@gpc-cli/core 0.10.5 → 0.10.7

package/dist/index.js

@@ -2315,28 +2315,18 @@ function reviewsToCsv(reviews) {
     const uc = r.comments?.[0]?.userComment;
     const fields = [
       r.reviewId,
-      csvEscape(r.authorName),
+      escapeCsvField(r.authorName),
       uc?.starRating ?? "",
-      csvEscape(uc?.text ?? ""),
+      escapeCsvField(uc?.text ?? ""),
       uc?.reviewerLanguage ?? "",
       uc ? new Date(Number(uc.lastModified.seconds) * 1e3).toISOString() : "",
-      csvEscape(uc?.device ?? ""),
-      csvEscape(uc?.appVersionName ?? "")
+      escapeCsvField(uc?.device ?? ""),
+      escapeCsvField(uc?.appVersionName ?? "")
     ];
     return fields.join(",");
   });
   return [header, ...rows].join("\n");
 }
-function csvEscape(value) {
-  let safe = value;
-  if (/^[=+\-@\t\r]/.test(safe)) {
-    safe = `'${safe}`;
-  }
-  if (safe.includes(",") || safe.includes('"') || safe.includes("\n")) {
-    return `"${safe.replace(/"/g, '""')}"`;
-  }
-  return safe;
-}
 async function analyzeReviews2(client, packageName, options) {
   const { reviews } = await listReviews(client, packageName, options);
   const items = reviews.map((r) => {
@@ -2696,6 +2686,100 @@ var METRIC_SET_METRICS = {
   ],
   errorCountMetricSet: ["errorReportCount", "distinctUsers"]
 };
+var REQUIRED_DIMENSIONS = {
+  slowStartRateMetricSet: ["startType"],
+  errorCountMetricSet: ["reportType"]
+};
+function withRequiredDimensions(metricSet, query) {
+  const required = REQUIRED_DIMENSIONS[metricSet];
+  if (!required) return query;
+  const dimensions = [...required];
+  for (const dim2 of query.dimensions ?? []) {
+    if (!dimensions.includes(dim2)) dimensions.push(dim2);
+  }
+  return { ...query, dimensions };
+}
+function readMetricValue(row, metric) {
+  const metrics = row?.metrics;
+  if (!metrics || typeof metrics !== "object") return void 0;
+  let entry;
+  if (Array.isArray(metrics)) {
+    entry = metric ? metrics.find((m) => m?.metric === metric) : metrics[0];
+  } else {
+    const map = metrics;
+    const key = metric ?? Object.keys(map)[0];
+    entry = key ? map[key] : void 0;
+  }
+  const raw = entry?.decimalValue?.value;
+  if (raw === void 0) return void 0;
+  const value = Number(raw);
+  return Number.isFinite(value) ? value : void 0;
+}
+function rowDateKey(row) {
+  const t = row.startTime;
+  if (!t) return "";
+  const pad = (n) => String(n ?? 0).padStart(2, "0");
+  return `${t.year ?? 0}-${pad(t.month)}-${pad(t.day)}T${pad(t.hours)}`;
+}
+function rowSliceKey(row) {
+  const dims = row.dimensions;
+  if (!dims || typeof dims !== "object") return "";
+  const pairs = Array.isArray(dims) ? dims.map((d) => [d?.dimension ?? "", d?.stringValue ?? d?.int64Value ?? ""]) : Object.entries(dims).map(([k, d]) => [
+    k,
+    d?.stringValue ?? d?.int64Value ?? ""
+  ]);
+  return JSON.stringify(pairs.sort());
+}
+function latestWorstValue(rows, metric) {
+  if (!rows || rows.length === 0) return void 0;
+  const latest = rows.map(rowDateKey).reduce((a, b) => b > a ? b : a);
+  let worst;
+  for (const row of rows) {
+    if (rowDateKey(row) !== latest) continue;
+    const value = readMetricValue(row, metric);
+    if (value !== void 0 && (worst === void 0 || value > worst)) worst = value;
+  }
+  return worst;
+}
+function worstSliceAverage(rows, metric) {
+  const sums = /* @__PURE__ */ new Map();
+  for (const row of rows ?? []) {
+    const value = readMetricValue(row, metric);
+    if (value === void 0) continue;
+    const key = rowSliceKey(row);
+    const entry = sums.get(key) ?? { total: 0, count: 0 };
+    entry.total += value;
+    entry.count++;
+    sums.set(key, entry);
+  }
+  let worst;
+  for (const { total, count } of sums.values()) {
+    const avg = total / count;
+    if (worst === void 0 || avg > worst) worst = avg;
+  }
+  return worst;
+}
+function assertRateThreshold(label, threshold) {
+  if (!Number.isFinite(threshold) || threshold < 0) {
+    throw new GpcError(
+      `Invalid ${label} threshold: expected a fraction such as 0.02.`,
+      "THRESHOLD_INVALID",
+      2,
+      "Write rates as fractions: 0.02 means 2%."
+    );
+  }
+  if (threshold >= 1) {
+    throw new GpcError(
+      `${label} threshold ${threshold} can never be reached: rates are between 0 and 1.`,
+      "THRESHOLD_INVALID",
+      2,
+      `Write rates as fractions: ${threshold / 100} means ${threshold}%. Check vitals.thresholds in your config too.`
+    );
+  }
+}
+function isGamesOnlyMetricError(err) {
+  return err?.code === "API_METRIC_GAMES_ONLY";
+}
 async function getFreshnessEndDate(reporting, packageName, metricSet, aggregation = "DAILY") {
   try {
     const info = await reporting.getMetricSetFreshness(packageName, metricSet);
@@ -2709,12 +2793,16 @@ async function getFreshnessEndDate(reporting, packageName, metricSet, aggregatio
   }
   return void 0;
 }
+async function latestQueryableEndDate(reporting, packageName, metricSet) {
+  const fallback = new Date(Date.now() - 2 * 24 * 60 * 60 * 1e3);
+  const freshnessEnd = await getFreshnessEndDate(reporting, packageName, metricSet);
+  return freshnessEnd ?? fallback;
+}
 function buildQuery(metricSet, options, freshnessEnd) {
   const metrics = METRIC_SET_METRICS[metricSet] ?? ["errorReportCount", "distinctUsers"];
   const days = options?.days ?? 30;
   const DAY_MS = 24 * 60 * 60 * 1e3;
-  const yesterday = new Date(Date.now() - DAY_MS);
-  const end = freshnessEnd && freshnessEnd < yesterday ? freshnessEnd : yesterday;
+  const end = freshnessEnd ?? new Date(Date.now() - 2 * DAY_MS);
   const start = new Date(end.getTime() - days * DAY_MS);
   const query = {
     metrics,
@@ -2735,7 +2823,7 @@ function buildQuery(metricSet, options, freshnessEnd) {
   if (options?.dimension) {
     query.dimensions = [options.dimension];
   }
-  return query;
+  return withRequiredDimensions(metricSet, query);
 }
 async function queryMetric(reporting, packageName, metricSet, options) {
   const freshnessEnd = await getFreshnessEndDate(
@@ -2771,16 +2859,29 @@ async function getVitalsOverview(reporting, packageName) {
     })
   );
   const overview = {};
+  const unavailable = [];
+  let firstFailure;
+  let succeeded = 0;
   for (let i = 0; i < metricSets.length; i++) {
     const entry = metricSets[i];
-    if (!entry) continue;
-    const key = entry[1];
     const result = results[i];
-    if (!result) continue;
+    if (!entry || !result) continue;
+    const key = entry[1];
     if (result.status === "fulfilled") {
       overview[key] = result.value.rows || [];
+      succeeded++;
+      continue;
     }
+    const err = result.reason;
+    if (!isGamesOnlyMetricError(err)) firstFailure ??= result.reason;
+    unavailable.push({
+      metric: key,
+      code: typeof err?.code === "string" ? err.code : "UNKNOWN_ERROR",
+      reason: isGamesOnlyMetricError(err) ? "Only available for apps categorised as games." : typeof err?.message === "string" ? err.message : String(result.reason)
+    });
   }
+  if (succeeded === 0 && firstFailure !== void 0) throw firstFailure;
+  if (unavailable.length > 0) overview.unavailable = unavailable;
   return overview;
 }
 async function getVitalsCrashes(reporting, packageName, options) {
@@ -2790,8 +2891,7 @@ async function getVitalsAnr(reporting, packageName, options) {
   return queryMetric(reporting, packageName, "anrRateMetricSet", options);
 }
 async function getVitalsStartup(reporting, packageName, options) {
-  const opts = options?.dimension ? options : { ...options, dimension: "startType" };
-  return queryMetric(reporting, packageName, "slowStartRateMetricSet", opts);
+  return queryMetric(reporting, packageName, "slowStartRateMetricSet", options);
 }
 async function getVitalsRendering(reporting, packageName, options) {
   return queryMetric(reporting, packageName, "slowRenderingRateMetricSet", options);
@@ -2821,8 +2921,7 @@ async function getVitalsMemoryBitmap(reporting, packageName, options) {
   });
 }
 async function getVitalsErrorCount(reporting, packageName, options) {
-  const opts = options?.dimension ? options : { ...options, dimension: "reportType" };
-  return queryMetric(reporting, packageName, "errorCountMetricSet", opts);
+  return queryMetric(reporting, packageName, "errorCountMetricSet", options);
 }
 async function getVitalsAnomalies(reporting, packageName) {
   return reporting.getAnomalies(packageName);
@@ -2846,7 +2945,7 @@ async function compareVitalsTrend(reporting, packageName, metricSet, days = 7) {
     month: d.getUTCMonth() + 1,
     day: d.getUTCDate()
   });
-  const makeQuery = (start, end) => ({
+  const makeQuery = (start, end) => withRequiredDimensions(metricSet, {
     metrics,
     timelineSpec: {
       aggregationPeriod: "DAILY",
@@ -2950,7 +3049,8 @@ function watchVitalsWithAutoHalt(reporting, packageName, options) {
     threshold,
     metricSet = "crashRateMetricSet",
     onHalt,
-    onPoll
+    onPoll,
+    onError
   } = options;
   let stopped = false;
   let haltTriggered = false;
@@ -2958,16 +3058,15 @@ function watchVitalsWithAutoHalt(reporting, packageName, options) {
     if (stopped) return;
     try {
       const result = await queryMetric(reporting, packageName, metricSet, { days: 1 });
-      const latestRow = result.rows?.[result.rows.length - 1];
-      const firstMetric = latestRow?.metrics ? Object.keys(latestRow.metrics)[0] : void 0;
-      const value = firstMetric ? Number(latestRow?.metrics[firstMetric]?.decimalValue?.value) : void 0;
+      const value = latestWorstValue(result.rows, METRIC_SET_METRICS[metricSet]?.[0]);
       const breached = value !== void 0 && value > threshold;
       onPoll?.(value, breached);
       if (breached && !haltTriggered && onHalt) {
         haltTriggered = true;
         await onHalt(value);
       }
-    } catch {
+    } catch (err) {
+      onError?.(err);
     }
     if (!stopped) {
       timerId = setTimeout(poll, intervalMs);
@@ -3033,33 +3132,28 @@ var WARN_MARGIN = 0.2;
 function toApiDate(d) {
   return { year: d.getUTCFullYear(), month: d.getUTCMonth() + 1, day: d.getUTCDate() };
 }
-async function queryVitalForStatus(reporting, packageName, metricSet, days, offsetDays = 0) {
+async function queryVitalForStatus(reporting, packageName, metricSet, days, latestEnd, offsetDays = 0) {
   const DAY_MS = 24 * 60 * 60 * 1e3;
-  const baseMs = Date.now() - 2 * DAY_MS - offsetDays * DAY_MS;
+  const baseMs = latestEnd.getTime() - offsetDays * DAY_MS;
   const end = new Date(baseMs);
   const start = new Date(baseMs - days * DAY_MS);
   const metrics = METRIC_SET_METRICS2[metricSet] ?? ["distinctUsers"];
-  const query = {
+  const query = withRequiredDimensions(metricSet, {
     metrics,
     timelineSpec: {
       aggregationPeriod: "DAILY",
       startTime: toApiDate(start),
       endTime: toApiDate(end)
     }
-  };
+  });
   const result = await reporting.queryMetricSet(packageName, metricSet, query);
-  if (!result.rows || result.rows.length === 0) return void 0;
-  const values = result.rows.map((row) => {
-    const firstKey = Object.keys(row.metrics)[0];
-    return firstKey ? Number(row.metrics[firstKey]?.decimalValue?.value) : NaN;
-  }).filter((v) => !isNaN(v));
-  if (values.length === 0) return void 0;
-  return values.reduce((a, b) => a + b, 0) / values.length;
+  return worstSliceAverage(result.rows, metrics[0]);
 }
 async function queryVitalWithTrend(reporting, packageName, metricSet, days) {
+  const latestEnd = await latestQueryableEndDate(reporting, packageName, metricSet);
   const [current, previous] = await Promise.all([
-    queryVitalForStatus(reporting, packageName, metricSet, days, 0),
-    queryVitalForStatus(reporting, packageName, metricSet, days, days)
+    queryVitalForStatus(reporting, packageName, metricSet, days, latestEnd, 0),
+    queryVitalForStatus(reporting, packageName, metricSet, days, latestEnd, days)
   ]);
   let trend = null;
   if (current !== void 0 && previous !== void 0) {
@@ -3157,7 +3251,7 @@ async function getAppStatus(client, reporting, packageName, options = {}) {
   if (slowStartResult.status === "rejected")
     sectionErrors.push(`vitals/slowStarts: ${String(slowStartResult.reason)}`);
   const slowRender = slowRenderResult.status === "fulfilled" ? slowRenderResult.value : SKIPPED_VITAL;
-  if (slowRenderResult.status === "rejected")
+  if (slowRenderResult.status === "rejected" && !isGamesOnlyMetricError(slowRenderResult.reason))
     sectionErrors.push(`vitals/slowRender: ${String(slowRenderResult.reason)}`);
   const rawReviews = reviewsResult.status === "fulfilled" ? reviewsResult.value.reviews : [];
   if (reviewsResult.status === "rejected")
@@ -3538,31 +3632,34 @@ async function queryWatchMetric(reporting, packageName, metric) {
   const metricSet = METRIC_TO_SET[metric];
   const metricKey = METRIC_KEY[metric];
   const DAY_MS = 24 * 60 * 60 * 1e3;
-  const end = new Date(Date.now() - 2 * DAY_MS);
-  const start = new Date(end.getTime() - 7 * DAY_MS);
   const toDate = (d) => ({
     year: d.getUTCFullYear(),
     month: d.getUTCMonth() + 1,
     day: d.getUTCDate()
   });
   try {
-    const result = await reporting.queryMetricSet(packageName, metricSet, {
-      metrics: [metricKey, "distinctUsers"],
-      timelineSpec: {
-        aggregationPeriod: "DAILY",
-        startTime: toDate(start),
-        endTime: toDate(end)
-      }
-    });
-    if (!result.rows || result.rows.length === 0) return void 0;
-    const values = result.rows.map((row) => {
-      const val = row.metrics[metricKey]?.decimalValue?.value;
-      return val !== void 0 ? Number(val) : NaN;
-    }).filter((v) => !isNaN(v));
-    if (values.length === 0) return void 0;
-    return values.reduce((a, b) => a + b, 0) / values.length;
-  } catch {
-    return void 0;
+    const end = await latestQueryableEndDate(reporting, packageName, metricSet);
+    const start = new Date(end.getTime() - 7 * DAY_MS);
+    const result = await reporting.queryMetricSet(
+      packageName,
+      metricSet,
+      withRequiredDimensions(metricSet, {
+        metrics: [metricKey, "distinctUsers"],
+        timelineSpec: {
+          aggregationPeriod: "DAILY",
+          startTime: toDate(start),
+          endTime: toDate(end)
+        }
+      })
+    );
+    return { value: latestWorstValue(result.rows, metricKey) };
+  } catch (err) {
+    const code = err?.code;
+    return {
+      value: void 0,
+      error: typeof code === "string" ? code : err instanceof Error ? err.message : String(err),
+      gamesOnly: isGamesOnlyMetricError(err)
+    };
   }
 }
 async function fetchRollout(client, packageName, track) {
@@ -3641,12 +3738,17 @@ async function runWatch(client, reporting, config, callbacks) {
       "Watch interval must be at least 60 seconds",
       "WATCH_USAGE_ERROR",
       2,
-      "Use --interval 60 or higher. Google vitals data is delayed 24-48h, so frequent polling wastes API quota."
+      "Use --interval 60 or higher. Google vitals data is delayed 2-4 days, so frequent polling wastes API quota."
     );
   }
+  for (const [metric, threshold] of Object.entries(config.thresholds)) {
+    if (metric !== "errorCount" && threshold !== void 0) assertRateThreshold(metric, threshold);
+  }
   let running = true;
   const events = [];
   let breachCount = 0;
+  let unreadableRounds = 0;
+  let lastRoundUnreadable = false;
   let halted = false;
   const startTime = Date.now();
   const cleanup = () => {
@@ -3662,19 +3764,24 @@ async function runWatch(client, reporting, config, callbacks) {
       const vitals = {};
       const metricResults = await Promise.all(
         config.metrics.map(async (metric) => {
-          const value = await queryWatchMetric(reporting, config.packageName, metric);
-          return { metric, value };
+          const reading = await queryWatchMetric(reporting, config.packageName, metric);
+          return { metric, ...reading };
         })
       );
-      for (const { metric, value } of metricResults) {
+      let unreadable = false;
+      for (const { metric, value, error, gamesOnly } of metricResults) {
         const threshold = config.thresholds[metric];
+        if (error && threshold !== void 0 && !gamesOnly) unreadable = true;
         const result = threshold !== void 0 ? checkThreshold(value, threshold) : { breached: false };
         vitals[metric] = {
           value,
           threshold,
-          breached: result.breached
+          breached: result.breached,
+          ...error ? { error } : {}
         };
       }
+      if (unreadable) unreadableRounds++;
+      lastRoundUnreadable = unreadable;
       const breaches = Object.entries(vitals).filter(([, v]) => v.breached).map(([k]) => k);
       const event = {
         round,
@@ -3726,6 +3833,8 @@ async function runWatch(client, reporting, config, callbacks) {
     durationMs: Date.now() - startTime,
     finalRollout: events[events.length - 1]?.rollout?.userFraction ?? null,
     breachCount,
+    unreadableRounds,
+    lastRoundUnreadable,
     halted,
     events
   };
@@ -4151,6 +4260,7 @@ function reportObjectNotFoundError(opts) {
 var GCS_API_BASE = "https://storage.googleapis.com/storage/v1/b";
 var LIST_TIMEOUT_MS = 6e4;
 var DOWNLOAD_TIMEOUT_MS = 12e4;
+var MAX_DOWNLOAD_BYTES = 512 * 1024 * 1024;
 function networkError(bucket, cause) {
   const detail = cause instanceof Error ? cause.message : String(cause);
   return new GpcError(
@@ -4160,6 +4270,14 @@ function networkError(bucket, cause) {
     "Check your internet connection and retry. Google Cloud Storage may also be briefly unavailable."
   );
 }
+function tooLargeError(objectName, maxBytes) {
+  return new GpcError(
+    `Report object "${objectName}" is larger than the ${maxBytes}-byte download limit.`,
+    "REPORT_DOWNLOAD_FAILED",
+    4,
+    "Play bulk reports are far smaller than this; confirm the bucket and object name, then download the file from Play Console -> Download reports if you really need it."
+  );
+}
 function maxRetries() {
   const parsed = Number(process.env["GPC_MAX_RETRIES"]);
   return Number.isInteger(parsed) && parsed >= 0 && parsed <= 10 ? parsed : 3;
@@ -4226,7 +4344,8 @@ async function listReportObjects(auth, bucket, options) {
   }));
   return { objects, nextPageToken: body.nextPageToken };
 }
-async function downloadReportObject(auth, bucket, objectName) {
+async function downloadReportObject(auth, bucket, objectName, options = {}) {
+  const maxBytes = options.maxBytes ?? MAX_DOWNLOAD_BYTES;
   const url = `${GCS_API_BASE}/${encodeURIComponent(bucket)}/o/${encodeURIComponent(objectName)}?alt=media`;
   const res = await gcsFetch(auth, bucket, url, DOWNLOAD_TIMEOUT_MS);
   if (res.status === 404) {
@@ -4245,11 +4364,25 @@ async function downloadReportObject(auth, bucket, objectName) {
       "Retry in a moment. If the error persists, list the reports to confirm the object still exists."
     );
   }
+  const declared = Number(res.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > maxBytes) {
+    throw tooLargeError(objectName, maxBytes);
+  }
+  const body = res.body;
+  if (!body) return Buffer.alloc(0);
+  const chunks = [];
+  let read = 0;
   try {
-    return Buffer.from(await res.arrayBuffer());
+    for await (const chunk of body) {
+      read += chunk.length;
+      if (read > maxBytes) throw tooLargeError(objectName, maxBytes);
+      chunks.push(Buffer.from(chunk));
+    }
   } catch (err) {
+    if (err instanceof GpcError) throw err;
     throw networkError(bucket, err);
   }
+  return Buffer.concat(chunks);
 }
 
 // src/reports/decode.ts
@@ -4285,13 +4418,15 @@ function decodeStatsCsv(buf) {
   return decodeCsvText(gunzipIfNeeded(buf));
 }
 var ZIP_READ_TIMEOUT_MS = 3e4;
-function extractCsvEntriesFromZip(buffer) {
+var MAX_CSV_ENTRIES = 64;
+function extractCsvEntriesFromZip(buffer, options = {}) {
+  const maxEntryBytes = options.maxEntryBytes ?? MAX_INFLATED_BYTES;
+  const maxTotalBytes = options.maxTotalBytes ?? MAX_INFLATED_BYTES;
   return new Promise((resolve2, reject) => {
     let settled = false;
     const timer = setTimeout(() => {
       settleReject(new Error("Timed out reading report archive"));
     }, ZIP_READ_TIMEOUT_MS);
-    timer.unref?.();
     function settleResolve(v) {
       if (settled) return;
       settled = true;
@@ -4314,6 +4449,8 @@ function extractCsvEntriesFromZip(buffer) {
         const entries = [];
         let pending = 0;
         let entriesDone = false;
+        let csvEntries = 0;
+        let totalBytes = 0;
         function fail(e) {
           try {
             zipfile.close();
@@ -4329,6 +4466,10 @@ function extractCsvEntriesFromZip(buffer) {
             zipfile.readEntry();
             return;
           }
+          if (++csvEntries > MAX_CSV_ENTRIES) {
+            fail(new Error(`Report archive holds more than ${MAX_CSV_ENTRIES} CSV entries`));
+            return;
+          }
           pending++;
           zipfile.openReadStream(entry, (streamErr, stream) => {
             if (streamErr || !stream) {
@@ -4336,10 +4477,35 @@ function extractCsvEntriesFromZip(buffer) {
               return;
             }
             const chunks = [];
-            stream.on("data", (c) => chunks.push(c));
+            let read = 0;
+            stream.on("data", (c) => {
+              read += c.length;
+              if (read > maxEntryBytes) {
+                stream.destroy();
+                fail(
+                  new Error(
+                    `Entry "${entry.fileName}" exceeds the ${maxEntryBytes}-byte limit for a report CSV`
+                  )
+                );
+                return;
+              }
+              chunks.push(c);
+            });
             stream.on("error", fail);
             stream.on("end", () => {
-              entries.push({ name: entry.fileName, text: decodeStatsCsv(Buffer.concat(chunks)) });
+              let text;
+              try {
+                text = decodeStatsCsv(Buffer.concat(chunks));
+              } catch (e) {
+                fail(e instanceof Error ? e : new Error(String(e)));
+                return;
+              }
+              totalBytes += text.length;
+              if (totalBytes > maxTotalBytes) {
+                fail(new Error(`Report archive exceeds the ${maxTotalBytes}-byte total limit`));
+                return;
+              }
+              entries.push({ name: entry.fileName, text });
               pending--;
               zipfile.readEntry();
               maybeResolve();
@@ -5364,10 +5530,9 @@ async function advanceTrain(apiClient, reportingClient, packageName) {
   if (state.gates) {
     if (state.gates.crashes?.max !== void 0) {
       const result = await getVitalsCrashes(reportingClient, packageName, { days: 1 });
-      const latestRow = result.rows?.[result.rows.length - 1];
-      const firstMetric = latestRow?.metrics ? Object.keys(latestRow.metrics)[0] : void 0;
-      const value = firstMetric ? Number(latestRow?.metrics[firstMetric]?.decimalValue?.value) : void 0;
-      if (value !== void 0 && value > state.gates.crashes.max / 100) {
+      const value = latestWorstValue(result.rows, "crashRate");
+      if (value === void 0) throw trainGateNoData("Crash", "crashes");
+      if (value > state.gates.crashes.max / 100) {
         state.status = "paused";
         state.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
         await writeTrainState(packageName, state);
@@ -5381,10 +5546,9 @@ async function advanceTrain(apiClient, reportingClient, packageName) {
     }
     if (state.gates.anr?.max !== void 0) {
       const result = await getVitalsAnr(reportingClient, packageName, { days: 1 });
-      const latestRow = result.rows?.[result.rows.length - 1];
-      const firstMetric = latestRow?.metrics ? Object.keys(latestRow.metrics)[0] : void 0;
-      const value = firstMetric ? Number(latestRow?.metrics[firstMetric]?.decimalValue?.value) : void 0;
-      if (value !== void 0 && value > state.gates.anr.max / 100) {
+      const value = latestWorstValue(result.rows, "anrRate");
+      if (value === void 0) throw trainGateNoData("ANR", "anr");
+      if (value > state.gates.anr.max / 100) {
         state.status = "paused";
         state.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
         await writeTrainState(packageName, state);
@@ -5416,6 +5580,14 @@ async function executeStage(apiClient, packageName, state, stageIndex) {
   state.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
   await writeTrainState(packageName, state);
 }
+function trainGateNoData(label, command) {
+  return new GpcError(
+    `${label} gate has no data to check, so the train was not advanced.`,
+    "TRAIN_GATE_NO_DATA",
+    6,
+    `Vitals data often lags 2-4 days. Run the train again later, or check with: gpc vitals ${command} --days 3`
+  );
+}
 
 // src/commands/games.ts
 import { mkdir as mkdir5, readdir as readdir4, readFile as readFile9, writeFile as writeFile5 } from "fs/promises";
@@ -5458,11 +5630,11 @@ async function getAchievementConfig(client, achievementId) {
 }
 async function createAchievementConfig(client, applicationId, data) {
   validateApplicationId(applicationId);
-  return client.achievements.insert(applicationId, data);
+  return client.achievements.insert(applicationId, withoutRedactedToken(data));
 }
 async function updateAchievementConfig(client, achievementId, data) {
   validateResourceId(achievementId, "achievement");
-  return client.achievements.update(achievementId, data);
+  return client.achievements.update(achievementId, withoutRedactedToken(data));
 }
 async function deleteAchievementConfig(client, achievementId) {
   validateResourceId(achievementId, "achievement");
@@ -5494,11 +5666,11 @@ async function getLeaderboardConfig(client, leaderboardId) {
 }
 async function createLeaderboardConfig(client, applicationId, data) {
   validateApplicationId(applicationId);
-  return client.leaderboards.insert(applicationId, data);
+  return client.leaderboards.insert(applicationId, withoutRedactedToken(data));
 }
 async function updateLeaderboardConfig(client, leaderboardId, data) {
   validateResourceId(leaderboardId, "leaderboard");
-  return client.leaderboards.update(leaderboardId, data);
+  return client.leaderboards.update(leaderboardId, withoutRedactedToken(data));
 }
 async function deleteLeaderboardConfig(client, leaderboardId) {
   validateResourceId(leaderboardId, "leaderboard");
@@ -5556,6 +5728,11 @@ async function setLeaderboardIcon(client, leaderboardId, filePath) {
     iconContentType(filePath)
   );
 }
+function withoutRedactedToken(config) {
+  if (config.token !== REDACTED) return config;
+  const { token: _token, ...rest } = config;
+  return rest;
+}
 function safeConfigFilename(id) {
   return `${id.replace(/[^a-zA-Z0-9_-]/g, "_")}.json`;
 }
@@ -5583,7 +5760,7 @@ async function readConfigDir(dir) {
         "Each file must contain a single achievement or leaderboard config object."
       );
     }
-    out.push({ file, config: parsed });
+    out.push({ file, config: withoutRedactedToken(parsed) });
   }
   return out;
 }
@@ -6293,6 +6470,7 @@ var SO_PATH_RE = /(?:^|\/)lib\/[^/]+\/[^/]+\.so$/;
 var MODULE_MANIFEST_RE = /^([^/]+)\/manifest\/AndroidManifest\.xml$/;
 var MAX_MODULE_MANIFEST_BYTES = 1024 * 1024;
 var MAX_MODULE_MANIFESTS = 256;
+var MAX_SO_HEADER_READS = 512;
 var SCAN_TIMEOUT_MS = 6e4;
 function detectManifestPath(filePath) {
   return filePath.toLowerCase().endsWith(".apk") ? APK_MANIFEST_PATH : AAB_MANIFEST_PATH;
@@ -6390,6 +6568,7 @@ function openAndScan(buffer, manifestPath = AAB_MANIFEST_PATH) {
         const soHeaders = /* @__PURE__ */ new Map();
         const moduleManifests = /* @__PURE__ */ new Map();
         let moduleManifestReads = 0;
+        let soHeaderReads = 0;
         let manifestBuf = null;
         let pendingStreams = 0;
         let entrysDone = false;
@@ -6406,6 +6585,10 @@ function openAndScan(buffer, manifestPath = AAB_MANIFEST_PATH) {
             settleResolve({ zipfile, entries, manifestBuf, soHeaders, moduleManifests });
           }
         }
+        function advance() {
+          if (settled) return;
+          zipfile.readEntry();
+        }
         function readEntryStream(entry, onData, maxBytes, optional = false) {
           pendingStreams++;
           let done = false;
@@ -6417,6 +6600,7 @@ function openAndScan(buffer, manifestPath = AAB_MANIFEST_PATH) {
             if (done) return;
             done = true;
             pendingStreams--;
+            advance();
             maybeResolve();
           };
           zipfile.openReadStream(entry, (streamErr, stream) => {
@@ -6443,6 +6627,7 @@ function openAndScan(buffer, manifestPath = AAB_MANIFEST_PATH) {
               const buf = Buffer.concat(chunks);
               onData(maxBytes ? buf.subarray(0, maxBytes) : buf);
               pendingStreams--;
+              advance();
               maybeResolve();
             };
             stream.on("end", finish);
@@ -6479,7 +6664,8 @@ function openAndScan(buffer, manifestPath = AAB_MANIFEST_PATH) {
                 MAX_MODULE_MANIFEST_BYTES,
                 true
               );
-            } else if (SO_PATH_RE.test(path)) {
+            } else if (SO_PATH_RE.test(path) && soHeaderReads < MAX_SO_HEADER_READS) {
+              soHeaderReads++;
               readEntryStream(
                 entry,
                 (buf) => {
@@ -6487,8 +6673,9 @@ function openAndScan(buffer, manifestPath = AAB_MANIFEST_PATH) {
                 },
                 SO_HEADER_BYTES
               );
+            } else {
+              advance();
             }
-            zipfile.readEntry();
           } catch (e) {
             fail(e instanceof Error ? e : new Error(String(e)));
           }
@@ -7044,6 +7231,20 @@ var nativeLibsScanner = {
       });
     }
     check16KBAlignment(ctx.nativeLibHeaders, ctx.manifest, findings);
+    if (ctx.nativeLibHeaders) {
+      const soCount = entries.filter((e) => nativeLibAbi(e.path) && e.path.endsWith(".so")).length;
+      const unchecked = soCount - ctx.nativeLibHeaders.size;
+      if (unchecked > 0) {
+        findings.push({
+          scanner: "native-libs",
+          ruleId: "native-libs-16kb-unchecked",
+          severity: "warning",
+          title: `${unchecked} of ${soCount} native libraries not checked for 16KB alignment`,
+          message: `Preflight checked the first ${ctx.nativeLibHeaders.size} native libraries in this bundle; the remaining ${unchecked} were not inspected, so a misaligned library among them would not be reported.`,
+          suggestion: "Verify alignment of the full bundle with Android Studio's APK Analyzer or `zipalign -c -P 16 -v 4 app.apk` on a universal APK."
+        });
+      }
+    }
     const detectedAbis = KNOWN_ABIS.filter((abi) => abisFound.has(abi));
     const unknownAbis = [...abisFound].filter(
       (abi) => !KNOWN_ABIS.includes(abi)
@@ -9807,7 +10008,7 @@ async function sha256File(filePath) {
 }
 
 // src/commands/image-sync.ts
-import { readdir as readdir7, stat as stat10 } from "fs/promises";
+import { readdir as readdir7 } from "fs/promises";
 import { join as join13, extname as extname5 } from "path";
 import { PlayApiError } from "@gpc-cli/api";
 var IMAGE_EXTENSIONS = /* @__PURE__ */ new Set([".png", ".jpg", ".jpeg"]);
@@ -9822,12 +10023,20 @@ var ALL_IMAGE_TYPES2 = [
   "wearScreenshots"
 ];
 async function scanLocalImages(dir) {
+  let entries;
   try {
-    const entries = await readdir7(dir, { withFileTypes: true });
-    return entries.filter((e) => e.isFile() && IMAGE_EXTENSIONS.has(extname5(e.name).toLowerCase())).map((e) => e.name).sort();
-  } catch {
-    return [];
+    entries = await readdir7(dir, { withFileTypes: true });
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return null;
+    throw new GpcError(
+      `Cannot read image directory "${dir}": ${code ?? String(error)}`,
+      "IMAGE_SYNC_DIR_UNREADABLE",
+      1,
+      "Check the directory's permissions (and container volume ownership in CI). Nothing was changed on Google Play."
+    );
   }
+  return entries.filter((e) => e.isFile() && IMAGE_EXTENSIONS.has(extname5(e.name).toLowerCase())).map((e) => e.name).sort();
 }
 async function scanLanguages(dir) {
   try {
@@ -9837,13 +10046,6 @@ async function scanLanguages(dir) {
     return [];
   }
 }
-async function dirExists(path) {
-  try {
-    return (await stat10(path)).isDirectory();
-  } catch {
-    return false;
-  }
-}
 async function syncImages(client, packageName, dir, options) {
   const details = [];
   let uploaded = 0;
@@ -9864,7 +10066,8 @@ async function syncImages(client, packageName, dir, options) {
     for (const language of languages) {
       for (const imageType of imageTypes) {
         const localDir = join13(dir, language, imageType);
-        const localFiles = await scanLocalImages(localDir);
+        const scanned = await scanLocalImages(localDir);
+        const localFiles = scanned ?? [];
         let remoteImages;
         try {
           remoteImages = await client.images.list(packageName, edit.id, language, imageType);
@@ -9906,7 +10109,7 @@ async function syncImages(client, packageName, dir, options) {
           details.push({ language, imageType, file, action: "upload", reason });
         };
         if (options?.delete) {
-          if (localFiles.length === 0 && remoteImages.length > 0 && !await dirExists(localDir)) {
+          if (scanned === null && remoteImages.length > 0) {
             for (const img of remoteImages) {
               details.push({
                 language,
@@ -10326,6 +10529,7 @@ export {
   analyzeReviews2 as analyzeReviews,
   annotateListResult,
   applyReleaseNotes,
+  assertRateThreshold,
   assignRelease,
   batchGetOrders,
   batchSyncInAppProducts,
@@ -10480,6 +10684,7 @@ export {
   isValidStatsDimension,
   isVersionedNotesDir,
   isZip,
+  latestWorstValue,
   lintListing,
   lintListings,
   lintLocalListings,
@@ -10531,6 +10736,7 @@ export {
   pushLeaderboardConfigs,
   pushListings,
   readListingsFromDir,
+  readMetricValue,
   readReleaseNotesForVersion,
   readReleaseNotesFromDir,
   readinessBadgeColor,
@@ -10620,6 +10826,7 @@ export {
   waitForBundleProcessing,
   watchVitalsWithAutoHalt,
   wordDiff,
+  worstSliceAverage,
   writeAuditLog,
   writeListingsToDir,
   writeMigrationOutput