looply-cli 0.5.14 → 0.5.18

package/dist/expo-release.js

@@ -0,0 +1,670 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nodeReleaseExec = exports.APP_RELEASES_FILE = exports.SUBMIT_TIMEOUT_MS = exports.EAS_TIMEOUT_MS = exports.RESOLVE_TIMEOUT_MS = exports.JEST_TIMEOUT_MS = exports.INSTALL_TIMEOUT_MS = exports.IOS_PROCESSING_MS = void 0;
+exports.fileAppReleaseStore = fileAppReleaseStore;
+exports.memoryAppReleaseStore = memoryAppReleaseStore;
+exports.lastJson = lastJson;
+exports.bumpVersion = bumpVersion;
+exports.realNodeModules = realNodeModules;
+exports.removeCheckout = removeCheckout;
+exports.planRelease = planRelease;
+exports.startRelease = startRelease;
+exports.followRelease = followRelease;
+exports.cleanup = cleanup;
+exports.easCliScript = easCliScript;
+exports.realEasRunner = realEasRunner;
+exports.dryRunEas = dryRunEas;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const core_1 = require("@looply/core");
+const expo_release_rules_1 = require("./expo-release-rules");
+const delivery_rules_1 = require("./delivery-rules");
+/** iOS: TestFlight processing after EAS's upload; Apple says nothing to EAS, so a window is waited out. */
+exports.IOS_PROCESSING_MS = 20 * 60_000;
+exports.INSTALL_TIMEOUT_MS = 30 * 60_000;
+exports.JEST_TIMEOUT_MS = 60 * 60_000;
+exports.RESOLVE_TIMEOUT_MS = 5 * 60_000;
+exports.EAS_TIMEOUT_MS = 15 * 60_000;
+exports.SUBMIT_TIMEOUT_MS = 45 * 60_000;
+// ─── local state: what is in flight, so a restart resumes instead of repeating ──
+exports.APP_RELEASES_FILE = 'app-releases.json';
+function fileAppReleaseStore(stateDir) {
+    const file = (0, node_path_1.join)(stateDir, exports.APP_RELEASES_FILE);
+    return {
+        read() {
+            try {
+                const raw = JSON.parse((0, node_fs_1.readFileSync)(file, 'utf8'));
+                return { releases: raw.releases ?? {}, lastReleasedSha: raw.lastReleasedSha ?? null, credentials: raw.credentials ?? {} };
+            }
+            catch {
+                return { releases: {}, lastReleasedSha: null, credentials: {} };
+            }
+        },
+        write(s) {
+            (0, node_fs_1.mkdirSync)(stateDir, { recursive: true });
+            const tmp = `${file}.${process.pid}.tmp`;
+            (0, node_fs_1.writeFileSync)(tmp, JSON.stringify(s, null, 2) + '\n', 'utf8');
+            (0, node_fs_1.renameSync)(tmp, file);
+        },
+    };
+}
+function memoryAppReleaseStore() {
+    let s = { releases: {}, lastReleasedSha: null, credentials: {} };
+    return { read: () => JSON.parse(JSON.stringify(s)), write: (n) => (s = JSON.parse(JSON.stringify(n))) };
+}
+// ─── helpers ────────────────────────────────────────────────────────────────
+const sentence = (s, n = 400) => {
+    const t = s.replace(/\s+/g, ' ').trim().slice(0, n);
+    return t === '' ? t : /[.!?…]$/.test(t) ? t : `${t}.`;
+};
+function readJson(path) {
+    try {
+        return JSON.parse((0, node_fs_1.readFileSync)(path, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** The last JSON value in a command's output (eas prints warnings around it). */
+function lastJson(stdout) {
+    const s = stdout.trim();
+    try {
+        return JSON.parse(s);
+    }
+    catch {
+        /* look for the last top-level array/object */
+    }
+    for (const open of ['[', '{']) {
+        for (let i = s.lastIndexOf(open); i >= 0; i = s.lastIndexOf(open, i - 1)) {
+            try {
+                return JSON.parse(s.slice(i));
+            }
+            catch {
+                /* keep looking */
+            }
+            if (i === 0)
+                break;
+        }
+    }
+    return null;
+}
+function bumpVersion(v, how) {
+    if (how === 'none')
+        return v;
+    const m = /^(\d+)\.(\d+)\.(\d+)(.*)$/.exec(v.trim());
+    if (m === null)
+        return v;
+    const [maj, min, pat] = [Number(m[1]), Number(m[2]), Number(m[3])];
+    return how === 'minor' ? `${maj}.${min + 1}.0` : `${maj}.${min}.${pat + 1}`;
+}
+/** node_modules is a real directory, not a symlink or a junction. */
+function realNodeModules(dir) {
+    const nm = (0, node_path_1.join)(dir, 'node_modules');
+    let st;
+    try {
+        st = (0, node_fs_1.lstatSync)(nm);
+    }
+    catch {
+        return 'there is no node_modules after the install';
+    }
+    if (st.isSymbolicLink())
+        return 'node_modules is a link (a junction moves the Expo fingerprint); the release needs a real copy';
+    if (!st.isDirectory())
+        return 'node_modules is not a directory';
+    return null;
+}
+/** Remove a clean checkout. Links at its top and in node_modules are unlinked first, so nothing they point at is touched. */
+function removeCheckout(dir) {
+    if (!(0, node_fs_1.existsSync)(dir))
+        return;
+    for (const p of [(0, node_path_1.join)(dir, 'node_modules'), ...safeList((0, node_path_1.join)(dir, 'node_modules')).map((n) => (0, node_path_1.join)(dir, 'node_modules', n))]) {
+        try {
+            if ((0, node_fs_1.lstatSync)(p).isSymbolicLink())
+                (0, node_fs_1.unlinkSync)(p);
+        }
+        catch {
+            /* gone already */
+        }
+    }
+    (0, node_fs_1.rmSync)(dir, { recursive: true, force: true, maxRetries: 3 });
+}
+function safeList(dir) {
+    try {
+        return (0, node_fs_1.readdirSync)(dir);
+    }
+    catch {
+        return [];
+    }
+}
+function installCommand(dir) {
+    if ((0, node_fs_1.existsSync)((0, node_path_1.join)(dir, 'package-lock.json')))
+        return { bin: 'npm', args: ['ci', '--no-audit', '--no-fund'] };
+    if ((0, node_fs_1.existsSync)((0, node_path_1.join)(dir, 'yarn.lock')))
+        return { bin: 'yarn', args: ['install', '--frozen-lockfile'] };
+    if ((0, node_fs_1.existsSync)((0, node_path_1.join)(dir, 'pnpm-lock.yaml')))
+        return { bin: 'pnpm', args: ['install', '--frozen-lockfile'] };
+    return null;
+}
+// ─── PLAN ───────────────────────────────────────────────────────────────────
+async function planRelease(deps, input) {
+    const s = input.settings;
+    const platforms = (0, core_1.platformsOf)(s);
+    const token = deps.expoToken();
+    const secrets = [token];
+    const say = (line) => deps.log((0, expo_release_rules_1.redact)(`app-release ${input.id} : ${line}`, secrets));
+    // The suite runs alone.
+    const busy = await deps.othersRunning();
+    if (busy !== null)
+        return { kind: 'wait', detail: `waiting to run the full test suite alone: ${busy}` };
+    // 1. origin's base branch, exactly.
+    let base = deps.baseBranch;
+    if (base === undefined) {
+        const head = await deps.git(['symbolic-ref', '--short', 'refs/remotes/origin/HEAD']);
+        base = head.code === 0 ? head.stdout.trim().replace(/^origin\//, '') : 'main';
+    }
+    const fetched = await deps.git(['fetch', '--quiet', 'origin', `refs/heads/${base}:refs/remotes/origin/${base}`]);
+    if (fetched.code !== 0)
+        return { kind: 'wait', detail: `could not fetch origin/${base}: ${sentence(fetched.stderr, 200)}` };
+    // A dry run may plan at another commit (`looply app-release plan --at`), to show a decision against an older release.
+    if (deps.at !== undefined && !deps.eas.dryRun)
+        return { kind: 'end', state: 'refused', detail: 'planning at another commit is for dry runs only' };
+    const rev = await deps.git(['rev-parse', deps.at ?? `refs/remotes/origin/${base}`]);
+    const sha = rev.stdout.trim();
+    if (rev.code !== 0 || !/^[0-9a-f]{40}$/.test(sha))
+        return { kind: 'end', state: 'failed', detail: `origin has no ${base} branch` };
+    const store = deps.store.read();
+    if (store.lastReleasedSha === sha) {
+        return { kind: 'end', state: 'nothing-to-release', detail: `origin/${base} is still at ${sha.slice(0, 7)}, which the last release already shipped` };
+    }
+    // 2. a clean checkout with a real node_modules.
+    const dir = (0, node_path_1.join)(deps.workRoot, `app-release-${input.id.replace(/[^A-Za-z0-9_-]/g, '').slice(0, 40)}`);
+    removeCheckout(dir);
+    await deps.git(['worktree', 'prune']);
+    (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(dir), { recursive: true });
+    const added = await deps.git(['worktree', 'add', '--detach', dir, sha]);
+    if (added.code !== 0)
+        return { kind: 'end', state: 'failed', detail: `could not make a clean checkout: ${sentence(added.stderr, 200)}` };
+    remember(deps, input.id, { checkoutDir: dir });
+    say(`clean checkout of ${deps.at === undefined ? `origin/${base}` : deps.at} (${sha.slice(0, 7)}) in ${dir}`);
+    if (deps.install === 'copy') {
+        const from = (0, node_path_1.join)(deps.repoDir, 'node_modules');
+        if (realNodeModules(deps.repoDir) !== null)
+            return { kind: 'end', state: 'failed', detail: 'the repository’s own node_modules is missing or linked, so it cannot be copied' };
+        const cp = await deps.exec(process.platform === 'win32' ? 'robocopy' : 'cp', process.platform === 'win32'
+            ? [from, (0, node_path_1.join)(dir, 'node_modules'), '/E', '/SL', '/NFL', '/NDL', '/NJH', '/NJS', '/NP', '/R:1', '/W:1']
+            : ['-a', from, (0, node_path_1.join)(dir, 'node_modules')], { cwd: dir, timeoutMs: exports.INSTALL_TIMEOUT_MS });
+        // robocopy: 0–7 are success codes.
+        if (process.platform === 'win32' ? cp.code > 7 : cp.code !== 0)
+            return { kind: 'end', state: 'failed', detail: `copying node_modules failed: ${sentence(cp.stderr || cp.stdout, 200)}` };
+    }
+    else {
+        const inst = installCommand(dir);
+        if (inst === null)
+            return { kind: 'end', state: 'failed', detail: 'the app has no lockfile (package-lock.json, yarn.lock or pnpm-lock.yaml) to install from' };
+        say(`${inst.bin} ${inst.args.join(' ')}`);
+        const r = await deps.exec(inst.bin, inst.args, { cwd: dir, timeoutMs: exports.INSTALL_TIMEOUT_MS });
+        if (r.code !== 0)
+            return { kind: 'end', state: 'failed', detail: `${inst.bin} ${inst.args[0]} failed: ${sentence((0, expo_release_rules_1.redact)(r.stderr || r.stdout, secrets).slice(-300), 300)}` };
+    }
+    const linked = realNodeModules(dir);
+    if (linked !== null)
+        return { kind: 'end', state: 'failed', detail: linked };
+    // 3. the full jest suite, alone.
+    const jestBin = (0, node_path_1.join)(dir, 'node_modules', 'jest', 'bin', 'jest.js');
+    if (!(0, node_fs_1.existsSync)(jestBin))
+        return { kind: 'end', state: 'refused', detail: 'the app has no jest; a release needs its full test suite to pass first' };
+    const busyAgain = await deps.othersRunning();
+    if (busyAgain !== null)
+        return { kind: 'wait', detail: `waiting to run the full test suite alone: ${busyAgain}` };
+    // Hold the machine while the suite runs, so no Looply run starts beside it.
+    const held = deps.reserve?.() ?? (() => undefined);
+    if (typeof held === 'string')
+        return { kind: 'wait', detail: `waiting to run the full test suite alone: ${held}` };
+    const out = (0, node_path_1.join)(dir, '.looply-jest-result.json');
+    const command = 'jest --ci (the full suite)';
+    say(command);
+    let jr;
+    try {
+        jr = await deps.exec(process.execPath, [jestBin, '--ci', '--json', `--outputFile=${out}`], { cwd: dir, env: { CI: '1' }, timeoutMs: exports.JEST_TIMEOUT_MS });
+    }
+    finally {
+        held();
+    }
+    const result = readJson(out);
+    const tests = { passed: result?.numPassedTests ?? 0, failed: result?.numFailedTests ?? 0, total: result?.numTotalTests ?? 0, command };
+    if (jr.code !== 0 || result === null || result.success !== true) {
+        const failing = (result?.testResults ?? []).filter((t) => t.status === 'failed').map((t) => (0, node_path_1.basename)(t.name ?? '?')).slice(0, 5);
+        return {
+            kind: 'end',
+            state: 'failed',
+            detail: result === null
+                ? `the test suite did not finish: ${sentence((0, expo_release_rules_1.redact)(jr.stderr, secrets).slice(-300), 300)}`
+                : `${tests.failed} of ${tests.total} tests failed${failing.length ? ` (${failing.join(', ')})` : ''}; nothing was released`,
+        };
+    }
+    say(`${tests.passed}/${tests.total} tests passed`);
+    // 4. the runtime version (the fingerprint) per platform, and a build that has it.
+    const eas = readJson((0, node_path_1.join)(dir, 'eas.json'));
+    if (eas === null)
+        return { kind: 'end', state: 'refused', detail: 'the app has no readable eas.json' };
+    const profile = (0, expo_release_rules_1.buildProfile)(eas, s.buildProfile);
+    if (profile === null)
+        return { kind: 'end', state: 'refused', detail: `eas.json has no build profile "${s.buildProfile}"` };
+    const appJson = readJson((0, node_path_1.join)(dir, 'app.json'));
+    const fingerprints = {};
+    const env = token ? { EXPO_TOKEN: token } : {};
+    const facts = (0, expo_release_rules_1.channelFacts)(eas, s.channel);
+    const ctx = argvContext(s, facts, false, eas);
+    for (const p of platforms) {
+        const hash = await runtimeVersion(deps, dir, p);
+        if (hash === null)
+            return { kind: 'end', state: 'failed', detail: `could not work out the ${p} runtime version (fingerprint)` };
+        let buildId = null;
+        const argv = (0, expo_release_rules_1.easBuildListArgv)({ platform: p, profile: s.buildProfile, runtimeVersion: hash });
+        const bad = (0, expo_release_rules_1.unsafeEasArgv)(argv, ctx);
+        if (bad !== null)
+            return { kind: 'end', state: 'refused', detail: bad };
+        if (token === null && !deps.eas.dryRun)
+            return { kind: 'end', state: 'failed', detail: 'there is no EXPO_TOKEN on this machine, so EAS cannot be asked which builds exist' };
+        const listed = await deps.eas.run(argv, { cwd: dir, env });
+        const builds = lastJson(listed.stdout);
+        if (listed.code === 0 && Array.isArray(builds) && builds.length > 0 && typeof builds[0]?.id === 'string')
+            buildId = builds[0].id;
+        fingerprints[p] = { hash, buildId };
+    }
+    // 5. the decision.
+    const unmatched = platforms.filter((p) => fingerprints[p]?.buildId === null);
+    let decision;
+    let reason;
+    if (unmatched.length === 0 && s.ota === 'allowed') {
+        decision = 'ota';
+        reason = `only JavaScript changed: every platform's fingerprint matches a finished ${s.buildProfile} build, so an OTA update to ${s.channel} reaches them`;
+    }
+    else {
+        decision = 'build';
+        reason = s.ota === 'builds-only'
+            ? 'this app is set to builds only'
+            : `native code changed: no finished ${s.buildProfile} build has the ${unmatched.join(' and ')} fingerprint, so a new store build is needed`;
+    }
+    const from = appJson?.expo?.version ?? '0.0.0';
+    const to = decision === 'build' ? bumpVersion(from, s.versionBump) : from;
+    if (decision === 'build' && !(0, expo_release_rules_1.remoteVersions)(eas) && appJson?.expo === undefined) {
+        return { kind: 'end', state: 'refused', detail: 'the build numbers live in the app config, and this app has no app.json to move them in' };
+    }
+    // 6. what it must not do, and who must say yes.
+    const submitName = s.submitProfile ?? s.buildProfile;
+    if (decision === 'build') {
+        const refusal = (0, expo_release_rules_1.submitProfileRefusal)(eas, submitName, platforms, s.android, deps.repoDir);
+        if (refusal !== null)
+            return { kind: 'end', state: 'refused', detail: refusal };
+    }
+    const originUrl = await deps.git(['remote', 'get-url', 'origin']);
+    const gh = originUrl.code === 0 ? (0, delivery_rules_1.githubRepoOf)(originUrl.stdout.trim()) : null;
+    const locked = (0, core_1.isApprovalLocked)({
+        repoNames: [(0, node_path_1.basename)(deps.repoDir), gh?.repo],
+        appIds: [appJson?.expo?.ios?.bundleIdentifier, appJson?.expo?.android?.package],
+    });
+    const reasons = (0, core_1.approvalReasons)({ settings: s, decision, locked, channel: facts });
+    const store2 = deps.store.read();
+    const credentials = {
+        expoToken: token ? 'connected' : 'missing',
+        appStoreConnect: s.ios ? store2.credentials.appStoreConnect ?? 'unknown' : 'not-needed',
+        playServiceAccount: s.android !== null ? store2.credentials.playServiceAccount ?? 'unknown' : 'not-needed',
+    };
+    const partial = { sha, decision, platforms, version: { from, to }, channel: s.channel };
+    const plan = {
+        ...partial,
+        base,
+        reason,
+        fingerprints,
+        tests,
+        notes: (0, core_1.releaseNotes)(input.tickets),
+        approvalReasons: reasons,
+        planKey: (0, core_1.planKeyOf)(partial),
+        credentials,
+        dryRun: deps.eas.dryRun,
+    };
+    remember(deps, input.id, { plan });
+    say(`plan: ${decision} (${reason})${reasons.length ? `; needs approval: ${reasons.join('; ')}` : ''}`);
+    return { kind: 'plan', plan };
+}
+async function runtimeVersion(deps, dir, p) {
+    const updates = (0, node_path_1.join)(dir, 'node_modules', 'expo-updates', 'bin', 'cli.js');
+    if ((0, node_fs_1.existsSync)(updates)) {
+        const r = await deps.exec(process.execPath, [updates, 'runtimeversion:resolve', '--platform', p], { cwd: dir, timeoutMs: exports.RESOLVE_TIMEOUT_MS });
+        const j = lastJson(r.stdout);
+        if (r.code === 0 && typeof j?.runtimeVersion === 'string' && j.runtimeVersion !== '')
+            return j.runtimeVersion;
+    }
+    const fp = (0, node_path_1.join)(dir, 'node_modules', '@expo', 'fingerprint', 'bin', 'cli.js');
+    if ((0, node_fs_1.existsSync)(fp)) {
+        const r = await deps.exec(process.execPath, [fp, 'fingerprint:generate', '--platform', p], { cwd: dir, timeoutMs: exports.RESOLVE_TIMEOUT_MS });
+        const j = lastJson(r.stdout);
+        if (r.code === 0 && typeof j?.hash === 'string')
+            return j.hash;
+    }
+    return null;
+}
+function argvContext(s, facts, approved, eas, submitAllowed = false) {
+    void eas;
+    return { channel: s.channel, channelFacts: facts, approved, buildProfile: s.buildProfile, submitProfile: s.submitProfile ?? s.buildProfile, submitAllowed };
+}
+function remember(deps, id, patch) {
+    const st = deps.store.read();
+    const cur = st.releases[id] ?? { id, checkoutDir: null, plan: null, platforms: [], branch: null, processingSince: {}, updatedAt: 0 };
+    const next = { ...cur, ...patch, updatedAt: deps.now() };
+    st.releases[id] = next;
+    deps.store.write(st);
+    return next;
+}
+// ─── RUN ────────────────────────────────────────────────────────────────────
+/**
+ * Start a planned release. `approved` is the server's word that the owner
+ * approved THIS plan; the rules re-check a production channel against it.
+ */
+async function startRelease(deps, input, plan, approved) {
+    const s = input.settings;
+    const token = deps.expoToken();
+    const secrets = [token];
+    const say = (line) => deps.log((0, expo_release_rules_1.redact)(`app-release ${input.id} : ${line}`, secrets));
+    if (plan.approvalReasons.length > 0 && !approved)
+        return { state: 'awaiting-approval', plan };
+    if (plan.dryRun || deps.eas.dryRun)
+        return { state: 'refused', plan, detail: 'dry run: nothing was published' };
+    if (token === null)
+        return { state: 'failed', plan, detail: 'there is no EXPO_TOKEN on this machine' };
+    const local = deps.store.read().releases[input.id];
+    const dir = local?.checkoutDir ?? null;
+    if (dir === null || !(0, node_fs_1.existsSync)(dir) || realNodeModules(dir) !== null)
+        return { state: 'planning', detail: 'the clean checkout is gone; planning again' };
+    // Still the commit that was planned (and approved)?
+    await deps.git(['fetch', '--quiet', 'origin', `refs/heads/${plan.base}:refs/remotes/origin/${plan.base}`]);
+    const now = (await deps.git(['rev-parse', `refs/remotes/origin/${plan.base}`])).stdout.trim();
+    if (now !== plan.sha)
+        return { state: 'planning', detail: `origin/${plan.base} moved on to ${now.slice(0, 7)} since the plan; planning again` };
+    const eas = readJson((0, node_path_1.join)(dir, 'eas.json'));
+    if (eas === null)
+        return { state: 'refused', plan, detail: 'eas.json is unreadable' };
+    const facts = (0, expo_release_rules_1.channelFacts)(eas, s.channel);
+    const submitName = s.submitProfile ?? s.buildProfile;
+    const submitAllowed = plan.decision === 'build' && (0, expo_release_rules_1.submitProfileRefusal)(eas, submitName, plan.platforms, s.android, deps.repoDir) === null;
+    const ctx = argvContext(s, facts, approved, eas, submitAllowed);
+    const env = { EXPO_TOKEN: token };
+    const run = async (argv, extraEnv = {}) => {
+        const bad = (0, expo_release_rules_1.unsafeEasArgv)(argv, ctx);
+        if (bad !== null)
+            return bad;
+        say(`eas ${argv.slice(0, 3).join(' ')} …`);
+        return deps.eas.run(argv, { cwd: dir, env: { ...extraEnv, ...env } });
+    };
+    if (plan.decision === 'ota') {
+        const appJson = readJson((0, node_path_1.join)(dir, 'app.json'));
+        const sdk = Number((readJson((0, node_path_1.join)(dir, 'node_modules', 'expo', 'package.json'))?.version ?? appJson?.expo?.sdkVersion ?? '').split('.')[0]);
+        const environment = Number.isFinite(sdk) && sdk >= 55 ? (0, expo_release_rules_1.buildProfile)(eas, s.buildProfile)?.environment ?? 'production' : undefined;
+        const r = await run((0, expo_release_rules_1.easUpdateArgv)({ channel: s.channel, platform: plan.platforms.length === 2 ? 'all' : plan.platforms[0], message: plan.notes, ...(environment ? { environment } : {}) }), 
+        // The build profile's variables (EXPO_PUBLIC_BACKEND_URL…): without them the bundle points elsewhere.
+        (0, expo_release_rules_1.buildProfile)(eas, s.buildProfile)?.env ?? {});
+        if (typeof r === 'string')
+            return { state: 'refused', plan, detail: r };
+        if (r.code !== 0)
+            return { state: 'failed', plan, detail: `eas update failed: ${sentence((0, expo_release_rules_1.redact)(r.stderr || r.stdout, secrets).slice(-300), 300)}` };
+        const ups = lastJson(r.stdout) ?? [];
+        const owner = appJson?.expo?.owner;
+        const slug = appJson?.expo?.slug;
+        const platforms = plan.platforms.map((p) => {
+            const u = ups.find((x) => x.platform === p) ?? ups[0];
+            const group = u?.group ?? null;
+            return {
+                platform: p,
+                kind: 'ota',
+                state: 'live',
+                channel: s.channel,
+                updateGroupId: group,
+                url: group && owner && slug ? `https://expo.dev/accounts/${owner}/projects/${slug}/updates/${group}` : null,
+            };
+        });
+        return finish(deps, input, plan, platforms);
+    }
+    // A build: the version moves on a release branch, then one build per platform.
+    const g = deps.gitAt(dir);
+    const branch = `looply/run-release-${plan.version.to.replace(/[^0-9A-Za-z.]/g, '')}-${deps.now().toString(36)}`;
+    const appPath = (0, node_path_1.join)(dir, 'app.json');
+    const appJson = readJson(appPath);
+    if (appJson?.expo !== undefined) {
+        appJson.expo.version = plan.version.to;
+        if (!(0, expo_release_rules_1.remoteVersions)(eas)) {
+            if (plan.platforms.includes('ios'))
+                appJson.expo.ios = { ...appJson.expo.ios, buildNumber: String((Number(appJson.expo.ios?.buildNumber ?? '0') || 0) + 1) };
+            if (plan.platforms.includes('android'))
+                appJson.expo.android = { ...appJson.expo.android, versionCode: (appJson.expo.android?.versionCode ?? 0) + 1 };
+        }
+        (0, node_fs_1.writeFileSync)(appPath, JSON.stringify(appJson, null, 2) + '\n', 'utf8');
+    }
+    await g(['switch', '-c', branch]);
+    const committed = await g(['-c', 'user.name=Looply', '-c', 'user.email=looply@users.noreply.github.com', 'commit', '-am', `Release ${plan.version.to}\n\n${plan.notes}`]);
+    if (committed.code !== 0 && plan.version.to !== plan.version.from)
+        return { state: 'failed', plan, detail: `could not commit the version bump: ${sentence(committed.stderr, 200)}` };
+    remember(deps, input.id, { branch });
+    const platforms = [];
+    for (const p of plan.platforms) {
+        const r = await run((0, expo_release_rules_1.easBuildArgv)({ platform: p, profile: s.buildProfile, message: `${input.title}: ${plan.version.to}` }));
+        if (typeof r === 'string')
+            return { state: 'refused', plan, detail: r };
+        const builds = lastJson(r.stdout);
+        const id = Array.isArray(builds) ? builds[0]?.id : undefined;
+        if (r.code !== 0 || typeof id !== 'string')
+            return { state: 'failed', plan, platforms, detail: `eas build (${p}) did not start: ${sentence((0, expo_release_rules_1.redact)(r.stderr || r.stdout, secrets).slice(-300), 300)}` };
+        platforms.push({ platform: p, kind: 'build', state: 'building', buildId: id, appVersion: plan.version.to, ...(p === 'android' ? { track: s.android } : {}) });
+    }
+    remember(deps, input.id, { platforms });
+    return { state: 'releasing', plan, platforms };
+}
+/** One step of following a build release: build → submit → processing → available. */
+async function followRelease(deps, input, plan) {
+    const s = input.settings;
+    const token = deps.expoToken();
+    const secrets = [token];
+    const local = deps.store.read().releases[input.id];
+    if (local === undefined || local.platforms.length === 0)
+        return { state: 'failed', plan, detail: 'this machine has no record of the builds it started (its state was lost); check EAS' };
+    const dir = local.checkoutDir ?? deps.repoDir;
+    const eas = readJson((0, node_path_1.join)(dir, 'eas.json')) ?? {};
+    const submitName = s.submitProfile ?? s.buildProfile;
+    const submitAllowed = (0, expo_release_rules_1.submitProfileRefusal)(eas, submitName, plan.platforms, s.android, deps.repoDir) === null;
+    const ctx = argvContext(s, (0, expo_release_rules_1.channelFacts)(eas, s.channel), false, eas, submitAllowed);
+    const env = token ? { EXPO_TOKEN: token } : {};
+    const platforms = local.platforms.map((p) => ({ ...p }));
+    const processing = { ...local.processingSince };
+    for (const p of platforms) {
+        if (p.kind !== 'build')
+            continue;
+        if (p.state === 'submitting') {
+            // A restart lost the submit's outcome: say so rather than upload twice.
+            p.state = 'failed';
+            p.detail = 'the submit was interrupted (the machine restarted); check it in EAS';
+            continue;
+        }
+        if (p.state === 'building' && p.buildId) {
+            const argv = (0, expo_release_rules_1.easBuildViewArgv)(p.buildId);
+            const bad = (0, expo_release_rules_1.unsafeEasArgv)(argv, ctx);
+            if (bad !== null)
+                return { state: 'refused', plan, platforms, detail: bad };
+            const r = await deps.eas.run(argv, { cwd: dir, env });
+            const b = lastJson(r.stdout);
+            const status = String(b?.status ?? '').toUpperCase();
+            if (status === 'ERRORED' || status === 'CANCELED') {
+                p.state = 'failed';
+                p.detail = sentence((0, expo_release_rules_1.redact)(b?.error?.message ?? `the build was ${status.toLowerCase()}`, secrets), 300);
+            }
+            else if (status === 'FINISHED') {
+                p.buildNumber = b?.appBuildVersion ?? p.buildNumber ?? null;
+                p.appVersion = b?.appVersion ?? p.appVersion ?? null;
+                p.url = `https://expo.dev/builds/${p.buildId}`;
+                p.state = 'submitting';
+                remember(deps, input.id, { platforms });
+                const sargv = (0, expo_release_rules_1.easSubmitArgv)({ platform: p.platform, profile: submitName, buildId: p.buildId, whatToTest: plan.notes, ...(s.testflightGroups ? { groups: s.testflightGroups } : {}) });
+                const sbad = (0, expo_release_rules_1.unsafeEasArgv)(sargv, ctx);
+                if (sbad !== null) {
+                    p.state = 'failed';
+                    p.detail = sbad;
+                    continue;
+                }
+                deps.log(`app-release ${input.id} : eas submit ${p.platform} ${p.buildId}`);
+                const sr = await deps.eas.run(sargv, { cwd: dir, env });
+                const cred = p.platform === 'ios' ? 'appStoreConnect' : 'playServiceAccount';
+                const st = deps.store.read();
+                if (sr.code === 0) {
+                    st.credentials[cred] = 'connected';
+                    deps.store.write(st);
+                    if (p.platform === 'ios') {
+                        p.state = 'processing';
+                        processing.ios = deps.now();
+                        p.detail = 'uploaded to App Store Connect; TestFlight is processing it';
+                    }
+                    else {
+                        p.state = 'available';
+                        p.detail = p.track === 'internal' ? null : 'Google may review it before testers on this track see it';
+                    }
+                }
+                else {
+                    const text = (0, expo_release_rules_1.redact)(`${sr.stderr}\n${sr.stdout}`, secrets);
+                    if (/credential|service account|api key|unauthori[sz]ed|forbidden|permission/i.test(text)) {
+                        st.credentials[cred] = 'missing';
+                        deps.store.write(st);
+                    }
+                    p.state = 'failed';
+                    p.detail = `eas submit (${p.platform}) failed: ${sentence(text.slice(-300), 300)}`;
+                }
+            }
+        }
+        if (p.state === 'processing' && p.platform === 'ios' && deps.now() - (processing.ios ?? deps.now()) >= exports.IOS_PROCESSING_MS) {
+            p.state = 'available';
+            p.detail = null;
+        }
+    }
+    remember(deps, input.id, { platforms, processingSince: processing });
+    if (platforms.some((p) => p.state === 'failed')) {
+        const why = platforms.filter((p) => p.state === 'failed').map((p) => `${p.platform}: ${p.detail ?? 'failed'}`).join('; ');
+        cleanup(deps, input.id);
+        return { state: 'failed', plan, platforms, detail: sentence(why, 580), testerLine: (0, core_1.testerLine)(platforms) };
+    }
+    if (platforms.every((p) => p.state === 'available'))
+        return finish(deps, input, plan, platforms);
+    return { state: 'releasing', plan, platforms, testerLine: (0, core_1.testerLine)(platforms) };
+}
+async function finish(deps, input, plan, platforms) {
+    const st = deps.store.read();
+    st.lastReleasedSha = plan.sha;
+    deps.store.write(st);
+    remember(deps, input.id, { platforms });
+    let detail = null;
+    const local = deps.store.read().releases[input.id];
+    if (local?.branch && deps.publishBranch && local.checkoutDir) {
+        const tip = (await deps.gitAt(local.checkoutDir)(['rev-parse', 'HEAD'])).stdout.trim();
+        try {
+            detail = await deps.publishBranch(local.branch, tip, `Release ${plan.version.to}`, `${plan.notes}\n\nThe version bump of the app release ${input.title}. Merge it so the next release starts from this version.`);
+        }
+        catch (e) {
+            detail = `the version bump branch was not pushed: ${e.message}`;
+        }
+    }
+    cleanup(deps, input.id);
+    return { state: 'live', plan, platforms, testerLine: (0, core_1.testerLine)(platforms), detail };
+}
+function cleanup(deps, id) {
+    const st = deps.store.read();
+    const r = st.releases[id];
+    if (r?.checkoutDir) {
+        try {
+            removeCheckout(r.checkoutDir);
+        }
+        catch (e) {
+            deps.log(`app-release ${id} : could not remove ${r.checkoutDir} (${e.message})`);
+        }
+        r.checkoutDir = null;
+        deps.store.write(st);
+        // The repository forgets the removed checkout too.
+        void deps.git?.(['worktree', 'prune']).catch(() => undefined);
+    }
+}
+// ─── real processes ─────────────────────────────────────────────────────────
+/** Spawn without a shell; on Windows `npm`/`yarn`/`pnpm` are .cmd files and go through cmd /c. Hidden windows. */
+const nodeReleaseExec = (bin, args, o) => new Promise((resolveP) => {
+    const win = process.platform === 'win32';
+    const viaCmd = win && ['npm', 'yarn', 'pnpm'].includes(bin);
+    const file = viaCmd ? (process.env['ComSpec'] ?? 'cmd.exe') : bin;
+    const argv = viaCmd ? ['/d', '/s', '/c', bin, ...args] : [...args];
+    let out = '';
+    let err = '';
+    let child;
+    try {
+        child = (0, node_child_process_1.spawn)(file, argv, { cwd: o.cwd, env: { ...process.env, ...(o.env ?? {}) }, stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
+    }
+    catch (e) {
+        resolveP({ code: -1, stdout: '', stderr: e.message });
+        return;
+    }
+    const cap = (s, d) => (s + d.toString('utf8')).slice(-400_000);
+    child.stdout?.on('data', (d) => (out = cap(out, d)));
+    child.stderr?.on('data', (d) => (err = cap(err, d)));
+    const timer = setTimeout(() => child.kill(), o.timeoutMs);
+    child.on('error', (e) => {
+        clearTimeout(timer);
+        resolveP({ code: -1, stdout: out, stderr: `${err}\n${e.message}` });
+    });
+    child.on('close', (code) => {
+        clearTimeout(timer);
+        resolveP({ code: code ?? -1, stdout: out, stderr: err });
+    });
+});
+exports.nodeReleaseExec = nodeReleaseExec;
+/** The installed eas-cli's entry script, run with this node (no shell, no PATH lookup in the repository). */
+function easCliScript(env = process.env) {
+    const own = env['LOOPLY_EAS_CLI'];
+    if (own && (0, node_fs_1.existsSync)(own))
+        return own;
+    const nodeDir = (0, node_path_1.dirname)(process.execPath);
+    for (const root of [(0, node_path_1.join)(nodeDir, 'node_modules'), (0, node_path_1.join)(nodeDir, '..', 'lib', 'node_modules'), env['APPDATA'] ? (0, node_path_1.join)(env['APPDATA'], 'npm', 'node_modules') : '']) {
+        if (!root)
+            continue;
+        const p = (0, node_path_1.join)(root, 'eas-cli', 'bin', 'run');
+        if ((0, node_fs_1.existsSync)(p))
+            return p;
+    }
+    return null;
+}
+function realEasRunner(exec = exports.nodeReleaseExec) {
+    return {
+        dryRun: false,
+        async run(argv, o) {
+            const script = easCliScript();
+            if (script === null)
+                return { code: -1, stdout: '', stderr: 'eas-cli is not installed on this machine (npm i -g eas-cli)' };
+            const timeoutMs = argv[0] === 'submit' ? exports.SUBMIT_TIMEOUT_MS : exports.EAS_TIMEOUT_MS;
+            return exec(process.execPath, [script, ...argv], { cwd: o.cwd, env: { ...o.env, CI: '1' }, timeoutMs });
+        },
+    };
+}
+/**
+ * THE DRY RUN'S EAS: records every argv it was asked to run and runs none of
+ * them. `builds` answers `build:list` (runtime version → build id), so a dry
+ * run can show both the OTA and the build decision.
+ */
+function dryRunEas(builds = {}) {
+    const calls = [];
+    return {
+        dryRun: true,
+        calls,
+        async run(argv) {
+            calls.push([...argv]);
+            if (argv[0] === 'build:list') {
+                const i = argv.indexOf('--runtime-version');
+                const id = i >= 0 ? builds[argv[i + 1] ?? ''] : undefined;
+                return { code: 0, stdout: JSON.stringify(id ? [{ id, status: 'FINISHED' }] : []), stderr: '' };
+            }
+            return { code: 0, stdout: '[]', stderr: 'dry run: not run' };
+        },
+    };
+}
+//# sourceMappingURL=expo-release.js.map