@sitepong/fastnode 0.2.1 → 0.3.0

package/dist/lane/index.mjs

@@ -2,7 +2,7 @@ import * as x509 from '@peculiar/x509';
 import { randomUUID, createHash, webcrypto, randomBytes, pbkdf2Sync, createCipheriv, createDecipheriv } from 'crypto';
 import { spawn, execFile, execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, copyFileSync, mkdtempSync, rmSync, chmodSync } from 'fs';
-import { join, extname, resolve, basename } from 'path';
+import { join, extname, resolve, basename, relative } from 'path';
 import { homedir, tmpdir } from 'os';
 import { promisify } from 'util';
 import { mkdir, writeFile, readFile, readdir, unlink, stat, rm, mkdtemp } from 'fs/promises';
@@ -153,8 +153,8 @@ async function revokeExpiredCertificates(options) {
   return count;
 }
 async function importToKeychain(certData, keychainPath, keychainPassword) {
-  const { tmpdir: tmpdir8 } = await import('os');
-  const tempCertPath = join(tmpdir8(), `fastnode-cert-${Date.now()}.cer`);
+  const { tmpdir: tmpdir7 } = await import('os');
+  const tempCertPath = join(tmpdir7(), `fastnode-cert-${Date.now()}.cer`);
   await writeFile(tempCertPath, certData);
   try {
     const args = [
@@ -1723,6 +1723,20 @@ var init_srp = __esm({
     };
   }
 });
+async function appleJson(res, what) {
+  const text = await res.text();
+  try {
+    return JSON.parse(text);
+  } catch {
+    const contentType = (res.headers.get("content-type") ?? "").split(";")[0].trim();
+    const title = /<title>([^<]{1,120})<\/title>/i.exec(text)?.[1]?.trim();
+    const looksHtml = /^\s*<(!doctype|html)/i.test(text) || contentType === "text/html";
+    const page = looksHtml ? "an HTML page" : contentType ? `a ${contentType} response` : "a non-JSON response";
+    throw new Error(
+      `Apple answered the ${what} with ${page} (HTTP ${res.status}${title ? `, "${title}"` : ""}) instead of JSON. Apple is refusing or rate-limiting sign-ins from this server right now; wait a few minutes and try again. If it keeps happening, sign in once at appleid.apple.com to clear any hold on the account.`
+    );
+  }
+}
 function checkPortalResponse(body, session) {
   if (!body || typeof body !== "object") return;
   if (body.resultCode === 4100) {
@@ -1799,7 +1813,7 @@ async function beginLogin(config) {
 }
 async function fetchTwoFactorChallenge(pending) {
   const r = await fetch(`${AUTH_BASE}`, { headers: buildAuthHeadersFromPending(pending) });
-  const body = await r.json();
+  const body = await appleJson(r, "two-factor challenge");
   const trustedPhoneNumbers = (body.trustedPhoneNumbers ?? []).map((p) => ({
     id: p.id,
     numberWithDialCode: p.numberWithDialCode,
@@ -1820,7 +1834,8 @@ async function requestSmsCode(input) {
     body: JSON.stringify({ phoneNumber: { id: input.phoneId }, mode: input.mode ?? "sms" })
   });
 }
-async function submitTwoFactorCode(input) {
+async function submitTwoFactorCode(rawInput) {
+  const input = { ...rawInput, code: rawInput.code.replace(/[\s\u00a0]+/g, "") };
   const log = input.onLog ?? (() => {
   });
   let path;
@@ -1932,9 +1947,12 @@ async function doSirp(user, password, serviceKey, cookieStr, hashcash) {
     body: JSON.stringify({ a: aBase64, accountName: user, protocols: ["s2k", "s2k_fo"] }),
     redirect: "manual"
   });
-  const initBody = await initRes.json();
+  const initBody = await appleJson(initRes, "sign-in init");
   if (initBody.serviceErrors) throw new Error(`Apple auth error: ${JSON.stringify(initBody.serviceErrors)}`);
   const { iteration: iterations, salt: saltB64, b: bB64, c, protocol } = initBody;
+  if (!iterations || !saltB64 || !bB64 || !c || !protocol) {
+    throw new Error(`Apple's sign-in init answered without a challenge (HTTP ${initRes.status}): ${JSON.stringify(initBody).slice(0, 300)}`);
+  }
   const salt = Buffer.from(saltB64, "base64");
   const b = Buffer.from(bB64, "base64");
   const encryptedPassword = applePbkdf2(password, salt, iterations, 32, protocol);
@@ -1977,7 +1995,7 @@ async function fetchOlympusSession(session) {
   const cookieStr = Object.entries(session.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
   const res = await fetch(OLYMPUS_SESSION, { headers: { Cookie: cookieStr, Accept: "application/json" } });
   if (res.ok) {
-    const body = await res.json();
+    const body = await appleJson(res, "session lookup");
     if (body?.user?.emailAddress) session.userEmail = body.user.emailAddress;
     if (body?.provider?.providerId) session.teamId = String(body.provider.providerId);
   }
@@ -1989,7 +2007,7 @@ async function fetchContractMessages(session) {
       headers: { Cookie: cookieStr, Accept: "application/json" }
     });
     if (!res.ok) return [];
-    const body = await res.json();
+    const body = await appleJson(res, "agreements lookup");
     return (body ?? []).map((m) => ({
       id: m.id ?? "",
       group: m.group ?? "",
@@ -2000,10 +2018,22 @@ async function fetchContractMessages(session) {
     return [];
   }
 }
-async function fetchServiceKey() {
-  const res = await fetch(WIDGET_KEY_URL);
-  const body = await res.json();
-  if (!body?.authServiceKey) throw new Error("Could not fetch Apple service key");
+function serviceKeyFromLocation(location) {
+  if (!location) return null;
+  try {
+    const key = new URL(location).searchParams.get("widgetKey")?.trim();
+    return key && /^[0-9a-f]{16,}$/i.test(key) ? key : null;
+  } catch {
+    return null;
+  }
+}
+async function fetchServiceKey(fetchImpl = fetch) {
+  const head = await fetchImpl(LOGOUT_URL, { method: "HEAD", redirect: "manual" });
+  const fromRedirect = serviceKeyFromLocation(head.headers.get("location"));
+  if (fromRedirect) return fromRedirect;
+  const res = await fetchImpl(WIDGET_KEY_URL);
+  const body = await appleJson(res, "service key request");
+  if (!body?.authServiceKey) throw new Error("Could not fetch Apple service key: the sign-out redirect carried no widgetKey and the config endpoint had no authServiceKey.");
   return body.authServiceKey;
 }
 function buildAuthHeaders(session) {
@@ -2051,7 +2081,7 @@ async function defaultPrompt(message) {
     });
   });
 }
-var AUTH_BASE, OLYMPUS_SESSION, WIDGET_KEY_URL, ProgramLicenseAgreementError;
+var AUTH_BASE, OLYMPUS_SESSION, WIDGET_KEY_URL, ProgramLicenseAgreementError, LOGOUT_URL;
 var init_apple_session = __esm({
   "src/client/apple-session.ts"() {
     init_srp();
@@ -2066,6 +2096,7 @@ var init_apple_session = __esm({
       }
       agreements;
     };
+    LOGOUT_URL = "https://appstoreconnect.apple.com/logout";
   }
 });
 
@@ -2382,9 +2413,10 @@ async function uploadWithTransporter(options) {
   const transporterBin = await resolveTransporter();
   const platform = options.platform ?? "ios";
   const timeout = options.timeout ?? 18e5;
-  const keyDir = await mkdtemp(join(tmpdir(), "fastnode-itms-"));
+  const keyDir = join(homedir(), ".appstoreconnect", "private_keys");
+  await mkdir(keyDir, { recursive: true });
   const keyPath = join(keyDir, `AuthKey_${options.apiKeyId}.p8`);
-  await writeFile(keyPath, options.apiPrivateKey);
+  await writeFile(keyPath, options.apiPrivateKey, { mode: 384 });
   return new Promise((resolve4) => {
     const args = [
       "-m",
@@ -2400,6 +2432,9 @@ async function uploadWithTransporter(options) {
       "-WONoPause",
       "true"
     ];
+    if (options.assetDescriptionPath) {
+      args.push("-assetDescription", options.assetDescriptionPath);
+    }
     if (platform !== "ios") {
       args.push("-bundleType", platform);
     }
@@ -2423,13 +2458,13 @@ async function uploadWithTransporter(options) {
     child.stderr.on("data", onData);
     child.on("close", async (code) => {
       clearTimeout(timer);
-      await rm(keyDir, { recursive: true, force: true }).catch(() => {
+      await rm(keyPath, { force: true }).catch(() => {
       });
       resolve4({ success: code === 0, output, backend: "transporter" });
     });
     child.on("error", async (err) => {
       clearTimeout(timer);
-      await rm(keyDir, { recursive: true, force: true }).catch(() => {
+      await rm(keyPath, { force: true }).catch(() => {
       });
       resolve4({
         success: false,
@@ -2721,6 +2756,311 @@ var init_metadata = __esm({
     };
   }
 });
+function categoryFor(placementType) {
+  return placementType === "APP_SCREENSHOT" || placementType === "IMESSAGE_APP_SCREENSHOT" || placementType === "APP_PREVIEW" ? "APP_SCREENSHOTS_AND_PREVIEWS" : "CREATIVE_ASSETS";
+}
+function readImageSize(data) {
+  if (data.length >= 26 && data.readUInt32BE(0) === 2303741511) {
+    const colorType = data[25];
+    return {
+      width: data.readUInt32BE(16),
+      height: data.readUInt32BE(20),
+      alpha: colorType === 4 || colorType === 6
+    };
+  }
+  if (data.length >= 4 && data[0] === 255 && data[1] === 216) {
+    let offset = 2;
+    while (offset + 9 < data.length) {
+      if (data[offset] !== 255) return null;
+      const marker = data[offset + 1];
+      const length = data.readUInt16BE(offset + 2);
+      const isSof = marker >= 192 && marker <= 207 && marker !== 196 && marker !== 200 && marker !== 204;
+      if (isSof) {
+        return { height: data.readUInt16BE(offset + 5), width: data.readUInt16BE(offset + 7), alpha: false };
+      }
+      offset += 2 + length;
+    }
+  }
+  return null;
+}
+function fits(spec, width, height) {
+  const d = spec.dimensions;
+  return width >= d.minWidth && width <= d.maxWidth && height >= d.minHeight && height <= d.maxHeight;
+}
+function groupsForFeature(refData, feature, placementType) {
+  const mappings = refData.placementTypes?.find((p) => p.placementTypeId === placementType)?.specMappings ?? [];
+  const all = mappings.map((m) => m.placementGroupId);
+  const policy = refData.features?.find((f) => f.featureId === feature)?.placementPolicies?.find((p) => p.placementType === placementType);
+  const limited = policy?.groupLimits?.flatMap((l) => l.groupIds);
+  return limited?.length ? all.filter((g) => limited.includes(g)) : all;
+}
+function maxCountFor(refData, feature, placementType, placementGroup) {
+  return refData.features?.find((f) => f.featureId === feature)?.placementPolicies?.find((p) => p.placementType === placementType)?.groupLimits?.find((l) => l.groupIds.includes(placementGroup))?.maxCount;
+}
+function resolveImageGroups(refData, feature, placementType, size) {
+  const specs = (refData.imageSpecs ?? []).filter(
+    (s) => s.compatiblePlacementTypes.includes(placementType) && fits(s, size.width, size.height)
+  );
+  const specIds = new Set(specs.map((s) => s.specId));
+  const allowed = new Set(groupsForFeature(refData, feature, placementType));
+  const mappings = refData.placementTypes?.find((p) => p.placementTypeId === placementType)?.specMappings ?? [];
+  const groups = mappings.filter((m) => allowed.has(m.placementGroupId) && m.specs.some((id) => specIds.has(id))).map((m) => m.placementGroupId);
+  return { groups: [...new Set(groups)], spec: specs[0] };
+}
+async function runUploadOperations(ops, data) {
+  for (const op of ops) {
+    const headers = {};
+    for (const h of op.requestHeaders) headers[h.name] = h.value;
+    const res = await fetch(op.url, {
+      method: op.method,
+      headers,
+      body: data.subarray(op.offset, op.offset + op.length)
+    });
+    if (!res.ok) {
+      throw new Error(`Upload operation failed: ${op.method} ${new URL(op.url).host} \u2192 HTTP ${res.status}`);
+    }
+  }
+}
+async function uploadLibraryAsset(options) {
+  const { client, libraryId, filePath, category } = options;
+  const data = await readFile(filePath);
+  const fileName = basename(filePath);
+  const kind = VIDEO_EXTENSIONS.includes(extname(filePath).toLowerCase()) ? "video" : "image";
+  const hash = createHash("sha256").update(data).digest("hex").slice(0, 12);
+  const referenceName = `${options.referenceName ?? fileName} #${hash}`;
+  const media = kind === "image" ? client.appAssetLibraryImages : client.appAssetLibraryVideos;
+  const filter = { filter: { referenceName } };
+  const existing = kind === "image" ? await client.appAssetLibraries.listImages(libraryId, filter) : await client.appAssetLibraries.listVideos(libraryId, filter);
+  const reusable = existing.find(
+    (a) => a.attributes.category === category && a.attributes.state && READY_STATES.includes(a.attributes.state)
+  );
+  if (reusable) {
+    return { kind, id: reusable.id, state: reusable.attributes.state, reused: true };
+  }
+  const reserved = kind === "image" ? await client.appAssetLibraryImages.create({ libraryId, fileName, fileSize: data.length, category, referenceName }) : await client.appAssetLibraryVideos.create({
+    libraryId,
+    fileName,
+    fileSize: data.length,
+    category,
+    referenceName,
+    previewFrameTimeCode: options.previewFrameTimeCode
+  });
+  await runUploadOperations(reserved.attributes.uploadOperations ?? [], data);
+  await media.update(reserved.id, { uploaded: true });
+  options.log?.(`uploaded ${fileName} (${kind}, ${data.length} bytes)`);
+  const state = await waitForAssetReady(
+    () => media.get(reserved.id),
+    options.pollIntervalMs ?? 3e3,
+    options.timeoutMs ?? (kind === "video" ? 30 * 6e4 : 5 * 6e4)
+  );
+  return { kind, id: reserved.id, state, reused: false };
+}
+async function waitForAssetReady(get, intervalMs, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    const asset = await get();
+    const state = asset.attributes.state;
+    if (state === "FAILED") {
+      const why = (asset.attributes.stateDetails ?? []).map((d) => d.message ?? d.code).filter(Boolean).join("; ");
+      throw new Error(`Asset processing failed${why ? `: ${why}` : ""}`);
+    }
+    if (state && READY_STATES.includes(state)) return state;
+    if (Date.now() > deadline) throw new Error(`Asset still ${state ?? "unknown"} after ${timeoutMs / 1e3}s`);
+    await new Promise((r) => setTimeout(r, intervalMs));
+  }
+}
+async function listFiles(dir) {
+  return (await readdir(dir)).filter((f) => !f.startsWith(".")).sort((a, b) => a.localeCompare(b, void 0, { numeric: true }));
+}
+async function isDir(path) {
+  return (await stat(path)).isDirectory();
+}
+async function planLocale(localeDir, refData, feature, folders, warn) {
+  const planned = [];
+  for (const [folder, placementType] of Object.entries(folders)) {
+    const typeDir = join(localeDir, folder);
+    if (!existsSync(typeDir)) continue;
+    const known = new Set(groupsForFeature(refData, feature, placementType));
+    const entries = [];
+    for (const entry of await listFiles(typeDir)) {
+      const full = join(typeDir, entry);
+      if (await isDir(full)) {
+        if (!known.has(entry)) {
+          warn(`${relative(localeDir, full)}: "${entry}" is not a ${placementType} placement group for ${feature} \u2014 skipped`);
+          continue;
+        }
+        for (const f of await listFiles(full)) entries.push({ filePath: join(full, f), group: entry });
+      } else {
+        entries.push({ filePath: full });
+      }
+    }
+    for (const { filePath, group } of entries) {
+      const ext = extname(filePath).toLowerCase();
+      const isVideo = VIDEO_EXTENSIONS.includes(ext);
+      if (!isVideo && !IMAGE_EXTENSIONS.includes(ext)) continue;
+      const needsVideo = placementType === "APP_PREVIEW";
+      const needsImage = placementType === "APP_SCREENSHOT" || placementType === "IMESSAGE_APP_SCREENSHOT";
+      if (needsVideo && !isVideo || needsImage && isVideo) {
+        warn(`${relative(localeDir, filePath)}: ${isVideo ? "video" : "image"} cannot be a ${placementType} \u2014 skipped`);
+        continue;
+      }
+      if (group) {
+        planned.push({ filePath, placementType, groups: [group] });
+        continue;
+      }
+      if (isVideo) {
+        if (known.size === 1) planned.push({ filePath, placementType, groups: [...known] });
+        else warn(`${relative(localeDir, filePath)}: put videos in a placement-group folder (one of ${[...known].join(", ")}) \u2014 skipped`);
+        continue;
+      }
+      const size = readImageSize(await readFile(filePath));
+      if (!size) {
+        warn(`${relative(localeDir, filePath)}: could not read image size \u2014 skipped`);
+        continue;
+      }
+      const { groups, spec } = resolveImageGroups(refData, feature, placementType, size);
+      if (!groups.length) {
+        warn(`${relative(localeDir, filePath)}: ${size.width}\xD7${size.height} matches no ${placementType} spec \u2014 skipped`);
+        continue;
+      }
+      if (size.alpha && spec && spec.alphaAllowed === false) {
+        warn(`${relative(localeDir, filePath)}: has an alpha channel, which Apple rejects for this spec`);
+      }
+      planned.push({ filePath, placementType, groups: groups.slice(0, 1) });
+    }
+  }
+  return planned;
+}
+async function uploadAssetLibrary(options) {
+  const { client } = options;
+  const log = options.log ?? (() => {
+  });
+  const feature = "APP_STORE_VERSIONS";
+  const result = { uploaded: 0, reused: 0, placed: 0, removed: 0, warnings: [] };
+  const warn = (line) => {
+    result.warnings.push(line);
+    log(`warning: ${line}`);
+  };
+  const [library, refData, localizations] = await Promise.all([
+    client.appAssetLibraries.getForApp(options.appId),
+    client.appAssetLibraries.refData({ features: [feature] }),
+    client.appStoreVersions.getLocalizations(options.versionId)
+  ]);
+  const folders = { ...options.folders ?? ASSET_FOLDERS };
+  if (options.rootPlacementType) folders["."] = options.rootPlacementType;
+  const uploads = /* @__PURE__ */ new Map();
+  const uploadOnce = (filePath, placementType) => {
+    const key = `${filePath}|${categoryFor(placementType)}`;
+    if (!uploads.has(key)) {
+      uploads.set(
+        key,
+        uploadLibraryAsset({
+          client,
+          libraryId: library.id,
+          filePath,
+          category: categoryFor(placementType),
+          referenceName: relative(options.assetsPath, filePath),
+          log
+        }).then((a) => {
+          if (a.reused) result.reused++;
+          else result.uploaded++;
+          return a;
+        })
+      );
+    }
+    return uploads.get(key);
+  };
+  for (const loc of localizations) {
+    const localeDir = join(options.assetsPath, loc.attributes.locale);
+    if (!existsSync(localeDir)) continue;
+    const target = { kind: "appStoreVersionLocalization", id: loc.id };
+    const plan = await planLocale(localeDir, refData, feature, folders, warn);
+    const slots = /* @__PURE__ */ new Map();
+    for (const p of plan) {
+      for (const group of p.groups) {
+        const key = `${p.placementType}|${group}`;
+        if (!slots.has(key)) slots.set(key, { placementType: p.placementType, group, files: [] });
+        slots.get(key).files.push(p.filePath);
+      }
+    }
+    for (const slot of slots.values()) {
+      const where = `${loc.attributes.locale} ${slot.placementType} ${slot.group}`;
+      const max = maxCountFor(refData, feature, slot.placementType, slot.group);
+      if (max !== void 0 && slot.files.length > max) {
+        warn(`${where}: ${slot.files.length} files but Apple allows ${max} \u2014 keeping the first ${max}`);
+        slot.files = slot.files.slice(0, max);
+      }
+      const existing = await client.appAssetLibraryPlacements.listForTarget(target, {
+        placementType: slot.placementType,
+        placementGroup: slot.group,
+        include: "image,video"
+      });
+      if (options.overwrite) {
+        for (const p of existing) {
+          await client.appAssetLibraryPlacements.delete(p.id);
+          result.removed++;
+        }
+      }
+      const kept = options.overwrite ? [] : existing;
+      const keptAssetIds = new Set(kept.map((p) => placementAssetId(p)).filter(Boolean));
+      const ours = [];
+      for (const filePath of slot.files) {
+        const asset = await uploadOnce(filePath, slot.placementType);
+        if (keptAssetIds.has(asset.id)) continue;
+        const placement = await client.appAssetLibraryPlacements.create({
+          placementType: slot.placementType,
+          placementGroup: slot.group,
+          ...asset.kind === "image" ? { imageId: asset.id } : { videoId: asset.id },
+          target
+        });
+        ours.push(placement.id);
+        result.placed++;
+      }
+      log(`${where}: placed ${ours.length}${kept.length ? `, kept ${kept.length}` : ""}`);
+      const orderable = slot.placementType === "APP_SCREENSHOT" || slot.placementType === "APP_PREVIEW" || slot.placementType === "IMESSAGE_APP_SCREENSHOT";
+      if (orderable && ours.length + kept.length > 1) {
+        await client.appAssetLibraryPlacements.order({
+          placementGroup: slot.group,
+          placementIds: [...ours, ...kept.map((p) => p.id)],
+          target
+        });
+      }
+    }
+  }
+  return result;
+}
+function placementAssetId(p) {
+  for (const rel of ["image", "video"]) {
+    const data = p.relationships?.[rel]?.data;
+    if (data?.id) return data.id;
+  }
+  return void 0;
+}
+var ASSET_FOLDERS, IMAGE_EXTENSIONS, VIDEO_EXTENSIONS, READY_STATES;
+var init_assets = __esm({
+  "src/deliver/assets.ts"() {
+    ASSET_FOLDERS = {
+      screenshots: "APP_SCREENSHOT",
+      imessage_screenshots: "IMESSAGE_APP_SCREENSHOT",
+      previews: "APP_PREVIEW",
+      header: "PRODUCT_PAGE_HEADER_ASSET",
+      search_results: "APP_STORE_SEARCH_RESULTS_ASSET",
+      event_card: "EVENT_CARD_ASSET",
+      event_details: "EVENT_DETAILS_PAGE_ASSET"
+    };
+    IMAGE_EXTENSIONS = [".png", ".jpg", ".jpeg"];
+    VIDEO_EXTENSIONS = [".mp4", ".mov", ".m4v"];
+    READY_STATES = [
+      "COMPLETE",
+      "PREPARE_FOR_SUBMISSION",
+      "READY_FOR_REVIEW",
+      "WAITING_FOR_REVIEW",
+      "IN_REVIEW",
+      "ACCEPTED",
+      "APPROVED"
+    ];
+  }
+});
 
 // src/xcode/upload.ts
 var upload_exports = {};
@@ -2786,8 +3126,14 @@ var init_upload = __esm({
 // src/deliver/index.ts
 var deliver_exports = {};
 __export(deliver_exports, {
+  ASSET_FOLDERS: () => ASSET_FOLDERS,
+  categoryFor: () => categoryFor,
   loadMetadata: () => loadMetadata,
+  readImageSize: () => readImageSize,
+  resolveImageGroups: () => resolveImageGroups,
   submitForReview: () => submitForReview,
+  uploadAssetLibrary: () => uploadAssetLibrary,
+  uploadLibraryAsset: () => uploadLibraryAsset,
   uploadMetadata: () => uploadMetadata,
   uploadScreenshots: () => uploadScreenshots,
   uploadToAppStore: () => uploadToAppStore
@@ -2826,11 +3172,36 @@ async function uploadToAppStore(options) {
       copyright: options.copyright
     });
   }
+  const log = (line) => options.onOutput?.(`${line}
+`);
   if (!options.skipScreenshots && options.screenshotsPath && existsSync(options.screenshotsPath)) {
-    await uploadScreenshots({
+    if (options.useAssetLibrary) {
+      await uploadAssetLibrary({
+        client: options.client,
+        appId: app.id,
+        versionId: version.id,
+        assetsPath: options.screenshotsPath,
+        folders: {},
+        rootPlacementType: "APP_SCREENSHOT",
+        overwrite: options.overwriteAssets,
+        log
+      });
+    } else {
+      await uploadScreenshots({
+        client: options.client,
+        versionId: version.id,
+        screenshotsPath: options.screenshotsPath
+      });
+    }
+  }
+  if (!options.skipAssets && options.assetsPath && existsSync(options.assetsPath)) {
+    await uploadAssetLibrary({
       client: options.client,
+      appId: app.id,
       versionId: version.id,
-      screenshotsPath: options.screenshotsPath
+      assetsPath: options.assetsPath,
+      overwrite: options.overwriteAssets,
+      log
     });
   }
   if (!options.skipBinaryUpload) {
@@ -2915,17 +3286,7 @@ async function uploadScreenshots(options) {
         fileName: file,
         fileSize: fileData.length
       });
-      const ops = reserved.attributes.uploadOperations;
-      if (ops) {
-        for (const op of ops) {
-          const chunk = fileData.subarray(op.offset, op.offset + op.length);
-          const headers = {};
-          for (const h of op.requestHeaders) {
-            headers[h.name] = h.value;
-          }
-          await fetch(op.url, { method: op.method, headers, body: chunk });
-        }
-      }
+      await runUploadOperations(reserved.attributes.uploadOperations ?? [], fileData);
       await options.client.appScreenshots.commitScreenshot(reserved.id, {
         sourceFileChecksum: checksum,
         uploaded: true
@@ -2945,7 +3306,9 @@ function detectDisplayType(filename) {
 var init_deliver = __esm({
   "src/deliver/index.ts"() {
     init_metadata();
+    init_assets();
     init_metadata();
+    init_assets();
   }
 });
 
@@ -2954,6 +3317,7 @@ var produce_exports = {};
 __export(produce_exports, {
   SERVICE_NAME_TO_CAPABILITY: () => SERVICE_NAME_TO_CAPABILITY,
   addCapability: () => addCapability,
+  associateAppGroups: () => associateAppGroups,
   buildCapabilitySettings: () => buildCapabilitySettings,
   createApp: () => createApp,
   enableServices: () => enableServices,
@@ -3048,6 +3412,30 @@ async function enableServices(options) {
     });
   }
 }
+async function associateAppGroups(options) {
+  if (!options.appGroups?.length) return;
+  await options.portalClient.enableAppGroups(options.bundleIdId).catch(() => {
+  });
+  const existing = await options.portalClient.listAppGroups();
+  const appGroupIds = [];
+  for (const group of options.appGroups) {
+    let record = existing.find((ag) => ag.identifier === group.identifier);
+    if (!record) {
+      record = await options.portalClient.createAppGroup({
+        name: group.name,
+        identifier: group.identifier
+      });
+    }
+    const id = record?.applicationGroup ?? record?.applicationGroupId ?? record?.appGroupId ?? record?.id;
+    if (id) appGroupIds.push(id);
+  }
+  if (appGroupIds.length) {
+    await options.portalClient.assignAppGroups({
+      appIdId: options.bundleIdId,
+      appGroupIds
+    });
+  }
+}
 async function createApp(options) {
   const existing = await options.client.apps.findByBundleId(options.bundleIdentifier);
   if (existing) return existing;
@@ -3066,25 +3454,20 @@ async function createApp(options) {
       });
     }
   }
-  const sku = options.sku ?? `${options.bundleIdentifier}.${Date.now()}`;
-  const primaryLocale = options.primaryLocale ?? "en-US";
-  const response = await options.client.http.post("/v1/apps", {
-    data: {
-      type: "apps",
-      attributes: {
-        bundleId: options.bundleIdentifier,
-        name: options.appName,
-        sku,
-        primaryLocale
-      },
-      relationships: {
-        bundleId: {
-          data: { type: "bundleIds", id: bundleId.id }
-        }
-      }
-    }
+  if (options.appGroups?.length && options.portalClient) {
+    await associateAppGroups({
+      portalClient: options.portalClient,
+      bundleIdId: bundleId.id,
+      appGroups: options.appGroups
+    });
+  }
+  return options.client.apps.create({
+    bundleIdentifier: options.bundleIdentifier,
+    bundleIdId: bundleId.id,
+    appName: options.appName,
+    sku: options.sku ?? `${options.bundleIdentifier}.${Date.now()}`,
+    primaryLocale: options.primaryLocale
   });
-  return response.data;
 }
 var SERVICE_NAME_TO_CAPABILITY;
 var init_produce = __esm({
@@ -3887,10 +4270,10 @@ async function parseTestResults(options) {
   } else if (inputPath.endsWith(".plist")) {
     testSuites = parsePlistResults(inputPath);
   } else {
-    const stat6 = await import('fs').then(
+    const stat7 = await import('fs').then(
       (fs) => fs.statSync(inputPath)
     );
-    if (stat6.isDirectory()) {
+    if (stat7.isDirectory()) {
       requireMacOS("xcresult parsing");
       testSuites = await parseXCResult(inputPath);
     } else {
@@ -4878,6 +5261,43 @@ var init_apps = __esm({
         });
         return results[0] ?? null;
       }
+      /**
+       * Create an App Store Connect **app record** (the thing that shows up
+       * under "My Apps" and that TestFlight / App Store uploads require).
+       *
+       * This is distinct from registering an App ID in the Developer Portal —
+       * you need BOTH. The Developer Portal App ID unlocks provisioning
+       * profiles and entitlements; the App Store Connect app record unlocks
+       * uploads. `upload_to_testflight` fails with "Couldn't find app
+       * 'com.foo.bar' on the account…" when this record is missing.
+       *
+       * `bundleIdId` is the REST API primary key of the bundle id resource
+       * (not the identifier string) — fetch it via `bundleIds.find(identifier)`
+       * or from the response of `bundleIds.create()`.
+       *
+       * `sku` is an arbitrary unique string Apple uses to identify the app in
+       * their internal records. If you don't have a meaningful one, pass the
+       * bundle identifier itself or append a timestamp for uniqueness.
+       */
+      async create(params) {
+        const response = await this.http.post("/v1/apps", {
+          data: {
+            type: "apps",
+            attributes: {
+              bundleId: params.bundleIdentifier,
+              name: params.appName,
+              sku: params.sku,
+              primaryLocale: params.primaryLocale ?? "en-US"
+            },
+            relationships: {
+              bundleId: {
+                data: { type: "bundleIds", id: params.bundleIdId }
+              }
+            }
+          }
+        });
+        return response.data;
+      }
     };
   }
 });
@@ -6030,9 +6450,22 @@ var init_pre_release_versions = __esm({
 });
 
 // src/resources/review-submission-items.ts
-var ReviewSubmissionItemsResource;
+var ITEM_RELATIONSHIPS, ReviewSubmissionItemsResource;
 var init_review_submission_items = __esm({
   "src/resources/review-submission-items.ts"() {
+    ITEM_RELATIONSHIPS = {
+      appStoreVersionId: ["appStoreVersion", "appStoreVersions"],
+      appCustomProductPageVersionId: ["appCustomProductPageVersion", "appCustomProductPageVersions"],
+      appStoreVersionExperimentId: ["appStoreVersionExperiment", "appStoreVersionExperiments"],
+      appStoreVersionExperimentV2Id: ["appStoreVersionExperimentV2", "appStoreVersionExperiments"],
+      appEventId: ["appEvent", "appEvents"],
+      appAssetLibraryImageId: ["appAssetLibraryImage", "appAssetLibraryImages"],
+      appAssetLibraryVideoId: ["appAssetLibraryVideo", "appAssetLibraryVideos"],
+      backgroundAssetVersionId: ["backgroundAssetVersion", "backgroundAssetVersions"],
+      inAppPurchaseVersionId: ["inAppPurchaseVersion", "inAppPurchaseVersions"],
+      subscriptionVersionId: ["subscriptionVersion", "subscriptionVersions"],
+      subscriptionGroupVersionId: ["subscriptionGroupVersion", "subscriptionGroupVersions"]
+    };
     ReviewSubmissionItemsResource = class {
       constructor(http) {
         this.http = http;
@@ -6054,32 +6487,20 @@ var init_review_submission_items = __esm({
         );
         return response.data;
       }
+      /**
+       * Add one item to a review submission. Besides versions, asset library
+       * images and videos can be submitted on their own (ASC API 4.5.1) so
+       * creative assets are approved ahead of a campaign.
+       */
       async create(params) {
         const relationships = {
           reviewSubmission: {
             data: { type: "reviewSubmissions", id: params.reviewSubmissionId }
           }
         };
-        if (params.appStoreVersionId) {
-          relationships.appStoreVersion = {
-            data: { type: "appStoreVersions", id: params.appStoreVersionId }
-          };
-        }
-        if (params.appCustomProductPageVersionId) {
-          relationships.appCustomProductPageVersion = {
-            data: {
-              type: "appCustomProductPageVersions",
-              id: params.appCustomProductPageVersionId
-            }
-          };
-        }
-        if (params.appStoreVersionExperimentId) {
-          relationships.appStoreVersionExperiment = {
-            data: {
-              type: "appStoreVersionExperiments",
-              id: params.appStoreVersionExperimentId
-            }
-          };
+        for (const [param, [relationship, type]] of Object.entries(ITEM_RELATIONSHIPS)) {
+          const id = params[param];
+          if (id) relationships[relationship] = { data: { type, id } };
         }
         const response = await this.http.post(
           "/v1/reviewSubmissionItems",
@@ -6310,6 +6731,204 @@ var init_xcode_metrics = __esm({
   }
 });
 
+// src/resources/app-asset-libraries.ts
+function mergeRefData(parts) {
+  const merged = {
+    features: [],
+    placementProfileGroups: [],
+    imageSpecs: [],
+    videoSpecs: [],
+    placementTypes: [],
+    displayClasses: []
+  };
+  for (const part of parts) {
+    for (const key of Object.keys(merged)) {
+      merged[key].push(...part[key] ?? []);
+    }
+  }
+  return merged;
+}
+var AppAssetLibrariesResource;
+var init_app_asset_libraries = __esm({
+  "src/resources/app-asset-libraries.ts"() {
+    AppAssetLibrariesResource = class {
+      constructor(http) {
+        this.http = http;
+      }
+      http;
+      async getForApp(appId) {
+        const response = await this.http.get(
+          `/v1/apps/${appId}/assetLibrary`
+        );
+        return response.data;
+      }
+      async listImages(libraryId, params = {}) {
+        return this.http.all(`/v1/appAssetLibraries/${libraryId}/images`, params);
+      }
+      async listVideos(libraryId, params = {}) {
+        return this.http.all(`/v1/appAssetLibraries/${libraryId}/videos`, params);
+      }
+      /**
+       * Specs, placement groups and limits. Apple adds placement groups (new
+       * devices) without an API version bump, so read them from here rather than
+       * hard-coding display types.
+       */
+      async refData(params = {}) {
+        const filter = {};
+        if (params.features?.length) filter.features = params.features;
+        if (params.placementTypes?.length) filter.placementTypes = params.placementTypes;
+        if (params.placementProfileGroups?.length) filter.placementProfileGroups = params.placementProfileGroups;
+        const data = await this.http.all("/v1/appAssetLibraryRefData", { filter });
+        return mergeRefData(data.map((d) => d.attributes));
+      }
+    };
+  }
+});
+
+// src/resources/app-asset-library-assets.ts
+var AssetLibraryMediaResource, AppAssetLibraryImagesResource, AppAssetLibraryVideosResource;
+var init_app_asset_library_assets = __esm({
+  "src/resources/app-asset-library-assets.ts"() {
+    AssetLibraryMediaResource = class {
+      constructor(http) {
+        this.http = http;
+      }
+      http;
+      async get(id) {
+        const response = await this.http.get(`/v1/${this.type}/${id}`);
+        return response.data;
+      }
+      async reserve(params, extra = {}) {
+        const { libraryId, ...attributes } = params;
+        const response = await this.http.post(`/v1/${this.type}`, {
+          data: {
+            type: this.type,
+            attributes: { ...attributes, ...extra },
+            relationships: {
+              assetLibrary: { data: { type: "appAssetLibraries", id: libraryId } }
+            }
+          }
+        });
+        return response.data;
+      }
+      async patch(id, attributes) {
+        const response = await this.http.patch(`/v1/${this.type}/${id}`, {
+          data: { type: this.type, id, attributes }
+        });
+        return response.data;
+      }
+      /** Fails with 409 STATE_ERROR.ASSET_HAS_PLACEMENTS while the asset is still placed. */
+      async delete(id) {
+        await this.http.delete(`/v1/${this.type}/${id}`);
+      }
+      async listPlacements(id, params = {}) {
+        return this.http.all(`/v1/${this.type}/${id}/placements`, params);
+      }
+    };
+    AppAssetLibraryImagesResource = class extends AssetLibraryMediaResource {
+      type = "appAssetLibraryImages";
+      async create(params) {
+        return this.reserve(params);
+      }
+      async update(id, attributes) {
+        return this.patch(id, { ...attributes });
+      }
+    };
+    AppAssetLibraryVideosResource = class extends AssetLibraryMediaResource {
+      type = "appAssetLibraryVideos";
+      async create(params) {
+        const { previewFrameTimeCode, ...rest } = params;
+        return this.reserve(rest, previewFrameTimeCode ? { previewFrameTimeCode } : {});
+      }
+      async update(id, attributes) {
+        return this.patch(id, { ...attributes });
+      }
+    };
+  }
+});
+
+// src/resources/app-asset-library-placements.ts
+function targetRelationship(target) {
+  return { [target.kind]: { data: { type: TARGET_TYPES[target.kind], id: target.id } } };
+}
+var TARGET_TYPES, AppAssetLibraryPlacementsResource;
+var init_app_asset_library_placements = __esm({
+  "src/resources/app-asset-library-placements.ts"() {
+    TARGET_TYPES = {
+      appStoreVersionLocalization: "appStoreVersionLocalizations",
+      appCustomProductPageLocalization: "appCustomProductPageLocalizations",
+      appEventLocalization: "appEventLocalizations",
+      appStoreVersionExperimentTreatmentLocalization: "appStoreVersionExperimentTreatmentLocalizations"
+    };
+    AppAssetLibraryPlacementsResource = class {
+      constructor(http) {
+        this.http = http;
+      }
+      http;
+      /**
+       * Place an image or video on one localization. Placements cannot be edited —
+       * delete and recreate. The parent version/page must be editable.
+       */
+      async create(params) {
+        if (!params.imageId === !params.videoId) {
+          throw new Error("A placement needs exactly one of imageId or videoId");
+        }
+        const media = params.imageId ? { image: { data: { type: "appAssetLibraryImages", id: params.imageId } } } : { video: { data: { type: "appAssetLibraryVideos", id: params.videoId } } };
+        const response = await this.http.post(
+          "/v1/appAssetLibraryPlacements",
+          {
+            data: {
+              type: "appAssetLibraryPlacements",
+              attributes: { placementType: params.placementType, placementGroup: params.placementGroup },
+              relationships: { ...media, ...targetRelationship(params.target) }
+            }
+          }
+        );
+        return response.data;
+      }
+      async get(id, params = {}) {
+        const response = await this.http.get(
+          `/v1/appAssetLibraryPlacements/${id}`,
+          params.include ? { include: params.include } : void 0
+        );
+        return response.data;
+      }
+      async delete(id) {
+        await this.http.delete(`/v1/appAssetLibraryPlacements/${id}`);
+      }
+      /** Placements on one localization, in display order by default. */
+      async listForTarget(target, params = {}) {
+        const filter = {};
+        if (params.placementType) filter.placementType = params.placementType;
+        if (params.placementGroup) filter.placementGroup = params.placementGroup;
+        const listParams = { filter, include: params.include, sort: "placementGroupPosition" };
+        return this.http.all(
+          `/v1/${TARGET_TYPES[target.kind]}/${target.id}/placements`,
+          listParams
+        );
+      }
+      /** Set the display order of a placement group. In-app event localizations cannot be ordered. */
+      async order(params) {
+        if (params.target.kind === "appEventLocalization") {
+          throw new Error("In-app event placements cannot be ordered");
+        }
+        await this.http.post("/v1/appAssetLibraryPlacementOrderingRequests", {
+          data: {
+            type: "appAssetLibraryPlacementOrderingRequests",
+            attributes: { placementGroup: params.placementGroup },
+            relationships: {
+              orderedPlacements: {
+                data: params.placementIds.map((id) => ({ type: "appAssetLibraryPlacements", id }))
+              },
+              ...targetRelationship(params.target)
+            }
+          }
+        });
+      }
+    };
+  }
+});
+
 // src/client/portal.ts
 function pickUniqueKeyName(base, taken) {
   if (!taken.has(base)) return base;
@@ -6649,7 +7268,10 @@ var init_portal = __esm({
       }
       // ── Teams ──────────────────────────────────────────────────────────────
       async listTeams() {
-        const data = await this.post("account/listTeams.action", {});
+        const data = await this.post("account/listTeams.action", {
+          pageSize: "500",
+          pageNumber: "1"
+        });
         return data.teams ?? [];
       }
       // ── App IDs / Bundle IDs ───────────────────────────────────────────────
@@ -6663,11 +7285,12 @@ var init_portal = __esm({
         return data.appIds ?? [];
       }
       async createAppId(params) {
+        const safeName = params.name.replace(/[^0-9A-Za-z\s]/g, " ").replace(/\s+/g, " ").trim() || "App";
         const reqParams = {
           teamId: this.teamId,
           type: "explicit",
           identifier: params.identifier,
-          name: params.name
+          name: safeName
         };
         if (params.enablePush) reqParams.push = "on";
         if (params.enableIAP !== false) reqParams.inAppPurchase = "on";
@@ -6702,6 +7325,191 @@ var init_portal = __esm({
           featureValue: params.enabled ? "on" : "off"
         });
       }
+      // ── Application Groups ──────────────────────────────────────────────────
+      //
+      // App Groups (e.g. `group.com.playspina.com`) are the only clean way to
+      // share data — an auth token, in our case — between a host app and an
+      // embedded extension (Messages / Notification Service / etc.). App Store
+      // Connect API keys (.p8) genuinely cannot manage them; Apple only exposes
+      // group create/associate through this legacy session-cookie portal API,
+      // which is why they live on PortalClient (Apple ID session) and not on the
+      // ASC REST client. Endpoint shapes ported 1:1 from Spaceship's
+      // portal_client.rb (listApplicationGroups / addApplicationGroup /
+      // assignApplicationGroupToAppId).
+      /** Apple's internal feature code for the App Groups capability. */
+      static APP_GROUPS_FEATURE = "APG3427HIY";
+      /** List all app groups in the team. */
+      async listAppGroups() {
+        const data = await this.post("account/ios/identifiers/listApplicationGroups.action", {
+          teamId: this.teamId,
+          pageNumber: "1",
+          pageSize: "500",
+          sort: "name=asc"
+        });
+        return data.applicationGroupList ?? [];
+      }
+      /**
+       * Create an app group, returning the raw group record. Idempotent —
+       * Apple rejects a duplicate group identifier ("Multiple App Groups may
+       * not have the same identifier"), so we list first and reuse an existing
+       * group when the identifier already exists in the team.
+       *
+       * Note the two ids on the returned record: `identifier` is the
+       * `group.com.…` string you type, while `applicationGroup` is Apple's
+       * opaque internal handle that association actually requires — do NOT pass
+       * the human identifier to assignAppGroups.
+       */
+      async createAppGroup(params) {
+        const existing = await this.listAppGroups();
+        const hit = existing.find((g) => g.identifier === params.identifier);
+        if (hit) return hit;
+        const safeName = params.name.replace(/[^0-9A-Za-z\s]/g, " ").replace(/\s+/g, " ").trim() || "App Group";
+        const data = await this.post("account/ios/identifiers/addApplicationGroup.action", {
+          teamId: this.teamId,
+          identifier: params.identifier,
+          name: safeName
+        });
+        return data.applicationGroup;
+      }
+      /**
+       * Enable the App Groups capability on an App ID. Required before an
+       * App ID can have a group associated with it — mirrors Spaceship
+       * enabling `AppService::AppGroup` before `associate_groups`.
+       */
+      async enableAppGroups(appIdId) {
+        await this.post("account/ios/identifiers/updateService.action", {
+          teamId: this.teamId,
+          displayId: appIdId,
+          featureType: _PortalClient.APP_GROUPS_FEATURE,
+          featureValue: "true"
+        });
+      }
+      /**
+       * Associate one or more app groups with an App ID. `appGroupIds` are the
+       * internal ids (Spaceship's `app_group_id`), NOT the `group.com.…`
+       * identifiers. Apple wants both `appIdId` and `displayId` set to the
+       * App ID's internal id, per Spaceship's associate_groups_with_app.
+       */
+      async assignAppGroups(params) {
+        await this.post("account/ios/identifiers/assignApplicationGroupToAppId.action", {
+          teamId: this.teamId,
+          appIdId: params.appIdId,
+          displayId: params.appIdId,
+          applicationGroups: params.appGroupIds
+        });
+      }
+      // ── Apple Pay merchants (OMCs) ─────────────────────────────────────────
+      //
+      // Merchant IDs are team-level identifiers (merchant.com.…) that an App ID's
+      // Apple Pay capability must be LINKED to — enabling the capability alone
+      // produces profiles that fail with "doesn't support the … Merchant ID".
+      // Like App Groups, merchants are only manageable through the legacy
+      // session-cookie portal API. Endpoint shapes ported 1:1 from Spaceship's
+      // portal_client.rb (merchants / create_merchant! /
+      // associate_merchants_with_app).
+      /** Apple's internal feature code for the Apple Pay capability. */
+      static APPLE_PAY_FEATURE = "OM633U5T5G";
+      /**
+       * List all Apple Pay merchant IDs in the team. Each record maps
+       * (per Spaceship's merchant.rb attr_mapping): `omcId` = internal id,
+       * `identifier` = the human `merchant.com.…` string, `name` = display name.
+       */
+      async listMerchants() {
+        const data = await this.post("account/ios/identifiers/listOMCs.action", {
+          teamId: this.teamId,
+          pageNumber: "1",
+          pageSize: "500",
+          sort: "name=asc"
+        });
+        return data.identifierList ?? [];
+      }
+      /**
+       * Register (or reuse) a merchant ID, returning its INTERNAL id (`omcId`) —
+       * Apple's opaque handle that association requires, NOT the human
+       * `merchant.com.…` identifier. Idempotent: lists first and reuses an
+       * existing merchant with the same identifier. Endpoint + params ported 1:1
+       * from Spaceship's create_merchant! (addOMC.action).
+       */
+      async createMerchant(params) {
+        const existing = await this.listMerchants();
+        const hit = existing.find((m) => m.identifier === params.identifier);
+        if (hit?.omcId) return String(hit.omcId);
+        const safeName = params.name.replace(/[^0-9A-Za-z\s]/g, " ").replace(/\s+/g, " ").trim() || "Merchant";
+        const data = await this.post("account/ios/identifiers/addOMC.action", {
+          name: safeName,
+          identifier: params.identifier,
+          teamId: this.teamId
+        });
+        const rec = data.omcId ?? data;
+        const id = typeof rec === "string" ? rec : rec?.omcId ?? rec?.merchantId;
+        if (!id) {
+          throw new Error("Apple returned no internal merchant id (omcId) for the registered merchant.");
+        }
+        return String(id);
+      }
+      /**
+       * Enable the Apple Pay capability on an App ID. Apple Pay is a standard
+       * AppService (service_id OM633U5T5G) whose service_uri is the default
+       * `updateService.action` — confirmed in Spaceship's app_service.rb.
+       */
+      async enableApplePay(appIdId) {
+        await this.post("account/ios/identifiers/updateService.action", {
+          teamId: this.teamId,
+          displayId: appIdId,
+          featureType: _PortalClient.APPLE_PAY_FEATURE,
+          featureValue: "true"
+        });
+      }
+      /**
+       * Associate merchant IDs with an App ID's Apple Pay capability. `omcIds`
+       * are the internal ids (each merchant record's `omcId`), NOT the
+       * `merchant.com.…` identifiers. Endpoint + params ported 1:1 from
+       * Spaceship's associate_merchants_with_app (assignOMCToAppId.action — note
+       * the singular "OMC", and NO displayId param).
+       */
+      async assignMerchants(params) {
+        await this.post("account/ios/identifiers/assignOMCToAppId.action", {
+          teamId: this.teamId,
+          appIdId: params.appIdId,
+          omcIds: params.omcIds
+        });
+      }
+      /**
+       * Create an Apple Pay **Payment Processing Certificate** on a merchant ID
+       * from a CSR — the certificate a PSP (e.g. Stripe) hands you as a CSR, which
+       * must be uploaded to the Merchant ID in Apple Developer, then the resulting
+       * `.cer` downloaded and given back to the PSP so it can decrypt payment
+       * tokens. This is the one manual Apple-portal step in wiring up Apple Pay.
+       *
+       * Ported 1:1 from Spaceship's create_certificate! (submitCertificateRequest
+       * .action): the merchant's INTERNAL id (`omcId`) is passed as BOTH `appIdId`
+       * and `specialIdentifierDisplayId` — the latter is how the portal scopes a
+       * cert to a merchant/special identifier rather than an App ID. The cert type
+       * is APPLE_PAY (`4APLUP237T`). Returns the created certRequest (its
+       * `certificateId` feeds `downloadApplePayCertificate`).
+       *
+       * @param omcId       the merchant's internal id (from createMerchant/listMerchants)
+       * @param csrContent  the PEM CSR string (Stripe's "Apple Pay CSR")
+       */
+      async createApplePayCertificate(params) {
+        const data = await this.post("account/ios/certificate/submitCertificateRequest.action", {
+          teamId: this.teamId,
+          type: _PortalClient.CERT_TYPES.APPLE_PAY,
+          csrContent: params.csrContent,
+          appIdId: params.omcId,
+          specialIdentifierDisplayId: params.omcId
+        });
+        return data.certRequest;
+      }
+      /**
+       * Download an Apple Pay Payment Processing Certificate's raw bytes by its
+       * certificate id (from `createApplePayCertificate`). Thin wrapper over
+       * `downloadCertificate` pinned to the APPLE_PAY type — the DER `.cer` you
+       * upload back into Stripe.
+       */
+      async downloadApplePayCertificate(certificateId) {
+        return this.downloadCertificate(certificateId, _PortalClient.CERT_TYPES.APPLE_PAY);
+      }
       // ── Certificates ───────────────────────────────────────────────────────
       async listCertificates(types) {
         const iosTypes = types ?? [
@@ -7241,6 +8049,9 @@ var init_client = __esm({
     init_in_app_purchases();
     init_game_center_detail();
     init_xcode_metrics();
+    init_app_asset_libraries();
+    init_app_asset_library_assets();
+    init_app_asset_library_placements();
     init_auth();
     init_request();
     init_apple_session();
@@ -7282,6 +8093,10 @@ var init_client = __esm({
       inAppPurchases;
       gameCenterDetail;
       xcodeMetrics;
+      appAssetLibraries;
+      appAssetLibraryImages;
+      appAssetLibraryVideos;
+      appAssetLibraryPlacements;
       constructor(config) {
         const tokenManager = new TokenManager({
           keyId: config.keyId,
@@ -7325,6 +8140,10 @@ var init_client = __esm({
         this.inAppPurchases = new InAppPurchasesResource(this.http);
         this.gameCenterDetail = new GameCenterDetailResource(this.http);
         this.xcodeMetrics = new XcodeMetricsResource(this.http);
+        this.appAssetLibraries = new AppAssetLibrariesResource(this.http);
+        this.appAssetLibraryImages = new AppAssetLibraryImagesResource(this.http);
+        this.appAssetLibraryVideos = new AppAssetLibraryVideosResource(this.http);
+        this.appAssetLibraryPlacements = new AppAssetLibraryPlacementsResource(this.http);
       }
       async request(path, options) {
         return this.http.request(path, options);