rorkai/App-Store-Connect-CLI

Summary Add --max-devices N to asc devices register --via-url so one shared registration URL or QR code can't register an unbounded number of devices, and verify the full flow on a real iPhone. Motivation #2770 made each callback token single-use and bound to one device, but kept the registration URL reusable for the whole session so one QR code can collect several testers. Anyone who obtains the URL during --ttl can therefore register additional devices against the team's device quota (100 per device family per membership year). A cap is the natural bound, and the flow has never been exercised on real hardware. Current behavior (verified on origin/main 3f1a758) internal/cli/devices/devices_via_url.go: each downloaded profile carries a random 128-bit callback token; unused tokens are capped at 1024 per session (profile downloads past that get 503). --ttl bounds the session (waitCtx via context.WithTimeout). There is no limit on registered devices per session. --stream prints one JSON

Summary 47 of 170 installs hit 409 on asc pricing schedule create (5.x, 14 days), and #2606 showed the rate is independent of --start-date. POST /v1/appPriceSchedules is the only write verb (no PATCH/DELETE) and replaces the app's single schedule, so it is not an existence conflict and --if-exists does not map. What to do Capture Apple's real 409 body for this endpoint (the disposable app 6759231657 is authorized for live mutations of this kind if needed; record what was run), then map the code/detail to a specific, actionable error message (e.g. a schedule change already pending, base territory mismatch, price point not available in a territory) and classify it correctly for telemetry. Acceptance criteria the real 409 body checked in as a fixture specific message per identified cause; other 409s unchanged

Summary --profile selects the API-key profile but is only bound on some commands. Telemetry (5.x, 14 days): 86 distinct installs passed --profile to 75 commands that do not define it (apps list 31, auth status 18, …) and got unknown-flag errors. Proposed fix Bind --profile at the root FlagSet (as --output/--api-debug are) so it is accepted before or after the subcommand on every command, with the same semantics as today's per-command flag; remove the per-command duplicates if they become redundant. Note the @env:/@file: indirection PR (#2585) excludes root-owned --profile; keep that exclusion. Acceptance criteria asc apps list --profile X and asc --profile X apps list both resolve the profile existing per-command --profile behavior unchanged; help regenerated

Summary asc screenshots list missing_required on --locale: 92 distinct installs (5.x, 14 days). Agents frequently do not know the locale set before listing. Proposed fix Either default --locale to the version's primary locale (printing the choice on stderr), or, when omitted, list screenshots across all localizations of the selected version with a locale column/field. Prefer the second if the output shape can stay additive; otherwise the first. In the error path, list the locales that exist for the version. Acceptance criteria cmdtest for omitted --locale behavior and for the enumerated error when the version has no localizations JSON contract remains additive

Summary asc pricing schedule create is the top missing_required hotspot after the ones already fixed: 99 distinct installs (5.x, 14 days) omitted --start-date, and 46 hit 409 conflicts afterwards. Proposed fix Default --start-date to today's date (UTC, the format Apple expects) when omitted; print the chosen date on stderr. Keep explicit values authoritative; reject malformed dates with exit 2 and the expected format. Note in help that Apple requires the date to be today or later. Acceptance criteria cmdtest: omitted flag sends today's date and prints the note; explicit flag unchanged; malformed → exit 2 help/docs updated