Operations shared by the ascapi command line and its MCP server.
Both surfaces need the same things: resolve credentials, call the App
Store Connect client, and shape the result into something worth showing
a human or handing a model. Putting that here means the two front ends
cannot drift, and in particular that the ordering guarantee in
[certificates::issue_certificate] (private key written before the
network call) has exactly one implementation.
Two rules the result types are built around, because one of the consumers is a language model:
- No key material in a result. [
certificates::IssuedCertificate] carries the path a key was written to, never the key. Enforced by construction rather than filtered at the edge, since a filter is one refactor away from being bypassed. - No certificate bodies either. They are large, never needed to
decide what to do next, and would otherwise land in a transcript.
[
profiles::ProfileSummary] applies the same rule toprofileContent, and [profiles::download_profile] returns the path it wrote instead.