID]: []
+      },
+      serviceConfigurationsRequests: [
+        {
+          isNew: true,
+          serviceId: _PortalClient.APNS_SERVICE_ID,
+          identifiers: {},
+          environment: "all",
+          scope: "team"
+        }
+      ],
+      scope: "team"
+    };
+    const result = await this.postJson("account/auth/key/v2/create", body);
+    const created = result.body?.keys?.[0];
+    if (!created?.keyId) {
+      throw new Error(`createApnsAuthKey: no key id in response. Body: ${result.rawText.slice(0, 400)}`);
+    }
+    const pem = await this.downloadApiKey(created.keyId);
+    return { keyId: created.keyId, pem, raw: created };
+  }
+  /**
+   * Find existing APNs auth keys in the team. Used by the wizard to
+   * detect "you already have one" cases and offer to reuse rather than
+   * proliferate keys.
+   */
+  async listApnsAuthKeys() {
+    const list = await this.listApiKeys();
+    return (list.keys ?? []).filter(
+      (k) => (k.services ?? []).some((s) => s.id === _PortalClient.APNS_SERVICE_ID || /apns/i.test(s.name ?? ""))
+    ).map((k) => ({
+      keyId: k.keyId,
+      keyName: k.keyName,
+      canDownload: Boolean(k.canDownload)
+    }));
+  }
+  /**
+   * Download an existing App Store Connect API key as PEM. Spaceship's
+   * `download_key` endpoint — GET with teamId + keyId in query string.
+   * Returns the raw .p8 PEM text. Apple shows the .p8 exactly once
+   * (after creation), so call this immediately after createApiKey.
+   */
+  async downloadApiKey(keyId) {
+    const { status, rawText, contentType } = await this.getRaw("account/auth/key/download", {
+      teamId: this.teamId,
+      keyId
+    });
+    if (status !== 200) {
+      throw new Error(`downloadApiKey failed (${status}): ${rawText.slice(0, 200)}`);
+    }
+    if (rawText.includes("BEGIN PRIVATE KEY")) return rawText;
+    if (contentType.includes("json")) {
+      try {
+        const parsed = JSON.parse(rawText);
+        const candidates = [
+          parsed?.privateKey,
+          parsed?.key?.privateKey,
+          parsed?.keys?.[0]?.privateKey,
+          parsed?.data?.attributes?.privateKey,
+          parsed?.value
+        ];
+        for (const c of candidates) {
+          if (typeof c === "string" && c.includes("BEGIN PRIVATE KEY")) return c;
+        }
+      } catch {
+      }
+    }
+    throw new Error(`downloadApiKey returned no PEM. Content-Type=${contentType} body=${rawText.slice(0, 300)}`);
+  }
+  /**
+   * List existing API keys via the portal. Used to discover the team's
+   * issuer id — every key in the team shares the same issuer id, and
+   * altool needs it alongside the key id and .p8 file.
+   *
+   * Form-encoded POST (NOT JSON), with pagination params, per Spaceship's
+   * `list_keys` method. JSON returned 415 from this endpoint.
+   */
+  async listApiKeys() {
+    const data = await this.post("account/auth/key/list", {
+      teamId: this.teamId,
+      pageNumber: "1",
+      pageSize: "500",
+      sort: "name=asc"
+    });
+    const keys = data?.keys ?? [];
+    const issuerId = data?.issuerId ?? data?.issuer ?? data?.team?.issuerId ?? keys[0]?.issuerId ?? keys[0]?.issuer;
+    return { keys, issuerId };
+  }
   async post(path, params) {
     const body = new URLSearchParams();
     for (const [k, v] of Object.entries(params)) {
@@ -2329,6 +2628,31 @@ var PortalClient = class _PortalClient {
   async deleteAppId(appIdId) {
     await this.post("account/ios/identifiers/deleteAppId.action", { teamId: this.teamId, appIdId });
   }
+  /**
+   * Toggle a capability (a.k.a. "service") on a bundle ID. Mirrors
+   * Spaceship::Portal's `update_service` — the legacy portal endpoint
+   * still works and is the only session-cookie-authenticated way to flip
+   * capabilities like Push Notifications and Sign in with Apple from
+   * outside the Apple Developer web UI.
+   *
+   * Common service codes (from Spaceship portal/portal_client.rb):
+   *   push          → push notifications
+   *   APG3427HIY    → Sign in with Apple
+   *   IAD53UNK2F    → in-app purchase
+   *   homeKit       → HomeKit
+   *   healthKit     → HealthKit
+   *
+   * @param featureType  Apple's internal capability key (string code or short name)
+   * @param enabled      true → turn on, false → turn off
+   */
+  async setBundleCapability(params) {
+    await this.post("account/ios/identifiers/updateAppService.action", {
+      teamId: this.teamId,
+      displayId: params.appIdId,
+      featureType: params.featureType,
+      featureValue: params.enabled ? "on" : "off"
+    });
+  }
   // ── Certificates ───────────────────────────────────────────────────────
   async listCertificates(types) {
     const iosTypes = types ?? [
@@ -2346,12 +2670,21 @@ var PortalClient = class _PortalClient {
     return data.certRequests ?? [];
   }
   async listPushCertificates() {
+    const types = Array.from(
+      /* @__PURE__ */ new Set([
+        _PortalClient.CERT_TYPES.IOS_PRODUCTION_PUSH,
+        _PortalClient.CERT_TYPES.IOS_DEVELOPMENT_PUSH,
+        // Legacy push codes from OLDER_IOS_CERTIFICATE_TYPES
+        "3BQKVH9I2X",
+        "BKLRAVXMGM"
+      ])
+    );
     const data = await this.post("account/ios/certificate/listCertRequests.action", {
       teamId: this.teamId,
       pageSize: "500",
       pageNumber: "1",
       sort: "certRequestStatusCode=asc",
-      types: [_PortalClient.CERT_TYPES.IOS_PRODUCTION_PUSH, _PortalClient.CERT_TYPES.IOS_DEVELOPMENT_PUSH].join(",")
+      types: types.join(",")
     });
     return data.certRequests ?? [];
   }
@@ -2491,6 +2824,310 @@ var PortalClient = class _PortalClient {
   ];
 };
 
+// src/client/iris.ts
+var IRIS_BASE = "https://appstoreconnect.apple.com/iris/v1";
+var IrisClient = class {
+  constructor(session) {
+    this.session = session;
+    this.cookieStr = Object.entries(session.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+  }
+  session;
+  cookieStr;
+  buildHeaders() {
+    return {
+      Cookie: this.cookieStr,
+      Accept: "application/vnd.api+json, application/json, text/plain, */*",
+      "Content-Type": "application/vnd.api+json",
+      "X-Requested-With": "XMLHttpRequest",
+      // Mimic the App Store Connect web UI's user agent
+      "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15"
+    };
+  }
+  /**
+   * Issue a request and absorb any new cookies (Apple rotates session
+   * cookies on a lot of iris calls).
+   */
+  async request(method, path, body) {
+    const headers = this.buildHeaders();
+    if (process.env.FASTNODE_DEBUG) {
+      console.log(`[iris] ${method} ${path}${body ? ` body=${JSON.stringify(body).slice(0, 200)}` : ""}`);
+    }
+    const res = await fetch(`${IRIS_BASE}${path}`, {
+      method,
+      headers,
+      body: body ? JSON.stringify(body) : void 0
+    });
+    for (const raw of res.headers.getSetCookie?.() ?? []) {
+      const m = raw.match(/^([^=]+)=([^;]*)/);
+      if (m) {
+        this.session.cookies[m[1]] = m[2];
+      }
+    }
+    this.cookieStr = Object.entries(this.session.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+    const text = await res.text();
+    let parsed = null;
+    try {
+      parsed = text ? JSON.parse(text) : null;
+    } catch {
+    }
+    if (process.env.FASTNODE_DEBUG) {
+      console.log(`[iris] \u2192 ${res.status} ${text.slice(0, 300)}`);
+    }
+    return { status: res.status, body: parsed, rawText: text };
+  }
+  /**
+   * List existing API keys. Used both as a sanity check (the user has
+   * permission) and to discover the team's issuer id (which is the same
+   * for every key in the team and is needed by altool).
+   *
+   * Important: Apple's iris endpoint rejects most query parameters with
+   * `PARAMETER_ERROR.INVALID`. Call with no params and let the API return
+   * its default page.
+   */
+  async listApiKeys() {
+    const { status, body, rawText } = await this.request("GET", "/apiKeys");
+    if (status === 403) {
+      throw new IrisAuthError(
+        "You don't have permission to manage App Store Connect API keys (this requires the Account Holder or Admin role)."
+      );
+    }
+    if (status >= 400 || !body) {
+      throw new Error(`iris listApiKeys failed (${status}): ${rawText.slice(0, 200)}`);
+    }
+    const issuerId = body?.meta?.issuerId ?? body?.data?.[0]?.attributes?.issuerId;
+    const keys = (body.data ?? []).map((d) => ({
+      id: d.id,
+      kid: d.attributes?.kid ?? d.id,
+      nickname: d.attributes?.nickname ?? "",
+      issuerId: d.attributes?.issuerId ?? issuerId,
+      roles: d.attributes?.roles ?? [],
+      allAppsVisible: d.attributes?.allAppsVisible ?? true
+    }));
+    return { keys, issuerId };
+  }
+  /**
+   * Create a new API key. Apple returns the .p8 PEM exactly once in the
+   * create response — capture it immediately or the key is dead weight.
+   *
+   * `keyType` is required by Apple's iris API:
+   *   • PUBLIC_API     — the standard team-wide API key (what TestFlight uploads need)
+   *   • MARKETING_API  — for App Analytics access only
+   */
+  async createApiKey(input) {
+    const requestBody = {
+      data: {
+        type: "apiKeys",
+        attributes: {
+          nickname: input.nickname,
+          roles: input.roles ?? ["APP_MANAGER"],
+          allAppsVisible: input.allAppsVisible ?? true,
+          keyType: input.keyType ?? "PUBLIC_API"
+        }
+      }
+    };
+    console.log("[iris] createApiKey request:", JSON.stringify(requestBody));
+    const { status, body, rawText } = await this.request("POST", "/apiKeys", requestBody);
+    console.log(`[iris] createApiKey response: ${status} ${rawText.slice(0, 800)}`);
+    if (status === 403) {
+      throw new IrisAuthError(
+        "You don't have permission to create App Store Connect API keys (this requires the Account Holder or Admin role)."
+      );
+    }
+    if (status >= 400 || !body) {
+      const msg = body?.errors?.[0]?.detail ?? body?.errors?.[0]?.title ?? rawText.slice(0, 300) ?? `iris createApiKey failed (${status})`;
+      throw new Error(msg);
+    }
+    const data = body.data ?? body;
+    if (!data?.id) {
+      throw new Error(`iris createApiKey returned no key id. Raw response: ${rawText.slice(0, 400)}`);
+    }
+    const key = {
+      id: data.id,
+      kid: data.attributes?.kid ?? data.id,
+      nickname: data.attributes?.nickname ?? input.nickname,
+      privateKey: data.attributes?.privateKey,
+      issuerId: data.attributes?.issuerId,
+      roles: data.attributes?.roles ?? input.roles ?? ["APP_MANAGER"],
+      allAppsVisible: data.attributes?.allAppsVisible ?? true
+    };
+    return key;
+  }
+  /**
+   * Fetch the .p8 PEM AND the team's issuer id for a previously-created
+   * ASC API key. Both come back in a single request via:
+   *
+   *   GET /iris/v1/apiKeys/{id}?fields[apiKeys]=privateKey&include=provider
+   *
+   * Sparse fieldset requesting ONLY `privateKey` is the magic that makes
+   * Apple actually include the (base64-encoded) PEM in the response —
+   * the default view returns `privateKey: null`. The `include=provider`
+   * pulls the team's contentProvider record into `included[]`, and its
+   * `id` field IS the issuer id altool needs (a UUID like
+   * `cfadaf94-44ca-4c2c-8fa6-ecc28d3c7d0d`).
+   *
+   * Reverse-engineered from @expo/apple-utils v2.1.21 (the package that
+   * powers EAS CLI), specifically the `ApiKey.downloadAsync` method
+   * combined with `ApiKey.infoAsync` reading `provider?.id`.
+   *
+   * Returns `{ pem, issuerId }`, or `null` if Apple won't return the
+   * private key (typically because the key was already downloaded once).
+   */
+  async fetchApiKeyPrivateKey(keyId) {
+    try {
+      const url = `${IRIS_BASE}/apiKeys/${keyId}?fields%5BapiKeys%5D=privateKey&include=provider`;
+      const res = await fetch(url, {
+        headers: {
+          ...this.buildHeaders(),
+          Accept: "application/vnd.api+json, application/json, text/plain, */*"
+        }
+      });
+      const text = await res.text();
+      console.log(`[iris] fetchApiKeyPrivateKey \u2192 ${res.status} (${text.length} bytes)`);
+      if (res.status !== 200) {
+        console.log(`[iris]   err: ${text.slice(0, 300)}`);
+        return null;
+      }
+      const body = JSON.parse(text);
+      const encoded = body?.data?.attributes?.privateKey;
+      if (typeof encoded !== "string" || encoded.length === 0) {
+        console.log(`[iris]   no privateKey in response`);
+        return null;
+      }
+      const pem = Buffer.from(encoded, "base64").toString("utf-8");
+      if (!pem.includes("BEGIN PRIVATE KEY")) {
+        console.log(`[iris]   decoded body didn't contain PEM marker`);
+        return null;
+      }
+      const provider = (body?.included ?? []).find((i) => i.type === "contentProviders");
+      const issuerId = provider?.id;
+      console.log(`[iris] \u2713 PEM ${pem.length} bytes, issuerId=${issuerId ?? "(missing)"}`);
+      return { pem, issuerId };
+    } catch (err) {
+      console.log(`[iris] fetchApiKeyPrivateKey error: ${err.message}`);
+      return null;
+    }
+  }
+  /**
+   * @deprecated Kept as a fallback probe for debugging. The real path
+   * is the sparse fieldset above — everything in this brute-force list
+   * returned 404 during testing. Left here so we can re-verify if Apple
+   * changes anything.
+   */
+  async fetchApiKeyPrivateKeyBruteForce(keyId) {
+    const attempts = [
+      // Sparse fieldsets — JSON-API spec lets us request specific attributes.
+      // Apple may exclude privateKey by default and return it only when asked.
+      { kind: "GET", path: `/apiKeys/${keyId}?fields[apiKeys]=privateKey,kid,issuerId,nickname,roles` },
+      { kind: "GET", path: `/apiKeys/${keyId}?include=privateKey` },
+      { kind: "GET", path: `/apiKeys/${keyId}?fields[apiKeys]=privateKey` },
+      // Custom Accept headers — maybe Apple negotiates content type
+      { kind: "GET", path: `/apiKeys/${keyId}`, accept: "application/x-pem-file" },
+      { kind: "GET", path: `/apiKeys/${keyId}`, accept: "application/octet-stream" },
+      { kind: "GET", path: `/apiKeys/${keyId}/p8`, accept: "application/x-pem-file" },
+      // POST variants — Apple sometimes uses POST to mint a download token
+      { kind: "POST", path: `/apiKeys/${keyId}/secrets`, body: {} },
+      { kind: "POST", path: `/apiKeys/${keyId}/regenerate`, body: {} },
+      { kind: "POST", path: `/apiKeys/${keyId}/p8`, body: {} },
+      // Bare GET (last) — confirms canonical fields, in case my parser missed any
+      { kind: "GET", path: `/apiKeys/${keyId}` },
+      // Different host — the legacy developer.apple.com user-and-access namespace
+      { kind: "ABSOLUTE", url: `https://appstoreconnect.apple.com/api/v1/apiKeys/${keyId}/p8` },
+      { kind: "ABSOLUTE", url: `https://appstoreconnect.apple.com/access/api/keys/${keyId}/download` }
+    ];
+    for (const attempt of attempts) {
+      try {
+        let result;
+        if (attempt.kind === "GET") {
+          result = await this.requestWithHeaders("GET", attempt.path, void 0, {
+            ...attempt.accept ? { Accept: attempt.accept } : {}
+          });
+          console.log(`[iris] fetchApiKeyPrivateKey GET ${attempt.path}${attempt.accept ? ` accept=${attempt.accept}` : ""} \u2192 ${result.status} (${result.rawText.length} bytes)`);
+        } else if (attempt.kind === "POST") {
+          result = await this.request("POST", attempt.path, attempt.body);
+          console.log(`[iris] fetchApiKeyPrivateKey POST ${attempt.path} \u2192 ${result.status} (${result.rawText.length} bytes)`);
+        } else {
+          result = await this.requestAbsolute("GET", attempt.url);
+          console.log(`[iris] fetchApiKeyPrivateKey GET ${attempt.url} \u2192 ${result.status} (${result.rawText.length} bytes)`);
+        }
+        if (result.status === 200) {
+          console.log(`[iris]   body: ${result.rawText.slice(0, 1500)}`);
+        }
+        if (result.status !== 200) continue;
+        if (result.rawText && result.rawText.includes("BEGIN PRIVATE KEY")) {
+          console.log(`[iris] \u2713 found PEM (plain text response)`);
+          return result.rawText;
+        }
+        if (result.body) {
+          const candidates = [
+            result.body?.data?.attributes?.privateKey,
+            result.body?.data?.attributes?.p8,
+            result.body?.data?.attributes?.privateKeyContent,
+            result.body?.data?.attributes?.kpem,
+            result.body?.data?.attributes?.secret,
+            result.body?.data?.attributes?.keyContent,
+            result.body?.privateKey,
+            result.body?.p8,
+            result.body?.value,
+            result.body?.secret
+          ];
+          for (const c of candidates) {
+            if (typeof c === "string" && c.includes("BEGIN PRIVATE KEY")) {
+              console.log(`[iris] \u2713 found PEM in JSON response`);
+              return c;
+            }
+          }
+        }
+      } catch (err) {
+        console.log(`[iris] fetchApiKeyPrivateKey attempt failed: ${err.message}`);
+      }
+    }
+    console.log(`[iris] fetchApiKeyPrivateKey: no working download path for key ${keyId}`);
+    return null;
+  }
+  /** Internal: like request() but lets us override headers. */
+  async requestWithHeaders(method, path, body, extraHeaders = {}) {
+    const headers = { ...this.buildHeaders(), ...extraHeaders };
+    const res = await fetch(`${IRIS_BASE}${path}`, {
+      method,
+      headers,
+      body: body ? JSON.stringify(body) : void 0
+    });
+    for (const raw of res.headers.getSetCookie?.() ?? []) {
+      const m = raw.match(/^([^=]+)=([^;]*)/);
+      if (m) this.session.cookies[m[1]] = m[2];
+    }
+    this.cookieStr = Object.entries(this.session.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+    const text = await res.text();
+    let parsed = null;
+    try {
+      parsed = text ? JSON.parse(text) : null;
+    } catch {
+    }
+    return { status: res.status, body: parsed, rawText: text };
+  }
+  /** Internal: fetch an absolute URL with the session cookies. */
+  async requestAbsolute(method, url) {
+    const headers = this.buildHeaders();
+    const res = await fetch(url, { method, headers });
+    const text = await res.text();
+    let parsed = null;
+    try {
+      parsed = text ? JSON.parse(text) : null;
+    } catch {
+    }
+    return { status: res.status, body: parsed, rawText: text };
+  }
+  async deleteApiKey(keyId) {
+    await this.request("DELETE", `/apiKeys/${keyId}`);
+  }
+};
+var IrisAuthError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "IrisAuthError";
+  }
+};
+
 // src/client/index.ts
 var AppStoreConnectClient = class {
   http;
@@ -2577,6 +3214,6 @@ var AppStoreConnectClient = class {
   }
 };
 
-export { AppStoreConnectClient, AppStoreConnectError, PortalClient, ProgramLicenseAgreementError, RateLimitError, RequestClient, TokenManager, checkPortalResponse, loginWithAppleId };
+export { AppStoreConnectClient, AppStoreConnectError, IrisAuthError, IrisClient, PortalClient, ProgramLicenseAgreementError, RateLimitError, RequestClient, TokenManager, beginLogin, checkPortalResponse, loginWithAppleId, requestSmsCode, submitTwoFactorCode };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map