@hot-updater/apple-helper 1.2.0-rc.0 → 1.2.0-rc.10

package/dist/index.cjs

@@ -23,209 +23,572 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 //#endregion
 let node_crypto = require("node:crypto");
 node_crypto = __toESM(node_crypto, 1);
-let node_fs = require("node:fs");
-let node_fs_promises = require("node:fs/promises");
-node_fs_promises = __toESM(node_fs_promises, 1);
-let node_net = require("node:net");
-node_net = __toESM(node_net, 1);
-let node_os = require("node:os");
-node_os = __toESM(node_os, 1);
-let node_path = require("node:path");
-node_path = __toESM(node_path, 1);
+let node_timers_promises = require("node:timers/promises");
 let _hot_updater_cli_tools = require("@hot-updater/cli-tools");
-let execa = require("execa");
 let fs = require("fs");
 fs = __toESM(fs, 1);
 let path = require("path");
 path = __toESM(path, 1);
+let execa = require("execa");
+let node_fs = require("node:fs");
+let node_fs_promises = require("node:fs/promises");
+let node_os = require("node:os");
+let node_path = require("node:path");
 let child_process = require("child_process");
 let crypto = require("crypto");
 crypto = __toESM(crypto, 1);
 let os = require("os");
 os = __toESM(os, 1);
-//#region src/asc/ascCli.ts
+//#region src/asc/appleSrp.ts
+/**
+* Apple's sign-in proof: SRP-6a over the RFC 5054 2048-bit group with
+* SHA-256, the password stretched with PBKDF2, as Apple's sign-in page and
+* asc, the open-source App Store Connect CLI
+* (https://github.com/rorkai/App-Store-Connect-CLI, MIT), compute it.
+*/
+/** RFC 5054, Appendix A, the 2048-bit group. */
+const N = BigInt("0xAC6BDB41324A9A9BF166DE5E1389582FAF72B6651987EE07FC3192943DB56050A37329CBB4A099ED8193E0757767A13DD52312AB4B03310DCD7F48A9DA04FD50E8083969EDB767B0CF6095179A163AB3661A05FBD5FAAAE82918A9962F0B93B855F97993EC975EEAA80D740ADBF4FF747359D041D5C33EA71D281E446B14773BCA97B43A23FB801676BD207A436C6481F1D2B9078717461A5B9D32E688F87748544523B524B0D57D5EA77A2775D2ECFA032CFBDBF52FB3786160279004E57AE6AF874E7303CE53299CCC041C7BC308D82A5698F3A8D0C38271AE35F8E9DBFBB694B5C803D89F7AE435DE236D525F54759B65E372FCD68EF20FA7111F9E4AFF73");
+const G = 2n;
+/** The hex length every padded value has: N's byte length, twice. */
+const PADDED_HEX_LENGTH = 512;
+const modPow = (base, exponent, modulus) => {
+	let result = 1n;
+	let b = (base % modulus + modulus) % modulus;
+	let e = exponent;
+	while (e > 0n) {
+		if (e & 1n) result = result * b % modulus;
+		b = b * b % modulus;
+		e >>= 1n;
+	}
+	return result;
+};
+/** An even-length lowercase hex of `value`, as the proof hashes it. */
+const toHex = (value) => {
+	const hex = value.toString(16);
+	return hex.length % 2 === 1 ? `0${hex}` : hex;
+};
+const fromBytes = (bytes) => bytes.length === 0 ? 0n : BigInt(`0x${Buffer.from(bytes).toString("hex")}`);
+const sha256Hex = (hex) => node_crypto.default.createHash("sha256").update(Buffer.from(hex, "hex")).digest("hex");
+/** SHA-256 of each value left-padded to N's length, as a number mod N. */
+const paddedHash = (...values) => BigInt(`0x${sha256Hex(values.map((value) => value.padStart(PADDED_HEX_LENGTH, "0")).join(""))}`) % N;
+/** The password as the protocol Apple named feeds it to PBKDF2. */
+const preparePassword = (password, protocol) => {
+	const digest = node_crypto.default.createHash("sha256").update(password).digest();
+	if (protocol === "s2k") return digest;
+	if (protocol === "s2k_fo") return Buffer.from(digest.toString("hex"));
+	throw new Error(`Apple asked for the sign-in protocol ${protocol}.`);
+};
+/** A new SRP client; `secret` is the private value a, random unless set. */
+const createSrpClient = (secret = fromBytes(node_crypto.default.randomBytes(256))) => {
+	const A = modPow(G, secret, N);
+	const aHex = toHex(A);
+	return {
+		a: Buffer.from(aHex, "hex").toString("base64"),
+		proof: ({ accountName, password, protocol, iterations, salt, b }) => {
+			const saltBytes = Buffer.from(salt, "base64");
+			const saltHex = saltBytes.toString("hex");
+			const bHex = Buffer.from(b, "base64").toString("hex");
+			const B = BigInt(`0x${bHex || "0"}`);
+			if (B % N === 0n) throw new Error("Apple answered an invalid SRP value.");
+			const derived = node_crypto.default.pbkdf2Sync(preparePassword(password, protocol), saltBytes, iterations, 32, "sha256");
+			const x = BigInt(`0x${sha256Hex(saltHex + sha256Hex(`3a${derived.toString("hex")}`))}`);
+			const k = paddedHash(toHex(N), toHex(G));
+			const u = paddedHash(aHex, bHex);
+			if (u === 0n) throw new Error("Apple answered an invalid SRP value.");
+			const S = modPow(B - k * modPow(G, x, N) % N, secret + u * x, N);
+			const K = sha256Hex(toHex(S));
+			const m1 = sha256Hex(toHex(paddedHash(toHex(N)) ^ paddedHash(toHex(G))) + node_crypto.default.createHash("sha256").update(accountName).digest("hex") + saltHex + aHex + bHex + K);
+			const m2 = toHex(BigInt(`0x${sha256Hex(aHex + m1 + K)}`));
+			return {
+				m1: Buffer.from(m1, "hex").toString("base64"),
+				m2: Buffer.from(m2, "hex").toString("base64")
+			};
+		}
+	};
+};
+const hasLeadingZeroBits = (digest, bits) => {
+	const full = Math.floor(bits / 8);
+	for (let index = 0; index < full; index++) if (digest[index] !== 0) return false;
+	const rest = bits % 8;
+	return rest === 0 || (digest[full] & 255 << 8 - rest & 255) === 0;
+};
+/**
+* The hashcash stamp Apple's sign-in asks for in `X-Apple-HC`: the first
+* `1:<bits>:<date>:<challenge>::<counter>` whose SHA-1 starts with `bits`
+* zero bits.
+*/
+const makeHashcash = (bits, challenge, now = /* @__PURE__ */ new Date()) => {
+	const date = now.toISOString().replace(/\.\d+Z$/u, "").replaceAll(/[-:T]/gu, "");
+	for (let counter = 0;; counter++) {
+		const stamp = `1:${bits}:${date}:${challenge}::${counter}`;
+		const digest = node_crypto.default.createHash("sha1").update(stamp).digest();
+		if (hasLeadingZeroBits(digest, bits)) return stamp;
+	}
+};
+//#endregion
+//#region src/asc/appleSignIn.ts
 /**
-* The release of asc, the open-source App Store Connect CLI
-* (https://github.com/rorkai/App-Store-Connect-CLI, MIT), that signs in with
-* an Apple Account and issues App Store Connect API keys for Hot Updater. An
-* `asc` on PATH is used when it is at least this version.
+* Signing in to App Store Connect with an Apple Account, as its web page
+* does: Apple's SRP sign-in at idmsa.apple.com, its two-factor check, then
+* App Store Connect's session. The endpoints and their headers follow asc,
+* the open-source App Store Connect CLI
+* (https://github.com/rorkai/App-Store-Connect-CLI, MIT), 5.16.1, whose
+* internal/web/auth.go has signed in this way against Apple.
 */
-const ASC_CLI_VERSION = "5.16.1";
+const AUTH_URL = "https://idmsa.apple.com/appleauth/auth";
+const ASC_URL = "https://appstoreconnect.apple.com";
+const SESSION_URL = `${ASC_URL}/olympus/v1/session`;
 /**
-* The SHA-256 of each macOS binary of the release, from its
-* asc_5.16.1_checksums.txt. Pinned here, so a download is trusted only when
-* it is the exact binary this version of Hot Updater was written against.
+* The public widget key App Store Connect's sign-in page ships, used when
+* neither place Apple publishes the current one answers. Not a credential.
 */
-const ASC_CLI_SHA256 = {
-	arm64: "85a848ef33fe3490adc4f0348af30b7bbf95209a258dac06c735318f62495707",
-	x64: "5a978732e0c2f2b673da601568c489dfaa232ae32c93dcfa63b95f0b892a2580"
-};
-const ASC_RELEASE_ASSET = {
-	arm64: `asc_${ASC_CLI_VERSION}_macOS_arm64`,
-	x64: `asc_${ASC_CLI_VERSION}_macOS_amd64`
-};
-const ASC_RELEASE_URL = `https://github.com/rorkai/App-Store-Connect-CLI/releases/download/${ASC_CLI_VERSION}`;
-const INSTALL_HINT = `Install asc ${ASC_CLI_VERSION} or later with \`brew install asc\` (https://github.com/rorkai/App-Store-Connect-CLI), then run the command again.`;
-/** asc could not be found, downloaded, or verified. */
-var AscCliUnavailableError = class extends Error {
+const ASC_WIDGET_KEY = "e0b80c3bf78523bfe80974d320935bfa30add02e1bff88ec2166c6bd5a706c42";
+/** Signing in, or a request in the signed-in session, failed. */
+var AppleSignInError = class extends Error {
+	status;
+	/** The response body, for messages that depend on what Apple said. */
+	body;
 	constructor(message, options) {
-		super(message, options);
-		this.name = "AscCliUnavailableError";
+		super(message, options?.cause ? { cause: options.cause } : void 0);
+		this.name = "AppleSignInError";
+		this.status = options?.status;
+		this.body = options?.body;
 	}
 };
-const parseVersion = (output) => {
-	const match = /(\d+)\.(\d+)\.(\d+)/u.exec(output);
-	return match ? match.slice(1, 4).map(Number) : void 0;
+/**
+* A cookie jar for the sign-in's requests, as a browser keeps one: `fetch`
+* keeps none, and Apple's session is its cookies.
+*/
+const createCookieJar = () => {
+	let cookies = [];
+	const live = () => {
+		const now = Date.now();
+		cookies = cookies.filter((cookie) => cookie.expires === void 0 || cookie.expires > now);
+		return cookies;
+	};
+	return {
+		store(url, response) {
+			for (const header of response.headers.getSetCookie()) {
+				const [pair = "", ...attributes] = header.split(";");
+				const separator = pair.indexOf("=");
+				if (separator <= 0) continue;
+				const name = pair.slice(0, separator).trim();
+				const value = pair.slice(separator + 1).trim();
+				let domain = url.hostname;
+				let hostOnly = true;
+				let path = "/";
+				let expires;
+				let maxAge;
+				for (const attribute of attributes) {
+					const index = attribute.indexOf("=");
+					const key = (index === -1 ? attribute : attribute.slice(0, index)).trim().toLowerCase();
+					const raw = index === -1 ? "" : attribute.slice(index + 1).trim();
+					if (key === "domain" && raw) {
+						const candidate = raw.replace(/^\./u, "").toLowerCase();
+						if (url.hostname !== candidate && !url.hostname.endsWith(`.${candidate}`)) {
+							domain = "";
+							break;
+						}
+						domain = candidate;
+						hostOnly = false;
+					} else if (key === "path" && raw.startsWith("/")) path = raw;
+					else if (key === "expires") {
+						const time = Date.parse(raw);
+						if (!Number.isNaN(time)) expires = time;
+					} else if (key === "max-age" && /^-?\d+$/u.test(raw)) maxAge = Number(raw);
+				}
+				if (!domain) continue;
+				if (maxAge !== void 0) expires = Date.now() + maxAge * 1e3;
+				cookies = cookies.filter((cookie) => !(cookie.name === name && cookie.domain === domain && cookie.path === path));
+				if (expires === void 0 || expires > Date.now()) cookies.push({
+					name,
+					value,
+					domain,
+					hostOnly,
+					path,
+					expires
+				});
+			}
+		},
+		header(url) {
+			const matching = live().filter((cookie) => (cookie.hostOnly ? url.hostname === cookie.domain : url.hostname === cookie.domain || url.hostname.endsWith(`.${cookie.domain}`)) && (url.pathname === cookie.path || url.pathname.startsWith(cookie.path.endsWith("/") ? cookie.path : `${cookie.path}/`)));
+			return matching.length === 0 ? void 0 : matching.map((cookie) => `${cookie.name}=${cookie.value}`).join("; ");
+		},
+		clear() {
+			cookies = [];
+		}
+	};
+};
+const REDIRECTS = /* @__PURE__ */ new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+/** `fetch` with the jar's cookies, following redirects itself to keep them. */
+const createClient = (fetch) => {
+	const jar = createCookieJar();
+	const request = async (url, init = {}) => {
+		let current = new URL(url);
+		let method = init.method ?? "GET";
+		let body = init.body;
+		for (let hop = 0; hop < 10; hop++) {
+			const headers = new Headers(init.headers);
+			const cookie = jar.header(current);
+			if (cookie) headers.set("Cookie", cookie);
+			const response = await fetch(current, {
+				method,
+				headers,
+				...body === void 0 ? {} : { body },
+				redirect: "manual"
+			});
+			jar.store(current, response);
+			const location = response.headers.get("location");
+			if (!REDIRECTS.has(response.status) || !location) return response;
+			await response.text();
+			current = new URL(location, current);
+			if (response.status === 303 || response.status !== 307 && response.status !== 308 && method === "POST") {
+				method = "GET";
+				body = void 0;
+			}
+		}
+		throw new AppleSignInError(`${url} redirected too many times.`);
+	};
+	return {
+		request,
+		clear: jar.clear
+	};
 };
-const isAtLeast = (version, minimum) => {
-	for (let index = 0; index < minimum.length; index++) {
-		const part = version[index] ?? 0;
-		if (part !== minimum[index]) return part > minimum[index];
+const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const text$1 = (value) => typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+const parseJson = (body) => {
+	try {
+		return JSON.parse(body);
+	} catch {
+		return;
 	}
-	return true;
 };
-const sha256Of = (file) => new Promise((resolve, reject) => {
-	const hash = node_crypto.default.createHash("sha256");
-	(0, node_fs.createReadStream)(file).on("data", (chunk) => hash.update(chunk)).on("error", reject).on("end", () => resolve(hash.digest("hex")));
+/** What Apple's sign-in said went wrong, from its `serviceErrors`. */
+const serviceErrors = (body) => {
+	const parsed = parseJson(body);
+	const errors = isRecord$1(parsed) && Array.isArray(parsed.serviceErrors) ? parsed.serviceErrors.filter(isRecord$1) : [];
+	return {
+		codes: errors.map((error) => text$1(error.code)).filter(Boolean),
+		message: errors.map((error) => text$1(error.message)).find(Boolean)
+	};
+};
+const failure = (step, response, body) => new AppleSignInError(`${step} failed (HTTP ${response.status}).${serviceErrors(body).message ? `\n${serviceErrors(body).message}` : ""}`, {
+	status: response.status,
+	body
 });
-/** Where a downloaded asc is kept, per user, so every project shares it. */
-const defaultAscCacheDir = () => node_path.default.join(node_os.default.homedir(), "Library", "Caches", "hot-updater");
 /**
-* Finds asc: the `asc` on PATH when it is at least `ASC_CLI_VERSION`, else
-* the pinned release in `cacheDir`, downloaded from GitHub on first use and
-* verified against its pinned SHA-256 each time it is used. Only macOS has
-* one: TestFlight builds need Xcode.
+* The widget key Apple's sign-in wants: from the sign-out redirect App Store
+* Connect answers without cookies, else its config, else the one its page
+* ships.
 */
-const findAscCli = async ({ cacheDir = defaultAscCacheDir(), fetch = globalThis.fetch, platform = process.platform, arch = process.arch, pathCommand = "asc" } = {}) => {
-	if (platform !== "darwin") throw new AscCliUnavailableError("Signing in with an Apple Account to issue an App Store Connect API key runs on macOS, where iOS builds run.");
-	const minimum = parseVersion(ASC_CLI_VERSION);
-	const onPath = await (0, execa.execa)(pathCommand, ["--version"], {
-		reject: false,
-		env: { ASC_TELEMETRY_DISABLED: "1" },
-		timeout: 15e3
+const findWidgetKey = async (fetch, client) => {
+	const signOut = await fetch(`${ASC_URL}/logout`, {
+		method: "HEAD",
+		redirect: "manual"
 	}).catch(() => void 0);
-	const pathVersion = onPath?.exitCode === 0 ? parseVersion(onPath.stdout) : void 0;
-	if (pathVersion && isAtLeast(pathVersion, minimum)) return {
-		path: pathCommand,
-		version: pathVersion.join("."),
-		source: "path"
+	const location = signOut?.headers.get("location");
+	if (signOut && REDIRECTS.has(signOut.status) && location) {
+		const url = (() => {
+			try {
+				return new URL(location);
+			} catch {
+				return;
+			}
+		})();
+		const keys = url?.searchParams.getAll("widgetKey") ?? [];
+		if (url?.protocol === "https:" && url.hostname === "idmsa.apple.com" && url.pathname === "/appleauth/signout" && keys.length === 1 && keys[0].trim()) return keys[0].trim();
+	}
+	const config = await client.request(`${ASC_URL}/olympus/v1/app/config?hostname=itunesconnect.apple.com`);
+	const body = await config.text();
+	if (config.status === 404) return ASC_WIDGET_KEY;
+	const parsed = parseJson(body);
+	const key = isRecord$1(parsed) ? text$1(parsed.authServiceKey) ?? text$1(parsed.serviceKey) : void 0;
+	if (!config.ok || !key) throw new AppleSignInError(`Couldn't load Apple's sign-in configuration (HTTP ${config.status}).`, { status: config.status });
+	return key;
+};
+const hashcash = async (client, widgetKey) => {
+	const response = await client.request(`${AUTH_URL}/signin?widgetKey=${encodeURIComponent(widgetKey)}`, { headers: { Accept: "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" } });
+	await response.text();
+	if (!response.ok) throw new AppleSignInError(`Loading Apple's sign-in page failed (HTTP ${response.status}).`, { status: response.status });
+	const bits = response.headers.get("x-apple-hc-bits")?.trim();
+	const challenge = response.headers.get("x-apple-hc-challenge")?.trim();
+	if (!bits || !challenge) return void 0;
+	if (!/^\d+$/u.test(bits) || Number(bits) > 32) throw new AppleSignInError(`Apple asked for a hashcash of ${bits} bits.`);
+	return makeHashcash(Number(bits), challenge);
+};
+const pendingHeaders = (pending) => ({
+	"X-Apple-ID-Session-Id": pending.sessionId,
+	"X-Apple-Widget-Key": pending.widgetKey,
+	scnt: pending.scnt,
+	Accept: "application/json"
+});
+/** Apple rotates `scnt` and the session ID; each request sends the latest. */
+const track = (pending, response) => {
+	const scnt = response.headers.get("scnt")?.trim();
+	const sessionId = response.headers.get("x-apple-id-session-id")?.trim();
+	if (scnt) pending.scnt = scnt;
+	if (sessionId) pending.sessionId = sessionId;
+};
+const CANCELLED = "Signing in was cancelled.";
+const twoFactor = async (client, pending, prompts) => {
+	const send = async (url, method, payload) => {
+		const response = await client.request(url, {
+			method,
+			headers: {
+				...pendingHeaders(pending),
+				...payload === void 0 ? {} : { "Content-Type": "application/json" }
+			},
+			...payload === void 0 ? {} : { body: JSON.stringify(payload) }
+		});
+		track(pending, response);
+		return {
+			response,
+			body: await response.text()
+		};
 	};
-	const asset = ASC_RELEASE_ASSET[arch];
-	const expected = ASC_CLI_SHA256[arch];
-	if (!asset || !expected) throw new AscCliUnavailableError(`asc publishes no macOS binary for ${arch}. ${INSTALL_HINT}`);
-	const binary = node_path.default.join(cacheDir, "asc", ASC_CLI_VERSION, asset);
-	if (await sha256Of(binary).catch(() => void 0) === expected) return {
-		path: binary,
-		version: ASC_CLI_VERSION,
-		source: "cache"
+	const options = await send(AUTH_URL, "GET");
+	if (!options.response.ok) throw failure("Loading the two-factor options", options.response, options.body);
+	const parsed = parseJson(options.body);
+	const phone = (isRecord$1(parsed) && Array.isArray(parsed.trustedPhoneNumbers) ? parsed.trustedPhoneNumbers.filter(isRecord$1) : []).filter((phone) => typeof phone.id === "number")[0];
+	const noDevices = isRecord$1(parsed) && parsed.noTrustedDevices === true;
+	if (noDevices && !phone) throw new AppleSignInError("The Apple Account has no trusted device or phone number for two-factor codes.");
+	const phoneMode = text$1(phone?.pushMode) ?? "sms";
+	const destination = text$1(phone?.numberWithDialCode);
+	const securityCode = isRecord$1(parsed) && isRecord$1(parsed.securityCode) ? parsed.securityCode.length : void 0;
+	const length = typeof securityCode === "number" && securityCode > 0 ? securityCode : 6;
+	const textCode = async () => {
+		const requested = await send(`${AUTH_URL}/verify/phone`, "PUT", {
+			phoneNumber: { id: phone.id },
+			mode: phoneMode
+		});
+		if (!requested.response.ok) throw failure("Texting a two-factor code", requested.response, requested.body);
 	};
-	await node_fs_promises.default.mkdir(node_path.default.dirname(binary), { recursive: true });
-	const partial = `${binary}.${process.pid}.download`;
-	try {
-		let response;
-		try {
-			response = await fetch(`${ASC_RELEASE_URL}/${asset}`, { redirect: "follow" });
-		} catch (error) {
-			throw new AscCliUnavailableError(`Could not download asc ${ASC_CLI_VERSION} from GitHub (${error instanceof Error ? error.message : String(error)}). ${INSTALL_HINT}`, { cause: error });
+	const verify = async (via, code) => {
+		const verified = via === "device" ? await send(`${AUTH_URL}/verify/trusteddevice/securitycode`, "POST", { securityCode: { code } }) : await send(`${AUTH_URL}/verify/phone/securitycode`, "POST", {
+			securityCode: { code },
+			phoneNumber: { id: phone.id },
+			mode: phoneMode
+		});
+		if (verified.response.ok) return true;
+		if ([
+			400,
+			401,
+			403
+		].includes(verified.response.status)) return false;
+		throw failure("Checking the two-factor code", verified.response, verified.body);
+	};
+	const ask = async (via, afterWrongCode) => {
+		const code = await prompts.twoFactorCode({
+			via,
+			destination,
+			textsOnWrongCode: via === "device" && phone !== void 0,
+			afterWrongCode,
+			length
+		});
+		if (code === void 0) throw new AppleSignInError(CANCELLED);
+		return code;
+	};
+	let accepted;
+	if (noDevices) {
+		await textCode();
+		accepted = await verify("sms", await ask("sms", false));
+	} else {
+		accepted = await verify("device", await ask("device", false));
+		if (!accepted && phone) {
+			await textCode();
+			accepted = await verify("sms", await ask("sms", true));
 		}
-		if (!response.ok || !response.body) throw new AscCliUnavailableError(`Could not download asc ${ASC_CLI_VERSION} from GitHub (HTTP ${response.status}). ${INSTALL_HINT}`);
-		await node_fs_promises.default.writeFile(partial, Buffer.from(await response.arrayBuffer()), { mode: 448 });
-		const actual = await sha256Of(partial);
-		if (actual !== expected) throw new AscCliUnavailableError(`The downloaded asc ${ASC_CLI_VERSION} does not match its published SHA-256 (expected ${expected}, got ${actual}), so it was deleted and not run. ${INSTALL_HINT}`);
-		await node_fs_promises.default.chmod(partial, 493);
-		await node_fs_promises.default.rename(partial, binary);
-	} finally {
-		await node_fs_promises.default.rm(partial, { force: true });
 	}
+	if (!accepted) throw new AppleSignInError("Apple rejected the verification code.");
+	const trust = await send(`${AUTH_URL}/2sv/trust`, "GET");
+	if (!trust.response.ok) throw failure("Finishing the two-factor check", trust.response, trust.body);
+};
+const parseProvider = (value) => {
+	if (!isRecord$1(value) || typeof value.providerId !== "number") return void 0;
+	const publicProviderId = text$1(value.publicProviderId);
+	if (!publicProviderId) return void 0;
 	return {
-		path: binary,
-		version: ASC_CLI_VERSION,
-		source: "download"
+		providerId: value.providerId,
+		publicProviderId,
+		name: text$1(value.name)
 	};
 };
-//#endregion
-//#region src/asc/ascCliKeyIssuer.ts
-/** An asc command failed; its message is asc's own, which it printed too. */
-var AscCommandError = class extends Error {
-	exitCode;
-	constructor(message, exitCode, options) {
-		super(message, options);
-		this.name = "AscCommandError";
-		this.exitCode = exitCode;
-	}
+const readSession = async (client) => {
+	const response = await client.request(SESSION_URL, { headers: { Accept: "application/json" } });
+	const body = await response.text();
+	if (!response.ok) throw new AppleSignInError(response.status === 401 || response.status === 403 ? "App Store Connect didn't accept the sign-in. Check that the Apple Account is in an Apple Developer team." : `Loading the App Store Connect session failed (HTTP ${response.status}).`, {
+		status: response.status,
+		body
+	});
+	const parsed = parseJson(body);
+	const provider = isRecord$1(parsed) ? parseProvider(parsed.provider) : void 0;
+	if (!isRecord$1(parsed) || !provider) throw new AppleSignInError("App Store Connect's session names no team for the Apple Account.");
+	const providers = (Array.isArray(parsed.availableProviders) ? parsed.availableProviders : []).map(parseProvider).filter((value) => value !== void 0);
+	return {
+		provider,
+		providers: providers.some((value) => value.providerId === provider.providerId) ? providers : [provider, ...providers]
+	};
 };
-const TERMINATION_SIGNALS$2 = [
-	"SIGHUP",
-	"SIGINT",
-	"SIGTERM"
-];
 /**
-* A 0700 directory holding asc's whole state for one sign-in (its web
-* session, config, and the downloaded `.p8`), removed by `dispose`, on
-* `exit`, or on a termination signal, so nothing outlives the sign-in.
+* Signs in to App Store Connect with `appleId` and `password`, asking
+* `prompts` for the two-factor code. The session lives only in the returned
+* object's memory.
 */
-const createWorkDirectory = async () => {
-	const root = await node_fs_promises.default.mkdtemp(node_path.default.join(node_os.default.tmpdir(), "hot-updater-asc-"));
-	await node_fs_promises.default.chmod(root, 448);
-	const remove = () => (0, node_fs.rmSync)(root, {
-		force: true,
-		recursive: true
-	});
-	const onSignal = (signal) => {
-		stop();
-		remove();
-		if (process.listenerCount(signal) === 0) process.kill(process.pid, signal);
-	};
-	const stop = () => {
-		process.off("exit", remove);
-		for (const signal of TERMINATION_SIGNALS$2) process.off(signal, onSignal);
-	};
-	process.on("exit", remove);
-	for (const signal of TERMINATION_SIGNALS$2) process.on(signal, onSignal);
-	for (const directory of [
-		"home",
-		"session",
-		"keys"
-	]) await node_fs_promises.default.mkdir(node_path.default.join(root, directory), { mode: 448 });
-	let disposal;
-	return {
-		root,
-		dispose: () => {
-			disposal ??= (async () => {
-				stop();
-				await node_fs_promises.default.rm(root, {
-					force: true,
-					recursive: true
-				});
+const signInToAppStoreConnect = async ({ appleId, password, prompts, fetch = globalThis.fetch }) => {
+	const client = createClient(fetch);
+	try {
+		const widgetKey = await findWidgetKey(fetch, client);
+		const json = {
+			"Content-Type": "application/json",
+			"X-Apple-Widget-Key": widgetKey,
+			"X-Requested-With": "XMLHttpRequest",
+			Accept: "application/json, text/javascript"
+		};
+		const srp = createSrpClient();
+		const init = await client.request(`${AUTH_URL}/signin/init`, {
+			method: "POST",
+			headers: json,
+			body: JSON.stringify({
+				accountName: appleId,
+				protocols: ["s2k", "s2k_fo"],
+				a: srp.a
+			})
+		});
+		const initBody = await init.text();
+		if (!init.ok) throw failure("Starting the sign-in", init, initBody);
+		const started = parseJson(initBody);
+		if (!isRecord$1(started) || typeof started.iteration !== "number" || !text$1(started.salt) || !text$1(started.b) || !text$1(started.protocol)) throw new AppleSignInError("Apple's sign-in answered no SRP challenge.");
+		const { m1, m2 } = srp.proof({
+			accountName: appleId,
+			password,
+			protocol: text$1(started.protocol),
+			iterations: started.iteration,
+			salt: text$1(started.salt),
+			b: text$1(started.b)
+		});
+		const stamp = await hashcash(client, widgetKey);
+		const complete = await client.request(`${AUTH_URL}/signin/complete?isRememberMeEnabled=false`, {
+			method: "POST",
+			headers: {
+				...json,
+				...stamp ? { "X-Apple-HC": stamp } : {}
+			},
+			body: JSON.stringify({
+				accountName: appleId,
+				rememberMe: false,
+				m1,
+				m2,
+				c: started.c
+			})
+		});
+		const completeBody = await complete.text();
+		if (complete.status === 409) {
+			const sessionId = complete.headers.get("x-apple-id-session-id")?.trim();
+			const scnt = complete.headers.get("scnt")?.trim();
+			if (!sessionId || !scnt) throw new AppleSignInError("Apple asked for a two-factor code without a sign-in session.");
+			await twoFactor(client, {
+				widgetKey,
+				sessionId,
+				scnt
+			}, prompts);
+		} else if (!complete.ok) {
+			const { codes } = serviceErrors(completeBody);
+			const authType = (() => {
+				const parsed = parseJson(completeBody);
+				return isRecord$1(parsed) ? text$1(parsed.authType) : void 0;
 			})();
-			return disposal;
+			if (complete.status === 401 && codes.includes("-20101")) throw new AppleSignInError("Apple rejected the email or password.", { status: 401 });
+			if (complete.status === 412 && authType && [
+				"sa",
+				"hsa",
+				"non-sa",
+				"hsa2"
+			].includes(authType)) throw new AppleSignInError("The Apple Account has a pending prompt. Sign in at https://appstoreconnect.apple.com once, then run this again.", { status: 412 });
+			throw failure("Signing in", complete, completeBody);
 		}
-	};
+		let { provider, providers } = await readSession(client);
+		return {
+			appleId,
+			get provider() {
+				return provider;
+			},
+			get providers() {
+				return providers;
+			},
+			selectProvider: async (publicProviderId) => {
+				if (provider.publicProviderId === publicProviderId) return provider;
+				const selected = providers.find((value) => value.publicProviderId === publicProviderId);
+				if (!selected) throw new AppleSignInError(`The Apple Account is in no team ${publicProviderId}.`);
+				const response = await client.request(SESSION_URL, {
+					method: "POST",
+					headers: {
+						"Content-Type": "application/json",
+						"X-Requested-With": "olympus-ui"
+					},
+					body: JSON.stringify({ provider: { providerId: selected.providerId } })
+				});
+				const body = await response.text();
+				if (!response.ok) throw new AppleSignInError(`Switching to the team ${selected.name ?? publicProviderId} failed (HTTP ${response.status}).`, {
+					status: response.status,
+					body
+				});
+				({provider, providers} = await readSession(client));
+				if (provider.providerId !== selected.providerId) throw new AppleSignInError(`App Store Connect stayed in the team ${provider.name ?? provider.publicProviderId}.`);
+				return provider;
+			},
+			request: client.request,
+			clear: client.clear
+		};
+	} catch (error) {
+		client.clear();
+		throw error;
+	}
 };
+//#endregion
+//#region src/asc/programLicenseAgreement.ts
 /**
-* asc's environment: the caller's, without any `ASC_*` variable (such as a
-* saved password, a 2FA code command, or another API key), and with every
-* file asc keeps (home, config, web session) in `root`. Passwords are never
-* stored, the keychain is bypassed, and telemetry is off.
+* What to do when Apple holds a team's requests until the Account Holder
+* accepts the latest Apple Developer Program License Agreement: App Store
+* Connect answers 403, and xcodebuild prints "PLA Update available".
 */
-const ascEnvironment = (root, base = process.env) => {
-	const env = {};
-	for (const [name, value] of Object.entries(base)) if (!name.startsWith("ASC_") && name !== "DO_NOT_TRACK") env[name] = value;
-	return {
-		...env,
-		HOME: node_path.default.join(root, "home"),
-		XDG_CONFIG_HOME: node_path.default.join(root, "home", ".config"),
-		XDG_CACHE_HOME: node_path.default.join(root, "home", ".cache"),
-		ASC_CONFIG_PATH: node_path.default.join(root, "home", "config.json"),
-		ASC_WEB_SESSION_CACHE_DIR: node_path.default.join(root, "session"),
-		ASC_WEB_SESSION_CACHE_BACKEND: "file",
-		ASC_WEB_DONT_STORE_PASSWORD: "1",
-		ASC_BYPASS_KEYCHAIN: "1",
-		ASC_TELEMETRY_DISABLED: "1",
-		ASC_SPINNER_DISABLED: "1"
-	};
-};
+const PROGRAM_LICENSE_AGREEMENT_HINT = ["The Account Holder must accept the latest Program License Agreement:", "https://developer.apple.com/account"].join("\n");
+/** The code App Store Connect answers a team with a pending agreement. */
+const AGREEMENT_ERROR_CODE = "FORBIDDEN.REQUIRED_AGREEMENTS_MISSING_OR_EXPIRED";
+/**
+* Whether App Store Connect's JSON:API errors say the team has a Program
+* License Agreement to accept, by its code or its detail.
+*/
+const isProgramLicenseAgreementError = (errors) => errors.some(({ code, detail, title }) => code === AGREEMENT_ERROR_CODE || /Program License Agreement/iu.test(`${detail ?? ""} ${title ?? ""}`));
+/** Whether xcodebuild's output says the team has an agreement to accept. */
+const mentionsProgramLicenseAgreement = (output) => output.includes("PLA Update available");
+//#endregion
+//#region src/asc/ascKeyIssuer.ts
+const IRIS_URL = "https://appstoreconnect.apple.com/iris/v1";
+/**
+* The headers App Store Connect's Integrations page sends its API with. A
+* function: `ascApiKey` imports this module, so its constants aren't set
+* yet when this module loads.
+*/
+const irisHeaders = () => ({
+	Accept: "application/vnd.api+json, application/json, text/csv",
+	"Content-Type": "application/json",
+	"X-CSRF-ITC": "[asc-ui]",
+	Origin: "https://appstoreconnect.apple.com",
+	Referer: ASC_INTEGRATIONS_URL
+});
 const answer = (value) => _hot_updater_cli_tools.p.isCancel(value) ? void 0 : value;
+/** One line: where the code went, and where a wrong one sends the next. */
+const twoFactorMessage = (request) => {
+	const phone = request.destination ?? "your trusted phone";
+	if (request.via === "sms") return `${request.afterWrongCode ? "Wrong code. " : ""}Code texted to ${phone}`;
+	return request.textsOnWrongCode ? `Code on your Apple device (wrong code texts ${phone})` : "Code on your Apple device";
+};
 /** Hot Updater's own prompts, so the sign-in looks like the rest of the CLI. */
 const cliPrompts = {
 	password: async (appleId) => answer(await _hot_updater_cli_tools.p.password({
@@ -233,65 +596,53 @@ const cliPrompts = {
 		mask: "•",
 		validate: (value) => value ? void 0 : "Enter the password."
 	})),
-	twoFactorCode: async (attempt) => answer(await _hot_updater_cli_tools.p.text({
-		message: attempt === 1 ? "Two-factor code from your trusted device (no device at hand? enter any wrong code once, and Apple texts one to your phone)" : "Verification code Apple sent to your phone",
-		validate: (value) => /^\d{6}$/u.test(value?.trim() ?? "") ? void 0 : "Enter the 6-digit code."
+	twoFactorCode: async (request) => answer(await _hot_updater_cli_tools.p.text({
+		message: twoFactorMessage(request),
+		validate: (value) => new RegExp(`^\\d{${request.length}}$`, "u").test(value?.trim() ?? "") ? void 0 : `Enter the ${request.length}-digit code.`
 	}))?.trim()
 };
-/** `value` as one word for `sh`. */
-const shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
-/**
-* A two-factor code command for asc that asks `prompts` in this process:
-* asc runs it when Apple wants a code, and it prints what the developer
-* typed, which it gets over a socket in the 0700 work directory. A
-* cancelled prompt makes it print nothing and fail, which stops the sign-in.
-*/
-const listenForTwoFactorCodes = async (root, prompts) => {
-	const socketPath = node_path.default.join(root, "2fa.sock");
-	const scriptPath = node_path.default.join(root, "two-factor-code.cjs");
-	await node_fs_promises.default.writeFile(scriptPath, [
-		"const socket = require(\"node:net\").connect(" + JSON.stringify(socketPath) + ");",
-		"let code = \"\";",
-		"socket.on(\"data\", (chunk) => { code += chunk; });",
-		"socket.on(\"end\", () => {",
-		"  code = code.trim();",
-		"  if (!code) process.exit(1);",
-		"  process.stdout.write(code + \"\\n\");",
-		"});",
-		"socket.on(\"error\", () => process.exit(1));",
-		""
-	].join("\n"), { mode: 384 });
-	let attempts = 0;
-	let cancelled = false;
-	const server = node_net.default.createServer((socket) => {
-		attempts += 1;
-		prompts.twoFactorCode(attempts).then((code) => {
-			if (!code) cancelled = true;
-			socket.end(code ? `${code}\n` : "");
-		}, () => {
-			cancelled = true;
-			socket.destroy();
-		});
-	});
-	await new Promise((resolve, reject) => {
-		server.once("error", reject);
-		server.listen(socketPath, resolve);
-	});
-	return {
-		command: `${shellQuote(process.execPath)} ${shellQuote(scriptPath)}`,
-		cancelled: () => cancelled,
-		close: () => new Promise((resolve) => server.close(() => resolve()))
-	};
-};
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const text = (value) => typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
-/** The last line of asc's error output, which names what failed. */
-const lastLine = (stderr) => stderr.split("\n").map((line) => line.trim()).filter(Boolean).at(-1);
-/** What to do about a key asc could not create, by what App Store Connect said. */
-const createFailureHint = (stderr) => {
-	if (/agreement/iu.test(stderr)) return "The Apple Developer Program License Agreement has changed: the Account Holder accepts it at https://developer.apple.com/account, then run this again.";
-	if (/limit|maximum/iu.test(stderr)) return `The team has as many active API keys as App Store Connect allows: revoke one you no longer use at ${ASC_INTEGRATIONS_URL}, then run this again.`;
-	if (/account holder|admin|permission|forbidden|not allowed|403/iu.test(stderr)) return "Creating an App Store Connect API key needs the Account Holder or Admin role in the team: sign in with such an Apple Account, or ask one to run this.";
+const toTeam = (appleId, provider) => ({
+	appleId,
+	teamId: provider.publicProviderId,
+	...provider.name ? { name: provider.name } : {}
+});
+/** What App Store Connect's API said went wrong, from its JSON:API errors. */
+const irisDetail = (body) => {
+	try {
+		const parsed = JSON.parse(body);
+		if (!isRecord(parsed) || !Array.isArray(parsed.errors)) return void 0;
+		return parsed.errors.filter(isRecord).map((error) => text(error.detail) ?? text(error.title)).find(Boolean);
+	} catch {
+		return;
+	}
+};
+/** What to do about a key App Store Connect would not create. */
+const createFailureHint = (status, body) => {
+	if (/agreement/iu.test(body)) return PROGRAM_LICENSE_AGREEMENT_HINT;
+	if (/limit|maximum/iu.test(body)) return `The team has the most API keys App Store Connect allows. Revoke one at:\n${ASC_INTEGRATIONS_URL}`;
+	if (status === 403 || /account holder|admin|permission/iu.test(body)) return "Creating an API key needs the Account Holder or Admin role in the team.";
+};
+const irisRequest = async (session, step, method, path, payload) => {
+	const response = await session.request(`${IRIS_URL}${path}`, {
+		method,
+		headers: irisHeaders(),
+		...payload === void 0 ? {} : { body: JSON.stringify(payload) }
+	});
+	const body = await response.text();
+	if (!response.ok) {
+		const detail = irisDetail(body);
+		throw new AppleSignInError(`${step} failed (HTTP ${response.status}).${detail ? `\n${detail}` : ""}`, {
+			status: response.status,
+			body
+		});
+	}
+	try {
+		const parsed = JSON.parse(body);
+		if (isRecord(parsed) && isRecord(parsed.data)) return parsed.data;
+	} catch {}
+	throw new AppleSignInError(`${step} answered no API key.`, { status: response.status });
 };
 /** A P-256 private key, as App Store Connect issues one, or a thrown error. */
 const assertP8 = (p8) => {
@@ -299,144 +650,108 @@ const assertP8 = (p8) => {
 	try {
 		key = node_crypto.default.createPrivateKey(p8);
 	} catch {
-		throw new Error("asc saved a .p8 that is not a private key.");
+		throw new Error("App Store Connect sent a .p8 that is not a private key.");
+	}
+	if (key.asymmetricKeyType !== "ec" || key.asymmetricKeyDetails?.namedCurve !== "prime256v1") throw new Error("App Store Connect sent a .p8 that is not a P-256 private key.");
+};
+/** The one-time `.p8`; a key App Store Connect hasn't settled yet is retried. */
+const downloadP8 = async (session, keyId, wait) => {
+	for (let attempt = 1;; attempt++) try {
+		const data = await irisRequest(session, "Downloading the key's .p8", "GET", `/apiKeys/${encodeURIComponent(keyId)}?${new URLSearchParams({ "fields[apiKeys]": "privateKey" })}`);
+		const encoded = isRecord(data.attributes) ? text(data.attributes.privateKey) : void 0;
+		if (text(data.id) !== keyId || !encoded) throw new Error("App Store Connect sent no .p8 for the key.");
+		return Buffer.from(encoded, "base64").toString("utf-8").trim();
+	} catch (error) {
+		if (!(error instanceof AppleSignInError && error.status !== void 0 && (error.status === 404 || error.status === 409 || error.status === 429 || error.status >= 500)) || attempt === 3) throw error;
+		await wait(attempt * 1e3);
 	}
-	if (key.asymmetricKeyType !== "ec") throw new Error("asc saved a .p8 that is not an EC private key.");
+};
+const issuerOf = (data) => {
+	const attributes = isRecord(data.attributes) ? data.attributes : {};
+	const relationships = isRecord(data.relationships) ? data.relationships : {};
+	const related = isRecord(relationships.provider) ? relationships.provider.data : void 0;
+	return (isRecord(attributes.provider) ? text(attributes.provider.id) : void 0) ?? (isRecord(related) ? text(related.id) : void 0);
 };
 /**
-* `IssueAscApiKey` with asc, the open-source App Store Connect CLI
-* (https://github.com/rorkai/App-Store-Connect-CLI, MIT):
+* `IssueAscApiKey` by signing in as App Store Connect's web page does
+* (`signInToAppStoreConnect`) and creating the key with the API its
+* Integrations page uses:
 *
-* 1. `asc web auth login` signs in with the password and the two-factor
-*    codes typed into Hot Updater's prompts. The password reaches only that
-*    asc process, in its environment (never an argument), each code only
-*    asc's two-factor code command, and neither is kept or printed.
-* 2. `chooseTeam` sees the team asc signed in to, unless `teamId` is set.
-* 3. `asc web api-keys create` issues the key and saves its one-time `.p8`,
-*    which is checked before it is handed out; a key that fails the check is
-*    revoked at once.
-* 4. `revoke` runs `asc web api-keys revoke` in the same session.
+* 1. The password typed into Hot Updater's prompt goes only to Apple's SRP
+*    sign-in, which sends a proof of it, never the password; the two-factor
+*    code goes only to Apple's check. Neither is kept or printed.
+* 2. `chooseTeam` sees the teams the Apple Account is in, unless `teamId`
+*    is set.
+* 3. The key is created, its one-time `.p8` downloaded and checked; a key
+*    that fails the check is revoked at once.
+* 4. `revoke` deactivates the key in the same session.
 *
-* asc's whole state (its web session, config, and the `.p8`) lives in a
-* temporary 0700 directory, which `dispose` deletes, as does the process
-* exiting first.
+* The session is cookies in this process's memory, which `dispose` drops.
 *
-* @param asc The asc binary; found or downloaded with `findAscCli` unless set.
-* @param env The environment asc's own is derived from.
+* @param fetch Where requests go, Apple unless set.
 * @param prompts Where the password and two-factor codes are asked.
+* @param wait How a retried download waits.
 */
-const createAscCliKeyIssuer = ({ asc, env = process.env, prompts = cliPrompts } = {}) => async ({ name, role, appleId, teamId, chooseTeam }) => {
-	const cli = asc ?? await findAscCli();
-	_hot_updater_cli_tools.p.log.info("Hot Updater signs in with asc, the open-source App Store Connect CLI. It keeps only the API key it issues: neither the password nor the session.");
+const createAscKeyIssuer = ({ fetch = globalThis.fetch, prompts = cliPrompts, wait = node_timers_promises.setTimeout } = {}) => async ({ name, role, appleId, teamId, chooseTeam }) => {
+	if (!appleId) throw new AppleSignInError("Signing in needs the Apple Account's email.");
+	_hot_updater_cli_tools.p.log.info("Signing in to App Store Connect. Only the issued key is kept.");
 	const password = await prompts.password(appleId);
-	if (password === void 0) throw new AscCommandError("Signing in was cancelled.", void 0);
+	if (password === void 0) throw new AppleSignInError("Signing in was cancelled.");
 	(0, _hot_updater_cli_tools.registerSecretValue)(password);
-	const work = await createWorkDirectory();
-	const ascEnv = ascEnvironment(work.root, env);
-	const run = async (step, args, extraEnv = {}) => {
-		const result = await (0, execa.execa)(cli.path, args, {
-			env: {
-				...ascEnv,
-				...extraEnv
-			},
-			extendEnv: false,
-			stdin: "ignore",
-			stdout: "pipe",
-			stderr: "pipe",
-			reject: false
-		});
-		const stderr = String(result.stderr ?? "");
-		if (result.exitCode !== 0 || result.failed) throw new AscCommandError(`${step} failed: ${lastLine(stderr) ?? (result.signal ? `stopped by ${result.signal}` : void 0) ?? `exit code ${result.exitCode}`}`, result.exitCode, { cause: { stderr } });
-		let parsed;
-		try {
-			parsed = JSON.parse(String(result.stdout));
-		} catch {
-			parsed = void 0;
-		}
-		if (!isRecord(parsed)) throw new AscCommandError(`${step} printed no JSON this version of Hot Updater reads.`, result.exitCode);
-		return parsed;
+	const session = await signInToAppStoreConnect({
+		appleId,
+		password,
+		prompts,
+		fetch
+	});
+	let disposed = false;
+	const dispose = async () => {
+		disposed = true;
+		session.clear();
 	};
 	try {
-		const twoFactor = await listenForTwoFactorCodes(work.root, prompts);
-		let login;
+		const teams = session.providers.map((provider) => toTeam(appleId, provider));
+		const chosen = teamId ?? await chooseTeam?.(teams, toTeam(appleId, session.provider));
+		const provider = chosen === void 0 ? session.provider : await session.selectProvider(chosen);
+		let data;
 		try {
-			login = await run("Signing in with asc web auth login", [
-				"web",
-				"auth",
-				"login",
-				...appleId ? ["--apple-id", appleId] : [],
-				"--two-factor-code-command",
-				twoFactor.command,
-				"--output",
-				"json"
-			], { ASC_WEB_PASSWORD: password });
+			data = await irisRequest(session, "Creating the App Store Connect API key", "POST", "/apiKeys", { data: {
+				type: "apiKeys",
+				attributes: {
+					nickname: name,
+					roles: [role],
+					allAppsVisible: true,
+					keyType: "PUBLIC_API"
+				}
+			} });
 		} catch (error) {
-			if (twoFactor.cancelled()) throw new AscCommandError("Signing in was cancelled.", void 0, { cause: error });
+			const hint = error instanceof AppleSignInError && error.status !== void 0 ? createFailureHint(error.status, error.body ?? "") : void 0;
+			if (hint) throw new AppleSignInError(`${error.message}\n${hint}`, {
+				...error.status === void 0 ? {} : { status: error.status },
+				cause: error
+			});
 			throw error;
-		} finally {
-			await twoFactor.close();
 		}
-		if (login.authenticated !== true) throw new AscCommandError("asc web auth login finished without a signed-in session.", 0);
-		const signedIn = {
-			...text(login.appleId) ? { appleId: text(login.appleId) } : {},
-			...text(login.publicProviderId) ? { teamId: text(login.publicProviderId) } : {},
-			...text(login.developerTeamId) ? { developerTeamId: text(login.developerTeamId) } : {}
-		};
-		const chosen = teamId ?? await chooseTeam?.(signedIn);
-		const team = chosen === void 0 || chosen === signedIn.teamId ? signedIn : {
-			...signedIn.appleId ? { appleId: signedIn.appleId } : {},
-			teamId: chosen
+		const keyId = text(data.id);
+		if (!keyId) throw new AppleSignInError("App Store Connect created a key without an ID.");
+		const revoke = async () => {
+			if (disposed) return false;
+			return irisRequest(session, "Revoking the key", "PATCH", `/apiKeys/${encodeURIComponent(keyId)}`, { data: {
+				id: keyId,
+				type: "apiKeys",
+				attributes: { isActive: false }
+			} }).then(() => true, () => false);
 		};
-		const sessionArgs = [...signedIn.appleId ? ["--apple-id", signedIn.appleId] : [], ...chosen === void 0 ? [] : ["--public-provider-id", chosen]];
-		let created;
-		try {
-			created = await run("Creating the App Store Connect API key", [
-				"web",
-				"api-keys",
-				"create",
-				"--name",
-				name,
-				"--role",
-				role,
-				"--output-dir",
-				node_path.default.join(work.root, "keys"),
-				...sessionArgs,
-				"--output",
-				"json"
-			]);
-		} catch (error) {
-			const stderr = error instanceof AscCommandError && isRecord(error.cause) ? String(error.cause.stderr ?? "") : "";
-			const hint = createFailureHint(stderr);
-			if (hint && error instanceof AscCommandError) throw new AscCommandError(`${error.message}\n${hint}`, error.exitCode, { cause: error });
-			throw error;
-		}
-		const keyId = text(created.keyId);
-		if (!keyId) throw new AscCommandError("asc web api-keys create printed no key ID.", 0);
-		const revoke = () => run("Revoking the key", [
-			"web",
-			"api-keys",
-			"revoke",
-			"--key-id",
-			keyId,
-			"--type",
-			"team",
-			"--confirm",
-			...sessionArgs,
-			"--output",
-			"json"
-		]).then((json) => json.active === false || json.status === "revoked", () => false);
 		let p8;
 		let issuerId;
 		try {
-			const issuer = text(created.issuerId);
-			const p8Path = text(created.p8Path);
-			const keys = node_path.default.join(work.root, "keys");
-			if (!issuer) throw new Error("asc printed no issuer ID for the key.");
-			if (!p8Path || await node_fs_promises.default.realpath(node_path.default.dirname(node_path.default.resolve(p8Path))) !== await node_fs_promises.default.realpath(keys)) throw new Error("asc saved the key's .p8 outside its output directory.");
-			p8 = (await node_fs_promises.default.readFile(p8Path, "utf-8")).trim();
+			p8 = await downloadP8(session, keyId, wait);
 			(0, _hot_updater_cli_tools.registerSecretValue)(p8);
 			(0, _hot_updater_cli_tools.registerSecretValue)(Buffer.from(p8).toString("base64"));
 			assertP8(p8);
+			const details = await irisRequest(session, "Reading the key's issuer ID", "GET", `/apiKeys/${encodeURIComponent(keyId)}?include=provider`);
+			const issuer = issuerOf(details) ?? issuerOf(data);
+			if (!issuer) throw new Error("App Store Connect named no issuer ID for the key.");
 			issuerId = issuer;
 		} catch (error) {
 			const revoked = await revoke();
@@ -446,13 +761,13 @@ const createAscCliKeyIssuer = ({ asc, env = process.env, prompts = cliPrompts }
 			p8,
 			keyId,
 			issuerId,
-			name: text(created.name) ?? name,
-			team,
+			name: text(isRecord(data.attributes) ? data.attributes.nickname : "") ?? name,
+			team: toTeam(appleId, provider),
 			revoke,
-			dispose: work.dispose
+			dispose
 		};
 	} catch (error) {
-		await work.dispose();
+		await dispose();
 		throw error;
 	}
 };
@@ -461,18 +776,121 @@ const createAscCliKeyIssuer = ({ asc, env = process.env, prompts = cliPrompts }
 /** Where team API keys are listed and revoked in App Store Connect. */
 const ASC_INTEGRATIONS_URL = "https://appstoreconnect.apple.com/access/integrations/api";
 /**
-* Hot Updater's sign-in, the one place that picks how it is done: asc, the
-* open-source App Store Connect CLI. Another implementation of
+* Hot Updater's sign-in, the one place that picks how it is done: App Store
+* Connect's own web sign-in, with no other tool. Another implementation of
 * `IssueAscApiKey` replaces it here without touching its callers.
 */
-const issueAscApiKey = (request) => createAscCliKeyIssuer()(request);
+const issueAscApiKey = (request) => createAscKeyIssuer()(request);
+//#endregion
+//#region src/utils/formatCommand.ts
+/**
+* A command to print, broken at spaces with ` \` once a line would pass
+* `width`, each continuation indented two spaces, so a terminal never wraps
+* it mid-word and it still pastes as one command.
+*/
+const formatCommand = (words, width = 74) => {
+	const lines = [];
+	let line = "";
+	for (const word of words) {
+		const next = line ? `${line} ${word}` : word;
+		if (line && next.length > width - 2) {
+			lines.push(`${line} \\`);
+			line = `  ${word}`;
+		} else line = next;
+	}
+	lines.push(line);
+	return lines.join("\n");
+};
 //#endregion
 //#region src/utils/cocoapods.ts
+/**
+* A failed command's error: the command, then the last lines of its
+* output, stdout and stderr as printed, without execa's full message.
+*/
+const commandFailure = (command, error) => {
+	const { all, stderr, stdout } = error ?? {};
+	const detail = String(all || [stdout, stderr].filter(Boolean).join("\n") || "").trimEnd().split("\n").filter((line) => line.trim()).slice(-12).join("\n") || (error instanceof Error ? error.message : String(error));
+	return new Error(`${command} failed.\n${detail}`, { cause: error });
+};
+/**
+* A line of the progress meter curl prints on stderr for each pod it
+* downloads, such as React Native's prebuilt core.
+*/
+const DOWNLOAD_PROGRESS = [
+	/^% Total +% Received/,
+	/^Dload +Upload/,
+	/^\d{1,3} +[\d.]+[kMGT]? +\d{1,3} +[\d.]+[kMGT]? /
+];
+/**
+* `pod install`'s output: its live line shows the pod it installs, its log
+* keeps the whole output, and a failure prints CocoaPods' `[!]` errors and a
+* crash's `SomeError - …` line with its last lines, without the download
+* progress CocoaPods' curl prints on stderr.
+*/
+const createPodInstallLogger = () => new _hot_updater_cli_tools.BuildLogger({
+	logPrefix: "pod-install",
+	createPhaseReader: () => (line) => {
+		const installing = /^Installing (\S+)/.exec(line);
+		if (installing) return `Installing ${installing[1]}`;
+		return /^(Analyzing dependencies|Downloading dependencies|Generating Pods project|Integrating client project)$/.test(line) ? line : void 0;
+	},
+	failureSummary: {
+		lines: [/^[A-Z]\w*(::\w+)*Error - /],
+		blocks: [{
+			start: /^\[!\] /,
+			end: /^$/,
+			includeEnd: false
+		}],
+		ignore: DOWNLOAD_PROGRESS,
+		tail: 4,
+		stopAfter: /^\[!\] Oh no, an error occurred\.$/,
+		maxWidth: 76
+	}
+});
+/**
+* Runs `pod install` as a step whose failure prints CocoaPods' errors and
+* the log's path, then throws a `BuildFailedError`.
+*/
+const runPodInstall = async ({ command, env, sourceDir }) => {
+	const logger = createPodInstallLogger();
+	const failureMessage = `${command.join(" ")} failed`;
+	await logger.start({
+		title: "Installing CocoaPods dependencies",
+		header: [`$ ${formatCommand([...Object.entries(env).map(([name, value]) => `${name}=${value}`), ...command])}`, ""]
+	});
+	try {
+		const podProcess = (0, execa.execa)(command[0], command.slice(1), {
+			cwd: sourceDir,
+			env,
+			all: true,
+			buffer: false
+		});
+		const logging = podProcess.all ? logger.processStream(podProcess.all) : Promise.resolve();
+		const [podResult, loggingResult] = await Promise.allSettled([podProcess, logging]);
+		if (podResult.status === "rejected") throw podResult.reason;
+		if (loggingResult.status === "rejected") throw loggingResult.reason;
+		logger.stop("CocoaPods dependencies installed");
+	} catch (error) {
+		logger.writeError(error);
+		const reason = error instanceof execa.ExecaError && error.exitCode !== void 0 ? `exited with code ${error.exitCode}` : error instanceof Error ? error.message : String(error);
+		logger.stop(`${failureMessage} · ${reason}`, false);
+		throw new _hot_updater_cli_tools.BuildFailedError(`${failureMessage}: ${reason}`, {
+			logPath: logger.logPath,
+			summary: logger.failureSummary,
+			cause: error
+		});
+	} finally {
+		await logger.close();
+	}
+};
 const installPodsIfNeeded = async (sourceDir) => {
 	const podfilePath = path.default.join(sourceDir, "Podfile");
 	if (!fs.default.existsSync(podfilePath)) {
 		_hot_updater_cli_tools.p.log.info("No Podfile found, skipping CocoaPods installation");
-		return;
+		return {
+			codegen: false,
+			pods: false
+		};
 	}
 	const gemfilePaths = [path.default.join(sourceDir, "Gemfile"), path.default.join((0, _hot_updater_cli_tools.getCwd)(), "Gemfile")];
 	const shouldUseBundler = (await Promise.all(gemfilePaths.map(checkShouldUseBundler))).some(Boolean);
@@ -486,36 +904,34 @@ const installPodsIfNeeded = async (sourceDir) => {
 		reactNativePath: reactNative.packagePath,
 		sourceDir
 	});
-	try {
-		if (shouldUseBundler) {
-			_hot_updater_cli_tools.p.log.info("Using bundler for CocoaPods installation");
-			const bundleSpinner = _hot_updater_cli_tools.p.spinner();
-			bundleSpinner.start("Installing Ruby gems");
-			await (0, execa.execa)("bundle", ["install"], { cwd: sourceDir });
-			bundleSpinner.stop("Ruby gems installed");
-			const podSpinner = _hot_updater_cli_tools.p.spinner();
-			podSpinner.start("Installing CocoaPods dependencies");
-			await (0, execa.execa)("bundle", [
-				"exec",
-				"pod",
-				"install"
-			], {
-				cwd: sourceDir,
-				env: plan.env
-			});
-			podSpinner.stop("CocoaPods dependencies installed");
-		} else {
-			const spinner = _hot_updater_cli_tools.p.spinner();
-			spinner.start("Installing CocoaPods dependencies");
-			await (0, execa.execa)("pod", ["install"], {
+	if (shouldUseBundler) {
+		const bundleSpinner = _hot_updater_cli_tools.p.spinner();
+		bundleSpinner.start("Installing Ruby gems");
+		try {
+			await (0, execa.execa)("bundle", ["install"], {
 				cwd: sourceDir,
-				env: plan.env
+				all: true
 			});
-			spinner.stop("CocoaPods dependencies installed");
+		} catch (error) {
+			bundleSpinner.error("bundle install failed");
+			throw commandFailure("bundle install", error);
 		}
-	} catch (error) {
-		throw new Error(`pod install failed: ${error}`);
+		bundleSpinner.stop("Ruby gems installed");
 	}
+	await runPodInstall({
+		command: shouldUseBundler ? [
+			"bundle",
+			"exec",
+			"pod",
+			"install"
+		] : ["pod", "install"],
+		env: plan.env,
+		sourceDir
+	});
+	return {
+		codegen: plan.runCodegen,
+		pods: true
+	};
 };
 const checkShouldUseBundler = async (gemfilePath) => {
 	try {
@@ -546,10 +962,13 @@ const runReactNativeCodegen = async ({ projectRoot, reactNativePath, sourceDir }
 			sourceDir,
 			"-t",
 			"ios"
-		], { cwd: projectRoot });
+		], {
+			cwd: projectRoot,
+			all: true
+		});
 	} catch (error) {
-		spinner.stop("React Native codegen failed");
-		throw new Error(`React Native codegen failed: ${error}`);
+		spinner.error("React Native codegen failed");
+		throw commandFailure("React Native codegen", error);
 	}
 	spinner.stop("React Native codegen done");
 };
@@ -578,8 +997,55 @@ const resolvePodInstallPlan = ({ version, env }) => {
 };
 //#endregion
 //#region src/utils/createRandomTmpDir.ts
+const TERMINATION_SIGNALS$2 = [
+	"SIGHUP",
+	"SIGINT",
+	"SIGTERM"
+];
+const REMOVE_OPTIONS = {
+	force: true,
+	recursive: true,
+	maxRetries: 3
+};
+const liveDirectories = /* @__PURE__ */ new Set();
+const onSignal = (signal) => {
+	removeLiveDirectories();
+	if (process.listenerCount(signal) === 0) process.kill(process.pid, signal);
+};
+const removeLiveDirectories = () => {
+	for (const directory of liveDirectories) try {
+		(0, node_fs.rmSync)(directory, REMOVE_OPTIONS);
+	} catch {}
+	liveDirectories.clear();
+	stopListening();
+};
+const startListening = () => {
+	process.on("exit", removeLiveDirectories);
+	for (const signal of TERMINATION_SIGNALS$2) process.on(signal, onSignal);
+};
+const stopListening = () => {
+	process.off("exit", removeLiveDirectories);
+	for (const signal of TERMINATION_SIGNALS$2) process.off(signal, onSignal);
+};
+/**
+* Creates a directory in the system's temporary directory, which
+* `removeTmpDir` removes, and which is otherwise removed when the process
+* exits or is stopped by a signal.
+*/
 const createRandomTmpDir = async (prefix = "apple-helper-") => {
-	return await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), prefix));
+	const directory = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), prefix));
+	if (liveDirectories.size === 0) startListening();
+	liveDirectories.add(directory);
+	return directory;
+};
+/**
+* Removes a directory `createRandomTmpDir` created. It stays tracked until
+* it is gone, so a signal during a removal that takes seconds, such as
+* DerivedData's, still finishes it.
+*/
+const removeTmpDir = async (directory) => {
+	await (0, node_fs_promises.rm)(directory, REMOVE_OPTIONS);
+	if (liveDirectories.delete(directory) && liveDirectories.size === 0) stopListening();
 };
 //#endregion
 //#region src/utils/platform.ts
@@ -654,80 +1120,113 @@ const parseXcodeProjectInfo = async (sourceDir) => {
 const prettifyXcodebuildError = (error) => {
 	if (error instanceof _hot_updater_cli_tools.BuildFailedError) {
 		const errorLines = error.summary.join("\n");
-		const message = errorLines.includes("error: No profiles for") || errorLines.includes("error: Provisioning profile") ? "Not valid provisioning profile is set in the project. Check out the Signing & Capabilities tab in Xcode." : error.message;
-		return new _hot_updater_cli_tools.BuildFailedError(`Xcodebuild failed: ${message}`, {
+		const hint = mentionsProgramLicenseAgreement(errorLines) ? PROGRAM_LICENSE_AGREEMENT_HINT : errorLines.includes("error: No profiles for") || errorLines.includes("error: Provisioning profile") ? "No valid provisioning profile is set in the project.\nCheck the Signing & Capabilities tab in Xcode." : null;
+		return new _hot_updater_cli_tools.BuildFailedError(hint ?? error.message, {
 			logPath: error.logPath,
 			summary: error.summary,
+			hint,
 			cause: error.cause
 		});
 	}
 	return /* @__PURE__ */ new Error(`Xcodebuild failed: ${error}`);
 };
 //#endregion
+//#region src/utils/xcodebuildPhase.ts
+/** The `(in target 'X' from project 'Y')` that ends an action's line. */
+const TARGET = /\(in target '([^']+)' from project '[^']+'\)\s*$/;
+/** A `PhaseScriptExecution` line's script phase, its spaces escaped. */
+const SCRIPT = /^PhaseScriptExecution ((?:\\.|[^\s\\])+)/;
+/** A batched `SwiftCompile`'s files: `Compiling\ A.swift,\ B.swift`. */
+const SWIFT_BATCH = /^SwiftCompile \S+ \S+ Compiling\\ ((?:\\.|[^\s\\])+)/;
+const unescape = (value) => value.replace(/\\(.)/g, "$1");
+/** Actions whose lines say what xcodebuild is doing, by their first word. */
+const ACTIONS = {
+	CompileAssetCatalog: "Compiling assets",
+	CompileAssetCatalogVariant: "Compiling assets",
+	LinkAssetCatalog: "Compiling assets",
+	CompileStoryboard: "Compiling storyboards",
+	CompileXIB: "Compiling storyboards",
+	LinkStoryboards: "Compiling storyboards",
+	Ld: "Linking",
+	Libtool: "Linking",
+	CodeSign: "Signing",
+	ProcessInfoPlistFile: "Processing",
+	ProcessProductPackaging: "Processing",
+	ProcessProductPackagingDER: "Processing",
+	CopySwiftLibs: "Copying",
+	CpResource: "Copying",
+	GenerateDSYMFile: "Generating dSYM",
+	Strip: "Stripping",
+	Validate: "Validating"
+};
+const COMPILES = /* @__PURE__ */ new Set([
+	"CompileC",
+	"SwiftCompile",
+	"CompileSwift"
+]);
+const PRECOMPILES = /* @__PURE__ */ new Set([
+	"PrecompileModule",
+	"ScanDependencies",
+	"SwiftExplicitDependencyGeneratePcm",
+	"SwiftExplicitDependencyCompileModuleFromInterface"
+]);
+const plural = (count, noun) => `${count} ${noun}${count === 1 ? "" : "s"}`;
+/**
+* Reads the phase of an `xcodebuild` build, archive, or export from its raw
+* output: `Compiling React-Core · 412 files`, `Linking CodexRelay`,
+* `Signing CodexRelay`, `Bundling JavaScript`, with the target each
+* action's line names.
+*/
+const createXcodebuildPhaseReader = () => {
+	let compiled = 0;
+	let precompiled = 0;
+	return (line) => {
+		const space = line.indexOf(" ");
+		const action = space === -1 ? line : line.slice(0, space);
+		const target = TARGET.exec(line)?.[1];
+		const withTarget = (phase) => target ? `${phase} ${target}` : phase;
+		if (COMPILES.has(action)) {
+			const batch = SWIFT_BATCH.exec(line)?.[1];
+			compiled += batch ? unescape(batch).split(",").length : 1;
+			return `${withTarget("Compiling")} · ${plural(compiled, "file")}`;
+		}
+		if (PRECOMPILES.has(action)) {
+			precompiled += 1;
+			return `Precompiling modules · ${precompiled}`;
+		}
+		if (action === "PhaseScriptExecution") {
+			const script = unescape(SCRIPT.exec(line)?.[1] ?? "");
+			if (script === "Bundle React Native code and images") return "Bundling JavaScript";
+			return script ? `Running ${script}` : withTarget("Running a script");
+		}
+		const phase = ACTIONS[action];
+		if (phase) return withTarget(phase);
+		if (line === "Prepare packages" || line.startsWith("Resolve Package")) return "Resolving packages";
+		if (line === "ComputeTargetDependencyGraph") return "Planning the build";
+	};
+};
+//#endregion
 //#region src/utils/createXcodebuildLogger.ts
-const createXcodebuildLogger = ({ logPrefix }) => new _hot_updater_cli_tools.BuildLogger({
+const createXcodebuildLogger = ({ logPrefix, logFilePath }) => new _hot_updater_cli_tools.BuildLogger({
 	logPrefix,
-	importantLogPatterns: [
-		"error:",
-		"** BUILD FAILED **",
-		"** ARCHIVE FAILED **",
-		"The following build commands failed:",
-		"note: Building targets in dependency order",
-		"note: Target dependency graph",
-		"Running script",
-		"[CP-User]",
-		"[CP] Check Pods Manifest.lock",
-		"Build Succeeded"
-	],
-	progressStages: [
-		["Building targets in dependency order", "Target dependency graph"],
-		["Write Auxiliary File", "[CP] Check Pods Manifest.lock"],
-		[
-			"Running script",
-			"[CP-User] [RN]Check rncore",
-			"[CP-User] [Hermes] Replace Hermes",
-			"[CP-User] [RN]Check FBReactNativeSpec"
-		],
-		[
-			"Processing",
-			"ProcessProductPackaging",
-			"ProcessProductPackagingDER"
-		],
-		["Compiling"],
-		["RegisterExecutionPolicyException"],
-		["Touching"],
-		["Building library", "Create Universal Binary"],
-		["Copying"],
-		[
-			"Build Succeeded",
-			"BUILD SUCCEEDED",
-			"ARCHIVE SUCCEEDED"
-		]
-	],
+	logFilePath,
+	createPhaseReader: createXcodebuildPhaseReader,
 	failureSummary: {
 		lines: [/(^|:\s)error: /, /^\*\* [A-Z ]+ FAILED \*\*$/],
 		blocks: [{
 			start: "The following build commands failed:",
 			end: /^\(\d+ failures?\)$/,
 			includeEnd: true
+		}, {
+			start: /^error: exportArchive /,
+			end: /^$/,
+			includeEnd: false
 		}]
 	}
 });
 //#endregion
 //#region src/utils/runXcodebuildWithLogging.ts
-let cachedXcbeautifyAvailability = null;
 const TERMINATION_SIGNALS$1 = ["SIGINT", "SIGTERM"];
-const isXcbeautifyAvailable = async () => {
-	if (cachedXcbeautifyAvailability !== null) return cachedXcbeautifyAvailability;
-	try {
-		await (0, execa.execa)("which", ["xcbeautify"]);
-		cachedXcbeautifyAvailability = true;
-		return true;
-	} catch {
-		cachedXcbeautifyAvailability = false;
-		return false;
-	}
-};
 const createRawXcodebuildProcess = ({ args, env, sourceDir }) => {
 	return (0, execa.execa)("xcodebuild", args, {
 		cwd: sourceDir,
@@ -740,13 +1239,6 @@ const createRawXcodebuildProcess = ({ args, env, sourceDir }) => {
 		}
 	});
 };
-const createXcbeautifyProcess = ({ cwd }) => {
-	return (0, execa.execa)("xcbeautify", [], {
-		cwd,
-		all: true,
-		buffer: false
-	});
-};
 /** Why xcodebuild failed, without its command line. */
 const describeFailure = (error) => {
 	if (error instanceof execa.ExecaError) {
@@ -755,10 +1247,24 @@ const describeFailure = (error) => {
 	}
 	return error instanceof Error ? error.message : String(error);
 };
-const runXcodebuildWithLogging = async ({ args, env, sourceDir, successMessage, failureMessage, logPrefix }) => {
-	const useXcbeautify = await isXcbeautifyAvailable();
-	const logger = createXcodebuildLogger({ logPrefix });
-	await logger.start();
+/**
+* Runs xcodebuild as a step titled `title`: its live line shows the build's
+* phase, the log file keeps the command and the whole output, and a failure
+* prints the output's errors and the log's path on stderr.
+*/
+const runXcodebuildWithLogging = async ({ args, env, sourceDir, title, successMessage, failureMessage, logPrefix, logFilePath, header = [] }) => {
+	const logger = createXcodebuildLogger({
+		logPrefix,
+		logFilePath
+	});
+	await logger.start({
+		title,
+		header: [
+			...header,
+			`$ ${formatCommand(["xcodebuild", ...args])}`,
+			""
+		]
+	});
 	const activeProcesses = [];
 	const terminateActiveProcesses = () => {
 		for (const activeProcess of activeProcesses) activeProcess.kill();
@@ -772,31 +1278,17 @@ const runXcodebuildWithLogging = async ({ args, env, sourceDir, successMessage,
 		});
 		activeProcesses.push(xcodebuildProcess);
 		const xcodebuildOutput = xcodebuildProcess.all ?? xcodebuildProcess.stdout;
-		let xcbeautifyProcess = null;
-		if (useXcbeautify && xcodebuildOutput) {
-			xcbeautifyProcess = createXcbeautifyProcess({ cwd: sourceDir });
-			activeProcesses.push(xcbeautifyProcess);
-		}
-		const logging = xcodebuildOutput ? logger.processStream(xcodebuildOutput, { display: xcbeautifyProcess ? xcbeautifyProcess.all ?? xcbeautifyProcess.stdout ?? void 0 : void 0 }) : Promise.resolve();
-		const xcbeautifyInput = xcbeautifyProcess?.stdin;
-		if (xcodebuildOutput && xcbeautifyInput) {
-			xcbeautifyInput.on("error", () => {
-				xcodebuildOutput.unpipe(xcbeautifyInput);
-			});
-			xcodebuildOutput.pipe(xcbeautifyInput);
-		}
-		const [xcodebuildResult, loggingResult] = await Promise.allSettled([
-			xcodebuildProcess,
-			logging,
-			xcbeautifyProcess
-		]);
+		const logging = xcodebuildOutput ? logger.processStream(xcodebuildOutput) : Promise.resolve();
+		const [xcodebuildResult, loggingResult] = await Promise.allSettled([xcodebuildProcess, logging]);
 		if (xcodebuildResult.status === "rejected") throw xcodebuildResult.reason;
 		if (loggingResult.status === "rejected") throw loggingResult.reason;
 		logger.stop(successMessage);
+		return { logFilePath: logger.logFilePath };
 	} catch (error) {
 		logger.writeError(error);
-		logger.stop(failureMessage, false);
-		throw new _hot_updater_cli_tools.BuildFailedError(`${failureMessage}: ${describeFailure(error)}`, {
+		const reason = describeFailure(error);
+		logger.stop(`${failureMessage} · ${reason.replace(/\.$/, "")}`, false);
+		throw new _hot_updater_cli_tools.BuildFailedError(`${failureMessage}: ${reason}`, {
 			logPath: logger.logPath,
 			summary: logger.failureSummary,
 			cause: error
@@ -883,53 +1375,66 @@ const buildSettingsOverScheme = ({ minBundleId, authenticationArgs }) => ({
 });
 //#endregion
 //#region src/builder/archiveXcodeProject.ts
-const archiveXcodeProject = async ({ sourceDir, platform, installPods, destination, extraParams, configuration, xcodeScheme, xcconfig, logPrefix, minBundleId, authenticationArgs }) => {
+/**
+* Archives the scheme into `archiveDirectory`. The build's xcconfig is
+* written to a temporary directory, removed whether the archive succeeds or
+* not.
+*/
+const archiveXcodeProject = async ({ sourceDir, archiveDirectory, platform, installPods, destination, extraParams, configuration, xcodeScheme, xcconfig, logPrefix, header = [], minBundleId, authenticationArgs }) => {
 	if (installPods) await installPodsIfNeeded(sourceDir);
 	const xcodeProject = await parseXcodeProjectInfo(sourceDir);
-	const tmpDir = await createRandomTmpDir();
 	const archiveName = `${xcodeProject.name.replace(".xcworkspace", "").replace(".xcodeproj", "")}.xcarchive`;
-	const archivePath = path.default.join(tmpDir, archiveName);
-	const build = await writeBuildXcconfig({
-		directory: tmpDir,
-		sourceDir,
-		xcconfig,
-		extraParams,
-		settings: buildSettingsOverScheme({
-			minBundleId,
-			authenticationArgs
-		})
-	});
-	const archiveArgs = prepareArchiveArgs({
-		authenticationArgs,
-		minBundleId,
-		archivePath,
-		platform,
-		sourceDir,
-		xcodeProject,
-		configuration,
-		extraParams: build.extraParams,
-		destination,
-		xcconfig: build.xcconfig,
-		xcodeScheme
-	});
-	_hot_updater_cli_tools.p.log.info(`Xcode Archive Settings:
-Project    ${xcodeProject.name}
-Scheme     ${xcodeScheme}
-Platform   ${platform}
-Command    xcodebuild ${archiveArgs.join(" ")}
-`);
+	const archivePath = path.default.join(archiveDirectory, archiveName);
+	const tmpDir = await createRandomTmpDir();
 	try {
-		await runXcodebuildWithLogging({
-			args: archiveArgs,
-			env: { HOT_UPDATER_MIN_BUNDLE_ID: minBundleId },
-			failureMessage: "Archive failed",
-			logPrefix,
+		const build = await writeBuildXcconfig({
+			directory: tmpDir,
 			sourceDir,
-			successMessage: "Archive completed successfully"
+			xcconfig,
+			extraParams,
+			settings: buildSettingsOverScheme({
+				minBundleId,
+				authenticationArgs
+			})
 		});
-		return { archivePath };
-	} catch (error) {
-		throw prettifyXcodebuildError(error);
+		const archiveArgs = prepareArchiveArgs({
+			authenticationArgs,
+			minBundleId,
+			archivePath,
+			platform,
+			sourceDir,
+			xcodeProject,
+			configuration,
+			extraParams: build.extraParams,
+			destination,
+			xcconfig: build.xcconfig,
+			xcodeScheme
+		});
+		try {
+			const { logFilePath } = await runXcodebuildWithLogging({
+				args: archiveArgs,
+				env: { HOT_UPDATER_MIN_BUNDLE_ID: minBundleId },
+				title: `Archiving ${xcodeScheme}`,
+				successMessage: `Archived ${xcodeScheme}`,
+				failureMessage: "Archive failed",
+				logPrefix,
+				header: [
+					...header,
+					`Project   ${xcodeProject.name}`,
+					`Scheme    ${xcodeScheme}`,
+					`Platform  ${platform}`
+				],
+				sourceDir
+			});
+			return {
+				archivePath,
+				logFilePath
+			};
+		} catch (error) {
+			throw prettifyXcodebuildError(error);
+		}
+	} finally {
+		await removeTmpDir(tmpDir);
 	}
 };
 const prepareArchiveArgs = ({ xcodeScheme, archivePath, platform, sourceDir, xcodeProject, configuration = "Release", xcconfig, extraParams, destination = [], minBundleId, authenticationArgs }) => {
@@ -962,69 +1467,88 @@ const prepareArchiveArgs = ({ xcodeScheme, archivePath, platform, sourceDir, xco
 };
 //#endregion
 //#region src/builder/buildXcodeProject.ts
-const buildXcodeProject = async ({ sourceDir, platform, xcodeScheme, configuration, deviceType, logPrefix, destination = [], useGenericDestination = false, installPods, extraParams, minBundleId, authenticationArgs }) => {
+/**
+* Builds the scheme in a temporary DerivedData directory, copies the built
+* `.app` to `outputDirectory`, and removes DerivedData, which takes 10 GB or
+* more, whether the build succeeds or not.
+*/
+const buildXcodeProject = async ({ sourceDir, outputDirectory, platform, xcodeScheme, configuration, deviceType, logPrefix, destination = [], useGenericDestination = false, installPods, extraParams, minBundleId, authenticationArgs, header = [] }) => {
 	if (installPods) await installPodsIfNeeded(sourceDir);
 	const xcodeProject = await parseXcodeProjectInfo(sourceDir);
-	const derivedDataPath = await createRandomTmpDir();
-	const resolvedDestinations = resolveDestinations({
-		destinations: destination,
-		useGeneric: useGenericDestination
-	});
-	if (resolvedDestinations.length === 0) resolvedDestinations.push(getDefaultDestination({
-		deviceType,
-		platform,
-		useGeneric: useGenericDestination
-	}));
-	const build = await writeBuildXcconfig({
-		directory: await createRandomTmpDir(),
-		sourceDir,
-		extraParams,
-		settings: buildSettingsOverScheme({
-			minBundleId,
-			authenticationArgs
-		})
-	});
-	const buildArgs = prepareBuildArgs({
-		authenticationArgs,
-		xcconfig: build.xcconfig,
-		minBundleId,
-		configuration,
-		derivedDataPath,
-		deviceType,
-		resolvedDestinations,
-		extraParams: build.extraParams,
-		platform,
-		xcodeScheme,
-		sourceDir,
-		xcodeProject
-	});
-	_hot_updater_cli_tools.p.log.info(`Xcode Build Settings:
-Project        ${xcodeProject.name}
-Scheme         ${xcodeScheme}
-Configuration  ${configuration}
-Platform       ${platform}
-Device Type    ${deviceType}
-Command        xcodebuild ${buildArgs.join(" ")}
-`);
+	const tmpDir = await createRandomTmpDir();
 	try {
-		await runXcodebuildWithLogging({
-			args: buildArgs,
-			env: { HOT_UPDATER_MIN_BUNDLE_ID: minBundleId },
+		const derivedDataPath = path.default.join(tmpDir, "DerivedData");
+		const resolvedDestinations = resolveDestinations({
+			destinations: destination,
+			useGeneric: useGenericDestination
+		});
+		if (resolvedDestinations.length === 0) resolvedDestinations.push(getDefaultDestination({
+			deviceType,
+			platform,
+			useGeneric: useGenericDestination
+		}));
+		const build = await writeBuildXcconfig({
+			directory: tmpDir,
 			sourceDir,
-			logPrefix,
-			successMessage: "Build completed successfully",
-			failureMessage: "Build failed"
+			extraParams,
+			settings: buildSettingsOverScheme({
+				minBundleId,
+				authenticationArgs
+			})
 		});
-		return await getBuildSettings({
+		const buildArgs = prepareBuildArgs({
+			authenticationArgs,
+			xcconfig: build.xcconfig,
+			minBundleId,
 			configuration,
 			derivedDataPath,
+			deviceType,
 			resolvedDestinations,
+			extraParams: build.extraParams,
+			platform,
 			xcodeScheme,
 			sourceDir,
 			xcodeProject
 		});
-	} catch (error) {
-		throw prettifyXcodebuildError(error);
+		let builtAppPath;
+		let logFilePath;
+		try {
+			({logFilePath} = await runXcodebuildWithLogging({
+				args: buildArgs,
+				env: { HOT_UPDATER_MIN_BUNDLE_ID: minBundleId },
+				sourceDir,
+				logPrefix,
+				header: [
+					...header,
+					`Project        ${xcodeProject.name}`,
+					`Scheme         ${xcodeScheme}`,
+					`Configuration  ${configuration}`,
+					`Platform       ${platform}`,
+					`Device type    ${deviceType}`
+				],
+				title: `Building ${xcodeScheme}`,
+				successMessage: `Built ${xcodeScheme}`,
+				failureMessage: "Build failed"
+			}));
+			({appPath: builtAppPath} = await getBuildSettings({
+				configuration,
+				derivedDataPath,
+				resolvedDestinations,
+				xcodeScheme,
+				sourceDir,
+				xcodeProject
+			}));
+		} catch (error) {
+			throw prettifyXcodebuildError(error);
+		}
+		const appPath = path.default.join(outputDirectory, path.default.basename(builtAppPath));
+		await fs.default.promises.cp(builtAppPath, appPath, { recursive: true });
+		return {
+			appPath,
+			logFilePath
+		};
+	} finally {
+		await removeTmpDir(tmpDir);
 	}
 };
 const prepareBuildArgs = ({ xcodeProject, sourceDir, platform, xcodeScheme, configuration, deviceType, resolvedDestinations, derivedDataPath, extraParams, minBundleId, authenticationArgs, xcconfig }) => {
@@ -1081,8 +1605,8 @@ const getBuildSettings = async ({ xcodeProject, sourceDir, xcodeScheme, configur
 };
 //#endregion
 //#region src/builder/exportXcodeArchive.ts
-const exportXcodeArchive = async ({ archivePath, sourceDir, exportExtraParams, exportOptionsPlist, logPrefix, authenticationArgs }) => {
-	const exportPath = await createRandomTmpDir();
+/** Exports the archive into `exportPath`. */
+const exportXcodeArchive = async ({ archivePath, exportPath, sourceDir, exportExtraParams, exportOptionsPlist, logPrefix, logFilePath, title, authenticationArgs }) => {
 	const exportArgs = prepareExportArgs({
 		authenticationArgs,
 		archivePath,
@@ -1094,9 +1618,11 @@ const exportXcodeArchive = async ({ archivePath, sourceDir, exportExtraParams, e
 		await runXcodebuildWithLogging({
 			args: exportArgs,
 			sourceDir,
-			successMessage: "Archive exported successfully",
+			title: `Exporting ${title}`,
+			successMessage: `Exported ${title}`,
 			failureMessage: "Export failed",
-			logPrefix
+			logPrefix,
+			logFilePath
 		});
 		return { exportPath };
 	} catch (error) {
@@ -1279,7 +1805,7 @@ var TestFlightBuildExistsError = class extends Error {
 	bundleVersion;
 	name = "TestFlightBuildExistsError";
 	constructor(shortVersion, bundleVersion, options) {
-		super(`App Store Connect already has build ${bundleVersion} of version ${shortVersion}. Each build of a version needs a new build number (CFBundleVersion).`, options);
+		super(`App Store Connect already has build ${bundleVersion} of version ${shortVersion}.\nUse a new build number (CFBundleVersion).`, options);
 		this.shortVersion = shortVersion;
 		this.bundleVersion = bundleVersion;
 	}
@@ -1466,15 +1992,15 @@ const codeSigningOff = async (iosScheme) => {
 * it (`assertTestFlightExportOptions`).
 */
 const resolveTestFlightUploadKey = async ({ scheme, iosScheme }) => {
-	if (iosScheme.simulator) throw new Error(`TestFlight takes an .ipa, and the scheme ${scheme} builds a simulator .app.`);
+	if (iosScheme.simulator) throw new Error(`The scheme ${scheme} builds a simulator .app, not an .ipa for TestFlight.`);
 	const configuration = iosScheme.configuration ?? "Release";
-	if (/debug$/i.test(configuration)) throw new Error(`TestFlight takes a release build, and the scheme ${scheme} builds the ${configuration} configuration, which loads its JavaScript from Metro.`);
+	if (/debug$/i.test(configuration)) throw new Error(`The scheme ${scheme} builds ${configuration}; TestFlight takes a release build.`);
 	const unsigned = await codeSigningOff(iosScheme);
-	if (unsigned) throw new Error(`TestFlight takes a signed .ipa, and the scheme ${scheme} turns code signing off (${unsigned}).`);
-	if (!iosScheme.exportOptionsPlist && !iosScheme.signing) throw new Error(`The scheme ${scheme} archives without exporting an .ipa. Set signing.ascApiKey, or an exportOptionsPlist with the method app-store-connect.`);
+	if (unsigned) throw new Error(`The scheme ${scheme} turns code signing off:\n${unsigned}`);
+	if (!iosScheme.exportOptionsPlist && !iosScheme.signing) throw new Error(`The scheme ${scheme} archives without exporting an .ipa.\nSet signing.ascApiKey, or exportOptionsPlist with method app-store-connect.`);
 	if (iosScheme.exportOptionsPlist && fs.default.existsSync(schemeFile(iosScheme.exportOptionsPlist))) {
 		const method = await readExportMethod(schemeFile(iosScheme.exportOptionsPlist));
-		if (!APP_STORE_EXPORT_METHODS.has(method)) throw new Error(`TestFlight takes an .ipa exported for App Store Connect, and the scheme ${scheme}'s exportOptionsPlist exports with the method ${method || "(none)"}. Set its method to app-store-connect.`);
+		if (!APP_STORE_EXPORT_METHODS.has(method)) throw new Error(`The scheme ${scheme}'s exportOptionsPlist uses method ${method || "(none)"}.\nSet its method to app-store-connect for TestFlight.`);
 	}
 	return {
 		kind: "asc-api-key",
@@ -1489,7 +2015,7 @@ const resolveTestFlightUploadKey = async ({ scheme, iosScheme }) => {
 const assertTestFlightExportOptions = async (schemeConfig) => {
 	if (!schemeConfig.exportOptionsPlist) return;
 	const method = await readExportMethod(schemeConfig.exportOptionsPlist);
-	if (!APP_STORE_EXPORT_METHODS.has(method)) throw new Error(`TestFlight takes an .ipa exported for App Store Connect, and the scheme ${schemeConfig.hotUpdaterSchemeName}'s exportOptionsPlist exports with the method ${method || "(none)"}. Set its method to app-store-connect.`);
+	if (!APP_STORE_EXPORT_METHODS.has(method)) throw new Error(`The scheme ${schemeConfig.hotUpdaterSchemeName}'s exportOptionsPlist uses method ${method || "(none)"}.\nSet its method to app-store-connect for TestFlight.`);
 };
 /**
 * Requests to the App Store Connect API with `apiKey`: each carries a token
@@ -1524,8 +2050,8 @@ const createAppStoreConnectRequest = ({ apiKey, privateKey, fetch }) => {
 		});
 		if (!response.ok) {
 			const error = new AppStoreConnectError(action, response.status, await readApiErrors(response), response.headers.get("retry-after"));
-			if (response.status === 401) throw new Error("App Store Connect refused the API key: check its key ID and issuer ID, and that the key is not revoked.", { cause: error });
-			if (response.status === 403) throw new Error(`${error.message} An API key with the Admin, App Manager, or Developer role uploads builds.`, { cause: error });
+			if (response.status === 401) throw new Error("App Store Connect refused the API key.\nCheck its key ID and issuer ID, and that it isn't revoked.", { cause: error });
+			if (response.status === 403) throw new Error(isProgramLicenseAgreementError(error.errors) ? `${action} failed (HTTP 403).\n${PROGRAM_LICENSE_AGREEMENT_HINT}` : `${error.message}\nUploads need a key with the Admin, App Manager, or Developer role.`, { cause: error });
 			throw error;
 		}
 		return response.status === 204 ? void 0 : await response.json();
@@ -1538,7 +2064,7 @@ const findApp = async (request, bundleId) => {
 		"fields[apps]": "bundleId"
 	})}`));
 	const app = apps.find((app) => app.attributes?.bundleId === bundleId);
-	if (!app) throw new Error(`App Store Connect has no app with the bundle ID ${bundleId} that this API key can see. Create the app in App Store Connect, or use a key of its team.`);
+	if (!app) throw new Error(`App Store Connect has no app ${bundleId} that this API key can see.\nCreate the app in App Store Connect, or use a key of its team.`);
 	return {
 		app,
 		testFlightUrl: `https://appstoreconnect.apple.com/apps/${app.id}/testflight/ios`
@@ -1610,14 +2136,18 @@ const uploadToTestFlight = async ({ ipaPath, apiKey, fetch = globalThis.fetch, p
 		} }));
 	} catch (error) {
 		if (error instanceof AppStoreConnectError && error.status === 409 && error.errors.some((apiError) => apiError.code === DUPLICATE_ERROR_CODE)) {
-			if (unanswered) throw new Error(`App Store Connect already has build ${info.bundleVersion} of version ${info.shortVersion}, which a request of this upload it did not answer may have reserved. Upload with a new build number (CFBundleVersion).`, { cause: error });
+			if (unanswered) throw new Error([
+				`App Store Connect already has build ${info.bundleVersion} of version ${info.shortVersion}.`,
+				"An unanswered request of this upload may have reserved it.",
+				"Upload with a new build number (CFBundleVersion)."
+			].join("\n"), { cause: error });
 			throw new TestFlightBuildExistsError(info.shortVersion, info.bundleVersion, { cause: error });
 		}
 		if (!isRetryable(error) || attempt === COMMIT_ATTEMPTS) throw error;
 		if (!isRateLimited(error)) unanswered = true;
 		await sleep(retryDelayMs(error, attempt));
 	}
-	_hot_updater_cli_tools.p.log.info(`Uploading ${ipaName} (version ${info.shortVersion}, build ${info.bundleVersion}) to App Store Connect`);
+	_hot_updater_cli_tools.p.log.info(`Uploading ${ipaName} ${info.shortVersion} (${info.bundleVersion}) to App Store Connect`);
 	const removeUpload = async () => {
 		for (let attempt = 1;; attempt++) try {
 			await request("Removing the build upload", "DELETE", `/v1/buildUploads/${buildUploadId}`);
@@ -1625,7 +2155,11 @@ const uploadToTestFlight = async ({ ipaPath, apiKey, fetch = globalThis.fetch, p
 		} catch (error) {
 			if (error instanceof AppStoreConnectError && error.status === 404) return;
 			if (!isRetryable(error) || attempt === COMMIT_ATTEMPTS) {
-				_hot_updater_cli_tools.p.log.warn(`App Store Connect kept the unfinished build upload ${buildUploadId}, which reserves build ${info.bundleVersion} of version ${info.shortVersion}: ${error.message} Upload with a new build number (CFBundleVersion).`);
+				_hot_updater_cli_tools.p.log.warn([
+					`App Store Connect kept the unfinished upload of build ${info.bundleVersion}.`,
+					error.message,
+					"Upload with a new build number (CFBundleVersion)."
+				].join("\n"));
 				return;
 			}
 			await sleep(retryDelayMs(error, attempt));
@@ -1667,7 +2201,12 @@ const uploadToTestFlight = async ({ ipaPath, apiKey, fetch = globalThis.fetch, p
 		} });
 		break;
 	} catch (error) {
-		const unconfirmed = () => new Error(`App Store Connect did not confirm the upload of build ${info.bundleVersion}: ${error.message} Check the build in TestFlight before you upload it again: ${testFlightUrl}`, { cause: error });
+		const unconfirmed = () => new Error([
+			`App Store Connect didn't confirm the upload of build ${info.bundleVersion}.`,
+			error.message,
+			"Check TestFlight before you upload it again:",
+			testFlightUrl
+		].join("\n"), { cause: error });
 		if (!isRetryable(error)) {
 			if (commitUnanswered) throw unconfirmed();
 			await removeUpload();
@@ -1693,8 +2232,13 @@ const uploadToTestFlight = async ({ ipaPath, apiKey, fetch = globalThis.fetch, p
 		if (state.state === "PROCESSING") reportedProcessing = true;
 		if (!state.state || IN_PROGRESS_STATES.has(state.state)) {
 			if (Date.now() >= deadline) {
-				if (!reportedProcessing) throw new Error(`App Store Connect did not report build ${info.bundleVersion} processing${lastError instanceof Error ? `: ${lastError.message}` : state.state ? ` (${state.state}).` : "."} Check the build in TestFlight: ${testFlightUrl}`, { cause: lastError });
-				_hot_updater_cli_tools.p.log.warn(`App Store Connect is still processing build ${info.bundleVersion}. It appears in TestFlight once processing finishes: ${testFlightUrl}`);
+				if (!reportedProcessing) throw new Error([
+					`App Store Connect didn't report build ${info.bundleVersion} processing.`,
+					lastError instanceof Error ? lastError.message : state.state ? `State: ${state.state}` : void 0,
+					"Check the build in TestFlight:",
+					testFlightUrl
+				].filter(Boolean).join("\n"), { cause: lastError });
+				_hot_updater_cli_tools.p.log.warn(`App Store Connect is still processing build ${info.bundleVersion}.\nTestFlight lists it once processing finishes:\n${testFlightUrl}`);
 				return {
 					appId: app.id,
 					buildUploadId,
@@ -1825,7 +2369,7 @@ const acquireWithLockf = async (lockPath) => {
 	await fs.default.promises.mkdir(path.default.dirname(lockPath), { recursive: true });
 	const release = await holdWithLockf(lockPath, false);
 	if (release) return release;
-	_hot_updater_cli_tools.p.log.info("Waiting for another build that signs in a keychain of its own under this macOS user.");
+	_hot_updater_cli_tools.p.log.info("Waiting for another build's signing keychain under this macOS user.");
 	return await holdWithLockf(lockPath, true);
 };
 /**
@@ -1896,7 +2440,12 @@ const createSigningKeychain = async ({ security = runSecurity, directory = os.de
 			live = void 0;
 			process.off("exit", restoreLive);
 			await releaseLock().catch(() => void 0);
-			if (failures.length > 0) _hot_updater_cli_tools.p.log.warn(`Restoring the keychains after the build failed (${failures.join("; ")}). Check \`security list-keychains -d user\` and \`security default-keychain -d user\`, and delete ${keychainPath} if it is left.`);
+			if (failures.length > 0) _hot_updater_cli_tools.p.log.warn([
+				"Couldn't restore the keychains after the build.",
+				...failures,
+				"Check security list-keychains -d user and default-keychain -d user,",
+				`and delete ${keychainPath} if it is left.`
+			].join("\n"));
 		})();
 		return disposal;
 	};
@@ -1941,38 +2490,62 @@ const createSigningKeychain = async ({ security = runSecurity, directory = os.de
 	return {
 		path: keychainPath,
 		certificates: async () => {
+			const identities = new Set([...(await security([
+				"find-identity",
+				"-p",
+				"codesigning",
+				keychainPath
+			])).matchAll(/^\s*\d+\)\s+([0-9A-F]{40})\s/gm)].map((match) => match[1]));
+			if (identities.size === 0) return [];
 			return ((await security([
 				"find-certificate",
 				"-a",
 				"-p",
 				keychainPath
-			])).match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g) ?? []).map((pem) => {
+			])).match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g) ?? []).flatMap((pem) => {
 				const certificate = new crypto.default.X509Certificate(pem);
-				return {
+				if (!identities.has(certificate.fingerprint.replaceAll(":", ""))) return [];
+				return [{
 					serialNumber: normalizeSerial(certificate.serialNumber),
 					commonName: certificate.subject.match(/^CN=(.*)$/m)?.[1] ?? certificate.subject
-				};
+				}];
 			});
 		},
 		dispose
 	};
 };
+/** A request App Store Connect refused, in one line. */
+var AppStoreConnectRefusal = class extends Error {
+	/** Whether the team has a Program License Agreement to accept. */
+	agreement;
+	constructor(message, agreement) {
+		super(message);
+		this.agreement = agreement;
+	}
+};
+const refusal = async (action, response) => {
+	const body = await response.json().catch(() => void 0);
+	return new AppStoreConnectRefusal(`${action} failed (HTTP ${response.status}).`, isProgramLicenseAgreementError(Array.isArray(body?.errors) ? body.errors : []));
+};
 /**
 * Revokes the certificates Xcode created in the build's keychain, whose
 * private keys the keychain's deletion destroys: on a runner that starts
 * empty, Xcode creates a development certificate for every build, and App
 * Store Connect refuses new ones once a team has its maximum. Each is found
 * in the team's certificates by serial number. A revocation that fails is
-* reported with where to revoke it by hand, and never fails the build.
+* reported with each certificate's name and serial and where to revoke it
+* by hand, and never fails the build.
 */
 const revokeKeychainCertificates = async ({ certificates, apiKey, privateKey, fetch = globalThis.fetch }) => {
 	const revoked = [];
 	const failed = [];
+	/** Why none could be revoked: the token or the listing failed. */
+	let reason;
+	let agreement = false;
 	if (certificates.length === 0) return {
-		revoked,
-		failed
+		revoked: [],
+		failed: []
 	};
-	const describe = ({ commonName, serialNumber }) => `${commonName} (serial ${serialNumber})`;
 	try {
 		const token = createAppStoreConnectToken({
 			privateKey: privateKey ?? crypto.default.createPrivateKey(await fs.default.promises.readFile(apiKey.keyPath, "utf-8")),
@@ -1988,7 +2561,7 @@ const revokeKeychainCertificates = async ({ certificates, apiKey, privateKey, fe
 		})}`;
 		while (next) {
 			const response = await fetch(next, { headers });
-			if (!response.ok) throw new Error(`Listing the team's certificates failed (HTTP ${response.status}).`);
+			if (!response.ok) throw await refusal("Listing the team's certificates", response);
 			const body = await response.json();
 			for (const { id, attributes } of body.data ?? []) if (attributes?.serialNumber) idsBySerial.set(normalizeSerial(attributes.serialNumber), id);
 			next = body.links?.next;
@@ -2000,18 +2573,32 @@ const revokeKeychainCertificates = async ({ certificates, apiKey, privateKey, fe
 				method: "DELETE",
 				headers
 			});
-			if (response.ok || response.status === 404) revoked.push(describe(certificate));
-			else failed.push(`${describe(certificate)}: HTTP ${response.status}`);
+			if (response.ok || response.status === 404) revoked.push(certificate);
+			else {
+				agreement ||= (await refusal("Revoking", response)).agreement;
+				failed.push({
+					certificate,
+					status: response.status
+				});
+			}
 		}
 	} catch (error) {
-		const reason = error instanceof Error ? error.message : String(error);
-		for (const certificate of certificates) if (!revoked.includes(describe(certificate))) failed.push(`${describe(certificate)}: ${reason}`);
+		reason = error instanceof Error ? error.message : String(error);
+		agreement ||= error instanceof AppStoreConnectRefusal && error.agreement;
+		for (const certificate of certificates) if (!revoked.includes(certificate)) failed.push({ certificate });
 	}
-	if (revoked.length > 0) _hot_updater_cli_tools.p.log.info(`Revoked the signing certificates Xcode created for this build, whose keys the build's keychain held: ${revoked.join(", ")}.`);
-	if (failed.length > 0) _hot_updater_cli_tools.p.log.warn(`Revoking the signing certificates Xcode created for this build failed, and their keys are deleted with the build's keychain: ${failed.join("; ")}. Revoke them at ${CERTIFICATES_URL}, since App Store Connect stops creating certificates at a team's maximum.`);
+	const describe = ({ commonName, serialNumber }) => `${commonName} (serial ${serialNumber})`;
+	if (revoked.length > 0) _hot_updater_cli_tools.p.log.info(["Revoked the certificates Xcode created for this build:", ...revoked.flatMap(({ commonName, serialNumber }) => [commonName, `Serial ${serialNumber}`])].join("\n"));
+	if (failed.length > 0) _hot_updater_cli_tools.p.log.warn([
+		"Couldn't revoke the certificates Xcode created for this build.",
+		...reason === void 0 ? [] : [reason],
+		...agreement ? [PROGRAM_LICENSE_AGREEMENT_HINT] : [],
+		...failed.flatMap(({ certificate, status }) => [certificate.commonName, `Serial ${certificate.serialNumber}${status === void 0 ? "" : ` (HTTP ${status})`}`]),
+		CERTIFICATES_URL
+	].join("\n"));
 	return {
-		revoked,
-		failed
+		revoked: revoked.map(describe),
+		failed: failed.map(({ certificate }) => describe(certificate))
 	};
 };
 const TERMINATION_SIGNALS = [
@@ -2036,7 +2623,7 @@ const withSigningKeychain = async ({ enabled, apiKey, run, security, lockPath, a
 		lockPath,
 		acquireLock
 	});
-	_hot_updater_cli_tools.p.log.info("Signing in a keychain of this build's own, deleted when it ends (CI is set).");
+	_hot_updater_cli_tools.p.log.info("Signing in a keychain of this build's own (CI is set).");
 	let cleanup;
 	const release = () => {
 		cleanup ??= (async () => {
@@ -2112,22 +2699,44 @@ const readBuiltApp = async (appPath) => {
 * Builds a simulator `.app` for a `simulator` scheme, and otherwise archives
 * and exports an `.ipa`, or returns the `.xcarchive` of a scheme it cannot
 * export: one with neither `exportOptionsPlist` nor `signing.ascApiKey`.
+*
+* The artifact is in a temporary `buildDirectory`, which `dispose` removes
+* once the caller has copied it out. A failed build removes it, and every
+* other directory the build used, itself.
 */
-const buildIos = async ({ schemeConfig, minBundleId = (0, _hot_updater_cli_tools.createMinBundleId)(), credentials }) => {
+const buildIos = async ({ schemeConfig, minBundleId = (0, _hot_updater_cli_tools.createMinBundleId)(), credentials, logHeader = [] }) => {
 	await assertXcodebuildExist();
-	const iosProjectRoot = path.default.join((0, _hot_updater_cli_tools.getCwd)(), "ios");
+	if (schemeConfig.simulator && schemeConfig.destination.length) {
+		_hot_updater_cli_tools.p.log.error("The scheme option 'simulator' is not compatible with the 'destination' option.");
+		process.exit(1);
+	}
 	const buildDirectory = await createRandomTmpDir();
-	await fs.default.promises.mkdir(path.default.join(buildDirectory, "archive"), { recursive: true });
+	try {
+		return {
+			...await buildInto({
+				schemeConfig,
+				minBundleId,
+				credentials,
+				buildDirectory,
+				logHeader
+			}),
+			dispose: () => removeTmpDir(buildDirectory)
+		};
+	} catch (error) {
+		await removeTmpDir(buildDirectory);
+		throw error;
+	}
+};
+const buildInto = async ({ schemeConfig, minBundleId, credentials, buildDirectory, logHeader }) => {
+	const iosProjectRoot = path.default.join((0, _hot_updater_cli_tools.getCwd)(), "ios");
 	if (schemeConfig.simulator) {
-		if (schemeConfig.destination.length) {
-			_hot_updater_cli_tools.p.log.error("The scheme option 'simulator' is not compatible with the 'destination' option.");
-			process.exit(1);
-		}
 		const appDir = path.default.join(buildDirectory, "app");
 		await fs.default.promises.mkdir(appDir, { recursive: true });
-		const { appPath } = await buildXcodeProject({
+		const { appPath, logFilePath } = await buildXcodeProject({
 			sourceDir: iosProjectRoot,
+			outputDirectory: appDir,
 			logPrefix: `ios-${schemeConfig.hotUpdaterSchemeName}-build`,
+			header: logHeader,
 			platform: schemeConfig.platform,
 			xcodeScheme: schemeConfig.scheme,
 			configuration: schemeConfig.configuration,
@@ -2137,13 +2746,11 @@ const buildIos = async ({ schemeConfig, minBundleId = (0, _hot_updater_cli_tools
 			useGenericDestination: true,
 			minBundleId
 		});
-		const finalAppPath = path.default.join(appDir, path.default.basename(appPath));
-		await fs.default.promises.cp(appPath, finalAppPath, { recursive: true });
-		_hot_updater_cli_tools.p.log.success(`.app file created: ${path.default.basename(appPath)}`);
 		return {
 			buildDirectory,
-			buildArtifactPath: finalAppPath,
-			builtApp: await readBuiltApp(finalAppPath)
+			buildArtifactPath: appPath,
+			logFilePath,
+			builtApp: await readBuiltApp(appPath)
 		};
 	} else {
 		const signing = await resolveXcodeSigning({
@@ -2153,10 +2760,11 @@ const buildIos = async ({ schemeConfig, minBundleId = (0, _hot_updater_cli_tools
 		if (!signing) return archiveAndExport({
 			schemeConfig,
 			minBundleId,
-			buildDirectory
+			buildDirectory,
+			logHeader
 		});
 		const appStoreConnect = await exportsForAppStoreConnect(schemeConfig);
-		if ((0, _hot_updater_cli_tools.isCI)() && !appStoreConnect) _hot_updater_cli_tools.p.log.info("This export isn't for App Store Connect, so it signs in the runner's own keychains and keeps the certificates Xcode creates.");
+		if ((0, _hot_updater_cli_tools.isCI)() && !appStoreConnect) _hot_updater_cli_tools.p.log.info("Signing in the runner's own keychains (not an App Store Connect export).");
 		return withSigningKeychain({
 			enabled: (0, _hot_updater_cli_tools.isCI)() && appStoreConnect,
 			apiKey: signing.apiKey,
@@ -2164,6 +2772,7 @@ const buildIos = async ({ schemeConfig, minBundleId = (0, _hot_updater_cli_tools
 				schemeConfig,
 				minBundleId,
 				buildDirectory,
+				logHeader,
 				authenticationArgs: signing.authenticationArgs
 			})
 		});
@@ -2173,11 +2782,13 @@ const buildIos = async ({ schemeConfig, minBundleId = (0, _hot_updater_cli_tools
 * Archives a device build and exports its `.ipa`, or returns the
 * `.xcarchive` of a scheme it cannot export.
 */
-const archiveAndExport = async ({ schemeConfig, minBundleId, buildDirectory, authenticationArgs }) => {
+const archiveAndExport = async ({ schemeConfig, minBundleId, buildDirectory, logHeader, authenticationArgs }) => {
 	const iosProjectRoot = path.default.join((0, _hot_updater_cli_tools.getCwd)(), "ios");
 	const archiveDir = path.default.join(buildDirectory, "archive");
 	const exportDir = path.default.join(buildDirectory, "export");
-	const { archivePath } = await archiveXcodeProject({
+	await fs.default.promises.mkdir(archiveDir, { recursive: true });
+	const { archivePath, logFilePath } = await archiveXcodeProject({
+		archiveDirectory: archiveDir,
 		authenticationArgs,
 		minBundleId,
 		platform: schemeConfig.platform,
@@ -2188,37 +2799,45 @@ const archiveAndExport = async ({ schemeConfig, minBundleId, buildDirectory, aut
 		extraParams: schemeConfig.extraParams,
 		configuration: schemeConfig.configuration,
 		installPods: schemeConfig.installPods,
-		logPrefix: `ios-${schemeConfig.hotUpdaterSchemeName}-build-archive`
+		logPrefix: `ios-${schemeConfig.hotUpdaterSchemeName}-build`,
+		header: logHeader
 	});
-	const finalArchivePath = path.default.join(archiveDir, path.default.basename(archivePath));
-	await fs.default.promises.cp(archivePath, finalArchivePath, { recursive: true });
-	const appFromArchive = extractAppFromXcarchive(finalArchivePath);
+	const appFromArchive = extractAppFromXcarchive(archivePath);
 	const archivedAppPath = appFromArchive ? path.default.join(archiveDir, path.default.basename(appFromArchive)) : void 0;
-	if (appFromArchive && archivedAppPath) {
-		await fs.default.promises.cp(appFromArchive, archivedAppPath, { recursive: true });
-		_hot_updater_cli_tools.p.log.success(".app extracted from .xcarchive");
-	}
+	if (appFromArchive && archivedAppPath) await fs.default.promises.cp(appFromArchive, archivedAppPath, { recursive: true });
 	if (!schemeConfig.exportOptionsPlist && !authenticationArgs) return {
 		buildDirectory,
-		buildArtifactPath: finalArchivePath,
+		buildArtifactPath: archivePath,
+		logFilePath,
 		builtApp: archivedAppPath ? await readBuiltApp(archivedAppPath) : void 0
 	};
 	await fs.default.promises.mkdir(exportDir, { recursive: true });
-	const exportOptionsPlist = schemeConfig.exportOptionsPlist ?? await writeAppStoreConnectExportOptions(await createRandomTmpDir());
-	const { exportPath } = await exportXcodeArchive({
+	const exportArchive = (exportOptionsPlist) => exportXcodeArchive({
 		archivePath,
+		exportPath: exportDir,
 		authenticationArgs,
 		exportExtraParams: schemeConfig.exportExtraParams,
 		exportOptionsPlist,
 		sourceDir: iosProjectRoot,
-		logPrefix: `ios-${schemeConfig.hotUpdaterSchemeName}-build-export`
+		logPrefix: `ios-${schemeConfig.hotUpdaterSchemeName}-build`,
+		logFilePath: logFilePath ?? void 0,
+		title: schemeConfig.scheme
 	});
-	await fs.default.promises.cp(exportPath, exportDir, { recursive: true });
+	if (schemeConfig.exportOptionsPlist) await exportArchive(schemeConfig.exportOptionsPlist);
+	else {
+		const exportOptionsDir = await createRandomTmpDir();
+		try {
+			await exportArchive(await writeAppStoreConnectExportOptions(exportOptionsDir));
+		} finally {
+			await removeTmpDir(exportOptionsDir);
+		}
+	}
 	const ipaFile = fs.default.readdirSync(exportDir).find((file) => file.endsWith(".ipa"));
 	if (!ipaFile) throw new Error("IPA file not found after export");
 	return {
 		buildDirectory,
 		buildArtifactPath: path.default.join(exportDir, ipaFile),
+		logFilePath,
 		builtApp: archivedAppPath ? await readBuiltApp(archivedAppPath) : void 0
 	};
 };