crossbind 2.0.0-beta.66 → 2.0.0-beta.68

package/src/actions/xcodeProject.js

@@ -3,6 +3,7 @@ import { spawnSync } from 'node:child_process';
 import state from '../state/index.js';
 import { IOS_DEPLOYMENT_TARGET } from '../utils/iosToolchain.js';
 import { textPlist, xmlPlist } from '../utils/plist.js';
+import { PRIVACY_CATEGORIES } from '../utils/appOptions.js';
 
 // The SDKs an iOS app builds for, one target each, and the slice of Hermes' release each takes.
 export const IOS_SDKS = ['iphoneos', 'iphonesimulator'];
@@ -18,7 +19,7 @@ int main(int argc, char *argv[]) { return crossbind_app_main(argc, argv); }
 
 const OBJECT_NAMES = ['project', 'mainGroup', 'products', 'target', 'product', 'main', 'info', 'app', 'hermes', 'mainBuild',
     'appBuild', 'hermesLink', 'hermesEmbed', 'sources', 'frameworks', 'resources', 'embed', 'projectDebug', 'projectRelease',
-    'targetDebug', 'targetRelease', 'projectConfigs', 'targetConfigs', 'assets', 'assetsBuild'];
+    'targetDebug', 'targetRelease', 'projectConfigs', 'targetConfigs', 'assets', 'assetsBuild', 'privacy', 'privacyBuild'];
 // Xcode names its objects by 24 hex digits. Fixed ones leave the project unchanged while what it holds is.
 const ID = Object.fromEntries(OBJECT_NAMES.map((name, index) => [name, `CB${(index + 1).toString(16).toUpperCase().padStart(22, '0')}`]));
 
@@ -39,7 +40,7 @@ const ORIENTATIONS = ['UIInterfaceOrientationPortrait', 'UIInterfaceOrientationL
 // The color set of app.window.backgroundColor, which the launch screen shows.
 const LAUNCH_COLOR = 'LaunchBackground';
 
-const infoPlist = (name, urlSchemes, hasBackground, usage) => xmlPlist({
+const infoPlist = (name, urlSchemes, hasBackground, usage, encryption) => xmlPlist({
     CFBundleDevelopmentRegion: 'en',
     CFBundleDisplayName: name,
     CFBundleExecutable: '$(EXECUTABLE_NAME)',
@@ -50,6 +51,7 @@ const infoPlist = (name, urlSchemes, hasBackground, usage) => xmlPlist({
     CFBundleShortVersionString: '$(MARKETING_VERSION)',
     ...(urlSchemes.length > 0 ? { CFBundleURLTypes: [{ CFBundleURLName: '$(PRODUCT_BUNDLE_IDENTIFIER)', CFBundleURLSchemes: urlSchemes }] } : {}),
     CFBundleVersion: '$(CURRENT_PROJECT_VERSION)',
+    ...(encryption === null ? {} : { ITSAppUsesNonExemptEncryption: encryption }),
     LSRequiresIPhoneOS: true,
     UIApplicationSceneManifest: { UIApplicationSupportsMultipleScenes: false },
     UILaunchScreen: hasBackground ? { UIColorName: LAUNCH_COLOR } : {},
@@ -59,7 +61,7 @@ const infoPlist = (name, urlSchemes, hasBackground, usage) => xmlPlist({
     ...usage,
 });
 
-function objects(name, targetSettings, hasAssets) {
+function objects(name, targetSettings, hasAssets, hasPrivacy) {
     const file = (path, type) => ({ isa: 'PBXFileReference', lastKnownFileType: type, path, sourceTree: '<group>' });
     const phase = (isa, files, extra = {}) => ({ isa, buildActionMask: 2147483647, files, runOnlyForDeploymentPostprocessing: 0, ...extra });
     const configuration = (configurationName, buildSettings) => ({ isa: 'XCBuildConfiguration', buildSettings, name: configurationName });
@@ -71,8 +73,13 @@ function objects(name, targetSettings, hasAssets) {
         [ID.assets]: file('Assets.xcassets', 'folder.assetcatalog'),
         [ID.assetsBuild]: { isa: 'PBXBuildFile', fileRef: ID.assets },
     } : {};
+    const privacy = hasPrivacy ? {
+        [ID.privacy]: file('PrivacyInfo.xcprivacy', 'text.xml'),
+        [ID.privacyBuild]: { isa: 'PBXBuildFile', fileRef: ID.privacy },
+    } : {};
     return {
         ...assets,
+        ...privacy,
         [ID.main]: file('main.m', 'sourcecode.c.objc'),
         [ID.info]: file('Info.plist', 'text.plist.xml'),
         [ID.app]: file('app', 'folder'),
@@ -86,10 +93,12 @@ function objects(name, targetSettings, hasAssets) {
         [ID.hermesEmbed]: { isa: 'PBXBuildFile', fileRef: ID.hermes, settings: { ATTRIBUTES: ['CodeSignOnCopy', 'RemoveHeadersOnCopy'] } },
         [ID.sources]: phase('PBXSourcesBuildPhase', [ID.mainBuild]),
         [ID.frameworks]: phase('PBXFrameworksBuildPhase', [ID.hermesLink]),
-        [ID.resources]: phase('PBXResourcesBuildPhase', [ID.appBuild, ...(hasAssets ? [ID.assetsBuild] : [])]),
+        [ID.resources]: phase('PBXResourcesBuildPhase', [ID.appBuild, ...(hasAssets ? [ID.assetsBuild] : []), ...(hasPrivacy ? [ID.privacyBuild] : [])]),
         [ID.embed]: phase('PBXCopyFilesBuildPhase', [ID.hermesEmbed], { dstPath: '', dstSubfolderSpec: 10, name: 'Embed Frameworks' }),
         [ID.mainGroup]: {
-            isa: 'PBXGroup', children: [ID.main, ID.info, ID.app, ...(hasAssets ? [ID.assets] : []), ID.hermes, ID.products], sourceTree: '<group>',
+            isa: 'PBXGroup',
+            children: [ID.main, ID.info, ID.app, ...(hasAssets ? [ID.assets] : []), ...(hasPrivacy ? [ID.privacy] : []), ID.hermes, ID.products],
+            sourceTree: '<group>',
         },
         [ID.products]: { isa: 'PBXGroup', children: [ID.product], name: 'Products', sourceTree: '<group>' },
         [ID.target]: {
@@ -143,10 +152,20 @@ function writeAssets(catalog, icon, background) {
     }
 }
 
+// The privacy manifest of app.privacy, without which App Store Connect refuses an app that calls required reason API.
+const privacyManifest = (privacy) => xmlPlist({
+    NSPrivacyAccessedAPITypes: Object.entries(privacy).map(([name, reasons]) => ({
+        NSPrivacyAccessedAPIType: PRIVACY_CATEGORIES[name].type,
+        NSPrivacyAccessedAPITypeReasons: reasons,
+    })),
+});
+
 // An iOS app as an Xcode project, written anew from the parts its SDK targets built: each brings its archives and
 // their link line, and its slice of Hermes; the first also the app's files. Xcode signs the app and runs it, in the
 // Simulator or on a device, and makes every size of its icon from the one PNG given.
-export default function writeXcodeProject(to, { parts, identity, label, version, icon = null, urlSchemes = [], background = null, usage = {} }) {
+export default function writeXcodeProject(to, {
+    parts, identity, label, version, build = version, icon = null, urlSchemes = [], background = null, usage = {}, encryption = null, privacy = {},
+}) {
     const { name } = state.config.general;
     if (parts.length === 0) throw new Error(`crossbind: no part of the iOS app ${name} is built, so there is no Xcode project to write.`);
     fs.rmSync(to, { recursive: true, force: true });
@@ -165,8 +184,10 @@ export default function writeXcodeProject(to, { parts, identity, label, version,
     if (result.status !== 0) throw new Error(`crossbind: cannot make Hermes' xcframework for ${to}: ${result.stderr || result.error?.message}`);
 
     fs.writeFileSync(`${to}/main.m`, MAIN);
-    fs.writeFileSync(`${to}/Info.plist`, infoPlist(label, urlSchemes, Boolean(background), usage));
+    fs.writeFileSync(`${to}/Info.plist`, infoPlist(label, urlSchemes, Boolean(background), usage, encryption));
     writeAssets(`${to}/Assets.xcassets`, icon, background);
+    const hasPrivacy = Object.keys(privacy).length > 0;
+    if (hasPrivacy) fs.writeFileSync(`${to}/PrivacyInfo.xcprivacy`, privacyManifest(privacy));
     const targetSettings = {
         ...(icon ? { ASSETCATALOG_COMPILER_APPICON_NAME: 'AppIcon' } : {}),
         PRODUCT_NAME: name,
@@ -175,12 +196,12 @@ export default function writeXcodeProject(to, { parts, identity, label, version,
         CODE_SIGN_STYLE: 'Automatic',
         INFOPLIST_FILE: 'Info.plist',
         MARKETING_VERSION: version,
-        CURRENT_PROJECT_VERSION: version,
+        CURRENT_PROJECT_VERSION: build,
         LD_RUNPATH_SEARCH_PATHS: ['$(inherited)', '@executable_path/Frameworks'],
         ...linkFlags,
     };
     fs.writeFileSync(`${to}/${name}.xcodeproj/project.pbxproj`, textPlist({
-        archiveVersion: 1, classes: {}, objectVersion: 56, objects: objects(name, targetSettings, Boolean(icon || background)), rootObject: ID.project,
+        archiveVersion: 1, classes: {}, objectVersion: 56, objects: objects(name, targetSettings, Boolean(icon || background), hasPrivacy), rootObject: ID.project,
     }));
     return to;
 }

package/src/app/index.d.ts

@@ -57,12 +57,16 @@ export declare const shell: {
     openPath(path: string): Promise<void>;
     /** A file, selected, in the system's file manager: one in the app's folders, or one a dialog picked during this run. */
     revealInFolder(path: string): Promise<void>;
+    /** A file or folder moved to the system's trash, where its user can take it back: one in the app's folders, not one of them itself, or one a dialog picked during this run. Where the system has no trash, nothing moves and it rejects. */
+    trash(path: string): Promise<void>;
 };
 
 export declare const app: {
     paths(): Promise<AppPaths>;
     /** Ends the app as closing its window does. */
     quit(): Promise<void>;
+    /** Ends the app as quit() does, then opens it again, with no link. */
+    relaunch(): Promise<void>;
     /** The links of app.urlSchemes in crossbind.config.js that opened the app and have not reached the page yet, the one it was launched with among them. Once the page has asked, each later link comes as the event open-url while it listens, so listening first, then asking, misses none. */
     launchUrls(): Promise<string[]>;
 };
@@ -93,6 +97,36 @@ export declare const menu: {
     set(menus: Menu[]): Promise<void>;
 };
 
+/** An item of the tray's menu: one the page handles, by its id, a submenu or a separator. */
+export type TrayItem =
+    | { label: string; id?: string; enabled?: boolean; checked?: boolean }
+    | { label: string; items: TrayItem[] }
+    | { type: 'separator' };
+
+export interface TrayOptions {
+    /** What the icon shows when the pointer rests on it. */
+    tooltip?: string;
+    /** The menu a click of the icon opens: a click on macOS, a right click on Windows, and on Linux the one its desktop takes. */
+    menu?: TrayItem[];
+}
+
+export declare const tray: {
+    /** The app's icon in the macOS menu bar, the Windows notification area or a Linux desktop's status tray. A click of an item with an id is the event menu, with a MenuClick, and a click of the icon the event tray where it opens no menu. Set again, it changes the icon that shows. */
+    set(options?: TrayOptions): Promise<void>;
+    /** Takes the icon away. */
+    remove(): Promise<void>;
+};
+
+export interface NotificationOptions {
+    title: string;
+    body?: string;
+}
+
+export declare const notification: {
+    /** A notification of the system's; a click on it is the event notification. macOS asks its user first. */
+    show(options: NotificationOptions): Promise<void>;
+};
+
 /** What the event second-instance carries: a later launch's arguments, the program's own left out, and the folder it was launched in. */
 export interface SecondInstance {
     args: string[];
@@ -105,12 +139,20 @@ export interface OpenUrl {
 }
 
 export declare const events: {
-    /** Calls listener with each click of an item with an id in the menus menu.set sets, until the function it returns is called. */
+    /** Calls listener with each click of an item with an id in the menus menu.set sets or in the tray's menu, until the function it returns is called. */
     on(name: 'menu', listener: (click: MenuClick) => void): () => void;
     /** Calls listener with each link of app.urlSchemes the system opens the app with once the page has called app.launchUrls(), until the function it returns is called. */
     on(name: 'open-url', listener: (open: OpenUrl) => void): () => void;
     /** Calls listener with each later launch of a desktop app that app.singleInstance keeps to one instance, which brings its window to the front as far as the system lets it, until the function it returns is called. */
     on(name: 'second-instance', listener: (launch: SecondInstance) => void): () => void;
+    /** Calls listener as the system of a desktop app goes to sleep, which it may do before the page has run, until the function it returns is called. */
+    on(name: 'suspend', listener: () => void): () => void;
+    /** Calls listener as the system of a desktop app wakes from sleep, until the function it returns is called. */
+    on(name: 'resume', listener: () => void): () => void;
+    /** Calls listener with each left or right click of the tray's icon that opens no menu, until the function it returns is called. */
+    on(name: 'tray', listener: () => void): () => void;
+    /** Calls listener with each click on a notification the app's notification.show showed while it runs, until the function it returns is called. */
+    on(name: 'notification', listener: () => void): () => void;
     /** Calls listener with the value of each event of this name the app's native code emits from now on, until the function it returns is called. */
     on(name: string, listener: (value: unknown) => void): () => void;
 };

package/src/app/index.js

@@ -1,7 +1,8 @@
 // What an app's host does for its page: the dialogs that pick files or show a message, opening an address or a file
-// outside the app, the app's folders, quitting, its menus, the events of the app's native code and a desktop app's
-// updates. Each call goes to the host of an app (target.runtimeEnv: 'app'); in any other build it rejects, or events.on
-// throws. The app's native code calls the same through <crossbind/app.h>, but for the menus and events.on.
+// outside the app, the app's folders, quitting, its menus, its tray icon and notifications, the events of the app's
+// native code and a desktop app's updates. Each call goes to the host of an app (target.runtimeEnv: 'app'); in any
+// other build it rejects, or events.on throws. The app's native code calls the same through <crossbind/app.h>, but for
+// the menus, the tray, notifications and events.on.
 
 const OPEN = { title: 'string', defaultPath: 'string', filters: 'filters', directory: 'boolean', multiple: 'boolean' };
 const SAVE = { title: 'string', defaultPath: 'string', defaultName: 'string', filters: 'filters' };
@@ -32,6 +33,7 @@ const isButtons = (value) => Array.isArray(value) && value.length >= 1 && value.
 const LISTS = {
     filters: { isFitting: isFilters, name: 'list of { name, extensions }' },
     buttons: { isFitting: isButtons, name: 'list of one to three labels' },
+    list: { isFitting: Array.isArray, name: 'list' },
 };
 
 // The options as the host takes them, so a misspelt or mistyped one fails here, saying which.
@@ -125,6 +127,46 @@ function checkedMenus(menus) {
     return { menus };
 }
 
+// A tray item is { label, id, enabled, checked }, a submenu { label, items } or { type: 'separator' }: a tray's menu has
+// no keys, and no standard item.
+const TRAY = { tooltip: 'string', menu: 'list' };
+const TRAY_ITEM = { label: 'string', id: 'string', enabled: 'boolean', checked: 'boolean', items: 'list', type: 'string' };
+const NOTIFICATION = { title: 'string', body: 'string' };
+
+function checkTrayItem(item, where) {
+    const refuse = (what) => {
+        throw new TypeError(`crossbind: tray.set's ${where} ${what}.`);
+    };
+    if (item === null || typeof item !== 'object' || Array.isArray(item)) refuse('is no object');
+    for (const [key, value] of Object.entries(item)) {
+        if (!Object.hasOwn(TRAY_ITEM, key)) refuse(`takes ${Object.keys(TRAY_ITEM).join(', ')}; ${key} is none of them`);
+        const kind = TRAY_ITEM[key];
+        if (value !== undefined && !(kind === 'list' ? Array.isArray(value) : typeof value === kind)) refuse(`.${key} is no ${kind}`);
+    }
+    const others = Object.keys(item).filter((key) => key !== 'type' && item[key] !== undefined);
+    if (item.type !== undefined) {
+        if (item.type !== 'separator' || others.length > 0) refuse("is no separator, which is { type: 'separator' } alone");
+    } else if (!item.label) {
+        refuse('has no label');
+    } else if (item.items !== undefined) {
+        if (others.some((key) => key !== 'label' && key !== 'items')) refuse('is a menu, which takes a label and items alone');
+        // entries() reads a hole as undefined, which forEach skips.
+        for (const [index, child] of item.items.entries()) checkTrayItem(child, `${where}.items[${index}]`);
+    }
+}
+
+function checkedTray(options) {
+    checked('tray.set', options, TRAY);
+    for (const [index, item] of (options.menu ?? []).entries()) checkTrayItem(item, `menu[${index}]`);
+    return options;
+}
+
+function checkedNotification(options) {
+    checked('notification.show', options, NOTIFICATION);
+    if (!options.title) throw new TypeError('crossbind: notification.show takes a title.');
+    return options;
+}
+
 export const dialog = {
     // The paths of the files or folders the user picked, or null when they cancelled.
     open: async (options = {}) => call('dialog.open', checked('dialog.open', options, OPEN)),
@@ -145,6 +187,9 @@ export const shell = {
     openPath: async (path) => call('shell.openPath', checkedPath('shell.openPath', path)),
     // A file, selected, in the system's file manager: one in the app's folders, or one a dialog picked during this run.
     revealInFolder: async (path) => call('shell.revealInFolder', checkedPath('shell.revealInFolder', path)),
+    // A file or folder moved to the system's trash, where its user can take it back: one in the app's folders, not one of
+    // them itself, or one a dialog picked during this run. Where the system has no trash, nothing moves.
+    trash: async (path) => call('shell.trash', checkedPath('shell.trash', path)),
 };
 
 export const app = {
@@ -152,6 +197,8 @@ export const app = {
     paths: async () => call('app.paths', {}),
     // Ends the app as closing its window does.
     quit: async () => call('app.quit', {}),
+    // Ends the app as quit() does, then opens it again, with no link.
+    relaunch: async () => call('app.relaunch', {}),
     // The links of app.urlSchemes that opened the app and have not reached the page yet, the one it was launched with
     // among them; later ones come as the event open-url. Listening first, then asking, misses none.
     launchUrls: async () => call('app.launchUrls', {}),
@@ -164,6 +211,20 @@ export const menu = {
     set: async (menus) => call('menu.set', checkedMenus(menus)),
 };
 
+export const tray = {
+    // The app's icon in the macOS menu bar, the Windows notification area or a Linux desktop's status tray, with its
+    // tooltip and the menu a click opens. A click of an item with an id is the event menu, as one of menu.set's is, and a
+    // click of the icon the event tray where it opens no menu. Set again, it changes the icon that shows.
+    set: async (options = {}) => call('tray.set', checkedTray(options)),
+    // Takes the icon away.
+    remove: async () => call('tray.remove', {}),
+};
+
+export const notification = {
+    // A notification of the system's, with a title and a body; a click on it is the event notification.
+    show: async (options) => call('notification.show', checkedNotification(options)),
+};
+
 export const events = {
     // Calls listener with the value of each event of this name the app's native code emits from now on, until the
     // function it returns is called.

package/src/assets/toolchain-digests.json

@@ -1,55 +1,55 @@
 {
-    "version": "1.0.16",
+    "version": "1.0.18",
     "registry": "ghcr.io/crossbind",
     "toolchains": {
         "rust": "1.99.1"
     },
     "images": {
         "rust-sysroot": {
-            "index": "sha256:b0745e62b7bc2d07acebf8dce8edef2e24a5f82f55bf37f51bacdbb67c393339",
+            "index": "sha256:31a213289c4dc1125b462ef006cc27b84ee7eca4e3ef0a93259bd698d56c7359",
             "platforms": {
-                "linux/amd64": "sha256:42e71c9f4b349e116fb25cf1fc357cb070ae9e294a6087bb111dad2346256594",
-                "linux/arm64": "sha256:7144a83fa33d2beaad105e88c0067fb6a44d9b9620e576f226758872962cca44"
+                "linux/arm64": "sha256:e82b9a4b9661356238b264a9d5b6921d364cbc81c54ec8426349527144b91bbc",
+                "linux/amd64": "sha256:33c63cb3ed60a6d771f079a60c97dfa1f183f215d4087bb655ff4deca2366d9a"
             }
         },
         "base": {
-            "index": "sha256:d1f2fee78a0238aebb70a2aaed3753212f8151afe0430144b4dfb522f1ccf2ac",
+            "index": "sha256:ca5b17d648e797193d7f3c67635e1e73e56b58d02699a55ea61a35eb5ca8d0c8",
             "platforms": {
-                "linux/arm64": "sha256:7faf80e5692ae636f4bc25af0849711c442275b2405b3d52f9e1943ed8089aa2",
-                "linux/amd64": "sha256:7d31882ed442c0425746fa1cbadf4bf1f6a5f035b2222cb907ad5006ef1af24d"
+                "linux/arm64": "sha256:48666c55a2f943d8be029080fab985839bc50231b8556a00100bc3702a7bcc51",
+                "linux/amd64": "sha256:847f3c686dc8a846b05ee76d38a79b9ac68fb293ca014d56967ee12859849f1f"
             }
         },
         "web": {
-            "index": "sha256:97d873ae67dac443a88d0dede3fee2893177f167e08e8c9096c29aebd95a3d0f",
+            "index": "sha256:72cdc6f5b41d946edc7ca8cd5e1bcf7314f03dfc71be9067994b38130f965711",
             "platforms": {
-                "linux/arm64": "sha256:a274755f6d2cc1702ff7681b75e44b5d1146b73b45ac2dab5e4b543554ad4b19",
-                "linux/amd64": "sha256:23414220cfd4839005d3a5c1e3b83cff4760a3e6eb23687c2a71a1187d0cd211"
+                "linux/arm64": "sha256:6d1756fa994e5d939ac5696ebe32012f56c95d0428a8bc7b3775d53acbff8735",
+                "linux/amd64": "sha256:14aa215c2157e485ce6d664e0077a3cf6938733855b8146e97830e48fda13875"
             }
         },
         "android": {
-            "index": "sha256:5cae71358e7619d5958dab6f38b5dad9582792dc3a49c07fdf8dbdbf157ab5bd",
+            "index": "sha256:7cbd98594a1fb1f48fe156a21c6c5256cd535d2ffd152c1f80f2860d4dc5b6f0",
             "platforms": {
-                "linux/amd64": "sha256:96ff7fa364b8fb109fd3f0257f591c3dc6315e2b1a810511bb129807940895bc"
+                "linux/amd64": "sha256:a6e99a0a66e038fd0e6d1154df6c7c58d68acd9def896b63f542d810d923bd87"
             }
         },
         "android-app": {
-            "index": "sha256:b225a3d04d771916c7a2cc0261990f09b71f6c8b5ae63bc0f3869c7cb5a00fb9",
+            "index": "sha256:5cfd1df40ae28730d592f76ade7e08e628f0002d73979015308d50727f021f3e",
             "platforms": {
-                "linux/amd64": "sha256:e18361ed3cee022767312cd9f63471f4fe4bf41fccb9c7dd53dafec2da67adc0"
+                "linux/amd64": "sha256:98d035dfaeb27095d0a4edce83299ebbb3ffa8e360a4cb925db7cd0b0b8a4666"
             }
         },
         "linux": {
-            "index": "sha256:6a642147d344f804f42241fc80c21b07bfe1eb40a9a364250959c3715a60700a",
+            "index": "sha256:9114bdc0e6b2c1b753d2ba154181566c320e9a901030a14c707f174b7e4849f5",
             "platforms": {
-                "linux/arm64": "sha256:2582d7cf143f876ad4a324174ccb0a1097c4ca2ce775c0216756415ca797cb93",
-                "linux/amd64": "sha256:a10f0efc028e8ba63a7a45dda475eb669d8a078bf1e2830ac0a8c026277afe92"
+                "linux/arm64": "sha256:47e104db909dc78a995733d3d27db94e135f1044e1f0860bb201930a65273af0",
+                "linux/amd64": "sha256:cd13e6b3f5c5303a583da5267531a83839fe8cf7979890463fc45a914a6d5d3f"
             }
         },
         "windows": {
-            "index": "sha256:c4c436763d559a5346f96369b444b79006d4298c5dfce78c15c06089cfdaaa33",
+            "index": "sha256:46e6da18313f4fd3b599fb2505383aa34f32ffe7ceb659426fa3fb71e6f1e8e7",
             "platforms": {
-                "linux/arm64": "sha256:6030741b223fcaccf301e165fb6dace4053dafaba966b067d48c376b7aedb290",
-                "linux/amd64": "sha256:b314de43f2ad7dec0e97e4f0d5033a8c53795118034d13220eb05c9ab885c7a5"
+                "linux/arm64": "sha256:b6457367be5c6863f8d336ce426b9dba7fdfa192308876e4bc390d82a6e18474",
+                "linux/amd64": "sha256:fd5bdc1f34d64bb9aebae1e1d44fc380c1dd815bd6686349e428d4551732f6e0"
             }
         }
     }

package/src/bin.js

@@ -15,8 +15,13 @@ import buildWasiCommand from './actions/buildWasiCommand.js';
 import buildNode, { addonsInPackages, bundleNodeLoader, publishNodeData } from './actions/buildNode.js';
 import buildNativeCommand from './actions/buildNativeCommand.js';
 import buildApp, { appOutputPath, assertAppRunner, publishApp } from './actions/buildApp.js';
-import { releaseSigning } from './actions/androidGradle.js';
 import { UPDATER_KEY, newUpdaterKey } from './actions/appUpdate.js';
+import {
+    makeUploadKey, releaseSigningEnv, showUploadKeyPassword, useUploadKey,
+} from './actions/uploadKey.js';
+import { publishAndroid } from './actions/publishAndroid.js';
+import { publishIos } from './actions/publishIos.js';
+import { iosDeviceOption } from './actions/iosDevice.js';
 import buildExternal from './actions/buildExternal.js';
 import buildPackageTypes from './actions/buildTypes.js';
 import buildLib from './actions/buildLib.js';
@@ -116,30 +121,51 @@ function projectVite() {
     }
 }
 
+// The project's Vite, as `crossbind app dev`, `build` and `publish` run it, and its exit code once it ends. A signal sent
+// to crossbind alone reaches Vite too, which ends through its exit hooks; Ctrl-C reaches both. Once Vite has ended,
+// signals stop crossbind again, as at the questions a publish asks after its build.
+function runVite(args, env) {
+    const vite = spawn(process.execPath, [projectVite(), ...args], { stdio: 'inherit', cwd: state.config.paths.project, env });
+    const forwards = ['SIGINT', 'SIGTERM', 'SIGHUP'].map((signal) => [signal, () => vite.kill(signal)]);
+    forwards.forEach(([signal, forward]) => process.prependListener(signal, forward));
+    return new Promise((resolve) => {
+        vite.on('exit', (code, signal) => {
+            forwards.forEach(([name, forward]) => process.off(name, forward));
+            resolve(code ?? 128 + os.constants.signals[signal]);
+        });
+    });
+}
+
+function assertAppProject() {
+    if (state.config.target.runtimeEnv !== 'app') {
+        throw new Error("crossbind: crossbind app builds an app, which this project is not: set target: { runtimeEnv: 'app' } in crossbind.config.js, as the desktop-app template does.");
+    }
+}
+
 const commandApp = program.command('app').description('build the project as an app, or open it on the dev server');
 [
     ['dev', 'open the app on the dev server, and open it anew as its native code changes'],
     ['build', 'build the app with its page: for Android also its APK, and with an upload key its bundle'],
-].forEach(([name, description]) => commandApp.command(name).description(description)
-    .addOption(new Option('-p, --platform <platform>', "the app's platform (default: CROSSBIND_APP_PLATFORM, else this machine's)").choices(APP_PLATFORMS))
-    // Vite's own options, as --port or --mode, go on to Vite.
-    .allowUnknownOption()
-    .allowExcessArguments()
-    .action(({ platform }, command) => {
-        if (state.config.target.runtimeEnv !== 'app') {
-            throw new Error("crossbind: crossbind app builds an app, which this project is not: set target: { runtimeEnv: 'app' } in crossbind.config.js, as the desktop-app template does.");
-        }
-        // An Android build checks its upload key before the native build, not after it.
-        if (name === 'build' && (platform ?? process.env.CROSSBIND_APP_PLATFORM) === 'android') releaseSigning();
-        const vite = spawn(process.execPath, [projectVite(), ...(name === 'build' ? ['build'] : []), ...command.args], {
-            stdio: 'inherit',
-            cwd: state.config.paths.project,
-            env: platform ? { ...process.env, CROSSBIND_APP_PLATFORM: platform } : process.env,
+].forEach(([name, description]) => {
+    const appCommand = commandApp.command(name).description(description)
+        .addOption(new Option('-p, --platform <platform>', "the app's platform (default: CROSSBIND_APP_PLATFORM, else this machine's)").choices(APP_PLATFORMS));
+    if (name === 'dev') {
+        appCommand.option('--device [name]', 'open an iOS app on a connected iPhone or iPad, the one named or else the only one, rather than in the Simulator');
+    }
+    appCommand
+        // Vite's own options, as --port or --mode, go on to Vite.
+        .allowUnknownOption()
+        .allowExcessArguments()
+        .action(async ({ platform, device }, command) => {
+            assertAppProject();
+            // An Android build checks its upload key before the native build, not after it.
+            const isAndroidBuild = name === 'build' && (platform ?? process.env.CROSSBIND_APP_PLATFORM) === 'android';
+            const { env: signing } = isAndroidBuild ? await releaseSigningEnv() : { env: {} };
+            const onDevice = device === undefined ? {} : { CROSSBIND_APP_DEVICE: iosDeviceOption(device, platform ?? process.env.CROSSBIND_APP_PLATFORM) };
+            const env = { ...process.env, ...signing, ...(platform ? { CROSSBIND_APP_PLATFORM: platform } : {}), ...onDevice };
+            process.exit(await runVite([...(name === 'build' ? ['build'] : []), ...command.args], env));
         });
-        // A signal sent to crossbind alone reaches Vite too, which ends through its exit hooks; Ctrl-C reaches both.
-        ['SIGINT', 'SIGTERM', 'SIGHUP'].forEach((signal) => process.prependListener(signal, () => vite.kill(signal)));
-        vite.on('exit', (code, signal) => process.exit(code ?? 128 + os.constants.signals[signal]));
-    }));
+});
 
 commandApp.command('updater-key')
     .description("make the key pair that signs a desktop app's updates")
@@ -149,6 +175,41 @@ commandApp.command('updater-key')
         console.log(`crossbind: ${UPDATER_KEY}, kept secret where the app is built: ${privateKey}`);
     });
 
+commandApp.command('upload-key')
+    .description("make this machine's upload key, which signs an Android app's bundle for Google Play")
+    .option('--use <keystore>', 'make a key you have the upload key instead, once it opens with its password')
+    .option('--alias <alias>', 'the alias of the key in the keystore --use names', 'upload')
+    .option('--no-keychain', 'keep the password in no keychain, so builds ask for it')
+    .option('--show-password', 'print the password the keychain keeps, for another machine or CI')
+    .action(async ({ use, alias, keychain, showPassword }) => {
+        if (showPassword) showUploadKeyPassword();
+        else if (use) await useUploadKey(use, { alias, isKeychain: keychain });
+        else await makeUploadKey({ isKeychain: keychain });
+    });
+
+commandApp.command('publish')
+    .description('build the app and send it to its store: an Android bundle to a Google Play track, an iOS app to App Store Connect for TestFlight')
+    .addOption(new Option('-p, --platform <platform>', "the store's platform (default: CROSSBIND_APP_PLATFORM)").choices(['android', 'ios']))
+    .option('--track <track>', 'the Google Play track the release goes on: internal, alpha, beta, production or one of your own', 'internal')
+    .option('--draft', 'leave the Google Play release a draft, which Play Console rolls out')
+    // Vite's own options, as --mode, go on to Vite.
+    .allowUnknownOption()
+    .allowExcessArguments()
+    .action(async ({ platform, track, draft }, command) => {
+        assertAppProject();
+        const store = platform ?? process.env.CROSSBIND_APP_PLATFORM;
+        if (store === 'android') {
+            await publishAndroid({ track, status: draft ? 'draft' : 'completed', viteArgs: command.args }, { runVite });
+            return;
+        }
+        if (store !== 'ios') throw new Error('crossbind: crossbind app publish takes -p android or -p ios, the platform of the store it sends the app to.');
+        const playOptions = ['track', 'draft'].filter((option) => command.getOptionValueSource(option) === 'cli');
+        if (playOptions.length > 0) {
+            throw new Error(`crossbind: ${playOptions.map((option) => `--${option}`).join(' and ')} ${playOptions.length > 1 ? 'are' : 'is'} Google Play's; App Store Connect hands every iOS upload to TestFlight.`);
+        }
+        await publishIos({ viteArgs: command.args }, { runVite });
+    });
+
 program.command('licenses')
     .description('list bundled native dependencies with SPDX license, versions and source URL')
     .option('--notices [file]', 'write a THIRD-PARTY-NOTICES markdown file (default: THIRD-PARTY-NOTICES.md)')

package/src/index.js

@@ -8,6 +8,9 @@ export {
 } from './actions/buildApp.js';
 export { checkInstaller } from './actions/appInstaller.js';
 export { default as openInSimulator, buildForSimulator } from './actions/iosSimulator.js';
+export {
+    default as openOnIosDevice, buildForIosDevice, connectedIosDevice, iosDeviceAddress, iosDevServer,
+} from './actions/iosDevice.js';
 export { default as openOnDevice, adbPath } from './actions/androidDevice.js';
 export { buildApk } from './actions/androidGradle.js';
 export { default as isSourceNewer } from './actions/isSourceNewer.js';

package/src/program.js

@@ -22,7 +22,9 @@ export const handleFatal = (e) => {
         if (e?.cause?.message) message += `\n  caused by: ${e.cause.message.split('\n')[0]}`;
         console.error(message);
     }
-    process.exit(1);
+    // Writes to a pipe are asynchronous, so exiting at once would cut what is still queued, such as the failed
+    // command's output run.js printed: exit after both streams have written it.
+    process.stdout.write('', () => process.stderr.write('', () => process.exit(1)));
 };
 
 export const createProgram = () => new Command()

package/src/utils/appApiHeader.js

@@ -12,6 +12,10 @@ export function compilesAsApp(target) {
     return state.config.target?.runtimeEnv === 'app' && runtimeEnvsOf(target.platform).includes('app');
 }
 
+// What an app's own code compiles with: CROSSBIND_APP, and on iOS its debug information, from which the archive's dSYM
+// gives App Store Connect its files and lines; Android's NDK keeps that by default.
+export const appCompileOptions = (target) => (compilesAsApp(target) ? ['-DCROSSBIND_APP', ...(target.platform === 'ios' ? ['-g'] : [])] : []);
+
 export function appApiHeader() {
     const header = `${resolveAppHostRoot()}/cpp/include/crossbind/app.h`;
     if (!fs.existsSync(header)) {