@gpc-cli/core 0.9.72 → 0.9.74

package/dist/index.js

@@ -4659,19 +4659,12 @@ async function diffAchievementConfig(client, achievementId, localData) {
   validateResourceId(achievementId, "achievement");
   const remote = await client.achievements.get(achievementId);
   const diffs = [];
-  const fields = [
-    "achievementType",
-    "initialState",
-    "stepsToUnlock",
-    "draft"
-  ];
+  const fields = ["achievementType", "initialState", "stepsToUnlock", "draft"];
   for (const field of fields) {
     const localVal = JSON.stringify(
       localData[field] ?? null
     );
-    const remoteVal = JSON.stringify(
-      remote[field] ?? null
-    );
+    const remoteVal = JSON.stringify(remote[field] ?? null);
     if (localVal !== remoteVal) {
       diffs.push({ field, local: localVal, remote: remoteVal });
     }
@@ -4707,9 +4700,7 @@ async function diffLeaderboardConfig(client, leaderboardId, localData) {
     const localVal = JSON.stringify(
       localData[field] ?? null
     );
-    const remoteVal = JSON.stringify(
-      remote[field] ?? null
-    );
+    const remoteVal = JSON.stringify(remote[field] ?? null);
     if (localVal !== remoteVal) {
       diffs.push({ field, local: localVal, remote: remoteVal });
     }
@@ -4964,7 +4955,7 @@ async function initProject(options) {
   const preflightrc = JSON.stringify(
     {
       failOn: "error",
-      targetSdkMinimum: 35,
+      targetSdkMinimum: 36,
       maxDownloadSizeMb: 150,
       allowedPermissions: [],
       disabledRules: [],
@@ -5141,7 +5132,8 @@ async function loadPreflightConfig(configPath) {
 }
 
 // src/preflight/aab-reader.ts
-import { open as yauzlOpen } from "yauzl";
+import { readFile as readFile10 } from "fs/promises";
+import { fromBuffer } from "yauzl";
 
 // src/preflight/manifest-parser.ts
 import protobuf from "protobufjs";
@@ -5330,12 +5322,20 @@ var AAB_MANIFEST_PATH = "base/manifest/AndroidManifest.xml";
 var APK_MANIFEST_PATH = "AndroidManifest.xml";
 var SO_HEADER_BYTES = 4096;
 var SO_PATH_RE = /(?:^|\/)lib\/[^/]+\/[^/]+\.so$/;
+var SCAN_TIMEOUT_MS = 6e4;
 function detectManifestPath(filePath) {
   return filePath.toLowerCase().endsWith(".apk") ? APK_MANIFEST_PATH : AAB_MANIFEST_PATH;
 }
 async function readAab(aabPath) {
   const manifestPath = detectManifestPath(aabPath);
-  const { zipfile, entries, manifestBuf, soHeaders } = await openAndScan(aabPath, manifestPath);
+  let buffer;
+  try {
+    buffer = await readFile10(aabPath);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(`Could not read ${aabPath}: ${msg}`);
+  }
+  const { zipfile, entries, manifestBuf, soHeaders } = await openAndScan(buffer, manifestPath);
   zipfile.close();
   if (!manifestBuf) {
     const fileType = aabPath.toLowerCase().endsWith(".apk") ? "APK" : "AAB";
@@ -5372,98 +5372,125 @@ function createFallbackManifest() {
     providers: []
   };
 }
-function openAndScan(aabPath, manifestPath = AAB_MANIFEST_PATH) {
+function openAndScan(buffer, manifestPath = AAB_MANIFEST_PATH) {
   return new Promise((resolve2, reject) => {
-    yauzlOpen(aabPath, { lazyEntries: true, autoClose: false }, (err, zipfile) => {
-      if (err || !zipfile) {
-        reject(err ?? new Error("Failed to open AAB file"));
-        return;
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (!settled) {
+        settled = true;
+        reject(new Error("Timed out reading the archive. The file may be corrupt or truncated."));
       }
-      const entries = [];
-      const soHeaders = /* @__PURE__ */ new Map();
-      let manifestBuf = null;
-      let rejected = false;
-      let pendingStreams = 0;
-      let entrysDone = false;
-      function fail(error) {
-        if (!rejected) {
-          rejected = true;
-          zipfile.close();
-          reject(error);
+    }, SCAN_TIMEOUT_MS);
+    function settleResolve(value) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve2(value);
+    }
+    function settleReject(error) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      reject(error);
+    }
+    try {
+      fromBuffer(buffer, { lazyEntries: true }, (err, zipfile) => {
+        if (err || !zipfile) {
+          settleReject(err ?? new Error("Failed to open AAB file"));
+          return;
         }
-      }
-      function maybeResolve() {
-        if (!rejected && entrysDone && pendingStreams === 0) {
-          resolve2({ zipfile, entries, manifestBuf, soHeaders });
+        const entries = [];
+        const soHeaders = /* @__PURE__ */ new Map();
+        let manifestBuf = null;
+        let pendingStreams = 0;
+        let entrysDone = false;
+        function fail(error) {
+          if (settled) return;
+          try {
+            zipfile.close();
+          } catch {
+          }
+          settleReject(error);
         }
-      }
-      function readEntryStream(entry, onData, maxBytes) {
-        pendingStreams++;
-        zipfile.openReadStream(entry, (streamErr, stream) => {
-          if (streamErr || !stream) {
-            fail(streamErr ?? new Error(`Failed to read ${entry.fileName}`));
-            return;
+        function maybeResolve() {
+          if (!settled && entrysDone && pendingStreams === 0) {
+            settleResolve({ zipfile, entries, manifestBuf, soHeaders });
           }
-          const chunks = [];
-          let totalBytes = 0;
-          let done = false;
-          stream.on("data", (chunk) => {
-            chunks.push(chunk);
-            totalBytes += chunk.length;
-            if (maxBytes && totalBytes >= maxBytes) {
-              stream.destroy();
-            }
-          });
-          stream.on("error", (e) => {
-            if (maxBytes && totalBytes >= maxBytes) return;
-            fail(e);
-          });
-          const finish = () => {
-            if (done) return;
-            done = true;
-            const buf = Buffer.concat(chunks);
-            onData(maxBytes ? buf.subarray(0, maxBytes) : buf);
-            pendingStreams--;
-            maybeResolve();
-          };
-          stream.on("end", finish);
-          stream.on("close", () => {
-            if (totalBytes > 0 && maxBytes) finish();
-          });
-        });
-      }
-      zipfile.on("error", fail);
-      zipfile.on("entry", (entry) => {
-        if (rejected) return;
-        const path = entry.fileName;
-        if (!path.endsWith("/")) {
-          entries.push({
-            path,
-            compressedSize: entry.compressedSize,
-            uncompressedSize: entry.uncompressedSize
-          });
         }
-        if (path === manifestPath) {
-          readEntryStream(entry, (buf) => {
-            manifestBuf = buf;
+        function readEntryStream(entry, onData, maxBytes) {
+          pendingStreams++;
+          zipfile.openReadStream(entry, (streamErr, stream) => {
+            if (streamErr || !stream) {
+              fail(streamErr ?? new Error(`Failed to read ${entry.fileName}`));
+              return;
+            }
+            const chunks = [];
+            let totalBytes = 0;
+            let done = false;
+            stream.on("data", (chunk) => {
+              chunks.push(chunk);
+              totalBytes += chunk.length;
+              if (maxBytes && totalBytes >= maxBytes) {
+                stream.destroy();
+              }
+            });
+            stream.on("error", (e) => {
+              if (maxBytes && totalBytes >= maxBytes) return;
+              fail(e);
+            });
+            const finish = () => {
+              if (done) return;
+              done = true;
+              const buf = Buffer.concat(chunks);
+              onData(maxBytes ? buf.subarray(0, maxBytes) : buf);
+              pendingStreams--;
+              maybeResolve();
+            };
+            stream.on("end", finish);
+            stream.on("close", () => {
+              if (totalBytes > 0 && maxBytes) finish();
+            });
           });
-        } else if (SO_PATH_RE.test(path)) {
-          readEntryStream(
-            entry,
-            (buf) => {
-              soHeaders.set(path, buf);
-            },
-            SO_HEADER_BYTES
-          );
         }
+        zipfile.on("error", fail);
+        zipfile.on("entry", (entry) => {
+          if (settled) return;
+          try {
+            const path = entry.fileName;
+            if (!path.endsWith("/")) {
+              entries.push({
+                path,
+                compressedSize: entry.compressedSize,
+                uncompressedSize: entry.uncompressedSize
+              });
+            }
+            if (path === manifestPath) {
+              readEntryStream(entry, (buf) => {
+                manifestBuf = buf;
+              });
+            } else if (SO_PATH_RE.test(path)) {
+              readEntryStream(
+                entry,
+                (buf) => {
+                  soHeaders.set(path, buf);
+                },
+                SO_HEADER_BYTES
+              );
+            }
+            zipfile.readEntry();
+          } catch (e) {
+            fail(e instanceof Error ? e : new Error(String(e)));
+          }
+        });
+        zipfile.on("end", () => {
+          entrysDone = true;
+          maybeResolve();
+        });
         zipfile.readEntry();
       });
-      zipfile.on("end", () => {
-        entrysDone = true;
-        maybeResolve();
-      });
-      zipfile.readEntry();
-    });
+    } catch (err) {
+      settleReject(err instanceof Error ? err : new Error(String(err)));
+    }
   });
 }
 
@@ -5582,8 +5609,8 @@ var manifestScanner = {
             ruleId: "geofencing-foreground-service",
             severity: "warning",
             title: `Possible geofencing via foreground service "${service.name}"`,
-            message: `Service "${service.name}" uses foregroundServiceType "location" and the app declares ACCESS_BACKGROUND_LOCATION. Google Play no longer approves geofencing as a foreground service use case (April 2026 policy). Compliance deadline: May 15, 2026.`,
-            suggestion: 'If this service performs geofencing, migrate to WorkManager or AlarmManager. If this is legitimate background location tracking (navigation, fitness), suppress this rule via .preflightrc.json: "disabledRules": ["geofencing-foreground-service"].',
+            message: `Service "${service.name}" uses foregroundServiceType "location" and the app declares ACCESS_BACKGROUND_LOCATION. Google Play no longer approves geofencing as a foreground service use case (sensitive-permissions policy announced April 15, 2026); enforcement for apps targeting Android 17 (API 37+) begins October 28, 2026.`,
+            suggestion: 'If this service performs geofencing, migrate to the Geofencing API (LocationServices.getGeofencingClient) or WorkManager/AlarmManager. If this is legitimate background location tracking (navigation, fitness), suppress this rule via .preflightrc.json: "disabledRules": ["geofencing-foreground-service"].',
             policyUrl: "https://support.google.com/googleplay/android-developer/answer/16926792"
           });
         }
@@ -5812,14 +5839,28 @@ var permissionsScanner = {
     ].filter((p) => manifest.permissions.includes(p) && !allowed.has(p));
     if (contactsPerms.length > 0) {
       const names = contactsPerms.map((p) => p.split(".").pop()).join(", ");
+      const enforced = manifest.targetSdk >= 37 ? ` Your app targets API ${manifest.targetSdk}, so this is enforced.` : "";
       findings.push({
         scanner: "permissions",
         ruleId: "contacts-permission-broad",
         severity: "warning",
         title: "Broad contacts access requires migration to Contact Picker",
-        message: `Your app declares ${names}. Google Play now requires the Android Contact Picker instead of broad contacts access. Compliance deadline: May 15, 2026.`,
-        suggestion: "Migrate to the Android Contact Picker API for user-initiated contact selection. Remove READ_CONTACTS/WRITE_CONTACTS unless your app is a dialer, messaging, or contacts management app.",
-        policyUrl: "https://support.google.com/googleplay/android-developer/answer/16926792"
+        message: `Your app declares ${names}. Google Play's Contacts Permissions policy requires the Android Contact Picker (Intent.ACTION_PICK_CONTACTS) unless broad access is core to your app. Mandatory for apps targeting Android 17 (API 37+) on October 28, 2026.${enforced}`,
+        suggestion: "Migrate to the Android Contact Picker (Intent.ACTION_PICK_CONTACTS) for user-initiated contact selection, or file a Permissions Declaration Form before October 28, 2026 if the picker cannot serve your core functionality. Remove READ_CONTACTS/WRITE_CONTACTS unless your app is a dialer, messaging, or contacts management app.",
+        policyUrl: "https://support.google.com/googleplay/android-developer/answer/16935362"
+      });
+    }
+    const fineLocation = "android.permission.ACCESS_FINE_LOCATION";
+    if (manifest.permissions.includes(fineLocation) && !allowed.has(fineLocation)) {
+      const targetsApi37 = manifest.targetSdk >= 37;
+      findings.push({
+        scanner: "permissions",
+        ruleId: "location-minimal-scope",
+        severity: targetsApi37 ? "warning" : "info",
+        title: "Precise location \u2014 consider the location button (minimum scope)",
+        message: `Your app declares ACCESS_FINE_LOCATION. Google Play's Location Permissions policy makes the Android location button the recommended minimum scope for transactional (one-time) precise location. Mandatory for apps targeting Android 17 (API 37+) on October 28, 2026.${targetsApi37 ? ` Your app targets API ${manifest.targetSdk}.` : ""}`,
+        suggestion: 'For one-time/transactional precise location, use the system location button instead of requesting ACCESS_FINE_LOCATION up front. Only keep continuous fine location if navigation, fitness, or a similar feature is core functionality. Suppress via .preflightrc.json "disabledRules": ["location-minimal-scope"] if fine location is essential.',
+        policyUrl: "https://support.google.com/googleplay/android-developer/answer/17033915"
       });
     }
     const broadHealthPerm = "android.permission.health.READ_ALL_HEALTH_DATA";
@@ -6013,7 +6054,7 @@ ${fileList}` + (hasPageSizeCompat ? "\nandroid:pageSizeCompat is set, so the app
 }
 
 // src/preflight/scanners/metadata-scanner.ts
-import { readdir as readdir4, stat as stat6, readFile as readFile10 } from "fs/promises";
+import { readdir as readdir4, stat as stat6, readFile as readFile11 } from "fs/promises";
 import { join as join8 } from "path";
 var SAFE_LANG = /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]{2,8})*$/;
 var FILE_MAP2 = {
@@ -6072,7 +6113,7 @@ var metadataScanner = {
       for (const [fileName, field] of Object.entries(FILE_MAP2)) {
         const filePath = join8(langDir, fileName);
         try {
-          const content = await readFile10(filePath, "utf-8");
+          const content = await readFile11(filePath, "utf-8");
           fields[field] = content.trimEnd();
         } catch {
         }
@@ -6145,7 +6186,7 @@ var metadataScanner = {
     const defaultLang = locales.includes("en-US") ? "en-US" : locales[0];
     const privacyPath = join8(dir, defaultLang, "privacy_policy_url.txt");
     try {
-      const url = await readFile10(privacyPath, "utf-8");
+      const url = await readFile11(privacyPath, "utf-8");
       if (!url.trim()) throw new Error("empty");
     } catch {
       findings.push({
@@ -6170,7 +6211,7 @@ var metadataScanner = {
 };
 
 // src/preflight/scanners/secrets-scanner.ts
-import { readFile as readFile11 } from "fs/promises";
+import { readFile as readFile12 } from "fs/promises";
 
 // src/preflight/scan-files.ts
 import { readdir as readdir5, stat as stat7 } from "fs/promises";
@@ -6290,7 +6331,7 @@ var secretsScanner = {
     for (const filePath of files) {
       let content;
       try {
-        content = await readFile11(filePath, "utf-8");
+        content = await readFile12(filePath, "utf-8");
       } catch {
         continue;
       }
@@ -6318,7 +6359,7 @@ var secretsScanner = {
 };
 
 // src/preflight/scanners/billing-scanner.ts
-import { readFile as readFile12 } from "fs/promises";
+import { readFile as readFile13 } from "fs/promises";
 var BILLING_PATTERNS = [
   {
     ruleId: "billing-stripe-sdk",
@@ -6379,7 +6420,7 @@ var billingScanner = {
     for (const filePath of files) {
       let content;
       try {
-        content = await readFile12(filePath, "utf-8");
+        content = await readFile13(filePath, "utf-8");
       } catch {
         continue;
       }
@@ -6405,7 +6446,7 @@ var billingScanner = {
 };
 
 // src/preflight/scanners/privacy-scanner.ts
-import { readFile as readFile13 } from "fs/promises";
+import { readFile as readFile14 } from "fs/promises";
 var TRACKING_SDKS = [
   {
     name: "Facebook SDK",
@@ -6445,7 +6486,7 @@ var privacyScanner = {
     for (const filePath of files) {
       let content;
       try {
-        content = await readFile13(filePath, "utf-8");
+        content = await readFile14(filePath, "utf-8");
       } catch {
         continue;
       }
@@ -7145,7 +7186,7 @@ async function downloadGeneratedApk(client, packageName, versionCode, apkId, out
 }
 
 // src/commands/bundle-analysis.ts
-import { readFile as readFile14, stat as stat8 } from "fs/promises";
+import { readFile as readFile15, stat as stat8 } from "fs/promises";
 var EOCD_SIGNATURE = 101010256;
 var CD_SIGNATURE = 33639248;
 var MODULE_SUBDIRS = /* @__PURE__ */ new Set(["dex", "manifest", "res", "assets", "lib", "resources.pb", "root"]);
@@ -7225,7 +7266,7 @@ async function analyzeBundle(filePath) {
   if (!fileInfo || !fileInfo.isFile()) {
     throw new Error(`File not found: ${filePath}`);
   }
-  const buf = await readFile14(filePath);
+  const buf = await readFile15(filePath);
   const cdEntries = parseCentralDirectory(buf);
   const fileType = detectFileType2(filePath);
   const isAab = fileType === "aab";
@@ -7311,7 +7352,7 @@ function topFiles(analysis, n = 20) {
 async function checkBundleSize(analysis, configPath = ".bundlesize.json") {
   let config;
   try {
-    const raw = await readFile14(configPath, "utf-8");
+    const raw = await readFile15(configPath, "utf-8");
     config = JSON.parse(raw);
   } catch {
     return { passed: true, violations: [] };