@sitepong/fastnode 0.1.2 → 0.2.1

package/dist/index.cjs

@@ -12,6 +12,7 @@ var util = require('util');
 var promises = require('fs/promises');
 var emojiRegex = require('emoji-regex');
 var plist5 = require('plist');
+var forge = require('node-forge');
 var commander = require('commander');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
@@ -37,6 +38,7 @@ function _interopNamespace(e) {
 var x509__namespace = /*#__PURE__*/_interopNamespace(x509);
 var emojiRegex__default = /*#__PURE__*/_interopDefault(emojiRegex);
 var plist5__namespace = /*#__PURE__*/_interopNamespace(plist5);
+var forge__default = /*#__PURE__*/_interopDefault(forge);
 
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -244,9 +246,9 @@ Please accept the agreement at https://developer.apple.com/account before contin
     throw new Error(msg);
   }
 }
-async function loginWithAppleId(config) {
-  const log = config.onLog ?? console.log;
-  const promptFn = config.onPrompt ?? defaultPrompt;
+async function beginLogin(config) {
+  const log = config.onLog ?? (() => {
+  });
   log("Fetching Apple service key...");
   const serviceKey = await fetchServiceKey();
   const initRes = await fetch(`${AUTH_BASE}/signin?widgetKey=${serviceKey}`, {
@@ -263,27 +265,94 @@ async function loginWithAppleId(config) {
   const cookieStr = Object.entries(initCookies).map(([k, v]) => k.startsWith("DES") ? `${k}="${v}"` : `${k}=${v}`).join("; ");
   log("Starting SIRP Apple ID login...");
   const response = await doSirp(config.email, config.password, serviceKey, cookieStr, hashcash);
-  const session = {
+  const baseState = {
     cookies: { ...initCookies, ...response.cookies },
     sessionId: response.sessionId,
     scnt: response.scnt,
     serviceKey,
-    userEmail: config.email,
-    pendingAgreements: []
+    userEmail: config.email
   };
   if (response.status === 403) {
     throw new Error(`Invalid username and password combination. Used '${config.email}' as the username.`);
-  } else if (response.status === 200) {
-    log("Login successful.");
-    await fetchOlympusSession(session);
-  } else if (response.status === 409) {
-    await handleTwoStepOrFactor(session, log, promptFn);
-    await fetchOlympusSession(session);
-  } else if (response.status === 412) {
+  }
+  if (response.status === 412) {
     throw new Error("Need to acknowledge Apple's Apple ID and Privacy statement. Please manually log into https://appleid.apple.com.");
+  }
+  if (response.status === 200) {
+    log("Login successful (no 2FA).");
+    const session = { ...baseState, pendingAgreements: [] };
+    await finalizeSession(session, log);
+    return { kind: "logged_in", session };
+  }
+  if (response.status === 409) {
+    log("2FA required, fetching challenge...");
+    const challenge = await fetchTwoFactorChallenge(baseState);
+    return { kind: "needs_2fa", pending: baseState, challenge };
+  }
+  throw new Error(`Unexpected login response (${response.status}): ${JSON.stringify(response.body).slice(0, 500)}`);
+}
+async function fetchTwoFactorChallenge(pending) {
+  const r = await fetch(`${AUTH_BASE}`, { headers: buildAuthHeadersFromPending(pending) });
+  const body = await r.json();
+  const trustedPhoneNumbers = (body.trustedPhoneNumbers ?? []).map((p) => ({
+    id: p.id,
+    numberWithDialCode: p.numberWithDialCode,
+    pushMode: p.pushMode
+  }));
+  const phoneOnly = body.noTrustedDevices === true;
+  const codeLength = body.securityCode?.length ?? 6;
+  return {
+    kind: phoneOnly ? "phone_only" : "device",
+    codeLength,
+    trustedPhoneNumbers
+  };
+}
+async function requestSmsCode(input) {
+  await fetch(`${AUTH_BASE}/verify/phone`, {
+    method: "PUT",
+    headers: { ...buildAuthHeadersFromPending(input.pending), "Content-Type": "application/json" },
+    body: JSON.stringify({ phoneNumber: { id: input.phoneId }, mode: input.mode ?? "sms" })
+  });
+}
+async function submitTwoFactorCode(input) {
+  const log = input.onLog ?? (() => {
+  });
+  let path;
+  let body;
+  if (input.source === "device") {
+    path = `${AUTH_BASE}/verify/trusteddevice/securitycode`;
+    body = JSON.stringify({ securityCode: { code: input.code } });
   } else {
-    throw new Error(`Unexpected login response (${response.status}): ${JSON.stringify(response.body).slice(0, 500)}`);
+    if (input.phoneId == null) throw new Error("phoneId is required when source='phone'");
+    path = `${AUTH_BASE}/verify/phone/securitycode`;
+    body = JSON.stringify({
+      securityCode: { code: input.code },
+      phoneNumber: { id: input.phoneId },
+      mode: input.mode ?? "sms"
+    });
   }
+  log("Submitting 2FA code...");
+  const verifyRes = await fetch(path, {
+    method: "POST",
+    headers: { ...buildAuthHeadersFromPending(input.pending), "Content-Type": "application/json" },
+    body
+  });
+  if (!verifyRes.ok) {
+    const err = await verifyRes.json().catch(() => ({}));
+    const msgs = (err?.service_errors ?? err?.serviceErrors ?? []).map((e) => e.message).filter(Boolean);
+    throw new Error(msgs.join("; ") || `Verification failed (${verifyRes.status})`);
+  }
+  const session = {
+    ...input.pending,
+    cookies: { ...input.pending.cookies, ...parseCookies(verifyRes.headers) },
+    pendingAgreements: []
+  };
+  await trustSession(session);
+  await finalizeSession(session, log);
+  return session;
+}
+async function finalizeSession(session, log) {
+  await fetchOlympusSession(session);
   const agreements = await fetchContractMessages(session);
   if (agreements.length > 0) {
     for (const msg of agreements) {
@@ -292,7 +361,53 @@ async function loginWithAppleId(config) {
   }
   session.pendingAgreements = agreements;
   log(`Logged in as ${session.userEmail}`);
-  return session;
+}
+async function loginWithAppleId(config) {
+  const log = config.onLog ?? console.log;
+  const promptFn = config.onPrompt ?? defaultPrompt;
+  const result = await beginLogin({ email: config.email, password: config.password, onLog: log });
+  if (result.kind === "logged_in") return result.session;
+  const { pending, challenge } = result;
+  const phones = challenge.trustedPhoneNumbers;
+  if (challenge.kind === "device") {
+    log("Two-factor Authentication (6 digit code) is enabled for this account");
+    log("(Input 'sms' to escape this prompt and select a trusted phone number to send the code as a text message)");
+    const input = await promptFn(`Please enter the ${challenge.codeLength} digit code: `);
+    if (input.toLowerCase() === "sms") {
+      log("Please select a trusted phone number:");
+      for (let i = 0; i < phones.length; i++) log(`  ${i + 1}. ${phones[i].numberWithDialCode}`);
+      const choice2 = await promptFn("Enter number: ");
+      const phone2 = phones[Math.max(0, parseInt(choice2, 10) - 1)] ?? phones[0];
+      await requestSmsCode({ pending, phoneId: phone2.id, mode: phone2.pushMode });
+      log(`Code sent to ${phone2.numberWithDialCode}`);
+      const code2 = await promptFn(`Please enter the ${challenge.codeLength} digit code: `);
+      return submitTwoFactorCode({ pending, code: code2, source: "phone", phoneId: phone2.id, mode: phone2.pushMode ?? "sms", onLog: log });
+    }
+    return submitTwoFactorCode({ pending, code: input, source: "device", onLog: log });
+  }
+  log("Two-factor Authentication (6 digit code) is enabled for this account");
+  if (phones.length === 1) {
+    const phone2 = phones[0];
+    log(`Code automatically sent to ${phone2.numberWithDialCode}`);
+    const code2 = await promptFn(`Please enter the ${challenge.codeLength} digit code: `);
+    return submitTwoFactorCode({ pending, code: code2, source: "phone", phoneId: phone2.id, mode: phone2.pushMode ?? "sms", onLog: log });
+  }
+  log("Please select a trusted phone number:");
+  for (let i = 0; i < phones.length; i++) log(`  ${i + 1}. ${phones[i].numberWithDialCode}`);
+  const choice = await promptFn("Enter number: ");
+  const phone = phones[Math.max(0, parseInt(choice, 10) - 1)] ?? phones[0];
+  await requestSmsCode({ pending, phoneId: phone.id, mode: phone.pushMode });
+  log(`Code sent to ${phone.numberWithDialCode}`);
+  const code = await promptFn(`Please enter the ${challenge.codeLength} digit code: `);
+  return submitTwoFactorCode({ pending, code, source: "phone", phoneId: phone.id, mode: phone.pushMode ?? "sms", onLog: log });
+}
+function buildAuthHeadersFromPending(pending) {
+  const h = { "X-Apple-Widget-Key": pending.serviceKey, Accept: "application/json" };
+  if (pending.sessionId) h["X-Apple-Id-Session-Id"] = pending.sessionId;
+  if (pending.scnt) h["scnt"] = pending.scnt;
+  const c = Object.entries(pending.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+  if (c) h["Cookie"] = c;
+  return h;
 }
 async function doSirp(user, password, serviceKey, cookieStr, hashcash) {
   const client = new SRPClient(2048);
@@ -348,99 +463,6 @@ async function doSirp(user, password, serviceKey, cookieStr, hashcash) {
     scnt: completeRes.headers.get("scnt") ?? ""
   };
 }
-async function handleTwoStepOrFactor(session, log, promptFn) {
-  const r = await fetch(`${AUTH_BASE}`, { headers: buildAuthHeaders(session) });
-  const body = await r.json();
-  if (body.trustedDevices?.length > 0) {
-    await handleTwoStep(session, body, log, promptFn);
-  } else if (body.trustedPhoneNumbers?.length > 0) {
-    await handleTwoFactor(session, body, log, promptFn);
-  } else {
-    throw new Error("2FA required but no trusted devices or phone numbers found.");
-  }
-}
-async function handleTwoFactor(session, authBody, log, promptFn) {
-  log("Two-factor Authentication (6 digit code) is enabled for this account");
-  const codeLength = authBody.securityCode?.length ?? 6;
-  const phones = authBody.trustedPhoneNumbers ?? [];
-  const noTrusted = authBody.noTrustedDevices === true;
-  let codeType;
-  let reqBody;
-  if (noTrusted && phones.length === 1) {
-    const phone = phones[0];
-    log(`Code automatically sent to ${phone.numberWithDialCode}`);
-    const code = await promptFn(`Please enter the ${codeLength} digit code you received at ${phone.numberWithDialCode}: `);
-    codeType = "phone";
-    reqBody = JSON.stringify({ securityCode: { code }, phoneNumber: { id: phone.id }, mode: phone.pushMode ?? "sms" });
-  } else if (noTrusted) {
-    const phone = await choosePhone(phones, log, promptFn);
-    await requestPhoneCode(session, phone);
-    log(`Successfully requested text message to ${phone.numberWithDialCode}`);
-    const code = await promptFn(`Please enter the ${codeLength} digit code: `);
-    codeType = "phone";
-    reqBody = JSON.stringify({ securityCode: { code }, phoneNumber: { id: phone.id }, mode: phone.pushMode ?? "sms" });
-  } else {
-    log("(Input 'sms' to escape this prompt and select a trusted phone number to send the code as a text message)");
-    const input = await promptFn(`Please enter the ${codeLength} digit code: `);
-    if (input.toLowerCase() === "sms") {
-      const phone = await choosePhone(phones, log, promptFn);
-      await requestPhoneCode(session, phone);
-      const code = await promptFn(`Please enter the ${codeLength} digit code sent to ${phone.numberWithDialCode}: `);
-      codeType = "phone";
-      reqBody = JSON.stringify({ securityCode: { code }, phoneNumber: { id: phone.id }, mode: phone.pushMode ?? "sms" });
-    } else {
-      codeType = "trusteddevice";
-      reqBody = JSON.stringify({ securityCode: { code: input } });
-    }
-  }
-  log("Requesting session...");
-  const verifyRes = await fetch(`${AUTH_BASE}/verify/${codeType}/securitycode`, {
-    method: "POST",
-    headers: { ...buildAuthHeaders(session), "Content-Type": "application/json" },
-    body: reqBody
-  });
-  if (!verifyRes.ok) {
-    const err = await verifyRes.json().catch(() => ({}));
-    const msgs = (err?.service_errors ?? err?.serviceErrors ?? []).map((e) => e.message).filter(Boolean);
-    throw new Error(msgs.join("; ") || `Verification failed (${verifyRes.status})`);
-  }
-  Object.assign(session.cookies, parseCookies(verifyRes.headers));
-  await trustSession(session);
-}
-async function handleTwoStep(session, authBody, log, promptFn) {
-  log("Two-step Verification (4 digit code) is enabled for this account");
-  const devices = authBody.trustedDevices ?? [];
-  log("Please select a trusted device:");
-  for (let i = 0; i < devices.length; i++) {
-    log(`  ${i + 1}. ${devices[i].name}	${devices[i].modelName ?? "SMS"}	(${devices[i].id})`);
-  }
-  const choice = await promptFn("Enter device number: ");
-  const device = devices[Math.max(0, parseInt(choice, 10) - 1)] ?? devices[0];
-  await fetch(`${AUTH_BASE}/verify/device/${device.id}/securitycode`, { method: "PUT", headers: buildAuthHeaders(session) });
-  log("Successfully requested notification");
-  const code = await promptFn("Please enter the 4 digit code: ");
-  const verifyRes = await fetch(`${AUTH_BASE}/verify/phone/securitycode`, {
-    method: "POST",
-    headers: { ...buildAuthHeaders(session), "Content-Type": "application/json" },
-    body: JSON.stringify({ phoneNumber: { id: device.id }, securityCode: { code }, mode: "sms" })
-  });
-  if (!verifyRes.ok) throw new Error("Incorrect verification code.");
-  Object.assign(session.cookies, parseCookies(verifyRes.headers));
-  await trustSession(session);
-}
-async function choosePhone(phones, log, promptFn) {
-  log("Please select a trusted phone number:");
-  for (let i = 0; i < phones.length; i++) log(`  ${i + 1}. ${phones[i].numberWithDialCode}`);
-  const choice = await promptFn("Enter number: ");
-  return phones[Math.max(0, parseInt(choice, 10) - 1)] ?? phones[0];
-}
-async function requestPhoneCode(session, phone) {
-  await fetch(`${AUTH_BASE}/verify/phone`, {
-    method: "PUT",
-    headers: { ...buildAuthHeaders(session), "Content-Type": "application/json" },
-    body: JSON.stringify({ phoneNumber: { id: phone.id }, mode: phone.pushMode ?? "sms" })
-  });
-}
 async function trustSession(session) {
   const r = await fetch(`${AUTH_BASE}/2sv/trust`, { headers: buildAuthHeaders(session) });
   Object.assign(session.cookies, parseCookies(r.headers));
@@ -2480,6 +2502,12 @@ var init_xcode_metrics = __esm({
 });
 
 // src/client/portal.ts
+function pickUniqueKeyName(base, taken) {
+  if (!taken.has(base)) return base;
+  let n = 1;
+  while (taken.has(`${base} - ${n}`)) n++;
+  return `${base} - ${n}`;
+}
 var PORTAL_BASE, PortalClient;
 var init_portal = __esm({
   "src/client/portal.ts"() {
@@ -2500,6 +2528,279 @@ var init_portal = __esm({
       async init() {
         await this.post("account/listTeams.action", {});
       }
+      /**
+       * JSON POST — different content type than the standard form-encoded
+       * `post()`. Used by the App Store Connect API key endpoints
+       * (`account/auth/key/v2/create`), which Spaceship discovered take a
+       * JSON body even though every other portal mutation is form-encoded.
+       *
+       * Like the form-encoded `post()`, this also runs the response through
+       * `checkPortalResponse` — Apple returns HTTP 200 even for errors and
+       * encodes the error in `resultCode`/`userString` fields, so a raw
+       * status check would silently miss real failures.
+       */
+      async postJson(path, body) {
+        const headers = {
+          Cookie: this.cookieStr,
+          "Content-Type": "application/json",
+          Accept: "application/json"
+        };
+        if (this.csrf) {
+          headers["csrf"] = this.csrf;
+          headers["csrf_ts"] = this.csrfTs;
+        }
+        console.log(`[portal] POST(json) ${path}`);
+        const res = await fetch(`${PORTAL_BASE}/${path}`, {
+          method: "POST",
+          headers,
+          body: JSON.stringify(body)
+        });
+        if (res.headers.get("csrf")) {
+          this.csrf = res.headers.get("csrf");
+          this.csrfTs = res.headers.get("csrf_ts") ?? "";
+        }
+        for (const raw of res.headers.getSetCookie?.() ?? []) {
+          const m = raw.match(/^([^=]+)=([^;]*)/);
+          if (m && !this.cookieStr.includes(m[1] + "=")) this.cookieStr += "; " + m[1] + "=" + m[2];
+        }
+        const text = await res.text();
+        let data = null;
+        try {
+          data = text ? JSON.parse(text) : null;
+        } catch {
+        }
+        console.log(`[portal] POST(json) ${path} \u2192 ${res.status} ${text.slice(0, 400)}`);
+        checkPortalResponse(data, this.session);
+        return { status: res.status, body: data, rawText: text };
+      }
+      /**
+       * GET helper for the portal endpoints that take query parameters
+       * (currently just `account/auth/key/download`). Returns the raw text
+       * since download endpoints can return PEMs or JSON depending on Apple's
+       * mood — caller decides how to parse.
+       */
+      async getRaw(path, params = {}) {
+        const url = new URL(`${PORTAL_BASE}/${path}`);
+        for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
+        const headers = {
+          Cookie: this.cookieStr,
+          Accept: "application/json, text/plain, application/x-pem-file, */*"
+        };
+        if (this.csrf) {
+          headers["csrf"] = this.csrf;
+          headers["csrf_ts"] = this.csrfTs;
+        }
+        console.log(`[portal] GET ${url.pathname}${url.search}`);
+        const res = await fetch(url.toString(), { headers });
+        for (const raw of res.headers.getSetCookie?.() ?? []) {
+          const m = raw.match(/^([^=]+)=([^;]*)/);
+          if (m && !this.cookieStr.includes(m[1] + "=")) this.cookieStr += "; " + m[1] + "=" + m[2];
+        }
+        const text = await res.text();
+        const contentType = res.headers.get("content-type") ?? "";
+        console.log(`[portal] GET ${url.pathname} \u2192 ${res.status} ${contentType} ${text.length}b`);
+        return { status: res.status, rawText: text, contentType };
+      }
+      // ── App Store Connect API Keys (.p8) ────────────────────────────────────
+      /**
+       * Create an App Store Connect API key via the developer portal's
+       * `account/auth/key/v2/create` endpoint. Reverse-engineered from the
+       * _current_ @expo/apple-utils npm package (v2.1.21), which is what
+       * EAS CLI uses to manage Apple credentials in production.
+       *
+       * This differs from older published reverse-engineering guides:
+       *   • URL uses the `/v2/create` suffix (Apple kept it)
+       *   • Field is `serviceConfigurations`, shape is an object keyed by
+       *     service id (NOT `serviceConfigurationsRequests: [...]` array)
+       *   • Body REQUIRES `scope: "team"`
+       *   • Needs a scope-specific CSRF warmup via the `keys` endpoint
+       *     before the create call (EAS's `ensureCSRFAsync("keys", …)`)
+       *
+       * For an App Store Connect API key (PUBLIC_API, used by altool for
+       * TestFlight uploads), `serviceConfigurations` is an empty object `{}`.
+       * For an APNs auth key, it's `{ "U27F4V844T": [] }`. For MusicKit:
+       * `{ "6A7HVUVQ3M": [musicId] }`, etc.
+       *
+       * Apple's name validator rejects parentheses, brackets, and most
+       * punctuation — sanitize to alphanumeric + space + dash + underscore
+       * + period and collapse whitespace.
+       */
+      async createApiKey(rawName, serviceConfigurations = {}) {
+        const baseName = rawName.replace(/[^A-Za-z0-9 _\-.]/g, " ").replace(/\s+/g, " ").trim().slice(0, 45);
+        if (!baseName) throw new Error("createApiKey: name is empty after sanitization");
+        let existingNames = /* @__PURE__ */ new Set();
+        try {
+          const list = await this.listApiKeys();
+          existingNames = new Set(
+            (list.keys ?? []).map((k) => String(k.keyName ?? "").trim())
+          );
+        } catch {
+        }
+        const name = pickUniqueKeyName(baseName, existingNames);
+        const body = {
+          teamId: this.teamId,
+          name,
+          serviceConfigurations,
+          scope: "team"
+        };
+        const result = await this.postJson("account/auth/key/v2/create", body);
+        const created = result.body?.keys?.[0] ?? result.body?.key ?? result.body?.data ?? result.body;
+        const keyId = created?.keyId ?? created?.id ?? created?.kid ?? created?.attributes?.kid;
+        if (!keyId) {
+          throw new Error(`createApiKey: no key id in response. Body: ${result.rawText.slice(0, 400)}`);
+        }
+        return { keyId, raw: created };
+      }
+      /**
+       * Fetch a single API key by id via `account/auth/key/get`. Reverse-
+       * engineered from Spaceship's `get_key`. Returns the raw key record so
+       * the caller can extract whatever fields it needs (e.g. issuerId).
+       *
+       * Form-encoded POST — same shape as every other PortalClient mutation
+       * except the JSON `create` endpoint.
+       */
+      async getApiKey(keyId) {
+        const data = await this.post("account/auth/key/get", {
+          teamId: this.teamId,
+          keyId
+        });
+        return data?.keys?.[0] ?? data?.key ?? data?.data ?? data;
+      }
+      /**
+       * Revoke an existing key. Form-encoded POST per Spaceship's
+       * `revoke_key!`. Used for cleaning up orphan keys created during
+       * failed wizard runs.
+       */
+      async revokeApiKey(keyId) {
+        await this.post("account/auth/key/revoke", {
+          teamId: this.teamId,
+          keyId
+        });
+      }
+      // ── APNs Authentication Keys (.p8) ──────────────────────────────────────
+      /** Apple's hardcoded service id for APNs auth keys (from Spaceship). */
+      static APNS_SERVICE_ID = "U27F4V844T";
+      /**
+       * Create an APNs Authentication Key (.p8) via the developer portal.
+       *
+       * Apple requires BOTH `serviceConfigurations` (the map) AND
+       * `serviceConfigurationsRequests` (the array of full config objects)
+       * in the v2/create body. Just sending the map alone results in
+       * "No value was provided for the parameter 'serviceConfigurations'".
+       *
+       * The exact body comes from @expo/apple-utils v2.1.21 — both fields
+       * are produced by separate functions (`d` for the map, `h` for the
+       * array) and merged into the create payload.
+       *
+       * Apple also rejects duplicate key names ("Another key with same
+       * name exists") — we dedupe by listing existing keys first and
+       * appending " (N)" until we find a free slot, mirroring the
+       * provisioning profile dedup.
+       */
+      async createApnsAuthKey(rawName) {
+        const baseName = rawName.replace(/[^A-Za-z0-9 _\-.]/g, " ").replace(/\s+/g, " ").trim().slice(0, 45);
+        if (!baseName) throw new Error("createApnsAuthKey: name is empty after sanitization");
+        let existingNames = /* @__PURE__ */ new Set();
+        try {
+          const list = await this.listApiKeys();
+          existingNames = new Set(
+            (list.keys ?? []).map((k) => String(k.keyName ?? "").trim())
+          );
+        } catch {
+        }
+        const name = pickUniqueKeyName(baseName, existingNames);
+        const body = {
+          teamId: this.teamId,
+          name,
+          serviceConfigurations: {
+            [_PortalClient.APNS_SERVICE_ID]: []
+          },
+          serviceConfigurationsRequests: [
+            {
+              isNew: true,
+              serviceId: _PortalClient.APNS_SERVICE_ID,
+              identifiers: {},
+              environment: "all",
+              scope: "team"
+            }
+          ],
+          scope: "team"
+        };
+        const result = await this.postJson("account/auth/key/v2/create", body);
+        const created = result.body?.keys?.[0];
+        if (!created?.keyId) {
+          throw new Error(`createApnsAuthKey: no key id in response. Body: ${result.rawText.slice(0, 400)}`);
+        }
+        const pem = await this.downloadApiKey(created.keyId);
+        return { keyId: created.keyId, pem, raw: created };
+      }
+      /**
+       * Find existing APNs auth keys in the team. Used by the wizard to
+       * detect "you already have one" cases and offer to reuse rather than
+       * proliferate keys.
+       */
+      async listApnsAuthKeys() {
+        const list = await this.listApiKeys();
+        return (list.keys ?? []).filter(
+          (k) => (k.services ?? []).some((s) => s.id === _PortalClient.APNS_SERVICE_ID || /apns/i.test(s.name ?? ""))
+        ).map((k) => ({
+          keyId: k.keyId,
+          keyName: k.keyName,
+          canDownload: Boolean(k.canDownload)
+        }));
+      }
+      /**
+       * Download an existing App Store Connect API key as PEM. Spaceship's
+       * `download_key` endpoint — GET with teamId + keyId in query string.
+       * Returns the raw .p8 PEM text. Apple shows the .p8 exactly once
+       * (after creation), so call this immediately after createApiKey.
+       */
+      async downloadApiKey(keyId) {
+        const { status, rawText, contentType } = await this.getRaw("account/auth/key/download", {
+          teamId: this.teamId,
+          keyId
+        });
+        if (status !== 200) {
+          throw new Error(`downloadApiKey failed (${status}): ${rawText.slice(0, 200)}`);
+        }
+        if (rawText.includes("BEGIN PRIVATE KEY")) return rawText;
+        if (contentType.includes("json")) {
+          try {
+            const parsed = JSON.parse(rawText);
+            const candidates = [
+              parsed?.privateKey,
+              parsed?.key?.privateKey,
+              parsed?.keys?.[0]?.privateKey,
+              parsed?.data?.attributes?.privateKey,
+              parsed?.value
+            ];
+            for (const c of candidates) {
+              if (typeof c === "string" && c.includes("BEGIN PRIVATE KEY")) return c;
+            }
+          } catch {
+          }
+        }
+        throw new Error(`downloadApiKey returned no PEM. Content-Type=${contentType} body=${rawText.slice(0, 300)}`);
+      }
+      /**
+       * List existing API keys via the portal. Used to discover the team's
+       * issuer id — every key in the team shares the same issuer id, and
+       * altool needs it alongside the key id and .p8 file.
+       *
+       * Form-encoded POST (NOT JSON), with pagination params, per Spaceship's
+       * `list_keys` method. JSON returned 415 from this endpoint.
+       */
+      async listApiKeys() {
+        const data = await this.post("account/auth/key/list", {
+          teamId: this.teamId,
+          pageNumber: "1",
+          pageSize: "500",
+          sort: "name=asc"
+        });
+        const keys = data?.keys ?? [];
+        const issuerId = data?.issuerId ?? data?.issuer ?? data?.team?.issuerId ?? keys[0]?.issuerId ?? keys[0]?.issuer;
+        return { keys, issuerId };
+      }
       async post(path, params) {
         const body = new URLSearchParams();
         for (const [k, v] of Object.entries(params)) {
@@ -2567,6 +2868,31 @@ var init_portal = __esm({
       async deleteAppId(appIdId) {
         await this.post("account/ios/identifiers/deleteAppId.action", { teamId: this.teamId, appIdId });
       }
+      /**
+       * Toggle a capability (a.k.a. "service") on a bundle ID. Mirrors
+       * Spaceship::Portal's `update_service` — the legacy portal endpoint
+       * still works and is the only session-cookie-authenticated way to flip
+       * capabilities like Push Notifications and Sign in with Apple from
+       * outside the Apple Developer web UI.
+       *
+       * Common service codes (from Spaceship portal/portal_client.rb):
+       *   push          → push notifications
+       *   APG3427HIY    → Sign in with Apple
+       *   IAD53UNK2F    → in-app purchase
+       *   homeKit       → HomeKit
+       *   healthKit     → HealthKit
+       *
+       * @param featureType  Apple's internal capability key (string code or short name)
+       * @param enabled      true → turn on, false → turn off
+       */
+      async setBundleCapability(params) {
+        await this.post("account/ios/identifiers/updateAppService.action", {
+          teamId: this.teamId,
+          displayId: params.appIdId,
+          featureType: params.featureType,
+          featureValue: params.enabled ? "on" : "off"
+        });
+      }
       // ── Certificates ───────────────────────────────────────────────────────
       async listCertificates(types) {
         const iosTypes = types ?? [
@@ -2584,12 +2910,21 @@ var init_portal = __esm({
         return data.certRequests ?? [];
       }
       async listPushCertificates() {
+        const types = Array.from(
+          /* @__PURE__ */ new Set([
+            _PortalClient.CERT_TYPES.IOS_PRODUCTION_PUSH,
+            _PortalClient.CERT_TYPES.IOS_DEVELOPMENT_PUSH,
+            // Legacy push codes from OLDER_IOS_CERTIFICATE_TYPES
+            "3BQKVH9I2X",
+            "BKLRAVXMGM"
+          ])
+        );
         const data = await this.post("account/ios/certificate/listCertRequests.action", {
           teamId: this.teamId,
           pageSize: "500",
           pageNumber: "1",
           sort: "certRequestStatusCode=asc",
-          types: [_PortalClient.CERT_TYPES.IOS_PRODUCTION_PUSH, _PortalClient.CERT_TYPES.IOS_DEVELOPMENT_PUSH].join(",")
+          types: types.join(",")
         });
         return data.certRequests ?? [];
       }
@@ -2731,18 +3066,332 @@ var init_portal = __esm({
   }
 });
 
+// src/client/iris.ts
+var IRIS_BASE, IrisClient, IrisAuthError;
+var init_iris = __esm({
+  "src/client/iris.ts"() {
+    IRIS_BASE = "https://appstoreconnect.apple.com/iris/v1";
+    IrisClient = class {
+      constructor(session) {
+        this.session = session;
+        this.cookieStr = Object.entries(session.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+      }
+      session;
+      cookieStr;
+      buildHeaders() {
+        return {
+          Cookie: this.cookieStr,
+          Accept: "application/vnd.api+json, application/json, text/plain, */*",
+          "Content-Type": "application/vnd.api+json",
+          "X-Requested-With": "XMLHttpRequest",
+          // Mimic the App Store Connect web UI's user agent
+          "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15"
+        };
+      }
+      /**
+       * Issue a request and absorb any new cookies (Apple rotates session
+       * cookies on a lot of iris calls).
+       */
+      async request(method, path, body) {
+        const headers = this.buildHeaders();
+        if (process.env.FASTNODE_DEBUG) {
+          console.log(`[iris] ${method} ${path}${body ? ` body=${JSON.stringify(body).slice(0, 200)}` : ""}`);
+        }
+        const res = await fetch(`${IRIS_BASE}${path}`, {
+          method,
+          headers,
+          body: body ? JSON.stringify(body) : void 0
+        });
+        for (const raw of res.headers.getSetCookie?.() ?? []) {
+          const m = raw.match(/^([^=]+)=([^;]*)/);
+          if (m) {
+            this.session.cookies[m[1]] = m[2];
+          }
+        }
+        this.cookieStr = Object.entries(this.session.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+        const text = await res.text();
+        let parsed = null;
+        try {
+          parsed = text ? JSON.parse(text) : null;
+        } catch {
+        }
+        if (process.env.FASTNODE_DEBUG) {
+          console.log(`[iris] \u2192 ${res.status} ${text.slice(0, 300)}`);
+        }
+        return { status: res.status, body: parsed, rawText: text };
+      }
+      /**
+       * List existing API keys. Used both as a sanity check (the user has
+       * permission) and to discover the team's issuer id (which is the same
+       * for every key in the team and is needed by altool).
+       *
+       * Important: Apple's iris endpoint rejects most query parameters with
+       * `PARAMETER_ERROR.INVALID`. Call with no params and let the API return
+       * its default page.
+       */
+      async listApiKeys() {
+        const { status, body, rawText } = await this.request("GET", "/apiKeys");
+        if (status === 403) {
+          throw new IrisAuthError(
+            "You don't have permission to manage App Store Connect API keys (this requires the Account Holder or Admin role)."
+          );
+        }
+        if (status >= 400 || !body) {
+          throw new Error(`iris listApiKeys failed (${status}): ${rawText.slice(0, 200)}`);
+        }
+        const issuerId = body?.meta?.issuerId ?? body?.data?.[0]?.attributes?.issuerId;
+        const keys = (body.data ?? []).map((d) => ({
+          id: d.id,
+          kid: d.attributes?.kid ?? d.id,
+          nickname: d.attributes?.nickname ?? "",
+          issuerId: d.attributes?.issuerId ?? issuerId,
+          roles: d.attributes?.roles ?? [],
+          allAppsVisible: d.attributes?.allAppsVisible ?? true
+        }));
+        return { keys, issuerId };
+      }
+      /**
+       * Create a new API key. Apple returns the .p8 PEM exactly once in the
+       * create response — capture it immediately or the key is dead weight.
+       *
+       * `keyType` is required by Apple's iris API:
+       *   • PUBLIC_API     — the standard team-wide API key (what TestFlight uploads need)
+       *   • MARKETING_API  — for App Analytics access only
+       */
+      async createApiKey(input) {
+        const requestBody = {
+          data: {
+            type: "apiKeys",
+            attributes: {
+              nickname: input.nickname,
+              roles: input.roles ?? ["APP_MANAGER"],
+              allAppsVisible: input.allAppsVisible ?? true,
+              keyType: input.keyType ?? "PUBLIC_API"
+            }
+          }
+        };
+        console.log("[iris] createApiKey request:", JSON.stringify(requestBody));
+        const { status, body, rawText } = await this.request("POST", "/apiKeys", requestBody);
+        console.log(`[iris] createApiKey response: ${status} ${rawText.slice(0, 800)}`);
+        if (status === 403) {
+          throw new IrisAuthError(
+            "You don't have permission to create App Store Connect API keys (this requires the Account Holder or Admin role)."
+          );
+        }
+        if (status >= 400 || !body) {
+          const msg = body?.errors?.[0]?.detail ?? body?.errors?.[0]?.title ?? rawText.slice(0, 300) ?? `iris createApiKey failed (${status})`;
+          throw new Error(msg);
+        }
+        const data = body.data ?? body;
+        if (!data?.id) {
+          throw new Error(`iris createApiKey returned no key id. Raw response: ${rawText.slice(0, 400)}`);
+        }
+        const key = {
+          id: data.id,
+          kid: data.attributes?.kid ?? data.id,
+          nickname: data.attributes?.nickname ?? input.nickname,
+          privateKey: data.attributes?.privateKey,
+          issuerId: data.attributes?.issuerId,
+          roles: data.attributes?.roles ?? input.roles ?? ["APP_MANAGER"],
+          allAppsVisible: data.attributes?.allAppsVisible ?? true
+        };
+        return key;
+      }
+      /**
+       * Fetch the .p8 PEM AND the team's issuer id for a previously-created
+       * ASC API key. Both come back in a single request via:
+       *
+       *   GET /iris/v1/apiKeys/{id}?fields[apiKeys]=privateKey&include=provider
+       *
+       * Sparse fieldset requesting ONLY `privateKey` is the magic that makes
+       * Apple actually include the (base64-encoded) PEM in the response —
+       * the default view returns `privateKey: null`. The `include=provider`
+       * pulls the team's contentProvider record into `included[]`, and its
+       * `id` field IS the issuer id altool needs (a UUID like
+       * `cfadaf94-44ca-4c2c-8fa6-ecc28d3c7d0d`).
+       *
+       * Reverse-engineered from @expo/apple-utils v2.1.21 (the package that
+       * powers EAS CLI), specifically the `ApiKey.downloadAsync` method
+       * combined with `ApiKey.infoAsync` reading `provider?.id`.
+       *
+       * Returns `{ pem, issuerId }`, or `null` if Apple won't return the
+       * private key (typically because the key was already downloaded once).
+       */
+      async fetchApiKeyPrivateKey(keyId) {
+        try {
+          const url = `${IRIS_BASE}/apiKeys/${keyId}?fields%5BapiKeys%5D=privateKey&include=provider`;
+          const res = await fetch(url, {
+            headers: {
+              ...this.buildHeaders(),
+              Accept: "application/vnd.api+json, application/json, text/plain, */*"
+            }
+          });
+          const text = await res.text();
+          console.log(`[iris] fetchApiKeyPrivateKey \u2192 ${res.status} (${text.length} bytes)`);
+          if (res.status !== 200) {
+            console.log(`[iris]   err: ${text.slice(0, 300)}`);
+            return null;
+          }
+          const body = JSON.parse(text);
+          const encoded = body?.data?.attributes?.privateKey;
+          if (typeof encoded !== "string" || encoded.length === 0) {
+            console.log(`[iris]   no privateKey in response`);
+            return null;
+          }
+          const pem = Buffer.from(encoded, "base64").toString("utf-8");
+          if (!pem.includes("BEGIN PRIVATE KEY")) {
+            console.log(`[iris]   decoded body didn't contain PEM marker`);
+            return null;
+          }
+          const provider = (body?.included ?? []).find((i) => i.type === "contentProviders");
+          const issuerId = provider?.id;
+          console.log(`[iris] \u2713 PEM ${pem.length} bytes, issuerId=${issuerId ?? "(missing)"}`);
+          return { pem, issuerId };
+        } catch (err) {
+          console.log(`[iris] fetchApiKeyPrivateKey error: ${err.message}`);
+          return null;
+        }
+      }
+      /**
+       * @deprecated Kept as a fallback probe for debugging. The real path
+       * is the sparse fieldset above — everything in this brute-force list
+       * returned 404 during testing. Left here so we can re-verify if Apple
+       * changes anything.
+       */
+      async fetchApiKeyPrivateKeyBruteForce(keyId) {
+        const attempts = [
+          // Sparse fieldsets — JSON-API spec lets us request specific attributes.
+          // Apple may exclude privateKey by default and return it only when asked.
+          { kind: "GET", path: `/apiKeys/${keyId}?fields[apiKeys]=privateKey,kid,issuerId,nickname,roles` },
+          { kind: "GET", path: `/apiKeys/${keyId}?include=privateKey` },
+          { kind: "GET", path: `/apiKeys/${keyId}?fields[apiKeys]=privateKey` },
+          // Custom Accept headers — maybe Apple negotiates content type
+          { kind: "GET", path: `/apiKeys/${keyId}`, accept: "application/x-pem-file" },
+          { kind: "GET", path: `/apiKeys/${keyId}`, accept: "application/octet-stream" },
+          { kind: "GET", path: `/apiKeys/${keyId}/p8`, accept: "application/x-pem-file" },
+          // POST variants — Apple sometimes uses POST to mint a download token
+          { kind: "POST", path: `/apiKeys/${keyId}/secrets`, body: {} },
+          { kind: "POST", path: `/apiKeys/${keyId}/regenerate`, body: {} },
+          { kind: "POST", path: `/apiKeys/${keyId}/p8`, body: {} },
+          // Bare GET (last) — confirms canonical fields, in case my parser missed any
+          { kind: "GET", path: `/apiKeys/${keyId}` },
+          // Different host — the legacy developer.apple.com user-and-access namespace
+          { kind: "ABSOLUTE", url: `https://appstoreconnect.apple.com/api/v1/apiKeys/${keyId}/p8` },
+          { kind: "ABSOLUTE", url: `https://appstoreconnect.apple.com/access/api/keys/${keyId}/download` }
+        ];
+        for (const attempt of attempts) {
+          try {
+            let result;
+            if (attempt.kind === "GET") {
+              result = await this.requestWithHeaders("GET", attempt.path, void 0, {
+                ...attempt.accept ? { Accept: attempt.accept } : {}
+              });
+              console.log(`[iris] fetchApiKeyPrivateKey GET ${attempt.path}${attempt.accept ? ` accept=${attempt.accept}` : ""} \u2192 ${result.status} (${result.rawText.length} bytes)`);
+            } else if (attempt.kind === "POST") {
+              result = await this.request("POST", attempt.path, attempt.body);
+              console.log(`[iris] fetchApiKeyPrivateKey POST ${attempt.path} \u2192 ${result.status} (${result.rawText.length} bytes)`);
+            } else {
+              result = await this.requestAbsolute("GET", attempt.url);
+              console.log(`[iris] fetchApiKeyPrivateKey GET ${attempt.url} \u2192 ${result.status} (${result.rawText.length} bytes)`);
+            }
+            if (result.status === 200) {
+              console.log(`[iris]   body: ${result.rawText.slice(0, 1500)}`);
+            }
+            if (result.status !== 200) continue;
+            if (result.rawText && result.rawText.includes("BEGIN PRIVATE KEY")) {
+              console.log(`[iris] \u2713 found PEM (plain text response)`);
+              return result.rawText;
+            }
+            if (result.body) {
+              const candidates = [
+                result.body?.data?.attributes?.privateKey,
+                result.body?.data?.attributes?.p8,
+                result.body?.data?.attributes?.privateKeyContent,
+                result.body?.data?.attributes?.kpem,
+                result.body?.data?.attributes?.secret,
+                result.body?.data?.attributes?.keyContent,
+                result.body?.privateKey,
+                result.body?.p8,
+                result.body?.value,
+                result.body?.secret
+              ];
+              for (const c of candidates) {
+                if (typeof c === "string" && c.includes("BEGIN PRIVATE KEY")) {
+                  console.log(`[iris] \u2713 found PEM in JSON response`);
+                  return c;
+                }
+              }
+            }
+          } catch (err) {
+            console.log(`[iris] fetchApiKeyPrivateKey attempt failed: ${err.message}`);
+          }
+        }
+        console.log(`[iris] fetchApiKeyPrivateKey: no working download path for key ${keyId}`);
+        return null;
+      }
+      /** Internal: like request() but lets us override headers. */
+      async requestWithHeaders(method, path, body, extraHeaders = {}) {
+        const headers = { ...this.buildHeaders(), ...extraHeaders };
+        const res = await fetch(`${IRIS_BASE}${path}`, {
+          method,
+          headers,
+          body: body ? JSON.stringify(body) : void 0
+        });
+        for (const raw of res.headers.getSetCookie?.() ?? []) {
+          const m = raw.match(/^([^=]+)=([^;]*)/);
+          if (m) this.session.cookies[m[1]] = m[2];
+        }
+        this.cookieStr = Object.entries(this.session.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+        const text = await res.text();
+        let parsed = null;
+        try {
+          parsed = text ? JSON.parse(text) : null;
+        } catch {
+        }
+        return { status: res.status, body: parsed, rawText: text };
+      }
+      /** Internal: fetch an absolute URL with the session cookies. */
+      async requestAbsolute(method, url) {
+        const headers = this.buildHeaders();
+        const res = await fetch(url, { method, headers });
+        const text = await res.text();
+        let parsed = null;
+        try {
+          parsed = text ? JSON.parse(text) : null;
+        } catch {
+        }
+        return { status: res.status, body: parsed, rawText: text };
+      }
+      async deleteApiKey(keyId) {
+        await this.request("DELETE", `/apiKeys/${keyId}`);
+      }
+    };
+    IrisAuthError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "IrisAuthError";
+      }
+    };
+  }
+});
+
 // src/client/index.ts
 var client_exports = {};
 __export(client_exports, {
   AppStoreConnectClient: () => exports.AppStoreConnectClient,
   AppStoreConnectError: () => exports.AppStoreConnectError,
+  IrisAuthError: () => IrisAuthError,
+  IrisClient: () => IrisClient,
   PortalClient: () => PortalClient,
   ProgramLicenseAgreementError: () => ProgramLicenseAgreementError,
   RateLimitError: () => exports.RateLimitError,
   RequestClient: () => exports.RequestClient,
   TokenManager: () => exports.TokenManager,
+  beginLogin: () => beginLogin,
   checkPortalResponse: () => checkPortalResponse,
-  loginWithAppleId: () => loginWithAppleId
+  loginWithAppleId: () => loginWithAppleId,
+  requestSmsCode: () => requestSmsCode,
+  submitTwoFactorCode: () => submitTwoFactorCode
 });
 exports.AppStoreConnectClient = void 0;
 var init_client = __esm({
@@ -2787,6 +3436,7 @@ var init_client = __esm({
     init_request();
     init_apple_session();
     init_portal();
+    init_iris();
     exports.AppStoreConnectClient = class {
       http;
       certificates;
@@ -7974,6 +8624,7 @@ init_review_submissions();
 // src/cert/index.ts
 var cert_exports2 = {};
 __export(cert_exports2, {
+  bundleP12: () => bundleP12,
   createCertificate: () => createCertificate,
   downloadCertificate: () => downloadCertificate,
   findValidCertificates: () => findValidCertificates,
@@ -7984,6 +8635,41 @@ __export(cert_exports2, {
 });
 init_cert();
 init_csr();
+function derBufferToPem(der) {
+  const b64 = der.toString("base64");
+  const lines = [];
+  for (let i = 0; i < b64.length; i += 64) lines.push(b64.slice(i, i + 64));
+  return `-----BEGIN CERTIFICATE-----
+${lines.join("\n")}
+-----END CERTIFICATE-----
+`;
+}
+function normalizeCertPem(input) {
+  if (typeof input === "string") {
+    if (input.includes("BEGIN CERTIFICATE")) return input;
+    const b64 = input.replace(/\s+/g, "");
+    return derBufferToPem(Buffer.from(b64, "base64"));
+  }
+  return derBufferToPem(input);
+}
+function bundleP12(options) {
+  const certPem = normalizeCertPem(options.certificate);
+  const cert = forge__default.default.pki.certificateFromPem(certPem);
+  const privateKey = forge__default.default.pki.privateKeyFromPem(options.privateKeyPem);
+  const friendlyName = options.friendlyName ?? "fastnode signing identity";
+  const p12Asn1 = forge__default.default.pkcs12.toPkcs12Asn1(
+    privateKey,
+    [cert],
+    options.password,
+    {
+      friendlyName,
+      generateLocalKeyId: true,
+      algorithm: "3des"
+    }
+  );
+  const der = forge__default.default.asn1.toDer(p12Asn1).getBytes();
+  return Buffer.from(der, "binary");
+}
 
 // src/index.ts
 init_sigh();
@@ -8331,6 +9017,440 @@ init_lane();
 init_lane();
 init_context();
 init_actions();
+
+// src/setup/one-click.ts
+init_portal();
+init_iris();
+init_client();
+init_csr();
+var DIST_CERT_TYPE = PortalClient.CERT_TYPES.IOS_DISTRIBUTION;
+var PUSH_PROD_TYPE = PortalClient.CERT_TYPES.IOS_PRODUCTION_PUSH;
+var PUSH_DEV_TYPE = PortalClient.CERT_TYPES.IOS_DEVELOPMENT_PUSH;
+function randomPassword(length = 32) {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+  const bytes = crypto.randomBytes(length);
+  let out = "";
+  for (let i = 0; i < length; i++) out += alphabet[bytes[i] % alphabet.length];
+  return out;
+}
+function extractProfileMetadata(profile) {
+  const text = profile.toString("binary");
+  const start = text.indexOf("<?xml");
+  const end = text.indexOf("</plist>");
+  if (start < 0 || end < 0) return {};
+  const plistXml = text.slice(start, end + "</plist>".length);
+  const nameMatch = plistXml.match(/<key>Name<\/key>\s*<string>([^<]+)<\/string>/);
+  const uuidMatch = plistXml.match(/<key>UUID<\/key>\s*<string>([^<]+)<\/string>/);
+  return { name: nameMatch?.[1], uuid: uuidMatch?.[1] };
+}
+function classifyPushCertType(typeString) {
+  if (!typeString) return "other";
+  const t = typeString.toLowerCase();
+  if (t.includes("production")) return "production";
+  if (t.includes("development") || t.includes("sandbox")) return "sandbox";
+  return "other";
+}
+function buildProfileName(appName, existingNames) {
+  const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const base = `${appName} App Store ${today}`;
+  const taken = new Set(existingNames);
+  if (!taken.has(base)) return base;
+  let n = 1;
+  while (taken.has(`${base} (${n})`)) n++;
+  return `${base} (${n})`;
+}
+async function oneClickListTeams(session) {
+  const portal = new PortalClient(session, "");
+  const teams = await portal.listTeams();
+  return (teams ?? []).map((t) => ({
+    teamId: t.teamId,
+    name: t.name,
+    role: t.userRole?.name ?? t.type,
+    status: t.status
+  }));
+}
+async function oneClickInventory(session, teamId) {
+  const portal = new PortalClient(session, teamId);
+  await portal.init();
+  const [appIds, allCerts, profiles, pushCerts, apiKeys] = await Promise.all([
+    portal.listAppIds(),
+    portal.listCertificates([DIST_CERT_TYPE]),
+    portal.listProfiles(),
+    portal.listPushCertificates(),
+    portal.listApiKeys().catch(() => ({ keys: [] }))
+  ]);
+  const distributionCerts = (allCerts ?? []).map((c) => ({
+    certificateId: c.certificateId,
+    name: c.name ?? "Distribution",
+    serialNumber: c.serialNum,
+    expirationDate: c.expirationDateString,
+    ownerName: c.ownerName
+  }));
+  const apnsAuthKeys = (apiKeys.keys ?? []).filter(
+    (k) => (k.services ?? []).some(
+      (s) => s.id === PortalClient.APNS_SERVICE_ID || /apns/i.test(s.name ?? "")
+    )
+  ).map((k) => ({
+    keyId: k.keyId,
+    keyName: k.keyName,
+    dateCreated: k.dateCreated
+  }));
+  return {
+    team: { id: teamId },
+    bundleIds: (appIds ?? []).map((a) => ({
+      appIdId: a.appIdId,
+      identifier: a.identifier,
+      name: a.name
+    })),
+    distributionCerts,
+    distCertCapacity: { used: distributionCerts.length, max: 3 },
+    apnsAuthKeys,
+    apnsKeyCapacity: { used: apnsAuthKeys.length, max: 2 },
+    pushCerts: (pushCerts ?? []).map((c) => ({
+      certificateId: c.certificateId,
+      name: c.name ?? "Push",
+      type: classifyPushCertType(c.typeString),
+      bundleIdentifier: c.appId?.identifier,
+      expirationDate: c.expirationDateString
+    })),
+    profiles: (profiles ?? []).map((p) => ({
+      provisioningProfileId: p.provisioningProfileId,
+      name: p.name,
+      type: p.type,
+      status: p.status,
+      expirationDate: p.expirationDate
+    }))
+  };
+}
+async function ensureBundleId(portal, identifier, name, warnings) {
+  const existing = await portal.listAppIds();
+  const hit = existing.find((a) => a.identifier === identifier);
+  if (hit) {
+    warnings.push(`Bundle ID ${identifier} already existed and was reused.`);
+    return hit.appIdId;
+  }
+  const created = await portal.createAppId({ identifier, name, enablePush: true });
+  return created.appIdId;
+}
+async function createDistCert(portal) {
+  const { csr, privateKey } = generateRSACSR();
+  const cert = await portal.createCertificate({ type: DIST_CERT_TYPE, csrContent: csr });
+  let certContent;
+  if (cert.certificateContent) {
+    certContent = Buffer.from(cert.certificateContent, "base64");
+  } else {
+    certContent = await portal.downloadCertificate(cert.certificateId, DIST_CERT_TYPE);
+  }
+  return { certificateId: cert.certificateId, privateKeyPem: privateKey, certContent };
+}
+async function createPushCert(portal, appIdId, type) {
+  const { csr, privateKey } = generateRSACSR();
+  const cert = await portal.createCertificate({ type, csrContent: csr, appIdId });
+  let certContent;
+  if (cert.certificateContent) {
+    certContent = Buffer.from(cert.certificateContent, "base64");
+  } else {
+    certContent = await portal.downloadCertificate(cert.certificateId, type);
+  }
+  return { certificateId: cert.certificateId, privateKeyPem: privateKey, certContent };
+}
+function findExistingPushCertForBundle(pushCerts, appIdId, bundleIdentifier, kind) {
+  for (const c of pushCerts) {
+    const appMatches = c.appId?.appIdId === appIdId || c.appId?.identifier === bundleIdentifier;
+    if (!appMatches) continue;
+    const ts = (c.typeString ?? "").toLowerCase();
+    const name = (c.name ?? "").toLowerCase();
+    const looksLikePush = ts.includes("push") || ts.includes("apns") || name.includes("apple push services");
+    if (!looksLikePush) continue;
+    const isProduction = ts.includes("production");
+    const isSandbox = ts.includes("development") || ts.includes("sandbox");
+    const isUnified = !isProduction && !isSandbox;
+    if (!isUnified) {
+      if (kind === "production" && !isProduction) continue;
+      if (kind === "sandbox" && !isSandbox) continue;
+    }
+    return {
+      certificateId: c.certificateId,
+      name: c.name ?? "Apple Push Services",
+      expirationDate: c.expirationDateString
+    };
+  }
+  return null;
+}
+async function oneClickSetup(input) {
+  const opts = {
+    generateDistributionCert: input.options?.generateDistributionCert ?? true,
+    generateStoreProfile: input.options?.generateStoreProfile ?? true,
+    generateAscApiKey: input.options?.generateAscApiKey ?? true,
+    generateApnsAuthKey: input.options?.generateApnsAuthKey ?? true,
+    generatePushProductionCert: input.options?.generatePushProductionCert ?? false,
+    generatePushSandboxCert: input.options?.generatePushSandboxCert ?? false,
+    enableSignInWithApple: input.options?.enableSignInWithApple ?? true,
+    enablePushNotifications: input.options?.enablePushNotifications ?? true,
+    revokeCertIds: input.options?.revokeCertIds ?? [],
+    revokeApnsKeyIds: input.options?.revokeApnsKeyIds ?? []
+  };
+  const onProgress = input.onProgress ?? (() => {
+  });
+  const warnings = [];
+  const created = { revokedCertIds: [] };
+  const additionalCerts = [];
+  if (!opts.generateDistributionCert || !opts.generateStoreProfile) {
+    throw new Error("Distribution cert and store profile are both required for an apple_credentials row.");
+  }
+  async function step(id, label, fn) {
+    onProgress({ type: "step_start", step: id, label });
+    try {
+      const result = await fn();
+      onProgress({ type: "step_done", step: id, label });
+      return result;
+    } catch (err) {
+      onProgress({
+        type: "step_failed",
+        step: id,
+        label,
+        error: err instanceof Error ? err.message : String(err)
+      });
+      throw err;
+    }
+  }
+  const portal = new PortalClient(input.session, input.teamId);
+  await step("init", "Initialize Apple Developer portal session", () => portal.init());
+  for (const certId of opts.revokeCertIds) {
+    await step(`revoke:${certId}`, `Revoke distribution certificate ${certId}`, async () => {
+      await portal.revokeCertificate(certId, DIST_CERT_TYPE);
+      created.revokedCertIds.push(certId);
+    });
+  }
+  const appIdId = await step(
+    "bundle_id",
+    `Bundle identifier ${input.bundleIdentifier}`,
+    () => ensureBundleId(portal, input.bundleIdentifier, input.appName, warnings)
+  );
+  created.bundleIdId = appIdId;
+  const dist = await step("dist_cert", "Distribution certificate", () => createDistCert(portal));
+  created.certificateId = dist.certificateId;
+  const certPassword = input.certPassword ?? randomPassword();
+  const distP12 = await step(
+    "p12",
+    "Bundle distribution .p12",
+    async () => bundleP12({
+      certificate: dist.certContent,
+      privateKeyPem: dist.privateKeyPem,
+      password: certPassword,
+      friendlyName: `${input.appName} Distribution`
+    })
+  );
+  const existingProfiles = await portal.listProfiles();
+  const profileName = buildProfileName(
+    input.appName,
+    (existingProfiles ?? []).map((p) => p.name)
+  );
+  const profile = await step("profile", `App Store provisioning profile (${profileName})`, async () => {
+    const p = await portal.createProfile({
+      appIdId,
+      name: profileName,
+      distributionType: "store",
+      certificateIds: [dist.certificateId]
+    });
+    const content = await portal.downloadProfile(p.provisioningProfileId);
+    return { id: p.provisioningProfileId, content };
+  });
+  created.provisioningProfileId = profile.id;
+  const profileMeta = extractProfileMetadata(profile.content);
+  if (profileMeta.uuid) created.profileUuid = profileMeta.uuid;
+  for (const keyId of opts.revokeApnsKeyIds) {
+    await step(`revoke_apns:${keyId}`, `Revoke APNs auth key ${keyId}`, async () => {
+      await portal.revokeApiKey(keyId);
+    });
+  }
+  if (opts.generateApnsAuthKey) {
+    await step("apns_auth_key", "APNs Authentication Key (.p8)", async () => {
+      try {
+        const key = await portal.createApnsAuthKey(`${input.appName} APNs`);
+        created.apnsAuthKeyId = key.keyId;
+        additionalCerts.push({
+          cert_type: "apns_key",
+          cert_base64: Buffer.from(key.pem, "utf-8").toString("base64"),
+          cert_password: key.keyId
+        });
+      } catch (err) {
+        warnings.push(
+          `APNs Authentication Key could not be created: ${err.message}. You can upload an existing .p8 manually from the credentials list.`
+        );
+      }
+    });
+  }
+  let pushCertCache = null;
+  const loadPushCerts = async () => {
+    if (pushCertCache == null) {
+      pushCertCache = await portal.listPushCertificates();
+    }
+    return pushCertCache;
+  };
+  async function provisionLegacyPushCert(stepId, label, kind, pushType, certType, friendlyName) {
+    await step(stepId, label, async () => {
+      try {
+        const existing = findExistingPushCertForBundle(
+          await loadPushCerts(),
+          appIdId,
+          input.bundleIdentifier,
+          kind
+        );
+        if (existing) {
+          warnings.push(
+            `${label} already exists for ${input.bundleIdentifier} ("${existing.name}"` + (existing.expirationDate ? `, expires ${existing.expirationDate}` : "") + `). Skipped \u2014 Apple caps these at 1 per bundle per environment and we can't recover the existing private key. Revoke it manually in Apple Developer Portal and re-run if you need a sitepong-managed copy.`
+          );
+          return;
+        }
+        const c = await createPushCert(portal, appIdId, pushType);
+        const pushPassword = randomPassword();
+        const p12 = bundleP12({
+          certificate: c.certContent,
+          privateKeyPem: c.privateKeyPem,
+          password: pushPassword,
+          friendlyName
+        });
+        additionalCerts.push({
+          cert_type: certType,
+          cert_base64: p12.toString("base64"),
+          cert_password: pushPassword
+        });
+      } catch (err) {
+        warnings.push(
+          `${label} could not be created: ${err.message}. You can upload an existing .p12 manually from the credentials list.`
+        );
+      }
+    });
+  }
+  if (opts.generatePushProductionCert) {
+    await provisionLegacyPushCert(
+      "push_prod_cert",
+      "APS Production push certificate (.p12)",
+      "production",
+      PUSH_PROD_TYPE,
+      "aps_production",
+      `${input.appName} APNs Production`
+    );
+  }
+  if (opts.generatePushSandboxCert) {
+    await provisionLegacyPushCert(
+      "push_sandbox_cert",
+      "APS Sandbox push certificate (.p12)",
+      "sandbox",
+      PUSH_DEV_TYPE,
+      "aps_sandbox",
+      `${input.appName} APNs Sandbox`
+    );
+  }
+  let ascKeyId = "";
+  let ascIssuerId = "";
+  let ascP8Base64 = "";
+  let ascP8Pem = "";
+  if (opts.generateAscApiKey) {
+    await step("asc_api_key", "App Store Connect API key (.p8)", async () => {
+      try {
+        const iris = new IrisClient(input.session);
+        const createdKey = await iris.createApiKey({
+          nickname: `${input.appName} SitePong`,
+          roles: ["APP_MANAGER"],
+          allAppsVisible: true,
+          keyType: "PUBLIC_API"
+        });
+        created.ascApiKeyId = createdKey.id;
+        const downloaded = await iris.fetchApiKeyPrivateKey(createdKey.id);
+        if (!downloaded) {
+          throw new Error(
+            `Created key ${createdKey.kid} but Apple did not return the .p8. Revoke it at appstoreconnect.apple.com/access/integrations/api/${createdKey.id} before retrying.`
+          );
+        }
+        if (!downloaded.issuerId) {
+          throw new Error(
+            `Created key ${createdKey.kid} and got the .p8 but Apple did not return an issuer id. Revoke it at appstoreconnect.apple.com/access/integrations/api/${createdKey.id} and check ApiKey.infoAsync semantics.`
+          );
+        }
+        ascKeyId = createdKey.kid;
+        ascIssuerId = downloaded.issuerId;
+        ascP8Pem = downloaded.pem;
+        ascP8Base64 = Buffer.from(downloaded.pem, "utf-8").toString("base64");
+      } catch (err) {
+        warnings.push(
+          `Could not auto-create ASC API key: ${err.message}. Upload a .p8 manually after the wizard finishes.`
+        );
+      }
+    });
+  }
+  if ((opts.enablePushNotifications || opts.enableSignInWithApple) && ascKeyId && ascIssuerId && ascP8Pem) {
+    await step("capabilities", "Enable bundle capabilities (Push, Sign in with Apple)", async () => {
+      try {
+        const ascClient = new exports.AppStoreConnectClient({
+          keyId: ascKeyId,
+          issuerId: ascIssuerId,
+          privateKey: ascP8Pem
+        });
+        const restBundle = await ascClient.bundleIds.find(input.bundleIdentifier);
+        if (!restBundle) {
+          warnings.push(
+            `Could not look up bundle id ${input.bundleIdentifier} via REST API \u2014 capability flips skipped.`
+          );
+          return;
+        }
+        const existing = await ascClient.capabilities.listForBundleId(restBundle.id);
+        const existingTypes = new Set(existing.map((c) => c.attributes?.capabilityType));
+        const wanted = [];
+        if (opts.enablePushNotifications) {
+          wanted.push({ type: "PUSH_NOTIFICATIONS", label: "Push Notifications" });
+        }
+        if (opts.enableSignInWithApple) {
+          wanted.push({
+            type: "APPLE_ID_AUTH",
+            label: "Sign in with Apple",
+            settings: [
+              {
+                key: "APPLE_ID_AUTH_APP_CONSENT",
+                options: [{ key: "PRIMARY_APP_CONSENT" }]
+              }
+            ]
+          });
+        }
+        for (const w of wanted) {
+          if (existingTypes.has(w.type)) continue;
+          try {
+            await ascClient.capabilities.enable({
+              bundleIdId: restBundle.id,
+              capabilityType: w.type,
+              settings: w.settings
+            });
+          } catch (err) {
+            warnings.push(`Could not enable ${w.label}: ${err.message}`);
+          }
+        }
+      } catch (err) {
+        warnings.push(`Capability setup failed: ${err.message}`);
+      }
+    });
+  } else if ((opts.enablePushNotifications || opts.enableSignInWithApple) && !ascKeyId) {
+    warnings.push(
+      "Push / Sign in with Apple capabilities couldn't be flipped automatically (no ASC API key). Enable them manually in your Apple Developer Portal."
+    );
+  }
+  return {
+    team_id: input.teamId,
+    bundle_identifier: input.bundleIdentifier,
+    name: `${input.appName} \u2014 Distribution`,
+    dist_cert_base64: distP12.toString("base64"),
+    private_key_base64: Buffer.from(dist.privateKeyPem, "utf-8").toString("base64"),
+    cert_password: certPassword,
+    provisioning_profile_base64: profile.content.toString("base64"),
+    profile_name: profileMeta.name ?? profileName,
+    asc_key_id: ascKeyId,
+    asc_issuer_id: ascIssuerId,
+    asc_api_key_base64: ascP8Base64,
+    additional_certs: additionalCerts,
+    created,
+    warnings
+  };
+}
 function createRunCommand() {
   const cmd = new commander.Command("run").description("Execute a lane from Fastfile.ts").argument("<lane>", "Lane name to execute").argument("[params...]", "Key:value parameters").option("-p, --platform <platform>", "Platform (ios, android)").action(async (laneName, params, opts) => {
     const { loadFastfile: loadFastfile2 } = await Promise.resolve().then(() => (init_fastfile(), fastfile_exports));
@@ -8648,6 +9768,9 @@ exports.listActions = listActions;
 exports.listAvailableLanes = listAvailableLanes;
 exports.loadFastfile = loadFastfile;
 exports.match = match_exports;
+exports.oneClickInventory = oneClickInventory;
+exports.oneClickListTeams = oneClickListTeams;
+exports.oneClickSetup = oneClickSetup;
 exports.pem = pem_exports;
 exports.pilot = pilot_exports;
 exports.precheck = precheck_exports;