@gpc-cli/core 0.9.36 → 0.9.38

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { OutputFormat, ResolvedConfig, WebhookConfig } from '@gpc-cli/config';
 import { AuthClient } from '@gpc-cli/auth';
 import { GpcPlugin, PluginManifest, CommandEvent, CommandResult, PluginError, RequestEvent, ResponseEvent, PluginCommand } from '@gpc-cli/plugin-sdk';
-import { PlayApiClient, Track, ExternallyHostedApk, ExternallyHostedApkResponse, UploadProgressEvent, ResumableUploadOptions, Listing, ImageType, CountryAvailability, Image, AppDetails, Review, ReviewReplyResponse, Subscription, SubscriptionOffer, OffersListResponse, BasePlanMigratePricesRequest, InAppProduct, SubscriptionDeferResponse, ProductPurchase, SubscriptionPurchaseV2, VoidedPurchase, UsersApiClient, User, DeveloperPermission, Grant, MetricRow, ReportingDimension, ReportingAggregation, VitalsMetricSet, ReportingApiClient, AnomalyDetectionResponse, MetricSetResponse, ErrorIssuesResponse, ConvertRegionPricesResponse, ReportType, StatsDimension, ReportBucket, Testers, AppRecoveryTargeting, AppRecoveryAction, CreateAppRecoveryActionRequest, DataSafety, ExternalTransaction, ExternalTransactionRefund, DeviceTierConfig, OneTimeOffer, OneTimeProduct, OneTimeOffersListResponse, OneTimeProductsListResponse, GamesApiClient, Achievement, GameEvent, Leaderboard, EnterpriseApiClient, CustomApp, GeneratedApk, PurchaseOption, PurchaseOptionsListResponse } from '@gpc-cli/api';
+import { PlayApiClient, Track, ExternallyHostedApk, ExternallyHostedApkResponse, UploadProgressEvent, ResumableUploadOptions, Listing, ImageType, CountryAvailability, Image, AppDetails, Review, ReviewReplyResponse, Subscription, SubscriptionOffer, OffersListResponse, BasePlanMigratePricesRequest, InAppProduct, Order, SubscriptionDeferResponse, SubscriptionsV2DeferResponse, ProductPurchase, ProductPurchaseV2, SubscriptionPurchaseV2, VoidedPurchase, UsersApiClient, User, DeveloperPermission, Grant, MetricRow, ReportingDimension, ReportingAggregation, VitalsMetricSet, ReportingApiClient, AnomalyDetectionResponse, MetricSetResponse, ErrorIssuesResponse, ConvertRegionPricesResponse, ReportType, StatsDimension, ReportBucket, Testers, AppRecoveryTargeting, AppRecoveryAction, CreateAppRecoveryActionRequest, DataSafety, ExternalTransaction, ExternalTransactionRefund, DeviceTierConfig, OneTimeOffer, OneTimeProduct, OneTimeOffersListResponse, OneTimeProductsListResponse, GamesApiClient, Achievement, GameEvent, Leaderboard, EnterpriseApiClient, CustomApp, GeneratedApk, PurchaseOption, PurchaseOptionsListResponse } from '@gpc-cli/api';
 
 declare class GpcError extends Error {
     readonly code: string;
@@ -541,6 +541,11 @@ declare function refundOrder(client: PlayApiClient, packageName: string, orderId
     fullRefund?: boolean;
     proratedRefund?: boolean;
 }): Promise<void>;
+declare function getOrderDetails(client: PlayApiClient, packageName: string, orderId: string): Promise<Order>;
+declare function batchGetOrders(client: PlayApiClient, packageName: string, orderIds: string[]): Promise<Order[]>;
+declare function getProductPurchaseV2(client: PlayApiClient, packageName: string, token: string): Promise<ProductPurchaseV2>;
+declare function cancelSubscriptionV2(client: PlayApiClient, packageName: string, token: string, cancellationType?: string): Promise<void>;
+declare function deferSubscriptionV2(client: PlayApiClient, packageName: string, token: string, desiredExpiryTime: string): Promise<SubscriptionsV2DeferResponse>;
 
 declare const PERMISSION_PROPAGATION_WARNING = "Note: Permission changes may take up to 48 hours to propagate.";
 interface ListUsersOptions {
@@ -885,6 +890,8 @@ interface ParsedManifest {
     services: ManifestComponent[];
     receivers: ManifestComponent[];
     providers: ManifestComponent[];
+    /** Set when the manifest could not be fully parsed — manifest-dependent scanners should skip. */
+    _parseError?: string;
 }
 interface ManifestFeature {
     name: string;
@@ -1174,4 +1181,26 @@ declare function trackBreachState(packageName: string, isBreaching: boolean): Pr
 declare function sendNotification(title: string, body: string): void;
 declare function statusHasBreach(status: AppStatus): boolean;
 
-export { ApiError, type AppInfo, type AppStatus, type AuditEntry, type BatchSyncResult, type BundleAnalysis, type BundleComparison, type BundleEntry, type BundleSizeCheckResult, type BundleSizeConfig, type CommandContext, ConfigError, DEFAULT_LIMITS, DEFAULT_PREFLIGHT_CONFIG, type DiffToken, type DiscoverPluginsOptions, type DryRunPublishResult, type DryRunResult, type DryRunUploadResult, type ExportImagesOptions, type ExportImagesSummary, type FastlaneDetection, type FastlaneLane, type FieldLintResult, type FileValidationResult, type FindingSeverity, GOOGLE_PLAY_LANGUAGES, type GetAppStatusOptions, type GitNotesOptions, type GitReleaseNotes, GpcError, type ImageValidationResult, type InitOptions, type InitResult, type InternalSharingUploadResult, type ListIapOptions, type ListSubscriptionsOptions, type ListUsersOptions, type ListVoidedOptions, type ListingDiff, type ListingFieldLimits, type ListingLintResult, type ListingsResult, type LoadedPlugin, type MigrationResult, NetworkError, type OneTimeProductDiff, PERMISSION_PROPAGATION_WARNING, type ParsedManifest, type ParsedMonth, PluginManager, type PreflightConfig, type PreflightFinding, type PreflightOptions, type PreflightResult, type PreflightScanner, type PublishOptions, type PublishResult, type PushResult, type QuotaUsage, type ReleaseDiff, type ReleaseNotesValidation, type ReleaseStatusResult, type ReviewAnalysis, type ReviewExportOptions, type ReviewsFilterOptions, SENSITIVE_ARG_KEYS, SENSITIVE_KEYS, SEVERITY_ORDER, type ScaffoldOptions, type ScaffoldResult, type Spinner, type StatusDiff, type StatusRelease, type StatusReviews, type StatusVitalMetric, type SubscriptionAnalytics, type SubscriptionDiff, type SyncResult, type ThresholdResult, type TrainConfig, type TrainState, type UploadResult, type ValidateCheck, type ValidateOptions, type ValidateResult, type VersionVitalsComparison, type VersionVitalsRow, type VitalsOverview, type VitalsQueryOptions, type VitalsTrendComparison, type WatchOptions, type WatchVitalsOptions, type WebhookPayload, abortTrain, acknowledgeProductPurchase, activateBasePlan, activateOffer, activatePurchaseOption, addRecoveryTargeting, addTesters, advanceTrain, analyzeBundle, analyzeRemoteListings, analyzeReviews, batchSyncInAppProducts, cancelRecoveryAction, cancelSubscriptionPurchase, checkBundleSize, checkThreshold, clearAuditLog, compareBundles, compareVersionVitals, compareVitalsTrend, computeStatusDiff, consumeProductPurchase, convertRegionPrices, createAuditEntry, createDeviceTier, createEnterpriseApp, createExternalTransaction, createGrant, createInAppProduct, createOffer, createOneTimeOffer, createOneTimeProduct, createPurchaseOption, createRecoveryAction, createSpinner, createSubscription, createTrack, deactivateBasePlan, deactivateOffer, deactivatePurchaseOption, deferSubscriptionPurchase, deleteBasePlan, deleteGrant, deleteImage, deleteInAppProduct, deleteListing, deleteOffer, deleteOneTimeOffer, deleteOneTimeProduct, deleteSubscription, deployRecoveryAction, detectFastlane, detectOutputFormat, diffListings, diffListingsCommand, diffListingsEnhanced, diffOneTimeProduct, diffReleases, diffSubscription, discoverPlugins, downloadGeneratedApk, downloadReport, exportDataSafety, exportImages, exportReviews, fetchReleaseNotes, formatCustomPayload, formatDiscordPayload, formatJunit, formatOutput, formatSlackPayload, formatStatusDiff, formatStatusSummary, formatStatusTable, formatWordDiff, generateMigrationPlan, generateNotesFromGit, getAllScannerNames, getAppInfo, getAppStatus, getCountryAvailability, getDataSafety, getDeviceTier, getExternalTransaction, getInAppProduct, getListings, getOffer, getOneTimeOffer, getOneTimeProduct, getProductPurchase, getPurchaseOption, getQuotaUsage, getReleasesStatus, getReview, getSubscription, getSubscriptionAnalytics, getSubscriptionPurchase, getTrainStatus, getUser, getVitalsAnomalies, getVitalsAnr, getVitalsBattery, getVitalsCrashes, getVitalsLmk, getVitalsMemory, getVitalsOverview, getVitalsRendering, getVitalsStartup, importDataSafety, importTestersFromCsv, initAudit, initProject, inviteUser, isFinancialReportType, isStatsReportType, isValidBcp47, isValidReportType, isValidStatsDimension, lintListing, lintListings, lintLocalListings, listAchievements, listAuditEvents, listDeviceTiers, listEnterpriseApps, listEvents, listGeneratedApks, listGrants, listImages, listInAppProducts, listLeaderboards, listOffers, listOneTimeOffers, listOneTimeProducts, listPurchaseOptions, listRecoveryActions, listReports, listReviews, listSubscriptions, listTesters, listTracks, listUsers, listVoidedPurchases, loadPreflightConfig, loadStatusCache, maybePaginate, migratePrices, parseAppfile, parseFastfile, parseGrantArg, parseMonth, pauseTrain, promoteRelease, publish, pullListings, pushListings, readListingsFromDir, readReleaseNotesFromDir, redactAuditArgs, redactSensitive, refundExternalTransaction, refundOrder, refundSubscriptionV2, removeTesters, removeUser, replyToReview, revokeSubscriptionPurchase, runPreflight, runWatchLoop, safePath, safePathWithin, saveStatusCache, scaffoldPlugin, searchAuditEvents, searchVitalsErrors, sendNotification, sendWebhook, sortResults, startTrain, statusHasBreach, syncInAppProducts, topFiles, trackBreachState, updateAppDetails, updateDataSafety, updateGrant, updateInAppProduct, updateListing, updateOffer, updateOneTimeOffer, updateOneTimeProduct, updateRollout, updateSubscription, updateTrackConfig, updateUser, uploadExternallyHosted, uploadImage, uploadInternalSharing, uploadRelease, validateImage, validateLanguageCode, validatePackageName, validatePreSubmission, validateReleaseNotes, validateSku, validateTrackName, validateUploadFile, validateVersionCode, watchVitalsWithAutoHalt, wordDiff, writeAuditLog, writeListingsToDir, writeMigrationOutput };
+interface ChangelogEntry {
+    version: string;
+    title: string;
+    date: string;
+    body: string;
+    url: string;
+}
+interface FetchChangelogOptions {
+    limit?: number;
+    version?: string;
+}
+/**
+ * Fetch release history from GitHub Releases API.
+ * Public endpoint — no auth required (60 req/hour rate limit).
+ */
+declare function fetchChangelog(options?: FetchChangelogOptions): Promise<ChangelogEntry[]>;
+/**
+ * Format a changelog entry as readable terminal text.
+ * Strips markdown formatting for clean terminal output.
+ */
+declare function formatChangelogEntry(entry: ChangelogEntry): string;
+
+export { ApiError, type AppInfo, type AppStatus, type AuditEntry, type BatchSyncResult, type BundleAnalysis, type BundleComparison, type BundleEntry, type BundleSizeCheckResult, type BundleSizeConfig, type ChangelogEntry, type CommandContext, ConfigError, DEFAULT_LIMITS, DEFAULT_PREFLIGHT_CONFIG, type DiffToken, type DiscoverPluginsOptions, type DryRunPublishResult, type DryRunResult, type DryRunUploadResult, type ExportImagesOptions, type ExportImagesSummary, type FastlaneDetection, type FastlaneLane, type FetchChangelogOptions, type FieldLintResult, type FileValidationResult, type FindingSeverity, GOOGLE_PLAY_LANGUAGES, type GetAppStatusOptions, type GitNotesOptions, type GitReleaseNotes, GpcError, type ImageValidationResult, type InitOptions, type InitResult, type InternalSharingUploadResult, type ListIapOptions, type ListSubscriptionsOptions, type ListUsersOptions, type ListVoidedOptions, type ListingDiff, type ListingFieldLimits, type ListingLintResult, type ListingsResult, type LoadedPlugin, type MigrationResult, NetworkError, type OneTimeProductDiff, PERMISSION_PROPAGATION_WARNING, type ParsedManifest, type ParsedMonth, PluginManager, type PreflightConfig, type PreflightFinding, type PreflightOptions, type PreflightResult, type PreflightScanner, type PublishOptions, type PublishResult, type PushResult, type QuotaUsage, type ReleaseDiff, type ReleaseNotesValidation, type ReleaseStatusResult, type ReviewAnalysis, type ReviewExportOptions, type ReviewsFilterOptions, SENSITIVE_ARG_KEYS, SENSITIVE_KEYS, SEVERITY_ORDER, type ScaffoldOptions, type ScaffoldResult, type Spinner, type StatusDiff, type StatusRelease, type StatusReviews, type StatusVitalMetric, type SubscriptionAnalytics, type SubscriptionDiff, type SyncResult, type ThresholdResult, type TrainConfig, type TrainState, type UploadResult, type ValidateCheck, type ValidateOptions, type ValidateResult, type VersionVitalsComparison, type VersionVitalsRow, type VitalsOverview, type VitalsQueryOptions, type VitalsTrendComparison, type WatchOptions, type WatchVitalsOptions, type WebhookPayload, abortTrain, acknowledgeProductPurchase, activateBasePlan, activateOffer, activatePurchaseOption, addRecoveryTargeting, addTesters, advanceTrain, analyzeBundle, analyzeRemoteListings, analyzeReviews, batchGetOrders, batchSyncInAppProducts, cancelRecoveryAction, cancelSubscriptionPurchase, cancelSubscriptionV2, checkBundleSize, checkThreshold, clearAuditLog, compareBundles, compareVersionVitals, compareVitalsTrend, computeStatusDiff, consumeProductPurchase, convertRegionPrices, createAuditEntry, createDeviceTier, createEnterpriseApp, createExternalTransaction, createGrant, createInAppProduct, createOffer, createOneTimeOffer, createOneTimeProduct, createPurchaseOption, createRecoveryAction, createSpinner, createSubscription, createTrack, deactivateBasePlan, deactivateOffer, deactivatePurchaseOption, deferSubscriptionPurchase, deferSubscriptionV2, deleteBasePlan, deleteGrant, deleteImage, deleteInAppProduct, deleteListing, deleteOffer, deleteOneTimeOffer, deleteOneTimeProduct, deleteSubscription, deployRecoveryAction, detectFastlane, detectOutputFormat, diffListings, diffListingsCommand, diffListingsEnhanced, diffOneTimeProduct, diffReleases, diffSubscription, discoverPlugins, downloadGeneratedApk, downloadReport, exportDataSafety, exportImages, exportReviews, fetchChangelog, fetchReleaseNotes, formatChangelogEntry, formatCustomPayload, formatDiscordPayload, formatJunit, formatOutput, formatSlackPayload, formatStatusDiff, formatStatusSummary, formatStatusTable, formatWordDiff, generateMigrationPlan, generateNotesFromGit, getAllScannerNames, getAppInfo, getAppStatus, getCountryAvailability, getDataSafety, getDeviceTier, getExternalTransaction, getInAppProduct, getListings, getOffer, getOneTimeOffer, getOneTimeProduct, getOrderDetails, getProductPurchase, getProductPurchaseV2, getPurchaseOption, getQuotaUsage, getReleasesStatus, getReview, getSubscription, getSubscriptionAnalytics, getSubscriptionPurchase, getTrainStatus, getUser, getVitalsAnomalies, getVitalsAnr, getVitalsBattery, getVitalsCrashes, getVitalsLmk, getVitalsMemory, getVitalsOverview, getVitalsRendering, getVitalsStartup, importDataSafety, importTestersFromCsv, initAudit, initProject, inviteUser, isFinancialReportType, isStatsReportType, isValidBcp47, isValidReportType, isValidStatsDimension, lintListing, lintListings, lintLocalListings, listAchievements, listAuditEvents, listDeviceTiers, listEnterpriseApps, listEvents, listGeneratedApks, listGrants, listImages, listInAppProducts, listLeaderboards, listOffers, listOneTimeOffers, listOneTimeProducts, listPurchaseOptions, listRecoveryActions, listReports, listReviews, listSubscriptions, listTesters, listTracks, listUsers, listVoidedPurchases, loadPreflightConfig, loadStatusCache, maybePaginate, migratePrices, parseAppfile, parseFastfile, parseGrantArg, parseMonth, pauseTrain, promoteRelease, publish, pullListings, pushListings, readListingsFromDir, readReleaseNotesFromDir, redactAuditArgs, redactSensitive, refundExternalTransaction, refundOrder, refundSubscriptionV2, removeTesters, removeUser, replyToReview, revokeSubscriptionPurchase, runPreflight, runWatchLoop, safePath, safePathWithin, saveStatusCache, scaffoldPlugin, searchAuditEvents, searchVitalsErrors, sendNotification, sendWebhook, sortResults, startTrain, statusHasBreach, syncInAppProducts, topFiles, trackBreachState, updateAppDetails, updateDataSafety, updateGrant, updateInAppProduct, updateListing, updateOffer, updateOneTimeOffer, updateOneTimeProduct, updateRollout, updateSubscription, updateTrackConfig, updateUser, uploadExternallyHosted, uploadImage, uploadInternalSharing, uploadRelease, validateImage, validateLanguageCode, validatePackageName, validatePreSubmission, validateReleaseNotes, validateSku, validateTrackName, validateUploadFile, validateVersionCode, watchVitalsWithAutoHalt, wordDiff, writeAuditLog, writeListingsToDir, writeMigrationOutput };

package/dist/index.js

@@ -115,7 +115,7 @@ function redactSensitive(data) {
   if (typeof data === "object") {
     const result = {};
     for (const [key, value] of Object.entries(data)) {
-      if (SENSITIVE_KEYS.has(key) && typeof value === "string") {
+      if (SENSITIVE_KEYS.has(key)) {
         result[key] = REDACTED;
       } else {
         result[key] = redactSensitive(value);
@@ -363,6 +363,10 @@ function formatJunit(data, commandName = "command") {
 }
 
 // src/plugins.ts
+var FIRST_PARTY_PLUGINS = /* @__PURE__ */ new Set([
+  "@gpc-cli/plugin-ci",
+  "@gpc-cli/plugin-sdk"
+]);
 var PluginManager = class {
   plugins = [];
   beforeHandlers = [];
@@ -373,7 +377,7 @@ var PluginManager = class {
   registeredCommands = [];
   /** Load and register a plugin */
   async load(plugin, manifest) {
-    const isTrusted = manifest?.trusted ?? plugin.name.startsWith("@gpc-cli/");
+    const isTrusted = manifest?.trusted ?? FIRST_PARTY_PLUGINS.has(plugin.name);
     if (!isTrusted && manifest?.permissions) {
       validatePermissions(manifest.permissions);
     }
@@ -1658,6 +1662,14 @@ async function exportImages(client, packageName, dir, options) {
           const dirPath = join12(dir, task.language, task.imageType);
           await mkdir8(dirPath, { recursive: true });
           const response = await fetch(task.url);
+          if (!response.ok) {
+            throw new GpcError(
+              `Failed to download image: HTTP ${response.status} for ${task.imageType} (${task.language})`,
+              "LISTINGS_IMAGE_DOWNLOAD_FAILED",
+              4,
+              "Check that the image URL is still valid. Re-run the export to retry."
+            );
+          }
           const buffer = Buffer.from(await response.arrayBuffer());
           const filePath = join12(dirPath, `${task.index}.png`);
           await writeFile10(filePath, buffer);
@@ -3292,6 +3304,35 @@ async function refundOrder(client, packageName, orderId, options) {
   validatePackageName(packageName);
   return client.orders.refund(packageName, orderId, options);
 }
+async function getOrderDetails(client, packageName, orderId) {
+  validatePackageName(packageName);
+  return client.orders.get(packageName, orderId);
+}
+async function batchGetOrders(client, packageName, orderIds) {
+  validatePackageName(packageName);
+  if (orderIds.length === 0) {
+    throw new GpcError("No order IDs provided", "ORDERS_BATCH_EMPTY", 2, "Pass at least one order ID with --ids");
+  }
+  if (orderIds.length > 1e3) {
+    throw new GpcError(`Too many order IDs (${orderIds.length}). Maximum is 1000.`, "ORDERS_BATCH_LIMIT", 2, "Split into multiple requests of 1000 or fewer");
+  }
+  return client.orders.batchGet(packageName, orderIds);
+}
+async function getProductPurchaseV2(client, packageName, token) {
+  validatePackageName(packageName);
+  return client.purchases.getProductV2(packageName, token);
+}
+async function cancelSubscriptionV2(client, packageName, token, cancellationType) {
+  validatePackageName(packageName);
+  const body = cancellationType ? { cancellationType } : void 0;
+  return client.purchases.cancelSubscriptionV2(packageName, token, body);
+}
+async function deferSubscriptionV2(client, packageName, token, desiredExpiryTime) {
+  validatePackageName(packageName);
+  return client.purchases.deferSubscriptionV2(packageName, token, {
+    deferralInfo: { desiredExpiryTime }
+  });
+}
 
 // src/commands/pricing.ts
 async function convertRegionPrices(client, packageName, currencyCode, amount) {
@@ -3970,7 +4011,7 @@ function createSpinner(message) {
 
 // src/utils/train-state.ts
 import { mkdir as mkdir3, readFile as readFile7, writeFile as writeFile4 } from "fs/promises";
-import { join as join5 } from "path";
+import { dirname, join as join5 } from "path";
 import { getCacheDir } from "@gpc-cli/config";
 function stateFile(packageName) {
   return join5(getCacheDir(), `train-${packageName}.json`);
@@ -3986,7 +4027,7 @@ async function readTrainState(packageName) {
 }
 async function writeTrainState(packageName, state) {
   const path = stateFile(packageName);
-  const dir = path.substring(0, path.lastIndexOf("/"));
+  const dir = dirname(path);
   await mkdir3(dir, { recursive: true });
   await writeFile4(path, JSON.stringify(state, null, 2), "utf-8");
 }
@@ -4085,8 +4126,11 @@ async function advanceTrain(apiClient, reportingClient, packageName) {
         state.status = "paused";
         state.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
         await writeTrainState(packageName, state);
-        throw new Error(
-          `Crash gate failed: ${(value * 100).toFixed(3)}% > max ${state.gates.crashes.max}%. Train paused.`
+        throw new GpcError(
+          `Crash gate failed: ${(value * 100).toFixed(3)}% > max ${state.gates.crashes.max}%. Train paused.`,
+          "TRAIN_CRASH_GATE_FAILED",
+          6,
+          "Review crash data with: gpc vitals crashes --days 1"
         );
       }
     }
@@ -4099,8 +4143,11 @@ async function advanceTrain(apiClient, reportingClient, packageName) {
         state.status = "paused";
         state.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
         await writeTrainState(packageName, state);
-        throw new Error(
-          `ANR gate failed: ${(value * 100).toFixed(3)}% > max ${state.gates.anr.max}%. Train paused.`
+        throw new GpcError(
+          `ANR gate failed: ${(value * 100).toFixed(3)}% > max ${state.gates.anr.max}%. Train paused.`,
+          "TRAIN_ANR_GATE_FAILED",
+          6,
+          "Review ANR data with: gpc vitals anr --days 1"
         );
       }
     }
@@ -4110,7 +4157,7 @@ async function advanceTrain(apiClient, reportingClient, packageName) {
 }
 async function executeStage(apiClient, packageName, state, stageIndex) {
   const stage = state.stages[stageIndex];
-  if (!stage) throw new Error(`Stage ${stageIndex} not found`);
+  if (!stage) throw new GpcError(`Stage ${stageIndex} not found`, "TRAIN_STAGE_NOT_FOUND", 1, "Check your release train configuration.");
   const rolloutFraction = stage.rollout / 100;
   await updateRollout(apiClient, packageName, stage.track, "increase", rolloutFraction);
   stage.executedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -4556,7 +4603,7 @@ async function loadPreflightConfig(configPath) {
 import { open as yauzlOpen } from "yauzl";
 
 // src/preflight/manifest-parser.ts
-import * as protobuf from "protobufjs";
+import protobuf from "protobufjs";
 var RESOURCE_IDS = {
   16842752: "theme",
   16842753: "label",
@@ -4717,9 +4764,35 @@ async function readAab(aabPath) {
       `AAB is missing ${MANIFEST_PATH}. This does not appear to be a valid Android App Bundle.`
     );
   }
-  const manifest = decodeManifest(manifestBuf);
+  let manifest;
+  try {
+    manifest = decodeManifest(manifestBuf);
+  } catch (err) {
+    const errMsg = err instanceof Error ? err.message : String(err);
+    manifest = createFallbackManifest();
+    manifest._parseError = `Manifest could not be fully parsed: ${errMsg}. Manifest-dependent checks will be skipped.`;
+  }
   return { manifest, entries };
 }
+function createFallbackManifest() {
+  return {
+    packageName: "",
+    versionCode: 0,
+    versionName: "",
+    minSdk: 0,
+    targetSdk: 0,
+    debuggable: false,
+    testOnly: false,
+    usesCleartextTraffic: false,
+    extractNativeLibs: true,
+    permissions: [],
+    features: [],
+    activities: [],
+    services: [],
+    receivers: [],
+    providers: []
+  };
+}
 function openAndScan(aabPath) {
   return new Promise((resolve2, reject) => {
     yauzlOpen(aabPath, { lazyEntries: true, autoClose: false }, (err, zipfile) => {
@@ -5868,11 +5941,23 @@ async function runPreflight(options) {
     failOn: options.failOn ?? fileConfig.failOn ?? DEFAULT_PREFLIGHT_CONFIG.failOn
   };
   const ctx = { config };
+  const earlyFindings = [];
   if (options.aabPath) {
     ctx.aabPath = options.aabPath;
     const aab = await readAab(options.aabPath);
     ctx.manifest = aab.manifest;
     ctx.zipEntries = aab.entries;
+    if (aab.manifest._parseError) {
+      earlyFindings.push({
+        scanner: "manifest-parser",
+        ruleId: "manifest-parse-error",
+        severity: "warning",
+        title: "Manifest could not be fully parsed",
+        message: aab.manifest._parseError,
+        suggestion: "Manifest-dependent scanners (manifest, permissions, policy, privacy) were skipped. Other scanners (native-libs, size, secrets, billing) still ran."
+      });
+      ctx.manifest = void 0;
+    }
   }
   if (options.metadataDir) ctx.metadataDir = options.metadataDir;
   if (options.sourceDir) ctx.sourceDir = options.sourceDir;
@@ -5888,7 +5973,7 @@ async function runPreflight(options) {
     return true;
   });
   const settled = await Promise.allSettled(applicableScanners.map((scanner) => scanner.scan(ctx)));
-  let findings = [];
+  let findings = [...earlyFindings];
   for (let i = 0; i < settled.length; i++) {
     const result = settled[i];
     if (result.status === "fulfilled") {
@@ -6990,6 +7075,62 @@ function sendNotification(title, body) {
 function statusHasBreach(status) {
   return status.vitals.crashes.status === "breach" || status.vitals.anr.status === "breach" || status.vitals.slowStarts.status === "breach" || status.vitals.slowRender.status === "breach";
 }
+
+// src/commands/changelog.ts
+var GITHUB_RELEASES_URL = "https://api.github.com/repos/yasserstudio/gpc/releases";
+var DOCS_CHANGELOG_URL = "https://yasserstudio.github.io/gpc/reference/changelog";
+async function fetchChangelog(options) {
+  const limit = options?.limit ?? 5;
+  const url = options?.version ? `${GITHUB_RELEASES_URL}/tags/${options.version.startsWith("v") ? options.version : `v${options.version}`}` : `${GITHUB_RELEASES_URL}?per_page=${Math.min(limit, 100)}`;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 1e4);
+  let response;
+  try {
+    response = await fetch(url, {
+      headers: {
+        Accept: "application/vnd.github+json",
+        "User-Agent": "gpc-cli"
+      },
+      signal: controller.signal
+    });
+  } catch {
+    throw new Error(
+      `Could not fetch changelog. View online: ${DOCS_CHANGELOG_URL}`
+    );
+  } finally {
+    clearTimeout(timer);
+  }
+  if (!response.ok) {
+    if (response.status === 404 && options?.version) {
+      throw new Error(
+        `Version ${options.version} not found. Run: gpc changelog --limit 10`
+      );
+    }
+    throw new Error(
+      `GitHub API returned ${response.status}. View online: ${DOCS_CHANGELOG_URL}`
+    );
+  }
+  const data = await response.json();
+  const releases = Array.isArray(data) ? data : [data];
+  return releases.filter((r) => r.tag_name.startsWith("v")).map((r) => ({
+    version: r.tag_name,
+    title: r.name || r.tag_name,
+    date: r.published_at ? r.published_at.split("T")[0] : "unknown",
+    body: r.body || "No release notes.",
+    url: r.html_url
+  }));
+}
+function formatChangelogEntry(entry) {
+  const lines = [];
+  lines.push(`${entry.version} \u2014 ${entry.title}`);
+  lines.push(`Released: ${entry.date}`);
+  lines.push("");
+  const body = entry.body.replace(/^### /gm, "").replace(/^## /gm, "").replace(/^# /gm, "").replace(/\*\*(.*?)\*\*/g, "$1").replace(/`([^`]+)`/g, "$1").replace(/\[([^\]]+)\]\([^)]+\)/g, "$1").trim();
+  lines.push(body);
+  lines.push("");
+  lines.push(`Full notes: ${entry.url}`);
+  return lines.join("\n");
+}
 export {
   ApiError,
   ConfigError,
@@ -7014,9 +7155,11 @@ export {
   analyzeBundle,
   analyzeRemoteListings,
   analyzeReviews2 as analyzeReviews,
+  batchGetOrders,
   batchSyncInAppProducts,
   cancelRecoveryAction,
   cancelSubscriptionPurchase,
+  cancelSubscriptionV2,
   checkBundleSize,
   checkThreshold,
   clearAuditLog,
@@ -7044,6 +7187,7 @@ export {
   deactivateOffer,
   deactivatePurchaseOption,
   deferSubscriptionPurchase,
+  deferSubscriptionV2,
   deleteBasePlan,
   deleteGrant,
   deleteImage,
@@ -7068,7 +7212,9 @@ export {
   exportDataSafety,
   exportImages,
   exportReviews,
+  fetchChangelog,
   fetchReleaseNotes,
+  formatChangelogEntry,
   formatCustomPayload,
   formatDiscordPayload,
   formatJunit,
@@ -7092,7 +7238,9 @@ export {
   getOffer,
   getOneTimeOffer,
   getOneTimeProduct,
+  getOrderDetails,
   getProductPurchase,
+  getProductPurchaseV2,
   getPurchaseOption,
   getQuotaUsage,
   getReleasesStatus,