crossbind 2.0.0-beta.68 → 2.0.0-beta.69

package/src/actions/iosDevice.js

@@ -3,7 +3,7 @@ import os from 'node:os';
 import { spawn, spawnSync } from 'node:child_process';
 import { EXEC_MAX_BUFFER } from './run.js';
 import { appTeam } from './buildApp.js';
-import { xcodebuild, xcodeTeams } from './appStoreConnect.js';
+import { xcodebuild, xcodeTeams } from './xcodebuild.js';
 import state from '../state/index.js';
 import { appId } from '../utils/appOptions.js';
 
@@ -171,7 +171,7 @@ export function buildForIosDevice(project, device) {
     xcodebuild(`the build for ${device.name}`, [
         '-project', `${project}/${name}.xcodeproj`, '-scheme', name, '-configuration', 'Debug', '-sdk', 'iphoneos', '-destination', `id=${device.udid}`,
         '-allowProvisioningUpdates', '-allowProvisioningDeviceRegistration', `SYMROOT=${products}`, 'build',
-    ], `${products}/device.log`, { team, id: appId(state.config) });
+    ], { log: `${products}/device.log`, facts: { team, id: appId(state.config) } });
     return `${products}/Debug-iphoneos/${name}.app`;
 }
 

package/src/actions/iosSimulator.js

@@ -43,8 +43,8 @@ export function buildForSimulator(project, configuration = 'Release') {
     return `${products}/${configuration}-iphonesimulator/${name}.app`;
 }
 
-// Opens a Simulator build of an iOS app, with `env` in its environment. The process returned carries the app's output
-// and ends with the app; close() ends the app.
+// Opens a Simulator build of an iOS app, with `env` in its environment, in the Simulator of the device returned. The
+// process returned carries the app's output and ends with the app; close() ends the app.
 export default function openInSimulator(app, { env = {}, show = false, stdio = 'pipe' } = {}) {
     const device = simulator();
     // Simulator.app only shows the device, which runs the app without it as well.
@@ -59,5 +59,5 @@ export default function openInSimulator(app, { env = {}, show = false, stdio = '
         childEnv[`SIMCTL_CHILD_${key}`] = value;
     });
     const child = spawn('xcrun', ['simctl', 'launch', '--console-pty', '--terminate-running-process', device, bundleId], { env: childEnv, stdio });
-    return { child, close: () => spawnSync('xcrun', ['simctl', 'terminate', device, bundleId]) };
+    return { child, device, close: () => spawnSync('xcrun', ['simctl', 'terminate', device, bundleId]) };
 }

package/src/actions/licenses.js

@@ -12,7 +12,11 @@ import resolveAppHostRoot, { resolveAppEmbindJsiRoot } from '../utils/resolveApp
 import {
     HERMES, HERMES_ANDROID, HERMES_SOURCE, hermesUrl,
 } from '../utils/hermes.js';
+import { installersFor } from './appInstaller.js';
+import { DESKTOP_PLATFORMS } from './buildApp.js';
+import extensionsInApp from './extensionsInApp.js';
 import { ANDROIDX_WEBKIT } from './gradleProject.js';
+import { extensionPackage, extensionPart } from '../utils/appExtensions.js';
 import { shippedBundledLicense } from '../utils/bundledLicenses.js';
 import toolchainNoticesDir from '../utils/toolchainNotices.js';
 
@@ -208,13 +212,12 @@ function nodeRuntimeRows({ isAddon }) {
     }];
 }
 
-// What an app's host carries beside crossbind's runtime, pinned as the third_party READMEs of @crossbind/core-app-host
+// What an app's host carries beside crossbind's runtime, pinned as the READMEs beside them in @crossbind/core-app-host
 // record: React Native's Hermes, JSI's jsi.cpp from the same release, webview/webview, and on Windows the WebView2 SDK's
 // headers.
 const WEBVIEW = { version: 'cbbdee44afff22867de9fd88a9fc8350d9bdd399', sha256: '10e972a2327b5681474f4aa4499e505eaa4ff659aa995380386f08fd6fc1b763' };
 const WEBVIEW2_SDK = { version: '1.0.4258.31', sha256: '56f7f4b8bf9aee4b8efefbbdd4f67d5f74ebd1b100ed0806da71bf76af481aa9' };
 const JSI_SHA256 = 'cb6274a22abc93ecc970066539815e716d3e47716e8f93a9971cf4eb5918ffc1';
-const MONOCYPHER = { version: '4.0.3', sha256: '8cc9bc341a66249016db9bd70e9142d8d0aef9945973744b1ac05dbc55d8ee66' };
 // The fbjni the Hermes release for Android depends on.
 const FBJNI_VERSION = '0.7.0';
 
@@ -273,8 +276,8 @@ function androidAppRows() {
     ];
 }
 
-// The WebView2 SDK headers a Windows host compiles against, and the NSIS its setup program carries. webview/webview
-// loads the WebView2 Runtime itself, without the SDK's loader.
+// The WebView2 SDK headers a Windows host compiles against. webview/webview loads the WebView2 Runtime itself, without the
+// SDK's loader.
 function windowsAppRows(hostRoot) {
     const license = 'BSD-3-Clause';
     return [{
@@ -290,22 +293,73 @@ function windowsAppRows(hostRoot) {
         sourceUrl: `https://api.nuget.org/v3-flatcontainer/microsoft.web.webview2/${WEBVIEW2_SDK.version}/microsoft.web.webview2.${WEBVIEW2_SDK.version}.nupkg`,
         licenseNotes: "the WebView2 SDK's headers from the windows toolchain image, whose interface IDs the host compiles in",
         licenseText: textOf(path.join(hostRoot, 'third_party', 'webview2', 'LICENSE')),
-    }, {
-        npmName: '@crossbind/core-app-host',
-        name: 'nsis',
-        version: '3.11',
-        nativeVersion: '3.11',
-        sha256: null,
-        license: 'Zlib AND MIT',
-        licenseDeclared: 'Zlib AND MIT',
-        licenseSelected: null,
-        isCopyleft: false,
-        sourceUrl: 'https://sources.debian.org/src/nsis/3.11-1/',
-        licenseNotes: "the installer stub and plugins the app's setup program carries, from Debian's nsis in the windows toolchain image: zlib/libpng, but for the System plugin's Call.S, MIT",
-        licenseText: textOf(path.join(hostRoot, 'third_party', 'nsis', 'LICENSE')),
     }];
 }
 
+const APP_PLATFORMS = ['darwin', 'ios', 'android', 'linux', 'win32'];
+
+// The extensions an app of this platform has, of any platform's without one: crossbind's own that bring it code, and those
+// crossbind.config.js lists.
+function extensionsIn(platform) {
+    if (!platform) return [...new Map(APP_PLATFORMS.flatMap((one) => extensionsIn(one)).map((extension) => [extension.name, extension])).values()];
+    const listed = (state.config.extensions ?? []).map(({ name }) => name);
+    const hasCode = (extension) => {
+        const { native, java } = extensionPart([extension], platform);
+        return native.length > 0 || java.length > 0;
+    };
+    return extensionsInApp(platform).filter((extension) => listed.includes(extension.name) || hasCode(extension));
+}
+
+// A row of the code of others an extension carries, by what its licenses list says of it.
+const carriedRow = (entry, root, notes) => ({
+    npmName: null,
+    name: entry.name,
+    version: null,
+    nativeVersion: entry.version,
+    sha256: entry.sha256 ?? null,
+    license: entry.license,
+    licenseDeclared: entry.license,
+    licenseSelected: null,
+    isCopyleft: isCopyleft(entry.license),
+    sourceUrl: entry.source ?? null,
+    licenseNotes: entry.notes ?? notes,
+    licenseText: textOf(path.join(root, entry.file)),
+});
+
+// What the installers of a desktop app carry into what they make.
+const installerRows = (platform) => (DESKTOP_PLATFORMS[platform] ? installersFor({ platform }) : [])
+    .flatMap(({ name, root, installer }) => (installer.licenses ?? []).map((entry) => carriedRow(entry, root, `carried by what the installer ${name} makes`)));
+
+// What an app's extensions bring into it: each extension package's own code, and the code of others each carries, as its
+// app.licenses lists it. An extension in the project's own folders is the project's code, as the app is.
+function extensionRows(platform) {
+    return extensionsIn(platform).flatMap((extension) => {
+        const own = extensionPackage(extension.root, state.config.paths.base);
+        const owner = own?.manifest.name ?? null;
+        const license = own?.manifest.license ?? null;
+        const shipped = own && packageLicenseFile(own.dir);
+        const packageRows = own && !own.manifest.private ? [{
+            npmName: owner,
+            name: owner,
+            version: own.manifest.version ?? null,
+            nativeVersion: null,
+            license,
+            licenseDeclared: license,
+            licenseSelected: null,
+            isCopyleft: Boolean(license) && isCopyleft(license),
+            sourceUrl: own.manifest.homepage ?? null,
+            licenseNotes: `the app extension ${extension.name}, which the app's host compiles in`,
+            licenseText: shipped ? textOf(shipped) : null,
+        }] : [];
+        const carried = (extension.app.licenses ?? []).map((entry) => carriedRow(
+            entry,
+            extension.root,
+            `carried by the app extension ${extension.name}${owner ? ` of ${owner}` : ''}, which the app's host compiles in`,
+        ));
+        return [...packageRows, ...carried];
+    });
+}
+
 function appRuntimeRows(platform) {
     const hostRoot = resolveAppHostRoot();
     const hermesLicense = textOf(path.join(hostRoot, 'third_party', 'jsi', 'LICENSE'));
@@ -347,24 +401,9 @@ function appRuntimeRows(platform) {
             nativeVersion: WEBVIEW.version,
             sha256: WEBVIEW.sha256,
             sourceUrl: 'https://github.com/webview/webview',
-            licenseNotes: 'webview/webview, with the local patch @crossbind/core-app-host lists',
+            licenseNotes: 'webview/webview, with the local patches @crossbind/core-app-host lists',
             licenseText: textOf(path.join(hostRoot, 'third_party', 'webview', 'LICENSE')),
         }]),
-        // A desktop host checks its updates with Monocypher, which the linker leaves out of one without app.updater.
-        ...(['ios', 'android'].includes(platform) || state.config.app?.updater === undefined ? [] : [{
-            npmName: '@crossbind/core-app-host',
-            name: 'monocypher',
-            version: MONOCYPHER.version,
-            nativeVersion: MONOCYPHER.version,
-            sha256: MONOCYPHER.sha256,
-            license: 'BSD-2-Clause OR CC0-1.0',
-            licenseDeclared: 'BSD-2-Clause OR CC0-1.0',
-            licenseSelected: null,
-            isCopyleft: false,
-            sourceUrl: `https://monocypher.org/download/monocypher-${MONOCYPHER.version}.tar.gz`,
-            licenseNotes: "Monocypher's Ed25519 and SHA-512, compiled into the host, which check the app's updates",
-            licenseText: textOf(path.join(hostRoot, 'third_party', 'monocypher', 'LICENCE.md')),
-        }]),
     ];
 }
 
@@ -484,6 +523,16 @@ export default async function collectLicenseRows(platform = null, { runtimeEnv =
     if (platform === 'wasi') rows.push(...wasiToolchainRows());
     if (['linux', 'linuxmusl', 'win32'].includes(platform)) rows.push(...addonToolchainRows(platform));
     if (runtimeEnv === 'node') rows.push(...nodeRuntimeRows({ isAddon: platform !== null }));
-    if (runtimeEnv === 'app') rows.push(...appRuntimeRows(platform));
+    if (runtimeEnv === 'app') {
+        rows.push(...appRuntimeRows(platform));
+        // A library two extensions carry, or one the app has already, is listed once for each version the app ships.
+        const versionOf = (row) => `${row.name}@${row.nativeVersion ?? row.version}`;
+        const listed = new Set(rows.map(versionOf));
+        for (const row of [...extensionRows(platform), ...installerRows(platform)]) {
+            if (listed.has(versionOf(row))) continue;
+            listed.add(versionOf(row));
+            rows.push(row);
+        }
+    }
     return rows.sort((a, b) => a.name.localeCompare(b.name));
 }

package/src/actions/linuxPackages.js

@@ -0,0 +1,48 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { downloadFile, verifyIntegrity } from '../utils/downloadAndExtractFile.js';
+
+// The Ubuntu 22.04 packages a Linux extension lists beside crossbind's sysroot: each downloaded once into the build's
+// folder from Launchpad, as the sysroot's own are, checked against its SHA-256 and unpacked into a sysroot of the
+// extension's own for the target, whose headers its sources include and whose libraries the host links against. Its
+// users' systems load the libraries at run time, as the app's Debian package's Depends asks for them.
+
+const DEBIAN_ARCH = { x64: 'amd64', arm64: 'arm64' };
+const MULTIARCH = { x64: 'x86_64-linux-gnu', arm64: 'aarch64-linux-gnu' };
+
+export const packageUrl = (file) => `https://launchpad.net/ubuntu/+archive/primary/+files/${file}`;
+
+// The packages of the target's architecture among the lines an extension lists.
+export function packagesFor(target, lines) {
+    return lines.map((line) => line.split(' ')).filter(([arch]) => arch === DEBIAN_ARCH[target.arch]).map(([, file, sha256]) => ({ file, sha256 }));
+}
+
+// What a sysroot gives the target: the folders its sources include, usr/include and each folder in it, as a library's
+// headers sit in one of its own, and the folder the host links from.
+export function sysrootDirs(target, root) {
+    const include = path.join(root, 'usr', 'include');
+    const nested = fs.existsSync(include)
+        ? fs.readdirSync(include, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path.join(include, entry.name))
+        : [];
+    return { includes: [include, ...nested], libDir: path.join(root, 'usr', 'lib', MULTIARCH[target.arch]) };
+}
+
+// Unpacks each extension's packages for the target, with unpack(deb, folder), which crossbind's Linux image runs.
+export async function unpackPackages(target, compiled, { cache, workDir, unpack }) {
+    const sysroots = [];
+    for (const { name, packages } of compiled.filter((part) => part.packages.length > 0)) {
+        const own = packagesFor(target, packages);
+        if (own.length === 0) throw new Error(`crossbind: the extension ${name} lists Linux packages, but none of ${DEBIAN_ARCH[target.arch]}, which an ${target.arch} app takes.`);
+        const root = path.join(workDir, 'sysroot', name);
+        fs.rmSync(root, { recursive: true, force: true });
+        fs.mkdirSync(root, { recursive: true });
+        for (const { file, sha256 } of own) {
+            const url = packageUrl(file);
+            const deb = await downloadFile(url, cache);
+            verifyIntegrity(deb, url, sha256);
+            unpack(deb, root);
+        }
+        sysroots.push({ name, ...sysrootDirs(target, root) });
+    }
+    return sysroots;
+}

package/src/actions/mavenVerification.js

@@ -0,0 +1,37 @@
+// The verification metadata of an Android app whose extensions ask Maven for libraries: the android-app image's, which
+// lists all crossbind's own project resolves, with each extension's components, as Gradle's
+// --write-verification-metadata lists them. Gradle then checks every file it resolves, from the image's cache or online.
+
+const COMPONENT = /<component group="([^"]+)" name="([^"]+)" version="([^"]+)"[^>]*>([\s\S]*?)<\/component>/g;
+const ARTIFACT = /<artifact name="([^"]+)">[\s\S]*?<\/artifact>/g;
+// What would leave a file unchecked, which an extension's metadata may not add to the app's.
+const TRUST = /<(trusted-artifacts|trust|ignored-keys|trusted-keys)\b/;
+
+export function mergedVerification(base, fragments) {
+    const components = new Map();
+    const add = (xml, owner) => {
+        for (const [, group, name, version, body] of xml.matchAll(COMPONENT)) {
+            const key = `${group}:${name}:${version}`;
+            const artifacts = components.get(key) ?? new Map();
+            for (const [block, artifact] of body.matchAll(ARTIFACT)) {
+                const known = artifacts.get(artifact);
+                if (known && known.block !== block) throw new Error(`crossbind: ${owner} gives ${artifact} of ${key} other checksums than ${known.owner} does.`);
+                if (!known) artifacts.set(artifact, { block, owner });
+            }
+            components.set(key, artifacts);
+        }
+    };
+    add(base, "the android-app image's verification metadata");
+    for (const { name, xml } of fragments) {
+        const owner = `the extension ${name}`;
+        if (TRUST.test(xml)) throw new Error(`crossbind: ${owner}'s verification metadata trusts files Gradle would then leave unchecked, which no extension's may.`);
+        if ([...xml.matchAll(COMPONENT)].length === 0) throw new Error(`crossbind: ${owner}'s verification metadata lists no component, as Gradle's --write-verification-metadata sha256 writes them.`);
+        add(xml, owner);
+    }
+    const listed = [...components.entries()].sort(([one], [other]) => (one < other ? -1 : 1)).map(([key, artifacts]) => {
+        const [group, name, version] = key.split(':');
+        const blocks = [...artifacts.values()].map(({ block }) => `         ${block}\n`).join('');
+        return `      <component group="${group}" name="${name}" version="${version}">\n${blocks}      </component>\n`;
+    });
+    return `${base.slice(0, base.indexOf('<components>'))}<components>\n${listed.join('')}   </components>\n</verification-metadata>\n`;
+}

package/src/actions/publish.js

@@ -0,0 +1,220 @@
+import state from '../state/index.js';
+import loadConfig from '../state/loadConfig.js';
+import {
+    DESKTOP_PLATFORMS, MAX_VERSION_CODE, appOutputOf, clearAppOutputs,
+} from './buildApp.js';
+import extensionApi from './extensionApi.js';
+import {
+    PUBLISH_PLATFORMS, extensionStep, isJsonValue, ownExtensions, withListed, withoutNamed,
+} from '../utils/appExtensions.js';
+import { CONFIG_CHANGES } from '../utils/configChanges.js';
+import { hasTerminal } from '../utils/ask.js';
+import resolveAppHostRoot from '../utils/resolveAppHost.js';
+
+const isObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const possessive = (name) => (name.endsWith('s') ? `${name}'` : `${name}'s`);
+const listed = (names, word = 'or') => (names.length > 1 ? `${names.slice(0, -1).join(', ')} ${word} ${names.at(-1)}` : names[0]);
+const kebab = (name) => name.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`);
+const camel = (name) => name.replace(/-([a-z0-9])/g, (dash, letter) => letter.toUpperCase());
+const storeName = ({ name, publisher }) => publisher.store ?? name;
+// How many builds a publish makes at most, as its first publisher may ask for another.
+const MAX_BUILDS = 4;
+
+// A step of the publisher's, which its publisher may lack.
+const step = ({ name, publisher }, which, ...args) => extensionStep(name, which, () => publisher[which]?.(...args));
+
+// crossbind's own publishers, which the host brings as it brings its other extensions.
+export const builtInPublishers = () => withoutNamed(ownExtensions(resolveAppHostRoot()), state.config?.app).filter(({ publisher }) => publisher);
+
+// The publishers an app has: crossbind's own, each in the place of the app's extension of its name that has a
+// publisher, then those of the app's other extensions.
+export const publishersOf = (extensions) => withListed(builtInPublishers(), extensions.filter((extension) => extension.publisher));
+
+// The store the command names first, before the options, else the last publisher that says it is the one of the platform
+// -p, or CROSSBIND_APP_PLATFORM, names, and the arguments after it. A store named after the options, of those crossbind
+// knows, is refused, as Vite would take it.
+export function storeOf(args, platform, envPlatform, publishers = []) {
+    const [first, ...rest] = args;
+    const named = first !== undefined && !first.startsWith('-') ? first : null;
+    const late = named ? null : args.find((arg) => publishers.some(({ name }) => name === arg));
+    if (late) throw new Error(`crossbind: crossbind app publish takes the store first, before the options: crossbind app publish ${late} ${args.filter((arg) => arg !== late).join(' ')}.`);
+    const where = platform ?? envPlatform;
+    const usual = publishers.findLast(({ publisher }) => publisher.isDefault && publisher.platforms.includes(where));
+    return { store: named ?? usual?.name ?? null, rest: named ? rest : args };
+}
+
+// The publisher of a store, after those it comes after, first to last.
+export function publishChain(publishers, store) {
+    if (!publishers.some(({ name }) => name === store)) {
+        throw new Error(`crossbind: crossbind app publish takes the store it sends the app to first: ${listed(publishers.map(({ name }) => name))}${store ? `, not ${store}` : ''}.`);
+    }
+    const chain = [];
+    for (let current = store; current;) {
+        const extension = publishers.find(({ name }) => name === current);
+        if (!extension) throw new Error(`crossbind: ${chain[0].name} comes after ${current}, which no publisher is named.`);
+        if (chain.includes(extension)) throw new Error(`crossbind: ${listed([extension, ...chain].map(({ name }) => name), 'and')} come after one another in a circle.`);
+        chain.unshift(extension);
+        current = extension.publisher.after;
+    }
+    return chain;
+}
+
+// The platform a publish builds for: the one -p names, which every publisher of it takes, else the only one they take,
+// else CROSSBIND_APP_PLATFORM's, else this machine's desktop one.
+export function publishPlatform(chain, platform, envPlatform, host = process.platform) {
+    const store = chain.at(-1).name;
+    const platforms = chain.reduce((taken, { publisher }) => taken.filter((one) => publisher.platforms.includes(one)), PUBLISH_PLATFORMS);
+    if (platforms.length === 0) throw new Error(`crossbind: ${store} comes after ${chain[0].name}, which takes apps of none of its platforms.`);
+    const takes = `${store} takes ${listed(platforms)} apps`;
+    if (platform) {
+        if (!platforms.includes(platform)) throw new Error(`crossbind: ${takes}, not ${possessive(platform)}, which -p names.`);
+        return platform;
+    }
+    if (platforms.length === 1) return platforms[0];
+    if (envPlatform) {
+        if (!platforms.includes(envPlatform)) throw new Error(`crossbind: ${takes}, not ${possessive(envPlatform)}, which CROSSBIND_APP_PLATFORM names.`);
+        return envPlatform;
+    }
+    if (platforms.includes(DESKTOP_PLATFORMS[host])) return DESKTOP_PLATFORMS[host];
+    throw new Error(`crossbind: ${takes}: name one with -p.`);
+}
+
+// The options of each publisher of a publish, as the command line gives them, and the arguments Vite takes. An option
+// that another publisher takes is refused, naming whose it is; any other goes on to Vite.
+export function publishOptions(chain, args, publishers) {
+    const kinds = new Map();
+    chain.forEach(({ name, publisher }) => Object.entries(publisher.options).forEach(([option, { value }]) => {
+        const first = kinds.get(option);
+        if (first && (first.value === null) !== (value === null)) {
+            throw new Error(`crossbind: ${first.name} and ${name} both take --${kebab(option)}, one as a flag and one with a value: one of them names it otherwise.`);
+        }
+        if (!first) kinds.set(option, { name, value });
+    }));
+    const given = new Map(chain.map(({ name }) => [name, new Map()]));
+    const foreign = new Map();
+    const viteArgs = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const match = /^--([a-z][a-z0-9-]*)(?:=(.*))?$/s.exec(args[index]);
+        const option = match && camel(match[1]);
+        const owners = match ? chain.filter(({ publisher }) => Object.hasOwn(publisher.options, option)) : [];
+        if (owners.length === 0) {
+            const other = match && publishers.find(({ publisher }) => Object.hasOwn(publisher.options, option));
+            if (other) foreign.set(other.name, [...(foreign.get(other.name) ?? []), `--${match[1]}`]);
+            else viteArgs.push(args[index]);
+            continue;
+        }
+        const { value: placeholder } = owners.at(-1).publisher.options[option];
+        let value = true;
+        if (placeholder !== null && match[2] === undefined) {
+            value = args[index + 1];
+            index += 1;
+            if (value === undefined || value.startsWith('-')) throw new Error(`crossbind: --${match[1]} takes a value, as ${placeholder}.`);
+        } else if (placeholder !== null) {
+            value = match[2];
+        } else if (match[2] !== undefined) {
+            throw new Error(`crossbind: --${match[1]} takes no value.`);
+        }
+        owners.forEach(({ name }) => given.get(name).set(option, value));
+    }
+    if (foreign.size > 0) {
+        const whose = [...foreign].map(([owner, names]) => `${listed(names, 'and')} ${names.length > 1 ? 'are' : 'is'} ${possessive(owner)}`);
+        throw new Error(`crossbind: ${listed(whose, 'and')}, which ${chain.at(-1).name} takes none of.`);
+    }
+    const options = Object.fromEntries(chain.map(({ name, publisher }) => [name, Object.fromEntries(Object.entries(publisher.options)
+        .map(([option, { value, default: fallback }]) => [option, given.get(name).get(option) ?? (value === null ? false : fallback)]))]));
+    return { options, viteArgs };
+}
+
+// The help of the stores crossbind publishes to itself, with the options each takes after its name.
+export function publishHelp(publishers = builtInPublishers()) {
+    const signature = (option, { value }) => `--${kebab(option)}${value ? ` ${value}` : ''}`;
+    const width = Math.max(...publishers.flatMap(({ publisher }) => Object.entries(publisher.options).map(([option, declared]) => signature(option, declared).length)));
+    return [
+        '',
+        'Stores, each with the options it takes after its name:',
+        ...publishers.flatMap(({ name, publisher }) => [
+            `  ${name}: ${storeName({ name, publisher })}, for ${listed(publisher.platforms)} apps${publisher.isDefault ? ', which goes first for them' : ''}`,
+            ...Object.entries(publisher.options).map(([option, declared]) => `    ${signature(option, declared).padEnd(width)}  ${declared.help}${declared.default ? ` (default: ${declared.default})` : ''}`),
+        ]),
+        "An app's extensions add stores of their own, each with the options its package gives.",
+    ].join('\n');
+}
+
+// The changes the first publisher makes to the config for its build: a JSON merge patch of crossbind.config.js's
+// export.
+async function buildChanges(extension, api) {
+    const { name } = extension;
+    const changes = await step(extension, 'build', api);
+    if (changes === null || changes === undefined) return null;
+    if (!isObject(changes) || !isJsonValue(changes)) {
+        throw new Error(`crossbind: ${name}'s build gives no changes to crossbind.config.js, which are an object of JSON values merged into its export, where null removes a key.`);
+    }
+    return changes;
+}
+
+// Hands the build's output to the uploads of the publishers after the first, each with what the one before it put out.
+async function uploadAfter(chain, apis, sessions, output, firstPublished) {
+    let published = firstPublished;
+    for (const [index, extension] of chain.entries()) {
+        const { name } = extension;
+        if (index > 0) {
+            const answer = await step(extension, 'upload', apis[index], sessions[index], output, published);
+            if (answer?.isRebuildAsked) throw new Error(`crossbind: ${name} asks for another build, which ${chain[0].name}, whose build it publishes from, alone can ask for.`);
+            published = answer?.published;
+        }
+    }
+}
+
+// Sends an app to a store through its publisher, after those it comes after. All they need is checked before the build,
+// which takes minutes: on a terminal they ask for what is missing and set it up; without one, as in CI, every missing
+// piece is named at once. crossbind then builds the app once, with the first publisher's changes to the config, build
+// number and environment, and hands its output to each one's upload in turn. The first may ask for another build, as
+// an iOS app's does once its user has given Apple's reasons for an API it calls.
+export default async function publish(args, { platform, envPlatform, runVite }) {
+    const publishers = publishersOf(state.config.extensions);
+    const { store, rest } = storeOf(args, platform, envPlatform, publishers);
+    const chain = publishChain(publishers, store);
+    const own = builtInPublishers().map(({ name }) => name);
+    chain.filter((extension) => own.includes(extension.name) && state.config.extensions.includes(extension))
+        .forEach(({ name, root }) => console.log(`crossbind: the extension ${name} of ${root} replaces crossbind's own publisher of its name.`));
+    const target = publishPlatform(chain, platform, envPlatform);
+    const { options, viteArgs } = publishOptions(chain, rest, publishers);
+    const run = { buildNumber: undefined };
+    const isGuided = hasTerminal();
+    const apis = chain.map(({ name }) => extensionApi(name, {
+        platform: target, options: options[name], isGuided, run,
+    }));
+    const [first] = chain;
+    const changes = await buildChanges(first, apis[0]);
+    if (changes) state.config = await loadConfig(undefined, undefined, { changes });
+    const checked = [];
+    for (const [index, extension] of chain.entries()) checked.push((await step(extension, 'check', apis[index])) ?? {});
+    const missing = checked.flatMap((result) => result.missing ?? []);
+    if (missing.length > 0) throw new Error(missing.join('\n'));
+    const sessions = checked.map(({ session }) => session);
+    run.buildNumber = (await step(first, 'buildNumber', apis[0], sessions[0])) ?? null;
+    if (run.buildNumber !== null && !(Number.isInteger(run.buildNumber) && run.buildNumber >= 1 && run.buildNumber <= MAX_VERSION_CODE)) {
+        throw new Error(`crossbind: ${first.name}'s buildNumber gives ${JSON.stringify(run.buildNumber)}, which is no build number: a whole number from 1 to ${MAX_VERSION_CODE}, as both stores take, or null for the app's own.`);
+    }
+    for (let builds = 1; ; builds += 1) {
+        clearAppOutputs();
+        const buildEnv = await step(first, 'buildEnv', apis[0], sessions[0]);
+        const exitCode = await runVite(['build', ...viteArgs], {
+            ...process.env,
+            ...(changes ? { [CONFIG_CHANGES]: JSON.stringify(changes) } : {}),
+            ...buildEnv,
+            CROSSBIND_APP_PLATFORM: target,
+            ...(run.buildNumber === null ? {} : { CROSSBIND_APP_BUILD_NUMBER: String(run.buildNumber) }),
+        });
+        if (exitCode !== 0) {
+            throw Object.assign(new Error(`crossbind: the build ended with exit code ${exitCode}, so nothing went to ${storeName(first)}.`), { exitCode });
+        }
+        const output = appOutputOf(target);
+        const answer = await step(first, 'upload', apis[0], sessions[0], output);
+        if (!answer?.isRebuildAsked) {
+            await uploadAfter(chain, apis, sessions, output, answer?.published);
+            return;
+        }
+        if (builds === MAX_BUILDS) throw new Error(`crossbind: ${first.name} asks for another build after ${MAX_BUILDS}, as many as a publish makes.`);
+    }
+}

package/src/actions/windowsSigning.js

@@ -49,7 +49,7 @@ export function windowsSigning(env = process.env) {
         return null;
     }
     if (TOKENS.includes(storetype)) {
-        throw new Error(`crossbind: ${WINDOWS_SIGNING.storetype} ${storetype} is a hardware token, which crossbind's windows container does not reach. Sign with a cloud's key service, as Azure Trusted Signing (TRUSTEDSIGNING) or Azure Key Vault (AZUREKEYVAULT), or with a PKCS#12 file.`);
+        throw new Error(`crossbind: ${WINDOWS_SIGNING.storetype} ${storetype} is a hardware token, which crossbind's windows container does not reach. Sign with a cloud's key service, as Azure Artifact Signing (TRUSTEDSIGNING) or Azure Key Vault (AZUREKEYVAULT), or with a PKCS#12 file.`);
     }
     if (![...FILE_STORES, ...CLOUDS].includes(storetype)) {
         throw new Error(`crossbind: ${WINDOWS_SIGNING.storetype} ${storetype} is no store type jsign takes: ${[...FILE_STORES, ...CLOUDS].join(', ')}.`);