@imagina-build/ias-cli 0.0.0 → 0.1.0

package/src/commands/migrate/credentials.mjs

@@ -0,0 +1,213 @@
+// ias migrate eas prepare and import: EAS's signing credentials into the sealed vault, as jscheduler-app's
+// store-credentials.mjs did by hand into 1Password (its docs/local-builds.md §2). prepare makes the folder where the
+// person runs eas credentials, which handles secrets and asks questions, so ias never runs it. import reads
+// credentials.json and credentials/ there with inspectEasCredentials, shows what is not secret, imports each credential
+// through ias credentials import (sealed and signed by the team on this Mac, its id made before sealing) and then
+// deletes the download, also when something fails half way. Nothing here prints a password or a key.
+import { existsSync, statSync } from 'node:fs';
+import process from 'node:process';
+import { join, resolve } from 'node:path';
+import { loadProject } from '../../config.mjs';
+import { IasError, UsageError } from '../../errors.mjs';
+import { applicationOf, connect } from '../../manage.mjs';
+import { cleanup } from '../../process.mjs';
+import { credentials as inspect } from '../../shared.mjs';
+import credentialsCommand from '../credentials/index.mjs';
+import { downloadIn, easProjectName, easProjectOf, iasCommand, internalProfiles, isInside, platformsOf, preparedFolders, projectDir, readApp, readMarker, removeDownload, shellWord, storeProfile, writeFolder } from './project.mjs';
+
+const credentialsImport = credentialsCommand.subcommands.find((subcommand) => subcommand.name === 'import');
+const LABELS = { apple_distribution_certificate: 'iOS distribution certificate', apple_provisioning_profile: 'iOS provisioning profile', android_upload_keystore: 'Android upload keystore' };
+const day = (date) => (date ? String(date).slice(0, 10) : 'never');
+
+export function prepare(context) {
+  const { values, env, output } = context;
+  const dir = projectDir(context);
+  const app = readApp(dir);
+  if (!app.expo) throw new IasError(`no app.json in ${dir}`, { fix: 'eas credentials needs the app.json of the Expo app: run it in the folder of the app, or pass --project' });
+  const easProject = easProjectOf(app, values);
+  if (!easProject) throw new IasError('app.json does not name its EAS project (extra.eas.projectId)', { fix: 'pass --eas-project <id> and --owner <account>: eas project:info or expo.dev › the project shows them' });
+  const [existing] = preparedFolders(dir, env);
+  const folder = writeFolder(app, easProject, { env, folder: existing?.dir });
+  const download = downloadIn(folder);
+  const profile = storeProfile(app.eas);
+  const internal = internalProfiles(app.eas);
+  const platforms = platformsOf(app.expo);
+  const commands = platforms.map((platform) => `EAS_NO_VCS=1 eas credentials -p ${platform}`);
+  output.log(`${existing ? 'Refreshed' : 'Prepared'} ${folder} for eas credentials (mode 700, outside the project): its app.json names the EAS project ${easProjectName(easProject)}, its eas.json has the build profiles${existsSync(join(folder, 'node_modules')) ? ', and node_modules is a link to the app\'s' : ''}.`);
+  if (!existsSync(join(dir, 'node_modules'))) output.warn(`there is no node_modules in ${dir}: if eas credentials cannot read the project there, run npm install in the app and ias migrate eas prepare again`);
+  if (download.length > 0) output.log(`It already holds a download (${download.join(', ')}): ${iasCommand(context, 'import', shellWord(folder))} seals it into the vault and deletes it.`);
+  output.log(`
+eas credentials writes credentials.json and credentials/ in the folder it runs in. It handles secrets and asks
+questions, so you run it, from that folder (EAS_NO_VCS=1: it is not a git repository):
+  cd ${shellWord(folder)}
+${commands.map((command) => `  ${command}`).join('\n')}
+In each: the profile ${profile} › «credentials.json: Upload/Download credentials between EAS servers and your local json» › «Download credentials from EAS to credentials.json».
+- Never «Download existing keystore»: it prints the passwords.
+- Before leaving, note what its summary shows besides: an App Store Connect API key, a push key, a Google service account (ias migrate eas checklist asks about them).${internal.length > 0 ? `\n- ${internal.length === 1 ? `The profile ${internal[0]} may have credentials of its own` : `The profiles ${internal.join(', ')} may have credentials of their own`} (ad hoc): each download replaces credentials.json, so import after each one.` : ''}
+Then, from the app:
+  ${iasCommand(context, 'import', shellWord(folder), '--dry-run')}
+  ${iasCommand(context, 'import', shellWord(folder))}`);
+  return { folder, reused: Boolean(existing), eas_project: easProject, download, profile, commands: [`cd ${shellWord(folder)}`, ...commands] };
+}
+
+/** The metadata of the download, without its secrets, and the problems for the app of app.json. */
+function inspectDownload(folder, expo) {
+  let found;
+  try {
+    found = inspect.inspectEasCredentials(folder);
+  } catch (error) {
+    if (error instanceof inspect.CredentialError) throw new IasError(`credentials.json: ${error.message}`, { fix: 'download it again with eas credentials, and check that the files it names are there', code: 'credential_unreadable' });
+    if (error instanceof TypeError) throw new IasError('credentials.json is not one eas credentials wrote', { fix: 'download it again with eas credentials › Download credentials from EAS to credentials.json', code: 'credential_unreadable' });
+    throw error;
+  }
+  const problems = [];
+  const notes = [];
+  if (found.ios) {
+    const { certificate, profile } = found.ios;
+    const teamId = expo?.ios?.appleTeamId;
+    const bundleId = expo?.ios?.bundleIdentifier;
+    problems.push(...inspect.checkIos({ certificate, profile }, { teamId, bundleId, type: profile.type }));
+    if (!teamId && bundleId && profile.bundleId !== bundleId) problems.push(`the profile is for ${profile.bundleId}, not ${bundleId}`);
+    if (profile.type !== 'app-store') notes.push(`the profile is ${profile.type}: it signs internal builds; store builds need an App Store profile (download the one of the store profile, or make one in Apple Developer and ias credentials import --profile it)`);
+    notes.push(`the certificate is the team's (${certificate.team}): other apps of the team may sign with it, so it goes to the team's credentials, and is skipped if it is already there`);
+  }
+  if (found.android) problems.push(...inspect.checkAndroid(found.android.keystore));
+  return { found, problems, notes };
+}
+
+function showDownload(folder, { found, problems, notes }, output) {
+  output.log(`credentials.json in ${folder}, without its secrets:`);
+  if (found.ios) {
+    const { certificate, profile } = found.ios;
+    output.log(`  ${LABELS.apple_distribution_certificate}  «${certificate.commonName}», team ${certificate.team}, serial ${certificate.serial}, SHA-1 ${certificate.sha1}, until ${day(certificate.expires)}`);
+    output.log(`  ${LABELS.apple_provisioning_profile}      «${profile.name}», ${profile.type}, UUID ${profile.uuid}, ${profile.applicationIdentifier}, until ${day(profile.expires)}${profile.devices > 0 ? `, ${profile.devices} devices` : ''}`);
+    output.log(`    entitlements: ${Object.keys(profile.entitlements).sort().join(', ') || 'none'}`);
+  }
+  if (found.android) {
+    const { keystore } = found.android;
+    output.log(`  ${LABELS.android_upload_keystore}       alias ${keystore.alias}, SHA-1 ${keystore.sha1}, until ${day(keystore.expires)}`);
+    output.log(`    SHA-256 ${keystore.sha256}`);
+    output.log('    Play Console › the app › Test and release › App integrity › App signing › «Upload key certificate» must show this SHA-256.');
+  }
+  for (const note of notes) output.log(`  note: ${note}`);
+  for (const problem of problems) output.warn(`credentials.json: ${problem}`);
+}
+
+/** The types of credential a download holds. */
+const typesOf = (found) => [...(found.ios ? ['apple_distribution_certificate', 'apple_provisioning_profile'] : []), ...(found.android ? ['android_upload_keystore'] : [])];
+
+/** What ias credentials import said it did with each type, from its lines (when it stopped before returning). */
+function fromLines(lines) {
+  const done = {};
+  for (const line of lines) {
+    const imported = /^imported ([a-z_]+) «.*» as (\S+),/.exec(line);
+    const skipped = /^([a-z_]+) «.*» is already in the vault as (\S+) /.exec(line);
+    if (imported) done[imported[1]] = { state: 'imported', id: imported[2] };
+    if (skipped) done[skipped[1]] = { state: 'already in the vault', id: skipped[2] };
+  }
+  return done;
+}
+
+/** What import did with each type, from the result of ias credentials import. */
+function fromResult(result) {
+  const done = {};
+  for (const entry of result?.credentials ?? []) done[entry.type] = { state: entry.skipped ? 'already in the vault' : entry.dry_run ? 'sealed, not sent (dry run)' : 'imported', id: entry.id };
+  return done;
+}
+
+/**
+ * Runs `fn` if this process is interrupted, and then exits: the download must not stay because of Ctrl-C. It goes
+ * before the handler of bin/ias.mjs, which exits at once.
+ */
+function onInterrupt(fn) {
+  const handler = (signal) => {
+    const said = fn();
+    process.stderr.write(`\nias: interrupted${said ? `: ${said}` : ''}\n`);
+    cleanup();
+    process.exit(signal === 'SIGINT' ? 130 : 143);
+  };
+  process.prependOnceListener('SIGINT', handler);
+  process.prependOnceListener('SIGTERM', handler);
+  return () => {
+    process.off('SIGINT', handler);
+    process.off('SIGTERM', handler);
+  };
+}
+
+export async function importDownload(context) {
+  const { values, positionals, env, output, cwd } = context;
+  const dir = projectDir(context);
+  const given = positionals[1];
+  if (!given) {
+    const waiting = preparedFolders(dir, env).filter((folder) => folder.download.length > 0).map((folder) => folder.dir);
+    throw new UsageError('import needs the folder of the download', { fix: waiting.length > 0 ? `the folders of ias migrate eas prepare with one: ${waiting.join(', ')}` : 'ias migrate eas prepare makes it and says how to download into it' });
+  }
+  const folder = resolve(cwd, given);
+  if (!existsSync(folder) || !statSync(folder).isDirectory()) throw new IasError(`there is no folder ${given}`, { fix: 'give the folder ias migrate eas prepare printed' });
+  if (isInside(dir, folder)) throw new IasError(`${given} is inside the project`, { fix: `nothing was read or deleted: move credentials.json and credentials/ to the folder of ias migrate eas prepare (mv) and import from there, so that git never sees them`, code: 'download_in_project' });
+  if (!existsSync(join(folder, 'credentials.json'))) throw new IasError(`there is no credentials.json in ${folder}`, { fix: 'download it there with eas credentials (ias migrate eas prepare says how)', code: 'download_missing' });
+  const marker = readMarker(folder);
+  const app = readApp(dir);
+  if (marker && !isInside(marker.project, dir)) throw new IasError(`${folder} was prepared for ${marker.project}, not for ${dir}`, { fix: `nothing was read or deleted: import it from that app (--project ${shellWord(marker.project)})`, code: 'download_of_another_app' });
+  if (statSync(folder).mode & 0o077) output.warn(`other users of this Mac can open ${folder}: the folders of ias migrate eas prepare are mode 700`);
+
+  // What is needed before reading the download: the application and a token. Stopping here leaves it as it is.
+  const project = loadProject(dir);
+  const application = applicationOf(context, project);
+  connect(context, project);
+  const dryRun = Boolean(values['dry-run']);
+  const lines = [];
+  const recorded = { ...output, log: (line) => (lines.push(line), output.log(line)) };
+  let inspected;
+  let result;
+  let failure;
+  const stop = onInterrupt(() => {
+    if (dryRun) return `the download stays in ${folder}`;
+    const { removed, failed } = removeDownload(folder);
+    return `deleted the download from ${folder}${removed.length > 0 ? ` (${removed.join(', ')})` : ''}${failed.length > 0 ? `; delete ${failed.join(', ')} yourself` : ''}`;
+  });
+  try {
+    inspected = inspectDownload(folder, app.expo);
+    showDownload(folder, inspected, output);
+    result = await credentialsImport.run({
+      ...context,
+      output: recorded,
+      positionals: [],
+      values: { project: values.project, app: application, eas: folder, force: values.force, 'dry-run': values['dry-run'], item: values.item, json: values.json },
+    });
+  } catch (error) {
+    failure = error;
+  } finally {
+    stop();
+  }
+
+  const types = inspected ? typesOf(inspected.found) : [];
+  const done = failure ? fromLines(lines) : fromResult(result);
+  const pending = types.filter((type) => !done[type]);
+  let cleaned = null;
+  if (dryRun) {
+    output.log(`dry run: nothing was sent, and the download stays in ${folder} for ${iasCommand(context, 'import', shellWord(folder))}.`);
+  } else {
+    cleaned = removeDownload(folder);
+    const say = failure ? output.warn : output.log;
+    say(`deleted the download from ${folder}${cleaned.removed.length > 0 ? ` (${cleaned.removed.join(', ')})` : ''}${failure ? ', although the import stopped' : ''}.`);
+    if (cleaned.failed.length > 0) output.warn(`could not delete ${cleaned.failed.join(', ')} in ${folder}: delete ${cleaned.failed.length === 1 ? 'it' : 'them'} yourself (rm -rf), since ${cleaned.failed.length === 1 ? 'it holds' : 'they hold'} secrets`);
+    if (cleaned.left.length > 0) output.warn(`${folder} still has ${cleaned.left.join(', ')}, which ias did not write: delete what holds a secret`);
+  }
+  if (failure) {
+    const imported = Object.entries(done).map(([type, { state, id }]) => `${LABELS[type] ?? type} ${state} (${id})`);
+    output.warn(`import stopped: ${imported.length > 0 ? `${imported.join('; ')}; ` : 'nothing was imported; '}${pending.length > 0 ? `left: ${pending.map((type) => LABELS[type] ?? type).join(', ')}. ` : ''}${dryRun ? '' : 'Download again with eas credentials and import again: what is in the vault already is skipped.'}`);
+    throw failure;
+  }
+  if (!dryRun) output.log(`Next: ${iasCommand(context, 'version')} brings the build numbers of EAS (${iasCommand(context)} says where the move is).`);
+  return {
+    folder,
+    application,
+    dry_run: dryRun,
+    found: Object.fromEntries(Object.entries(inspected.found).map(([platform, value]) => [platform, platform === 'ios' ? { certificate: value.certificate, profile: value.profile } : { keystore: value.keystore }])),
+    problems: inspected.problems,
+    credentials: result?.credentials ?? [],
+    deleted: cleaned?.removed ?? [],
+    left: cleaned?.left ?? null,
+  };
+}

package/src/commands/migrate/eas-cli.mjs

@@ -0,0 +1,153 @@
+// eas-cli for ias migrate eas. ias runs it only where it reads nothing secret into a terminal and asks nothing:
+// build:version:get and env:list, without a terminal (eas-cli is then non-interactive), their output read here and
+// never printed. eas credentials and eas env:pull handle secrets and ask questions, so the person runs them; this reads
+// the .env that env:pull writes. What is read was checked against eas-cli 24.14.
+import { spawnSync } from 'node:child_process';
+import { IasError } from '../../errors.mjs';
+
+const ANSI = /\u001b\[[0-9;]*[A-Za-z]/g;
+const NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const BUILD_NUMBER = /^[1-9][0-9]{0,9}$/;
+
+/** The environment of eas: this one without IAS's variables (an IAS token is none of eas's business) and without colours. */
+export function easEnvironment(env, { noVcs = false } = {}) {
+  const clean = Object.fromEntries(Object.entries(env).filter(([name]) => !name.startsWith('IAS_')));
+  return { ...clean, NO_COLOR: '1', FORCE_COLOR: '0', ...(noVcs ? { EAS_NO_VCS: '1' } : {}) };
+}
+
+/** Why eas failed: the last line it wrote that says more than «Error: <command> command failed.». */
+function reasonOf(text) {
+  const lines = String(text ?? '').replace(ANSI, '').split('\n').map((line) => line.trim()).filter(Boolean);
+  return (lines.filter((line) => !/^(Error: )?\S+ command failed\.?$/.test(line)).at(-1) ?? lines.at(-1))?.slice(0, 300);
+}
+
+/**
+ * Runs eas with `args` in `cwd`, with no terminal: stdin closed and its output read here. Returns stdout. Fails with
+ * the last line eas wrote to stderr, never with its stdout, which may hold values.
+ */
+export function runEas(args, { cwd, env, noVcs = false, fix }) {
+  const command = `eas ${args[0]}`;
+  const result = spawnSync('eas', args, { cwd, env: easEnvironment(env, { noVcs }), encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 16 * 1024 * 1024, timeout: 180_000 });
+  if (result.error?.code === 'ENOENT') throw new IasError(`${command}: eas-cli is not installed here`, { fix, code: 'eas_missing' });
+  if (result.error) throw new IasError(`${command}: ${result.error.message}`, { fix, code: 'eas_failed' });
+  if (result.status !== 0) throw new IasError(`${command} failed: ${reasonOf(result.stderr) ?? `exit ${result.status}`}`, { fix, code: 'eas_failed' });
+  return result.stdout.replace(ANSI, '');
+}
+
+/** The JSON document in `text`, or undefined. */
+function jsonIn(text) {
+  const trimmed = text.trim();
+  for (const start of [0, trimmed.search(/[[{]/)]) {
+    if (start < 0) continue;
+    try {
+      return JSON.parse(trimmed.slice(start));
+    } catch {
+      // not from here
+    }
+  }
+  return undefined;
+}
+
+/** A build number as IAS keeps it (a whole number from 1), or null. */
+export function buildNumber(value) {
+  const number = typeof value === 'string' && BUILD_NUMBER.test(value.trim()) ? Number(value) : value;
+  return Number.isInteger(number) && number >= 1 && number <= 2147483647 ? number : null;
+}
+
+/**
+ * The numbers of `eas build:version:get --json`: { buildNumber: "3", versionCode: "3" }, each only when EAS has one.
+ * Returns { ios, android } (numbers or null) and `raw`, what EAS said, for a number IAS cannot take (iOS allows 1.0.3).
+ */
+export function parseVersions(text) {
+  const json = jsonIn(text);
+  if (!json || typeof json !== 'object' || Array.isArray(json)) throw new IasError('eas build:version:get did not print the JSON of --json', { fix: 'update eas-cli, or run eas build:version:get -p all yourself and give the numbers: ias migrate eas version --ios <n> --android <n>', code: 'eas_output_unknown' });
+  const raw = { ios: json.buildNumber ?? json.ios ?? null, android: json.versionCode ?? json.android ?? null };
+  return { ios: buildNumber(raw.ios), android: buildNumber(raw.android), raw };
+}
+
+/** The visibility of a variable in EAS, in lowercase: public, sensitive or secret. */
+const visibilityOf = (value) => String(value ?? '').toLowerCase() || 'public';
+
+/** A variable of eas env:list as ias migrate eas uses it. */
+function variable({ name, value, visibility, type, scope }) {
+  const file = /file/i.test(String(type ?? ''));
+  const shown = typeof value === 'string' && !/^\*{5}( \(This is a .*\))?$/.test(value) ? value : null;
+  const secret = visibilityOf(visibility) === 'secret';
+  return { name, value: file || secret ? null : shown, visibility: visibilityOf(visibility), file, scope: scope ? String(scope).toLowerCase() : 'project' };
+}
+
+/** The fields of a variable in `eas env:list --format long`, in their order. */
+const LONG_FIELDS = ['ID', 'Name', 'Value', 'Scope', 'Visibility', 'Environments', 'type', 'Created at', 'Updated at'];
+
+/** One variable of the long format: its fields in their order, and a value that may take several lines. */
+function longBlock(block) {
+  const lines = block.split('\n');
+  const start = lines.findIndex((line) => /^ID +\S/.test(line));
+  if (start === -1) return undefined;
+  // Every label is padded to the longest one and followed by two spaces: the values start at the same column.
+  const column = /^ID +/.exec(lines[start])[0].length;
+  const fields = {};
+  let at = -1;
+  for (const line of lines.slice(start)) {
+    const next = LONG_FIELDS.slice(at + 1).findIndex((label) => line.startsWith(`${label} `) || line === label);
+    if (next !== -1) {
+      at += next + 1;
+      fields[LONG_FIELDS[at]] = line.slice(column);
+    } else if (LONG_FIELDS[at] === 'Value') {
+      fields.Value += `\n${line}`;
+    }
+  }
+  if (!fields.Name) return undefined;
+  return variable({ name: fields.Name.trim(), value: fields.Value, visibility: fields.Visibility?.trim(), type: fields.type?.trim(), scope: fields.Scope?.trim() });
+}
+
+/**
+ * The variables of one environment as `eas env:list --format long` prints them (eas-cli 24 has no --json there):
+ * blocks separated by ———, with the fields ID, Name, Value, Scope, Visibility, Environments, type… A later eas-cli that
+ * prints JSON is read too. Returns [{ name, value, visibility, file, scope }]; value is null when eas could not show
+ * it: a secret (only EAS's builders read those), or a file.
+ */
+export function parseVariableList(text) {
+  const trimmed = text.trim();
+  if (trimmed.startsWith('[') || trimmed.startsWith('{')) {
+    const json = jsonIn(trimmed);
+    const list = Array.isArray(json) ? json : (json?.variables ?? json?.data ?? []);
+    return list.filter((entry) => typeof entry?.name === 'string').map((entry) => variable(entry));
+  }
+  if (/No variables found/i.test(trimmed)) return [];
+  return trimmed.split(/\n\s*———\s*\n/).map(longBlock).filter(Boolean);
+}
+
+/** A value of a .env line: in double quotes with their escapes, in single quotes as it is, or bare and trimmed. */
+function unquote(text) {
+  const value = text.trim();
+  if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) return value.slice(1, -1).replace(/\\([nrt"\\])/g, (_, char) => ({ n: '\n', r: '\r', t: '\t' })[char] ?? char);
+  if (value.length >= 2 && value.startsWith("'") && value.endsWith("'")) return value.slice(1, -1);
+  return value;
+}
+
+/**
+ * The .env that `eas env:pull` writes: «# Environment: production», then NAME=value lines as they are, a secret as
+ * «# NAME=***** (secret)» (only EAS's builders read it), and a file variable as the path of the file it wrote in
+ * .eas/.env/. Returns { environment, variables: [{ name, value }], secret: [names], files: [{ name, path }], unread }.
+ */
+export function parseEnvFile(text) {
+  const result = { environment: /^# Environment: (\S+)/m.exec(text)?.[1]?.toLowerCase() ?? null, variables: [], secret: [], files: [], unread: 0 };
+  for (const line of text.split(/\r?\n/)) {
+    const hidden = /^\s*#\s*([A-Za-z_][A-Za-z0-9_]*)=\*{5} \(secret\)\s*$/.exec(line);
+    if (hidden) {
+      result.secret.push(hidden[1]);
+      continue;
+    }
+    if (/^\s*(#|$)/.test(line)) continue;
+    const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/.exec(line);
+    if (!match || !NAME.test(match[1])) {
+      result.unread += 1;
+      continue;
+    }
+    const value = unquote(match[2]);
+    if (/(^|[\\/])\.eas[\\/]\.env[\\/]/.test(value)) result.files.push({ name: match[1], path: value });
+    else result.variables.push({ name: match[1], value });
+  }
+  return result;
+}

package/src/commands/migrate/index.mjs

@@ -0,0 +1,73 @@
+// ias migrate eas: leave EAS for IAS step by step (track 4D of PLAN-APPLICATION-SERVICES.md), as jscheduler-app did by
+// hand on 19 October 2026 (its docs/local-builds.md): ias.json from eas.json, a folder outside the project for
+// eas credentials, the credentials sealed into the vault, the build numbers and the variables of EAS on the server, and
+// what is left to do in expo.dev and the stores. Each step can run again without harm and says what it did and what is
+// left; without a step, it says where the move is. The router has two levels, so the step is an argument.
+import { UsageError } from '../../errors.mjs';
+import { importDownload, prepare } from './credentials.mjs';
+import { version } from './numbers.mjs';
+import { profiles } from './profiles.mjs';
+import { checklist, status } from './survey.mjs';
+import { variables } from './variables.mjs';
+
+/** Each step, with the options it takes besides --project, --json and --help. */
+const STEPS = {
+  status: { run: status, options: ['app'] },
+  profiles: { run: profiles, options: ['app', 'server', 'force', 'dry-run'] },
+  prepare: { run: prepare, options: ['eas-project', 'owner'] },
+  import: { run: importDownload, options: ['app', 'force', 'dry-run', 'item'], folder: true },
+  version: { run: version, options: ['app', 'profile', 'ios', 'android', 'dry-run'] },
+  env: { run: variables, options: ['app', 'environment', 'env-file', 'force', 'dry-run', 'item'] },
+  checklist: { run: checklist, options: ['app'] },
+};
+const GLOBAL = ['project', 'json', 'help'];
+
+function run(context) {
+  const name = context.positionals[0] ?? 'status';
+  const step = STEPS[name];
+  const foreign = Object.keys(context.values).filter((option) => context.values[option] !== undefined && !GLOBAL.includes(option) && !step.options.includes(option));
+  if (foreign.length > 0) throw new UsageError(`--${foreign[0]} does not go with ias migrate eas ${name}`, { fix: `it takes ${step.options.map((option) => `--${option}`).join(', ') || 'no options'}; ias migrate eas --help says which step takes which` });
+  if (context.positionals[1] !== undefined && !step.folder) throw new UsageError(`ias migrate eas ${name} takes no folder`, { fix: 'only import does: ias migrate eas import <folder>' });
+  return step.run(context);
+}
+
+export default {
+  name: 'migrate',
+  summary: 'Leave another service for IAS, step by step: eas',
+  subcommands: [
+    {
+      name: 'eas',
+      summary: 'Leave EAS: ias.json, the signing credentials, the build numbers, the variables and what is left in expo.dev',
+      description: [
+        'Steps, in their order (each can run again without harm, and says what it did and what is left):',
+        '  (none)     where the move is: what each step finds done, and the next one',
+        '  profiles   the build and submit profiles of eas.json into ias.json, and what has no equivalent [--app, --server, --force, --dry-run]',
+        '  prepare    a folder outside the project (mode 700) where you run eas credentials, and how [--eas-project, --owner]',
+        '  import     <folder>: credentials.json of eas credentials sealed into the vault, as ias credentials import --eas does; the download is then deleted, also when it fails half way (not with --dry-run) [--force, --dry-run, --item]',
+        '  version    the last build numbers of EAS (eas build:version:get, run here without a terminal) to the server; they never go down [--ios, --android, --profile, --dry-run]',
+        '  env        the variables of EAS (eas env:list, or the .env of eas env:pull with --env-file): EXPO_PUBLIC_* plain, the rest sealed [--environment, --env-file, --force, --dry-run, --item]',
+        '  checklist  what is left in expo.dev, the stores and the app; ias deletes nothing',
+        'eas credentials and eas env:pull handle secrets and ask questions: you run them. Nothing prints a password or a key.',
+      ].join('\n'),
+      positionals: [
+        { name: 'step', optional: true, description: `One of ${Object.keys(STEPS).join(', ')} (status when left out).`, pattern: new RegExp(`^(${Object.keys(STEPS).join('|')})$`) },
+        { name: 'folder', optional: true, description: 'import: the folder of ias migrate eas prepare, with the download of eas credentials.' },
+      ],
+      options: {
+        app: { type: 'string', value: '<code>', description: 'The application in IAS (app of ias.json by default; profiles writes it in a new ias.json).' },
+        server: { type: 'string', value: '<origin>', description: 'profiles: the server of IAS in ias.json, such as https://sync.domibi.com.' },
+        'eas-project': { type: 'string', value: '<id>', description: 'prepare: the id of the EAS project, when app.json no longer names it (extra.eas.projectId).' },
+        owner: { type: 'string', value: '<account>', description: 'prepare: the Expo account of the project, when app.json does not say it.' },
+        profile: { type: 'string', value: '<profile>', description: 'version: the build profile of eas.json whose numbers to bring (production by default).' },
+        ios: { type: 'string', value: '<number>', description: 'version: the last iOS build number, instead of asking eas.' },
+        android: { type: 'string', value: '<number>', description: 'version: the last Android version code, instead of asking eas.' },
+        environment: { type: 'string', value: '<environment>', description: 'env: development, preview or production (all three from eas env:list by default; required with --env-file).' },
+        'env-file': { type: 'string', value: '<file>', description: 'env: the .env of eas env:pull, deleted afterwards when it is in the folder of prepare.' },
+        force: { type: 'boolean', description: 'profiles: take eas.json\'s profiles over those of ias.json; import: import credentials already in the vault or with problems; env: replace variables already in IAS.' },
+        'dry-run': { type: 'boolean', description: 'Read and check everything, and send or write nothing; import keeps the download.' },
+        item: { type: 'string', value: '<op://vault/item>', description: 'import and env: the 1Password item of the vault, to seal.' },
+      },
+      run,
+    },
+  ],
+};

package/src/commands/migrate/numbers.mjs

@@ -0,0 +1,85 @@
+// ias migrate eas version: the last build numbers of EAS to the server of IAS (PUT /apps/{code}/build-numbers,
+// docs/technical/runner-api.md §4.1), so that the next build with autoIncrement goes above every number a store has seen. They
+// come from --ios and --android, or from eas build:version:get, which ias runs without a terminal (it reads no secret)
+// when eas.json says appVersionSource remote; app.json's count too, the highest wins, and a number on the server never
+// goes down.
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { loadProject } from '../../config.mjs';
+import { IasError } from '../../errors.mjs';
+import { applicationOf, connect } from '../../manage.mjs';
+import { buildNumberOf } from '../build/source.mjs';
+import { buildNumber, parseVersions, runEas } from './eas-cli.mjs';
+import { iasCommand, platformsOf, preparedFolders, projectDir, readApp, storeProfile } from './project.mjs';
+
+const NAMES = { ios: 'iOS', android: 'Android' };
+
+/**
+ * Where eas can run for the app: its own folder if app.json names the EAS project, or else the folder of prepare,
+ * whose app.json does (EAS_NO_VCS there: it is not a repository). Undefined if neither.
+ */
+export function easFolder(app, env) {
+  if (app.expo?.extra?.eas?.projectId) return { dir: app.dir, noVcs: !existsSync(join(app.dir, '.git')) };
+  const [prepared] = preparedFolders(app.dir, env);
+  return prepared ? { dir: prepared.dir, noVcs: true } : undefined;
+}
+
+/** The numbers of EAS for the store profile, with eas build:version:get. */
+function easNumbers(app, { env, profile }) {
+  const fix = 'run eas build:version:get -p all yourself (logged in to Expo) and give its numbers: ias migrate eas version --ios <n> --android <n>';
+  const folder = easFolder(app, env);
+  if (!folder) throw new IasError('app.json does not name its EAS project, so eas cannot read its numbers here', { fix: `ias migrate eas prepare --eas-project <id> makes a folder where it can; or ${fix}` });
+  return parseVersions(runEas(['build:version:get', '--platform', 'all', '--profile', profile, '--json', '--non-interactive'], { cwd: folder.dir, env, noVcs: folder.noVcs, fix }));
+}
+
+export async function version(context) {
+  const { values, env, output } = context;
+  const dir = projectDir(context);
+  const app = readApp(dir);
+  const project = loadProject(dir);
+  const application = applicationOf(context, project);
+  const platforms = platformsOf(app.expo);
+  const given = Object.fromEntries(['ios', 'android'].filter((platform) => values[platform] !== undefined).map((platform) => {
+    const number = buildNumber(values[platform]);
+    if (number === null) throw new IasError(`--${platform} takes a whole number from 1, not «${values[platform]}»`, { fix: 'the last build number EAS gave, as eas build:version:get shows it' });
+    return [platform, number];
+  }));
+  const explicit = Object.keys(given).length > 0;
+  const profile = values.profile ?? storeProfile(app.eas);
+  // With appVersionSource local, EAS took the numbers from app.json, and eas build:version:get refuses to answer.
+  const remote = app.eas?.cli?.appVersionSource === 'remote';
+  const eas = explicit || !remote ? null : easNumbers(app, { env, profile });
+  const appJson = Object.fromEntries(platforms.map((platform) => [platform, app.expo ? buildNumberOf(app.expo, platform) : null]));
+  const client = connect(context, project);
+  const { data: current } = await client.request('GET', `/apps/${application}/build-numbers`);
+  const raise = {};
+  const rows = [];
+  output.log(`Build numbers of ${application}${explicit ? '' : remote ? ` (EAS: profile ${profile})` : ' (appVersionSource is not remote in eas.json: EAS took them from app.json)'}:`);
+  for (const platform of explicit ? Object.keys(given) : platforms) {
+    const sources = explicit ? [given[platform]] : [eas?.[platform] ?? null, appJson[platform]];
+    const wanted = Math.max(0, ...sources.filter((number) => number !== null)) || null;
+    const now = current?.[platform] ?? null;
+    const said = explicit ? `--${platform} ${given[platform]}` : `${eas ? `EAS ${eas.raw[platform] ?? 'none'}, ` : ''}app.json ${appJson[platform] ?? 'none'}`;
+    let outcome;
+    if (eas && eas.raw[platform] !== null && eas[platform] === null) output.warn(`the ${NAMES[platform]} build number of EAS («${eas.raw[platform]}») is not a whole number, which IAS needs: give the last one with --${platform} <n>`);
+    if (wanted === null) outcome = `nothing to bring (--${platform} <n> gives it); IAS ${now ?? 'none yet'}`;
+    else if (now !== null && now >= wanted) outcome = `IAS already ${now}: left as it is (it never goes down)`;
+    else {
+      raise[platform] = wanted;
+      outcome = `IAS ${now ?? 'none yet'} → ${wanted}`;
+    }
+    rows.push({ platform, eas: eas?.[platform] ?? null, app_json: explicit ? null : appJson[platform], given: given[platform] ?? null, server: now, set: raise[platform] ?? null });
+    output.log(`  ${NAMES[platform].padEnd(8)} ${said}: ${outcome}`);
+  }
+  let after = current;
+  if (Object.keys(raise).length > 0 && !values['dry-run']) {
+    after = (await client.request('PUT', `/apps/${application}/build-numbers`, { json: raise })).data;
+    output.log(`${application}: the last build numbers are now iOS ${after.ios ?? 'none yet'}, Android ${after.android ?? 'none yet'}; a build with autoIncrement takes the next one.`);
+  } else if (Object.keys(raise).length > 0) {
+    output.log(`dry run: would set ${Object.entries(raise).map(([platform, number]) => `${NAMES[platform]} ${number}`).join(' and ')}; nothing sent.`);
+  } else {
+    output.log(`${application}: nothing to raise.`);
+  }
+  if (!explicit && !values['dry-run']) output.log(`Next: ${iasCommand(context, 'env')} brings the variables of EAS.`);
+  return { application, profile: eas ? profile : null, platforms: rows, build_numbers: after, dry_run: Boolean(values['dry-run']) };
+}