@hot-updater/apple-helper 1.2.0-rc.6 → 1.2.0-rc.8

package/dist/index.cjs

@@ -551,6 +551,23 @@ const signInToAppStoreConnect = async ({ appleId, password, prompts, fetch = glo
 	}
 };
 //#endregion
+//#region src/asc/programLicenseAgreement.ts
+/**
+* What to do when Apple holds a team's requests until the Account Holder
+* accepts the latest Apple Developer Program License Agreement: App Store
+* Connect answers 403, and xcodebuild prints "PLA Update available".
+*/
+const PROGRAM_LICENSE_AGREEMENT_HINT = ["The Account Holder must accept the latest Program License Agreement:", "https://developer.apple.com/account"].join("\n");
+/** The code App Store Connect answers a team with a pending agreement. */
+const AGREEMENT_ERROR_CODE = "FORBIDDEN.REQUIRED_AGREEMENTS_MISSING_OR_EXPIRED";
+/**
+* Whether App Store Connect's JSON:API errors say the team has a Program
+* License Agreement to accept, by its code or its detail.
+*/
+const isProgramLicenseAgreementError = (errors) => errors.some(({ code, detail, title }) => code === AGREEMENT_ERROR_CODE || /Program License Agreement/iu.test(`${detail ?? ""} ${title ?? ""}`));
+/** Whether xcodebuild's output says the team has an agreement to accept. */
+const mentionsProgramLicenseAgreement = (output) => output.includes("PLA Update available");
+//#endregion
 //#region src/asc/ascKeyIssuer.ts
 const IRIS_URL = "https://appstoreconnect.apple.com/iris/v1";
 /**
@@ -603,7 +620,7 @@ const irisDetail = (body) => {
 };
 /** What to do about a key App Store Connect would not create. */
 const createFailureHint = (status, body) => {
-	if (/agreement/iu.test(body)) return "The Account Holder must accept the new Apple Developer Program License\nAgreement at https://developer.apple.com/account, then run this again.";
+	if (/agreement/iu.test(body)) return PROGRAM_LICENSE_AGREEMENT_HINT;
 	if (/limit|maximum/iu.test(body)) return `The team has the most API keys App Store Connect allows. Revoke one at:\n${ASC_INTEGRATIONS_URL}`;
 	if (status === 403 || /account holder|admin|permission/iu.test(body)) return "Creating an API key needs the Account Holder or Admin role in the team.";
 };
@@ -766,11 +783,23 @@ const ASC_INTEGRATIONS_URL = "https://appstoreconnect.apple.com/access/integrati
 const issueAscApiKey = (request) => createAscKeyIssuer()(request);
 //#endregion
 //#region src/utils/cocoapods.ts
+/**
+* A failed command's error: the command, then the last lines of its
+* output, without execa's full message.
+*/
+const commandFailure = (command, error) => {
+	const { stderr, stdout } = error ?? {};
+	const detail = String(stderr || stdout || "").trimEnd().split("\n").slice(-12).join("\n") || (error instanceof Error ? error.message : String(error));
+	return new Error(`${command} failed.\n${detail}`, { cause: error });
+};
 const installPodsIfNeeded = async (sourceDir) => {
 	const podfilePath = path.default.join(sourceDir, "Podfile");
 	if (!fs.default.existsSync(podfilePath)) {
 		_hot_updater_cli_tools.p.log.info("No Podfile found, skipping CocoaPods installation");
-		return;
+		return {
+			codegen: false,
+			pods: false
+		};
 	}
 	const gemfilePaths = [path.default.join(sourceDir, "Gemfile"), path.default.join((0, _hot_updater_cli_tools.getCwd)(), "Gemfile")];
 	const shouldUseBundler = (await Promise.all(gemfilePaths.map(checkShouldUseBundler))).some(Boolean);
@@ -784,36 +813,39 @@ const installPodsIfNeeded = async (sourceDir) => {
 		reactNativePath: reactNative.packagePath,
 		sourceDir
 	});
-	try {
-		if (shouldUseBundler) {
-			_hot_updater_cli_tools.p.log.info("Using bundler for CocoaPods installation");
-			const bundleSpinner = _hot_updater_cli_tools.p.spinner();
-			bundleSpinner.start("Installing Ruby gems");
+	if (shouldUseBundler) {
+		const bundleSpinner = _hot_updater_cli_tools.p.spinner();
+		bundleSpinner.start("Installing Ruby gems");
+		try {
 			await (0, execa.execa)("bundle", ["install"], { cwd: sourceDir });
-			bundleSpinner.stop("Ruby gems installed");
-			const podSpinner = _hot_updater_cli_tools.p.spinner();
-			podSpinner.start("Installing CocoaPods dependencies");
-			await (0, execa.execa)("bundle", [
-				"exec",
-				"pod",
-				"install"
-			], {
-				cwd: sourceDir,
-				env: plan.env
-			});
-			podSpinner.stop("CocoaPods dependencies installed");
-		} else {
-			const spinner = _hot_updater_cli_tools.p.spinner();
-			spinner.start("Installing CocoaPods dependencies");
-			await (0, execa.execa)("pod", ["install"], {
-				cwd: sourceDir,
-				env: plan.env
-			});
-			spinner.stop("CocoaPods dependencies installed");
+		} catch (error) {
+			bundleSpinner.error("bundle install failed");
+			throw commandFailure("bundle install", error);
 		}
+		bundleSpinner.stop("Ruby gems installed");
+	}
+	const podCommand = shouldUseBundler ? [
+		"bundle",
+		"exec",
+		"pod",
+		"install"
+	] : ["pod", "install"];
+	const podSpinner = _hot_updater_cli_tools.p.spinner();
+	podSpinner.start("Installing CocoaPods dependencies");
+	try {
+		await (0, execa.execa)(podCommand[0], podCommand.slice(1), {
+			cwd: sourceDir,
+			env: plan.env
+		});
 	} catch (error) {
-		throw new Error(`pod install failed: ${error}`);
+		podSpinner.error(`${podCommand.join(" ")} failed`);
+		throw commandFailure(podCommand.join(" "), error);
 	}
+	podSpinner.stop("CocoaPods dependencies installed");
+	return {
+		codegen: plan.runCodegen,
+		pods: true
+	};
 };
 const checkShouldUseBundler = async (gemfilePath) => {
 	try {
@@ -846,8 +878,8 @@ const runReactNativeCodegen = async ({ projectRoot, reactNativePath, sourceDir }
 			"ios"
 		], { cwd: projectRoot });
 	} catch (error) {
-		spinner.stop("React Native codegen failed");
-		throw new Error(`React Native codegen failed: ${error}`);
+		spinner.error("React Native codegen failed");
+		throw commandFailure("React Native codegen", error);
 	}
 	spinner.stop("React Native codegen done");
 };
@@ -977,26 +1009,6 @@ const getDefaultDestination = ({ platform, useGeneric, deviceType }) => {
 	});
 };
 //#endregion
-//#region src/utils/formatCommand.ts
-/**
-* A command to print, broken at spaces with ` \` once a line would pass
-* `width`, each continuation indented two spaces, so a terminal never wraps
-* it mid-word and it still pastes as one command.
-*/
-const formatCommand = (words, width = 74) => {
-	const lines = [];
-	let line = "";
-	for (const word of words) {
-		const next = line ? `${line} ${word}` : word;
-		if (line && next.length > width - 2) {
-			lines.push(`${line} \\`);
-			line = `  ${word}`;
-		} else line = next;
-	}
-	lines.push(line);
-	return lines.join("\n");
-};
-//#endregion
 //#region src/utils/parseXcodeProjectInfo.ts
 const parseXcodeProjectInfo = async (sourceDir) => {
 	const files = await fs.default.promises.readdir(sourceDir);
@@ -1019,80 +1031,133 @@ const parseXcodeProjectInfo = async (sourceDir) => {
 const prettifyXcodebuildError = (error) => {
 	if (error instanceof _hot_updater_cli_tools.BuildFailedError) {
 		const errorLines = error.summary.join("\n");
-		const message = errorLines.includes("error: No profiles for") || errorLines.includes("error: Provisioning profile") ? "No valid provisioning profile is set in the project.\nCheck the Signing & Capabilities tab in Xcode." : error.message;
-		return new _hot_updater_cli_tools.BuildFailedError(message, {
+		const hint = mentionsProgramLicenseAgreement(errorLines) ? PROGRAM_LICENSE_AGREEMENT_HINT : errorLines.includes("error: No profiles for") || errorLines.includes("error: Provisioning profile") ? "No valid provisioning profile is set in the project.\nCheck the Signing & Capabilities tab in Xcode." : null;
+		return new _hot_updater_cli_tools.BuildFailedError(hint ?? error.message, {
 			logPath: error.logPath,
 			summary: error.summary,
+			hint,
 			cause: error.cause
 		});
 	}
 	return /* @__PURE__ */ new Error(`Xcodebuild failed: ${error}`);
 };
 //#endregion
+//#region src/utils/xcodebuildPhase.ts
+/** The `(in target 'X' from project 'Y')` that ends an action's line. */
+const TARGET = /\(in target '([^']+)' from project '[^']+'\)\s*$/;
+/** A `PhaseScriptExecution` line's script phase, its spaces escaped. */
+const SCRIPT = /^PhaseScriptExecution ((?:\\.|[^\s\\])+)/;
+/** A batched `SwiftCompile`'s files: `Compiling\ A.swift,\ B.swift`. */
+const SWIFT_BATCH = /^SwiftCompile \S+ \S+ Compiling\\ ((?:\\.|[^\s\\])+)/;
+const unescape = (value) => value.replace(/\\(.)/g, "$1");
+/** Actions whose lines say what xcodebuild is doing, by their first word. */
+const ACTIONS = {
+	CompileAssetCatalog: "Compiling assets",
+	CompileAssetCatalogVariant: "Compiling assets",
+	LinkAssetCatalog: "Compiling assets",
+	CompileStoryboard: "Compiling storyboards",
+	CompileXIB: "Compiling storyboards",
+	LinkStoryboards: "Compiling storyboards",
+	Ld: "Linking",
+	Libtool: "Linking",
+	CodeSign: "Signing",
+	ProcessInfoPlistFile: "Processing",
+	ProcessProductPackaging: "Processing",
+	ProcessProductPackagingDER: "Processing",
+	CopySwiftLibs: "Copying",
+	CpResource: "Copying",
+	GenerateDSYMFile: "Generating dSYM",
+	Strip: "Stripping",
+	Validate: "Validating"
+};
+const COMPILES = /* @__PURE__ */ new Set([
+	"CompileC",
+	"SwiftCompile",
+	"CompileSwift"
+]);
+const PRECOMPILES = /* @__PURE__ */ new Set([
+	"PrecompileModule",
+	"ScanDependencies",
+	"SwiftExplicitDependencyGeneratePcm",
+	"SwiftExplicitDependencyCompileModuleFromInterface"
+]);
+const plural = (count, noun) => `${count} ${noun}${count === 1 ? "" : "s"}`;
+/**
+* Reads the phase of an `xcodebuild` build, archive, or export from its raw
+* output: `Compiling React-Core · 412 files`, `Linking CodexRelay`,
+* `Signing CodexRelay`, `Bundling JavaScript`, with the target each
+* action's line names.
+*/
+const createXcodebuildPhaseReader = () => {
+	let compiled = 0;
+	let precompiled = 0;
+	return (line) => {
+		const space = line.indexOf(" ");
+		const action = space === -1 ? line : line.slice(0, space);
+		const target = TARGET.exec(line)?.[1];
+		const withTarget = (phase) => target ? `${phase} ${target}` : phase;
+		if (COMPILES.has(action)) {
+			const batch = SWIFT_BATCH.exec(line)?.[1];
+			compiled += batch ? unescape(batch).split(",").length : 1;
+			return `${withTarget("Compiling")} · ${plural(compiled, "file")}`;
+		}
+		if (PRECOMPILES.has(action)) {
+			precompiled += 1;
+			return `Precompiling modules · ${precompiled}`;
+		}
+		if (action === "PhaseScriptExecution") {
+			const script = unescape(SCRIPT.exec(line)?.[1] ?? "");
+			if (script === "Bundle React Native code and images") return "Bundling JavaScript";
+			return script ? `Running ${script}` : withTarget("Running a script");
+		}
+		const phase = ACTIONS[action];
+		if (phase) return withTarget(phase);
+		if (line === "Prepare packages" || line.startsWith("Resolve Package")) return "Resolving packages";
+		if (line === "ComputeTargetDependencyGraph") return "Planning the build";
+	};
+};
+//#endregion
 //#region src/utils/createXcodebuildLogger.ts
-const createXcodebuildLogger = ({ logPrefix }) => new _hot_updater_cli_tools.BuildLogger({
+const createXcodebuildLogger = ({ logPrefix, logFilePath }) => new _hot_updater_cli_tools.BuildLogger({
 	logPrefix,
-	importantLogPatterns: [
-		"error:",
-		"** BUILD FAILED **",
-		"** ARCHIVE FAILED **",
-		"The following build commands failed:",
-		"note: Building targets in dependency order",
-		"note: Target dependency graph",
-		"Running script",
-		"[CP-User]",
-		"[CP] Check Pods Manifest.lock",
-		"Build Succeeded"
-	],
-	progressStages: [
-		["Building targets in dependency order", "Target dependency graph"],
-		["Write Auxiliary File", "[CP] Check Pods Manifest.lock"],
-		[
-			"Running script",
-			"[CP-User] [RN]Check rncore",
-			"[CP-User] [Hermes] Replace Hermes",
-			"[CP-User] [RN]Check FBReactNativeSpec"
-		],
-		[
-			"Processing",
-			"ProcessProductPackaging",
-			"ProcessProductPackagingDER"
-		],
-		["Compiling"],
-		["RegisterExecutionPolicyException"],
-		["Touching"],
-		["Building library", "Create Universal Binary"],
-		["Copying"],
-		[
-			"Build Succeeded",
-			"BUILD SUCCEEDED",
-			"ARCHIVE SUCCEEDED"
-		]
-	],
+	logFilePath,
+	createPhaseReader: createXcodebuildPhaseReader,
 	failureSummary: {
 		lines: [/(^|:\s)error: /, /^\*\* [A-Z ]+ FAILED \*\*$/],
 		blocks: [{
 			start: "The following build commands failed:",
 			end: /^\(\d+ failures?\)$/,
 			includeEnd: true
+		}, {
+			start: /^error: exportArchive /,
+			end: /^$/,
+			includeEnd: false
 		}]
 	}
 });
 //#endregion
-//#region src/utils/runXcodebuildWithLogging.ts
-let cachedXcbeautifyAvailability = null;
-const TERMINATION_SIGNALS$1 = ["SIGINT", "SIGTERM"];
-const isXcbeautifyAvailable = async () => {
-	if (cachedXcbeautifyAvailability !== null) return cachedXcbeautifyAvailability;
-	try {
-		await (0, execa.execa)("which", ["xcbeautify"]);
-		cachedXcbeautifyAvailability = true;
-		return true;
-	} catch {
-		cachedXcbeautifyAvailability = false;
-		return false;
+//#region src/utils/formatCommand.ts
+/**
+* A command to print, broken at spaces with ` \` once a line would pass
+* `width`, each continuation indented two spaces, so a terminal never wraps
+* it mid-word and it still pastes as one command.
+*/
+const formatCommand = (words, width = 74) => {
+	const lines = [];
+	let line = "";
+	for (const word of words) {
+		const next = line ? `${line} ${word}` : word;
+		if (line && next.length > width - 2) {
+			lines.push(`${line} \\`);
+			line = `  ${word}`;
+		} else line = next;
 	}
+	lines.push(line);
+	return lines.join("\n");
 };
+//#endregion
+//#region src/utils/runXcodebuildWithLogging.ts
+const TERMINATION_SIGNALS$1 = ["SIGINT", "SIGTERM"];
 const createRawXcodebuildProcess = ({ args, env, sourceDir }) => {
 	return (0, execa.execa)("xcodebuild", args, {
 		cwd: sourceDir,
@@ -1105,13 +1170,6 @@ const createRawXcodebuildProcess = ({ args, env, sourceDir }) => {
 		}
 	});
 };
-const createXcbeautifyProcess = ({ cwd }) => {
-	return (0, execa.execa)("xcbeautify", [], {
-		cwd,
-		all: true,
-		buffer: false
-	});
-};
 /** Why xcodebuild failed, without its command line. */
 const describeFailure = (error) => {
 	if (error instanceof execa.ExecaError) {
@@ -1120,10 +1178,24 @@ const describeFailure = (error) => {
 	}
 	return error instanceof Error ? error.message : String(error);
 };
-const runXcodebuildWithLogging = async ({ args, env, sourceDir, successMessage, failureMessage, logPrefix }) => {
-	const useXcbeautify = await isXcbeautifyAvailable();
-	const logger = createXcodebuildLogger({ logPrefix });
-	await logger.start();
+/**
+* Runs xcodebuild as a step titled `title`: its live line shows the build's
+* phase, the log file keeps the command and the whole output, and a failure
+* prints the output's errors and the log's path on stderr.
+*/
+const runXcodebuildWithLogging = async ({ args, env, sourceDir, title, successMessage, failureMessage, logPrefix, logFilePath, header = [] }) => {
+	const logger = createXcodebuildLogger({
+		logPrefix,
+		logFilePath
+	});
+	await logger.start({
+		title,
+		header: [
+			...header,
+			`$ ${formatCommand(["xcodebuild", ...args])}`,
+			""
+		]
+	});
 	const activeProcesses = [];
 	const terminateActiveProcesses = () => {
 		for (const activeProcess of activeProcesses) activeProcess.kill();
@@ -1137,31 +1209,17 @@ const runXcodebuildWithLogging = async ({ args, env, sourceDir, successMessage,
 		});
 		activeProcesses.push(xcodebuildProcess);
 		const xcodebuildOutput = xcodebuildProcess.all ?? xcodebuildProcess.stdout;
-		let xcbeautifyProcess = null;
-		if (useXcbeautify && xcodebuildOutput) {
-			xcbeautifyProcess = createXcbeautifyProcess({ cwd: sourceDir });
-			activeProcesses.push(xcbeautifyProcess);
-		}
-		const logging = xcodebuildOutput ? logger.processStream(xcodebuildOutput, { display: xcbeautifyProcess ? xcbeautifyProcess.all ?? xcbeautifyProcess.stdout ?? void 0 : void 0 }) : Promise.resolve();
-		const xcbeautifyInput = xcbeautifyProcess?.stdin;
-		if (xcodebuildOutput && xcbeautifyInput) {
-			xcbeautifyInput.on("error", () => {
-				xcodebuildOutput.unpipe(xcbeautifyInput);
-			});
-			xcodebuildOutput.pipe(xcbeautifyInput);
-		}
-		const [xcodebuildResult, loggingResult] = await Promise.allSettled([
-			xcodebuildProcess,
-			logging,
-			xcbeautifyProcess
-		]);
+		const logging = xcodebuildOutput ? logger.processStream(xcodebuildOutput) : Promise.resolve();
+		const [xcodebuildResult, loggingResult] = await Promise.allSettled([xcodebuildProcess, logging]);
 		if (xcodebuildResult.status === "rejected") throw xcodebuildResult.reason;
 		if (loggingResult.status === "rejected") throw loggingResult.reason;
 		logger.stop(successMessage);
+		return { logFilePath: logger.logFilePath };
 	} catch (error) {
 		logger.writeError(error);
-		logger.stop(failureMessage, false);
-		throw new _hot_updater_cli_tools.BuildFailedError(`${failureMessage}: ${describeFailure(error)}`, {
+		const reason = describeFailure(error);
+		logger.stop(`${failureMessage} · ${reason.replace(/\.$/, "")}`, false);
+		throw new _hot_updater_cli_tools.BuildFailedError(`${failureMessage}: ${reason}`, {
 			logPath: logger.logPath,
 			summary: logger.failureSummary,
 			cause: error
@@ -1253,7 +1311,7 @@ const buildSettingsOverScheme = ({ minBundleId, authenticationArgs }) => ({
 * written to a temporary directory, removed whether the archive succeeds or
 * not.
 */
-const archiveXcodeProject = async ({ sourceDir, archiveDirectory, platform, installPods, destination, extraParams, configuration, xcodeScheme, xcconfig, logPrefix, minBundleId, authenticationArgs }) => {
+const archiveXcodeProject = async ({ sourceDir, archiveDirectory, platform, installPods, destination, extraParams, configuration, xcodeScheme, xcconfig, logPrefix, header = [], minBundleId, authenticationArgs }) => {
 	if (installPods) await installPodsIfNeeded(sourceDir);
 	const xcodeProject = await parseXcodeProjectInfo(sourceDir);
 	const archiveName = `${xcodeProject.name.replace(".xcworkspace", "").replace(".xcodeproj", "")}.xcarchive`;
@@ -1283,24 +1341,26 @@ const archiveXcodeProject = async ({ sourceDir, archiveDirectory, platform, inst
 			xcconfig: build.xcconfig,
 			xcodeScheme
 		});
-		_hot_updater_cli_tools.p.log.info([
-			"Xcode archive",
-			`Project   ${xcodeProject.name}`,
-			`Scheme    ${xcodeScheme}`,
-			`Platform  ${platform}`,
-			"Command",
-			formatCommand(["xcodebuild", ...archiveArgs])
-		].join("\n"));
 		try {
-			await runXcodebuildWithLogging({
+			const { logFilePath } = await runXcodebuildWithLogging({
 				args: archiveArgs,
 				env: { HOT_UPDATER_MIN_BUNDLE_ID: minBundleId },
+				title: `Archiving ${xcodeScheme}`,
+				successMessage: `Archived ${xcodeScheme}`,
 				failureMessage: "Archive failed",
 				logPrefix,
-				sourceDir,
-				successMessage: "Archive completed successfully"
+				header: [
+					...header,
+					`Project   ${xcodeProject.name}`,
+					`Scheme    ${xcodeScheme}`,
+					`Platform  ${platform}`
+				],
+				sourceDir
 			});
-			return { archivePath };
+			return {
+				archivePath,
+				logFilePath
+			};
 		} catch (error) {
 			throw prettifyXcodebuildError(error);
 		}
@@ -1343,7 +1403,7 @@ const prepareArchiveArgs = ({ xcodeScheme, archivePath, platform, sourceDir, xco
 * `.app` to `outputDirectory`, and removes DerivedData, which takes 10 GB or
 * more, whether the build succeeds or not.
 */
-const buildXcodeProject = async ({ sourceDir, outputDirectory, platform, xcodeScheme, configuration, deviceType, logPrefix, destination = [], useGenericDestination = false, installPods, extraParams, minBundleId, authenticationArgs }) => {
+const buildXcodeProject = async ({ sourceDir, outputDirectory, platform, xcodeScheme, configuration, deviceType, logPrefix, destination = [], useGenericDestination = false, installPods, extraParams, minBundleId, authenticationArgs, header = [] }) => {
 	if (installPods) await installPodsIfNeeded(sourceDir);
 	const xcodeProject = await parseXcodeProjectInfo(sourceDir);
 	const tmpDir = await createRandomTmpDir();
@@ -1381,26 +1441,26 @@ const buildXcodeProject = async ({ sourceDir, outputDirectory, platform, xcodeSc
 			sourceDir,
 			xcodeProject
 		});
-		_hot_updater_cli_tools.p.log.info([
-			"Xcode build",
-			`Project        ${xcodeProject.name}`,
-			`Scheme         ${xcodeScheme}`,
-			`Configuration  ${configuration}`,
-			`Platform       ${platform}`,
-			`Device type    ${deviceType}`,
-			"Command",
-			formatCommand(["xcodebuild", ...buildArgs])
-		].join("\n"));
 		let builtAppPath;
+		let logFilePath;
 		try {
-			await runXcodebuildWithLogging({
+			({logFilePath} = await runXcodebuildWithLogging({
 				args: buildArgs,
 				env: { HOT_UPDATER_MIN_BUNDLE_ID: minBundleId },
 				sourceDir,
 				logPrefix,
-				successMessage: "Build completed successfully",
+				header: [
+					...header,
+					`Project        ${xcodeProject.name}`,
+					`Scheme         ${xcodeScheme}`,
+					`Configuration  ${configuration}`,
+					`Platform       ${platform}`,
+					`Device type    ${deviceType}`
+				],
+				title: `Building ${xcodeScheme}`,
+				successMessage: `Built ${xcodeScheme}`,
 				failureMessage: "Build failed"
-			});
+			}));
 			({appPath: builtAppPath} = await getBuildSettings({
 				configuration,
 				derivedDataPath,
@@ -1414,7 +1474,10 @@ const buildXcodeProject = async ({ sourceDir, outputDirectory, platform, xcodeSc
 		}
 		const appPath = path.default.join(outputDirectory, path.default.basename(builtAppPath));
 		await fs.default.promises.cp(builtAppPath, appPath, { recursive: true });
-		return { appPath };
+		return {
+			appPath,
+			logFilePath
+		};
 	} finally {
 		await removeTmpDir(tmpDir);
 	}
@@ -1474,7 +1537,7 @@ const getBuildSettings = async ({ xcodeProject, sourceDir, xcodeScheme, configur
 //#endregion
 //#region src/builder/exportXcodeArchive.ts
 /** Exports the archive into `exportPath`. */
-const exportXcodeArchive = async ({ archivePath, exportPath, sourceDir, exportExtraParams, exportOptionsPlist, logPrefix, authenticationArgs }) => {
+const exportXcodeArchive = async ({ archivePath, exportPath, sourceDir, exportExtraParams, exportOptionsPlist, logPrefix, logFilePath, title, authenticationArgs }) => {
 	const exportArgs = prepareExportArgs({
 		authenticationArgs,
 		archivePath,
@@ -1486,9 +1549,11 @@ const exportXcodeArchive = async ({ archivePath, exportPath, sourceDir, exportEx
 		await runXcodebuildWithLogging({
 			args: exportArgs,
 			sourceDir,
-			successMessage: "Archive exported successfully",
+			title: `Exporting ${title}`,
+			successMessage: `Exported ${title}`,
 			failureMessage: "Export failed",
-			logPrefix
+			logPrefix,
+			logFilePath
 		});
 		return { exportPath };
 	} catch (error) {
@@ -1917,7 +1982,7 @@ const createAppStoreConnectRequest = ({ apiKey, privateKey, fetch }) => {
 		if (!response.ok) {
 			const error = new AppStoreConnectError(action, response.status, await readApiErrors(response), response.headers.get("retry-after"));
 			if (response.status === 401) throw new Error("App Store Connect refused the API key.\nCheck its key ID and issuer ID, and that it isn't revoked.", { cause: error });
-			if (response.status === 403) throw new Error(`${error.message}\nUploads need a key with the Admin, App Manager, or Developer role.`, { cause: error });
+			if (response.status === 403) throw new Error(isProgramLicenseAgreementError(error.errors) ? `${action} failed (HTTP 403).\n${PROGRAM_LICENSE_AGREEMENT_HINT}` : `${error.message}\nUploads need a key with the Admin, App Manager, or Developer role.`, { cause: error });
 			throw error;
 		}
 		return response.status === 204 ? void 0 : await response.json();
@@ -2356,38 +2421,62 @@ const createSigningKeychain = async ({ security = runSecurity, directory = os.de
 	return {
 		path: keychainPath,
 		certificates: async () => {
+			const identities = new Set([...(await security([
+				"find-identity",
+				"-p",
+				"codesigning",
+				keychainPath
+			])).matchAll(/^\s*\d+\)\s+([0-9A-F]{40})\s/gm)].map((match) => match[1]));
+			if (identities.size === 0) return [];
 			return ((await security([
 				"find-certificate",
 				"-a",
 				"-p",
 				keychainPath
-			])).match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g) ?? []).map((pem) => {
+			])).match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g) ?? []).flatMap((pem) => {
 				const certificate = new crypto.default.X509Certificate(pem);
-				return {
+				if (!identities.has(certificate.fingerprint.replaceAll(":", ""))) return [];
+				return [{
 					serialNumber: normalizeSerial(certificate.serialNumber),
 					commonName: certificate.subject.match(/^CN=(.*)$/m)?.[1] ?? certificate.subject
-				};
+				}];
 			});
 		},
 		dispose
 	};
 };
+/** A request App Store Connect refused, in one line. */
+var AppStoreConnectRefusal = class extends Error {
+	/** Whether the team has a Program License Agreement to accept. */
+	agreement;
+	constructor(message, agreement) {
+		super(message);
+		this.agreement = agreement;
+	}
+};
+const refusal = async (action, response) => {
+	const body = await response.json().catch(() => void 0);
+	return new AppStoreConnectRefusal(`${action} failed (HTTP ${response.status}).`, isProgramLicenseAgreementError(Array.isArray(body?.errors) ? body.errors : []));
+};
 /**
 * Revokes the certificates Xcode created in the build's keychain, whose
 * private keys the keychain's deletion destroys: on a runner that starts
 * empty, Xcode creates a development certificate for every build, and App
 * Store Connect refuses new ones once a team has its maximum. Each is found
 * in the team's certificates by serial number. A revocation that fails is
-* reported with where to revoke it by hand, and never fails the build.
+* reported with each certificate's name and serial and where to revoke it
+* by hand, and never fails the build.
 */
 const revokeKeychainCertificates = async ({ certificates, apiKey, privateKey, fetch = globalThis.fetch }) => {
 	const revoked = [];
 	const failed = [];
+	/** Why none could be revoked: the token or the listing failed. */
+	let reason;
+	let agreement = false;
 	if (certificates.length === 0) return {
-		revoked,
-		failed
+		revoked: [],
+		failed: []
 	};
-	const describe = ({ commonName, serialNumber }) => `${commonName} (serial ${serialNumber})`;
 	try {
 		const token = createAppStoreConnectToken({
 			privateKey: privateKey ?? crypto.default.createPrivateKey(await fs.default.promises.readFile(apiKey.keyPath, "utf-8")),
@@ -2403,7 +2492,7 @@ const revokeKeychainCertificates = async ({ certificates, apiKey, privateKey, fe
 		})}`;
 		while (next) {
 			const response = await fetch(next, { headers });
-			if (!response.ok) throw new Error(`Listing the team's certificates failed (HTTP ${response.status}).`);
+			if (!response.ok) throw await refusal("Listing the team's certificates", response);
 			const body = await response.json();
 			for (const { id, attributes } of body.data ?? []) if (attributes?.serialNumber) idsBySerial.set(normalizeSerial(attributes.serialNumber), id);
 			next = body.links?.next;
@@ -2415,23 +2504,32 @@ const revokeKeychainCertificates = async ({ certificates, apiKey, privateKey, fe
 				method: "DELETE",
 				headers
 			});
-			if (response.ok || response.status === 404) revoked.push(describe(certificate));
-			else failed.push(`${describe(certificate)}: HTTP ${response.status}`);
+			if (response.ok || response.status === 404) revoked.push(certificate);
+			else {
+				agreement ||= (await refusal("Revoking", response)).agreement;
+				failed.push({
+					certificate,
+					status: response.status
+				});
+			}
 		}
 	} catch (error) {
-		const reason = error instanceof Error ? error.message : String(error);
-		for (const certificate of certificates) if (!revoked.includes(describe(certificate))) failed.push(`${describe(certificate)}: ${reason}`);
+		reason = error instanceof Error ? error.message : String(error);
+		agreement ||= error instanceof AppStoreConnectRefusal && error.agreement;
+		for (const certificate of certificates) if (!revoked.includes(certificate)) failed.push({ certificate });
 	}
-	if (revoked.length > 0) _hot_updater_cli_tools.p.log.info(["Revoked the certificates Xcode created for this build:", ...revoked].join("\n"));
+	const describe = ({ commonName, serialNumber }) => `${commonName} (serial ${serialNumber})`;
+	if (revoked.length > 0) _hot_updater_cli_tools.p.log.info(["Revoked the certificates Xcode created for this build:", ...revoked.flatMap(({ commonName, serialNumber }) => [commonName, `Serial ${serialNumber}`])].join("\n"));
 	if (failed.length > 0) _hot_updater_cli_tools.p.log.warn([
 		"Couldn't revoke the certificates Xcode created for this build.",
-		...failed,
-		"Revoke them at:",
+		...reason === void 0 ? [] : [reason],
+		...agreement ? [PROGRAM_LICENSE_AGREEMENT_HINT] : [],
+		...failed.flatMap(({ certificate, status }) => [certificate.commonName, `Serial ${certificate.serialNumber}${status === void 0 ? "" : ` (HTTP ${status})`}`]),
 		CERTIFICATES_URL
 	].join("\n"));
 	return {
-		revoked,
-		failed
+		revoked: revoked.map(describe),
+		failed: failed.map(({ certificate }) => describe(certificate))
 	};
 };
 const TERMINATION_SIGNALS = [
@@ -2537,7 +2635,7 @@ const readBuiltApp = async (appPath) => {
 * once the caller has copied it out. A failed build removes it, and every
 * other directory the build used, itself.
 */
-const buildIos = async ({ schemeConfig, minBundleId = (0, _hot_updater_cli_tools.createMinBundleId)(), credentials }) => {
+const buildIos = async ({ schemeConfig, minBundleId = (0, _hot_updater_cli_tools.createMinBundleId)(), credentials, logHeader = [] }) => {
 	await assertXcodebuildExist();
 	if (schemeConfig.simulator && schemeConfig.destination.length) {
 		_hot_updater_cli_tools.p.log.error("The scheme option 'simulator' is not compatible with the 'destination' option.");
@@ -2550,7 +2648,8 @@ const buildIos = async ({ schemeConfig, minBundleId = (0, _hot_updater_cli_tools
 				schemeConfig,
 				minBundleId,
 				credentials,
-				buildDirectory
+				buildDirectory,
+				logHeader
 			}),
 			dispose: () => removeTmpDir(buildDirectory)
 		};
@@ -2559,15 +2658,16 @@ const buildIos = async ({ schemeConfig, minBundleId = (0, _hot_updater_cli_tools
 		throw error;
 	}
 };
-const buildInto = async ({ schemeConfig, minBundleId, credentials, buildDirectory }) => {
+const buildInto = async ({ schemeConfig, minBundleId, credentials, buildDirectory, logHeader }) => {
 	const iosProjectRoot = path.default.join((0, _hot_updater_cli_tools.getCwd)(), "ios");
 	if (schemeConfig.simulator) {
 		const appDir = path.default.join(buildDirectory, "app");
 		await fs.default.promises.mkdir(appDir, { recursive: true });
-		const { appPath } = await buildXcodeProject({
+		const { appPath, logFilePath } = await buildXcodeProject({
 			sourceDir: iosProjectRoot,
 			outputDirectory: appDir,
 			logPrefix: `ios-${schemeConfig.hotUpdaterSchemeName}-build`,
+			header: logHeader,
 			platform: schemeConfig.platform,
 			xcodeScheme: schemeConfig.scheme,
 			configuration: schemeConfig.configuration,
@@ -2580,6 +2680,7 @@ const buildInto = async ({ schemeConfig, minBundleId, credentials, buildDirector
 		return {
 			buildDirectory,
 			buildArtifactPath: appPath,
+			logFilePath,
 			builtApp: await readBuiltApp(appPath)
 		};
 	} else {
@@ -2590,7 +2691,8 @@ const buildInto = async ({ schemeConfig, minBundleId, credentials, buildDirector
 		if (!signing) return archiveAndExport({
 			schemeConfig,
 			minBundleId,
-			buildDirectory
+			buildDirectory,
+			logHeader
 		});
 		const appStoreConnect = await exportsForAppStoreConnect(schemeConfig);
 		if ((0, _hot_updater_cli_tools.isCI)() && !appStoreConnect) _hot_updater_cli_tools.p.log.info("Signing in the runner's own keychains (not an App Store Connect export).");
@@ -2601,6 +2703,7 @@ const buildInto = async ({ schemeConfig, minBundleId, credentials, buildDirector
 				schemeConfig,
 				minBundleId,
 				buildDirectory,
+				logHeader,
 				authenticationArgs: signing.authenticationArgs
 			})
 		});
@@ -2610,12 +2713,12 @@ const buildInto = async ({ schemeConfig, minBundleId, credentials, buildDirector
 * Archives a device build and exports its `.ipa`, or returns the
 * `.xcarchive` of a scheme it cannot export.
 */
-const archiveAndExport = async ({ schemeConfig, minBundleId, buildDirectory, authenticationArgs }) => {
+const archiveAndExport = async ({ schemeConfig, minBundleId, buildDirectory, logHeader, authenticationArgs }) => {
 	const iosProjectRoot = path.default.join((0, _hot_updater_cli_tools.getCwd)(), "ios");
 	const archiveDir = path.default.join(buildDirectory, "archive");
 	const exportDir = path.default.join(buildDirectory, "export");
 	await fs.default.promises.mkdir(archiveDir, { recursive: true });
-	const { archivePath } = await archiveXcodeProject({
+	const { archivePath, logFilePath } = await archiveXcodeProject({
 		archiveDirectory: archiveDir,
 		authenticationArgs,
 		minBundleId,
@@ -2627,7 +2730,8 @@ const archiveAndExport = async ({ schemeConfig, minBundleId, buildDirectory, aut
 		extraParams: schemeConfig.extraParams,
 		configuration: schemeConfig.configuration,
 		installPods: schemeConfig.installPods,
-		logPrefix: `ios-${schemeConfig.hotUpdaterSchemeName}-build-archive`
+		logPrefix: `ios-${schemeConfig.hotUpdaterSchemeName}-build`,
+		header: logHeader
 	});
 	const appFromArchive = extractAppFromXcarchive(archivePath);
 	const archivedAppPath = appFromArchive ? path.default.join(archiveDir, path.default.basename(appFromArchive)) : void 0;
@@ -2635,6 +2739,7 @@ const archiveAndExport = async ({ schemeConfig, minBundleId, buildDirectory, aut
 	if (!schemeConfig.exportOptionsPlist && !authenticationArgs) return {
 		buildDirectory,
 		buildArtifactPath: archivePath,
+		logFilePath,
 		builtApp: archivedAppPath ? await readBuiltApp(archivedAppPath) : void 0
 	};
 	await fs.default.promises.mkdir(exportDir, { recursive: true });
@@ -2645,7 +2750,9 @@ const archiveAndExport = async ({ schemeConfig, minBundleId, buildDirectory, aut
 		exportExtraParams: schemeConfig.exportExtraParams,
 		exportOptionsPlist,
 		sourceDir: iosProjectRoot,
-		logPrefix: `ios-${schemeConfig.hotUpdaterSchemeName}-build-export`
+		logPrefix: `ios-${schemeConfig.hotUpdaterSchemeName}-build`,
+		logFilePath: logFilePath ?? void 0,
+		title: schemeConfig.scheme
 	});
 	if (schemeConfig.exportOptionsPlist) await exportArchive(schemeConfig.exportOptionsPlist);
 	else {
@@ -2661,6 +2768,7 @@ const archiveAndExport = async ({ schemeConfig, minBundleId, buildDirectory, aut
 	return {
 		buildDirectory,
 		buildArtifactPath: path.default.join(exportDir, ipaFile),
+		logFilePath,
 		builtApp: archivedAppPath ? await readBuiltApp(archivedAppPath) : void 0
 	};
 };