@sitepong/fastnode 0.2.0 → 0.2.1

package/dist/index.d.cts

@@ -1,18 +1,18 @@
-import { A as AppleSession } from './index-CMH_GpN9.cjs';
-export { j as App, K as AppScreenshot, M as AppScreenshotSet, I as AppScreenshotsResource, a as AppStoreConnectClient, d as AppStoreConnectConfig, b as AppStoreConnectError, G as AppStoreVersion, H as AppStoreVersionLocalization, Q as AppStoreVersionSubmission, F as AppStoreVersionsResource, x as AppsResource, m as BetaBuildLocalization, l as BetaGroup, z as BetaGroupsResource, k as Build, n as BuildBetaDetail, y as BuildsResource, B as BundleId, p as BundleIdCapability, v as BundleIdsResource, E as CapabilitiesResource, s as CapabilityOption, r as CapabilitySetting, q as CapabilitySettingInput, C as Certificate, t as CertificatesResource, D as Device, w as DevicesResource, i as JsonApiError, h as JsonApiListResponse, J as JsonApiResource, g as JsonApiResponse, L as ListParams, o as PreReleaseVersion, P as Profile, u as ProfilesResource, c as RateLimitError, R as RequestClient, f as RequestOptions, O as ReviewSubmission, N as ReviewSubmissionsResource, e as TokenConfig, T as TokenManager, U as UploadOperation } from './index-CMH_GpN9.cjs';
+import { A as AppleSession } from './index-CdfgEZwh.cjs';
+export { j as App, K as AppScreenshot, M as AppScreenshotSet, I as AppScreenshotsResource, a as AppStoreConnectClient, d as AppStoreConnectConfig, b as AppStoreConnectError, G as AppStoreVersion, H as AppStoreVersionLocalization, Q as AppStoreVersionSubmission, F as AppStoreVersionsResource, x as AppsResource, m as BetaBuildLocalization, l as BetaGroup, z as BetaGroupsResource, k as Build, n as BuildBetaDetail, y as BuildsResource, B as BundleId, p as BundleIdCapability, v as BundleIdsResource, E as CapabilitiesResource, s as CapabilityOption, r as CapabilitySetting, q as CapabilitySettingInput, C as Certificate, t as CertificatesResource, D as Device, w as DevicesResource, i as JsonApiError, h as JsonApiListResponse, J as JsonApiResource, g as JsonApiResponse, L as ListParams, o as PreReleaseVersion, P as Profile, u as ProfilesResource, c as RateLimitError, R as RequestClient, f as RequestOptions, O as ReviewSubmission, N as ReviewSubmissionsResource, e as TokenConfig, T as TokenManager, U as UploadOperation } from './index-CdfgEZwh.cjs';
 export { A as AppStoreVersionState, i as BetaReviewState, h as BuildProcessingState, B as BundleIdPlatform, f as CapabilityOptionKey, e as CapabilitySettingsKey, d as CapabilityType, C as CertificateType, g as ContentRightsDeclaration, D as DeviceClass, c as DeviceStatus, E as ExportMethod, b as Platform, a as ProfileState, P as ProfileType, R as ReleaseType } from './enums-B609j2rb.cjs';
-export { i as cert } from './index-CCs5irG7.cjs';
-export { i as sigh } from './index-Ce-WMV7c.cjs';
-export { i as match } from './index-CQd4bo3G.cjs';
-export { i as produce } from './index-KCB2q1-8.cjs';
-export { i as pilot } from './index-AD8QXY1T.cjs';
-export { i as deliver } from './index-CdYdwxpQ.cjs';
-export { i as pem } from './index-BWK-T2-S.cjs';
+export { i as cert } from './index-CtydPNxA.cjs';
+export { i as sigh } from './index-BN0iWhuw.cjs';
+export { i as match } from './index-DHxi-QPC.cjs';
+export { i as produce } from './index-BjkOUQcQ.cjs';
+export { i as pilot } from './index-BgHagzj1.cjs';
+export { i as deliver } from './index-XsMsVc3O.cjs';
+export { i as pem } from './index-DrCOh0Vh.cjs';
 export { i as gym } from './index-DrUpRXRG.cjs';
 export { i as scan } from './index-BimqCmY8.cjs';
 export { i as snapshot } from './index-CR3BFPIz.cjs';
 export { i as trainer } from './index-BoU8qt8r.cjs';
-export { i as precheck } from './index-BW8wQUGC.cjs';
+export { i as precheck } from './index-Clyf4-lu.cjs';
 export { i as frameit } from './index-BYonklf3.cjs';
 export { i as xcode } from './index-Cp6cjtd-.cjs';
 export { i as core } from './index-C2yG3wXA.cjs';
@@ -20,7 +20,7 @@ export { LaneCallback, LaneDefinition, RunLaneOptions, RunResult, afterAll, afte
 export { L as LaneContext } from './context-CymLkfrS.cjs';
 export { ActionDefinition, action, ensureActionsRegistered, getAction, listActions, registerAction } from './actions/index.cjs';
 export { createCli } from './cli/index.cjs';
-import './cert-6m1R8UeW.cjs';
+import './cert-uLLdb5a7.cjs';
 import 'commander';
 
 /**
@@ -68,6 +68,16 @@ interface OneClickInventory {
         used: number;
         max: number;
     };
+    /** Active APNs Authentication Keys. Apple caps a team at 2. */
+    apnsAuthKeys: {
+        keyId: string;
+        keyName: string;
+        dateCreated?: string;
+    }[];
+    apnsKeyCapacity: {
+        used: number;
+        max: number;
+    };
     pushCerts: {
         certificateId: string;
         name: string;
@@ -98,20 +108,37 @@ interface OneClickOptions {
     /**
      * Generate an APNs Authentication Key (.p8) for push notifications.
      * Default true. ONE key per team works for ALL apps and never expires.
-     * Created via the developer portal's `account/auth/key/v2/create`
-     * endpoint, downloaded immediately via `account/auth/key/download`.
+     * The modern replacement for the legacy per-app .p12 push certs.
      *
      * Apple allows multiple APNs keys per team — the wizard always
      * creates a new one when this flag is set, regardless of what's
      * already in the team. Unrelated existing keys are not affected.
      */
     generateApnsAuthKey?: boolean;
+    /**
+     * Generate an APNs **Production** push certificate (.p12). Default
+     * false — the modern APNs Auth Key (.p8) above replaces this and is
+     * generally preferred. Only enable if a downstream integration
+     * specifically requires the legacy cert-based APNs path.
+     *
+     * Apple caps these at 1 per bundle per environment, so existing
+     * production push certs for the bundle are left alone (the wizard
+     * skips with a warning rather than revoking).
+     */
+    generatePushProductionCert?: boolean;
+    /**
+     * Generate an APNs **Sandbox** (development) push certificate (.p12).
+     * Default false. Same caveats as `generatePushProductionCert`.
+     */
+    generatePushSandboxCert?: boolean;
     /** Enable Sign in with Apple capability on the bundle ID. Default true. */
     enableSignInWithApple?: boolean;
     /** Enable Push Notifications capability on the bundle ID. Default true. */
     enablePushNotifications?: boolean;
     /** Distribution cert IDs to revoke before creating the new one (for the 3-cert limit). */
     revokeCertIds?: string[];
+    /** APNs auth key IDs to revoke before creating the new one (Apple caps APNs keys at 2/team). */
+    revokeApnsKeyIds?: string[];
 }
 interface OneClickInput {
     session: AppleSession;

package/dist/index.d.ts

@@ -1,18 +1,18 @@
-import { A as AppleSession } from './index-D2z7RiAM.js';
-export { j as App, K as AppScreenshot, M as AppScreenshotSet, I as AppScreenshotsResource, a as AppStoreConnectClient, d as AppStoreConnectConfig, b as AppStoreConnectError, G as AppStoreVersion, H as AppStoreVersionLocalization, Q as AppStoreVersionSubmission, F as AppStoreVersionsResource, x as AppsResource, m as BetaBuildLocalization, l as BetaGroup, z as BetaGroupsResource, k as Build, n as BuildBetaDetail, y as BuildsResource, B as BundleId, p as BundleIdCapability, v as BundleIdsResource, E as CapabilitiesResource, s as CapabilityOption, r as CapabilitySetting, q as CapabilitySettingInput, C as Certificate, t as CertificatesResource, D as Device, w as DevicesResource, i as JsonApiError, h as JsonApiListResponse, J as JsonApiResource, g as JsonApiResponse, L as ListParams, o as PreReleaseVersion, P as Profile, u as ProfilesResource, c as RateLimitError, R as RequestClient, f as RequestOptions, O as ReviewSubmission, N as ReviewSubmissionsResource, e as TokenConfig, T as TokenManager, U as UploadOperation } from './index-D2z7RiAM.js';
+import { A as AppleSession } from './index-BwwpAlk2.js';
+export { j as App, K as AppScreenshot, M as AppScreenshotSet, I as AppScreenshotsResource, a as AppStoreConnectClient, d as AppStoreConnectConfig, b as AppStoreConnectError, G as AppStoreVersion, H as AppStoreVersionLocalization, Q as AppStoreVersionSubmission, F as AppStoreVersionsResource, x as AppsResource, m as BetaBuildLocalization, l as BetaGroup, z as BetaGroupsResource, k as Build, n as BuildBetaDetail, y as BuildsResource, B as BundleId, p as BundleIdCapability, v as BundleIdsResource, E as CapabilitiesResource, s as CapabilityOption, r as CapabilitySetting, q as CapabilitySettingInput, C as Certificate, t as CertificatesResource, D as Device, w as DevicesResource, i as JsonApiError, h as JsonApiListResponse, J as JsonApiResource, g as JsonApiResponse, L as ListParams, o as PreReleaseVersion, P as Profile, u as ProfilesResource, c as RateLimitError, R as RequestClient, f as RequestOptions, O as ReviewSubmission, N as ReviewSubmissionsResource, e as TokenConfig, T as TokenManager, U as UploadOperation } from './index-BwwpAlk2.js';
 export { A as AppStoreVersionState, i as BetaReviewState, h as BuildProcessingState, B as BundleIdPlatform, f as CapabilityOptionKey, e as CapabilitySettingsKey, d as CapabilityType, C as CertificateType, g as ContentRightsDeclaration, D as DeviceClass, c as DeviceStatus, E as ExportMethod, b as Platform, a as ProfileState, P as ProfileType, R as ReleaseType } from './enums-B609j2rb.js';
-export { i as cert } from './index-CQKpbHZt.js';
-export { i as sigh } from './index-CojSGJ7m.js';
-export { i as match } from './index-DZaPkUnC.js';
-export { i as produce } from './index-BpiEBPVd.js';
-export { i as pilot } from './index-D82CmjMP.js';
-export { i as deliver } from './index-CsFIp7OO.js';
-export { i as pem } from './index-Kq3rbG0u.js';
+export { i as cert } from './index-BNP7Bpu5.js';
+export { i as sigh } from './index-CEldrbyz.js';
+export { i as match } from './index-Di4Ic0EE.js';
+export { i as produce } from './index-EKU_G1G5.js';
+export { i as pilot } from './index-mddpvrRX.js';
+export { i as deliver } from './index-BbY_H_f6.js';
+export { i as pem } from './index-C2YLoFVl.js';
 export { i as gym } from './index-DImN9PWc.js';
 export { i as scan } from './index-BimqCmY8.js';
 export { i as snapshot } from './index-CR3BFPIz.js';
 export { i as trainer } from './index-BoU8qt8r.js';
-export { i as precheck } from './index-CLsvyTkh.js';
+export { i as precheck } from './index-jeI44Q5G.js';
 export { i as frameit } from './index-BYonklf3.js';
 export { i as xcode } from './index-Cp6cjtd-.js';
 export { i as core } from './index-C2yG3wXA.js';
@@ -20,7 +20,7 @@ export { LaneCallback, LaneDefinition, RunLaneOptions, RunResult, afterAll, afte
 export { L as LaneContext } from './context-CymLkfrS.js';
 export { ActionDefinition, action, ensureActionsRegistered, getAction, listActions, registerAction } from './actions/index.js';
 export { createCli } from './cli/index.js';
-import './cert-DtYDJBjG.js';
+import './cert-e5GAgAPb.js';
 import 'commander';
 
 /**
@@ -68,6 +68,16 @@ interface OneClickInventory {
         used: number;
         max: number;
     };
+    /** Active APNs Authentication Keys. Apple caps a team at 2. */
+    apnsAuthKeys: {
+        keyId: string;
+        keyName: string;
+        dateCreated?: string;
+    }[];
+    apnsKeyCapacity: {
+        used: number;
+        max: number;
+    };
     pushCerts: {
         certificateId: string;
         name: string;
@@ -98,20 +108,37 @@ interface OneClickOptions {
     /**
      * Generate an APNs Authentication Key (.p8) for push notifications.
      * Default true. ONE key per team works for ALL apps and never expires.
-     * Created via the developer portal's `account/auth/key/v2/create`
-     * endpoint, downloaded immediately via `account/auth/key/download`.
+     * The modern replacement for the legacy per-app .p12 push certs.
      *
      * Apple allows multiple APNs keys per team — the wizard always
      * creates a new one when this flag is set, regardless of what's
      * already in the team. Unrelated existing keys are not affected.
      */
     generateApnsAuthKey?: boolean;
+    /**
+     * Generate an APNs **Production** push certificate (.p12). Default
+     * false — the modern APNs Auth Key (.p8) above replaces this and is
+     * generally preferred. Only enable if a downstream integration
+     * specifically requires the legacy cert-based APNs path.
+     *
+     * Apple caps these at 1 per bundle per environment, so existing
+     * production push certs for the bundle are left alone (the wizard
+     * skips with a warning rather than revoking).
+     */
+    generatePushProductionCert?: boolean;
+    /**
+     * Generate an APNs **Sandbox** (development) push certificate (.p12).
+     * Default false. Same caveats as `generatePushProductionCert`.
+     */
+    generatePushSandboxCert?: boolean;
     /** Enable Sign in with Apple capability on the bundle ID. Default true. */
     enableSignInWithApple?: boolean;
     /** Enable Push Notifications capability on the bundle ID. Default true. */
     enablePushNotifications?: boolean;
     /** Distribution cert IDs to revoke before creating the new one (for the 3-cert limit). */
     revokeCertIds?: string[];
+    /** APNs auth key IDs to revoke before creating the new one (Apple caps APNs keys at 2/team). */
+    revokeApnsKeyIds?: string[];
 }
 interface OneClickInput {
     session: AppleSession;

package/dist/index.mjs

@@ -2476,6 +2476,12 @@ var init_xcode_metrics = __esm({
 });
 
 // src/client/portal.ts
+function pickUniqueKeyName(base, taken) {
+  if (!taken.has(base)) return base;
+  let n = 1;
+  while (taken.has(`${base} - ${n}`)) n++;
+  return `${base} - ${n}`;
+}
 var PORTAL_BASE, PortalClient;
 var init_portal = __esm({
   "src/client/portal.ts"() {
@@ -2594,12 +2600,17 @@ var init_portal = __esm({
        * + period and collapse whitespace.
        */
       async createApiKey(rawName, serviceConfigurations = {}) {
-        const name = rawName.replace(/[^A-Za-z0-9 _\-.]/g, " ").replace(/\s+/g, " ").trim().slice(0, 50);
-        if (!name) throw new Error("createApiKey: name is empty after sanitization");
+        const baseName = rawName.replace(/[^A-Za-z0-9 _\-.]/g, " ").replace(/\s+/g, " ").trim().slice(0, 45);
+        if (!baseName) throw new Error("createApiKey: name is empty after sanitization");
+        let existingNames = /* @__PURE__ */ new Set();
         try {
-          await this.listApiKeys();
+          const list = await this.listApiKeys();
+          existingNames = new Set(
+            (list.keys ?? []).map((k) => String(k.keyName ?? "").trim())
+          );
         } catch {
         }
+        const name = pickUniqueKeyName(baseName, existingNames);
         const body = {
           teamId: this.teamId,
           name,
@@ -2654,14 +2665,24 @@ var init_portal = __esm({
        * The exact body comes from @expo/apple-utils v2.1.21 — both fields
        * are produced by separate functions (`d` for the map, `h` for the
        * array) and merged into the create payload.
+       *
+       * Apple also rejects duplicate key names ("Another key with same
+       * name exists") — we dedupe by listing existing keys first and
+       * appending " (N)" until we find a free slot, mirroring the
+       * provisioning profile dedup.
        */
       async createApnsAuthKey(rawName) {
-        const name = rawName.replace(/[^A-Za-z0-9 _\-.]/g, " ").replace(/\s+/g, " ").trim().slice(0, 50);
-        if (!name) throw new Error("createApnsAuthKey: name is empty after sanitization");
+        const baseName = rawName.replace(/[^A-Za-z0-9 _\-.]/g, " ").replace(/\s+/g, " ").trim().slice(0, 45);
+        if (!baseName) throw new Error("createApnsAuthKey: name is empty after sanitization");
+        let existingNames = /* @__PURE__ */ new Set();
         try {
-          await this.listApiKeys();
+          const list = await this.listApiKeys();
+          existingNames = new Set(
+            (list.keys ?? []).map((k) => String(k.keyName ?? "").trim())
+          );
         } catch {
         }
+        const name = pickUniqueKeyName(baseName, existingNames);
         const body = {
           teamId: this.teamId,
           name,
@@ -8977,6 +8998,8 @@ init_iris();
 init_client();
 init_csr();
 var DIST_CERT_TYPE = PortalClient.CERT_TYPES.IOS_DISTRIBUTION;
+var PUSH_PROD_TYPE = PortalClient.CERT_TYPES.IOS_PRODUCTION_PUSH;
+var PUSH_DEV_TYPE = PortalClient.CERT_TYPES.IOS_DEVELOPMENT_PUSH;
 function randomPassword(length = 32) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
   const bytes = randomBytes(length);
@@ -9023,11 +9046,12 @@ async function oneClickListTeams(session) {
 async function oneClickInventory(session, teamId) {
   const portal = new PortalClient(session, teamId);
   await portal.init();
-  const [appIds, allCerts, profiles, pushCerts] = await Promise.all([
+  const [appIds, allCerts, profiles, pushCerts, apiKeys] = await Promise.all([
     portal.listAppIds(),
     portal.listCertificates([DIST_CERT_TYPE]),
     portal.listProfiles(),
-    portal.listPushCertificates()
+    portal.listPushCertificates(),
+    portal.listApiKeys().catch(() => ({ keys: [] }))
   ]);
   const distributionCerts = (allCerts ?? []).map((c) => ({
     certificateId: c.certificateId,
@@ -9036,6 +9060,15 @@ async function oneClickInventory(session, teamId) {
     expirationDate: c.expirationDateString,
     ownerName: c.ownerName
   }));
+  const apnsAuthKeys = (apiKeys.keys ?? []).filter(
+    (k) => (k.services ?? []).some(
+      (s) => s.id === PortalClient.APNS_SERVICE_ID || /apns/i.test(s.name ?? "")
+    )
+  ).map((k) => ({
+    keyId: k.keyId,
+    keyName: k.keyName,
+    dateCreated: k.dateCreated
+  }));
   return {
     team: { id: teamId },
     bundleIds: (appIds ?? []).map((a) => ({
@@ -9045,6 +9078,8 @@ async function oneClickInventory(session, teamId) {
     })),
     distributionCerts,
     distCertCapacity: { used: distributionCerts.length, max: 3 },
+    apnsAuthKeys,
+    apnsKeyCapacity: { used: apnsAuthKeys.length, max: 2 },
     pushCerts: (pushCerts ?? []).map((c) => ({
       certificateId: c.certificateId,
       name: c.name ?? "Push",
@@ -9082,15 +9117,52 @@ async function createDistCert(portal) {
   }
   return { certificateId: cert.certificateId, privateKeyPem: privateKey, certContent };
 }
+async function createPushCert(portal, appIdId, type) {
+  const { csr, privateKey } = generateRSACSR();
+  const cert = await portal.createCertificate({ type, csrContent: csr, appIdId });
+  let certContent;
+  if (cert.certificateContent) {
+    certContent = Buffer.from(cert.certificateContent, "base64");
+  } else {
+    certContent = await portal.downloadCertificate(cert.certificateId, type);
+  }
+  return { certificateId: cert.certificateId, privateKeyPem: privateKey, certContent };
+}
+function findExistingPushCertForBundle(pushCerts, appIdId, bundleIdentifier, kind) {
+  for (const c of pushCerts) {
+    const appMatches = c.appId?.appIdId === appIdId || c.appId?.identifier === bundleIdentifier;
+    if (!appMatches) continue;
+    const ts = (c.typeString ?? "").toLowerCase();
+    const name = (c.name ?? "").toLowerCase();
+    const looksLikePush = ts.includes("push") || ts.includes("apns") || name.includes("apple push services");
+    if (!looksLikePush) continue;
+    const isProduction = ts.includes("production");
+    const isSandbox = ts.includes("development") || ts.includes("sandbox");
+    const isUnified = !isProduction && !isSandbox;
+    if (!isUnified) {
+      if (kind === "production" && !isProduction) continue;
+      if (kind === "sandbox" && !isSandbox) continue;
+    }
+    return {
+      certificateId: c.certificateId,
+      name: c.name ?? "Apple Push Services",
+      expirationDate: c.expirationDateString
+    };
+  }
+  return null;
+}
 async function oneClickSetup(input) {
   const opts = {
     generateDistributionCert: input.options?.generateDistributionCert ?? true,
     generateStoreProfile: input.options?.generateStoreProfile ?? true,
     generateAscApiKey: input.options?.generateAscApiKey ?? true,
     generateApnsAuthKey: input.options?.generateApnsAuthKey ?? true,
+    generatePushProductionCert: input.options?.generatePushProductionCert ?? false,
+    generatePushSandboxCert: input.options?.generatePushSandboxCert ?? false,
     enableSignInWithApple: input.options?.enableSignInWithApple ?? true,
     enablePushNotifications: input.options?.enablePushNotifications ?? true,
-    revokeCertIds: input.options?.revokeCertIds ?? []
+    revokeCertIds: input.options?.revokeCertIds ?? [],
+    revokeApnsKeyIds: input.options?.revokeApnsKeyIds ?? []
   };
   const onProgress = input.onProgress ?? (() => {
   });
@@ -9161,6 +9233,11 @@ async function oneClickSetup(input) {
   created.provisioningProfileId = profile.id;
   const profileMeta = extractProfileMetadata(profile.content);
   if (profileMeta.uuid) created.profileUuid = profileMeta.uuid;
+  for (const keyId of opts.revokeApnsKeyIds) {
+    await step(`revoke_apns:${keyId}`, `Revoke APNs auth key ${keyId}`, async () => {
+      await portal.revokeApiKey(keyId);
+    });
+  }
   if (opts.generateApnsAuthKey) {
     await step("apns_auth_key", "APNs Authentication Key (.p8)", async () => {
       try {
@@ -9178,6 +9255,68 @@ async function oneClickSetup(input) {
       }
     });
   }
+  let pushCertCache = null;
+  const loadPushCerts = async () => {
+    if (pushCertCache == null) {
+      pushCertCache = await portal.listPushCertificates();
+    }
+    return pushCertCache;
+  };
+  async function provisionLegacyPushCert(stepId, label, kind, pushType, certType, friendlyName) {
+    await step(stepId, label, async () => {
+      try {
+        const existing = findExistingPushCertForBundle(
+          await loadPushCerts(),
+          appIdId,
+          input.bundleIdentifier,
+          kind
+        );
+        if (existing) {
+          warnings.push(
+            `${label} already exists for ${input.bundleIdentifier} ("${existing.name}"` + (existing.expirationDate ? `, expires ${existing.expirationDate}` : "") + `). Skipped \u2014 Apple caps these at 1 per bundle per environment and we can't recover the existing private key. Revoke it manually in Apple Developer Portal and re-run if you need a sitepong-managed copy.`
+          );
+          return;
+        }
+        const c = await createPushCert(portal, appIdId, pushType);
+        const pushPassword = randomPassword();
+        const p12 = bundleP12({
+          certificate: c.certContent,
+          privateKeyPem: c.privateKeyPem,
+          password: pushPassword,
+          friendlyName
+        });
+        additionalCerts.push({
+          cert_type: certType,
+          cert_base64: p12.toString("base64"),
+          cert_password: pushPassword
+        });
+      } catch (err) {
+        warnings.push(
+          `${label} could not be created: ${err.message}. You can upload an existing .p12 manually from the credentials list.`
+        );
+      }
+    });
+  }
+  if (opts.generatePushProductionCert) {
+    await provisionLegacyPushCert(
+      "push_prod_cert",
+      "APS Production push certificate (.p12)",
+      "production",
+      PUSH_PROD_TYPE,
+      "aps_production",
+      `${input.appName} APNs Production`
+    );
+  }
+  if (opts.generatePushSandboxCert) {
+    await provisionLegacyPushCert(
+      "push_sandbox_cert",
+      "APS Sandbox push certificate (.p12)",
+      "sandbox",
+      PUSH_DEV_TYPE,
+      "aps_sandbox",
+      `${input.appName} APNs Sandbox`
+    );
+  }
   let ascKeyId = "";
   let ascIssuerId = "";
   let ascP8Base64 = "";