crossbind 2.0.0-beta.66 → 2.0.0-beta.68

package/src/actions/appleSigning.js

@@ -2,6 +2,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { secretFile } from '../utils/secretFile.js';
 
 // The Developer ID that signs a macOS app and the App Store Connect API key Apple notarizes it with, named by the
 // environment alone so that no secret reaches a file.
@@ -12,6 +13,10 @@ export const APPLE_SIGNING = {
     issuer: 'CROSSBIND_APPLE_API_ISSUER',
 };
 const NOTARY = [APPLE_SIGNING.key, APPLE_SIGNING.keyId, APPLE_SIGNING.issuer];
+// App Store Connect gives a key's file as AuthKey_<key id>.p8, so the file's own name tells its ID.
+const KEY_FILE = /^AuthKey_([A-Z0-9]{10})\.p8$/;
+// A key's own text, as CI's secrets give it, in place of its file's path.
+const KEY_TEXT = /^\s*-----BEGIN /;
 
 const listed = (names) => `${names.join(' and ')} ${names.length > 1 ? 'are' : 'is'}`;
 
@@ -30,16 +35,32 @@ function signingIdentities() {
         .map(([, hash, name]) => ({ hash, name }));
 }
 
+// The App Store Connect API key the environment names, with which Apple notarizes a macOS app and xcodebuild uploads an
+// iOS one in place of Xcode's account, or null: all of it or none, but for its ID where its file's name tells it. The key
+// is its file, or its text, which goes to a file as the tools take files.
+export function appStoreKey(env = process.env) {
+    const set = NOTARY.filter((name) => env[name]);
+    if (!set.length) return null;
+    const given = env[APPLE_SIGNING.key] ?? '';
+    const isText = KEY_TEXT.test(given);
+    const keyId = env[APPLE_SIGNING.keyId] || (isText ? undefined : path.basename(given).match(KEY_FILE)?.[1]);
+    const missing = NOTARY.filter((name) => !env[name] && !(name === APPLE_SIGNING.keyId && keyId));
+    if (missing.length) {
+        const byName = missing.includes(APPLE_SIGNING.keyId) && !isText ? ', the ID unless its file keeps the name App Store Connect gives it, AuthKey_<key id>.p8' : '';
+        throw new Error(`crossbind: ${listed(set)} set, but ${listed(missing)} not: an App Store Connect API key takes all three${byName}.`);
+    }
+    const key = isText ? secretFile('AuthKey.p8', `${given.trim()}\n`) : path.resolve(given);
+    if (!fs.statSync(key, { throwIfNoEntry: false })?.isFile()) throw new Error(`crossbind: ${APPLE_SIGNING.key} names ${key}, which is no file.`);
+    return { key, keyId, issuer: env[APPLE_SIGNING.issuer] };
+}
+
 // The identity a macOS app is signed with and the key Apple notarizes it with, or null without an identity: the app is
-// then signed ad hoc, which opens it on the Mac that built it alone. codesign takes the identity's hash, which the
-// renewed certificates of one name do not share.
+// then signed ad hoc, which opens it on the Mac that built it alone, even with the key, which iOS uploads take too.
+// codesign takes the identity's hash, which the renewed certificates of one name do not share.
 export function appleSigning(env = process.env) {
-    const notary = NOTARY.filter((name) => env[name]);
     const identity = env[APPLE_SIGNING.identity];
-    if (!identity) {
-        if (notary.length) throw new Error(`crossbind: ${listed(notary)} set without ${APPLE_SIGNING.identity}, the Developer ID that signs the app Apple notarizes.`);
-        return null;
-    }
+    if (!identity) return null;
+    const notary = appStoreKey(env);
     const found = signingIdentities().filter(({ hash, name }) => hash === identity.toUpperCase() || name.includes(identity));
     const matches = [...new Map(found.map((match) => [match.hash, match])).values()];
     if (!matches.length) throw new Error(`crossbind: ${APPLE_SIGNING.identity} names ${JSON.stringify(identity)}, which no valid code signing identity in the keychain is; \`security find-identity -v -p codesigning\` lists them.`);
@@ -47,13 +68,10 @@ export function appleSigning(env = process.env) {
         throw new Error(`crossbind: ${APPLE_SIGNING.identity} names ${JSON.stringify(identity)}, which ${matches.length} identities in the keychain are: ${matches.map(({ hash, name }) => `${hash} "${name}"`).join(', ')}. Set it to one of their hashes.`);
     }
     const [{ hash, name }] = matches;
-    if (!notary.length) return { identity: hash, notary: null };
-    const missing = NOTARY.filter((variable) => !env[variable]);
-    if (missing.length) throw new Error(`crossbind: ${listed(notary)} set, but ${listed(missing)} not: notarizing takes all three.`);
-    if (!name.startsWith('Developer ID Application:')) throw new Error(`crossbind: Apple notarizes an app signed with a Developer ID Application certificate, which ${JSON.stringify(name)} is not.`);
-    const key = path.resolve(env[APPLE_SIGNING.key]);
-    if (!fs.statSync(key, { throwIfNoEntry: false })?.isFile()) throw new Error(`crossbind: ${APPLE_SIGNING.key} names ${key}, which is no file.`);
-    return { identity: hash, notary: { key, keyId: env[APPLE_SIGNING.keyId], issuer: env[APPLE_SIGNING.issuer] } };
+    if (notary && !name.startsWith('Developer ID Application:')) {
+        throw new Error(`crossbind: Apple notarizes an app signed with a Developer ID Application certificate, which ${JSON.stringify(name)} is not.`);
+    }
+    return { identity: hash, notary };
 }
 
 // The ticket Apple issues can take a moment to reach the servers stapler asks for it.

package/src/actions/buildApp.js

@@ -30,8 +30,10 @@ import findFiles from '../utils/findFiles.js';
 import { getContentHash, getFilesFingerprint } from '../utils/hash.js';
 import { xmlPlist } from '../utils/plist.js';
 import {
-    appBackgroundColor, appDisplayName, appHeader, appId, appPermissions, appUrlSchemes, usageDescriptions,
+    appBackgroundColor, appCategory, appCopyright, appDisplayName, appEncryption, appHeader, appId, appPermissions, appPrivacy, appUrlSchemes,
+    usageDescriptions,
 } from '../utils/appOptions.js';
+import { unreasonedApis, unreasonedWarning } from '../utils/requiredReasonApis.js';
 import { androidIcons, iosIcon, linuxIcon, macIcon, readAppIcon, windowsIcon } from '../utils/appIcon.js';
 import writeIfChanged from '../utils/writeIfChanged.js';
 import { writeNativeSourceStamp } from '../utils/nativeSourceStamp.js';
@@ -78,7 +80,8 @@ export function assertAppRunner(target) {
 
 // The app a bundler builds: this machine's desktop app, or with CROSSBIND_APP_PLATFORM an iOS app for both SDKs, an
 // Android app for both ABIs, or a Linux or Windows app for both arches, which builds in Docker on any machine. During
-// development only what runs it: the Simulator, the attached device, or this machine.
+// development only what runs it: the Simulator, or the iPhone or iPad CROSSBIND_APP_DEVICE names, the attached Android
+// device, or this machine.
 export function appTargetParams({ dev = false } = {}, env = process.env) {
     const platform = env.CROSSBIND_APP_PLATFORM;
     const app = (platforms, archs) => {
@@ -107,11 +110,12 @@ export function appTargetParams({ dev = false } = {}, env = process.env) {
         throw new Error(`crossbind: CROSSBIND_APP_PLATFORM=${platform} names no platform an app builds for. Set it to android, ios, linux, macos or windows, or leave it unset for this machine's desktop app.`);
     }
     if (process.platform !== 'darwin') throw new Error('crossbind: iOS apps build on macOS, with Xcode.');
-    return getTargetParams({ platform: ['ios'], arch: dev ? ['iphonesimulator'] : IOS_SDKS, runtime: ['mt'], runtimeEnv: ['app'] }, true);
+    const devSdk = env.CROSSBIND_APP_DEVICE ? 'iphoneos' : 'iphonesimulator';
+    return getTargetParams({ platform: ['ios'], arch: dev ? [devSdk] : IOS_SDKS, runtime: ['mt'], runtimeEnv: ['app'] }, true);
 }
 
 // The Apple team that signs an iOS app: the project's app.team, else the machine's XCODE_DEVELOPMENT_TEAM, else none.
-function appTeam() {
+export function appTeam() {
     const team = state.config.app.team ?? state.config.system.XCODE_DEVELOPMENT_TEAM ?? '';
     if (team && !/^[A-Z0-9]{10}$/.test(team)) {
         throw new Error(`crossbind: ${JSON.stringify(team)} (app.team or XCODE_DEVELOPMENT_TEAM) is no Apple team id, which is ten capital letters and digits.`);
@@ -119,22 +123,41 @@ function appTeam() {
     return team;
 }
 
+// An Android application id: dot-separated parts of letters, digits and underscores that each start with a letter.
+const ANDROID_APP_ID = /^[A-Za-z][A-Za-z0-9_]*(\.[A-Za-z][A-Za-z0-9_]*)+$/;
+
 // An Android app's id: the project's app.id, else one made from the project's name.
-function androidAppId() {
+export function androidAppId() {
     const id = state.config.app.id ?? `dev.crossbind.${state.config.general.name.replace(/[^A-Za-z0-9.]/g, '_')}`;
-    if (!/^[A-Za-z][A-Za-z0-9_]*(\.[A-Za-z][A-Za-z0-9_]*)+$/.test(id)) {
+    if (!ANDROID_APP_ID.test(id)) {
         throw new Error(`crossbind: ${JSON.stringify(id)} (app.id, else made from the project's name) is no Android application id, which takes dot-separated parts of letters, digits and underscores that each start with a letter, as com.example.app does. Set app.id in crossbind.config.js.`);
     }
     return id;
 }
 
 // Apple takes dot-separated integers alone as an app's version.
-const appVersion = () => (state.config.package?.version ?? '1.0.0').replace(/[-+].*$/, '');
+export const appVersion = () => (state.config.package?.version ?? '1.0.0').replace(/[-+].*$/, '');
+
+const BUILD_NUMBER = 'CROSSBIND_APP_BUILD_NUMBER';
+// Google Play takes no larger version code.
+const MAX_VERSION_CODE = 2100000000;
+
+// The number CI or a publish gives a build, which iOS takes as its build and Android as its version code:
+// CROSSBIND_APP_BUILD_NUMBER, a whole number both stores take, else none.
+export function appBuildNumber(env = process.env) {
+    const value = env[BUILD_NUMBER];
+    if (!value) return null;
+    if (!/^[1-9]\d*$/.test(value) || Number(value) > MAX_VERSION_CODE) {
+        throw new Error(`crossbind: ${BUILD_NUMBER} ${JSON.stringify(value)} is no build number, which is a whole number from 1 to ${MAX_VERSION_CODE}, as both stores take.`);
+    }
+    return Number(value);
+}
 
-// Android takes any name for an app's version, and a positive integer that grows from release to release as its code.
-function androidVersion() {
+// Android takes any name for an app's version, and a positive integer that grows from release to release as its code:
+// the build number, else one made of the version's numbers.
+export function androidVersion(env = process.env) {
     const [major = 0, minor = 0, patch = 0] = appVersion().split('.').map(Number);
-    return { name: state.config.package?.version ?? '1.0.0', code: Math.max(1, major * 1000000 + minor * 1000 + patch) };
+    return { name: state.config.package?.version ?? '1.0.0', code: appBuildNumber(env) ?? Math.max(1, major * 1000000 + minor * 1000 + patch) };
 }
 
 // The apps this run built or found current. A part of an iOS app that an earlier run built may be stale.
@@ -195,9 +218,12 @@ const infoPlist = (name, version, hasIcon, urlSchemes) => xmlPlist({
     CFBundleShortVersionString: version,
     ...(urlSchemes.length > 0 ? { CFBundleURLTypes: [{ CFBundleURLName: appId(state.config), CFBundleURLSchemes: urlSchemes }] } : {}),
     CFBundleVersion: version,
+    ...(appCategory(state.config) ? { LSApplicationCategoryType: appCategory(state.config).darwin } : {}),
     LSMinimumSystemVersion: DARWIN_DEPLOYMENT_TARGET,
     NSPrincipalClass: 'NSApplication',
     NSHighResolutionCapable: true,
+    // The app menu's About item shows it.
+    ...(appCopyright(state.config) ? { NSHumanReadableCopyright: appCopyright(state.config) } : {}),
     ...usageDescriptions(state.config, 'darwin'),
 });
 
@@ -257,13 +283,16 @@ function assembleIosPart(target, { library, linkArgs, hbc, hermes }) {
 }
 
 // What an Android ABI target brings to the app's Gradle project: the host, the libraries beside it and the packages'
-// shared libraries it links, and the app's files.
+// shared libraries it links, and the app's files. A release's host build left the packages' libraries stripped beside
+// the host, and every library as linked in symbols/.
 function assembleAndroidPart(target, { libDir, sharedLibs, hbc }) {
     const part = `${state.config.paths.build}/${target.appName}`;
     fs.rmSync(part, { recursive: true, force: true });
     fs.mkdirSync(`${part}/lib`, { recursive: true });
-    [...['libcrossbind_app.so', 'libjsi.so', 'libc++_shared.so'].map((file) => `${libDir}/${file}`), ...sharedLibs]
+    const shipped = sharedLibs.map((file) => (fs.existsSync(`${libDir}/${path.basename(file)}`) ? `${libDir}/${path.basename(file)}` : file));
+    [...['libcrossbind_app.so', 'libjsi.so', 'libc++_shared.so'].map((file) => `${libDir}/${file}`), ...shipped]
         .forEach((file) => fs.copyFileSync(file, `${part}/lib/${path.basename(file)}`));
+    if (fs.existsSync(`${libDir}/symbols`)) fs.cpSync(`${libDir}/symbols`, `${part}/symbols`, { recursive: true });
     copyAppFiles(`${part}/app`, hbc, target);
 }
 
@@ -324,6 +353,34 @@ function shipMacApp(app, signing) {
     else console.warn(`crossbind: ${path.basename(app)} is signed ad hoc, which opens it on this Mac alone. Set ${APPLE_SIGNING.identity} to sign it with your Developer ID, and ${notarize}.`);
 }
 
+// App Store Connect refuses an iOS app whose archives call required reason API without app.privacy's reasons; the build
+// names them, from the archives a device gets.
+function warnUnreasonedApis(project, privacy) {
+    const device = `${project}/lib/iphoneos`;
+    if (!fs.existsSync(device)) return;
+    const archives = fs.readdirSync(device).filter((file) => file.endsWith('.a')).map((file) => `${device}/${file}`);
+    const warning = unreasonedWarning(unreasonedApis(archives, privacy));
+    if (warning) console.warn(warning);
+}
+
+// Where publishApp last put this project's iOS and Android apps, for `crossbind app publish`, which runs Vite and so
+// cannot know the outDir it builds into.
+const appOutputsFile = () => `${state.config.paths.build}/app-outputs.json`;
+const readAppOutputs = () => (fs.existsSync(appOutputsFile()) ? JSON.parse(fs.readFileSync(appOutputsFile(), 'utf8')) : {});
+
+export const clearAppOutputs = () => fs.rmSync(appOutputsFile(), { force: true });
+
+export function appOutputOf(platform) {
+    const output = readAppOutputs()[platform];
+    if (!output) throw new Error(`crossbind: the build wrote no ${platform} app, so there is nothing to publish.`);
+    return output;
+}
+
+function recordAppOutput(platform, to) {
+    fs.mkdirSync(state.config.paths.build, { recursive: true });
+    fs.writeFileSync(appOutputsFile(), `${JSON.stringify({ ...readAppOutputs(), [platform]: path.resolve(to) }, null, 4)}\n`);
+}
+
 // Where a build without a bundler puts an app: under its own name, or for iOS and Android as the project of its build
 // type.
 export function appOutputPath(target) {
@@ -339,10 +396,14 @@ export function publishApp(target, { to = appOutputPath(target), page = null } =
     if (target.platform === 'ios') {
         const parts = appParts(target).map(({ arch, dir }) => ({ sdk: arch, dir }));
         const icon = readAppIcon(state.config);
+        const privacy = appPrivacy(state.config);
+        const build = appBuildNumber();
         writeXcodeProject(to, {
-            parts, identity: { id: appId(state.config), team: appTeam() }, label: appDisplayName(state.config), version: appVersion(), icon: icon && iosIcon(icon),
-            urlSchemes: appUrlSchemes(state.config), background: appBackgroundColor(state.config), usage: usageDescriptions(state.config, 'ios'),
+            parts, identity: { id: appId(state.config), team: appTeam() }, label: appDisplayName(state.config), version: appVersion(),
+            build: build === null ? appVersion() : String(build), icon: icon && iosIcon(icon), urlSchemes: appUrlSchemes(state.config),
+            background: appBackgroundColor(state.config), usage: usageDescriptions(state.config, 'ios'), encryption: appEncryption(state.config), privacy,
         });
+        if (target.buildType === 'release') warnUnreasonedApis(to, privacy);
     } else if (target.platform === 'android') {
         const icon = readAppIcon(state.config);
         writeGradleProject(to, {
@@ -370,7 +431,10 @@ export function publishApp(target, { to = appOutputPath(target), page = null } =
         if (page) shipMacApp(to, signing);
     } else if (target.platform === 'android' && target.buildType === 'release') {
         packageAndroidRelease(to);
-    } else if (!['ios', 'android'].includes(target.platform)) {
+    }
+    if (['ios', 'android'].includes(target.platform)) {
+        recordAppOutput(target.platform, to);
+    } else if (target.platform !== 'darwin') {
         if (target.platform === 'win32') signWindowsApp(to, target, page);
         archiveApp(to, target);
     }
@@ -415,6 +479,7 @@ export default async function buildApp(target, { bridges = [], force = false } =
         inputs: headerDirs.flatMap((dir) => (fs.existsSync(dir) ? findFiles('**/*.h', { cwd: dir }) : [dir])),
     });
     const { libs, linkArgs, extraSources } = linkInputs(target, { bridge: BRIDGE });
+    const sharedLibs = libs.filter((lib) => lib.endsWith('.so'));
 
     const fingerprintFile = `${build}/${target.appName}.fingerprint`;
     const fingerprint = getContentHash(JSON.stringify({
@@ -471,6 +536,8 @@ export default async function buildApp(target, { bridges = [], force = false } =
         `-DCROSSBIND_EXTRA_SOURCES=${extraSources.join(';')}`,
         `-DCROSSBIND_LINK_ARGS=${linkArgs.join(';')}`,
         `-DCROSSBIND_LINK_DEPENDS=${libs.join(';')}`,
+        // An Android release ships the packages' shared libraries stripped as well, and keeps them as they come.
+        ...(target.platform === 'android' ? [`-DCROSSBIND_SHARED_LIBS=${sharedLibs.join(';')}`] : []),
         ...cmakeArgs,
     ], platformPrefix, target);
     run(null, ['cmake', '--build', '.', '-j', String(cpuCount)], platformPrefix, target, { exclusive: true });
@@ -487,7 +554,7 @@ export default async function buildApp(target, { bridges = [], force = false } =
     if (target.platform === 'ios') {
         assembleIosPart(target, { library: `${workDir}/lib${name}.a`, linkArgs, hbc: `${workDir}/host.hbc`, hermes });
     } else if (target.platform === 'android') {
-        assembleAndroidPart(target, { libDir: workDir, sharedLibs: libs.filter((lib) => lib.endsWith('.so')), hbc: `${workDir}/host.hbc` });
+        assembleAndroidPart(target, { libDir: workDir, sharedLibs, hbc: `${workDir}/host.hbc` });
     } else {
         assembleApp(target, { executable: `${workDir}/${path.basename(appLayout(target).executable)}`, hbc: `${workDir}/host.hbc`, hermes, icon });
     }

package/src/actions/buildExternal.js

@@ -7,6 +7,7 @@ import state from '../state/index.js';
 import buildLib from './buildLib.js';
 import buildBinTools from './buildBinTools.js';
 import { copyBundledLicenses } from '../utils/bundledLicenses.js';
+import { applyRecipePatches, refreshPatchedSource, writePatchedSourceStamp } from '../utils/recipePatches.js';
 
 export default async function buildExternal(targetParams, options = {}) {
     const version = state.config.package.nativeVersion;
@@ -14,9 +15,15 @@ export default async function buildExternal(targetParams, options = {}) {
         throw new Error(`crossbind: "${state.config.general?.name}" has a crossbind.build recipe but no "nativeVersion" in package.json — cannot build from source.`);
     }
 
-    const { sha256, replaceList, copyToSource, copyToDist } = state.config.build;
+    const { sha256, replaceList, copyToSource, copyToDist, patches } = state.config.build;
+    refreshPatchedSource(state.config.paths.build, patches);
     const isNewlyCreated = await downloadAndExtractFile(sourcesOf(state.config.build, version), state.config.paths.build, sha256);
     const sourcePath = `${state.config.paths.build}/source`;
+    // Upstream fixes are diffs against the source as released, so they go in before crossbind's own edits.
+    if (isNewlyCreated) {
+        applyRecipePatches(sourcePath, patches);
+        writePatchedSourceStamp(state.config.paths.build, patches);
+    }
     if (isNewlyCreated && replaceList) {
         replaceList.forEach(({ regex, replacement, paths }) => {
             replace({

package/src/actions/createLib.js

@@ -11,7 +11,9 @@ import state from '../state/index.js';
 import logger from '../utils/logger.js';
 import { WASI_EMULATION_LIBS, WASI_LINK_LIBS, wasiCFlags, wasiCxxFlags } from '../utils/wasiToolchain.js';
 import { stageWasiHttpInclude, wasiHttpHeader } from '../utils/wasiHttp.js';
-import { appApiHeader, compilesAsApp, stageAppApiInclude } from '../utils/appApiHeader.js';
+import {
+    appApiHeader, appCompileOptions, compilesAsApp, stageAppApiInclude,
+} from '../utils/appApiHeader.js';
 import { getFilesFingerprint, getContentHash } from '../utils/hash.js';
 import { withDependencyBridges } from '../utils/dependencyBridges.js';
 import { targetArchiveFlags } from '../utils/archiveFlags.js';
@@ -66,8 +68,8 @@ export default function createLib(target, fileType, options = {}) {
         : null;
     // An Android app links the project's archives from the build where React Native's shared library comes from.
     const appArchives = target.platform === 'android' && target.runtimeEnv === 'app' ? 'archives' : null;
-    // An app's own code compiles against <crossbind/app.h>, with CROSSBIND_APP defined.
-    const appApi = compilesAsApp(target) ? getFilesFingerprint([appApiHeader()]) : null;
+    // An app's own code compiles against <crossbind/app.h>, with the options of an app.
+    const appApi = compilesAsApp(target) ? [getFilesFingerprint([appApiHeader()]), ...appCompileOptions(target)] : null;
     const extraKeys = [httpHeader, appArchives, appApi].filter(Boolean);
     const flagsFingerprint = getContentHash(JSON.stringify(extraKeys.length ? [keyInputs, ...extraKeys] : keyInputs));
     const flagsChanged = !fs.existsSync(flagsFingerprintFile)

package/src/actions/getCmakeParameters.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs';
 import state from '../state/index.js';
 import getData from './getData.js';
-import { compilesAsApp } from '../utils/appApiHeader.js';
+import { appCompileOptions } from '../utils/appApiHeader.js';
 
 export default function getCmakeParameters(target, options = {}) {
     if (!options || typeof options !== 'object' || Array.isArray(options)) {
@@ -39,8 +39,7 @@ export default function getCmakeParameters(target, options = {}) {
     const otherBuildType = buildType === 'STATIC' ? 'SHARED' : 'STATIC';
 
     // An app's own code can tell it is one, to reach <crossbind/app.h>.
-    const appOptions = compilesAsApp(target) ? ['-DCROSSBIND_APP'] : [];
-    const cmakeCompileOptions = [...new Set([...(getData('cmake', target)?.compileOptions || []), ...appOptions])];
+    const cmakeCompileOptions = [...new Set([...(getData('cmake', target)?.compileOptions || []), ...appCompileOptions(target)])];
 
     params.push(...[
         `-DPROJECT_NAME=${options.name || state.config.general.name}`,

package/src/actions/googlePlay.js

@@ -0,0 +1,213 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createSign } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { accessToken } from './googleSignIn.js';
+import { readSecret, storeSecret } from '../utils/keychain.js';
+
+// Google Play's credentials, which the environment or ~/.crossbind.json names: a service account's e-mail, whose token
+// the user's gcloud login buys with no key, or its JSON key; or, from the environment alone, an access token made
+// elsewhere, as CI makes one with no key.
+export const PLAY = { key: 'CROSSBIND_GOOGLE_PLAY_KEY', serviceAccount: 'CROSSBIND_GOOGLE_PLAY_SERVICE_ACCOUNT', token: 'CROSSBIND_GOOGLE_PLAY_TOKEN' };
+export const PLAY_SCOPE = 'https://www.googleapis.com/auth/androidpublisher';
+// The keychain keeps the user's Google sign-in for Play under this service; on Windows, beside this path.
+const SIGN_IN_SERVICE = 'crossbind google play';
+const signInKey = () => path.join(os.homedir(), '.crossbind', 'google-play');
+const API = 'https://androidpublisher.googleapis.com/androidpublisher/v3/applications';
+const UPLOAD = 'https://androidpublisher.googleapis.com/upload/androidpublisher/v3/applications';
+const IAM = 'https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts';
+// The longest a service account's token lasts.
+const TOKEN_SECONDS = 3600;
+// Play's answer for an app whose first release Play Console has not rolled out yet.
+const DRAFT_APP = /status draft may be created on draft app/;
+
+const encode = (value) => Buffer.from(JSON.stringify(value)).toString('base64url');
+
+// A JSON key's own text, as CI's secrets give it, in place of its file's path.
+const KEY_TEXT = /^\s*\{/;
+
+// A service account key from its JSON, which `source` names where it is none, never repeating the text.
+function parseKey(json, source, isText) {
+    let key;
+    try {
+        key = JSON.parse(json);
+    } catch {
+        throw new Error(`crossbind: ${source} ${isText ? 'holds' : 'is'} no JSON, so it is no service account key.`);
+    }
+    const missing = ['client_email', 'private_key', 'token_uri'].filter((field) => !key[field]);
+    if (missing.length) throw new Error(`crossbind: ${source} has no ${missing.join(', ')}, so it is no service account key.`);
+    return key;
+}
+
+function readKey(file) {
+    if (!fs.statSync(file, { throwIfNoEntry: false })?.isFile()) throw new Error(`crossbind: ${PLAY.key} names ${file}, which is no file.`);
+    return parseKey(fs.readFileSync(file, 'utf8'), `${file} (${PLAY.key})`, false);
+}
+
+// The credentials Play takes from this environment and machine, or null without any: one of the three kinds.
+export function playCredentials(env = process.env, system = {}) {
+    const file = env[PLAY.key] || system.GOOGLE_PLAY_KEY;
+    const account = env[PLAY.serviceAccount] || system.GOOGLE_PLAY_SERVICE_ACCOUNT;
+    const token = env[PLAY.token];
+    if (file && account) {
+        throw new Error(`crossbind: both ${PLAY.key} and ${PLAY.serviceAccount} are set, or their keys in ~/.crossbind.json: set one, the service account's e-mail to use your gcloud login, or its JSON key.`);
+    }
+    if (token && (file || account)) {
+        throw new Error(`crossbind: ${PLAY.token} is set, and so is ${file ? PLAY.key : PLAY.serviceAccount} or its key in ~/.crossbind.json: set one.`);
+    }
+    if (token) return { token };
+    if (account) return { account };
+    if (!file) return null;
+    if (KEY_TEXT.test(env[PLAY.key] ?? '')) {
+        const key = parseKey(env[PLAY.key], PLAY.key, true);
+        return { account: key.client_email, key, file: null };
+    }
+    const key = readKey(file);
+    return { account: key.client_email, key, file };
+}
+
+// The user's Google sign-in for Play that this machine keeps, or null where it keeps none or Google no longer takes it.
+export async function keptSignIn() {
+    const refreshToken = readSecret(signInKey(), { service: SIGN_IN_SERVICE });
+    if (!refreshToken) return null;
+    try {
+        await accessToken(refreshToken);
+    } catch (error) {
+        if (error.reason !== 'invalid_grant') throw error;
+        console.log('crossbind: Google no longer takes the sign-in this machine keeps for Google Play, as when it was revoked.');
+        return null;
+    }
+    return { refreshToken };
+}
+
+// Keeps the user's Google sign-in for Play in the system's keychain, and says whether it did.
+export function keepSignIn(refreshToken) {
+    fs.mkdirSync(path.dirname(signInKey()), { recursive: true });
+    return storeSecret(signInKey(), refreshToken, { service: SIGN_IN_SERVICE });
+}
+
+async function keyToken({ account, key }) {
+    const now = Math.floor(Date.now() / 1000);
+    const unsigned = `${encode({ alg: 'RS256', typ: 'JWT' })}.${encode({ iss: account, scope: PLAY_SCOPE, aud: key.token_uri, iat: now, exp: now + TOKEN_SECONDS })}`;
+    const signature = createSign('RSA-SHA256').update(unsigned).sign(key.private_key).toString('base64url');
+    const response = await fetch(key.token_uri, {
+        method: 'POST',
+        body: new URLSearchParams({ grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer', assertion: `${unsigned}.${signature}` }),
+    });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok) throw new Error(`crossbind: Google refused the token of ${account}: ${response.status} ${body.error ?? ''} ${body.error_description ?? ''}`.trim());
+    return body.access_token;
+}
+
+// The user's own gcloud login buys an hour's token of the service account, so no key of it exists anywhere.
+async function accountToken({ account }) {
+    const own = spawnSync('gcloud', ['auth', 'print-access-token'], { encoding: 'utf8' });
+    if (own.error || own.status !== 0) {
+        throw new Error(`crossbind: gcloud gave no token of yours: sign in with gcloud auth login, or name the service account's JSON key with ${PLAY.key} instead.\n${(own.stderr || own.error?.message || '').trim()}`);
+    }
+    const response = await fetch(`${IAM}/${account}:generateAccessToken`, {
+        method: 'POST',
+        headers: { authorization: `Bearer ${own.stdout.trim()}`, 'content-type': 'application/json' },
+        body: JSON.stringify({ scope: [PLAY_SCOPE] }),
+    });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok) {
+        throw new Error(`crossbind: Google gave no token of ${account}: ${response.status} ${body.error?.message ?? ''}\nyour gcloud account needs the Service Account Token Creator role on it, and its project the IAM Service Account Credentials API.`);
+    }
+    return body.accessToken;
+}
+
+// An hour's token of Play's API: the one from the environment, or one for the user's Google sign-in or for the service
+// account.
+export async function playToken(credentials) {
+    if (credentials.token) return credentials.token;
+    if (credentials.refreshToken) return accessToken(credentials.refreshToken);
+    return credentials.key ? keyToken(credentials) : accountToken(credentials);
+}
+
+function playError(status, message, method, url, appId, credentials) {
+    const route = new URL(url).pathname.replace(/^.*\/applications\/[^/]+/, '') || '/';
+    let text = `crossbind: Google Play answered ${method} ${route} with ${status}: ${message}`;
+    if (status === 404 && route === '/edits') {
+        text = `crossbind: Play Console has no app ${appId}: create it there, with ${appId} as its package name, as Play's API makes none.`;
+    } else if (status === 401 && credentials.token) {
+        text = `crossbind: Google Play takes ${PLAY.token} no more: it has expired, as access tokens do after an hour, or it is no access token; make it in the publish's own job.`;
+    } else if (status === 403 && credentials.token && /insufficient authentication scopes/i.test(message)) {
+        text = `crossbind: ${PLAY.token} lacks the scope ${PLAY_SCOPE}, which Google Play's API takes: ask for it where the token is made, as google-github-actions/auth's access_token_scopes does.`;
+    } else if (status === 403 && credentials.refreshToken) {
+        text = `crossbind: the Google account you signed in with has no release rights for ${appId}: sign in with one that has, or have it invited in Play Console, under Users and permissions, with "Release apps to testing tracks" for the app.`;
+    } else if (status === 403) {
+        const account = credentials.token ? `the account behind ${PLAY.token}` : credentials.account;
+        text = `crossbind: ${account} has no release rights for ${appId}: invite it in Play Console, under Users and permissions, with "Release apps to testing tracks" for the app.`;
+    }
+    return Object.assign(new Error(text), { status, playMessage: message });
+}
+
+// A caller of Play's API for one app, whose failures say what to do where they can.
+async function playCaller(appId, credentials) {
+    const token = await playToken(credentials);
+    return async (method, url, body) => {
+        const isBinary = Buffer.isBuffer(body);
+        const response = await fetch(url, {
+            method,
+            headers: { authorization: `Bearer ${token}`, 'content-type': isBinary ? 'application/octet-stream' : 'application/json' },
+            body: isBinary || body === undefined ? body : JSON.stringify(body),
+        });
+        const text = await response.text();
+        if (response.ok) return text ? JSON.parse(text) : {};
+        let message = text;
+        try {
+            message = JSON.parse(text).error?.message ?? text;
+        } catch {
+            // Not Google's JSON error, so the text is the message.
+        }
+        throw playError(response.status, message, method, url, appId, credentials);
+    };
+}
+
+// The highest versionCode Play has seen of an app, in its bundles, its APKs and its tracks' releases; 0 for none.
+export async function highestVersionCode(appId, credentials) {
+    const call = await playCaller(appId, credentials);
+    const edits = `${API}/${appId}/edits`;
+    const edit = await call('POST', edits, {});
+    try {
+        const { tracks = [] } = await call('GET', `${edits}/${edit.id}/tracks`);
+        const { bundles = [] } = await call('GET', `${edits}/${edit.id}/bundles`);
+        const { apks = [] } = await call('GET', `${edits}/${edit.id}/apks`);
+        const released = tracks.flatMap(({ releases = [] }) => releases.flatMap(({ versionCodes = [] }) => versionCodes));
+        return Math.max(0, ...[...bundles, ...apks].map(({ versionCode }) => versionCode), ...released.map(Number));
+    } finally {
+        await call('DELETE', `${edits}/${edit.id}`).catch(() => {});
+    }
+}
+
+// Uploads a bundle, with the zip of its native debug symbols if there is one, and releases it on a track, as status
+// says, in one edit. An app never released takes a draft alone, which its first rollout in Play Console makes live, so
+// its release becomes one.
+export async function uploadBundle(appId, credentials, { aab, symbols = null, track, status }) {
+    const call = await playCaller(appId, credentials);
+    const edits = `${API}/${appId}/edits`;
+    const edit = await call('POST', edits, {});
+    try {
+        const { versionCode } = await call('POST', `${UPLOAD}/${appId}/edits/${edit.id}/bundles?uploadType=media`, fs.readFileSync(aab));
+        if (symbols) {
+            await call('POST', `${UPLOAD}/${appId}/edits/${edit.id}/apks/${versionCode}/deobfuscationFiles/nativeCode?uploadType=media`, fs.readFileSync(symbols));
+        }
+        const release = async (releaseStatus) => {
+            await call('PUT', `${edits}/${edit.id}/tracks/${track}`, { track, releases: [{ versionCodes: [String(versionCode)], status: releaseStatus }] });
+            await call('POST', `${edits}/${edit.id}:commit`);
+            return { versionCode, status: releaseStatus };
+        };
+        try {
+            return await release(status);
+        } catch (error) {
+            if (status === 'draft' || !DRAFT_APP.test(error.playMessage ?? '')) throw error;
+            return await release('draft');
+        }
+    } catch (error) {
+        // An edit left open expires by itself; the first failure is the one to report.
+        await call('DELETE', `${edits}/${edit.id}`).catch(() => {});
+        throw error;
+    }
+}

package/src/actions/googleSignIn.js

@@ -0,0 +1,78 @@
+import http from 'node:http';
+import { createHash, randomBytes } from 'node:crypto';
+import openUrl from '../utils/openUrl.js';
+
+// crossbind's own OAuth client, a desktop app's. Google counts a desktop app's secret as public, as every copy of the app
+// carries it, and PKCE ties each sign-in to the crossbind that started it. The secret is split only so that secret
+// scanners do not take it for a leaked one.
+const CLIENT_ID = '1070398855248-kemr8k5u0k8l2ovuvql32e220fhap165.apps.googleusercontent.com';
+const CLIENT_SECRET = ['GOCSPX', '5w7qGQktYssQg9C5ClWs4x0hZeHV'].join('-');
+const AUTHORIZE = 'https://accounts.google.com/o/oauth2/v2/auth';
+const TOKEN = 'https://oauth2.googleapis.com/token';
+
+const randomText = (bytes) => randomBytes(bytes).toString('base64url');
+
+async function tokens(grant) {
+    const response = await fetch(TOKEN, { method: 'POST', body: new URLSearchParams({ client_id: CLIENT_ID, client_secret: CLIENT_SECRET, ...grant }) });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok) {
+        const reason = `${response.status} ${body.error ?? ''} ${body.error_description ?? ''}`.trim();
+        throw Object.assign(new Error(`crossbind: Google refused crossbind's sign-in: ${reason}`), { reason: body.error });
+    }
+    return body;
+}
+
+// The code Google's page sends the browser back to this machine with once the user has signed in. A request without this
+// sign-in's state is no answer of Google's to it, and is turned away.
+function codeFrom(server, state) {
+    return new Promise((resolve, reject) => {
+        server.on('request', (request, response) => {
+            const query = new URL(request.url, 'http://127.0.0.1').searchParams;
+            if (query.get('state') !== state) {
+                response.writeHead(400, { connection: 'close' }).end();
+                return;
+            }
+            const code = query.get('code');
+            response.writeHead(200, { 'content-type': 'text/plain; charset=utf-8', connection: 'close' })
+                .end(code ? 'crossbind is signed in. Close this tab and go back to the terminal.' : 'crossbind is not signed in. Go back to the terminal.');
+            if (code) resolve(code);
+            else reject(new Error(`crossbind: Google's sign-in ended with ${query.get('error') ?? 'no code'}.`));
+        });
+    });
+}
+
+// Signs the user in with their Google account, in their browser, for scope: Google's page sends the browser back to a
+// port of this machine. It resolves to Google's tokens, whose scope says what the user granted, as the page lets them
+// leave a scope out.
+export async function signIn(scope) {
+    const server = http.createServer();
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', resolve);
+    });
+    const verifier = randomText(32);
+    const state = randomText(16);
+    const redirect = `http://127.0.0.1:${server.address().port}`;
+    const page = `${AUTHORIZE}?${new URLSearchParams({
+        client_id: CLIENT_ID,
+        redirect_uri: redirect,
+        response_type: 'code',
+        scope,
+        code_challenge: createHash('sha256').update(verifier).digest('base64url'),
+        code_challenge_method: 'S256',
+        state,
+        prompt: 'select_account',
+    })}`;
+    console.log(`crossbind: opening Google's sign-in in your browser; if it does not open, go to ${page}`);
+    openUrl(page);
+    try {
+        const code = await codeFrom(server, state);
+        return await tokens({ grant_type: 'authorization_code', code, code_verifier: verifier, redirect_uri: redirect });
+    } finally {
+        server.close();
+    }
+}
+
+// An hour's access token for the refresh token of an earlier sign-in. Google refuses one revoked or expired, with the
+// reason invalid_grant.
+export const accessToken = async (refreshToken) => (await tokens({ grant_type: 'refresh_token', refresh_token: refreshToken })).access_token;