@imagina-build/ias-cli 0.2.1 → 0.3.0

package/src/commands/sdk/index.mjs

@@ -11,6 +11,17 @@ import { SDK_PACKAGE, addCommand, addPlugin, packageManager, sdkSource, sdkState
 /** Runs the install with its output on stderr, so --json keeps stdout whole; at a low priority on macOS. */
 const systemExec = (command, commandArgs, options) => (process.platform === 'darwin' ? gently : run)(command, commandArgs, { stdio: ['inherit', 2, 'inherit'], ...options });
 
+/** The Expo modules each service of ias.json needs, for `ias sdk install --modules` and `ias setup`. */
+export function expoModulesFor({ updates = false, push = false } = {}) {
+  return [...(updates ? ['expo-updates'] : []), ...(push ? ['expo-notifications', 'expo-task-manager'] : [])];
+}
+
+/** The modules of `wanted` that the app does not have yet. */
+export function missingExpoModules(dir, wanted) {
+  const { dependencies } = sdkState(dir);
+  return wanted.filter((name) => !dependencies[name]);
+}
+
 /** The steps left after the install, from ias.json and the dependencies of the app: [{ step, why }]. */
 export function nextSteps(dir, { plugin, dependencies }) {
   const steps = [];
@@ -29,8 +40,11 @@ export function nextSteps(dir, { plugin, dependencies }) {
   return steps;
 }
 
-/** Installs the SDK in the app in `dir` and adds its plugin. `exec` runs the package manager (the tests pass their own). */
-export function installSdk(dir, { from, dryRun = false, repository } = {}, { output, env = process.env, exec = systemExec } = {}) {
+/**
+ * Installs the SDK in the app in `dir` and adds its plugin. With `modules`, it also installs the Expo modules they need
+ * with `npx expo install`. `exec` runs the package manager (the tests pass their own).
+ */
+export function installSdk(dir, { from, dryRun = false, modules = [], repository } = {}, { output, env = process.env, exec = systemExec } = {}) {
   if (!existsSync(join(dir, 'package.json'))) throw new IasError(`no package.json in ${dir}`, { fix: 'run it in the folder of the Expo app, or pass --project <app folder>' });
   if (!existsSync(join(dir, 'app.json')) && !DYNAMIC_CONFIGS.some((name) => existsSync(join(dir, name)))) throw new IasError(`no app.json nor app.config.* in ${dir}: it is not an Expo app`, { fix: 'run it in the folder of the Expo app, or pass --project <app folder>' });
   const source = sdkSource(dir, { from, env, ...(repository !== undefined ? { repository } : {}) });
@@ -48,11 +62,20 @@ export function installSdk(dir, { from, dryRun = false, repository } = {}, { out
   else if (plugin.reason === 'present') output.log(`${output.prefix}: app.json already has the plugin of ${SDK_PACKAGE}`);
   else output.log(`${output.prefix}: ${plugin.file} is code, and ias leaves it alone: add the plugin by hand (below)`);
 
+  const missing = modules.length > 0 ? missingExpoModules(dir, modules) : [];
+  if (missing.length > 0) {
+    const installCommand = `npx expo install ${missing.join(' ')}`;
+    output.progress(`${output.prefix}: ${dryRun ? 'would run' : 'running'} ${installCommand}`);
+    if (!dryRun) exec('npx', ['expo', 'install', ...missing], { cwd: dir, label: installCommand });
+  } else if (modules.length > 0) {
+    output.log(`${output.prefix}: ${modules.join(', ')} already installed`);
+  }
+
   const steps = nextSteps(dir, { plugin, dependencies: sdkState(dir).dependencies });
   output.log('left to do:');
   for (const [index, { step, why }] of steps.entries()) output.log(`  ${index + 1}. ${step}\n     ${why}`);
   output.log('ias doctor checks the SDK; docs/guide/sdk.md explains how to configure it.');
-  return { package: SDK_PACKAGE, spec: source.spec, source: source.origin, package_manager: manager.name, command, installed: !dryRun, plugin: plugin.reason, next: steps };
+  return { package: SDK_PACKAGE, spec: source.spec, source: source.origin, package_manager: manager.name, command, installed: !dryRun, plugin: plugin.reason, modules: missing, next: steps };
 }
 
 export default {
@@ -69,12 +92,16 @@ export default {
       ].join('\n'),
       options: {
         from: { type: 'string', value: '<source>', description: `Where ${SDK_PACKAGE} comes from: a .tgz of a release (a file or its URL), a folder, or a version of the registry.` },
+        modules: { type: 'boolean', description: 'Also install the Expo modules the services of ias.json need (expo-updates, expo-notifications and expo-task-manager) with npx expo install.' },
         'dry-run': { type: 'boolean', description: 'Say what it would run and change, and change nothing.' },
       },
       run: ({ values, cwd, env, output }) => {
         // A file or folder of --from is relative to where ias runs, as the shell completes it.
         const from = values.from && existsSync(resolve(cwd, values.from)) ? resolve(cwd, values.from) : values.from;
-        return installSdk(resolve(cwd, values.project ?? '.'), { from, dryRun: values['dry-run'] }, { output, env });
+        const dir = resolve(cwd, values.project ?? '.');
+        const config = loadProject(dir).config;
+        const modules = values.modules ? expoModulesFor({ updates: Boolean(config?.updates), push: Boolean(config?.push) }) : [];
+        return installSdk(dir, { from, dryRun: values['dry-run'], modules }, { output, env });
       },
     },
   ],

package/src/commands/setup/index.mjs

@@ -0,0 +1,184 @@
+// ias setup: the checklist of a new app, one step at a time. It writes ias.json, installs the SDK and logs in here; the
+// steps that need a person (the application in the panel, the credentials, a runner) say exactly what to do and stay
+// locked until the check passes. Without an action it prints where the app is in the checklist.
+import { resolve } from 'node:path';
+import { UsageError } from '../../errors.mjs';
+import { openUrl as systemOpen } from '../../manage.mjs';
+import { EXIT_CODE } from '../../output.mjs';
+import { createSetupContext, printPlan, runSetupBuild, runSetupPublish, setupNext, setupPlan } from '../../setup.mjs';
+import { STATUS } from '../../setup.mjs';
+import { parseServices, readSetupState, resetSetupState, writeSetupState } from '../../setup-state.mjs';
+
+const ACTIONS = ['status', 'next', 'check', 'services', 'reset'];
+const SYMBOL = { [STATUS.DONE]: '[x]', [STATUS.READY]: '[>]', [STATUS.LOCKED]: '[ ]', [STATUS.OPTIONAL]: '[-]' };
+
+const resultOf = (ctx, plan, extra = {}) => {
+  const server = ctx.config?.server ?? ctx.env.IAS_SERVER ?? 'https://ias.imagina.build';
+  let origin = server;
+  try {
+    origin = new URL(server).origin;
+  } catch {
+    // The server is not a URL yet: the checklist already says so.
+  }
+  return {
+    app: ctx.config?.app ?? null,
+    server: origin,
+    services: ctx.services,
+    complete: plan.complete,
+    counts: plan.counts,
+    steps: plan.steps,
+    next: plan.next,
+    ...extra,
+  };
+};
+
+function printWaiting(step, output) {
+  output.log(`\n${SYMBOL[step.status]} ${step.id}: ${step.detail}`);
+  if (step.fix) for (const line of step.fix.split('\n')) output.log(`  → ${line}`);
+  if (step.command) output.log(`  ${step.command}`);
+  if (step.url && !step.fix?.includes(step.url)) output.log(`  ${step.url}`);
+  output.log('  when it is done: ias setup next');
+}
+
+function printStep(step, output) {
+  output.log(`${SYMBOL[step.status]} ${step.id}  ${step.detail}`);
+  if (step.fix) for (const line of step.fix.split('\n')) output.log(`  → ${line}`);
+  if (step.command) output.log(`  ${step.command}`);
+  if (step.url) output.log(`  ${step.url}`);
+}
+
+function servicesOf(context, state) {
+  if (context.values.services === undefined) return { services: state.services, state };
+  const parsed = parseServices(context.values.services);
+  if (parsed.error) throw new UsageError(`${parsed.error}: ias setup --services takes ${['updates', 'distribution', 'push'].join(', ')} (or a comma-separated list)`);
+  return { services: parsed.services, state, explicit: true };
+}
+
+export default {
+  name: 'setup',
+  summary: 'The checklist of a new app: what is done, what is next and what a person has to do',
+  description: [
+    'The steps, in order: environment, project (ias.json), login, application, services, stores, sdk, vault, credentials, signing, runner, build, testflight, updates, distribution, push and ci.',
+    'ias does the ones it can here: ias init, ias sdk install (with the Expo modules of the services), ias login and ias vault init. The rest are checked against the files and the server; a step says what a person has to do and the next step stays locked until it is done.',
+    'Without an action, it prints where the app is. next runs the next step, or says what a person has to do; with --build <profile> it makes the first build and with --publish the first OTA update, both explicit. check re-checks everything and exits with 1 while the checklist is not complete. services reads or sets the services of the app (updates, distribution, push); reset forgets the local state (it holds no secret).',
+    'Optional steps (they never block and --all never runs them): stores, signing, testflight, push and ci; runner is optional with --local-builds, and a step with a service only counts when that service is on.',
+  ].join('\n'),
+  positionals: [
+    { name: 'action', optional: true, description: `One of ${ACTIONS.join(', ')} (status when left out).`, pattern: new RegExp(`^(${ACTIONS.join('|')})$`) },
+    { name: 'value', optional: true, description: 'check: the step to check; services: updates, distribution, push or a comma-separated list.' },
+  ],
+  options: {
+    'create-app': { type: 'boolean', description: 'Create the application in IAS with the code of ias.json and the name, bundle id and package of app.json (an owner with a personal token).' },
+    name: { type: 'string', value: '"…"', description: 'The name of the new application (the name of app.json by default).' },
+    'ios-bundle-id': { type: 'string', value: '<id>', description: 'The iOS bundle id of the new application (app.json by default).' },
+    'android-package': { type: 'string', value: '<id>', description: 'The Android package of the new application (app.json by default).' },
+    'apple-team-id': { type: 'string', value: '<id>', description: 'The Apple team id of the new application.' },
+    app: { type: 'string', value: '<code>', description: 'The code of the application, when ias init cannot read it from app.json (the slug is only a guess).' },
+    services: { type: 'string', value: '<list>', description: 'The services of the app: updates, distribution, push, or a comma-separated list. Saved for the next runs.' },
+    team: { type: 'string', value: '<code>', description: 'The team the login is for, when the person is in several.' },
+    'local-builds': { type: 'boolean', description: 'The app is built on this Mac (ias build --local): the runner step is optional.' },
+    item: { type: 'string', value: '<op://vault/item>', description: 'next: the 1Password item the vault step uses with ias vault init (IAS_VAULT_ITEM, vault.item of ias.json, or op://IAS/IAS vault <host>).' },
+    all: { type: 'boolean', description: 'next: run every automatic step until one needs a person.' },
+    build: { type: 'string', value: '<profile>', description: 'next: build the app with this profile (preview, production…) and stop; an explicit opt-in.' },
+    publish: { type: 'boolean', description: 'next: publish the first OTA update after the build (or after the last succeeded build).' },
+    message: { type: 'string', value: '"…"', description: 'next --build or --publish: the message of the build or the update.' },
+    wait: { type: 'boolean', description: 'next --build: download the artifacts when it succeeds (ias build --wait).' },
+    open: { type: 'boolean', description: 'next: open the link of the step that needs a person.' },
+    'dry-run': { type: 'boolean', description: 'Do not write ias.json, install anything or change the configuration: say what would be done.' },
+  },
+  async run(context) {
+    const { output, env, cwd, values, positionals } = context;
+    const action = positionals[0] ?? 'status';
+    const value = positionals[1];
+    const dir = resolve(cwd, values.project ?? '.');
+    const state = readSetupState(dir, env);
+    const chosen = servicesOf(context, state);
+    if (chosen.explicit) writeSetupState(dir, { ...state, services: chosen.services }, env);
+
+    const ctx = createSetupContext({
+      dir,
+      env,
+      output,
+      values,
+      state,
+      services: chosen.services,
+      sleep: context.sleep,
+      openUrl: context.openUrl,
+    });
+
+    if (action === 'services') {
+      if (value !== undefined) {
+        const parsed = parseServices(value);
+        if (parsed.error) throw new UsageError(`${parsed.error}: ias setup services takes updates, distribution, push or a comma-separated list`);
+        writeSetupState(dir, { ...state, services: parsed.services }, env);
+        ctx.services = parsed.services;
+        output.log(`${output.prefix} setup: services ${parsed.services.join(', ') || '(none)'}`);
+        return { services: parsed.services, file: true };
+      }
+      output.log(ctx.services.length > 0 ? ctx.services.join(', ') : '(none)');
+      return { services: ctx.services };
+    }
+
+    if (action === 'reset') {
+      resetSetupState(dir, env);
+      output.log(`${output.prefix} setup: forgot the local state of ${dir}; the files and the server still say what is done.`);
+      return { reset: true, file: true };
+    }
+
+    if (values['create-app'] && action === 'status') {
+      const outcome = await setupNext(ctx, { id: 'application' });
+      if (outcome.ran) output.log(`${output.prefix} setup: ran ${outcome.ran}`);
+      printPlan(outcome.plan, ctx, output);
+      return { ...resultOf(ctx, outcome.plan, { ran: outcome.ran ?? null }), [EXIT_CODE]: 0 };
+    }
+
+    if (action === 'next' && (values.build !== undefined || values.publish)) {
+      let buildResult;
+      let publishResult;
+      if (values.build !== undefined) {
+        buildResult = await runSetupBuild(ctx);
+        if (buildResult?.[EXIT_CODE]) {
+          printPlan(await setupPlan(ctx), ctx, output);
+          return { ...resultOf(ctx, await setupPlan(ctx), { build: buildResult }), [EXIT_CODE]: 1 };
+        }
+      }
+      if (values.publish) publishResult = await runSetupPublish(ctx);
+      const plan = await setupPlan(ctx);
+      printPlan(plan, ctx, output);
+      return { ...resultOf(ctx, plan, { ...(buildResult ? { build: buildResult } : {}), ...(publishResult ? { published: publishResult } : {}) }), [EXIT_CODE]: 0 };
+    }
+
+    if (action === 'next') {
+      const outcome = await setupNext(ctx, { all: values.all });
+      const plan = outcome.plan;
+      if (outcome.ran) output.log(`${output.prefix} setup: ran ${outcome.ran}`);
+      printPlan(plan, ctx, output);
+      const waiting = outcome.waiting;
+      if (waiting && waiting.kind === 'manual') {
+        printWaiting(waiting, output);
+        if (values.open && waiting.url) (context.openUrl ?? ((url) => systemOpen(url, env)))(waiting.url);
+      }
+      const failed = outcome.ran && plan.steps.find((step) => step.id === outcome.ran)?.status !== STATUS.DONE;
+      return {
+        ...resultOf(ctx, plan, { ran: outcome.ran ?? null, result: outcome.result ?? null, waiting: waiting?.id ?? null }),
+        [EXIT_CODE]: failed ? 1 : 0,
+      };
+    }
+
+    const plan = await setupPlan(ctx);
+
+    if (action === 'check') {
+      if (value) {
+        const step = plan.steps.find((candidate) => candidate.id === value);
+        if (!step) throw new UsageError(`there is no step «${value}»: the checklist has ${plan.steps.map((candidate) => candidate.id).join(', ')}`);
+        printStep(step, output);
+        return { ...resultOf(ctx, plan), step, [EXIT_CODE]: step.status === STATUS.DONE || step.optional ? 0 : 1 };
+      }
+      printPlan(plan, ctx, output);
+      return { ...resultOf(ctx, plan), [EXIT_CODE]: plan.complete ? 0 : 1 };
+    }
+
+    printPlan(plan, ctx, output);
+    return resultOf(ctx, plan);
+  },
+};

package/src/commands/submit/index.mjs

@@ -1,16 +1,25 @@
-// ias submit: sends a store build that succeeded to App Store Connect or Google Play (docs/technical/runner-api.md §6, decision
-// D7). The runner does it, with the keys sealed in the vault, after an owner approves it with a passkey: always as a
-// draft, to send for review in the store. It opens the approval and, with --wait, follows the submission to its end.
+// ias submit: sends a store build that succeeded to App Store Connect or Google Play (docs/technical/runner-api.md §6,
+// decision D7 and docs/plans/gaps/03-google-play-rollout.md). The runner does it, with the keys sealed in the vault, after an
+// owner approves it with a passkey. A Google Play release is a draft by default; --release-status inProgress with
+// --rollout serves a percentage, and --release-status completed serves it to everyone, only when the track's policy allows
+// it (the server, not ias.json, is the permission). --changes-not-sent-for-review makes Play apply the commit without
+// sending the release for review: it stays pending for a person in Play Console, and nobody receives it until then.
+// It opens the approval and, with --wait, follows the submission to its end.
 import { resolve } from 'node:path';
 import { loadProject } from '../../config.mjs';
-import { IasError } from '../../errors.mjs';
+import { ApiError, IasError } from '../../errors.mjs';
 import { connect, openUrl, sleep } from '../../manage.mjs';
 import { EXIT_CODE } from '../../output.mjs';
 import { buildsClient, isFinished } from '../build/follow.mjs';
+import { sayPolicy } from '../policy/progress.mjs';
+import { PLAY_TRACK } from '../../shared.mjs';
 
 const BUILD_ID = /^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$/;
-const TRACK = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+const TRACK = PLAY_TRACK;
 const DEFAULT_TRACK = 'internal';
+const RELEASE_STATUSES = Object.freeze(['draft', 'inProgress', 'completed']);
+/** What the server answers when a policy does not allow what ias.json asks: the command falls back to a draft. */
+const POLICY_CODES = Object.freeze(['release_policy_required', 'release_not_allowed', 'release_percent_above_cap', 'release_step_too_big', 'release_too_soon', 'release_percent_invalid']);
 
 /** What the store says of a submission that ended: the delivery of App Store Connect, or the edit of Google Play. */
 function outcome(submission) {
@@ -20,21 +29,108 @@ function outcome(submission) {
   return parts.length > 0 ? ` (${parts.join(', ')})` : '';
 }
 
-/** The body of POST /builds/{id}/submit for `build`, from the options and the submit profile of ias.json. */
-function targetOf(context, build, config) {
+/** A whole percentage from --rollout, which is 1-99: 100 is completed. */
+function percentOf(value) {
+  if (value === undefined || value === null || value === '') return undefined;
+  const text = String(value);
+  if (!/^[0-9]+$/.test(text)) throw new IasError(`--rollout ${text} is not a whole percentage`, { fix: 'a staged rollout serves 1 to 99: use --rollout 20, or --release-status completed for 100 %' });
+  const percent = Number(text);
+  if (percent < 1 || percent > 99) throw new IasError(`--rollout ${percent} is outside 1-99`, { fix: 'a staged rollout serves 1 to 99: the 100 % is --release-status completed' });
+  return percent;
+}
+
+/** The release ias.json proposes for a profile: EAS writes rollout as a fraction, IAS as a whole percentage. */
+function configuredRelease(profile) {
+  const status = profile?.android?.releaseStatus;
+  if (status === undefined || status === null || status === 'draft') return null;
+  const rollout = profile?.android?.rollout;
+  const percent = typeof rollout === 'number' && rollout > 0 && rollout < 1 ? Math.max(1, Math.min(99, Math.round(rollout * 100))) : undefined;
+  return { status, percent };
+}
+
+/** The body of POST /builds/{id}/submit for `build`, from the options, the submit profile of ias.json and the application. */
+function targetOf(context, build, config, application) {
   const { values, output } = context;
   const profile = config?.submit?.[build.profile] ?? {};
   if (build.platform === 'ios') {
+    if (values['changes-not-sent-for-review']) throw new IasError('--changes-not-sent-for-review is for Google Play', { fix: 'an iOS build goes to App Store Connect, where Apple reviews every build: there is no commit to hold back for review' });
     if (values.track) throw new IasError('--track is for Google Play', { fix: 'an iOS build goes to App Store Connect (TestFlight), without a track' });
-    const ascAppId = values['asc-app-id'] ?? profile.ios?.ascAppId;
-    if (ascAppId !== undefined && !/^[0-9]{1,20}$/.test(ascAppId)) throw new IasError(`«${ascAppId}» is not the Apple ID of an app`, { fix: 'it is the number App Store Connect shows in App Information' });
-    return { target: 'app_store_connect', ...(ascAppId ? { asc_app_id: ascAppId } : {}) };
+    if (values['release-status'] || values.rollout) throw new IasError('--release-status and --rollout are for Google Play', { fix: 'an iOS build goes to App Store Connect as it is: TestFlight decides when it is distributed' });
+    const ascAppId = values['asc-app-id'] ?? profile.ios?.ascAppId ?? application?.ios?.asc_app_id;
+    if (ascAppId === undefined || ascAppId === null || ascAppId === '') {
+      throw new IasError(`${build.app} has no app record in App Store Connect`, {
+        fix: `a person creates it in App Store Connect with the bundle id ${application?.ios?.bundle_id ?? 'of the app'} and the SKU IAS-${build.app.toUpperCase()}; when it exists: ias apps store ${build.app} --check`,
+        code: 'asc_app_missing',
+      });
+    }
+    if (!/^[0-9]{1,20}$/.test(ascAppId)) throw new IasError(`«${ascAppId}» is not the Apple ID of an app`, { fix: 'it is the number App Store Connect shows in App Information' });
+    return { target: 'app_store_connect', asc_app_id: ascAppId };
   }
   if (values['asc-app-id']) throw new IasError('--asc-app-id is for App Store Connect', { fix: 'an Android build goes to Google Play: --track production, beta, alpha or internal' });
   const track = values.track ?? profile.android?.track ?? DEFAULT_TRACK;
-  if (!TRACK.test(track)) throw new IasError(`«${track}» is not a track of Google Play`, { fix: 'production, beta, alpha, internal or the name of a closed track' });
-  if (profile.android?.releaseStatus && profile.android.releaseStatus !== 'draft') output.warn(`submit.${build.profile}.android.releaseStatus is ${profile.android.releaseStatus}, but IAS always sends a draft (D7): send it for review in Play Console`);
-  return { target: 'google_play', track, release_status: 'draft' };
+  if (!TRACK.test(track)) throw new IasError(`«${track}» is not a track of Google Play`, { fix: 'production, beta, alpha, internal, the name of a closed track or a form factor\'s (wear:production)' });
+
+  // The flag wins over ias.json; without either, Play sends the commit for review as always.
+  const notSentFlag = values['changes-not-sent-for-review'];
+  const notSent = notSentFlag === true || (notSentFlag === undefined && profile.android?.changesNotSentForReview === true);
+  const notSentFrom = notSentFlag !== undefined ? '--changes-not-sent-for-review' : `submit.${build.profile}.android.changesNotSentForReview`;
+  const of = (body) => ({ body: notSent ? { ...body, changes_not_sent_for_review: true } : body, notSentFrom });
+
+  const explicit = values['release-status'] !== undefined || values.rollout !== undefined;
+  let status = values['release-status'];
+  let percent = percentOf(values.rollout);
+
+  if (status !== undefined && !RELEASE_STATUSES.includes(status)) throw new IasError(`--release-status ${status} is not a release state`, { fix: 'draft, inProgress or completed' });
+
+  if (explicit) {
+    status ??= percent === undefined ? 'draft' : 'inProgress';
+    if (percent !== undefined && status !== 'inProgress') throw new IasError(`--rollout only goes with --release-status inProgress`, { fix: `use --release-status inProgress --rollout ${percent}, or --release-status completed without --rollout` });
+    if (status === 'inProgress' && percent === undefined) throw new IasError('--release-status inProgress needs --rollout <1-99>', { fix: `ias submit ${build.id} --track ${track} --release-status inProgress --rollout 20` });
+    return { ...of({ target: 'google_play', track, release_status: status, ...(percent === undefined ? {} : { percent }) }), fromConfig: false };
+  }
+
+  const configured = configuredRelease(profile);
+  if (configured === null) return { ...of({ target: 'google_play', track, release_status: 'draft' }), fromConfig: false };
+
+  if (!RELEASE_STATUSES.includes(configured.status)) {
+    output.warn(`submit.${build.profile}.android.releaseStatus is ${configured.status}, which IAS does not know: sending a draft`);
+    return { ...of({ target: 'google_play', track, release_status: 'draft' }), fromConfig: false };
+  }
+
+  if (configured.status === 'inProgress' && configured.percent === undefined) {
+    output.warn(`submit.${build.profile}.android says inProgress without a rollout between 0 and 1: sending a draft (set rollout: 0.1, or use --rollout 10)`);
+    return { ...of({ target: 'google_play', track, release_status: 'draft' }), fromConfig: false };
+  }
+
+  if (configured.status === 'completed') return { ...of({ target: 'google_play', track, release_status: 'completed' }), fromConfig: true };
+
+  return { ...of({ target: 'google_play', track, release_status: configured.status, percent: configured.percent }), fromConfig: true };
+}
+
+/**
+ * What `changesNotSentForReview` means, said when it is sent: with a draft it changes nothing, and with a release it
+ * keeps the change from reaching anyone until a person sends it from Play Console.
+ */
+function warnNotSentForReview(output, body, source) {
+  if (body.changes_not_sent_for_review !== true) return;
+  if (body.release_status === 'draft') {
+    output.warn(`${source} is redundant with a draft: a draft is not sent for review anyway. Send it from Play Console when you are ready.`);
+    return;
+  }
+  output.warn(`${source}: Play applies the release but does not send it for review, so testers and users will not receive it until someone sends it in Play Console (Publishing overview › Send for review).`);
+}
+
+/** Creates the submission; what ias.json proposed falls back to a draft when the policy does not allow it, with a warning. */
+async function createSubmission(client, build, body, fromConfig, output) {
+  try {
+    return { submission: (await client.request('POST', `/builds/${build.id}/submit`, { json: body })).data, body };
+  } catch (error) {
+    if (!fromConfig || !(error instanceof ApiError) || !POLICY_CODES.includes(error.code)) throw error;
+    const why = error.data?.fix ?? error.message;
+    output.warn(`ias.json asks ${body.release_status}${body.percent ? ` at ${body.percent} %` : ''}, but the policy does not allow it: sending a draft instead. ${why}`);
+    const draft = { target: 'google_play', track: body.track, release_status: 'draft' };
+    return { submission: (await client.request('POST', `/builds/${build.id}/submit`, { json: draft })).data, body: draft };
+  }
 }
 
 async function submit(context) {
@@ -43,10 +139,21 @@ async function submit(context) {
   const client = buildsClient(connect(context, project));
   const { data: build } = await client.request('GET', `/builds/${context.positionals[0]}`);
   if (build.distribution !== 'store') throw new IasError(`${build.id} is an internal build (${build.profile})`, { fix: 'only a store build goes to the stores: ias build --profile production', code: 'build_not_submittable' });
-  const body = targetOf(context, build, project.config);
-  const { data: submission } = await client.request('POST', `/builds/${build.id}/submit`, { json: body });
-  const where = body.target === 'google_play' ? `Google Play (${body.track}, draft)` : 'App Store Connect';
+  // The Apple ID goes in the body: the flag, then ias.json, then the one saved in the application.
+  const configured = values['asc-app-id'] ?? project.config?.submit?.[build.profile]?.ios?.ascAppId;
+  const needsApplication = build.platform === 'ios' && (configured === undefined || configured === null || configured === '');
+  const application = needsApplication ? (await client.request('GET', `/apps/${encodeURIComponent(build.app)}`)).data : null;
+  const target = targetOf(context, build, project.config, application);
+  const requested = target.body ?? target;
+  const sent = await createSubmission(client, build, requested, target.fromConfig === true, output);
+  const body = sent.body;
+  const submission = sent.submission;
+  warnNotSentForReview(output, body, target.notSentFrom);
+  const where = body.target === 'google_play'
+    ? `Google Play (${body.track}, ${body.release_status}${body.percent ? ` ${body.percent} %` : ''}${body.changes_not_sent_for_review ? ', not sent for review' : ''})`
+    : 'App Store Connect';
   output.progress(`${build.platform} ${build.version} (${build.build_number}) to ${where}: submission ${submission.id}, ${submission.status}`);
+  sayPolicy(output, submission);
   if (submission.approval_url) {
     const opened = (context.openUrl ?? ((url) => openUrl(url, env)))(submission.approval_url);
     output.progress(`${opened ? 'Opened' : 'Open'} ${submission.approval_url}: an owner approves it with a passkey (the panel shows the hash ${submission.hash}).`);
@@ -68,17 +175,26 @@ async function submit(context) {
     }
   }
   output.log(`submission ${current.id} to ${where}: ${current.status}${outcome(current)}`);
+  if (current.status === 'succeeded' && body.target === 'app_store_connect') output.log(`build in TestFlight; ias testflight ${build.id} distributes it`);
+  if (current.status === 'succeeded' && body.target === 'google_play') {
+    output.log(body.changes_not_sent_for_review
+      ? `release state: ias releases view ${body.track} --refresh; it was not sent for review: a person sends it in Play Console › Publishing overview`
+      : `release state: ias releases view ${body.track} --refresh; the next rollout: ias rollout ${body.track}`);
+  }
   return current.status === 'succeeded' ? current : { ...current, [EXIT_CODE]: 1 };
 }
 
 export default {
   name: 'submit',
-  summary: 'Send a store build to App Store Connect or Google Play, as a draft, after an owner approves it',
-  description: 'The runner sends it with the keys of the vault (asc_api_key, google_service_account), and always as a draft: the review is asked in the store. The track and the Apple ID of the app come from the options or from submit.<profile> of ias.json; Google Play goes to the internal track by default.',
+  summary: 'Send a store build to App Store Connect or Google Play, after an owner approves it (a draft by default)',
+  description: 'The runner sends it with the keys of the vault (asc_api_key, google_service_account). Google Play goes to the internal track by default and, like always, as a draft: the review is asked in Play. --release-status inProgress with --rollout serves a percentage and --release-status completed serves it to everyone, only when the track has a policy that allows it (an owner sets it with ias releases policy; without one, a track only takes drafts). --changes-not-sent-for-review applies the commit without sending it for review: a person sends it from Play Console, and until then nobody receives it (redundant with a draft). submit.<profile>.android.releaseStatus, rollout and changesNotSentForReview in ias.json are used the same way, and if the policy does not allow them the command warns and sends a draft instead.',
   positionals: [{ name: 'build', description: 'The id of a store build that succeeded, from ias builds list.', pattern: BUILD_ID }],
   options: {
-    track: { type: 'string', value: '<track>', description: 'Google Play: production, beta, alpha, internal (the default) or a closed track.' },
+    track: { type: 'string', value: '<track>', description: 'Google Play: production, beta, alpha, internal (the default), a closed track or a form factor\'s (wear:production).' },
     'asc-app-id': { type: 'string', value: '<id>', description: 'App Store Connect: the Apple ID of the app (submit.<profile>.ios.ascAppId by default).' },
+    'release-status': { type: 'string', value: '<draft|inProgress|completed>', description: 'Google Play: the state of the release (draft by default).' },
+    rollout: { type: 'string', value: '<1-99>', description: 'Google Play: the percentage an inProgress release serves; 100 is completed.' },
+    'changes-not-sent-for-review': { type: 'boolean', description: 'Google Play: apply the release without sending it for review; a person sends it in Play Console (submit.<profile>.android.changesNotSentForReview by default).' },
     wait: { type: 'boolean', description: 'Wait until the runner has sent it, and say what the store answered.' },
   },
   run: submit,