@sitepong/fastnode 0.2.2 → 0.3.1

package/dist/client/index.mjs

@@ -1,6 +1,9 @@
 import { importPKCS8, SignJWT } from 'jose';
 import { createHash, randomBytes, pbkdf2Sync } from 'crypto';
 import { createInterface } from 'readline';
+import { writeFileSync, chmodSync, existsSync, unlinkSync, readFileSync, mkdirSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
 
 // src/client/auth.ts
 var MAX_TOKEN_DURATION = 1200;
@@ -164,6 +167,20 @@ function applePbkdf2(password, salt, iterations, keyLength, protocol) {
 
 // src/client/apple-session.ts
 var AUTH_BASE = "https://idmsa.apple.com/appleauth/auth";
+async function appleJson(res, what) {
+  const text = await res.text();
+  try {
+    return JSON.parse(text);
+  } catch {
+    const contentType = (res.headers.get("content-type") ?? "").split(";")[0].trim();
+    const title = /<title>([^<]{1,120})<\/title>/i.exec(text)?.[1]?.trim();
+    const looksHtml = /^\s*<(!doctype|html)/i.test(text) || contentType === "text/html";
+    const page = looksHtml ? "an HTML page" : contentType ? `a ${contentType} response` : "a non-JSON response";
+    throw new Error(
+      `Apple answered the ${what} with ${page} (HTTP ${res.status}${title ? `, "${title}"` : ""}) instead of JSON. Apple is refusing or rate-limiting sign-ins from this server right now; wait a few minutes and try again. If it keeps happening, sign in once at appleid.apple.com to clear any hold on the account.`
+    );
+  }
+}
 var OLYMPUS_SESSION = "https://appstoreconnect.apple.com/olympus/v1/session";
 var WIDGET_KEY_URL = "https://appstoreconnect.apple.com/olympus/v1/app/config?hostname=itunesconnect.apple.com";
 var ProgramLicenseAgreementError = class extends Error {
@@ -250,7 +267,7 @@ async function beginLogin(config) {
 }
 async function fetchTwoFactorChallenge(pending) {
   const r = await fetch(`${AUTH_BASE}`, { headers: buildAuthHeadersFromPending(pending) });
-  const body = await r.json();
+  const body = await appleJson(r, "two-factor challenge");
   const trustedPhoneNumbers = (body.trustedPhoneNumbers ?? []).map((p) => ({
     id: p.id,
     numberWithDialCode: p.numberWithDialCode,
@@ -271,7 +288,8 @@ async function requestSmsCode(input) {
     body: JSON.stringify({ phoneNumber: { id: input.phoneId }, mode: input.mode ?? "sms" })
   });
 }
-async function submitTwoFactorCode(input) {
+async function submitTwoFactorCode(rawInput) {
+  const input = { ...rawInput, code: rawInput.code.replace(/[\s\u00a0]+/g, "") };
   const log = input.onLog ?? (() => {
   });
   let path;
@@ -383,9 +401,12 @@ async function doSirp(user, password, serviceKey, cookieStr, hashcash) {
     body: JSON.stringify({ a: aBase64, accountName: user, protocols: ["s2k", "s2k_fo"] }),
     redirect: "manual"
   });
-  const initBody = await initRes.json();
+  const initBody = await appleJson(initRes, "sign-in init");
   if (initBody.serviceErrors) throw new Error(`Apple auth error: ${JSON.stringify(initBody.serviceErrors)}`);
   const { iteration: iterations, salt: saltB64, b: bB64, c, protocol } = initBody;
+  if (!iterations || !saltB64 || !bB64 || !c || !protocol) {
+    throw new Error(`Apple's sign-in init answered without a challenge (HTTP ${initRes.status}): ${JSON.stringify(initBody).slice(0, 300)}`);
+  }
   const salt = Buffer.from(saltB64, "base64");
   const b = Buffer.from(bB64, "base64");
   const encryptedPassword = applePbkdf2(password, salt, iterations, 32, protocol);
@@ -428,7 +449,7 @@ async function fetchOlympusSession(session) {
   const cookieStr = Object.entries(session.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
   const res = await fetch(OLYMPUS_SESSION, { headers: { Cookie: cookieStr, Accept: "application/json" } });
   if (res.ok) {
-    const body = await res.json();
+    const body = await appleJson(res, "session lookup");
     if (body?.user?.emailAddress) session.userEmail = body.user.emailAddress;
     if (body?.provider?.providerId) session.teamId = String(body.provider.providerId);
   }
@@ -440,7 +461,7 @@ async function fetchContractMessages(session) {
       headers: { Cookie: cookieStr, Accept: "application/json" }
     });
     if (!res.ok) return [];
-    const body = await res.json();
+    const body = await appleJson(res, "agreements lookup");
     return (body ?? []).map((m) => ({
       id: m.id ?? "",
       group: m.group ?? "",
@@ -451,10 +472,23 @@ async function fetchContractMessages(session) {
     return [];
   }
 }
-async function fetchServiceKey() {
-  const res = await fetch(WIDGET_KEY_URL);
-  const body = await res.json();
-  if (!body?.authServiceKey) throw new Error("Could not fetch Apple service key");
+var LOGOUT_URL = "https://appstoreconnect.apple.com/logout";
+function serviceKeyFromLocation(location) {
+  if (!location) return null;
+  try {
+    const key = new URL(location).searchParams.get("widgetKey")?.trim();
+    return key && /^[0-9a-f]{16,}$/i.test(key) ? key : null;
+  } catch {
+    return null;
+  }
+}
+async function fetchServiceKey(fetchImpl = fetch) {
+  const head = await fetchImpl(LOGOUT_URL, { method: "HEAD", redirect: "manual" });
+  const fromRedirect = serviceKeyFromLocation(head.headers.get("location"));
+  if (fromRedirect) return fromRedirect;
+  const res = await fetchImpl(WIDGET_KEY_URL);
+  const body = await appleJson(res, "service key request");
+  if (!body?.authServiceKey) throw new Error("Could not fetch Apple service key: the sign-out redirect carried no widgetKey and the config endpoint had no authServiceKey.");
   return body.authServiceKey;
 }
 function buildAuthHeaders(session) {
@@ -2052,6 +2086,19 @@ var PreReleaseVersionsResource = class {
 };
 
 // src/resources/review-submission-items.ts
+var ITEM_RELATIONSHIPS = {
+  appStoreVersionId: ["appStoreVersion", "appStoreVersions"],
+  appCustomProductPageVersionId: ["appCustomProductPageVersion", "appCustomProductPageVersions"],
+  appStoreVersionExperimentId: ["appStoreVersionExperiment", "appStoreVersionExperiments"],
+  appStoreVersionExperimentV2Id: ["appStoreVersionExperimentV2", "appStoreVersionExperiments"],
+  appEventId: ["appEvent", "appEvents"],
+  appAssetLibraryImageId: ["appAssetLibraryImage", "appAssetLibraryImages"],
+  appAssetLibraryVideoId: ["appAssetLibraryVideo", "appAssetLibraryVideos"],
+  backgroundAssetVersionId: ["backgroundAssetVersion", "backgroundAssetVersions"],
+  inAppPurchaseVersionId: ["inAppPurchaseVersion", "inAppPurchaseVersions"],
+  subscriptionVersionId: ["subscriptionVersion", "subscriptionVersions"],
+  subscriptionGroupVersionId: ["subscriptionGroupVersion", "subscriptionGroupVersions"]
+};
 var ReviewSubmissionItemsResource = class {
   constructor(http) {
     this.http = http;
@@ -2073,32 +2120,20 @@ var ReviewSubmissionItemsResource = class {
     );
     return response.data;
   }
+  /**
+   * Add one item to a review submission. Besides versions, asset library
+   * images and videos can be submitted on their own (ASC API 4.5.1) so
+   * creative assets are approved ahead of a campaign.
+   */
   async create(params) {
     const relationships = {
       reviewSubmission: {
         data: { type: "reviewSubmissions", id: params.reviewSubmissionId }
       }
     };
-    if (params.appStoreVersionId) {
-      relationships.appStoreVersion = {
-        data: { type: "appStoreVersions", id: params.appStoreVersionId }
-      };
-    }
-    if (params.appCustomProductPageVersionId) {
-      relationships.appCustomProductPageVersion = {
-        data: {
-          type: "appCustomProductPageVersions",
-          id: params.appCustomProductPageVersionId
-        }
-      };
-    }
-    if (params.appStoreVersionExperimentId) {
-      relationships.appStoreVersionExperiment = {
-        data: {
-          type: "appStoreVersionExperiments",
-          id: params.appStoreVersionExperimentId
-        }
-      };
+    for (const [param, [relationship, type]] of Object.entries(ITEM_RELATIONSHIPS)) {
+      const id = params[param];
+      if (id) relationships[relationship] = { data: { type, id } };
     }
     const response = await this.http.post(
       "/v1/reviewSubmissionItems",
@@ -2302,6 +2337,256 @@ var XcodeMetricsResource = class {
   }
 };
 
+// src/resources/app-asset-libraries.ts
+var AppAssetLibrariesResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async getForApp(appId) {
+    const response = await this.http.get(
+      `/v1/apps/${appId}/assetLibrary`
+    );
+    return response.data;
+  }
+  async listImages(libraryId, params = {}) {
+    return this.http.all(`/v1/appAssetLibraries/${libraryId}/images`, params);
+  }
+  async listVideos(libraryId, params = {}) {
+    return this.http.all(`/v1/appAssetLibraries/${libraryId}/videos`, params);
+  }
+  /**
+   * Specs, placement groups and limits. Apple adds placement groups (new
+   * devices) without an API version bump, so read them from here rather than
+   * hard-coding display types.
+   */
+  async refData(params = {}) {
+    const filter = {};
+    if (params.features?.length) filter.features = params.features;
+    if (params.placementTypes?.length) filter.placementTypes = params.placementTypes;
+    if (params.placementProfileGroups?.length) filter.placementProfileGroups = params.placementProfileGroups;
+    const data = await this.http.all("/v1/appAssetLibraryRefData", { filter });
+    return mergeRefData(data.map((d) => d.attributes));
+  }
+};
+function mergeRefData(parts) {
+  const merged = {
+    features: [],
+    placementProfileGroups: [],
+    imageSpecs: [],
+    videoSpecs: [],
+    placementTypes: [],
+    displayClasses: []
+  };
+  for (const part of parts) {
+    for (const key of Object.keys(merged)) {
+      merged[key].push(...part[key] ?? []);
+    }
+  }
+  return merged;
+}
+
+// src/resources/app-asset-library-assets.ts
+var AssetLibraryMediaResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async get(id) {
+    const response = await this.http.get(`/v1/${this.type}/${id}`);
+    return response.data;
+  }
+  async reserve(params, extra = {}) {
+    const { libraryId, ...attributes } = params;
+    const response = await this.http.post(`/v1/${this.type}`, {
+      data: {
+        type: this.type,
+        attributes: { ...attributes, ...extra },
+        relationships: {
+          assetLibrary: { data: { type: "appAssetLibraries", id: libraryId } }
+        }
+      }
+    });
+    return response.data;
+  }
+  async patch(id, attributes) {
+    const response = await this.http.patch(`/v1/${this.type}/${id}`, {
+      data: { type: this.type, id, attributes }
+    });
+    return response.data;
+  }
+  /** Fails with 409 STATE_ERROR.ASSET_HAS_PLACEMENTS while the asset is still placed. */
+  async delete(id) {
+    await this.http.delete(`/v1/${this.type}/${id}`);
+  }
+  async listPlacements(id, params = {}) {
+    return this.http.all(`/v1/${this.type}/${id}/placements`, params);
+  }
+};
+var AppAssetLibraryImagesResource = class extends AssetLibraryMediaResource {
+  type = "appAssetLibraryImages";
+  async create(params) {
+    return this.reserve(params);
+  }
+  async update(id, attributes) {
+    return this.patch(id, { ...attributes });
+  }
+};
+var AppAssetLibraryVideosResource = class extends AssetLibraryMediaResource {
+  type = "appAssetLibraryVideos";
+  async create(params) {
+    const { previewFrameTimeCode, ...rest } = params;
+    return this.reserve(rest, previewFrameTimeCode ? { previewFrameTimeCode } : {});
+  }
+  async update(id, attributes) {
+    return this.patch(id, { ...attributes });
+  }
+};
+
+// src/resources/app-asset-library-placements.ts
+var TARGET_TYPES = {
+  appStoreVersionLocalization: "appStoreVersionLocalizations",
+  appCustomProductPageLocalization: "appCustomProductPageLocalizations",
+  appEventLocalization: "appEventLocalizations",
+  appStoreVersionExperimentTreatmentLocalization: "appStoreVersionExperimentTreatmentLocalizations"
+};
+function targetRelationship(target) {
+  return { [target.kind]: { data: { type: TARGET_TYPES[target.kind], id: target.id } } };
+}
+var AppAssetLibraryPlacementsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /**
+   * Place an image or video on one localization. Placements cannot be edited —
+   * delete and recreate. The parent version/page must be editable.
+   */
+  async create(params) {
+    if (!params.imageId === !params.videoId) {
+      throw new Error("A placement needs exactly one of imageId or videoId");
+    }
+    const media = params.imageId ? { image: { data: { type: "appAssetLibraryImages", id: params.imageId } } } : { video: { data: { type: "appAssetLibraryVideos", id: params.videoId } } };
+    const response = await this.http.post(
+      "/v1/appAssetLibraryPlacements",
+      {
+        data: {
+          type: "appAssetLibraryPlacements",
+          attributes: { placementType: params.placementType, placementGroup: params.placementGroup },
+          relationships: { ...media, ...targetRelationship(params.target) }
+        }
+      }
+    );
+    return response.data;
+  }
+  async get(id, params = {}) {
+    const response = await this.http.get(
+      `/v1/appAssetLibraryPlacements/${id}`,
+      params.include ? { include: params.include } : void 0
+    );
+    return response.data;
+  }
+  async delete(id) {
+    await this.http.delete(`/v1/appAssetLibraryPlacements/${id}`);
+  }
+  /** Placements on one localization, in display order by default. */
+  async listForTarget(target, params = {}) {
+    const filter = {};
+    if (params.placementType) filter.placementType = params.placementType;
+    if (params.placementGroup) filter.placementGroup = params.placementGroup;
+    const listParams = { filter, include: params.include, sort: "placementGroupPosition" };
+    return this.http.all(
+      `/v1/${TARGET_TYPES[target.kind]}/${target.id}/placements`,
+      listParams
+    );
+  }
+  /** Set the display order of a placement group. In-app event localizations cannot be ordered. */
+  async order(params) {
+    if (params.target.kind === "appEventLocalization") {
+      throw new Error("In-app event placements cannot be ordered");
+    }
+    await this.http.post("/v1/appAssetLibraryPlacementOrderingRequests", {
+      data: {
+        type: "appAssetLibraryPlacementOrderingRequests",
+        attributes: { placementGroup: params.placementGroup },
+        relationships: {
+          orderedPlacements: {
+            data: params.placementIds.map((id) => ({ type: "appAssetLibraryPlacements", id }))
+          },
+          ...targetRelationship(params.target)
+        }
+      }
+    });
+  }
+};
+var OLYMPUS_SESSION2 = "https://appstoreconnect.apple.com/olympus/v1/session";
+function sessionDir() {
+  return process.env.FASTNODE_SESSION_DIR || join(homedir(), ".fastnode", "sessions");
+}
+function fileFor(email) {
+  const key = createHash("sha256").update(email.trim().toLowerCase()).digest("hex").slice(0, 16);
+  return join(sessionDir(), `${key}.json`);
+}
+function ensureDir() {
+  const dir = sessionDir();
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 448 });
+  chmodSync(dir, 448);
+}
+function saveAppleSession(session) {
+  ensureDir();
+  const stored = { email: session.userEmail, savedAt: (/* @__PURE__ */ new Date()).toISOString(), session };
+  const path = fileFor(session.userEmail);
+  writeFileSync(path, JSON.stringify(stored), { mode: 384 });
+  chmodSync(path, 384);
+  writeFileSync(join(sessionDir(), "last-apple-id"), session.userEmail, { mode: 384 });
+}
+function clearAppleSession(email) {
+  const path = fileFor(email);
+  if (existsSync(path)) unlinkSync(path);
+}
+function lastAppleId() {
+  try {
+    return readFileSync(join(sessionDir(), "last-apple-id"), "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+async function loadAppleSession(email, fetchImpl = fetch) {
+  const path = fileFor(email);
+  if (!existsSync(path)) return null;
+  let stored;
+  try {
+    stored = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+  const cookie = Object.entries(stored.session.cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+  try {
+    const res = await fetchImpl(OLYMPUS_SESSION2, { headers: { Cookie: cookie, Accept: "application/json" } });
+    if (!res.ok) {
+      clearAppleSession(email);
+      return null;
+    }
+  } catch {
+    return null;
+  }
+  return stored.session;
+}
+async function signInWithAppleId(options) {
+  const email = options.email || lastAppleId() || await options.askEmail();
+  if (!options.fresh) {
+    const saved = await loadAppleSession(email);
+    if (saved) {
+      options.onLog?.(`Using saved Apple ID session for ${email}`);
+      return saved;
+    }
+  }
+  const password = await options.askPassword(email);
+  const session = await loginWithAppleId({ email, password, onLog: options.onLog });
+  saveAppleSession(session);
+  return session;
+}
+
 // src/client/portal.ts
 var PORTAL_BASE = "https://developer.apple.com/services-account/QH65B2";
 function pickUniqueKeyName(base, taken) {
@@ -2637,7 +2922,10 @@ var PortalClient = class _PortalClient {
   }
   // ── Teams ──────────────────────────────────────────────────────────────
   async listTeams() {
-    const data = await this.post("account/listTeams.action", {});
+    const data = await this.post("account/listTeams.action", {
+      pageSize: "500",
+      pageNumber: "1"
+    });
     return data.teams ?? [];
   }
   // ── App IDs / Bundle IDs ───────────────────────────────────────────────
@@ -2651,11 +2939,12 @@ var PortalClient = class _PortalClient {
     return data.appIds ?? [];
   }
   async createAppId(params) {
+    const safeName = params.name.replace(/[^0-9A-Za-z\s]/g, " ").replace(/\s+/g, " ").trim() || "App";
     const reqParams = {
       teamId: this.teamId,
       type: "explicit",
       identifier: params.identifier,
-      name: params.name
+      name: safeName
     };
     if (params.enablePush) reqParams.push = "on";
     if (params.enableIAP !== false) reqParams.inAppPurchase = "on";
@@ -2690,6 +2979,191 @@ var PortalClient = class _PortalClient {
       featureValue: params.enabled ? "on" : "off"
     });
   }
+  // ── Application Groups ──────────────────────────────────────────────────
+  //
+  // App Groups (e.g. `group.com.playspina.com`) are the only clean way to
+  // share data — an auth token, in our case — between a host app and an
+  // embedded extension (Messages / Notification Service / etc.). App Store
+  // Connect API keys (.p8) genuinely cannot manage them; Apple only exposes
+  // group create/associate through this legacy session-cookie portal API,
+  // which is why they live on PortalClient (Apple ID session) and not on the
+  // ASC REST client. Endpoint shapes ported 1:1 from Spaceship's
+  // portal_client.rb (listApplicationGroups / addApplicationGroup /
+  // assignApplicationGroupToAppId).
+  /** Apple's internal feature code for the App Groups capability. */
+  static APP_GROUPS_FEATURE = "APG3427HIY";
+  /** List all app groups in the team. */
+  async listAppGroups() {
+    const data = await this.post("account/ios/identifiers/listApplicationGroups.action", {
+      teamId: this.teamId,
+      pageNumber: "1",
+      pageSize: "500",
+      sort: "name=asc"
+    });
+    return data.applicationGroupList ?? [];
+  }
+  /**
+   * Create an app group, returning the raw group record. Idempotent —
+   * Apple rejects a duplicate group identifier ("Multiple App Groups may
+   * not have the same identifier"), so we list first and reuse an existing
+   * group when the identifier already exists in the team.
+   *
+   * Note the two ids on the returned record: `identifier` is the
+   * `group.com.…` string you type, while `applicationGroup` is Apple's
+   * opaque internal handle that association actually requires — do NOT pass
+   * the human identifier to assignAppGroups.
+   */
+  async createAppGroup(params) {
+    const existing = await this.listAppGroups();
+    const hit = existing.find((g) => g.identifier === params.identifier);
+    if (hit) return hit;
+    const safeName = params.name.replace(/[^0-9A-Za-z\s]/g, " ").replace(/\s+/g, " ").trim() || "App Group";
+    const data = await this.post("account/ios/identifiers/addApplicationGroup.action", {
+      teamId: this.teamId,
+      identifier: params.identifier,
+      name: safeName
+    });
+    return data.applicationGroup;
+  }
+  /**
+   * Enable the App Groups capability on an App ID. Required before an
+   * App ID can have a group associated with it — mirrors Spaceship
+   * enabling `AppService::AppGroup` before `associate_groups`.
+   */
+  async enableAppGroups(appIdId) {
+    await this.post("account/ios/identifiers/updateService.action", {
+      teamId: this.teamId,
+      displayId: appIdId,
+      featureType: _PortalClient.APP_GROUPS_FEATURE,
+      featureValue: "true"
+    });
+  }
+  /**
+   * Associate one or more app groups with an App ID. `appGroupIds` are the
+   * internal ids (Spaceship's `app_group_id`), NOT the `group.com.…`
+   * identifiers. Apple wants both `appIdId` and `displayId` set to the
+   * App ID's internal id, per Spaceship's associate_groups_with_app.
+   */
+  async assignAppGroups(params) {
+    await this.post("account/ios/identifiers/assignApplicationGroupToAppId.action", {
+      teamId: this.teamId,
+      appIdId: params.appIdId,
+      displayId: params.appIdId,
+      applicationGroups: params.appGroupIds
+    });
+  }
+  // ── Apple Pay merchants (OMCs) ─────────────────────────────────────────
+  //
+  // Merchant IDs are team-level identifiers (merchant.com.…) that an App ID's
+  // Apple Pay capability must be LINKED to — enabling the capability alone
+  // produces profiles that fail with "doesn't support the … Merchant ID".
+  // Like App Groups, merchants are only manageable through the legacy
+  // session-cookie portal API. Endpoint shapes ported 1:1 from Spaceship's
+  // portal_client.rb (merchants / create_merchant! /
+  // associate_merchants_with_app).
+  /** Apple's internal feature code for the Apple Pay capability. */
+  static APPLE_PAY_FEATURE = "OM633U5T5G";
+  /**
+   * List all Apple Pay merchant IDs in the team. Each record maps
+   * (per Spaceship's merchant.rb attr_mapping): `omcId` = internal id,
+   * `identifier` = the human `merchant.com.…` string, `name` = display name.
+   */
+  async listMerchants() {
+    const data = await this.post("account/ios/identifiers/listOMCs.action", {
+      teamId: this.teamId,
+      pageNumber: "1",
+      pageSize: "500",
+      sort: "name=asc"
+    });
+    return data.identifierList ?? [];
+  }
+  /**
+   * Register (or reuse) a merchant ID, returning its INTERNAL id (`omcId`) —
+   * Apple's opaque handle that association requires, NOT the human
+   * `merchant.com.…` identifier. Idempotent: lists first and reuses an
+   * existing merchant with the same identifier. Endpoint + params ported 1:1
+   * from Spaceship's create_merchant! (addOMC.action).
+   */
+  async createMerchant(params) {
+    const existing = await this.listMerchants();
+    const hit = existing.find((m) => m.identifier === params.identifier);
+    if (hit?.omcId) return String(hit.omcId);
+    const safeName = params.name.replace(/[^0-9A-Za-z\s]/g, " ").replace(/\s+/g, " ").trim() || "Merchant";
+    const data = await this.post("account/ios/identifiers/addOMC.action", {
+      name: safeName,
+      identifier: params.identifier,
+      teamId: this.teamId
+    });
+    const rec = data.omcId ?? data;
+    const id = typeof rec === "string" ? rec : rec?.omcId ?? rec?.merchantId;
+    if (!id) {
+      throw new Error("Apple returned no internal merchant id (omcId) for the registered merchant.");
+    }
+    return String(id);
+  }
+  /**
+   * Enable the Apple Pay capability on an App ID. Apple Pay is a standard
+   * AppService (service_id OM633U5T5G) whose service_uri is the default
+   * `updateService.action` — confirmed in Spaceship's app_service.rb.
+   */
+  async enableApplePay(appIdId) {
+    await this.post("account/ios/identifiers/updateService.action", {
+      teamId: this.teamId,
+      displayId: appIdId,
+      featureType: _PortalClient.APPLE_PAY_FEATURE,
+      featureValue: "true"
+    });
+  }
+  /**
+   * Associate merchant IDs with an App ID's Apple Pay capability. `omcIds`
+   * are the internal ids (each merchant record's `omcId`), NOT the
+   * `merchant.com.…` identifiers. Endpoint + params ported 1:1 from
+   * Spaceship's associate_merchants_with_app (assignOMCToAppId.action — note
+   * the singular "OMC", and NO displayId param).
+   */
+  async assignMerchants(params) {
+    await this.post("account/ios/identifiers/assignOMCToAppId.action", {
+      teamId: this.teamId,
+      appIdId: params.appIdId,
+      omcIds: params.omcIds
+    });
+  }
+  /**
+   * Create an Apple Pay **Payment Processing Certificate** on a merchant ID
+   * from a CSR — the certificate a PSP (e.g. Stripe) hands you as a CSR, which
+   * must be uploaded to the Merchant ID in Apple Developer, then the resulting
+   * `.cer` downloaded and given back to the PSP so it can decrypt payment
+   * tokens. This is the one manual Apple-portal step in wiring up Apple Pay.
+   *
+   * Ported 1:1 from Spaceship's create_certificate! (submitCertificateRequest
+   * .action): the merchant's INTERNAL id (`omcId`) is passed as BOTH `appIdId`
+   * and `specialIdentifierDisplayId` — the latter is how the portal scopes a
+   * cert to a merchant/special identifier rather than an App ID. The cert type
+   * is APPLE_PAY (`4APLUP237T`). Returns the created certRequest (its
+   * `certificateId` feeds `downloadApplePayCertificate`).
+   *
+   * @param omcId       the merchant's internal id (from createMerchant/listMerchants)
+   * @param csrContent  the PEM CSR string (Stripe's "Apple Pay CSR")
+   */
+  async createApplePayCertificate(params) {
+    const data = await this.post("account/ios/certificate/submitCertificateRequest.action", {
+      teamId: this.teamId,
+      type: _PortalClient.CERT_TYPES.APPLE_PAY,
+      csrContent: params.csrContent,
+      appIdId: params.omcId,
+      specialIdentifierDisplayId: params.omcId
+    });
+    return data.certRequest;
+  }
+  /**
+   * Download an Apple Pay Payment Processing Certificate's raw bytes by its
+   * certificate id (from `createApplePayCertificate`). Thin wrapper over
+   * `downloadCertificate` pinned to the APPLE_PAY type — the DER `.cer` you
+   * upload back into Stripe.
+   */
+  async downloadApplePayCertificate(certificateId) {
+    return this.downloadCertificate(certificateId, _PortalClient.CERT_TYPES.APPLE_PAY);
+  }
   // ── Certificates ───────────────────────────────────────────────────────
   async listCertificates(types) {
     const iosTypes = types ?? [
@@ -3202,6 +3676,10 @@ var AppStoreConnectClient = class {
   inAppPurchases;
   gameCenterDetail;
   xcodeMetrics;
+  appAssetLibraries;
+  appAssetLibraryImages;
+  appAssetLibraryVideos;
+  appAssetLibraryPlacements;
   constructor(config) {
     const tokenManager = new TokenManager({
       keyId: config.keyId,
@@ -3245,12 +3723,16 @@ var AppStoreConnectClient = class {
     this.inAppPurchases = new InAppPurchasesResource(this.http);
     this.gameCenterDetail = new GameCenterDetailResource(this.http);
     this.xcodeMetrics = new XcodeMetricsResource(this.http);
+    this.appAssetLibraries = new AppAssetLibrariesResource(this.http);
+    this.appAssetLibraryImages = new AppAssetLibraryImagesResource(this.http);
+    this.appAssetLibraryVideos = new AppAssetLibraryVideosResource(this.http);
+    this.appAssetLibraryPlacements = new AppAssetLibraryPlacementsResource(this.http);
   }
   async request(path, options) {
     return this.http.request(path, options);
   }
 };
 
-export { AppStoreConnectClient, AppStoreConnectError, IrisAuthError, IrisClient, PortalClient, ProgramLicenseAgreementError, RateLimitError, RequestClient, TokenManager, beginLogin, checkPortalResponse, loginWithAppleId, requestSmsCode, submitTwoFactorCode };
+export { AppStoreConnectClient, AppStoreConnectError, IrisAuthError, IrisClient, PortalClient, ProgramLicenseAgreementError, RateLimitError, RequestClient, TokenManager, beginLogin, checkPortalResponse, clearAppleSession, lastAppleId, loadAppleSession, loginWithAppleId, requestSmsCode, saveAppleSession, sessionDir, signInWithAppleId, submitTwoFactorCode };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map