@hot-updater/android-helper 1.1.4 → 1.2.0-rc.0

package/dist/index.cjs

@@ -24,12 +24,21 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 let path = require("path");
 path = __toESM(path, 1);
 let _hot_updater_cli_tools = require("@hot-updater/cli-tools");
-let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
 let fs = require("fs");
 fs = __toESM(fs, 1);
 let execa = require("execa");
-let node_os = require("node:os");
-node_os = __toESM(node_os, 1);
+let os = require("os");
+os = __toESM(os, 1);
+let jszip = require("jszip");
+jszip = __toESM(jszip, 1);
+let crypto = require("crypto");
+crypto = __toESM(crypto, 1);
+let stream_promises = require("stream/promises");
+let zlib = require("zlib");
+let node_crypto = require("node:crypto");
+node_crypto = __toESM(node_crypto, 1);
+let node_http = require("node:http");
+node_http = __toESM(node_http, 1);
 //#region src/utils/createGradleLogger.ts
 const createGradleLogger = ({ logPrefix }) => new _hot_updater_cli_tools.BuildLogger({
 	logPrefix,
@@ -140,25 +149,29 @@ const createGradleLogger = ({ logPrefix }) => new _hot_updater_cli_tools.BuildLo
 		],
 		["bundleRelease", "bundleDebug"],
 		["BUILD SUCCESSFUL", /\d+ actionable tasks:/]
-	]
+	],
+	failureSummary: {
+		lines: [
+			/^e: /,
+			/(^|:\s)error: /,
+			/^BUILD FAILED/
+		],
+		blocks: [{
+			start: "* What went wrong:",
+			end: "* Try:",
+			includeEnd: false
+		}]
+	}
 });
 //#endregion
 //#region src/builder/runGradle.ts
-/**
-* Clean up gradle error message by removing common noise
-*/
-const getCleanedErrorMessage = (error) => {
-	const gradleLinesToRemove = [
-		"FAILURE: Build failed with an exception.",
-		"* Try:",
-		"> Run with --stacktrace option to get the stack trace.",
-		"> Run with --info or --debug option to get more log output.",
-		"> Run with --scan to get full insights.",
-		"> Get more help at [undefined](https://help.gradle.org).",
-		"> Get more help at https://help.gradle.org.",
-		"BUILD FAILED"
-	];
-	return error.message.split("\n").filter((line) => !gradleLinesToRemove.some((l) => line.includes(l))).join("\n").trim();
+/** Why Gradle failed, without its command line. */
+const describeFailure = (error) => {
+	if (error instanceof execa.ExecaError) {
+		if (error.signal) return `Gradle was stopped by ${error.signal}.`;
+		if (error.exitCode !== void 0) return `Gradle exited with code ${error.exitCode}.`;
+	}
+	return error instanceof Error ? error.message : String(error);
 };
 /**
 * Generate gradle task names with module prefix
@@ -173,13 +186,13 @@ const getGradleWrapper = () => process.platform.startsWith("win") ? "gradlew.bat
 /**
 * Run gradle build with specified tasks and arguments
 */
-async function runGradle({ tasks, logPrefix, args, androidProjectPath, appModuleName }) {
+async function runGradle({ tasks, logPrefix, args, env, androidProjectPath, appModuleName }) {
 	const gradleArgs = getTaskNames(appModuleName, tasks);
 	gradleArgs.push("-x", "lint");
 	if (args.extraParams) gradleArgs.push(...args.extraParams);
 	_hot_updater_cli_tools.p.log.info(`Run Gradle Settings: 
 Project    ${androidProjectPath}
-App Moudle ${appModuleName}
+App Module ${appModuleName}
 Tasks      ${tasks.join(", ")}
 Args       ${gradleArgs.join(" ")}
 `);
@@ -187,20 +200,25 @@ Args       ${gradleArgs.join(" ")}
 	const logger = createGradleLogger({ logPrefix });
 	await logger.start();
 	try {
-		const process = (0, execa.execa)(getGradleWrapper(), gradleArgs, {
+		const gradle = (0, execa.execa)(getGradleWrapper(), gradleArgs, {
 			cwd: androidProjectPath,
-			all: true
+			env,
+			all: true,
+			buffer: false
 		});
-		const outputStream = process.all ?? process.stdout;
-		if (outputStream) await logger.processStream(outputStream);
-		await process;
+		const outputStream = gradle.all ?? gradle.stdout;
+		const [gradleResult, loggingResult] = await Promise.allSettled([gradle, outputStream ? logger.processStream(outputStream) : void 0]);
+		if (gradleResult.status === "rejected") throw gradleResult.reason;
+		if (loggingResult.status === "rejected") throw loggingResult.reason;
 		logger.stop();
 	} catch (e) {
 		logger.writeError(e);
 		logger.stop("Build failed", false);
-		if (e instanceof execa.ExecaError) _hot_updater_cli_tools.p.log.error(getCleanedErrorMessage(e));
-		else if (e instanceof Error) _hot_updater_cli_tools.p.log.error(e.message);
-		throw new Error("Failed to build the app. See the error above for details from Gradle.");
+		throw new _hot_updater_cli_tools.BuildFailedError(`Build failed: ${describeFailure(e)}`, {
+			logPath: logger.logPath,
+			summary: logger.failureSummary,
+			cause: e
+		});
 	} finally {
 		await logger.close();
 	}
@@ -243,429 +261,1407 @@ async function getBuildOutputFilePath({ aab, appModuleName, buildDirectory, vari
 	process.exit(1);
 }
 //#endregion
-//#region src/buildAndroid.ts
-const buildAndroid = async ({ schemeConfig }) => {
-	const androidProjectPath = path.default.join((0, _hot_updater_cli_tools.getCwd)(), "android");
-	return runGradle({
-		args: { extraParams: [`-PMIN_BUNDLE_ID=${(0, _hot_updater_plugin_core.generateMinBundleId)()}`] },
-		appModuleName: schemeConfig.appModuleName,
-		tasks: schemeConfig.aab ? [`bundle${schemeConfig.variant}`] : [`assemble${schemeConfig.variant}`],
-		logPrefix: `android-${schemeConfig.hotUpdaterSchemeName}-build`,
-		androidProjectPath
+//#region src/utils/gradleSigning.ts
+const isDebugVariant = (variant) => /debug$/i.test(variant);
+/**
+* The environment that signs a release variant with the scheme's keystore,
+* through the properties Android Studio's signed builds inject. Gradle reads
+* `ORG_GRADLE_PROJECT_*` variables as project properties, so the passwords
+* never appear in the Gradle command line. The keystore is resolved only
+* here: a debug variant, or a scheme without `signing`, resolves nothing.
+* Without `credentials`, it resolves from the environment or the config's
+* `secrets` adapter, and the temporary files are deleted when the process
+* exits.
+*/
+const resolveGradleSigningEnv = async ({ schemeConfig, credentials }) => {
+	const reference = schemeConfig.signing?.keystore;
+	if (!reference) return;
+	if (isDebugVariant(schemeConfig.variant)) {
+		_hot_updater_cli_tools.p.log.info(`${schemeConfig.variant} signs with the debug keystore, so signing.keystore is not used.`);
+		return;
+	}
+	const keystore = await (credentials ?? (0, _hot_updater_cli_tools.createCredentialResolver)()).resolve({
+		kind: "android-keystore",
+		name: (0, _hot_updater_cli_tools.parseSecretReference)(reference, "signing.keystore")
 	});
+	return (0, _hot_updater_cli_tools.assertUnreservedEnv)({
+		"ORG_GRADLE_PROJECT_android.injected.signing.store.file": keystore.storeFile,
+		"ORG_GRADLE_PROJECT_android.injected.signing.store.password": keystore.storePassword,
+		"ORG_GRADLE_PROJECT_android.injected.signing.key.alias": keystore.keyAlias,
+		"ORG_GRADLE_PROJECT_android.injected.signing.key.password": keystore.keyPassword
+	}, "The Gradle signing environment");
 };
 //#endregion
-//#region src/utils/device.ts
+//#region src/utils/readBuiltApp.ts
+const CHANNEL_META_DATA_KEY = "com.hotupdater.CHANNEL";
+/** The SDK Gradle builds with: the environment's, or local.properties'. */
+const findAndroidSdk = (androidProjectPath) => {
+	const fromEnv = process.env["ANDROID_HOME"] || process.env["ANDROID_SDK_ROOT"];
+	if (fromEnv) return fromEnv;
+	const localProperties = path.default.join(androidProjectPath, "local.properties");
+	if (!fs.default.existsSync(localProperties)) return;
+	return (fs.default.readFileSync(localProperties, "utf-8").match(/^sdk\.dir=(.*)$/m)?.[1])?.trim().replace(/\\(.)/g, "$1");
+};
+const compareVersions = (a, b) => {
+	const left = a.split(/[.-]/).map((part) => Number.parseInt(part, 10) || 0);
+	const right = b.split(/[.-]/).map((part) => Number.parseInt(part, 10) || 0);
+	for (let i = 0; i < Math.max(left.length, right.length); i++) {
+		const difference = (left[i] ?? 0) - (right[i] ?? 0);
+		if (difference !== 0) return difference;
+	}
+	return 0;
+};
+/** The newest build-tools' aapt2, which reads the artifact Gradle wrote. */
+const findAapt2 = (androidProjectPath) => {
+	const sdk = findAndroidSdk(androidProjectPath);
+	const buildTools = sdk && path.default.join(sdk, "build-tools");
+	if (!buildTools || !fs.default.existsSync(buildTools)) return;
+	const executable = process.platform.startsWith("win") ? "aapt2.exe" : "aapt2";
+	return fs.default.readdirSync(buildTools).sort(compareVersions).reverse().map((version) => path.default.join(buildTools, version, executable)).find((aapt2) => fs.default.existsSync(aapt2));
+};
+const RAW_MARKER = "\" (Raw: \"";
+/**
+* An attribute aapt2 prints as `="<value>" (Raw: "<value>")`, given the text
+* after `="`. aapt2 does not escape the value, so it is the prefix the rest
+* of the line repeats; a value with a line break, which aapt2 indents, reads
+* as undefined.
+*/
+const readQuotedValue = (rest) => {
+	for (let end = rest.indexOf(RAW_MARKER); end !== -1; end = rest.indexOf(RAW_MARKER, end + 1)) {
+		const value = rest.slice(0, end);
+		if (rest === `${value}${RAW_MARKER}${value}")`) return value;
+	}
+};
 /**
-* Get the path to adb executable from ANDROID_HOME or use system adb
+* The value of the attribute `marker` (such as `:value(0x01010024)=`) on
+* `line`: null without one, and undefined when it cannot be read exactly.
 */
-const getAdbPath = () => {
-	return process.env["ANDROID_HOME"] ? path.default.join(process.env["ANDROID_HOME"], "platform-tools", "adb") : "adb";
+const readAttribute = (line, marker) => {
+	const start = line.indexOf(marker);
+	if (start === -1) return null;
+	const rest = line.slice(start + marker.length);
+	if (rest.startsWith("\"")) return readQuotedValue(rest.slice(1));
+	return rest.match(/^@[\w./:]+/)?.[0];
 };
 /**
-* Parses the output of the 'adb devices' command
+* A `<meta-data>` value from `aapt2 dump xmltree` of the manifest: the
+* literal, or a resource reference such as `@string/channel`. null when the
+* manifest has none, and undefined when aapt2 printed one it cannot read
+* exactly.
 */
-const parseDevicesResult = ({ result }) => {
-	if (!result) return [];
-	const devices = [];
-	const lines = result.trim().split(/\r?\n/);
-	for (const line of lines) {
-		const [device, state] = line.split(/[ ,\t]+/).filter((w) => w !== "");
-		if (device && state === "device") devices.push(device);
+const parseManifestMetaData = (xmltree, name) => {
+	const lines = xmltree.split("\n");
+	for (let i = 0; i < lines.length; i++) {
+		if (!/^\s*E: meta-data\b/.test(lines[i])) continue;
+		let metaDataName = null;
+		let value = null;
+		for (let j = i + 1; j < lines.length && /^\s*A: /.test(lines[j]); j++) {
+			metaDataName ||= readAttribute(lines[j], ":name(0x01010003)=");
+			if (value === null) value = readAttribute(lines[j], ":value(0x01010024)=");
+		}
+		if (metaDataName === name) return value ?? void 0;
 	}
-	return devices;
+	return null;
 };
 /**
-* Executes the commands needed to get a list of devices from ADB
+* The `android:versionName` of the `<manifest>` element in `aapt2 dump
+* xmltree`, which Gradle merges from the variant, with its suffixes: null
+* without one, and undefined when it cannot be read exactly.
 */
-const getConnectedDevices = async () => {
-	const adbPath = getAdbPath();
+const parseManifestVersionName = (xmltree) => {
+	for (const line of xmltree.split("\n")) {
+		const value = readAttribute(line, ":versionName(0x0101021c)=");
+		if (value !== null) return value;
+	}
+	return null;
+};
+/**
+* The `android:versionCode` of the `<manifest>` element in `aapt2 dump
+* xmltree`, an integer aapt2 prints bare or quoted: null without one.
+*/
+const parseManifestVersionCode = (xmltree) => {
+	const match = /:versionCode\(0x0101021b\)="?(\d+)/.exec(xmltree);
+	return match ? Number(match[1]) : null;
+};
+/**
+* The string a resource reference resolves to, from `aapt2 dump resources`:
+* its default configuration's value, or else its first. undefined when the
+* table has none aapt2 printed on one line.
+*/
+const parseResourceString = (resources, reference) => {
+	const lines = resources.split("\n");
+	const start = lines.findIndex((line) => {
+		const [, id, name] = line.match(/^\s*resource (0x[0-9a-f]+) (\S+)/) ?? [];
+		return id !== void 0 && (reference === `@${id}` || reference === `@${name}`);
+	});
+	if (start === -1) return;
+	const values = [];
+	for (let i = start + 1; i < lines.length; i++) {
+		if (/^\s*resource 0x/.test(lines[i])) break;
+		const match = lines[i].match(/^\s*\(([^)]*)\) "(.*)"$/);
+		if (match) values.push({
+			config: match[1],
+			value: match[2]
+		});
+	}
+	return (values.find(({ config }) => config === "") ?? values[0])?.value;
+};
+/**
+* An `.aab` module is a proto-format APK under `base/`, which aapt2 reads
+* once its manifest and resource table sit at the root of a zip.
+*/
+const writeBaseModuleApk = async (aabPath, directory) => {
+	const bundle = await jszip.default.loadAsync(await fs.default.promises.readFile(aabPath));
+	const module = new jszip.default();
+	for (const [entry, name] of [["base/manifest/AndroidManifest.xml", "AndroidManifest.xml"], ["base/resources.pb", "resources.pb"]]) {
+		const file = bundle.file(entry);
+		if (file) module.file(name, await file.async("uint8array"));
+	}
+	const apkPath = path.default.join(directory, "base.apk");
+	await fs.default.promises.writeFile(apkPath, await module.generateAsync({ type: "uint8array" }));
+	return apkPath;
+};
+/**
+* What the built `.apk` or `.aab` reports at runtime: the `versionName` and
+* the `com.hotupdater.CHANNEL` meta-data Gradle merged into its manifest,
+* from flavors, build types and `versionNameSuffix`. Without aapt2 it
+* returns undefined, and the build reports the project's values.
+*/
+const readBuiltApp = async ({ artifactPath, androidProjectPath }) => {
+	const aapt2 = findAapt2(androidProjectPath);
+	if (!aapt2) {
+		_hot_updater_cli_tools.p.log.warn("aapt2 was not found in the Android SDK's build-tools, so the build reports the app version and channel of the project files.");
+		return;
+	}
+	const directory = await fs.default.promises.mkdtemp(path.default.join(os.default.tmpdir(), "android-helper-"));
 	try {
-		const { stdout } = await (0, execa.execa)(adbPath, ["devices"]);
-		return parseDevicesResult({ result: stdout });
-	} catch {
-		return [];
+		const apkPath = artifactPath.endsWith(".aab") ? await writeBaseModuleApk(artifactPath, directory) : artifactPath;
+		const { stdout: xmltree } = await (0, execa.execa)(aapt2, [
+			"dump",
+			"xmltree",
+			"--file",
+			"AndroidManifest.xml",
+			apkPath
+		]);
+		let resources;
+		const resolve = async (value) => {
+			if (!value?.startsWith("@")) return value;
+			resources ??= (0, execa.execa)(aapt2, [
+				"dump",
+				"resources",
+				apkPath
+			]).then(({ stdout }) => stdout);
+			return parseResourceString(await resources, value);
+		};
+		const appVersion = await resolve(parseManifestVersionName(xmltree));
+		const channel = await resolve(parseManifestMetaData(xmltree, CHANNEL_META_DATA_KEY));
+		if (appVersion === void 0 || channel === void 0) _hot_updater_cli_tools.p.log.warn("aapt2 printed the artifact's versionName or com.hotupdater.CHANNEL in a form that cannot be read exactly, so the build reports the project files' value for it.");
+		const versionCode = parseManifestVersionCode(xmltree);
+		return {
+			appVersion: appVersion ?? null,
+			channel,
+			buildNumber: versionCode === null ? null : String(versionCode)
+		};
+	} finally {
+		await fs.default.promises.rm(directory, {
+			recursive: true,
+			force: true
+		});
 	}
 };
 /**
-* Runs ADB reverse tcp:8081 tcp:8081 to allow loading the jsbundle from the packager
-* Set up port forwarding from device to development server using adb reverse
+* The application ID of the built `.apk` or `.aab`, the package name Google
+* Play files it under, with the suffixes flavors and build types add.
+* undefined without aapt2.
 */
-async function tryRunAdbReverse({ port = 8081, deviceId }) {
+const readBuiltPackageName = async ({ artifactPath, androidProjectPath }) => {
+	const aapt2 = findAapt2(androidProjectPath);
+	if (!aapt2) return;
+	const directory = await fs.default.promises.mkdtemp(path.default.join(os.default.tmpdir(), "android-helper-"));
 	try {
-		const adbPath = getAdbPath();
-		const adbArgs = [
-			"-s",
-			deviceId,
-			"reverse",
-			`tcp:${port}`,
-			`tcp:${port}`
-		];
-		_hot_updater_cli_tools.p.log.info(`Connecting "${deviceId}" to the development server`);
-		await (0, execa.execa)(adbPath, adbArgs);
-	} catch {
-		throw new Error(`Failed to connect "${deviceId}" to development server using "adb reverse"`);
+		const apkPath = artifactPath.endsWith(".aab") ? await writeBaseModuleApk(artifactPath, directory) : artifactPath;
+		const { stdout } = await (0, execa.execa)(aapt2, [
+			"dump",
+			"packagename",
+			apkPath
+		]);
+		return stdout.trim() || void 0;
+	} finally {
+		await fs.default.promises.rm(directory, {
+			recursive: true,
+			force: true
+		});
 	}
-}
+};
 /**
-* Get name of Android emulator
-*/
-const getEmulatorName = async (deviceId) => {
-	const adbPath = getAdbPath();
-	const { stdout } = await (0, execa.execa)(adbPath, [
-		"-s",
-		deviceId,
-		"emu",
-		"avd",
-		"name"
-	], { stdio: "pipe" });
-	if (!stdout) return "";
-	return stdout.split(node_os.default.EOL)[0].replace(/(\r\n|\n|\r)/gm, "").trim();
-};
-/**
-* Get Android device name in readable format
-*/
-const getPhoneName = async (deviceId) => {
-	const adbPath = getAdbPath();
-	const { stdout } = await (0, execa.execa)(adbPath, [
-		"-s",
-		deviceId,
-		"shell",
-		"getprop",
-		"ro.product.model"
-	], { stdio: "pipe" });
-	return stdout.replace(/\[ro\.product\.model\]:\s*\[(.*)\]/, "$1").trim();
-};
-/**
-* Check if emulator has finished booting
-*/
-const isEmulatorBooted = async (device) => {
-	const adbPath = getAdbPath();
-	const adbArgs = [
-		"-s",
-		device,
-		"shell",
-		"getprop",
-		"sys.boot_completed"
-	];
+* The version code of the built `.apk` or `.aab`, which Google Play files
+* its releases by. undefined without aapt2, or when the manifest has none.
+*/
+const readBuiltVersionCode = async ({ artifactPath, androidProjectPath }) => {
+	const aapt2 = findAapt2(androidProjectPath);
+	if (!aapt2) return;
+	const directory = await fs.default.promises.mkdtemp(path.default.join(os.default.tmpdir(), "android-helper-"));
 	try {
-		const { stdout } = await (0, execa.execa)(adbPath, adbArgs, { stdio: "pipe" });
-		return stdout.trim() === "1";
-	} catch {
-		return false;
+		const apkPath = artifactPath.endsWith(".aab") ? await writeBaseModuleApk(artifactPath, directory) : artifactPath;
+		const { stdout } = await (0, execa.execa)(aapt2, [
+			"dump",
+			"xmltree",
+			"--file",
+			"AndroidManifest.xml",
+			apkPath
+		]);
+		return parseManifestVersionCode(stdout) ?? void 0;
+	} finally {
+		await fs.default.promises.rm(directory, {
+			recursive: true,
+			force: true
+		});
+	}
+};
+//#endregion
+//#region src/buildAndroid.ts
+const buildAndroid = async ({ schemeConfig, minBundleId = (0, _hot_updater_cli_tools.createMinBundleId)(), credentials }) => {
+	const androidProjectPath = path.default.join((0, _hot_updater_cli_tools.getCwd)(), "android");
+	const result = await runGradle({
+		args: { extraParams: [`-PMIN_BUNDLE_ID=${minBundleId}`] },
+		env: await resolveGradleSigningEnv({
+			schemeConfig,
+			credentials
+		}),
+		appModuleName: schemeConfig.appModuleName,
+		tasks: schemeConfig.aab ? [`bundle${schemeConfig.variant}`] : [`assemble${schemeConfig.variant}`],
+		logPrefix: `android-${schemeConfig.hotUpdaterSchemeName}-build`,
+		androidProjectPath
+	});
+	return {
+		...result,
+		builtApp: await readBuiltApp({
+			artifactPath: result.buildArtifactPath,
+			androidProjectPath
+		})
+	};
+};
+//#endregion
+//#region src/uploadToPlay.ts
+const API_URL = "https://androidpublisher.googleapis.com";
+/** Where Google serves resumable upload sessions, as its docs show both. */
+const UPLOAD_ORIGINS = /* @__PURE__ */ new Set([API_URL, "https://www.googleapis.com"]);
+const DEFAULT_TOKEN_URI = "https://oauth2.googleapis.com/token";
+const SCOPE = "https://www.googleapis.com/auth/androidpublisher";
+/** Google accepts assertions that expire within an hour. */
+const ASSERTION_LIFETIME_SECONDS = 3600;
+/** An access token is replaced well before it expires. */
+const TOKEN_REUSE_MS = 27e5;
+/** Google asks for multiples of 256 KiB; only one chunk is held in memory. */
+const CHUNK_SIZE = 8388608;
+/** Attempts per chunk, each resuming at the offset Google confirms. */
+const CHUNK_ATTEMPTS = 3;
+/** Commits while Google is still processing the uploaded bundle. */
+const COMMIT_ATTEMPTS = 6;
+/** The track `--submit play-internal` releases to. */
+const INTERNAL_TRACK = "internal";
+const BUNDLE_STILL_PROCESSING = "Some of the Android App Bundle uploads are not completed yet";
+const NEEDS_CHANGES_NOT_SENT_FOR_REVIEW = "Please set the query parameter changesNotSentForReview to true";
+const DRAFT_APP_ERRORS = ["Only releases with status draft may be created on draft app"];
+/** A Google Play Developer API request that failed, with Google's message. */
+var GooglePlayError = class extends Error {
+	status;
+	apiMessage;
+	constructor(action, status, apiMessage) {
+		super(`${action} failed (HTTP ${status})${apiMessage ? `: ${apiMessage}` : "."}`);
+		this.name = "GooglePlayError";
+		this.status = status;
+		this.apiMessage = apiMessage;
 	}
 };
-const emulatorCommand = process.env["ANDROID_HOME"] ? `${process.env["ANDROID_HOME"]}/emulator/emulator` : "emulator";
 /**
-* Get a list of available Android emulators
+* Reads the service account JSON in memory: its private key never touches
+* the disk, and its contents are never echoed.
 */
-const getEmulatorNames = async () => {
+const readServiceAccount = (json) => {
+	let parsed;
+	try {
+		parsed = JSON.parse(json);
+	} catch {
+		throw new Error("The Play service account is not a JSON key file.");
+	}
+	const { client_email, private_key, token_uri } = parsed;
+	if (typeof client_email !== "string" || typeof private_key !== "string") throw new Error("The Play service account has no client_email or private_key: use the JSON key file Google Cloud creates for the service account.");
+	(0, _hot_updater_cli_tools.registerSecretValue)(private_key);
+	let privateKey;
 	try {
-		const { stdout } = await (0, execa.execa)(emulatorCommand, ["-list-avds"], { stdio: "pipe" });
-		return stdout.split(node_os.default.EOL).filter((name) => name !== "" && !name.includes(" "));
+		privateKey = crypto.default.createPrivateKey(private_key);
 	} catch {
-		return [];
+		throw new Error("The Play service account's private_key is no private key.");
 	}
+	const tokenUri = typeof token_uri === "string" ? token_uri : DEFAULT_TOKEN_URI;
+	if (new URL(tokenUri).protocol !== "https:") throw new Error("The Play service account's token_uri is not an https URL.");
+	return {
+		clientEmail: client_email,
+		privateKey,
+		tokenUri
+	};
+};
+/** The RS256 JWT a service account exchanges for an access token. */
+const createServiceAccountAssertion = ({ clientEmail, privateKey, tokenUri, issuedAtSeconds = Math.floor(Date.now() / 1e3) }) => {
+	const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+	const signingInput = `${encode({
+		alg: "RS256",
+		typ: "JWT"
+	})}.${encode({
+		iss: clientEmail,
+		scope: SCOPE,
+		aud: tokenUri,
+		iat: issuedAtSeconds,
+		exp: issuedAtSeconds + ASSERTION_LIFETIME_SECONDS
+	})}`;
+	return `${signingInput}.${crypto.default.sign("sha256", Buffer.from(signingInput), privateKey).toString("base64url")}`;
 };
-const checkEmulatorBootStatus = async ({ port, emulatorName, loader, onBooted }) => {
-	const connected = (await getConnectedDevices()).find((d) => d.includes(`${port}`));
-	if (connected) {
-		loader.message(`Emulator "${emulatorName}" is connected. Waiting for boot`);
-		if (await isEmulatorBooted(connected)) onBooted(connected);
+const readApiMessage = async (response) => {
+	const body = await response.json().catch(() => void 0);
+	if (typeof body?.error === "object" && typeof body.error.message === "string") return body.error.message;
+	if (typeof body?.error_description === "string") return body.error_description;
+	return typeof body?.error === "string" ? body.error : "";
+};
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+* Google Play refused the upload: it already has a bundle or APK with the
+* `.aab`'s version code, from this or another upload, and takes each version
+* code once.
+*/
+var PlayVersionCodeUsedError = class extends Error {
+	name = "PlayVersionCodeUsedError";
+	constructor(options) {
+		super("Google Play already has this .aab's version code. Raise versionCode for every build you upload.", options);
 	}
 };
 /**
-* Launch the Android emulator and wait for it to boot
+* What Google's message means for the user, for the failures a release to
+* a track runs into.
 */
-const launchEmulator = async (emulatorName, port, loader) => {
-	const manualCommand = `${emulatorCommand} -avd ${emulatorName}`;
-	const timeout = 120;
-	const cp = (0, execa.execa)(emulatorCommand, [
-		"-avd",
-		emulatorName,
-		"-port",
-		`${port}`
-	], {
-		detached: true,
-		stdio: "ignore"
-	});
-	cp.unref();
-	return new Promise((resolve, reject) => {
-		let bootCheckInterval;
-		let rejectTimeout;
-		const cleanup = () => {
-			clearTimeout(rejectTimeout);
-			clearInterval(bootCheckInterval);
-		};
-		const handleError = (message) => {
-			cleanup();
-			reject(new Error(message));
-		};
-		bootCheckInterval = setInterval(async () => {
-			await checkEmulatorBootStatus({
-				port,
-				emulatorName,
-				loader,
-				onBooted: (deviceId) => {
-					cleanup();
-					resolve(deviceId);
-				}
+const explain = (error, packageName) => {
+	if (!(error instanceof GooglePlayError)) return error;
+	const { status, apiMessage } = error;
+	if (status === 401 || /does not have permission/i.test(apiMessage)) return new Error(`The Play service account cannot release ${packageName}. Invite its email in Play Console under Users and permissions, with permission to release to testing tracks, and enable the Google Play Android Developer API in its Google Cloud project.`, { cause: error });
+	if (/package not found/i.test(apiMessage)) return new Error(`Google Play has no app ${packageName}. Create the app in Play Console and upload its first .aab there; the API releases the builds after it.`, { cause: error });
+	if (/version code .*(already been used|already used)/i.test(apiMessage)) return new PlayVersionCodeUsedError({ cause: error });
+	return error;
+};
+/**
+* Requests to the Google Play Developer API for `packageName`, as the
+* service account: each carries an access token, exchanged for a signed
+* assertion and replaced well before it expires.
+*/
+const createPlayClient = ({ json, packageName, fetch }) => {
+	const account = readServiceAccount(json);
+	let token;
+	const authorization = async () => {
+		if (!token || Date.now() - token.issuedAtMs >= TOKEN_REUSE_MS) {
+			const issuedAtMs = Date.now();
+			const assertion = createServiceAccountAssertion(account);
+			(0, _hot_updater_cli_tools.registerSecretValue)(assertion);
+			const response = await fetch(account.tokenUri, {
+				method: "POST",
+				headers: { "Content-Type": "application/x-www-form-urlencoded" },
+				body: new URLSearchParams({
+					grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+					assertion
+				}).toString()
 			});
-		}, 1e3);
-		rejectTimeout = setTimeout(() => {
-			handleError(`It took too long to start and connect with Android emulator: ${emulatorName}. You can try starting the emulator manually from the terminal with: ${manualCommand}`);
-		}, timeout * 1e3);
-		cp.catch((error) => {
-			handleError(error);
+			if (!response.ok) throw new Error(`Google refused the Play service account (HTTP ${response.status}): ${await readApiMessage(response) || "check that its key is current and the service account is enabled."}`);
+			const { access_token } = await response.json();
+			if (typeof access_token !== "string" || !access_token) throw new Error("Google answered the Play service account with no access token.");
+			(0, _hot_updater_cli_tools.registerSecretValue)(access_token);
+			token = {
+				value: access_token,
+				issuedAtMs
+			};
+		}
+		return `Bearer ${token.value}`;
+	};
+	const app = `/androidpublisher/v3/applications/${encodeURIComponent(packageName)}`;
+	const request = async (action, method, url, body) => {
+		const response = await fetch(url, {
+			method,
+			headers: {
+				Authorization: await authorization(),
+				...body ? { "Content-Type": "application/json" } : {}
+			},
+			...body ? { body: JSON.stringify(body) } : {}
 		});
-	});
+		if (!response.ok) throw new GooglePlayError(action, response.status, await readApiMessage(response));
+		return response.status === 204 ? void 0 : await response.json();
+	};
+	return {
+		app,
+		authorization,
+		request
+	};
 };
-const defaultPort = 5554;
-const maxPort = 5682;
-/**
-* Find an available port for emulator (starting from 5554)
-*/
-const getAvailableDevicePort = async (startPort = defaultPort) => {
-	/**
-	* The default value is 5554 for the first virtual device instance running on your machine.
-	* A virtual device normally occupies a pair of adjacent ports: a console port and an adb port.
-	* The console of the first virtual device running on a particular machine uses console port 5554 and adb port 5555.
-	* Subsequent instances use port numbers increasing by two.
-	* For example, 5556/5557, 5558/5559, and so on. The range is 5554 to 5682, allowing for 64 concurrent virtual devices.
-	*/
-	const devices = await getConnectedDevices();
-	for (let port = startPort; port <= maxPort; port += 2) if (!devices.some((d) => d.includes(port.toString()))) return port;
-	throw new Error("Failed to launch emulator: no available ports");
-};
-/**
-* Try to launch an emulator (or find the first available one)
-*/
-const tryLaunchEmulator = async (name) => {
-	const port = await getAvailableDevicePort();
-	const spinner = _hot_updater_cli_tools.p.spinner();
-	spinner.start("Looking for available emulators");
-	const emulators = await getEmulatorNames();
-	const emulatorName = name ?? emulators[0];
-	let deviceId;
-	if (emulators.length > 0) try {
-		spinner.message(`Launching emulator "${emulatorName}"`);
-		deviceId = await launchEmulator(emulatorName, port, spinner);
-		spinner.stop(`Launched ${emulatorName} emulator.`);
+/**
+* Whether Google Play's internal testing track already releases the
+* `.aab`'s version code, as when a reused native build was uploaded
+* before. It reads the track in an edit it then deletes, changing nothing.
+*/
+const findPlayInternalRelease = async ({ versionCode, packageName, serviceAccount: { json }, fetch = globalThis.fetch }) => {
+	const { app, request } = createPlayClient({
+		json,
+		packageName,
+		fetch
+	});
+	let editId;
+	try {
+		({id: editId} = await request("Opening a Google Play edit", "POST", `${API_URL}${app}/edits`, {}));
 	} catch (error) {
-		spinner.error(`Failed to launch ${emulatorName} emulator. ${error.message}`);
+		throw explain(error, packageName);
+	}
+	const edit = `${API_URL}${app}/edits/${encodeURIComponent(editId)}`;
+	try {
+		const { releases = [] } = await request("Reading the internal track", "GET", `${edit}/tracks/${INTERNAL_TRACK}`);
+		return releases.some(({ versionCodes = [] }) => versionCodes.includes(String(versionCode)));
+	} catch (error) {
+		throw explain(error, packageName);
+	} finally {
+		await request("Deleting the Google Play edit", "DELETE", edit).catch(() => void 0);
 	}
-	else spinner.error("No emulators found as an output of `emulator -list-avds`. Please launch an emulator manually or connect a device");
-	return deviceId;
 };
 /**
-* List all Android devices and emulators (connected and available)
+* The common name of every Android debug certificate: Android Studio's and
+* the Android Gradle plugin's (`CN=Android Debug, O=Android, C=US`), and React
+* Native's template `debug.keystore` (`CN=Android Debug, OU=Android,
+* O=Unknown, …`), as `keytool` prints the owner, whatever the label's
+* language.
 */
-const listDevices = async () => {
-	const devices = await getConnectedDevices();
-	const allDevices = [];
-	for (const deviceId of devices) if (deviceId.includes("emulator")) {
-		const emulatorData = {
-			deviceId,
-			readableName: await getEmulatorName(deviceId),
-			connected: true,
-			type: "emulator"
-		};
-		allDevices.push(emulatorData);
-	} else {
-		const phoneData = {
-			deviceId,
-			readableName: await getPhoneName(deviceId),
-			type: "phone",
-			connected: true
-		};
-		allDevices.push(phoneData);
-	}
-	const emulatorNames = await getEmulatorNames();
-	for (const emulatorName of emulatorNames) {
-		if (allDevices.some((device) => device.readableName === emulatorName)) continue;
-		const emulatorData = {
-			deviceId: void 0,
-			readableName: emulatorName,
-			type: "emulator",
-			connected: false
+const ANDROID_DEBUG_SIGNER = /:\s*CN=Android Debug\s*(?:,|$)/mu;
+/**
+* Throws when the `.aab` is signed with the Android debug keystore, which
+* Google Play refuses: a release build type left on `signingConfigs.debug`,
+* as React Native's template ships it. It reads the signer with the JDK's
+* `keytool`, which Gradle needs too; without one it checks nothing.
+*/
+const assertPlaySigned = async (aabPath) => {
+	const { stdout, exitCode } = await (0, execa.execa)("keytool", [
+		"-J-Duser.language=en",
+		"-printcert",
+		"-jarfile",
+		aabPath
+	], { reject: false });
+	if (exitCode === 0 && ANDROID_DEBUG_SIGNER.test(String(stdout))) throw new Error(`Google Play refuses an .aab signed with the Android debug keystore, and ${aabPath} is. Set the scheme's signing.keystore, or a release signingConfig in android/app/build.gradle, then build again.`);
+};
+/**
+* Uploads an `.aab` to Google Play's internal testing track with the Google
+* Play Developer API: it opens an edit, uploads the bundle, releases its
+* version code to the internal track, and commits the edit, which it
+* deletes again when any step fails. The service account stays in memory.
+*/
+const uploadToPlay = async ({ aabPath, packageName, serviceAccount: { json }, fetch = globalThis.fetch, commitRetryDelayMs = 2e3 }) => {
+	const { app, authorization, request } = createPlayClient({
+		json,
+		packageName,
+		fetch
+	});
+	let editId;
+	try {
+		({id: editId} = await request("Opening a Google Play edit", "POST", `${API_URL}${app}/edits`, {}));
+	} catch (error) {
+		throw explain(error, packageName);
+	}
+	const edit = `${API_URL}${app}/edits/${encodeURIComponent(editId)}`;
+	try {
+		_hot_updater_cli_tools.p.log.info(`Uploading ${packageName}'s .aab to Google Play`);
+		const versionCode = await uploadBundle({
+			aabPath,
+			sessionUrl: `${API_URL}/upload${app}/edits/${encodeURIComponent(editId)}/bundles?uploadType=resumable`,
+			authorization,
+			fetch
+		});
+		const release = async (status) => {
+			await request("Releasing to the internal track", "PUT", `${edit}/tracks/${INTERNAL_TRACK}`, {
+				track: INTERNAL_TRACK,
+				releases: [{
+					versionCodes: [String(versionCode)],
+					status
+				}]
+			});
+			await commit({
+				request,
+				edit,
+				retryDelayMs: commitRetryDelayMs
+			});
 		};
-		allDevices.push(emulatorData);
+		try {
+			await release("completed");
+			return {
+				versionCode,
+				status: "completed"
+			};
+		} catch (error) {
+			if (!(error instanceof GooglePlayError) || !DRAFT_APP_ERRORS.some((message) => error.apiMessage.includes(message))) throw error;
+			_hot_updater_cli_tools.p.log.warn(`Play Console has not published ${packageName} yet, which takes only draft releases. The internal release of version code ${versionCode} is a draft: roll it out in Play Console.`);
+			await release("draft");
+			return {
+				versionCode,
+				status: "draft"
+			};
+		}
+	} catch (error) {
+		await request("Deleting the Google Play edit", "DELETE", edit).catch(() => void 0);
+		throw explain(error, packageName);
 	}
-	return allDevices.sort((a, b) => {
-		if (a.type === "phone" && b.type === "emulator") return -1;
-		if (a.type === "emulator" && b.type === "phone") return 1;
-		return 0;
-	});
 };
-const matchingDevice = (devices, deviceArg) => {
-	const deviceByName = devices.find((device) => device.readableName === deviceArg);
-	const deviceById = devices.find((d) => d.deviceId === deviceArg);
-	return deviceByName || deviceById;
-};
-const selectTargetDevice = async ({ interactive, deviceOption }) => {
-	const availableDevices = await listDevices();
-	if (deviceOption === true && !interactive) {
-		_hot_updater_cli_tools.p.log.error("you can't select device manually with non-interactive cli mode(without -i option).");
-		process.exit(1);
-	}
-	if (typeof deviceOption === "string") {
-		const matchedDevice = matchingDevice(availableDevices, deviceOption);
-		if (!matchedDevice) {
-			_hot_updater_cli_tools.p.log.error(`device '${deviceOption}' isn't included in the attached devices.`);
-			process.exit(1);
+/**
+* Commits the edit, again while Google is still processing the bundle, and
+* with `changesNotSentForReview` when the app's state asks for it. An
+* unanswered commit is reported as unconfirmed, since Google may have
+* applied it.
+*/
+const commit = async ({ request, edit, retryDelayMs }) => {
+	let changesNotSentForReview = false;
+	for (let attempt = 1;; attempt++) try {
+		await request("Committing the Google Play edit", "POST", `${edit}:commit${changesNotSentForReview ? "?changesNotSentForReview=true" : ""}`);
+		if (changesNotSentForReview) _hot_updater_cli_tools.p.log.warn("Google Play saved the release without sending it for review, as the app's state requires. Send the changes for review in Play Console.");
+		return;
+	} catch (error) {
+		if (!(error instanceof GooglePlayError) || error.status >= 500 || error.status === 429) throw new Error(`Google Play did not confirm the release: ${error instanceof Error ? error.message : String(error)} Check internal testing in Play Console before you upload this version code again.`, { cause: error });
+		if (error.status !== 400) throw error;
+		if (!changesNotSentForReview && error.apiMessage.includes(NEEDS_CHANGES_NOT_SENT_FOR_REVIEW)) {
+			changesNotSentForReview = true;
+			continue;
 		}
-		return matchedDevice;
-	}
-	if (interactive) {
-		if (!availableDevices.length) {
-			_hot_updater_cli_tools.p.log.error("you passed -d option but there is no attached adb devices.");
-			process.exit(1);
+		if (error.apiMessage.includes(BUNDLE_STILL_PROCESSING) && attempt < COMMIT_ATTEMPTS) {
+			await sleep(retryDelayMs * 2 ** (attempt - 1));
+			continue;
 		}
-		const device = await _hot_updater_cli_tools.p.select({
-			message: "Target Device",
-			options: availableDevices.map((d) => ({
-				value: d,
-				label: d.readableName
-			}))
+		throw error;
+	}
+};
+/**
+* Uploads the `.aab` in a resumable upload session, one chunk in memory at a
+* time. A chunk that fails without an answer resumes at the offset Google
+* confirms. Returns the bundle's version code.
+*/
+const uploadBundle = async ({ aabPath, sessionUrl, authorization, fetch }) => {
+	const file = await fs.default.promises.open(aabPath, "r");
+	try {
+		const { size } = await file.stat();
+		if (size === 0) throw new Error("The .aab is empty.");
+		const started = await fetch(sessionUrl, {
+			method: "POST",
+			headers: {
+				Authorization: await authorization(),
+				"X-Upload-Content-Type": "application/octet-stream",
+				"X-Upload-Content-Length": String(size)
+			}
 		});
-		if (_hot_updater_cli_tools.p.isCancel(device)) process.exit(1);
-		return device;
+		if (!started.ok) throw new GooglePlayError("Starting the .aab upload", started.status, await readApiMessage(started));
+		const location = started.headers.get("location");
+		if (!location || !UPLOAD_ORIGINS.has(new URL(location).origin)) throw new Error("Google returned no upload session for the .aab.");
+		let offset = 0;
+		let failures = 0;
+		/**
+		* Resumes at the offset Google confirms. Progress starts a new retry
+		* budget; an attempt that keeps nothing counts against it.
+		*/
+		const resumeAt = (confirmed, reason) => {
+			if (confirmed > offset) {
+				offset = confirmed;
+				failures = 0;
+				return;
+			}
+			offset = confirmed;
+			if (++failures === CHUNK_ATTEMPTS) throw new Error(`Uploading the .aab failed: ${reason}.`);
+		};
+		for (;;) {
+			const end = Math.min(offset + CHUNK_SIZE, size);
+			const body = Buffer.alloc(end - offset);
+			const { bytesRead } = await file.read(body, 0, body.length, offset);
+			if (bytesRead !== body.length) throw new Error("The .aab changed while it was uploading.");
+			const response = await fetch(location, {
+				method: "PUT",
+				headers: {
+					"Content-Range": `bytes ${offset}-${end - 1}/${size}`,
+					"Content-Type": "application/octet-stream"
+				},
+				body
+			}).catch((error) => error);
+			if (!(response instanceof Error) && response.ok) return readVersionCode(response);
+			if (!(response instanceof Error) && response.status === 308) {
+				resumeAt(confirmedOffset(response), "Google kept none of a chunk");
+				if (failures > 0) await sleep(1e3 * failures);
+				continue;
+			}
+			if (!(response instanceof Error) && response.status < 500 && response.status !== 429) throw new GooglePlayError("Uploading the .aab", response.status, await readApiMessage(response));
+			await sleep(1e3 * (failures + 1));
+			const status = await fetch(location, {
+				method: "PUT",
+				headers: { "Content-Range": `bytes */${size}` }
+			}).catch(() => void 0);
+			if (status?.ok) return readVersionCode(status);
+			resumeAt(status?.status === 308 ? confirmedOffset(status) : offset, response instanceof Error ? response.message : `HTTP ${response.status}`);
+		}
+	} finally {
+		await file.close();
 	}
 };
-const Device = {
-	getAdbPath,
-	getConnectedDevices,
-	tryRunAdbReverse,
-	tryLaunchEmulator,
-	listDevices,
-	selectTargetDevice
+/** The version code of the bundle a finished upload answers with. */
+const readVersionCode = async (response) => {
+	const { versionCode } = await response.json();
+	if (typeof versionCode !== "number") throw new Error("Google Play read no version code from the .aab.");
+	return versionCode;
+};
+/**
+* The next offset of a `308 Resume Incomplete`: past its `Range`, which
+* Google sends as `bytes=0-<last>` or `0-<last>`, and 0 without one.
+*/
+const confirmedOffset = (response) => {
+	const range = response.headers.get("range")?.match(/^(?:bytes=)?0-(\d+)$/);
+	return range ? Number(range[1]) + 1 : 0;
+};
+/**
+* The Play service account a scheme's `.aab` uploads with: the
+* `play-service-account` item. It reads only the config, before the native
+* projects are written, and throws for a scheme whose build Google Play
+* would not take as a release: an `.apk`, which Play takes only as an `.aab`
+* from new apps, or a debug variant, which Play refuses.
+*/
+const resolvePlayUploadServiceAccount = ({ scheme, androidScheme }) => {
+	if (androidScheme.aab === false) throw new Error(`Google Play takes an .aab, and the scheme ${scheme} builds an .apk (aab: false).`);
+	const variant = androidScheme.variant ?? "Release";
+	if (/debug$/i.test(variant)) throw new Error(`Google Play takes a release build, and the scheme ${scheme} builds the ${variant} variant, which is debuggable and loads its JavaScript from Metro.`);
+	return {
+		kind: "play-service-account",
+		name: "play-service-account"
+	};
 };
 //#endregion
-//#region src/runner/tryInstallAppOnDevice.ts
-const tryInstallAppOnDevice = async ({ device, apkPath }) => {
-	if (!device.deviceId) {
-		_hot_updater_cli_tools.p.log.warn(`No device with id "${device.deviceId}", skipping launching the app.`);
+//#region src/utils/enrichNativeBuildAndroidScheme.ts
+const enrichNativeBuildAndroidScheme = async ({ schemeConfig, hotUpdaterSchemeName }) => {
+	return {
+		aab: true,
+		variant: "Release",
+		appModuleName: "app",
+		applicationId: schemeConfig.packageName,
+		...schemeConfig,
+		hotUpdaterSchemeName
+	};
+};
+//#endregion
+//#region src/utils/extractBuiltInBundle.ts
+const EOCD_SIGNATURE = 101010256;
+const ZIP64_EOCD_LOCATOR_SIGNATURE = 117853008;
+const ZIP64_EOCD_SIGNATURE = 101075792;
+const CENTRAL_HEADER_SIGNATURE = 33639248;
+const LOCAL_HEADER_SIGNATURE = 67324752;
+const ZIP64_EXTRA_ID = 1;
+const UINT32_MAX = 4294967295;
+/** The end-of-central-directory record and the longest comment after it. */
+const EOCD_SEARCH_LENGTH = 65557;
+const read = async (file, offset, length) => {
+	const buffer = Buffer.alloc(length);
+	const { bytesRead } = await file.read(buffer, 0, length, offset);
+	return buffer.subarray(0, bytesRead);
+};
+/** The central directory's offset and size, from its end record (ZIP64 too). */
+const centralDirectoryOf = async (file) => {
+	const { size } = await file.stat();
+	const start = Math.max(0, size - EOCD_SEARCH_LENGTH);
+	const tail = await read(file, start, size - start);
+	for (let i = tail.length - 22; i >= 0; i -= 1) {
+		if (tail.readUInt32LE(i) !== EOCD_SIGNATURE) continue;
+		const entries = tail.readUInt16LE(i + 10);
+		let directorySize = tail.readUInt32LE(i + 12);
+		let directoryOffset = tail.readUInt32LE(i + 16);
+		if (directoryOffset === UINT32_MAX || directorySize === UINT32_MAX) {
+			const locator = i - 20;
+			if (locator < 0 || tail.readUInt32LE(locator) !== ZIP64_EOCD_LOCATOR_SIGNATURE) throw new Error("The archive's ZIP64 end record is missing.");
+			const record = await read(file, Number(tail.readBigUInt64LE(locator + 8)), 56);
+			if (record.readUInt32LE(0) !== ZIP64_EOCD_SIGNATURE) throw new Error("The archive's ZIP64 end record is invalid.");
+			directorySize = Number(record.readBigUInt64LE(40));
+			directoryOffset = Number(record.readBigUInt64LE(48));
+		}
+		return {
+			entries,
+			directoryOffset,
+			directorySize
+		};
+	}
+	throw new Error("The artifact is not a zip archive.");
+};
+/** One entry's location, from the central directory, without reading the rest of the archive. */
+const findEntry = async (file, name) => {
+	const { directoryOffset, directorySize } = await centralDirectoryOf(file);
+	const directory = await read(file, directoryOffset, directorySize);
+	for (let i = 0; i + 46 <= directory.length;) {
+		if (directory.readUInt32LE(i) !== CENTRAL_HEADER_SIGNATURE) break;
+		const method = directory.readUInt16LE(i + 10);
+		let compressedSize = directory.readUInt32LE(i + 20);
+		const uncompressedSize = directory.readUInt32LE(i + 24);
+		const nameLength = directory.readUInt16LE(i + 28);
+		const extraLength = directory.readUInt16LE(i + 30);
+		const commentLength = directory.readUInt16LE(i + 32);
+		let localHeaderOffset = directory.readUInt32LE(i + 42);
+		if (directory.toString("utf8", i + 46, i + 46 + nameLength) === name) {
+			const extra = directory.subarray(i + 46 + nameLength, i + 46 + nameLength + extraLength);
+			for (let j = 0; j + 4 <= extra.length;) {
+				const id = extra.readUInt16LE(j);
+				const length = extra.readUInt16LE(j + 2);
+				if (id === ZIP64_EXTRA_ID) {
+					let k = j + 4;
+					if (uncompressedSize === UINT32_MAX) k += 8;
+					if (compressedSize === UINT32_MAX) {
+						compressedSize = Number(extra.readBigUInt64LE(k));
+						k += 8;
+					}
+					if (localHeaderOffset === UINT32_MAX) localHeaderOffset = Number(extra.readBigUInt64LE(k));
+				}
+				j += 4 + length;
+			}
+			return {
+				method,
+				compressedSize,
+				localHeaderOffset
+			};
+		}
+		i += 46 + nameLength + extraLength + commentLength;
+	}
+	return null;
+};
+/**
+* Copies the JavaScript bundle React Native's Gradle build packed into an
+* `.apk` (`assets/index.android.bundle`) or an `.aab`
+* (`base/assets/index.android.bundle`) to `outputPath`: the built-in bundle,
+* byte for byte, which no rebuild reproduces. It reads only the archive's
+* directory and that entry, streamed, so a large artifact stays on disk.
+*/
+const extractBuiltInBundle = async ({ artifactPath, outputPath }) => {
+	const name = path.default.extname(artifactPath) === ".aab" ? "base/assets/index.android.bundle" : "assets/index.android.bundle";
+	const file = await fs.default.promises.open(artifactPath, "r");
+	let entry;
+	let dataOffset;
+	try {
+		entry = await findEntry(file, name);
+		if (entry === null) throw new Error(`${path.default.basename(artifactPath)} has no ${name}. A release build packs its JavaScript bundle there unless the app's react { bundleAssetName } names another file.`);
+		const local = await read(file, entry.localHeaderOffset, 30);
+		if (local.readUInt32LE(0) !== LOCAL_HEADER_SIGNATURE) throw new Error(`${path.default.basename(artifactPath)} has a corrupt ${name}.`);
+		dataOffset = entry.localHeaderOffset + 30 + local.readUInt16LE(26) + local.readUInt16LE(28);
+	} finally {
+		await file.close();
+	}
+	if (entry.method !== 0 && entry.method !== 8) throw new Error(`${path.default.basename(artifactPath)} stores ${name} with an unsupported compression method (${entry.method}).`);
+	await fs.default.promises.mkdir(path.default.dirname(outputPath), { recursive: true });
+	if (entry.compressedSize === 0) {
+		await fs.default.promises.writeFile(outputPath, "");
 		return;
 	}
-	const deviceId = device.deviceId;
-	const adbArgs = [
-		"-s",
-		deviceId,
-		"install",
-		"-r",
-		"-d"
-	];
-	adbArgs.push(apkPath);
-	const adbPath = Device.getAdbPath();
-	const spinner = _hot_updater_cli_tools.p.spinner();
-	spinner.start(`Installing the app on ${device.readableName} (id: ${deviceId})`);
+	const source = fs.default.createReadStream(artifactPath, {
+		start: dataOffset,
+		end: dataOffset + entry.compressedSize - 1
+	});
+	await (entry.method === 8 ? (0, stream_promises.pipeline)(source, (0, zlib.createInflateRaw)(), fs.default.createWriteStream(outputPath)) : (0, stream_promises.pipeline)(source, fs.default.createWriteStream(outputPath)));
+};
+//#endregion
+//#region src/google/googleApi.ts
+/** A Google Cloud or Google Play API request that failed, with Google's error. */
+var GoogleApiError = class extends Error {
+	status;
+	/** Google's canonical status, such as `PERMISSION_DENIED`. */
+	apiStatus;
+	apiMessage;
+	/** The `ErrorInfo` reasons, such as `SERVICE_DISABLED`. */
+	reasons;
+	/** The `PreconditionFailure` violation types, such as an org policy constraint. */
+	violations;
+	/** The `ErrorInfo` consumer of a disabled service, such as `projects/123`. */
+	consumer;
+	constructor(action, status, body = {}) {
+		const apiMessage = body.apiMessage ?? "";
+		super(`${action} failed (HTTP ${status})${apiMessage ? `: ${apiMessage}` : "."}`);
+		this.name = "GoogleApiError";
+		this.status = status;
+		this.apiStatus = body.apiStatus;
+		this.apiMessage = apiMessage;
+		this.reasons = body.reasons ?? [];
+		this.violations = body.violations ?? [];
+		this.consumer = body.consumer;
+	}
+};
+/** Google's error body, `{ error: { code, status, message, details } }`. */
+const readError = async (action, response) => {
+	let error;
 	try {
-		await (0, execa.execa)(adbPath, adbArgs);
-		spinner.stop(`Installed the app on ${device.readableName} (id: ${deviceId}).`);
-	} catch (error) {
-		const errorMessage = error.stdout || error.stderr || "Unknown error";
-		if (typeof errorMessage === "string" && errorMessage.includes("INSTALL_FAILED_INSUFFICIENT_STORAGE")) spinner.message("Installation failed due to insufficient storage");
-		spinner.error(`Failed: Installing the app on ${device.readableName} (id: ${deviceId})`);
-		throw new Error(typeof errorMessage === "string" ? errorMessage : "Installation failed");
+		error = (await response.json()).error;
+	} catch {}
+	const details = Array.isArray(error?.details) ? error.details : [];
+	const info = details.filter((detail) => typeof detail.reason === "string");
+	return new GoogleApiError(action, response.status, {
+		...typeof error?.status === "string" ? { apiStatus: error.status } : {},
+		...typeof error?.message === "string" ? { apiMessage: error.message } : {},
+		reasons: info.map((detail) => detail.reason),
+		violations: details.flatMap((detail) => (detail.violations ?? []).flatMap((violation) => typeof violation.type === "string" ? [violation.type] : [])),
+		...info.find((detail) => detail.metadata?.["consumer"]) ? { consumer: info.find((detail) => detail.metadata?.["consumer"]).metadata["consumer"] } : {}
+	});
+};
+/** Whether Google answered that a service is disabled in a project. */
+const isServiceDisabled = (error) => error instanceof GoogleApiError && (error.reasons.includes("SERVICE_DISABLED") || /has not been used in project .* or it is disabled/i.test(error.apiMessage));
+/** Requests with the signed-in user's access token, throwing `GoogleApiError`. */
+const createGoogleRequest = ({ accessToken, fetch }) => async (action, method, url, body) => {
+	const response = await fetch(url, {
+		method,
+		headers: {
+			authorization: `Bearer ${accessToken}`,
+			...body === void 0 ? {} : { "content-type": "application/json" }
+		},
+		...body === void 0 ? {} : { body: JSON.stringify(body) }
+	});
+	if (!response.ok) throw await readError(action, response);
+	const text = await response.text();
+	return text ? JSON.parse(text) : {};
+};
+/**
+* Polls `operation` at `origin` until it is done, returning its response or
+* throwing its error as a `GoogleApiError` with the operation's code.
+*/
+const waitForOperation = async ({ request, origin, operation, action, sleep, intervalMs = 2e3, attempts = 60 }) => {
+	let current = operation;
+	for (let attempt = 0; !current.done; attempt++) {
+		if (attempt >= attempts || !current.name) throw new Error(`${action} did not finish in time.`);
+		await sleep(intervalMs);
+		current = await request(action, "GET", `${origin}/${current.name}`);
 	}
+	if (current.error) throw new GoogleApiError(action, 400, {
+		apiMessage: current.error.message ?? "",
+		...current.error.code === 7 ? { apiStatus: "PERMISSION_DENIED" } : {},
+		...current.error.code === 8 ? { apiStatus: "RESOURCE_EXHAUSTED" } : {}
+	});
+	return current.response;
 };
 //#endregion
-//#region src/runner/tryLaunchAppOnDevice.ts
-async function tryLaunchAppOnDevice({ device, port, mainActivity, applicationId, packageName }) {
-	if (!device.deviceId) {
-		_hot_updater_cli_tools.p.log.warn(`No device with id "${device.deviceId}", skipping launching the app.`);
-		return;
+//#region src/google/types.ts
+/** A named failure of `issuePlayServiceAccount`, with what to do in its message. */
+var PlayServiceAccountError = class extends Error {
+	code;
+	constructor(code, message, options) {
+		super(message, options);
+		this.name = "PlayServiceAccountError";
+		this.code = code;
 	}
-	const deviceId = device.deviceId;
-	await Device.tryRunAdbReverse({
-		deviceId,
-		port
+};
+/** The environment variables that replace Hot Updater's Google OAuth client. */
+const GOOGLE_OAUTH_CLIENT_ENV_NAMES = {
+	clientId: "HOT_UPDATER_GOOGLE_OAUTH_CLIENT_ID",
+	clientSecret: "HOT_UPDATER_GOOGLE_OAUTH_CLIENT_SECRET"
+};
+/** The service account Hot Updater creates, `hot-updater-play@<project>.iam.gserviceaccount.com`. */
+const PLAY_SERVICE_ACCOUNT_ID = "hot-updater-play";
+/** Where a Play Console admin finds the developer account ID. */
+const PLAY_CONSOLE_URL = "https://play.google.com/console";
+//#endregion
+//#region src/google/googleSignIn.ts
+const AUTHORIZATION_URL = "https://accounts.google.com/o/oauth2/v2/auth";
+const TOKEN_URL = "https://oauth2.googleapis.com/token";
+const REVOKE_URL = "https://oauth2.googleapis.com/revoke";
+/** How long the browser has to come back with the sign-in. */
+const SIGN_IN_TIMEOUT_MS = 3e5;
+const base64url = (bytes) => bytes.toString("base64url");
+const page = (message) => `<!doctype html><meta charset="utf-8"><title>Hot Updater</title><body style="font-family:system-ui;margin:3rem"><p>${message}</p></body>`;
+/**
+* Signs in with Google as an installed app does (RFC 8252): the browser
+* opens Google's own consent screen, so the password and the second factor
+* stay with Google, and the authorization code comes back to a loopback
+* server on 127.0.0.1, bound to a random port for this sign-in only. The
+* code is exchanged with PKCE (S256), and `state` ties the answer to this
+* request.
+*
+* @param onUrl Sees the sign-in URL, to print and open in a browser.
+*/
+const signInWithGoogle = async ({ client, scopes, onUrl, fetch = globalThis.fetch, timeoutMs = SIGN_IN_TIMEOUT_MS }) => {
+	const verifier = base64url(node_crypto.default.randomBytes(32));
+	const challenge = base64url(node_crypto.default.createHash("sha256").update(verifier).digest());
+	const state = base64url(node_crypto.default.randomBytes(16));
+	const server = node_http.default.createServer();
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(0, "127.0.0.1", () => resolve());
 	});
-	const activity = mainActivity || ".MainActivity";
-	const adbArgs = [
-		"shell",
-		"am",
-		"start",
-		"-n",
-		`${applicationId}/${activity.startsWith(packageName) || !activity.startsWith(".") && activity.includes(".") ? activity : activity.startsWith(".") ? [packageName, activity].join("") : [packageName, activity].filter(Boolean).join(".")}`,
-		"-a",
-		"android.intent.action.MAIN",
-		"-c",
-		"android.intent.category.LAUNCHER"
-	];
-	adbArgs.unshift("-s", deviceId);
-	const adbPath = Device.getAdbPath();
-	console.debug(`Running ${adbPath} ${adbArgs.join(" ")}.`);
-	const spinner = _hot_updater_cli_tools.p.spinner();
-	spinner.start(`Launching the app on ${device.readableName} (id: ${deviceId})`);
 	try {
-		await (0, execa.execa)(adbPath, adbArgs);
-		spinner.stop(`Launched the app on ${device.readableName} (id: ${deviceId}) and listening on port ${port}.`);
+		const { port } = server.address();
+		const redirectUri = `http://127.0.0.1:${port}`;
+		const code = new Promise((resolve, reject) => {
+			const timer = setTimeout(() => reject(new PlayServiceAccountError("sign-in-cancelled", "The Google sign-in did not finish in time.")), timeoutMs);
+			timer.unref();
+			server.on("request", (req, res) => {
+				const query = new URL(req.url ?? "/", redirectUri).searchParams;
+				if (query.get("state") !== state) {
+					res.writeHead(404).end();
+					return;
+				}
+				const error = query.get("error");
+				const answer = query.get("code");
+				res.writeHead(error || !answer ? 400 : 200, { "content-type": "text/html; charset=utf-8" }).end(page(error || !answer ? "The sign-in did not finish. Return to the terminal." : "Signed in. Close this tab and return to the terminal."));
+				clearTimeout(timer);
+				if (error || !answer) reject(new PlayServiceAccountError("sign-in-cancelled", error === "access_denied" ? "The Google sign-in was cancelled." : `The Google sign-in failed: ${error ?? "no authorization code"}.`));
+				else resolve(answer);
+			});
+		});
+		code.catch(() => {});
+		const url = new URL(AUTHORIZATION_URL);
+		url.search = new URLSearchParams({
+			client_id: client.clientId,
+			redirect_uri: redirectUri,
+			response_type: "code",
+			scope: scopes.join(" "),
+			code_challenge: challenge,
+			code_challenge_method: "S256",
+			state,
+			prompt: "select_account"
+		}).toString();
+		await onUrl(url.toString());
+		const authorizationCode = await code;
+		(0, _hot_updater_cli_tools.registerSecretValue)(authorizationCode);
+		const response = await fetch(TOKEN_URL, {
+			method: "POST",
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				code: authorizationCode,
+				client_id: client.clientId,
+				...client.clientSecret ? { client_secret: client.clientSecret } : {},
+				redirect_uri: redirectUri,
+				grant_type: "authorization_code",
+				code_verifier: verifier
+			}).toString()
+		});
+		const token = await response.json().catch(() => ({}));
+		if (!response.ok || typeof token.access_token !== "string") throw new PlayServiceAccountError(token.error === "invalid_client" ? "sign-in-not-configured" : "sign-in-cancelled", `Google refused the sign-in (HTTP ${response.status})${typeof token.error_description === "string" ? `: ${token.error_description}` : typeof token.error === "string" ? `: ${token.error}` : "."}`);
+		(0, _hot_updater_cli_tools.registerSecretValue)(token.access_token);
+		return {
+			accessToken: token.access_token,
+			scopes: typeof token.scope === "string" ? token.scope.split(" ") : []
+		};
+	} finally {
+		server.closeAllConnections();
+		await new Promise((resolve) => server.close(() => resolve()));
+	}
+};
+/** Ends a sign-in: Google revokes its access token. Whether Google did. */
+const revokeGoogleToken = async (accessToken, fetch = globalThis.fetch) => {
+	try {
+		return (await fetch(REVOKE_URL, {
+			method: "POST",
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({ token: accessToken }).toString()
+		})).ok;
 	} catch {
-		spinner.error("Failed to launch the app.");
-		throw new Error(`Failed to launch the app on ${device.readableName}`);
+		return false;
 	}
-}
+};
 //#endregion
-//#region src/runAndroid.ts
-const runAndroid = async ({ schemeConfig, runOption }) => {
-	const { interactive, device: deviceOption } = runOption;
-	const androidProjectPath = path.default.join((0, _hot_updater_cli_tools.getCwd)(), "android");
-	if (schemeConfig.aab) {
-		_hot_updater_cli_tools.p.log.error("aab scheme can't not be run");
-		process.exit(1);
-	}
-	const device = await Device.selectTargetDevice({
-		deviceOption,
-		interactive
+//#region src/google/googleKeyIssuer.ts
+const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
+const ANDROID_PUBLISHER_SCOPE = "https://www.googleapis.com/auth/androidpublisher";
+const SCOPES = [CLOUD_PLATFORM_SCOPE, ANDROID_PUBLISHER_SCOPE];
+const PUBLISHER_API = "https://androidpublisher.googleapis.com/androidpublisher/v3";
+const RESOURCE_MANAGER_API = "https://cloudresourcemanager.googleapis.com";
+const SERVICE_USAGE_API = "https://serviceusage.googleapis.com";
+const IAM_API = "https://iam.googleapis.com/v1";
+/** IAM creates the service account; the Play Developer API is what it calls. */
+const SERVICES = ["iam.googleapis.com", "androidpublisher.googleapis.com"];
+/**
+* What the service account may do in Play Console, for the app only: read
+* it, and release to testing tracks, which `--submit play-internal` does.
+*/
+const APP_PERMISSIONS = ["CAN_VIEW_NON_FINANCIAL_DATA", "CAN_MANAGE_TRACK_APKS"];
+const KEY_CREATION_CONSTRAINT = "constraints/iam.disableServiceAccountKeyCreation";
+/** Retries while Google enables an API or creates a service account. */
+const PROPAGATION_ATTEMPTS = 12;
+const PROPAGATION_DELAY_MS = 1e4;
+const sleepFor = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** The developer account ID in `input`, a number or a Play Console URL. */
+const parseDeveloperId = (input) => {
+	const trimmed = input.trim();
+	if (/^\d+$/u.test(trimmed)) return trimmed;
+	return trimmed.match(/\/developers\/(\d+)(?:[/?#]|$)/u)?.[1];
+};
+/** A project ID nobody has: Google Cloud's are global. */
+const newProjectId = () => `${PLAY_SERVICE_ACCOUNT_ID}-${node_crypto.default.randomBytes(3).toString("hex")}`;
+const isNotFound = (error) => error instanceof GoogleApiError && error.status === 404;
+const isConflict = (error) => error instanceof GoogleApiError && error.status === 409;
+/** The API is disabled in the OAuth client's own project: waiting does not help. */
+const clientApiDisabled = (error) => new PlayServiceAccountError("api-not-enabled", `${error.apiMessage} The Google OAuth client Hot Updater signs in with belongs to that project, which must enable the API (see ${GOOGLE_OAUTH_CLIENT_ENV_NAMES.clientId}).`, { cause: error });
+/** Google's own words, after a message that names the likely cause. */
+const googleSays = (error) => error instanceof GoogleApiError && error.apiMessage ? ` (Google: ${error.apiMessage})` : "";
+/** A Play Console refusal, as `not-play-admin`. */
+const notPlayAdmin = (developerId, error) => new PlayServiceAccountError("not-play-admin", `The Google Account you signed in with is not an admin of the Play Console developer account ${developerId}. Sign in with an account that has the Admin permission there (Users and permissions in ${PLAY_CONSOLE_URL})${googleSays(error)}.`, { cause: error });
+const isDenied = (error) => error instanceof GoogleApiError && (error.status === 403 || error.apiStatus === "PERMISSION_DENIED");
+/**
+* `IssuePlayServiceAccount` with Google's own APIs, after a sign-in on
+* Google's consent screen (OAuth for installed apps, with PKCE and a
+* loopback redirect):
+*
+* 1. the Play Console side is checked first, with no change anywhere: the
+*    developer account answers to the account as its admin, and has the app;
+* 2. the chosen Google Cloud project, or a new one, gets the IAM and Play
+*    Developer APIs enabled, and the service account `hot-updater-play`;
+* 3. the service account becomes a Play Console user that may release the
+*    app to testing tracks;
+* 4. only then is its JSON key created, the last step, so a failure before
+*    it leaves no key behind.
+*
+* Each step reuses what an earlier run created: the project, the service
+* account, and its Play Console access.
+*/
+const createGoogleKeyIssuer = ({ fetch = globalThis.fetch, sleep = sleepFor } = {}) => async (request) => {
+	const { packageName, oauthClient, onStep = () => {} } = request;
+	if (!oauthClient?.clientId) throw new PlayServiceAccountError("sign-in-not-configured", `This build of Hot Updater has no Google OAuth client to sign in with. Set ${GOOGLE_OAUTH_CLIENT_ENV_NAMES.clientId} and ${GOOGLE_OAUTH_CLIENT_ENV_NAMES.clientSecret} to a "Desktop app" OAuth client.`);
+	const signIn = await signInWithGoogle({
+		client: oauthClient,
+		scopes: SCOPES,
+		onUrl: request.onSignInUrl,
+		fetch
 	});
-	if (device) {
-		if (!(await Device.getConnectedDevices()).includes(device.deviceId || "")) {
-			if (device.type === "emulator") device.deviceId = await Device.tryLaunchEmulator(device.readableName);
+	const dispose = async () => {
+		await revokeGoogleToken(signIn.accessToken, fetch);
+	};
+	try {
+		const missing = SCOPES.filter((scope) => !signIn.scopes.includes(scope));
+		if (missing.length > 0) throw new PlayServiceAccountError("scope-not-granted", `The sign-in did not allow ${missing.map((scope) => scope === ANDROID_PUBLISHER_SCOPE ? "managing Google Play" : "managing Google Cloud").join(" or ")}. Run this again and keep every box on Google's consent screen ticked.`);
+		const google = createGoogleRequest({
+			accessToken: signIn.accessToken,
+			fetch
+		});
+		const developerInput = await request.askDeveloperId();
+		const developerId = parseDeveloperId(developerInput);
+		if (developerId === void 0) throw new PlayServiceAccountError("developer-not-found", `"${developerInput.trim()}" is no developer account ID. Open ${PLAY_CONSOLE_URL}: it is the number after /developers/ in the address.`);
+		onStep("Checking the Play Console developer account");
+		await checkPlayConsole({
+			google,
+			developerId,
+			packageName
+		});
+		const project = await chooseProject({
+			google,
+			request,
+			sleep,
+			onStep
+		});
+		const { projectId } = project;
+		onStep(`Enabling the Google Play Developer API in ${projectId}`);
+		await enableServices({
+			google,
+			projectId,
+			sleep
+		});
+		onStep(`Creating the service account in ${projectId}`);
+		const email = await ensureServiceAccount({
+			google,
+			project,
+			sleep
+		});
+		onStep(`Giving ${email} release access to ${packageName}`);
+		await grantPlayAccess({
+			google,
+			developerId,
+			email,
+			packageName
+		});
+		onStep("Creating the service account's JSON key");
+		const key = await createKey({
+			google,
+			project,
+			email,
+			sleep
+		});
+		return {
+			json: key.json,
+			keyId: key.keyId,
+			email,
+			projectId,
+			developerId,
+			revoke: async () => {
+				try {
+					await google("Deleting the key", "DELETE", `${IAM_API}/${key.name}`);
+					return true;
+				} catch (error) {
+					return isNotFound(error);
+				}
+			},
+			dispose
+		};
+	} catch (error) {
+		await dispose();
+		throw error;
+	}
+};
+/**
+* Whether the signed-in account administers `developerId`, and Google Play
+* has `packageName` there, asked without changing anything: listing the
+* account's users takes the admin permission, and an edit opened on the app
+* is deleted again.
+*/
+const checkPlayConsole = async ({ google, developerId, packageName }) => {
+	try {
+		await google("Listing the Play Console users", "GET", `${PUBLISHER_API}/developers/${developerId}/users?pageSize=1`);
+	} catch (error) {
+		if (isServiceDisabled(error)) throw clientApiDisabled(error);
+		if (isNotFound(error)) throw new PlayServiceAccountError("developer-not-found", `Play Console has no developer account ${developerId}. Open ${PLAY_CONSOLE_URL}: the developer account ID is the number after /developers/ in the address${googleSays(error)}.`, { cause: error });
+		if (isDenied(error)) throw notPlayAdmin(developerId, error);
+		throw error;
+	}
+	let edit;
+	try {
+		edit = await google(`Opening an edit of ${packageName}`, "POST", `${PUBLISHER_API}/applications/${encodeURIComponent(packageName)}/edits`);
+	} catch (error) {
+		if (isServiceDisabled(error)) throw clientApiDisabled(error);
+		if (isNotFound(error) || isDenied(error)) throw appNotFound(packageName, developerId, error);
+		throw error;
+	}
+	if (edit.id) await google("Deleting the edit", "DELETE", `${PUBLISHER_API}/applications/${encodeURIComponent(packageName)}/edits/${edit.id}`).catch(() => {});
+};
+const appNotFound = (packageName, developerId, cause) => new PlayServiceAccountError("app-not-found", `Google Play has no app ${packageName} in the developer account ${developerId}. Google takes the first .aab of a new app only in Play Console: create the app there, upload one .aab by hand (for example to internal testing), then run this again${googleSays(cause)}.`, { cause });
+/** The account's active projects, every page of them. */
+const listProjects = async (google) => {
+	const projects = [];
+	let pageToken;
+	do {
+		const page = await google("Listing the Google Cloud projects", "GET", `${RESOURCE_MANAGER_API}/v3/projects:search?${new URLSearchParams({
+			query: "state:ACTIVE",
+			...pageToken ? { pageToken } : {}
+		})}`);
+		for (const project of page.projects ?? []) if (project.projectId) projects.push({
+			projectId: project.projectId,
+			...project.displayName ? { displayName: project.displayName } : {},
+			...projectNumberOf(project.name)
+		});
+		pageToken = page.nextPageToken || void 0;
+	} while (pageToken);
+	return projects;
+};
+/** The project the developer picks, or a new one when there is none or they ask. */
+const chooseProject = async ({ google, request, sleep, onStep }) => {
+	const projects = await listProjects(google);
+	const chosen = projects.length > 0 ? await request.chooseProject(projects.map(({ projectId, displayName }) => ({
+		projectId,
+		...displayName ? { displayName } : {}
+	}))) : void 0;
+	if (chosen !== void 0) return projects.find((project) => project.projectId === chosen) ?? { projectId: chosen };
+	const projectId = newProjectId();
+	onStep(`Creating the Google Cloud project ${projectId}`);
+	try {
+		const operation = await google("Creating the Google Cloud project", "POST", `${RESOURCE_MANAGER_API}/v3/projects`, {
+			projectId,
+			displayName: "Hot Updater Play"
+		});
+		const created = await waitForOperation({
+			request: google,
+			origin: `${RESOURCE_MANAGER_API}/v3`,
+			operation,
+			action: "Creating the Google Cloud project",
+			sleep
+		});
+		return {
+			projectId,
+			...projectNumberOf(created?.name)
+		};
+	} catch (error) {
+		if (!(error instanceof GoogleApiError)) throw error;
+		if (error.status === 429 || error.apiStatus === "RESOURCE_EXHAUSTED" || /quota/iu.test(error.apiMessage)) throw new PlayServiceAccountError("project-quota", `Google Cloud has no project quota left for this account: ${error.apiMessage || "quota exceeded"}. Delete a project you no longer use (https://console.cloud.google.com/cloud-resource-manager), or run this again and pick an existing project.`, { cause: error });
+		if (/terms of service/iu.test(error.apiMessage)) throw new PlayServiceAccountError("project-create-denied", "This Google Account has not accepted the Google Cloud Terms of Service. Open https://console.cloud.google.com once to accept them, then run this again.", { cause: error });
+		if (isDenied(error) || error.apiStatus === "FAILED_PRECONDITION") throw new PlayServiceAccountError("project-create-denied", `This Google Account may not create Google Cloud projects: ${error.apiMessage || "permission denied"}. Ask your organization's admin for the Project Creator role, or run this again and pick an existing project.`, { cause: error });
+		throw error;
+	}
+};
+/** `projectNumber` from a resource name `projects/<number>`. */
+const projectNumberOf = (name) => {
+	const number = name?.match(/^projects\/(\d+)$/u)?.[1];
+	return number === void 0 ? {} : { projectNumber: number };
+};
+/**
+* Runs `run` again while Google is still enabling an API in `project`,
+* or, with `notFound`, still creating what it reads.
+*/
+const whilePropagating = async ({ run, project, sleep, notFound = false }) => {
+	for (let attempt = 1;; attempt++) try {
+		return await run();
+	} catch (error) {
+		const disabled = isServiceDisabled(error);
+		if (disabled && !consumerIs(error, project)) throw clientApiDisabled(error);
+		if (!disabled && !(notFound && isNotFound(error)) || attempt >= PROPAGATION_ATTEMPTS) {
+			if (disabled) throw new PlayServiceAccountError("api-not-enabled", `Google is still enabling the APIs in ${project.projectId}: ${error.apiMessage} Wait a few minutes, then run this again.`, { cause: error });
+			throw error;
 		}
-		if (!device.deviceId) throw new Error("Failed to run on any device");
-	} else if ((await Device.getConnectedDevices()).length === 0) {
-		_hot_updater_cli_tools.p.log.info("No devices found. Launching first available emulator.");
-		await Device.tryLaunchEmulator();
+		await sleep(PROPAGATION_DELAY_MS);
 	}
-	const task = `assemble${schemeConfig.variant}`;
-	const result = await runGradle({
-		args: { extraParams: [`-PMIN_BUNDLE_ID=${(0, _hot_updater_plugin_core.generateMinBundleId)()}`] },
-		appModuleName: schemeConfig.appModuleName,
-		logPrefix: `android-${schemeConfig.hotUpdaterSchemeName}-run`,
-		tasks: [task],
-		androidProjectPath
-	});
-	const targetDevices = device ? [device] : (await Device.listDevices()).filter((d) => d.connected);
-	for (const targetDevice of targetDevices) {
-		await tryInstallAppOnDevice({
-			apkPath: result.buildArtifactPath,
-			device: targetDevice
+};
+/**
+* Whether a disabled-service error is about `project` itself, which waiting
+* fixes: Google names the consumer by number, and an error naming none
+* counts as the project's own.
+*/
+const consumerIs = (error, project) => error.consumer === void 0 || error.consumer === `projects/${project.projectId}` || (project.projectNumber === void 0 ? true : error.consumer === `projects/${project.projectNumber}`);
+const enableServices = async ({ google, projectId, sleep }) => {
+	try {
+		const operation = await google("Enabling the APIs", "POST", `${SERVICE_USAGE_API}/v1/projects/${projectId}/services:batchEnable`, { serviceIds: SERVICES });
+		await waitForOperation({
+			request: google,
+			origin: `${SERVICE_USAGE_API}/v1`,
+			operation,
+			action: "Enabling the APIs",
+			sleep
+		});
+	} catch (error) {
+		if (isDenied(error) && !isServiceDisabled(error)) throw new PlayServiceAccountError("project-access-denied", `This Google Account may not enable APIs in ${projectId}: ${error.apiMessage || "permission denied"}. Pick a project you own, or ask its owner for the Editor role.`, { cause: error });
+		throw error;
+	}
+};
+/** The `hot-updater-play` service account's email, created unless it exists. */
+const ensureServiceAccount = async ({ google, project, sleep }) => {
+	const { projectId } = project;
+	const email = `${PLAY_SERVICE_ACCOUNT_ID}@${projectId}.iam.gserviceaccount.com`;
+	try {
+		return (await whilePropagating({
+			project,
+			sleep,
+			run: () => google("Creating the service account", "POST", `${IAM_API}/projects/${projectId}/serviceAccounts`, {
+				accountId: "hot-updater-play",
+				serviceAccount: {
+					displayName: "Hot Updater Play uploads",
+					description: "Uploads Android App Bundles to Google Play for hot-updater native-build android --submit play-internal."
+				}
+			})
+		})).email ?? email;
+	} catch (error) {
+		if (isConflict(error)) return email;
+		if (isDenied(error) && !isServiceDisabled(error)) throw new PlayServiceAccountError("project-access-denied", `This Google Account may not create service accounts in ${projectId}: ${error.apiMessage || "permission denied"}. Pick a project you own, or ask its owner for the Service Account Admin role.`, { cause: error });
+		throw error;
+	}
+};
+/**
+* Makes `email` a Play Console user that may release `packageName`, keeping
+* any permission it has: the user and the app's grant are created, or the
+* grant gains the release permissions.
+*/
+const grantPlayAccess = async ({ google, developerId, email, packageName }) => {
+	const developer = `${PUBLISHER_API}/developers/${developerId}`;
+	const user = `${developer}/users/${encodeURIComponent(email)}`;
+	try {
+		await google("Adding the Play Console user", "POST", `${developer}/users`, {
+			name: `developers/${developerId}/users/${email}`,
+			email
 		});
-		await tryLaunchAppOnDevice({
-			applicationId: schemeConfig.applicationId,
-			device: targetDevice,
-			mainActivity: runOption.mainActivity,
-			packageName: schemeConfig.packageName,
-			port: runOption.port
+	} catch (error) {
+		if (isDenied(error)) throw notPlayAdmin(developerId, error);
+		if (!isConflict(error)) throw error;
+	}
+	try {
+		await google("Granting access to the app", "POST", `${user}/grants`, {
+			name: `developers/${developerId}/users/${email}/grants/${packageName}`,
+			packageName,
+			appLevelPermissions: APP_PERMISSIONS
 		});
+		return;
+	} catch (error) {
+		if (isNotFound(error)) throw appNotFound(packageName, developerId, error);
+		if (isDenied(error)) throw notPlayAdmin(developerId, error);
+		if (!isConflict(error)) throw error;
 	}
-	_hot_updater_cli_tools.p.outro("Success 🎉");
-	return result;
+	const granted = await findGrant({
+		google,
+		developer,
+		email,
+		packageName
+	});
+	const missing = APP_PERMISSIONS.filter((permission) => !granted.includes(permission));
+	if (missing.length === 0) return;
+	await google("Granting access to the app", "PATCH", `${user}/grants/${encodeURIComponent(packageName)}?updateMask=appLevelPermissions`, { appLevelPermissions: [...granted, ...missing] });
 };
-//#endregion
-//#region src/utils/enrichNativeBuildAndroidScheme.ts
-const enrichNativeBuildAndroidScheme = async ({ schemeConfig, hotUpdaterSchemeName }) => {
+/** The app permissions `email` holds on `packageName`, from the user list. */
+const findGrant = async ({ google, developer, email, packageName }) => {
+	let pageToken;
+	do {
+		const page = await google("Listing the Play Console users", "GET", `${developer}/users?${new URLSearchParams({
+			pageSize: "100",
+			...pageToken ? { pageToken } : {}
+		})}`);
+		const found = page.users?.find((candidate) => candidate.email === email);
+		if (found) return found.grants?.find((grant) => grant.packageName === packageName)?.appLevelPermissions ?? [];
+		pageToken = page.nextPageToken || void 0;
+	} while (pageToken);
+	return [];
+};
+/** A new JSON key of the service account, checked and masked in the CLI's output. */
+const createKey = async ({ google, project, email, sleep }) => {
+	const { projectId } = project;
+	let key;
+	try {
+		key = await whilePropagating({
+			project,
+			sleep,
+			notFound: true,
+			run: () => google("Creating the key", "POST", `${IAM_API}/projects/${projectId}/serviceAccounts/${email}/keys`, {
+				privateKeyType: "TYPE_GOOGLE_CREDENTIALS_FILE",
+				keyAlgorithm: "KEY_ALG_RSA_2048"
+			})
+		});
+	} catch (error) {
+		if (error instanceof GoogleApiError && (error.violations.includes(KEY_CREATION_CONSTRAINT) || /disableServiceAccountKeyCreation/u.test(error.apiMessage))) throw new PlayServiceAccountError("key-creation-disabled", `An organization policy (iam.disableServiceAccountKeyCreation) forbids service account keys in ${projectId}; organizations created since 2024 enforce it by default. Ask an organization policy admin to allow keys for this project, or run this again with a project outside the organization. The service account ${email} and its Play Console access remain for the next run.`, { cause: error });
+		throw error;
+	}
+	if (!key.name || !key.privateKeyData) throw new Error("Google Cloud created the key without its JSON file.");
+	(0, _hot_updater_cli_tools.registerSecretValue)(key.privateKeyData);
+	const json = Buffer.from(key.privateKeyData, "base64").toString("utf-8");
+	(0, _hot_updater_cli_tools.registerSecretValue)(json);
+	let parsed;
+	try {
+		parsed = JSON.parse(json);
+	} catch {
+		parsed = {};
+	}
+	if (typeof parsed.private_key !== "string") {
+		await google("Deleting the key", "DELETE", `${IAM_API}/${key.name}`).catch(() => {});
+		throw new Error("Google Cloud created a key that is no JSON key file.");
+	}
+	(0, _hot_updater_cli_tools.registerSecretValue)(parsed.private_key);
 	return {
-		aab: true,
-		variant: "Release",
-		appModuleName: "app",
-		applicationId: schemeConfig.packageName,
-		...schemeConfig,
-		hotUpdaterSchemeName
+		json,
+		name: key.name,
+		keyId: key.name.split("/").pop()
 	};
 };
 //#endregion
+//#region src/playServiceAccount.ts
+/**
+* Hot Updater's Google OAuth client, a "Desktop app" client the sign-in
+* opens Google's consent screen for. Empty in a build that has none, where
+* `HOT_UPDATER_GOOGLE_OAUTH_CLIENT_ID` and `_SECRET` name one.
+*/
+const HOT_UPDATER_GOOGLE_OAUTH_CLIENT = {
+	clientId: "",
+	clientSecret: ""
+};
+/**
+* Hot Updater's issuer, the one place that picks how it is done: Google's
+* OAuth for installed apps, then the Cloud Resource Manager, Service Usage,
+* IAM, and Play Developer APIs. Another implementation of
+* `IssuePlayServiceAccount` replaces it here without touching its callers.
+*/
+const issuePlayServiceAccount = (request) => createGoogleKeyIssuer()({
+	...request,
+	oauthClient: request.oauthClient ?? HOT_UPDATER_GOOGLE_OAUTH_CLIENT
+});
+//#endregion
+exports.GOOGLE_OAUTH_CLIENT_ENV_NAMES = GOOGLE_OAUTH_CLIENT_ENV_NAMES;
+exports.HOT_UPDATER_GOOGLE_OAUTH_CLIENT = HOT_UPDATER_GOOGLE_OAUTH_CLIENT;
+exports.PLAY_CONSOLE_URL = PLAY_CONSOLE_URL;
+exports.PLAY_SERVICE_ACCOUNT_ID = PLAY_SERVICE_ACCOUNT_ID;
+exports.PlayServiceAccountError = PlayServiceAccountError;
+exports.PlayVersionCodeUsedError = PlayVersionCodeUsedError;
+exports.assertPlaySigned = assertPlaySigned;
 exports.buildAndroid = buildAndroid;
 exports.enrichNativeBuildAndroidScheme = enrichNativeBuildAndroidScheme;
-exports.runAndroid = runAndroid;
+exports.extractBuiltInBundle = extractBuiltInBundle;
+exports.findPlayInternalRelease = findPlayInternalRelease;
+exports.issuePlayServiceAccount = issuePlayServiceAccount;
+exports.readBuiltApp = readBuiltApp;
+exports.readBuiltPackageName = readBuiltPackageName;
+exports.readBuiltVersionCode = readBuiltVersionCode;
+exports.resolvePlayUploadServiceAccount = resolvePlayUploadServiceAccount;
+exports.uploadToPlay = uploadToPlay;