@hot-updater/apple-helper 1.1.3 → 1.2.0-rc.0

package/dist/index.cjs

@@ -21,18 +21,452 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-let fs = require("fs");
-fs = __toESM(fs, 1);
-let path = require("path");
-path = __toESM(path, 1);
-let _hot_updater_cli_tools = require("@hot-updater/cli-tools");
-let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
-let execa = require("execa");
+let node_crypto = require("node:crypto");
+node_crypto = __toESM(node_crypto, 1);
+let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
+node_fs_promises = __toESM(node_fs_promises, 1);
+let node_net = require("node:net");
+node_net = __toESM(node_net, 1);
 let node_os = require("node:os");
 node_os = __toESM(node_os, 1);
 let node_path = require("node:path");
-let stream_promises = require("stream/promises");
+node_path = __toESM(node_path, 1);
+let _hot_updater_cli_tools = require("@hot-updater/cli-tools");
+let execa = require("execa");
+let fs = require("fs");
+fs = __toESM(fs, 1);
+let path = require("path");
+path = __toESM(path, 1);
+let child_process = require("child_process");
+let crypto = require("crypto");
+crypto = __toESM(crypto, 1);
+let os = require("os");
+os = __toESM(os, 1);
+//#region src/asc/ascCli.ts
+/**
+* The release of asc, the open-source App Store Connect CLI
+* (https://github.com/rorkai/App-Store-Connect-CLI, MIT), that signs in with
+* an Apple Account and issues App Store Connect API keys for Hot Updater. An
+* `asc` on PATH is used when it is at least this version.
+*/
+const ASC_CLI_VERSION = "5.16.1";
+/**
+* The SHA-256 of each macOS binary of the release, from its
+* asc_5.16.1_checksums.txt. Pinned here, so a download is trusted only when
+* it is the exact binary this version of Hot Updater was written against.
+*/
+const ASC_CLI_SHA256 = {
+	arm64: "85a848ef33fe3490adc4f0348af30b7bbf95209a258dac06c735318f62495707",
+	x64: "5a978732e0c2f2b673da601568c489dfaa232ae32c93dcfa63b95f0b892a2580"
+};
+const ASC_RELEASE_ASSET = {
+	arm64: `asc_${ASC_CLI_VERSION}_macOS_arm64`,
+	x64: `asc_${ASC_CLI_VERSION}_macOS_amd64`
+};
+const ASC_RELEASE_URL = `https://github.com/rorkai/App-Store-Connect-CLI/releases/download/${ASC_CLI_VERSION}`;
+const INSTALL_HINT = `Install asc ${ASC_CLI_VERSION} or later with \`brew install asc\` (https://github.com/rorkai/App-Store-Connect-CLI), then run the command again.`;
+/** asc could not be found, downloaded, or verified. */
+var AscCliUnavailableError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "AscCliUnavailableError";
+	}
+};
+const parseVersion = (output) => {
+	const match = /(\d+)\.(\d+)\.(\d+)/u.exec(output);
+	return match ? match.slice(1, 4).map(Number) : void 0;
+};
+const isAtLeast = (version, minimum) => {
+	for (let index = 0; index < minimum.length; index++) {
+		const part = version[index] ?? 0;
+		if (part !== minimum[index]) return part > minimum[index];
+	}
+	return true;
+};
+const sha256Of = (file) => new Promise((resolve, reject) => {
+	const hash = node_crypto.default.createHash("sha256");
+	(0, node_fs.createReadStream)(file).on("data", (chunk) => hash.update(chunk)).on("error", reject).on("end", () => resolve(hash.digest("hex")));
+});
+/** Where a downloaded asc is kept, per user, so every project shares it. */
+const defaultAscCacheDir = () => node_path.default.join(node_os.default.homedir(), "Library", "Caches", "hot-updater");
+/**
+* Finds asc: the `asc` on PATH when it is at least `ASC_CLI_VERSION`, else
+* the pinned release in `cacheDir`, downloaded from GitHub on first use and
+* verified against its pinned SHA-256 each time it is used. Only macOS has
+* one: TestFlight builds need Xcode.
+*/
+const findAscCli = async ({ cacheDir = defaultAscCacheDir(), fetch = globalThis.fetch, platform = process.platform, arch = process.arch, pathCommand = "asc" } = {}) => {
+	if (platform !== "darwin") throw new AscCliUnavailableError("Signing in with an Apple Account to issue an App Store Connect API key runs on macOS, where iOS builds run.");
+	const minimum = parseVersion(ASC_CLI_VERSION);
+	const onPath = await (0, execa.execa)(pathCommand, ["--version"], {
+		reject: false,
+		env: { ASC_TELEMETRY_DISABLED: "1" },
+		timeout: 15e3
+	}).catch(() => void 0);
+	const pathVersion = onPath?.exitCode === 0 ? parseVersion(onPath.stdout) : void 0;
+	if (pathVersion && isAtLeast(pathVersion, minimum)) return {
+		path: pathCommand,
+		version: pathVersion.join("."),
+		source: "path"
+	};
+	const asset = ASC_RELEASE_ASSET[arch];
+	const expected = ASC_CLI_SHA256[arch];
+	if (!asset || !expected) throw new AscCliUnavailableError(`asc publishes no macOS binary for ${arch}. ${INSTALL_HINT}`);
+	const binary = node_path.default.join(cacheDir, "asc", ASC_CLI_VERSION, asset);
+	if (await sha256Of(binary).catch(() => void 0) === expected) return {
+		path: binary,
+		version: ASC_CLI_VERSION,
+		source: "cache"
+	};
+	await node_fs_promises.default.mkdir(node_path.default.dirname(binary), { recursive: true });
+	const partial = `${binary}.${process.pid}.download`;
+	try {
+		let response;
+		try {
+			response = await fetch(`${ASC_RELEASE_URL}/${asset}`, { redirect: "follow" });
+		} catch (error) {
+			throw new AscCliUnavailableError(`Could not download asc ${ASC_CLI_VERSION} from GitHub (${error instanceof Error ? error.message : String(error)}). ${INSTALL_HINT}`, { cause: error });
+		}
+		if (!response.ok || !response.body) throw new AscCliUnavailableError(`Could not download asc ${ASC_CLI_VERSION} from GitHub (HTTP ${response.status}). ${INSTALL_HINT}`);
+		await node_fs_promises.default.writeFile(partial, Buffer.from(await response.arrayBuffer()), { mode: 448 });
+		const actual = await sha256Of(partial);
+		if (actual !== expected) throw new AscCliUnavailableError(`The downloaded asc ${ASC_CLI_VERSION} does not match its published SHA-256 (expected ${expected}, got ${actual}), so it was deleted and not run. ${INSTALL_HINT}`);
+		await node_fs_promises.default.chmod(partial, 493);
+		await node_fs_promises.default.rename(partial, binary);
+	} finally {
+		await node_fs_promises.default.rm(partial, { force: true });
+	}
+	return {
+		path: binary,
+		version: ASC_CLI_VERSION,
+		source: "download"
+	};
+};
+//#endregion
+//#region src/asc/ascCliKeyIssuer.ts
+/** An asc command failed; its message is asc's own, which it printed too. */
+var AscCommandError = class extends Error {
+	exitCode;
+	constructor(message, exitCode, options) {
+		super(message, options);
+		this.name = "AscCommandError";
+		this.exitCode = exitCode;
+	}
+};
+const TERMINATION_SIGNALS$2 = [
+	"SIGHUP",
+	"SIGINT",
+	"SIGTERM"
+];
+/**
+* A 0700 directory holding asc's whole state for one sign-in (its web
+* session, config, and the downloaded `.p8`), removed by `dispose`, on
+* `exit`, or on a termination signal, so nothing outlives the sign-in.
+*/
+const createWorkDirectory = async () => {
+	const root = await node_fs_promises.default.mkdtemp(node_path.default.join(node_os.default.tmpdir(), "hot-updater-asc-"));
+	await node_fs_promises.default.chmod(root, 448);
+	const remove = () => (0, node_fs.rmSync)(root, {
+		force: true,
+		recursive: true
+	});
+	const onSignal = (signal) => {
+		stop();
+		remove();
+		if (process.listenerCount(signal) === 0) process.kill(process.pid, signal);
+	};
+	const stop = () => {
+		process.off("exit", remove);
+		for (const signal of TERMINATION_SIGNALS$2) process.off(signal, onSignal);
+	};
+	process.on("exit", remove);
+	for (const signal of TERMINATION_SIGNALS$2) process.on(signal, onSignal);
+	for (const directory of [
+		"home",
+		"session",
+		"keys"
+	]) await node_fs_promises.default.mkdir(node_path.default.join(root, directory), { mode: 448 });
+	let disposal;
+	return {
+		root,
+		dispose: () => {
+			disposal ??= (async () => {
+				stop();
+				await node_fs_promises.default.rm(root, {
+					force: true,
+					recursive: true
+				});
+			})();
+			return disposal;
+		}
+	};
+};
+/**
+* asc's environment: the caller's, without any `ASC_*` variable (such as a
+* saved password, a 2FA code command, or another API key), and with every
+* file asc keeps (home, config, web session) in `root`. Passwords are never
+* stored, the keychain is bypassed, and telemetry is off.
+*/
+const ascEnvironment = (root, base = process.env) => {
+	const env = {};
+	for (const [name, value] of Object.entries(base)) if (!name.startsWith("ASC_") && name !== "DO_NOT_TRACK") env[name] = value;
+	return {
+		...env,
+		HOME: node_path.default.join(root, "home"),
+		XDG_CONFIG_HOME: node_path.default.join(root, "home", ".config"),
+		XDG_CACHE_HOME: node_path.default.join(root, "home", ".cache"),
+		ASC_CONFIG_PATH: node_path.default.join(root, "home", "config.json"),
+		ASC_WEB_SESSION_CACHE_DIR: node_path.default.join(root, "session"),
+		ASC_WEB_SESSION_CACHE_BACKEND: "file",
+		ASC_WEB_DONT_STORE_PASSWORD: "1",
+		ASC_BYPASS_KEYCHAIN: "1",
+		ASC_TELEMETRY_DISABLED: "1",
+		ASC_SPINNER_DISABLED: "1"
+	};
+};
+const answer = (value) => _hot_updater_cli_tools.p.isCancel(value) ? void 0 : value;
+/** Hot Updater's own prompts, so the sign-in looks like the rest of the CLI. */
+const cliPrompts = {
+	password: async (appleId) => answer(await _hot_updater_cli_tools.p.password({
+		message: appleId ? `Password of ${appleId}` : "Apple Account password",
+		mask: "•",
+		validate: (value) => value ? void 0 : "Enter the password."
+	})),
+	twoFactorCode: async (attempt) => answer(await _hot_updater_cli_tools.p.text({
+		message: attempt === 1 ? "Two-factor code from your trusted device (no device at hand? enter any wrong code once, and Apple texts one to your phone)" : "Verification code Apple sent to your phone",
+		validate: (value) => /^\d{6}$/u.test(value?.trim() ?? "") ? void 0 : "Enter the 6-digit code."
+	}))?.trim()
+};
+/** `value` as one word for `sh`. */
+const shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+/**
+* A two-factor code command for asc that asks `prompts` in this process:
+* asc runs it when Apple wants a code, and it prints what the developer
+* typed, which it gets over a socket in the 0700 work directory. A
+* cancelled prompt makes it print nothing and fail, which stops the sign-in.
+*/
+const listenForTwoFactorCodes = async (root, prompts) => {
+	const socketPath = node_path.default.join(root, "2fa.sock");
+	const scriptPath = node_path.default.join(root, "two-factor-code.cjs");
+	await node_fs_promises.default.writeFile(scriptPath, [
+		"const socket = require(\"node:net\").connect(" + JSON.stringify(socketPath) + ");",
+		"let code = \"\";",
+		"socket.on(\"data\", (chunk) => { code += chunk; });",
+		"socket.on(\"end\", () => {",
+		"  code = code.trim();",
+		"  if (!code) process.exit(1);",
+		"  process.stdout.write(code + \"\\n\");",
+		"});",
+		"socket.on(\"error\", () => process.exit(1));",
+		""
+	].join("\n"), { mode: 384 });
+	let attempts = 0;
+	let cancelled = false;
+	const server = node_net.default.createServer((socket) => {
+		attempts += 1;
+		prompts.twoFactorCode(attempts).then((code) => {
+			if (!code) cancelled = true;
+			socket.end(code ? `${code}\n` : "");
+		}, () => {
+			cancelled = true;
+			socket.destroy();
+		});
+	});
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(socketPath, resolve);
+	});
+	return {
+		command: `${shellQuote(process.execPath)} ${shellQuote(scriptPath)}`,
+		cancelled: () => cancelled,
+		close: () => new Promise((resolve) => server.close(() => resolve()))
+	};
+};
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const text = (value) => typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+/** The last line of asc's error output, which names what failed. */
+const lastLine = (stderr) => stderr.split("\n").map((line) => line.trim()).filter(Boolean).at(-1);
+/** What to do about a key asc could not create, by what App Store Connect said. */
+const createFailureHint = (stderr) => {
+	if (/agreement/iu.test(stderr)) return "The Apple Developer Program License Agreement has changed: the Account Holder accepts it at https://developer.apple.com/account, then run this again.";
+	if (/limit|maximum/iu.test(stderr)) return `The team has as many active API keys as App Store Connect allows: revoke one you no longer use at ${ASC_INTEGRATIONS_URL}, then run this again.`;
+	if (/account holder|admin|permission|forbidden|not allowed|403/iu.test(stderr)) return "Creating an App Store Connect API key needs the Account Holder or Admin role in the team: sign in with such an Apple Account, or ask one to run this.";
+};
+/** A P-256 private key, as App Store Connect issues one, or a thrown error. */
+const assertP8 = (p8) => {
+	let key;
+	try {
+		key = node_crypto.default.createPrivateKey(p8);
+	} catch {
+		throw new Error("asc saved a .p8 that is not a private key.");
+	}
+	if (key.asymmetricKeyType !== "ec") throw new Error("asc saved a .p8 that is not an EC private key.");
+};
+/**
+* `IssueAscApiKey` with asc, the open-source App Store Connect CLI
+* (https://github.com/rorkai/App-Store-Connect-CLI, MIT):
+*
+* 1. `asc web auth login` signs in with the password and the two-factor
+*    codes typed into Hot Updater's prompts. The password reaches only that
+*    asc process, in its environment (never an argument), each code only
+*    asc's two-factor code command, and neither is kept or printed.
+* 2. `chooseTeam` sees the team asc signed in to, unless `teamId` is set.
+* 3. `asc web api-keys create` issues the key and saves its one-time `.p8`,
+*    which is checked before it is handed out; a key that fails the check is
+*    revoked at once.
+* 4. `revoke` runs `asc web api-keys revoke` in the same session.
+*
+* asc's whole state (its web session, config, and the `.p8`) lives in a
+* temporary 0700 directory, which `dispose` deletes, as does the process
+* exiting first.
+*
+* @param asc The asc binary; found or downloaded with `findAscCli` unless set.
+* @param env The environment asc's own is derived from.
+* @param prompts Where the password and two-factor codes are asked.
+*/
+const createAscCliKeyIssuer = ({ asc, env = process.env, prompts = cliPrompts } = {}) => async ({ name, role, appleId, teamId, chooseTeam }) => {
+	const cli = asc ?? await findAscCli();
+	_hot_updater_cli_tools.p.log.info("Hot Updater signs in with asc, the open-source App Store Connect CLI. It keeps only the API key it issues: neither the password nor the session.");
+	const password = await prompts.password(appleId);
+	if (password === void 0) throw new AscCommandError("Signing in was cancelled.", void 0);
+	(0, _hot_updater_cli_tools.registerSecretValue)(password);
+	const work = await createWorkDirectory();
+	const ascEnv = ascEnvironment(work.root, env);
+	const run = async (step, args, extraEnv = {}) => {
+		const result = await (0, execa.execa)(cli.path, args, {
+			env: {
+				...ascEnv,
+				...extraEnv
+			},
+			extendEnv: false,
+			stdin: "ignore",
+			stdout: "pipe",
+			stderr: "pipe",
+			reject: false
+		});
+		const stderr = String(result.stderr ?? "");
+		if (result.exitCode !== 0 || result.failed) throw new AscCommandError(`${step} failed: ${lastLine(stderr) ?? (result.signal ? `stopped by ${result.signal}` : void 0) ?? `exit code ${result.exitCode}`}`, result.exitCode, { cause: { stderr } });
+		let parsed;
+		try {
+			parsed = JSON.parse(String(result.stdout));
+		} catch {
+			parsed = void 0;
+		}
+		if (!isRecord(parsed)) throw new AscCommandError(`${step} printed no JSON this version of Hot Updater reads.`, result.exitCode);
+		return parsed;
+	};
+	try {
+		const twoFactor = await listenForTwoFactorCodes(work.root, prompts);
+		let login;
+		try {
+			login = await run("Signing in with asc web auth login", [
+				"web",
+				"auth",
+				"login",
+				...appleId ? ["--apple-id", appleId] : [],
+				"--two-factor-code-command",
+				twoFactor.command,
+				"--output",
+				"json"
+			], { ASC_WEB_PASSWORD: password });
+		} catch (error) {
+			if (twoFactor.cancelled()) throw new AscCommandError("Signing in was cancelled.", void 0, { cause: error });
+			throw error;
+		} finally {
+			await twoFactor.close();
+		}
+		if (login.authenticated !== true) throw new AscCommandError("asc web auth login finished without a signed-in session.", 0);
+		const signedIn = {
+			...text(login.appleId) ? { appleId: text(login.appleId) } : {},
+			...text(login.publicProviderId) ? { teamId: text(login.publicProviderId) } : {},
+			...text(login.developerTeamId) ? { developerTeamId: text(login.developerTeamId) } : {}
+		};
+		const chosen = teamId ?? await chooseTeam?.(signedIn);
+		const team = chosen === void 0 || chosen === signedIn.teamId ? signedIn : {
+			...signedIn.appleId ? { appleId: signedIn.appleId } : {},
+			teamId: chosen
+		};
+		const sessionArgs = [...signedIn.appleId ? ["--apple-id", signedIn.appleId] : [], ...chosen === void 0 ? [] : ["--public-provider-id", chosen]];
+		let created;
+		try {
+			created = await run("Creating the App Store Connect API key", [
+				"web",
+				"api-keys",
+				"create",
+				"--name",
+				name,
+				"--role",
+				role,
+				"--output-dir",
+				node_path.default.join(work.root, "keys"),
+				...sessionArgs,
+				"--output",
+				"json"
+			]);
+		} catch (error) {
+			const stderr = error instanceof AscCommandError && isRecord(error.cause) ? String(error.cause.stderr ?? "") : "";
+			const hint = createFailureHint(stderr);
+			if (hint && error instanceof AscCommandError) throw new AscCommandError(`${error.message}\n${hint}`, error.exitCode, { cause: error });
+			throw error;
+		}
+		const keyId = text(created.keyId);
+		if (!keyId) throw new AscCommandError("asc web api-keys create printed no key ID.", 0);
+		const revoke = () => run("Revoking the key", [
+			"web",
+			"api-keys",
+			"revoke",
+			"--key-id",
+			keyId,
+			"--type",
+			"team",
+			"--confirm",
+			...sessionArgs,
+			"--output",
+			"json"
+		]).then((json) => json.active === false || json.status === "revoked", () => false);
+		let p8;
+		let issuerId;
+		try {
+			const issuer = text(created.issuerId);
+			const p8Path = text(created.p8Path);
+			const keys = node_path.default.join(work.root, "keys");
+			if (!issuer) throw new Error("asc printed no issuer ID for the key.");
+			if (!p8Path || await node_fs_promises.default.realpath(node_path.default.dirname(node_path.default.resolve(p8Path))) !== await node_fs_promises.default.realpath(keys)) throw new Error("asc saved the key's .p8 outside its output directory.");
+			p8 = (await node_fs_promises.default.readFile(p8Path, "utf-8")).trim();
+			(0, _hot_updater_cli_tools.registerSecretValue)(p8);
+			(0, _hot_updater_cli_tools.registerSecretValue)(Buffer.from(p8).toString("base64"));
+			assertP8(p8);
+			issuerId = issuer;
+		} catch (error) {
+			const revoked = await revoke();
+			throw new Error(revoked ? `${error.message} The App Store Connect API key ${keyId} was revoked again.` : `${error.message} Revoking the App Store Connect API key ${keyId} failed too: revoke it at ${ASC_INTEGRATIONS_URL}.`, { cause: error });
+		}
+		return {
+			p8,
+			keyId,
+			issuerId,
+			name: text(created.name) ?? name,
+			team,
+			revoke,
+			dispose: work.dispose
+		};
+	} catch (error) {
+		await work.dispose();
+		throw error;
+	}
+};
+//#endregion
+//#region src/ascApiKey.ts
+/** Where team API keys are listed and revoked in App Store Connect. */
+const ASC_INTEGRATIONS_URL = "https://appstoreconnect.apple.com/access/integrations/api";
+/**
+* Hot Updater's sign-in, the one place that picks how it is done: asc, the
+* open-source App Store Connect CLI. Another implementation of
+* `IssueAscApiKey` replaces it here without touching its callers.
+*/
+const issueAscApiKey = (request) => createAscCliKeyIssuer()(request);
+//#endregion
 //#region src/utils/cocoapods.ts
 const installPodsIfNeeded = async (sourceDir) => {
 	const podfilePath = path.default.join(sourceDir, "Podfile");
@@ -42,6 +476,16 @@ const installPodsIfNeeded = async (sourceDir) => {
 	}
 	const gemfilePaths = [path.default.join(sourceDir, "Gemfile"), path.default.join((0, _hot_updater_cli_tools.getCwd)(), "Gemfile")];
 	const shouldUseBundler = (await Promise.all(gemfilePaths.map(checkShouldUseBundler))).some(Boolean);
+	const reactNative = (0, _hot_updater_cli_tools.getReactNativeMetadatas)();
+	const plan = resolvePodInstallPlan({
+		version: reactNative.version,
+		env: process.env
+	});
+	if (plan.runCodegen) await runReactNativeCodegen({
+		projectRoot: (0, _hot_updater_cli_tools.getCwd)(),
+		reactNativePath: reactNative.packagePath,
+		sourceDir
+	});
 	try {
 		if (shouldUseBundler) {
 			_hot_updater_cli_tools.p.log.info("Using bundler for CocoaPods installation");
@@ -57,7 +501,7 @@ const installPodsIfNeeded = async (sourceDir) => {
 				"install"
 			], {
 				cwd: sourceDir,
-				env: preparePodInstallEnvVars()
+				env: plan.env
 			});
 			podSpinner.stop("CocoaPods dependencies installed");
 		} else {
@@ -65,7 +509,7 @@ const installPodsIfNeeded = async (sourceDir) => {
 			spinner.start("Installing CocoaPods dependencies");
 			await (0, execa.execa)("pod", ["install"], {
 				cwd: sourceDir,
-				env: preparePodInstallEnvVars()
+				env: plan.env
 			});
 			spinner.stop("CocoaPods dependencies installed");
 		}
@@ -81,13 +525,55 @@ const checkShouldUseBundler = async (gemfilePath) => {
 		return false;
 	}
 };
-const preparePodInstallEnvVars = () => {
-	const { minor } = (0, _hot_updater_cli_tools.getReactNativeMetadatas)().version;
-	const usePrebuiltReactNative = minor >= 81;
+/**
+* Runs React Native codegen into `<sourceDir>/build/generated/ios`, as the
+* React Native CLI does before `pod install`. Clearing the old output first
+* drops the modules of removed libraries.
+*/
+const runReactNativeCodegen = async ({ projectRoot, reactNativePath, sourceDir }) => {
+	await fs.default.promises.rm(path.default.join(sourceDir, "build", "generated", "ios"), {
+		recursive: true,
+		force: true
+	});
+	const spinner = _hot_updater_cli_tools.p.spinner();
+	spinner.start("Running React Native codegen");
+	try {
+		await (0, execa.execa)("node", [
+			path.default.join(reactNativePath, "scripts", "generate-codegen-artifacts.js"),
+			"-p",
+			projectRoot,
+			"-o",
+			sourceDir,
+			"-t",
+			"ios"
+		], { cwd: projectRoot });
+	} catch (error) {
+		spinner.stop("React Native codegen failed");
+		throw new Error(`React Native codegen failed: ${error}`);
+	}
+	spinner.stop("React Native codegen done");
+};
+/**
+* The environment `pod install` runs with, and whether codegen runs first.
+*
+* From React Native 0.79, `RCT_IGNORE_PODS_DEPRECATION=1` silences the
+* deprecation notice for calling `pod install` directly and also sets
+* `RCT_SKIP_CODEGEN=1`, because the React Native CLI runs codegen itself
+* first. Hot Updater sets it the same way and runs codegen too, unless the
+* user's `RCT_SKIP_CODEGEN=1` takes codegen over. Before 0.79, and when the
+* version is unknown, CocoaPods runs codegen. A user's value of a flag wins.
+*/
+const resolvePodInstallPlan = ({ version, env }) => {
+	const podsSkipCodegen = version.major > 0 || version.minor >= 79;
+	const usePrebuiltReactNative = version.major > 0 || version.minor >= 81;
+	const ignorePodsDeprecation = env["RCT_IGNORE_PODS_DEPRECATION"] ?? (podsSkipCodegen ? "1" : void 0);
 	return {
-		RCT_IGNORE_PODS_DEPRECATION: "1",
-		RCT_USE_RN_DEP: process.env["RCT_USE_RN_DEP"] !== void 0 ? String(process.env["RCT_USE_RN_DEP"]) : usePrebuiltReactNative ? "1" : "0",
-		RCT_USE_PREBUILT_RNCORE: process.env["RCT_USE_PREBUILT_RNCORE"] !== void 0 ? String(process.env["RCT_USE_PREBUILT_RNCORE"]) : usePrebuiltReactNative ? "1" : "0"
+		runCodegen: podsSkipCodegen && ignorePodsDeprecation === "1" && env["RCT_SKIP_CODEGEN"] !== "1",
+		env: {
+			...ignorePodsDeprecation !== void 0 && { RCT_IGNORE_PODS_DEPRECATION: ignorePodsDeprecation },
+			RCT_USE_RN_DEP: env["RCT_USE_RN_DEP"] ?? (usePrebuiltReactNative ? "1" : "0"),
+			RCT_USE_PREBUILT_RNCORE: env["RCT_USE_PREBUILT_RNCORE"] ?? (usePrebuiltReactNative ? "1" : "0")
+		}
 	};
 };
 //#endregion
@@ -166,9 +652,15 @@ const parseXcodeProjectInfo = async (sourceDir) => {
 //#endregion
 //#region src/utils/prettifyXcodebuildError.ts
 const prettifyXcodebuildError = (error) => {
-	let errorString = "";
-	if (error instanceof execa.ExecaError || error instanceof Error || "message" in error) errorString = error.message;
-	if (errorString.includes("error: No profiles for") || errorString.includes("error: Provisioning profile")) return /* @__PURE__ */ new Error("Xcodebuild failed: Not valid provisioning profile is set in the project. Check out Singing & Capabilities tab in the Xcode.");
+	if (error instanceof _hot_updater_cli_tools.BuildFailedError) {
+		const errorLines = error.summary.join("\n");
+		const message = errorLines.includes("error: No profiles for") || errorLines.includes("error: Provisioning profile") ? "Not valid provisioning profile is set in the project. Check out the Signing & Capabilities tab in Xcode." : error.message;
+		return new _hot_updater_cli_tools.BuildFailedError(`Xcodebuild failed: ${message}`, {
+			logPath: error.logPath,
+			summary: error.summary,
+			cause: error.cause
+		});
+	}
 	return /* @__PURE__ */ new Error(`Xcodebuild failed: ${error}`);
 };
 //#endregion
@@ -211,13 +703,20 @@ const createXcodebuildLogger = ({ logPrefix }) => new _hot_updater_cli_tools.Bui
 			"BUILD SUCCEEDED",
 			"ARCHIVE SUCCEEDED"
 		]
-	]
+	],
+	failureSummary: {
+		lines: [/(^|:\s)error: /, /^\*\* [A-Z ]+ FAILED \*\*$/],
+		blocks: [{
+			start: "The following build commands failed:",
+			end: /^\(\d+ failures?\)$/,
+			includeEnd: true
+		}]
+	}
 });
 //#endregion
 //#region src/utils/runXcodebuildWithLogging.ts
 let cachedXcbeautifyAvailability = null;
-const TERMINATION_SIGNALS = ["SIGINT", "SIGTERM"];
-const IGNORED_PIPELINE_ERROR_CODES = ["EPIPE", "ERR_STREAM_PREMATURE_CLOSE"];
+const TERMINATION_SIGNALS$1 = ["SIGINT", "SIGTERM"];
 const isXcbeautifyAvailable = async () => {
 	if (cachedXcbeautifyAvailability !== null) return cachedXcbeautifyAvailability;
 	try {
@@ -233,6 +732,7 @@ const createRawXcodebuildProcess = ({ args, env, sourceDir }) => {
 	return (0, execa.execa)("xcodebuild", args, {
 		cwd: sourceDir,
 		all: true,
+		buffer: false,
 		env: {
 			...process.env,
 			...env,
@@ -243,29 +743,17 @@ const createRawXcodebuildProcess = ({ args, env, sourceDir }) => {
 const createXcbeautifyProcess = ({ cwd }) => {
 	return (0, execa.execa)("xcbeautify", [], {
 		cwd,
-		all: true
+		all: true,
+		buffer: false
 	});
 };
-const getErrorCode = (error) => {
-	if (typeof error !== "object" || error === null || !("code" in error)) return "";
-	const { code } = error;
-	return typeof code === "string" ? code : "";
-};
-const shouldIgnorePipelineError = (error) => {
-	const errorCode = getErrorCode(error);
-	return IGNORED_PIPELINE_ERROR_CODES.includes(errorCode);
-};
-const createXcodebuildOutputPipingPromise = async ({ xcodebuildOutput, xcbeautifyInput }) => {
-	try {
-		return await (0, stream_promises.pipeline)(xcodebuildOutput, xcbeautifyInput);
-	} catch (error) {
-		if (shouldIgnorePipelineError(error)) return;
-		throw error;
+/** Why xcodebuild failed, without its command line. */
+const describeFailure = (error) => {
+	if (error instanceof execa.ExecaError) {
+		if (error.signal) return `xcodebuild was stopped by ${error.signal}.`;
+		if (error.exitCode !== void 0) return `xcodebuild exited with code ${error.exitCode}.`;
 	}
-};
-const processOutputStream = async ({ outputStream, logger }) => {
-	if (!outputStream) return;
-	await logger.processStream(outputStream);
+	return error instanceof Error ? error.message : String(error);
 };
 const runXcodebuildWithLogging = async ({ args, env, sourceDir, successMessage, failureMessage, logPrefix }) => {
 	const useXcbeautify = await isXcbeautifyAvailable();
@@ -275,74 +763,153 @@ const runXcodebuildWithLogging = async ({ args, env, sourceDir, successMessage,
 	const terminateActiveProcesses = () => {
 		for (const activeProcess of activeProcesses) activeProcess.kill();
 	};
-	for (const signal of TERMINATION_SIGNALS) process.once(signal, terminateActiveProcesses);
+	for (const signal of TERMINATION_SIGNALS$1) process.once(signal, terminateActiveProcesses);
 	try {
-		if (useXcbeautify) {
-			const xcodebuildProcess = createRawXcodebuildProcess({
-				args,
-				env,
-				sourceDir
-			});
-			const xcbeautifyProcess = createXcbeautifyProcess({ cwd: sourceDir });
-			activeProcesses.push(xcodebuildProcess, xcbeautifyProcess);
-			const xcodebuildOutput = xcodebuildProcess.all ?? xcodebuildProcess.stdout;
-			const xcbeautifyInput = xcbeautifyProcess.stdin;
-			if (!xcodebuildOutput || !xcbeautifyInput) throw new Error("Failed to pipe xcodebuild output into xcbeautify");
-			const pipingPromise = createXcodebuildOutputPipingPromise({
-				xcodebuildOutput,
-				xcbeautifyInput
-			});
-			await processOutputStream({
-				logger,
-				outputStream: xcbeautifyProcess.all ?? xcbeautifyProcess.stdout
-			});
-			await Promise.all([
-				xcbeautifyProcess,
-				xcodebuildProcess,
-				pipingPromise
-			]);
-		} else {
-			const xcodebuildProcess = createRawXcodebuildProcess({
-				args,
-				env,
-				sourceDir
-			});
-			activeProcesses.push(xcodebuildProcess);
-			await processOutputStream({
-				logger,
-				outputStream: xcodebuildProcess.all ?? xcodebuildProcess.stdout
+		const xcodebuildProcess = createRawXcodebuildProcess({
+			args,
+			env,
+			sourceDir
+		});
+		activeProcesses.push(xcodebuildProcess);
+		const xcodebuildOutput = xcodebuildProcess.all ?? xcodebuildProcess.stdout;
+		let xcbeautifyProcess = null;
+		if (useXcbeautify && xcodebuildOutput) {
+			xcbeautifyProcess = createXcbeautifyProcess({ cwd: sourceDir });
+			activeProcesses.push(xcbeautifyProcess);
+		}
+		const logging = xcodebuildOutput ? logger.processStream(xcodebuildOutput, { display: xcbeautifyProcess ? xcbeautifyProcess.all ?? xcbeautifyProcess.stdout ?? void 0 : void 0 }) : Promise.resolve();
+		const xcbeautifyInput = xcbeautifyProcess?.stdin;
+		if (xcodebuildOutput && xcbeautifyInput) {
+			xcbeautifyInput.on("error", () => {
+				xcodebuildOutput.unpipe(xcbeautifyInput);
 			});
-			await xcodebuildProcess;
+			xcodebuildOutput.pipe(xcbeautifyInput);
 		}
+		const [xcodebuildResult, loggingResult] = await Promise.allSettled([
+			xcodebuildProcess,
+			logging,
+			xcbeautifyProcess
+		]);
+		if (xcodebuildResult.status === "rejected") throw xcodebuildResult.reason;
+		if (loggingResult.status === "rejected") throw loggingResult.reason;
 		logger.stop(successMessage);
 	} catch (error) {
 		logger.writeError(error);
 		logger.stop(failureMessage, false);
-		throw error;
+		throw new _hot_updater_cli_tools.BuildFailedError(`${failureMessage}: ${describeFailure(error)}`, {
+			logPath: logger.logPath,
+			summary: logger.failureSummary,
+			cause: error
+		});
 	} finally {
-		for (const signal of TERMINATION_SIGNALS) process.off(signal, terminateActiveProcesses);
+		for (const signal of TERMINATION_SIGNALS$1) process.off(signal, terminateActiveProcesses);
 		await logger.close();
 	}
 };
 //#endregion
+//#region src/utils/writeBuildXcconfig.ts
+const SDK_CONDITIONS = [
+	"",
+	"[sdk=iphoneos*]",
+	"[sdk=iphonesimulator*]"
+];
+/**
+* Finds a setting of `keys` that an included xcconfig sets with a condition
+* the build xcconfig does not, such as `[config=Release]` or `[arch=arm64]`,
+* which would outrank the build's own. It follows `#include`s, which are
+* relative to the including file.
+*/
+const findConditionalSetting = async (files, keys, visited = /* @__PURE__ */ new Set()) => {
+	for (const file of files) {
+		if (visited.has(file) || !fs.default.existsSync(file)) continue;
+		visited.add(file);
+		const lines = (await fs.default.promises.readFile(file, "utf-8")).split("\n");
+		for (const [index, line] of lines.entries()) {
+			const include = line.match(/^\s*#include\??\s*"([^"]+)"/)?.[1];
+			if (include) {
+				const found = await findConditionalSetting([path.default.resolve(path.default.dirname(file), include)], keys, visited);
+				if (found) return found;
+				continue;
+			}
+			const [, key, conditions] = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)((?:\[[^\]]*\])+)\s*=/) ?? [];
+			if (key && keys.includes(key) && !SDK_CONDITIONS.includes(conditions)) return `${file}:${index + 1} sets ${key}${conditions}`;
+		}
+	}
+};
+/**
+* Writes the xcconfig a build loads, which sets the CLI's build settings
+* over every other. xcodebuild ranks an `-xcconfig`'s settings above the
+* command line's, so the scheme's `xcconfig` and each `-xcconfig` in
+* `extraParams` are included, in order, before `settings`, and the build
+* loads only this one.
+*/
+const writeBuildXcconfig = async ({ directory, sourceDir, xcconfig, extraParams = [], settings }) => {
+	const included = xcconfig ? [xcconfig] : [];
+	const otherParams = [];
+	for (let i = 0; i < extraParams.length; i++) if (extraParams[i] === "-xcconfig" && i + 1 < extraParams.length) included.push(extraParams[++i]);
+	else otherParams.push(extraParams[i]);
+	const includedFiles = included.map((file) => path.default.resolve(sourceDir, file));
+	const conditional = await findConditionalSetting(includedFiles, Object.keys(settings));
+	if (conditional) throw new Error(`${conditional}, which would outrank the value the build sets. Set it without that condition, or remove it.`);
+	const buildXcconfig = path.default.join(directory, "HotUpdater.xcconfig");
+	await fs.default.promises.writeFile(buildXcconfig, [
+		...includedFiles.map((file) => `#include "${file}"`),
+		...Object.entries(settings).flatMap(([key, value]) => SDK_CONDITIONS.map((condition) => `${key}${condition} = ${value}`)),
+		""
+	].join("\n"));
+	return {
+		xcconfig: buildXcconfig,
+		extraParams: otherParams
+	};
+};
+/**
+* Automatic signing over a target set to manual signing, whose provisioning
+* profile and identity Xcode would otherwise report as conflicting.
+*/
+const AUTOMATIC_SIGNING = {
+	CODE_SIGN_STYLE: "Automatic",
+	PROVISIONING_PROFILE: "",
+	PROVISIONING_PROFILE_SPECIFIER: "",
+	CODE_SIGN_IDENTITY: "Apple Development"
+};
+/**
+* The settings a build sets over the scheme's: the MIN_BUNDLE_ID the CLI
+* issues and reports, and automatic signing when an App Store Connect API
+* key signs, which a target set to manual signing would not use.
+*/
+const buildSettingsOverScheme = ({ minBundleId, authenticationArgs }) => ({
+	HOT_UPDATER_MIN_BUNDLE_ID: minBundleId,
+	...authenticationArgs ? AUTOMATIC_SIGNING : {}
+});
+//#endregion
 //#region src/builder/archiveXcodeProject.ts
-const archiveXcodeProject = async ({ sourceDir, platform, installPods, destination, extraParams, configuration, xcodeScheme, xcconfig, logPrefix }) => {
-	const xcodeProject = await parseXcodeProjectInfo(sourceDir);
+const archiveXcodeProject = async ({ sourceDir, platform, installPods, destination, extraParams, configuration, xcodeScheme, xcconfig, logPrefix, minBundleId, authenticationArgs }) => {
 	if (installPods) await installPodsIfNeeded(sourceDir);
+	const xcodeProject = await parseXcodeProjectInfo(sourceDir);
 	const tmpDir = await createRandomTmpDir();
 	const archiveName = `${xcodeProject.name.replace(".xcworkspace", "").replace(".xcodeproj", "")}.xcarchive`;
 	const archivePath = path.default.join(tmpDir, archiveName);
-	const minBundleId = (0, _hot_updater_plugin_core.generateMinBundleId)();
+	const build = await writeBuildXcconfig({
+		directory: tmpDir,
+		sourceDir,
+		xcconfig,
+		extraParams,
+		settings: buildSettingsOverScheme({
+			minBundleId,
+			authenticationArgs
+		})
+	});
 	const archiveArgs = prepareArchiveArgs({
+		authenticationArgs,
 		minBundleId,
 		archivePath,
 		platform,
 		sourceDir,
 		xcodeProject,
 		configuration,
-		extraParams,
+		extraParams: build.extraParams,
 		destination,
-		xcconfig,
+		xcconfig: build.xcconfig,
 		xcodeScheme
 	});
 	_hot_updater_cli_tools.p.log.info(`Xcode Archive Settings:
@@ -365,7 +932,7 @@ Command    xcodebuild ${archiveArgs.join(" ")}
 		throw prettifyXcodebuildError(error);
 	}
 };
-const prepareArchiveArgs = ({ xcodeScheme, archivePath, platform, sourceDir, xcodeProject, configuration = "Release", xcconfig, extraParams, destination = [], minBundleId }) => {
+const prepareArchiveArgs = ({ xcodeScheme, archivePath, platform, sourceDir, xcodeProject, configuration = "Release", xcconfig, extraParams, destination = [], minBundleId, authenticationArgs }) => {
 	const args = [
 		xcodeProject.isWorkspace ? "-workspace" : "-project",
 		path.default.join(sourceDir, xcodeProject.name),
@@ -378,6 +945,7 @@ const prepareArchiveArgs = ({ xcodeScheme, archivePath, platform, sourceDir, xco
 		archivePath,
 		`HOT_UPDATER_MIN_BUNDLE_ID=${minBundleId}`
 	];
+	if (authenticationArgs) args.push(...authenticationArgs);
 	if (xcconfig) args.push("-xcconfig", xcconfig);
 	if (extraParams) args.push(...extraParams);
 	const resolvedDestinations = resolveDestinations({
@@ -394,9 +962,9 @@ const prepareArchiveArgs = ({ xcodeScheme, archivePath, platform, sourceDir, xco
 };
 //#endregion
 //#region src/builder/buildXcodeProject.ts
-const buildXcodeProject = async ({ sourceDir, platform, xcodeScheme, configuration, deviceType, logPrefix, destination = [], useGenericDestination = false, installPods, extraParams }) => {
-	const xcodeProject = await parseXcodeProjectInfo(sourceDir);
+const buildXcodeProject = async ({ sourceDir, platform, xcodeScheme, configuration, deviceType, logPrefix, destination = [], useGenericDestination = false, installPods, extraParams, minBundleId, authenticationArgs }) => {
 	if (installPods) await installPodsIfNeeded(sourceDir);
+	const xcodeProject = await parseXcodeProjectInfo(sourceDir);
 	const derivedDataPath = await createRandomTmpDir();
 	const resolvedDestinations = resolveDestinations({
 		destinations: destination,
@@ -407,14 +975,24 @@ const buildXcodeProject = async ({ sourceDir, platform, xcodeScheme, configurati
 		platform,
 		useGeneric: useGenericDestination
 	}));
-	const minBundleId = (0, _hot_updater_plugin_core.generateMinBundleId)();
+	const build = await writeBuildXcconfig({
+		directory: await createRandomTmpDir(),
+		sourceDir,
+		extraParams,
+		settings: buildSettingsOverScheme({
+			minBundleId,
+			authenticationArgs
+		})
+	});
 	const buildArgs = prepareBuildArgs({
+		authenticationArgs,
+		xcconfig: build.xcconfig,
 		minBundleId,
 		configuration,
 		derivedDataPath,
 		deviceType,
 		resolvedDestinations,
-		extraParams,
+		extraParams: build.extraParams,
 		platform,
 		xcodeScheme,
 		sourceDir,
@@ -449,7 +1027,7 @@ Command        xcodebuild ${buildArgs.join(" ")}
 		throw prettifyXcodebuildError(error);
 	}
 };
-const prepareBuildArgs = ({ xcodeProject, sourceDir, platform, xcodeScheme, configuration, deviceType, resolvedDestinations, derivedDataPath, extraParams, minBundleId }) => {
+const prepareBuildArgs = ({ xcodeProject, sourceDir, platform, xcodeScheme, configuration, deviceType, resolvedDestinations, derivedDataPath, extraParams, minBundleId, authenticationArgs, xcconfig }) => {
 	const sdk = deviceType === "simulator" ? platformConfigs[platform].simulatorSdk : platformConfigs[platform].deviceSdk;
 	const args = [
 		xcodeProject.isWorkspace ? "-workspace" : "-project",
@@ -465,6 +1043,8 @@ const prepareBuildArgs = ({ xcodeProject, sourceDir, platform, xcodeScheme, conf
 		`HOT_UPDATER_MIN_BUNDLE_ID=${minBundleId}`,
 		"build"
 	];
+	if (authenticationArgs) args.push(...authenticationArgs);
+	args.push("-xcconfig", xcconfig);
 	if (extraParams) args.push(...extraParams);
 	for (const dest of resolvedDestinations) args.push("-destination", dest);
 	return args;
@@ -501,9 +1081,10 @@ const getBuildSettings = async ({ xcodeProject, sourceDir, xcodeScheme, configur
 };
 //#endregion
 //#region src/builder/exportXcodeArchive.ts
-const exportXcodeArchive = async ({ archivePath, sourceDir, exportExtraParams, exportOptionsPlist, logPrefix }) => {
+const exportXcodeArchive = async ({ archivePath, sourceDir, exportExtraParams, exportOptionsPlist, logPrefix, authenticationArgs }) => {
 	const exportPath = await createRandomTmpDir();
 	const exportArgs = prepareExportArgs({
+		authenticationArgs,
 		archivePath,
 		exportPath,
 		exportOptionsPlist,
@@ -522,7 +1103,7 @@ const exportXcodeArchive = async ({ archivePath, sourceDir, exportExtraParams, e
 		throw prettifyXcodebuildError(error);
 	}
 };
-const prepareExportArgs = ({ exportPath, archivePath, exportExtraParams, exportOptionsPlist }) => {
+const prepareExportArgs = ({ exportPath, archivePath, exportExtraParams, exportOptionsPlist, authenticationArgs }) => {
 	const args = [
 		"-exportArchive",
 		"-archivePath",
@@ -530,6 +1111,7 @@ const prepareExportArgs = ({ exportPath, archivePath, exportExtraParams, exportO
 		"-exportPath",
 		exportPath
 	];
+	if (authenticationArgs) args.push(...authenticationArgs);
 	if (exportExtraParams) args.push(...exportExtraParams);
 	args.push("-exportOptionsPlist", exportOptionsPlist);
 	return args;
@@ -545,446 +1127,1107 @@ const assertXcodebuildExist = async () => {
 	}
 };
 //#endregion
-//#region src/buildIos.ts
-const buildIos = async ({ schemeConfig }) => {
-	await assertXcodebuildExist();
-	const iosProjectRoot = path.default.join((0, _hot_updater_cli_tools.getCwd)(), "ios");
-	const buildDirectory = await createRandomTmpDir();
-	const archiveDir = path.default.join(buildDirectory, "archive");
-	const exportDir = path.default.join(buildDirectory, "export");
-	await fs.default.promises.mkdir(archiveDir, { recursive: true });
-	if (schemeConfig.simulator) {
-		if (schemeConfig.destination.length) {
-			_hot_updater_cli_tools.p.log.error("The scheme option 'simulator' is not compatible with the 'destination' option.");
-			process.exit(1);
+//#region src/utils/escapeUnzipPattern.ts
+/**
+* A zip entry name as `unzip` reads a literal member. It takes `*`, `?` and
+* `[...]` in a member name as wildcards, which a backslash escapes, so an
+* app named `My[Dev].app` would otherwise match nothing.
+*/
+const escapeUnzipPattern = (name) => name.replace(/[[\]*?\\]/gu, "\\$&");
+//#endregion
+//#region src/utils/readIpaInfo.ts
+const INFO_PLIST_KEYS = {
+	bundleId: "CFBundleIdentifier",
+	shortVersion: "CFBundleShortVersionString",
+	bundleVersion: "CFBundleVersion"
+};
+/**
+* Reads the app's `Payload/<App>.app/Info.plist` out of an `.ipa`, never a
+* framework's or an extension's, which nest deeper.
+*/
+const readIpaInfo = async (ipaPath) => {
+	const { stdout } = await (0, execa.execa)("unzip", ["-Z1", ipaPath]);
+	const entry = stdout.split("\n").map((name) => name.trim()).find((name) => /^Payload\/[^/]+\.app\/Info\.plist$/u.test(name));
+	if (entry === void 0) throw new Error(`${path.default.basename(ipaPath)} has no Payload/<App>.app/Info.plist.`);
+	const directory = await createRandomTmpDir();
+	try {
+		const infoPlist = path.default.join(directory, "Info.plist");
+		await (0, execa.execa)("unzip", [
+			"-p",
+			ipaPath,
+			escapeUnzipPattern(entry)
+		], { stdout: { file: infoPlist } });
+		const info = {};
+		for (const [field, key] of Object.entries(INFO_PLIST_KEYS)) {
+			const { stdout: value, exitCode } = await (0, execa.execa)("plutil", [
+				"-extract",
+				key,
+				"raw",
+				"-o",
+				"-",
+				infoPlist
+			], { reject: false });
+			if (exitCode !== 0 || !value.trim()) throw new Error(`${path.default.basename(ipaPath)}'s Info.plist has no ${key}.`);
+			info[field] = value.trim();
 		}
-		const appDir = path.default.join(buildDirectory, "app");
-		await fs.default.promises.mkdir(appDir, { recursive: true });
-		const { appPath } = await buildXcodeProject({
-			sourceDir: iosProjectRoot,
-			logPrefix: `ios-${schemeConfig.hotUpdaterSchemeName}-build`,
-			platform: schemeConfig.platform,
-			xcodeScheme: schemeConfig.scheme,
-			configuration: schemeConfig.configuration,
-			deviceType: "simulator",
-			installPods: schemeConfig.installPods,
-			extraParams: schemeConfig.extraParams,
-			useGenericDestination: true
-		});
-		const finalAppPath = path.default.join(appDir, path.default.basename(appPath));
-		await fs.default.promises.cp(appPath, finalAppPath, { recursive: true });
-		_hot_updater_cli_tools.p.log.success(`.app file created: ${path.default.basename(appPath)}`);
-		return {
-			buildDirectory,
-			buildArtifactPath: finalAppPath
-		};
-	} else {
-		const { archivePath } = await archiveXcodeProject({
-			platform: schemeConfig.platform,
-			sourceDir: iosProjectRoot,
-			xcconfig: schemeConfig.xcconfig,
-			xcodeScheme: schemeConfig.scheme,
-			destination: schemeConfig.destination,
-			extraParams: schemeConfig.extraParams,
-			configuration: schemeConfig.configuration,
-			installPods: schemeConfig.installPods,
-			logPrefix: `ios-${schemeConfig.hotUpdaterSchemeName}-build-archive`
+		return info;
+	} finally {
+		await fs.default.promises.rm(directory, {
+			recursive: true,
+			force: true
 		});
-		const finalArchivePath = path.default.join(archiveDir, path.default.basename(archivePath));
-		await fs.default.promises.cp(archivePath, finalArchivePath, { recursive: true });
-		const appFromArchive = extractAppFromXcarchive(finalArchivePath);
-		if (appFromArchive) {
-			await fs.default.promises.cp(appFromArchive, path.default.join(archiveDir, path.default.basename(appFromArchive)), { recursive: true });
-			_hot_updater_cli_tools.p.log.success(".app extracted from .xcarchive");
-		}
-		if (schemeConfig.exportOptionsPlist) {
-			await fs.default.promises.mkdir(exportDir, { recursive: true });
-			const { exportPath } = await exportXcodeArchive({
-				archivePath,
-				exportExtraParams: schemeConfig.exportExtraParams,
-				exportOptionsPlist: schemeConfig.exportOptionsPlist,
-				sourceDir: iosProjectRoot,
-				logPrefix: `ios-${schemeConfig.hotUpdaterSchemeName}-build-export`
-			});
-			await fs.default.promises.cp(exportPath, exportDir, { recursive: true });
-			const ipaFile = fs.default.readdirSync(exportDir).find((file) => file.endsWith(".ipa"));
-			if (ipaFile) return {
-				buildDirectory,
-				buildArtifactPath: path.default.join(exportDir, ipaFile)
-			};
-			throw new Error("IPA file not found after export");
-		}
-		return {
-			buildDirectory,
-			buildArtifactPath: finalArchivePath
-		};
 	}
 };
-const extractAppFromXcarchive = (archivePath) => {
-	const productsPath = path.default.join(archivePath, "Products", "Applications");
-	if (!fs.default.existsSync(productsPath)) return;
-	const appFile = fs.default.readdirSync(productsPath).find((file) => file.endsWith(".app"));
-	if (appFile) return path.default.join(productsPath, appFile);
-	_hot_updater_cli_tools.p.log.warn("Failed to extract .app from xcarchive");
-};
 //#endregion
-//#region src/runner/deviceRunner.ts
-const installAndLaunchOnDevice = async ({ device, appPath, options }) => {
-	await installOnDevice({
-		device,
-		appPath,
-		options
-	});
-	if (options.launch !== false) await launchAppOnDevice({
-		device,
-		options
+//#region src/utils/xcodeSigning.ts
+/**
+* How a device build signs with automatic signing, authenticated by the
+* scheme's App Store Connect API key: the xcodebuild arguments, and the key.
+* The key is resolved only here, for a device build of a scheme with
+* `signing`. Without `credentials`, it resolves from the environment or the
+* config's `secrets` adapter, and the temporary files are deleted when the
+* process exits.
+*/
+const resolveXcodeSigning = async ({ schemeConfig, credentials }) => {
+	const reference = schemeConfig.signing?.ascApiKey;
+	if (!reference) return;
+	const apiKey = await (credentials ?? (0, _hot_updater_cli_tools.createCredentialResolver)()).resolve({
+		kind: "asc-api-key",
+		name: (0, _hot_updater_cli_tools.parseSecretReference)(reference, "signing.ascApiKey")
 	});
+	return {
+		authenticationArgs: [
+			"-allowProvisioningUpdates",
+			"-authenticationKeyPath",
+			apiKey.keyPath,
+			"-authenticationKeyID",
+			apiKey.keyId,
+			"-authenticationKeyIssuerID",
+			apiKey.issuerId
+		],
+		apiKey
+	};
 };
-const installOnDevice = async ({ device, appPath, options }) => {
-	const deviceCtlArgs = [
-		"devicectl",
-		"device",
-		"install",
-		"app",
-		"--device",
-		device.udid,
-		appPath
-	];
-	const spinner = _hot_updater_cli_tools.p.spinner();
-	spinner.start(`Installing app on ${device.name}`);
-	try {
-		await (0, execa.execa)("xcrun", deviceCtlArgs, { cwd: options.sourceDir });
-		spinner.stop(`Successfully installed app on ${device.name}`);
-	} catch (error) {
-		spinner.stop(`Failed to install app on ${device.name}`);
-		throw new Error(`Failed to install the app on ${device.name}: ${error}`);
-	}
-};
-const launchAppOnDevice = async ({ device, options }) => {
-	const deviceCtlArgs = [
-		"devicectl",
-		"device",
-		"process",
-		"launch",
-		"--device",
-		device.udid,
-		options.bundleIdentifier
-	];
-	const spinner = _hot_updater_cli_tools.p.spinner();
-	spinner.start(`Launching app on ${device.name}`);
-	try {
-		await (0, execa.execa)("xcrun", deviceCtlArgs, { cwd: options.sourceDir });
-		spinner.stop(`Successfully launched app on ${device.name}`);
-	} catch (error) {
-		spinner.stop(`Failed to launch app on ${device.name}`);
-		throw new Error(`Failed to launch the app on ${device.name}: ${error}`);
-	}
+const APP_STORE_CONNECT_EXPORT_OPTIONS = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>method</key>
+  <string>app-store-connect</string>
+  <key>signingStyle</key>
+  <string>automatic</string>
+</dict>
+</plist>
+`;
+/**
+* Writes the export options of a scheme that signs with an App Store Connect
+* API key and sets no `exportOptionsPlist`: an App Store Connect export with
+* automatic signing.
+*/
+const writeAppStoreConnectExportOptions = async (directory) => {
+	const exportOptionsPlist = path.default.join(directory, "ExportOptions.plist");
+	await fs.default.promises.writeFile(exportOptionsPlist, APP_STORE_CONNECT_EXPORT_OPTIONS);
+	return exportOptionsPlist;
 };
+/** The export methods whose `.ipa` App Store Connect takes. */
+const APP_STORE_EXPORT_METHODS = /* @__PURE__ */ new Set(["app-store", "app-store-connect"]);
+/** The `method` of export options, or "" when it has none or can't be read. */
+const readExportMethod = async (exportOptionsPlist) => {
+	const xml = (await fs.default.promises.readFile(exportOptionsPlist, "utf-8").catch(() => void 0))?.replace(/<!--[\s\S]*?-->/gu, "").match(/<key>\s*method\s*<\/key>\s*<string>\s*([^<]*?)\s*<\/string>/u);
+	if (xml) return xml[1];
+	const { stdout, exitCode } = await (0, execa.execa)("plutil", [
+		"-extract",
+		"method",
+		"raw",
+		"-o",
+		"-",
+		exportOptionsPlist
+	], { reject: false });
+	return exitCode === 0 ? stdout.trim() : "";
+};
+/**
+* Whether a device build exports for App Store Connect: with its
+* `exportOptionsPlist`'s method, or, without one, as a scheme signing with
+* an App Store Connect API key does. Such an `.ipa` is signed with Apple's
+* cloud-managed distribution certificate, never with a development
+* certificate the archive was signed with.
+*/
+const exportsForAppStoreConnect = async (schemeConfig) => !schemeConfig.exportOptionsPlist || APP_STORE_EXPORT_METHODS.has(await readExportMethod(schemeConfig.exportOptionsPlist));
 //#endregion
-//#region src/runner/simulatorRunner.ts
-const installAndLaunchOnSimulator = async ({ device, appPath, options }) => {
-	await launchSimulator({ device });
-	await installOnSimulator({
-		device,
-		appPath,
-		options
-	});
-	if (options.launch !== false) await launchAppOnSimulator({
-		device,
-		options
-	});
+//#region src/uploadToTestFlight.ts
+const API_URL$1 = "https://api.appstoreconnect.apple.com";
+/** Apple accepts tokens that expire within 20 minutes. */
+const TOKEN_LIFETIME_SECONDS = 1200;
+/** A token is replaced well before it expires, so no request carries a stale one. */
+const TOKEN_REUSE_SECONDS = 600;
+/** The parts of an `.ipa` sent at once. */
+const UPLOAD_CONCURRENCY = 4;
+/** Attempts to create the build upload and to commit the uploaded `.ipa`. */
+const COMMIT_ATTEMPTS = 3;
+/** Attempts per part: a part is a plain PUT, safe to repeat. */
+const UPLOAD_ATTEMPTS = 3;
+const IN_PROGRESS_STATES = /* @__PURE__ */ new Set(["AWAITING_UPLOAD", "PROCESSING"]);
+/** The error App Store Connect answers with when a build number is taken. */
+const DUPLICATE_ERROR_CODE = "ENTITY_ERROR.ATTRIBUTE.INVALID.DUPLICATE";
+/**
+* App Store Connect refused the upload: it already has a build with the
+* `.ipa`'s version and build number, from this or another upload, and takes
+* each build number once per version.
+*/
+var TestFlightBuildExistsError = class extends Error {
+	shortVersion;
+	bundleVersion;
+	name = "TestFlightBuildExistsError";
+	constructor(shortVersion, bundleVersion, options) {
+		super(`App Store Connect already has build ${bundleVersion} of version ${shortVersion}. Each build of a version needs a new build number (CFBundleVersion).`, options);
+		this.shortVersion = shortVersion;
+		this.bundleVersion = bundleVersion;
+	}
 };
-const launchSimulator = async ({ device }) => {
-	if (device.type !== "simulator") return;
-	const { stdout: activeDeveloperDir } = await (0, execa.execa)("xcode-select", ["-p"]);
-	await (0, execa.execa)("open", [
-		`${activeDeveloperDir}/Applications/Simulator.app`,
-		"--args",
-		"-CurrentDeviceUDID",
-		device.udid
-	]);
-	if (device.state !== "Booted") await bootSimulator({ device });
+/** An App Store Connect API request that failed, with the errors it answered. */
+var AppStoreConnectError = class extends Error {
+	status;
+	errors;
+	/** The answer's `Retry-After` header, for a rate limit. */
+	retryAfter;
+	constructor(action, status, errors, retryAfter = null) {
+		const details = errors.map((error) => error.detail ?? error.title ?? error.code).filter(Boolean);
+		super(`${action} failed (HTTP ${status})${details.length > 0 ? `: ${details.join(" ")}` : "."}`);
+		this.name = "AppStoreConnectError";
+		this.status = status;
+		this.errors = errors;
+		this.retryAfter = retryAfter;
+	}
 };
-const installOnSimulator = async ({ device, appPath, options }) => {
-	const spinner = _hot_updater_cli_tools.p.spinner();
-	spinner.start(`Installing app on "${device.name}"`);
+/**
+* An App Store Connect API token: an ES256 JWT, whose signature JWS encodes
+* as the raw 64-byte r || s, not the DER Node signs by default.
+*/
+const createAppStoreConnectToken = ({ privateKey, keyId, issuerId, issuedAtSeconds = Math.floor(Date.now() / 1e3) }) => {
+	const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+	const signingInput = `${encode({
+		alg: "ES256",
+		kid: keyId,
+		typ: "JWT"
+	})}.${encode({
+		iss: issuerId,
+		iat: issuedAtSeconds,
+		exp: issuedAtSeconds + TOKEN_LIFETIME_SECONDS,
+		aud: "appstoreconnect-v1"
+	})}`;
+	return `${signingInput}.${crypto.default.sign("sha256", Buffer.from(signingInput), {
+		key: privateKey,
+		dsaEncoding: "ieee-p1363"
+	}).toString("base64url")}`;
+};
+const readPrivateKey = async (keyPath) => {
 	try {
-		await (0, execa.execa)("xcrun", [
-			"simctl",
-			"install",
-			device.udid,
-			appPath
-		], { cwd: options.sourceDir });
-		spinner.stop(`Successfully installed app on "${device.name}"`);
-	} catch (error) {
-		spinner.stop(`Failed to install app on "${device.name}"`);
-		throw new Error(`Failed to install the app on simulator: ${error}`);
+		return crypto.default.createPrivateKey(await fs.default.promises.readFile(keyPath, "utf-8"));
+	} catch {
+		throw new Error("The App Store Connect API key is not a .p8 private key.");
 	}
 };
-const launchAppOnSimulator = async ({ device, options }) => {
-	const spinner = _hot_updater_cli_tools.p.spinner();
-	spinner.start(`Launching app on "${device.name}"`);
-	try {
-		await (0, execa.execa)("xcrun", [
-			"simctl",
-			"launch",
-			device.udid,
-			options.bundleIdentifier
-		], { cwd: options.sourceDir });
-		spinner.stop(`Successfully launched app on "${device.name}"`);
+const readApiErrors = async (response) => {
+	const body = await response.json().catch(() => void 0);
+	return Array.isArray(body?.errors) ? body.errors : [];
+};
+const describeDetails = (details) => details.map((detail) => `${detail.description ?? "(no description)"}${detail.code ? ` (${detail.code})` : ""}`);
+/** Answers a request may outlive: a timeout, a rate limit, a server error. */
+const isRetryableStatus = (status) => status === 408 || status === 429 || status >= 500;
+/**
+* Whether a request may succeed when sent again: a retryable answer, or a
+* network failure, which fetch rejects with a TypeError. A refused key or
+* request is not.
+*/
+const isRetryable = (error) => error instanceof AppStoreConnectError ? isRetryableStatus(error.status) : error instanceof TypeError;
+/** Whether App Store Connect refused a request for its rate limit only. */
+const isRateLimited = (error) => error instanceof AppStoreConnectError && error.status === 429;
+/**
+* Runs `request`, again after a failure `retryable` accepts, up to the
+* attempts.
+*/
+const retrying = async (request, retryable = isRetryable) => {
+	for (let attempt = 1;; attempt++) try {
+		return await request();
 	} catch (error) {
-		spinner.stop(`Failed to launch app on "${device.name}"`);
-		throw new Error(`Failed to launch the app on simulator: ${error}`);
+		if (!retryable(error) || attempt === COMMIT_ATTEMPTS) throw error;
+		await sleep(retryDelayMs(error, attempt));
 	}
 };
-const bootSimulator = async ({ device }) => {
-	try {
-		await (0, execa.execa)("xcrun", [
-			"simctl",
-			"boot",
-			device.udid
-		]);
-	} catch (error) {
-		if ((error instanceof Error ? error.message : String(error)).includes("Unable to boot device in current state: Booted")) {
-			_hot_updater_cli_tools.p.log.info(`Simulator ${device.udid} already booted. Skipping.`);
-			return;
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** The longest wait before a retry, so a run stays bounded. */
+const MAX_RETRY_DELAY_MS = 6e4;
+/**
+* The first wait after a rate limit without `Retry-After`: App Store Connect
+* limits a key per rolling hour, so a retry within seconds meets it again.
+*/
+const RATE_LIMIT_DELAY_MS = 15e3;
+/**
+* How long to wait before sending a request again after `failure`, an
+* answer or the error it raised: the `Retry-After` seconds it asks for, a
+* longer backoff for a rate limit without one, and else a growing backoff,
+* all within a bound.
+*/
+const retryDelayMs = (failure, attempt) => {
+	const { status, retryAfter } = failure instanceof Response ? {
+		status: failure.status,
+		retryAfter: failure.headers.get("retry-after")
+	} : failure instanceof AppStoreConnectError ? failure : {
+		status: 0,
+		retryAfter: null
+	};
+	const seconds = retryAfter === null || retryAfter.trim() === "" ? NaN : Number(retryAfter);
+	const delay = Number.isFinite(seconds) && seconds >= 0 ? seconds * 1e3 : status === 429 ? RATE_LIMIT_DELAY_MS * attempt : 1e3 * attempt;
+	return Math.min(delay, MAX_RETRY_DELAY_MS);
+};
+/**
+* Runs `run` over `items`, at most `concurrency` at a time. After the first
+* failure no item starts, and it throws that failure once every running item
+* has settled, so nothing is still sending when the caller cleans up.
+*/
+const runConcurrently = async (items, concurrency, run) => {
+	let next = 0;
+	let failure;
+	await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, async () => {
+		while (!failure && next < items.length) {
+			const index = next++;
+			try {
+				await run(items[index], index);
+			} catch (error) {
+				failure ??= { error };
+			}
 		}
-		throw new Error(`Failed to boot simulator: ${error}`);
+	}));
+	if (failure) throw failure.error;
+};
+/**
+* A signing build setting's assignment: the key, any conditions such as
+* `[sdk=iphoneos*]`, and the value, without a trailing comment.
+*/
+const SIGNING_SETTING = /^\s*(CODE_SIGNING_ALLOWED|CODE_SIGNING_REQUIRED)((?:\[[^\]]*\])*)\s*=\s*([^\s/]*)\s*(?:\/\/.*)?$/u;
+/** A scheme's `exportOptionsPlist`, which resolves from the project's root. */
+const schemeFile = (file) => path.default.isAbsolute(file) ? file : path.default.resolve((0, _hot_updater_cli_tools.getCwd)(), file);
+/** Applies one assignment, as Xcode does: the last unconditional one wins. */
+const applySetting = (settings, line, label) => {
+	const [, key, conditions, value] = line.match(SIGNING_SETTING) ?? [];
+	if (!key) return;
+	if (conditions) settings.conditional.add(key);
+	else settings.values.set(key, {
+		value,
+		where: `${line.trim()} in ${label}`
+	});
+};
+/**
+* Applies an xcconfig's signing settings over `settings`, in order,
+* following its `#include`s, which resolve from the including file, as
+* Xcode reads it. A file included again applies again; only an include
+* cycle (`including`) stops.
+*/
+const applyXcconfig = async (file, label, settings, including) => {
+	if (including.has(file)) return;
+	including.add(file);
+	const uncommented = (await fs.default.promises.readFile(file, "utf-8").catch(() => void 0))?.replace(/\/\*[\s\S]*?\*\//gu, (comment) => comment.replace(/[^\n]/gu, ""));
+	for (const line of uncommented?.split("\n") ?? []) {
+		const include = line.match(/^\s*#include\??\s*"([^"]+)"/u)?.[1];
+		if (include) await applyXcconfig(path.default.resolve(path.default.dirname(file), include), include, settings, including);
+		else applySetting(settings, line, label);
 	}
+	including.delete(file);
 };
-//#endregion
-//#region src/utils/device.ts
-/**
-* Parses devicectl output to Device array
-* @param devicectlOutput - Raw devicectl JSON output
-* @returns Array of parsed devices
-*/
-const parseDevicectlList = (devicectlOutput) => {
-	return devicectlOutput.map((device) => ({
-		name: device.deviceProperties.name,
-		udid: device.hardwareProperties.udid,
-		version: `${device.hardwareProperties.platform} ${device.deviceProperties.osVersionNumber}`,
-		platform: getPlatformFromOsVersion(device.hardwareProperties.platform),
-		state: device.deviceProperties.bootState === "booted" ? "Booted" : "Shutdown",
-		type: "device"
-	}));
+/**
+* Where the scheme turns code signing off, after every override the build
+* applies: the `extraParams` settings first, then the xcconfigs the build
+* xcconfig includes over them, in order, its `xcconfig` and each
+* `-xcconfig` in `extraParams`, which resolve from `ios/`, where xcodebuild
+* runs (`writeBuildXcconfig`). Undefined when it signs, or when a
+* conditional setting, such as `[sdk=iphoneos*]`, may decide: the build
+* does.
+*/
+const codeSigningOff = async (iosScheme) => {
+	const extraParams = iosScheme.extraParams ?? [];
+	const settings = {
+		values: /* @__PURE__ */ new Map(),
+		conditional: /* @__PURE__ */ new Set()
+	};
+	for (const entry of extraParams) applySetting(settings, entry, "extraParams");
+	const xcconfigs = [...iosScheme.xcconfig ? [iosScheme.xcconfig] : [], ...extraParams.flatMap((entry, index) => entry === "-xcconfig" && index + 1 < extraParams.length ? [extraParams[index + 1]] : [])];
+	for (const xcconfig of xcconfigs) await applyXcconfig(path.default.resolve((0, _hot_updater_cli_tools.getCwd)(), "ios", xcconfig), xcconfig, settings, /* @__PURE__ */ new Set());
+	for (const [key, { value, where }] of settings.values) if (/^no$/iu.test(value) && !settings.conditional.has(key)) return where;
 };
 /**
-* Gets physical iOS devices using devicectl
+* The App Store Connect API key a scheme's `.ipa` uploads with: the
+* `signing.ascApiKey` it signs with, or else the `asc-api-key` item. It reads
+* the config, and the scheme's files that exist before the native projects
+* are written, and throws, saying why, for a scheme whose build App Store
+* Connect would not take: a simulator `.app`, a Debug configuration, which
+* loads its JavaScript from Metro, code signing turned off, an
+* `.xcarchive` it cannot export, or export options of another method. An
+* `exportOptionsPlist` the adapter's prebuild writes later is checked after
+* it (`assertTestFlightExportOptions`).
 */
-const getDevices = async () => {
-	const tmpPath = path.default.resolve(node_os.default.tmpdir(), "iosPhysicalDevices.json");
-	try {
-		await (0, execa.execa)("xcrun", [
-			"devicectl",
-			"list",
-			"devices",
-			"-j",
-			tmpPath
-		]);
-		const output = JSON.parse(fs.default.readFileSync(tmpPath, "utf8"));
-		return parseDevicectlList(output.result.devices);
-	} catch (error) {
-		throw new Error(`Failed to get devices: ${error}`);
+const resolveTestFlightUploadKey = async ({ scheme, iosScheme }) => {
+	if (iosScheme.simulator) throw new Error(`TestFlight takes an .ipa, and the scheme ${scheme} builds a simulator .app.`);
+	const configuration = iosScheme.configuration ?? "Release";
+	if (/debug$/i.test(configuration)) throw new Error(`TestFlight takes a release build, and the scheme ${scheme} builds the ${configuration} configuration, which loads its JavaScript from Metro.`);
+	const unsigned = await codeSigningOff(iosScheme);
+	if (unsigned) throw new Error(`TestFlight takes a signed .ipa, and the scheme ${scheme} turns code signing off (${unsigned}).`);
+	if (!iosScheme.exportOptionsPlist && !iosScheme.signing) throw new Error(`The scheme ${scheme} archives without exporting an .ipa. Set signing.ascApiKey, or an exportOptionsPlist with the method app-store-connect.`);
+	if (iosScheme.exportOptionsPlist && fs.default.existsSync(schemeFile(iosScheme.exportOptionsPlist))) {
+		const method = await readExportMethod(schemeFile(iosScheme.exportOptionsPlist));
+		if (!APP_STORE_EXPORT_METHODS.has(method)) throw new Error(`TestFlight takes an .ipa exported for App Store Connect, and the scheme ${scheme}'s exportOptionsPlist exports with the method ${method || "(none)"}. Set its method to app-store-connect.`);
 	}
+	return {
+		kind: "asc-api-key",
+		name: iosScheme.signing ? (0, _hot_updater_cli_tools.parseSecretReference)(iosScheme.signing.ascApiKey, "signing.ascApiKey") : "asc-api-key"
+	};
 };
 /**
-* Gets iOS simulators using simctl with JSON output
+* Throws when the scheme's `exportOptionsPlist` exports with another method
+* than App Store Connect's, whose `.ipa` App Store Connect refuses. It reads
+* the file, which an adapter's prebuild may write, so it runs after it.
 */
-const getSimulators = async () => {
+const assertTestFlightExportOptions = async (schemeConfig) => {
+	if (!schemeConfig.exportOptionsPlist) return;
+	const method = await readExportMethod(schemeConfig.exportOptionsPlist);
+	if (!APP_STORE_EXPORT_METHODS.has(method)) throw new Error(`TestFlight takes an .ipa exported for App Store Connect, and the scheme ${schemeConfig.hotUpdaterSchemeName}'s exportOptionsPlist exports with the method ${method || "(none)"}. Set its method to app-store-connect.`);
+};
+/**
+* Requests to the App Store Connect API with `apiKey`: each carries a token
+* signed with its private key, replaced well before it expires.
+*/
+const createAppStoreConnectRequest = ({ apiKey, privateKey, fetch }) => {
+	let token;
+	const authorization = () => {
+		const now = Math.floor(Date.now() / 1e3);
+		if (!token || now - token.issuedAtSeconds >= TOKEN_REUSE_SECONDS) {
+			token = {
+				value: createAppStoreConnectToken({
+					privateKey,
+					keyId: apiKey.keyId,
+					issuerId: apiKey.issuerId,
+					issuedAtSeconds: now
+				}),
+				issuedAtSeconds: now
+			};
+			(0, _hot_updater_cli_tools.registerSecretValue)(token.value);
+		}
+		return `Bearer ${token.value}`;
+	};
+	return async (action, method, pathname, body) => {
+		const response = await fetch(`${API_URL$1}${pathname}`, {
+			method,
+			headers: {
+				Authorization: authorization(),
+				...body ? { "Content-Type": "application/json" } : {}
+			},
+			...body ? { body: JSON.stringify(body) } : {}
+		});
+		if (!response.ok) {
+			const error = new AppStoreConnectError(action, response.status, await readApiErrors(response), response.headers.get("retry-after"));
+			if (response.status === 401) throw new Error("App Store Connect refused the API key: check its key ID and issuer ID, and that the key is not revoked.", { cause: error });
+			if (response.status === 403) throw new Error(`${error.message} An API key with the Admin, App Manager, or Developer role uploads builds.`, { cause: error });
+			throw error;
+		}
+		return response.status === 204 ? void 0 : await response.json();
+	};
+};
+/** The App Store Connect app of `bundleId`, and its TestFlight page. */
+const findApp = async (request, bundleId) => {
+	const { data: apps } = await retrying(() => request("Finding the App Store Connect app", "GET", `/v1/apps?${new URLSearchParams({
+		"filter[bundleId]": bundleId,
+		"fields[apps]": "bundleId"
+	})}`));
+	const app = apps.find((app) => app.attributes?.bundleId === bundleId);
+	if (!app) throw new Error(`App Store Connect has no app with the bundle ID ${bundleId} that this API key can see. Create the app in App Store Connect, or use a key of its team.`);
+	return {
+		app,
+		testFlightUrl: `https://appstoreconnect.apple.com/apps/${app.id}/testflight/ios`
+	};
+};
+/**
+* Whether App Store Connect already has the `.ipa`'s build: a build of its
+* version with its build number, which TestFlight lists or is processing,
+* as when a reused native build was uploaded before. A build upload that
+* never finished is no build, so uploading again fails as it would without
+* this check.
+*/
+const findTestFlightBuild = async ({ ipaPath, apiKey, fetch = globalThis.fetch }) => {
+	const [info, privateKey] = await Promise.all([readIpaInfo(ipaPath), readPrivateKey(apiKey.keyPath)]);
+	const request = createAppStoreConnectRequest({
+		apiKey,
+		privateKey,
+		fetch
+	});
+	const { app, testFlightUrl } = await findApp(request, info.bundleId);
+	const { data: builds } = await retrying(() => request("Finding the build in App Store Connect", "GET", `/v1/builds?${new URLSearchParams({
+		"filter[app]": app.id,
+		"filter[version]": info.bundleVersion,
+		"filter[preReleaseVersion.version]": info.shortVersion,
+		"fields[builds]": "version",
+		limit: "1"
+	})}`));
+	return {
+		found: builds.length > 0,
+		testFlightUrl,
+		shortVersion: info.shortVersion,
+		bundleVersion: info.bundleVersion
+	};
+};
+/**
+* Uploads an `.ipa` to App Store Connect, which lists it in TestFlight, with
+* the App Store Connect API's build uploads: it finds the app by the
+* `.ipa`'s bundle ID, reserves the build's version and build number, sends
+* the file in the parts App Store Connect asks for, commits it, and waits
+* for App Store Connect to accept or reject the build.
+*/
+const uploadToTestFlight = async ({ ipaPath, apiKey, fetch = globalThis.fetch, pollIntervalMs = 5e3, processingTimeoutMs = 18e5 }) => {
+	const ipaName = path.default.basename(ipaPath);
+	const [info, privateKey, { size: fileSize }] = await Promise.all([
+		readIpaInfo(ipaPath),
+		readPrivateKey(apiKey.keyPath),
+		fs.default.promises.stat(ipaPath)
+	]);
+	const request = createAppStoreConnectRequest({
+		apiKey,
+		privateKey,
+		fetch
+	});
+	const { app, testFlightUrl } = await findApp(request, info.bundleId);
+	let buildUploadId;
+	let unanswered = false;
+	for (let attempt = 1; buildUploadId === void 0; attempt++) try {
+		({data: {id: buildUploadId}} = await request("Creating the build upload", "POST", "/v1/buildUploads", { data: {
+			type: "buildUploads",
+			attributes: {
+				platform: "IOS",
+				cfBundleShortVersionString: info.shortVersion,
+				cfBundleVersion: info.bundleVersion
+			},
+			relationships: { app: { data: {
+				type: "apps",
+				id: app.id
+			} } }
+		} }));
+	} catch (error) {
+		if (error instanceof AppStoreConnectError && error.status === 409 && error.errors.some((apiError) => apiError.code === DUPLICATE_ERROR_CODE)) {
+			if (unanswered) throw new Error(`App Store Connect already has build ${info.bundleVersion} of version ${info.shortVersion}, which a request of this upload it did not answer may have reserved. Upload with a new build number (CFBundleVersion).`, { cause: error });
+			throw new TestFlightBuildExistsError(info.shortVersion, info.bundleVersion, { cause: error });
+		}
+		if (!isRetryable(error) || attempt === COMMIT_ATTEMPTS) throw error;
+		if (!isRateLimited(error)) unanswered = true;
+		await sleep(retryDelayMs(error, attempt));
+	}
+	_hot_updater_cli_tools.p.log.info(`Uploading ${ipaName} (version ${info.shortVersion}, build ${info.bundleVersion}) to App Store Connect`);
+	const removeUpload = async () => {
+		for (let attempt = 1;; attempt++) try {
+			await request("Removing the build upload", "DELETE", `/v1/buildUploads/${buildUploadId}`);
+			return;
+		} catch (error) {
+			if (error instanceof AppStoreConnectError && error.status === 404) return;
+			if (!isRetryable(error) || attempt === COMMIT_ATTEMPTS) {
+				_hot_updater_cli_tools.p.log.warn(`App Store Connect kept the unfinished build upload ${buildUploadId}, which reserves build ${info.bundleVersion} of version ${info.shortVersion}: ${error.message} Upload with a new build number (CFBundleVersion).`);
+				return;
+			}
+			await sleep(retryDelayMs(error, attempt));
+		}
+	};
+	let fileId;
 	try {
-		const { stdout } = await (0, execa.execa)("xcrun", [
-			"simctl",
-			"list",
-			"devices",
-			"available",
-			"-j"
-		]);
-		const output = JSON.parse(stdout);
-		return parseSimctlJson(output);
+		const { data } = await retrying(() => request("Reserving the .ipa upload", "POST", "/v1/buildUploadFiles", { data: {
+			type: "buildUploadFiles",
+			attributes: {
+				assetType: "ASSET",
+				fileName: ipaName,
+				fileSize,
+				uti: "com.apple.ipa"
+			},
+			relationships: { buildUpload: { data: {
+				type: "buildUploads",
+				id: buildUploadId
+			} } }
+		} }), isRateLimited);
+		fileId = data.id;
+		const operations = data.attributes?.uploadOperations ?? [];
+		if (operations.length === 0) throw new Error("App Store Connect returned no upload operations.");
+		await uploadParts({
+			ipaPath,
+			operations,
+			fetch
+		});
 	} catch (error) {
-		throw new Error(`Failed to get simulators: ${error}`);
+		await removeUpload();
+		throw error;
+	}
+	let commitUnanswered = false;
+	for (let attempt = 1;; attempt++) try {
+		await request("Committing the .ipa upload", "PATCH", `/v1/buildUploadFiles/${fileId}`, { data: {
+			type: "buildUploadFiles",
+			id: fileId,
+			attributes: { uploaded: true }
+		} });
+		break;
+	} catch (error) {
+		const unconfirmed = () => new Error(`App Store Connect did not confirm the upload of build ${info.bundleVersion}: ${error.message} Check the build in TestFlight before you upload it again: ${testFlightUrl}`, { cause: error });
+		if (!isRetryable(error)) {
+			if (commitUnanswered) throw unconfirmed();
+			await removeUpload();
+			throw error;
+		}
+		commitUnanswered = true;
+		const fileState = await retrying(() => request("Reading the .ipa upload", "GET", `/v1/buildUploadFiles/${fileId}?fields[buildUploadFiles]=assetDeliveryState`)).then(({ data }) => data.attributes?.assetDeliveryState?.state).catch(() => void 0);
+		if (fileState && fileState !== "AWAITING_UPLOAD") break;
+		if (attempt === COMMIT_ATTEMPTS) throw unconfirmed();
+		await sleep(retryDelayMs(error, attempt));
+	}
+	const deadline = Date.now() + processingTimeoutMs;
+	let reportedProcessing = false;
+	let lastError;
+	for (let failedReads = 0;;) {
+		let readError;
+		const read = await request("Reading the build upload", "GET", `/v1/buildUploads/${buildUploadId}`).catch((error) => {
+			if (!isRetryable(error)) throw error;
+			lastError = readError = error;
+		});
+		failedReads = read ? 0 : failedReads + 1;
+		const state = read ? read.data.attributes?.state ?? {} : {};
+		if (state.state === "PROCESSING") reportedProcessing = true;
+		if (!state.state || IN_PROGRESS_STATES.has(state.state)) {
+			if (Date.now() >= deadline) {
+				if (!reportedProcessing) throw new Error(`App Store Connect did not report build ${info.bundleVersion} processing${lastError instanceof Error ? `: ${lastError.message}` : state.state ? ` (${state.state}).` : "."} Check the build in TestFlight: ${testFlightUrl}`, { cause: lastError });
+				_hot_updater_cli_tools.p.log.warn(`App Store Connect is still processing build ${info.bundleVersion}. It appears in TestFlight once processing finishes: ${testFlightUrl}`);
+				return {
+					appId: app.id,
+					buildUploadId,
+					state: "PROCESSING",
+					testFlightUrl,
+					shortVersion: info.shortVersion,
+					bundleVersion: info.bundleVersion
+				};
+			}
+			await sleep(readError === void 0 ? pollIntervalMs : Math.max(pollIntervalMs, retryDelayMs(readError, failedReads)));
+			continue;
+		}
+		for (const warning of describeDetails(state.warnings ?? [])) _hot_updater_cli_tools.p.log.warn(warning);
+		if (state.state !== "COMPLETE") {
+			const errors = describeDetails(state.errors ?? []);
+			throw new Error([`App Store Connect rejected build ${info.bundleVersion} of version ${info.shortVersion} (${state.state}).`, ...errors.map((error) => `- ${error}`)].join("\n"));
+		}
+		return {
+			appId: app.id,
+			buildUploadId,
+			state: "COMPLETE",
+			testFlightUrl,
+			shortVersion: info.shortVersion,
+			bundleVersion: info.bundleVersion
+		};
 	}
 };
 /**
-* Parses simctl JSON output to Device array
+* Sends each part App Store Connect asked for: the bytes at its offset, with
+* only the headers it lists, since the URLs are presigned: another header,
+* or the App Store Connect token, would break their signature.
 */
-const parseSimctlJson = (simctlOutput) => {
-	const devices = [];
-	for (const [runtime, runtimeDevices] of Object.entries(simctlOutput.devices)) {
-		const osVersion = runtime.replace("com.apple.CoreSimulator.SimRuntime.", "").replace(/-/g, " ");
-		const platform = getPlatformFromOsVersion(osVersion.split(" ")[0]);
-		if (!platform) continue;
-		for (const device of runtimeDevices) if (device.isAvailable) devices.push({
-			name: device.name,
-			udid: device.udid,
-			version: osVersion,
-			platform,
-			state: device.state,
-			type: "simulator"
+const uploadParts = async ({ ipaPath, operations, fetch }) => {
+	const file = await fs.default.promises.open(ipaPath, "r");
+	try {
+		await runConcurrently(operations, UPLOAD_CONCURRENCY, async (operation, index) => {
+			const body = Buffer.alloc(operation.length);
+			const { bytesRead } = await file.read(body, 0, operation.length, operation.offset);
+			if (bytesRead !== operation.length) throw new Error(`${path.default.basename(ipaPath)} changed while it was uploading.`);
+			const headers = {};
+			for (const { name, value } of operation.requestHeaders ?? []) headers[name] = value;
+			for (let attempt = 1;; attempt++) {
+				const response = await fetch(operation.url, {
+					method: operation.method,
+					headers,
+					body
+				}).catch((error) => error);
+				if (!(response instanceof Error) && response.ok) return;
+				if (!(response instanceof Error || isRetryableStatus(response.status)) || attempt === UPLOAD_ATTEMPTS) throw new Error(`Uploading part ${index + 1} of ${operations.length} failed: ${response instanceof Error ? response.message : `HTTP ${response.status}`}.`);
+				await sleep(retryDelayMs(response, attempt));
+			}
 		});
+	} finally {
+		await file.close();
 	}
-	return devices;
+};
+//#endregion
+//#region src/utils/ciSigningKeychain.ts
+const API_URL = "https://api.appstoreconnect.apple.com";
+const CERTIFICATES_URL = "https://developer.apple.com/account/resources/certificates/list";
+/** Long enough for any build: the keychain never locks while one runs. */
+const KEYCHAIN_TIMEOUT_SECONDS = 21600;
+const runSecurity = async (args) => (await (0, execa.execa)("security", args)).stdout;
+/** The keychain paths `security` prints, one quoted path per line. */
+const parseKeychains = (stdout) => [...stdout.matchAll(/"([^"]+)"/g)].map((match) => match[1]);
+const normalizeSerial = (serial) => serial.toUpperCase().replace(/^0+(?=.)/, "");
+/** The keychain whose state the process restores if it exits first. */
+let live;
+const restoreLive = () => {
+	live?.restore();
+	live = void 0;
+	process.off("exit", restoreLive);
 };
 /**
-* Maps OS version string to Apple platform
-* @param osVersion - OS version string from devicectl/simctl
-* @returns Apple platform or undefined if unknown
+* Where builds under one macOS user take turns: the default keychain and the
+* search list are the user's, not a process's, so two builds that overlap,
+* such as two self-hosted runner instances, would each restore the other's
+* keychain. It is in the user's caches, whatever TMPDIR a runner sets.
 */
-const getPlatformFromOsVersion = (osVersion) => {
-	switch (osVersion) {
-		case "iOS": return "ios";
-		default: return "ios";
-	}
+const defaultLockPath = () => path.default.join(os.default.homedir(), "Library", "Caches", "hot-updater", "signing-keychain.lock");
+/** lockf's exit code when `-t 0` finds the lock held. */
+const EX_TEMPFAIL = 75;
+/**
+* Holds `lockPath` with macOS's `lockf`, a kernel lock on the file kept by a
+* helper that waits on this process's pipe: the kernel releases it when the
+* helper ends, which is when the pipe closes, so a build that dies, even
+* killed outright, leaves no lock behind and none needs taking over. The
+* helper runs in its own process group, out of reach of a terminal's
+* Ctrl+C, and never keeps this process alive.
+*/
+const holdWithLockf = (lockPath, wait) => new Promise((resolve, reject) => {
+	const child = (0, child_process.spawn)("lockf", [
+		"-k",
+		...wait ? [] : ["-t", "0"],
+		lockPath,
+		"/bin/sh",
+		"-c",
+		"echo held; exec cat >/dev/null"
+	], {
+		detached: true,
+		stdio: [
+			"pipe",
+			"pipe",
+			"ignore"
+		]
+	});
+	let held = false;
+	child.stdout.once("data", () => {
+		held = true;
+		child.unref();
+		child.stdin.unref?.();
+		child.stdout.unref?.();
+		const exited = new Promise((done) => child.once("exit", () => done()));
+		resolve(async () => {
+			child.ref();
+			child.stdin.end();
+			await exited;
+		});
+	});
+	child.once("error", reject);
+	child.once("exit", (code) => {
+		if (held) return;
+		if (!wait && code === EX_TEMPFAIL) resolve(void 0);
+		else reject(/* @__PURE__ */ new Error(`lockf ${lockPath} exited with ${code}.`));
+	});
+});
+const acquireWithLockf = async (lockPath) => {
+	await fs.default.promises.mkdir(path.default.dirname(lockPath), { recursive: true });
+	const release = await holdWithLockf(lockPath, false);
+	if (release) return release;
+	_hot_updater_cli_tools.p.log.info("Waiting for another build that signs in a keychain of its own under this macOS user.");
+	return await holdWithLockf(lockPath, true);
 };
 /**
-* Lists devices and simulators for a specific platform
-* @param platform - Apple platform to filter by
-* @param options - Filtering options
-* @returns Array of devices filtered by options
+* Creates the build's keychain and makes it the user's default keychain,
+* first in the search list, ahead of the keychains already there, so Xcode
+* still finds a signing identity a self-hosted runner keeps and creates a
+* new one only when it has none.
 */
-const listDevices = async (platform, options = {}) => {
-	const spinner = _hot_updater_cli_tools.p.spinner();
-	spinner.start(`Discovering ${platform} devices`);
+const createSigningKeychain = async ({ security = runSecurity, directory = os.default.tmpdir(), lockPath = defaultLockPath(), acquireLock = acquireWithLockf } = {}) => {
+	if (live) throw new Error("A signing keychain is already in use by this process.");
+	live = { restore: () => void 0 };
+	let releaseLock;
 	try {
-		const [simulators, devices] = await Promise.all([getSimulators(), getDevices().catch(() => [])]);
-		let allDevices = [...devices, ...simulators].filter((device) => device.platform === platform);
-		if (options.deviceType) allDevices = allDevices.filter((d) => d.type === options.deviceType);
-		if (options.state && options.state !== "all") allDevices = allDevices.filter((d) => d.state === options.state);
-		spinner.stop(`Found ${allDevices.length} ${platform} devices`);
-		return allDevices;
+		releaseLock = await acquireLock(lockPath);
 	} catch (error) {
-		spinner.stop(`Failed to discover ${platform} devices`);
+		live = void 0;
 		throw error;
 	}
-};
-const matchingDevice = (devices, deviceArg, options = {}) => {
-	let filtered = [...devices];
-	if (options.deviceType) filtered = filtered.filter((d) => d.type === options.deviceType);
-	if (options.bootedOnly) filtered = filtered.filter((d) => d.state === "Booted");
-	const byName = filtered.find((d) => d.name === deviceArg);
-	if (byName) return byName;
-	const byFormattedName = filtered.find((d) => formatDeviceName(d) === deviceArg);
-	if (byFormattedName) return byFormattedName;
-	const byUdid = filtered.find((d) => d.udid === deviceArg);
-	if (byUdid) return byUdid;
-};
-const formatDeviceName = (device) => {
-	return device.version ? `${device.name} (${device.version})` : device.name;
-};
-const selectTargetDevice = async ({ platform, interactive, deviceOption }) => {
-	const availableDevices = await listDevices(platform);
-	if (deviceOption === true && !interactive) {
-		_hot_updater_cli_tools.p.log.error("you can't select device manually with non-interactive cli mode(without -i option).");
-		process.exit(1);
+	process.on("exit", restoreLive);
+	let originalDefault;
+	let originalSearchList;
+	try {
+		[originalDefault] = parseKeychains(await security([
+			"default-keychain",
+			"-d",
+			"user"
+		]).catch(() => ""));
+		originalSearchList = parseKeychains(await security([
+			"list-keychains",
+			"-d",
+			"user"
+		]));
+	} catch (error) {
+		restoreLive();
+		await releaseLock();
+		throw error;
 	}
-	if (typeof deviceOption === "string") {
-		const matchedDevice = matchingDevice(availableDevices, deviceOption);
-		if (!matchedDevice) {
-			_hot_updater_cli_tools.p.log.error(`device '${deviceOption}' isn't included in the attached devices.`);
-			process.exit(1);
+	const keychainPath = path.default.join(directory, `hot-updater-${crypto.default.randomBytes(6).toString("hex")}.keychain-db`);
+	const password = crypto.default.randomBytes(24).toString("base64url");
+	(0, _hot_updater_cli_tools.registerSecretValue)(password);
+	const restoreArgs = [
+		...originalDefault ? [[
+			"default-keychain",
+			"-d",
+			"user",
+			"-s",
+			originalDefault
+		]] : [],
+		[
+			"list-keychains",
+			"-d",
+			"user",
+			"-s",
+			...originalSearchList
+		],
+		["delete-keychain", keychainPath]
+	];
+	live = { restore: () => {
+		for (const args of restoreArgs) (0, child_process.spawnSync)("security", args);
+	} };
+	let disposal;
+	const dispose = () => {
+		disposal ??= (async () => {
+			const failures = [];
+			for (const args of restoreArgs) await security(args).catch((error) => {
+				failures.push(`security ${args[0]}: ${error instanceof Error ? error.message : String(error)}`);
+			});
+			live = void 0;
+			process.off("exit", restoreLive);
+			await releaseLock().catch(() => void 0);
+			if (failures.length > 0) _hot_updater_cli_tools.p.log.warn(`Restoring the keychains after the build failed (${failures.join("; ")}). Check \`security list-keychains -d user\` and \`security default-keychain -d user\`, and delete ${keychainPath} if it is left.`);
+		})();
+		return disposal;
+	};
+	try {
+		await security([
+			"create-keychain",
+			"-p",
+			password,
+			keychainPath
+		]);
+		await security([
+			"set-keychain-settings",
+			"-lut",
+			String(KEYCHAIN_TIMEOUT_SECONDS),
+			keychainPath
+		]);
+		await security([
+			"unlock-keychain",
+			"-p",
+			password,
+			keychainPath
+		]);
+		await security([
+			"list-keychains",
+			"-d",
+			"user",
+			"-s",
+			keychainPath,
+			...originalSearchList.filter((keychain) => keychain !== keychainPath)
+		]);
+		await security([
+			"default-keychain",
+			"-d",
+			"user",
+			"-s",
+			keychainPath
+		]);
+	} catch (error) {
+		await dispose();
+		throw error;
+	}
+	return {
+		path: keychainPath,
+		certificates: async () => {
+			return ((await security([
+				"find-certificate",
+				"-a",
+				"-p",
+				keychainPath
+			])).match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g) ?? []).map((pem) => {
+				const certificate = new crypto.default.X509Certificate(pem);
+				return {
+					serialNumber: normalizeSerial(certificate.serialNumber),
+					commonName: certificate.subject.match(/^CN=(.*)$/m)?.[1] ?? certificate.subject
+				};
+			});
+		},
+		dispose
+	};
+};
+/**
+* Revokes the certificates Xcode created in the build's keychain, whose
+* private keys the keychain's deletion destroys: on a runner that starts
+* empty, Xcode creates a development certificate for every build, and App
+* Store Connect refuses new ones once a team has its maximum. Each is found
+* in the team's certificates by serial number. A revocation that fails is
+* reported with where to revoke it by hand, and never fails the build.
+*/
+const revokeKeychainCertificates = async ({ certificates, apiKey, privateKey, fetch = globalThis.fetch }) => {
+	const revoked = [];
+	const failed = [];
+	if (certificates.length === 0) return {
+		revoked,
+		failed
+	};
+	const describe = ({ commonName, serialNumber }) => `${commonName} (serial ${serialNumber})`;
+	try {
+		const token = createAppStoreConnectToken({
+			privateKey: privateKey ?? crypto.default.createPrivateKey(await fs.default.promises.readFile(apiKey.keyPath, "utf-8")),
+			keyId: apiKey.keyId,
+			issuerId: apiKey.issuerId
+		});
+		(0, _hot_updater_cli_tools.registerSecretValue)(token);
+		const headers = { Authorization: `Bearer ${token}` };
+		const idsBySerial = /* @__PURE__ */ new Map();
+		let next = `${API_URL}/v1/certificates?${new URLSearchParams({
+			"fields[certificates]": "serialNumber",
+			limit: "200"
+		})}`;
+		while (next) {
+			const response = await fetch(next, { headers });
+			if (!response.ok) throw new Error(`Listing the team's certificates failed (HTTP ${response.status}).`);
+			const body = await response.json();
+			for (const { id, attributes } of body.data ?? []) if (attributes?.serialNumber) idsBySerial.set(normalizeSerial(attributes.serialNumber), id);
+			next = body.links?.next;
 		}
-		return matchedDevice;
+		for (const certificate of certificates) {
+			const id = idsBySerial.get(certificate.serialNumber);
+			if (id === void 0) continue;
+			const response = await fetch(`${API_URL}/v1/certificates/${id}`, {
+				method: "DELETE",
+				headers
+			});
+			if (response.ok || response.status === 404) revoked.push(describe(certificate));
+			else failed.push(`${describe(certificate)}: HTTP ${response.status}`);
+		}
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : String(error);
+		for (const certificate of certificates) if (!revoked.includes(describe(certificate))) failed.push(`${describe(certificate)}: ${reason}`);
 	}
-	if (interactive) {
-		if (!availableDevices.length) {
-			_hot_updater_cli_tools.p.log.error("you passed -d option but there is no attached devices.");
-			process.exit(1);
+	if (revoked.length > 0) _hot_updater_cli_tools.p.log.info(`Revoked the signing certificates Xcode created for this build, whose keys the build's keychain held: ${revoked.join(", ")}.`);
+	if (failed.length > 0) _hot_updater_cli_tools.p.log.warn(`Revoking the signing certificates Xcode created for this build failed, and their keys are deleted with the build's keychain: ${failed.join("; ")}. Revoke them at ${CERTIFICATES_URL}, since App Store Connect stops creating certificates at a team's maximum.`);
+	return {
+		revoked,
+		failed
+	};
+};
+const TERMINATION_SIGNALS = [
+	"SIGHUP",
+	"SIGINT",
+	"SIGTERM"
+];
+/**
+* Runs `run`, the archive and export of a build that signs with an App
+* Store Connect API key, in a keychain of its own when `enabled` (in CI),
+* then revokes the certificates Xcode created in it and deletes it. A
+* termination signal does the same before the process ends with it: the
+* certificates are read from the keychain before it is deleted, and the key
+* is read into memory first, since the build's temporary key file is deleted
+* on the signal. A second signal restores the keychains at once.
+*/
+const withSigningKeychain = async ({ enabled, apiKey, run, security, lockPath, acquireLock, fetch }) => {
+	if (!enabled) return run();
+	const privateKey = crypto.default.createPrivateKey(await fs.default.promises.readFile(apiKey.keyPath, "utf-8"));
+	const keychain = await createSigningKeychain({
+		security,
+		lockPath,
+		acquireLock
+	});
+	_hot_updater_cli_tools.p.log.info("Signing in a keychain of this build's own, deleted when it ends (CI is set).");
+	let cleanup;
+	const release = () => {
+		cleanup ??= (async () => {
+			const certificates = await keychain.certificates().catch(() => []);
+			await keychain.dispose();
+			await revokeKeychainCertificates({
+				certificates,
+				apiKey,
+				privateKey,
+				fetch
+			});
+		})();
+		return cleanup;
+	};
+	const stopListening = () => {
+		for (const signal of TERMINATION_SIGNALS) process.off(signal, onSignal);
+	};
+	const onSignal = (signal) => {
+		if (cleanup) {
+			stopListening();
+			restoreLive();
+			process.kill(process.pid, signal);
+			return;
 		}
-		const device = await _hot_updater_cli_tools.p.select({
-			message: "Target Device",
-			options: availableDevices.map((d) => ({
-				value: d,
-				label: `${d.name} (${d.type}) - ${d.state}`,
-				hint: d.udid
-			}))
+		release().finally(() => {
+			stopListening();
+			if (process.listenerCount(signal) === 0) process.kill(process.pid, signal);
 		});
-		if (_hot_updater_cli_tools.p.isCancel(device)) process.exit(1);
-		return device;
+	};
+	for (const signal of TERMINATION_SIGNALS) process.on(signal, onSignal);
+	try {
+		return await run();
+	} finally {
+		await release();
+		stopListening();
 	}
-	const bootedDevices = await listDevices(platform, { state: "Booted" });
-	if (bootedDevices.length > 0) return bootedDevices[0];
 };
-const Device = {
-	listDevices,
-	selectTargetDevice
+//#endregion
+//#region src/utils/readBuiltApp.ts
+const readInfoValue = async (infoPlist, key) => {
+	const { stdout, exitCode } = await (0, execa.execa)("plutil", [
+		"-extract",
+		key,
+		"raw",
+		"-o",
+		"-",
+		infoPlist
+	], { reject: false });
+	return exitCode === 0 && stdout.trim() ? stdout.trim() : null;
+};
+/**
+* What the built `.app` reports at runtime, from its Info.plist: the
+* `CFBundleShortVersionString`, `CFBundleVersion` (the build number) and
+* `HOT_UPDATER_CHANNEL` the build settings,
+* an `xcconfig` and `extraParams` expanded.
+*/
+const readBuiltApp = async (appPath) => {
+	const infoPlist = path.default.join(appPath, "Info.plist");
+	const [appVersion, channel, buildNumber] = await Promise.all([
+		readInfoValue(infoPlist, "CFBundleShortVersionString"),
+		readInfoValue(infoPlist, "HOT_UPDATER_CHANNEL"),
+		readInfoValue(infoPlist, "CFBundleVersion")
+	]);
+	return {
+		appVersion,
+		channel,
+		buildNumber
+	};
 };
 //#endregion
-//#region src/runIos.ts
-const runIos = async ({ schemeConfig, runOption }) => {
-	const { interactive, device: deviceOption } = runOption;
-	const iosProjectPath = path.default.join((0, _hot_updater_cli_tools.getCwd)(), "ios");
-	const device = await Device.selectTargetDevice({
-		platform: "ios",
-		deviceOption,
-		interactive
-	});
-	if (!device) {
-		const simulators = await Device.listDevices("ios", { deviceType: "simulator" });
-		if (simulators.length === 0) {
-			_hot_updater_cli_tools.p.log.error("No simulators found. Please create a simulator in Xcode.");
+//#region src/buildIos.ts
+/**
+* Builds a simulator `.app` for a `simulator` scheme, and otherwise archives
+* and exports an `.ipa`, or returns the `.xcarchive` of a scheme it cannot
+* export: one with neither `exportOptionsPlist` nor `signing.ascApiKey`.
+*/
+const buildIos = async ({ schemeConfig, minBundleId = (0, _hot_updater_cli_tools.createMinBundleId)(), credentials }) => {
+	await assertXcodebuildExist();
+	const iosProjectRoot = path.default.join((0, _hot_updater_cli_tools.getCwd)(), "ios");
+	const buildDirectory = await createRandomTmpDir();
+	await fs.default.promises.mkdir(path.default.join(buildDirectory, "archive"), { recursive: true });
+	if (schemeConfig.simulator) {
+		if (schemeConfig.destination.length) {
+			_hot_updater_cli_tools.p.log.error("The scheme option 'simulator' is not compatible with the 'destination' option.");
 			process.exit(1);
 		}
-		_hot_updater_cli_tools.p.log.info(`Using first available simulator: ${simulators[0].name}`);
-		const selectedDevice = simulators[0];
-		_hot_updater_cli_tools.p.log.info(`Building for ${selectedDevice.name}...`);
-		const result = await buildXcodeProject({
-			sourceDir: iosProjectPath,
+		const appDir = path.default.join(buildDirectory, "app");
+		await fs.default.promises.mkdir(appDir, { recursive: true });
+		const { appPath } = await buildXcodeProject({
+			sourceDir: iosProjectRoot,
+			logPrefix: `ios-${schemeConfig.hotUpdaterSchemeName}-build`,
 			platform: schemeConfig.platform,
 			xcodeScheme: schemeConfig.scheme,
 			configuration: schemeConfig.configuration,
-			deviceType: selectedDevice.type,
-			destination: [{ id: selectedDevice.udid }],
+			deviceType: "simulator",
 			installPods: schemeConfig.installPods,
 			extraParams: schemeConfig.extraParams,
-			logPrefix: `ios-${schemeConfig.hotUpdaterSchemeName}-run`
+			useGenericDestination: true,
+			minBundleId
 		});
-		const runnerOptions = {
-			bundleIdentifier: schemeConfig.bundleIdentifier,
-			sourceDir: iosProjectPath,
-			launch: true,
-			infoPlistPath: result.infoPlistPath
+		const finalAppPath = path.default.join(appDir, path.default.basename(appPath));
+		await fs.default.promises.cp(appPath, finalAppPath, { recursive: true });
+		_hot_updater_cli_tools.p.log.success(`.app file created: ${path.default.basename(appPath)}`);
+		return {
+			buildDirectory,
+			buildArtifactPath: finalAppPath,
+			builtApp: await readBuiltApp(finalAppPath)
 		};
-		await installAndLaunchOnSimulator({
-			device: selectedDevice,
-			appPath: result.appPath,
-			options: runnerOptions
+	} else {
+		const signing = await resolveXcodeSigning({
+			schemeConfig,
+			credentials
+		});
+		if (!signing) return archiveAndExport({
+			schemeConfig,
+			minBundleId,
+			buildDirectory
+		});
+		const appStoreConnect = await exportsForAppStoreConnect(schemeConfig);
+		if ((0, _hot_updater_cli_tools.isCI)() && !appStoreConnect) _hot_updater_cli_tools.p.log.info("This export isn't for App Store Connect, so it signs in the runner's own keychains and keeps the certificates Xcode creates.");
+		return withSigningKeychain({
+			enabled: (0, _hot_updater_cli_tools.isCI)() && appStoreConnect,
+			apiKey: signing.apiKey,
+			run: () => archiveAndExport({
+				schemeConfig,
+				minBundleId,
+				buildDirectory,
+				authenticationArgs: signing.authenticationArgs
+			})
 		});
-		_hot_updater_cli_tools.p.outro("Success 🎉");
-		return result;
 	}
-	_hot_updater_cli_tools.p.log.info(`Building for ${device.name}...`);
-	const result = await buildXcodeProject({
-		sourceDir: iosProjectPath,
+};
+/**
+* Archives a device build and exports its `.ipa`, or returns the
+* `.xcarchive` of a scheme it cannot export.
+*/
+const archiveAndExport = async ({ schemeConfig, minBundleId, buildDirectory, authenticationArgs }) => {
+	const iosProjectRoot = path.default.join((0, _hot_updater_cli_tools.getCwd)(), "ios");
+	const archiveDir = path.default.join(buildDirectory, "archive");
+	const exportDir = path.default.join(buildDirectory, "export");
+	const { archivePath } = await archiveXcodeProject({
+		authenticationArgs,
+		minBundleId,
 		platform: schemeConfig.platform,
+		sourceDir: iosProjectRoot,
+		xcconfig: schemeConfig.xcconfig,
 		xcodeScheme: schemeConfig.scheme,
+		destination: schemeConfig.destination,
+		extraParams: schemeConfig.extraParams,
 		configuration: schemeConfig.configuration,
-		deviceType: device.type,
-		destination: [{ id: device.udid }],
 		installPods: schemeConfig.installPods,
-		extraParams: schemeConfig.extraParams,
-		logPrefix: `ios-${schemeConfig.hotUpdaterSchemeName}-run`
+		logPrefix: `ios-${schemeConfig.hotUpdaterSchemeName}-build-archive`
 	});
-	const runnerOptions = {
-		bundleIdentifier: schemeConfig.bundleIdentifier,
-		sourceDir: iosProjectPath,
-		launch: true
-	};
-	if (device.type === "simulator") await installAndLaunchOnSimulator({
-		device,
-		appPath: result.appPath,
-		options: {
-			...runnerOptions,
-			infoPlistPath: result.infoPlistPath
-		}
-	});
-	else await installAndLaunchOnDevice({
-		device,
-		appPath: result.appPath,
-		options: runnerOptions
+	const finalArchivePath = path.default.join(archiveDir, path.default.basename(archivePath));
+	await fs.default.promises.cp(archivePath, finalArchivePath, { recursive: true });
+	const appFromArchive = extractAppFromXcarchive(finalArchivePath);
+	const archivedAppPath = appFromArchive ? path.default.join(archiveDir, path.default.basename(appFromArchive)) : void 0;
+	if (appFromArchive && archivedAppPath) {
+		await fs.default.promises.cp(appFromArchive, archivedAppPath, { recursive: true });
+		_hot_updater_cli_tools.p.log.success(".app extracted from .xcarchive");
+	}
+	if (!schemeConfig.exportOptionsPlist && !authenticationArgs) return {
+		buildDirectory,
+		buildArtifactPath: finalArchivePath,
+		builtApp: archivedAppPath ? await readBuiltApp(archivedAppPath) : void 0
+	};
+	await fs.default.promises.mkdir(exportDir, { recursive: true });
+	const exportOptionsPlist = schemeConfig.exportOptionsPlist ?? await writeAppStoreConnectExportOptions(await createRandomTmpDir());
+	const { exportPath } = await exportXcodeArchive({
+		archivePath,
+		authenticationArgs,
+		exportExtraParams: schemeConfig.exportExtraParams,
+		exportOptionsPlist,
+		sourceDir: iosProjectRoot,
+		logPrefix: `ios-${schemeConfig.hotUpdaterSchemeName}-build-export`
 	});
-	_hot_updater_cli_tools.p.outro("Success 🎉");
-	return result;
+	await fs.default.promises.cp(exportPath, exportDir, { recursive: true });
+	const ipaFile = fs.default.readdirSync(exportDir).find((file) => file.endsWith(".ipa"));
+	if (!ipaFile) throw new Error("IPA file not found after export");
+	return {
+		buildDirectory,
+		buildArtifactPath: path.default.join(exportDir, ipaFile),
+		builtApp: archivedAppPath ? await readBuiltApp(archivedAppPath) : void 0
+	};
+};
+const extractAppFromXcarchive = (archivePath) => {
+	const productsPath = path.default.join(archivePath, "Products", "Applications");
+	if (!fs.default.existsSync(productsPath)) return;
+	const appFile = fs.default.readdirSync(productsPath).find((file) => file.endsWith(".app"));
+	if (appFile) return path.default.join(productsPath, appFile);
+	_hot_updater_cli_tools.p.log.warn("Failed to extract .app from xcarchive");
 };
 //#endregion
 //#region src/utils/enrichNativeBuildIosScheme.ts
@@ -1009,6 +2252,71 @@ const enrichNativeBuildIosScheme = async ({ scheme, hotUpdaterSchemeName }) => {
 	};
 };
 //#endregion
+//#region src/utils/extractBuiltInBundle.ts
+/** The file React Native's Xcode build phase writes into the `.app`. */
+const BUILT_IN_BUNDLE = "main.jsbundle";
+/**
+* Copies the JavaScript bundle React Native's Xcode build phase wrote into a
+* `.app` or an `.ipa` (`Payload/<App>.app/main.jsbundle`) to `outputPath`:
+* the built-in bundle, byte for byte, which no rebuild reproduces.
+*/
+const extractBuiltInBundle = async ({ artifactPath, outputPath }) => {
+	await fs.default.promises.mkdir(path.default.dirname(outputPath), { recursive: true });
+	if (path.default.extname(artifactPath) === ".app") {
+		const source = path.default.join(artifactPath, BUILT_IN_BUNDLE);
+		if (!fs.default.existsSync(source)) throw new Error(`${path.default.basename(artifactPath)} has no ${BUILT_IN_BUNDLE}. A debug build loads its bundle from Metro instead.`);
+		await fs.default.promises.copyFile(source, outputPath);
+		return;
+	}
+	const { stdout } = await (0, execa.execa)("unzip", ["-Z1", artifactPath]);
+	const entry = stdout.split("\n").find((name) => /^Payload\/[^/]+\.app\/main\.jsbundle$/u.test(name.trim()))?.trim();
+	if (entry === void 0) throw new Error(`${path.default.basename(artifactPath)} has no Payload/<App>.app/${BUILT_IN_BUNDLE}.`);
+	await (0, execa.execa)("unzip", [
+		"-p",
+		artifactPath,
+		escapeUnzipPattern(entry)
+	], { stdout: { file: outputPath } });
+};
+/**
+* Unpacks a `.app` that `archiveAppBundle` stored as one zip file into
+* `outputPath`, which then holds the `.app` directory.
+*/
+const extractAppBundle = async ({ archivePath, outputPath }) => {
+	await fs.default.promises.mkdir(outputPath, { recursive: true });
+	await (0, execa.execa)("ditto", [
+		"-x",
+		"-k",
+		archivePath,
+		outputPath
+	]);
+};
+/**
+* A `.app` directory as one zip file, the way Finder and Xcode archive it,
+* so a simulator build uploads and downloads as a single artifact.
+*/
+const archiveAppBundle = async ({ appPath, outputPath }) => {
+	await fs.default.promises.mkdir(path.default.dirname(outputPath), { recursive: true });
+	await fs.default.promises.rm(outputPath, { force: true });
+	await (0, execa.execa)("ditto", [
+		"-c",
+		"-k",
+		"--sequesterRsrc",
+		"--keepParent",
+		appPath,
+		outputPath
+	]);
+};
+//#endregion
+exports.ASC_INTEGRATIONS_URL = ASC_INTEGRATIONS_URL;
+exports.TestFlightBuildExistsError = TestFlightBuildExistsError;
+exports.archiveAppBundle = archiveAppBundle;
+exports.assertTestFlightExportOptions = assertTestFlightExportOptions;
 exports.buildIos = buildIos;
 exports.enrichNativeBuildIosScheme = enrichNativeBuildIosScheme;
-exports.runIos = runIos;
+exports.extractAppBundle = extractAppBundle;
+exports.extractBuiltInBundle = extractBuiltInBundle;
+exports.findTestFlightBuild = findTestFlightBuild;
+exports.installPodsIfNeeded = installPodsIfNeeded;
+exports.issueAscApiKey = issueAscApiKey;
+exports.resolveTestFlightUploadKey = resolveTestFlightUploadKey;
+exports.uploadToTestFlight = uploadToTestFlight;