@extension.dev/deploy 0.3.0 → 1.1.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 1.1.0
+
+- Chrome: service account authentication (`CHROME_SERVICE_ACCOUNT_JSON` /
+  `--chrome-service-account-json`, JSON key content or file path) as an
+  alternative to the OAuth client/secret/refresh-token trio. The service
+  account wins when both are set. Avoids the 7-day refresh-token expiry of
+  OAuth clients whose consent screen is in "Testing" status. Add the
+  account's email to your publisher in the dev console (Account section).
+
+## 1.0.0
+
+- BREAKING: Chrome Web Store API v2 only (`chromewebstore.googleapis.com`).
+  `CHROME_PUBLISHER_ID` is required; the v1.1 path, `publishTarget`, and the
+  trusted-testers target were removed (staged rollout via
+  `CHROME_DEPLOY_PERCENTAGE` replaces them).
+
+## 0.3.0
+
+- Chrome Web Store API v2 support, opt-in via `CHROME_PUBLISHER_ID`
+  (v1.1 fallback retained).
+
 ## 0.2.5
 
 Current release. Earlier history is tracked in the source monorepo; entries

package/README.md

@@ -78,14 +78,22 @@ Run `extension-deploy --help` for the full list of flags.
 | ---------------------------------- | --------------------------- | --------------------------------- |
 | `--chrome-zip <path>`              | `CHROME_ZIP`                | Path to the extension ZIP file    |
 | `--chrome-extension-id <id>`       | `CHROME_EXTENSION_ID`       | Chrome Web Store extension ID     |
+| `--chrome-publisher-id <uuid>`     | `CHROME_PUBLISHER_ID`       | Publisher UUID from the dev console (required) |
+| `--chrome-service-account-json <v>` | `CHROME_SERVICE_ACCOUNT_JSON` | Service account JSON key (content or file path); alternative to the OAuth trio below |
 | `--chrome-client-id <id>`          | `CHROME_CLIENT_ID`          | OAuth2 client ID                  |
 | `--chrome-client-secret <secret>`  | `CHROME_CLIENT_SECRET`      | OAuth2 client secret              |
 | `--chrome-refresh-token <token>`   | `CHROME_REFRESH_TOKEN`      | OAuth2 refresh token              |
-| `--chrome-publish-target <target>` | `CHROME_PUBLISH_TARGET`     | `"default"` or `"trustedTesters"` |
 | `--chrome-deploy-percentage <n>`   | `CHROME_DEPLOY_PERCENTAGE`  | Staged rollout percentage (1-100) |
 | `--chrome-review-exemption`        | `CHROME_REVIEW_EXEMPTION`   | Request expedited review          |
 | `--chrome-skip-submit-review`      | `CHROME_SKIP_SUBMIT_REVIEW` | Upload only, skip publish step    |
 
+Chrome accepts two credential shapes: a Google Cloud **service account** JSON key
+(recommended for CI; add the account's email to your publisher under
+dev console > Account, one per publisher) or the classic OAuth2
+client ID / client secret / refresh token trio. When both are set, the service
+account is used. Service accounts avoid the 7-day refresh-token expiry that
+affects OAuth clients whose consent screen is in "Testing" status.
+
 ### Firefox AMO
 
 | Flag                            | Env var                | Description                                |
@@ -156,7 +164,7 @@ const result = await deploy({
     clientId: "123.apps.googleusercontent.com",
     clientSecret: "GOCSPX-xxx",
     refreshToken: "1//0xxx",
-    publishTarget: "default",
+    publisherId: "00000000-0000-0000-0000-000000000000", // required
     deployPercentage: 10, // optional: staged rollout
   },
   firefox: {

package/dist/module.js

@@ -59,21 +59,28 @@ const external_zod_namespaceObject = require("zod");
 const chromeOptionsSchema = external_zod_namespaceObject.z.object({
     zip: external_zod_namespaceObject.z.string().min(1),
     extensionId: external_zod_namespaceObject.z.string().min(1).trim(),
-    clientId: external_zod_namespaceObject.z.string().min(1).trim(),
-    clientSecret: external_zod_namespaceObject.z.string().min(1).trim(),
-    refreshToken: external_zod_namespaceObject.z.string().min(1).trim(),
-    publishTarget: external_zod_namespaceObject.z["enum"]([
-        "default",
-        "trustedTesters"
-    ]).default("default"),
+    serviceAccountJson: external_zod_namespaceObject.z.string().trim().default(""),
+    clientId: external_zod_namespaceObject.z.string().trim().default(""),
+    clientSecret: external_zod_namespaceObject.z.string().trim().default(""),
+    refreshToken: external_zod_namespaceObject.z.string().trim().default(""),
+    publisherId: external_zod_namespaceObject.z.string().min(1).trim(),
     deployPercentage: external_zod_namespaceObject.z.number().int().min(1).max(100).optional(),
     reviewExemption: external_zod_namespaceObject.z.boolean().default(false),
-    skipSubmitReview: external_zod_namespaceObject.z.boolean().default(false),
-    publisherId: external_zod_namespaceObject.z.string().trim().optional(),
-    apiVersion: external_zod_namespaceObject.z["enum"]([
-        "v1.1",
-        "v2"
-    ]).optional()
+    skipSubmitReview: external_zod_namespaceObject.z.boolean().default(false)
+}).superRefine((val, ctx)=>{
+    if (val.serviceAccountJson) return;
+    const missing = [
+        "clientId",
+        "clientSecret",
+        "refreshToken"
+    ].filter((k)=>!val[k]);
+    for (const key of missing)ctx.addIssue({
+        code: external_zod_namespaceObject.z.ZodIssueCode.custom,
+        path: [
+            key
+        ],
+        message: "Required unless a service account key is provided (CHROME_SERVICE_ACCOUNT_JSON)."
+    });
 });
 const firefoxOptionsSchema = external_zod_namespaceObject.z.object({
     zip: external_zod_namespaceObject.z.string().min(1),
@@ -117,15 +124,14 @@ function resolveConfig(flags) {
         chrome: null == chromeZip ? void 0 : {
             zip: chromeZip,
             extensionId: flags.chromeExtensionId ?? envStr("CHROME_EXTENSION_ID") ?? "",
+            serviceAccountJson: flags.chromeServiceAccountJson ?? envStr("CHROME_SERVICE_ACCOUNT_JSON") ?? "",
             clientId: flags.chromeClientId ?? envStr("CHROME_CLIENT_ID") ?? "",
             clientSecret: flags.chromeClientSecret ?? envStr("CHROME_CLIENT_SECRET") ?? "",
             refreshToken: flags.chromeRefreshToken ?? envStr("CHROME_REFRESH_TOKEN") ?? "",
-            publishTarget: flags.chromePublishTarget ?? envStr("CHROME_PUBLISH_TARGET"),
+            publisherId: flags.chromePublisherId ?? envStr("CHROME_PUBLISHER_ID") ?? "",
             deployPercentage: flags.chromeDeployPercentage ?? envInt("CHROME_DEPLOY_PERCENTAGE"),
             reviewExemption: flags.chromeReviewExemption ?? envBool("CHROME_REVIEW_EXEMPTION"),
-            skipSubmitReview: flags.chromeSkipSubmitReview ?? envBool("CHROME_SKIP_SUBMIT_REVIEW"),
-            publisherId: flags.chromePublisherId ?? envStr("CHROME_PUBLISHER_ID"),
-            apiVersion: flags.chromeApiVersion ?? envStr("CHROME_API_VERSION")
+            skipSubmitReview: flags.chromeSkipSubmitReview ?? envBool("CHROME_SKIP_SUBMIT_REVIEW")
         },
         firefox: null == firefoxZip ? void 0 : {
             zip: firefoxZip,
@@ -149,10 +155,11 @@ function pathToEnvName(segments) {
 }
 const SETUP_HINTS = {
     CHROME_EXTENSION_ID: "Find this in the Chrome Web Store Developer Dashboard URL for your extension.",
+    CHROME_SERVICE_ACCOUNT_JSON: "Optional alternative to OAuth: a Google Cloud service account JSON key (content or file path), added to your publisher under dev console > Account.",
     CHROME_CLIENT_ID: "Create OAuth 2.0 credentials at https://console.cloud.google.com/apis/credentials",
     CHROME_CLIENT_SECRET: "Generated alongside the Client ID in the Google Cloud Console.",
     CHROME_REFRESH_TOKEN: "Obtain by completing the OAuth consent flow. See the Chrome Web Store API docs.",
-    CHROME_PUBLISHER_ID: "The publisher UUID from your Chrome Web Store dev console URL (chrome.google.com/webstore/devconsole/<UUID>). Required for the v2 API.",
+    CHROME_PUBLISHER_ID: "The publisher UUID from your Chrome Web Store dev console URL (chrome.google.com/webstore/devconsole/<UUID>).",
     CHROME_ZIP: "Path to the .zip file built for Chrome Web Store upload.",
     FIREFOX_EXTENSION_ID: "The addon GUID ({uuid} format) or email-style ID from your addon's AMO page.",
     FIREFOX_JWT_ISSUER: "API key from https://addons.mozilla.org/developers/addon/api/key/",
@@ -193,6 +200,8 @@ function envInt(name) {
     const val = process.env[name];
     return null == val ? void 0 : parseInt(val, 10);
 }
+const external_node_crypto_namespaceObject = require("node:crypto");
+var external_node_crypto_default = /*#__PURE__*/ __webpack_require__.n(external_node_crypto_namespaceObject);
 const promises_namespaceObject = require("node:fs/promises");
 var promises_default = /*#__PURE__*/ __webpack_require__.n(promises_namespaceObject);
 const DEFAULT_TIMEOUT_MS = 60000;
@@ -268,27 +277,64 @@ function logDryStep(scope, step, details) {
 const UPLOAD_TIMEOUT_MS = 120000;
 const PUBLISH_TIMEOUT_MS = 60000;
 const CWS_OAUTH_URL = "https://oauth2.googleapis.com/token";
-const CWS_UPLOAD_BASE = "https://www.googleapis.com/upload/chromewebstore/v1.1/items";
-const CWS_PUBLISH_BASE = "https://www.googleapis.com/chromewebstore/v1.1/items";
-const CWS_ITEMS_BASE = "https://www.googleapis.com/chromewebstore/v1.1/items";
 const CWS_V2_BASE = "https://chromewebstore.googleapis.com/v2";
 const CWS_V2_UPLOAD_BASE = "https://chromewebstore.googleapis.com/upload/v2";
-function resolveChromeApiVersion(opts) {
-    if ("v1.1" === opts.apiVersion || "v2" === opts.apiVersion) return opts.apiVersion;
-    return String(opts.publisherId || "").trim() ? "v2" : "v1.1";
-}
 function v2ItemName(publisherId, extensionId) {
     return `publishers/${encodeURIComponent(publisherId)}/items/${encodeURIComponent(extensionId)}`;
 }
 function requirePublisherId(publisherId, op) {
     const id = String(publisherId || "").trim();
-    if (!id) throw new Error(`Chrome ${op} on the v2 API needs a publisher ID (the UUID from your Chrome Web Store dev console URL).`);
+    if (!id) throw new Error(`Chrome ${op} needs a publisher ID (the UUID from your Chrome Web Store dev console URL).`);
     return id;
 }
 function chromeStoreUrl(extensionId) {
     return `https://chromewebstore.google.com/detail/${extensionId}`;
 }
-async function authenticate(clientId, clientSecret, refreshToken) {
+const CWS_SCOPE = "https://www.googleapis.com/auth/chromewebstore";
+async function resolveServiceAccountKey(value) {
+    const trimmed = value.trim();
+    const raw = trimmed.startsWith("{") ? trimmed : await promises_default().readFile(trimmed, "utf-8").catch(()=>{
+        throw new Error(`Chrome service account key: "${trimmed.slice(0, 80)}" is neither JSON nor a readable file path.`);
+    });
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    } catch  {
+        throw new Error("Chrome service account key is not valid JSON.");
+    }
+    if (!parsed.client_email || !parsed.private_key) throw new Error("Chrome service account key is missing client_email or private_key. Download the JSON key from the Google Cloud Console.");
+    return {
+        client_email: parsed.client_email,
+        private_key: parsed.private_key
+    };
+}
+async function authenticateServiceAccount(serviceAccountJson) {
+    const key = await resolveServiceAccountKey(serviceAccountJson);
+    const iat = Math.floor(Date.now() / 1000);
+    const encode = (obj)=>Buffer.from(JSON.stringify(obj)).toString("base64url");
+    const unsigned = `${encode({
+        alg: "RS256",
+        typ: "JWT"
+    })}.${encode({
+        iss: key.client_email,
+        scope: CWS_SCOPE,
+        aud: CWS_OAUTH_URL,
+        iat,
+        exp: iat + 3600
+    })}`;
+    const signature = external_node_crypto_default().createSign("RSA-SHA256").update(unsigned).sign(key.private_key).toString("base64url");
+    return fetchJson(CWS_OAUTH_URL, {
+        method: "POST",
+        body: new URLSearchParams({
+            grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+            assertion: `${unsigned}.${signature}`
+        }).toString(),
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded"
+        }
+    });
+}
+async function authenticateOauth(clientId, clientSecret, refreshToken) {
     return fetchJson(CWS_OAUTH_URL, {
         method: "POST",
         body: JSON.stringify({
@@ -303,27 +349,21 @@ async function authenticate(clientId, clientSecret, refreshToken) {
         }
     });
 }
-async function chrome_upload(extensionId, zipPath, token, ctx) {
+async function authenticate(creds) {
+    if (creds.serviceAccountJson) return authenticateServiceAccount(creds.serviceAccountJson);
+    if (creds.clientId && creds.clientSecret && creds.refreshToken) return authenticateOauth(creds.clientId, creds.clientSecret, creds.refreshToken);
+    throw new Error("Chrome credentials missing: provide a service account key (CHROME_SERVICE_ACCOUNT_JSON) or the OAuth client ID, client secret, and refresh token.");
+}
+async function chrome_upload(extensionId, publisherId, zipPath, token) {
     const body = await promises_default().readFile(zipPath);
-    let url;
-    let method;
-    const headers = {
-        Authorization: `${token.token_type} ${token.access_token}`,
-        "Content-Type": "application/zip"
-    };
-    if ("v2" === ctx.apiVersion) {
-        const pub = requirePublisherId(ctx.publisherId, "upload");
-        url = `${CWS_V2_UPLOAD_BASE}/${v2ItemName(pub, extensionId)}:upload`;
-        method = "POST";
-    } else {
-        url = `${CWS_UPLOAD_BASE}/${extensionId}`;
-        method = "PUT";
-        headers["x-goog-api-version"] = "2";
-    }
+    const url = `${CWS_V2_UPLOAD_BASE}/${v2ItemName(publisherId, extensionId)}:upload`;
     const res = await fetch(url, {
-        method,
+        method: "POST",
         body,
-        headers,
+        headers: {
+            Authorization: `${token.token_type} ${token.access_token}`,
+            "Content-Type": "application/zip"
+        },
         signal: AbortSignal.timeout(UPLOAD_TIMEOUT_MS)
     });
     if (!res.ok) {
@@ -332,44 +372,22 @@ async function chrome_upload(extensionId, zipPath, token, ctx) {
     }
 }
 async function publish(params) {
-    if ("v2" === params.apiVersion) {
-        const pub = requirePublisherId(params.publisherId, "publish");
-        if ("trustedTesters" === params.publishTarget) throw new Error("The Chrome v2 API has no trusted-tester publish target. Use staged publish, or keep this project on the v1.1 API for trusted-tester releases.");
-        const reqBody = {
-            publishType: "DEFAULT_PUBLISH"
-        };
-        if (null != params.deployPercentage) reqBody.deployInfos = [
-            {
-                deployPercentage: params.deployPercentage
-            }
-        ];
-        if (params.reviewExemption) reqBody.skipReview = true;
-        const res = await fetch(`${CWS_V2_BASE}/${v2ItemName(pub, params.extensionId)}:publish`, {
-            method: "POST",
-            headers: {
-                Authorization: `${params.token.token_type} ${params.token.access_token}`,
-                "Content-Type": "application/json"
-            },
-            body: JSON.stringify(reqBody),
-            signal: AbortSignal.timeout(PUBLISH_TIMEOUT_MS)
-        });
-        if (!res.ok) {
-            const text = await res.text().catch(()=>"");
-            throw new Error(`Chrome publish failed: ${res.status} ${res.statusText}\n${text}`);
+    const reqBody = {
+        publishType: "DEFAULT_PUBLISH"
+    };
+    if (null != params.deployPercentage) reqBody.deployInfos = [
+        {
+            deployPercentage: params.deployPercentage
         }
-        return;
-    }
-    const url = new URL(`${CWS_PUBLISH_BASE}/${params.extensionId}/publish`);
-    url.searchParams.set("publishTarget", params.publishTarget);
-    if (null != params.deployPercentage) url.searchParams.set("deployPercentage", String(params.deployPercentage));
-    if (null != params.reviewExemption) url.searchParams.set("reviewExemption", String(params.reviewExemption));
-    const res = await fetch(url.href, {
+    ];
+    if (params.reviewExemption) reqBody.skipReview = true;
+    const res = await fetch(`${CWS_V2_BASE}/${v2ItemName(params.publisherId, params.extensionId)}:publish`, {
         method: "POST",
         headers: {
             Authorization: `${params.token.token_type} ${params.token.access_token}`,
-            "x-goog-api-version": "2",
-            "Content-Length": "0"
+            "Content-Type": "application/json"
         },
+        body: JSON.stringify(reqBody),
         signal: AbortSignal.timeout(PUBLISH_TIMEOUT_MS)
     });
     if (!res.ok) {
@@ -380,9 +398,9 @@ async function publish(params) {
 async function publishChrome(options, dryRun) {
     await assertFilePresent(options.zip);
     const zipSize = await getFileSize(options.zip);
-    const apiVersion = resolveChromeApiVersion(options);
-    log("chrome", `Authenticating with Chrome Web Store (API ${apiVersion})`);
-    const token = await authenticate(options.clientId, options.clientSecret, options.refreshToken);
+    const publisherId = requirePublisherId(options.publisherId, "submit");
+    log("chrome", `Authenticating with Chrome Web Store (API v2, ${options.serviceAccountJson ? "service account" : "OAuth"})`);
+    const token = await authenticate(options);
     const outcome = {
         storeUrl: chromeStoreUrl(options.extensionId),
         submissionId: options.extensionId
@@ -390,17 +408,13 @@ async function publishChrome(options, dryRun) {
     if (dryRun) {
         logDryStep("chrome", "Authentication succeeded", {
             tokenType: token.token_type,
-            scope: "chromewebstore",
-            apiVersion
+            scope: "chromewebstore"
         });
         logDryStep("chrome", "Would upload ZIP", {
             file: options.zip,
-            size: formatBytes(zipSize),
-            apiVersion
+            size: formatBytes(zipSize)
         });
         options.skipSubmitReview ? logDryStep("chrome", "Would skip publish (skipSubmitReview=true)") : logDryStep("chrome", "Would publish for review", {
-            apiVersion,
-            publishTarget: options.publishTarget ?? "default",
             deployPercentage: options.deployPercentage,
             reviewExemption: options.reviewExemption
         });
@@ -408,10 +422,7 @@ async function publishChrome(options, dryRun) {
         return outcome;
     }
     log("chrome", `Uploading ZIP file (${formatBytes(zipSize)})`);
-    await chrome_upload(options.extensionId, options.zip, token, {
-        apiVersion,
-        publisherId: options.publisherId
-    });
+    await chrome_upload(options.extensionId, publisherId, options.zip, token);
     if (options.skipSubmitReview) {
         log("chrome", "Skipping publish step (skipSubmitReview=true)");
         return outcome;
@@ -419,77 +430,54 @@ async function publishChrome(options, dryRun) {
     log("chrome", "Publishing extension");
     await publish({
         extensionId: options.extensionId,
-        publishTarget: options.publishTarget,
+        publisherId,
         token,
         deployPercentage: options.deployPercentage,
-        reviewExemption: options.reviewExemption,
-        apiVersion,
-        publisherId: options.publisherId
+        reviewExemption: options.reviewExemption
     });
     return outcome;
 }
 async function getChromeItem(params) {
-    const token = await authenticate(params.clientId, params.clientSecret, params.refreshToken);
+    var _rev_distributionChannels_, _rev_distributionChannels;
+    const token = await authenticate(params);
     const auth = {
         Authorization: `${token.token_type} ${token.access_token}`
     };
-    const version = resolveChromeApiVersion(params);
-    if ("v2" === version) {
-        var _rev_distributionChannels_, _rev_distributionChannels;
-        const pub = requirePublisherId(params.publisherId, "status");
-        const status = await fetchJson(`${CWS_V2_BASE}/${v2ItemName(pub, params.extensionId)}:fetchStatus`, {
-            headers: auth
-        });
-        const rev = status.submittedItemRevisionStatus || status.publishedItemRevisionStatus;
-        return {
-            uploadState: status.lastAsyncUploadState,
-            crxVersion: null == rev ? void 0 : null == (_rev_distributionChannels = rev.distributionChannels) ? void 0 : null == (_rev_distributionChannels_ = _rev_distributionChannels[0]) ? void 0 : _rev_distributionChannels_.crxVersion,
-            publicKey: status.publicKey,
-            state: null == rev ? void 0 : rev.state
-        };
-    }
-    const url = `${CWS_ITEMS_BASE}/${encodeURIComponent(params.extensionId)}?projection=${params.projection ?? "DRAFT"}`;
-    return fetchJson(url, {
-        headers: {
-            ...auth,
-            "x-goog-api-version": "2"
-        }
+    const pub = requirePublisherId(params.publisherId, "status");
+    const status = await fetchJson(`${CWS_V2_BASE}/${v2ItemName(pub, params.extensionId)}:fetchStatus`, {
+        headers: auth
     });
+    const rev = status.submittedItemRevisionStatus || status.publishedItemRevisionStatus;
+    return {
+        uploadState: status.lastAsyncUploadState,
+        crxVersion: null == rev ? void 0 : null == (_rev_distributionChannels = rev.distributionChannels) ? void 0 : null == (_rev_distributionChannels_ = _rev_distributionChannels[0]) ? void 0 : _rev_distributionChannels_.crxVersion,
+        publicKey: status.publicKey,
+        state: null == rev ? void 0 : rev.state
+    };
 }
 async function verifyChromeCredentials(params) {
     let token;
     try {
-        token = await authenticate(params.clientId, params.clientSecret, params.refreshToken);
+        token = await authenticate(params);
     } catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
         return {
             ok: false,
-            message: `OAuth token exchange failed. Verify your Client ID, Client Secret, and Refresh Token are correct.\n${err instanceof Error ? err.message : err}`
+            message: params.serviceAccountJson ? `Service account token exchange failed. Verify the JSON key is intact and the account was added to your publisher (dev console > Account).\n${detail}` : `OAuth token exchange failed. Verify your Client ID, Client Secret, and Refresh Token are correct.\n${detail}`
         };
     }
     const auth = {
         Authorization: `${token.token_type} ${token.access_token}`
     };
-    const version = resolveChromeApiVersion(params);
     try {
-        if ("v2" === version) {
-            const pub = requirePublisherId(params.publisherId, "verify");
-            const status = await fetchJson(`${CWS_V2_BASE}/${v2ItemName(pub, params.extensionId)}:fetchStatus`, {
-                headers: auth
-            });
-            const rev = status.submittedItemRevisionStatus || status.publishedItemRevisionStatus;
-            return {
-                ok: true,
-                message: `Credentials verified (Chrome v2 API). Item state: ${(null == rev ? void 0 : rev.state) || "unknown"}.`
-            };
-        }
-        const item = await fetchJson(`${CWS_ITEMS_BASE}/${encodeURIComponent(params.extensionId)}?projection=DRAFT`, {
+        const pub = requirePublisherId(params.publisherId, "verify");
+        const status = await fetchJson(`${CWS_V2_BASE}/${v2ItemName(pub, params.extensionId)}:fetchStatus`, {
             headers: auth
         });
-        const title = (null == item ? void 0 : item.title) || params.extensionId;
+        const rev = status.submittedItemRevisionStatus || status.publishedItemRevisionStatus;
         return {
             ok: true,
-            message: `Credentials verified. You have access to "${title}".`,
-            extensionTitle: title
+            message: `Credentials verified (Chrome Web Store API v2). Item state: ${(null == rev ? void 0 : rev.state) || "unknown"}.`
         };
     } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -499,7 +487,7 @@ async function verifyChromeCredentials(params) {
         };
         if (msg.includes("403")) return {
             ok: false,
-            message: "v2" === version ? "Access denied. Check the publisher ID matches this extension's account, and that the extension ID is correct." : `Access denied to extension ${params.extensionId}. You may not be the owner or a developer on this item.`
+            message: params.serviceAccountJson ? "Access denied. Check the publisher ID, and that this service account's email was added to the publisher (dev console > Account)." : "Access denied. Check the publisher ID matches this extension's account, and that the extension ID is correct."
         };
         return {
             ok: false,
@@ -512,8 +500,6 @@ function delay(ms) {
         setTimeout(resolve, ms);
     });
 }
-const external_node_crypto_namespaceObject = require("node:crypto");
-var external_node_crypto_default = /*#__PURE__*/ __webpack_require__.n(external_node_crypto_namespaceObject);
 const AMO_BASE = "https://addons.mozilla.org/api/v5/addons";
 function signJwt(issuer, secret, expiresInSeconds = 30) {
     const header = {
@@ -989,10 +975,12 @@ GLOBAL
 CHROME
   --chrome-zip <path>               Path to Chrome extension ZIP
   --chrome-extension-id <id>        Chrome extension ID
+  --chrome-publisher-id <uuid>      Publisher UUID from the dev console (required)
+  --chrome-service-account-json <v> Service account JSON key content or file path
+                                    (alternative to the OAuth flags below)
   --chrome-client-id <id>           OAuth2 client ID
   --chrome-client-secret <secret>   OAuth2 client secret
   --chrome-refresh-token <token>    OAuth2 refresh token
-  --chrome-publish-target <target>  "default" or "trustedTesters"
   --chrome-deploy-percentage <n>    Staged rollout percentage (1-100)
   --chrome-review-exemption         Request expedited review
   --chrome-skip-submit-review       Upload only, skip publish
@@ -1257,11 +1245,13 @@ async function collectChromeCredentials(deps) {
     io.log("  2. OAuth 2.0 credentials (application type: Desktop app):");
     io.log("     https://console.cloud.google.com/apis/credentials");
     io.log("  3. Your extension ID from the Chrome Web Store Developer Dashboard.");
+    io.log("  4. Your publisher ID (the UUID in your dev console URL: chrome.google.com/webstore/devconsole/<UUID>).");
     io.log("");
     io.log("This wizard will take your Client ID + Secret and walk you through");
     io.log("generating a refresh token automatically.");
     io.log("");
     const extensionId = await requireValue(io, "Chrome extension ID", "(32-character ID from the CWS dashboard URL)");
+    const publisherId = await requireValue(io, "Chrome publisher ID", "(UUID from your dev console URL)");
     const clientId = await requireValue(io, "OAuth Client ID");
     const clientSecret = await requireValue(io, "OAuth Client Secret", void 0, {
         secret: true
@@ -1269,6 +1259,7 @@ async function collectChromeCredentials(deps) {
     const refreshToken = await obtainChromeRefreshToken(deps, clientId, clientSecret);
     return {
         extensionId,
+        publisherId,
         clientId,
         clientSecret,
         refreshToken
@@ -1400,7 +1391,7 @@ async function runInit(deps, options = {}) {
         io.log("");
         if ("chrome" === store) {
             const creds = await collectChromeCredentials(deps);
-            envLines.push(`CHROME_EXTENSION_ID=${creds.extensionId}`, `CHROME_CLIENT_ID=${creds.clientId}`, `CHROME_CLIENT_SECRET=${creds.clientSecret}`, `CHROME_REFRESH_TOKEN=${creds.refreshToken}`, "");
+            envLines.push(`CHROME_EXTENSION_ID=${creds.extensionId}`, `CHROME_PUBLISHER_ID=${creds.publisherId}`, `CHROME_CLIENT_ID=${creds.clientId}`, `CHROME_CLIENT_SECRET=${creds.clientSecret}`, `CHROME_REFRESH_TOKEN=${creds.refreshToken}`, "");
             if (!options.skipVerify) {
                 const verify = deps.verifyChrome ?? verifyChromeCredentials;
                 verified.chrome = normalizeVerify(await verify(creds));
@@ -1582,16 +1573,21 @@ async function runWatch(flags) {
     const timeoutMs = (flags.watchTimeout ?? 3600) * 1000;
     let terminal;
     try {
-        terminal = "chrome" === store ? await watchChromeSubmission({
-            clientId: mustEnv("CHROME_CLIENT_ID", flags.chromeClientId),
-            clientSecret: mustEnv("CHROME_CLIENT_SECRET", flags.chromeClientSecret),
-            refreshToken: mustEnv("CHROME_REFRESH_TOKEN", flags.chromeRefreshToken),
-            extensionId: mustEnv("CHROME_EXTENSION_ID", flags.chromeExtensionId)
-        }, {
-            pollIntervalMs,
-            timeoutMs,
-            onEvent
-        }) : "firefox" === store ? await watchFirefoxSubmission({
+        if ("chrome" === store) {
+            const serviceAccountJson = flags.chromeServiceAccountJson ?? process.env.CHROME_SERVICE_ACCOUNT_JSON;
+            terminal = await watchChromeSubmission({
+                serviceAccountJson,
+                clientId: serviceAccountJson ? flags.chromeClientId : mustEnv("CHROME_CLIENT_ID", flags.chromeClientId),
+                clientSecret: serviceAccountJson ? flags.chromeClientSecret : mustEnv("CHROME_CLIENT_SECRET", flags.chromeClientSecret),
+                refreshToken: serviceAccountJson ? flags.chromeRefreshToken : mustEnv("CHROME_REFRESH_TOKEN", flags.chromeRefreshToken),
+                extensionId: mustEnv("CHROME_EXTENSION_ID", flags.chromeExtensionId),
+                publisherId: mustEnv("CHROME_PUBLISHER_ID", flags.chromePublisherId)
+            }, {
+                pollIntervalMs,
+                timeoutMs,
+                onEvent
+            });
+        } else terminal = "firefox" === store ? await watchFirefoxSubmission({
             jwtIssuer: mustEnv("FIREFOX_JWT_ISSUER", flags.firefoxJwtIssuer),
             jwtSecret: mustEnv("FIREFOX_JWT_SECRET", flags.firefoxJwtSecret),
             extensionId: mustEnv("FIREFOX_EXTENSION_ID", flags.firefoxExtensionId),