@geekmidas/cli 10.0.0-alpha.12 → 10.0.0-alpha.121

package/dist/googlePlay-BVcfFWRO.cjs

@@ -0,0 +1,931 @@
+const require_errors = require("./errors-DMC4Umsb.cjs");
+const require_run = require("./run-fVZ-rLnc.cjs");
+const require_config = require("./config.cjs");
+const require_index = require("./index.cjs");
+const require_stage = require("./stage-DEQJGW3r.cjs");
+const require_eas = require("./eas-CNi16SoO.cjs");
+let node_path = require("node:path");
+let node_fs = require("node:fs");
+let node_fs_promises = require("node:fs/promises");
+let node_child_process = require("node:child_process");
+let node_crypto = require("node:crypto");
+//#region src/mobile/googlePlay/easApi.ts
+/**
+* EAS, as `gkm deploy:google-play` reaches it: the GraphQL API eas-cli itself
+* calls, with an `EXPO_TOKEN` — to upload a Google service account key and
+* assign it to the app's Android credentials for EAS Submit, which is what
+* `eas credentials` does interactively.
+*
+* The documents are eas-cli's own (24.x), each selecting only what gkm reads:
+* eas-cli's credentials fragment also brings back the app's keystore and its
+* passwords, which gkm has no reason to hold.
+*/
+const EAS_GRAPHQL = "https://api.expo.dev/graphql";
+/** No `EXPO_TOKEN` to call EAS with. */
+var ExpoTokenMissing = class extends require_errors.GkmError {
+	constructor() {
+		super("gkm uploads the key to EAS with an access token, and EXPO_TOKEN is not set. Create one at https://expo.dev/settings/access-tokens and export it as EXPO_TOKEN.");
+		this.name = "ExpoTokenMissing";
+	}
+};
+/** EAS refused a call. */
+var EasApiError = class extends require_errors.GkmError {
+	operation;
+	detail;
+	constructor(operation, detail) {
+		super(`EAS refused ${operation}: ${detail}`);
+		this.operation = operation;
+		this.detail = detail;
+		this.name = "EasApiError";
+	}
+};
+const KEY_FIELDS = "id clientEmail privateKeyIdentifier";
+function easApi(token = process.env.EXPO_TOKEN, endpoint = EAS_GRAPHQL) {
+	const call = async (operation, query, variables) => {
+		if (!token) throw new ExpoTokenMissing();
+		const response = await fetch(endpoint, {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${token}`,
+				"content-type": "application/json"
+			},
+			body: JSON.stringify({
+				query,
+				variables,
+				operationName: operation
+			})
+		});
+		const body = await response.json().catch(() => ({}));
+		if (!response.ok || body.errors?.length || !body.data) throw new EasApiError(operation, body.errors?.map((error) => error.message).join("; ") || `HTTP ${response.status}`);
+		return body.data;
+	};
+	const credentialsFields = `id googleServiceAccountKeyForSubmissions { ${KEY_FIELDS} }`;
+	const asCredentials = (credentials) => ({
+		id: credentials.id,
+		...credentials.googleServiceAccountKeyForSubmissions ? { submissionsKey: credentials.googleServiceAccountKeyForSubmissions } : {}
+	});
+	return {
+		async project(projectId) {
+			const app = (await call("AppByIdQuery", `query AppByIdQuery($appId: String!) {
+  app { byId(appId: $appId) { id fullName ownerAccount { id name } } }
+}`, { appId: projectId })).app.byId;
+			return {
+				accountId: app.ownerAccount.id,
+				accountName: app.ownerAccount.name,
+				fullName: app.fullName
+			};
+		},
+		async androidCredentials(project, packageName) {
+			const existing = (await call("AndroidAppCredentialsByApplicationIdentifierQuery", `query AndroidAppCredentialsByApplicationIdentifierQuery(
+  $projectFullName: String!
+  $applicationIdentifier: String
+  $legacyOnly: Boolean
+) {
+  app {
+    byFullName(fullName: $projectFullName) {
+      id
+      androidAppCredentials(
+        filter: { applicationIdentifier: $applicationIdentifier, legacyOnly: $legacyOnly }
+      ) { ${credentialsFields} }
+    }
+  }
+}`, {
+				projectFullName: project.fullName,
+				applicationIdentifier: packageName,
+				legacyOnly: false
+			})).app.byFullName.androidAppCredentials[0];
+			if (existing) return asCredentials(existing);
+			const created = await call("CreateAndroidAppCredentialsMutation", `mutation CreateAndroidAppCredentialsMutation(
+  $androidAppCredentialsInput: AndroidAppCredentialsInput!
+  $appId: ID!
+  $applicationIdentifier: String!
+) {
+  androidAppCredentials {
+    createAndroidAppCredentials(
+      androidAppCredentialsInput: $androidAppCredentialsInput
+      appId: $appId
+      applicationIdentifier: $applicationIdentifier
+    ) { ${credentialsFields} }
+  }
+}`, {
+				androidAppCredentialsInput: {},
+				appId: project.projectId,
+				applicationIdentifier: packageName
+			});
+			return asCredentials(created.androidAppCredentials.createAndroidAppCredentials);
+		},
+		async createKey(accountId, json) {
+			return (await call("CreateGoogleServiceAccountKeyMutation", `mutation CreateGoogleServiceAccountKeyMutation(
+  $googleServiceAccountKeyInput: GoogleServiceAccountKeyInput!
+  $accountId: ID!
+) {
+  googleServiceAccountKey {
+    createGoogleServiceAccountKey(
+      googleServiceAccountKeyInput: $googleServiceAccountKeyInput
+      accountId: $accountId
+    ) { ${KEY_FIELDS} }
+  }
+}`, {
+				googleServiceAccountKeyInput: { jsonKey: json },
+				accountId
+			})).googleServiceAccountKey.createGoogleServiceAccountKey;
+		},
+		async useForSubmissions(credentialsId, keyId) {
+			await call("SetGoogleServiceAccountKeyForSubmissionsMutation", `mutation SetGoogleServiceAccountKeyForSubmissionsMutation(
+  $androidAppCredentialsId: ID!
+  $googleServiceAccountKeyId: ID!
+) {
+  androidAppCredentials {
+    setGoogleServiceAccountKeyForSubmissions(
+      id: $androidAppCredentialsId
+      googleServiceAccountKeyId: $googleServiceAccountKeyId
+    ) { id }
+  }
+}`, {
+				androidAppCredentialsId: credentialsId,
+				googleServiceAccountKeyId: keyId
+			});
+		},
+		async keys(accountName) {
+			const keys = [];
+			let after = null;
+			do {
+				const page = (await call("GoogleServiceAccountKeysPaginatedByAccountQuery", `query GoogleServiceAccountKeysPaginatedByAccountQuery(
+  $accountName: String!
+  $after: String
+  $first: Int
+) {
+  account {
+    byName(accountName: $accountName) {
+      id
+      googleServiceAccountKeysPaginated(after: $after, first: $first) {
+        edges { node { ${KEY_FIELDS} } }
+        pageInfo { hasNextPage endCursor }
+      }
+    }
+  }
+}`, {
+					accountName,
+					after,
+					first: 50
+				})).account.byName.googleServiceAccountKeysPaginated;
+				keys.push(...page.edges.map((edge) => edge.node));
+				after = page.pageInfo.hasNextPage ? page.pageInfo.endCursor : null;
+			} while (after);
+			return keys;
+		},
+		async deleteKey(id) {
+			await call("DeleteGoogleServiceAccountKeyMutation", `mutation DeleteGoogleServiceAccountKeyMutation($googleServiceAccountKeyId: ID!) {
+  googleServiceAccountKey { deleteGoogleServiceAccountKey(id: $googleServiceAccountKeyId) { id } }
+}`, { googleServiceAccountKeyId: id });
+		}
+	};
+}
+//#endregion
+//#region src/mobile/googlePlay/google.ts
+/**
+* Google, as `gkm deploy:google-play` reaches it: a token for the person
+* running it, and the Cloud APIs that make a project, a service account and
+* its key.
+*
+* The token is gcloud's own application-default credential, with the
+* `cloud-platform` and `androidpublisher` scopes — no OAuth client of gkm's —
+* kept in gkm's own gcloud config (`<gkm home>/gcloud`), so the person's own
+* gcloud setup is never read or changed. Every call carries the project as
+* its quota project (`x-goog-user-project`), which the Play Developer API
+* requires of a user credential.
+*/
+/** The scopes the sign-in asks for. */
+const GOOGLE_SCOPES = ["https://www.googleapis.com/auth/cloud-platform", "https://www.googleapis.com/auth/androidpublisher"];
+/** `gcloud` is not installed. */
+var GcloudMissing = class extends require_errors.GkmError {
+	constructor() {
+		super("gkm signs in to Google with gcloud, and there is no `gcloud` here. Install the Google Cloud CLI: https://cloud.google.com/sdk/docs/install.");
+		this.name = "GcloudMissing";
+	}
+};
+/** Not signed in, and no terminal to sign in from. */
+var GoogleSignInRequired = class extends require_errors.GkmError {
+	config;
+	constructor(config) {
+		super(`Signing in to Google opens a browser, and this run has no terminal. Run it once where you can sign in, as a Play Console admin: CLOUDSDK_CONFIG=${config} gcloud auth application-default login --scopes=${GOOGLE_SCOPES.join(",")}.`);
+		this.config = config;
+		this.name = "GoogleSignInRequired";
+	}
+};
+/** A Google API refused a call. */
+var GoogleApiError = class extends require_errors.GkmError {
+	method;
+	url;
+	status;
+	detail;
+	constructor(method, url, status, detail) {
+		super(`Google answered ${status} to ${method} ${url}: ${detail}`);
+		this.method = method;
+		this.url = url;
+		this.status = status;
+		this.detail = detail;
+		this.name = "GoogleApiError";
+	}
+};
+/** A long-running Google operation did not finish in time. */
+var GoogleOperationTimedOut = class extends require_errors.GkmError {
+	operation;
+	constructor(operation) {
+		super(`Google's operation ${operation} had not finished after a minute. Run the command again: what it finished is kept.`);
+		this.operation = operation;
+		this.name = "GoogleOperationTimedOut";
+	}
+};
+/** Where gkm keeps its gcloud sign-in. */
+function gcloudConfig(env = process.env) {
+	return (0, node_path.join)(require_run.gkmHome(env), "gcloud");
+}
+function gcloud(args, config, inherit) {
+	return new Promise((resolve, reject) => {
+		const child = (0, node_child_process.spawn)("gcloud", [...args], {
+			stdio: [
+				"inherit",
+				inherit ? "inherit" : "pipe",
+				inherit ? "inherit" : "pipe"
+			],
+			env: {
+				...process.env,
+				CLOUDSDK_CONFIG: config
+			}
+		});
+		let stdout = "";
+		child.stdout?.on("data", (chunk) => {
+			stdout += chunk.toString();
+		});
+		child.on("error", (error) => reject(error.code === "ENOENT" ? new GcloudMissing() : error));
+		child.on("close", (code) => resolve({
+			code,
+			stdout
+		}));
+	});
+}
+/** gcloud's application-default credential, in gkm's own gcloud config. */
+function gcloudSignIn(config = gcloudConfig()) {
+	return { async token({ interactive }) {
+		const print = () => gcloud([
+			"auth",
+			"application-default",
+			"print-access-token"
+		], config, false);
+		let printed = await print();
+		if (printed.code !== 0) {
+			if (!interactive) throw new GoogleSignInRequired(config);
+			await gcloud([
+				"auth",
+				"application-default",
+				"login",
+				`--scopes=${GOOGLE_SCOPES.join(",")}`
+			], config, true);
+			printed = await print();
+			if (printed.code !== 0) throw new GoogleSignInRequired(config);
+		}
+		return printed.stdout.trim();
+	} };
+}
+function googleClient(token, quotaProject) {
+	return { async request(method, url, body, options) {
+		const headers = {
+			authorization: `Bearer ${token}`,
+			...quotaProject ? { "x-goog-user-project": quotaProject } : {}
+		};
+		let payload;
+		if (options?.raw) {
+			headers["content-type"] = options.raw.contentType;
+			payload = options.raw.data;
+		} else if (body !== void 0) {
+			headers["content-type"] = "application/json";
+			payload = JSON.stringify(body);
+		}
+		const response = await fetch(url, {
+			method,
+			headers,
+			...payload !== void 0 ? { body: payload } : {}
+		});
+		const text = await response.text();
+		if (!response.ok) {
+			let detail = text;
+			try {
+				detail = JSON.parse(text).error?.message ?? text;
+			} catch {}
+			throw new GoogleApiError(method, url, response.status, detail);
+		}
+		return text ? JSON.parse(text) : {};
+	} };
+}
+/** A long-running operation, polled until it is done. */
+async function finished(client, base, operation, options = {}) {
+	let current = operation;
+	for (let attempt = 0; !current.done; attempt++) {
+		if (attempt >= (options.attempts ?? 30)) throw new GoogleOperationTimedOut(current.name ?? "(unnamed)");
+		await new Promise((resolve) => setTimeout(resolve, options.intervalMs ?? 2e3));
+		current = await client.request("GET", `${base}/${current.name}`);
+	}
+	if (current.error) throw new GoogleApiError("GET", `${base}/${current.name}`, 500, current.error.message ?? "the operation failed");
+}
+//#endregion
+//#region src/mobile/googlePlay/gcp.ts
+/**
+* The Google Cloud side of publishing to Play: a project with the Android
+* Publisher API on, and a service account in it whose JSON key EAS Submit
+* uses. Each step finds what is there before it creates anything, so a
+* second run reuses the project and the account and only makes a new key.
+*/
+const CLOUD_RESOURCE_MANAGER = "https://cloudresourcemanager.googleapis.com/v3";
+const SERVICE_USAGE = "https://serviceusage.googleapis.com/v1";
+const IAM = "https://iam.googleapis.com/v1";
+/** The API EAS Submit and gkm call Play through. */
+const ANDROID_PUBLISHER_API = "androidpublisher.googleapis.com";
+/** A project id or service account id gkm would derive is not a valid one. */
+var GoogleIdInvalid = class extends require_errors.GkmError {
+	kind;
+	id;
+	constructor(kind, id) {
+		super(`'${id}' is not a valid Google ${kind} id: 6 to 30 lowercase letters, digits and hyphens, starting with a letter and not ending in a hyphen. ` + (kind === "project" ? "Name one with --project." : ""));
+		this.kind = kind;
+		this.id = id;
+		this.name = "GoogleIdInvalid";
+	}
+};
+/** The project could not be created — most often, its id is someone else's. */
+var GoogleProjectUnavailable = class extends require_errors.GkmError {
+	project;
+	detail;
+	constructor(project, detail) {
+		super(`Could not create the Google Cloud project '${project}' (${detail}). Project ids are global: name another, or one you already have, with --project.`);
+		this.project = project;
+		this.detail = detail;
+		this.name = "GoogleProjectUnavailable";
+	}
+};
+const ID = /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/;
+/**
+* An id Google accepts, from a workspace's name: `shop` → `shop-play`.
+* Lowercased, anything else made a hyphen, cut to 30.
+*/
+function playId(workspace) {
+	return `${workspace.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^[^a-z]+|-+$/g, "").slice(0, 25).replace(/-+$/, "")}-play`;
+}
+/** Throws unless `id` is a valid project or service account id. */
+function assertGoogleId(kind, id) {
+	if (!ID.test(id)) throw new GoogleIdInvalid(kind, id);
+}
+/**
+* The project, created when it is not there. Answers whether it was made.
+*
+* @throws {GoogleProjectUnavailable}
+*/
+async function ensureProject(client, project, displayName, options = {}) {
+	assertGoogleId("project", project);
+	try {
+		await client.request("GET", `${CLOUD_RESOURCE_MANAGER}/projects/${project}`);
+		return false;
+	} catch (error) {
+		if (!(error instanceof GoogleApiError) || ![403, 404].includes(error.status)) throw error;
+	}
+	try {
+		const operation = await client.request("POST", `${CLOUD_RESOURCE_MANAGER}/projects`, {
+			projectId: project,
+			displayName: displayName.slice(0, 30)
+		});
+		await finished(client, CLOUD_RESOURCE_MANAGER, operation, options);
+	} catch (error) {
+		if (error instanceof GoogleApiError) throw new GoogleProjectUnavailable(project, error.detail);
+		throw error;
+	}
+	return true;
+}
+/** The Android Publisher API, on in the project. */
+async function enablePublisherApi(client, project, options = {}) {
+	const operation = await client.request("POST", `${SERVICE_USAGE}/projects/${project}/services/${ANDROID_PUBLISHER_API}:enable`, {});
+	await finished(client, SERVICE_USAGE, operation, options);
+}
+/** The service account's email, which is what Play and EAS know it by. */
+function serviceAccountEmail(project, account) {
+	return `${account}@${project}.iam.gserviceaccount.com`;
+}
+/** The service account, created when it is not there. Answers its email. */
+async function ensureServiceAccount(client, project, account, displayName) {
+	assertGoogleId("service account", account);
+	const email = serviceAccountEmail(project, account);
+	try {
+		await client.request("GET", `${IAM}/projects/${project}/serviceAccounts/${email}`);
+		return email;
+	} catch (error) {
+		if (!(error instanceof GoogleApiError) || error.status !== 404) throw error;
+	}
+	await client.request("POST", `${IAM}/projects/${project}/serviceAccounts`, {
+		accountId: account,
+		serviceAccount: { displayName: displayName.slice(0, 100) }
+	});
+	return email;
+}
+/** A new key for the account. Its JSON exists only in what this returns. */
+async function createKey(client, project, email) {
+	const key = await client.request("POST", `${IAM}/projects/${project}/serviceAccounts/${email}/keys`, {});
+	return {
+		name: key.name,
+		json: Buffer.from(key.privateKeyData, "base64").toString("utf8")
+	};
+}
+/** The account's keys that someone made — not Google's own. */
+async function listKeys(client, project, email) {
+	const { keys = [] } = await client.request("GET", `${IAM}/projects/${project}/serviceAccounts/${email}/keys?keyTypes=USER_MANAGED`);
+	return keys.map(({ name }) => ({ name }));
+}
+async function deleteKey(client, key) {
+	await client.request("DELETE", `${IAM}/${key.name}`);
+}
+/** A key's id: the last part of its name. */
+function keyId(key) {
+	return key.name.split("/").pop();
+}
+//#endregion
+//#region src/mobile/googlePlay/play.ts
+/**
+* Play Console, through the Play Developer API (androidpublisher v3): the
+* service account's access to the app, the store listing as code, and a
+* check that the new key can act on the app.
+*/
+const PLAY = "https://androidpublisher.googleapis.com/androidpublisher/v3";
+const PLAY_UPLOAD = "https://androidpublisher.googleapis.com/upload/androidpublisher/v3";
+/** What Play answers about a package no app in the account has. */
+const PACKAGE_MISSING = /packages are not available/i;
+/** The app is not in Play Console yet, and Play has no API that makes one. */
+var PlayAppMissing = class extends require_errors.GkmError {
+	packageName;
+	developer;
+	constructor(packageName, developer) {
+		super(`Play Console has no app '${packageName}', and Play has no API that creates one. Create it at https://play.google.com/console/developers/${developer}/create-new-app, with ${packageName} as its package, then run this again.`);
+		this.packageName = packageName;
+		this.developer = developer;
+		this.name = "PlayAppMissing";
+	}
+};
+/** The new key could not open an edit on the app. */
+var PlayKeyUnverified = class extends require_errors.GkmError {
+	email;
+	detail;
+	constructor(email, detail) {
+		super(`The new key for ${email} could not open an edit on the app (${detail}). Its access can take a few minutes to reach Play: run this again shortly.`);
+		this.email = email;
+		this.detail = detail;
+		this.name = "PlayKeyUnverified";
+	}
+};
+/**
+* The app-level permissions the service account needs: releasing to the
+* testing tracks, to production only where a stage submits there, and the
+* store listing where the workspace keeps one.
+*/
+function playPermissions(options) {
+	return [
+		"CAN_MANAGE_TRACK_APKS",
+		...options.tracks.includes("production") ? ["CAN_MANAGE_PUBLIC_APKS"] : [],
+		...options.listing ? ["CAN_MANAGE_PUBLIC_LISTING"] : []
+	].sort();
+}
+/**
+* The service account in Play Console with exactly `permissions` on the
+* app: invited with the grant in one call — Play refuses a user with no
+* permission, and a grant for a user not yet there — and, already there,
+* its grant made what it should be. Answers what changed.
+*
+* @throws {PlayAppMissing}
+*/
+async function ensurePlayAccess(client, options) {
+	const { developer, email, packageName } = options;
+	const permissions = [...options.permissions].sort();
+	const users = `${PLAY}/developers/${developer}/users`;
+	const missing = (error) => error instanceof GoogleApiError && PACKAGE_MISSING.test(error.detail) ? new PlayAppMissing(packageName, developer) : error;
+	const { users: listed = [] } = await client.request("GET", `${users}?pageSize=-1`);
+	const user = listed.find((candidate) => candidate.email === email);
+	if (!user) {
+		await client.request("POST", users, {
+			email,
+			grants: [{
+				packageName,
+				appLevelPermissions: permissions
+			}]
+		}).catch((error) => {
+			throw missing(error);
+		});
+		return "invited";
+	}
+	const grant = user.grants?.find((g) => g.packageName === packageName);
+	const grantPath = `${users}/${encodeURIComponent(email)}/grants`;
+	if (!grant) {
+		await client.request("POST", grantPath, {
+			packageName,
+			appLevelPermissions: permissions
+		}).catch((error) => {
+			throw missing(error);
+		});
+		return "granted";
+	}
+	if ([...grant.appLevelPermissions ?? []].sort().join() === permissions.join()) return "unchanged";
+	await client.request("PATCH", `${grantPath}/${packageName}?updateMask=appLevelPermissions`, { appLevelPermissions: permissions });
+	return "updated";
+}
+/** An access token for the key itself: a signed JWT, exchanged. */
+async function keyToken(key) {
+	const tokenUri = key.token_uri ?? "https://oauth2.googleapis.com/token";
+	const now = Math.floor(Date.now() / 1e3);
+	const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+	const unsigned = `${encode({
+		alg: "RS256",
+		typ: "JWT"
+	})}.${encode({
+		iss: key.client_email,
+		scope: "https://www.googleapis.com/auth/androidpublisher",
+		aud: tokenUri,
+		iat: now,
+		exp: now + 600
+	})}`;
+	const signature = (0, node_crypto.createSign)("RSA-SHA256").update(unsigned).sign(key.private_key).toString("base64url");
+	const response = await fetch(tokenUri, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+			assertion: `${unsigned}.${signature}`
+		})
+	});
+	const body = await response.json().catch(() => ({}));
+	if (!response.ok || !body.access_token) throw new PlayKeyUnverified(key.client_email, body.error_description ?? `token exchange answered ${response.status}`);
+	return body.access_token;
+}
+/**
+* Proof the key and its grant work: as the key, open an edit on the app and
+* discard it — what EAS Submit's first call is.
+*
+* @throws {PlayKeyUnverified}
+*/
+async function verifyKey(key, packageName) {
+	const client = googleClient(await keyToken(key));
+	try {
+		const edit = await client.request("POST", `${PLAY}/applications/${packageName}/edits`, {});
+		await client.request("DELETE", `${PLAY}/applications/${packageName}/edits/${edit.id}`);
+	} catch (error) {
+		if (error instanceof GoogleApiError) throw new PlayKeyUnverified(key.client_email, error.detail);
+		throw error;
+	}
+}
+/** The image kinds Play's listing takes, as fastlane supply names them. */
+const IMAGE_TYPES = [
+	"icon",
+	"featureGraphic",
+	"promoGraphic",
+	"tvBanner",
+	"phoneScreenshots",
+	"sevenInchScreenshots",
+	"tenInchScreenshots",
+	"tvScreenshots",
+	"wearScreenshots"
+];
+/**
+* `<app>/store/play`, read: undefined where there is none.
+*
+* ```
+* store/play/
+*   data-safety.csv
+*   listings/en-US/title.txt, short_description.txt, full_description.txt, video.txt
+*   listings/en-US/images/icon.png, featureGraphic.png
+*   listings/en-US/images/phoneScreenshots/1.png, 2.png …
+* ```
+*/
+function readPlayStore(appDir) {
+	const root = (0, node_path.join)(appDir, "store", "play");
+	if (!(0, node_fs.existsSync)(root)) return void 0;
+	const text = (path) => (0, node_fs.existsSync)(path) ? (0, node_fs.readFileSync)(path, "utf8").trim() : void 0;
+	const listings = [];
+	const listingsDir = (0, node_path.join)(root, "listings");
+	for (const language of (0, node_fs.existsSync)(listingsDir) ? (0, node_fs.readdirSync)(listingsDir).sort() : []) {
+		const dir = (0, node_path.join)(listingsDir, language);
+		if (!(0, node_fs.statSync)(dir).isDirectory()) continue;
+		const images = {};
+		const imagesDir = (0, node_path.join)(dir, "images");
+		for (const type of IMAGE_TYPES) {
+			const single = [
+				".png",
+				".jpg",
+				".jpeg"
+			].map((ext) => (0, node_path.join)(imagesDir, `${type}${ext}`)).find(node_fs.existsSync);
+			const many = (0, node_path.join)(imagesDir, type);
+			const files = single ? [single] : (0, node_fs.existsSync)(many) ? (0, node_fs.readdirSync)(many).filter((f) => /\.(png|jpe?g)$/i.test(f)).sort().map((f) => (0, node_path.join)(many, f)) : [];
+			if (files.length > 0) images[type] = files;
+		}
+		const listing = {
+			language,
+			images
+		};
+		const title = text((0, node_path.join)(dir, "title.txt"));
+		const shortDescription = text((0, node_path.join)(dir, "short_description.txt"));
+		const fullDescription = text((0, node_path.join)(dir, "full_description.txt"));
+		const video = text((0, node_path.join)(dir, "video.txt"));
+		if (title) listing.title = title;
+		if (shortDescription) listing.shortDescription = shortDescription;
+		if (fullDescription) listing.fullDescription = fullDescription;
+		if (video) listing.video = video;
+		listings.push(listing);
+	}
+	const dataSafety = text((0, node_path.join)(root, "data-safety.csv"));
+	return {
+		listings,
+		...dataSafety ? { dataSafety } : {}
+	};
+}
+/**
+* Push the listing through one edit, committed: each locale's text, and each
+* image kind replaced by the files kept. Then the data safety form, which
+* Play takes outside an edit. Answers whether the listing was pushed: an
+* app that has never had an upload may refuse an edit, and that is left for
+* the next run, not failed.
+*/
+async function pushPlayStore(client, packageName, store) {
+	const app = `${PLAY}/applications/${packageName}`;
+	let listing = false;
+	let reason;
+	if (store.listings.length > 0) {
+		let edit;
+		try {
+			edit = await client.request("POST", `${app}/edits`, {});
+		} catch (error) {
+			if (!(error instanceof GoogleApiError)) throw error;
+			reason = error.detail;
+		}
+		if (edit) {
+			const base = `${app}/edits/${edit.id}/listings`;
+			for (const entry of store.listings) {
+				const { images, ...text } = entry;
+				if (text.title || text.shortDescription || text.fullDescription) await client.request("PUT", `${base}/${entry.language}`, text);
+				for (const [type, files] of Object.entries(images)) {
+					await client.request("DELETE", `${base}/${entry.language}/${type}`);
+					for (const file of files ?? []) await client.request("POST", `${PLAY_UPLOAD}/applications/${packageName}/edits/${edit.id}/listings/${entry.language}/${type}?uploadType=media`, void 0, { raw: {
+						contentType: (0, node_path.extname)(file).toLowerCase() === ".png" ? "image/png" : "image/jpeg",
+						data: (0, node_fs.readFileSync)(file)
+					} });
+				}
+			}
+			await client.request("POST", `${app}/edits/${edit.id}:commit`);
+			listing = true;
+		}
+	}
+	let dataSafety = false;
+	if (store.dataSafety) {
+		await client.request("POST", `${app}/dataSafety`, { safetyLabels: store.dataSafety });
+		dataSafety = true;
+	}
+	return {
+		listing,
+		dataSafety,
+		...reason ? { reason } : {}
+	};
+}
+/** What Play Console only takes by hand, for the person to tick off. */
+const PLAY_CONSOLE_CHECKLIST = [
+	"App content → Privacy policy: the URL of the published policy",
+	"App content → App access: how a reviewer signs in",
+	"App content → Ads: whether the app shows ads",
+	"App content → Content rating: the questionnaire",
+	"App content → Target audience and content",
+	"App content → Health apps / Health Connect, where the app reads health data",
+	"App content → Sensitive permissions, where the app asks for any",
+	"Release → the first upload of a new app, by hand"
+];
+//#endregion
+//#region src/mobile/googlePlay/index.ts
+/**
+* `gkm deploy:google-play`: what EAS Submit needs to publish a `MobileApp`
+* to Google Play, set up in one run — the counterpart of `gkm deploy:github`
+* for the AWS side.
+*
+* 1. Each deployed stage's track and release status into `eas.json`
+*    (`submit.<stage>.android`), from `mobileStage`.
+* 2. Google: the project (`--project`, else `<workspace>-play`, made when
+*    absent) with the Android Publisher API on, and the service account
+*    `<workspace>-play` in it, found or made.
+* 3. Play Console: the account invited with a grant on the app alone, its
+*    permissions following the stages' tracks — production releases only
+*    when a stage submits there. An app not in Play Console yet is a step
+*    only a person can take; interactively, the run says so and waits.
+* 4. A new JSON key, held in memory: uploaded to EAS, assigned to the app's
+*    Android credentials for EAS Submit, and proved by opening and
+*    discarding an edit with it. Only then are the account's older keys
+*    deleted, from EAS and from Google — a failed run leaves the old key
+*    working.
+* 5. The store listing kept beside the app (`store/play/`), pushed.
+* 6. What Play Console only takes by hand, as a checklist.
+*
+* Running it again rotates the key and pushes the listing.
+*/
+const logger = console;
+/** No Play developer account to act in. */
+var PlayDeveloperMissing = class extends require_errors.GkmError {
+	constructor() {
+		super("Name the Play developer account: --developer <id>. It is the number in Play Console's address: https://play.google.com/console/developers/<id>/….");
+		this.name = "PlayDeveloperMissing";
+	}
+};
+/** The app's Expo config has no Android package, or no EAS project. */
+var ExpoConfigIncomplete = class extends require_errors.GkmError {
+	app;
+	missing;
+	constructor(app, missing) {
+		super(missing === "android.package" ? `'${app}' has no android.package in its Expo config: Play knows an app by its package. Set it in app.config.ts: android: { package: 'com.acme.shop' }.` : `'${app}' has no extra.eas.projectId in its Expo config: it is not linked to an EAS project. Run \`eas init\` in the app.`);
+		this.app = app;
+		this.missing = missing;
+		this.name = "ExpoConfigIncomplete";
+	}
+};
+/** `expo config` could not read the app's config. */
+var ExpoConfigFailed = class extends require_errors.GkmError {
+	dir;
+	detail;
+	constructor(dir, detail) {
+		super(`Could not read the Expo config in ${dir} (${detail}). Check that \`npx expo config --json\` works there.`);
+		this.dir = dir;
+		this.detail = detail;
+		this.name = "ExpoConfigFailed";
+	}
+};
+/** The workspace deploys no stage. */
+var NoDeployedStage = class extends require_errors.GkmError {
+	constructor() {
+		super("gkm.config.ts deploys no stage, so there is nothing to publish to: add one to stages.deployed.");
+		this.name = "NoDeployedStage";
+	}
+};
+/** `expo config --json`, run with the app's Expo — its own, or the workspace's. */
+function expoConfig(dir, root, env) {
+	return new Promise((resolve, reject) => {
+		const child = (0, node_child_process.spawn)("expo", [
+			"config",
+			"--json",
+			"--type",
+			"public"
+		], {
+			cwd: dir,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			env: {
+				...process.env,
+				...env,
+				PATH: [
+					(0, node_path.join)(dir, "node_modules", ".bin"),
+					(0, node_path.join)(root, "node_modules", ".bin"),
+					process.env.PATH
+				].join(node_path.delimiter)
+			}
+		});
+		let stdout = "";
+		let stderr = "";
+		child.stdout.on("data", (chunk) => {
+			stdout += chunk.toString();
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk.toString();
+		});
+		child.on("error", (error) => reject(new ExpoConfigFailed(dir, error.message)));
+		child.on("close", (code) => {
+			if (code !== 0) {
+				reject(new ExpoConfigFailed(dir, stderr.trim() || `exit ${code}`));
+				return;
+			}
+			try {
+				resolve(JSON.parse(stdout));
+			} catch {
+				reject(new ExpoConfigFailed(dir, `no JSON: ${stdout.slice(0, 200)}`));
+			}
+		});
+	});
+}
+const defaultGooglePlayDeps = {
+	signIn: gcloudSignIn(),
+	eas: easApi(),
+	expoConfig,
+	interactive: require_index.canPrompt(),
+	sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+};
+/**
+* Set up publishing a mobile app to Google Play.
+*
+* @throws {PlayDeveloperMissing}, {ExpoConfigIncomplete}, {PlayAppMissing},
+*   {PlayKeyUnverified} — and what each step's API throws
+*/
+async function deployGooglePlay(options, deps = defaultGooglePlayDeps) {
+	if (!options.developer) throw new PlayDeveloperMissing();
+	const developer = options.developer;
+	const declared = (await require_config.loadWorkspaceConfig(options.cwd)).workspace.stages;
+	const stageName = options.stage ?? declared.protected?.[0] ?? declared.deployed[0];
+	if (!stageName) throw new NoDeployedStage();
+	const loaded = await require_stage.loadStage({
+		stage: stageName,
+		...options.cwd ? { cwd: options.cwd } : {},
+		...options.profile ? { profile: options.profile } : {}
+	});
+	const { workspace, manifest, stack } = loaded;
+	const declaration = require_eas.chooseMobileApp(manifest, options.app, loaded.appName);
+	const name = declaration.id;
+	const dir = (0, node_path.join)(workspace.root, declaration.app.path);
+	const values = stack.mobileApps.find((candidate) => candidate.id === declaration.id)?.values ?? {};
+	const config = await deps.expoConfig(dir, workspace.root, values);
+	const packageName = config.android?.package;
+	if (!packageName) throw new ExpoConfigIncomplete(name, "android.package");
+	const projectId = config.extra?.eas?.projectId;
+	if (!projectId) throw new ExpoConfigIncomplete(name, "extra.eas.projectId");
+	const stages = workspace.stages.deployed.map((stage) => require_index.mobileStage(workspace, declaration, stage));
+	const easJsonPath = (0, node_path.join)(dir, "eas.json");
+	const before = (0, node_fs.existsSync)(easJsonPath) ? JSON.parse(await (0, node_fs_promises.readFile)(easJsonPath, "utf8")) : {};
+	const after = stages.reduce(require_eas.withStageProfiles, before);
+	if (JSON.stringify(before) !== JSON.stringify(after)) {
+		await (0, node_fs_promises.writeFile)(easJsonPath, `${JSON.stringify(after, null, 2)}\n`);
+		logger.log(`📝 ${easJsonPath}: each stage's build and submit profiles`);
+	}
+	const store = readPlayStore(dir);
+	const permissions = playPermissions({
+		tracks: stages.map((stage) => stage.android.track),
+		listing: (store?.listings.length ?? 0) > 0
+	});
+	const project = options.project ?? playId(workspace.name);
+	assertGoogleId("project", project);
+	const account = playId(workspace.name);
+	const token = await deps.signIn.token({ interactive: deps.interactive });
+	const created = await ensureProject(googleClient(token), project, `${workspace.name} Play`);
+	logger.log(`☁️  Google Cloud project ${project}${created ? " (created)" : ""}`);
+	const client = googleClient(token, project);
+	await enablePublisherApi(client, project);
+	const email = await ensureServiceAccount(client, project, account, `${workspace.name} publishing (gkm)`);
+	logger.log(`🤖 Service account ${email}`);
+	let access;
+	for (let attempt = 0; !access; attempt++) try {
+		access = await ensurePlayAccess(client, {
+			developer,
+			email,
+			packageName,
+			permissions
+		});
+	} catch (error) {
+		if (!(error instanceof PlayAppMissing) || !deps.interactive) throw error;
+		if (attempt === 0) logger.log(`\n⏳ ${error.message}\n   Waiting for it…`);
+		await deps.sleep(15e3);
+	}
+	logger.log(`🎟️  Play access on ${packageName}: ${access} (${permissions.join(", ")})`);
+	const older = await listKeys(client, project, email);
+	const key = await createKey(client, project, email);
+	const json = JSON.parse(key.json);
+	const easProject = await deps.eas.project(projectId);
+	const credentials = await deps.eas.androidCredentials({
+		projectId,
+		fullName: easProject.fullName
+	}, packageName);
+	const easKey = await deps.eas.createKey(easProject.accountId, json);
+	await deps.eas.useForSubmissions(credentials.id, easKey.id);
+	logger.log(`🔑 New key ${keyId(key)} assigned to EAS Submit for ${packageName}`);
+	for (let attempt = 0;; attempt++) try {
+		await verifyKey(json, packageName);
+		break;
+	} catch (error) {
+		if (!(error instanceof PlayKeyUnverified) || attempt >= 5) throw error;
+		await deps.sleep(1e4);
+	}
+	logger.log("✅ The key opens an edit on the app");
+	const easOlder = (await deps.eas.keys(easProject.accountName)).filter((candidate) => candidate.clientEmail === email && candidate.id !== easKey.id);
+	for (const old of easOlder) await deps.eas.deleteKey(old.id);
+	for (const old of older) await deleteKey(client, old);
+	if (older.length + easOlder.length > 0) logger.log(`🧹 Deleted ${older.length} older key(s) from Google, ${easOlder.length} from EAS`);
+	const listing = store ? await pushPlayStore(client, packageName, store) : void 0;
+	if (listing?.listing) logger.log("🛍️  Store listing pushed");
+	if (store && !listing?.listing && listing?.reason) logger.log(`⏭️  Store listing not pushed yet (${listing.reason}): run this again after the app's first upload`);
+	if (listing?.dataSafety) logger.log("🛡️  Data safety pushed");
+	logger.log("\nLeft to do in Play Console, by hand:");
+	for (const item of PLAY_CONSOLE_CHECKLIST) logger.log(`  [ ] ${item}`);
+	return {
+		packageName,
+		project,
+		email,
+		permissions,
+		access,
+		key: {
+			google: keyId(key),
+			eas: easKey.id
+		},
+		deleted: {
+			google: older.map(keyId),
+			eas: easOlder.map((candidate) => candidate.id)
+		},
+		listing
+	};
+}
+//#endregion
+exports.deployGooglePlay = deployGooglePlay;
+
+//# sourceMappingURL=googlePlay-BVcfFWRO.cjs.map