@sitepong/fastnode 0.2.1 → 0.3.0

package/dist/index.d.ts

@@ -1,48 +1,51 @@
-import { A as AppleSession } from './index-BwwpAlk2.js';
-export { j as App, K as AppScreenshot, M as AppScreenshotSet, I as AppScreenshotsResource, a as AppStoreConnectClient, d as AppStoreConnectConfig, b as AppStoreConnectError, G as AppStoreVersion, H as AppStoreVersionLocalization, Q as AppStoreVersionSubmission, F as AppStoreVersionsResource, x as AppsResource, m as BetaBuildLocalization, l as BetaGroup, z as BetaGroupsResource, k as Build, n as BuildBetaDetail, y as BuildsResource, B as BundleId, p as BundleIdCapability, v as BundleIdsResource, E as CapabilitiesResource, s as CapabilityOption, r as CapabilitySetting, q as CapabilitySettingInput, C as Certificate, t as CertificatesResource, D as Device, w as DevicesResource, i as JsonApiError, h as JsonApiListResponse, J as JsonApiResource, g as JsonApiResponse, L as ListParams, o as PreReleaseVersion, P as Profile, u as ProfilesResource, c as RateLimitError, R as RequestClient, f as RequestOptions, O as ReviewSubmission, N as ReviewSubmissionsResource, e as TokenConfig, T as TokenManager, U as UploadOperation } from './index-BwwpAlk2.js';
-export { A as AppStoreVersionState, i as BetaReviewState, h as BuildProcessingState, B as BundleIdPlatform, f as CapabilityOptionKey, e as CapabilitySettingsKey, d as CapabilityType, C as CertificateType, g as ContentRightsDeclaration, D as DeviceClass, c as DeviceStatus, E as ExportMethod, b as Platform, a as ProfileState, P as ProfileType, R as ReleaseType } from './enums-B609j2rb.js';
-export { i as cert } from './index-BNP7Bpu5.js';
-export { i as sigh } from './index-CEldrbyz.js';
-export { i as match } from './index-Di4Ic0EE.js';
-export { i as produce } from './index-EKU_G1G5.js';
-export { i as pilot } from './index-mddpvrRX.js';
-export { i as deliver } from './index-BbY_H_f6.js';
-export { i as pem } from './index-C2YLoFVl.js';
-export { i as gym } from './index-DImN9PWc.js';
+import { A as AppStoreConnectClient } from './index-lsuS2R1T.js';
+export { i as App, Q as AppAssetLibrariesResource, S as AppAssetLibrary, Z as AppAssetLibraryDimensions, a0 as AppAssetLibraryImage, X as AppAssetLibraryImageSpec, _ as AppAssetLibraryImagesResource, a5 as AppAssetLibraryPlacement, a4 as AppAssetLibraryPlacementsResource, V as AppAssetLibraryRefDatum, W as AppAssetLibraryRefDatumAttributes, a1 as AppAssetLibraryVideo, Y as AppAssetLibraryVideoSpec, $ as AppAssetLibraryVideosResource, I as AppScreenshot, K as AppScreenshotSet, H as AppScreenshotsResource, c as AppStoreConnectConfig, a as AppStoreConnectError, F as AppStoreVersion, G as AppStoreVersionLocalization, O as AppStoreVersionSubmission, E as AppStoreVersionsResource, w as AppsResource, l as BetaBuildLocalization, k as BetaGroup, y as BetaGroupsResource, j as Build, m as BuildBetaDetail, x as BuildsResource, B as BundleId, o as BundleIdCapability, u as BundleIdsResource, z as CapabilitiesResource, r as CapabilityOption, q as CapabilitySetting, p as CapabilitySettingInput, C as Certificate, s as CertificatesResource, a2 as CreateAssetParams, D as Device, v as DevicesResource, h as JsonApiError, g as JsonApiListResponse, J as JsonApiResource, f as JsonApiResponse, L as ListParams, a6 as PlacementTarget, a7 as PlacementTargetKind, n as PreReleaseVersion, P as Profile, t as ProfilesResource, b as RateLimitError, R as RequestClient, e as RequestOptions, N as ReviewSubmission, M as ReviewSubmissionsResource, d as TokenConfig, T as TokenManager, a3 as UpdateAssetAttributes, U as UploadOperation } from './index-lsuS2R1T.js';
+export { j as AppAssetLibraryAssetCategory, m as AppAssetLibraryAssetState, o as AppAssetLibraryFeature, k as AppAssetLibraryMediaType, p as AppAssetLibraryPlacementPlatform, n as AppAssetLibraryPlacementState, l as AppAssetLibraryPlacementType, A as AppStoreVersionState, i as BetaReviewState, h as BuildProcessingState, B as BundleIdPlatform, f as CapabilityOptionKey, e as CapabilitySettingsKey, d as CapabilityType, C as CertificateType, g as ContentRightsDeclaration, D as DeviceClass, c as DeviceStatus, E as ExportMethod, b as Platform, a as ProfileState, P as ProfileType, R as ReleaseType } from './enums-yXNVh3UI.js';
+export { C as CertExpiryInfo, i as cert, p as parseCertificateExpiry } from './index-D1GHEM3c.js';
+export { i as sigh } from './index-C01Rkrir.js';
+export { i as match } from './index-BvyZ4uiw.js';
+export { i as produce } from './index-DjC_gmnL.js';
+export { i as pilot } from './index-CAEiXVWd.js';
+export { i as deliver } from './index-CBf0-NUQ.js';
+export { i as pem } from './index-rTZOdMRE.js';
+export { i as gym } from './index-mEEB7An6.js';
+export { i as gradle } from './index-Dv-Mek07.js';
+export { i as playstore } from './index-CXJlvmB4.js';
 export { i as scan } from './index-BimqCmY8.js';
 export { i as snapshot } from './index-CR3BFPIz.js';
 export { i as trainer } from './index-BoU8qt8r.js';
-export { i as precheck } from './index-jeI44Q5G.js';
+export { i as precheck } from './index-C9mHBJED.js';
+export { i as privacy } from './index-8djTPW8O.js';
+export { i as review } from './index-BGhV0gS-.js';
 export { i as frameit } from './index-BYonklf3.js';
 export { i as xcode } from './index-Cp6cjtd-.js';
 export { i as core } from './index-C2yG3wXA.js';
 export { LaneCallback, LaneDefinition, RunLaneOptions, RunResult, afterAll, afterEach, beforeAll, beforeEach, generateFastfileTemplate, lane, listAvailableLanes, loadFastfile, privateLane, runLane } from './lane/index.js';
 export { L as LaneContext } from './context-CymLkfrS.js';
 export { ActionDefinition, action, ensureActionsRegistered, getAction, listActions, registerAction } from './actions/index.js';
+import { A as AppleSession } from './apple-session-jUzBrql5.js';
 export { createCli } from './cli/index.js';
-import './cert-e5GAgAPb.js';
+import './cert-RvXmdMke.js';
 import 'commander';
 
 /**
  * One-click Apple Developer setup — given an authenticated portal session,
  * provisions everything needed to code-sign and upload iOS builds:
  *
- *   • Bundle ID (created or reused)
+ *   • Bundle ID (Developer Portal App ID, created or reused)
  *   • Distribution certificate + RSA private key bundled into a .p12
  *   • App Store provisioning profile
- *   • Optional APNs Production push certificate (.p12)
- *   • Optional APNs Sandbox push certificate (.p12)
+ *   • App Store Connect API key (.p8) for TestFlight uploads
+ *   • APNs Authentication Key (.p8) for push notifications
+ *   • Push / Sign in with Apple capabilities on the bundle
+ *   • App Store Connect app record (the "My Apps" entry uploads need)
+ *   • Optional legacy APNs Production / Sandbox push certificates (.p12)
  *   • Optional revocation of existing distribution certificates first
  *     (used when the team is at the 3-cert distribution limit)
  *
  * Returns values shaped to match the `apple_credentials` form in the
  * App Release product so an HTTP route or the in-page wizard can pre-fill
  * the existing form fields.
- *
- * Three fields are intentionally left empty (asc_key_id, asc_issuer_id,
- * asc_api_key_base64) — the App Store Connect API key still needs to be
- * uploaded manually. Auto-creating ASC API keys via the iris admin API
- * is a separate stretch goal.
  */
 
 interface OneClickInventory {
@@ -54,6 +57,7 @@ interface OneClickInventory {
         appIdId: string;
         identifier: string;
         name: string;
+        capabilities?: string[];
     }[];
     /** Active distribution certs. Apple caps a team at 3. */
     distributionCerts: {
@@ -135,6 +139,27 @@ interface OneClickOptions {
     enableSignInWithApple?: boolean;
     /** Enable Push Notifications capability on the bundle ID. Default true. */
     enablePushNotifications?: boolean;
+    /** Enable Apple Pay capability on the bundle ID. Default false. Required for Stripe. */
+    enableApplePay?: boolean;
+    /**
+     * Enable the Associated Domains capability on the bundle ID (universal
+     * links, passkeys / webcredentials, app clips). Default false. The domain
+     * list itself ships in the app's entitlements — Apple only stores the
+     * on/off switch. Requires the ASC API key (same JWT-only path as Push).
+     */
+    enableAssociatedDomains?: boolean;
+    /** Merchant ID to register for Apple Pay (e.g. "merchant.com.example.app"). Required when enableApplePay is true. */
+    merchantId?: string;
+    /**
+     * Create the App Store Connect **app record** (the "My Apps" entry that
+     * TestFlight and App Store uploads require). Default true. Distinct
+     * from registering the bundle id in the Developer Portal — you need
+     * both. Requires an ASC API key to be created (step 7) since the call
+     * goes through the JWT-authenticated REST API. Non-fatal — if the app
+     * record can't be created (or already exists), the orchestrator
+     * records a warning and continues.
+     */
+    createAscAppRecord?: boolean;
     /** Distribution cert IDs to revoke before creating the new one (for the 3-cert limit). */
     revokeCertIds?: string[];
     /** APNs auth key IDs to revoke before creating the new one (Apple caps APNs keys at 2/team). */
@@ -146,8 +171,31 @@ interface OneClickInput {
     bundleIdentifier: string;
     appName: string;
     options?: OneClickOptions;
+    /**
+     * Reuse an existing shared distribution certificate instead of minting a new
+     * one (Apple caps a team at 3). The provisioning profile is still created —
+     * against this cert's portal id (resolved by serial when only the serial is
+     * known). When set, the result's dist_cert / private_key / cert_password come
+     * back empty because the secret lives on the shared signing account, not here.
+     */
+    reuseDistributionCert?: {
+        certificateId?: string;
+        certSerial?: string;
+    };
     /** Defaults to a random 32-char password. Override for deterministic tests. */
     certPassword?: string;
+    /**
+     * SKU for the App Store Connect app record. Arbitrary unique string
+     * Apple uses internally. Defaults to `<bundle_identifier>.<timestamp>`
+     * which is good enough for most automated flows.
+     */
+    sku?: string;
+    /**
+     * Primary locale for the App Store Connect app record. Defaults to
+     * `en-US`. Changing this after creation requires a support ticket so
+     * err on the side of sensible defaults.
+     */
+    primaryLocale?: string;
     /**
      * Structured progress callback invoked at every step transition. The
      * wizard UI uses this to render a live list of "in progress / done /
@@ -187,11 +235,31 @@ interface OneClickResult {
     dist_cert_base64: string;
     private_key_base64: string;
     cert_password: string;
+    /**
+     * Serial of the distribution certificate this run MINTED, and when it
+     * expires. Empty when the run reused a shared certificate rather than
+     * minting one.
+     *
+     * The serial is the only handle a later run can reuse a certificate by:
+     * reuse matches on serialNumber, while creation returns a certificateId,
+     * and the two are different identifiers. Without this the caller has a p12
+     * and no way to name what is inside it, so it stores a certificate nothing
+     * can ever reuse — and the next "use existing" mints another.
+     */
+    dist_cert_serial: string;
+    dist_cert_expires_at: string;
     provisioning_profile_base64: string;
     profile_name: string;
     asc_key_id: string;
     asc_issuer_id: string;
     asc_api_key_base64: string;
+    /**
+     * App Store Connect app-record id, populated when the record was
+     * created fresh OR already existed and we reused it. Empty string
+     * when creation was skipped or failed — check `warnings` for the
+     * reason in that case.
+     */
+    asc_app_id: string;
     /** Additional certs to write to apple_credential_certs after credential is created. */
     additional_certs: AdditionalCertResult[];
     /** IDs of resources created (for debugging / rollback) */
@@ -202,6 +270,7 @@ interface OneClickResult {
         profileUuid?: string;
         apnsAuthKeyId?: string;
         ascApiKeyId?: string;
+        ascAppId?: string;
         revokedCertIds: string[];
     };
     /** Non-fatal issues — e.g. "used existing bundle id" */
@@ -223,6 +292,43 @@ interface PortalTeam {
  * API calls (and is not what the legacy portal endpoints want).
  */
 declare function oneClickListTeams(session: AppleSession): Promise<PortalTeam[]>;
+interface EnsureAppGroupInput {
+    session: AppleSession;
+    teamId: string;
+    /** The App Group identifier, e.g. `group.com.playspina.com`. */
+    groupIdentifier: string;
+    /** Human-readable name for the group. Defaults to the identifier. */
+    groupName?: string;
+    /**
+     * Bundle identifiers to associate the group with — typically the host
+     * app plus its extension(s), e.g. `["com.playspina.com",
+     * "com.playspina.com.MessagesExtension"]`. Each is resolved to its App ID
+     * (created if missing) before the group is enabled + associated.
+     */
+    bundleIdentifiers: string[];
+    onLog?: (msg: string) => void;
+}
+interface EnsureAppGroupResult {
+    /** Apple's internal handle for the group (used by profiles/association). */
+    appGroupId: string;
+    /** The `group.com.…` identifier. */
+    identifier: string;
+    /** Bundle identifiers successfully associated with the group. */
+    associated: string[];
+    /** Non-fatal issues (e.g. a capability toggle that Apple reported as already-on). */
+    warnings: string[];
+}
+/**
+ * Idempotently ensure an App Group exists and is associated with the given
+ * bundle identifiers, enabling the App Groups capability on each App ID
+ * first. This is the piece the `.p8` build pipeline cannot do — it requires
+ * the Apple ID session that onboarding already collects (see PortalClient's
+ * Application Groups section for why).
+ *
+ * Safe to re-run: the group is reused if it exists, capability-enable is
+ * best-effort (Apple no-ops when already on), and association is declarative.
+ */
+declare function ensureAppGroup(input: EnsureAppGroupInput): Promise<EnsureAppGroupResult>;
 /**
  * Read the team's current state: bundle IDs, distribution cert capacity,
  * push certs, profiles. Used by the wizard to render the configure screen
@@ -236,4 +342,154 @@ declare function oneClickInventory(session: AppleSession, teamId: string): Promi
  */
 declare function oneClickSetup(input: OneClickInput): Promise<OneClickResult>;
 
-export { type AdditionalCertResult, type OneClickInput, type OneClickInventory, type OneClickOptions, type OneClickResult, type PortalTeam, type ProgressEvent, oneClickInventory, oneClickListTeams, oneClickSetup };
+/**
+ * Apple Pay Payment Processing Certificate generation.
+ *
+ * The one manual Apple-portal step in wiring up in-app Apple Pay with a PSP
+ * (e.g. Stripe): the PSP hands you a CSR, which must be uploaded to the
+ * Merchant ID in Apple Developer to mint a Payment Processing Certificate, then
+ * the resulting `.cer` downloaded and given back to the PSP so it can decrypt
+ * payment tokens. This automates the Apple side end to end from the CSR.
+ *
+ * Merchant certs are created through the legacy session-cookie portal API
+ * (same as the merchant IDs themselves). Endpoint shapes are pinned in
+ * PortalClient (createApplePayCertificate / downloadApplePayCertificate),
+ * ported 1:1 from Spaceship.
+ */
+
+interface ApplePayCertInput {
+    session: AppleSession;
+    /** The team the merchant ID lives on (the credential's team). */
+    teamId: string;
+    /** The merchant identifier (`merchant.…`) to mint the certificate on. */
+    merchantIdentifier: string;
+    /** PEM CSR string — the "Apple Pay CSR" the PSP (Stripe) gives you. */
+    csr: string;
+    onLog?: (m: string) => void;
+}
+interface ApplePayCertResult {
+    merchantIdentifier: string;
+    /** Apple's internal merchant id the cert was minted on. */
+    omcId: string;
+    /** Apple's certificate id (for later download / revoke). */
+    certificateId: string;
+    /** The DER `.cer` bytes, base64-encoded — upload this back to the PSP. */
+    certificateBase64: string;
+}
+/**
+ * Upload a CSR to a Merchant ID and return the minted Apple Pay Payment
+ * Processing Certificate. Idempotent-ish: Apple allows a small number of live
+ * certs per merchant; if you re-run with a new CSR it mints another.
+ *
+ * Throws a clear error if the merchant identifier doesn't exist on the team
+ * (the caller should add the Apple Pay capability first, which registers it).
+ */
+declare function generateApplePayCertificate(input: ApplePayCertInput): Promise<ApplePayCertResult>;
+
+/**
+ * Capability action registry — the individually-callable building blocks
+ * behind Apple credential provisioning.
+ *
+ * `oneClickSetup` composes these in sequence for first-time setup, but each
+ * action is also standalone and idempotent, so a "select → type → go" UI can
+ * add ONE capability (an app extension, an App Group, an APNs key, an extra
+ * cert) to an already-provisioned credential without re-running the whole
+ * flow — as long as it has a live Apple session (re-auth on demand when the
+ * server-side session has expired).
+ *
+ * Actions return portable `ProvisionArtifact`s (raw Apple bytes + ids). The
+ * API layer is responsible for persisting them (Vault + apple_credential_certs
+ * / credential patches) — this module stays free of any DB coupling.
+ */
+
+interface ActionContext {
+    session: AppleSession;
+    teamId: string;
+    /** The primary app bundle id the credential is for (host app). */
+    bundleIdentifier: string;
+    /** Human-readable app name, used for cert/profile friendly names. */
+    appName: string;
+    /** Password to encrypt any generated .p12. Random if omitted. */
+    certPassword?: string;
+    /**
+     * Token-authenticated ASC REST client, when the credential has an ASC API
+     * key. Some capabilities (Associated Domains, Push, SIWA) can only be
+     * flipped via the ASC REST API — Apple removed their legacy portal
+     * endpoints — so actions that need it throw a clear error when absent.
+     */
+    ascClient?: AppStoreConnectClient;
+    onLog?: (m: string) => void;
+}
+type ArtifactKind = "apns_key" | "aps_production" | "aps_sandbox" | "distribution_cert" | "provisioning_profile" | "app_group" | "extension";
+/**
+ * A portable provisioning result. `base64` holds the primary blob
+ * (.p8 / .p12), `secret` the secondary secret (a .p12 password, or an APNs
+ * Key ID), and `ids`/`meta` any Apple-side identifiers the caller may want
+ * to persist. The API layer maps each kind to its storage:
+ *   apns_key / aps_* → apple_credential_certs
+ *   distribution_cert → credential patch (dist/private-key/password secrets)
+ *   app_group / extension → metadata / entitlements
+ */
+interface ProvisionArtifact {
+    kind: ArtifactKind;
+    base64?: string;
+    secret?: string;
+    name?: string;
+    ids?: Record<string, string>;
+    meta?: Record<string, unknown>;
+}
+interface ActionResult {
+    artifacts: ProvisionArtifact[];
+    warnings: string[];
+    /** One-line human summary for the UI. */
+    summary: string;
+}
+interface ActionField {
+    key: string;
+    label: string;
+    type: "text" | "bundleId" | "select" | "boolean";
+    required?: boolean;
+    placeholder?: string;
+    help?: string;
+    options?: {
+        value: string;
+        label: string;
+    }[];
+    /** Default value the UI pre-fills. */
+    default?: string | boolean;
+    /**
+     * When set, the UI offers the team's existing values (fetched via
+     * listCapabilityInventory) as a pick-from-list-or-type-new combobox instead
+     * of a bare text input. `bundleIds` → existing App IDs; `appGroups` →
+     * existing App Groups.
+     */
+    source?: "bundleIds" | "appGroups";
+}
+interface CapabilityAction {
+    key: string;
+    label: string;
+    description: string;
+    fields: ActionField[];
+    run(ctx: ActionContext, params: Record<string, any>): Promise<ActionResult>;
+}
+declare const CAPABILITY_ACTIONS: Record<string, CapabilityAction>;
+/** Serializable descriptors (no `run`) for a UI to render the action picker + forms. */
+declare function listCapabilityActions(): Array<Omit<CapabilityAction, "run">>;
+interface CapabilityInventory {
+    /** Existing App ID identifiers in the team, sorted. */
+    bundleIds: string[];
+    /** Existing App Groups in the team. */
+    appGroups: {
+        identifier: string;
+        name: string;
+    }[];
+}
+/**
+ * List the team's existing App IDs + App Groups, for the UI to offer as
+ * pick-from-existing options in fields tagged with a `source`. Read-only.
+ */
+declare function listCapabilityInventory(session: AppleSession, teamId: string): Promise<CapabilityInventory>;
+/** Run a single capability action by key. Throws on unknown key. */
+declare function runCapabilityAction(key: string, ctx: ActionContext, params: Record<string, any>): Promise<ActionResult>;
+
+export { type ActionContext, type ActionField, type ActionResult, type AdditionalCertResult, AppStoreConnectClient, type ApplePayCertInput, type ApplePayCertResult, type ArtifactKind, CAPABILITY_ACTIONS, type CapabilityAction, type CapabilityInventory, type EnsureAppGroupInput, type EnsureAppGroupResult, type OneClickInput, type OneClickInventory, type OneClickOptions, type OneClickResult, type PortalTeam, type ProgressEvent, type ProvisionArtifact, ensureAppGroup, generateApplePayCertificate, listCapabilityActions, listCapabilityInventory, oneClickInventory, oneClickListTeams, oneClickSetup, runCapabilityAction };