crossbind 2.0.0-beta.68 → 2.0.0-beta.69

package/src/utils/resolveAppHost.js

@@ -19,3 +19,10 @@ export function resolveAppEmbindJsiRoot() {
     const req = createRequire(path.join(resolveAppHostRoot(), 'package.json'));
     return path.dirname(fs.realpathSync(req.resolve('@crossbind/core-embind-jsi/package.json')));
 }
+
+// crossbind/app as an app's page imports it, which the app host assembles with what crossbind's own extensions give the page.
+export function resolveAppPageApi() {
+    const file = path.join(resolveAppHostRoot(), 'js', 'app.js');
+    if (!fs.existsSync(file)) throw new Error(`crossbind: the app host at ${resolveAppHostRoot()} has no crossbind/app for an app's page: update ${PKG} to match crossbind.`);
+    return fs.realpathSync(file);
+}

package/src/utils/systemConfig.js

@@ -13,7 +13,20 @@ export default function loadSystemConfig() {
     return { ...system, ...Object.fromEntries(defaults) };
 }
 
-// Sets keys of ~/.crossbind.json, as `crossbind config set` does, keeping the others.
-export function updateSystemConfig(values) {
-    writeJson(systemConfigPath(), { ...loadSystemConfig(), ...values });
+const isObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+
+// The settings of an extension's own, which ~/.crossbind.json keeps apart from crossbind's, under extensions by the
+// extension's name.
+export function extensionSettingsOf(system, name) {
+    const own = system.extensions === undefined ? {} : isObject(system.extensions) && (system.extensions[name] ?? {});
+    if (!isObject(own)) throw new Error(`crossbind: ${systemConfigPath()} keeps the settings of the extension ${name} as no object of them, under extensions: fix it.`);
+    return own;
+}
+
+// Sets keys of ~/.crossbind.json, as `crossbind config set` does, keeping the others, and with { name, values } settings
+// of that extension's own.
+export function updateSystemConfig(values, extension = null) {
+    const system = loadSystemConfig();
+    const own = extension && { extensions: { ...system.extensions, [extension.name]: { ...extensionSettingsOf(system, extension.name), ...extension.values } } };
+    writeJson(systemConfigPath(), { ...system, ...values, ...own });
 }

package/vitest.config.js

@@ -52,7 +52,12 @@ export default defineConfig({
             // exercised a machine without that image already cached, and android builds shipped
             // broken to every Apple Silicon user. Which command line these actions build IS the
             // behaviour, so the layer is measured.
-            include: ['src/utils/**/*.js', 'src/state/**/*.js', 'src/assets/**/*.js', 'src/actions/**/*.js'],
+            // crossbind's own extensions' build-side code, which left src/ as packages of their own, is measured with it.
+            include: [
+                'src/utils/**/*.js', 'src/state/**/*.js', 'src/assets/**/*.js', 'src/actions/**/*.js',
+                '../../extensions/*/crossbind.extension.js', '../../extensions/*/src/**/*.js', '../../core/store-kit/*.js',
+            ],
+            allowExternal: true,
             all: true,
             // A floor with a one-point band, not a ratchet. Coverage is not identical across
             // environments - resolveEmbindRust walks the real node_modules layout, so which of its

package/src/actions/appSetup.js

@@ -1,116 +0,0 @@
-import state from '../state/index.js';
-import { askLine, askYesNo } from '../utils/ask.js';
-import { entry, writeAppOption } from '../utils/configWriter.js';
-import { PRIVACY_CATEGORIES } from '../utils/appOptions.js';
-import { readAppIcon } from '../utils/appIcon.js';
-
-// What only the project can answer, which `crossbind app publish` asks on a terminal and writes into crossbind.config.js
-// once the user says yes.
-
-// An id both stores take: dot-separated parts of letters and digits, each starting with a letter, as Apple's take no
-// underscore and Google's no hyphen.
-const STORE_APP_ID = /^[A-Za-z][A-Za-z0-9]*(\.[A-Za-z][A-Za-z0-9]*)+$/;
-
-const REASONS_PAGE = 'https://developer.apple.com/documentation/bundleresources/describing-use-of-required-reason-api';
-// Apple's reasons an app may give, in short; that page has their rules. 0A2A.1 and C56D.1 are for third-party SDKs alone.
-const REASONS = {
-    'DDA9.1': 'to show file timestamps to the user; they stay on the device',
-    'C617.1': "for the timestamps, size or other metadata of files in the app's container, app group container or CloudKit container",
-    '3B52.1': 'for those of files or folders the user granted access to, as with a document picker',
-    '35F9.1': 'to measure the time between events in the app, or for timers; only that time may leave the device',
-    '8FFB.1': "to turn the times of the app's events into absolute timestamps, which may leave the device; the boot time may not",
-    '3D61.1': 'in an optional bug report the user chooses to send, which shows it prominently',
-    '85F4.1': 'to show disk space to the user; it stays on the device',
-    'E174.1': 'to check for space before writing files, or to delete files when space runs low, in a way the user notices; it stays on the device',
-    '7D9E.1': 'in an optional bug report the user chooses to send, which shows it prominently',
-    'B728.1': 'in a health research app, to tell participants that low disk space hampers the research',
-    '3EC4.1': 'in a custom keyboard app, to find the keyboards active on the device',
-    '54BD.1': 'to show the right interface for the active keyboard in text fields, in a way the user notices; it stays on the device',
-    'CA92.1': 'for information only the app itself reads and writes',
-    '1C8F.1': "for information only the apps and extensions of the app's App Group read and write",
-    'AC6B.1': 'for the managed app configuration MDM sets, or the feedback MDM reads',
-};
-
-// Writes app.<key> into crossbind.config.js once the user says yes, and into this run's config. One the config sets
-// already is the user's to change.
-async function writeAppAnswer(key, value) {
-    const text = entry(key, value);
-    if (state.config.app[key] !== undefined) throw new Error(`crossbind: set app.${text} in crossbind.config.js in place of the app.${key} there, and publish again.`);
-    if (!await askYesNo(`Write app.${text} into crossbind.config.js? [Y/n] `)) throw new Error(`crossbind: set app.${text} in crossbind.config.js to publish.`);
-    if (!writeAppOption(state.config.paths.project, key, value)) {
-        throw new Error(`crossbind: crossbind.config.js is no config crossbind can write app.${key} into safely: set app.${text} in it yourself.`);
-    }
-    state.config.app = { ...state.config.app, [key]: value };
-}
-
-// Asks for the app's id, which the store keeps for good, under the name the store gives it.
-export async function askAppId(store, term) {
-    console.log(`crossbind: ${store} knows an app by its ${term}, app.id, and keeps it for good.`);
-    for (;;) {
-        const id = (await askLine(`The ${term}, as com.example.myapp: `)).trim();
-        if (STORE_APP_ID.test(id)) {
-            await writeAppAnswer('id', id);
-            return id;
-        }
-        console.log(`That is no ${term} both stores take, which is dot-separated parts of letters and digits, each starting with a letter.`);
-    }
-}
-
-function iconProblem(icon) {
-    try {
-        readAppIcon({ ...state.config, app: { ...state.config.app, icon } });
-        return null;
-    } catch (error) {
-        return error.message;
-    }
-}
-
-// Asks for the app's icon, without which App Store Connect takes no iOS app.
-export async function askIcon() {
-    console.log('crossbind: App Store Connect takes no iOS app without an icon, app.icon: a square PNG, at best 1024 × 1024.');
-    for (;;) {
-        const icon = (await askLine("Its path, from the project's folder: ")).trim();
-        const problem = iconProblem(icon);
-        if (!problem) {
-            await writeAppAnswer('icon', icon);
-            return;
-        }
-        console.log(problem);
-    }
-}
-
-// Asks whether the app's encryption is iOS's own alone, which App Store Connect otherwise asks for every build. The answer
-// is a legal statement, so there is no default.
-export async function askEncryption() {
-    console.log('crossbind: App Store Connect asks for every build whether the app uses encryption that export rules do not exempt, until app.encryption answers it.');
-    for (;;) {
-        const answer = (await askLine('Does the app use only the encryption iOS provides, as HTTPS through iOS, or none at all? [y/n] ')).trim();
-        if (/^[yn]/i.test(answer)) {
-            await writeAppAnswer('encryption', /^n/i.test(answer));
-            return;
-        }
-        console.log('Answer y or n.');
-    }
-}
-
-async function askReasons(reasons) {
-    for (;;) {
-        const picks = (await askLine('Which apply, as 1 or 1,2? ')).split(',').map((pick) => pick.trim()).filter(Boolean);
-        const chosen = picks.map((pick) => reasons[Number(pick) - 1]);
-        if (chosen.length > 0 && chosen.every(Boolean)) return [...new Set(chosen)];
-        console.log(`Name one or more of 1 to ${reasons.length}, separated by commas.`);
-    }
-}
-
-// Asks for Apple's reasons for each category of required reason API the app calls with none in app.privacy.
-export async function askPrivacy(unreasoned) {
-    console.log(`crossbind: App Store Connect refuses an iOS app that calls required reason API without Apple's reasons for it (ITMS-91053), which app.privacy gives; ${REASONS_PAGE} has the rules of each.`);
-    const privacy = { ...state.config.app.privacy };
-    for (const { category, symbols } of unreasoned) {
-        const reasons = PRIVACY_CATEGORIES[category].reasons.filter((reason) => Object.hasOwn(REASONS, reason));
-        console.log(`The app calls ${category} API (${symbols.join(', ')}). Apple's reasons for it:`);
-        reasons.forEach((reason, index) => console.log(`  ${index + 1}) ${reason} ${REASONS[reason]}`));
-        privacy[category] = await askReasons(reasons);
-    }
-    await writeAppAnswer('privacy', privacy);
-}

package/src/actions/appStoreConnect.js

@@ -1,188 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import state from '../state/index.js';
-import { APPLE_SIGNING } from './appleSigning.js';
-import { EXEC_MAX_BUFFER } from './run.js';
-import { PRIVACY_CATEGORIES } from '../utils/appOptions.js';
-import { xmlPlist } from '../utils/plist.js';
-
-export const APP_STORE_CONNECT = 'https://appstoreconnect.apple.com/apps';
-const DEVELOPER_ACCOUNT = 'https://developer.apple.com/account';
-// The lines of a failed xcodebuild's output that say why; its log has the rest.
-const REASON_LINES = 15;
-
-// An upload to an app App Store Connect does not have yet, which only its site makes.
-const MISSING_APP = {
-    pattern: /No suitable application records were found|App record with bundle identifier .* not found/i,
-    hint: ({ id }) => `App Store Connect has no app ${id}: create it at ${APP_STORE_CONNECT}, a new iOS app with ${id} as its bundle ID, which this publish registered with Apple.`,
-    page: APP_STORE_CONNECT,
-};
-
-// What a failed archive or upload means where xcodebuild's own words leave it unclear: what the user mends in Xcode or
-// on Apple's sites, and the page where.
-const CAUSES = [
-    {
-        pattern: /login details for account .* were rejected|No Accounts?\b|No Account for Team/i,
-        hint: ({ team }) => `Xcode is signed in to no account of team ${team}, or its sign-in has lapsed: sign in again in Xcode, under Settings › Accounts.`,
-    },
-    {
-        pattern: /PLA Update available|Program License Agreement/i,
-        hint: () => `Apple has a new Program License Agreement, which the team's Account Holder accepts at ${DEVELOPER_ACCOUNT}.`,
-        page: DEVELOPER_ACCOUNT,
-    },
-    {
-        pattern: /Cloud signing permission error/i,
-        hint: () => `the API key may not sign in the cloud, which takes its Admin role: use an Admin key, make an Apple Distribution certificate once in Xcode, under Settings › Accounts › Manage Certificates, or unset ${APPLE_SIGNING.key} to upload with Xcode's account.`,
-    },
-    {
-        pattern: /cannot be registered to your development team because it is not available/i,
-        hint: ({ id }) => `another team registered the bundle id ${id} with Apple first: set app.id in crossbind.config.js to an id of your own, as one under a domain you own.`,
-        // The id is in what was built, so the same step tried again fails the same way.
-        needsRebuild: true,
-    },
-    MISSING_APP,
-];
-
-// Where a publish keeps the archive, its export and their logs.
-const storeDir = () => `${state.config.paths.build}/app-store`;
-
-const keyArgs = (key) => (key ? ['-authenticationKeyPath', key.key, '-authenticationKeyID', key.keyId, '-authenticationKeyIssuerID', key.issuer] : []);
-
-// Runs xcodebuild with its output in `log`, which it returns. Its failure names the lines that say why, and what to do
-// where those leave it unclear.
-export function xcodebuild(what, args, log, facts) {
-    const out = fs.openSync(log, 'w');
-    let result;
-    try {
-        result = spawnSync('xcodebuild', args, { stdio: ['ignore', out, out] });
-    } finally {
-        fs.closeSync(out);
-    }
-    if (result.error) throw new Error(`crossbind: cannot run xcodebuild, which comes with Xcode: ${result.error.message}`, { cause: result.error });
-    if (result.signal) throw new Error(`crossbind: ${what} stopped on ${result.signal}.`);
-    const output = fs.readFileSync(log, 'utf8');
-    if (result.status === 0) return output;
-    const reasons = [...new Set(output.split('\n').map((line) => line.trim()).filter((line) => /\berror\b|ITMS-/i.test(line)))].slice(-REASON_LINES);
-    const cause = CAUSES.find(({ pattern }) => pattern.test(output));
-    const lines = [`crossbind: ${what} failed; xcodebuild's log is ${log}.`, ...reasons.map((line) => `  ${line}`), ...(cause ? [`crossbind: ${cause.hint(facts)}`] : [])];
-    throw Object.assign(new Error(lines.join('\n')), { isMendable: Boolean(cause) && !cause.needsRebuild, page: cause?.page ?? null, reason: cause ?? null });
-}
-
-const archivedApp = (archive) => `${archive}/Products/Applications/${state.config.general.name}.app`;
-
-// The entitlements file the Xcode project names, or null without one.
-function projectEntitlements(project) {
-    const settings = fs.readFileSync(`${project}/${state.config.general.name}.xcodeproj/project.pbxproj`, 'utf8');
-    const file = settings.match(/"?CODE_SIGN_ENTITLEMENTS"?\s*=\s*"?([^";]+)"?;/)?.[1];
-    return file ? path.resolve(project, file.replace('$(SRCROOT)/', '')) : null;
-}
-
-// Signs an archived app ad hoc, its frameworks first, which takes no certificate. The signature carries the app's
-// entitlements to the upload, which an unsigned app would lose, and the upload replaces it with its distribution one.
-function signAdHoc(app, entitlements) {
-    const frameworks = fs.existsSync(`${app}/Frameworks`) ? fs.readdirSync(`${app}/Frameworks`).map((name) => `${app}/Frameworks/${name}`) : [];
-    [...frameworks, app].forEach((code) => {
-        const withEntitlements = code === app && entitlements ? ['--entitlements', entitlements, '--generate-entitlement-der'] : [];
-        const result = spawnSync('codesign', ['--force', '--sign', '-', '--timestamp=none', ...withEntitlements, code], { encoding: 'utf8' });
-        if (result.error || result.status !== 0) {
-            throw new Error(`crossbind: codesign could not sign ${code} ad hoc: ${(result.stderr || result.error?.message || '').trim()}`);
-        }
-    });
-}
-
-// Archives the app of the iOS Xcode project crossbind wrote unsigned, then signs it ad hoc with the entitlements the
-// project names. The upload signs it for distribution, so the archive needs no development certificate, profile, device
-// or Apple account.
-export function archiveIosApp(project, { facts }) {
-    const { name } = state.config.general;
-    const archive = `${storeDir()}/${name}.xcarchive`;
-    fs.rmSync(archive, { recursive: true, force: true });
-    fs.mkdirSync(storeDir(), { recursive: true });
-    xcodebuild('the archive', [
-        'archive', '-project', `${project}/${name}.xcodeproj`, '-scheme', name, '-configuration', 'Release', '-destination', 'generic/platform=iOS',
-        '-archivePath', archive, 'CODE_SIGNING_ALLOWED=NO',
-    ], `${storeDir()}/archive.log`, facts);
-    signAdHoc(archivedApp(archive), projectEntitlements(project));
-    return archive;
-}
-
-export const archivedBinary = (archive) => `${archivedApp(archive)}/${state.config.general.name}`;
-
-// The reasons the archived app's privacy manifest gives, by category: what App Store Connect reads, whatever the config
-// the build read said.
-export function archivedPrivacy(archive) {
-    const manifest = `${archivedApp(archive)}/PrivacyInfo.xcprivacy`;
-    if (!fs.existsSync(manifest)) return {};
-    const result = spawnSync('plutil', ['-convert', 'json', '-o', '-', manifest], { encoding: 'utf8' });
-    if (result.status !== 0) throw new Error(`crossbind: cannot read ${manifest}: ${result.stderr || result.error?.message}`);
-    const names = Object.fromEntries(Object.entries(PRIVACY_CATEGORIES).map(([name, { type }]) => [type, name]));
-    return Object.fromEntries((JSON.parse(result.stdout).NSPrivacyAccessedAPITypes ?? [])
-        .filter(({ NSPrivacyAccessedAPIType: type }) => Object.hasOwn(names, type))
-        .map(({ NSPrivacyAccessedAPIType: type, NSPrivacyAccessedAPITypeReasons: reasons }) => [names[type], reasons]));
-}
-
-// Hermes comes prebuilt, so the archive has no dSYM of it, which App Store Connect asks for.
-export function addHermesDsym(archive, dsym) {
-    fs.cpSync(dsym, `${archive}/dSYMs/hermesvm.framework.dSYM`, { recursive: true });
-}
-
-// The options of an export for App Store Connect: an upload with the app's dSYMs, or an .ipa alone.
-function writeExportOptions(file, { destination, team, isBuildManaged }) {
-    fs.writeFileSync(file, xmlPlist({
-        destination,
-        manageAppVersionAndBuildNumber: isBuildManaged,
-        method: 'app-store-connect',
-        signingStyle: 'automatic',
-        teamID: team,
-        uploadSymbols: destination === 'upload',
-    }));
-    return file;
-}
-
-// Registers the app's bundle id with Apple, as App Store Connect's form for a new app lists registered ids alone. An
-// upload asks for the app record before it signs, so it registers nothing; an export to an .ipa, with no build number
-// to look up, signs at once, which registers the id.
-function registerBundleId(archive, { team, key, facts }) {
-    const options = writeExportOptions(`${storeDir()}/RegisterOptions.plist`, { destination: 'export', team, isBuildManaged: false });
-    xcodebuild('the registration of the bundle id', [
-        '-exportArchive', '-archivePath', archive, '-exportOptionsPlist', options, '-exportPath', `${storeDir()}/register`, '-allowProvisioningUpdates',
-        ...keyArgs(key),
-    ], `${storeDir()}/register.log`, facts);
-}
-
-// Exports the archive for App Store Connect and uploads it with its dSYMs, signed for distribution in the cloud by Xcode's
-// account or an Admin key, else with an Apple Distribution certificate in the keychain, with the entitlements of its ad
-// hoc signature, which the App ID gets the capabilities of. Xcode numbers the build unless CROSSBIND_APP_BUILD_NUMBER
-// did, and writes nothing to -exportPath, which xcodebuild asks for all the same.
-export function uploadIosArchive(archive, { team, key, isBuildManaged, facts }) {
-    const options = writeExportOptions(`${storeDir()}/ExportOptions.plist`, { destination: 'upload', team, isBuildManaged });
-    let output;
-    try {
-        output = xcodebuild('the upload', [
-            '-exportArchive', '-archivePath', archive, '-exportOptionsPlist', options, '-exportPath', `${storeDir()}/export`, '-allowProvisioningUpdates',
-            ...keyArgs(key),
-        ], `${storeDir()}/upload.log`, facts);
-    } catch (error) {
-        if (error.reason === MISSING_APP) {
-            console.log(`crossbind: App Store Connect has no app ${facts.id} yet, so this publish registers its bundle id with Apple first.`);
-            registerBundleId(archive, { team, key, facts });
-        }
-        throw error;
-    }
-    // What App Store Connect warns of, as a dSYM it could not take, goes up with the app all the same.
-    output.split('\n').filter((line) => line.startsWith('warning: exportArchive')).forEach((line) => console.warn(`crossbind: ${line}`));
-}
-
-// The teams of the accounts signed in to Xcode that upload to App Store Connect, which a free personal team does not,
-// from Xcode's settings; `withPersonal` adds those free teams, which sign for their own devices.
-export function xcodeTeams({ withPersonal = false } = {}) {
-    const settings = spawnSync('defaults', ['export', 'com.apple.dt.Xcode', '-'], { maxBuffer: EXEC_MAX_BUFFER });
-    if (settings.status !== 0) return [];
-    const teams = spawnSync('plutil', ['-extract', 'IDEProvisioningTeamByIdentifier', 'json', '-o', '-', '-'], {
-        input: settings.stdout, encoding: 'utf8', maxBuffer: EXEC_MAX_BUFFER,
-    });
-    if (teams.status !== 0) return [];
-    const signing = Object.values(JSON.parse(teams.stdout)).flat().filter((team) => withPersonal || !team.isFreeProvisioningTeam);
-    return [...new Map(signing.map((team) => [team.teamID, { id: team.teamID, name: team.teamName }])).values()];
-}

package/src/actions/appUpdate.js

@@ -1,68 +0,0 @@
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import path from 'node:path';
-import run from './run.js';
-import state from '../state/index.js';
-import { appId, appUpdater } from '../utils/appOptions.js';
-
-// The private key that signs a desktop app's updates, named by the environment alone so that no secret reaches a file.
-export const UPDATER_KEY = 'CROSSBIND_UPDATER_PRIVATE_KEY';
-// The fixed DER around an Ed25519 key's 32 bytes, private and public.
-const PRIVATE_DER = Buffer.from('302e020100300506032b657004220420', 'hex');
-const PUBLIC_DER = Buffer.from('302a300506032b6570032100', 'hex');
-
-const publicKeyOf = (privateKey) => crypto.createPublicKey(privateKey).export({ format: 'der', type: 'spki' }).subarray(PUBLIC_DER.length);
-
-// A new key pair: the public key for app.updater.publicKey, the private one for CROSSBIND_UPDATER_PRIVATE_KEY.
-export function newUpdaterKey() {
-    const { privateKey } = crypto.generateKeyPairSync('ed25519');
-    return {
-        publicKey: publicKeyOf(privateKey).toString('base64'),
-        privateKey: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(PRIVATE_DER.length).toString('base64'),
-    };
-}
-
-// The key a build signs updates with, or null without CROSSBIND_UPDATER_PRIVATE_KEY. It has to be the private half of
-// app.updater.publicKey, or the app would refuse what it signs.
-export function updaterSigning(env = process.env) {
-    if (!env[UPDATER_KEY]) return null;
-    const updater = appUpdater(state.config);
-    if (!updater) throw new Error(`crossbind: ${UPDATER_KEY} is set, but crossbind.config.js has no app.updater, which tells an app where its updates are.`);
-    const seed = Buffer.from(env[UPDATER_KEY], 'base64');
-    if (seed.length !== 32) throw new Error(`crossbind: ${UPDATER_KEY} is no Ed25519 private key, which \`crossbind app updater-key\` prints.`);
-    const privateKey = crypto.createPrivateKey({ key: Buffer.concat([PRIVATE_DER, seed]), format: 'der', type: 'pkcs8' });
-    if (!publicKeyOf(privateKey).equals(updater.publicKey)) {
-        throw new Error(`crossbind: ${UPDATER_KEY} is not the private key of app.updater.publicKey, so the app would refuse the updates it signs.`);
-    }
-    return { privateKey, version: updater.version };
-}
-
-// What an update's signature covers: the app's id, the platform and arch it is for, its version and its file's SHA-512,
-// so that no file passes for another app's, platform's or version's. The host checks the same text.
-export function signedText(id, target, version, file) {
-    const hash = crypto.createHash('sha512').update(fs.readFileSync(file)).digest('hex');
-    return `crossbind update\n${id}\n${target}\n${version}\n${hash}\n`;
-}
-
-// The file a desktop app updates itself from, beside it: a macOS app as a zip, which keeps its signature and Apple's
-// ticket, a Windows app's setup program and a Linux app's tar.gz.
-function updateFile(app, target) {
-    if (target.platform === 'win32') return `${app}-setup.exe`;
-    if (target.platform === 'linux') return `${app}.tar.gz`;
-    const zip = path.join(path.dirname(app), `${state.config.general.name}-darwin-${target.arch}.app.zip`);
-    fs.rmSync(zip, { force: true });
-    run(null, ['ditto', '-c', '-k', '--keepParent', app, zip], null, target);
-    return zip;
-}
-
-// With a key in the environment, the update a desktop app finds at app.updater.url, beside the app: its file, and the
-// manifest that gives its version, the file's name and its signature, <name>-<platform>-<arch>.update.json.
-export default function writeUpdate(app, target) {
-    const signing = updaterSigning();
-    if (!signing) return;
-    const file = updateFile(app, target);
-    const name = `${target.platform}-${target.arch}`;
-    const signature = crypto.sign(null, Buffer.from(signedText(appId(state.config), name, signing.version, file)), signing.privateKey).toString('base64');
-    const manifest = { version: signing.version, file: path.basename(file), signature };
-    fs.writeFileSync(path.join(path.dirname(app), `${state.config.general.name}-${name}.update.json`), `${JSON.stringify(manifest, null, 2)}\n`);
-}

package/src/actions/extensions.js

@@ -1,7 +0,0 @@
-import state from '../state/index.js';
-
-export default function triggerExtensions(fileName, hook, params = []) {
-    state.config.extensions?.forEach(e => {
-        e?.[fileName]?.[hook](state, ...params);
-    });
-}

package/src/actions/googlePlay.js

@@ -1,213 +0,0 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { createSign } from 'node:crypto';
-import { spawnSync } from 'node:child_process';
-import { accessToken } from './googleSignIn.js';
-import { readSecret, storeSecret } from '../utils/keychain.js';
-
-// Google Play's credentials, which the environment or ~/.crossbind.json names: a service account's e-mail, whose token
-// the user's gcloud login buys with no key, or its JSON key; or, from the environment alone, an access token made
-// elsewhere, as CI makes one with no key.
-export const PLAY = { key: 'CROSSBIND_GOOGLE_PLAY_KEY', serviceAccount: 'CROSSBIND_GOOGLE_PLAY_SERVICE_ACCOUNT', token: 'CROSSBIND_GOOGLE_PLAY_TOKEN' };
-export const PLAY_SCOPE = 'https://www.googleapis.com/auth/androidpublisher';
-// The keychain keeps the user's Google sign-in for Play under this service; on Windows, beside this path.
-const SIGN_IN_SERVICE = 'crossbind google play';
-const signInKey = () => path.join(os.homedir(), '.crossbind', 'google-play');
-const API = 'https://androidpublisher.googleapis.com/androidpublisher/v3/applications';
-const UPLOAD = 'https://androidpublisher.googleapis.com/upload/androidpublisher/v3/applications';
-const IAM = 'https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts';
-// The longest a service account's token lasts.
-const TOKEN_SECONDS = 3600;
-// Play's answer for an app whose first release Play Console has not rolled out yet.
-const DRAFT_APP = /status draft may be created on draft app/;
-
-const encode = (value) => Buffer.from(JSON.stringify(value)).toString('base64url');
-
-// A JSON key's own text, as CI's secrets give it, in place of its file's path.
-const KEY_TEXT = /^\s*\{/;
-
-// A service account key from its JSON, which `source` names where it is none, never repeating the text.
-function parseKey(json, source, isText) {
-    let key;
-    try {
-        key = JSON.parse(json);
-    } catch {
-        throw new Error(`crossbind: ${source} ${isText ? 'holds' : 'is'} no JSON, so it is no service account key.`);
-    }
-    const missing = ['client_email', 'private_key', 'token_uri'].filter((field) => !key[field]);
-    if (missing.length) throw new Error(`crossbind: ${source} has no ${missing.join(', ')}, so it is no service account key.`);
-    return key;
-}
-
-function readKey(file) {
-    if (!fs.statSync(file, { throwIfNoEntry: false })?.isFile()) throw new Error(`crossbind: ${PLAY.key} names ${file}, which is no file.`);
-    return parseKey(fs.readFileSync(file, 'utf8'), `${file} (${PLAY.key})`, false);
-}
-
-// The credentials Play takes from this environment and machine, or null without any: one of the three kinds.
-export function playCredentials(env = process.env, system = {}) {
-    const file = env[PLAY.key] || system.GOOGLE_PLAY_KEY;
-    const account = env[PLAY.serviceAccount] || system.GOOGLE_PLAY_SERVICE_ACCOUNT;
-    const token = env[PLAY.token];
-    if (file && account) {
-        throw new Error(`crossbind: both ${PLAY.key} and ${PLAY.serviceAccount} are set, or their keys in ~/.crossbind.json: set one, the service account's e-mail to use your gcloud login, or its JSON key.`);
-    }
-    if (token && (file || account)) {
-        throw new Error(`crossbind: ${PLAY.token} is set, and so is ${file ? PLAY.key : PLAY.serviceAccount} or its key in ~/.crossbind.json: set one.`);
-    }
-    if (token) return { token };
-    if (account) return { account };
-    if (!file) return null;
-    if (KEY_TEXT.test(env[PLAY.key] ?? '')) {
-        const key = parseKey(env[PLAY.key], PLAY.key, true);
-        return { account: key.client_email, key, file: null };
-    }
-    const key = readKey(file);
-    return { account: key.client_email, key, file };
-}
-
-// The user's Google sign-in for Play that this machine keeps, or null where it keeps none or Google no longer takes it.
-export async function keptSignIn() {
-    const refreshToken = readSecret(signInKey(), { service: SIGN_IN_SERVICE });
-    if (!refreshToken) return null;
-    try {
-        await accessToken(refreshToken);
-    } catch (error) {
-        if (error.reason !== 'invalid_grant') throw error;
-        console.log('crossbind: Google no longer takes the sign-in this machine keeps for Google Play, as when it was revoked.');
-        return null;
-    }
-    return { refreshToken };
-}
-
-// Keeps the user's Google sign-in for Play in the system's keychain, and says whether it did.
-export function keepSignIn(refreshToken) {
-    fs.mkdirSync(path.dirname(signInKey()), { recursive: true });
-    return storeSecret(signInKey(), refreshToken, { service: SIGN_IN_SERVICE });
-}
-
-async function keyToken({ account, key }) {
-    const now = Math.floor(Date.now() / 1000);
-    const unsigned = `${encode({ alg: 'RS256', typ: 'JWT' })}.${encode({ iss: account, scope: PLAY_SCOPE, aud: key.token_uri, iat: now, exp: now + TOKEN_SECONDS })}`;
-    const signature = createSign('RSA-SHA256').update(unsigned).sign(key.private_key).toString('base64url');
-    const response = await fetch(key.token_uri, {
-        method: 'POST',
-        body: new URLSearchParams({ grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer', assertion: `${unsigned}.${signature}` }),
-    });
-    const body = await response.json().catch(() => ({}));
-    if (!response.ok) throw new Error(`crossbind: Google refused the token of ${account}: ${response.status} ${body.error ?? ''} ${body.error_description ?? ''}`.trim());
-    return body.access_token;
-}
-
-// The user's own gcloud login buys an hour's token of the service account, so no key of it exists anywhere.
-async function accountToken({ account }) {
-    const own = spawnSync('gcloud', ['auth', 'print-access-token'], { encoding: 'utf8' });
-    if (own.error || own.status !== 0) {
-        throw new Error(`crossbind: gcloud gave no token of yours: sign in with gcloud auth login, or name the service account's JSON key with ${PLAY.key} instead.\n${(own.stderr || own.error?.message || '').trim()}`);
-    }
-    const response = await fetch(`${IAM}/${account}:generateAccessToken`, {
-        method: 'POST',
-        headers: { authorization: `Bearer ${own.stdout.trim()}`, 'content-type': 'application/json' },
-        body: JSON.stringify({ scope: [PLAY_SCOPE] }),
-    });
-    const body = await response.json().catch(() => ({}));
-    if (!response.ok) {
-        throw new Error(`crossbind: Google gave no token of ${account}: ${response.status} ${body.error?.message ?? ''}\nyour gcloud account needs the Service Account Token Creator role on it, and its project the IAM Service Account Credentials API.`);
-    }
-    return body.accessToken;
-}
-
-// An hour's token of Play's API: the one from the environment, or one for the user's Google sign-in or for the service
-// account.
-export async function playToken(credentials) {
-    if (credentials.token) return credentials.token;
-    if (credentials.refreshToken) return accessToken(credentials.refreshToken);
-    return credentials.key ? keyToken(credentials) : accountToken(credentials);
-}
-
-function playError(status, message, method, url, appId, credentials) {
-    const route = new URL(url).pathname.replace(/^.*\/applications\/[^/]+/, '') || '/';
-    let text = `crossbind: Google Play answered ${method} ${route} with ${status}: ${message}`;
-    if (status === 404 && route === '/edits') {
-        text = `crossbind: Play Console has no app ${appId}: create it there, with ${appId} as its package name, as Play's API makes none.`;
-    } else if (status === 401 && credentials.token) {
-        text = `crossbind: Google Play takes ${PLAY.token} no more: it has expired, as access tokens do after an hour, or it is no access token; make it in the publish's own job.`;
-    } else if (status === 403 && credentials.token && /insufficient authentication scopes/i.test(message)) {
-        text = `crossbind: ${PLAY.token} lacks the scope ${PLAY_SCOPE}, which Google Play's API takes: ask for it where the token is made, as google-github-actions/auth's access_token_scopes does.`;
-    } else if (status === 403 && credentials.refreshToken) {
-        text = `crossbind: the Google account you signed in with has no release rights for ${appId}: sign in with one that has, or have it invited in Play Console, under Users and permissions, with "Release apps to testing tracks" for the app.`;
-    } else if (status === 403) {
-        const account = credentials.token ? `the account behind ${PLAY.token}` : credentials.account;
-        text = `crossbind: ${account} has no release rights for ${appId}: invite it in Play Console, under Users and permissions, with "Release apps to testing tracks" for the app.`;
-    }
-    return Object.assign(new Error(text), { status, playMessage: message });
-}
-
-// A caller of Play's API for one app, whose failures say what to do where they can.
-async function playCaller(appId, credentials) {
-    const token = await playToken(credentials);
-    return async (method, url, body) => {
-        const isBinary = Buffer.isBuffer(body);
-        const response = await fetch(url, {
-            method,
-            headers: { authorization: `Bearer ${token}`, 'content-type': isBinary ? 'application/octet-stream' : 'application/json' },
-            body: isBinary || body === undefined ? body : JSON.stringify(body),
-        });
-        const text = await response.text();
-        if (response.ok) return text ? JSON.parse(text) : {};
-        let message = text;
-        try {
-            message = JSON.parse(text).error?.message ?? text;
-        } catch {
-            // Not Google's JSON error, so the text is the message.
-        }
-        throw playError(response.status, message, method, url, appId, credentials);
-    };
-}
-
-// The highest versionCode Play has seen of an app, in its bundles, its APKs and its tracks' releases; 0 for none.
-export async function highestVersionCode(appId, credentials) {
-    const call = await playCaller(appId, credentials);
-    const edits = `${API}/${appId}/edits`;
-    const edit = await call('POST', edits, {});
-    try {
-        const { tracks = [] } = await call('GET', `${edits}/${edit.id}/tracks`);
-        const { bundles = [] } = await call('GET', `${edits}/${edit.id}/bundles`);
-        const { apks = [] } = await call('GET', `${edits}/${edit.id}/apks`);
-        const released = tracks.flatMap(({ releases = [] }) => releases.flatMap(({ versionCodes = [] }) => versionCodes));
-        return Math.max(0, ...[...bundles, ...apks].map(({ versionCode }) => versionCode), ...released.map(Number));
-    } finally {
-        await call('DELETE', `${edits}/${edit.id}`).catch(() => {});
-    }
-}
-
-// Uploads a bundle, with the zip of its native debug symbols if there is one, and releases it on a track, as status
-// says, in one edit. An app never released takes a draft alone, which its first rollout in Play Console makes live, so
-// its release becomes one.
-export async function uploadBundle(appId, credentials, { aab, symbols = null, track, status }) {
-    const call = await playCaller(appId, credentials);
-    const edits = `${API}/${appId}/edits`;
-    const edit = await call('POST', edits, {});
-    try {
-        const { versionCode } = await call('POST', `${UPLOAD}/${appId}/edits/${edit.id}/bundles?uploadType=media`, fs.readFileSync(aab));
-        if (symbols) {
-            await call('POST', `${UPLOAD}/${appId}/edits/${edit.id}/apks/${versionCode}/deobfuscationFiles/nativeCode?uploadType=media`, fs.readFileSync(symbols));
-        }
-        const release = async (releaseStatus) => {
-            await call('PUT', `${edits}/${edit.id}/tracks/${track}`, { track, releases: [{ versionCodes: [String(versionCode)], status: releaseStatus }] });
-            await call('POST', `${edits}/${edit.id}:commit`);
-            return { versionCode, status: releaseStatus };
-        };
-        try {
-            return await release(status);
-        } catch (error) {
-            if (status === 'draft' || !DRAFT_APP.test(error.playMessage ?? '')) throw error;
-            return await release('draft');
-        }
-    } catch (error) {
-        // An edit left open expires by itself; the first failure is the one to report.
-        await call('DELETE', `${edits}/${edit.id}`).catch(() => {});
-        throw error;
-    }
-}