@hot-updater/apple-helper 1.2.0-rc.4 → 1.2.0-rc.6

package/dist/index.cjs

@@ -23,214 +23,555 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 //#endregion
 let node_crypto = require("node:crypto");
 node_crypto = __toESM(node_crypto, 1);
-let node_fs = require("node:fs");
-let node_fs_promises = require("node:fs/promises");
-node_fs_promises = __toESM(node_fs_promises, 1);
-let node_net = require("node:net");
-node_net = __toESM(node_net, 1);
-let node_os = require("node:os");
-node_os = __toESM(node_os, 1);
-let node_path = require("node:path");
-node_path = __toESM(node_path, 1);
+let node_timers_promises = require("node:timers/promises");
 let _hot_updater_cli_tools = require("@hot-updater/cli-tools");
-let execa = require("execa");
 let fs = require("fs");
 fs = __toESM(fs, 1);
 let path = require("path");
 path = __toESM(path, 1);
+let execa = require("execa");
+let node_fs = require("node:fs");
+let node_fs_promises = require("node:fs/promises");
+let node_os = require("node:os");
+let node_path = require("node:path");
 let child_process = require("child_process");
 let crypto = require("crypto");
 crypto = __toESM(crypto, 1);
 let os = require("os");
 os = __toESM(os, 1);
-//#region src/asc/ascCli.ts
+//#region src/asc/appleSrp.ts
 /**
-* The release of asc, the open-source App Store Connect CLI
-* (https://github.com/rorkai/App-Store-Connect-CLI, MIT), that signs in with
-* an Apple Account and issues App Store Connect API keys for Hot Updater. An
-* `asc` on PATH is used when it is at least this version.
+* Apple's sign-in proof: SRP-6a over the RFC 5054 2048-bit group with
+* SHA-256, the password stretched with PBKDF2, as Apple's sign-in page and
+* asc, the open-source App Store Connect CLI
+* (https://github.com/rorkai/App-Store-Connect-CLI, MIT), compute it.
 */
-const ASC_CLI_VERSION = "5.16.1";
+/** RFC 5054, Appendix A, the 2048-bit group. */
+const N = BigInt("0xAC6BDB41324A9A9BF166DE5E1389582FAF72B6651987EE07FC3192943DB56050A37329CBB4A099ED8193E0757767A13DD52312AB4B03310DCD7F48A9DA04FD50E8083969EDB767B0CF6095179A163AB3661A05FBD5FAAAE82918A9962F0B93B855F97993EC975EEAA80D740ADBF4FF747359D041D5C33EA71D281E446B14773BCA97B43A23FB801676BD207A436C6481F1D2B9078717461A5B9D32E688F87748544523B524B0D57D5EA77A2775D2ECFA032CFBDBF52FB3786160279004E57AE6AF874E7303CE53299CCC041C7BC308D82A5698F3A8D0C38271AE35F8E9DBFBB694B5C803D89F7AE435DE236D525F54759B65E372FCD68EF20FA7111F9E4AFF73");
+const G = 2n;
+/** The hex length every padded value has: N's byte length, twice. */
+const PADDED_HEX_LENGTH = 512;
+const modPow = (base, exponent, modulus) => {
+	let result = 1n;
+	let b = (base % modulus + modulus) % modulus;
+	let e = exponent;
+	while (e > 0n) {
+		if (e & 1n) result = result * b % modulus;
+		b = b * b % modulus;
+		e >>= 1n;
+	}
+	return result;
+};
+/** An even-length lowercase hex of `value`, as the proof hashes it. */
+const toHex = (value) => {
+	const hex = value.toString(16);
+	return hex.length % 2 === 1 ? `0${hex}` : hex;
+};
+const fromBytes = (bytes) => bytes.length === 0 ? 0n : BigInt(`0x${Buffer.from(bytes).toString("hex")}`);
+const sha256Hex = (hex) => node_crypto.default.createHash("sha256").update(Buffer.from(hex, "hex")).digest("hex");
+/** SHA-256 of each value left-padded to N's length, as a number mod N. */
+const paddedHash = (...values) => BigInt(`0x${sha256Hex(values.map((value) => value.padStart(PADDED_HEX_LENGTH, "0")).join(""))}`) % N;
+/** The password as the protocol Apple named feeds it to PBKDF2. */
+const preparePassword = (password, protocol) => {
+	const digest = node_crypto.default.createHash("sha256").update(password).digest();
+	if (protocol === "s2k") return digest;
+	if (protocol === "s2k_fo") return Buffer.from(digest.toString("hex"));
+	throw new Error(`Apple asked for the sign-in protocol ${protocol}.`);
+};
+/** A new SRP client; `secret` is the private value a, random unless set. */
+const createSrpClient = (secret = fromBytes(node_crypto.default.randomBytes(256))) => {
+	const A = modPow(G, secret, N);
+	const aHex = toHex(A);
+	return {
+		a: Buffer.from(aHex, "hex").toString("base64"),
+		proof: ({ accountName, password, protocol, iterations, salt, b }) => {
+			const saltBytes = Buffer.from(salt, "base64");
+			const saltHex = saltBytes.toString("hex");
+			const bHex = Buffer.from(b, "base64").toString("hex");
+			const B = BigInt(`0x${bHex || "0"}`);
+			if (B % N === 0n) throw new Error("Apple answered an invalid SRP value.");
+			const derived = node_crypto.default.pbkdf2Sync(preparePassword(password, protocol), saltBytes, iterations, 32, "sha256");
+			const x = BigInt(`0x${sha256Hex(saltHex + sha256Hex(`3a${derived.toString("hex")}`))}`);
+			const k = paddedHash(toHex(N), toHex(G));
+			const u = paddedHash(aHex, bHex);
+			if (u === 0n) throw new Error("Apple answered an invalid SRP value.");
+			const S = modPow(B - k * modPow(G, x, N) % N, secret + u * x, N);
+			const K = sha256Hex(toHex(S));
+			const m1 = sha256Hex(toHex(paddedHash(toHex(N)) ^ paddedHash(toHex(G))) + node_crypto.default.createHash("sha256").update(accountName).digest("hex") + saltHex + aHex + bHex + K);
+			const m2 = toHex(BigInt(`0x${sha256Hex(aHex + m1 + K)}`));
+			return {
+				m1: Buffer.from(m1, "hex").toString("base64"),
+				m2: Buffer.from(m2, "hex").toString("base64")
+			};
+		}
+	};
+};
+const hasLeadingZeroBits = (digest, bits) => {
+	const full = Math.floor(bits / 8);
+	for (let index = 0; index < full; index++) if (digest[index] !== 0) return false;
+	const rest = bits % 8;
+	return rest === 0 || (digest[full] & 255 << 8 - rest & 255) === 0;
+};
 /**
-* The SHA-256 of each macOS binary of the release, from its
-* asc_5.16.1_checksums.txt. Pinned here, so a download is trusted only when
-* it is the exact binary this version of Hot Updater was written against.
+* The hashcash stamp Apple's sign-in asks for in `X-Apple-HC`: the first
+* `1:<bits>:<date>:<challenge>::<counter>` whose SHA-1 starts with `bits`
+* zero bits.
 */
-const ASC_CLI_SHA256 = {
-	arm64: "85a848ef33fe3490adc4f0348af30b7bbf95209a258dac06c735318f62495707",
-	x64: "5a978732e0c2f2b673da601568c489dfaa232ae32c93dcfa63b95f0b892a2580"
-};
-const ASC_RELEASE_ASSET = {
-	arm64: `asc_${ASC_CLI_VERSION}_macOS_arm64`,
-	x64: `asc_${ASC_CLI_VERSION}_macOS_amd64`
-};
-const ASC_RELEASE_URL = `https://github.com/rorkai/App-Store-Connect-CLI/releases/download/${ASC_CLI_VERSION}`;
-const INSTALL_HINT = `Install asc ${ASC_CLI_VERSION} or later with brew install asc, then run this again.`;
-/** asc could not be found, downloaded, or verified. */
-var AscCliUnavailableError = class extends Error {
+const makeHashcash = (bits, challenge, now = /* @__PURE__ */ new Date()) => {
+	const date = now.toISOString().replace(/\.\d+Z$/u, "").replaceAll(/[-:T]/gu, "");
+	for (let counter = 0;; counter++) {
+		const stamp = `1:${bits}:${date}:${challenge}::${counter}`;
+		const digest = node_crypto.default.createHash("sha1").update(stamp).digest();
+		if (hasLeadingZeroBits(digest, bits)) return stamp;
+	}
+};
+//#endregion
+//#region src/asc/appleSignIn.ts
+/**
+* Signing in to App Store Connect with an Apple Account, as its web page
+* does: Apple's SRP sign-in at idmsa.apple.com, its two-factor check, then
+* App Store Connect's session. The endpoints and their headers follow asc,
+* the open-source App Store Connect CLI
+* (https://github.com/rorkai/App-Store-Connect-CLI, MIT), 5.16.1, whose
+* internal/web/auth.go has signed in this way against Apple.
+*/
+const AUTH_URL = "https://idmsa.apple.com/appleauth/auth";
+const ASC_URL = "https://appstoreconnect.apple.com";
+const SESSION_URL = `${ASC_URL}/olympus/v1/session`;
+/**
+* The public widget key App Store Connect's sign-in page ships, used when
+* neither place Apple publishes the current one answers. Not a credential.
+*/
+const ASC_WIDGET_KEY = "e0b80c3bf78523bfe80974d320935bfa30add02e1bff88ec2166c6bd5a706c42";
+/** Signing in, or a request in the signed-in session, failed. */
+var AppleSignInError = class extends Error {
+	status;
+	/** The response body, for messages that depend on what Apple said. */
+	body;
 	constructor(message, options) {
-		super(message, options);
-		this.name = "AscCliUnavailableError";
+		super(message, options?.cause ? { cause: options.cause } : void 0);
+		this.name = "AppleSignInError";
+		this.status = options?.status;
+		this.body = options?.body;
 	}
 };
-const parseVersion = (output) => {
-	const match = /(\d+)\.(\d+)\.(\d+)/u.exec(output);
-	return match ? match.slice(1, 4).map(Number) : void 0;
+/**
+* A cookie jar for the sign-in's requests, as a browser keeps one: `fetch`
+* keeps none, and Apple's session is its cookies.
+*/
+const createCookieJar = () => {
+	let cookies = [];
+	const live = () => {
+		const now = Date.now();
+		cookies = cookies.filter((cookie) => cookie.expires === void 0 || cookie.expires > now);
+		return cookies;
+	};
+	return {
+		store(url, response) {
+			for (const header of response.headers.getSetCookie()) {
+				const [pair = "", ...attributes] = header.split(";");
+				const separator = pair.indexOf("=");
+				if (separator <= 0) continue;
+				const name = pair.slice(0, separator).trim();
+				const value = pair.slice(separator + 1).trim();
+				let domain = url.hostname;
+				let hostOnly = true;
+				let path = "/";
+				let expires;
+				let maxAge;
+				for (const attribute of attributes) {
+					const index = attribute.indexOf("=");
+					const key = (index === -1 ? attribute : attribute.slice(0, index)).trim().toLowerCase();
+					const raw = index === -1 ? "" : attribute.slice(index + 1).trim();
+					if (key === "domain" && raw) {
+						const candidate = raw.replace(/^\./u, "").toLowerCase();
+						if (url.hostname !== candidate && !url.hostname.endsWith(`.${candidate}`)) {
+							domain = "";
+							break;
+						}
+						domain = candidate;
+						hostOnly = false;
+					} else if (key === "path" && raw.startsWith("/")) path = raw;
+					else if (key === "expires") {
+						const time = Date.parse(raw);
+						if (!Number.isNaN(time)) expires = time;
+					} else if (key === "max-age" && /^-?\d+$/u.test(raw)) maxAge = Number(raw);
+				}
+				if (!domain) continue;
+				if (maxAge !== void 0) expires = Date.now() + maxAge * 1e3;
+				cookies = cookies.filter((cookie) => !(cookie.name === name && cookie.domain === domain && cookie.path === path));
+				if (expires === void 0 || expires > Date.now()) cookies.push({
+					name,
+					value,
+					domain,
+					hostOnly,
+					path,
+					expires
+				});
+			}
+		},
+		header(url) {
+			const matching = live().filter((cookie) => (cookie.hostOnly ? url.hostname === cookie.domain : url.hostname === cookie.domain || url.hostname.endsWith(`.${cookie.domain}`)) && (url.pathname === cookie.path || url.pathname.startsWith(cookie.path.endsWith("/") ? cookie.path : `${cookie.path}/`)));
+			return matching.length === 0 ? void 0 : matching.map((cookie) => `${cookie.name}=${cookie.value}`).join("; ");
+		},
+		clear() {
+			cookies = [];
+		}
+	};
+};
+const REDIRECTS = /* @__PURE__ */ new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+/** `fetch` with the jar's cookies, following redirects itself to keep them. */
+const createClient = (fetch) => {
+	const jar = createCookieJar();
+	const request = async (url, init = {}) => {
+		let current = new URL(url);
+		let method = init.method ?? "GET";
+		let body = init.body;
+		for (let hop = 0; hop < 10; hop++) {
+			const headers = new Headers(init.headers);
+			const cookie = jar.header(current);
+			if (cookie) headers.set("Cookie", cookie);
+			const response = await fetch(current, {
+				method,
+				headers,
+				...body === void 0 ? {} : { body },
+				redirect: "manual"
+			});
+			jar.store(current, response);
+			const location = response.headers.get("location");
+			if (!REDIRECTS.has(response.status) || !location) return response;
+			await response.text();
+			current = new URL(location, current);
+			if (response.status === 303 || response.status !== 307 && response.status !== 308 && method === "POST") {
+				method = "GET";
+				body = void 0;
+			}
+		}
+		throw new AppleSignInError(`${url} redirected too many times.`);
+	};
+	return {
+		request,
+		clear: jar.clear
+	};
 };
-const isAtLeast = (version, minimum) => {
-	for (let index = 0; index < minimum.length; index++) {
-		const part = version[index] ?? 0;
-		if (part !== minimum[index]) return part > minimum[index];
+const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const text$1 = (value) => typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+const parseJson = (body) => {
+	try {
+		return JSON.parse(body);
+	} catch {
+		return;
 	}
-	return true;
 };
-const sha256Of = (file) => new Promise((resolve, reject) => {
-	const hash = node_crypto.default.createHash("sha256");
-	(0, node_fs.createReadStream)(file).on("data", (chunk) => hash.update(chunk)).on("error", reject).on("end", () => resolve(hash.digest("hex")));
+/** What Apple's sign-in said went wrong, from its `serviceErrors`. */
+const serviceErrors = (body) => {
+	const parsed = parseJson(body);
+	const errors = isRecord$1(parsed) && Array.isArray(parsed.serviceErrors) ? parsed.serviceErrors.filter(isRecord$1) : [];
+	return {
+		codes: errors.map((error) => text$1(error.code)).filter(Boolean),
+		message: errors.map((error) => text$1(error.message)).find(Boolean)
+	};
+};
+const failure = (step, response, body) => new AppleSignInError(`${step} failed (HTTP ${response.status}).${serviceErrors(body).message ? `\n${serviceErrors(body).message}` : ""}`, {
+	status: response.status,
+	body
 });
-/** Where a downloaded asc is kept, per user, so every project shares it. */
-const defaultAscCacheDir = () => node_path.default.join(node_os.default.homedir(), "Library", "Caches", "hot-updater");
 /**
-* Finds asc: the `asc` on PATH when it is at least `ASC_CLI_VERSION`, else
-* the pinned release in `cacheDir`, downloaded from GitHub on first use and
-* verified against its pinned SHA-256 each time it is used. Only macOS has
-* one: TestFlight builds need Xcode.
+* The widget key Apple's sign-in wants: from the sign-out redirect App Store
+* Connect answers without cookies, else its config, else the one its page
+* ships.
 */
-const findAscCli = async ({ cacheDir = defaultAscCacheDir(), fetch = globalThis.fetch, platform = process.platform, arch = process.arch, pathCommand = "asc" } = {}) => {
-	if (platform !== "darwin") throw new AscCliUnavailableError("Signing in to issue an App Store Connect API key needs macOS.");
-	const minimum = parseVersion(ASC_CLI_VERSION);
-	const onPath = await (0, execa.execa)(pathCommand, ["--version"], {
-		reject: false,
-		env: { ASC_TELEMETRY_DISABLED: "1" },
-		timeout: 15e3
+const findWidgetKey = async (fetch, client) => {
+	const signOut = await fetch(`${ASC_URL}/logout`, {
+		method: "HEAD",
+		redirect: "manual"
 	}).catch(() => void 0);
-	const pathVersion = onPath?.exitCode === 0 ? parseVersion(onPath.stdout) : void 0;
-	if (pathVersion && isAtLeast(pathVersion, minimum)) return {
-		path: pathCommand,
-		version: pathVersion.join("."),
-		source: "path"
+	const location = signOut?.headers.get("location");
+	if (signOut && REDIRECTS.has(signOut.status) && location) {
+		const url = (() => {
+			try {
+				return new URL(location);
+			} catch {
+				return;
+			}
+		})();
+		const keys = url?.searchParams.getAll("widgetKey") ?? [];
+		if (url?.protocol === "https:" && url.hostname === "idmsa.apple.com" && url.pathname === "/appleauth/signout" && keys.length === 1 && keys[0].trim()) return keys[0].trim();
+	}
+	const config = await client.request(`${ASC_URL}/olympus/v1/app/config?hostname=itunesconnect.apple.com`);
+	const body = await config.text();
+	if (config.status === 404) return ASC_WIDGET_KEY;
+	const parsed = parseJson(body);
+	const key = isRecord$1(parsed) ? text$1(parsed.authServiceKey) ?? text$1(parsed.serviceKey) : void 0;
+	if (!config.ok || !key) throw new AppleSignInError(`Couldn't load Apple's sign-in configuration (HTTP ${config.status}).`, { status: config.status });
+	return key;
+};
+const hashcash = async (client, widgetKey) => {
+	const response = await client.request(`${AUTH_URL}/signin?widgetKey=${encodeURIComponent(widgetKey)}`, { headers: { Accept: "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" } });
+	await response.text();
+	if (!response.ok) throw new AppleSignInError(`Loading Apple's sign-in page failed (HTTP ${response.status}).`, { status: response.status });
+	const bits = response.headers.get("x-apple-hc-bits")?.trim();
+	const challenge = response.headers.get("x-apple-hc-challenge")?.trim();
+	if (!bits || !challenge) return void 0;
+	if (!/^\d+$/u.test(bits) || Number(bits) > 32) throw new AppleSignInError(`Apple asked for a hashcash of ${bits} bits.`);
+	return makeHashcash(Number(bits), challenge);
+};
+const pendingHeaders = (pending) => ({
+	"X-Apple-ID-Session-Id": pending.sessionId,
+	"X-Apple-Widget-Key": pending.widgetKey,
+	scnt: pending.scnt,
+	Accept: "application/json"
+});
+/** Apple rotates `scnt` and the session ID; each request sends the latest. */
+const track = (pending, response) => {
+	const scnt = response.headers.get("scnt")?.trim();
+	const sessionId = response.headers.get("x-apple-id-session-id")?.trim();
+	if (scnt) pending.scnt = scnt;
+	if (sessionId) pending.sessionId = sessionId;
+};
+const CANCELLED = "Signing in was cancelled.";
+const twoFactor = async (client, pending, prompts) => {
+	const send = async (url, method, payload) => {
+		const response = await client.request(url, {
+			method,
+			headers: {
+				...pendingHeaders(pending),
+				...payload === void 0 ? {} : { "Content-Type": "application/json" }
+			},
+			...payload === void 0 ? {} : { body: JSON.stringify(payload) }
+		});
+		track(pending, response);
+		return {
+			response,
+			body: await response.text()
+		};
 	};
-	const asset = ASC_RELEASE_ASSET[arch];
-	const expected = ASC_CLI_SHA256[arch];
-	if (!asset || !expected) throw new AscCliUnavailableError(`asc publishes no macOS binary for ${arch}.\n${INSTALL_HINT}`);
-	const binary = node_path.default.join(cacheDir, "asc", ASC_CLI_VERSION, asset);
-	if (await sha256Of(binary).catch(() => void 0) === expected) return {
-		path: binary,
-		version: ASC_CLI_VERSION,
-		source: "cache"
+	const options = await send(AUTH_URL, "GET");
+	if (!options.response.ok) throw failure("Loading the two-factor options", options.response, options.body);
+	const parsed = parseJson(options.body);
+	const phone = (isRecord$1(parsed) && Array.isArray(parsed.trustedPhoneNumbers) ? parsed.trustedPhoneNumbers.filter(isRecord$1) : []).filter((phone) => typeof phone.id === "number")[0];
+	const noDevices = isRecord$1(parsed) && parsed.noTrustedDevices === true;
+	if (noDevices && !phone) throw new AppleSignInError("The Apple Account has no trusted device or phone number for two-factor codes.");
+	const phoneMode = text$1(phone?.pushMode) ?? "sms";
+	const destination = text$1(phone?.numberWithDialCode);
+	const securityCode = isRecord$1(parsed) && isRecord$1(parsed.securityCode) ? parsed.securityCode.length : void 0;
+	const length = typeof securityCode === "number" && securityCode > 0 ? securityCode : 6;
+	const textCode = async () => {
+		const requested = await send(`${AUTH_URL}/verify/phone`, "PUT", {
+			phoneNumber: { id: phone.id },
+			mode: phoneMode
+		});
+		if (!requested.response.ok) throw failure("Texting a two-factor code", requested.response, requested.body);
 	};
-	await node_fs_promises.default.mkdir(node_path.default.dirname(binary), { recursive: true });
-	const partial = `${binary}.${process.pid}.download`;
-	try {
-		let response;
-		try {
-			response = await fetch(`${ASC_RELEASE_URL}/${asset}`, { redirect: "follow" });
-		} catch (error) {
-			throw new AscCliUnavailableError(`Couldn't download asc ${ASC_CLI_VERSION} from GitHub.\n${error instanceof Error ? error.message : String(error)}\n${INSTALL_HINT}`, { cause: error });
+	const verify = async (via, code) => {
+		const verified = via === "device" ? await send(`${AUTH_URL}/verify/trusteddevice/securitycode`, "POST", { securityCode: { code } }) : await send(`${AUTH_URL}/verify/phone/securitycode`, "POST", {
+			securityCode: { code },
+			phoneNumber: { id: phone.id },
+			mode: phoneMode
+		});
+		if (verified.response.ok) return true;
+		if ([
+			400,
+			401,
+			403
+		].includes(verified.response.status)) return false;
+		throw failure("Checking the two-factor code", verified.response, verified.body);
+	};
+	const ask = async (via, afterWrongCode) => {
+		const code = await prompts.twoFactorCode({
+			via,
+			destination,
+			textsOnWrongCode: via === "device" && phone !== void 0,
+			afterWrongCode,
+			length
+		});
+		if (code === void 0) throw new AppleSignInError(CANCELLED);
+		return code;
+	};
+	let accepted;
+	if (noDevices) {
+		await textCode();
+		accepted = await verify("sms", await ask("sms", false));
+	} else {
+		accepted = await verify("device", await ask("device", false));
+		if (!accepted && phone) {
+			await textCode();
+			accepted = await verify("sms", await ask("sms", true));
 		}
-		if (!response.ok || !response.body) throw new AscCliUnavailableError(`Couldn't download asc ${ASC_CLI_VERSION} from GitHub (HTTP ${response.status}).\n${INSTALL_HINT}`);
-		await node_fs_promises.default.writeFile(partial, Buffer.from(await response.arrayBuffer()), { mode: 448 });
-		const actual = await sha256Of(partial);
-		if (actual !== expected) throw new AscCliUnavailableError([
-			`The downloaded asc ${ASC_CLI_VERSION} failed its SHA-256 check; it was deleted.`,
-			`Expected ${expected}`,
-			`Got      ${actual}`,
-			INSTALL_HINT
-		].join("\n"));
-		await node_fs_promises.default.chmod(partial, 493);
-		await node_fs_promises.default.rename(partial, binary);
-	} finally {
-		await node_fs_promises.default.rm(partial, { force: true });
 	}
+	if (!accepted) throw new AppleSignInError("Apple rejected the verification code.");
+	const trust = await send(`${AUTH_URL}/2sv/trust`, "GET");
+	if (!trust.response.ok) throw failure("Finishing the two-factor check", trust.response, trust.body);
+};
+const parseProvider = (value) => {
+	if (!isRecord$1(value) || typeof value.providerId !== "number") return void 0;
+	const publicProviderId = text$1(value.publicProviderId);
+	if (!publicProviderId) return void 0;
 	return {
-		path: binary,
-		version: ASC_CLI_VERSION,
-		source: "download"
+		providerId: value.providerId,
+		publicProviderId,
+		name: text$1(value.name)
 	};
 };
-//#endregion
-//#region src/asc/ascCliKeyIssuer.ts
-/** An asc command failed; its message is asc's own, which it printed too. */
-var AscCommandError = class extends Error {
-	exitCode;
-	constructor(message, exitCode, options) {
-		super(message, options);
-		this.name = "AscCommandError";
-		this.exitCode = exitCode;
-	}
+const readSession = async (client) => {
+	const response = await client.request(SESSION_URL, { headers: { Accept: "application/json" } });
+	const body = await response.text();
+	if (!response.ok) throw new AppleSignInError(response.status === 401 || response.status === 403 ? "App Store Connect didn't accept the sign-in. Check that the Apple Account is in an Apple Developer team." : `Loading the App Store Connect session failed (HTTP ${response.status}).`, {
+		status: response.status,
+		body
+	});
+	const parsed = parseJson(body);
+	const provider = isRecord$1(parsed) ? parseProvider(parsed.provider) : void 0;
+	if (!isRecord$1(parsed) || !provider) throw new AppleSignInError("App Store Connect's session names no team for the Apple Account.");
+	const providers = (Array.isArray(parsed.availableProviders) ? parsed.availableProviders : []).map(parseProvider).filter((value) => value !== void 0);
+	return {
+		provider,
+		providers: providers.some((value) => value.providerId === provider.providerId) ? providers : [provider, ...providers]
+	};
 };
-const TERMINATION_SIGNALS$3 = [
-	"SIGHUP",
-	"SIGINT",
-	"SIGTERM"
-];
 /**
-* A 0700 directory holding asc's whole state for one sign-in (its web
-* session, config, and the downloaded `.p8`), removed by `dispose`, on
-* `exit`, or on a termination signal, so nothing outlives the sign-in.
+* Signs in to App Store Connect with `appleId` and `password`, asking
+* `prompts` for the two-factor code. The session lives only in the returned
+* object's memory.
 */
-const createWorkDirectory = async () => {
-	const root = await node_fs_promises.default.mkdtemp(node_path.default.join(node_os.default.tmpdir(), "hot-updater-asc-"));
-	await node_fs_promises.default.chmod(root, 448);
-	const remove = () => (0, node_fs.rmSync)(root, {
-		force: true,
-		recursive: true
-	});
-	const onSignal = (signal) => {
-		stop();
-		remove();
-		if (process.listenerCount(signal) === 0) process.kill(process.pid, signal);
-	};
-	const stop = () => {
-		process.off("exit", remove);
-		for (const signal of TERMINATION_SIGNALS$3) process.off(signal, onSignal);
-	};
-	process.on("exit", remove);
-	for (const signal of TERMINATION_SIGNALS$3) process.on(signal, onSignal);
-	for (const directory of [
-		"home",
-		"session",
-		"keys"
-	]) await node_fs_promises.default.mkdir(node_path.default.join(root, directory), { mode: 448 });
-	let disposal;
-	return {
-		root,
-		dispose: () => {
-			disposal ??= (async () => {
-				stop();
-				await node_fs_promises.default.rm(root, {
-					force: true,
-					recursive: true
-				});
+const signInToAppStoreConnect = async ({ appleId, password, prompts, fetch = globalThis.fetch }) => {
+	const client = createClient(fetch);
+	try {
+		const widgetKey = await findWidgetKey(fetch, client);
+		const json = {
+			"Content-Type": "application/json",
+			"X-Apple-Widget-Key": widgetKey,
+			"X-Requested-With": "XMLHttpRequest",
+			Accept: "application/json, text/javascript"
+		};
+		const srp = createSrpClient();
+		const init = await client.request(`${AUTH_URL}/signin/init`, {
+			method: "POST",
+			headers: json,
+			body: JSON.stringify({
+				accountName: appleId,
+				protocols: ["s2k", "s2k_fo"],
+				a: srp.a
+			})
+		});
+		const initBody = await init.text();
+		if (!init.ok) throw failure("Starting the sign-in", init, initBody);
+		const started = parseJson(initBody);
+		if (!isRecord$1(started) || typeof started.iteration !== "number" || !text$1(started.salt) || !text$1(started.b) || !text$1(started.protocol)) throw new AppleSignInError("Apple's sign-in answered no SRP challenge.");
+		const { m1, m2 } = srp.proof({
+			accountName: appleId,
+			password,
+			protocol: text$1(started.protocol),
+			iterations: started.iteration,
+			salt: text$1(started.salt),
+			b: text$1(started.b)
+		});
+		const stamp = await hashcash(client, widgetKey);
+		const complete = await client.request(`${AUTH_URL}/signin/complete?isRememberMeEnabled=false`, {
+			method: "POST",
+			headers: {
+				...json,
+				...stamp ? { "X-Apple-HC": stamp } : {}
+			},
+			body: JSON.stringify({
+				accountName: appleId,
+				rememberMe: false,
+				m1,
+				m2,
+				c: started.c
+			})
+		});
+		const completeBody = await complete.text();
+		if (complete.status === 409) {
+			const sessionId = complete.headers.get("x-apple-id-session-id")?.trim();
+			const scnt = complete.headers.get("scnt")?.trim();
+			if (!sessionId || !scnt) throw new AppleSignInError("Apple asked for a two-factor code without a sign-in session.");
+			await twoFactor(client, {
+				widgetKey,
+				sessionId,
+				scnt
+			}, prompts);
+		} else if (!complete.ok) {
+			const { codes } = serviceErrors(completeBody);
+			const authType = (() => {
+				const parsed = parseJson(completeBody);
+				return isRecord$1(parsed) ? text$1(parsed.authType) : void 0;
 			})();
-			return disposal;
+			if (complete.status === 401 && codes.includes("-20101")) throw new AppleSignInError("Apple rejected the email or password.", { status: 401 });
+			if (complete.status === 412 && authType && [
+				"sa",
+				"hsa",
+				"non-sa",
+				"hsa2"
+			].includes(authType)) throw new AppleSignInError("The Apple Account has a pending prompt. Sign in at https://appstoreconnect.apple.com once, then run this again.", { status: 412 });
+			throw failure("Signing in", complete, completeBody);
 		}
-	};
+		let { provider, providers } = await readSession(client);
+		return {
+			appleId,
+			get provider() {
+				return provider;
+			},
+			get providers() {
+				return providers;
+			},
+			selectProvider: async (publicProviderId) => {
+				if (provider.publicProviderId === publicProviderId) return provider;
+				const selected = providers.find((value) => value.publicProviderId === publicProviderId);
+				if (!selected) throw new AppleSignInError(`The Apple Account is in no team ${publicProviderId}.`);
+				const response = await client.request(SESSION_URL, {
+					method: "POST",
+					headers: {
+						"Content-Type": "application/json",
+						"X-Requested-With": "olympus-ui"
+					},
+					body: JSON.stringify({ provider: { providerId: selected.providerId } })
+				});
+				const body = await response.text();
+				if (!response.ok) throw new AppleSignInError(`Switching to the team ${selected.name ?? publicProviderId} failed (HTTP ${response.status}).`, {
+					status: response.status,
+					body
+				});
+				({provider, providers} = await readSession(client));
+				if (provider.providerId !== selected.providerId) throw new AppleSignInError(`App Store Connect stayed in the team ${provider.name ?? provider.publicProviderId}.`);
+				return provider;
+			},
+			request: client.request,
+			clear: client.clear
+		};
+	} catch (error) {
+		client.clear();
+		throw error;
+	}
 };
+//#endregion
+//#region src/asc/ascKeyIssuer.ts
+const IRIS_URL = "https://appstoreconnect.apple.com/iris/v1";
 /**
-* asc's environment: the caller's, without any `ASC_*` variable (such as a
-* saved password, a 2FA code command, or another API key), and with every
-* file asc keeps (home, config, web session) in `root`. Passwords are never
-* stored, the keychain is bypassed, and telemetry is off.
+* The headers App Store Connect's Integrations page sends its API with. A
+* function: `ascApiKey` imports this module, so its constants aren't set
+* yet when this module loads.
 */
-const ascEnvironment = (root, base = process.env) => {
-	const env = {};
-	for (const [name, value] of Object.entries(base)) if (!name.startsWith("ASC_") && name !== "DO_NOT_TRACK") env[name] = value;
-	return {
-		...env,
-		HOME: node_path.default.join(root, "home"),
-		XDG_CONFIG_HOME: node_path.default.join(root, "home", ".config"),
-		XDG_CACHE_HOME: node_path.default.join(root, "home", ".cache"),
-		ASC_CONFIG_PATH: node_path.default.join(root, "home", "config.json"),
-		ASC_WEB_SESSION_CACHE_DIR: node_path.default.join(root, "session"),
-		ASC_WEB_SESSION_CACHE_BACKEND: "file",
-		ASC_WEB_DONT_STORE_PASSWORD: "1",
-		ASC_BYPASS_KEYCHAIN: "1",
-		ASC_TELEMETRY_DISABLED: "1",
-		ASC_SPINNER_DISABLED: "1"
-	};
-};
+const irisHeaders = () => ({
+	Accept: "application/vnd.api+json, application/json, text/csv",
+	"Content-Type": "application/json",
+	"X-CSRF-ITC": "[asc-ui]",
+	Origin: "https://appstoreconnect.apple.com",
+	Referer: ASC_INTEGRATIONS_URL
+});
 const answer = (value) => _hot_updater_cli_tools.p.isCancel(value) ? void 0 : value;
+/** One line: where the code went, and where a wrong one sends the next. */
+const twoFactorMessage = (request) => {
+	const phone = request.destination ?? "your trusted phone";
+	if (request.via === "sms") return `${request.afterWrongCode ? "Wrong code. " : ""}Code texted to ${phone}`;
+	return request.textsOnWrongCode ? `Code on your Apple device (wrong code texts ${phone})` : "Code on your Apple device";
+};
 /** Hot Updater's own prompts, so the sign-in looks like the rest of the CLI. */
 const cliPrompts = {
 	password: async (appleId) => answer(await _hot_updater_cli_tools.p.password({
@@ -238,65 +579,53 @@ const cliPrompts = {
 		mask: "•",
 		validate: (value) => value ? void 0 : "Enter the password."
 	})),
-	twoFactorCode: async (attempt) => answer(await _hot_updater_cli_tools.p.text({
-		message: attempt === 1 ? "Two-factor code (no trusted device? enter a wrong one for an SMS)" : "Verification code Apple sent to your phone",
-		validate: (value) => /^\d{6}$/u.test(value?.trim() ?? "") ? void 0 : "Enter the 6-digit code."
+	twoFactorCode: async (request) => answer(await _hot_updater_cli_tools.p.text({
+		message: twoFactorMessage(request),
+		validate: (value) => new RegExp(`^\\d{${request.length}}$`, "u").test(value?.trim() ?? "") ? void 0 : `Enter the ${request.length}-digit code.`
 	}))?.trim()
 };
-/** `value` as one word for `sh`. */
-const shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
-/**
-* A two-factor code command for asc that asks `prompts` in this process:
-* asc runs it when Apple wants a code, and it prints what the developer
-* typed, which it gets over a socket in the 0700 work directory. A
-* cancelled prompt makes it print nothing and fail, which stops the sign-in.
-*/
-const listenForTwoFactorCodes = async (root, prompts) => {
-	const socketPath = node_path.default.join(root, "2fa.sock");
-	const scriptPath = node_path.default.join(root, "two-factor-code.cjs");
-	await node_fs_promises.default.writeFile(scriptPath, [
-		"const socket = require(\"node:net\").connect(" + JSON.stringify(socketPath) + ");",
-		"let code = \"\";",
-		"socket.on(\"data\", (chunk) => { code += chunk; });",
-		"socket.on(\"end\", () => {",
-		"  code = code.trim();",
-		"  if (!code) process.exit(1);",
-		"  process.stdout.write(code + \"\\n\");",
-		"});",
-		"socket.on(\"error\", () => process.exit(1));",
-		""
-	].join("\n"), { mode: 384 });
-	let attempts = 0;
-	let cancelled = false;
-	const server = node_net.default.createServer((socket) => {
-		attempts += 1;
-		prompts.twoFactorCode(attempts).then((code) => {
-			if (!code) cancelled = true;
-			socket.end(code ? `${code}\n` : "");
-		}, () => {
-			cancelled = true;
-			socket.destroy();
-		});
-	});
-	await new Promise((resolve, reject) => {
-		server.once("error", reject);
-		server.listen(socketPath, resolve);
-	});
-	return {
-		command: `${shellQuote(process.execPath)} ${shellQuote(scriptPath)}`,
-		cancelled: () => cancelled,
-		close: () => new Promise((resolve) => server.close(() => resolve()))
-	};
-};
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const text = (value) => typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
-/** The last line of asc's error output, which names what failed. */
-const lastLine = (stderr) => stderr.split("\n").map((line) => line.trim()).filter(Boolean).at(-1);
-/** What to do about a key asc could not create, by what App Store Connect said. */
-const createFailureHint = (stderr) => {
-	if (/agreement/iu.test(stderr)) return "The Account Holder must accept the new Apple Developer Program License\nAgreement at https://developer.apple.com/account, then run this again.";
-	if (/limit|maximum/iu.test(stderr)) return `The team has the most API keys App Store Connect allows. Revoke one at:\n${ASC_INTEGRATIONS_URL}`;
-	if (/account holder|admin|permission|forbidden|not allowed|403/iu.test(stderr)) return "Creating an API key needs the Account Holder or Admin role in the team.";
+const toTeam = (appleId, provider) => ({
+	appleId,
+	teamId: provider.publicProviderId,
+	...provider.name ? { name: provider.name } : {}
+});
+/** What App Store Connect's API said went wrong, from its JSON:API errors. */
+const irisDetail = (body) => {
+	try {
+		const parsed = JSON.parse(body);
+		if (!isRecord(parsed) || !Array.isArray(parsed.errors)) return void 0;
+		return parsed.errors.filter(isRecord).map((error) => text(error.detail) ?? text(error.title)).find(Boolean);
+	} catch {
+		return;
+	}
+};
+/** What to do about a key App Store Connect would not create. */
+const createFailureHint = (status, body) => {
+	if (/agreement/iu.test(body)) return "The Account Holder must accept the new Apple Developer Program License\nAgreement at https://developer.apple.com/account, then run this again.";
+	if (/limit|maximum/iu.test(body)) return `The team has the most API keys App Store Connect allows. Revoke one at:\n${ASC_INTEGRATIONS_URL}`;
+	if (status === 403 || /account holder|admin|permission/iu.test(body)) return "Creating an API key needs the Account Holder or Admin role in the team.";
+};
+const irisRequest = async (session, step, method, path, payload) => {
+	const response = await session.request(`${IRIS_URL}${path}`, {
+		method,
+		headers: irisHeaders(),
+		...payload === void 0 ? {} : { body: JSON.stringify(payload) }
+	});
+	const body = await response.text();
+	if (!response.ok) {
+		const detail = irisDetail(body);
+		throw new AppleSignInError(`${step} failed (HTTP ${response.status}).${detail ? `\n${detail}` : ""}`, {
+			status: response.status,
+			body
+		});
+	}
+	try {
+		const parsed = JSON.parse(body);
+		if (isRecord(parsed) && isRecord(parsed.data)) return parsed.data;
+	} catch {}
+	throw new AppleSignInError(`${step} answered no API key.`, { status: response.status });
 };
 /** A P-256 private key, as App Store Connect issues one, or a thrown error. */
 const assertP8 = (p8) => {
@@ -304,144 +633,108 @@ const assertP8 = (p8) => {
 	try {
 		key = node_crypto.default.createPrivateKey(p8);
 	} catch {
-		throw new Error("asc saved a .p8 that is not a private key.");
+		throw new Error("App Store Connect sent a .p8 that is not a private key.");
 	}
-	if (key.asymmetricKeyType !== "ec") throw new Error("asc saved a .p8 that is not an EC private key.");
+	if (key.asymmetricKeyType !== "ec" || key.asymmetricKeyDetails?.namedCurve !== "prime256v1") throw new Error("App Store Connect sent a .p8 that is not a P-256 private key.");
+};
+/** The one-time `.p8`; a key App Store Connect hasn't settled yet is retried. */
+const downloadP8 = async (session, keyId, wait) => {
+	for (let attempt = 1;; attempt++) try {
+		const data = await irisRequest(session, "Downloading the key's .p8", "GET", `/apiKeys/${encodeURIComponent(keyId)}?${new URLSearchParams({ "fields[apiKeys]": "privateKey" })}`);
+		const encoded = isRecord(data.attributes) ? text(data.attributes.privateKey) : void 0;
+		if (text(data.id) !== keyId || !encoded) throw new Error("App Store Connect sent no .p8 for the key.");
+		return Buffer.from(encoded, "base64").toString("utf-8").trim();
+	} catch (error) {
+		if (!(error instanceof AppleSignInError && error.status !== void 0 && (error.status === 404 || error.status === 409 || error.status === 429 || error.status >= 500)) || attempt === 3) throw error;
+		await wait(attempt * 1e3);
+	}
+};
+const issuerOf = (data) => {
+	const attributes = isRecord(data.attributes) ? data.attributes : {};
+	const relationships = isRecord(data.relationships) ? data.relationships : {};
+	const related = isRecord(relationships.provider) ? relationships.provider.data : void 0;
+	return (isRecord(attributes.provider) ? text(attributes.provider.id) : void 0) ?? (isRecord(related) ? text(related.id) : void 0);
 };
 /**
-* `IssueAscApiKey` with asc, the open-source App Store Connect CLI
-* (https://github.com/rorkai/App-Store-Connect-CLI, MIT):
+* `IssueAscApiKey` by signing in as App Store Connect's web page does
+* (`signInToAppStoreConnect`) and creating the key with the API its
+* Integrations page uses:
 *
-* 1. `asc web auth login` signs in with the password and the two-factor
-*    codes typed into Hot Updater's prompts. The password reaches only that
-*    asc process, in its environment (never an argument), each code only
-*    asc's two-factor code command, and neither is kept or printed.
-* 2. `chooseTeam` sees the team asc signed in to, unless `teamId` is set.
-* 3. `asc web api-keys create` issues the key and saves its one-time `.p8`,
-*    which is checked before it is handed out; a key that fails the check is
-*    revoked at once.
-* 4. `revoke` runs `asc web api-keys revoke` in the same session.
+* 1. The password typed into Hot Updater's prompt goes only to Apple's SRP
+*    sign-in, which sends a proof of it, never the password; the two-factor
+*    code goes only to Apple's check. Neither is kept or printed.
+* 2. `chooseTeam` sees the teams the Apple Account is in, unless `teamId`
+*    is set.
+* 3. The key is created, its one-time `.p8` downloaded and checked; a key
+*    that fails the check is revoked at once.
+* 4. `revoke` deactivates the key in the same session.
 *
-* asc's whole state (its web session, config, and the `.p8`) lives in a
-* temporary 0700 directory, which `dispose` deletes, as does the process
-* exiting first.
+* The session is cookies in this process's memory, which `dispose` drops.
 *
-* @param asc The asc binary; found or downloaded with `findAscCli` unless set.
-* @param env The environment asc's own is derived from.
+* @param fetch Where requests go, Apple unless set.
 * @param prompts Where the password and two-factor codes are asked.
+* @param wait How a retried download waits.
 */
-const createAscCliKeyIssuer = ({ asc, env = process.env, prompts = cliPrompts } = {}) => async ({ name, role, appleId, teamId, chooseTeam }) => {
-	const cli = asc ?? await findAscCli();
-	_hot_updater_cli_tools.p.log.info("Signing in with asc, the App Store Connect CLI. Only the issued key is kept.");
+const createAscKeyIssuer = ({ fetch = globalThis.fetch, prompts = cliPrompts, wait = node_timers_promises.setTimeout } = {}) => async ({ name, role, appleId, teamId, chooseTeam }) => {
+	if (!appleId) throw new AppleSignInError("Signing in needs the Apple Account's email.");
+	_hot_updater_cli_tools.p.log.info("Signing in to App Store Connect. Only the issued key is kept.");
 	const password = await prompts.password(appleId);
-	if (password === void 0) throw new AscCommandError("Signing in was cancelled.", void 0);
+	if (password === void 0) throw new AppleSignInError("Signing in was cancelled.");
 	(0, _hot_updater_cli_tools.registerSecretValue)(password);
-	const work = await createWorkDirectory();
-	const ascEnv = ascEnvironment(work.root, env);
-	const run = async (step, args, extraEnv = {}) => {
-		const result = await (0, execa.execa)(cli.path, args, {
-			env: {
-				...ascEnv,
-				...extraEnv
-			},
-			extendEnv: false,
-			stdin: "ignore",
-			stdout: "pipe",
-			stderr: "pipe",
-			reject: false
-		});
-		const stderr = String(result.stderr ?? "");
-		if (result.exitCode !== 0 || result.failed) throw new AscCommandError(`${step} failed: ${lastLine(stderr) ?? (result.signal ? `stopped by ${result.signal}` : void 0) ?? `exit code ${result.exitCode}`}`, result.exitCode, { cause: { stderr } });
-		let parsed;
-		try {
-			parsed = JSON.parse(String(result.stdout));
-		} catch {
-			parsed = void 0;
-		}
-		if (!isRecord(parsed)) throw new AscCommandError(`${step} printed no JSON this version of Hot Updater reads.`, result.exitCode);
-		return parsed;
+	const session = await signInToAppStoreConnect({
+		appleId,
+		password,
+		prompts,
+		fetch
+	});
+	let disposed = false;
+	const dispose = async () => {
+		disposed = true;
+		session.clear();
 	};
 	try {
-		const twoFactor = await listenForTwoFactorCodes(work.root, prompts);
-		let login;
+		const teams = session.providers.map((provider) => toTeam(appleId, provider));
+		const chosen = teamId ?? await chooseTeam?.(teams, toTeam(appleId, session.provider));
+		const provider = chosen === void 0 ? session.provider : await session.selectProvider(chosen);
+		let data;
 		try {
-			login = await run("Signing in with asc web auth login", [
-				"web",
-				"auth",
-				"login",
-				...appleId ? ["--apple-id", appleId] : [],
-				"--two-factor-code-command",
-				twoFactor.command,
-				"--output",
-				"json"
-			], { ASC_WEB_PASSWORD: password });
+			data = await irisRequest(session, "Creating the App Store Connect API key", "POST", "/apiKeys", { data: {
+				type: "apiKeys",
+				attributes: {
+					nickname: name,
+					roles: [role],
+					allAppsVisible: true,
+					keyType: "PUBLIC_API"
+				}
+			} });
 		} catch (error) {
-			if (twoFactor.cancelled()) throw new AscCommandError("Signing in was cancelled.", void 0, { cause: error });
+			const hint = error instanceof AppleSignInError && error.status !== void 0 ? createFailureHint(error.status, error.body ?? "") : void 0;
+			if (hint) throw new AppleSignInError(`${error.message}\n${hint}`, {
+				...error.status === void 0 ? {} : { status: error.status },
+				cause: error
+			});
 			throw error;
-		} finally {
-			await twoFactor.close();
 		}
-		if (login.authenticated !== true) throw new AscCommandError("asc web auth login finished without a signed-in session.", 0);
-		const signedIn = {
-			...text(login.appleId) ? { appleId: text(login.appleId) } : {},
-			...text(login.publicProviderId) ? { teamId: text(login.publicProviderId) } : {},
-			...text(login.developerTeamId) ? { developerTeamId: text(login.developerTeamId) } : {}
-		};
-		const chosen = teamId ?? await chooseTeam?.(signedIn);
-		const team = chosen === void 0 || chosen === signedIn.teamId ? signedIn : {
-			...signedIn.appleId ? { appleId: signedIn.appleId } : {},
-			teamId: chosen
+		const keyId = text(data.id);
+		if (!keyId) throw new AppleSignInError("App Store Connect created a key without an ID.");
+		const revoke = async () => {
+			if (disposed) return false;
+			return irisRequest(session, "Revoking the key", "PATCH", `/apiKeys/${encodeURIComponent(keyId)}`, { data: {
+				id: keyId,
+				type: "apiKeys",
+				attributes: { isActive: false }
+			} }).then(() => true, () => false);
 		};
-		const sessionArgs = [...signedIn.appleId ? ["--apple-id", signedIn.appleId] : [], ...chosen === void 0 ? [] : ["--public-provider-id", chosen]];
-		let created;
-		try {
-			created = await run("Creating the App Store Connect API key", [
-				"web",
-				"api-keys",
-				"create",
-				"--name",
-				name,
-				"--role",
-				role,
-				"--output-dir",
-				node_path.default.join(work.root, "keys"),
-				...sessionArgs,
-				"--output",
-				"json"
-			]);
-		} catch (error) {
-			const stderr = error instanceof AscCommandError && isRecord(error.cause) ? String(error.cause.stderr ?? "") : "";
-			const hint = createFailureHint(stderr);
-			if (hint && error instanceof AscCommandError) throw new AscCommandError(`${error.message}\n${hint}`, error.exitCode, { cause: error });
-			throw error;
-		}
-		const keyId = text(created.keyId);
-		if (!keyId) throw new AscCommandError("asc web api-keys create printed no key ID.", 0);
-		const revoke = () => run("Revoking the key", [
-			"web",
-			"api-keys",
-			"revoke",
-			"--key-id",
-			keyId,
-			"--type",
-			"team",
-			"--confirm",
-			...sessionArgs,
-			"--output",
-			"json"
-		]).then((json) => json.active === false || json.status === "revoked", () => false);
 		let p8;
 		let issuerId;
 		try {
-			const issuer = text(created.issuerId);
-			const p8Path = text(created.p8Path);
-			const keys = node_path.default.join(work.root, "keys");
-			if (!issuer) throw new Error("asc printed no issuer ID for the key.");
-			if (!p8Path || await node_fs_promises.default.realpath(node_path.default.dirname(node_path.default.resolve(p8Path))) !== await node_fs_promises.default.realpath(keys)) throw new Error("asc saved the key's .p8 outside its output directory.");
-			p8 = (await node_fs_promises.default.readFile(p8Path, "utf-8")).trim();
+			p8 = await downloadP8(session, keyId, wait);
 			(0, _hot_updater_cli_tools.registerSecretValue)(p8);
 			(0, _hot_updater_cli_tools.registerSecretValue)(Buffer.from(p8).toString("base64"));
 			assertP8(p8);
+			const details = await irisRequest(session, "Reading the key's issuer ID", "GET", `/apiKeys/${encodeURIComponent(keyId)}?include=provider`);
+			const issuer = issuerOf(details) ?? issuerOf(data);
+			if (!issuer) throw new Error("App Store Connect named no issuer ID for the key.");
 			issuerId = issuer;
 		} catch (error) {
 			const revoked = await revoke();
@@ -451,13 +744,13 @@ const createAscCliKeyIssuer = ({ asc, env = process.env, prompts = cliPrompts }
 			p8,
 			keyId,
 			issuerId,
-			name: text(created.name) ?? name,
-			team,
+			name: text(isRecord(data.attributes) ? data.attributes.nickname : "") ?? name,
+			team: toTeam(appleId, provider),
 			revoke,
-			dispose: work.dispose
+			dispose
 		};
 	} catch (error) {
-		await work.dispose();
+		await dispose();
 		throw error;
 	}
 };
@@ -466,11 +759,11 @@ const createAscCliKeyIssuer = ({ asc, env = process.env, prompts = cliPrompts }
 /** Where team API keys are listed and revoked in App Store Connect. */
 const ASC_INTEGRATIONS_URL = "https://appstoreconnect.apple.com/access/integrations/api";
 /**
-* Hot Updater's sign-in, the one place that picks how it is done: asc, the
-* open-source App Store Connect CLI. Another implementation of
+* Hot Updater's sign-in, the one place that picks how it is done: App Store
+* Connect's own web sign-in, with no other tool. Another implementation of
 * `IssueAscApiKey` replaces it here without touching its callers.
 */
-const issueAscApiKey = (request) => createAscCliKeyIssuer()(request);
+const issueAscApiKey = (request) => createAscKeyIssuer()(request);
 //#endregion
 //#region src/utils/cocoapods.ts
 const installPodsIfNeeded = async (sourceDir) => {