@sitepong/fastnode 0.2.2 → 0.3.1

package/dist/index.d.cts

@@ -1,26 +1,31 @@
-import { A as AppleSession } from './index-BKUapQP2.cjs';
-export { j as App, K as AppScreenshot, M as AppScreenshotSet, I as AppScreenshotsResource, a as AppStoreConnectClient, d as AppStoreConnectConfig, b as AppStoreConnectError, G as AppStoreVersion, H as AppStoreVersionLocalization, Q as AppStoreVersionSubmission, F as AppStoreVersionsResource, x as AppsResource, m as BetaBuildLocalization, l as BetaGroup, z as BetaGroupsResource, k as Build, n as BuildBetaDetail, y as BuildsResource, B as BundleId, p as BundleIdCapability, v as BundleIdsResource, E as CapabilitiesResource, s as CapabilityOption, r as CapabilitySetting, q as CapabilitySettingInput, C as Certificate, t as CertificatesResource, D as Device, w as DevicesResource, i as JsonApiError, h as JsonApiListResponse, J as JsonApiResource, g as JsonApiResponse, L as ListParams, o as PreReleaseVersion, P as Profile, u as ProfilesResource, c as RateLimitError, R as RequestClient, f as RequestOptions, O as ReviewSubmission, N as ReviewSubmissionsResource, e as TokenConfig, T as TokenManager, U as UploadOperation } from './index-BKUapQP2.cjs';
-export { A as AppStoreVersionState, i as BetaReviewState, h as BuildProcessingState, B as BundleIdPlatform, f as CapabilityOptionKey, e as CapabilitySettingsKey, d as CapabilityType, C as CertificateType, g as ContentRightsDeclaration, D as DeviceClass, c as DeviceStatus, E as ExportMethod, b as Platform, a as ProfileState, P as ProfileType, R as ReleaseType } from './enums-B609j2rb.cjs';
-export { i as cert } from './index-CNHf7I4v.cjs';
-export { i as sigh } from './index-BZWmOTWE.cjs';
-export { i as match } from './index-oVyLLIEK.cjs';
-export { i as produce } from './index-OelCoOth.cjs';
-export { i as pilot } from './index-BICa8odo.cjs';
-export { i as deliver } from './index-B9QeTpQK.cjs';
-export { i as pem } from './index-Bk1Gd-qE.cjs';
-export { i as gym } from './index-DrUpRXRG.cjs';
+import { A as AppStoreConnectClient } from './index-CpGV1f0L.cjs';
+export { i as App, Q as AppAssetLibrariesResource, S as AppAssetLibrary, Z as AppAssetLibraryDimensions, a0 as AppAssetLibraryImage, X as AppAssetLibraryImageSpec, _ as AppAssetLibraryImagesResource, a5 as AppAssetLibraryPlacement, a4 as AppAssetLibraryPlacementsResource, V as AppAssetLibraryRefDatum, W as AppAssetLibraryRefDatumAttributes, a1 as AppAssetLibraryVideo, Y as AppAssetLibraryVideoSpec, $ as AppAssetLibraryVideosResource, I as AppScreenshot, K as AppScreenshotSet, H as AppScreenshotsResource, c as AppStoreConnectConfig, a as AppStoreConnectError, F as AppStoreVersion, G as AppStoreVersionLocalization, O as AppStoreVersionSubmission, E as AppStoreVersionsResource, w as AppsResource, l as BetaBuildLocalization, k as BetaGroup, y as BetaGroupsResource, j as Build, m as BuildBetaDetail, x as BuildsResource, B as BundleId, o as BundleIdCapability, u as BundleIdsResource, z as CapabilitiesResource, r as CapabilityOption, q as CapabilitySetting, p as CapabilitySettingInput, C as Certificate, s as CertificatesResource, a2 as CreateAssetParams, D as Device, v as DevicesResource, h as JsonApiError, g as JsonApiListResponse, J as JsonApiResource, f as JsonApiResponse, L as ListParams, a6 as PlacementTarget, a7 as PlacementTargetKind, n as PreReleaseVersion, P as Profile, t as ProfilesResource, b as RateLimitError, R as RequestClient, e as RequestOptions, N as ReviewSubmission, M as ReviewSubmissionsResource, d as TokenConfig, T as TokenManager, a3 as UpdateAssetAttributes, U as UploadOperation } from './index-CpGV1f0L.cjs';
+export { j as AppAssetLibraryAssetCategory, m as AppAssetLibraryAssetState, o as AppAssetLibraryFeature, k as AppAssetLibraryMediaType, p as AppAssetLibraryPlacementPlatform, n as AppAssetLibraryPlacementState, l as AppAssetLibraryPlacementType, A as AppStoreVersionState, i as BetaReviewState, h as BuildProcessingState, B as BundleIdPlatform, f as CapabilityOptionKey, e as CapabilitySettingsKey, d as CapabilityType, C as CertificateType, g as ContentRightsDeclaration, D as DeviceClass, c as DeviceStatus, E as ExportMethod, b as Platform, a as ProfileState, P as ProfileType, R as ReleaseType } from './enums-yXNVh3UI.cjs';
+export { C as CertExpiryInfo, i as cert, p as parseCertificateExpiry } from './index-_24DRp3a.cjs';
+export { i as sigh } from './index-isT08RuY.cjs';
+export { i as match } from './index-O3EMrd5s.cjs';
+export { i as produce } from './index-BbVQzSV1.cjs';
+export { i as pilot } from './index-CmcFPn_G.cjs';
+export { i as deliver } from './index-BhGaVlK1.cjs';
+export { i as pem } from './index-925_Ov7X.cjs';
+export { i as gym } from './index-B6-MJpO4.cjs';
+export { i as gradle } from './index-Dv-Mek07.cjs';
+export { i as playstore } from './index-CXJlvmB4.cjs';
 export { i as scan } from './index-BimqCmY8.cjs';
 export { i as snapshot } from './index-CR3BFPIz.cjs';
 export { i as trainer } from './index-BoU8qt8r.cjs';
-export { i as precheck } from './index-D13sn8DO.cjs';
+export { i as precheck } from './index-on573dnO.cjs';
+export { i as privacy } from './index-DnHQ2uT2.cjs';
+export { i as review } from './index-DFstwgGK.cjs';
 export { i as frameit } from './index-BYonklf3.cjs';
 export { i as xcode } from './index-Cp6cjtd-.cjs';
 export { i as core } from './index-C2yG3wXA.cjs';
 export { LaneCallback, LaneDefinition, RunLaneOptions, RunResult, afterAll, afterEach, beforeAll, beforeEach, generateFastfileTemplate, lane, listAvailableLanes, loadFastfile, privateLane, runLane } from './lane/index.cjs';
 export { L as LaneContext } from './context-CymLkfrS.cjs';
 export { ActionDefinition, action, ensureActionsRegistered, getAction, listActions, registerAction } from './actions/index.cjs';
+import { A as AppleSession } from './apple-session-jUzBrql5.cjs';
 export { createCli } from './cli/index.cjs';
-import './cert-FehieKeb.cjs';
+import './cert-DffLKURp.cjs';
 import 'commander';
 
 /**
@@ -136,6 +141,13 @@ interface OneClickOptions {
     enablePushNotifications?: boolean;
     /** Enable Apple Pay capability on the bundle ID. Default false. Required for Stripe. */
     enableApplePay?: boolean;
+    /**
+     * Enable the Associated Domains capability on the bundle ID (universal
+     * links, passkeys / webcredentials, app clips). Default false. The domain
+     * list itself ships in the app's entitlements — Apple only stores the
+     * on/off switch. Requires the ASC API key (same JWT-only path as Push).
+     */
+    enableAssociatedDomains?: boolean;
     /** Merchant ID to register for Apple Pay (e.g. "merchant.com.example.app"). Required when enableApplePay is true. */
     merchantId?: string;
     /**
@@ -159,6 +171,17 @@ interface OneClickInput {
     bundleIdentifier: string;
     appName: string;
     options?: OneClickOptions;
+    /**
+     * Reuse an existing shared distribution certificate instead of minting a new
+     * one (Apple caps a team at 3). The provisioning profile is still created —
+     * against this cert's portal id (resolved by serial when only the serial is
+     * known). When set, the result's dist_cert / private_key / cert_password come
+     * back empty because the secret lives on the shared signing account, not here.
+     */
+    reuseDistributionCert?: {
+        certificateId?: string;
+        certSerial?: string;
+    };
     /** Defaults to a random 32-char password. Override for deterministic tests. */
     certPassword?: string;
     /**
@@ -212,6 +235,19 @@ interface OneClickResult {
     dist_cert_base64: string;
     private_key_base64: string;
     cert_password: string;
+    /**
+     * Serial of the distribution certificate this run MINTED, and when it
+     * expires. Empty when the run reused a shared certificate rather than
+     * minting one.
+     *
+     * The serial is the only handle a later run can reuse a certificate by:
+     * reuse matches on serialNumber, while creation returns a certificateId,
+     * and the two are different identifiers. Without this the caller has a p12
+     * and no way to name what is inside it, so it stores a certificate nothing
+     * can ever reuse — and the next "use existing" mints another.
+     */
+    dist_cert_serial: string;
+    dist_cert_expires_at: string;
     provisioning_profile_base64: string;
     profile_name: string;
     asc_key_id: string;
@@ -256,6 +292,43 @@ interface PortalTeam {
  * API calls (and is not what the legacy portal endpoints want).
  */
 declare function oneClickListTeams(session: AppleSession): Promise<PortalTeam[]>;
+interface EnsureAppGroupInput {
+    session: AppleSession;
+    teamId: string;
+    /** The App Group identifier, e.g. `group.com.playspina.com`. */
+    groupIdentifier: string;
+    /** Human-readable name for the group. Defaults to the identifier. */
+    groupName?: string;
+    /**
+     * Bundle identifiers to associate the group with — typically the host
+     * app plus its extension(s), e.g. `["com.playspina.com",
+     * "com.playspina.com.MessagesExtension"]`. Each is resolved to its App ID
+     * (created if missing) before the group is enabled + associated.
+     */
+    bundleIdentifiers: string[];
+    onLog?: (msg: string) => void;
+}
+interface EnsureAppGroupResult {
+    /** Apple's internal handle for the group (used by profiles/association). */
+    appGroupId: string;
+    /** The `group.com.…` identifier. */
+    identifier: string;
+    /** Bundle identifiers successfully associated with the group. */
+    associated: string[];
+    /** Non-fatal issues (e.g. a capability toggle that Apple reported as already-on). */
+    warnings: string[];
+}
+/**
+ * Idempotently ensure an App Group exists and is associated with the given
+ * bundle identifiers, enabling the App Groups capability on each App ID
+ * first. This is the piece the `.p8` build pipeline cannot do — it requires
+ * the Apple ID session that onboarding already collects (see PortalClient's
+ * Application Groups section for why).
+ *
+ * Safe to re-run: the group is reused if it exists, capability-enable is
+ * best-effort (Apple no-ops when already on), and association is declarative.
+ */
+declare function ensureAppGroup(input: EnsureAppGroupInput): Promise<EnsureAppGroupResult>;
 /**
  * Read the team's current state: bundle IDs, distribution cert capacity,
  * push certs, profiles. Used by the wizard to render the configure screen
@@ -269,4 +342,154 @@ declare function oneClickInventory(session: AppleSession, teamId: string): Promi
  */
 declare function oneClickSetup(input: OneClickInput): Promise<OneClickResult>;
 
-export { type AdditionalCertResult, type OneClickInput, type OneClickInventory, type OneClickOptions, type OneClickResult, type PortalTeam, type ProgressEvent, oneClickInventory, oneClickListTeams, oneClickSetup };
+/**
+ * Apple Pay Payment Processing Certificate generation.
+ *
+ * The one manual Apple-portal step in wiring up in-app Apple Pay with a PSP
+ * (e.g. Stripe): the PSP hands you a CSR, which must be uploaded to the
+ * Merchant ID in Apple Developer to mint a Payment Processing Certificate, then
+ * the resulting `.cer` downloaded and given back to the PSP so it can decrypt
+ * payment tokens. This automates the Apple side end to end from the CSR.
+ *
+ * Merchant certs are created through the legacy session-cookie portal API
+ * (same as the merchant IDs themselves). Endpoint shapes are pinned in
+ * PortalClient (createApplePayCertificate / downloadApplePayCertificate),
+ * ported 1:1 from Spaceship.
+ */
+
+interface ApplePayCertInput {
+    session: AppleSession;
+    /** The team the merchant ID lives on (the credential's team). */
+    teamId: string;
+    /** The merchant identifier (`merchant.…`) to mint the certificate on. */
+    merchantIdentifier: string;
+    /** PEM CSR string — the "Apple Pay CSR" the PSP (Stripe) gives you. */
+    csr: string;
+    onLog?: (m: string) => void;
+}
+interface ApplePayCertResult {
+    merchantIdentifier: string;
+    /** Apple's internal merchant id the cert was minted on. */
+    omcId: string;
+    /** Apple's certificate id (for later download / revoke). */
+    certificateId: string;
+    /** The DER `.cer` bytes, base64-encoded — upload this back to the PSP. */
+    certificateBase64: string;
+}
+/**
+ * Upload a CSR to a Merchant ID and return the minted Apple Pay Payment
+ * Processing Certificate. Idempotent-ish: Apple allows a small number of live
+ * certs per merchant; if you re-run with a new CSR it mints another.
+ *
+ * Throws a clear error if the merchant identifier doesn't exist on the team
+ * (the caller should add the Apple Pay capability first, which registers it).
+ */
+declare function generateApplePayCertificate(input: ApplePayCertInput): Promise<ApplePayCertResult>;
+
+/**
+ * Capability action registry — the individually-callable building blocks
+ * behind Apple credential provisioning.
+ *
+ * `oneClickSetup` composes these in sequence for first-time setup, but each
+ * action is also standalone and idempotent, so a "select → type → go" UI can
+ * add ONE capability (an app extension, an App Group, an APNs key, an extra
+ * cert) to an already-provisioned credential without re-running the whole
+ * flow — as long as it has a live Apple session (re-auth on demand when the
+ * server-side session has expired).
+ *
+ * Actions return portable `ProvisionArtifact`s (raw Apple bytes + ids). The
+ * API layer is responsible for persisting them (Vault + apple_credential_certs
+ * / credential patches) — this module stays free of any DB coupling.
+ */
+
+interface ActionContext {
+    session: AppleSession;
+    teamId: string;
+    /** The primary app bundle id the credential is for (host app). */
+    bundleIdentifier: string;
+    /** Human-readable app name, used for cert/profile friendly names. */
+    appName: string;
+    /** Password to encrypt any generated .p12. Random if omitted. */
+    certPassword?: string;
+    /**
+     * Token-authenticated ASC REST client, when the credential has an ASC API
+     * key. Some capabilities (Associated Domains, Push, SIWA) can only be
+     * flipped via the ASC REST API — Apple removed their legacy portal
+     * endpoints — so actions that need it throw a clear error when absent.
+     */
+    ascClient?: AppStoreConnectClient;
+    onLog?: (m: string) => void;
+}
+type ArtifactKind = "apns_key" | "aps_production" | "aps_sandbox" | "distribution_cert" | "provisioning_profile" | "app_group" | "extension";
+/**
+ * A portable provisioning result. `base64` holds the primary blob
+ * (.p8 / .p12), `secret` the secondary secret (a .p12 password, or an APNs
+ * Key ID), and `ids`/`meta` any Apple-side identifiers the caller may want
+ * to persist. The API layer maps each kind to its storage:
+ *   apns_key / aps_* → apple_credential_certs
+ *   distribution_cert → credential patch (dist/private-key/password secrets)
+ *   app_group / extension → metadata / entitlements
+ */
+interface ProvisionArtifact {
+    kind: ArtifactKind;
+    base64?: string;
+    secret?: string;
+    name?: string;
+    ids?: Record<string, string>;
+    meta?: Record<string, unknown>;
+}
+interface ActionResult {
+    artifacts: ProvisionArtifact[];
+    warnings: string[];
+    /** One-line human summary for the UI. */
+    summary: string;
+}
+interface ActionField {
+    key: string;
+    label: string;
+    type: "text" | "bundleId" | "select" | "boolean";
+    required?: boolean;
+    placeholder?: string;
+    help?: string;
+    options?: {
+        value: string;
+        label: string;
+    }[];
+    /** Default value the UI pre-fills. */
+    default?: string | boolean;
+    /**
+     * When set, the UI offers the team's existing values (fetched via
+     * listCapabilityInventory) as a pick-from-list-or-type-new combobox instead
+     * of a bare text input. `bundleIds` → existing App IDs; `appGroups` →
+     * existing App Groups.
+     */
+    source?: "bundleIds" | "appGroups";
+}
+interface CapabilityAction {
+    key: string;
+    label: string;
+    description: string;
+    fields: ActionField[];
+    run(ctx: ActionContext, params: Record<string, any>): Promise<ActionResult>;
+}
+declare const CAPABILITY_ACTIONS: Record<string, CapabilityAction>;
+/** Serializable descriptors (no `run`) for a UI to render the action picker + forms. */
+declare function listCapabilityActions(): Array<Omit<CapabilityAction, "run">>;
+interface CapabilityInventory {
+    /** Existing App ID identifiers in the team, sorted. */
+    bundleIds: string[];
+    /** Existing App Groups in the team. */
+    appGroups: {
+        identifier: string;
+        name: string;
+    }[];
+}
+/**
+ * List the team's existing App IDs + App Groups, for the UI to offer as
+ * pick-from-existing options in fields tagged with a `source`. Read-only.
+ */
+declare function listCapabilityInventory(session: AppleSession, teamId: string): Promise<CapabilityInventory>;
+/** Run a single capability action by key. Throws on unknown key. */
+declare function runCapabilityAction(key: string, ctx: ActionContext, params: Record<string, any>): Promise<ActionResult>;
+
+export { type ActionContext, type ActionField, type ActionResult, type AdditionalCertResult, AppStoreConnectClient, type ApplePayCertInput, type ApplePayCertResult, type ArtifactKind, CAPABILITY_ACTIONS, type CapabilityAction, type CapabilityInventory, type EnsureAppGroupInput, type EnsureAppGroupResult, type OneClickInput, type OneClickInventory, type OneClickOptions, type OneClickResult, type PortalTeam, type ProgressEvent, type ProvisionArtifact, ensureAppGroup, generateApplePayCertificate, listCapabilityActions, listCapabilityInventory, oneClickInventory, oneClickListTeams, oneClickSetup, runCapabilityAction };

package/dist/index.d.ts

@@ -1,26 +1,31 @@
-import { A as AppleSession } from './index-CCtYhPN9.js';
-export { j as App, K as AppScreenshot, M as AppScreenshotSet, I as AppScreenshotsResource, a as AppStoreConnectClient, d as AppStoreConnectConfig, b as AppStoreConnectError, G as AppStoreVersion, H as AppStoreVersionLocalization, Q as AppStoreVersionSubmission, F as AppStoreVersionsResource, x as AppsResource, m as BetaBuildLocalization, l as BetaGroup, z as BetaGroupsResource, k as Build, n as BuildBetaDetail, y as BuildsResource, B as BundleId, p as BundleIdCapability, v as BundleIdsResource, E as CapabilitiesResource, s as CapabilityOption, r as CapabilitySetting, q as CapabilitySettingInput, C as Certificate, t as CertificatesResource, D as Device, w as DevicesResource, i as JsonApiError, h as JsonApiListResponse, J as JsonApiResource, g as JsonApiResponse, L as ListParams, o as PreReleaseVersion, P as Profile, u as ProfilesResource, c as RateLimitError, R as RequestClient, f as RequestOptions, O as ReviewSubmission, N as ReviewSubmissionsResource, e as TokenConfig, T as TokenManager, U as UploadOperation } from './index-CCtYhPN9.js';
-export { A as AppStoreVersionState, i as BetaReviewState, h as BuildProcessingState, B as BundleIdPlatform, f as CapabilityOptionKey, e as CapabilitySettingsKey, d as CapabilityType, C as CertificateType, g as ContentRightsDeclaration, D as DeviceClass, c as DeviceStatus, E as ExportMethod, b as Platform, a as ProfileState, P as ProfileType, R as ReleaseType } from './enums-B609j2rb.js';
-export { i as cert } from './index-CplRWSUc.js';
-export { i as sigh } from './index-B8FOfxOw.js';
-export { i as match } from './index-DZoPGCbE.js';
-export { i as produce } from './index-CtPyeMLH.js';
-export { i as pilot } from './index-DI1ZHr-3.js';
-export { i as deliver } from './index-xykpq6Lz.js';
-export { i as pem } from './index-DFni8oZt.js';
-export { i as gym } from './index-DImN9PWc.js';
+import { A as AppStoreConnectClient } from './index-CemR3UI9.js';
+export { i as App, Q as AppAssetLibrariesResource, S as AppAssetLibrary, Z as AppAssetLibraryDimensions, a0 as AppAssetLibraryImage, X as AppAssetLibraryImageSpec, _ as AppAssetLibraryImagesResource, a5 as AppAssetLibraryPlacement, a4 as AppAssetLibraryPlacementsResource, V as AppAssetLibraryRefDatum, W as AppAssetLibraryRefDatumAttributes, a1 as AppAssetLibraryVideo, Y as AppAssetLibraryVideoSpec, $ as AppAssetLibraryVideosResource, I as AppScreenshot, K as AppScreenshotSet, H as AppScreenshotsResource, c as AppStoreConnectConfig, a as AppStoreConnectError, F as AppStoreVersion, G as AppStoreVersionLocalization, O as AppStoreVersionSubmission, E as AppStoreVersionsResource, w as AppsResource, l as BetaBuildLocalization, k as BetaGroup, y as BetaGroupsResource, j as Build, m as BuildBetaDetail, x as BuildsResource, B as BundleId, o as BundleIdCapability, u as BundleIdsResource, z as CapabilitiesResource, r as CapabilityOption, q as CapabilitySetting, p as CapabilitySettingInput, C as Certificate, s as CertificatesResource, a2 as CreateAssetParams, D as Device, v as DevicesResource, h as JsonApiError, g as JsonApiListResponse, J as JsonApiResource, f as JsonApiResponse, L as ListParams, a6 as PlacementTarget, a7 as PlacementTargetKind, n as PreReleaseVersion, P as Profile, t as ProfilesResource, b as RateLimitError, R as RequestClient, e as RequestOptions, N as ReviewSubmission, M as ReviewSubmissionsResource, d as TokenConfig, T as TokenManager, a3 as UpdateAssetAttributes, U as UploadOperation } from './index-CemR3UI9.js';
+export { j as AppAssetLibraryAssetCategory, m as AppAssetLibraryAssetState, o as AppAssetLibraryFeature, k as AppAssetLibraryMediaType, p as AppAssetLibraryPlacementPlatform, n as AppAssetLibraryPlacementState, l as AppAssetLibraryPlacementType, A as AppStoreVersionState, i as BetaReviewState, h as BuildProcessingState, B as BundleIdPlatform, f as CapabilityOptionKey, e as CapabilitySettingsKey, d as CapabilityType, C as CertificateType, g as ContentRightsDeclaration, D as DeviceClass, c as DeviceStatus, E as ExportMethod, b as Platform, a as ProfileState, P as ProfileType, R as ReleaseType } from './enums-yXNVh3UI.js';
+export { C as CertExpiryInfo, i as cert, p as parseCertificateExpiry } from './index-C18cijCd.js';
+export { i as sigh } from './index-D9YQQ3FM.js';
+export { i as match } from './index-Ol0RtbQA.js';
+export { i as produce } from './index-C-EEYXSE.js';
+export { i as pilot } from './index-N6eV5yym.js';
+export { i as deliver } from './index-s2PigtDM.js';
+export { i as pem } from './index-CBM5XZKC.js';
+export { i as gym } from './index-mEEB7An6.js';
+export { i as gradle } from './index-Dv-Mek07.js';
+export { i as playstore } from './index-CXJlvmB4.js';
 export { i as scan } from './index-BimqCmY8.js';
 export { i as snapshot } from './index-CR3BFPIz.js';
 export { i as trainer } from './index-BoU8qt8r.js';
-export { i as precheck } from './index-YcKz4aRS.js';
+export { i as precheck } from './index-Dkf5sH1E.js';
+export { i as privacy } from './index-8djTPW8O.js';
+export { i as review } from './index-BGhV0gS-.js';
 export { i as frameit } from './index-BYonklf3.js';
 export { i as xcode } from './index-Cp6cjtd-.js';
 export { i as core } from './index-C2yG3wXA.js';
 export { LaneCallback, LaneDefinition, RunLaneOptions, RunResult, afterAll, afterEach, beforeAll, beforeEach, generateFastfileTemplate, lane, listAvailableLanes, loadFastfile, privateLane, runLane } from './lane/index.js';
 export { L as LaneContext } from './context-CymLkfrS.js';
 export { ActionDefinition, action, ensureActionsRegistered, getAction, listActions, registerAction } from './actions/index.js';
+import { A as AppleSession } from './apple-session-jUzBrql5.js';
 export { createCli } from './cli/index.js';
-import './cert-Ddl7FpFT.js';
+import './cert-ClacRx9y.js';
 import 'commander';
 
 /**
@@ -136,6 +141,13 @@ interface OneClickOptions {
     enablePushNotifications?: boolean;
     /** Enable Apple Pay capability on the bundle ID. Default false. Required for Stripe. */
     enableApplePay?: boolean;
+    /**
+     * Enable the Associated Domains capability on the bundle ID (universal
+     * links, passkeys / webcredentials, app clips). Default false. The domain
+     * list itself ships in the app's entitlements — Apple only stores the
+     * on/off switch. Requires the ASC API key (same JWT-only path as Push).
+     */
+    enableAssociatedDomains?: boolean;
     /** Merchant ID to register for Apple Pay (e.g. "merchant.com.example.app"). Required when enableApplePay is true. */
     merchantId?: string;
     /**
@@ -159,6 +171,17 @@ interface OneClickInput {
     bundleIdentifier: string;
     appName: string;
     options?: OneClickOptions;
+    /**
+     * Reuse an existing shared distribution certificate instead of minting a new
+     * one (Apple caps a team at 3). The provisioning profile is still created —
+     * against this cert's portal id (resolved by serial when only the serial is
+     * known). When set, the result's dist_cert / private_key / cert_password come
+     * back empty because the secret lives on the shared signing account, not here.
+     */
+    reuseDistributionCert?: {
+        certificateId?: string;
+        certSerial?: string;
+    };
     /** Defaults to a random 32-char password. Override for deterministic tests. */
     certPassword?: string;
     /**
@@ -212,6 +235,19 @@ interface OneClickResult {
     dist_cert_base64: string;
     private_key_base64: string;
     cert_password: string;
+    /**
+     * Serial of the distribution certificate this run MINTED, and when it
+     * expires. Empty when the run reused a shared certificate rather than
+     * minting one.
+     *
+     * The serial is the only handle a later run can reuse a certificate by:
+     * reuse matches on serialNumber, while creation returns a certificateId,
+     * and the two are different identifiers. Without this the caller has a p12
+     * and no way to name what is inside it, so it stores a certificate nothing
+     * can ever reuse — and the next "use existing" mints another.
+     */
+    dist_cert_serial: string;
+    dist_cert_expires_at: string;
     provisioning_profile_base64: string;
     profile_name: string;
     asc_key_id: string;
@@ -256,6 +292,43 @@ interface PortalTeam {
  * API calls (and is not what the legacy portal endpoints want).
  */
 declare function oneClickListTeams(session: AppleSession): Promise<PortalTeam[]>;
+interface EnsureAppGroupInput {
+    session: AppleSession;
+    teamId: string;
+    /** The App Group identifier, e.g. `group.com.playspina.com`. */
+    groupIdentifier: string;
+    /** Human-readable name for the group. Defaults to the identifier. */
+    groupName?: string;
+    /**
+     * Bundle identifiers to associate the group with — typically the host
+     * app plus its extension(s), e.g. `["com.playspina.com",
+     * "com.playspina.com.MessagesExtension"]`. Each is resolved to its App ID
+     * (created if missing) before the group is enabled + associated.
+     */
+    bundleIdentifiers: string[];
+    onLog?: (msg: string) => void;
+}
+interface EnsureAppGroupResult {
+    /** Apple's internal handle for the group (used by profiles/association). */
+    appGroupId: string;
+    /** The `group.com.…` identifier. */
+    identifier: string;
+    /** Bundle identifiers successfully associated with the group. */
+    associated: string[];
+    /** Non-fatal issues (e.g. a capability toggle that Apple reported as already-on). */
+    warnings: string[];
+}
+/**
+ * Idempotently ensure an App Group exists and is associated with the given
+ * bundle identifiers, enabling the App Groups capability on each App ID
+ * first. This is the piece the `.p8` build pipeline cannot do — it requires
+ * the Apple ID session that onboarding already collects (see PortalClient's
+ * Application Groups section for why).
+ *
+ * Safe to re-run: the group is reused if it exists, capability-enable is
+ * best-effort (Apple no-ops when already on), and association is declarative.
+ */
+declare function ensureAppGroup(input: EnsureAppGroupInput): Promise<EnsureAppGroupResult>;
 /**
  * Read the team's current state: bundle IDs, distribution cert capacity,
  * push certs, profiles. Used by the wizard to render the configure screen
@@ -269,4 +342,154 @@ declare function oneClickInventory(session: AppleSession, teamId: string): Promi
  */
 declare function oneClickSetup(input: OneClickInput): Promise<OneClickResult>;
 
-export { type AdditionalCertResult, type OneClickInput, type OneClickInventory, type OneClickOptions, type OneClickResult, type PortalTeam, type ProgressEvent, oneClickInventory, oneClickListTeams, oneClickSetup };
+/**
+ * Apple Pay Payment Processing Certificate generation.
+ *
+ * The one manual Apple-portal step in wiring up in-app Apple Pay with a PSP
+ * (e.g. Stripe): the PSP hands you a CSR, which must be uploaded to the
+ * Merchant ID in Apple Developer to mint a Payment Processing Certificate, then
+ * the resulting `.cer` downloaded and given back to the PSP so it can decrypt
+ * payment tokens. This automates the Apple side end to end from the CSR.
+ *
+ * Merchant certs are created through the legacy session-cookie portal API
+ * (same as the merchant IDs themselves). Endpoint shapes are pinned in
+ * PortalClient (createApplePayCertificate / downloadApplePayCertificate),
+ * ported 1:1 from Spaceship.
+ */
+
+interface ApplePayCertInput {
+    session: AppleSession;
+    /** The team the merchant ID lives on (the credential's team). */
+    teamId: string;
+    /** The merchant identifier (`merchant.…`) to mint the certificate on. */
+    merchantIdentifier: string;
+    /** PEM CSR string — the "Apple Pay CSR" the PSP (Stripe) gives you. */
+    csr: string;
+    onLog?: (m: string) => void;
+}
+interface ApplePayCertResult {
+    merchantIdentifier: string;
+    /** Apple's internal merchant id the cert was minted on. */
+    omcId: string;
+    /** Apple's certificate id (for later download / revoke). */
+    certificateId: string;
+    /** The DER `.cer` bytes, base64-encoded — upload this back to the PSP. */
+    certificateBase64: string;
+}
+/**
+ * Upload a CSR to a Merchant ID and return the minted Apple Pay Payment
+ * Processing Certificate. Idempotent-ish: Apple allows a small number of live
+ * certs per merchant; if you re-run with a new CSR it mints another.
+ *
+ * Throws a clear error if the merchant identifier doesn't exist on the team
+ * (the caller should add the Apple Pay capability first, which registers it).
+ */
+declare function generateApplePayCertificate(input: ApplePayCertInput): Promise<ApplePayCertResult>;
+
+/**
+ * Capability action registry — the individually-callable building blocks
+ * behind Apple credential provisioning.
+ *
+ * `oneClickSetup` composes these in sequence for first-time setup, but each
+ * action is also standalone and idempotent, so a "select → type → go" UI can
+ * add ONE capability (an app extension, an App Group, an APNs key, an extra
+ * cert) to an already-provisioned credential without re-running the whole
+ * flow — as long as it has a live Apple session (re-auth on demand when the
+ * server-side session has expired).
+ *
+ * Actions return portable `ProvisionArtifact`s (raw Apple bytes + ids). The
+ * API layer is responsible for persisting them (Vault + apple_credential_certs
+ * / credential patches) — this module stays free of any DB coupling.
+ */
+
+interface ActionContext {
+    session: AppleSession;
+    teamId: string;
+    /** The primary app bundle id the credential is for (host app). */
+    bundleIdentifier: string;
+    /** Human-readable app name, used for cert/profile friendly names. */
+    appName: string;
+    /** Password to encrypt any generated .p12. Random if omitted. */
+    certPassword?: string;
+    /**
+     * Token-authenticated ASC REST client, when the credential has an ASC API
+     * key. Some capabilities (Associated Domains, Push, SIWA) can only be
+     * flipped via the ASC REST API — Apple removed their legacy portal
+     * endpoints — so actions that need it throw a clear error when absent.
+     */
+    ascClient?: AppStoreConnectClient;
+    onLog?: (m: string) => void;
+}
+type ArtifactKind = "apns_key" | "aps_production" | "aps_sandbox" | "distribution_cert" | "provisioning_profile" | "app_group" | "extension";
+/**
+ * A portable provisioning result. `base64` holds the primary blob
+ * (.p8 / .p12), `secret` the secondary secret (a .p12 password, or an APNs
+ * Key ID), and `ids`/`meta` any Apple-side identifiers the caller may want
+ * to persist. The API layer maps each kind to its storage:
+ *   apns_key / aps_* → apple_credential_certs
+ *   distribution_cert → credential patch (dist/private-key/password secrets)
+ *   app_group / extension → metadata / entitlements
+ */
+interface ProvisionArtifact {
+    kind: ArtifactKind;
+    base64?: string;
+    secret?: string;
+    name?: string;
+    ids?: Record<string, string>;
+    meta?: Record<string, unknown>;
+}
+interface ActionResult {
+    artifacts: ProvisionArtifact[];
+    warnings: string[];
+    /** One-line human summary for the UI. */
+    summary: string;
+}
+interface ActionField {
+    key: string;
+    label: string;
+    type: "text" | "bundleId" | "select" | "boolean";
+    required?: boolean;
+    placeholder?: string;
+    help?: string;
+    options?: {
+        value: string;
+        label: string;
+    }[];
+    /** Default value the UI pre-fills. */
+    default?: string | boolean;
+    /**
+     * When set, the UI offers the team's existing values (fetched via
+     * listCapabilityInventory) as a pick-from-list-or-type-new combobox instead
+     * of a bare text input. `bundleIds` → existing App IDs; `appGroups` →
+     * existing App Groups.
+     */
+    source?: "bundleIds" | "appGroups";
+}
+interface CapabilityAction {
+    key: string;
+    label: string;
+    description: string;
+    fields: ActionField[];
+    run(ctx: ActionContext, params: Record<string, any>): Promise<ActionResult>;
+}
+declare const CAPABILITY_ACTIONS: Record<string, CapabilityAction>;
+/** Serializable descriptors (no `run`) for a UI to render the action picker + forms. */
+declare function listCapabilityActions(): Array<Omit<CapabilityAction, "run">>;
+interface CapabilityInventory {
+    /** Existing App ID identifiers in the team, sorted. */
+    bundleIds: string[];
+    /** Existing App Groups in the team. */
+    appGroups: {
+        identifier: string;
+        name: string;
+    }[];
+}
+/**
+ * List the team's existing App IDs + App Groups, for the UI to offer as
+ * pick-from-existing options in fields tagged with a `source`. Read-only.
+ */
+declare function listCapabilityInventory(session: AppleSession, teamId: string): Promise<CapabilityInventory>;
+/** Run a single capability action by key. Throws on unknown key. */
+declare function runCapabilityAction(key: string, ctx: ActionContext, params: Record<string, any>): Promise<ActionResult>;
+
+export { type ActionContext, type ActionField, type ActionResult, type AdditionalCertResult, AppStoreConnectClient, type ApplePayCertInput, type ApplePayCertResult, type ArtifactKind, CAPABILITY_ACTIONS, type CapabilityAction, type CapabilityInventory, type EnsureAppGroupInput, type EnsureAppGroupResult, type OneClickInput, type OneClickInventory, type OneClickOptions, type OneClickResult, type PortalTeam, type ProgressEvent, type ProvisionArtifact, ensureAppGroup, generateApplePayCertificate, listCapabilityActions, listCapabilityInventory, oneClickInventory, oneClickListTeams, oneClickSetup, runCapabilityAction };