@hot-updater/apple-helper 1.2.0-rc.12 → 1.2.0-rc.13

package/dist/index.cjs

@@ -25,6 +25,9 @@ let node_crypto = require("node:crypto");
 node_crypto = __toESM(node_crypto, 1);
 let node_timers_promises = require("node:timers/promises");
 let _hot_updater_cli_tools = require("@hot-updater/cli-tools");
+let _hot_updater_protocol_native_artifact = require("@hot-updater/protocol/native-artifact");
+let crypto = require("crypto");
+crypto = __toESM(crypto, 1);
 let fs = require("fs");
 fs = __toESM(fs, 1);
 let path = require("path");
@@ -35,8 +38,6 @@ let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
 let node_path = require("node:path");
 let child_process = require("child_process");
-let crypto = require("crypto");
-crypto = __toESM(crypto, 1);
 let os = require("os");
 os = __toESM(os, 1);
 //#region src/asc/appleSrp.ts
@@ -782,220 +783,6 @@ const ASC_INTEGRATIONS_URL = "https://appstoreconnect.apple.com/access/integrati
 */
 const issueAscApiKey = (request) => createAscKeyIssuer()(request);
 //#endregion
-//#region src/utils/formatCommand.ts
-/**
-* A command to print, broken at spaces with ` \` once a line would pass
-* `width`, each continuation indented two spaces, so a terminal never wraps
-* it mid-word and it still pastes as one command.
-*/
-const formatCommand = (words, width = 74) => {
-	const lines = [];
-	let line = "";
-	for (const word of words) {
-		const next = line ? `${line} ${word}` : word;
-		if (line && next.length > width - 2) {
-			lines.push(`${line} \\`);
-			line = `  ${word}`;
-		} else line = next;
-	}
-	lines.push(line);
-	return lines.join("\n");
-};
-//#endregion
-//#region src/utils/cocoapods.ts
-/**
-* A failed command's error: the command, then the last lines of its
-* output, stdout and stderr as printed, without execa's full message.
-*/
-const commandFailure = (command, error) => {
-	const { all, stderr, stdout } = error ?? {};
-	const detail = String(all || [stdout, stderr].filter(Boolean).join("\n") || "").trimEnd().split("\n").filter((line) => line.trim()).slice(-12).join("\n") || (error instanceof Error ? error.message : String(error));
-	return new Error(`${command} failed.\n${detail}`, { cause: error });
-};
-/**
-* A line of the progress meter curl prints on stderr for each pod it
-* downloads, such as React Native's prebuilt core.
-*/
-const DOWNLOAD_PROGRESS = [
-	/^% Total +% Received/,
-	/^Dload +Upload/,
-	/^\d{1,3} +[\d.]+[kMGT]? +\d{1,3} +[\d.]+[kMGT]? /
-];
-/**
-* `pod install`'s output: its live line shows the pod it installs, its log
-* keeps the whole output, and a failure prints CocoaPods' `[!]` errors and a
-* crash's `SomeError - …` line with its last lines, without the download
-* progress CocoaPods' curl prints on stderr.
-*/
-const createPodInstallLogger = () => new _hot_updater_cli_tools.BuildLogger({
-	logPrefix: "pod-install",
-	createPhaseReader: () => (line) => {
-		const installing = /^Installing (\S+)/.exec(line);
-		if (installing) return `Installing ${installing[1]}`;
-		return /^(Analyzing dependencies|Downloading dependencies|Generating Pods project|Integrating client project)$/.test(line) ? line : void 0;
-	},
-	failureSummary: {
-		lines: [/^[A-Z]\w*(::\w+)*Error - /],
-		blocks: [{
-			start: /^\[!\] /,
-			end: /^$/,
-			includeEnd: false
-		}],
-		ignore: DOWNLOAD_PROGRESS,
-		tail: 4,
-		stopAfter: /^\[!\] Oh no, an error occurred\.$/,
-		maxWidth: 76
-	}
-});
-/**
-* Runs `pod install` as a step whose failure prints CocoaPods' errors and
-* the log's path, then throws a `BuildFailedError`.
-*/
-const runPodInstall = async ({ command, env, sourceDir }) => {
-	const logger = createPodInstallLogger();
-	const failureMessage = `${command.join(" ")} failed`;
-	await logger.start({
-		title: "Installing CocoaPods dependencies",
-		header: [`$ ${formatCommand([...Object.entries(env).map(([name, value]) => `${name}=${value}`), ...command])}`, ""]
-	});
-	try {
-		const podProcess = (0, execa.execa)(command[0], command.slice(1), {
-			cwd: sourceDir,
-			env,
-			all: true,
-			buffer: false
-		});
-		const logging = podProcess.all ? logger.processStream(podProcess.all) : Promise.resolve();
-		const [podResult, loggingResult] = await Promise.allSettled([podProcess, logging]);
-		if (podResult.status === "rejected") throw podResult.reason;
-		if (loggingResult.status === "rejected") throw loggingResult.reason;
-		logger.stop("CocoaPods dependencies installed");
-	} catch (error) {
-		logger.writeError(error);
-		const reason = error instanceof execa.ExecaError && error.exitCode !== void 0 ? `exited with code ${error.exitCode}` : error instanceof Error ? error.message : String(error);
-		logger.stop(`${failureMessage} · ${reason}`, false);
-		throw new _hot_updater_cli_tools.BuildFailedError(`${failureMessage}: ${reason}`, {
-			logPath: logger.logPath,
-			summary: logger.failureSummary,
-			cause: error
-		});
-	} finally {
-		await logger.close();
-	}
-};
-const installPodsIfNeeded = async (sourceDir) => {
-	const podfilePath = path.default.join(sourceDir, "Podfile");
-	if (!fs.default.existsSync(podfilePath)) {
-		_hot_updater_cli_tools.p.log.info("No Podfile found, skipping CocoaPods installation");
-		return {
-			codegen: false,
-			pods: false
-		};
-	}
-	const gemfilePaths = [path.default.join(sourceDir, "Gemfile"), path.default.join((0, _hot_updater_cli_tools.getCwd)(), "Gemfile")];
-	const shouldUseBundler = (await Promise.all(gemfilePaths.map(checkShouldUseBundler))).some(Boolean);
-	const reactNative = (0, _hot_updater_cli_tools.getReactNativeMetadatas)();
-	const plan = resolvePodInstallPlan({
-		version: reactNative.version,
-		env: process.env
-	});
-	if (plan.runCodegen) await runReactNativeCodegen({
-		projectRoot: (0, _hot_updater_cli_tools.getCwd)(),
-		reactNativePath: reactNative.packagePath,
-		sourceDir
-	});
-	if (shouldUseBundler) {
-		const bundleSpinner = _hot_updater_cli_tools.p.spinner();
-		bundleSpinner.start("Installing Ruby gems");
-		try {
-			await (0, execa.execa)("bundle", ["install"], {
-				cwd: sourceDir,
-				all: true
-			});
-		} catch (error) {
-			bundleSpinner.error("bundle install failed");
-			throw commandFailure("bundle install", error);
-		}
-		bundleSpinner.stop("Ruby gems installed");
-	}
-	await runPodInstall({
-		command: shouldUseBundler ? [
-			"bundle",
-			"exec",
-			"pod",
-			"install"
-		] : ["pod", "install"],
-		env: plan.env,
-		sourceDir
-	});
-	return {
-		codegen: plan.runCodegen,
-		pods: true
-	};
-};
-const checkShouldUseBundler = async (gemfilePath) => {
-	try {
-		if (!fs.default.existsSync(gemfilePath)) return false;
-		return (await fs.default.promises.readFile(gemfilePath, "utf-8")).includes("cocoapods");
-	} catch {
-		return false;
-	}
-};
-/**
-* Runs React Native codegen into `<sourceDir>/build/generated/ios`, as the
-* React Native CLI does before `pod install`. Clearing the old output first
-* drops the modules of removed libraries.
-*/
-const runReactNativeCodegen = async ({ projectRoot, reactNativePath, sourceDir }) => {
-	await fs.default.promises.rm(path.default.join(sourceDir, "build", "generated", "ios"), {
-		recursive: true,
-		force: true
-	});
-	const spinner = _hot_updater_cli_tools.p.spinner();
-	spinner.start("Running React Native codegen");
-	try {
-		await (0, execa.execa)("node", [
-			path.default.join(reactNativePath, "scripts", "generate-codegen-artifacts.js"),
-			"-p",
-			projectRoot,
-			"-o",
-			sourceDir,
-			"-t",
-			"ios"
-		], {
-			cwd: projectRoot,
-			all: true
-		});
-	} catch (error) {
-		spinner.error("React Native codegen failed");
-		throw commandFailure("React Native codegen", error);
-	}
-	spinner.stop("React Native codegen done");
-};
-/**
-* The environment `pod install` runs with, and whether codegen runs first.
-*
-* From React Native 0.79, `RCT_IGNORE_PODS_DEPRECATION=1` silences the
-* deprecation notice for calling `pod install` directly and also sets
-* `RCT_SKIP_CODEGEN=1`, because the React Native CLI runs codegen itself
-* first. Hot Updater sets it the same way and runs codegen too, unless the
-* user's `RCT_SKIP_CODEGEN=1` takes codegen over. Before 0.79, and when the
-* version is unknown, CocoaPods runs codegen. A user's value of a flag wins.
-*/
-const resolvePodInstallPlan = ({ version, env }) => {
-	const podsSkipCodegen = version.major > 0 || version.minor >= 79;
-	const usePrebuiltReactNative = version.major > 0 || version.minor >= 81;
-	const ignorePodsDeprecation = env["RCT_IGNORE_PODS_DEPRECATION"] ?? (podsSkipCodegen ? "1" : void 0);
-	return {
-		runCodegen: podsSkipCodegen && ignorePodsDeprecation === "1" && env["RCT_SKIP_CODEGEN"] !== "1",
-		env: {
-			...ignorePodsDeprecation !== void 0 && { RCT_IGNORE_PODS_DEPRECATION: ignorePodsDeprecation },
-			RCT_USE_RN_DEP: env["RCT_USE_RN_DEP"] ?? (usePrebuiltReactNative ? "1" : "0"),
-			RCT_USE_PREBUILT_RNCORE: env["RCT_USE_PREBUILT_RNCORE"] ?? (usePrebuiltReactNative ? "1" : "0")
-		}
-	};
-};
-//#endregion
 //#region src/utils/createRandomTmpDir.ts
 const TERMINATION_SIGNALS$2 = [
 	"SIGHUP",
@@ -1048,844 +835,325 @@ const removeTmpDir = async (directory) => {
 	if (liveDirectories.delete(directory) && liveDirectories.size === 0) stopListening();
 };
 //#endregion
-//#region src/utils/platform.ts
+//#region src/utils/escapeUnzipPattern.ts
 /**
-* Platform configurations for different Apple platforms
+* A zip entry name as `unzip` reads a literal member. It takes `*`, `?` and
+* `[...]` in a member name as wildcards, which a backslash escapes, so an
+* app named `My[Dev].app` would otherwise match nothing.
 */
-const platformConfigs = { ios: {
-	name: "ios",
-	deviceSdk: "iphoneos",
-	simulatorSdk: "iphonesimulator",
-	supportsSimulator: true,
-	deviceDestination: "platform=iOS",
-	simulatorDestination: "platform=iOS Simulator"
-} };
+const escapeUnzipPattern = (name) => name.replace(/[[\]*?\\]/gu, "\\$&");
 //#endregion
-//#region src/utils/destination.ts
-const buildDestinationString = ({ deviceType, platform, useGeneric }) => `${useGeneric ? "generic/" : ""}${deviceType === "device" ? platformConfigs[platform].deviceDestination : platformConfigs[platform].simulatorDestination}`;
+//#region src/utils/readIpaInfo.ts
+const INFO_PLIST_KEYS = {
+	bundleId: "CFBundleIdentifier",
+	shortVersion: "CFBundleShortVersionString",
+	bundleVersion: "CFBundleVersion"
+};
 /**
-* Resolves IosBuildDestination to xcodebuild destination format
+* Runs `read` on a copy of the app's `Payload/<App>.app/Info.plist` out of an
+* `.ipa`, never a framework's or an extension's, which nest deeper.
 */
-const resolveDestination = ({ destination, useGeneric }) => {
-	if (typeof destination === "object") {
-		if ("id" in destination) return `id=${destination.id}`;
-		if ("name" in destination) return `name=${destination.name}`;
-	}
-	switch (destination) {
-		case "ios-device": return buildDestinationString({
-			platform: "ios",
-			deviceType: "device",
-			useGeneric
-		});
-		case "ios-simulator": return buildDestinationString({
-			platform: "ios",
-			deviceType: "simulator",
-			useGeneric
+const withIpaInfoPlist = async (ipaPath, read) => {
+	const { stdout } = await (0, execa.execa)("unzip", ["-Z1", ipaPath]);
+	const entry = stdout.split("\n").map((name) => name.trim()).find((name) => /^Payload\/[^/]+\.app\/Info\.plist$/u.test(name));
+	if (entry === void 0) throw new Error(`${path.default.basename(ipaPath)} has no Payload/<App>.app/Info.plist.`);
+	const directory = await createRandomTmpDir();
+	try {
+		const infoPlist = path.default.join(directory, "Info.plist");
+		await (0, execa.execa)("unzip", [
+			"-p",
+			ipaPath,
+			escapeUnzipPattern(entry)
+		], { stdout: { file: infoPlist } });
+		return await read(infoPlist);
+	} finally {
+		await fs.default.promises.rm(directory, {
+			recursive: true,
+			force: true
 		});
 	}
 };
-const resolveDestinations = ({ destinations, useGeneric }) => {
-	return destinations.map((destination) => resolveDestination({
-		destination,
-		useGeneric
-	}));
-};
-const getDefaultDestination = ({ platform, useGeneric, deviceType }) => {
-	return buildDestinationString({
-		deviceType,
-		platform,
-		useGeneric
-	});
-};
-//#endregion
-//#region src/utils/parseXcodeProjectInfo.ts
-const parseXcodeProjectInfo = async (sourceDir) => {
-	const files = await fs.default.promises.readdir(sourceDir);
-	const workspace = files.find((file) => file.endsWith(".xcworkspace"));
-	if (workspace) return {
-		isWorkspace: true,
-		name: workspace,
-		path: path.default.join(sourceDir, workspace)
-	};
-	const project = files.find((file) => file.endsWith(".xcodeproj"));
-	if (project) return {
-		isWorkspace: false,
-		name: project,
-		path: path.default.join(sourceDir, project)
-	};
-	throw new Error(`No Xcode project or workspace found in ${sourceDir}`);
-};
-//#endregion
-//#region src/utils/prettifyXcodebuildError.ts
-const prettifyXcodebuildError = (error) => {
-	if (error instanceof _hot_updater_cli_tools.BuildFailedError) {
-		const errorLines = error.summary.join("\n");
-		const hint = mentionsProgramLicenseAgreement(errorLines) ? PROGRAM_LICENSE_AGREEMENT_HINT : errorLines.includes("error: No profiles for") || errorLines.includes("error: Provisioning profile") ? "No valid provisioning profile is set in the project.\nCheck the Signing & Capabilities tab in Xcode." : null;
-		return new _hot_updater_cli_tools.BuildFailedError(hint ?? error.message, {
-			logPath: error.logPath,
-			summary: error.summary,
-			hint,
-			cause: error.cause
-		});
+/** What App Store Connect files an `.ipa` under. */
+const readIpaInfo = (ipaPath) => withIpaInfoPlist(ipaPath, async (infoPlist) => {
+	const info = {};
+	for (const [field, key] of Object.entries(INFO_PLIST_KEYS)) {
+		const { stdout: value, exitCode } = await (0, execa.execa)("plutil", [
+			"-extract",
+			key,
+			"raw",
+			"-o",
+			"-",
+			infoPlist
+		], { reject: false });
+		if (exitCode !== 0 || !value.trim()) throw new Error(`${path.default.basename(ipaPath)}'s Info.plist has no ${key}.`);
+		info[field] = value.trim();
 	}
-	return /* @__PURE__ */ new Error(`Xcodebuild failed: ${error}`);
-};
-//#endregion
-//#region src/utils/xcodebuildPhase.ts
-/** The `(in target 'X' from project 'Y')` that ends an action's line. */
-const TARGET = /\(in target '([^']+)' from project '[^']+'\)\s*$/;
-/** A `PhaseScriptExecution` line's script phase, its spaces escaped. */
-const SCRIPT = /^PhaseScriptExecution ((?:\\.|[^\s\\])+)/;
-/** A batched `SwiftCompile`'s files: `Compiling\ A.swift,\ B.swift`. */
-const SWIFT_BATCH = /^SwiftCompile \S+ \S+ Compiling\\ ((?:\\.|[^\s\\])+)/;
-const unescape = (value) => value.replace(/\\(.)/g, "$1");
-/** Actions whose lines say what xcodebuild is doing, by their first word. */
-const ACTIONS = {
-	CompileAssetCatalog: "Compiling assets",
-	CompileAssetCatalogVariant: "Compiling assets",
-	LinkAssetCatalog: "Compiling assets",
-	CompileStoryboard: "Compiling storyboards",
-	CompileXIB: "Compiling storyboards",
-	LinkStoryboards: "Compiling storyboards",
-	Ld: "Linking",
-	Libtool: "Linking",
-	CodeSign: "Signing",
-	ProcessInfoPlistFile: "Processing",
-	ProcessProductPackaging: "Processing",
-	ProcessProductPackagingDER: "Processing",
-	CopySwiftLibs: "Copying",
-	CpResource: "Copying",
-	GenerateDSYMFile: "Generating dSYM",
-	Strip: "Stripping",
-	Validate: "Validating"
-};
-const COMPILES = /* @__PURE__ */ new Set([
-	"CompileC",
-	"SwiftCompile",
-	"CompileSwift"
-]);
-const PRECOMPILES = /* @__PURE__ */ new Set([
-	"PrecompileModule",
-	"ScanDependencies",
-	"SwiftExplicitDependencyGeneratePcm",
-	"SwiftExplicitDependencyCompileModuleFromInterface"
-]);
-const plural = (count, noun) => `${count} ${noun}${count === 1 ? "" : "s"}`;
+	return info;
+});
+/** Whether Xcode marked an `.ipa`'s app for TestFlight internal testing only. */
+const readIpaInternalTestingOnly = (ipaPath) => withIpaInfoPlist(ipaPath, async (infoPlist) => {
+	const { stdout: value, exitCode } = await (0, execa.execa)("plutil", [
+		"-extract",
+		"TFInternalTestingOnly",
+		"raw",
+		"-o",
+		"-",
+		infoPlist
+	], { reject: false });
+	return exitCode === 0 && value.trim() === "true";
+});
 /**
-* Reads the phase of an `xcodebuild` build, archive, or export from its raw
-* output: `Compiling React-Core · 412 files`, `Linking CodexRelay`,
-* `Signing CodexRelay`, `Bundling JavaScript`, with the target each
-* action's line names.
+* Whether an `.ipa`'s app answers export compliance in its Info.plist. Either
+* value is an answer, so this asks only whether the key is there.
 */
-const createXcodebuildPhaseReader = () => {
-	let compiled = 0;
-	let precompiled = 0;
-	return (line) => {
-		const space = line.indexOf(" ");
-		const action = space === -1 ? line : line.slice(0, space);
-		const target = TARGET.exec(line)?.[1];
-		const withTarget = (phase) => target ? `${phase} ${target}` : phase;
-		if (COMPILES.has(action)) {
-			const batch = SWIFT_BATCH.exec(line)?.[1];
-			compiled += batch ? unescape(batch).split(",").length : 1;
-			return `${withTarget("Compiling")} · ${plural(compiled, "file")}`;
-		}
-		if (PRECOMPILES.has(action)) {
-			precompiled += 1;
-			return `Precompiling modules · ${precompiled}`;
-		}
-		if (action === "PhaseScriptExecution") {
-			const script = unescape(SCRIPT.exec(line)?.[1] ?? "");
-			if (script === "Bundle React Native code and images") return "Bundling JavaScript";
-			return script ? `Running ${script}` : withTarget("Running a script");
-		}
-		const phase = ACTIONS[action];
-		if (phase) return withTarget(phase);
-		if (line === "Prepare packages" || line.startsWith("Resolve Package")) return "Resolving packages";
-		if (line === "ComputeTargetDependencyGraph") return "Planning the build";
-	};
-};
-//#endregion
-//#region src/utils/createXcodebuildLogger.ts
-const createXcodebuildLogger = ({ logPrefix, logFilePath }) => new _hot_updater_cli_tools.BuildLogger({
-	logPrefix,
-	logFilePath,
-	createPhaseReader: createXcodebuildPhaseReader,
-	failureSummary: {
-		lines: [/(^|:\s)error: /, /^\*\* [A-Z ]+ FAILED \*\*$/],
-		blocks: [{
-			start: "The following build commands failed:",
-			end: /^\(\d+ failures?\)$/,
-			includeEnd: true
-		}, {
-			start: /^error: exportArchive /,
-			end: /^$/,
-			includeEnd: false
-		}]
-	}
+const readIpaHasExportComplianceKey = (ipaPath) => withIpaInfoPlist(ipaPath, async (infoPlist) => {
+	const { exitCode } = await (0, execa.execa)("plutil", [
+		"-extract",
+		"ITSAppUsesNonExemptEncryption",
+		"raw",
+		"-o",
+		"-",
+		infoPlist
+	], { reject: false });
+	return exitCode === 0;
 });
 //#endregion
-//#region src/utils/runXcodebuildWithLogging.ts
-const TERMINATION_SIGNALS$1 = ["SIGINT", "SIGTERM"];
-const createRawXcodebuildProcess = ({ args, env, sourceDir }) => {
-	return (0, execa.execa)("xcodebuild", args, {
-		cwd: sourceDir,
-		all: true,
-		buffer: false,
-		env: {
-			...process.env,
-			...env,
-			NSUnbufferedIO: "YES"
-		}
+//#region src/utils/xcodeSigning.ts
+/**
+* How a device build signs with automatic signing, authenticated by the
+* scheme's App Store Connect API key: the xcodebuild arguments, and the key.
+* The key is resolved only here, for a device build of a scheme with
+* `signing`. Without `credentials`, it resolves from the environment or the
+* config's `secrets` adapter, and the temporary files are deleted when the
+* process exits.
+*/
+const resolveXcodeSigning = async ({ schemeConfig, credentials }) => {
+	const reference = schemeConfig.signing?.ascApiKey;
+	if (!reference) return;
+	const apiKey = await (credentials ?? (0, _hot_updater_cli_tools.createCredentialResolver)()).resolve({
+		kind: "asc-api-key",
+		name: (0, _hot_updater_cli_tools.parseSecretReference)(reference, "signing.ascApiKey")
 	});
+	return {
+		authenticationArgs: [
+			"-allowProvisioningUpdates",
+			"-authenticationKeyPath",
+			apiKey.keyPath,
+			"-authenticationKeyID",
+			apiKey.keyId,
+			"-authenticationKeyIssuerID",
+			apiKey.issuerId
+		],
+		apiKey
+	};
 };
-/** Why xcodebuild failed, without its command line. */
-const describeFailure = (error) => {
-	if (error instanceof execa.ExecaError) {
-		if (error.signal) return `xcodebuild was stopped by ${error.signal}.`;
-		if (error.exitCode !== void 0) return `xcodebuild exited with code ${error.exitCode}.`;
+const APP_STORE_CONNECT_EXPORT_OPTIONS = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>method</key>
+  <string>app-store-connect</string>
+  <key>signingStyle</key>
+  <string>automatic</string>
+</dict>
+</plist>
+`;
+/** The export option that keeps a build from App Store review. */
+const INTERNAL_TESTING_ONLY = "testFlightInternalTestingOnly";
+/**
+* Writes the export options of a scheme that signs with an App Store Connect
+* API key and sets no `exportOptionsPlist`: an App Store Connect export with
+* automatic signing, internal testing only for a sandbox build.
+*/
+const writeAppStoreConnectExportOptions = async (directory, { internalTestingOnly = false } = {}) => {
+	const exportOptionsPlist = path.default.join(directory, "ExportOptions.plist");
+	await fs.default.promises.writeFile(exportOptionsPlist, internalTestingOnly ? APP_STORE_CONNECT_EXPORT_OPTIONS.replace("</dict>", `  <key>${INTERNAL_TESTING_ONLY}</key>\n  <true/>\n</dict>`) : APP_STORE_CONNECT_EXPORT_OPTIONS);
+	return exportOptionsPlist;
+};
+/**
+* `testFlightInternalTestingOnly` in export options: undefined without it.
+*/
+const readInternalTestingOnly = async (exportOptionsPlist) => {
+	const uncommented = (await fs.default.promises.readFile(exportOptionsPlist, "utf-8").catch(() => void 0))?.replace(/<!--[\s\S]*?-->/gu, "");
+	if (uncommented?.includes("<plist")) {
+		const match = new RegExp(`<key>\\s*${INTERNAL_TESTING_ONLY}\\s*</key>\\s*<(true|false)\\s*/>`, "u").exec(uncommented);
+		return match ? match[1] === "true" : void 0;
 	}
-	return error instanceof Error ? error.message : String(error);
+	const { stdout, exitCode } = await (0, execa.execa)("plutil", [
+		"-extract",
+		INTERNAL_TESTING_ONLY,
+		"raw",
+		"-o",
+		"-",
+		exportOptionsPlist
+	], { reject: false });
+	return exitCode === 0 ? stdout.trim() === "true" : void 0;
 };
 /**
-* Runs xcodebuild as a step titled `title`: its live line shows the build's
-* phase, the log file keeps the command and the whole output, and a failure
-* prints the output's errors and the log's path on stderr.
+* Refuses a sandbox scheme's App Store Connect export that turns internal
+* testing off: Apple keeps a build out of review only with it on. Another
+* method's `.ipa` never reaches App Store Connect.
 */
-const runXcodebuildWithLogging = async ({ args, env, sourceDir, title, successMessage, failureMessage, logPrefix, logFilePath, header = [] }) => {
-	const logger = createXcodebuildLogger({
-		logPrefix,
-		logFilePath
-	});
-	await logger.start({
-		title,
-		header: [
-			...header,
-			`$ ${formatCommand(["xcodebuild", ...args])}`,
-			""
-		]
-	});
-	const activeProcesses = [];
-	const terminateActiveProcesses = () => {
-		for (const activeProcess of activeProcesses) activeProcess.kill();
-	};
-	for (const signal of TERMINATION_SIGNALS$1) process.once(signal, terminateActiveProcesses);
-	try {
-		const xcodebuildProcess = createRawXcodebuildProcess({
-			args,
-			env,
-			sourceDir
-		});
-		activeProcesses.push(xcodebuildProcess);
-		const xcodebuildOutput = xcodebuildProcess.all ?? xcodebuildProcess.stdout;
-		const logging = xcodebuildOutput ? logger.processStream(xcodebuildOutput) : Promise.resolve();
-		const [xcodebuildResult, loggingResult] = await Promise.allSettled([xcodebuildProcess, logging]);
-		if (xcodebuildResult.status === "rejected") throw xcodebuildResult.reason;
-		if (loggingResult.status === "rejected") throw loggingResult.reason;
-		logger.stop(successMessage);
-		return { logFilePath: logger.logFilePath };
-	} catch (error) {
-		logger.writeError(error);
-		const reason = describeFailure(error);
-		logger.stop(`${failureMessage} · ${reason.replace(/\.$/, "")}`, false);
-		throw new _hot_updater_cli_tools.BuildFailedError(`${failureMessage}: ${reason}`, {
-			logPath: logger.logPath,
-			summary: logger.failureSummary,
-			cause: error
-		});
-	} finally {
-		for (const signal of TERMINATION_SIGNALS$1) process.off(signal, terminateActiveProcesses);
-		await logger.close();
-	}
+const assertSandboxExportOptions = async (schemeName, exportOptionsPlist) => {
+	if (APP_STORE_EXPORT_METHODS.has(await readExportMethod(exportOptionsPlist)) && await readInternalTestingOnly(exportOptionsPlist) === false) throw new Error(`The sandbox scheme ${schemeName} turns ${INTERNAL_TESTING_ONLY} off in exportOptionsPlist.\nRemove the key, or set it to true.`);
 };
-//#endregion
-//#region src/utils/writeBuildXcconfig.ts
-const SDK_CONDITIONS = [
-	"",
-	"[sdk=iphoneos*]",
-	"[sdk=iphonesimulator*]"
-];
 /**
-* Finds a setting of `keys` that an included xcconfig sets with a condition
-* the build xcconfig does not, such as `[config=Release]` or `[arch=arm64]`,
-* which would outrank the build's own. It follows `#include`s, which are
-* relative to the including file.
+* The export options a sandbox scheme's `exportOptionsPlist` exports with:
+* the file itself, or a copy in `directory` that turns internal testing on
+* when an App Store Connect export leaves it out.
 */
-const findConditionalSetting = async (files, keys, visited = /* @__PURE__ */ new Set()) => {
-	for (const file of files) {
-		if (visited.has(file) || !fs.default.existsSync(file)) continue;
-		visited.add(file);
-		const lines = (await fs.default.promises.readFile(file, "utf-8")).split("\n");
-		for (const [index, line] of lines.entries()) {
-			const include = line.match(/^\s*#include\??\s*"([^"]+)"/)?.[1];
-			if (include) {
-				const found = await findConditionalSetting([path.default.resolve(path.default.dirname(file), include)], keys, visited);
-				if (found) return found;
-				continue;
-			}
-			const [, key, conditions] = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)((?:\[[^\]]*\])+)\s*=/) ?? [];
-			if (key && keys.includes(key) && !SDK_CONDITIONS.includes(conditions)) return `${file}:${index + 1} sets ${key}${conditions}`;
-		}
-	}
+const resolveSandboxExportOptions = async (schemeName, exportOptionsPlist, directory) => {
+	await assertSandboxExportOptions(schemeName, exportOptionsPlist);
+	if (!APP_STORE_EXPORT_METHODS.has(await readExportMethod(exportOptionsPlist)) || await readInternalTestingOnly(exportOptionsPlist) === true) return exportOptionsPlist;
+	const copy = path.default.join(directory, "ExportOptions.plist");
+	await fs.default.promises.copyFile(exportOptionsPlist, copy);
+	await (0, execa.execa)("plutil", [
+		"-insert",
+		INTERNAL_TESTING_ONLY,
+		"-bool",
+		"true",
+		copy
+	]);
+	return copy;
 };
-/**
-* Writes the xcconfig a build loads, which sets the CLI's build settings
-* over every other. xcodebuild ranks an `-xcconfig`'s settings above the
-* command line's, so the scheme's `xcconfig` and each `-xcconfig` in
-* `extraParams` are included, in order, before `settings`, and the build
-* loads only this one.
-*/
-const writeBuildXcconfig = async ({ directory, sourceDir, xcconfig, extraParams = [], settings }) => {
-	const included = xcconfig ? [xcconfig] : [];
-	const otherParams = [];
-	for (let i = 0; i < extraParams.length; i++) if (extraParams[i] === "-xcconfig" && i + 1 < extraParams.length) included.push(extraParams[++i]);
-	else otherParams.push(extraParams[i]);
-	const includedFiles = included.map((file) => path.default.resolve(sourceDir, file));
-	const conditional = await findConditionalSetting(includedFiles, Object.keys(settings));
-	if (conditional) throw new Error(`${conditional}, which would outrank the value the build sets. Set it without that condition, or remove it.`);
-	const buildXcconfig = path.default.join(directory, "HotUpdater.xcconfig");
-	await fs.default.promises.writeFile(buildXcconfig, [
-		...includedFiles.map((file) => `#include "${file}"`),
-		...Object.entries(settings).flatMap(([key, value]) => SDK_CONDITIONS.map((condition) => `${key}${condition} = ${value}`)),
-		""
-	].join("\n"));
-	return {
-		xcconfig: buildXcconfig,
-		extraParams: otherParams
-	};
+/** The export methods whose `.ipa` App Store Connect takes. */
+const APP_STORE_EXPORT_METHODS = /* @__PURE__ */ new Set(["app-store", "app-store-connect"]);
+/** The `method` of export options, or "" when it has none or can't be read. */
+const readExportMethod = async (exportOptionsPlist) => {
+	const xml = (await fs.default.promises.readFile(exportOptionsPlist, "utf-8").catch(() => void 0))?.replace(/<!--[\s\S]*?-->/gu, "").match(/<key>\s*method\s*<\/key>\s*<string>\s*([^<]*?)\s*<\/string>/u);
+	if (xml) return xml[1];
+	const { stdout, exitCode } = await (0, execa.execa)("plutil", [
+		"-extract",
+		"method",
+		"raw",
+		"-o",
+		"-",
+		exportOptionsPlist
+	], { reject: false });
+	return exitCode === 0 ? stdout.trim() : "";
 };
 /**
-* Automatic signing over a target set to manual signing, whose provisioning
-* profile and identity Xcode would otherwise report as conflicting.
+* Whether a device build exports for the devices its profile lists: with
+* `release-testing`, or `ad-hoc`, Xcode's older name for it. On an empty
+* keychain with the API key, Apple's cloud-managed distribution certificate
+* signs it, as it does an App Store Connect export.
 */
-const AUTOMATIC_SIGNING = {
-	CODE_SIGN_STYLE: "Automatic",
-	PROVISIONING_PROFILE: "",
-	PROVISIONING_PROFILE_SPECIFIER: "",
-	CODE_SIGN_IDENTITY: "Apple Development"
-};
+const exportsForRegisteredDevices = async ({ exportOptionsPlist }) => exportOptionsPlist !== void 0 && ["release-testing", "ad-hoc"].includes(await readExportMethod(exportOptionsPlist));
 /**
-* The settings a build sets over the scheme's: the MIN_BUNDLE_ID the CLI
-* issues and reports, and automatic signing when an App Store Connect API
-* key signs, which a target set to manual signing would not use.
+* Whether a device build exports for App Store Connect: with its
+* `exportOptionsPlist`'s method, or, without one, as a scheme signing with
+* an App Store Connect API key does. Such an `.ipa` is signed with Apple's
+* cloud-managed distribution certificate, never with a development
+* certificate the archive was signed with.
 */
-const buildSettingsOverScheme = ({ minBundleId, authenticationArgs }) => ({
-	HOT_UPDATER_MIN_BUNDLE_ID: minBundleId,
-	...authenticationArgs ? AUTOMATIC_SIGNING : {}
-});
+const exportsForAppStoreConnect = async (schemeConfig) => !schemeConfig.exportOptionsPlist || APP_STORE_EXPORT_METHODS.has(await readExportMethod(schemeConfig.exportOptionsPlist));
 //#endregion
-//#region src/builder/archiveXcodeProject.ts
+//#region src/uploadToTestFlight.ts
+const API_URL$2 = "https://api.appstoreconnect.apple.com";
+/** Apple accepts tokens that expire within 20 minutes. */
+const TOKEN_LIFETIME_SECONDS = 1200;
+/** A token is replaced well before it expires, so no request carries a stale one. */
+const TOKEN_REUSE_SECONDS = 600;
+/** The parts of an `.ipa` sent at once. */
+const UPLOAD_CONCURRENCY = 4;
+/** Attempts to create the build upload and to commit the uploaded `.ipa`. */
+const COMMIT_ATTEMPTS = 3;
+/** Attempts per part: a part is a plain PUT, safe to repeat. */
+const UPLOAD_ATTEMPTS = 3;
+const IN_PROGRESS_STATES = /* @__PURE__ */ new Set(["AWAITING_UPLOAD", "PROCESSING"]);
+/** The error App Store Connect answers with when a build number is taken. */
+const DUPLICATE_ERROR_CODE = "ENTITY_ERROR.ATTRIBUTE.INVALID.DUPLICATE";
 /**
-* Archives the scheme into `archiveDirectory`. The build's xcconfig is
-* written to a temporary directory, removed whether the archive succeeds or
-* not.
+* App Store Connect refused the upload: it already has a build with the
+* `.ipa`'s version and build number, from this or another upload, and takes
+* each build number once per version.
 */
-const archiveXcodeProject = async ({ sourceDir, archiveDirectory, platform, installPods, destination, extraParams, configuration, xcodeScheme, xcconfig, logPrefix, header = [], minBundleId, authenticationArgs }) => {
-	if (installPods) await installPodsIfNeeded(sourceDir);
-	const xcodeProject = await parseXcodeProjectInfo(sourceDir);
-	const archiveName = `${xcodeProject.name.replace(".xcworkspace", "").replace(".xcodeproj", "")}.xcarchive`;
-	const archivePath = path.default.join(archiveDirectory, archiveName);
-	const tmpDir = await createRandomTmpDir();
-	try {
-		const build = await writeBuildXcconfig({
-			directory: tmpDir,
-			sourceDir,
-			xcconfig,
-			extraParams,
-			settings: buildSettingsOverScheme({
-				minBundleId,
-				authenticationArgs
-			})
-		});
-		const archiveArgs = prepareArchiveArgs({
-			authenticationArgs,
-			minBundleId,
-			archivePath,
-			platform,
-			sourceDir,
-			xcodeProject,
-			configuration,
-			extraParams: build.extraParams,
-			destination,
-			xcconfig: build.xcconfig,
-			xcodeScheme
-		});
-		try {
-			const { logFilePath } = await runXcodebuildWithLogging({
-				args: archiveArgs,
-				env: { HOT_UPDATER_MIN_BUNDLE_ID: minBundleId },
-				title: `Archiving ${xcodeScheme}`,
-				successMessage: `Archived ${xcodeScheme}`,
-				failureMessage: "Archive failed",
-				logPrefix,
-				header: [
-					...header,
-					`Project   ${xcodeProject.name}`,
-					`Scheme    ${xcodeScheme}`,
-					`Platform  ${platform}`
-				],
-				sourceDir
-			});
-			return {
-				archivePath,
-				logFilePath
-			};
-		} catch (error) {
-			throw prettifyXcodebuildError(error);
-		}
-	} finally {
-		await removeTmpDir(tmpDir);
+var TestFlightBuildExistsError = class extends Error {
+	shortVersion;
+	bundleVersion;
+	name = "TestFlightBuildExistsError";
+	constructor(shortVersion, bundleVersion, options) {
+		super(`App Store Connect already has build ${bundleVersion} of version ${shortVersion}.\nUse a new build number (CFBundleVersion).`, options);
+		this.shortVersion = shortVersion;
+		this.bundleVersion = bundleVersion;
 	}
 };
-const prepareArchiveArgs = ({ xcodeScheme, archivePath, platform, sourceDir, xcodeProject, configuration = "Release", xcconfig, extraParams, destination = [], minBundleId, authenticationArgs }) => {
-	const args = [
-		xcodeProject.isWorkspace ? "-workspace" : "-project",
-		path.default.join(sourceDir, xcodeProject.name),
-		"-scheme",
-		xcodeScheme,
-		"-configuration",
-		configuration,
-		"archive",
-		"-archivePath",
-		archivePath,
-		`HOT_UPDATER_MIN_BUNDLE_ID=${minBundleId}`
-	];
-	if (authenticationArgs) args.push(...authenticationArgs);
-	if (xcconfig) args.push("-xcconfig", xcconfig);
-	if (extraParams) args.push(...extraParams);
-	const resolvedDestinations = resolveDestinations({
-		destinations: destination,
-		useGeneric: true
-	});
-	if (resolvedDestinations.length === 0) resolvedDestinations.push(getDefaultDestination({
-		deviceType: "device",
-		platform,
-		useGeneric: true
-	}));
-	for (const destination of resolvedDestinations) args.push("-destination", destination);
-	return args;
+/** An App Store Connect API request that failed, with the errors it answered. */
+var AppStoreConnectError = class extends Error {
+	status;
+	errors;
+	/** The answer's `Retry-After` header, for a rate limit. */
+	retryAfter;
+	constructor(action, status, errors, retryAfter = null) {
+		const details = errors.map((error) => error.detail ?? error.title ?? error.code).filter(Boolean);
+		super(`${action} failed (HTTP ${status})${details.length > 0 ? `: ${details.join(" ")}` : "."}`);
+		this.name = "AppStoreConnectError";
+		this.status = status;
+		this.errors = errors;
+		this.retryAfter = retryAfter;
+	}
 };
-//#endregion
-//#region src/builder/buildXcodeProject.ts
 /**
-* Builds the scheme in a temporary DerivedData directory, copies the built
-* `.app` to `outputDirectory`, and removes DerivedData, which takes 10 GB or
-* more, whether the build succeeds or not.
+* An App Store Connect API token: an ES256 JWT, whose signature JWS encodes
+* as the raw 64-byte r || s, not the DER Node signs by default.
 */
-const buildXcodeProject = async ({ sourceDir, outputDirectory, platform, xcodeScheme, configuration, deviceType, logPrefix, destination = [], useGenericDestination = false, installPods, extraParams, minBundleId, authenticationArgs, header = [] }) => {
-	if (installPods) await installPodsIfNeeded(sourceDir);
-	const xcodeProject = await parseXcodeProjectInfo(sourceDir);
-	const tmpDir = await createRandomTmpDir();
-	try {
-		const derivedDataPath = path.default.join(tmpDir, "DerivedData");
-		const resolvedDestinations = resolveDestinations({
-			destinations: destination,
-			useGeneric: useGenericDestination
-		});
-		if (resolvedDestinations.length === 0) resolvedDestinations.push(getDefaultDestination({
-			deviceType,
-			platform,
-			useGeneric: useGenericDestination
-		}));
-		const build = await writeBuildXcconfig({
-			directory: tmpDir,
-			sourceDir,
-			extraParams,
-			settings: buildSettingsOverScheme({
-				minBundleId,
-				authenticationArgs
-			})
-		});
-		const buildArgs = prepareBuildArgs({
-			authenticationArgs,
-			xcconfig: build.xcconfig,
-			minBundleId,
-			configuration,
-			derivedDataPath,
-			deviceType,
-			resolvedDestinations,
-			extraParams: build.extraParams,
-			platform,
-			xcodeScheme,
-			sourceDir,
-			xcodeProject
-		});
-		let builtAppPath;
-		let logFilePath;
-		try {
-			({logFilePath} = await runXcodebuildWithLogging({
-				args: buildArgs,
-				env: { HOT_UPDATER_MIN_BUNDLE_ID: minBundleId },
-				sourceDir,
-				logPrefix,
-				header: [
-					...header,
-					`Project        ${xcodeProject.name}`,
-					`Scheme         ${xcodeScheme}`,
-					`Configuration  ${configuration}`,
-					`Platform       ${platform}`,
-					`Device type    ${deviceType}`
-				],
-				title: `Building ${xcodeScheme}`,
-				successMessage: `Built ${xcodeScheme}`,
-				failureMessage: "Build failed"
-			}));
-			({appPath: builtAppPath} = await getBuildSettings({
-				configuration,
-				derivedDataPath,
-				resolvedDestinations,
-				xcodeScheme,
-				sourceDir,
-				xcodeProject
-			}));
-		} catch (error) {
-			throw prettifyXcodebuildError(error);
-		}
-		const appPath = path.default.join(outputDirectory, path.default.basename(builtAppPath));
-		await fs.default.promises.cp(builtAppPath, appPath, { recursive: true });
-		return {
-			appPath,
-			logFilePath
-		};
-	} finally {
-		await removeTmpDir(tmpDir);
-	}
-};
-const prepareBuildArgs = ({ xcodeProject, sourceDir, platform, xcodeScheme, configuration, deviceType, resolvedDestinations, derivedDataPath, extraParams, minBundleId, authenticationArgs, xcconfig }) => {
-	const sdk = deviceType === "simulator" ? platformConfigs[platform].simulatorSdk : platformConfigs[platform].deviceSdk;
-	const args = [
-		xcodeProject.isWorkspace ? "-workspace" : "-project",
-		path.default.join(sourceDir, xcodeProject.name),
-		"-scheme",
-		xcodeScheme,
-		"-configuration",
-		configuration,
-		"-sdk",
-		sdk,
-		"-derivedDataPath",
-		derivedDataPath,
-		`HOT_UPDATER_MIN_BUNDLE_ID=${minBundleId}`,
-		"build"
-	];
-	if (authenticationArgs) args.push(...authenticationArgs);
-	args.push("-xcconfig", xcconfig);
-	if (extraParams) args.push(...extraParams);
-	for (const dest of resolvedDestinations) args.push("-destination", dest);
-	return args;
-};
-const getBuildSettings = async ({ xcodeProject, sourceDir, xcodeScheme, configuration, resolvedDestinations, derivedDataPath }) => {
-	const destinationArgs = resolvedDestinations.flatMap((dest) => ["-destination", dest]);
-	const { stdout: buildSettings } = await (0, execa.execa)("xcodebuild", [
-		xcodeProject.isWorkspace ? "-workspace" : "-project",
-		xcodeProject.name,
-		"-scheme",
-		xcodeScheme,
-		"-configuration",
-		configuration,
-		...destinationArgs,
-		"-derivedDataPath",
-		derivedDataPath,
-		"-showBuildSettings",
-		"-json"
-	], { cwd: sourceDir });
-	const settings = JSON.parse(buildSettings).filter(({ target }) => target !== "React" && target !== "React-Core");
-	if (settings.length === 0) throw new Error("Failed to get build settings for your project");
-	const targetSettings = settings[0].buildSettings;
-	const wrapperExtension = targetSettings.WRAPPER_EXTENSION;
-	if (wrapperExtension !== "app" && wrapperExtension !== "framework") throw new Error(`Expected wrapper extension to be "app" or "framework" but found: ${wrapperExtension}`);
-	const targetBuildDir = targetSettings.TARGET_BUILD_DIR;
-	const executableFolderPath = targetSettings.EXECUTABLE_FOLDER_PATH;
-	const fullProductName = targetSettings.FULL_PRODUCT_NAME;
-	const infoPlistPath = targetSettings.INFOPLIST_PATH;
-	if (!targetBuildDir || !executableFolderPath || !fullProductName) throw new Error("Failed to get build paths from build settings");
-	return {
-		appPath: path.default.join(targetBuildDir, executableFolderPath),
-		infoPlistPath: path.default.join(targetBuildDir, infoPlistPath)
-	};
-};
-//#endregion
-//#region src/builder/exportXcodeArchive.ts
-/** Exports the archive into `exportPath`. */
-const exportXcodeArchive = async ({ archivePath, exportPath, sourceDir, exportExtraParams, exportOptionsPlist, logPrefix, logFilePath, title, authenticationArgs }) => {
-	const exportArgs = prepareExportArgs({
-		authenticationArgs,
-		archivePath,
-		exportPath,
-		exportOptionsPlist,
-		exportExtraParams
-	});
-	try {
-		await runXcodebuildWithLogging({
-			args: exportArgs,
-			sourceDir,
-			title: `Exporting ${title}`,
-			successMessage: `Exported ${title}`,
-			failureMessage: "Export failed",
-			logPrefix,
-			logFilePath
-		});
-		return { exportPath };
-	} catch (error) {
-		throw prettifyXcodebuildError(error);
-	}
-};
-const prepareExportArgs = ({ exportPath, archivePath, exportExtraParams, exportOptionsPlist, authenticationArgs }) => {
-	const args = [
-		"-exportArchive",
-		"-archivePath",
-		archivePath,
-		"-exportPath",
-		exportPath
-	];
-	if (authenticationArgs) args.push(...authenticationArgs);
-	if (exportExtraParams) args.push(...exportExtraParams);
-	args.push("-exportOptionsPlist", exportOptionsPlist);
-	return args;
+const createAppStoreConnectToken = ({ privateKey, keyId, issuerId, issuedAtSeconds = Math.floor(Date.now() / 1e3) }) => {
+	const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+	const signingInput = `${encode({
+		alg: "ES256",
+		kid: keyId,
+		typ: "JWT"
+	})}.${encode({
+		iss: issuerId,
+		iat: issuedAtSeconds,
+		exp: issuedAtSeconds + TOKEN_LIFETIME_SECONDS,
+		aud: "appstoreconnect-v1"
+	})}`;
+	return `${signingInput}.${crypto.default.sign("sha256", Buffer.from(signingInput), {
+		key: privateKey,
+		dsaEncoding: "ieee-p1363"
+	}).toString("base64url")}`;
 };
-//#endregion
-//#region src/utils/assertXcodebuildExist.ts
-const assertXcodebuildExist = async () => {
+const readPrivateKey = async (keyPath) => {
 	try {
-		await (0, execa.execa)("which", ["xcodebuild"]);
+		return crypto.default.createPrivateKey(await fs.default.promises.readFile(keyPath, "utf-8"));
 	} catch {
-		_hot_updater_cli_tools.p.log.error(`${_hot_updater_cli_tools.colors.blueBright("xcodebuild")} resolve failed. Ensure that xcode is installed on your machine or xcodebuild is included in your path`);
-		process.exit(1);
+		throw new Error("The App Store Connect API key is not a .p8 private key.");
 	}
 };
-//#endregion
-//#region src/utils/escapeUnzipPattern.ts
+const readApiErrors = async (response) => {
+	const body = await response.json().catch(() => void 0);
+	return Array.isArray(body?.errors) ? body.errors : [];
+};
+const describeDetails = (details) => details.map((detail) => `${detail.description ?? "(no description)"}${detail.code ? ` (${detail.code})` : ""}`);
+/** Answers a request may outlive: a timeout, a rate limit, a server error. */
+const isRetryableStatus = (status) => status === 408 || status === 429 || status >= 500;
 /**
-* A zip entry name as `unzip` reads a literal member. It takes `*`, `?` and
-* `[...]` in a member name as wildcards, which a backslash escapes, so an
-* app named `My[Dev].app` would otherwise match nothing.
+* Whether a request may succeed when sent again: a retryable answer, or a
+* network failure, which fetch rejects with a TypeError. A refused key or
+* request is not.
 */
-const escapeUnzipPattern = (name) => name.replace(/[[\]*?\\]/gu, "\\$&");
-//#endregion
-//#region src/utils/readIpaInfo.ts
-const INFO_PLIST_KEYS = {
-	bundleId: "CFBundleIdentifier",
-	shortVersion: "CFBundleShortVersionString",
-	bundleVersion: "CFBundleVersion"
-};
+const isRetryable = (error) => error instanceof AppStoreConnectError ? isRetryableStatus(error.status) : error instanceof TypeError;
+/** Whether App Store Connect refused a request for its rate limit only. */
+const isRateLimited = (error) => error instanceof AppStoreConnectError && error.status === 429;
 /**
-* Reads the app's `Payload/<App>.app/Info.plist` out of an `.ipa`, never a
-* framework's or an extension's, which nest deeper.
+* Runs `request`, again after a failure `retryable` accepts, up to the
+* attempts.
 */
-const readIpaInfo = async (ipaPath) => {
-	const { stdout } = await (0, execa.execa)("unzip", ["-Z1", ipaPath]);
-	const entry = stdout.split("\n").map((name) => name.trim()).find((name) => /^Payload\/[^/]+\.app\/Info\.plist$/u.test(name));
-	if (entry === void 0) throw new Error(`${path.default.basename(ipaPath)} has no Payload/<App>.app/Info.plist.`);
-	const directory = await createRandomTmpDir();
-	try {
-		const infoPlist = path.default.join(directory, "Info.plist");
-		await (0, execa.execa)("unzip", [
-			"-p",
-			ipaPath,
-			escapeUnzipPattern(entry)
-		], { stdout: { file: infoPlist } });
-		const info = {};
-		for (const [field, key] of Object.entries(INFO_PLIST_KEYS)) {
-			const { stdout: value, exitCode } = await (0, execa.execa)("plutil", [
-				"-extract",
-				key,
-				"raw",
-				"-o",
-				"-",
-				infoPlist
-			], { reject: false });
-			if (exitCode !== 0 || !value.trim()) throw new Error(`${path.default.basename(ipaPath)}'s Info.plist has no ${key}.`);
-			info[field] = value.trim();
-		}
-		return info;
-	} finally {
-		await fs.default.promises.rm(directory, {
-			recursive: true,
-			force: true
-		});
+const retrying = async (request, retryable = isRetryable) => {
+	for (let attempt = 1;; attempt++) try {
+		return await request();
+	} catch (error) {
+		if (!retryable(error) || attempt === COMMIT_ATTEMPTS) throw error;
+		await sleep(retryDelayMs(error, attempt));
 	}
 };
-//#endregion
-//#region src/utils/xcodeSigning.ts
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** The longest wait before a retry, so a run stays bounded. */
+const MAX_RETRY_DELAY_MS = 6e4;
 /**
-* How a device build signs with automatic signing, authenticated by the
-* scheme's App Store Connect API key: the xcodebuild arguments, and the key.
-* The key is resolved only here, for a device build of a scheme with
-* `signing`. Without `credentials`, it resolves from the environment or the
-* config's `secrets` adapter, and the temporary files are deleted when the
-* process exits.
-*/
-const resolveXcodeSigning = async ({ schemeConfig, credentials }) => {
-	const reference = schemeConfig.signing?.ascApiKey;
-	if (!reference) return;
-	const apiKey = await (credentials ?? (0, _hot_updater_cli_tools.createCredentialResolver)()).resolve({
-		kind: "asc-api-key",
-		name: (0, _hot_updater_cli_tools.parseSecretReference)(reference, "signing.ascApiKey")
-	});
-	return {
-		authenticationArgs: [
-			"-allowProvisioningUpdates",
-			"-authenticationKeyPath",
-			apiKey.keyPath,
-			"-authenticationKeyID",
-			apiKey.keyId,
-			"-authenticationKeyIssuerID",
-			apiKey.issuerId
-		],
-		apiKey
-	};
-};
-const APP_STORE_CONNECT_EXPORT_OPTIONS = `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>method</key>
-  <string>app-store-connect</string>
-  <key>signingStyle</key>
-  <string>automatic</string>
-</dict>
-</plist>
-`;
-/**
-* Writes the export options of a scheme that signs with an App Store Connect
-* API key and sets no `exportOptionsPlist`: an App Store Connect export with
-* automatic signing.
-*/
-const writeAppStoreConnectExportOptions = async (directory) => {
-	const exportOptionsPlist = path.default.join(directory, "ExportOptions.plist");
-	await fs.default.promises.writeFile(exportOptionsPlist, APP_STORE_CONNECT_EXPORT_OPTIONS);
-	return exportOptionsPlist;
-};
-/** The export methods whose `.ipa` App Store Connect takes. */
-const APP_STORE_EXPORT_METHODS = /* @__PURE__ */ new Set(["app-store", "app-store-connect"]);
-/** The `method` of export options, or "" when it has none or can't be read. */
-const readExportMethod = async (exportOptionsPlist) => {
-	const xml = (await fs.default.promises.readFile(exportOptionsPlist, "utf-8").catch(() => void 0))?.replace(/<!--[\s\S]*?-->/gu, "").match(/<key>\s*method\s*<\/key>\s*<string>\s*([^<]*?)\s*<\/string>/u);
-	if (xml) return xml[1];
-	const { stdout, exitCode } = await (0, execa.execa)("plutil", [
-		"-extract",
-		"method",
-		"raw",
-		"-o",
-		"-",
-		exportOptionsPlist
-	], { reject: false });
-	return exitCode === 0 ? stdout.trim() : "";
-};
-/**
-* Whether a device build exports for App Store Connect: with its
-* `exportOptionsPlist`'s method, or, without one, as a scheme signing with
-* an App Store Connect API key does. Such an `.ipa` is signed with Apple's
-* cloud-managed distribution certificate, never with a development
-* certificate the archive was signed with.
-*/
-const exportsForAppStoreConnect = async (schemeConfig) => !schemeConfig.exportOptionsPlist || APP_STORE_EXPORT_METHODS.has(await readExportMethod(schemeConfig.exportOptionsPlist));
-//#endregion
-//#region src/uploadToTestFlight.ts
-const API_URL$1 = "https://api.appstoreconnect.apple.com";
-/** Apple accepts tokens that expire within 20 minutes. */
-const TOKEN_LIFETIME_SECONDS = 1200;
-/** A token is replaced well before it expires, so no request carries a stale one. */
-const TOKEN_REUSE_SECONDS = 600;
-/** The parts of an `.ipa` sent at once. */
-const UPLOAD_CONCURRENCY = 4;
-/** Attempts to create the build upload and to commit the uploaded `.ipa`. */
-const COMMIT_ATTEMPTS = 3;
-/** Attempts per part: a part is a plain PUT, safe to repeat. */
-const UPLOAD_ATTEMPTS = 3;
-const IN_PROGRESS_STATES = /* @__PURE__ */ new Set(["AWAITING_UPLOAD", "PROCESSING"]);
-/** The error App Store Connect answers with when a build number is taken. */
-const DUPLICATE_ERROR_CODE = "ENTITY_ERROR.ATTRIBUTE.INVALID.DUPLICATE";
-/**
-* App Store Connect refused the upload: it already has a build with the
-* `.ipa`'s version and build number, from this or another upload, and takes
-* each build number once per version.
-*/
-var TestFlightBuildExistsError = class extends Error {
-	shortVersion;
-	bundleVersion;
-	name = "TestFlightBuildExistsError";
-	constructor(shortVersion, bundleVersion, options) {
-		super(`App Store Connect already has build ${bundleVersion} of version ${shortVersion}.\nUse a new build number (CFBundleVersion).`, options);
-		this.shortVersion = shortVersion;
-		this.bundleVersion = bundleVersion;
-	}
-};
-/** An App Store Connect API request that failed, with the errors it answered. */
-var AppStoreConnectError = class extends Error {
-	status;
-	errors;
-	/** The answer's `Retry-After` header, for a rate limit. */
-	retryAfter;
-	constructor(action, status, errors, retryAfter = null) {
-		const details = errors.map((error) => error.detail ?? error.title ?? error.code).filter(Boolean);
-		super(`${action} failed (HTTP ${status})${details.length > 0 ? `: ${details.join(" ")}` : "."}`);
-		this.name = "AppStoreConnectError";
-		this.status = status;
-		this.errors = errors;
-		this.retryAfter = retryAfter;
-	}
-};
-/**
-* An App Store Connect API token: an ES256 JWT, whose signature JWS encodes
-* as the raw 64-byte r || s, not the DER Node signs by default.
-*/
-const createAppStoreConnectToken = ({ privateKey, keyId, issuerId, issuedAtSeconds = Math.floor(Date.now() / 1e3) }) => {
-	const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
-	const signingInput = `${encode({
-		alg: "ES256",
-		kid: keyId,
-		typ: "JWT"
-	})}.${encode({
-		iss: issuerId,
-		iat: issuedAtSeconds,
-		exp: issuedAtSeconds + TOKEN_LIFETIME_SECONDS,
-		aud: "appstoreconnect-v1"
-	})}`;
-	return `${signingInput}.${crypto.default.sign("sha256", Buffer.from(signingInput), {
-		key: privateKey,
-		dsaEncoding: "ieee-p1363"
-	}).toString("base64url")}`;
-};
-const readPrivateKey = async (keyPath) => {
-	try {
-		return crypto.default.createPrivateKey(await fs.default.promises.readFile(keyPath, "utf-8"));
-	} catch {
-		throw new Error("The App Store Connect API key is not a .p8 private key.");
-	}
-};
-const readApiErrors = async (response) => {
-	const body = await response.json().catch(() => void 0);
-	return Array.isArray(body?.errors) ? body.errors : [];
-};
-const describeDetails = (details) => details.map((detail) => `${detail.description ?? "(no description)"}${detail.code ? ` (${detail.code})` : ""}`);
-/** Answers a request may outlive: a timeout, a rate limit, a server error. */
-const isRetryableStatus = (status) => status === 408 || status === 429 || status >= 500;
-/**
-* Whether a request may succeed when sent again: a retryable answer, or a
-* network failure, which fetch rejects with a TypeError. A refused key or
-* request is not.
-*/
-const isRetryable = (error) => error instanceof AppStoreConnectError ? isRetryableStatus(error.status) : error instanceof TypeError;
-/** Whether App Store Connect refused a request for its rate limit only. */
-const isRateLimited = (error) => error instanceof AppStoreConnectError && error.status === 429;
-/**
-* Runs `request`, again after a failure `retryable` accepts, up to the
-* attempts.
-*/
-const retrying = async (request, retryable = isRetryable) => {
-	for (let attempt = 1;; attempt++) try {
-		return await request();
-	} catch (error) {
-		if (!retryable(error) || attempt === COMMIT_ATTEMPTS) throw error;
-		await sleep(retryDelayMs(error, attempt));
-	}
-};
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-/** The longest wait before a retry, so a run stays bounded. */
-const MAX_RETRY_DELAY_MS = 6e4;
-/**
-* The first wait after a rate limit without `Retry-After`: App Store Connect
-* limits a key per rolling hour, so a retry within seconds meets it again.
+* The first wait after a rate limit without `Retry-After`: App Store Connect
+* limits a key per rolling hour, so a retry within seconds meets it again.
 */
 const RATE_LIMIT_DELAY_MS = 15e3;
 /**
@@ -2040,7 +1308,7 @@ const createAppStoreConnectRequest = ({ apiKey, privateKey, fetch }) => {
 		return `Bearer ${token.value}`;
 	};
 	return async (action, method, pathname, body) => {
-		const response = await fetch(`${API_URL$1}${pathname}`, {
+		const response = await fetch(`${API_URL$2}${pathname}`, {
 			method,
 			headers: {
 				Authorization: authorization(),
@@ -2227,72 +1495,1041 @@ const uploadToTestFlight = async ({ ipaPath, apiKey, fetch = globalThis.fetch, p
 			if (!isRetryable(error)) throw error;
 			lastError = readError = error;
 		});
-		failedReads = read ? 0 : failedReads + 1;
-		const state = read ? read.data.attributes?.state ?? {} : {};
-		if (state.state === "PROCESSING") reportedProcessing = true;
-		if (!state.state || IN_PROGRESS_STATES.has(state.state)) {
-			if (Date.now() >= deadline) {
-				if (!reportedProcessing) throw new Error([
-					`App Store Connect didn't report build ${info.bundleVersion} processing.`,
-					lastError instanceof Error ? lastError.message : state.state ? `State: ${state.state}` : void 0,
-					"Check the build in TestFlight:",
-					testFlightUrl
-				].filter(Boolean).join("\n"), { cause: lastError });
-				_hot_updater_cli_tools.p.log.warn(`App Store Connect is still processing build ${info.bundleVersion}.\nTestFlight lists it once processing finishes:\n${testFlightUrl}`);
-				return {
-					appId: app.id,
-					buildUploadId,
-					state: "PROCESSING",
-					testFlightUrl,
-					shortVersion: info.shortVersion,
-					bundleVersion: info.bundleVersion
-				};
-			}
-			await sleep(readError === void 0 ? pollIntervalMs : Math.max(pollIntervalMs, retryDelayMs(readError, failedReads)));
-			continue;
-		}
-		for (const warning of describeDetails(state.warnings ?? [])) _hot_updater_cli_tools.p.log.warn(warning);
-		if (state.state !== "COMPLETE") {
-			const errors = describeDetails(state.errors ?? []);
-			throw new Error([`App Store Connect rejected build ${info.bundleVersion} of version ${info.shortVersion} (${state.state}).`, ...errors.map((error) => `- ${error}`)].join("\n"));
-		}
-		return {
-			appId: app.id,
-			buildUploadId,
-			state: "COMPLETE",
-			testFlightUrl,
-			shortVersion: info.shortVersion,
-			bundleVersion: info.bundleVersion
-		};
+		failedReads = read ? 0 : failedReads + 1;
+		const state = read ? read.data.attributes?.state ?? {} : {};
+		if (state.state === "PROCESSING") reportedProcessing = true;
+		if (!state.state || IN_PROGRESS_STATES.has(state.state)) {
+			if (Date.now() >= deadline) {
+				if (!reportedProcessing) throw new Error([
+					`App Store Connect didn't report build ${info.bundleVersion} processing.`,
+					lastError instanceof Error ? lastError.message : state.state ? `State: ${state.state}` : void 0,
+					"Check the build in TestFlight:",
+					testFlightUrl
+				].filter(Boolean).join("\n"), { cause: lastError });
+				_hot_updater_cli_tools.p.log.warn(`App Store Connect is still processing build ${info.bundleVersion}.\nTestFlight lists it once processing finishes:\n${testFlightUrl}`);
+				return {
+					appId: app.id,
+					buildUploadId,
+					state: "PROCESSING",
+					testFlightUrl,
+					shortVersion: info.shortVersion,
+					bundleVersion: info.bundleVersion
+				};
+			}
+			await sleep(readError === void 0 ? pollIntervalMs : Math.max(pollIntervalMs, retryDelayMs(readError, failedReads)));
+			continue;
+		}
+		for (const warning of describeDetails(state.warnings ?? [])) _hot_updater_cli_tools.p.log.warn(warning);
+		if (state.state !== "COMPLETE") {
+			const errors = describeDetails(state.errors ?? []);
+			throw new Error([`App Store Connect rejected build ${info.bundleVersion} of version ${info.shortVersion} (${state.state}).`, ...errors.map((error) => `- ${error}`)].join("\n"));
+		}
+		return {
+			appId: app.id,
+			buildUploadId,
+			state: "COMPLETE",
+			testFlightUrl,
+			shortVersion: info.shortVersion,
+			bundleVersion: info.bundleVersion
+		};
+	}
+};
+/**
+* Sends each part App Store Connect asked for: the bytes at its offset, with
+* only the headers it lists, since the URLs are presigned: another header,
+* or the App Store Connect token, would break their signature.
+*/
+const uploadParts = async ({ ipaPath, operations, fetch }) => {
+	const file = await fs.default.promises.open(ipaPath, "r");
+	try {
+		await runConcurrently(operations, UPLOAD_CONCURRENCY, async (operation, index) => {
+			const body = Buffer.alloc(operation.length);
+			const { bytesRead } = await file.read(body, 0, operation.length, operation.offset);
+			if (bytesRead !== operation.length) throw new Error(`${path.default.basename(ipaPath)} changed while it was uploading.`);
+			const headers = {};
+			for (const { name, value } of operation.requestHeaders ?? []) headers[name] = value;
+			for (let attempt = 1;; attempt++) {
+				const response = await fetch(operation.url, {
+					method: operation.method,
+					headers,
+					body
+				}).catch((error) => error);
+				if (!(response instanceof Error) && response.ok) return;
+				if (!(response instanceof Error || isRetryableStatus(response.status)) || attempt === UPLOAD_ATTEMPTS) throw new Error(`Uploading part ${index + 1} of ${operations.length} failed: ${response instanceof Error ? response.message : `HTTP ${response.status}`}.`);
+				await sleep(retryDelayMs(response, attempt));
+			}
+		});
+	} finally {
+		await file.close();
+	}
+};
+//#endregion
+//#region src/asc/devices.ts
+const API_URL$1 = "https://api.appstoreconnect.apple.com";
+const DEVICE_FIELDS = "name,udid,status,deviceClass";
+const PAGE_SIZE = 200;
+/** More pages than an account's yearly limit of devices can fill. */
+const MAX_PAGES = 50;
+const deviceOf = ({ id, attributes }) => ({
+	id,
+	name: attributes?.name ?? "",
+	udid: attributes?.udid ?? "",
+	status: attributes?.status ?? "",
+	deviceClass: attributes?.deviceClass ?? null
+});
+/**
+* A 403 from this API means something else than an upload's. A key's role
+* decides it, and only the person who owns the key can change that, so no key
+* is issued here.
+*/
+const describingAccess = async (run) => {
+	try {
+		return await run();
+	} catch (error) {
+		const cause = error instanceof Error ? error.cause : void 0;
+		if (cause instanceof AppStoreConnectError && cause.status === 403 && !isProgramLicenseAgreementError(cause.errors)) throw new Error("App Store Connect doesn't let this API key register devices.\nUse a key with the Admin role: npx hot-updater apple login", { cause });
+		throw error;
+	}
+};
+const readPages = async (request, firstPath) => {
+	const devices = [];
+	let pathname = firstPath;
+	for (let page = 0; pathname !== void 0; page += 1) {
+		if (page === MAX_PAGES) throw new Error("App Store Connect's device list didn't end.");
+		const path = pathname;
+		const answer = await retrying(() => request("Reading App Store Connect's devices", "GET", path));
+		devices.push(...answer.data.map(deviceOf));
+		const next = answer.links?.next;
+		if (next !== void 0 && !next.startsWith(`${API_URL$1}/`)) throw new Error("App Store Connect's next page is on another host.");
+		pathname = next?.slice(37);
+	}
+	return devices;
+};
+const listPath = (filter = {}) => `/v1/devices?${new URLSearchParams({
+	"filter[platform]": "IOS",
+	...filter,
+	"fields[devices]": DEVICE_FIELDS,
+	limit: String(PAGE_SIZE)
+})}`;
+/** Every iPhone and iPad the Apple account has registered. */
+const listAscDevices = async ({ apiKey, fetch = globalThis.fetch }) => {
+	const privateKey = await readPrivateKey(apiKey.keyPath);
+	const request = createAppStoreConnectRequest({
+		apiKey,
+		privateKey,
+		fetch
+	});
+	return describingAccess(() => readPages(request, listPath()));
+};
+const keyOf = (udid) => (0, _hot_updater_protocol_native_artifact.normalizeIosUdid)(udid) ?? udid.toLowerCase();
+const findDevices = async (request, udids) => new Map((await readPages(request, listPath({ "filter[udid]": udids.join(",") }))).map((device) => [keyOf(device.udid), device]));
+/**
+* Registers devices with the Apple account, each at most once: a device that
+* is already there succeeds and changes nothing, so running it again is safe,
+* and so is a race with another run, which App Store Connect answers with 409.
+* A disabled device stays disabled, since its slot is already spent and someone
+* chose to disable it. It only registers: Xcode adds a registered device to the
+* profile at the next export, so an `.ipa` signed before never gains it.
+*/
+const addAscDevices = async ({ devices, apiKey, fetch = globalThis.fetch }) => {
+	const privateKey = await readPrivateKey(apiKey.keyPath);
+	const request = createAppStoreConnectRequest({
+		apiKey,
+		privateKey,
+		fetch
+	});
+	return describingAccess(async () => {
+		const found = await findDevices(request, devices.map(({ udid }) => udid));
+		const outcomes = [];
+		for (const { udid, name } of devices) {
+			const existing = found.get(keyOf(udid));
+			if (existing !== void 0) {
+				outcomes.push({
+					udid,
+					outcome: existing.status === "DISABLED" ? "disabled" : "already-registered",
+					device: existing
+				});
+				continue;
+			}
+			try {
+				const { data } = await retrying(() => request(`Registering ${udid}`, "POST", "/v1/devices", { data: {
+					type: "devices",
+					attributes: {
+						name,
+						platform: "IOS",
+						udid
+					}
+				} }));
+				outcomes.push({
+					udid,
+					outcome: "registered",
+					device: deviceOf(data)
+				});
+			} catch (error) {
+				if (!(error instanceof AppStoreConnectError) || error.status !== 409) throw error;
+				const raced = (await findDevices(request, [udid])).get(keyOf(udid));
+				if (raced !== void 0) {
+					outcomes.push({
+						udid,
+						outcome: raced.status === "DISABLED" ? "disabled" : "already-registered",
+						device: raced
+					});
+					continue;
+				}
+				const reason = error.errors.map(({ detail, title }) => detail ?? title).filter(Boolean).join(" ");
+				outcomes.push({
+					udid,
+					outcome: "refused",
+					reason: reason || "App Store Connect refused it.",
+					limitReached: /maximum|limit/iu.test(reason)
+				});
+			}
+		}
+		return outcomes;
+	});
+};
+//#endregion
+//#region src/utils/formatCommand.ts
+/**
+* A command to print, broken at spaces with ` \` once a line would pass
+* `width`, each continuation indented two spaces, so a terminal never wraps
+* it mid-word and it still pastes as one command.
+*/
+const formatCommand = (words, width = 74) => {
+	const lines = [];
+	let line = "";
+	for (const word of words) {
+		const next = line ? `${line} ${word}` : word;
+		if (line && next.length > width - 2) {
+			lines.push(`${line} \\`);
+			line = `  ${word}`;
+		} else line = next;
+	}
+	lines.push(line);
+	return lines.join("\n");
+};
+//#endregion
+//#region src/utils/cocoapods.ts
+/**
+* A failed command's error: the command, then the last lines of its
+* output, stdout and stderr as printed, without execa's full message.
+*/
+const commandFailure = (command, error) => {
+	const { all, stderr, stdout } = error ?? {};
+	const detail = String(all || [stdout, stderr].filter(Boolean).join("\n") || "").trimEnd().split("\n").filter((line) => line.trim()).slice(-12).join("\n") || (error instanceof Error ? error.message : String(error));
+	return new Error(`${command} failed.\n${detail}`, { cause: error });
+};
+/**
+* A line of the progress meter curl prints on stderr for each pod it
+* downloads, such as React Native's prebuilt core.
+*/
+const DOWNLOAD_PROGRESS = [
+	/^% Total +% Received/,
+	/^Dload +Upload/,
+	/^\d{1,3} +[\d.]+[kMGT]? +\d{1,3} +[\d.]+[kMGT]? /
+];
+/**
+* `pod install`'s output: its live line shows the pod it installs, its log
+* keeps the whole output, and a failure prints CocoaPods' `[!]` errors and a
+* crash's `SomeError - …` line with its last lines, without the download
+* progress CocoaPods' curl prints on stderr.
+*/
+const createPodInstallLogger = () => new _hot_updater_cli_tools.BuildLogger({
+	logPrefix: "pod-install",
+	createPhaseReader: () => (line) => {
+		const installing = /^Installing (\S+)/.exec(line);
+		if (installing) return `Installing ${installing[1]}`;
+		return /^(Analyzing dependencies|Downloading dependencies|Generating Pods project|Integrating client project)$/.test(line) ? line : void 0;
+	},
+	failureSummary: {
+		lines: [/^[A-Z]\w*(::\w+)*Error - /],
+		blocks: [{
+			start: /^\[!\] /,
+			end: /^$/,
+			includeEnd: false
+		}],
+		ignore: DOWNLOAD_PROGRESS,
+		tail: 4,
+		stopAfter: /^\[!\] Oh no, an error occurred\.$/,
+		maxWidth: 76
+	}
+});
+/**
+* Runs `pod install` as a step whose failure prints CocoaPods' errors and
+* the log's path, then throws a `BuildFailedError`.
+*/
+const runPodInstall = async ({ command, env, sourceDir }) => {
+	const logger = createPodInstallLogger();
+	const failureMessage = `${command.join(" ")} failed`;
+	await logger.start({
+		title: "Installing CocoaPods dependencies",
+		header: [`$ ${formatCommand([...Object.entries(env).map(([name, value]) => `${name}=${value}`), ...command])}`, ""]
+	});
+	try {
+		const podProcess = (0, execa.execa)(command[0], command.slice(1), {
+			cwd: sourceDir,
+			env,
+			all: true,
+			buffer: false
+		});
+		const logging = podProcess.all ? logger.processStream(podProcess.all) : Promise.resolve();
+		const [podResult, loggingResult] = await Promise.allSettled([podProcess, logging]);
+		if (podResult.status === "rejected") throw podResult.reason;
+		if (loggingResult.status === "rejected") throw loggingResult.reason;
+		logger.stop("CocoaPods dependencies installed");
+	} catch (error) {
+		logger.writeError(error);
+		const reason = error instanceof execa.ExecaError && error.exitCode !== void 0 ? `exited with code ${error.exitCode}` : error instanceof Error ? error.message : String(error);
+		logger.stop(`${failureMessage} · ${reason}`, false);
+		throw new _hot_updater_cli_tools.BuildFailedError(`${failureMessage}: ${reason}`, {
+			logPath: logger.logPath,
+			summary: logger.failureSummary,
+			cause: error
+		});
+	} finally {
+		await logger.close();
+	}
+};
+const installPodsIfNeeded = async (sourceDir) => {
+	const podfilePath = path.default.join(sourceDir, "Podfile");
+	if (!fs.default.existsSync(podfilePath)) {
+		_hot_updater_cli_tools.p.log.info("No Podfile found, skipping CocoaPods installation");
+		return {
+			codegen: false,
+			pods: false
+		};
+	}
+	const gemfilePaths = [path.default.join(sourceDir, "Gemfile"), path.default.join((0, _hot_updater_cli_tools.getCwd)(), "Gemfile")];
+	const shouldUseBundler = (await Promise.all(gemfilePaths.map(checkShouldUseBundler))).some(Boolean);
+	const reactNative = (0, _hot_updater_cli_tools.getReactNativeMetadatas)();
+	const plan = resolvePodInstallPlan({
+		version: reactNative.version,
+		env: process.env
+	});
+	if (plan.runCodegen) await runReactNativeCodegen({
+		projectRoot: (0, _hot_updater_cli_tools.getCwd)(),
+		reactNativePath: reactNative.packagePath,
+		sourceDir
+	});
+	if (shouldUseBundler) {
+		const bundleSpinner = _hot_updater_cli_tools.p.spinner();
+		bundleSpinner.start("Installing Ruby gems");
+		try {
+			await (0, execa.execa)("bundle", ["install"], {
+				cwd: sourceDir,
+				all: true
+			});
+		} catch (error) {
+			bundleSpinner.error("bundle install failed");
+			throw commandFailure("bundle install", error);
+		}
+		bundleSpinner.stop("Ruby gems installed");
+	}
+	await runPodInstall({
+		command: shouldUseBundler ? [
+			"bundle",
+			"exec",
+			"pod",
+			"install"
+		] : ["pod", "install"],
+		env: plan.env,
+		sourceDir
+	});
+	return {
+		codegen: plan.runCodegen,
+		pods: true
+	};
+};
+const checkShouldUseBundler = async (gemfilePath) => {
+	try {
+		if (!fs.default.existsSync(gemfilePath)) return false;
+		return (await fs.default.promises.readFile(gemfilePath, "utf-8")).includes("cocoapods");
+	} catch {
+		return false;
+	}
+};
+/**
+* Runs React Native codegen into `<sourceDir>/build/generated/ios`, as the
+* React Native CLI does before `pod install`. Clearing the old output first
+* drops the modules of removed libraries.
+*/
+const runReactNativeCodegen = async ({ projectRoot, reactNativePath, sourceDir }) => {
+	await fs.default.promises.rm(path.default.join(sourceDir, "build", "generated", "ios"), {
+		recursive: true,
+		force: true
+	});
+	const spinner = _hot_updater_cli_tools.p.spinner();
+	spinner.start("Running React Native codegen");
+	try {
+		await (0, execa.execa)("node", [
+			path.default.join(reactNativePath, "scripts", "generate-codegen-artifacts.js"),
+			"-p",
+			projectRoot,
+			"-o",
+			sourceDir,
+			"-t",
+			"ios"
+		], {
+			cwd: projectRoot,
+			all: true
+		});
+	} catch (error) {
+		spinner.error("React Native codegen failed");
+		throw commandFailure("React Native codegen", error);
+	}
+	spinner.stop("React Native codegen done");
+};
+/**
+* The environment `pod install` runs with, and whether codegen runs first.
+*
+* From React Native 0.79, `RCT_IGNORE_PODS_DEPRECATION=1` silences the
+* deprecation notice for calling `pod install` directly and also sets
+* `RCT_SKIP_CODEGEN=1`, because the React Native CLI runs codegen itself
+* first. Hot Updater sets it the same way and runs codegen too, unless the
+* user's `RCT_SKIP_CODEGEN=1` takes codegen over. Before 0.79, and when the
+* version is unknown, CocoaPods runs codegen. A user's value of a flag wins.
+*/
+const resolvePodInstallPlan = ({ version, env }) => {
+	const podsSkipCodegen = version.major > 0 || version.minor >= 79;
+	const usePrebuiltReactNative = version.major > 0 || version.minor >= 81;
+	const ignorePodsDeprecation = env["RCT_IGNORE_PODS_DEPRECATION"] ?? (podsSkipCodegen ? "1" : void 0);
+	return {
+		runCodegen: podsSkipCodegen && ignorePodsDeprecation === "1" && env["RCT_SKIP_CODEGEN"] !== "1",
+		env: {
+			...ignorePodsDeprecation !== void 0 && { RCT_IGNORE_PODS_DEPRECATION: ignorePodsDeprecation },
+			RCT_USE_RN_DEP: env["RCT_USE_RN_DEP"] ?? (usePrebuiltReactNative ? "1" : "0"),
+			RCT_USE_PREBUILT_RNCORE: env["RCT_USE_PREBUILT_RNCORE"] ?? (usePrebuiltReactNative ? "1" : "0")
+		}
+	};
+};
+//#endregion
+//#region src/utils/platform.ts
+/**
+* Platform configurations for different Apple platforms
+*/
+const platformConfigs = { ios: {
+	name: "ios",
+	deviceSdk: "iphoneos",
+	simulatorSdk: "iphonesimulator",
+	supportsSimulator: true,
+	deviceDestination: "platform=iOS",
+	simulatorDestination: "platform=iOS Simulator"
+} };
+//#endregion
+//#region src/utils/destination.ts
+const buildDestinationString = ({ deviceType, platform, useGeneric }) => `${useGeneric ? "generic/" : ""}${deviceType === "device" ? platformConfigs[platform].deviceDestination : platformConfigs[platform].simulatorDestination}`;
+/**
+* Resolves IosBuildDestination to xcodebuild destination format
+*/
+const resolveDestination = ({ destination, useGeneric }) => {
+	if (typeof destination === "object") {
+		if ("id" in destination) return `id=${destination.id}`;
+		if ("name" in destination) return `name=${destination.name}`;
+	}
+	switch (destination) {
+		case "ios-device": return buildDestinationString({
+			platform: "ios",
+			deviceType: "device",
+			useGeneric
+		});
+		case "ios-simulator": return buildDestinationString({
+			platform: "ios",
+			deviceType: "simulator",
+			useGeneric
+		});
+	}
+};
+const resolveDestinations = ({ destinations, useGeneric }) => {
+	return destinations.map((destination) => resolveDestination({
+		destination,
+		useGeneric
+	}));
+};
+const getDefaultDestination = ({ platform, useGeneric, deviceType }) => {
+	return buildDestinationString({
+		deviceType,
+		platform,
+		useGeneric
+	});
+};
+//#endregion
+//#region src/utils/parseXcodeProjectInfo.ts
+const parseXcodeProjectInfo = async (sourceDir) => {
+	const files = await fs.default.promises.readdir(sourceDir);
+	const workspace = files.find((file) => file.endsWith(".xcworkspace"));
+	if (workspace) return {
+		isWorkspace: true,
+		name: workspace,
+		path: path.default.join(sourceDir, workspace)
+	};
+	const project = files.find((file) => file.endsWith(".xcodeproj"));
+	if (project) return {
+		isWorkspace: false,
+		name: project,
+		path: path.default.join(sourceDir, project)
+	};
+	throw new Error(`No Xcode project or workspace found in ${sourceDir}`);
+};
+//#endregion
+//#region src/utils/prettifyXcodebuildError.ts
+const prettifyXcodebuildError = (error) => {
+	if (error instanceof _hot_updater_cli_tools.BuildFailedError) {
+		const errorLines = error.summary.join("\n");
+		const hint = mentionsProgramLicenseAgreement(errorLines) ? PROGRAM_LICENSE_AGREEMENT_HINT : errorLines.includes("error: No profiles for") || errorLines.includes("error: Provisioning profile") ? "No valid provisioning profile is set in the project.\nCheck the Signing & Capabilities tab in Xcode." : null;
+		return new _hot_updater_cli_tools.BuildFailedError(hint ?? error.message, {
+			logPath: error.logPath,
+			summary: error.summary,
+			hint,
+			cause: error.cause
+		});
+	}
+	return /* @__PURE__ */ new Error(`Xcodebuild failed: ${error}`);
+};
+//#endregion
+//#region src/utils/xcodebuildPhase.ts
+/** The `(in target 'X' from project 'Y')` that ends an action's line. */
+const TARGET = /\(in target '([^']+)' from project '[^']+'\)\s*$/;
+/** A `PhaseScriptExecution` line's script phase, its spaces escaped. */
+const SCRIPT = /^PhaseScriptExecution ((?:\\.|[^\s\\])+)/;
+/** A batched `SwiftCompile`'s files: `Compiling\ A.swift,\ B.swift`. */
+const SWIFT_BATCH = /^SwiftCompile \S+ \S+ Compiling\\ ((?:\\.|[^\s\\])+)/;
+const unescape = (value) => value.replace(/\\(.)/g, "$1");
+/** Actions whose lines say what xcodebuild is doing, by their first word. */
+const ACTIONS = {
+	CompileAssetCatalog: "Compiling assets",
+	CompileAssetCatalogVariant: "Compiling assets",
+	LinkAssetCatalog: "Compiling assets",
+	CompileStoryboard: "Compiling storyboards",
+	CompileXIB: "Compiling storyboards",
+	LinkStoryboards: "Compiling storyboards",
+	Ld: "Linking",
+	Libtool: "Linking",
+	CodeSign: "Signing",
+	ProcessInfoPlistFile: "Processing",
+	ProcessProductPackaging: "Processing",
+	ProcessProductPackagingDER: "Processing",
+	CopySwiftLibs: "Copying",
+	CpResource: "Copying",
+	GenerateDSYMFile: "Generating dSYM",
+	Strip: "Stripping",
+	Validate: "Validating"
+};
+const COMPILES = /* @__PURE__ */ new Set([
+	"CompileC",
+	"SwiftCompile",
+	"CompileSwift"
+]);
+const PRECOMPILES = /* @__PURE__ */ new Set([
+	"PrecompileModule",
+	"ScanDependencies",
+	"SwiftExplicitDependencyGeneratePcm",
+	"SwiftExplicitDependencyCompileModuleFromInterface"
+]);
+const plural = (count, noun) => `${count} ${noun}${count === 1 ? "" : "s"}`;
+/**
+* Reads the phase of an `xcodebuild` build, archive, or export from its raw
+* output: `Compiling React-Core · 412 files`, `Linking CodexRelay`,
+* `Signing CodexRelay`, `Bundling JavaScript`, with the target each
+* action's line names.
+*/
+const createXcodebuildPhaseReader = () => {
+	let compiled = 0;
+	let precompiled = 0;
+	return (line) => {
+		const space = line.indexOf(" ");
+		const action = space === -1 ? line : line.slice(0, space);
+		const target = TARGET.exec(line)?.[1];
+		const withTarget = (phase) => target ? `${phase} ${target}` : phase;
+		if (COMPILES.has(action)) {
+			const batch = SWIFT_BATCH.exec(line)?.[1];
+			compiled += batch ? unescape(batch).split(",").length : 1;
+			return `${withTarget("Compiling")} · ${plural(compiled, "file")}`;
+		}
+		if (PRECOMPILES.has(action)) {
+			precompiled += 1;
+			return `Precompiling modules · ${precompiled}`;
+		}
+		if (action === "PhaseScriptExecution") {
+			const script = unescape(SCRIPT.exec(line)?.[1] ?? "");
+			if (script === "Bundle React Native code and images") return "Bundling JavaScript";
+			return script ? `Running ${script}` : withTarget("Running a script");
+		}
+		const phase = ACTIONS[action];
+		if (phase) return withTarget(phase);
+		if (line === "Prepare packages" || line.startsWith("Resolve Package")) return "Resolving packages";
+		if (line === "ComputeTargetDependencyGraph") return "Planning the build";
+	};
+};
+//#endregion
+//#region src/utils/createXcodebuildLogger.ts
+const createXcodebuildLogger = ({ logPrefix, logFilePath }) => new _hot_updater_cli_tools.BuildLogger({
+	logPrefix,
+	logFilePath,
+	createPhaseReader: createXcodebuildPhaseReader,
+	failureSummary: {
+		lines: [/(^|:\s)error: /, /^\*\* [A-Z ]+ FAILED \*\*$/],
+		blocks: [{
+			start: "The following build commands failed:",
+			end: /^\(\d+ failures?\)$/,
+			includeEnd: true
+		}, {
+			start: /^error: exportArchive /,
+			end: /^$/,
+			includeEnd: false
+		}]
+	}
+});
+//#endregion
+//#region src/utils/runXcodebuildWithLogging.ts
+const TERMINATION_SIGNALS$1 = ["SIGINT", "SIGTERM"];
+const createRawXcodebuildProcess = ({ args, env, sourceDir }) => {
+	return (0, execa.execa)("xcodebuild", args, {
+		cwd: sourceDir,
+		all: true,
+		buffer: false,
+		env: {
+			...process.env,
+			...env,
+			NSUnbufferedIO: "YES"
+		}
+	});
+};
+/** Why xcodebuild failed, without its command line. */
+const describeFailure = (error) => {
+	if (error instanceof execa.ExecaError) {
+		if (error.signal) return `xcodebuild was stopped by ${error.signal}.`;
+		if (error.exitCode !== void 0) return `xcodebuild exited with code ${error.exitCode}.`;
+	}
+	return error instanceof Error ? error.message : String(error);
+};
+/**
+* Runs xcodebuild as a step titled `title`: its live line shows the build's
+* phase, the log file keeps the command and the whole output, and a failure
+* prints the output's errors and the log's path on stderr.
+*/
+const runXcodebuildWithLogging = async ({ args, env, sourceDir, title, successMessage, failureMessage, logPrefix, logFilePath, header = [] }) => {
+	const logger = createXcodebuildLogger({
+		logPrefix,
+		logFilePath
+	});
+	await logger.start({
+		title,
+		header: [
+			...header,
+			`$ ${formatCommand(["xcodebuild", ...args])}`,
+			""
+		]
+	});
+	const activeProcesses = [];
+	const terminateActiveProcesses = () => {
+		for (const activeProcess of activeProcesses) activeProcess.kill();
+	};
+	for (const signal of TERMINATION_SIGNALS$1) process.once(signal, terminateActiveProcesses);
+	try {
+		const xcodebuildProcess = createRawXcodebuildProcess({
+			args,
+			env,
+			sourceDir
+		});
+		activeProcesses.push(xcodebuildProcess);
+		const xcodebuildOutput = xcodebuildProcess.all ?? xcodebuildProcess.stdout;
+		const logging = xcodebuildOutput ? logger.processStream(xcodebuildOutput) : Promise.resolve();
+		const [xcodebuildResult, loggingResult] = await Promise.allSettled([xcodebuildProcess, logging]);
+		if (xcodebuildResult.status === "rejected") throw xcodebuildResult.reason;
+		if (loggingResult.status === "rejected") throw loggingResult.reason;
+		logger.stop(successMessage);
+		return { logFilePath: logger.logFilePath };
+	} catch (error) {
+		logger.writeError(error);
+		const reason = describeFailure(error);
+		logger.stop(`${failureMessage} · ${reason.replace(/\.$/, "")}`, false);
+		throw new _hot_updater_cli_tools.BuildFailedError(`${failureMessage}: ${reason}`, {
+			logPath: logger.logPath,
+			summary: logger.failureSummary,
+			cause: error
+		});
+	} finally {
+		for (const signal of TERMINATION_SIGNALS$1) process.off(signal, terminateActiveProcesses);
+		await logger.close();
+	}
+};
+//#endregion
+//#region src/utils/writeBuildXcconfig.ts
+const SDK_CONDITIONS = [
+	"",
+	"[sdk=iphoneos*]",
+	"[sdk=iphonesimulator*]"
+];
+/**
+* Finds a setting of `keys` that an included xcconfig sets with a condition
+* the build xcconfig does not, such as `[config=Release]` or `[arch=arm64]`,
+* which would outrank the build's own. It follows `#include`s, which are
+* relative to the including file.
+*/
+const findConditionalSetting = async (files, keys, visited = /* @__PURE__ */ new Set()) => {
+	for (const file of files) {
+		if (visited.has(file) || !fs.default.existsSync(file)) continue;
+		visited.add(file);
+		const lines = (await fs.default.promises.readFile(file, "utf-8")).split("\n");
+		for (const [index, line] of lines.entries()) {
+			const include = line.match(/^\s*#include\??\s*"([^"]+)"/)?.[1];
+			if (include) {
+				const found = await findConditionalSetting([path.default.resolve(path.default.dirname(file), include)], keys, visited);
+				if (found) return found;
+				continue;
+			}
+			const [, key, conditions] = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)((?:\[[^\]]*\])+)\s*=/) ?? [];
+			if (key && keys.includes(key) && !SDK_CONDITIONS.includes(conditions)) return `${file}:${index + 1} sets ${key}${conditions}`;
+		}
+	}
+};
+/**
+* Writes the xcconfig a build loads, which sets the CLI's build settings
+* over every other. xcodebuild ranks an `-xcconfig`'s settings above the
+* command line's, so the scheme's `xcconfig` and each `-xcconfig` in
+* `extraParams` are included, in order, before `settings`, and the build
+* loads only this one.
+*/
+const writeBuildXcconfig = async ({ directory, sourceDir, xcconfig, extraParams = [], settings }) => {
+	const included = xcconfig ? [xcconfig] : [];
+	const otherParams = [];
+	for (let i = 0; i < extraParams.length; i++) if (extraParams[i] === "-xcconfig" && i + 1 < extraParams.length) included.push(extraParams[++i]);
+	else otherParams.push(extraParams[i]);
+	const includedFiles = included.map((file) => path.default.resolve(sourceDir, file));
+	const conditional = await findConditionalSetting(includedFiles, Object.keys(settings));
+	if (conditional) throw new Error(`${conditional}, which would outrank the value the build sets. Set it without that condition, or remove it.`);
+	const buildXcconfig = path.default.join(directory, "HotUpdater.xcconfig");
+	await fs.default.promises.writeFile(buildXcconfig, [
+		...includedFiles.map((file) => `#include "${file}"`),
+		...Object.entries(settings).flatMap(([key, value]) => SDK_CONDITIONS.map((condition) => `${key}${condition} = ${value}`)),
+		""
+	].join("\n"));
+	return {
+		xcconfig: buildXcconfig,
+		extraParams: otherParams
+	};
+};
+/**
+* Automatic signing over a target set to manual signing, whose provisioning
+* profile and identity Xcode would otherwise report as conflicting.
+*/
+const AUTOMATIC_SIGNING = {
+	CODE_SIGN_STYLE: "Automatic",
+	PROVISIONING_PROFILE: "",
+	PROVISIONING_PROFILE_SPECIFIER: "",
+	CODE_SIGN_IDENTITY: "Apple Development"
+};
+/** The sandbox layer's sources, by the file names the podspec excludes. */
+const SANDBOX_SOURCES = "HotUpdaterSandbox*";
+/** What each of those sources is wrapped in: without it, they compile to nothing. */
+const SANDBOX_CONDITION = "HOT_UPDATER_SANDBOX_LAYER";
+/**
+* The settings a build sets over the scheme's: the MIN_BUNDLE_ID the CLI
+* issues and reports, and automatic signing when an App Store Connect API key
+* signs, which a target set to manual signing would not use.
+*
+* A sandbox scheme brings the sandbox layer's sources back, and sets the
+* condition they compile under, which nothing else sets: any build can undo the
+* podspec's exclusion, and those sources then compile to nothing. Any other scheme
+* excludes them again: a scheme's `xcconfig`, which outranks the pod's settings
+* on every target, would otherwise replace the podspec's exclusion, and the
+* layer would compile into a store build.
+*/
+const buildSettingsOverScheme = ({ minBundleId, authenticationArgs, sandbox = false }) => ({
+	HOT_UPDATER_MIN_BUNDLE_ID: minBundleId,
+	...authenticationArgs ? AUTOMATIC_SIGNING : {},
+	...sandbox ? {
+		INCLUDED_SOURCE_FILE_NAMES: SANDBOX_SOURCES,
+		SWIFT_ACTIVE_COMPILATION_CONDITIONS: `$(inherited) ${SANDBOX_CONDITION}`,
+		GCC_PREPROCESSOR_DEFINITIONS: `$(inherited) ${SANDBOX_CONDITION}=1`
+	} : { EXCLUDED_SOURCE_FILE_NAMES: `$(inherited) ${SANDBOX_SOURCES}` }
+});
+//#endregion
+//#region src/builder/archiveXcodeProject.ts
+/**
+* Archives the scheme into `archiveDirectory`. The build's xcconfig is
+* written to a temporary directory, removed whether the archive succeeds or
+* not.
+*/
+const archiveXcodeProject = async ({ sourceDir, archiveDirectory, platform, installPods, destination, extraParams, configuration, xcodeScheme, xcconfig, logPrefix, header = [], minBundleId, authenticationArgs, sandbox }) => {
+	if (installPods) await installPodsIfNeeded(sourceDir);
+	const xcodeProject = await parseXcodeProjectInfo(sourceDir);
+	const archiveName = `${xcodeProject.name.replace(".xcworkspace", "").replace(".xcodeproj", "")}.xcarchive`;
+	const archivePath = path.default.join(archiveDirectory, archiveName);
+	const tmpDir = await createRandomTmpDir();
+	try {
+		const build = await writeBuildXcconfig({
+			directory: tmpDir,
+			sourceDir,
+			xcconfig,
+			extraParams,
+			settings: buildSettingsOverScheme({
+				minBundleId,
+				authenticationArgs,
+				sandbox
+			})
+		});
+		const archiveArgs = prepareArchiveArgs({
+			authenticationArgs,
+			minBundleId,
+			archivePath,
+			platform,
+			sourceDir,
+			xcodeProject,
+			configuration,
+			extraParams: build.extraParams,
+			destination,
+			xcconfig: build.xcconfig,
+			xcodeScheme
+		});
+		try {
+			const { logFilePath } = await runXcodebuildWithLogging({
+				args: archiveArgs,
+				env: { HOT_UPDATER_MIN_BUNDLE_ID: minBundleId },
+				title: `Archiving ${xcodeScheme}`,
+				successMessage: `Archived ${xcodeScheme}`,
+				failureMessage: "Archive failed",
+				logPrefix,
+				header: [
+					...header,
+					`Project   ${xcodeProject.name}`,
+					`Scheme    ${xcodeScheme}`,
+					`Platform  ${platform}`
+				],
+				sourceDir
+			});
+			return {
+				archivePath,
+				logFilePath
+			};
+		} catch (error) {
+			throw prettifyXcodebuildError(error);
+		}
+	} finally {
+		await removeTmpDir(tmpDir);
+	}
+};
+const prepareArchiveArgs = ({ xcodeScheme, archivePath, platform, sourceDir, xcodeProject, configuration = "Release", xcconfig, extraParams, destination = [], minBundleId, authenticationArgs }) => {
+	const args = [
+		xcodeProject.isWorkspace ? "-workspace" : "-project",
+		path.default.join(sourceDir, xcodeProject.name),
+		"-scheme",
+		xcodeScheme,
+		"-configuration",
+		configuration,
+		"archive",
+		"-archivePath",
+		archivePath,
+		`HOT_UPDATER_MIN_BUNDLE_ID=${minBundleId}`
+	];
+	if (authenticationArgs) args.push(...authenticationArgs);
+	if (xcconfig) args.push("-xcconfig", xcconfig);
+	if (extraParams) args.push(...extraParams);
+	const resolvedDestinations = resolveDestinations({
+		destinations: destination,
+		useGeneric: true
+	});
+	if (resolvedDestinations.length === 0) resolvedDestinations.push(getDefaultDestination({
+		deviceType: "device",
+		platform,
+		useGeneric: true
+	}));
+	for (const destination of resolvedDestinations) args.push("-destination", destination);
+	return args;
+};
+//#endregion
+//#region src/builder/buildXcodeProject.ts
+/**
+* Builds the scheme in a temporary DerivedData directory, copies the built
+* `.app` to `outputDirectory`, and removes DerivedData, which takes 10 GB or
+* more, whether the build succeeds or not.
+*/
+const buildXcodeProject = async ({ sourceDir, outputDirectory, platform, xcodeScheme, configuration, deviceType, logPrefix, destination = [], useGenericDestination = false, installPods, xcconfig, extraParams, minBundleId, authenticationArgs, sandbox, header = [] }) => {
+	if (installPods) await installPodsIfNeeded(sourceDir);
+	const xcodeProject = await parseXcodeProjectInfo(sourceDir);
+	const tmpDir = await createRandomTmpDir();
+	try {
+		const derivedDataPath = path.default.join(tmpDir, "DerivedData");
+		const resolvedDestinations = resolveDestinations({
+			destinations: destination,
+			useGeneric: useGenericDestination
+		});
+		if (resolvedDestinations.length === 0) resolvedDestinations.push(getDefaultDestination({
+			deviceType,
+			platform,
+			useGeneric: useGenericDestination
+		}));
+		const build = await writeBuildXcconfig({
+			directory: tmpDir,
+			sourceDir,
+			xcconfig,
+			extraParams,
+			settings: buildSettingsOverScheme({
+				minBundleId,
+				authenticationArgs,
+				sandbox
+			})
+		});
+		const buildArgs = prepareBuildArgs({
+			authenticationArgs,
+			xcconfig: build.xcconfig,
+			minBundleId,
+			configuration,
+			derivedDataPath,
+			deviceType,
+			resolvedDestinations,
+			extraParams: build.extraParams,
+			platform,
+			xcodeScheme,
+			sourceDir,
+			xcodeProject
+		});
+		let builtAppPath;
+		let logFilePath;
+		try {
+			({logFilePath} = await runXcodebuildWithLogging({
+				args: buildArgs,
+				env: { HOT_UPDATER_MIN_BUNDLE_ID: minBundleId },
+				sourceDir,
+				logPrefix,
+				header: [
+					...header,
+					`Project        ${xcodeProject.name}`,
+					`Scheme         ${xcodeScheme}`,
+					`Configuration  ${configuration}`,
+					`Platform       ${platform}`,
+					`Device type    ${deviceType}`
+				],
+				title: `Building ${xcodeScheme}`,
+				successMessage: `Built ${xcodeScheme}`,
+				failureMessage: "Build failed"
+			}));
+			({appPath: builtAppPath} = await getBuildSettings({
+				configuration,
+				derivedDataPath,
+				resolvedDestinations,
+				xcodeScheme,
+				sourceDir,
+				xcodeProject,
+				xcconfig: build.xcconfig,
+				extraParams: build.extraParams
+			}));
+		} catch (error) {
+			throw prettifyXcodebuildError(error);
+		}
+		const appPath = path.default.join(outputDirectory, path.default.basename(builtAppPath));
+		await fs.default.promises.cp(builtAppPath, appPath, { recursive: true });
+		return {
+			appPath,
+			logFilePath
+		};
+	} finally {
+		await removeTmpDir(tmpDir);
+	}
+};
+const prepareBuildArgs = ({ xcodeProject, sourceDir, platform, xcodeScheme, configuration, deviceType, resolvedDestinations, derivedDataPath, extraParams, minBundleId, authenticationArgs, xcconfig }) => {
+	const sdk = deviceType === "simulator" ? platformConfigs[platform].simulatorSdk : platformConfigs[platform].deviceSdk;
+	const args = [
+		xcodeProject.isWorkspace ? "-workspace" : "-project",
+		path.default.join(sourceDir, xcodeProject.name),
+		"-scheme",
+		xcodeScheme,
+		"-configuration",
+		configuration,
+		"-sdk",
+		sdk,
+		"-derivedDataPath",
+		derivedDataPath,
+		`HOT_UPDATER_MIN_BUNDLE_ID=${minBundleId}`,
+		"build"
+	];
+	if (authenticationArgs) args.push(...authenticationArgs);
+	args.push("-xcconfig", xcconfig);
+	if (extraParams) args.push(...extraParams);
+	for (const dest of resolvedDestinations) args.push("-destination", dest);
+	return args;
+};
+const BUILD_SETTING = /^[A-Za-z_][A-Za-z0-9_]*(\[[^\]]*\])*=/u;
+const getBuildSettings = async ({ xcodeProject, sourceDir, xcodeScheme, configuration, resolvedDestinations, derivedDataPath, xcconfig, extraParams }) => {
+	const destinationArgs = resolvedDestinations.flatMap((dest) => ["-destination", dest]);
+	const { stdout: buildSettings } = await (0, execa.execa)("xcodebuild", [
+		xcodeProject.isWorkspace ? "-workspace" : "-project",
+		xcodeProject.name,
+		"-scheme",
+		xcodeScheme,
+		"-configuration",
+		configuration,
+		...destinationArgs,
+		"-derivedDataPath",
+		derivedDataPath,
+		"-xcconfig",
+		xcconfig,
+		...extraParams.filter((param) => BUILD_SETTING.test(param)),
+		"-showBuildSettings",
+		"-json"
+	], { cwd: sourceDir });
+	const settings = JSON.parse(buildSettings).filter(({ target }) => target !== "React" && target !== "React-Core");
+	if (settings.length === 0) throw new Error("Failed to get build settings for your project");
+	const targetSettings = settings[0].buildSettings;
+	const wrapperExtension = targetSettings.WRAPPER_EXTENSION;
+	if (wrapperExtension !== "app" && wrapperExtension !== "framework") throw new Error(`Expected wrapper extension to be "app" or "framework" but found: ${wrapperExtension}`);
+	const targetBuildDir = targetSettings.TARGET_BUILD_DIR;
+	const executableFolderPath = targetSettings.EXECUTABLE_FOLDER_PATH;
+	const fullProductName = targetSettings.FULL_PRODUCT_NAME;
+	const infoPlistPath = targetSettings.INFOPLIST_PATH;
+	if (!targetBuildDir || !executableFolderPath || !fullProductName) throw new Error("Failed to get build paths from build settings");
+	return {
+		appPath: path.default.join(targetBuildDir, executableFolderPath),
+		infoPlistPath: path.default.join(targetBuildDir, infoPlistPath)
+	};
+};
+//#endregion
+//#region src/builder/exportXcodeArchive.ts
+/** Exports the archive into `exportPath`. */
+const exportXcodeArchive = async ({ archivePath, exportPath, sourceDir, exportExtraParams, exportOptionsPlist, logPrefix, logFilePath, title, authenticationArgs }) => {
+	const exportArgs = prepareExportArgs({
+		authenticationArgs,
+		archivePath,
+		exportPath,
+		exportOptionsPlist,
+		exportExtraParams
+	});
+	try {
+		await runXcodebuildWithLogging({
+			args: exportArgs,
+			sourceDir,
+			title: `Exporting ${title}`,
+			successMessage: `Exported ${title}`,
+			failureMessage: "Export failed",
+			logPrefix,
+			logFilePath
+		});
+		return { exportPath };
+	} catch (error) {
+		throw prettifyXcodebuildError(error);
 	}
 };
-/**
-* Sends each part App Store Connect asked for: the bytes at its offset, with
-* only the headers it lists, since the URLs are presigned: another header,
-* or the App Store Connect token, would break their signature.
-*/
-const uploadParts = async ({ ipaPath, operations, fetch }) => {
-	const file = await fs.default.promises.open(ipaPath, "r");
+const prepareExportArgs = ({ exportPath, archivePath, exportExtraParams, exportOptionsPlist, authenticationArgs }) => {
+	const args = [
+		"-exportArchive",
+		"-archivePath",
+		archivePath,
+		"-exportPath",
+		exportPath
+	];
+	if (authenticationArgs) args.push(...authenticationArgs);
+	if (exportExtraParams) args.push(...exportExtraParams);
+	args.push("-exportOptionsPlist", exportOptionsPlist);
+	return args;
+};
+//#endregion
+//#region src/utils/assertXcodebuildExist.ts
+const assertXcodebuildExist = async () => {
 	try {
-		await runConcurrently(operations, UPLOAD_CONCURRENCY, async (operation, index) => {
-			const body = Buffer.alloc(operation.length);
-			const { bytesRead } = await file.read(body, 0, operation.length, operation.offset);
-			if (bytesRead !== operation.length) throw new Error(`${path.default.basename(ipaPath)} changed while it was uploading.`);
-			const headers = {};
-			for (const { name, value } of operation.requestHeaders ?? []) headers[name] = value;
-			for (let attempt = 1;; attempt++) {
-				const response = await fetch(operation.url, {
-					method: operation.method,
-					headers,
-					body
-				}).catch((error) => error);
-				if (!(response instanceof Error) && response.ok) return;
-				if (!(response instanceof Error || isRetryableStatus(response.status)) || attempt === UPLOAD_ATTEMPTS) throw new Error(`Uploading part ${index + 1} of ${operations.length} failed: ${response instanceof Error ? response.message : `HTTP ${response.status}`}.`);
-				await sleep(retryDelayMs(response, attempt));
-			}
-		});
-	} finally {
-		await file.close();
+		await (0, execa.execa)("which", ["xcodebuild"]);
+	} catch {
+		_hot_updater_cli_tools.p.log.error(`${_hot_updater_cli_tools.colors.blueBright("xcodebuild")} resolve failed. Ensure that xcode is installed on your machine or xcodebuild is included in your path`);
+		process.exit(1);
 	}
 };
 //#endregion
@@ -2523,7 +2760,7 @@ var AppStoreConnectRefusal = class extends Error {
 		this.agreement = agreement;
 	}
 };
-const refusal = async (action, response) => {
+const refusal$1 = async (action, response) => {
 	const body = await response.json().catch(() => void 0);
 	return new AppStoreConnectRefusal(`${action} failed (HTTP ${response.status}).`, isProgramLicenseAgreementError(Array.isArray(body?.errors) ? body.errors : []));
 };
@@ -2561,7 +2798,7 @@ const revokeKeychainCertificates = async ({ certificates, apiKey, privateKey, fe
 		})}`;
 		while (next) {
 			const response = await fetch(next, { headers });
-			if (!response.ok) throw await refusal("Listing the team's certificates", response);
+			if (!response.ok) throw await refusal$1("Listing the team's certificates", response);
 			const body = await response.json();
 			for (const { id, attributes } of body.data ?? []) if (attributes?.serialNumber) idsBySerial.set(normalizeSerial(attributes.serialNumber), id);
 			next = body.links?.next;
@@ -2575,7 +2812,7 @@ const revokeKeychainCertificates = async ({ certificates, apiKey, privateKey, fe
 			});
 			if (response.ok || response.status === 404) revoked.push(certificate);
 			else {
-				agreement ||= (await refusal("Revoking", response)).agreement;
+				agreement ||= (await refusal$1("Revoking", response)).agreement;
 				failed.push({
 					certificate,
 					status: response.status
@@ -2587,111 +2824,711 @@ const revokeKeychainCertificates = async ({ certificates, apiKey, privateKey, fe
 		agreement ||= error instanceof AppStoreConnectRefusal && error.agreement;
 		for (const certificate of certificates) if (!revoked.includes(certificate)) failed.push({ certificate });
 	}
-	const describe = ({ commonName, serialNumber }) => `${commonName} (serial ${serialNumber})`;
-	if (revoked.length > 0) _hot_updater_cli_tools.p.log.info(["Revoked the certificates Xcode created for this build:", ...revoked.flatMap(({ commonName, serialNumber }) => [commonName, `Serial ${serialNumber}`])].join("\n"));
-	if (failed.length > 0) _hot_updater_cli_tools.p.log.warn([
-		"Couldn't revoke the certificates Xcode created for this build.",
-		...reason === void 0 ? [] : [reason],
-		...agreement ? [PROGRAM_LICENSE_AGREEMENT_HINT] : [],
-		...failed.flatMap(({ certificate, status }) => [certificate.commonName, `Serial ${certificate.serialNumber}${status === void 0 ? "" : ` (HTTP ${status})`}`]),
-		CERTIFICATES_URL
-	].join("\n"));
+	const describe = ({ commonName, serialNumber }) => `${commonName} (serial ${serialNumber})`;
+	if (revoked.length > 0) _hot_updater_cli_tools.p.log.info(["Revoked the certificates Xcode created for this build:", ...revoked.flatMap(({ commonName, serialNumber }) => [commonName, `Serial ${serialNumber}`])].join("\n"));
+	if (failed.length > 0) _hot_updater_cli_tools.p.log.warn([
+		"Couldn't revoke the certificates Xcode created for this build.",
+		...reason === void 0 ? [] : [reason],
+		...agreement ? [PROGRAM_LICENSE_AGREEMENT_HINT] : [],
+		...failed.flatMap(({ certificate, status }) => [certificate.commonName, `Serial ${certificate.serialNumber}${status === void 0 ? "" : ` (HTTP ${status})`}`]),
+		CERTIFICATES_URL
+	].join("\n"));
+	return {
+		revoked: revoked.map(describe),
+		failed: failed.map(({ certificate }) => describe(certificate))
+	};
+};
+const TERMINATION_SIGNALS = [
+	"SIGHUP",
+	"SIGINT",
+	"SIGTERM"
+];
+/**
+* Runs `run`, the archive and export of a build that signs with an App
+* Store Connect API key, in a keychain of its own when `enabled` (in CI),
+* then revokes the certificates Xcode created in it and deletes it. A
+* termination signal does the same before the process ends with it: the
+* certificates are read from the keychain before it is deleted, and the key
+* is read into memory first, since the build's temporary key file is deleted
+* on the signal. A second signal restores the keychains at once.
+*
+* `keepDistribution` keeps a distribution certificate out of the revoking, for
+* an ad hoc export: Xcode may have signed the `.ipa` with one it created here,
+* rather than the cloud-managed one, and installs may need it valid. Only the
+* development certificates Xcode created for the archive are then revoked.
+*/
+const withSigningKeychain = async ({ enabled, keepDistribution = false, apiKey, run, security, lockPath, acquireLock, fetch }) => {
+	if (!enabled) return run();
+	const privateKey = crypto.default.createPrivateKey(await fs.default.promises.readFile(apiKey.keyPath, "utf-8"));
+	const keychain = await createSigningKeychain({
+		security,
+		lockPath,
+		acquireLock
+	});
+	_hot_updater_cli_tools.p.log.info("Signing in a keychain of this build's own (CI is set).");
+	let cleanup;
+	const release = () => {
+		cleanup ??= (async () => {
+			const certificates = await keychain.certificates().catch(() => []);
+			await keychain.dispose();
+			await revokeKeychainCertificates({
+				certificates: keepDistribution ? certificates.filter(({ commonName }) => !commonName.includes("Distribution")) : certificates,
+				apiKey,
+				privateKey,
+				fetch
+			});
+		})();
+		return cleanup;
+	};
+	const stopListening = () => {
+		for (const signal of TERMINATION_SIGNALS) process.off(signal, onSignal);
+	};
+	const onSignal = (signal) => {
+		if (cleanup) {
+			stopListening();
+			restoreLive();
+			process.kill(process.pid, signal);
+			return;
+		}
+		release().finally(() => {
+			stopListening();
+			if (process.listenerCount(signal) === 0) process.kill(process.pid, signal);
+		});
+	};
+	for (const signal of TERMINATION_SIGNALS) process.on(signal, onSignal);
+	try {
+		return await run();
+	} finally {
+		await release();
+		stopListening();
+	}
+};
+//#endregion
+//#region src/utils/readBuiltApp.ts
+const readInfoValue = async (infoPlist, key) => {
+	const { stdout, exitCode } = await (0, execa.execa)("plutil", [
+		"-extract",
+		key,
+		"raw",
+		"-o",
+		"-",
+		infoPlist
+	], { reject: false });
+	return exitCode === 0 && stdout.trim() ? stdout.trim() : null;
+};
+/**
+* What the built `.app` reports at runtime, from its Info.plist: the
+* `CFBundleShortVersionString`, `CFBundleVersion` (the build number) and
+* `HOT_UPDATER_CHANNEL` the build settings,
+* an `xcconfig` and `extraParams` expanded.
+*/
+const readBuiltApp = async (appPath) => {
+	const infoPlist = path.default.join(appPath, "Info.plist");
+	const [appVersion, channel, buildNumber] = await Promise.all([
+		readInfoValue(infoPlist, "CFBundleShortVersionString"),
+		readInfoValue(infoPlist, "HOT_UPDATER_CHANNEL"),
+		readInfoValue(infoPlist, "CFBundleVersion")
+	]);
+	return {
+		appVersion,
+		channel,
+		buildNumber
+	};
+};
+//#endregion
+//#region src/sandboxTestFlight.ts
+/**
+* The states of a version Apple hasn't approved, which still takes builds.
+* Any other state, such as one Apple adds later, counts as closed: a raise
+* costs a sandbox build nothing, and an upload to a closed train costs one.
+*/
+const OPEN_VERSION_STATES = /* @__PURE__ */ new Set([
+	"PREPARE_FOR_SUBMISSION",
+	"READY_FOR_REVIEW",
+	"WAITING_FOR_REVIEW",
+	"IN_REVIEW",
+	"WAITING_FOR_EXPORT_COMPLIANCE",
+	"PENDING_CONTRACT",
+	"INVALID_BINARY",
+	"METADATA_REJECTED",
+	"REJECTED",
+	"DEVELOPER_REJECTED"
+]);
+/** A version as numbers: `1.6.2`, or null for one that isn't only numbers. */
+const parseVersion = (version) => /^\d+(\.\d+)*$/u.test(version) ? version.split(".").map(Number) : null;
+/** Negative, zero or positive as `a` is below, equal to or above `b`. */
+const compareVersions = (a, b) => {
+	for (let i = 0; i < Math.max(a.length, b.length); i += 1) {
+		const difference = (a[i] ?? 0) - (b[i] ?? 0);
+		if (difference !== 0) return difference;
+	}
+	return 0;
+};
+/** The highest of `versions`, ignoring any that aren't only numbers. */
+const highestVersion = (versions) => {
+	let highest = null;
+	for (const text of versions) {
+		const parts = parseVersion(text);
+		if (parts && (!highest || compareVersions(parts, highest.parts) > 0)) highest = {
+			text,
+			parts
+		};
+	}
+	return highest?.text ?? null;
+};
+/** The highest integer build number among `versions`. */
+const highestBuildNumberOf = (versions) => {
+	const numbers = versions.filter((version) => /^\d+$/u.test(version)).map(Number);
+	return numbers.length > 0 ? Math.max(...numbers) : null;
+};
+/**
+* Reads what a sandbox build must fit before it is built: the versions Apple
+* approved, from `/v1/appStoreVersions`, since a closed train's builds look
+* like any others in `/v1/builds`, and the app's highest build number.
+*/
+const readAppStoreTrain = async ({ bundleId, apiKey, fetch = globalThis.fetch }) => {
+	const privateKey = await readPrivateKey(apiKey.keyPath);
+	const request = createAppStoreConnectRequest({
+		apiKey,
+		privateKey,
+		fetch
+	});
+	const { app } = await findApp(request, bundleId);
+	const [{ data: versions }, { data: builds }] = await Promise.all([retrying(() => request("Reading the App Store versions", "GET", `/v1/apps/${app.id}/appStoreVersions?${new URLSearchParams({
+		"filter[platform]": "IOS",
+		"fields[appStoreVersions]": "versionString,appVersionState,appStoreState",
+		limit: "200"
+	})}`)), retrying(() => request("Reading the app's builds", "GET", `/v1/builds?${new URLSearchParams({
+		"filter[app]": app.id,
+		sort: "-uploadedDate",
+		"fields[builds]": "version",
+		limit: "200"
+	})}`))]);
+	const closed = versions.flatMap(({ attributes }) => {
+		const state = attributes?.appVersionState ?? attributes?.appStoreState;
+		return attributes?.versionString && !(state && OPEN_VERSION_STATES.has(state)) ? [attributes.versionString] : [];
+	});
+	return {
+		highestClosedVersion: highestVersion(closed),
+		highestBuildNumber: highestBuildNumberOf(builds.flatMap(({ attributes }) => attributes?.version ?? []))
+	};
+};
+/**
+* What a sandbox device build needs from App Store Connect, read before the
+* build. An export for elsewhere has no train, and without an API key it
+* can't be read: the store would say so after the upload. What a closed train
+* does to the build waits for the archive (`patchSandboxArchive`): only the
+* archived app holds the version an `xcconfig` or `extraParams` settled on,
+* which the project's files don't.
+*/
+const prepareSandboxArchive = async ({ schemeConfig, apiKey, updateStrategy, fetch }) => {
+	if (!await exportsForAppStoreConnect(schemeConfig)) return { updateStrategy };
+	if (!apiKey) {
+		_hot_updater_cli_tools.p.log.warn("No App Store Connect API key, so the sandbox build can't check for a closed version.\nSet signing.ascApiKey on the scheme.");
+		return { updateStrategy };
+	}
+	return {
+		train: await readAppStoreTrain({
+			bundleId: schemeConfig.bundleIdentifier,
+			apiKey,
+			...fetch ? { fetch } : {}
+		}),
+		updateStrategy
+	};
+};
+/** Whether Apple refuses a build of `version`, as `train` says. */
+const isVersionTrainClosed = (version, { highestClosedVersion }) => {
+	const parts = parseVersion(version);
+	const closed = highestClosedVersion === null ? null : parseVersion(highestClosedVersion);
+	return parts !== null && closed !== null && compareVersions(parts, closed) <= 0;
+};
+/**
+* What a sandbox build does with a closed version train. Under the fingerprint
+* strategy it raises its own version past the closed one, which targets no
+* update. Under appVersion the version is what updates target, so it refuses
+* rather than move them silently.
+*/
+const sandboxVersionDecision = ({ version, train, updateStrategy }) => {
+	if (!isVersionTrainClosed(version, train)) return { kind: "keep" };
+	const closed = train.highestClosedVersion;
+	if (updateStrategy === "appVersion") return {
+		kind: "refuse",
+		message: `App Store Connect closed version ${closed}, so TestFlight refuses ${version}.\nRaise the app version.`
+	};
+	const [major = 0, minor = 0, patch = 0] = parseVersion(closed);
+	return {
+		kind: "raise",
+		version: `${major}.${minor}.${patch + 1}`
+	};
+};
+/**
+* Refuses, before the upload, a sandbox `.ipa` Xcode didn't mark for internal
+* testing only: App Store Connect would let it reach App Store review.
+*/
+const assertIpaIsInternalOnly = async (ipaPath) => {
+	if (!await readIpaInternalTestingOnly(ipaPath)) throw new Error(`${path.default.basename(ipaPath)} isn't marked for internal testing only (TFInternalTestingOnly), so it wasn't uploaded.\nExport it with testFlightInternalTestingOnly.`);
+};
+/** How long App Store Connect may take to list a build it accepted. */
+const AUDIENCE_TIMEOUT_MS = 3e5;
+const STATE_OF_INTERNAL_BUILD = {
+	MISSING_EXPORT_COMPLIANCE: "missing-compliance",
+	IN_EXPORT_COMPLIANCE_REVIEW: "missing-compliance",
+	PROCESSING: "processing",
+	PROCESSING_EXCEPTION: "failed",
+	EXPIRED: "expired"
+};
+/**
+* One read of a version and build number: its audience, processing state,
+* expiry, and internal testing state. Null while App Store Connect lists none.
+*/
+const readBuildStatus = async (request, { appId, shortVersion, bundleVersion }) => {
+	const { data, included } = await retrying(() => request("Reading the build", "GET", `/v1/builds?${new URLSearchParams({
+		"filter[app]": appId,
+		"filter[version]": bundleVersion,
+		...shortVersion === null ? {} : { "filter[preReleaseVersion.version]": shortVersion },
+		"fields[builds]": "buildAudienceType,processingState,expirationDate,expired,buildBetaDetail",
+		include: "buildBetaDetail",
+		"fields[buildBetaDetails]": "internalBuildState",
+		limit: "1"
+	})}`));
+	const build = data[0];
+	if (!build) return null;
+	const internal = included?.find(({ type }) => type === "buildBetaDetails")?.attributes?.internalBuildState;
+	const processing = build.attributes?.processingState;
+	const expiration = build.attributes?.expirationDate;
+	const state = build.attributes?.expired ? "expired" : processing === "PROCESSING" || !processing ? "processing" : processing !== "VALID" ? "failed" : STATE_OF_INTERNAL_BUILD[internal ?? ""] ?? "ready";
+	return {
+		buildId: build.id,
+		audience: build.attributes?.buildAudienceType ?? null,
+		state,
+		...state === "missing-compliance" && internal === "IN_EXPORT_COMPLIANCE_REVIEW" ? { inExportComplianceReview: true } : {},
+		expiresAtMs: expiration ? Date.parse(expiration) : null
+	};
+};
+/**
+* Fails unless App Store Connect holds the uploaded sandbox build for internal
+* testing only, as `buildAudienceType` says once the build is listed, and
+* returns what that read says of it.
+*/
+const assertBuildIsInternalOnly = async ({ ipaPath, apiKey, fetch = globalThis.fetch, pollIntervalMs = 5e3, timeoutMs = AUDIENCE_TIMEOUT_MS }) => {
+	const [info, privateKey] = await Promise.all([readIpaInfo(ipaPath), readPrivateKey(apiKey.keyPath)]);
+	const request = createAppStoreConnectRequest({
+		apiKey,
+		privateKey,
+		fetch
+	});
+	const { app, testFlightUrl } = await findApp(request, info.bundleId);
+	const label = `${info.shortVersion} (${info.bundleVersion})`;
+	const deadline = Date.now() + timeoutMs;
+	for (;;) {
+		const status = await readBuildStatus(request, {
+			appId: app.id,
+			shortVersion: info.shortVersion,
+			bundleVersion: info.bundleVersion
+		});
+		if (status?.audience === "INTERNAL_ONLY") return {
+			...status,
+			appId: app.id,
+			testFlightUrl
+		};
+		if (status?.audience) throw new Error(`App Store Connect holds sandbox build ${label} for ${status.audience}, not INTERNAL_ONLY.\nExpire it in TestFlight:\n${testFlightUrl}`);
+		if (Date.now() >= deadline) throw new Error(`App Store Connect didn't say who sandbox build ${label} is for.\nCheck that it is internal only in TestFlight:\n${testFlightUrl}`);
+		await sleep(pollIntervalMs);
+	}
+};
+/**
+* The internal TestFlight group named `name`, read before anything is built.
+* An external group is refused: its builds go to Beta App Review, and a sandbox
+* build is for internal testing only.
+*/
+const findInternalBetaGroup = async ({ bundleId, name, apiKey, fetch = globalThis.fetch }) => {
+	const privateKey = await readPrivateKey(apiKey.keyPath);
+	const request = createAppStoreConnectRequest({
+		apiKey,
+		privateKey,
+		fetch
+	});
+	const { app, testFlightUrl } = await findApp(request, bundleId);
+	return readInternalBetaGroup(request, {
+		appId: app.id,
+		bundleId,
+		name,
+		testFlightUrl
+	});
+};
+/** The group named `name` of an app, refused unless it is internal. */
+const readInternalBetaGroup = async (request, { appId, bundleId, name, testFlightUrl }) => {
+	const { data } = await retrying(() => request("Reading the TestFlight groups", "GET", `/v1/betaGroups?${new URLSearchParams({
+		"filter[app]": appId,
+		"filter[name]": name,
+		"fields[betaGroups]": "name,isInternalGroup,hasAccessToAllBuilds",
+		limit: "200"
+	})}`));
+	const group = data.find(({ attributes }) => attributes?.name === name);
+	if (!group) throw new Error(`App Store Connect has no TestFlight group ${name} for ${bundleId}.\nCreate it as an internal group:\n${testFlightUrl}`);
+	if (group.attributes?.isInternalGroup !== true) throw new Error(`TestFlight group ${name} is external, and a sandbox build is for internal testing only.\nName an internal group.`);
 	return {
-		revoked: revoked.map(describe),
-		failed: failed.map(({ certificate }) => describe(certificate))
+		id: group.id,
+		name,
+		hasAccessToAllBuilds: group.attributes.hasAccessToAllBuilds === true
 	};
 };
-const TERMINATION_SIGNALS = [
-	"SIGHUP",
-	"SIGINT",
-	"SIGTERM"
-];
+/** How long a build's processing may hold up its group and What to Test. */
+const DISTRIBUTION_TIMEOUT_MS = 9e5;
+/** What to Test's locale: the language the CLI writes it in. */
+const WHAT_TO_TEST_LOCALE = "en-US";
 /**
-* Runs `run`, the archive and export of a build that signs with an App
-* Store Connect API key, in a keychain of its own when `enabled` (in CI),
-* then revokes the certificates Xcode created in it and deletes it. A
-* termination signal does the same before the process ends with it: the
-* certificates are read from the keychain before it is deleted, and the key
-* is read into memory first, since the build's temporary key file is deleted
-* on the signal. A second signal restores the keychains at once.
+* Adds a processed build to its internal group and sets its What to Test, which
+* App Store Connect takes once the build is processed. A build still processing
+* after `timeoutMs` keeps its upload: a warning says what to do by hand. Returns
+* the build's state.
 */
-const withSigningKeychain = async ({ enabled, apiKey, run, security, lockPath, acquireLock, fetch }) => {
-	if (!enabled) return run();
-	const privateKey = crypto.default.createPrivateKey(await fs.default.promises.readFile(apiKey.keyPath, "utf-8"));
-	const keychain = await createSigningKeychain({
-		security,
-		lockPath,
-		acquireLock
+const distributeTestFlightBuild = async ({ build: { appId, shortVersion, bundleVersion, testFlightUrl }, group, whatToTest, apiKey, fetch = globalThis.fetch, pollIntervalMs = 15e3, timeoutMs = DISTRIBUTION_TIMEOUT_MS }) => {
+	const privateKey = await readPrivateKey(apiKey.keyPath);
+	const request = createAppStoreConnectRequest({
+		apiKey,
+		privateKey,
+		fetch
 	});
-	_hot_updater_cli_tools.p.log.info("Signing in a keychain of this build's own (CI is set).");
-	let cleanup;
-	const release = () => {
-		cleanup ??= (async () => {
-			const certificates = await keychain.certificates().catch(() => []);
-			await keychain.dispose();
-			await revokeKeychainCertificates({
-				certificates,
-				apiKey,
-				privateKey,
-				fetch
-			});
-		})();
-		return cleanup;
+	const build = {
+		appId,
+		shortVersion,
+		bundleVersion,
+		testFlightUrl
 	};
-	const stopListening = () => {
-		for (const signal of TERMINATION_SIGNALS) process.off(signal, onSignal);
-	};
-	const onSignal = (signal) => {
-		if (cleanup) {
-			stopListening();
-			restoreLive();
-			process.kill(process.pid, signal);
-			return;
+	const status = await waitUntilProcessed(request, build, await readBuildStatus(request, build), {
+		pollIntervalMs,
+		timeoutMs,
+		unset: "its testers and What to Test"
+	});
+	if (!status || status.state === "processing") return status;
+	const { buildId } = status;
+	if (group && !group.hasAccessToAllBuilds) await addBuildToGroup(request, build, buildId, group);
+	if (whatToTest !== void 0) await setWhatToTest(request, buildId, whatToTest);
+	return status;
+};
+/**
+* Reads the build until App Store Connect has processed it, from the status a
+* read already has, for what it takes only then. A build still processing after
+* `timeoutMs` keeps its upload: a warning says what is `unset`. One that can't
+* be processed fails.
+*/
+const waitUntilProcessed = async (request, build, listed, { pollIntervalMs, timeoutMs, unset }) => {
+	const label = `${build.shortVersion} (${build.bundleVersion})`;
+	const deadline = Date.now() + timeoutMs;
+	let status = listed;
+	while (!status || status.state === "processing") {
+		if (Date.now() >= deadline) {
+			_hot_updater_cli_tools.p.log.warn(`App Store Connect is still processing build ${label}, so ${unset} aren't set.\nSet them in TestFlight:\n${build.testFlightUrl}`);
+			return status;
 		}
-		release().finally(() => {
-			stopListening();
-			if (process.listenerCount(signal) === 0) process.kill(process.pid, signal);
-		});
+		await sleep(pollIntervalMs);
+		status = await readBuildStatus(request, build);
+	}
+	if (status.state === "failed") throw new Error(`App Store Connect couldn't process build ${label}.\nCheck it in TestFlight:\n${build.testFlightUrl}`);
+	return status;
+};
+const addBuildToGroup = (request, { shortVersion, bundleVersion }, buildId, group) => retrying(() => request(`Adding build ${shortVersion} (${bundleVersion}) to ${group.name}`, "POST", `/v1/betaGroups/${group.id}/relationships/builds`, { data: [{
+	type: "builds",
+	id: buildId
+}] }));
+/**
+* Applies an internal group to a build already on TestFlight, as an upload does,
+* so a reused build reaches the group named now. One process reads the app, the
+* build and the group once each. Reading a build's `betaGroups` relationship
+* answered 403 when we tried it, so this doesn't check membership first: every
+* run adds the build. A build not `isOffered` gets nothing: it needs a new
+* build, which checks the group itself. A build still processing waits as an
+* upload's does, and the next run applies the group again.
+*/
+const applyTestFlightGroup = async ({ bundleId, shortVersion, bundleVersion, name, isOffered, apiKey, fetch = globalThis.fetch, pollIntervalMs = 15e3, timeoutMs = DISTRIBUTION_TIMEOUT_MS }) => {
+	const privateKey = await readPrivateKey(apiKey.keyPath);
+	const request = createAppStoreConnectRequest({
+		apiKey,
+		privateKey,
+		fetch
+	});
+	const { app, testFlightUrl } = await findApp(request, bundleId);
+	const build = {
+		appId: app.id,
+		shortVersion,
+		bundleVersion,
+		testFlightUrl
 	};
-	for (const signal of TERMINATION_SIGNALS) process.on(signal, onSignal);
+	const listed = await readBuildStatus(request, build);
+	if (!isOffered(listed)) return {
+		testFlightUrl,
+		status: listed,
+		outcome: "not-offered"
+	};
+	const group = await readInternalBetaGroup(request, {
+		appId: app.id,
+		bundleId,
+		name,
+		testFlightUrl
+	});
+	if (group.hasAccessToAllBuilds) return {
+		testFlightUrl,
+		status: listed,
+		outcome: "takes-every-build"
+	};
+	const status = await waitUntilProcessed(request, build, listed, {
+		pollIntervalMs,
+		timeoutMs,
+		unset: "its testers"
+	});
+	if (!status || status.state === "processing") return {
+		testFlightUrl,
+		status,
+		outcome: "pending"
+	};
+	await addBuildToGroup(request, build, status.buildId, group);
+	return {
+		testFlightUrl,
+		status,
+		outcome: "added"
+	};
+};
+/** Sets a build's What to Test: creates it, or updates the one a rerun left. */
+const setWhatToTest = async (request, buildId, whatsNew) => {
 	try {
-		return await run();
-	} finally {
-		await release();
-		stopListening();
+		await retrying(() => request("Setting What to Test", "POST", "/v1/betaBuildLocalizations", { data: {
+			type: "betaBuildLocalizations",
+			attributes: {
+				locale: WHAT_TO_TEST_LOCALE,
+				whatsNew
+			},
+			relationships: { build: { data: {
+				type: "builds",
+				id: buildId
+			} } }
+		} }));
+	} catch (error) {
+		if (!(error instanceof AppStoreConnectError) || error.status !== 409) throw error;
+		const { data } = await retrying(() => request("Reading What to Test", "GET", `/v1/builds/${buildId}/betaBuildLocalizations?${new URLSearchParams({
+			"fields[betaBuildLocalizations]": "locale",
+			limit: "200"
+		})}`));
+		const existing = data.find(({ attributes }) => attributes?.locale === WHAT_TO_TEST_LOCALE);
+		if (!existing) throw error;
+		await retrying(() => request("Setting What to Test", "PATCH", `/v1/betaBuildLocalizations/${existing.id}`, { data: {
+			type: "betaBuildLocalizations",
+			id: existing.id,
+			attributes: { whatsNew }
+		} }));
 	}
 };
+/**
+* What App Store Connect says of a build a run recorded as uploaded, which a
+* later run reuses: its page, and its state and expiry, or a null status when
+* it no longer lists the build.
+*/
+const readTestFlightBuildStatus = async ({ bundleId, shortVersion, bundleVersion, apiKey, fetch = globalThis.fetch }) => {
+	const privateKey = await readPrivateKey(apiKey.keyPath);
+	const request = createAppStoreConnectRequest({
+		apiKey,
+		privateKey,
+		fetch
+	});
+	const { app, testFlightUrl } = await findApp(request, bundleId);
+	return {
+		testFlightUrl,
+		status: await readBuildStatus(request, {
+			appId: app.id,
+			shortVersion,
+			bundleVersion
+		})
+	};
+};
 //#endregion
-//#region src/utils/readBuiltApp.ts
-const readInfoValue = async (infoPlist, key) => {
+//#region src/utils/sandboxInfoPlist.ts
+const URL_TYPE_NAME = "hot-updater-sandbox";
+const CAMERA_USAGE = "Scans the QR code of a preview to open it in this build.";
+const LOCAL_NETWORK_USAGE = "Connects to the dev server you choose on this network.";
+const ATS_KEY = "NSAppTransportSecurity";
+const ATS_LOCAL_NETWORKING_KEY = "NSAllowsLocalNetworking";
+/** A refusal the command prints as it is: the build ran as it should. */
+const refusal = (message) => new _hot_updater_cli_tools.BuildFailedError(message, {
+	logPath: null,
+	summary: [],
+	hint: message
+});
+const plutil = (args) => (0, execa.execa)("plutil", args);
+const readValue = async (plist, key) => {
 	const { stdout, exitCode } = await (0, execa.execa)("plutil", [
 		"-extract",
 		key,
 		"raw",
 		"-o",
 		"-",
-		infoPlist
+		plist
 	], { reject: false });
 	return exitCode === 0 && stdout.trim() ? stdout.trim() : null;
 };
+const setString = (plist, key, value) => plutil([
+	"-replace",
+	key,
+	"-string",
+	value,
+	plist
+]);
+/** Appends a URL type with the sandbox's scheme to the app's own. */
+const addUrlScheme = async (plist, urlScheme) => {
+	const urlType = JSON.stringify({
+		CFBundleURLName: URL_TYPE_NAME,
+		CFBundleURLSchemes: [urlScheme]
+	});
+	const { stdout, exitCode } = await (0, execa.execa)("plutil", [
+		"-extract",
+		"CFBundleURLTypes",
+		"json",
+		"-o",
+		"-",
+		plist
+	], { reject: false });
+	if (exitCode !== 0) {
+		await plutil([
+			"-insert",
+			"CFBundleURLTypes",
+			"-json",
+			`[${urlType}]`,
+			plist
+		]);
+		return;
+	}
+	const existing = JSON.parse(stdout);
+	await plutil([
+		"-insert",
+		`CFBundleURLTypes.${existing.length}`,
+		"-json",
+		urlType,
+		plist
+	]);
+};
+const hasKey = async (plist, key) => {
+	const { exitCode } = await (0, execa.execa)("plutil", [
+		"-extract",
+		key,
+		"xml1",
+		"-o",
+		"-",
+		plist
+	], { reject: false });
+	return exitCode === 0;
+};
 /**
-* What the built `.app` reports at runtime, from its Info.plist: the
-* `CFBundleShortVersionString`, `CFBundleVersion` (the build number) and
-* `HOT_UPDATER_CHANNEL` the build settings,
-* an `xcconfig` and `extraParams` expanded.
+* What the sandbox's screen asks the system for: the camera for its QR scanner,
+* and the local network for a dev server. A value the app already set stays, and
+* nested App Transport Security entries stay beside the one this adds.
 */
-const readBuiltApp = async (appPath) => {
-	const infoPlist = path.default.join(appPath, "Info.plist");
-	const [appVersion, channel, buildNumber] = await Promise.all([
-		readInfoValue(infoPlist, "CFBundleShortVersionString"),
-		readInfoValue(infoPlist, "HOT_UPDATER_CHANNEL"),
-		readInfoValue(infoPlist, "CFBundleVersion")
+const addSandboxPermissions = async (plist) => {
+	for (const [key, value] of [["NSCameraUsageDescription", CAMERA_USAGE], ["NSLocalNetworkUsageDescription", LOCAL_NETWORK_USAGE]]) if (!await hasKey(plist, key)) await plutil([
+		"-insert",
+		key,
+		"-string",
+		value,
+		plist
+	]);
+	if (!await hasKey(plist, ATS_KEY)) await plutil([
+		"-insert",
+		ATS_KEY,
+		"-json",
+		`{"${ATS_LOCAL_NETWORKING_KEY}":true}`,
+		plist
+	]);
+	else if (!await hasKey(plist, `${ATS_KEY}.${ATS_LOCAL_NETWORKING_KEY}`)) await plutil([
+		"-insert",
+		`${ATS_KEY}.${ATS_LOCAL_NETWORKING_KEY}`,
+		"-bool",
+		"true",
+		plist
+	]);
+};
+/**
+* The app's dedicated URL scheme, default channel, and the sandbox's key. The
+* URL scheme and App Store Connect's app come from the scheme's
+* `bundleIdentifier`, while Xcode's build settings decide the app's ID, so an
+* app of another ID stops here, before anything is signed or uploaded.
+*/
+const patchAppInfoPlist = async (plist, scheme) => {
+	const built = await readValue(plist, "CFBundleIdentifier");
+	if (built !== scheme.bundleIdentifier) throw refusal(`The sandbox scheme ${scheme.hotUpdaterSchemeName} sets bundleIdentifier ${scheme.bundleIdentifier}, but Xcode built ${built ?? "no bundle ID"}.\nSet bundleIdentifier to the ID its configuration builds.`);
+	await setString(plist, "HOT_UPDATER_CHANNEL", (0, _hot_updater_protocol_native_artifact.sandboxChannelOf)(scheme.hotUpdaterSchemeName));
+	await plutil([
+		"-replace",
+		_hot_updater_protocol_native_artifact.SANDBOX_INFO_PLIST_KEY,
+		"-bool",
+		"true",
+		plist
+	]);
+	await addUrlScheme(plist, (0, _hot_updater_protocol_native_artifact.sandboxUrlSchemeOf)(scheme.bundleIdentifier));
+	await addSandboxPermissions(plist);
+};
+/** The Info.plist of each app extension inside an `.app`. */
+const extensionInfoPlists = (appPath) => ["PlugIns", "Extensions"].flatMap((directory) => {
+	const extensions = path.default.join(appPath, directory);
+	if (!fs.default.existsSync(extensions)) return [];
+	return fs.default.readdirSync(extensions).filter((name) => name.endsWith(".appex")).map((name) => path.default.join(extensions, name, "Info.plist"));
+});
+/**
+* Makes the archived app a sandbox app before `-exportArchive`, which signs
+* what it finds, so no project file changes: its URL scheme, default channel
+* and key, and from App Store Connect, the version a closed train needs and
+* the next build number, in its extensions too, which must match it.
+*/
+const patchSandboxArchive = async ({ archivePath, appPath, schemeConfig, plan }) => {
+	const appPlist = path.default.join(appPath, "Info.plist");
+	await patchAppInfoPlist(appPlist, schemeConfig);
+	const train = plan?.train;
+	if (!train) return;
+	const version = await readValue(appPlist, "CFBundleShortVersionString");
+	const buildNumber = await readValue(appPlist, "CFBundleVersion");
+	const raised = version === null ? void 0 : sandboxVersionDecision({
+		version,
+		train,
+		updateStrategy: plan.updateStrategy
+	});
+	if (raised?.kind === "refuse") throw refusal(raised.message);
+	const newVersion = raised?.kind === "raise" ? raised.version : null;
+	const newBuildNumber = nextBuildNumber(buildNumber, train.highestBuildNumber);
+	const bundles = [appPlist, ...extensionInfoPlists(appPath)];
+	const archivePlist = path.default.join(archivePath, "Info.plist");
+	const properties = "ApplicationProperties";
+	if (newVersion !== null) {
+		for (const plist of bundles) await setString(plist, "CFBundleShortVersionString", newVersion);
+		await setString(archivePlist, `${properties}.CFBundleShortVersionString`, newVersion);
+		_hot_updater_cli_tools.p.log.info(`Sandbox version ${newVersion}: App Store Connect closed ${version}.`);
+	}
+	if (newBuildNumber !== null) {
+		for (const plist of bundles) await setString(plist, "CFBundleVersion", newBuildNumber);
+		await setString(archivePlist, `${properties}.CFBundleVersion`, newBuildNumber);
+	}
+};
+/**
+* The build number to set over `current`: the one after App Store Connect's
+* highest, or null to keep `current`, already higher, or one that isn't an
+* integer such as `1.2.3`.
+*/
+const nextBuildNumber = (current, highest) => {
+	if (highest === null) return null;
+	if (current !== null && !/^\d+$/u.test(current)) return null;
+	if (current !== null && Number(current) > highest) return null;
+	return String(highest + 1);
+};
+/**
+* Makes a built simulator `.app` a sandbox app, and signs it again ad hoc, as
+* Xcode does for the simulator, since its signature covers the Info.plist.
+*/
+const patchSandboxSimulatorApp = async (appPath, schemeConfig) => {
+	await patchAppInfoPlist(path.default.join(appPath, "Info.plist"), schemeConfig);
+	await (0, execa.execa)("codesign", [
+		"--force",
+		"--sign",
+		"-",
+		"--timestamp=none",
+		"--preserve-metadata=entitlements",
+		appPath
 	]);
-	return {
-		appVersion,
-		channel,
-		buildNumber
-	};
 };
 //#endregion
 //#region src/buildIos.ts
@@ -2704,7 +3541,7 @@ const readBuiltApp = async (appPath) => {
 * once the caller has copied it out. A failed build removes it, and every
 * other directory the build used, itself.
 */
-const buildIos = async ({ schemeConfig, minBundleId = (0, _hot_updater_cli_tools.createMinBundleId)(), credentials, logHeader = [] }) => {
+const buildIos = async ({ schemeConfig, minBundleId = (0, _hot_updater_cli_tools.createMinBundleId)(), credentials, sandbox, logHeader = [] }) => {
 	await assertXcodebuildExist();
 	if (schemeConfig.simulator && schemeConfig.destination.length) {
 		_hot_updater_cli_tools.p.log.error("The scheme option 'simulator' is not compatible with the 'destination' option.");
@@ -2717,6 +3554,7 @@ const buildIos = async ({ schemeConfig, minBundleId = (0, _hot_updater_cli_tools
 				schemeConfig,
 				minBundleId,
 				credentials,
+				sandbox,
 				buildDirectory,
 				logHeader
 			}),
@@ -2727,7 +3565,7 @@ const buildIos = async ({ schemeConfig, minBundleId = (0, _hot_updater_cli_tools
 		throw error;
 	}
 };
-const buildInto = async ({ schemeConfig, minBundleId, credentials, buildDirectory, logHeader }) => {
+const buildInto = async ({ schemeConfig, minBundleId, credentials, sandbox, buildDirectory, logHeader }) => {
 	const iosProjectRoot = path.default.join((0, _hot_updater_cli_tools.getCwd)(), "ios");
 	if (schemeConfig.simulator) {
 		const appDir = path.default.join(buildDirectory, "app");
@@ -2742,10 +3580,13 @@ const buildInto = async ({ schemeConfig, minBundleId, credentials, buildDirector
 			configuration: schemeConfig.configuration,
 			deviceType: "simulator",
 			installPods: schemeConfig.installPods,
+			xcconfig: schemeConfig.xcconfig,
 			extraParams: schemeConfig.extraParams,
 			useGenericDestination: true,
-			minBundleId
+			minBundleId,
+			sandbox: schemeConfig.sandbox
 		});
+		if (schemeConfig.sandbox) await patchSandboxSimulatorApp(appPath, schemeConfig);
 		return {
 			buildDirectory,
 			buildArtifactPath: appPath,
@@ -2760,17 +3601,21 @@ const buildInto = async ({ schemeConfig, minBundleId, credentials, buildDirector
 		if (!signing) return archiveAndExport({
 			schemeConfig,
 			minBundleId,
+			sandbox,
 			buildDirectory,
 			logHeader
 		});
-		const appStoreConnect = await exportsForAppStoreConnect(schemeConfig);
-		if ((0, _hot_updater_cli_tools.isCI)() && !appStoreConnect) _hot_updater_cli_tools.p.log.info("Signing in the runner's own keychains (not an App Store Connect export).");
+		const registeredDevices = await exportsForRegisteredDevices(schemeConfig);
+		const ownKeychain = registeredDevices || await exportsForAppStoreConnect(schemeConfig);
+		if ((0, _hot_updater_cli_tools.isCI)() && !ownKeychain) _hot_updater_cli_tools.p.log.info("Signing in the runner's own keychains (not an App Store Connect or ad hoc export).");
 		return withSigningKeychain({
-			enabled: (0, _hot_updater_cli_tools.isCI)() && appStoreConnect,
+			enabled: (0, _hot_updater_cli_tools.isCI)() && ownKeychain,
+			keepDistribution: registeredDevices,
 			apiKey: signing.apiKey,
 			run: () => archiveAndExport({
 				schemeConfig,
 				minBundleId,
+				sandbox,
 				buildDirectory,
 				logHeader,
 				authenticationArgs: signing.authenticationArgs
@@ -2782,7 +3627,7 @@ const buildInto = async ({ schemeConfig, minBundleId, credentials, buildDirector
 * Archives a device build and exports its `.ipa`, or returns the
 * `.xcarchive` of a scheme it cannot export.
 */
-const archiveAndExport = async ({ schemeConfig, minBundleId, buildDirectory, logHeader, authenticationArgs }) => {
+const archiveAndExport = async ({ schemeConfig, minBundleId, sandbox, buildDirectory, logHeader, authenticationArgs }) => {
 	const iosProjectRoot = path.default.join((0, _hot_updater_cli_tools.getCwd)(), "ios");
 	const archiveDir = path.default.join(buildDirectory, "archive");
 	const exportDir = path.default.join(buildDirectory, "export");
@@ -2800,9 +3645,19 @@ const archiveAndExport = async ({ schemeConfig, minBundleId, buildDirectory, log
 		configuration: schemeConfig.configuration,
 		installPods: schemeConfig.installPods,
 		logPrefix: `ios-${schemeConfig.hotUpdaterSchemeName}-build`,
-		header: logHeader
+		header: logHeader,
+		sandbox: schemeConfig.sandbox
 	});
 	const appFromArchive = extractAppFromXcarchive(archivePath);
+	if (schemeConfig.sandbox) {
+		if (!appFromArchive) throw new Error(`The archive ${archivePath} has no app to patch.`);
+		await patchSandboxArchive({
+			archivePath,
+			appPath: appFromArchive,
+			schemeConfig,
+			plan: sandbox
+		});
+	}
 	const archivedAppPath = appFromArchive ? path.default.join(archiveDir, path.default.basename(appFromArchive)) : void 0;
 	if (appFromArchive && archivedAppPath) await fs.default.promises.cp(appFromArchive, archivedAppPath, { recursive: true });
 	if (!schemeConfig.exportOptionsPlist && !authenticationArgs) return {
@@ -2823,15 +3678,17 @@ const archiveAndExport = async ({ schemeConfig, minBundleId, buildDirectory, log
 		logFilePath: logFilePath ?? void 0,
 		title: schemeConfig.scheme
 	});
-	if (schemeConfig.exportOptionsPlist) await exportArchive(schemeConfig.exportOptionsPlist);
+	const { exportOptionsPlist } = schemeConfig;
+	if (exportOptionsPlist && !schemeConfig.sandbox) await exportArchive(exportOptionsPlist);
 	else {
 		const exportOptionsDir = await createRandomTmpDir();
 		try {
-			await exportArchive(await writeAppStoreConnectExportOptions(exportOptionsDir));
+			await exportArchive(exportOptionsPlist ? await resolveSandboxExportOptions(schemeConfig.hotUpdaterSchemeName, exportOptionsPlist, exportOptionsDir) : await writeAppStoreConnectExportOptions(exportOptionsDir, { internalTestingOnly: schemeConfig.sandbox }));
 		} finally {
 			await removeTmpDir(exportOptionsDir);
 		}
 	}
+	await keepOnlyIpas(exportDir);
 	const ipaFile = fs.default.readdirSync(exportDir).find((file) => file.endsWith(".ipa"));
 	if (!ipaFile) throw new Error("IPA file not found after export");
 	return {
@@ -2841,6 +3698,17 @@ const archiveAndExport = async ({ schemeConfig, minBundleId, buildDirectory, log
 		builtApp: archivedAppPath ? await readBuiltApp(archivedAppPath) : void 0
 	};
 };
+/**
+* Leaves only the `.ipa` in an export's folder. Xcode writes `Packaging.log`
+* beside it, which holds the API key's bearer token for its 20 minutes, and the
+* build's output and its cache copy the whole build directory into the project.
+*/
+const keepOnlyIpas = async (exportDir) => {
+	for (const entry of await fs.default.promises.readdir(exportDir)) if (!entry.endsWith(".ipa")) await fs.default.promises.rm(path.default.join(exportDir, entry), {
+		recursive: true,
+		force: true
+	});
+};
 const extractAppFromXcarchive = (archivePath) => {
 	const productsPath = path.default.join(archivePath, "Products", "Applications");
 	if (!fs.default.existsSync(productsPath)) return;
@@ -2849,28 +3717,6 @@ const extractAppFromXcarchive = (archivePath) => {
 	_hot_updater_cli_tools.p.log.warn("Failed to extract .app from xcarchive");
 };
 //#endregion
-//#region src/utils/enrichNativeBuildIosScheme.ts
-const resolveExportOptionsPlist = (exportOptionsPlist) => {
-	const resolvedExportOptionsPlist = exportOptionsPlist ? path.default.isAbsolute(exportOptionsPlist) ? exportOptionsPlist : path.default.resolve((0, _hot_updater_cli_tools.getCwd)(), exportOptionsPlist) : void 0;
-	if (resolvedExportOptionsPlist && !fs.default.existsSync(resolvedExportOptionsPlist)) {
-		_hot_updater_cli_tools.p.log.error(`exportOptionsPlist doesn't exist in ${resolvedExportOptionsPlist}`);
-		process.exit(1);
-	}
-	return resolvedExportOptionsPlist;
-};
-const enrichNativeBuildIosScheme = async ({ scheme, hotUpdaterSchemeName }) => {
-	return {
-		platform: "ios",
-		installPods: false,
-		configuration: "Release",
-		destination: [],
-		simulator: false,
-		...scheme,
-		exportOptionsPlist: resolveExportOptionsPlist(scheme.exportOptionsPlist),
-		hotUpdaterSchemeName
-	};
-};
-//#endregion
 //#region src/utils/extractBuiltInBundle.ts
 /** The file React Native's Xcode build phase writes into the `.app`. */
 const BUILT_IN_BUNDLE = "main.jsbundle";
@@ -2926,16 +3772,125 @@ const archiveAppBundle = async ({ appPath, outputPath }) => {
 	]);
 };
 //#endregion
+//#region src/simulator.ts
+const simctl = async (args) => {
+	try {
+		return (await (0, execa.execa)("xcrun", ["simctl", ...args])).stdout;
+	} catch (error) {
+		const { code, stderr, shortMessage } = error;
+		if (code === "ENOENT") throw new Error("The iOS Simulator needs Xcode on a Mac.\nInstall Xcode, then run this again.");
+		throw new Error(stderr?.trim() || shortMessage || String(error));
+	}
+};
+/** Every simulator on this Mac, booted or not. */
+const listSimulators = async () => {
+	const { devices } = JSON.parse(await simctl([
+		"list",
+		"devices",
+		"--json"
+	]));
+	return Object.values(devices).flat().map(({ udid, name, state }) => ({
+		udid,
+		name,
+		state
+	}));
+};
+/**
+* The simulator to install on: `udid`, or else the only booted one, by its
+* UDID. `simctl`'s own `booted` alias picks one of several by itself.
+*/
+const selectSimulator = (simulators, udid) => {
+	if (udid !== void 0) {
+		const simulator = simulators.find((candidate) => candidate.udid === udid);
+		if (simulator === void 0) throw new Error(`No iOS Simulator has the UDID ${udid}.\nList them: xcrun simctl list devices`);
+		if (simulator.state !== "Booted") throw new Error(`${simulator.name} isn't booted.\nBoot it: xcrun simctl boot ${udid}`);
+		return simulator;
+	}
+	const booted = simulators.filter(({ state }) => state === "Booted");
+	const [only] = booted;
+	if (only === void 0) throw new Error("No iOS Simulator is booted.\nBoot one: open -a Simulator");
+	if (booted.length > 1) throw new Error([
+		`${booted.length} iOS Simulators are booted:`,
+		...booted.map(({ udid, name }) => `  ${udid}  ${name}`),
+		"Pick one with --simulator <udid>."
+	].join("\n"));
+	return only;
+};
+/**
+* Unpacks a simulator build's `.app.zip` into `outputPath`, and returns the
+* `.app` in it.
+*/
+const extractSimulatorApp = async ({ archivePath, outputPath }) => {
+	await extractAppBundle({
+		archivePath,
+		outputPath
+	});
+	const app = (await fs.default.promises.readdir(outputPath)).find((entry) => entry.endsWith(".app"));
+	if (app === void 0) throw new Error(`${path.default.basename(archivePath)} holds no .app.`);
+	return path.default.join(outputPath, app);
+};
+/** Installs a `.app` on a booted simulator, and opens it. */
+const installOnSimulator = async ({ udid, appPath, appId }) => {
+	await simctl([
+		"install",
+		udid,
+		appPath
+	]);
+	await simctl([
+		"launch",
+		udid,
+		appId
+	]);
+};
+//#endregion
+//#region src/utils/enrichNativeBuildIosScheme.ts
+const resolveExportOptionsPlist = (exportOptionsPlist) => {
+	const resolvedExportOptionsPlist = exportOptionsPlist ? path.default.isAbsolute(exportOptionsPlist) ? exportOptionsPlist : path.default.resolve((0, _hot_updater_cli_tools.getCwd)(), exportOptionsPlist) : void 0;
+	if (resolvedExportOptionsPlist && !fs.default.existsSync(resolvedExportOptionsPlist)) {
+		_hot_updater_cli_tools.p.log.error(`exportOptionsPlist doesn't exist in ${resolvedExportOptionsPlist}`);
+		process.exit(1);
+	}
+	return resolvedExportOptionsPlist;
+};
+const enrichNativeBuildIosScheme = async ({ scheme, hotUpdaterSchemeName }) => {
+	return {
+		platform: "ios",
+		installPods: false,
+		configuration: "Release",
+		destination: [],
+		simulator: false,
+		...scheme,
+		exportOptionsPlist: resolveExportOptionsPlist(scheme.exportOptionsPlist),
+		hotUpdaterSchemeName
+	};
+};
+//#endregion
 exports.ASC_INTEGRATIONS_URL = ASC_INTEGRATIONS_URL;
 exports.TestFlightBuildExistsError = TestFlightBuildExistsError;
+exports.addAscDevices = addAscDevices;
+exports.applyTestFlightGroup = applyTestFlightGroup;
 exports.archiveAppBundle = archiveAppBundle;
+exports.assertBuildIsInternalOnly = assertBuildIsInternalOnly;
+exports.assertIpaIsInternalOnly = assertIpaIsInternalOnly;
+exports.assertSandboxExportOptions = assertSandboxExportOptions;
 exports.assertTestFlightExportOptions = assertTestFlightExportOptions;
 exports.buildIos = buildIos;
+exports.distributeTestFlightBuild = distributeTestFlightBuild;
 exports.enrichNativeBuildIosScheme = enrichNativeBuildIosScheme;
 exports.extractAppBundle = extractAppBundle;
 exports.extractBuiltInBundle = extractBuiltInBundle;
+exports.extractSimulatorApp = extractSimulatorApp;
+exports.findInternalBetaGroup = findInternalBetaGroup;
 exports.findTestFlightBuild = findTestFlightBuild;
+exports.installOnSimulator = installOnSimulator;
 exports.installPodsIfNeeded = installPodsIfNeeded;
+exports.isVersionTrainClosed = isVersionTrainClosed;
 exports.issueAscApiKey = issueAscApiKey;
+exports.listAscDevices = listAscDevices;
+exports.listSimulators = listSimulators;
+exports.prepareSandboxArchive = prepareSandboxArchive;
+exports.readIpaHasExportComplianceKey = readIpaHasExportComplianceKey;
+exports.readTestFlightBuildStatus = readTestFlightBuildStatus;
 exports.resolveTestFlightUploadKey = resolveTestFlightUploadKey;
+exports.selectSimulator = selectSimulator;
 exports.uploadToTestFlight = uploadToTestFlight;