@hot-updater/android-helper 1.2.0-rc.0 → 1.2.0-rc.10

package/dist/index.d.cts

@@ -13,15 +13,19 @@ declare const enrichNativeBuildAndroidScheme: ({ schemeConfig, hotUpdaterSchemeN
 }) => Promise<EnrichedNativeBuildAndroidScheme>;
 //#endregion
 //#region src/buildAndroid.d.ts
-declare const buildAndroid: ({ schemeConfig, minBundleId, credentials }: {
+declare const buildAndroid: ({ schemeConfig, minBundleId, credentials, logHeader }: {
   schemeConfig: EnrichedNativeBuildAndroidScheme;
   /** The MIN_BUNDLE_ID the build compiles in. */
   minBundleId?: string;
   /** Resolves the scheme's `signing` keystore, when it signs with one. */
   credentials?: Pick<CredentialResolver, "resolve">;
+  /** Lines the build log starts with, such as the native build key. */
+  logHeader?: string[];
 }) => Promise<{
   buildDirectory: string;
   buildArtifactPath: string;
+  /** The build log, or null without one. */
+  logFilePath: string | null;
   /** What the built artifact reports, or undefined without aapt2. */
   builtApp?: {
     appVersion: string | null;
@@ -42,6 +46,44 @@ declare class PlayVersionCodeUsedError extends Error {
   readonly name = "PlayVersionCodeUsedError";
   constructor(options?: ErrorOptions);
 }
+/**
+ * Play Console's page that invites `email` as a user. `_` stands for the
+ * developer account the browser is signed in to, so no ID is needed.
+ */
+declare const playConsoleInviteUrl: (email: string) => string;
+/**
+ * Whether a service account reaches an app in Google Play:
+ * - `ready`: it opened an edit of the app;
+ * - `denied`: Google Play refused it (401/403), so it needs a Play Console
+ *   invite;
+ * - `not-found`: Google Play has no such app it can see (404), as before
+ *   the app's first `.aab` is uploaded in Play Console;
+ * - `refused`: Google's token endpoint refused the key itself, such as a
+ *   deleted key, with Google's reason.
+ */
+type PlayAccess = {
+  readonly status: "ready";
+} | {
+  readonly status: "denied";
+  readonly email: string;
+} | {
+  readonly status: "not-found";
+  readonly email: string;
+} | {
+  readonly status: "refused";
+  readonly email: string;
+  readonly reason: string;
+};
+/**
+ * Checks once whether the service account's key reaches `packageName`: it
+ * opens an edit of the app and deletes it again, which changes nothing.
+ * Throws only for what says nothing about access, such as a network error.
+ */
+declare const checkPlayAccess: ({ serviceAccount: { json }, packageName, fetch }: {
+  serviceAccount: Credentials["play-service-account"];
+  packageName: string;
+  fetch?: typeof globalThis.fetch;
+}) => Promise<PlayAccess>;
 /**
  * Whether Google Play's internal testing track already releases the
  * `.aab`'s version code, as when a reused native build was uploaded
@@ -143,117 +185,4 @@ declare const readBuiltVersionCode: ({ artifactPath, androidProjectPath }: {
   androidProjectPath: string;
 }) => Promise<number | undefined>;
 //#endregion
-//#region src/google/types.d.ts
-/** What stopped Hot Updater from issuing the Play service account key. */
-type PlayServiceAccountErrorCode =
-/** No OAuth client to sign in with, or Google refused it. */
-"sign-in-not-configured" |
-/** The browser sign-in was cancelled, refused, or timed out. */
-"sign-in-cancelled" |
-/** The account unticked a scope the setup needs on Google's consent screen. */
-"scope-not-granted" |
-/** The developer account ID names no Play Console account. */
-"developer-not-found" |
-/** The Google Account is no admin of the Play Console developer account. */
-"not-play-admin" |
-/** Google Play has no app with the package name in the developer account. */
-"app-not-found" |
-/** The Google Account may not create a Google Cloud project. */
-"project-create-denied" |
-/** The Google Account has no Google Cloud project quota left. */
-"project-quota" |
-/** The Google Account may not enable APIs or create service accounts in the project. */
-"project-access-denied" |
-/** Google is still enabling an API, or it is disabled in the OAuth client's project. */
-"api-not-enabled" |
-/** An organization policy (`iam.disableServiceAccountKeyCreation`) forbids keys. */
-"key-creation-disabled";
-/** A named failure of `issuePlayServiceAccount`, with what to do in its message. */
-declare class PlayServiceAccountError extends Error {
-  readonly code: PlayServiceAccountErrorCode;
-  constructor(code: PlayServiceAccountErrorCode, message: string, options?: {
-    cause?: unknown;
-  });
-}
-/**
- * A Google OAuth client of type "Desktop app". Google treats an installed
- * app's client secret as public, so it ships with the client ID.
- */
-interface GoogleOAuthClient {
-  readonly clientId: string;
-  readonly clientSecret?: string;
-}
-/** The environment variables that replace Hot Updater's Google OAuth client. */
-declare const GOOGLE_OAUTH_CLIENT_ENV_NAMES: {
-  readonly clientId: "HOT_UPDATER_GOOGLE_OAUTH_CLIENT_ID";
-  readonly clientSecret: "HOT_UPDATER_GOOGLE_OAUTH_CLIENT_SECRET";
-};
-/** The service account Hot Updater creates, `hot-updater-play@<project>.iam.gserviceaccount.com`. */
-declare const PLAY_SERVICE_ACCOUNT_ID = "hot-updater-play";
-/** Where a Play Console admin finds the developer account ID. */
-declare const PLAY_CONSOLE_URL = "https://play.google.com/console";
-//#endregion
-//#region src/playServiceAccount.d.ts
-/**
- * Hot Updater's Google OAuth client, a "Desktop app" client the sign-in
- * opens Google's consent screen for. Empty in a build that has none, where
- * `HOT_UPDATER_GOOGLE_OAUTH_CLIENT_ID` and `_SECRET` name one.
- */
-declare const HOT_UPDATER_GOOGLE_OAUTH_CLIENT: GoogleOAuthClient;
-/** A Google Cloud project the signed-in account can use. */
-interface GoogleCloudProject {
-  readonly projectId: string;
-  readonly displayName?: string;
-}
-interface IssuePlayServiceAccountRequest {
-  /** The app's package name in Google Play, which the service account may release. */
-  readonly packageName: string;
-  /** The OAuth client to sign in with; Hot Updater's unless set. */
-  readonly oauthClient?: GoogleOAuthClient;
-  /** Sees the sign-in URL, to print it and open it in a browser. */
-  readonly onSignInUrl: (url: string) => Promise<void> | void;
-  /** Asks for the Play Console developer account ID, after the sign-in. */
-  readonly askDeveloperId: () => Promise<string>;
-  /**
-   * Sees the account's projects when there are any, and returns the one to
-   * create the service account in, or undefined to create a project.
-   */
-  readonly chooseProject: (projects: readonly GoogleCloudProject[]) => Promise<string | undefined>;
-  /** Reports each step, such as "Creating the service account". */
-  readonly onStep?: (message: string) => void;
-}
-/**
- * A Play service account's JSON key, just created, with the access token
- * of the sign-in it was created in. `revoke` deletes the key while the
- * sign-in lasts, and `dispose` ends the sign-in.
- */
-interface IssuedPlayServiceAccount {
-  /** The JSON key file, as Google Cloud downloads it. */
-  readonly json: string;
-  /** The service account's email, the Play Console user it releases as. */
-  readonly email: string;
-  readonly projectId: string;
-  readonly developerId: string;
-  /** The key's ID, as Google Cloud lists it under the service account's keys. */
-  readonly keyId: string;
-  /** Deletes the key with the same sign-in; whether Google Cloud did. */
-  revoke(): Promise<boolean>;
-  /** Ends the sign-in: Google revokes its access token. */
-  dispose(): Promise<void>;
-}
-/**
- * Signs in with Google and issues a service account key that releases the
- * app to Google Play: the developer signs in on Google's own consent
- * screen, in a browser, and the caller never sees the password. Nothing of
- * the sign-in outlives `dispose`.
- */
-type IssuePlayServiceAccount = (request: IssuePlayServiceAccountRequest) => Promise<IssuedPlayServiceAccount>;
-/**
- * Hot Updater's issuer, the one place that picks how it is done: Google's
- * OAuth for installed apps, then the Cloud Resource Manager, Service Usage,
- * IAM, and Play Developer APIs. Another implementation of
- * `IssuePlayServiceAccount` replaces it here without touching its callers.
- */
-declare const issuePlayServiceAccount: IssuePlayServiceAccount;
-//#endregion
-export { type EnrichedNativeBuildAndroidScheme, GOOGLE_OAUTH_CLIENT_ENV_NAMES, type GoogleCloudProject, type GoogleOAuthClient, HOT_UPDATER_GOOGLE_OAUTH_CLIENT, type IssuePlayServiceAccount, type IssuePlayServiceAccountRequest, type IssuedPlayServiceAccount, PLAY_CONSOLE_URL, PLAY_SERVICE_ACCOUNT_ID, PlayServiceAccountError, type PlayServiceAccountErrorCode, PlayVersionCodeUsedError, type UploadToPlayResult, assertPlaySigned, buildAndroid, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, issuePlayServiceAccount, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };
+export { type EnrichedNativeBuildAndroidScheme, type PlayAccess, PlayVersionCodeUsedError, type UploadToPlayResult, assertPlaySigned, buildAndroid, checkPlayAccess, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, playConsoleInviteUrl, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };

package/dist/index.d.mts

@@ -14,15 +14,19 @@ declare const enrichNativeBuildAndroidScheme: ({ schemeConfig, hotUpdaterSchemeN
 }) => Promise<EnrichedNativeBuildAndroidScheme>;
 //#endregion
 //#region src/buildAndroid.d.ts
-declare const buildAndroid: ({ schemeConfig, minBundleId, credentials }: {
+declare const buildAndroid: ({ schemeConfig, minBundleId, credentials, logHeader }: {
   schemeConfig: EnrichedNativeBuildAndroidScheme;
   /** The MIN_BUNDLE_ID the build compiles in. */
   minBundleId?: string;
   /** Resolves the scheme's `signing` keystore, when it signs with one. */
   credentials?: Pick<CredentialResolver, "resolve">;
+  /** Lines the build log starts with, such as the native build key. */
+  logHeader?: string[];
 }) => Promise<{
   buildDirectory: string;
   buildArtifactPath: string;
+  /** The build log, or null without one. */
+  logFilePath: string | null;
   /** What the built artifact reports, or undefined without aapt2. */
   builtApp?: {
     appVersion: string | null;
@@ -43,6 +47,44 @@ declare class PlayVersionCodeUsedError extends Error {
   readonly name = "PlayVersionCodeUsedError";
   constructor(options?: ErrorOptions);
 }
+/**
+ * Play Console's page that invites `email` as a user. `_` stands for the
+ * developer account the browser is signed in to, so no ID is needed.
+ */
+declare const playConsoleInviteUrl: (email: string) => string;
+/**
+ * Whether a service account reaches an app in Google Play:
+ * - `ready`: it opened an edit of the app;
+ * - `denied`: Google Play refused it (401/403), so it needs a Play Console
+ *   invite;
+ * - `not-found`: Google Play has no such app it can see (404), as before
+ *   the app's first `.aab` is uploaded in Play Console;
+ * - `refused`: Google's token endpoint refused the key itself, such as a
+ *   deleted key, with Google's reason.
+ */
+type PlayAccess = {
+  readonly status: "ready";
+} | {
+  readonly status: "denied";
+  readonly email: string;
+} | {
+  readonly status: "not-found";
+  readonly email: string;
+} | {
+  readonly status: "refused";
+  readonly email: string;
+  readonly reason: string;
+};
+/**
+ * Checks once whether the service account's key reaches `packageName`: it
+ * opens an edit of the app and deletes it again, which changes nothing.
+ * Throws only for what says nothing about access, such as a network error.
+ */
+declare const checkPlayAccess: ({ serviceAccount: { json }, packageName, fetch }: {
+  serviceAccount: Credentials["play-service-account"];
+  packageName: string;
+  fetch?: typeof globalThis.fetch;
+}) => Promise<PlayAccess>;
 /**
  * Whether Google Play's internal testing track already releases the
  * `.aab`'s version code, as when a reused native build was uploaded
@@ -144,117 +186,4 @@ declare const readBuiltVersionCode: ({ artifactPath, androidProjectPath }: {
   androidProjectPath: string;
 }) => Promise<number | undefined>;
 //#endregion
-//#region src/google/types.d.ts
-/** What stopped Hot Updater from issuing the Play service account key. */
-type PlayServiceAccountErrorCode =
-/** No OAuth client to sign in with, or Google refused it. */
-"sign-in-not-configured" |
-/** The browser sign-in was cancelled, refused, or timed out. */
-"sign-in-cancelled" |
-/** The account unticked a scope the setup needs on Google's consent screen. */
-"scope-not-granted" |
-/** The developer account ID names no Play Console account. */
-"developer-not-found" |
-/** The Google Account is no admin of the Play Console developer account. */
-"not-play-admin" |
-/** Google Play has no app with the package name in the developer account. */
-"app-not-found" |
-/** The Google Account may not create a Google Cloud project. */
-"project-create-denied" |
-/** The Google Account has no Google Cloud project quota left. */
-"project-quota" |
-/** The Google Account may not enable APIs or create service accounts in the project. */
-"project-access-denied" |
-/** Google is still enabling an API, or it is disabled in the OAuth client's project. */
-"api-not-enabled" |
-/** An organization policy (`iam.disableServiceAccountKeyCreation`) forbids keys. */
-"key-creation-disabled";
-/** A named failure of `issuePlayServiceAccount`, with what to do in its message. */
-declare class PlayServiceAccountError extends Error {
-  readonly code: PlayServiceAccountErrorCode;
-  constructor(code: PlayServiceAccountErrorCode, message: string, options?: {
-    cause?: unknown;
-  });
-}
-/**
- * A Google OAuth client of type "Desktop app". Google treats an installed
- * app's client secret as public, so it ships with the client ID.
- */
-interface GoogleOAuthClient {
-  readonly clientId: string;
-  readonly clientSecret?: string;
-}
-/** The environment variables that replace Hot Updater's Google OAuth client. */
-declare const GOOGLE_OAUTH_CLIENT_ENV_NAMES: {
-  readonly clientId: "HOT_UPDATER_GOOGLE_OAUTH_CLIENT_ID";
-  readonly clientSecret: "HOT_UPDATER_GOOGLE_OAUTH_CLIENT_SECRET";
-};
-/** The service account Hot Updater creates, `hot-updater-play@<project>.iam.gserviceaccount.com`. */
-declare const PLAY_SERVICE_ACCOUNT_ID = "hot-updater-play";
-/** Where a Play Console admin finds the developer account ID. */
-declare const PLAY_CONSOLE_URL = "https://play.google.com/console";
-//#endregion
-//#region src/playServiceAccount.d.ts
-/**
- * Hot Updater's Google OAuth client, a "Desktop app" client the sign-in
- * opens Google's consent screen for. Empty in a build that has none, where
- * `HOT_UPDATER_GOOGLE_OAUTH_CLIENT_ID` and `_SECRET` name one.
- */
-declare const HOT_UPDATER_GOOGLE_OAUTH_CLIENT: GoogleOAuthClient;
-/** A Google Cloud project the signed-in account can use. */
-interface GoogleCloudProject {
-  readonly projectId: string;
-  readonly displayName?: string;
-}
-interface IssuePlayServiceAccountRequest {
-  /** The app's package name in Google Play, which the service account may release. */
-  readonly packageName: string;
-  /** The OAuth client to sign in with; Hot Updater's unless set. */
-  readonly oauthClient?: GoogleOAuthClient;
-  /** Sees the sign-in URL, to print it and open it in a browser. */
-  readonly onSignInUrl: (url: string) => Promise<void> | void;
-  /** Asks for the Play Console developer account ID, after the sign-in. */
-  readonly askDeveloperId: () => Promise<string>;
-  /**
-   * Sees the account's projects when there are any, and returns the one to
-   * create the service account in, or undefined to create a project.
-   */
-  readonly chooseProject: (projects: readonly GoogleCloudProject[]) => Promise<string | undefined>;
-  /** Reports each step, such as "Creating the service account". */
-  readonly onStep?: (message: string) => void;
-}
-/**
- * A Play service account's JSON key, just created, with the access token
- * of the sign-in it was created in. `revoke` deletes the key while the
- * sign-in lasts, and `dispose` ends the sign-in.
- */
-interface IssuedPlayServiceAccount {
-  /** The JSON key file, as Google Cloud downloads it. */
-  readonly json: string;
-  /** The service account's email, the Play Console user it releases as. */
-  readonly email: string;
-  readonly projectId: string;
-  readonly developerId: string;
-  /** The key's ID, as Google Cloud lists it under the service account's keys. */
-  readonly keyId: string;
-  /** Deletes the key with the same sign-in; whether Google Cloud did. */
-  revoke(): Promise<boolean>;
-  /** Ends the sign-in: Google revokes its access token. */
-  dispose(): Promise<void>;
-}
-/**
- * Signs in with Google and issues a service account key that releases the
- * app to Google Play: the developer signs in on Google's own consent
- * screen, in a browser, and the caller never sees the password. Nothing of
- * the sign-in outlives `dispose`.
- */
-type IssuePlayServiceAccount = (request: IssuePlayServiceAccountRequest) => Promise<IssuedPlayServiceAccount>;
-/**
- * Hot Updater's issuer, the one place that picks how it is done: Google's
- * OAuth for installed apps, then the Cloud Resource Manager, Service Usage,
- * IAM, and Play Developer APIs. Another implementation of
- * `IssuePlayServiceAccount` replaces it here without touching its callers.
- */
-declare const issuePlayServiceAccount: IssuePlayServiceAccount;
-//#endregion
-export { type EnrichedNativeBuildAndroidScheme, GOOGLE_OAUTH_CLIENT_ENV_NAMES, type GoogleCloudProject, type GoogleOAuthClient, HOT_UPDATER_GOOGLE_OAUTH_CLIENT, type IssuePlayServiceAccount, type IssuePlayServiceAccountRequest, type IssuedPlayServiceAccount, PLAY_CONSOLE_URL, PLAY_SERVICE_ACCOUNT_ID, PlayServiceAccountError, type PlayServiceAccountErrorCode, PlayVersionCodeUsedError, type UploadToPlayResult, assertPlaySigned, buildAndroid, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, issuePlayServiceAccount, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };
+export { type EnrichedNativeBuildAndroidScheme, type PlayAccess, PlayVersionCodeUsedError, type UploadToPlayResult, assertPlaySigned, buildAndroid, checkPlayAccess, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, playConsoleInviteUrl, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };