@sitepong/fastnode 0.2.1 → 0.3.0

package/dist/cli/index.cjs

@@ -13,6 +13,7 @@ var readline = require('readline');
 var emojiRegex = require('emoji-regex');
 var jose = require('jose');
 var commander = require('commander');
+var stream = require('stream');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
@@ -209,8 +210,8 @@ async function revokeExpiredCertificates(options) {
   return count;
 }
 async function importToKeychain(certData, keychainPath, keychainPassword) {
-  const { tmpdir: tmpdir8 } = await import('os');
-  const tempCertPath = path.join(tmpdir8(), `fastnode-cert-${Date.now()}.cer`);
+  const { tmpdir: tmpdir7 } = await import('os');
+  const tempCertPath = path.join(tmpdir7(), `fastnode-cert-${Date.now()}.cer`);
   await promises.writeFile(tempCertPath, certData);
   try {
     const args = [
@@ -1779,6 +1780,34 @@ var init_srp = __esm({
     };
   }
 });
+
+// src/client/apple-session.ts
+var apple_session_exports = {};
+__export(apple_session_exports, {
+  ProgramLicenseAgreementError: () => ProgramLicenseAgreementError,
+  appleJson: () => appleJson,
+  beginLogin: () => beginLogin,
+  checkPortalResponse: () => checkPortalResponse,
+  fetchServiceKey: () => fetchServiceKey,
+  loginWithAppleId: () => loginWithAppleId,
+  requestSmsCode: () => requestSmsCode,
+  serviceKeyFromLocation: () => serviceKeyFromLocation,
+  submitTwoFactorCode: () => submitTwoFactorCode
+});
+async function appleJson(res, what) {
+  const text = await res.text();
+  try {
+    return JSON.parse(text);
+  } catch {
+    const contentType = (res.headers.get("content-type") ?? "").split(";")[0].trim();
+    const title = /<title>([^<]{1,120})<\/title>/i.exec(text)?.[1]?.trim();
+    const looksHtml = /^\s*<(!doctype|html)/i.test(text) || contentType === "text/html";
+    const page = looksHtml ? "an HTML page" : contentType ? `a ${contentType} response` : "a non-JSON response";
+    throw new Error(
+      `Apple answered the ${what} with ${page} (HTTP ${res.status}${title ? `, "${title}"` : ""}) instead of JSON. Apple is refusing or rate-limiting sign-ins from this server right now; wait a few minutes and try again. If it keeps happening, sign in once at appleid.apple.com to clear any hold on the account.`
+    );
+  }
+}
 function checkPortalResponse(body, session) {
   if (!body || typeof body !== "object") return;
   if (body.resultCode === 4100) {
@@ -1855,7 +1884,7 @@ async function beginLogin(config) {
 }
 async function fetchTwoFactorChallenge(pending) {
   const r = await fetch(`${AUTH_BASE}`, { headers: buildAuthHeadersFromPending(pending) });
-  const body = await r.json();
+  const body = await appleJson(r, "two-factor challenge");
   const trustedPhoneNumbers = (body.trustedPhoneNumbers ?? []).map((p) => ({
     id: p.id,
     numberWithDialCode: p.numberWithDialCode,
@@ -1876,7 +1905,8 @@ async function requestSmsCode(input) {
     body: JSON.stringify({ phoneNumber: { id: input.phoneId }, mode: input.mode ?? "sms" })
   });
 }
-async function submitTwoFactorCode(input) {
+async function submitTwoFactorCode(rawInput) {
+  const input = { ...rawInput, code: rawInput.code.replace(/[\s\u00a0]+/g, "") };
   const log = input.onLog ?? (() => {
   });
   let path;
@@ -1988,9 +2018,12 @@ async function doSirp(user, password, serviceKey, cookieStr, hashcash) {
     body: JSON.stringify({ a: aBase64, accountName: user, protocols: ["s2k", "s2k_fo"] }),
     redirect: "manual"
   });
-  const initBody = await initRes.json();
+  const initBody = await appleJson(initRes, "sign-in init");
   if (initBody.serviceErrors) throw new Error(`Apple auth error: ${JSON.stringify(initBody.serviceErrors)}`);
   const { iteration: iterations, salt: saltB64, b: bB64, c, protocol } = initBody;
+  if (!iterations || !saltB64 || !bB64 || !c || !protocol) {
+    throw new Error(`Apple's sign-in init answered without a challenge (HTTP ${initRes.status}): ${JSON.stringify(initBody).slice(0, 300)}`);
+  }
   const salt = Buffer.from(saltB64, "base64");
   const b = Buffer.from(bB64, "base64");
   const encryptedPassword = applePbkdf2(password, salt, iterations, 32, protocol);
@@ -2033,7 +2066,7 @@ async function fetchOlympusSession(session) {
   const cookieStr = Object.entries(session.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
   const res = await fetch(OLYMPUS_SESSION, { headers: { Cookie: cookieStr, Accept: "application/json" } });
   if (res.ok) {
-    const body = await res.json();
+    const body = await appleJson(res, "session lookup");
     if (body?.user?.emailAddress) session.userEmail = body.user.emailAddress;
     if (body?.provider?.providerId) session.teamId = String(body.provider.providerId);
   }
@@ -2045,7 +2078,7 @@ async function fetchContractMessages(session) {
       headers: { Cookie: cookieStr, Accept: "application/json" }
     });
     if (!res.ok) return [];
-    const body = await res.json();
+    const body = await appleJson(res, "agreements lookup");
     return (body ?? []).map((m) => ({
       id: m.id ?? "",
       group: m.group ?? "",
@@ -2056,10 +2089,22 @@ async function fetchContractMessages(session) {
     return [];
   }
 }
-async function fetchServiceKey() {
-  const res = await fetch(WIDGET_KEY_URL);
-  const body = await res.json();
-  if (!body?.authServiceKey) throw new Error("Could not fetch Apple service key");
+function serviceKeyFromLocation(location) {
+  if (!location) return null;
+  try {
+    const key = new URL(location).searchParams.get("widgetKey")?.trim();
+    return key && /^[0-9a-f]{16,}$/i.test(key) ? key : null;
+  } catch {
+    return null;
+  }
+}
+async function fetchServiceKey(fetchImpl = fetch) {
+  const head = await fetchImpl(LOGOUT_URL, { method: "HEAD", redirect: "manual" });
+  const fromRedirect = serviceKeyFromLocation(head.headers.get("location"));
+  if (fromRedirect) return fromRedirect;
+  const res = await fetchImpl(WIDGET_KEY_URL);
+  const body = await appleJson(res, "service key request");
+  if (!body?.authServiceKey) throw new Error("Could not fetch Apple service key: the sign-out redirect carried no widgetKey and the config endpoint had no authServiceKey.");
   return body.authServiceKey;
 }
 function buildAuthHeaders(session) {
@@ -2107,7 +2152,7 @@ async function defaultPrompt(message) {
     });
   });
 }
-var AUTH_BASE, OLYMPUS_SESSION, WIDGET_KEY_URL, ProgramLicenseAgreementError;
+var AUTH_BASE, OLYMPUS_SESSION, WIDGET_KEY_URL, ProgramLicenseAgreementError, LOGOUT_URL;
 var init_apple_session = __esm({
   "src/client/apple-session.ts"() {
     init_srp();
@@ -2122,6 +2167,7 @@ var init_apple_session = __esm({
       }
       agreements;
     };
+    LOGOUT_URL = "https://appstoreconnect.apple.com/logout";
   }
 });
 
@@ -2438,9 +2484,10 @@ async function uploadWithTransporter(options) {
   const transporterBin = await resolveTransporter();
   const platform = options.platform ?? "ios";
   const timeout = options.timeout ?? 18e5;
-  const keyDir = await promises.mkdtemp(path.join(os.tmpdir(), "fastnode-itms-"));
+  const keyDir = path.join(os.homedir(), ".appstoreconnect", "private_keys");
+  await promises.mkdir(keyDir, { recursive: true });
   const keyPath = path.join(keyDir, `AuthKey_${options.apiKeyId}.p8`);
-  await promises.writeFile(keyPath, options.apiPrivateKey);
+  await promises.writeFile(keyPath, options.apiPrivateKey, { mode: 384 });
   return new Promise((resolve4) => {
     const args = [
       "-m",
@@ -2456,6 +2503,9 @@ async function uploadWithTransporter(options) {
       "-WONoPause",
       "true"
     ];
+    if (options.assetDescriptionPath) {
+      args.push("-assetDescription", options.assetDescriptionPath);
+    }
     if (platform !== "ios") {
       args.push("-bundleType", platform);
     }
@@ -2479,13 +2529,13 @@ async function uploadWithTransporter(options) {
     child.stderr.on("data", onData);
     child.on("close", async (code) => {
       clearTimeout(timer);
-      await promises.rm(keyDir, { recursive: true, force: true }).catch(() => {
+      await promises.rm(keyPath, { force: true }).catch(() => {
       });
       resolve4({ success: code === 0, output, backend: "transporter" });
     });
     child.on("error", async (err) => {
       clearTimeout(timer);
-      await promises.rm(keyDir, { recursive: true, force: true }).catch(() => {
+      await promises.rm(keyPath, { force: true }).catch(() => {
       });
       resolve4({
         success: false,
@@ -2777,6 +2827,311 @@ var init_metadata = __esm({
     };
   }
 });
+function categoryFor(placementType) {
+  return placementType === "APP_SCREENSHOT" || placementType === "IMESSAGE_APP_SCREENSHOT" || placementType === "APP_PREVIEW" ? "APP_SCREENSHOTS_AND_PREVIEWS" : "CREATIVE_ASSETS";
+}
+function readImageSize(data) {
+  if (data.length >= 26 && data.readUInt32BE(0) === 2303741511) {
+    const colorType = data[25];
+    return {
+      width: data.readUInt32BE(16),
+      height: data.readUInt32BE(20),
+      alpha: colorType === 4 || colorType === 6
+    };
+  }
+  if (data.length >= 4 && data[0] === 255 && data[1] === 216) {
+    let offset = 2;
+    while (offset + 9 < data.length) {
+      if (data[offset] !== 255) return null;
+      const marker = data[offset + 1];
+      const length = data.readUInt16BE(offset + 2);
+      const isSof = marker >= 192 && marker <= 207 && marker !== 196 && marker !== 200 && marker !== 204;
+      if (isSof) {
+        return { height: data.readUInt16BE(offset + 5), width: data.readUInt16BE(offset + 7), alpha: false };
+      }
+      offset += 2 + length;
+    }
+  }
+  return null;
+}
+function fits(spec, width, height) {
+  const d = spec.dimensions;
+  return width >= d.minWidth && width <= d.maxWidth && height >= d.minHeight && height <= d.maxHeight;
+}
+function groupsForFeature(refData, feature, placementType) {
+  const mappings = refData.placementTypes?.find((p) => p.placementTypeId === placementType)?.specMappings ?? [];
+  const all = mappings.map((m) => m.placementGroupId);
+  const policy = refData.features?.find((f) => f.featureId === feature)?.placementPolicies?.find((p) => p.placementType === placementType);
+  const limited = policy?.groupLimits?.flatMap((l) => l.groupIds);
+  return limited?.length ? all.filter((g) => limited.includes(g)) : all;
+}
+function maxCountFor(refData, feature, placementType, placementGroup) {
+  return refData.features?.find((f) => f.featureId === feature)?.placementPolicies?.find((p) => p.placementType === placementType)?.groupLimits?.find((l) => l.groupIds.includes(placementGroup))?.maxCount;
+}
+function resolveImageGroups(refData, feature, placementType, size) {
+  const specs = (refData.imageSpecs ?? []).filter(
+    (s) => s.compatiblePlacementTypes.includes(placementType) && fits(s, size.width, size.height)
+  );
+  const specIds = new Set(specs.map((s) => s.specId));
+  const allowed = new Set(groupsForFeature(refData, feature, placementType));
+  const mappings = refData.placementTypes?.find((p) => p.placementTypeId === placementType)?.specMappings ?? [];
+  const groups = mappings.filter((m) => allowed.has(m.placementGroupId) && m.specs.some((id) => specIds.has(id))).map((m) => m.placementGroupId);
+  return { groups: [...new Set(groups)], spec: specs[0] };
+}
+async function runUploadOperations(ops, data) {
+  for (const op of ops) {
+    const headers = {};
+    for (const h of op.requestHeaders) headers[h.name] = h.value;
+    const res = await fetch(op.url, {
+      method: op.method,
+      headers,
+      body: data.subarray(op.offset, op.offset + op.length)
+    });
+    if (!res.ok) {
+      throw new Error(`Upload operation failed: ${op.method} ${new URL(op.url).host} \u2192 HTTP ${res.status}`);
+    }
+  }
+}
+async function uploadLibraryAsset(options) {
+  const { client, libraryId, filePath, category } = options;
+  const data = await promises.readFile(filePath);
+  const fileName = path.basename(filePath);
+  const kind = VIDEO_EXTENSIONS.includes(path.extname(filePath).toLowerCase()) ? "video" : "image";
+  const hash = crypto.createHash("sha256").update(data).digest("hex").slice(0, 12);
+  const referenceName = `${options.referenceName ?? fileName} #${hash}`;
+  const media = kind === "image" ? client.appAssetLibraryImages : client.appAssetLibraryVideos;
+  const filter = { filter: { referenceName } };
+  const existing = kind === "image" ? await client.appAssetLibraries.listImages(libraryId, filter) : await client.appAssetLibraries.listVideos(libraryId, filter);
+  const reusable = existing.find(
+    (a) => a.attributes.category === category && a.attributes.state && READY_STATES.includes(a.attributes.state)
+  );
+  if (reusable) {
+    return { kind, id: reusable.id, state: reusable.attributes.state, reused: true };
+  }
+  const reserved = kind === "image" ? await client.appAssetLibraryImages.create({ libraryId, fileName, fileSize: data.length, category, referenceName }) : await client.appAssetLibraryVideos.create({
+    libraryId,
+    fileName,
+    fileSize: data.length,
+    category,
+    referenceName,
+    previewFrameTimeCode: options.previewFrameTimeCode
+  });
+  await runUploadOperations(reserved.attributes.uploadOperations ?? [], data);
+  await media.update(reserved.id, { uploaded: true });
+  options.log?.(`uploaded ${fileName} (${kind}, ${data.length} bytes)`);
+  const state = await waitForAssetReady(
+    () => media.get(reserved.id),
+    options.pollIntervalMs ?? 3e3,
+    options.timeoutMs ?? (kind === "video" ? 30 * 6e4 : 5 * 6e4)
+  );
+  return { kind, id: reserved.id, state, reused: false };
+}
+async function waitForAssetReady(get, intervalMs, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    const asset = await get();
+    const state = asset.attributes.state;
+    if (state === "FAILED") {
+      const why = (asset.attributes.stateDetails ?? []).map((d) => d.message ?? d.code).filter(Boolean).join("; ");
+      throw new Error(`Asset processing failed${why ? `: ${why}` : ""}`);
+    }
+    if (state && READY_STATES.includes(state)) return state;
+    if (Date.now() > deadline) throw new Error(`Asset still ${state ?? "unknown"} after ${timeoutMs / 1e3}s`);
+    await new Promise((r) => setTimeout(r, intervalMs));
+  }
+}
+async function listFiles(dir) {
+  return (await promises.readdir(dir)).filter((f) => !f.startsWith(".")).sort((a, b) => a.localeCompare(b, void 0, { numeric: true }));
+}
+async function isDir(path) {
+  return (await promises.stat(path)).isDirectory();
+}
+async function planLocale(localeDir, refData, feature, folders, warn) {
+  const planned = [];
+  for (const [folder, placementType] of Object.entries(folders)) {
+    const typeDir = path.join(localeDir, folder);
+    if (!fs.existsSync(typeDir)) continue;
+    const known = new Set(groupsForFeature(refData, feature, placementType));
+    const entries = [];
+    for (const entry of await listFiles(typeDir)) {
+      const full = path.join(typeDir, entry);
+      if (await isDir(full)) {
+        if (!known.has(entry)) {
+          warn(`${path.relative(localeDir, full)}: "${entry}" is not a ${placementType} placement group for ${feature} \u2014 skipped`);
+          continue;
+        }
+        for (const f of await listFiles(full)) entries.push({ filePath: path.join(full, f), group: entry });
+      } else {
+        entries.push({ filePath: full });
+      }
+    }
+    for (const { filePath, group } of entries) {
+      const ext = path.extname(filePath).toLowerCase();
+      const isVideo = VIDEO_EXTENSIONS.includes(ext);
+      if (!isVideo && !IMAGE_EXTENSIONS.includes(ext)) continue;
+      const needsVideo = placementType === "APP_PREVIEW";
+      const needsImage = placementType === "APP_SCREENSHOT" || placementType === "IMESSAGE_APP_SCREENSHOT";
+      if (needsVideo && !isVideo || needsImage && isVideo) {
+        warn(`${path.relative(localeDir, filePath)}: ${isVideo ? "video" : "image"} cannot be a ${placementType} \u2014 skipped`);
+        continue;
+      }
+      if (group) {
+        planned.push({ filePath, placementType, groups: [group] });
+        continue;
+      }
+      if (isVideo) {
+        if (known.size === 1) planned.push({ filePath, placementType, groups: [...known] });
+        else warn(`${path.relative(localeDir, filePath)}: put videos in a placement-group folder (one of ${[...known].join(", ")}) \u2014 skipped`);
+        continue;
+      }
+      const size = readImageSize(await promises.readFile(filePath));
+      if (!size) {
+        warn(`${path.relative(localeDir, filePath)}: could not read image size \u2014 skipped`);
+        continue;
+      }
+      const { groups, spec } = resolveImageGroups(refData, feature, placementType, size);
+      if (!groups.length) {
+        warn(`${path.relative(localeDir, filePath)}: ${size.width}\xD7${size.height} matches no ${placementType} spec \u2014 skipped`);
+        continue;
+      }
+      if (size.alpha && spec && spec.alphaAllowed === false) {
+        warn(`${path.relative(localeDir, filePath)}: has an alpha channel, which Apple rejects for this spec`);
+      }
+      planned.push({ filePath, placementType, groups: groups.slice(0, 1) });
+    }
+  }
+  return planned;
+}
+async function uploadAssetLibrary(options) {
+  const { client } = options;
+  const log = options.log ?? (() => {
+  });
+  const feature = "APP_STORE_VERSIONS";
+  const result = { uploaded: 0, reused: 0, placed: 0, removed: 0, warnings: [] };
+  const warn = (line) => {
+    result.warnings.push(line);
+    log(`warning: ${line}`);
+  };
+  const [library, refData, localizations] = await Promise.all([
+    client.appAssetLibraries.getForApp(options.appId),
+    client.appAssetLibraries.refData({ features: [feature] }),
+    client.appStoreVersions.getLocalizations(options.versionId)
+  ]);
+  const folders = { ...options.folders ?? ASSET_FOLDERS };
+  if (options.rootPlacementType) folders["."] = options.rootPlacementType;
+  const uploads = /* @__PURE__ */ new Map();
+  const uploadOnce = (filePath, placementType) => {
+    const key = `${filePath}|${categoryFor(placementType)}`;
+    if (!uploads.has(key)) {
+      uploads.set(
+        key,
+        uploadLibraryAsset({
+          client,
+          libraryId: library.id,
+          filePath,
+          category: categoryFor(placementType),
+          referenceName: path.relative(options.assetsPath, filePath),
+          log
+        }).then((a) => {
+          if (a.reused) result.reused++;
+          else result.uploaded++;
+          return a;
+        })
+      );
+    }
+    return uploads.get(key);
+  };
+  for (const loc of localizations) {
+    const localeDir = path.join(options.assetsPath, loc.attributes.locale);
+    if (!fs.existsSync(localeDir)) continue;
+    const target = { kind: "appStoreVersionLocalization", id: loc.id };
+    const plan = await planLocale(localeDir, refData, feature, folders, warn);
+    const slots = /* @__PURE__ */ new Map();
+    for (const p of plan) {
+      for (const group of p.groups) {
+        const key = `${p.placementType}|${group}`;
+        if (!slots.has(key)) slots.set(key, { placementType: p.placementType, group, files: [] });
+        slots.get(key).files.push(p.filePath);
+      }
+    }
+    for (const slot of slots.values()) {
+      const where = `${loc.attributes.locale} ${slot.placementType} ${slot.group}`;
+      const max = maxCountFor(refData, feature, slot.placementType, slot.group);
+      if (max !== void 0 && slot.files.length > max) {
+        warn(`${where}: ${slot.files.length} files but Apple allows ${max} \u2014 keeping the first ${max}`);
+        slot.files = slot.files.slice(0, max);
+      }
+      const existing = await client.appAssetLibraryPlacements.listForTarget(target, {
+        placementType: slot.placementType,
+        placementGroup: slot.group,
+        include: "image,video"
+      });
+      if (options.overwrite) {
+        for (const p of existing) {
+          await client.appAssetLibraryPlacements.delete(p.id);
+          result.removed++;
+        }
+      }
+      const kept = options.overwrite ? [] : existing;
+      const keptAssetIds = new Set(kept.map((p) => placementAssetId(p)).filter(Boolean));
+      const ours = [];
+      for (const filePath of slot.files) {
+        const asset = await uploadOnce(filePath, slot.placementType);
+        if (keptAssetIds.has(asset.id)) continue;
+        const placement = await client.appAssetLibraryPlacements.create({
+          placementType: slot.placementType,
+          placementGroup: slot.group,
+          ...asset.kind === "image" ? { imageId: asset.id } : { videoId: asset.id },
+          target
+        });
+        ours.push(placement.id);
+        result.placed++;
+      }
+      log(`${where}: placed ${ours.length}${kept.length ? `, kept ${kept.length}` : ""}`);
+      const orderable = slot.placementType === "APP_SCREENSHOT" || slot.placementType === "APP_PREVIEW" || slot.placementType === "IMESSAGE_APP_SCREENSHOT";
+      if (orderable && ours.length + kept.length > 1) {
+        await client.appAssetLibraryPlacements.order({
+          placementGroup: slot.group,
+          placementIds: [...ours, ...kept.map((p) => p.id)],
+          target
+        });
+      }
+    }
+  }
+  return result;
+}
+function placementAssetId(p) {
+  for (const rel of ["image", "video"]) {
+    const data = p.relationships?.[rel]?.data;
+    if (data?.id) return data.id;
+  }
+  return void 0;
+}
+var ASSET_FOLDERS, IMAGE_EXTENSIONS, VIDEO_EXTENSIONS, READY_STATES;
+var init_assets = __esm({
+  "src/deliver/assets.ts"() {
+    ASSET_FOLDERS = {
+      screenshots: "APP_SCREENSHOT",
+      imessage_screenshots: "IMESSAGE_APP_SCREENSHOT",
+      previews: "APP_PREVIEW",
+      header: "PRODUCT_PAGE_HEADER_ASSET",
+      search_results: "APP_STORE_SEARCH_RESULTS_ASSET",
+      event_card: "EVENT_CARD_ASSET",
+      event_details: "EVENT_DETAILS_PAGE_ASSET"
+    };
+    IMAGE_EXTENSIONS = [".png", ".jpg", ".jpeg"];
+    VIDEO_EXTENSIONS = [".mp4", ".mov", ".m4v"];
+    READY_STATES = [
+      "COMPLETE",
+      "PREPARE_FOR_SUBMISSION",
+      "READY_FOR_REVIEW",
+      "WAITING_FOR_REVIEW",
+      "IN_REVIEW",
+      "ACCEPTED",
+      "APPROVED"
+    ];
+  }
+});
 
 // src/xcode/upload.ts
 var upload_exports = {};
@@ -2842,8 +3197,14 @@ var init_upload = __esm({
 // src/deliver/index.ts
 var deliver_exports = {};
 __export(deliver_exports, {
+  ASSET_FOLDERS: () => ASSET_FOLDERS,
+  categoryFor: () => categoryFor,
   loadMetadata: () => loadMetadata,
+  readImageSize: () => readImageSize,
+  resolveImageGroups: () => resolveImageGroups,
   submitForReview: () => submitForReview,
+  uploadAssetLibrary: () => uploadAssetLibrary,
+  uploadLibraryAsset: () => uploadLibraryAsset,
   uploadMetadata: () => uploadMetadata,
   uploadScreenshots: () => uploadScreenshots,
   uploadToAppStore: () => uploadToAppStore
@@ -2882,11 +3243,36 @@ async function uploadToAppStore(options) {
       copyright: options.copyright
     });
   }
+  const log = (line) => options.onOutput?.(`${line}
+`);
   if (!options.skipScreenshots && options.screenshotsPath && fs.existsSync(options.screenshotsPath)) {
-    await uploadScreenshots({
+    if (options.useAssetLibrary) {
+      await uploadAssetLibrary({
+        client: options.client,
+        appId: app.id,
+        versionId: version.id,
+        assetsPath: options.screenshotsPath,
+        folders: {},
+        rootPlacementType: "APP_SCREENSHOT",
+        overwrite: options.overwriteAssets,
+        log
+      });
+    } else {
+      await uploadScreenshots({
+        client: options.client,
+        versionId: version.id,
+        screenshotsPath: options.screenshotsPath
+      });
+    }
+  }
+  if (!options.skipAssets && options.assetsPath && fs.existsSync(options.assetsPath)) {
+    await uploadAssetLibrary({
       client: options.client,
+      appId: app.id,
       versionId: version.id,
-      screenshotsPath: options.screenshotsPath
+      assetsPath: options.assetsPath,
+      overwrite: options.overwriteAssets,
+      log
     });
   }
   if (!options.skipBinaryUpload) {
@@ -2971,17 +3357,7 @@ async function uploadScreenshots(options) {
         fileName: file,
         fileSize: fileData.length
       });
-      const ops = reserved.attributes.uploadOperations;
-      if (ops) {
-        for (const op of ops) {
-          const chunk = fileData.subarray(op.offset, op.offset + op.length);
-          const headers = {};
-          for (const h of op.requestHeaders) {
-            headers[h.name] = h.value;
-          }
-          await fetch(op.url, { method: op.method, headers, body: chunk });
-        }
-      }
+      await runUploadOperations(reserved.attributes.uploadOperations ?? [], fileData);
       await options.client.appScreenshots.commitScreenshot(reserved.id, {
         sourceFileChecksum: checksum,
         uploaded: true
@@ -3001,7 +3377,9 @@ function detectDisplayType(filename) {
 var init_deliver = __esm({
   "src/deliver/index.ts"() {
     init_metadata();
+    init_assets();
     init_metadata();
+    init_assets();
   }
 });
 
@@ -3010,6 +3388,7 @@ var produce_exports = {};
 __export(produce_exports, {
   SERVICE_NAME_TO_CAPABILITY: () => SERVICE_NAME_TO_CAPABILITY,
   addCapability: () => addCapability,
+  associateAppGroups: () => associateAppGroups,
   buildCapabilitySettings: () => buildCapabilitySettings,
   createApp: () => createApp,
   enableServices: () => enableServices,
@@ -3104,6 +3483,30 @@ async function enableServices(options) {
     });
   }
 }
+async function associateAppGroups(options) {
+  if (!options.appGroups?.length) return;
+  await options.portalClient.enableAppGroups(options.bundleIdId).catch(() => {
+  });
+  const existing = await options.portalClient.listAppGroups();
+  const appGroupIds = [];
+  for (const group of options.appGroups) {
+    let record = existing.find((ag) => ag.identifier === group.identifier);
+    if (!record) {
+      record = await options.portalClient.createAppGroup({
+        name: group.name,
+        identifier: group.identifier
+      });
+    }
+    const id = record?.applicationGroup ?? record?.applicationGroupId ?? record?.appGroupId ?? record?.id;
+    if (id) appGroupIds.push(id);
+  }
+  if (appGroupIds.length) {
+    await options.portalClient.assignAppGroups({
+      appIdId: options.bundleIdId,
+      appGroupIds
+    });
+  }
+}
 async function createApp(options) {
   const existing = await options.client.apps.findByBundleId(options.bundleIdentifier);
   if (existing) return existing;
@@ -3122,25 +3525,20 @@ async function createApp(options) {
       });
     }
   }
-  const sku = options.sku ?? `${options.bundleIdentifier}.${Date.now()}`;
-  const primaryLocale = options.primaryLocale ?? "en-US";
-  const response = await options.client.http.post("/v1/apps", {
-    data: {
-      type: "apps",
-      attributes: {
-        bundleId: options.bundleIdentifier,
-        name: options.appName,
-        sku,
-        primaryLocale
-      },
-      relationships: {
-        bundleId: {
-          data: { type: "bundleIds", id: bundleId.id }
-        }
-      }
-    }
+  if (options.appGroups?.length && options.portalClient) {
+    await associateAppGroups({
+      portalClient: options.portalClient,
+      bundleIdId: bundleId.id,
+      appGroups: options.appGroups
+    });
+  }
+  return options.client.apps.create({
+    bundleIdentifier: options.bundleIdentifier,
+    bundleIdId: bundleId.id,
+    appName: options.appName,
+    sku: options.sku ?? `${options.bundleIdentifier}.${Date.now()}`,
+    primaryLocale: options.primaryLocale
   });
-  return response.data;
 }
 var SERVICE_NAME_TO_CAPABILITY;
 var init_produce = __esm({
@@ -3943,10 +4341,10 @@ async function parseTestResults(options) {
   } else if (inputPath.endsWith(".plist")) {
     testSuites = parsePlistResults(inputPath);
   } else {
-    const stat6 = await import('fs').then(
+    const stat7 = await import('fs').then(
       (fs) => fs.statSync(inputPath)
     );
-    if (stat6.isDirectory()) {
+    if (stat7.isDirectory()) {
       requireMacOS("xcresult parsing");
       testSuites = await parseXCResult(inputPath);
     } else {
@@ -4934,6 +5332,43 @@ var init_apps = __esm({
         });
         return results[0] ?? null;
       }
+      /**
+       * Create an App Store Connect **app record** (the thing that shows up
+       * under "My Apps" and that TestFlight / App Store uploads require).
+       *
+       * This is distinct from registering an App ID in the Developer Portal —
+       * you need BOTH. The Developer Portal App ID unlocks provisioning
+       * profiles and entitlements; the App Store Connect app record unlocks
+       * uploads. `upload_to_testflight` fails with "Couldn't find app
+       * 'com.foo.bar' on the account…" when this record is missing.
+       *
+       * `bundleIdId` is the REST API primary key of the bundle id resource
+       * (not the identifier string) — fetch it via `bundleIds.find(identifier)`
+       * or from the response of `bundleIds.create()`.
+       *
+       * `sku` is an arbitrary unique string Apple uses to identify the app in
+       * their internal records. If you don't have a meaningful one, pass the
+       * bundle identifier itself or append a timestamp for uniqueness.
+       */
+      async create(params) {
+        const response = await this.http.post("/v1/apps", {
+          data: {
+            type: "apps",
+            attributes: {
+              bundleId: params.bundleIdentifier,
+              name: params.appName,
+              sku: params.sku,
+              primaryLocale: params.primaryLocale ?? "en-US"
+            },
+            relationships: {
+              bundleId: {
+                data: { type: "bundleIds", id: params.bundleIdId }
+              }
+            }
+          }
+        });
+        return response.data;
+      }
     };
   }
 });
@@ -6086,9 +6521,22 @@ var init_pre_release_versions = __esm({
 });
 
 // src/resources/review-submission-items.ts
-var ReviewSubmissionItemsResource;
+var ITEM_RELATIONSHIPS, ReviewSubmissionItemsResource;
 var init_review_submission_items = __esm({
   "src/resources/review-submission-items.ts"() {
+    ITEM_RELATIONSHIPS = {
+      appStoreVersionId: ["appStoreVersion", "appStoreVersions"],
+      appCustomProductPageVersionId: ["appCustomProductPageVersion", "appCustomProductPageVersions"],
+      appStoreVersionExperimentId: ["appStoreVersionExperiment", "appStoreVersionExperiments"],
+      appStoreVersionExperimentV2Id: ["appStoreVersionExperimentV2", "appStoreVersionExperiments"],
+      appEventId: ["appEvent", "appEvents"],
+      appAssetLibraryImageId: ["appAssetLibraryImage", "appAssetLibraryImages"],
+      appAssetLibraryVideoId: ["appAssetLibraryVideo", "appAssetLibraryVideos"],
+      backgroundAssetVersionId: ["backgroundAssetVersion", "backgroundAssetVersions"],
+      inAppPurchaseVersionId: ["inAppPurchaseVersion", "inAppPurchaseVersions"],
+      subscriptionVersionId: ["subscriptionVersion", "subscriptionVersions"],
+      subscriptionGroupVersionId: ["subscriptionGroupVersion", "subscriptionGroupVersions"]
+    };
     ReviewSubmissionItemsResource = class {
       constructor(http) {
         this.http = http;
@@ -6110,32 +6558,20 @@ var init_review_submission_items = __esm({
         );
         return response.data;
       }
+      /**
+       * Add one item to a review submission. Besides versions, asset library
+       * images and videos can be submitted on their own (ASC API 4.5.1) so
+       * creative assets are approved ahead of a campaign.
+       */
       async create(params) {
         const relationships = {
           reviewSubmission: {
             data: { type: "reviewSubmissions", id: params.reviewSubmissionId }
           }
         };
-        if (params.appStoreVersionId) {
-          relationships.appStoreVersion = {
-            data: { type: "appStoreVersions", id: params.appStoreVersionId }
-          };
-        }
-        if (params.appCustomProductPageVersionId) {
-          relationships.appCustomProductPageVersion = {
-            data: {
-              type: "appCustomProductPageVersions",
-              id: params.appCustomProductPageVersionId
-            }
-          };
-        }
-        if (params.appStoreVersionExperimentId) {
-          relationships.appStoreVersionExperiment = {
-            data: {
-              type: "appStoreVersionExperiments",
-              id: params.appStoreVersionExperimentId
-            }
-          };
+        for (const [param, [relationship, type]] of Object.entries(ITEM_RELATIONSHIPS)) {
+          const id = params[param];
+          if (id) relationships[relationship] = { data: { type, id } };
         }
         const response = await this.http.post(
           "/v1/reviewSubmissionItems",
@@ -6366,6 +6802,204 @@ var init_xcode_metrics = __esm({
   }
 });
 
+// src/resources/app-asset-libraries.ts
+function mergeRefData(parts) {
+  const merged = {
+    features: [],
+    placementProfileGroups: [],
+    imageSpecs: [],
+    videoSpecs: [],
+    placementTypes: [],
+    displayClasses: []
+  };
+  for (const part of parts) {
+    for (const key of Object.keys(merged)) {
+      merged[key].push(...part[key] ?? []);
+    }
+  }
+  return merged;
+}
+var AppAssetLibrariesResource;
+var init_app_asset_libraries = __esm({
+  "src/resources/app-asset-libraries.ts"() {
+    AppAssetLibrariesResource = class {
+      constructor(http) {
+        this.http = http;
+      }
+      http;
+      async getForApp(appId) {
+        const response = await this.http.get(
+          `/v1/apps/${appId}/assetLibrary`
+        );
+        return response.data;
+      }
+      async listImages(libraryId, params = {}) {
+        return this.http.all(`/v1/appAssetLibraries/${libraryId}/images`, params);
+      }
+      async listVideos(libraryId, params = {}) {
+        return this.http.all(`/v1/appAssetLibraries/${libraryId}/videos`, params);
+      }
+      /**
+       * Specs, placement groups and limits. Apple adds placement groups (new
+       * devices) without an API version bump, so read them from here rather than
+       * hard-coding display types.
+       */
+      async refData(params = {}) {
+        const filter = {};
+        if (params.features?.length) filter.features = params.features;
+        if (params.placementTypes?.length) filter.placementTypes = params.placementTypes;
+        if (params.placementProfileGroups?.length) filter.placementProfileGroups = params.placementProfileGroups;
+        const data = await this.http.all("/v1/appAssetLibraryRefData", { filter });
+        return mergeRefData(data.map((d) => d.attributes));
+      }
+    };
+  }
+});
+
+// src/resources/app-asset-library-assets.ts
+var AssetLibraryMediaResource, AppAssetLibraryImagesResource, AppAssetLibraryVideosResource;
+var init_app_asset_library_assets = __esm({
+  "src/resources/app-asset-library-assets.ts"() {
+    AssetLibraryMediaResource = class {
+      constructor(http) {
+        this.http = http;
+      }
+      http;
+      async get(id) {
+        const response = await this.http.get(`/v1/${this.type}/${id}`);
+        return response.data;
+      }
+      async reserve(params, extra = {}) {
+        const { libraryId, ...attributes } = params;
+        const response = await this.http.post(`/v1/${this.type}`, {
+          data: {
+            type: this.type,
+            attributes: { ...attributes, ...extra },
+            relationships: {
+              assetLibrary: { data: { type: "appAssetLibraries", id: libraryId } }
+            }
+          }
+        });
+        return response.data;
+      }
+      async patch(id, attributes) {
+        const response = await this.http.patch(`/v1/${this.type}/${id}`, {
+          data: { type: this.type, id, attributes }
+        });
+        return response.data;
+      }
+      /** Fails with 409 STATE_ERROR.ASSET_HAS_PLACEMENTS while the asset is still placed. */
+      async delete(id) {
+        await this.http.delete(`/v1/${this.type}/${id}`);
+      }
+      async listPlacements(id, params = {}) {
+        return this.http.all(`/v1/${this.type}/${id}/placements`, params);
+      }
+    };
+    AppAssetLibraryImagesResource = class extends AssetLibraryMediaResource {
+      type = "appAssetLibraryImages";
+      async create(params) {
+        return this.reserve(params);
+      }
+      async update(id, attributes) {
+        return this.patch(id, { ...attributes });
+      }
+    };
+    AppAssetLibraryVideosResource = class extends AssetLibraryMediaResource {
+      type = "appAssetLibraryVideos";
+      async create(params) {
+        const { previewFrameTimeCode, ...rest } = params;
+        return this.reserve(rest, previewFrameTimeCode ? { previewFrameTimeCode } : {});
+      }
+      async update(id, attributes) {
+        return this.patch(id, { ...attributes });
+      }
+    };
+  }
+});
+
+// src/resources/app-asset-library-placements.ts
+function targetRelationship(target) {
+  return { [target.kind]: { data: { type: TARGET_TYPES[target.kind], id: target.id } } };
+}
+var TARGET_TYPES, AppAssetLibraryPlacementsResource;
+var init_app_asset_library_placements = __esm({
+  "src/resources/app-asset-library-placements.ts"() {
+    TARGET_TYPES = {
+      appStoreVersionLocalization: "appStoreVersionLocalizations",
+      appCustomProductPageLocalization: "appCustomProductPageLocalizations",
+      appEventLocalization: "appEventLocalizations",
+      appStoreVersionExperimentTreatmentLocalization: "appStoreVersionExperimentTreatmentLocalizations"
+    };
+    AppAssetLibraryPlacementsResource = class {
+      constructor(http) {
+        this.http = http;
+      }
+      http;
+      /**
+       * Place an image or video on one localization. Placements cannot be edited —
+       * delete and recreate. The parent version/page must be editable.
+       */
+      async create(params) {
+        if (!params.imageId === !params.videoId) {
+          throw new Error("A placement needs exactly one of imageId or videoId");
+        }
+        const media = params.imageId ? { image: { data: { type: "appAssetLibraryImages", id: params.imageId } } } : { video: { data: { type: "appAssetLibraryVideos", id: params.videoId } } };
+        const response = await this.http.post(
+          "/v1/appAssetLibraryPlacements",
+          {
+            data: {
+              type: "appAssetLibraryPlacements",
+              attributes: { placementType: params.placementType, placementGroup: params.placementGroup },
+              relationships: { ...media, ...targetRelationship(params.target) }
+            }
+          }
+        );
+        return response.data;
+      }
+      async get(id, params = {}) {
+        const response = await this.http.get(
+          `/v1/appAssetLibraryPlacements/${id}`,
+          params.include ? { include: params.include } : void 0
+        );
+        return response.data;
+      }
+      async delete(id) {
+        await this.http.delete(`/v1/appAssetLibraryPlacements/${id}`);
+      }
+      /** Placements on one localization, in display order by default. */
+      async listForTarget(target, params = {}) {
+        const filter = {};
+        if (params.placementType) filter.placementType = params.placementType;
+        if (params.placementGroup) filter.placementGroup = params.placementGroup;
+        const listParams = { filter, include: params.include, sort: "placementGroupPosition" };
+        return this.http.all(
+          `/v1/${TARGET_TYPES[target.kind]}/${target.id}/placements`,
+          listParams
+        );
+      }
+      /** Set the display order of a placement group. In-app event localizations cannot be ordered. */
+      async order(params) {
+        if (params.target.kind === "appEventLocalization") {
+          throw new Error("In-app event placements cannot be ordered");
+        }
+        await this.http.post("/v1/appAssetLibraryPlacementOrderingRequests", {
+          data: {
+            type: "appAssetLibraryPlacementOrderingRequests",
+            attributes: { placementGroup: params.placementGroup },
+            relationships: {
+              orderedPlacements: {
+                data: params.placementIds.map((id) => ({ type: "appAssetLibraryPlacements", id }))
+              },
+              ...targetRelationship(params.target)
+            }
+          }
+        });
+      }
+    };
+  }
+});
+
 // src/client/portal.ts
 function pickUniqueKeyName(base, taken) {
   if (!taken.has(base)) return base;
@@ -6705,7 +7339,10 @@ var init_portal = __esm({
       }
       // ── Teams ──────────────────────────────────────────────────────────────
       async listTeams() {
-        const data = await this.post("account/listTeams.action", {});
+        const data = await this.post("account/listTeams.action", {
+          pageSize: "500",
+          pageNumber: "1"
+        });
         return data.teams ?? [];
       }
       // ── App IDs / Bundle IDs ───────────────────────────────────────────────
@@ -6719,11 +7356,12 @@ var init_portal = __esm({
         return data.appIds ?? [];
       }
       async createAppId(params) {
+        const safeName = params.name.replace(/[^0-9A-Za-z\s]/g, " ").replace(/\s+/g, " ").trim() || "App";
         const reqParams = {
           teamId: this.teamId,
           type: "explicit",
           identifier: params.identifier,
-          name: params.name
+          name: safeName
         };
         if (params.enablePush) reqParams.push = "on";
         if (params.enableIAP !== false) reqParams.inAppPurchase = "on";
@@ -6758,6 +7396,191 @@ var init_portal = __esm({
           featureValue: params.enabled ? "on" : "off"
         });
       }
+      // ── Application Groups ──────────────────────────────────────────────────
+      //
+      // App Groups (e.g. `group.com.playspina.com`) are the only clean way to
+      // share data — an auth token, in our case — between a host app and an
+      // embedded extension (Messages / Notification Service / etc.). App Store
+      // Connect API keys (.p8) genuinely cannot manage them; Apple only exposes
+      // group create/associate through this legacy session-cookie portal API,
+      // which is why they live on PortalClient (Apple ID session) and not on the
+      // ASC REST client. Endpoint shapes ported 1:1 from Spaceship's
+      // portal_client.rb (listApplicationGroups / addApplicationGroup /
+      // assignApplicationGroupToAppId).
+      /** Apple's internal feature code for the App Groups capability. */
+      static APP_GROUPS_FEATURE = "APG3427HIY";
+      /** List all app groups in the team. */
+      async listAppGroups() {
+        const data = await this.post("account/ios/identifiers/listApplicationGroups.action", {
+          teamId: this.teamId,
+          pageNumber: "1",
+          pageSize: "500",
+          sort: "name=asc"
+        });
+        return data.applicationGroupList ?? [];
+      }
+      /**
+       * Create an app group, returning the raw group record. Idempotent —
+       * Apple rejects a duplicate group identifier ("Multiple App Groups may
+       * not have the same identifier"), so we list first and reuse an existing
+       * group when the identifier already exists in the team.
+       *
+       * Note the two ids on the returned record: `identifier` is the
+       * `group.com.…` string you type, while `applicationGroup` is Apple's
+       * opaque internal handle that association actually requires — do NOT pass
+       * the human identifier to assignAppGroups.
+       */
+      async createAppGroup(params) {
+        const existing = await this.listAppGroups();
+        const hit = existing.find((g) => g.identifier === params.identifier);
+        if (hit) return hit;
+        const safeName = params.name.replace(/[^0-9A-Za-z\s]/g, " ").replace(/\s+/g, " ").trim() || "App Group";
+        const data = await this.post("account/ios/identifiers/addApplicationGroup.action", {
+          teamId: this.teamId,
+          identifier: params.identifier,
+          name: safeName
+        });
+        return data.applicationGroup;
+      }
+      /**
+       * Enable the App Groups capability on an App ID. Required before an
+       * App ID can have a group associated with it — mirrors Spaceship
+       * enabling `AppService::AppGroup` before `associate_groups`.
+       */
+      async enableAppGroups(appIdId) {
+        await this.post("account/ios/identifiers/updateService.action", {
+          teamId: this.teamId,
+          displayId: appIdId,
+          featureType: _PortalClient.APP_GROUPS_FEATURE,
+          featureValue: "true"
+        });
+      }
+      /**
+       * Associate one or more app groups with an App ID. `appGroupIds` are the
+       * internal ids (Spaceship's `app_group_id`), NOT the `group.com.…`
+       * identifiers. Apple wants both `appIdId` and `displayId` set to the
+       * App ID's internal id, per Spaceship's associate_groups_with_app.
+       */
+      async assignAppGroups(params) {
+        await this.post("account/ios/identifiers/assignApplicationGroupToAppId.action", {
+          teamId: this.teamId,
+          appIdId: params.appIdId,
+          displayId: params.appIdId,
+          applicationGroups: params.appGroupIds
+        });
+      }
+      // ── Apple Pay merchants (OMCs) ─────────────────────────────────────────
+      //
+      // Merchant IDs are team-level identifiers (merchant.com.…) that an App ID's
+      // Apple Pay capability must be LINKED to — enabling the capability alone
+      // produces profiles that fail with "doesn't support the … Merchant ID".
+      // Like App Groups, merchants are only manageable through the legacy
+      // session-cookie portal API. Endpoint shapes ported 1:1 from Spaceship's
+      // portal_client.rb (merchants / create_merchant! /
+      // associate_merchants_with_app).
+      /** Apple's internal feature code for the Apple Pay capability. */
+      static APPLE_PAY_FEATURE = "OM633U5T5G";
+      /**
+       * List all Apple Pay merchant IDs in the team. Each record maps
+       * (per Spaceship's merchant.rb attr_mapping): `omcId` = internal id,
+       * `identifier` = the human `merchant.com.…` string, `name` = display name.
+       */
+      async listMerchants() {
+        const data = await this.post("account/ios/identifiers/listOMCs.action", {
+          teamId: this.teamId,
+          pageNumber: "1",
+          pageSize: "500",
+          sort: "name=asc"
+        });
+        return data.identifierList ?? [];
+      }
+      /**
+       * Register (or reuse) a merchant ID, returning its INTERNAL id (`omcId`) —
+       * Apple's opaque handle that association requires, NOT the human
+       * `merchant.com.…` identifier. Idempotent: lists first and reuses an
+       * existing merchant with the same identifier. Endpoint + params ported 1:1
+       * from Spaceship's create_merchant! (addOMC.action).
+       */
+      async createMerchant(params) {
+        const existing = await this.listMerchants();
+        const hit = existing.find((m) => m.identifier === params.identifier);
+        if (hit?.omcId) return String(hit.omcId);
+        const safeName = params.name.replace(/[^0-9A-Za-z\s]/g, " ").replace(/\s+/g, " ").trim() || "Merchant";
+        const data = await this.post("account/ios/identifiers/addOMC.action", {
+          name: safeName,
+          identifier: params.identifier,
+          teamId: this.teamId
+        });
+        const rec = data.omcId ?? data;
+        const id = typeof rec === "string" ? rec : rec?.omcId ?? rec?.merchantId;
+        if (!id) {
+          throw new Error("Apple returned no internal merchant id (omcId) for the registered merchant.");
+        }
+        return String(id);
+      }
+      /**
+       * Enable the Apple Pay capability on an App ID. Apple Pay is a standard
+       * AppService (service_id OM633U5T5G) whose service_uri is the default
+       * `updateService.action` — confirmed in Spaceship's app_service.rb.
+       */
+      async enableApplePay(appIdId) {
+        await this.post("account/ios/identifiers/updateService.action", {
+          teamId: this.teamId,
+          displayId: appIdId,
+          featureType: _PortalClient.APPLE_PAY_FEATURE,
+          featureValue: "true"
+        });
+      }
+      /**
+       * Associate merchant IDs with an App ID's Apple Pay capability. `omcIds`
+       * are the internal ids (each merchant record's `omcId`), NOT the
+       * `merchant.com.…` identifiers. Endpoint + params ported 1:1 from
+       * Spaceship's associate_merchants_with_app (assignOMCToAppId.action — note
+       * the singular "OMC", and NO displayId param).
+       */
+      async assignMerchants(params) {
+        await this.post("account/ios/identifiers/assignOMCToAppId.action", {
+          teamId: this.teamId,
+          appIdId: params.appIdId,
+          omcIds: params.omcIds
+        });
+      }
+      /**
+       * Create an Apple Pay **Payment Processing Certificate** on a merchant ID
+       * from a CSR — the certificate a PSP (e.g. Stripe) hands you as a CSR, which
+       * must be uploaded to the Merchant ID in Apple Developer, then the resulting
+       * `.cer` downloaded and given back to the PSP so it can decrypt payment
+       * tokens. This is the one manual Apple-portal step in wiring up Apple Pay.
+       *
+       * Ported 1:1 from Spaceship's create_certificate! (submitCertificateRequest
+       * .action): the merchant's INTERNAL id (`omcId`) is passed as BOTH `appIdId`
+       * and `specialIdentifierDisplayId` — the latter is how the portal scopes a
+       * cert to a merchant/special identifier rather than an App ID. The cert type
+       * is APPLE_PAY (`4APLUP237T`). Returns the created certRequest (its
+       * `certificateId` feeds `downloadApplePayCertificate`).
+       *
+       * @param omcId       the merchant's internal id (from createMerchant/listMerchants)
+       * @param csrContent  the PEM CSR string (Stripe's "Apple Pay CSR")
+       */
+      async createApplePayCertificate(params) {
+        const data = await this.post("account/ios/certificate/submitCertificateRequest.action", {
+          teamId: this.teamId,
+          type: _PortalClient.CERT_TYPES.APPLE_PAY,
+          csrContent: params.csrContent,
+          appIdId: params.omcId,
+          specialIdentifierDisplayId: params.omcId
+        });
+        return data.certRequest;
+      }
+      /**
+       * Download an Apple Pay Payment Processing Certificate's raw bytes by its
+       * certificate id (from `createApplePayCertificate`). Thin wrapper over
+       * `downloadCertificate` pinned to the APPLE_PAY type — the DER `.cer` you
+       * upload back into Stripe.
+       */
+      async downloadApplePayCertificate(certificateId) {
+        return this.downloadCertificate(certificateId, _PortalClient.CERT_TYPES.APPLE_PAY);
+      }
       // ── Certificates ───────────────────────────────────────────────────────
       async listCertificates(types) {
         const iosTypes = types ?? [
@@ -7297,6 +8120,9 @@ var init_client = __esm({
     init_in_app_purchases();
     init_game_center_detail();
     init_xcode_metrics();
+    init_app_asset_libraries();
+    init_app_asset_library_assets();
+    init_app_asset_library_placements();
     init_auth();
     init_request();
     init_apple_session();
@@ -7338,6 +8164,10 @@ var init_client = __esm({
       inAppPurchases;
       gameCenterDetail;
       xcodeMetrics;
+      appAssetLibraries;
+      appAssetLibraryImages;
+      appAssetLibraryVideos;
+      appAssetLibraryPlacements;
       constructor(config) {
         const tokenManager = new TokenManager({
           keyId: config.keyId,
@@ -7381,6 +8211,10 @@ var init_client = __esm({
         this.inAppPurchases = new InAppPurchasesResource(this.http);
         this.gameCenterDetail = new GameCenterDetailResource(this.http);
         this.xcodeMetrics = new XcodeMetricsResource(this.http);
+        this.appAssetLibraries = new AppAssetLibrariesResource(this.http);
+        this.appAssetLibraryImages = new AppAssetLibraryImagesResource(this.http);
+        this.appAssetLibraryVideos = new AppAssetLibraryVideosResource(this.http);
+        this.appAssetLibraryPlacements = new AppAssetLibraryPlacementsResource(this.http);
       }
       async request(path, options) {
         return this.http.request(path, options);
@@ -8148,8 +8982,8 @@ var init_utilities = __esm({
       description: "Ask the user for input",
       async run(params) {
         const text = params.text ?? "Enter a value:";
-        const { createInterface: createInterface2 } = await import('readline');
-        const rl = createInterface2({ input: process.stdin, output: process.stdout });
+        const { createInterface: createInterface4 } = await import('readline');
+        const rl = createInterface4({ input: process.stdin, output: process.stdout });
         return new Promise((resolve4) => {
           rl.question(text + " ", (answer) => {
             rl.close();
@@ -8541,6 +9375,308 @@ var init_options = __esm({
     init_client();
   }
 });
+
+// src/privacy/index.ts
+var privacy_exports = {};
+__export(privacy_exports, {
+  DATA_PROTECTIONS: () => DATA_PROTECTIONS,
+  DATA_USAGE_CATEGORIES: () => DATA_USAGE_CATEGORIES,
+  DATA_USAGE_PURPOSES: () => DATA_USAGE_PURPOSES,
+  createAppDataUsage: () => createAppDataUsage,
+  deleteAppDataUsage: () => deleteAppDataUsage,
+  getAppDataUsagesPublishState: () => getAppDataUsagesPublishState,
+  listAppDataUsages: () => listAppDataUsages,
+  publishAppDataUsages: () => publishAppDataUsages,
+  selectProviderForApp: () => selectProviderForApp,
+  uploadAppPrivacyDetails: () => uploadAppPrivacyDetails,
+  validateUsages: () => validateUsages
+});
+async function iris(session, method, path, body) {
+  const res = await fetch(path.startsWith("http") ? path : `${IRIS_BASE2}${path}`, {
+    method,
+    headers: {
+      Cookie: cookieHeader(session),
+      Accept: "application/vnd.api+json, application/json",
+      "Content-Type": "application/vnd.api+json",
+      "X-Requested-With": "XMLHttpRequest"
+    },
+    body: body ? JSON.stringify(body) : void 0
+  });
+  absorbCookies(session, res);
+  const text = await res.text();
+  let parsed = null;
+  try {
+    parsed = text ? JSON.parse(text) : null;
+  } catch {
+  }
+  return { status: res.status, body: parsed, text };
+}
+function cookieHeader(session) {
+  return Object.entries(session.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+}
+function absorbCookies(session, res) {
+  for (const raw of res.headers.getSetCookie?.() ?? []) {
+    const m = raw.match(/^([^=]+)=([^;]*)/);
+    if (m) session.cookies[m[1]] = m[2];
+  }
+}
+function fail(what, r) {
+  const detail = r.body?.errors?.map((e) => e.detail ?? e.title).join("; ") || r.text.slice(0, 300);
+  throw new Error(`${what} failed (HTTP ${r.status}): ${detail}`);
+}
+async function selectProviderForApp(session, appId, onLog) {
+  const owns = async () => (await iris(session, "GET", `/apps/${appId}?fields[apps]=name`)).status === 200;
+  if (await owns()) return;
+  const res = await fetch(OLYMPUS_SESSION2, { headers: { Cookie: cookieHeader(session), Accept: "application/json" } });
+  absorbCookies(session, res);
+  const info = await res.json().catch(() => null);
+  const providers = info?.availableProviders ?? [];
+  for (const p of providers) {
+    const sw = await fetch(OLYMPUS_SESSION2, {
+      method: "POST",
+      headers: { Cookie: cookieHeader(session), "Content-Type": "application/json", Accept: "application/json" },
+      body: JSON.stringify({ provider: { providerId: p.providerId } })
+    });
+    absorbCookies(session, sw);
+    if (sw.ok && await owns()) {
+      onLog?.(`Switched to team "${p.name}"`);
+      session.teamId = String(p.providerId);
+      return;
+    }
+  }
+  throw new Error(`None of this Apple ID's ${providers.length} teams can see app ${appId}.`);
+}
+async function listAppDataUsages(session, appId) {
+  const all = [];
+  let next = `/apps/${appId}/dataUsages?include=category,grouping,purpose,dataProtection&limit=500`;
+  while (next) {
+    const r = await iris(session, "GET", next);
+    if (r.status !== 200) fail("List app data usages", r);
+    all.push(...(r.body?.data ?? []).map((d) => ({ id: d.id })));
+    next = r.body?.links?.next ?? null;
+  }
+  return all;
+}
+async function createAppDataUsage(session, input) {
+  const relationships = { app: { data: { type: "apps", id: input.appId } } };
+  if (input.category) relationships.category = { data: { type: "appDataUsageCategories", id: input.category } };
+  if (input.purpose) relationships.purpose = { data: { type: "appDataUsagePurposes", id: input.purpose } };
+  relationships.dataProtection = { data: { type: "appDataUsageDataProtections", id: input.dataProtection } };
+  const r = await iris(session, "POST", "/appDataUsages", { data: { type: "appDataUsages", relationships } });
+  if (r.status !== 201 && r.status !== 200) fail(`Create ${input.category ?? ""} ${input.purpose ?? ""} ${input.dataProtection}`.replace(/\s+/g, " "), r);
+  return r.body?.data?.id;
+}
+async function deleteAppDataUsage(session, id) {
+  const r = await iris(session, "DELETE", `/appDataUsages/${id}`);
+  if (r.status !== 204 && r.status !== 200) fail(`Delete app data usage ${id}`, r);
+}
+async function getAppDataUsagesPublishState(session, appId) {
+  const r = await iris(session, "GET", `/apps/${appId}/dataUsagePublishState`);
+  if (r.status !== 200) fail("Read privacy publish state", r);
+  return { id: r.body.data.id, published: Boolean(r.body.data.attributes?.published) };
+}
+async function publishAppDataUsages(session, publishStateId) {
+  const r = await iris(session, "PATCH", `/appDataUsagesPublishState/${publishStateId}`, {
+    data: { type: "appDataUsagesPublishState", id: publishStateId, attributes: { published: true } }
+  });
+  if (r.status !== 200) fail("Publish privacy details", r);
+}
+async function uploadAppPrivacyDetails(opts) {
+  const { session, appId, usages, skipPublish, onLog = () => {
+  } } = opts;
+  validateUsages(usages);
+  await selectProviderForApp(session, appId, onLog);
+  const existing = await listAppDataUsages(session, appId);
+  onLog(`Deleting ${existing.length} existing answer${existing.length === 1 ? "" : "s"}`);
+  for (const u of existing) await deleteAppDataUsage(session, u.id);
+  let created = 0;
+  for (const usage of usages) {
+    const purposes = usage.purposes?.length ? usage.purposes : [null];
+    for (const purpose of purposes) {
+      for (const protection of usage.data_protections) {
+        onLog(protection === "DATA_NOT_COLLECTED" ? `Setting ${protection}` : `Setting ${usage.category} and ${purpose} to ${protection}`);
+        await createAppDataUsage(session, { appId, category: usage.category ?? null, purpose, dataProtection: protection });
+        created++;
+      }
+    }
+  }
+  if (skipPublish) {
+    onLog("Skipping publish");
+    return { deleted: existing.length, created, published: false };
+  }
+  const state = await getAppDataUsagesPublishState(session, appId);
+  await publishAppDataUsages(session, state.id);
+  onLog("Published");
+  return { deleted: existing.length, created, published: true };
+}
+function validateUsages(usages) {
+  if (!Array.isArray(usages) || usages.length === 0) throw new Error("No privacy usages given.");
+  const notCollected = usages.some((u) => u.data_protections?.includes("DATA_NOT_COLLECTED"));
+  if (notCollected && usages.length > 1) {
+    throw new Error("DATA_NOT_COLLECTED must be the only entry: an app cannot both collect nothing and collect something.");
+  }
+  const known = (list, v, what) => {
+    if (!list.includes(v)) throw new Error(`"${v}" is not an App Store Connect ${what}. Use one of: ${list.join(", ")}.`);
+  };
+  for (const u of usages) {
+    if (!u.data_protections?.length) throw new Error(`${u.category ?? "An entry"} has no data_protections.`);
+    if (u.category) known(DATA_USAGE_CATEGORIES, u.category, "data category");
+    for (const p of u.purposes ?? []) known(DATA_USAGE_PURPOSES, p, "purpose");
+    for (const d of u.data_protections) known(DATA_PROTECTIONS, d, "data protection");
+    if (u.data_protections.includes("DATA_NOT_COLLECTED")) continue;
+    if (!u.category) throw new Error("Every collected entry needs a category.");
+    if (!u.purposes?.length) throw new Error(`${u.category} needs at least one purpose.`);
+    const linked = u.data_protections.includes("DATA_LINKED_TO_YOU");
+    const unlinked = u.data_protections.includes("DATA_NOT_LINKED_TO_YOU");
+    if (linked && unlinked) throw new Error(`${u.category} cannot be both linked and not linked to the user.`);
+  }
+}
+var IRIS_BASE2, OLYMPUS_SESSION2, DATA_USAGE_CATEGORIES, DATA_USAGE_PURPOSES, DATA_PROTECTIONS;
+var init_privacy = __esm({
+  "src/privacy/index.ts"() {
+    IRIS_BASE2 = "https://appstoreconnect.apple.com/iris/v1";
+    OLYMPUS_SESSION2 = "https://appstoreconnect.apple.com/olympus/v1/session";
+    DATA_USAGE_CATEGORIES = [
+      "PAYMENT_INFORMATION",
+      "CREDIT_AND_FRAUD",
+      "OTHER_FINANCIAL_INFO",
+      "PRECISE_LOCATION",
+      "COARSE_LOCATION",
+      "SENSITIVE_INFO",
+      "PHYSICAL_ADDRESS",
+      "EMAIL_ADDRESS",
+      "NAME",
+      "PHONE_NUMBER",
+      "OTHER_CONTACT_INFO",
+      "CONTACTS",
+      "EMAILS_OR_TEXT_MESSAGES",
+      "PHOTOS_OR_VIDEOS",
+      "AUDIO",
+      "GAMEPLAY_CONTENT",
+      "CUSTOMER_SUPPORT",
+      "OTHER_USER_CONTENT",
+      "BROWSING_HISTORY",
+      "SEARCH_HISTORY",
+      "USER_ID",
+      "DEVICE_ID",
+      "PURCHASE_HISTORY",
+      "PRODUCT_INTERACTION",
+      "ADVERTISING_DATA",
+      "OTHER_USAGE_DATA",
+      "CRASH_DATA",
+      "PERFORMANCE_DATA",
+      "OTHER_DIAGNOSTIC_DATA",
+      "OTHER_DATA",
+      "HEALTH",
+      "FITNESS"
+    ];
+    DATA_USAGE_PURPOSES = [
+      "THIRD_PARTY_ADVERTISING",
+      "DEVELOPERS_ADVERTISING",
+      "ANALYTICS",
+      "PRODUCT_PERSONALIZATION",
+      "APP_FUNCTIONALITY",
+      "OTHER_PURPOSES"
+    ];
+    DATA_PROTECTIONS = [
+      "DATA_USED_TO_TRACK_YOU",
+      "DATA_LINKED_TO_YOU",
+      "DATA_NOT_LINKED_TO_YOU",
+      "DATA_NOT_COLLECTED"
+    ];
+  }
+});
+
+// src/review/index.ts
+var review_exports = {};
+__export(review_exports, {
+  getReviewFeedback: () => getReviewFeedback,
+  getThreadMessages: () => getThreadMessages,
+  htmlToText: () => htmlToText
+});
+async function iris2(session, path) {
+  const res = await fetch(`${IRIS_BASE3}${path}`, {
+    headers: {
+      Cookie: Object.entries(session.cookies).map(([k, v]) => `${k}=${v}`).join("; "),
+      Accept: "application/vnd.api+json, application/json",
+      "X-Requested-With": "XMLHttpRequest"
+    }
+  });
+  for (const raw of res.headers.getSetCookie?.() ?? []) {
+    const m = raw.match(/^([^=]+)=([^;]*)/);
+    if (m) session.cookies[m[1]] = m[2];
+  }
+  const text = await res.text();
+  let body = null;
+  try {
+    body = text ? JSON.parse(text) : null;
+  } catch {
+  }
+  if (!res.ok) {
+    const detail = body?.errors?.map((e) => e.detail ?? e.title).join("; ") || text.slice(0, 300);
+    throw new Error(`GET ${path} failed (HTTP ${res.status}): ${detail}`);
+  }
+  return body;
+}
+function htmlToText(html) {
+  if (!html) return "";
+  return html.replace(/<br\s*\/?>/gi, "\n").replace(/<\/(p|div|li|h\d)>/gi, "\n").replace(/<li[^>]*>/gi, "- ").replace(/<[^>]+>/g, "").replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/\n{3,}/g, "\n\n").trim();
+}
+function reasonsFrom(rejection) {
+  const reasons = rejection?.attributes?.reasons ?? [];
+  return (Array.isArray(reasons) ? reasons : []).map((r) => ({
+    section: r.reasonSection ?? r.section,
+    description: r.reasonDescription ?? r.description,
+    code: r.reasonCode ?? r.code
+  }));
+}
+async function getThreadMessages(session, threadId) {
+  const body = await iris2(session, `/resolutionCenterThreads/${threadId}/resolutionCenterMessages?include=fromActor,rejections`);
+  const included = new Map((body?.included ?? []).map((i) => [`${i.type}:${i.id}`, i]));
+  return (body?.data ?? []).map((m) => {
+    const actor = m.relationships?.fromActor?.data;
+    const actorRow = actor ? included.get(`${actor.type}:${actor.id}`) : null;
+    const rejections = (m.relationships?.rejections?.data ?? []).map((r) => included.get(`${r.type}:${r.id}`)).filter(Boolean);
+    return {
+      id: m.id,
+      createdDate: m.attributes?.createdDate ?? null,
+      from: actorRow?.attributes?.actorType ?? actorRow?.attributes?.userFirstName ?? null,
+      body: htmlToText(m.attributes?.messageBody),
+      reasons: rejections.flatMap(reasonsFrom)
+    };
+  });
+}
+async function getReviewFeedback(session, appId, opts = {}) {
+  await selectProviderForApp(session, appId, opts.onLog);
+  const subs = await iris2(session, `/apps/${appId}/reviewSubmissions?limit=10`);
+  const out = [];
+  for (const s of subs?.data ?? []) {
+    const state = s.attributes?.state ?? "";
+    if (opts.onlyOpen && state !== "UNRESOLVED_ISSUES") continue;
+    const threadsBody = await iris2(session, `/resolutionCenterThreads?filter[reviewSubmission]=${s.id}&include=reviewSubmission`);
+    const threads = [];
+    for (const t of threadsBody?.data ?? []) {
+      threads.push({
+        id: t.id,
+        threadType: t.attributes?.threadType ?? null,
+        state: t.attributes?.state ?? null,
+        createdDate: t.attributes?.createdDate ?? null,
+        messages: await getThreadMessages(session, t.id)
+      });
+    }
+    if (threads.length || !opts.onlyOpen) {
+      out.push({ submissionId: s.id, state, submittedDate: s.attributes?.submittedDate ?? null, threads });
+    }
+  }
+  return out;
+}
+var IRIS_BASE3;
+var init_review = __esm({
+  "src/review/index.ts"() {
+    init_privacy();
+    IRIS_BASE3 = "https://appstoreconnect.apple.com/iris/v1";
+  }
+});
 function createRunCommand() {
   const cmd = new commander.Command("run").description("Execute a lane from Fastfile.ts").argument("<lane>", "Lane name to execute").argument("[params...]", "Key:value parameters").option("-p, --platform <platform>", "Platform (ios, android)").action(async (laneName, params, opts) => {
     const { loadFastfile: loadFastfile2 } = await Promise.resolve().then(() => (init_fastfile(), fastfile_exports));
@@ -8661,10 +9797,10 @@ function createPilotCommand() {
   const cmd = new commander.Command("pilot").description("Manage TestFlight builds and testers");
   cmd.command("upload").description("Upload a build to TestFlight").requiredOption("-i, --ipa <path>", "Path to IPA file").option("--api-key-id <id>", "ASC API Key ID").option("--api-issuer-id <id>", "ASC API Issuer ID").option("--api-key <path>", "Path to .p8 API key file").action(async (opts) => {
     const { uploadToTestFlight: uploadToTestFlight2 } = await Promise.resolve().then(() => (init_pilot(), pilot_exports));
-    const { readFile: readFile8 } = await import('fs/promises');
+    const { readFile: readFile9 } = await import('fs/promises');
     let apiPrivateKey = "";
     if (opts.apiKey) {
-      apiPrivateKey = await readFile8(opts.apiKey, "utf-8");
+      apiPrivateKey = await readFile9(opts.apiKey, "utf-8");
     }
     console.log(`Uploading ${opts.ipa}...`);
     const result = await uploadToTestFlight2({
@@ -8696,7 +9832,10 @@ function createPilotCommand() {
   return cmd;
 }
 function createDeliverCommand() {
-  return new commander.Command("deliver").description("Upload metadata and binary to App Store Connect").option("-a, --app-identifier <id>", "Bundle identifier").option("-i, --ipa <path>", "Path to IPA file").option("-m, --metadata-path <path>", "Path to metadata directory").option("--screenshots-path <path>", "Path to screenshots directory").option("--submit-for-review", "Submit for review after upload").option("--skip-binary-upload", "Skip binary upload").option("--skip-metadata", "Skip metadata upload").option("--skip-screenshots", "Skip screenshot upload").option("--app-version <version>", "App version string").action(async (opts) => {
+  return new commander.Command("deliver").description("Upload metadata and binary to App Store Connect").option("-a, --app-identifier <id>", "Bundle identifier").option("-i, --ipa <path>", "Path to IPA file").option("-m, --metadata-path <path>", "Path to metadata directory").option("--screenshots-path <path>", "Path to screenshots directory").option("--submit-for-review", "Submit for review after upload").option("--skip-binary-upload", "Skip binary upload").option("--skip-metadata", "Skip metadata upload").option("--skip-screenshots", "Skip screenshot upload").option(
+    "--assets-path <path>",
+    "App Asset Library folder: <locale>/{screenshots,previews,header,search_results}/"
+  ).option("--asset-library", "Upload --screenshots-path through the App Asset Library (screenshot sets are deprecated)").option("--overwrite-assets", "Replace existing placements in each slot that gets new files").option("--skip-assets", "Skip asset library upload").option("--app-version <version>", "App version string").action(async (opts) => {
     const { resolveClientFromEnv: resolveClientFromEnv2 } = await Promise.resolve().then(() => (init_options(), options_exports));
     const { uploadToAppStore: uploadToAppStore2 } = await Promise.resolve().then(() => (init_deliver(), deliver_exports));
     const client = await resolveClientFromEnv2();
@@ -8715,7 +9854,12 @@ function createDeliverCommand() {
       submitForReview: opts.submitForReview,
       skipBinaryUpload: opts.skipBinaryUpload,
       skipMetadata: opts.skipMetadata,
-      skipScreenshots: opts.skipScreenshots
+      skipScreenshots: opts.skipScreenshots,
+      assetsPath: opts.assetsPath,
+      useAssetLibrary: opts.assetLibrary,
+      overwriteAssets: opts.overwriteAssets,
+      skipAssets: opts.skipAssets,
+      onOutput: (chunk) => process.stdout.write(chunk)
     });
     console.log(`App: ${result.appId}`);
     console.log(`Version: ${result.versionId}`);
@@ -8819,6 +9963,145 @@ function createLanesCommand() {
     }
   });
 }
+function createPrivacyCommand() {
+  return new commander.Command("privacy").description("Upload App Privacy details (nutrition labels) to App Store Connect").requiredOption("--app-id <id>", "App Store Connect app id (numeric Apple ID)").requiredOption("-j, --json-path <path>", "Fastlane-format app_privacy_details.json").option("-u, --username <email>", "Apple ID", process.env.FASTNODE_USER ?? process.env.FASTLANE_USER).option("--skip-publish", "Save the answers without publishing them", false).action(async (opts) => {
+    const { loginWithAppleId: loginWithAppleId2 } = await Promise.resolve().then(() => (init_apple_session(), apple_session_exports));
+    const { uploadAppPrivacyDetails: uploadAppPrivacyDetails2, validateUsages: validateUsages2 } = await Promise.resolve().then(() => (init_privacy(), privacy_exports));
+    const usages = JSON.parse(fs.readFileSync(opts.jsonPath, "utf8"));
+    validateUsages2(usages);
+    const email = opts.username || await ask("Apple ID: ");
+    const password = process.env.FASTNODE_PASSWORD ?? process.env.FASTLANE_PASSWORD ?? await ask(`Password for ${email}: `, true);
+    const session = await loginWithAppleId2({ email, password, onLog: (m) => console.log(m) });
+    const result = await uploadAppPrivacyDetails2({
+      session,
+      appId: opts.appId,
+      usages,
+      skipPublish: opts.skipPublish,
+      onLog: (m) => console.log(m)
+    });
+    console.log(`Done: ${result.created} answers${result.published ? ", published" : ""}.`);
+  });
+}
+function ask(question, secret = false) {
+  let muted = false;
+  const output = new stream.Writable({
+    write(chunk, _enc, cb) {
+      if (!muted) process.stdout.write(chunk);
+      cb();
+    }
+  });
+  const rl = readline.createInterface({ input: process.stdin, output, terminal: true });
+  return new Promise((resolve4) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      if (secret) process.stdout.write("\n");
+      resolve4(answer.trim());
+    });
+    muted = secret;
+  });
+}
+function createRejectionsCommand() {
+  return new commander.Command("rejections").description("Show App Review's Resolution Center messages and rejection reasons").requiredOption("--app-id <ids...>", "App Store Connect app id(s) (numeric Apple ID)").option("-u, --username <email>", "Apple ID", process.env.FASTNODE_USER ?? process.env.FASTLANE_USER).option("--all", "Include resolved submissions, not just ones awaiting you", false).option("--json", "Print JSON instead of text", false).action(async (opts) => {
+    const { loginWithAppleId: loginWithAppleId2 } = await Promise.resolve().then(() => (init_apple_session(), apple_session_exports));
+    const { getReviewFeedback: getReviewFeedback2 } = await Promise.resolve().then(() => (init_review(), review_exports));
+    const email = opts.username || await ask2("Apple ID: ");
+    const password = process.env.FASTNODE_PASSWORD ?? process.env.FASTLANE_PASSWORD ?? await ask2(`Password for ${email}: `, true);
+    const session = await loginWithAppleId2({ email, password, onLog: (m) => console.error(m) });
+    const all = {};
+    for (const appId of opts.appId) {
+      const feedback = await getReviewFeedback2(session, appId, { onlyOpen: !opts.all, onLog: (m) => console.error(m) });
+      all[appId] = feedback;
+      if (opts.json) continue;
+      console.log(`
+\u2550\u2550 App ${appId} \u2550\u2550`);
+      if (!feedback.length) console.log("No open App Review feedback.");
+      for (const s of feedback) {
+        console.log(`
+Submission ${s.submissionId} \u2014 ${s.state} (submitted ${s.submittedDate ?? "?"})`);
+        for (const t of s.threads) {
+          console.log(`  Thread ${t.threadType ?? "?"} \xB7 ${t.state ?? "?"} \xB7 ${t.createdDate ?? ""}`);
+          for (const m of t.messages) {
+            console.log(`
+  \u2500\u2500 ${m.from ?? "App Review"} \xB7 ${m.createdDate ?? ""}`);
+            for (const r of m.reasons) console.log(`  \u25B8 ${[r.section, r.description].filter(Boolean).join(" \u2014 ")}${r.code ? ` [${r.code}]` : ""}`);
+            console.log(m.body.split("\n").map((l) => `    ${l}`).join("\n"));
+          }
+        }
+      }
+    }
+    if (opts.json) console.log(JSON.stringify(all, null, 2));
+  });
+}
+function ask2(question, secret = false) {
+  let muted = false;
+  const output = new stream.Writable({ write(chunk, _enc, cb) {
+    if (!muted) process.stdout.write(chunk);
+    cb();
+  } });
+  const rl = readline.createInterface({ input: process.stdin, output, terminal: true });
+  return new Promise((resolve4) => {
+    rl.question(question, (a) => {
+      rl.close();
+      if (secret) process.stdout.write("\n");
+      resolve4(a.trim());
+    });
+    muted = secret;
+  });
+}
+function createAssetsCommand() {
+  const assets = new commander.Command("assets").description(
+    "App Store asset library \u2014 screenshots, previews, product page headers, search results assets"
+  );
+  assets.command("specs").description("List placement groups and the image sizes Apple accepts for each (from ASC reference data)").option("--feature <feature>", "APP_STORE_VERSIONS, CUSTOM_PRODUCT_PAGES, IN_APP_EVENTS, \u2026", "APP_STORE_VERSIONS").option("--placement-type <type>", "e.g. APP_SCREENSHOT, PRODUCT_PAGE_HEADER_ASSET").option("--json", "Print the raw reference data").action(async (opts) => {
+    const { resolveClientFromEnv: resolveClientFromEnv2 } = await Promise.resolve().then(() => (init_options(), options_exports));
+    const client = await resolveClientFromEnv2();
+    const feature = opts.feature;
+    const refData = await client.appAssetLibraries.refData({
+      features: [feature],
+      placementTypes: opts.placementType ? [opts.placementType] : void 0
+    });
+    if (opts.json) {
+      console.log(JSON.stringify(refData, null, 2));
+      return;
+    }
+    const policies = refData.features?.find((f) => f.featureId === feature)?.placementPolicies ?? [];
+    const specs = new Map([...refData.imageSpecs ?? [], ...refData.videoSpecs ?? []].map((s) => [s.specId, s]));
+    for (const type of refData.placementTypes ?? []) {
+      if (opts.placementType && type.placementTypeId !== opts.placementType) continue;
+      const policy = policies.find((p) => p.placementType === type.placementTypeId);
+      if (policies.length && !policy) continue;
+      console.log(`
+${type.placementTypeId}  (${(type.acceptsAssetCategories ?? []).join(", ")})`);
+      for (const mapping of type.specMappings ?? []) {
+        const max = policy?.groupLimits?.find((l) => l.groupIds.includes(mapping.placementGroupId))?.maxCount;
+        const sizes = mapping.specs.map((id) => specs.get(id)).filter((s) => Boolean(s)).map((s) => {
+          const d = s.dimensions;
+          const w = d.minWidth === d.maxWidth ? `${d.minWidth}` : `${d.minWidth}-${d.maxWidth}`;
+          const h = d.minHeight === d.maxHeight ? `${d.minHeight}` : `${d.minHeight}-${d.maxHeight}`;
+          return `${w}\xD7${h}`;
+        });
+        console.log(`  ${mapping.placementGroupId.padEnd(44)} ${max ? `max ${max}  ` : ""}${sizes.join(", ")}`);
+      }
+    }
+  });
+  assets.command("list").description("List images and videos in an app's asset library").requiredOption("-a, --app-identifier <id>", "Bundle identifier").action(async (opts) => {
+    const { resolveClientFromEnv: resolveClientFromEnv2 } = await Promise.resolve().then(() => (init_options(), options_exports));
+    const client = await resolveClientFromEnv2();
+    const app = await client.apps.findByBundleId(opts.appIdentifier);
+    if (!app) throw new Error(`App not found: ${opts.appIdentifier}`);
+    const library = await client.appAssetLibraries.getForApp(app.id);
+    const [images, videos] = await Promise.all([
+      client.appAssetLibraries.listImages(library.id),
+      client.appAssetLibraries.listVideos(library.id)
+    ]);
+    for (const a of [...images, ...videos]) {
+      const at = a.attributes;
+      console.log(`${a.type === "appAssetLibraryImages" ? "image" : "video"}  ${a.id}  ${String(at.state).padEnd(22)} ${at.category}  ${at.referenceName ?? at.fileName}`);
+    }
+    if (!images.length && !videos.length) console.log("Asset library is empty");
+  });
+  return assets;
+}
 
 // src/cli/index.ts
 init_options();
@@ -8837,6 +10120,9 @@ function createCli() {
   program.addCommand(createMatchCommand());
   program.addCommand(createActionsCommand());
   program.addCommand(createLanesCommand());
+  program.addCommand(createPrivacyCommand());
+  program.addCommand(createRejectionsCommand());
+  program.addCommand(createAssetsCommand());
   return program;
 }