@better-update/cli 0.47.2 → 0.47.3

package/dist/index.mjs

@@ -9,7 +9,7 @@ import path from "node:path";
 import process$1 from "node:process";
 import AppleUtils from "@expo/apple-utils";
 import { autocomplete, cancel, confirm, isCancel, multiselect, password, select, text } from "@clack/prompts";
-import { open, readFile, writeFile } from "node:fs/promises";
+import { mkdtemp, open, readFile, rm, writeFile } from "node:fs/promises";
 import { X509Certificate, createHash, createSign, createVerify, randomBytes, randomUUID } from "node:crypto";
 import { accessSync, chmodSync, constants, createReadStream, promises } from "node:fs";
 import { Entry } from "@napi-rs/keyring";
@@ -35,7 +35,7 @@ var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
 
 //#endregion
 //#region package.json
-var version = "0.47.2";
+var version = "0.47.3";
 
 //#endregion
 //#region src/lib/interactive-mode.ts
@@ -21543,9 +21543,16 @@ const ExecErrorSchema = Schema.Struct({
 	stdout: Schema.optional(Schema.String),
 	stderr: Schema.optional(Schema.String)
 });
-const runAltool = (args) => Effect.tryPromise({
+const runAltool = (args, extraEnv) => Effect.tryPromise({
 	try: async () => {
-		const { stdout, stderr } = await execFileAsync("xcrun", ["altool", ...args]);
+		const options = extraEnv ? {
+			encoding: "utf8",
+			env: {
+				...process.env,
+				...extraEnv
+			}
+		} : { encoding: "utf8" };
+		const { stdout, stderr } = await execFileAsync("xcrun", ["altool", ...args], options);
 		return {
 			exitCode: 0,
 			stdout,
@@ -21695,11 +21702,23 @@ const resolveAscUploadCredentials = (params) => Effect.gen(function* () {
 		p8Pem: creds.p8Pem
 	})), Effect.catchAll((error) => printHuman(`Could not prepare ASC API key ${credsKeyId} (${messageOf(error)}).`).pipe(Effect.as(null))));
 });
-/** `altool` reads the API key from `--apiKeyDir`; write the decrypted `.p8` there. */
-const writeP8ForAltool = (credentials) => Effect.gen(function* () {
-	const target = path.join(tmpdir(), `better-update-submit-AuthKey_${credentials.keyId}.p8`);
-	yield* Effect.promise(async () => writeFile(target, credentials.p8Pem, "utf8"));
-	return target;
+/**
+* `altool --apiKey <id>` searches for a file named *exactly* `AuthKey_<id>.p8` in
+* the standard `private_keys` dirs plus `$API_PRIVATE_KEYS_DIR`. Write the decrypted
+* `.p8` under that exact name into a fresh private temp dir and return the dir so the
+* caller can point `API_PRIVATE_KEYS_DIR` at it (and remove it afterward — it holds
+* the unencrypted signing key).
+*/
+const writeP8KeyDir = (credentials) => Effect.promise(async () => {
+	const dir = await mkdtemp(path.join(tmpdir(), "better-update-asc-"));
+	await writeFile(path.join(dir, `AuthKey_${credentials.keyId}.p8`), credentials.p8Pem, "utf8");
+	return dir;
+});
+const removeKeyDir = (dir) => Effect.promise(async () => {
+	await rm(dir, {
+		recursive: true,
+		force: true
+	});
 });
 const baseAltoolArgs = (ipaPath) => [
 	"--upload-app",
@@ -21724,15 +21743,12 @@ const buildAltoolArgs = (params) => Effect.gen(function* () {
 		code: "SUBMISSION_ASC_KEY_FETCH_FAILED",
 		message: "ASC API key is required for an asc-api-key upload but was not resolved."
 	});
-	const p8Path = yield* writeP8ForAltool(params.ascCredentials);
 	return [
 		...baseAltoolArgs(params.ipaPath),
 		"--apiKey",
 		params.ascCredentials.keyId,
 		"--apiIssuer",
-		params.ascCredentials.issuerId,
-		"--apiKeyDir",
-		path.dirname(p8Path)
+		params.ascCredentials.issuerId
 	];
 });
 const runIosSubmit = (inputs) => Effect.gen(function* () {
@@ -21758,7 +21774,7 @@ const runIosSubmit = (inputs) => Effect.gen(function* () {
 		ipaPath
 	});
 	yield* patchSubmissionStatus(inputs.api, inputs.submissionId, { status: "IN_PROGRESS" });
-	const result = yield* runAltool(altoolArgs);
+	const result = inputs.auth.kind === "asc-api-key" && ascCredentials !== null ? yield* Effect.acquireUseRelease(writeP8KeyDir(ascCredentials), (keyDir) => runAltool(altoolArgs, { API_PRIVATE_KEYS_DIR: keyDir }), (keyDir) => removeKeyDir(keyDir)) : yield* runAltool(altoolArgs);
 	if (result.exitCode !== 0) {
 		yield* patchSubmissionStatus(inputs.api, inputs.submissionId, {
 			status: "ERRORED",