rosefc 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 rosefd
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/deploy/Dockerfile.node

@@ -0,0 +1,25 @@
+# The Node service: the dynamic half as a container. Builds the app, then
+# runs `rosefd serve` - the cluster runner (one worker per core, bounded
+# request bodies, request/header/keep-alive timeouts, graceful SIGTERM
+# drain, one access line per request on stdout). Pair it with
+# Dockerfile.static (the Go binary in front) using docker-compose.yml.
+FROM node:22-alpine AS build
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+FROM node:22-alpine
+WORKDIR /app
+ENV NODE_ENV=production PORT=3000
+COPY --from=build /app/node_modules ./node_modules
+COPY --from=build /app/dist ./dist
+COPY --from=build /app/src ./src
+COPY --from=build /app/package.json ./
+EXPOSE 3000
+# ROSEFD_WORKERS defaults to the container's CPU count.
+# The demo api's SQLite file lands in the working directory: mount a volume
+# at /app to keep it across deploys (a real deployment points the api at
+# Postgres instead - the connection block is the only thing that changes).
+CMD ["node", "node_modules/tsx/dist/cli.mjs", "src/cli/index.ts", "serve"]

package/deploy/Dockerfile.static

@@ -0,0 +1,34 @@
+# The static half of the hybrid deploy.
+#
+# Build the site with Node, embed it into ONE Go binary, ship an image with
+# no runtime to install and nothing to configure:
+#
+#   docker build -f deploy/Dockerfile.static -t rosefd-static .
+#   docker run -p 8080:8080 -e UPSTREAM=http://dynamic:3000 rosefd-static
+#
+# UPSTREAM is optional. Without it the binary is the pure-static deploy (it
+# answers 405 for POSTs and a JSON 404 for unbaked /api routes - the
+# documented boundary). With it, POST server actions and live /api handlers
+# are reverse-proxied to the Node/edge backend.
+FROM node:22-alpine AS site
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+# golang:alpine (not a pinned patch) tracks go.mod: the module declares the
+# minimum toolchain, and a stale pin is a build failure nobody needs.
+FROM golang:alpine AS bin
+WORKDIR /app
+COPY main.go go.mod ./
+COPY --from=site /app/dist ./dist
+RUN go build -trimpath -o rosefd-server .
+
+FROM alpine:3.20
+COPY --from=bin /app/rosefd-server /usr/local/bin/rosefd-server
+ENV PORT=8080
+EXPOSE 8080
+# The access log goes to stdout and errors to stderr, so `docker logs`
+# and any collector see them without mounting a file.
+ENTRYPOINT ["rosefd-server"]

package/deploy/api/rosefd.ts

@@ -0,0 +1,19 @@
+/**
+ * Vercel function entry: the edge adapter, unchanged.
+ *
+ * vercel.json rewrites every unmatched path here and ships dist/ with the
+ * bundle (the adapter imports dist/server.js at runtime, so the function
+ * cannot start without it). The handler is createEdgeHandler's returned
+ * (request) => Response, exposed behind Vercel's Web Standard signature.
+ *
+ * The dist path goes through fileURLToPath, NOT URL.pathname: on Windows a
+ * pathname carries the drive as `/C:/...` and the leading slash makes the
+ * dynamic import resolve against the drive root instead of this directory.
+ */
+import { fileURLToPath } from 'node:url';
+import { createEdgeHandler } from '../src/cli/edge.ts';
+
+const dist = fileURLToPath(new URL('../dist/', import.meta.url));
+const handle = await createEdgeHandler(dist);
+
+export default { fetch: handle };

package/deploy/cloudflare/functions/[[path]].ts

@@ -0,0 +1,59 @@
+/**
+ * The rosefd Cloudflare Pages function - the dynamic half of a Pages
+ * deploy.
+ *
+ * Pages answers static assets (everything in dist/: prerendered
+ * documents, bundles, baked API bodies) from its own asset server and
+ * invokes this function only for the paths that are NOT files. So the
+ * split is the same as on every other target - the static half never
+ * pays a function invocation, and the dynamic half (dynamic routes, live
+ * /api routes, POST server actions) renders here, one request per page.
+ *
+ * The `[[path]]` filename is Pages' catch-all: this file handles every
+ * incoming URL the asset layer did not answer.
+ *
+ * workerd has NO filesystem, which is the one real difference from the
+ * Node targets: the adapter cannot read dist/ at boot. Two things close
+ * that gap, both visible below:
+ *
+ *   1. `import * as server from '../../dist/server.js'` - a STATIC import,
+ *      so Pages' deploy-time compiler bundles the server module into the
+ *      function. (The generated bundle has zero Node built-in imports, so
+ *      it runs on workerd as-is.)
+ *   2. the client bundle, the component styles and the broken-route
+ *      manifest are fetched from this very site once per isolate - they
+ *      are static assets of the same deployment, and the function only
+ *      ever sees non-asset paths, so the fetch cannot re-enter it.
+ *
+ * The CSP is then computed from the exact fetched bytes, identical to what
+ * the Node server hashes: same documents, same headers, every target.
+ *
+ * Install: copy this file to <project>/functions/[[path]].ts and
+ * deploy/cloudflare/wrangler.toml to <project>/wrangler.toml, then
+ * `npx wrangler pages deploy` (or push, with the Pages git integration).
+ * In a project that depends on the published package the import below
+ * becomes:
+ *   import { createEdgeHandler } from 'rosefd/edge';
+ */
+import { createEdgeHandler } from '../src/cli/edge.ts';
+import * as server from '../dist/server.js';
+
+let handle: ((request: Request) => Promise<Response>) | null = null;
+
+export const onRequest = async (context: { request: Request }): Promise<Response> => {
+  if (!handle) {
+    const base = new URL(context.request.url);
+    const [client, styles, broken] = await Promise.all([
+      fetch(new URL('/client.js', base)).then((r) => r.text()),
+      fetch(new URL('/styles.css', base)).then((r) => (r.ok ? r.text() : '')),
+      fetch(new URL('/broken.json', base)).then((r) => (r.ok ? r.json() : [])),
+    ]);
+    handle = await createEdgeHandler('./dist', {
+      server,
+      client,
+      styles,
+      broken: broken as string[],
+    });
+  }
+  return handle(context.request);
+};

package/deploy/cloudflare/wrangler.toml

@@ -0,0 +1,14 @@
+# Cloudflare Pages - rosefd. `pages_build_output_dir` makes this file the
+# source of truth for the project, so it lives in the repo next to the app.
+name = "rosefd"
+pages_build_output_dir = "./dist"
+
+# The build writes dist/ exactly like every other target; Pages then serves
+# it as static assets and deploys ./functions alongside it.
+[build]
+command = "npm run build"
+
+# workerd has no Node filesystem: the function imports the adapter, which
+# imports node:url / node:path. nodejs_compat provides both.
+compatibility_date = "2024-09-23"
+compatibility_flags = ["nodejs_compat"]

package/deploy/docker-compose.yml

@@ -0,0 +1,45 @@
+# The hybrid deploy:
+# one command - `docker compose -f deploy/docker-compose.yml up --build`.
+#
+#   static  -> the immutable half: the Go single binary serves prerendered
+#              documents, build-precompressed brotli, ETag 304s and the SPA
+#              fallback, logs one access line per request to stdout and
+#              answers /metrics (Prometheus text format).
+#   dynamic -> the live half: server actions, /api handlers, middleware,
+#              $data - the Node server, same code, same compiler output.
+#
+# Every request the static half cannot answer itself (any POST, any /api
+# route without a baked body) is reverse-proxied to `dynamic` via UPSTREAM.
+# Drop the UPSTREAM line and the static service becomes the pure-static
+# deploy: POSTs answer 405, unbaked APIs answer the JSON 404.
+services:
+  static:
+    build:
+      context: ..
+      dockerfile: deploy/Dockerfile.static
+    environment:
+      PORT: "8080"
+      UPSTREAM: http://dynamic:3000
+    ports:
+      - "8080:8080"
+    depends_on:
+      dynamic:
+        condition: service_healthy
+    restart: unless-stopped
+  dynamic:
+    image: node:22-alpine
+    working_dir: /app
+    # Build inside the container: the host's node_modules may hold
+    # foreign-platform binaries (esbuild ships one per OS).
+    command: sh -c "npm ci && npm run build && npm run preview"
+    environment:
+      PORT: "3000"
+    volumes:
+      - ..:/app
+      - /app/node_modules
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:' + (process.env.PORT || 3000) + '/').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+    restart: unless-stopped

package/deploy/fly.toml

@@ -0,0 +1,28 @@
+# Fly.io: the rosefd Node service as a machine.
+#
+#   cp deploy/fly.toml ./fly.toml
+#   fly launch --no-deploy
+#   fly deploy
+#
+# The app builds deploy/Dockerfile.node (Node builds the site, then runs
+# `rosefd serve` - the cluster runner). Swap the dockerfile line for
+# "deploy/Dockerfile.static" to ship the Go single binary instead, and set
+# UPSTREAM to the Node app for the dynamic half.
+app = "rosefd"
+primary_region = "iad"
+
+[build]
+  dockerfile = "deploy/Dockerfile.node"
+
+[http_service]
+  internal_port = 3000
+  force_https = true
+  # rosefd serve already clusters across every core of the machine; give it
+  # the cores instead of paying for more, smaller machines.
+  auto_stop_machines = "suspend"
+  auto_start_machines = true
+  min_machines_running = 1
+
+[[vm]]
+  size = "shared-cpu-2x"
+  memory = "512mb"

package/deploy/k8s/rosefd.yaml

@@ -0,0 +1,128 @@
+# The hybrid deploy on Kubernetes - the same split
+# `docker-compose.yml` runs, as manifests:
+#
+#   static  -> the immutable half: the Go single binary serves prerendered
+#              documents, build-precompressed brotli, ETag 304s and the SPA
+#              fallback, logs one access line per request and answers
+#              /metrics (Prometheus text format).
+#   dynamic -> the live half: server actions, /api handlers, middleware,
+#              $data - the Node server, same code, same compiler output.
+#
+# Every request the static half cannot answer itself (any POST, any /api
+# route without a baked body) is reverse-proxied to `dynamic` through
+# UPSTREAM, which is the in-cluster DNS name of the Service below. Delete the
+# UPSTREAM env and the static Deployment becomes the pure-static deploy:
+# POSTs answer 405, unbaked APIs answer the JSON 404.
+#
+#   kubectl apply -f deploy/k8s/rosefd.yaml
+#
+# Build the two images first (from the repo root):
+#   docker build -f deploy/Dockerfile.static -t rosefd-static .
+#   docker build -f deploy/Dockerfile.node    -t rosefd .
+# ...then push them to your registry and replace the image names below.
+# The Ingress is optional: delete it and port-forward the static Service.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rosefd-static
+  labels: { app: rosefd, tier: static }
+spec:
+  replicas: 2
+  selector:
+    matchLabels: { app: rosefd, tier: static }
+  template:
+    metadata:
+      labels: { app: rosefd, tier: static }
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/path: /metrics
+        prometheus.io/port: "8080"
+    spec:
+      containers:
+        - name: static
+          image: rosefd-static:latest
+          env:
+            - name: PORT
+              value: "8080"
+            - name: UPSTREAM
+              value: http://rosefd-dynamic:3000
+          ports:
+            - name: http
+              containerPort: 8080
+          readinessProbe:
+            httpGet: { path: /, port: http }
+          resources:
+            requests: { cpu: 50m, memory: 32Mi }
+            limits: { memory: 64Mi }
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: rosefd-static
+spec:
+  selector: { app: rosefd, tier: static }
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rosefd-dynamic
+  labels: { app: rosefd, tier: dynamic }
+spec:
+  replicas: 2
+  selector:
+    matchLabels: { app: rosefd, tier: dynamic }
+  template:
+    metadata:
+      labels: { app: rosefd, tier: dynamic }
+    spec:
+      containers:
+        - name: dynamic
+          image: rosefd:latest
+          # `rosefd serve` is the production runner: the stdlib cluster (one
+          # worker per core), bounded bodies, timeouts, graceful drain.
+          command: ["rosefd", "serve"]
+          env:
+            - name: PORT
+              value: "3000"
+          ports:
+            - name: http
+              containerPort: 3000
+          readinessProbe:
+            httpGet: { path: /, port: http }
+          resources:
+            requests: { cpu: 100m, memory: 128Mi }
+            limits: { memory: 512Mi }
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: rosefd-dynamic
+spec:
+  # ClusterIP on purpose: the dynamic half is reached through the static
+  # half's UPSTREAM proxy, never directly.
+  type: ClusterIP
+  selector: { app: rosefd, tier: dynamic }
+  ports:
+    - name: http
+      port: 3000
+      targetPort: http
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: rosefd
+spec:
+  rules:
+    - http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: rosefd-static
+                port:
+                  number: 80

package/deploy/native/RosefdApp.xcscheme

@@ -0,0 +1,87 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Rosefd - the shared scheme for the generated Xcode project.
+
+  `rosefd export xcode` copies this to
+  RosefdApp.xcodeproj/xcshareddata/xcschemes/RosefdApp.xcscheme and substitutes
+  __ROSEFD_TARGET_ID__ with the pbxproj's own target id. `xcodebuild archive`
+  requires a scheme, and Xcode only auto-creates one when the project is opened
+  in the IDE - which a CI runner never does.
+-->
+<Scheme
+   LastUpgradeVersion = "1500"
+   version = "1.7">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "__ROSEFD_TARGET_ID__"
+               BuildableName = "RosefdApp.app"
+               BlueprintName = "RosefdApp"
+               ReferencedContainer = "container:RosefdApp.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES">
+      <Testables>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "__ROSEFD_TARGET_ID__"
+            BuildableName = "RosefdApp.app"
+            BlueprintName = "RosefdApp"
+            ReferencedContainer = "container:RosefdApp.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "__ROSEFD_TARGET_ID__"
+            BuildableName = "RosefdApp.app"
+            BlueprintName = "RosefdApp"
+            ReferencedContainer = "container:RosefdApp.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

package/deploy/native/android.yml

@@ -0,0 +1,62 @@
+# Rosefd - Android release build (GitHub Actions).
+#
+# `rosefd export android` copies this file into the export tree as
+# .github/workflows/android.yml, at the root of the exported Gradle project,
+# so every path below is the project's own.
+#
+# No credential is written into this file. A signed build reads its keystore
+# material from `${{ secrets.NAME }}` - see DEPLOY.md, the manual step.
+
+name: Android
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  apk:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      # The export carries no Gradle wrapper (gradlew is a binary the emitter
+      # does not generate), so this action installs and caches Gradle itself.
+      - uses: gradle/actions/setup-gradle@v4
+        with:
+          gradle-version: '8.7'
+
+      # Unsigned until the signing config in DEPLOY.md is in place - the
+      # resulting APK still installs with `adb install`.
+      - name: gradle assembleRelease
+        run: gradle assembleRelease
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: rosefd-android-release
+          path: app/build/outputs/apk/release/*.apk
+          if-no-files-found: error
+
+# Signed release: add the four repository secrets below, then decode the
+# keystore before the build and add the `signingConfigs.release` block that
+# reads keystore.properties (DEPLOY.md shows both).
+#
+#     env:
+#       ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+#       ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+#       ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+#       ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+#
+#     steps:
+#       - name: Decode the release keystore
+#         run: |
+#           echo "$ANDROID_KEYSTORE_BASE64" | base64 -d > release.keystore
+#           printf 'storeFile=release.keystore\nstorePassword=%s\nkeyAlias=%s\nkeyPassword=%s\n' \
+#             "$ANDROID_KEYSTORE_PASSWORD" "$ANDROID_KEY_ALIAS" "$ANDROID_KEY_PASSWORD" > keystore.properties

package/deploy/native/flutter.yml

@@ -0,0 +1,96 @@
+# Rosefd - Flutter build (GitHub Actions): APK + unsigned iOS app.
+#
+# `rosefd export flutter` copies this file into the export tree as
+# .github/workflows/flutter.yml, at the root of the exported Flutter project,
+# so every path below is the project's own.
+#
+# No credential is written into this file. A signed build reads its keystore
+# or certificate from `${{ secrets.NAME }}` - see DEPLOY.md.
+
+name: Flutter
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  apk:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - uses: subosito/flutter-action@v2
+        with:
+          channel: stable
+          cache: true
+
+      - run: flutter pub get
+
+      # The export ships `lib/` and `pubspec.yaml` but no platform folders
+      # (the emitter generates none). `flutter create` fills in android/ and
+      # ios/ without touching the generated Dart - `--overwrite` is what would
+      # clobber it, so it is deliberately absent. --org matters: with no
+      # ios/Runner or android/app on disk, `flutter create` cannot infer one.
+      - name: Scaffold the platform folders
+        run: flutter create --platforms=android,ios --org dev.rosefd --project-name rosefd_app .
+
+      # Flutter falls back to the debug key until a release keystore is
+      # configured, so this APK builds and installs without one - signing it is
+      # the manual step (see DEPLOY.md).
+      - name: flutter build apk
+        run: flutter build apk --release
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: rosefd-flutter-apk
+          path: build/app/outputs/flutter-apk/app-release.apk
+          if-no-files-found: error
+
+  ios:
+    runs-on: macos-14
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: subosito/flutter-action@v2
+        with:
+          channel: stable
+          cache: true
+
+      - run: flutter pub get
+
+      - name: Scaffold the platform folders
+        run: flutter create --platforms=android,ios --project-name rosefd_app .
+
+      # `flutter build ipa` needs a signed Xcode project, and the export ships
+      # no signing setup. Until a certificate exists, build the device app
+      # bundle without codesign, then package it as an .ipa by hand -
+      # Payload/Runner.app is the whole format.
+      - name: flutter build ios (unsigned)
+        run: flutter build ios --release --no-codesign
+
+      - name: Package an unsigned ipa
+        run: |
+          mkdir -p build/ipa/Payload
+          cp -R build/ios/iphoneos/Runner.app build/ipa/Payload/
+          cd build/ipa && zip -qry RosefdApp-unsigned.ipa Payload
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: rosefd-flutter-ipa
+          path: build/ipa/RosefdApp-unsigned.ipa
+          if-no-files-found: error
+
+# Signed builds: add the secrets named in DEPLOY.md, then
+#   - Android: write android/key.properties from
+#     `${{ secrets.ANDROID_KEYSTORE_BASE64 }}` (base64 -d) et al.
+#   - iOS: import `${{ secrets.IOS_CERT_P12_BASE64 }}` into a temporary
+#     keychain and replace the two steps above with `flutter build ipa --release`.