crossbind 2.0.0-beta.66 → 2.0.0-beta.68

package/src/actions/gradleProject.js

@@ -154,6 +154,9 @@ export default function writeGradleProject(to, { parts, id, label, version, icon
         .replace(INTERNET, [INTERNET, ...usesPermissions(permissions)].join('\n'))
         .replace(ACTIVITY_END, urlSchemes.length > 0 ? `${urlFilter(urlSchemes)}\n${ACTIVITY_END}` : ACTIVITY_END));
     parts.forEach(({ arch, dir }) => fs.cpSync(path.join(dir, 'lib'), path.join(main, 'jniLibs', arch), { recursive: true }));
+    // A release keeps its libraries as linked beside the stripped ones it ships, for Google Play's crash reports.
+    parts.filter(({ dir }) => fs.existsSync(path.join(dir, 'symbols')))
+        .forEach(({ arch, dir }) => fs.cpSync(path.join(dir, 'symbols'), path.join(to, 'symbols', arch), { recursive: true }));
     fs.cpSync(path.join(parts[0].dir, 'app'), path.join(main, 'assets', 'app'), { recursive: true });
     if (icons) {
         Object.entries({ ...icons, 'mipmap-anydpi/ic_launcher.xml': ADAPTIVE_ICON }).forEach(([file, content]) => {

package/src/actions/iosDevice.js

@@ -0,0 +1,200 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import { spawn, spawnSync } from 'node:child_process';
+import { EXEC_MAX_BUFFER } from './run.js';
+import { appTeam } from './buildApp.js';
+import { xcodebuild, xcodeTeams } from './appStoreConnect.js';
+import state from '../state/index.js';
+import { appId } from '../utils/appOptions.js';
+
+// How much of what devicectl says as it launches the app is read for a failure; the app's own output follows it.
+const SAID_LIMIT = 64 * 1024;
+const LAUNCHED = /Launched application with/;
+// Addresses of this Mac that no device reaches.
+const LOOPBACK = ['localhost', '127.0.0.1', '::1'];
+// Vite's --host for every address of this Mac.
+const EVERY_ADDRESS = [true, '0.0.0.0', '::'];
+
+const developerModeFix = (name) => `Developer Mode is off on ${name}: turn it on in Settings › Privacy & Security › Developer Mode, which restarts ${name}, and run again.`;
+
+// What a failed install or launch on the device means, in devicectl's words, and what the developer does about it.
+const FIXES = [
+    { pattern: /device was still locked|device is currently locked/i, fix: ({ name }) => `unlock ${name}, and run again.` },
+    { pattern: /developer mode is not enabled/i, fix: ({ name }) => developerModeFix(name) },
+    {
+        pattern: /0xe8008012|provisioning profile cannot be installed on this device/i,
+        fix: ({ name }) => `the app's profile leaves ${name} out, which Xcode registers with the team as it builds for it: run again, and if it stays out, run the app on ${name} from Xcode once.`,
+    },
+    {
+        pattern: /not been explicitly trusted by the user/i,
+        fix: ({ name }) => `${name} does not trust the app's developer yet, as with a free team's first app: on ${name}, open Settings › General › VPN & Device Management, trust the Apple Development entry, and run again.`,
+    },
+];
+
+function tool(program, args, options = {}) {
+    const result = spawnSync(program, args, { encoding: 'utf8', maxBuffer: EXEC_MAX_BUFFER, ...options });
+    if (result.status !== 0) {
+        throw new Error(`crossbind: ${program} ${args.join(' ')} failed: ${`${result.stdout ?? ''}${result.stderr ?? ''}`.trim() || result.error?.message}`);
+    }
+    return result.stdout;
+}
+
+// devicectl's output, or its failure with what it said and, where known, what to do on `device`.
+function devicectl(args, device = null) {
+    const result = spawnSync('xcrun', ['devicectl', ...args], { encoding: 'utf8', maxBuffer: EXEC_MAX_BUFFER });
+    if (result.status === 0) return result.stdout;
+    const said = `${result.stdout ?? ''}${result.stderr ?? ''}`.trim() || result.error?.message;
+    const fix = device && FIXES.find(({ pattern }) => pattern.test(said));
+    throw new Error([`crossbind: devicectl ${args.join(' ')} failed: ${said}`, ...(fix ? [`crossbind: ${fix.fix(device)}`] : [])].join('\n'));
+}
+
+// The iPhones and iPads this Mac reaches, on a cable or over the network; devicectl lists the Simulators too.
+function physicalDevices() {
+    return JSON.parse(devicectl(['list', 'devices', '--json-output', '-'])).result.devices
+        .filter(({ hardwareProperties: hardware, connectionProperties: connection }) => hardware?.reality === 'physical'
+            && hardware.platform === 'iOS' && connection?.transportType)
+        .map(({ deviceProperties: properties, hardwareProperties: hardware, connectionProperties: connection }) => ({
+            name: properties?.name ?? hardware.udid,
+            udid: hardware.udid,
+            isWired: connection.transportType === 'wired',
+            isPaired: connection.pairingState === 'paired',
+            developerMode: properties?.developerModeStatus,
+        }));
+}
+
+// iOS names a device with ’, as Ada’s iPhone, where a terminal types '.
+const plainName = (name) => name.replaceAll('’', "'");
+
+function pick(devices, choice) {
+    const found = choice ? devices.filter(({ name, udid }) => plainName(name) === plainName(choice) || udid === choice) : devices;
+    if (found.length === 1) return found[0];
+    if (found.length > 1) {
+        const names = found.map(({ name }) => name);
+        // A name two devices share names neither; a UDID is one device's.
+        const example = new Set(names).size === names.length ? `"${found.at(-1).name}"` : found.at(-1).udid;
+        throw new Error(`crossbind: ${found.length} iPhones and iPads are connected (${names.join(', ')}): name one, as --device ${example}.`);
+    }
+    throw new Error(choice
+        ? `crossbind: no iPhone or iPad named ${choice} is connected; connected: ${devices.map(({ name }) => name).join(', ') || 'none'}.`
+        : 'crossbind: no iPhone or iPad is connected. Connect one with a cable, unlock it, and tap Trust on it if it asks.');
+}
+
+// The iPhone or iPad an app runs on in development: the one `choice` names, by its name or UDID, else the only one
+// connected. It gets paired with this Mac, which the phone's Trust allows, and runs development apps once its Developer
+// Mode is on.
+export function connectedIosDevice(choice) {
+    let device = pick(physicalDevices(), choice);
+    if (!device.isPaired) {
+        console.log(`crossbind: tap Trust on ${device.name}, then enter its passcode, to pair it with this Mac.`);
+        devicectl(['manage', 'pair', '--device', device.udid], device);
+        device = pick(physicalDevices(), device.udid);
+    }
+    // A device just paired may not say yet; its install then names the fix, if it needs one.
+    if (device.developerMode === 'disabled') throw new Error(`crossbind: ${developerModeFix(device.name)}`);
+    return { name: device.name, udid: device.udid, isWired: device.isWired };
+}
+
+// What `crossbind app dev --device` hands Vite as CROSSBIND_APP_DEVICE: the device it names, else the UDID of the only
+// one connected.
+export function iosDeviceOption(choice, platform) {
+    if (platform !== 'ios') {
+        throw new Error('crossbind: --device opens an iOS app on an iPhone or iPad: add -p ios. An Android app opens on the attached device already, which ANDROID_SERIAL picks among several.');
+    }
+    return choice === true || choice === '' ? connectedIosDevice().udid : choice;
+}
+
+// The network interfaces the device's USB connection makes on this Mac, which ioreg holds under the USB device whose
+// serial number is the device's UDID without its dash. plutil turns no binary, date or non-finite value into JSON,
+// which ioreg's tree holds and the lookup needs none of.
+function cableInterfaces({ name, udid }) {
+    const tree = spawnSync('ioreg', ['-a', '-r', '-c', 'IOUSBHostDevice', '-l'], { encoding: 'utf8', maxBuffer: EXEC_MAX_BUFFER }).stdout;
+    if (!tree) return [];
+    const input = tree.replace(/<(data|date|real)>[^<]*<\/\1>/g, '<string></string>');
+    const json = spawnSync('plutil', ['-convert', 'json', '-o', '-', '-'], { input, encoding: 'utf8', maxBuffer: EXEC_MAX_BUFFER });
+    if (json.status !== 0) {
+        throw new Error(`crossbind: cannot read the USB devices ioreg lists, among them the cable to ${name}: ${(json.stderr ?? '').trim() || json.error?.message}`);
+    }
+    const serial = udid.replaceAll('-', '');
+    const nodes = (node) => [node, ...(node.IORegistryEntryChildren ?? []).flatMap(nodes)];
+    const usb = [JSON.parse(json.stdout)].flat().flatMap(nodes).find((node) => node['USB Serial Number'] === serial);
+    return usb ? nodes(usb).map((node) => node['BSD Name']).filter(Boolean) : [];
+}
+
+function defaultRouteInterface() {
+    return spawnSync('route', ['-n', 'get', 'default'], { encoding: 'utf8' }).stdout?.match(/interface:\s*(\S+)/)?.[1];
+}
+
+// The address of this Mac that the device reaches the dev server at: on the device's own cable, which needs no network,
+// else on the default route's network, which the device must share. A .local name or the CoreDevice tunnel reaches
+// nothing from the app.
+export function iosDeviceAddress(device) {
+    const route = device.isWired ? null : defaultRouteInterface();
+    if (/^(utun|ipsec|ppp)/.test(route ?? '')) {
+        throw new Error(`crossbind: this Mac's default route goes through ${route}, a VPN, which ${device.name} cannot reach: give this Mac's address on the phone's network with --host <address>, or connect the phone with a cable.`);
+    }
+    const interfaces = device.isWired ? cableInterfaces(device) : [route].filter(Boolean);
+    const address = interfaces.map((name) => os.networkInterfaces()[name]?.find(({ family }) => family === 'IPv4')?.address).find(Boolean);
+    if (address) return address;
+    throw new Error(device.isWired
+        ? `crossbind: this Mac has no address on the cable to ${device.name} yet: plug it in again, or give the address the phone reaches this Mac at with --host <address>.`
+        : `crossbind: this Mac has no network address ${device.name} could reach it at: join the network the phone is on, or give an address with --host <address>.`);
+}
+
+// Where the dev server is for the device: the address Vite's own --host names, else the one this Mac has for the
+// device, and the host Vite listens on, that one address unless --host asks for every one.
+export function iosDevServer(device, requested) {
+    if (LOOPBACK.includes(requested)) {
+        throw new Error(`crossbind: ${device.name} cannot reach this Mac at ${requested}: give --host an address the phone reaches, or leave --host out.`);
+    }
+    if (EVERY_ADDRESS.includes(requested)) return { address: iosDeviceAddress(device), host: requested };
+    const address = typeof requested === 'string' ? requested : iosDeviceAddress(device);
+    return { address, host: address };
+}
+
+function noTeam() {
+    const teams = xcodeTeams({ withPersonal: true }).map(({ id, name }) => `${id} (${name})`);
+    const which = teams.length > 0
+        ? `one of the teams Xcode is signed in to: ${teams.join(', ')}`
+        : 'the team of an account you sign in to in Xcode, under Settings › Accounts; a free Apple Account has a Personal Team';
+    return `crossbind: an app on an iPhone or iPad is signed for an Apple team: set app.team in crossbind.config.js, or XCODE_DEVELOPMENT_TEAM in ~/.crossbind.json, to ${which}.`;
+}
+
+// Builds an iOS app's Xcode project for the device, signed for the app's team by Xcode, which registers the device and
+// the bundle id with the team and makes the profile as it needs, and returns the app. xcodebuild takes a destination
+// only with a scheme, which Xcode makes of the project's target.
+export function buildForIosDevice(project, device) {
+    const { name } = state.config.general;
+    const team = appTeam();
+    if (!team) throw new Error(noTeam());
+    const products = `${state.config.paths.build}/xcode`;
+    fs.mkdirSync(products, { recursive: true });
+    xcodebuild(`the build for ${device.name}`, [
+        '-project', `${project}/${name}.xcodeproj`, '-scheme', name, '-configuration', 'Debug', '-sdk', 'iphoneos', '-destination', `id=${device.udid}`,
+        '-allowProvisioningUpdates', '-allowProvisioningDeviceRegistration', `SYMROOT=${products}`, 'build',
+    ], `${products}/device.log`, { team, id: appId(state.config) });
+    return `${products}/Debug-iphoneos/${name}.app`;
+}
+
+// Installs an iOS app on the device and opens it with `env` in its environment. The process returned is devicectl,
+// which xcrun runs in its own place: it carries the app's output and ends with the app, and a signal to it ends the app
+// too. A launch the phone refuses, as one that waits for the developer's trust, names its fix.
+export default function openOnIosDevice(app, { env = {}, stdio = 'pipe', device } = {}) {
+    devicectl(['device', 'install', 'app', '--device', device.udid, app], device);
+    const bundleId = tool('plutil', ['-extract', 'CFBundleIdentifier', 'raw', '-o', '-', `${app}/Info.plist`]).trim();
+    const [input, output, errors] = typeof stdio === 'string' ? [stdio, stdio, stdio] : stdio;
+    const child = spawn('xcrun', [
+        'devicectl', 'device', 'process', 'launch', '--device', device.udid, '--console', '--terminate-existing',
+        '--environment-variables', JSON.stringify(env), bundleId,
+    ], { stdio: [input, output, 'pipe'] });
+    child.stderr.setEncoding('utf8');
+    let said = '';
+    child.stderr.on('data', (text) => {
+        if (errors === 'inherit') process.stderr.write(text);
+        if (said === null) return;
+        said += text;
+        const fix = FIXES.find(({ pattern }) => pattern.test(said));
+        if (fix) process.stderr.write(`crossbind: ${fix.fix(device)}\n`);
+        if (fix || LAUNCHED.test(said) || said.length > SAID_LIMIT) said = null;
+    });
+    return { child, close: () => child.kill() };
+}

package/src/actions/playSetup.js

@@ -0,0 +1,19 @@
+import { PLAY_SCOPE, keepSignIn } from './googlePlay.js';
+import { signIn } from './googleSignIn.js';
+import { askYesNo } from '../utils/ask.js';
+
+// Signs the user in to Google Play with their Google account, in their browser, once they say yes to question, and keeps
+// the sign-in in the system's keychain for later publishes. Google's page lets the user leave Play's access out, so the
+// sign-in is asked for again until it has it, or is null once the user says no.
+export async function signInToPlay(question) {
+    let asked = question;
+    while (await askYesNo(asked)) {
+        const { refresh_token: refreshToken, scope = '' } = await signIn(PLAY_SCOPE);
+        if (scope.split(' ').includes(PLAY_SCOPE)) {
+            if (!keepSignIn(refreshToken)) console.log('crossbind: this machine has no keychain to keep the sign-in in, so the next publish signs in again.');
+            return { refreshToken };
+        }
+        asked = "The sign-in left Google Play's access out, its box on Google's page. Sign in again? [Y/n] ";
+    }
+    return null;
+}

package/src/actions/publishAndroid.js

@@ -0,0 +1,102 @@
+import fs from 'node:fs';
+import state from '../state/index.js';
+import { SIGNING } from './androidGradle.js';
+import {
+    androidAppId, androidVersion, appBuildNumber, appOutputOf, clearAppOutputs,
+} from './buildApp.js';
+import {
+    PLAY, highestVersionCode, keptSignIn, playCredentials, uploadBundle,
+} from './googlePlay.js';
+import { signInToPlay } from './playSetup.js';
+import { askAppId } from './appSetup.js';
+import { makeUploadKey, releaseSigningEnv } from './uploadKey.js';
+import { askLine, askYesNo, hasTerminal } from '../utils/ask.js';
+import loadSystemConfig from '../utils/systemConfig.js';
+import openUrl from '../utils/openUrl.js';
+
+const PLAY_CONSOLE = 'https://play.google.com/console';
+const NO_APP_ID = 'crossbind: Google Play knows an app by its package name, app.id, which crossbind.config.js does not set: set it, as com.example.myapp, before the first publish, as Play keeps it for good.';
+const NO_UPLOAD_KEY = `crossbind: Google Play takes bundles signed with your upload key: crossbind app upload-key makes one, or ${SIGNING.keystore}, ${SIGNING.alias} and ${SIGNING.password} name yours.`;
+const NO_CREDENTIALS = `crossbind: Google Play takes uploads from your Google account, which a publish on a terminal signs in to, or from a service account: set ${PLAY.serviceAccount} to its e-mail, with gcloud signed in, ${PLAY.key} to its JSON key, or ${PLAY.token} to an access token of it; app.md's Publishing says how to make one.`;
+const SIGN_IN = 'Google Play takes uploads from your Google account once crossbind is signed in to it. Sign in now, in your browser? [Y/n] ';
+const ANOTHER_ACCOUNT = 'Sign in with another Google account? [Y/n] ';
+
+// The highest versionCode Play has seen, and the credentials that saw it, once the user has done what Play asks for,
+// which only the user can do: in Play Console, which crossbind opens before it waits for Enter and checks again, or, for
+// a Google account without release rights, by signing in with another.
+async function highestWithPlayConsole(appId, credentials) {
+    let current = credentials;
+    for (;;) {
+        try {
+            return { highest: await highestVersionCode(appId, current), credentials: current };
+        } catch (error) {
+            console.log(error.message);
+            if (error.status === 403 && current.refreshToken) {
+                current = await signInToPlay(ANOTHER_ACCOUNT);
+                if (!current) throw error;
+            } else {
+                if ([403, 404].includes(error.status)) {
+                    console.log(`crossbind: opening ${PLAY_CONSOLE}.`);
+                    openUrl(PLAY_CONSOLE);
+                }
+                await askLine('Press Enter once that is done to check again, or Ctrl-C to stop. ');
+            }
+        }
+    }
+}
+
+// Builds an Android app with the next versionCode Google Play takes, signed with the upload key, and releases its bundle
+// on a track. All it needs is checked before the build, which takes minutes: on a terminal, what is missing is asked for
+// and set up; without one, as in CI, every missing piece is named at once.
+export async function publishAndroid({ track, status, viteArgs }, { runVite }) {
+    const isGuided = hasTerminal();
+    const missing = [];
+    let appId = state.config.app.id === undefined ? null : androidAppId();
+    if (!appId && isGuided) appId = await askAppId('Google Play', 'package name');
+    if (!appId) missing.push(NO_APP_ID);
+
+    let signing = await releaseSigningEnv();
+    if (!signing.isSigned && isGuided && await askYesNo('This machine has no upload key, which Google Play takes bundles signed with. Make one now? [Y/n] ')) {
+        await makeUploadKey();
+        state.config.system = loadSystemConfig();
+        signing = await releaseSigningEnv();
+    }
+    if (!signing.isSigned) missing.push(NO_UPLOAD_KEY);
+
+    let credentials = playCredentials(process.env, state.config.system) ?? await keptSignIn();
+    if (!credentials && isGuided) credentials = await signInToPlay(SIGN_IN);
+    if (!credentials) missing.push(NO_CREDENTIALS);
+    if (missing.length > 0) throw new Error(missing.join('\n'));
+    const version = state.config.package?.version ?? '1.0.0';
+    console.log(`crossbind: publishing ${appId} ${version} to Google Play's ${track} track.`);
+
+    let highest;
+    if (isGuided) ({ highest, credentials } = await highestWithPlayConsole(appId, credentials));
+    else highest = await highestVersionCode(appId, credentials);
+    const versionCode = appBuildNumber() ?? Math.max(androidVersion().code, highest + 1);
+    console.log(highest
+        ? `crossbind: Google Play has seen versionCode ${highest} at most, so this build is ${versionCode}.`
+        : `crossbind: Google Play has no build of ${appId} yet, so this build is ${versionCode}.`);
+
+    clearAppOutputs();
+    const exitCode = await runVite(['build', ...viteArgs], {
+        ...process.env, ...signing.env, CROSSBIND_APP_PLATFORM: 'android', CROSSBIND_APP_BUILD_NUMBER: String(versionCode),
+    });
+    if (exitCode !== 0) throw Object.assign(new Error(`crossbind: the build ended with exit code ${exitCode}, so nothing went to Google Play.`), { exitCode });
+    const project = appOutputOf('android');
+    const aab = `${project}.aab`;
+    if (!fs.existsSync(aab)) throw new Error(`crossbind: the build made no bundle at ${aab}, so nothing went to Google Play.`);
+    const symbols = fs.existsSync(`${project}-symbols.zip`) ? `${project}-symbols.zip` : null;
+
+    console.log(`crossbind: uploading the bundle${symbols ? ' and its native debug symbols' : ''} to Google Play.`);
+    const released = await uploadBundle(appId, credentials, { aab, symbols, track, status });
+    const app = `${appId} ${version} (versionCode ${released.versionCode})`;
+    if (released.status !== 'draft') {
+        console.log(`crossbind: ${app} is out on Google Play's ${track} track.`);
+        return;
+    }
+    console.log(`crossbind: ${app} is a draft on Google Play's ${track} track.`);
+    if (status !== 'draft') {
+        console.log("crossbind: Play takes drafts alone until an app's first release is out: roll it out once in Play Console, under Test and release, and later publishes go out by themselves.");
+    }
+}

package/src/actions/publishIos.js

@@ -0,0 +1,146 @@
+import state from '../state/index.js';
+import { appStoreKey } from './appleSigning.js';
+import {
+    appBuildNumber, appOutputOf, appTeam, appVersion, clearAppOutputs,
+} from './buildApp.js';
+import {
+    addHermesDsym, archiveIosApp, archivedBinary, archivedPrivacy, uploadIosArchive, xcodeTeams,
+} from './appStoreConnect.js';
+import {
+    askAppId, askEncryption, askIcon, askPrivacy,
+} from './appSetup.js';
+import { appEncryption, appId } from '../utils/appOptions.js';
+import { resolveHermesDsym } from '../utils/hermes.js';
+import { unreasonedImports } from '../utils/requiredReasonApis.js';
+import { askLine, askYesNo, hasTerminal } from '../utils/ask.js';
+import loadSystemConfig, { updateSystemConfig } from '../utils/systemConfig.js';
+import openUrl from '../utils/openUrl.js';
+
+const NO_APP_ID = 'crossbind: App Store Connect knows an app by its bundle id, app.id, which crossbind.config.js does not set: set it, as com.example.myapp, before the first publish, as Apple keeps it for good.';
+const NO_TEAM = "crossbind: App Store Connect takes uploads from an Apple Developer Program team, which neither app.team in crossbind.config.js nor this machine's XCODE_DEVELOPMENT_TEAM names: set either to its id, which developer.apple.com/account shows under Membership details.";
+const NO_ICON = 'crossbind: App Store Connect takes no iOS app without an icon: set app.icon in crossbind.config.js to a square PNG, at best 1024 × 1024.';
+const NO_ENCRYPTION = 'crossbind: app.encryption is not set, so App Store Connect asks whether this build uses encryption before TestFlight hands it out; set it in crossbind.config.js to answer for every build.';
+const TEAM_ID = /^[A-Z0-9]{10}$/;
+
+async function pickTeam(teams) {
+    if (teams.length === 1) {
+        const [{ id, name }] = teams;
+        return await askYesNo(`Upload as team ${id}, ${name}, which Xcode is signed in to? [Y/n] `) ? teams[0] : null;
+    }
+    console.log('Xcode is signed in to these teams:');
+    teams.forEach(({ id, name }, index) => console.log(`  ${index + 1}) ${id} ${name}`));
+    for (;;) {
+        const team = teams[Number((await askLine(`Which one uploads, 1 to ${teams.length}? `)).trim()) - 1];
+        if (team) return team;
+    }
+}
+
+// A team id the user types, or null once they have signed in to Xcode, for its teams to be read again.
+async function typedTeam() {
+    console.log("crossbind: Xcode is signed in to no such team, as a free personal team is none. Sign in to Xcode, under Settings › Accounts, with your membership's Apple Account, or type the team's id, which developer.apple.com/account shows under Membership details.");
+    for (;;) {
+        const id = (await askLine('Team id, or Enter once Xcode is signed in: ')).trim().toUpperCase();
+        if (!id) return null;
+        if (TEAM_ID.test(id)) return id;
+        console.log('That is no team id, which is ten letters and digits.');
+    }
+}
+
+// The team the user picks of those Xcode is signed in to, or types, which this machine keeps as XCODE_DEVELOPMENT_TEAM.
+async function askTeam() {
+    console.log('crossbind: App Store Connect takes uploads from an Apple Developer Program team, which neither app.team nor XCODE_DEVELOPMENT_TEAM names.');
+    let id = null;
+    while (!id) {
+        const teams = xcodeTeams();
+        if (teams.length > 0) {
+            const team = await pickTeam(teams);
+            if (!team) throw new Error(NO_TEAM);
+            ({ id } = team);
+        } else {
+            id = await typedTeam();
+        }
+    }
+    updateSystemConfig({ XCODE_DEVELOPMENT_TEAM: id });
+    state.config.system = loadSystemConfig();
+    if (appTeam() !== id) throw new Error(`crossbind: ~/.crossbind.json did not take XCODE_DEVELOPMENT_TEAM: set app.team: '${id}' in crossbind.config.js.`);
+    console.log(`crossbind: ~/.crossbind.json keeps ${id} as XCODE_DEVELOPMENT_TEAM.`);
+}
+
+// A step that failed for what only the user can mend, in Xcode or on Apple's sites, runs again once they press Enter,
+// after crossbind opened the page that mends it where it knows one. Any other failure, or one without a terminal, stops
+// the publish.
+async function untilDone(isGuided, step) {
+    for (;;) {
+        try {
+            return step();
+        } catch (error) {
+            if (!isGuided || !error.isMendable) throw error;
+            console.log(error.message);
+            if (error.page) {
+                console.log(`crossbind: opening ${error.page}.`);
+                openUrl(error.page);
+            }
+            await askLine('Press Enter once that is done to try again, or Ctrl-C to stop. ');
+            console.log('crossbind: trying again, which can take a few minutes.');
+        }
+    }
+}
+
+async function buildIosApp(viteArgs, runVite) {
+    clearAppOutputs();
+    const exitCode = await runVite(['build', ...viteArgs], { ...process.env, CROSSBIND_APP_PLATFORM: 'ios' });
+    if (exitCode !== 0) throw Object.assign(new Error(`crossbind: the build ended with exit code ${exitCode}, so nothing went to App Store Connect.`), { exitCode });
+    return appOutputOf('ios');
+}
+
+const unreasonedError = (unreasoned) => new Error(`crossbind: App Store Connect refuses an iOS app that calls required reason API without Apple's reasons for it (ITMS-91053), and this app calls ${unreasoned.map(({ category, symbols }) => `${category} (${symbols.join(', ')})`).join(' and ')} with no reason in its privacy manifest. Give app.privacy Apple's reasons, as { fileTimestamp: ['C617.1'] }; Apple's "Describing use of required reason API" says what each covers. Nothing went to App Store Connect.`);
+
+// Builds an iOS app, archives it and uploads it to App Store Connect, whose TestFlight hands it out. All it needs is
+// checked before the build, which takes minutes: on a terminal, what is missing is asked for and set up; without one,
+// as in CI, every missing piece is named at once. The archived app then shows what required reason API it calls.
+export async function publishIos({ viteArgs }, { runVite }) {
+    if (process.platform !== 'darwin') throw new Error('crossbind: iOS apps build and go to App Store Connect on macOS, with Xcode.');
+    const isGuided = hasTerminal();
+    const key = appStoreKey();
+    const missing = [];
+    if (state.config.app.id === undefined) {
+        if (isGuided) await askAppId('App Store Connect', 'bundle id');
+        else missing.push(NO_APP_ID);
+    }
+    if (!appTeam()) {
+        if (isGuided) await askTeam();
+        else missing.push(NO_TEAM);
+    }
+    if (state.config.app.icon === undefined) {
+        if (isGuided) await askIcon();
+        else missing.push(NO_ICON);
+    }
+    if (missing.length > 0) throw new Error(missing.join('\n'));
+    if (appEncryption(state.config) === null) {
+        if (isGuided) await askEncryption();
+        else console.warn(NO_ENCRYPTION);
+    }
+    const hermesDsym = await resolveHermesDsym();
+
+    const facts = { id: appId(state.config), team: appTeam() };
+    console.log(`crossbind: publishing ${facts.id} ${appVersion()} to App Store Connect for team ${facts.team}; building the app first.`);
+    let archive;
+    for (;;) {
+        const project = await buildIosApp(viteArgs, runVite);
+        console.log('crossbind: archiving the app, which takes a few minutes.');
+        archive = await untilDone(isGuided, () => archiveIosApp(project, { facts }));
+        const unreasoned = unreasonedImports(archivedBinary(archive), archivedPrivacy(archive));
+        if (unreasoned.length === 0) break;
+        if (!isGuided) throw unreasonedError(unreasoned);
+        await askPrivacy(unreasoned);
+        console.log('crossbind: building the app again, with those reasons in its privacy manifest.');
+    }
+    addHermesDsym(archive, hermesDsym);
+    console.log(`crossbind: uploading the app to App Store Connect for team ${facts.team} with ${key ? `the API key ${key.keyId}` : "Xcode's account"}, which signs it.`);
+    const build = appBuildNumber();
+    await untilDone(isGuided, () => uploadIosArchive(archive, {
+        team: facts.team, key, isBuildManaged: build === null, facts,
+    }));
+    const app = build === null ? `${facts.id} ${appVersion()}, numbered by Xcode after the builds App Store Connect has of it,` : `${facts.id} ${appVersion()} (build ${build})`;
+    console.log(`crossbind: ${app} is on App Store Connect. TestFlight hands it out once Apple has processed it, usually within 5 to 30 minutes, and Apple mails when it has.`);
+}

package/src/actions/uploadKey.js

@@ -0,0 +1,134 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import {
+    SIGNING, machineUploadKey, releaseSigning, uploadKeyEnv,
+} from './androidGradle.js';
+import pullDockerImage, { getDockerImage } from '../utils/pullDockerImage.js';
+import { DOCKER_RUN_SECURITY_ARGS } from '../utils/dockerSecurity.js';
+import getOsUserAndGroupId from '../utils/getOsUserAndGroupId.js';
+import loadSystemConfig, { updateSystemConfig } from '../utils/systemConfig.js';
+import { hasKeychain, readSecret, storeSecret } from '../utils/keychain.js';
+import { PASSWORD_RULES, makePassword, passwordProblem } from '../utils/password.js';
+import { askHidden, askLine, hasTerminal } from '../utils/ask.js';
+
+const ROLE = 'android-app';
+const PLATFORM = 'linux/amd64';
+const ALIAS = 'upload';
+// Nobody sees an upload key's name: an app installed from Google Play carries Google's signature.
+const NAME = 'CN=Android upload key';
+// Google Play wants a key valid past 2033; 10,000 days is 27 years.
+const VALIDITY_DAYS = 10000;
+
+// Where `crossbind app upload-key` makes this machine's upload key.
+export const uploadKeyFile = () => path.join(os.homedir(), '.crossbind', 'keys', 'android-upload.p12');
+
+// keytool in crossbind's android-app image, which an Android app's build pulls anyway: with no network, the key's folder
+// alone, and the password by name in the environment, never on a command line.
+function keytool(keystore, command, args, password, { isReadOnly = false } = {}) {
+    pullDockerImage(ROLE, PLATFORM);
+    const result = spawnSync('docker', [
+        'run', '--rm', ...DOCKER_RUN_SECURITY_ARGS, '--network', 'none', '--platform', PLATFORM, '--user', getOsUserAndGroupId(),
+        '-v', `${path.dirname(keystore)}:/keys${isReadOnly ? ':ro' : ''}`, '-e', SIGNING.password, getDockerImage(ROLE, PLATFORM),
+        'keytool', command, '-keystore', `/keys/${path.basename(keystore)}`, ...args, '-storepass:env', SIGNING.password,
+    ], { encoding: 'utf8', env: { ...process.env, [SIGNING.password]: password } });
+    if (result.error) throw new Error(`crossbind: cannot run keytool in the ${ROLE} image: ${result.error.message}`, { cause: result.error });
+    return { status: result.status, output: `${result.stdout ?? ''}${result.stderr ?? ''}`.trim() };
+}
+
+// The password the user types for a new key, held to the rules and typed twice the same.
+async function typedPassword() {
+    console.error(`The upload key's password needs:\n${PASSWORD_RULES.map((rule) => `  - ${rule}`).join('\n')}`);
+    for (;;) {
+        const password = await askHidden('Password: ');
+        const problem = passwordProblem(password);
+        if (problem) {
+            console.error(`That one will not do: ${problem}.`);
+        } else if (await askHidden('Again: ') === password) {
+            return password;
+        } else {
+            console.error('The two did not match.');
+        }
+    }
+}
+
+// A new key's password: the environment's, else one crossbind makes or one the user types. Only a keychain keeps a made
+// one, so without a keychain the user types their own.
+async function newPassword(canKeep) {
+    const given = process.env[SIGNING.password];
+    if (given) {
+        const problem = passwordProblem(given);
+        if (problem) throw new Error(`crossbind: ${SIGNING.password} cannot lock an upload key: ${problem}.`);
+        return { password: given, isMade: false };
+    }
+    if (!hasTerminal()) throw new Error(`crossbind: an upload key needs a password: run this on a terminal, which asks for one, or set ${SIGNING.password}.`);
+    const choice = canKeep
+        ? await askLine("The upload key's password:\n  1) make a strong one for me (recommended)\n  2) I will type my own\nChoose 1 or 2 [1]: ")
+        : '2';
+    if (choice.trim() !== '2') return { password: makePassword(), isMade: true };
+    return { password: await typedPassword(), isMade: false };
+}
+
+// Makes a key this machine's upload key, its password kept in the system keychain where it can be.
+function keep(keystore, alias, password, isKeychain) {
+    const isKept = isKeychain && storeSecret(keystore, password);
+    updateSystemConfig({ ANDROID_KEYSTORE: keystore, ANDROID_KEY_ALIAS: alias });
+    console.log(isKept
+        ? 'crossbind: the system keychain keeps its password, so builds sign without asking.'
+        : `crossbind: builds ask for its password, as no keychain keeps it; set ${SIGNING.password} where no one can type it, as in CI.`);
+}
+
+// Makes this machine's upload key, which signs its Android apps' bundles for Google Play. It never makes one over a key
+// the machine has.
+export async function makeUploadKey({ isKeychain = true } = {}) {
+    const system = loadSystemConfig();
+    if (system.ANDROID_KEYSTORE) {
+        throw new Error(`crossbind: this machine's upload key is ${system.ANDROID_KEYSTORE}, and crossbind never makes another over it, as Google Play takes an app's updates only signed with the key it knows. To make a new one anyway, drop it first with crossbind config delete ANDROID_KEYSTORE.`);
+    }
+    const file = uploadKeyFile();
+    if (fs.existsSync(file)) {
+        throw new Error(`crossbind: ${file} is there already, and crossbind never replaces an upload key: use it with crossbind app upload-key --use ${file}.`);
+    }
+    const canKeep = isKeychain && hasKeychain();
+    const { password, isMade } = await newPassword(canKeep);
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const made = keytool(file, '-genkeypair', ['-storetype', 'PKCS12', '-alias', ALIAS, '-keyalg', 'RSA', '-keysize', '2048',
+        '-validity', String(VALIDITY_DAYS), '-dname', NAME], password);
+    if (made.status !== 0) throw new Error(`crossbind: keytool did not make the upload key:\n${made.output}`);
+    fs.chmodSync(file, 0o600);
+    console.log(`crossbind: your upload key is ${file}.`);
+    if (isMade) console.log(`crossbind: its password, shown this once: ${password}`);
+    keep(file, ALIAS, password, canKeep);
+    console.log(`crossbind: keep a copy of ${file} and of its password somewhere safe, as a password manager. Google keeps only the key's certificate: a lost key takes an upload key reset in Play Console, which takes effect 72 hours later.`);
+}
+
+// Makes a key the user has this machine's upload key, once it opens with its password and alias.
+export async function useUploadKey(file, { alias = ALIAS, isKeychain = true } = {}) {
+    const keystore = path.resolve(file);
+    if (!fs.statSync(keystore, { throwIfNoEntry: false })?.isFile()) throw new Error(`crossbind: ${keystore} is no file.`);
+    const password = process.env[SIGNING.password] || (hasTerminal() ? await askHidden(`Password of ${keystore}: `) : '');
+    if (!password) throw new Error(`crossbind: ${keystore} needs its password: run this on a terminal, which asks for it, or set ${SIGNING.password}.`);
+    const opened = keytool(keystore, '-list', ['-alias', alias], password, { isReadOnly: true });
+    if (opened.status !== 0) throw new Error(`crossbind: ${keystore} did not open with that password and the alias ${alias}:\n${opened.output}`);
+    console.log(`crossbind: this machine's upload key is ${keystore}, alias ${alias}.`);
+    keep(keystore, alias, password, isKeychain);
+}
+
+// The environment an Android release builds in, with the environment's upload key, else this machine's, whose password
+// the keychain keeps or the terminal gives, and whether a key signs it: checked before the native build, not after it.
+export async function releaseSigningEnv() {
+    const key = machineUploadKey();
+    const password = key && !key.password && hasTerminal() ? await askHidden(`Password of this machine's upload key, ${key.keystore}: `) : null;
+    const env = key ? uploadKeyEnv({ ...key, password: key.password || password }) : {};
+    return { env, isSigned: releaseSigning({ ...process.env, ...env }) !== null };
+}
+
+// The password the keychain keeps for this machine's upload key, for another machine or CI.
+export function showUploadKeyPassword() {
+    const { ANDROID_KEYSTORE: keystore } = loadSystemConfig();
+    if (!keystore) throw new Error('crossbind: this machine has no upload key: crossbind app upload-key makes one.');
+    const password = readSecret(keystore);
+    if (!password) throw new Error(`crossbind: no keychain keeps the password of ${keystore}.`);
+    console.log(password);
+}