crossbind 2.0.0-beta.68 → 2.0.0-beta.72

package/src/actions/appStoreConnect.js

@@ -1,188 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import state from '../state/index.js';
-import { APPLE_SIGNING } from './appleSigning.js';
-import { EXEC_MAX_BUFFER } from './run.js';
-import { PRIVACY_CATEGORIES } from '../utils/appOptions.js';
-import { xmlPlist } from '../utils/plist.js';
-
-export const APP_STORE_CONNECT = 'https://appstoreconnect.apple.com/apps';
-const DEVELOPER_ACCOUNT = 'https://developer.apple.com/account';
-// The lines of a failed xcodebuild's output that say why; its log has the rest.
-const REASON_LINES = 15;
-
-// An upload to an app App Store Connect does not have yet, which only its site makes.
-const MISSING_APP = {
-    pattern: /No suitable application records were found|App record with bundle identifier .* not found/i,
-    hint: ({ id }) => `App Store Connect has no app ${id}: create it at ${APP_STORE_CONNECT}, a new iOS app with ${id} as its bundle ID, which this publish registered with Apple.`,
-    page: APP_STORE_CONNECT,
-};
-
-// What a failed archive or upload means where xcodebuild's own words leave it unclear: what the user mends in Xcode or
-// on Apple's sites, and the page where.
-const CAUSES = [
-    {
-        pattern: /login details for account .* were rejected|No Accounts?\b|No Account for Team/i,
-        hint: ({ team }) => `Xcode is signed in to no account of team ${team}, or its sign-in has lapsed: sign in again in Xcode, under Settings › Accounts.`,
-    },
-    {
-        pattern: /PLA Update available|Program License Agreement/i,
-        hint: () => `Apple has a new Program License Agreement, which the team's Account Holder accepts at ${DEVELOPER_ACCOUNT}.`,
-        page: DEVELOPER_ACCOUNT,
-    },
-    {
-        pattern: /Cloud signing permission error/i,
-        hint: () => `the API key may not sign in the cloud, which takes its Admin role: use an Admin key, make an Apple Distribution certificate once in Xcode, under Settings › Accounts › Manage Certificates, or unset ${APPLE_SIGNING.key} to upload with Xcode's account.`,
-    },
-    {
-        pattern: /cannot be registered to your development team because it is not available/i,
-        hint: ({ id }) => `another team registered the bundle id ${id} with Apple first: set app.id in crossbind.config.js to an id of your own, as one under a domain you own.`,
-        // The id is in what was built, so the same step tried again fails the same way.
-        needsRebuild: true,
-    },
-    MISSING_APP,
-];
-
-// Where a publish keeps the archive, its export and their logs.
-const storeDir = () => `${state.config.paths.build}/app-store`;
-
-const keyArgs = (key) => (key ? ['-authenticationKeyPath', key.key, '-authenticationKeyID', key.keyId, '-authenticationKeyIssuerID', key.issuer] : []);
-
-// Runs xcodebuild with its output in `log`, which it returns. Its failure names the lines that say why, and what to do
-// where those leave it unclear.
-export function xcodebuild(what, args, log, facts) {
-    const out = fs.openSync(log, 'w');
-    let result;
-    try {
-        result = spawnSync('xcodebuild', args, { stdio: ['ignore', out, out] });
-    } finally {
-        fs.closeSync(out);
-    }
-    if (result.error) throw new Error(`crossbind: cannot run xcodebuild, which comes with Xcode: ${result.error.message}`, { cause: result.error });
-    if (result.signal) throw new Error(`crossbind: ${what} stopped on ${result.signal}.`);
-    const output = fs.readFileSync(log, 'utf8');
-    if (result.status === 0) return output;
-    const reasons = [...new Set(output.split('\n').map((line) => line.trim()).filter((line) => /\berror\b|ITMS-/i.test(line)))].slice(-REASON_LINES);
-    const cause = CAUSES.find(({ pattern }) => pattern.test(output));
-    const lines = [`crossbind: ${what} failed; xcodebuild's log is ${log}.`, ...reasons.map((line) => `  ${line}`), ...(cause ? [`crossbind: ${cause.hint(facts)}`] : [])];
-    throw Object.assign(new Error(lines.join('\n')), { isMendable: Boolean(cause) && !cause.needsRebuild, page: cause?.page ?? null, reason: cause ?? null });
-}
-
-const archivedApp = (archive) => `${archive}/Products/Applications/${state.config.general.name}.app`;
-
-// The entitlements file the Xcode project names, or null without one.
-function projectEntitlements(project) {
-    const settings = fs.readFileSync(`${project}/${state.config.general.name}.xcodeproj/project.pbxproj`, 'utf8');
-    const file = settings.match(/"?CODE_SIGN_ENTITLEMENTS"?\s*=\s*"?([^";]+)"?;/)?.[1];
-    return file ? path.resolve(project, file.replace('$(SRCROOT)/', '')) : null;
-}
-
-// Signs an archived app ad hoc, its frameworks first, which takes no certificate. The signature carries the app's
-// entitlements to the upload, which an unsigned app would lose, and the upload replaces it with its distribution one.
-function signAdHoc(app, entitlements) {
-    const frameworks = fs.existsSync(`${app}/Frameworks`) ? fs.readdirSync(`${app}/Frameworks`).map((name) => `${app}/Frameworks/${name}`) : [];
-    [...frameworks, app].forEach((code) => {
-        const withEntitlements = code === app && entitlements ? ['--entitlements', entitlements, '--generate-entitlement-der'] : [];
-        const result = spawnSync('codesign', ['--force', '--sign', '-', '--timestamp=none', ...withEntitlements, code], { encoding: 'utf8' });
-        if (result.error || result.status !== 0) {
-            throw new Error(`crossbind: codesign could not sign ${code} ad hoc: ${(result.stderr || result.error?.message || '').trim()}`);
-        }
-    });
-}
-
-// Archives the app of the iOS Xcode project crossbind wrote unsigned, then signs it ad hoc with the entitlements the
-// project names. The upload signs it for distribution, so the archive needs no development certificate, profile, device
-// or Apple account.
-export function archiveIosApp(project, { facts }) {
-    const { name } = state.config.general;
-    const archive = `${storeDir()}/${name}.xcarchive`;
-    fs.rmSync(archive, { recursive: true, force: true });
-    fs.mkdirSync(storeDir(), { recursive: true });
-    xcodebuild('the archive', [
-        'archive', '-project', `${project}/${name}.xcodeproj`, '-scheme', name, '-configuration', 'Release', '-destination', 'generic/platform=iOS',
-        '-archivePath', archive, 'CODE_SIGNING_ALLOWED=NO',
-    ], `${storeDir()}/archive.log`, facts);
-    signAdHoc(archivedApp(archive), projectEntitlements(project));
-    return archive;
-}
-
-export const archivedBinary = (archive) => `${archivedApp(archive)}/${state.config.general.name}`;
-
-// The reasons the archived app's privacy manifest gives, by category: what App Store Connect reads, whatever the config
-// the build read said.
-export function archivedPrivacy(archive) {
-    const manifest = `${archivedApp(archive)}/PrivacyInfo.xcprivacy`;
-    if (!fs.existsSync(manifest)) return {};
-    const result = spawnSync('plutil', ['-convert', 'json', '-o', '-', manifest], { encoding: 'utf8' });
-    if (result.status !== 0) throw new Error(`crossbind: cannot read ${manifest}: ${result.stderr || result.error?.message}`);
-    const names = Object.fromEntries(Object.entries(PRIVACY_CATEGORIES).map(([name, { type }]) => [type, name]));
-    return Object.fromEntries((JSON.parse(result.stdout).NSPrivacyAccessedAPITypes ?? [])
-        .filter(({ NSPrivacyAccessedAPIType: type }) => Object.hasOwn(names, type))
-        .map(({ NSPrivacyAccessedAPIType: type, NSPrivacyAccessedAPITypeReasons: reasons }) => [names[type], reasons]));
-}
-
-// Hermes comes prebuilt, so the archive has no dSYM of it, which App Store Connect asks for.
-export function addHermesDsym(archive, dsym) {
-    fs.cpSync(dsym, `${archive}/dSYMs/hermesvm.framework.dSYM`, { recursive: true });
-}
-
-// The options of an export for App Store Connect: an upload with the app's dSYMs, or an .ipa alone.
-function writeExportOptions(file, { destination, team, isBuildManaged }) {
-    fs.writeFileSync(file, xmlPlist({
-        destination,
-        manageAppVersionAndBuildNumber: isBuildManaged,
-        method: 'app-store-connect',
-        signingStyle: 'automatic',
-        teamID: team,
-        uploadSymbols: destination === 'upload',
-    }));
-    return file;
-}
-
-// Registers the app's bundle id with Apple, as App Store Connect's form for a new app lists registered ids alone. An
-// upload asks for the app record before it signs, so it registers nothing; an export to an .ipa, with no build number
-// to look up, signs at once, which registers the id.
-function registerBundleId(archive, { team, key, facts }) {
-    const options = writeExportOptions(`${storeDir()}/RegisterOptions.plist`, { destination: 'export', team, isBuildManaged: false });
-    xcodebuild('the registration of the bundle id', [
-        '-exportArchive', '-archivePath', archive, '-exportOptionsPlist', options, '-exportPath', `${storeDir()}/register`, '-allowProvisioningUpdates',
-        ...keyArgs(key),
-    ], `${storeDir()}/register.log`, facts);
-}
-
-// Exports the archive for App Store Connect and uploads it with its dSYMs, signed for distribution in the cloud by Xcode's
-// account or an Admin key, else with an Apple Distribution certificate in the keychain, with the entitlements of its ad
-// hoc signature, which the App ID gets the capabilities of. Xcode numbers the build unless CROSSBIND_APP_BUILD_NUMBER
-// did, and writes nothing to -exportPath, which xcodebuild asks for all the same.
-export function uploadIosArchive(archive, { team, key, isBuildManaged, facts }) {
-    const options = writeExportOptions(`${storeDir()}/ExportOptions.plist`, { destination: 'upload', team, isBuildManaged });
-    let output;
-    try {
-        output = xcodebuild('the upload', [
-            '-exportArchive', '-archivePath', archive, '-exportOptionsPlist', options, '-exportPath', `${storeDir()}/export`, '-allowProvisioningUpdates',
-            ...keyArgs(key),
-        ], `${storeDir()}/upload.log`, facts);
-    } catch (error) {
-        if (error.reason === MISSING_APP) {
-            console.log(`crossbind: App Store Connect has no app ${facts.id} yet, so this publish registers its bundle id with Apple first.`);
-            registerBundleId(archive, { team, key, facts });
-        }
-        throw error;
-    }
-    // What App Store Connect warns of, as a dSYM it could not take, goes up with the app all the same.
-    output.split('\n').filter((line) => line.startsWith('warning: exportArchive')).forEach((line) => console.warn(`crossbind: ${line}`));
-}
-
-// The teams of the accounts signed in to Xcode that upload to App Store Connect, which a free personal team does not,
-// from Xcode's settings; `withPersonal` adds those free teams, which sign for their own devices.
-export function xcodeTeams({ withPersonal = false } = {}) {
-    const settings = spawnSync('defaults', ['export', 'com.apple.dt.Xcode', '-'], { maxBuffer: EXEC_MAX_BUFFER });
-    if (settings.status !== 0) return [];
-    const teams = spawnSync('plutil', ['-extract', 'IDEProvisioningTeamByIdentifier', 'json', '-o', '-', '-'], {
-        input: settings.stdout, encoding: 'utf8', maxBuffer: EXEC_MAX_BUFFER,
-    });
-    if (teams.status !== 0) return [];
-    const signing = Object.values(JSON.parse(teams.stdout)).flat().filter((team) => withPersonal || !team.isFreeProvisioningTeam);
-    return [...new Map(signing.map((team) => [team.teamID, { id: team.teamID, name: team.teamName }])).values()];
-}

package/src/actions/appUpdate.js

@@ -1,68 +0,0 @@
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import path from 'node:path';
-import run from './run.js';
-import state from '../state/index.js';
-import { appId, appUpdater } from '../utils/appOptions.js';
-
-// The private key that signs a desktop app's updates, named by the environment alone so that no secret reaches a file.
-export const UPDATER_KEY = 'CROSSBIND_UPDATER_PRIVATE_KEY';
-// The fixed DER around an Ed25519 key's 32 bytes, private and public.
-const PRIVATE_DER = Buffer.from('302e020100300506032b657004220420', 'hex');
-const PUBLIC_DER = Buffer.from('302a300506032b6570032100', 'hex');
-
-const publicKeyOf = (privateKey) => crypto.createPublicKey(privateKey).export({ format: 'der', type: 'spki' }).subarray(PUBLIC_DER.length);
-
-// A new key pair: the public key for app.updater.publicKey, the private one for CROSSBIND_UPDATER_PRIVATE_KEY.
-export function newUpdaterKey() {
-    const { privateKey } = crypto.generateKeyPairSync('ed25519');
-    return {
-        publicKey: publicKeyOf(privateKey).toString('base64'),
-        privateKey: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(PRIVATE_DER.length).toString('base64'),
-    };
-}
-
-// The key a build signs updates with, or null without CROSSBIND_UPDATER_PRIVATE_KEY. It has to be the private half of
-// app.updater.publicKey, or the app would refuse what it signs.
-export function updaterSigning(env = process.env) {
-    if (!env[UPDATER_KEY]) return null;
-    const updater = appUpdater(state.config);
-    if (!updater) throw new Error(`crossbind: ${UPDATER_KEY} is set, but crossbind.config.js has no app.updater, which tells an app where its updates are.`);
-    const seed = Buffer.from(env[UPDATER_KEY], 'base64');
-    if (seed.length !== 32) throw new Error(`crossbind: ${UPDATER_KEY} is no Ed25519 private key, which \`crossbind app updater-key\` prints.`);
-    const privateKey = crypto.createPrivateKey({ key: Buffer.concat([PRIVATE_DER, seed]), format: 'der', type: 'pkcs8' });
-    if (!publicKeyOf(privateKey).equals(updater.publicKey)) {
-        throw new Error(`crossbind: ${UPDATER_KEY} is not the private key of app.updater.publicKey, so the app would refuse the updates it signs.`);
-    }
-    return { privateKey, version: updater.version };
-}
-
-// What an update's signature covers: the app's id, the platform and arch it is for, its version and its file's SHA-512,
-// so that no file passes for another app's, platform's or version's. The host checks the same text.
-export function signedText(id, target, version, file) {
-    const hash = crypto.createHash('sha512').update(fs.readFileSync(file)).digest('hex');
-    return `crossbind update\n${id}\n${target}\n${version}\n${hash}\n`;
-}
-
-// The file a desktop app updates itself from, beside it: a macOS app as a zip, which keeps its signature and Apple's
-// ticket, a Windows app's setup program and a Linux app's tar.gz.
-function updateFile(app, target) {
-    if (target.platform === 'win32') return `${app}-setup.exe`;
-    if (target.platform === 'linux') return `${app}.tar.gz`;
-    const zip = path.join(path.dirname(app), `${state.config.general.name}-darwin-${target.arch}.app.zip`);
-    fs.rmSync(zip, { force: true });
-    run(null, ['ditto', '-c', '-k', '--keepParent', app, zip], null, target);
-    return zip;
-}
-
-// With a key in the environment, the update a desktop app finds at app.updater.url, beside the app: its file, and the
-// manifest that gives its version, the file's name and its signature, <name>-<platform>-<arch>.update.json.
-export default function writeUpdate(app, target) {
-    const signing = updaterSigning();
-    if (!signing) return;
-    const file = updateFile(app, target);
-    const name = `${target.platform}-${target.arch}`;
-    const signature = crypto.sign(null, Buffer.from(signedText(appId(state.config), name, signing.version, file)), signing.privateKey).toString('base64');
-    const manifest = { version: signing.version, file: path.basename(file), signature };
-    fs.writeFileSync(path.join(path.dirname(app), `${state.config.general.name}-${name}.update.json`), `${JSON.stringify(manifest, null, 2)}\n`);
-}

package/src/actions/extensions.js

@@ -1,7 +0,0 @@
-import state from '../state/index.js';
-
-export default function triggerExtensions(fileName, hook, params = []) {
-    state.config.extensions?.forEach(e => {
-        e?.[fileName]?.[hook](state, ...params);
-    });
-}

package/src/actions/googlePlay.js

@@ -1,213 +0,0 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { createSign } from 'node:crypto';
-import { spawnSync } from 'node:child_process';
-import { accessToken } from './googleSignIn.js';
-import { readSecret, storeSecret } from '../utils/keychain.js';
-
-// Google Play's credentials, which the environment or ~/.crossbind.json names: a service account's e-mail, whose token
-// the user's gcloud login buys with no key, or its JSON key; or, from the environment alone, an access token made
-// elsewhere, as CI makes one with no key.
-export const PLAY = { key: 'CROSSBIND_GOOGLE_PLAY_KEY', serviceAccount: 'CROSSBIND_GOOGLE_PLAY_SERVICE_ACCOUNT', token: 'CROSSBIND_GOOGLE_PLAY_TOKEN' };
-export const PLAY_SCOPE = 'https://www.googleapis.com/auth/androidpublisher';
-// The keychain keeps the user's Google sign-in for Play under this service; on Windows, beside this path.
-const SIGN_IN_SERVICE = 'crossbind google play';
-const signInKey = () => path.join(os.homedir(), '.crossbind', 'google-play');
-const API = 'https://androidpublisher.googleapis.com/androidpublisher/v3/applications';
-const UPLOAD = 'https://androidpublisher.googleapis.com/upload/androidpublisher/v3/applications';
-const IAM = 'https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts';
-// The longest a service account's token lasts.
-const TOKEN_SECONDS = 3600;
-// Play's answer for an app whose first release Play Console has not rolled out yet.
-const DRAFT_APP = /status draft may be created on draft app/;
-
-const encode = (value) => Buffer.from(JSON.stringify(value)).toString('base64url');
-
-// A JSON key's own text, as CI's secrets give it, in place of its file's path.
-const KEY_TEXT = /^\s*\{/;
-
-// A service account key from its JSON, which `source` names where it is none, never repeating the text.
-function parseKey(json, source, isText) {
-    let key;
-    try {
-        key = JSON.parse(json);
-    } catch {
-        throw new Error(`crossbind: ${source} ${isText ? 'holds' : 'is'} no JSON, so it is no service account key.`);
-    }
-    const missing = ['client_email', 'private_key', 'token_uri'].filter((field) => !key[field]);
-    if (missing.length) throw new Error(`crossbind: ${source} has no ${missing.join(', ')}, so it is no service account key.`);
-    return key;
-}
-
-function readKey(file) {
-    if (!fs.statSync(file, { throwIfNoEntry: false })?.isFile()) throw new Error(`crossbind: ${PLAY.key} names ${file}, which is no file.`);
-    return parseKey(fs.readFileSync(file, 'utf8'), `${file} (${PLAY.key})`, false);
-}
-
-// The credentials Play takes from this environment and machine, or null without any: one of the three kinds.
-export function playCredentials(env = process.env, system = {}) {
-    const file = env[PLAY.key] || system.GOOGLE_PLAY_KEY;
-    const account = env[PLAY.serviceAccount] || system.GOOGLE_PLAY_SERVICE_ACCOUNT;
-    const token = env[PLAY.token];
-    if (file && account) {
-        throw new Error(`crossbind: both ${PLAY.key} and ${PLAY.serviceAccount} are set, or their keys in ~/.crossbind.json: set one, the service account's e-mail to use your gcloud login, or its JSON key.`);
-    }
-    if (token && (file || account)) {
-        throw new Error(`crossbind: ${PLAY.token} is set, and so is ${file ? PLAY.key : PLAY.serviceAccount} or its key in ~/.crossbind.json: set one.`);
-    }
-    if (token) return { token };
-    if (account) return { account };
-    if (!file) return null;
-    if (KEY_TEXT.test(env[PLAY.key] ?? '')) {
-        const key = parseKey(env[PLAY.key], PLAY.key, true);
-        return { account: key.client_email, key, file: null };
-    }
-    const key = readKey(file);
-    return { account: key.client_email, key, file };
-}
-
-// The user's Google sign-in for Play that this machine keeps, or null where it keeps none or Google no longer takes it.
-export async function keptSignIn() {
-    const refreshToken = readSecret(signInKey(), { service: SIGN_IN_SERVICE });
-    if (!refreshToken) return null;
-    try {
-        await accessToken(refreshToken);
-    } catch (error) {
-        if (error.reason !== 'invalid_grant') throw error;
-        console.log('crossbind: Google no longer takes the sign-in this machine keeps for Google Play, as when it was revoked.');
-        return null;
-    }
-    return { refreshToken };
-}
-
-// Keeps the user's Google sign-in for Play in the system's keychain, and says whether it did.
-export function keepSignIn(refreshToken) {
-    fs.mkdirSync(path.dirname(signInKey()), { recursive: true });
-    return storeSecret(signInKey(), refreshToken, { service: SIGN_IN_SERVICE });
-}
-
-async function keyToken({ account, key }) {
-    const now = Math.floor(Date.now() / 1000);
-    const unsigned = `${encode({ alg: 'RS256', typ: 'JWT' })}.${encode({ iss: account, scope: PLAY_SCOPE, aud: key.token_uri, iat: now, exp: now + TOKEN_SECONDS })}`;
-    const signature = createSign('RSA-SHA256').update(unsigned).sign(key.private_key).toString('base64url');
-    const response = await fetch(key.token_uri, {
-        method: 'POST',
-        body: new URLSearchParams({ grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer', assertion: `${unsigned}.${signature}` }),
-    });
-    const body = await response.json().catch(() => ({}));
-    if (!response.ok) throw new Error(`crossbind: Google refused the token of ${account}: ${response.status} ${body.error ?? ''} ${body.error_description ?? ''}`.trim());
-    return body.access_token;
-}
-
-// The user's own gcloud login buys an hour's token of the service account, so no key of it exists anywhere.
-async function accountToken({ account }) {
-    const own = spawnSync('gcloud', ['auth', 'print-access-token'], { encoding: 'utf8' });
-    if (own.error || own.status !== 0) {
-        throw new Error(`crossbind: gcloud gave no token of yours: sign in with gcloud auth login, or name the service account's JSON key with ${PLAY.key} instead.\n${(own.stderr || own.error?.message || '').trim()}`);
-    }
-    const response = await fetch(`${IAM}/${account}:generateAccessToken`, {
-        method: 'POST',
-        headers: { authorization: `Bearer ${own.stdout.trim()}`, 'content-type': 'application/json' },
-        body: JSON.stringify({ scope: [PLAY_SCOPE] }),
-    });
-    const body = await response.json().catch(() => ({}));
-    if (!response.ok) {
-        throw new Error(`crossbind: Google gave no token of ${account}: ${response.status} ${body.error?.message ?? ''}\nyour gcloud account needs the Service Account Token Creator role on it, and its project the IAM Service Account Credentials API.`);
-    }
-    return body.accessToken;
-}
-
-// An hour's token of Play's API: the one from the environment, or one for the user's Google sign-in or for the service
-// account.
-export async function playToken(credentials) {
-    if (credentials.token) return credentials.token;
-    if (credentials.refreshToken) return accessToken(credentials.refreshToken);
-    return credentials.key ? keyToken(credentials) : accountToken(credentials);
-}
-
-function playError(status, message, method, url, appId, credentials) {
-    const route = new URL(url).pathname.replace(/^.*\/applications\/[^/]+/, '') || '/';
-    let text = `crossbind: Google Play answered ${method} ${route} with ${status}: ${message}`;
-    if (status === 404 && route === '/edits') {
-        text = `crossbind: Play Console has no app ${appId}: create it there, with ${appId} as its package name, as Play's API makes none.`;
-    } else if (status === 401 && credentials.token) {
-        text = `crossbind: Google Play takes ${PLAY.token} no more: it has expired, as access tokens do after an hour, or it is no access token; make it in the publish's own job.`;
-    } else if (status === 403 && credentials.token && /insufficient authentication scopes/i.test(message)) {
-        text = `crossbind: ${PLAY.token} lacks the scope ${PLAY_SCOPE}, which Google Play's API takes: ask for it where the token is made, as google-github-actions/auth's access_token_scopes does.`;
-    } else if (status === 403 && credentials.refreshToken) {
-        text = `crossbind: the Google account you signed in with has no release rights for ${appId}: sign in with one that has, or have it invited in Play Console, under Users and permissions, with "Release apps to testing tracks" for the app.`;
-    } else if (status === 403) {
-        const account = credentials.token ? `the account behind ${PLAY.token}` : credentials.account;
-        text = `crossbind: ${account} has no release rights for ${appId}: invite it in Play Console, under Users and permissions, with "Release apps to testing tracks" for the app.`;
-    }
-    return Object.assign(new Error(text), { status, playMessage: message });
-}
-
-// A caller of Play's API for one app, whose failures say what to do where they can.
-async function playCaller(appId, credentials) {
-    const token = await playToken(credentials);
-    return async (method, url, body) => {
-        const isBinary = Buffer.isBuffer(body);
-        const response = await fetch(url, {
-            method,
-            headers: { authorization: `Bearer ${token}`, 'content-type': isBinary ? 'application/octet-stream' : 'application/json' },
-            body: isBinary || body === undefined ? body : JSON.stringify(body),
-        });
-        const text = await response.text();
-        if (response.ok) return text ? JSON.parse(text) : {};
-        let message = text;
-        try {
-            message = JSON.parse(text).error?.message ?? text;
-        } catch {
-            // Not Google's JSON error, so the text is the message.
-        }
-        throw playError(response.status, message, method, url, appId, credentials);
-    };
-}
-
-// The highest versionCode Play has seen of an app, in its bundles, its APKs and its tracks' releases; 0 for none.
-export async function highestVersionCode(appId, credentials) {
-    const call = await playCaller(appId, credentials);
-    const edits = `${API}/${appId}/edits`;
-    const edit = await call('POST', edits, {});
-    try {
-        const { tracks = [] } = await call('GET', `${edits}/${edit.id}/tracks`);
-        const { bundles = [] } = await call('GET', `${edits}/${edit.id}/bundles`);
-        const { apks = [] } = await call('GET', `${edits}/${edit.id}/apks`);
-        const released = tracks.flatMap(({ releases = [] }) => releases.flatMap(({ versionCodes = [] }) => versionCodes));
-        return Math.max(0, ...[...bundles, ...apks].map(({ versionCode }) => versionCode), ...released.map(Number));
-    } finally {
-        await call('DELETE', `${edits}/${edit.id}`).catch(() => {});
-    }
-}
-
-// Uploads a bundle, with the zip of its native debug symbols if there is one, and releases it on a track, as status
-// says, in one edit. An app never released takes a draft alone, which its first rollout in Play Console makes live, so
-// its release becomes one.
-export async function uploadBundle(appId, credentials, { aab, symbols = null, track, status }) {
-    const call = await playCaller(appId, credentials);
-    const edits = `${API}/${appId}/edits`;
-    const edit = await call('POST', edits, {});
-    try {
-        const { versionCode } = await call('POST', `${UPLOAD}/${appId}/edits/${edit.id}/bundles?uploadType=media`, fs.readFileSync(aab));
-        if (symbols) {
-            await call('POST', `${UPLOAD}/${appId}/edits/${edit.id}/apks/${versionCode}/deobfuscationFiles/nativeCode?uploadType=media`, fs.readFileSync(symbols));
-        }
-        const release = async (releaseStatus) => {
-            await call('PUT', `${edits}/${edit.id}/tracks/${track}`, { track, releases: [{ versionCodes: [String(versionCode)], status: releaseStatus }] });
-            await call('POST', `${edits}/${edit.id}:commit`);
-            return { versionCode, status: releaseStatus };
-        };
-        try {
-            return await release(status);
-        } catch (error) {
-            if (status === 'draft' || !DRAFT_APP.test(error.playMessage ?? '')) throw error;
-            return await release('draft');
-        }
-    } catch (error) {
-        // An edit left open expires by itself; the first failure is the one to report.
-        await call('DELETE', `${edits}/${edit.id}`).catch(() => {});
-        throw error;
-    }
-}

package/src/actions/googleSignIn.js

@@ -1,78 +0,0 @@
-import http from 'node:http';
-import { createHash, randomBytes } from 'node:crypto';
-import openUrl from '../utils/openUrl.js';
-
-// crossbind's own OAuth client, a desktop app's. Google counts a desktop app's secret as public, as every copy of the app
-// carries it, and PKCE ties each sign-in to the crossbind that started it. The secret is split only so that secret
-// scanners do not take it for a leaked one.
-const CLIENT_ID = '1070398855248-kemr8k5u0k8l2ovuvql32e220fhap165.apps.googleusercontent.com';
-const CLIENT_SECRET = ['GOCSPX', '5w7qGQktYssQg9C5ClWs4x0hZeHV'].join('-');
-const AUTHORIZE = 'https://accounts.google.com/o/oauth2/v2/auth';
-const TOKEN = 'https://oauth2.googleapis.com/token';
-
-const randomText = (bytes) => randomBytes(bytes).toString('base64url');
-
-async function tokens(grant) {
-    const response = await fetch(TOKEN, { method: 'POST', body: new URLSearchParams({ client_id: CLIENT_ID, client_secret: CLIENT_SECRET, ...grant }) });
-    const body = await response.json().catch(() => ({}));
-    if (!response.ok) {
-        const reason = `${response.status} ${body.error ?? ''} ${body.error_description ?? ''}`.trim();
-        throw Object.assign(new Error(`crossbind: Google refused crossbind's sign-in: ${reason}`), { reason: body.error });
-    }
-    return body;
-}
-
-// The code Google's page sends the browser back to this machine with once the user has signed in. A request without this
-// sign-in's state is no answer of Google's to it, and is turned away.
-function codeFrom(server, state) {
-    return new Promise((resolve, reject) => {
-        server.on('request', (request, response) => {
-            const query = new URL(request.url, 'http://127.0.0.1').searchParams;
-            if (query.get('state') !== state) {
-                response.writeHead(400, { connection: 'close' }).end();
-                return;
-            }
-            const code = query.get('code');
-            response.writeHead(200, { 'content-type': 'text/plain; charset=utf-8', connection: 'close' })
-                .end(code ? 'crossbind is signed in. Close this tab and go back to the terminal.' : 'crossbind is not signed in. Go back to the terminal.');
-            if (code) resolve(code);
-            else reject(new Error(`crossbind: Google's sign-in ended with ${query.get('error') ?? 'no code'}.`));
-        });
-    });
-}
-
-// Signs the user in with their Google account, in their browser, for scope: Google's page sends the browser back to a
-// port of this machine. It resolves to Google's tokens, whose scope says what the user granted, as the page lets them
-// leave a scope out.
-export async function signIn(scope) {
-    const server = http.createServer();
-    await new Promise((resolve, reject) => {
-        server.once('error', reject);
-        server.listen(0, '127.0.0.1', resolve);
-    });
-    const verifier = randomText(32);
-    const state = randomText(16);
-    const redirect = `http://127.0.0.1:${server.address().port}`;
-    const page = `${AUTHORIZE}?${new URLSearchParams({
-        client_id: CLIENT_ID,
-        redirect_uri: redirect,
-        response_type: 'code',
-        scope,
-        code_challenge: createHash('sha256').update(verifier).digest('base64url'),
-        code_challenge_method: 'S256',
-        state,
-        prompt: 'select_account',
-    })}`;
-    console.log(`crossbind: opening Google's sign-in in your browser; if it does not open, go to ${page}`);
-    openUrl(page);
-    try {
-        const code = await codeFrom(server, state);
-        return await tokens({ grant_type: 'authorization_code', code, code_verifier: verifier, redirect_uri: redirect });
-    } finally {
-        server.close();
-    }
-}
-
-// An hour's access token for the refresh token of an earlier sign-in. Google refuses one revoked or expired, with the
-// reason invalid_grant.
-export const accessToken = async (refreshToken) => (await tokens({ grant_type: 'refresh_token', refresh_token: refreshToken })).access_token;

package/src/actions/playSetup.js

@@ -1,19 +0,0 @@
-import { PLAY_SCOPE, keepSignIn } from './googlePlay.js';
-import { signIn } from './googleSignIn.js';
-import { askYesNo } from '../utils/ask.js';
-
-// Signs the user in to Google Play with their Google account, in their browser, once they say yes to question, and keeps
-// the sign-in in the system's keychain for later publishes. Google's page lets the user leave Play's access out, so the
-// sign-in is asked for again until it has it, or is null once the user says no.
-export async function signInToPlay(question) {
-    let asked = question;
-    while (await askYesNo(asked)) {
-        const { refresh_token: refreshToken, scope = '' } = await signIn(PLAY_SCOPE);
-        if (scope.split(' ').includes(PLAY_SCOPE)) {
-            if (!keepSignIn(refreshToken)) console.log('crossbind: this machine has no keychain to keep the sign-in in, so the next publish signs in again.');
-            return { refreshToken };
-        }
-        asked = "The sign-in left Google Play's access out, its box on Google's page. Sign in again? [Y/n] ";
-    }
-    return null;
-}