@gpc-cli/core 0.9.10 → 0.9.12

package/dist/index.d.ts

@@ -30,6 +30,7 @@ declare class NetworkError extends GpcError {
 
 declare function detectOutputFormat(): OutputFormat;
 declare function formatOutput(data: unknown, format: OutputFormat, redact?: boolean): string;
+declare const SENSITIVE_KEYS: Set<string>;
 /** Recursively redact sensitive fields from data before output. */
 declare function redactSensitive(data: unknown): unknown;
 declare function formatJunit(data: unknown, commandName?: string): string;
@@ -235,6 +236,12 @@ declare function writeMigrationOutput(result: MigrationResult, dir: string): Pro
 declare const GOOGLE_PLAY_LANGUAGES: string[];
 declare function isValidBcp47(tag: string): boolean;
 
+declare function validatePackageName(name: string): void;
+declare function validateVersionCode(code: string | number): void;
+declare function validateLanguageCode(code: string): void;
+declare function validateTrackName(name: string): void;
+declare function validateSku(sku: string): void;
+
 interface FileValidationResult {
     valid: boolean;
     fileType: "aab" | "apk" | "unknown";
@@ -593,6 +600,9 @@ declare function initAudit(configDir: string): void;
  * Write an audit log entry. Non-blocking — errors are silently ignored.
  */
 declare function writeAuditLog(entry: AuditEntry): Promise<void>;
+declare const SENSITIVE_ARG_KEYS: Set<string>;
+
+declare function redactAuditArgs(entry: AuditEntry): AuditEntry;
 /**
  * Convenience: create an audit entry for a write command.
  */
@@ -631,4 +641,4 @@ declare function createPurchaseOption(client: PlayApiClient, packageName: string
 declare function activatePurchaseOption(client: PlayApiClient, packageName: string, purchaseOptionId: string): Promise<PurchaseOption>;
 declare function deactivatePurchaseOption(client: PlayApiClient, packageName: string, purchaseOptionId: string): Promise<PurchaseOption>;
 
-export { ApiError, type AppInfo, type AuditEntry, type BatchSyncResult, type CommandContext, ConfigError, type DiscoverPluginsOptions, type DryRunPublishResult, type DryRunResult, type DryRunUploadResult, type ExportImagesOptions, type ExportImagesSummary, type FastlaneDetection, type FastlaneLane, type FileValidationResult, GOOGLE_PLAY_LANGUAGES, type GitNotesOptions, type GitReleaseNotes, GpcError, type ImageValidationResult, type InternalSharingUploadResult, type ListIapOptions, type ListSubscriptionsOptions, type ListUsersOptions, type ListVoidedOptions, type ListingDiff, type ListingsResult, type LoadedPlugin, type MigrationResult, NetworkError, PERMISSION_PROPAGATION_WARNING, type ParsedMonth, PluginManager, type PublishOptions, type PublishResult, type PushResult, type ReleaseNotesValidation, type ReleaseStatusResult, type ReviewExportOptions, type ReviewsFilterOptions, type ScaffoldOptions, type ScaffoldResult, type Spinner, type SyncResult, type ThresholdResult, type UploadResult, type ValidateCheck, type ValidateOptions, type ValidateResult, type VitalsOverview, type VitalsQueryOptions, type VitalsTrendComparison, type WebhookPayload, acknowledgeProductPurchase, activateBasePlan, activateOffer, activatePurchaseOption, addRecoveryTargeting, addTesters, batchSyncInAppProducts, cancelRecoveryAction, cancelSubscriptionPurchase, checkThreshold, compareVitalsTrend, consumeProductPurchase, convertRegionPrices, createAuditEntry, createDeviceTier, createExternalTransaction, createInAppProduct, createOffer, createOneTimeOffer, createOneTimeProduct, createPurchaseOption, createRecoveryAction, createSpinner, createSubscription, createTrack, deactivateBasePlan, deactivateOffer, deactivatePurchaseOption, deferSubscriptionPurchase, deleteBasePlan, deleteImage, deleteInAppProduct, deleteListing, deleteOffer, deleteOneTimeOffer, deleteOneTimeProduct, deleteSubscription, deployRecoveryAction, detectFastlane, detectOutputFormat, diffListings, diffListingsCommand, discoverPlugins, downloadGeneratedApk, downloadReport, exportDataSafety, exportImages, exportReviews, formatCustomPayload, formatDiscordPayload, formatJunit, formatOutput, formatSlackPayload, generateMigrationPlan, generateNotesFromGit, getAppInfo, getCountryAvailability, getDataSafety, getDeviceTier, getExternalTransaction, getInAppProduct, getListings, getOffer, getOneTimeOffer, getOneTimeProduct, getProductPurchase, getPurchaseOption, getReleasesStatus, getReview, getSubscription, getSubscriptionPurchase, getUser, getVitalsAnomalies, getVitalsAnr, getVitalsBattery, getVitalsCrashes, getVitalsMemory, getVitalsOverview, getVitalsRendering, getVitalsStartup, importDataSafety, importTestersFromCsv, initAudit, inviteUser, isFinancialReportType, isStatsReportType, isValidBcp47, isValidReportType, isValidStatsDimension, listDeviceTiers, listGeneratedApks, listImages, listInAppProducts, listOffers, listOneTimeOffers, listOneTimeProducts, listPurchaseOptions, listRecoveryActions, listReports, listReviews, listSubscriptions, listTesters, listTracks, listUsers, listVoidedPurchases, migratePrices, parseAppfile, parseFastfile, parseGrantArg, parseMonth, promoteRelease, publish, pullListings, pushListings, readListingsFromDir, readReleaseNotesFromDir, redactSensitive, refundExternalTransaction, refundOrder, removeTesters, removeUser, replyToReview, revokeSubscriptionPurchase, safePath, safePathWithin, scaffoldPlugin, searchVitalsErrors, sendWebhook, sortResults, syncInAppProducts, updateAppDetails, updateDataSafety, updateInAppProduct, updateListing, updateOffer, updateOneTimeOffer, updateOneTimeProduct, updateRollout, updateSubscription, updateTrackConfig, updateUser, uploadExternallyHosted, uploadImage, uploadInternalSharing, uploadRelease, validateImage, validatePreSubmission, validateReleaseNotes, validateUploadFile, writeAuditLog, writeListingsToDir, writeMigrationOutput };
+export { ApiError, type AppInfo, type AuditEntry, type BatchSyncResult, type CommandContext, ConfigError, type DiscoverPluginsOptions, type DryRunPublishResult, type DryRunResult, type DryRunUploadResult, type ExportImagesOptions, type ExportImagesSummary, type FastlaneDetection, type FastlaneLane, type FileValidationResult, GOOGLE_PLAY_LANGUAGES, type GitNotesOptions, type GitReleaseNotes, GpcError, type ImageValidationResult, type InternalSharingUploadResult, type ListIapOptions, type ListSubscriptionsOptions, type ListUsersOptions, type ListVoidedOptions, type ListingDiff, type ListingsResult, type LoadedPlugin, type MigrationResult, NetworkError, PERMISSION_PROPAGATION_WARNING, type ParsedMonth, PluginManager, type PublishOptions, type PublishResult, type PushResult, type ReleaseNotesValidation, type ReleaseStatusResult, type ReviewExportOptions, type ReviewsFilterOptions, SENSITIVE_ARG_KEYS, SENSITIVE_KEYS, type ScaffoldOptions, type ScaffoldResult, type Spinner, type SyncResult, type ThresholdResult, type UploadResult, type ValidateCheck, type ValidateOptions, type ValidateResult, type VitalsOverview, type VitalsQueryOptions, type VitalsTrendComparison, type WebhookPayload, acknowledgeProductPurchase, activateBasePlan, activateOffer, activatePurchaseOption, addRecoveryTargeting, addTesters, batchSyncInAppProducts, cancelRecoveryAction, cancelSubscriptionPurchase, checkThreshold, compareVitalsTrend, consumeProductPurchase, convertRegionPrices, createAuditEntry, createDeviceTier, createExternalTransaction, createInAppProduct, createOffer, createOneTimeOffer, createOneTimeProduct, createPurchaseOption, createRecoveryAction, createSpinner, createSubscription, createTrack, deactivateBasePlan, deactivateOffer, deactivatePurchaseOption, deferSubscriptionPurchase, deleteBasePlan, deleteImage, deleteInAppProduct, deleteListing, deleteOffer, deleteOneTimeOffer, deleteOneTimeProduct, deleteSubscription, deployRecoveryAction, detectFastlane, detectOutputFormat, diffListings, diffListingsCommand, discoverPlugins, downloadGeneratedApk, downloadReport, exportDataSafety, exportImages, exportReviews, formatCustomPayload, formatDiscordPayload, formatJunit, formatOutput, formatSlackPayload, generateMigrationPlan, generateNotesFromGit, getAppInfo, getCountryAvailability, getDataSafety, getDeviceTier, getExternalTransaction, getInAppProduct, getListings, getOffer, getOneTimeOffer, getOneTimeProduct, getProductPurchase, getPurchaseOption, getReleasesStatus, getReview, getSubscription, getSubscriptionPurchase, getUser, getVitalsAnomalies, getVitalsAnr, getVitalsBattery, getVitalsCrashes, getVitalsMemory, getVitalsOverview, getVitalsRendering, getVitalsStartup, importDataSafety, importTestersFromCsv, initAudit, inviteUser, isFinancialReportType, isStatsReportType, isValidBcp47, isValidReportType, isValidStatsDimension, listDeviceTiers, listGeneratedApks, listImages, listInAppProducts, listOffers, listOneTimeOffers, listOneTimeProducts, listPurchaseOptions, listRecoveryActions, listReports, listReviews, listSubscriptions, listTesters, listTracks, listUsers, listVoidedPurchases, migratePrices, parseAppfile, parseFastfile, parseGrantArg, parseMonth, promoteRelease, publish, pullListings, pushListings, readListingsFromDir, readReleaseNotesFromDir, redactAuditArgs, redactSensitive, refundExternalTransaction, refundOrder, removeTesters, removeUser, replyToReview, revokeSubscriptionPurchase, safePath, safePathWithin, scaffoldPlugin, searchVitalsErrors, sendWebhook, sortResults, syncInAppProducts, updateAppDetails, updateDataSafety, updateInAppProduct, updateListing, updateOffer, updateOneTimeOffer, updateOneTimeProduct, updateRollout, updateSubscription, updateTrackConfig, updateUser, uploadExternallyHosted, uploadImage, uploadInternalSharing, uploadRelease, validateImage, validateLanguageCode, validatePackageName, validatePreSubmission, validateReleaseNotes, validateSku, validateTrackName, validateUploadFile, validateVersionCode, writeAuditLog, writeListingsToDir, writeMigrationOutput };

package/dist/index.js

@@ -74,7 +74,20 @@ var SENSITIVE_KEYS = /* @__PURE__ */ new Set([
   "token",
   "password",
   "secret",
-  "credentials"
+  "credentials",
+  "keyFile",
+  "key_file",
+  "serviceAccount",
+  "service-account",
+  "apiKey",
+  "api_key",
+  "auth_token",
+  "bearer",
+  "jwt",
+  "signing_key",
+  "keystore_password",
+  "store_password",
+  "key_password"
 ]);
 var REDACTED = "[REDACTED]";
 function redactSensitive(data) {
@@ -1535,6 +1548,71 @@ async function writeMigrationOutput(result, dir) {
   return files;
 }
 
+// src/utils/validation.ts
+var PACKAGE_NAME_RE = /^[a-zA-Z][a-zA-Z0-9_]*(\.[a-zA-Z][a-zA-Z0-9_]*){1,}$/;
+var SKU_RE = /^[a-zA-Z0-9._]+$/;
+var TRACK_NAMES = ["internal", "alpha", "beta", "production"];
+var CUSTOM_TRACK_RE = /^[a-zA-Z0-9\-_]+$/;
+function validatePackageName(name) {
+  if (!name || !PACKAGE_NAME_RE.test(name)) {
+    throw new GpcError(
+      `Invalid package name: "${name}"`,
+      "INVALID_PACKAGE_NAME",
+      2,
+      "Package name must be a valid Android application ID (e.g., com.example.myapp)"
+    );
+  }
+}
+function validateVersionCode(code) {
+  const num = typeof code === "string" ? parseInt(code, 10) : code;
+  if (!Number.isInteger(num) || num < 1) {
+    throw new GpcError(
+      `Invalid version code: "${code}"`,
+      "INVALID_VERSION_CODE",
+      2,
+      "Version code must be a positive integer (e.g., 142)"
+    );
+  }
+}
+function validateLanguageCode(code) {
+  if (!code || !isValidBcp47(code)) {
+    throw new GpcError(
+      `Invalid language code: "${code}"`,
+      "INVALID_LANGUAGE_CODE",
+      2,
+      "Language code must be a valid BCP-47 tag supported by Google Play (e.g., en-US, ja-JP, fr-FR)"
+    );
+  }
+}
+function validateTrackName(name) {
+  if (!name) {
+    throw new GpcError(
+      "Track name is required",
+      "INVALID_TRACK_NAME",
+      2,
+      "Specify a track: internal, alpha, beta, production, or a custom track name"
+    );
+  }
+  if (!TRACK_NAMES.includes(name) && !CUSTOM_TRACK_RE.test(name)) {
+    throw new GpcError(
+      `Invalid track name: "${name}"`,
+      "INVALID_TRACK_NAME",
+      2,
+      `Valid tracks: ${TRACK_NAMES.join(", ")}, or a custom track matching [a-zA-Z0-9-_]+`
+    );
+  }
+}
+function validateSku(sku) {
+  if (!sku || !SKU_RE.test(sku)) {
+    throw new GpcError(
+      `Invalid product ID (SKU): "${sku}"`,
+      "INVALID_SKU",
+      2,
+      "Product ID must contain only letters, numbers, dots, and underscores (e.g., premium_upgrade)"
+    );
+  }
+}
+
 // src/utils/release-notes.ts
 import { readdir as readdir3, readFile as readFile4, stat as stat4 } from "fs/promises";
 import { extname as extname3, basename, join as join3 } from "path";
@@ -1971,6 +2049,7 @@ function checkThreshold(value, threshold) {
 // src/commands/subscriptions.ts
 import { paginateAll as paginateAll2 } from "@gpc-cli/api";
 async function listSubscriptions(client, packageName, options) {
+  validatePackageName(packageName);
   if (options?.limit || options?.nextPage) {
     const result = await paginateAll2(
       async (pageToken) => {
@@ -1990,39 +2069,62 @@ async function listSubscriptions(client, packageName, options) {
   });
 }
 async function getSubscription(client, packageName, productId) {
+  validatePackageName(packageName);
+  validateSku(productId);
   return client.subscriptions.get(packageName, productId);
 }
 async function createSubscription(client, packageName, data) {
+  validatePackageName(packageName);
   return client.subscriptions.create(packageName, data);
 }
 async function updateSubscription(client, packageName, productId, data, updateMask) {
+  validatePackageName(packageName);
+  validateSku(productId);
   return client.subscriptions.update(packageName, productId, data, updateMask);
 }
 async function deleteSubscription(client, packageName, productId) {
+  validatePackageName(packageName);
+  validateSku(productId);
   return client.subscriptions.delete(packageName, productId);
 }
 async function activateBasePlan(client, packageName, productId, basePlanId) {
+  validatePackageName(packageName);
+  validateSku(productId);
   return client.subscriptions.activateBasePlan(packageName, productId, basePlanId);
 }
 async function deactivateBasePlan(client, packageName, productId, basePlanId) {
+  validatePackageName(packageName);
+  validateSku(productId);
   return client.subscriptions.deactivateBasePlan(packageName, productId, basePlanId);
 }
 async function deleteBasePlan(client, packageName, productId, basePlanId) {
+  validatePackageName(packageName);
+  validateSku(productId);
   return client.subscriptions.deleteBasePlan(packageName, productId, basePlanId);
 }
 async function migratePrices(client, packageName, productId, basePlanId, data) {
+  validatePackageName(packageName);
+  validateSku(productId);
   return client.subscriptions.migratePrices(packageName, productId, basePlanId, data);
 }
 async function listOffers(client, packageName, productId, basePlanId) {
+  validatePackageName(packageName);
+  validateSku(productId);
   return client.subscriptions.listOffers(packageName, productId, basePlanId);
 }
 async function getOffer(client, packageName, productId, basePlanId, offerId) {
+  validatePackageName(packageName);
+  validateSku(productId);
   return client.subscriptions.getOffer(packageName, productId, basePlanId, offerId);
 }
 async function createOffer(client, packageName, productId, basePlanId, data) {
+  validatePackageName(packageName);
+  validateSku(productId);
   return client.subscriptions.createOffer(packageName, productId, basePlanId, data);
 }
 async function updateOffer(client, packageName, productId, basePlanId, offerId, data, updateMask) {
+  validatePackageName(packageName);
+  validateSku(productId);
   return client.subscriptions.updateOffer(
     packageName,
     productId,
@@ -2033,12 +2135,18 @@ async function updateOffer(client, packageName, productId, basePlanId, offerId,
   );
 }
 async function deleteOffer(client, packageName, productId, basePlanId, offerId) {
+  validatePackageName(packageName);
+  validateSku(productId);
   return client.subscriptions.deleteOffer(packageName, productId, basePlanId, offerId);
 }
 async function activateOffer(client, packageName, productId, basePlanId, offerId) {
+  validatePackageName(packageName);
+  validateSku(productId);
   return client.subscriptions.activateOffer(packageName, productId, basePlanId, offerId);
 }
 async function deactivateOffer(client, packageName, productId, basePlanId, offerId) {
+  validatePackageName(packageName);
+  validateSku(productId);
   return client.subscriptions.deactivateOffer(packageName, productId, basePlanId, offerId);
 }
 
@@ -2200,22 +2308,28 @@ async function batchSyncInAppProducts(client, packageName, dir, options) {
 // src/commands/purchases.ts
 import { paginateAll as paginateAll4 } from "@gpc-cli/api";
 async function getProductPurchase(client, packageName, productId, token) {
+  validatePackageName(packageName);
   return client.purchases.getProduct(packageName, productId, token);
 }
 async function acknowledgeProductPurchase(client, packageName, productId, token, payload) {
+  validatePackageName(packageName);
   const body = payload ? { developerPayload: payload } : void 0;
   return client.purchases.acknowledgeProduct(packageName, productId, token, body);
 }
 async function consumeProductPurchase(client, packageName, productId, token) {
+  validatePackageName(packageName);
   return client.purchases.consumeProduct(packageName, productId, token);
 }
 async function getSubscriptionPurchase(client, packageName, token) {
+  validatePackageName(packageName);
   return client.purchases.getSubscriptionV2(packageName, token);
 }
 async function cancelSubscriptionPurchase(client, packageName, subscriptionId, token) {
+  validatePackageName(packageName);
   return client.purchases.cancelSubscription(packageName, subscriptionId, token);
 }
 async function deferSubscriptionPurchase(client, packageName, subscriptionId, token, desiredExpiry) {
+  validatePackageName(packageName);
   const sub = await client.purchases.getSubscriptionV1(packageName, subscriptionId, token);
   return client.purchases.deferSubscription(packageName, subscriptionId, token, {
     deferralInfo: {
@@ -2225,9 +2339,11 @@ async function deferSubscriptionPurchase(client, packageName, subscriptionId, to
   });
 }
 async function revokeSubscriptionPurchase(client, packageName, token) {
+  validatePackageName(packageName);
   return client.purchases.revokeSubscriptionV2(packageName, token);
 }
 async function listVoidedPurchases(client, packageName, options) {
+  validatePackageName(packageName);
   if (options?.limit || options?.nextPage) {
     const result = await paginateAll4(
       async (pageToken) => {
@@ -2249,6 +2365,7 @@ async function listVoidedPurchases(client, packageName, options) {
   return client.purchases.listVoided(packageName, options);
 }
 async function refundOrder(client, packageName, orderId, options) {
+  validatePackageName(packageName);
   return client.orders.refund(packageName, orderId, options);
 }
 
@@ -3112,9 +3229,8 @@ async function writeAuditLog(entry) {
   }
 }
 var SENSITIVE_ARG_KEYS = /* @__PURE__ */ new Set([
-  "key",
   "keyFile",
-  "key-file",
+  "key_file",
   "serviceAccount",
   "service-account",
   "token",
@@ -3122,7 +3238,24 @@ var SENSITIVE_ARG_KEYS = /* @__PURE__ */ new Set([
   "secret",
   "credentials",
   "private_key",
-  "client_secret"
+  "privateKey",
+  "private_key_id",
+  "privateKeyId",
+  "client_secret",
+  "clientSecret",
+  "accessToken",
+  "access_token",
+  "refreshToken",
+  "refresh_token",
+  "apiKey",
+  "api_key",
+  "auth_token",
+  "bearer",
+  "jwt",
+  "signing_key",
+  "keystore_password",
+  "store_password",
+  "key_password"
 ]);
 function redactAuditArgs(entry) {
   const redacted = {};
@@ -3389,6 +3522,8 @@ export {
   NetworkError,
   PERMISSION_PROPAGATION_WARNING,
   PluginManager,
+  SENSITIVE_ARG_KEYS,
+  SENSITIVE_KEYS,
   acknowledgeProductPurchase,
   activateBasePlan,
   activateOffer,
@@ -3505,6 +3640,7 @@ export {
   pushListings,
   readListingsFromDir,
   readReleaseNotesFromDir,
+  redactAuditArgs,
   redactSensitive,
   refundExternalTransaction,
   refundOrder,
@@ -3535,9 +3671,14 @@ export {
   uploadInternalSharing,
   uploadRelease,
   validateImage,
+  validateLanguageCode,
+  validatePackageName,
   validatePreSubmission,
   validateReleaseNotes,
+  validateSku,
+  validateTrackName,
   validateUploadFile,
+  validateVersionCode,
   writeAuditLog,
   writeListingsToDir,
   writeMigrationOutput