@imagina-build/ias-cli 0.0.0 → 0.1.0

package/src/commands/migrate/profiles.mjs

@@ -0,0 +1,174 @@
+// ias migrate eas profiles: the build and submit profiles of eas.json into ias.json, with the conversion of ias init.
+// A new ias.json is written whole; an existing one only gains the profiles it lacks (--force takes eas.json's for those
+// that differ), so running it again changes nothing. It says what has no equivalent in IAS and what to do instead.
+import { existsSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { CONFIG_FILE, loadProject } from '../../config.mjs';
+import { IasError, UsageError } from '../../errors.mjs';
+import { validate } from '../../schema.mjs';
+import { writtenSecrets } from '../../secrets.mjs';
+import { initialConfig } from '../init/index.mjs';
+import { iasCommand, projectDir, readApp } from './project.mjs';
+
+const SERVER = /^https?:\/\/[^/?#\s]+\/?$/;
+const TOOLCHAIN = 'the runners build with the tools of their Mac: there is no version per profile';
+const VAULT_ASC = 'ias submit sends with the App Store Connect API key of the vault: ias credentials import --p8 AuthKey_<id>.p8 --issuer-id <uuid> --team-id <team>';
+const METADATA = 'EAS Metadata has no equivalent: edit the listing in App Store Connect';
+
+/** What IAS does instead of a field of eas.json, by its name. A function gets the value. */
+const NOTES = {
+  env: (value) => `${Object.keys(value ?? {}).join(', ') || 'none'}: IAS keeps variables per environment (ias env set), not per profile`,
+  credentialsSource: () => 'IAS signs with the credentials of its vault (ias migrate eas import): there is no local credentials.json',
+  node: () => TOOLCHAIN,
+  yarn: () => TOOLCHAIN,
+  pnpm: () => TOOLCHAIN,
+  bun: () => TOOLCHAIN,
+  corepack: () => TOOLCHAIN,
+  cocoapods: () => TOOLCHAIN,
+  fastlane: () => TOOLCHAIN,
+  bundler: () => TOOLCHAIN,
+  ndk: () => TOOLCHAIN,
+  image: () => 'the runners are Macs of the team: there are no images or machine sizes',
+  resourceClass: () => 'the runners are Macs of the team: there are no images or machine sizes',
+  cache: () => 'IAS has no build cache',
+  prebuildCommand: () => 'the runner runs expo prebuild itself: there is no command of your own',
+  buildArtifactPaths: () => 'the runner keeps the IPA or AAB, the dSYMs or the mapping and a result file: there are no paths of your own',
+  applicationArchivePath: () => 'the runner keeps the IPA or AAB, the dSYMs or the mapping and a result file: there are no paths of your own',
+  config: () => 'EAS custom builds (.eas/build/*.yml) have no equivalent',
+  releaseChannel: () => 'classic updates: IAS uses channel',
+  withoutCredentials: () => 'an IAS build always signs: internal ones with ad hoc or development credentials',
+  buildConfiguration: () => 'the runner builds the Release configuration of the app\'s scheme',
+  scheme: () => 'the runner builds the Release configuration of the app\'s scheme',
+  enterpriseProvisioning: () => 'IAS has no enterprise distribution',
+  autoIncrement: () => 'autoIncrement goes per profile in ias.json, not per platform',
+  gradleCommand: () => 'the runner runs bundleRelease or assembleRelease after the format of the profile: there is no command of your own',
+  appleId: () => VAULT_ASC,
+  ascApiKeyPath: () => VAULT_ASC,
+  ascApiKeyId: () => VAULT_ASC,
+  ascApiKeyIssuerId: () => VAULT_ASC,
+  serviceAccountKeyPath: (value) => `ias submit sends with the Google service account of the vault: ias credentials import --service-account ${value ?? '<file>'}; then keep the file in 1Password and take it out of the project`,
+  sku: () => METADATA,
+  language: () => METADATA,
+  companyName: () => METADATA,
+  appName: () => METADATA,
+  metadataPath: () => METADATA,
+  bundleIdentifier: () => 'ias submit takes the identifier of the build',
+  applicationId: () => 'ias submit takes the identifier of the build',
+};
+
+/** What IAS does instead of each setting of eas.json › cli. */
+const CLI_NOTES = {
+  appVersionSource: (value) => (value === 'remote' ? 'EAS kept the build numbers: ias migrate eas version brings them, and the server of IAS keeps them from then on (autoIncrement)' : 'the build numbers were in app.json: ias migrate eas version takes them to the server of IAS, which keeps them from then on (autoIncrement)'),
+  requireCommit: () => 'ias build always builds a commit of a clean tree',
+  version: () => 'the version of eas-cli that eas.json asks for: ias does not need it',
+  promptToConfigurePushNotifications: () => 'IAS asks nothing about push: ias push credentials loads the APNs key and the FCM account',
+};
+
+/** The build hooks EAS runs from package.json (EAS build lifecycle), which the runners of IAS do not run. */
+const HOOKS = ['eas-build-pre-install', 'eas-build-post-install', 'eas-build-pre-upload-artifacts', 'eas-build-on-success', 'eas-build-on-error', 'eas-build-on-complete', 'eas-build-on-cancel'];
+
+/** The value at `path` (build.preview.env) of eas.json. */
+const valueAt = (eas, path) => path.split('.').reduce((value, key) => (value && typeof value === 'object' ? value[key] : undefined), eas);
+
+/**
+ * What has no equivalent in IAS, as [{ path, why }]: what ias init left out of eas.json (in the words of a move from
+ * EAS), what it kept but IAS treats otherwise, and the EAS files and hooks of the app.
+ */
+export function notesOf(app, leftOut) {
+  const notes = [];
+  for (const { path, why } of leftOut) {
+    if (path === 'eas.json › cli') {
+      for (const [key, value] of Object.entries(app.eas?.cli ?? {})) notes.push({ path: `eas.json › cli.${key}`, why: CLI_NOTES[key]?.(value) ?? 'eas-cli only' });
+      continue;
+    }
+    if (path === 'updates') {
+      notes.push({ path: 'app.json › updates.url', why: `${app.expo?.updates?.url ?? 'it'} is not an OTA project of IAS: changing it needs a new build (ias migrate eas checklist)` });
+      continue;
+    }
+    const key = path.split('.').at(-1);
+    const note = path.startsWith('build.') || path.startsWith('submit.') ? NOTES[key] : undefined;
+    notes.push({ path, why: note ? note(valueAt(app.eas, path)) : why });
+  }
+  for (const [name, profile] of Object.entries(app.eas?.submit ?? {})) {
+    const status = profile?.android?.releaseStatus;
+    if (status !== undefined && status !== 'draft') notes.push({ path: `submit.${name}.android.releaseStatus`, why: `IAS sends drafts only (decision D7): ias submit leaves «${status}» aside, and the release is sent for review in Play Console` });
+  }
+  for (const [name, profile] of Object.entries(app.eas?.build ?? {})) {
+    if (profile?.developmentClient || profile?.ios?.simulator) notes.push({ path: `build.${name}`, why: 'the runners of IAS do not build development clients or simulator builds yet: ias build --local does, on this Mac' });
+  }
+  for (const hook of HOOKS) {
+    if (app.packageJson?.scripts?.[hook] !== undefined) notes.push({ path: `package.json › scripts.${hook}`, why: 'the runners of IAS do not run the build hooks of EAS: move what it does to a config plugin of the app' });
+  }
+  if (existsSync(join(app.dir, '.easignore'))) notes.push({ path: '.easignore', why: 'ias build sends the commit with git archive: export-ignore in .gitattributes leaves files out instead' });
+  if (existsSync(join(app.dir, '.eas', 'build'))) notes.push({ path: '.eas/build', why: 'EAS custom builds have no equivalent' });
+  if (existsSync(join(app.dir, '.eas', 'workflows'))) notes.push({ path: '.eas/workflows', why: 'EAS Workflows have no equivalent yet (PLAN-APPLICATION-SERVICES.md, track 5C)' });
+  return notes;
+}
+
+export function profiles(context) {
+  const { values, output } = context;
+  const dir = projectDir(context);
+  const app = readApp(dir);
+  if (!app.eas) throw new IasError(`no eas.json in ${dir}`, { fix: 'there are no profiles to bring: write those of ias.json by hand (packages/cli/README.md §3), or run ias init' });
+  if (values.server !== undefined && !SERVER.test(values.server)) throw new UsageError(`--server takes the origin of IAS, not «${values.server}»`, { fix: 'such as https://sync.domibi.com, while ias.imagina.build does not answer' });
+  const project = loadProject(dir);
+  const current = project.config;
+  const { config: fresh, from, leftOut } = initialConfig(dir, { app: values.app ?? current?.app });
+  if (values.server !== undefined) {
+    fresh.server = new URL(values.server).origin;
+    from.server = '--server';
+  }
+  const added = [];
+  const same = [];
+  const kept = [];
+  let next;
+  if (!current) {
+    next = fresh;
+    for (const part of ['build', 'submit']) added.push(...Object.keys(fresh[part] ?? {}).map((name) => `${part}.${name}`));
+  } else {
+    next = structuredClone(current);
+    if (values.server !== undefined && next.server !== fresh.server) {
+      next.server = fresh.server;
+      added.push('server');
+    }
+    for (const part of ['build', 'submit']) {
+      for (const [name, profile] of Object.entries(fresh[part] ?? {})) {
+        const mine = next[part]?.[name];
+        if (mine === undefined || (values.force && !isDeepStrictEqual(mine, profile))) {
+          next[part] = { ...(next[part] ?? {}), [name]: profile };
+          added.push(`${part}.${name}${mine === undefined ? '' : ' (replaced)'}`);
+        } else if (isDeepStrictEqual(mine, profile)) {
+          same.push(`${part}.${name}`);
+        } else {
+          kept.push(`${part}.${name}`);
+        }
+      }
+    }
+  }
+  const problems = [...writtenSecrets(next), ...validate(next)];
+  if (problems.length > 0) throw new IasError(`the ias.json it would write is not valid (${problems.join('; ')})`, { fix: current ? 'fix ias.json (ias doctor checks it) and run it again' : 'this is a bug of ias: write ias.json by hand meanwhile' });
+  const notes = notesOf(app, leftOut);
+  const file = join(dir, CONFIG_FILE);
+  const write = added.length > 0 && !values['dry-run'];
+  if (write) writeFileSync(file, `${JSON.stringify(next, null, 2)}\n`);
+  const verb = values['dry-run'] ? 'would write' : 'wrote';
+  if (!current) {
+    output.log(`${verb} ${file}, new:`);
+    output.log(`  app     ${next.app}, from ${from.app}`);
+    output.log(`  server  ${next.server}, from ${from.server}`);
+    for (const part of ['build', 'submit']) if (next[part]) output.log(`  ${part.padEnd(7)} ${Object.keys(next[part]).join(', ')}, from eas.json`);
+  } else if (added.length > 0) {
+    output.log(`${verb} ${file}: ${added.join(', ')} from eas.json.`);
+  } else {
+    output.log(`${file} already has the profiles of eas.json: nothing to write.`);
+  }
+  if (same.length > 0 && added.length > 0) output.log(`already the same: ${same.join(', ')}`);
+  if (kept.length > 0) output.log(`kept those of ias.json, which differ from eas.json (--force takes eas.json's): ${kept.join(', ')}`);
+  if (notes.length > 0) {
+    output.log('without an equivalent in IAS:');
+    for (const { path, why } of notes) output.log(`  ${path}: ${why}`);
+  }
+  output.log(`Next: commit ias.json; then ${iasCommand(context, 'prepare')}.`);
+  return { file, written: write, created: !current, added, same, kept, notes, config: next };
+}

package/src/commands/migrate/project.mjs

@@ -0,0 +1,249 @@
+// What ias migrate eas reads from the app (app.json, eas.json, package.json) and the folders of prepare: outside the
+// project, mode 700, with only what eas-cli needs to recognise the EAS project, so that eas credentials downloads there
+// and never into the repository. Nothing here reads a secret; removeDownload deletes what eas wrote into such a folder.
+import { chmodSync, existsSync, lstatSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, rmdirSync, symlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { readExpo, readJson } from '../../config.mjs';
+import { IasError } from '../../errors.mjs';
+
+/** The file of a folder of prepare that says which app it is for. It holds no secret. */
+export const MARKER = 'ias-migrate-eas.json';
+const FORMAT = 'ias-migrate-eas-1';
+const PREFIX = 'ias-eas-';
+/** What prepare writes in its folder: anything else there came from eas. */
+export const SCAFFOLD = Object.freeze(['package.json', 'app.json', 'eas.json', 'node_modules', MARKER]);
+/** What eas credentials downloads: credentials.json and the files it names, by default in credentials/. */
+export const DOWNLOAD = Object.freeze(['credentials.json', 'credentials']);
+
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const ACCOUNT = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+const EAS_UPDATE = /^https:\/\/u\.expo\.dev\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\/?$/i;
+
+/** The folder of the app: --project, or the current one. */
+export const projectDir = ({ values, cwd }) => resolve(cwd, values.project ?? '.');
+
+/** The app in `dir`: the expo object of app.json, eas.json and package.json, each undefined when it is missing. */
+export function readApp(dir) {
+  const optional = (name) => (existsSync(join(dir, name)) ? readJson(join(dir, name), name, `fix ${name}: ias migrate eas reads it`) : undefined);
+  return { dir, expo: readExpo(dir), eas: optional('eas.json'), packageJson: optional('package.json') };
+}
+
+/** Whether app.json still points updates.url at EAS Update (u.expo.dev). */
+export const usesEasUpdate = (expo) => EAS_UPDATE.test(expo?.updates?.url ?? '');
+
+/**
+ * The EAS project of the app: { projectId, owner, slug }, from --eas-project and --owner, or from app.json
+ * (extra.eas.projectId, or the u.expo.dev URL of updates, and owner). Undefined if nothing names it. The owner may be
+ * null: eas-cli then takes the project's own.
+ */
+export function easProjectOf(app, values = {}) {
+  const projectId = values['eas-project'] ?? app.expo?.extra?.eas?.projectId ?? EAS_UPDATE.exec(app.expo?.updates?.url ?? '')?.[1];
+  const owner = values.owner ?? app.expo?.owner ?? null;
+  if (projectId === undefined) return undefined;
+  if (typeof projectId !== 'string' || !UUID.test(projectId)) throw new IasError(`«${projectId}» is not the id of an EAS project`, { fix: 'it is a UUID: eas project:info, or expo.dev › the project, shows it' });
+  if (owner !== null && (typeof owner !== 'string' || !ACCOUNT.test(owner))) throw new IasError(`«${owner}» is not the name of an Expo account`, { fix: 'the account that owns the project, as expo.dev shows it (@account/project)' });
+  return { projectId: projectId.toLowerCase(), owner, slug: app.expo?.slug ?? null };
+}
+
+/** How the person calls the EAS project: @owner/slug, or the slug and its id. */
+export const easProjectName = (easProject) => (easProject.owner ? `@${easProject.owner}/${easProject.slug}` : `${easProject.slug ?? 'the project'} (${easProject.projectId})`);
+
+/** The platforms the app has: those whose identifier app.json gives, or both when it gives neither. */
+export function platformsOf(expo) {
+  const platforms = [...(expo?.ios?.bundleIdentifier ? ['ios'] : []), ...(expo?.android?.package ? ['android'] : [])];
+  return platforms.length > 0 ? platforms : ['ios', 'android'];
+}
+
+/** The build profile of eas.json whose credentials go to the stores: production, or the first store one. */
+export function storeProfile(eas) {
+  const profiles = eas?.build && typeof eas.build === 'object' ? eas.build : {};
+  if (profiles.production) return 'production';
+  return Object.entries(profiles).find(([, profile]) => profile?.distribution !== 'internal' && !profile?.developmentClient)?.[0] ?? 'production';
+}
+
+/** The build profiles of eas.json that distribute internally (ad hoc on iOS), which may have credentials of their own. */
+export const internalProfiles = (eas) => Object.entries(eas?.build ?? {}).filter(([, profile]) => profile?.distribution === 'internal' && !profile?.developmentClient && !profile?.ios?.simulator).map(([name]) => name);
+
+/** The real path of `path`, links resolved; for one that does not exist yet, that of its nearest folder that does. */
+const realpath = (path) => {
+  const full = resolve(path);
+  try {
+    return realpathSync(full);
+  } catch {
+    const parent = dirname(full);
+    return parent === full ? full : join(realpath(parent), basename(full));
+  }
+};
+
+/** Whether `path` is `parent` or inside it, links resolved: a link into the project counts as inside. */
+export function isInside(parent, path) {
+  const rest = relative(realpath(parent), realpath(path));
+  return rest === '' || (rest.split(sep)[0] !== '..' && !isAbsolute(rest));
+}
+
+/** Where prepare makes its folders: $TMPDIR, private to this user on macOS. */
+export const temporaryBase = (env) => env.TMPDIR || tmpdir();
+
+/** The marker of a folder of prepare, or undefined if it is not one. */
+export function readMarker(folder) {
+  try {
+    const marker = JSON.parse(readFileSync(join(folder, MARKER), 'utf8'));
+    return marker?.format === FORMAT ? marker : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** What eas credentials left in `folder` (credentials.json, credentials/). */
+export const downloadIn = (folder) => DOWNLOAD.filter((name) => existsSync(join(folder, name)));
+
+/** What `folder` has besides the scaffold of prepare: a download, a .env of eas env:pull, the files of .eas/… */
+export function leftovers(folder) {
+  try {
+    return readdirSync(folder).filter((name) => !SCAFFOLD.includes(name)).sort();
+  } catch {
+    return [];
+  }
+}
+
+/** The folders prepare made for the app in `dir`, oldest first: [{ dir, marker, download, leftovers }]. */
+export function preparedFolders(dir, env) {
+  const base = temporaryBase(env);
+  let names;
+  try {
+    names = readdirSync(base);
+  } catch {
+    return [];
+  }
+  const project = realpath(dir);
+  return names
+    .filter((name) => name.startsWith(PREFIX))
+    .map((name) => ({ dir: join(base, name), marker: readMarker(join(base, name)) }))
+    .filter(({ marker }) => marker?.project === project)
+    .map((folder) => ({ ...folder, download: downloadIn(folder.dir), leftovers: leftovers(folder.dir) }))
+    .sort((a, b) => String(a.marker.created).localeCompare(String(b.marker.created)));
+}
+
+/** app.json with only what eas-cli needs to know the project: names, identifiers and the EAS project. */
+function minimalAppJson(expo, easProject) {
+  const ios = expo.ios?.bundleIdentifier ? { bundleIdentifier: expo.ios.bundleIdentifier, ...(expo.ios.appleTeamId ? { appleTeamId: expo.ios.appleTeamId } : {}) } : undefined;
+  const android = expo.android?.package ? { package: expo.android.package } : undefined;
+  return {
+    expo: {
+      name: expo.name,
+      slug: expo.slug,
+      ...(typeof expo.version === 'string' ? { version: expo.version } : {}),
+      ...(easProject.owner ? { owner: easProject.owner } : {}),
+      ...(ios ? { ios } : {}),
+      ...(android ? { android } : {}),
+      extra: { eas: { projectId: easProject.projectId } },
+    },
+  };
+}
+
+/** eas.json with its cli settings and build profiles, without the variables of each profile. */
+function minimalEasJson(eas) {
+  const profiles = eas?.build && typeof eas.build === 'object' ? eas.build : { production: {} };
+  const build = Object.fromEntries(Object.entries(profiles).map(([name, profile]) => {
+    const { env: _variables, ...rest } = profile && typeof profile === 'object' ? profile : {};
+    return [name, rest];
+  }));
+  return { ...(eas?.cli ? { cli: eas.cli } : {}), build };
+}
+
+/**
+ * Makes (or, given `folder`, refreshes) the folder of prepare for `app`: mode 700, outside the project, with
+ * package.json, the minimal app.json and eas.json, node_modules linked to the app's, and the marker. A download already
+ * there stays. Returns its path.
+ */
+export function writeFolder(app, easProject, { env, folder }) {
+  const base = temporaryBase(env);
+  if (!folder && isInside(app.dir, base)) throw new IasError(`the temporary folder (${base}) is inside the project`, { fix: 'set TMPDIR to a folder outside the app: the download must never be where git can pick it up' });
+  const target = folder ?? mkdtempSync(join(base, `${PREFIX}${String(app.expo.slug ?? 'app').replace(/[^A-Za-z0-9_-]+/g, '-').slice(0, 40)}-`));
+  chmodSync(target, 0o700);
+  const write = (name, value) => writeFileSync(join(target, name), `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+  write('package.json', { name: `${String(app.expo.slug ?? 'app').toLowerCase().replace(/[^a-z0-9-]+/g, '-')}-eas-credentials`, private: true });
+  write('app.json', minimalAppJson(app.expo, easProject));
+  write('eas.json', minimalEasJson(app.eas));
+  const previous = readMarker(target);
+  write(MARKER, { format: FORMAT, project: realpath(app.dir), eas: easProject, created: previous?.created ?? new Date().toISOString(), note: 'Made by ias migrate eas prepare. eas credentials downloads here; ias migrate eas import seals the download into the vault of IAS and deletes it.' });
+  // eas-cli resolves expo from the project to read app.json; it only reads from there. A link is removed by rm -rf
+  // without touching what it points to.
+  const link = join(target, 'node_modules');
+  let linked = false;
+  try {
+    linked = lstatSync(link).isSymbolicLink();
+  } catch {
+    linked = false;
+  }
+  if (!linked && existsSync(join(app.dir, 'node_modules'))) symlinkSync(join(app.dir, 'node_modules'), link);
+  return target;
+}
+
+/** The paths credentials.json of `folder` names (certificates, profiles and keystores), resolved in the folder. */
+function namedFiles(folder) {
+  let json;
+  try {
+    json = JSON.parse(readFileSync(join(folder, 'credentials.json'), 'utf8'));
+  } catch {
+    return [];
+  }
+  const paths = [];
+  const target = (ios) => {
+    if (typeof ios?.distributionCertificate?.path === 'string') paths.push(ios.distributionCertificate.path);
+    if (typeof ios?.provisioningProfilePath === 'string') paths.push(ios.provisioningProfilePath);
+  };
+  if (json?.ios && typeof json.ios === 'object') {
+    if (json.ios.distributionCertificate || json.ios.provisioningProfilePath) target(json.ios);
+    else Object.values(json.ios).forEach(target);
+  }
+  if (typeof json?.android?.keystore?.keystorePath === 'string') paths.push(json.android.keystore.keystorePath);
+  return paths.map((path) => resolve(folder, path));
+}
+
+/**
+ * Deletes what eas credentials downloaded into `folder`: the files its credentials.json names inside the folder (never
+ * through node_modules, which is a link to the app), credentials.json and credentials/. Never throws: returns
+ * { removed, failed, left }, `left` being what the folder still has besides the scaffold of prepare.
+ */
+export function removeDownload(folder) {
+  const removed = [];
+  const failed = [];
+  const remove = (path) => {
+    let exists = false;
+    try {
+      lstatSync(path);
+      exists = true;
+    } catch {
+      exists = false;
+    }
+    if (!exists) return;
+    try {
+      rmSync(path, { recursive: true, force: true });
+      removed.push(relative(folder, path));
+    } catch {
+      failed.push(relative(folder, path));
+    }
+  };
+  for (const path of namedFiles(folder)) {
+    if (!existsSync(path) || !isInside(folder, path) || isInside(join(folder, 'node_modules'), path)) continue;
+    remove(path);
+    // The folders eas made for it, up to the folder of prepare, when they are left empty.
+    for (let parent = dirname(path); parent !== folder && isInside(folder, parent); parent = dirname(parent)) {
+      try {
+        rmdirSync(parent);
+      } catch {
+        break;
+      }
+    }
+  }
+  for (const name of DOWNLOAD) remove(join(folder, name));
+  return { removed, failed, left: leftovers(folder) };
+}
+
+/** `text` as one word of the shell: as it is when it is safe, in single quotes otherwise. */
+export const shellWord = (text) => (/^[A-Za-z0-9_./:@%+=,-]+$/.test(text) ? text : `'${String(text).replace(/'/g, "'\\''")}'`);
+
+/** A command of ias migrate eas to print, with --project when the person gave it. */
+export const iasCommand = (context, ...words) => ['ias', 'migrate', 'eas', ...words, ...(context.values.project ? ['--project', shellWord(projectDir(context))] : [])].join(' ');

package/src/commands/migrate/survey.mjs

@@ -0,0 +1,205 @@
+// Where a move from EAS is, from what can be looked at without touching anything: the app's files, the folders of
+// prepare, and what the server of IAS has (credentials, build numbers and variables), if there is a token for it.
+// ias migrate eas without a step says which steps are done and what comes next; checklist says what is left in
+// expo.dev, the stores and the app, as jscheduler-app's docs/local-builds.md §7 did by hand, adapted to what it finds.
+// Neither deletes nor changes anything.
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { loadProject } from '../../config.mjs';
+import { ApiError } from '../../errors.mjs';
+import { applicationOf, connect } from '../../manage.mjs';
+import { easProjectName, easProjectOf, iasCommand, platformsOf, preparedFolders, projectDir, readApp, shellWord, usesEasUpdate } from './project.mjs';
+
+const DAY = 24 * 60 * 60 * 1000;
+/** The names of profile ias.json takes: those of eas.json that ias init leaves out never count as missing. */
+const PROFILE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,49}$/;
+const day = (date) => String(date).slice(0, 10);
+
+/** What the server of IAS has for the application, or why it is not known: { known, application?, why? … }. */
+async function serverState(context, project) {
+  let application;
+  try {
+    application = applicationOf(context, project);
+  } catch {
+    return { known: false, why: 'there is no ias.json (ias migrate eas profiles writes it) nor --app' };
+  }
+  let client;
+  try {
+    client = connect(context, project);
+  } catch (error) {
+    return { known: false, application, why: error.what ?? error.message };
+  }
+  try {
+    const credentials = (await client.request('GET', `/apps/${application}/credentials`)).data.data;
+    try {
+      credentials.push(...(await client.request('GET', '/team/credentials')).data.data);
+    } catch (error) {
+      if (!(error instanceof ApiError) || error.code !== 'role_forbidden') throw error;
+    }
+    const numbers = (await client.request('GET', `/apps/${application}/build-numbers`)).data;
+    const variables = (await client.request('GET', `/apps/${application}/env`)).data.data;
+    return { known: true, application, server: client.server, credentials: credentials.filter((credential) => !credential.retired_at), numbers, variables };
+  } catch (error) {
+    return { known: false, application, server: client.server, why: error.message };
+  }
+}
+
+/** Everything status and checklist look at. */
+async function gather(context) {
+  const dir = projectDir(context);
+  const app = readApp(dir);
+  let project;
+  let configError;
+  try {
+    project = loadProject(dir);
+  } catch (error) {
+    project = { dir, source: 'legacy', config: undefined };
+    configError = error.message;
+  }
+  let easProject;
+  try {
+    easProject = easProjectOf(app, context.values);
+  } catch {
+    easProject = undefined;
+  }
+  return { dir, app, project, configError, easProject, folders: preparedFolders(dir, context.env), server: await serverState(context, project) };
+}
+
+const find = (state, type) => (state.server.credentials ?? []).filter((credential) => credential.type === type);
+
+/** The steps of the move and their state: [{ step, state, detail }], state being done, pending or unknown. */
+function steps(context, state) {
+  const { app, project, configError, folders, server } = state;
+  const platforms = platformsOf(app.expo);
+  const list = [];
+  const easProfiles = Object.keys(app.eas?.build ?? {}).filter((name) => PROFILE.test(name));
+  const missing = easProfiles.filter((name) => !project.config?.build?.[name]);
+  list.push(configError
+    ? { step: 'profiles', state: 'pending', detail: `ias.json is not valid: ${configError}` }
+    : !project.config
+      ? { step: 'profiles', state: 'pending', detail: 'there is no ias.json yet' }
+      : missing.length > 0
+        ? { step: 'profiles', state: 'pending', detail: `ias.json lacks ${missing.join(', ')} of eas.json` }
+        : { step: 'profiles', state: 'done', detail: `ias.json has ${Object.keys(project.config.build ?? {}).join(', ') || 'no build profiles'}` });
+  const waiting = folders.filter((folder) => folder.download.length > 0);
+  list.push(folders.length > 0
+    ? { step: 'prepare', state: 'done', detail: `${folders.map((folder) => folder.dir).join(', ')}${waiting.length > 0 ? `; a download waits in ${waiting.map((folder) => folder.dir).join(', ')}` : ''}` }
+    : server.known && hasSigning(state, platforms)
+      ? { step: 'prepare', state: 'done', detail: 'its folder is gone, and the credentials are in the vault' }
+      : { step: 'prepare', state: 'pending', detail: 'no folder for eas credentials on this Mac' });
+  if (!server.known) {
+    for (const step of ['import', 'version', 'env']) list.push({ step, state: 'unknown', detail: server.why });
+  } else {
+    const have = signing(state);
+    const lacking = [...(platforms.includes('ios') ? ['certificate', 'profile'] : []), ...(platforms.includes('android') ? ['keystore'] : [])].filter((what) => !have[what]);
+    const owned = Object.entries(have).filter(([, value]) => value).map(([what, value]) => `${what} ${value}`);
+    list.push({ step: 'import', state: lacking.length === 0 ? 'done' : 'pending', detail: `${owned.length > 0 ? `the vault has: ${owned.join('; ')}` : 'the vault has no signing credentials of the app'}${lacking.length > 0 ? `; lacks the ${lacking.join(', ')}` : ''}${waiting.length > 0 ? `; import ${waiting[0].dir}` : ''}` });
+    const numbers = platforms.map((platform) => `${platform === 'ios' ? 'iOS' : 'Android'} ${server.numbers?.[platform] ?? 'none yet'}`);
+    list.push({ step: 'version', state: platforms.every((platform) => server.numbers?.[platform]) ? 'done' : 'pending', detail: `IAS: ${numbers.join(', ')}` });
+    const counts = ['development', 'preview', 'production'].map((environment) => `${environment} ${server.variables.filter((variable) => variable.environment === environment).length}`);
+    list.push({ step: 'env', state: server.variables.length > 0 ? 'done' : 'pending', detail: `variables in IAS: ${counts.join(', ')}${server.variables.length === 0 ? ' (if EAS has none, there is nothing to do)' : ''}` });
+  }
+  list.push({ step: 'checklist', state: 'pending', detail: 'what is left in expo.dev, the stores and the app: yours to do' });
+  return list;
+}
+
+/** The signing credentials the vault has for the app: { certificate, profile, keystore }, each described or null. */
+function signing(state) {
+  const profiles = find(state, 'apple_provisioning_profile');
+  const [certificate] = find(state, 'apple_distribution_certificate');
+  const [keystore] = find(state, 'android_upload_keystore');
+  return {
+    certificate: certificate ? `«${certificate.name}»` : null,
+    profile: profiles.length > 0 ? profiles.map((profile) => `«${profile.name}» (${profile.metadata?.type ?? 'profile'})`).join(', ') : null,
+    keystore: keystore ? `alias ${keystore.metadata?.alias ?? '?'}` : null,
+  };
+}
+
+const hasSigning = (state, platforms) => {
+  const have = signing(state);
+  return Boolean((!platforms.includes('ios') || (have.certificate && have.profile)) && (!platforms.includes('android') || have.keystore));
+};
+
+export async function status(context) {
+  const { output } = context;
+  const state = await gather(context);
+  const { app, easProject, server } = state;
+  const list = steps(context, state);
+  output.log(`Leaving EAS${easProject ? `, project ${easProjectName(easProject)},` : ''} for IAS${server.application ? `, application ${server.application}${server.server ? ` on ${server.server}` : ''}` : ''}:`);
+  list.forEach((entry, index) => output.log(`  ${index + 1}. ${entry.step.padEnd(9)} ${entry.state.padEnd(7)}  ${entry.detail}`));
+  if (!app.eas && !easProject) output.log('This app has neither eas.json nor an EAS project in app.json: there may be nothing to bring.');
+  const next = list.find((entry) => entry.state !== 'done');
+  const waiting = state.folders.find((folder) => folder.download.length > 0);
+  let command = iasCommand(context, next?.step ?? 'checklist');
+  if (next?.state === 'unknown') command = `${/not logged in/.test(server.why) ? 'ias login' : 'what stops it above'}, and ${iasCommand(context)} again`;
+  else if (next?.step === 'import' && waiting) command = iasCommand(context, 'import', shellWord(waiting.dir));
+  else if (next?.step === 'import' && state.folders.length > 0) command = `eas credentials in ${state.folders[0].dir} (${iasCommand(context, 'prepare')} says how), then import`;
+  output.log(`Next: ${command}`);
+  return { eas_project: easProject ?? null, application: server.application ?? null, steps: list, next: next?.step ?? null };
+}
+
+/** The items of the checklist, by section: [{ section, done, text }], done being true, false or null (not known). */
+function items(context, state) {
+  const { dir, app, easProject, folders, server } = state;
+  const list = [];
+  const add = (section, done, text) => list.push({ section, done, text });
+  const platforms = platformsOf(app.expo);
+  const [certificate] = find(state, 'apple_distribution_certificate');
+  const [keystore] = find(state, 'android_upload_keystore');
+  const profiles = find(state, 'apple_provisioning_profile');
+  /** Whether an item of IAS is done, or null when the server could not be asked. */
+  const check = (value) => (server.known ? Boolean(value) : null);
+
+  // IAS.
+  const have = server.known ? signing(state) : {};
+  add('IAS', check(hasSigning(state, platforms)), `The signing credentials in the vault${server.known ? `: ${Object.entries(have).filter(([, value]) => value).map(([what, value]) => `${what} ${value}`).join('; ') || 'none yet'}` : ` (${server.why})`}: ${iasCommand(context, 'import', '<folder>')}.`);
+  if (profiles.length > 0 && !profiles.some((profile) => profile.metadata?.type === 'app-store')) add('IAS', false, 'Store builds need an App Store profile, and the vault has only internal ones: download the one of the store profile with eas credentials, or make one in Apple Developer, and import it.');
+  if (platforms.includes('android')) add('IAS', null, `Play Console › the app › Test and release › App integrity › App signing: the «Upload key certificate» must be ${keystore?.metadata?.sha256 ? `SHA-256 ${keystore.metadata.sha256}` : 'the SHA-256 of the upload keystore'}. Change nothing in EAS until it is: Google rejects an AAB signed with another upload key.`);
+  add('IAS', check(platforms.every((platform) => server.numbers?.[platform])), `The build numbers on the server${server.known ? `: iOS ${server.numbers?.ios ?? 'none yet'}, Android ${server.numbers?.android ?? 'none yet'}` : ''}: ${iasCommand(context, 'version')}.`);
+  add('IAS', server.variables?.length > 0 ? true : null, `The variables${server.known ? `: ${server.variables.length} in IAS` : ''}: ${iasCommand(context, 'env')}. Secret ones of EAS, which only its builders read, go with ias env set … --from op://…; account-wide ones (eas env:list --scope account) are not brought.`);
+  if (certificate?.expires_at && Date.parse(certificate.expires_at) - Date.now() < 90 * DAY) add('IAS', false, `The distribution certificate «${certificate.name}» expires on ${day(certificate.expires_at)}: renew it in Apple Developer before the first build after that date, and import it with its profile.`);
+  add('IAS', null, 'The first build with IAS, accepted by the stores: ias build --profile production, then ias submit (or Transporter and Play Console). Delete nothing in expo.dev before it is.');
+
+  // The app.
+  if (usesEasUpdate(app.expo)) add('The app', false, `updates.url is EAS Update's (${app.expo.updates.url}): the build after the move has to carry IAS's (${server.server ?? state.project.config?.server ?? 'https://ias.imagina.build'}/api/v1/ota/<project>/manifest, php artisan ota:project) and its code signing certificate. Take extra.eas and owner out of app.json in that same build: they enter the fingerprint.`);
+  for (const name of ['credentials.json', 'credentials']) if (existsSync(join(dir, name))) add('The app', false, `${name} is in the project: eas credentials ran there, and git does not ignore it. Move it to the folder of prepare (mv) and import it from there.`);
+  for (const [profileName, profile] of Object.entries(app.eas?.submit ?? {})) {
+    const path = profile?.android?.serviceAccountKeyPath;
+    if (typeof path === 'string' && existsSync(join(dir, path))) add('The app', false, `The Google service account of submit.${profileName} (${path}) is in the project folder: import it (ias credentials import --service-account ${shellWord(path)}), keep it in 1Password and delete it from the folder. Revoking its key in Google Cloud and its access in Play Console closes the uploads by API: a separate decision.`);
+  }
+  const hooks = Object.keys(app.packageJson?.scripts ?? {}).filter((name) => name.startsWith('eas-build-'));
+  if (hooks.length > 0) add('The app', false, `package.json has the EAS build hooks ${hooks.join(', ')}, which the runners of IAS do not run.`);
+  const easFiles = ['eas.json', '.easignore', '.eas'].filter((name) => existsSync(join(dir, name)));
+  if (easFiles.length > 0) add('The app', false, `Once the EAS project is deleted: remove ${easFiles.join(', ')} and the eas scripts of package.json (eas.json does not enter the fingerprint).`);
+
+  // expo.dev, in this order, after the first build with IAS.
+  const where = folders[0] ? ` (from ${folders[0].dir}, where eas knows the project, or expo.dev › Credentials)` : ' (expo.dev › Credentials, or eas credentials from a folder of ias migrate eas prepare)';
+  const submitProfiles = Object.values(app.eas?.submit ?? {});
+  const asc = submitProfiles.some((profile) => profile?.ios && Object.keys(profile.ios).some((key) => /^(ascApiKey|appleId)/.test(key)));
+  add('expo.dev', null, `Remove the submit keys from EAS${where}: eas credentials -p ios › App Store Connect: Manage your API Key › remove it${asc ? ' (eas.json names one)' : ''}; -p android › Google Service Account › remove it. With that, whoever enters the Expo account can no longer upload to TestFlight or Google Play. The key EAS made can be revoked in App Store Connect › Users and Access › Integrations: a separate decision.`);
+  const push = Boolean(app.packageJson?.dependencies?.['expo-notifications']);
+  if (push) add('expo.dev', null, `The app uses expo-notifications: EAS may hold its APNs key and its FCM account. Load them into IAS (ias push credentials ios AuthKey_<id>.p8, android <account>.json; the .p8 cannot be downloaded from EAS: use the team's, or make one) before removing them from EAS.`);
+  add('expo.dev', null, `Delete the EAS project: expo.dev › ${easProject ? easProjectName(easProject) : 'the project'} › Project settings › Delete project. Builds whose updates.url is u.expo.dev${easProject ? `/${easProject.projectId}` : ''} stop getting updates until they are updated from the store, nobody who enters the account can publish to them again, and the id cannot be made again.`);
+  add('expo.dev', null, `The credentials of the account: expo.dev › ${easProject?.owner ?? 'the account'} › Credentials. Distribution certificates${certificate?.metadata?.team ? ` (team ${certificate.metadata.team})` : ''}, App Store Connect keys, Google service accounts and push keys belong to the account and survive the project. Before deleting one, check that no other app of the account uses it: the same distribution certificate serves every app of the team. Deleting it in EAS only deletes EAS's copy: the certificate stays valid in Apple and the upload key stays Google Play's.`);
+
+  // This Mac.
+  for (const folder of folders) add('This Mac', false, `Delete the folder of prepare when you are done: rm -rf ${shellWord(folder.dir)}${folder.download.length > 0 ? ` (it still holds a download: ${folder.download.join(', ')})` : ''}. Its node_modules is a link: the app's is not touched.`);
+  return list;
+}
+
+export async function checklist(context) {
+  const { output } = context;
+  const state = await gather(context);
+  const list = items(context, state);
+  output.log(`What is left to leave EAS${state.easProject ? `, project ${easProjectName(state.easProject)}` : ''}. ias deletes nothing: each one is yours, in this order.`);
+  let section;
+  for (const item of list) {
+    if (item.section !== section) {
+      section = item.section;
+      output.log(`${section}${section === 'expo.dev' ? ', after the first build with IAS' : ''}`);
+    }
+    output.log(`  [${item.done === true ? 'x' : item.done === false ? ' ' : '?'}] ${item.text}`);
+  }
+  output.log('[x] done, [ ] to do, [?] only you can check it.');
+  return { eas_project: state.easProject ?? null, application: state.server.application ?? null, items: list };
+}