@hot-updater/android-helper 1.2.0-rc.1 → 1.2.0-rc.11

package/dist/index.cjs

@@ -35,121 +35,34 @@ let crypto = require("crypto");
 crypto = __toESM(crypto, 1);
 let stream_promises = require("stream/promises");
 let zlib = require("zlib");
-let node_crypto = require("node:crypto");
-node_crypto = __toESM(node_crypto, 1);
-let node_http = require("node:http");
-node_http = __toESM(node_http, 1);
+//#region src/utils/gradlePhase.ts
+/** `> Task :app:compileReleaseKotlin`, with an outcome such as `UP-TO-DATE`. */
+const TASK = /^> Task (:\S+)/;
+const CONFIGURE = /^> Configure project (:\S*)/;
+/**
+* Reads the phase of a Gradle build from its plain console output: the
+* task it runs, after how many it has run, such as
+* `312 tasks · :app:mergeReleaseResources`.
+*/
+const createGradlePhaseReader = () => {
+	let tasks = 0;
+	return (line) => {
+		const task = TASK.exec(line)?.[1];
+		if (task) {
+			tasks += 1;
+			return `${tasks} task${tasks === 1 ? "" : "s"} · ${task}`;
+		}
+		const project = CONFIGURE.exec(line)?.[1];
+		if (project) return `Configuring ${project}`;
+		if (line.startsWith("Starting a Gradle Daemon")) return "Starting the Gradle daemon";
+		if (line.startsWith("Downloading https://services.gradle.org/")) return "Downloading Gradle";
+	};
+};
+//#endregion
 //#region src/utils/createGradleLogger.ts
 const createGradleLogger = ({ logPrefix }) => new _hot_updater_cli_tools.BuildLogger({
 	logPrefix,
-	importantLogPatterns: [
-		"error:",
-		"Error:",
-		"ERROR:",
-		"> Task :",
-		"BUILD FAILED",
-		"BUILD SUCCESSFUL",
-		"FAILURE: Build failed with an exception.",
-		"* What went wrong:",
-		"Execution failed for task",
-		"Could not resolve",
-		"Failed to",
-		"Unable to load script",
-		"Metro encountered an error",
-		"React Native CLI",
-		"Android resource compilation failed",
-		"Duplicate class",
-		"Program type already present",
-		"actionable tasks:",
-		"Deprecated Gradle features were used",
-		":app:configureCMake",
-		":app:buildCMake",
-		":app:compileDebugKotlin",
-		":app:compileReleaseKotlin",
-		":app:compileDebugJavaWithJavac",
-		":app:compileReleaseJavaWithJavac",
-		":app:mergeDebugResources",
-		":app:mergeReleaseResources",
-		":app:processDebugResources",
-		":app:processReleaseResources",
-		":app:packageDebug",
-		":app:packageRelease",
-		":app:assembleDebug",
-		":app:assembleRelease"
-	],
-	progressStages: [
-		[
-			"buildKotlinToolingMetadata",
-			"generateAutolinkingNewArchitectureFiles",
-			"generateAutolinkingPackageList",
-			"generateCodegenSchemaFromJavaScript",
-			"generateCodegenArtifactsFromSchema",
-			"generateReactNativeEntryPoint"
-		],
-		[
-			"createBundleReleaseJsAndAssets",
-			"bundleReleaseJsAndAssets",
-			"bundleDebugJsAndAssets"
-		],
-		[
-			"generateReleaseResValues",
-			"generateDebugResValues",
-			"generateReleaseResources",
-			"generateDebugResources",
-			"mergeReleaseResources",
-			"mergeDebugResources"
-		],
-		[
-			"processReleaseResources",
-			"processDebugResources",
-			"processReleaseManifest",
-			"processDebugManifest",
-			"processDebugMainManifest",
-			"parseReleaseLocalResources",
-			"parseDebugLocalResources"
-		],
-		["compileReleaseKotlin", "compileDebugKotlin"],
-		["compileReleaseJavaWithJavac", "compileDebugJavaWithJavac"],
-		[
-			/configureCMake\w+\[/,
-			/buildCMake\w+\[/,
-			"mergeReleaseJniLibFolders",
-			"mergeDebugJniLibFolders",
-			"mergeReleaseNativeLibs",
-			"mergeDebugNativeLibs"
-		],
-		[
-			"desugarReleaseFileDependencies",
-			"desugarDebugFileDependencies",
-			"dexBuilderRelease",
-			"dexBuilderDebug",
-			"mergeDexRelease",
-			"mergeExtDexRelease",
-			"mergeExtDexDebug",
-			"mergeProjectDexRelease",
-			"mergeProjectDexDebug",
-			"mergeLibDexRelease",
-			"mergeLibDexDebug",
-			"mergeDebugGlobalSynthetics",
-			"mergeReleaseGlobalSynthetics",
-			"transformClassesWithDex"
-		],
-		[
-			"compressReleaseAssets",
-			"compressDebugAssets",
-			"optimizeReleaseResources",
-			"mergeReleaseAssets",
-			"mergeDebugAssets"
-		],
-		[
-			"packageRelease",
-			"packageDebug",
-			"assembleRelease",
-			"assembleDebug"
-		],
-		["bundleRelease", "bundleDebug"],
-		["BUILD SUCCESSFUL", /\d+ actionable tasks:/]
-	],
+	createPhaseReader: createGradlePhaseReader,
 	failureSummary: {
 		lines: [
 			/^e: /,
@@ -164,6 +77,26 @@ const createGradleLogger = ({ logPrefix }) => new _hot_updater_cli_tools.BuildLo
 	}
 });
 //#endregion
+//#region src/utils/formatCommand.ts
+/**
+* A command to print, broken at spaces with ` \` once a line would pass
+* `width`, each continuation indented two spaces, so a terminal never wraps
+* it mid-word and it still pastes as one command.
+*/
+const formatCommand = (words, width = 74) => {
+	const lines = [];
+	let line = "";
+	for (const word of words) {
+		const next = line ? `${line} ${word}` : word;
+		if (line && next.length > width - 2) {
+			lines.push(`${line} \\`);
+			line = `  ${word}`;
+		} else line = next;
+	}
+	lines.push(line);
+	return lines.join("\n");
+};
+//#endregion
 //#region src/builder/runGradle.ts
 /** Why Gradle failed, without its command line. */
 const describeFailure = (error) => {
@@ -186,19 +119,24 @@ const getGradleWrapper = () => process.platform.startsWith("win") ? "gradlew.bat
 /**
 * Run gradle build with specified tasks and arguments
 */
-async function runGradle({ tasks, logPrefix, args, env, androidProjectPath, appModuleName }) {
+async function runGradle({ tasks, logPrefix, args, env, androidProjectPath, appModuleName, logHeader = [] }) {
 	const gradleArgs = getTaskNames(appModuleName, tasks);
 	gradleArgs.push("-x", "lint");
 	if (args.extraParams) gradleArgs.push(...args.extraParams);
-	_hot_updater_cli_tools.p.log.info(`Run Gradle Settings: 
-Project    ${androidProjectPath}
-App Module ${appModuleName}
-Tasks      ${tasks.join(", ")}
-Args       ${gradleArgs.join(" ")}
-`);
 	if ("port" in args && args.port != null) gradleArgs.push(`-PreactNativeDevServerPort=${args.port}`);
 	const logger = createGradleLogger({ logPrefix });
-	await logger.start();
+	await logger.start({
+		title: `Building ${tasks.join(", ")}`,
+		header: [
+			...logHeader,
+			`Project     ${path.default.relative((0, _hot_updater_cli_tools.getCwd)(), androidProjectPath) || "."}`,
+			`App module  ${appModuleName}`,
+			`Tasks       ${tasks.join(", ")}`,
+			`$ ${formatCommand([path.default.basename(getGradleWrapper()), ...gradleArgs])}`,
+			""
+		]
+	});
+	let logFilePath = null;
 	try {
 		const gradle = (0, execa.execa)(getGradleWrapper(), gradleArgs, {
 			cwd: androidProjectPath,
@@ -210,11 +148,13 @@ Args       ${gradleArgs.join(" ")}
 		const [gradleResult, loggingResult] = await Promise.allSettled([gradle, outputStream ? logger.processStream(outputStream) : void 0]);
 		if (gradleResult.status === "rejected") throw gradleResult.reason;
 		if (loggingResult.status === "rejected") throw loggingResult.reason;
-		logger.stop();
+		logger.stop(`Built ${tasks.join(", ")}`);
+		logFilePath = logger.logFilePath;
 	} catch (e) {
 		logger.writeError(e);
-		logger.stop("Build failed", false);
-		throw new _hot_updater_cli_tools.BuildFailedError(`Build failed: ${describeFailure(e)}`, {
+		const reason = describeFailure(e);
+		logger.stop(`Build failed · ${reason.replace(/\.$/, "")}`, false);
+		throw new _hot_updater_cli_tools.BuildFailedError(`Build failed: ${reason}`, {
 			logPath: logger.logPath,
 			summary: logger.failureSummary,
 			cause: e
@@ -222,11 +162,14 @@ Args       ${gradleArgs.join(" ")}
 	} finally {
 		await logger.close();
 	}
-	return findBuildDirectory({
-		androidProjectPath,
-		moduleName: appModuleName,
-		tasks
-	});
+	return {
+		...await findBuildDirectory({
+			androidProjectPath,
+			moduleName: appModuleName,
+			tasks
+		}),
+		logFilePath
+	};
 }
 /**
 * Find the build output directory and artifact path
@@ -257,7 +200,7 @@ async function getBuildOutputFilePath({ aab, appModuleName, buildDirectory, vari
 	const outputFile = `${appModuleName}-${variant}.${aab ? "aab" : "apk"}`;
 	const outputFilePath = path.default.join(buildDirectory, outputFile);
 	if (fs.default.existsSync(outputFilePath)) return outputFilePath;
-	_hot_updater_cli_tools.p.log.error(`Failed to find the output file for ${outputFilePath}`);
+	_hot_updater_cli_tools.p.log.error(`Gradle wrote no ${outputFilePath}.`);
 	process.exit(1);
 }
 //#endregion
@@ -277,7 +220,7 @@ const resolveGradleSigningEnv = async ({ schemeConfig, credentials }) => {
 	const reference = schemeConfig.signing?.keystore;
 	if (!reference) return;
 	if (isDebugVariant(schemeConfig.variant)) {
-		_hot_updater_cli_tools.p.log.info(`${schemeConfig.variant} signs with the debug keystore, so signing.keystore is not used.`);
+		_hot_updater_cli_tools.p.log.info(`${schemeConfig.variant} signs with the debug keystore; signing.keystore is unused.`);
 		return;
 	}
 	const keystore = await (credentials ?? (0, _hot_updater_cli_tools.createCredentialResolver)()).resolve({
@@ -430,7 +373,7 @@ const writeBaseModuleApk = async (aabPath, directory) => {
 const readBuiltApp = async ({ artifactPath, androidProjectPath }) => {
 	const aapt2 = findAapt2(androidProjectPath);
 	if (!aapt2) {
-		_hot_updater_cli_tools.p.log.warn("aapt2 was not found in the Android SDK's build-tools, so the build reports the app version and channel of the project files.");
+		_hot_updater_cli_tools.p.log.warn("No aapt2 in the Android SDK build-tools.\nThe build reports the project files' app version and channel.");
 		return;
 	}
 	const directory = await fs.default.promises.mkdtemp(path.default.join(os.default.tmpdir(), "android-helper-"));
@@ -455,7 +398,7 @@ const readBuiltApp = async ({ artifactPath, androidProjectPath }) => {
 		};
 		const appVersion = await resolve(parseManifestVersionName(xmltree));
 		const channel = await resolve(parseManifestMetaData(xmltree, CHANNEL_META_DATA_KEY));
-		if (appVersion === void 0 || channel === void 0) _hot_updater_cli_tools.p.log.warn("aapt2 printed the artifact's versionName or com.hotupdater.CHANNEL in a form that cannot be read exactly, so the build reports the project files' value for it.");
+		if (appVersion === void 0 || channel === void 0) _hot_updater_cli_tools.p.log.warn("Couldn't read the artifact's versionName or com.hotupdater.CHANNEL exactly.\nThe build reports the project files' value instead.");
 		const versionCode = parseManifestVersionCode(xmltree);
 		return {
 			appVersion: appVersion ?? null,
@@ -520,7 +463,7 @@ const readBuiltVersionCode = async ({ artifactPath, androidProjectPath }) => {
 };
 //#endregion
 //#region src/buildAndroid.ts
-const buildAndroid = async ({ schemeConfig, minBundleId = (0, _hot_updater_cli_tools.createMinBundleId)(), credentials }) => {
+const buildAndroid = async ({ schemeConfig, minBundleId = (0, _hot_updater_cli_tools.createMinBundleId)(), credentials, logHeader }) => {
 	const androidProjectPath = path.default.join((0, _hot_updater_cli_tools.getCwd)(), "android");
 	const result = await runGradle({
 		args: { extraParams: [`-PMIN_BUNDLE_ID=${minBundleId}`] },
@@ -531,7 +474,8 @@ const buildAndroid = async ({ schemeConfig, minBundleId = (0, _hot_updater_cli_t
 		appModuleName: schemeConfig.appModuleName,
 		tasks: schemeConfig.aab ? [`bundle${schemeConfig.variant}`] : [`assemble${schemeConfig.variant}`],
 		logPrefix: `android-${schemeConfig.hotUpdaterSchemeName}-build`,
-		androidProjectPath
+		androidProjectPath,
+		logHeader
 	});
 	return {
 		...result,
@@ -586,7 +530,7 @@ const readServiceAccount = (json) => {
 		throw new Error("The Play service account is not a JSON key file.");
 	}
 	const { client_email, private_key, token_uri } = parsed;
-	if (typeof client_email !== "string" || typeof private_key !== "string") throw new Error("The Play service account has no client_email or private_key: use the JSON key file Google Cloud creates for the service account.");
+	if (typeof client_email !== "string" || typeof private_key !== "string") throw new Error("The Play service account has no client_email or private_key.\nUse the JSON key file Google Cloud creates for it.");
 	(0, _hot_updater_cli_tools.registerSecretValue)(private_key);
 	let privateKey;
 	try {
@@ -632,7 +576,7 @@ const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 var PlayVersionCodeUsedError = class extends Error {
 	name = "PlayVersionCodeUsedError";
 	constructor(options) {
-		super("Google Play already has this .aab's version code. Raise versionCode for every build you upload.", options);
+		super("Google Play already has this .aab's version code.\nRaise versionCode for every build you upload.", options);
 	}
 };
 /**
@@ -642,15 +586,20 @@ var PlayVersionCodeUsedError = class extends Error {
 const explain = (error, packageName) => {
 	if (!(error instanceof GooglePlayError)) return error;
 	const { status, apiMessage } = error;
-	if (status === 401 || /does not have permission/i.test(apiMessage)) return new Error(`The Play service account cannot release ${packageName}. Invite its email in Play Console under Users and permissions, with permission to release to testing tracks, and enable the Google Play Android Developer API in its Google Cloud project.`, { cause: error });
-	if (/package not found/i.test(apiMessage)) return new Error(`Google Play has no app ${packageName}. Create the app in Play Console and upload its first .aab there; the API releases the builds after it.`, { cause: error });
+	if (status === 401 || /does not have permission/i.test(apiMessage)) return new Error([
+		`The Play service account can't release ${packageName}.`,
+		"Invite its email in Play Console (Users and permissions) to release to",
+		"testing tracks, and enable the Google Play Android Developer API."
+	].join("\n"), { cause: error });
+	if (/package not found/i.test(apiMessage)) return new Error(`Google Play has no app ${packageName}.\nCreate it in Play Console and upload its first .aab there.`, { cause: error });
 	if (/version code .*(already been used|already used)/i.test(apiMessage)) return new PlayVersionCodeUsedError({ cause: error });
 	return error;
 };
 /**
 * Requests to the Google Play Developer API for `packageName`, as the
 * service account: each carries an access token, exchanged for a signed
-* assertion and replaced well before it expires.
+* assertion and replaced well before it expires. `checkPlayAccess`
+* checks a key's access with it too.
 */
 const createPlayClient = ({ json, packageName, fetch }) => {
 	const account = readServiceAccount(json);
@@ -668,7 +617,7 @@ const createPlayClient = ({ json, packageName, fetch }) => {
 					assertion
 				}).toString()
 			});
-			if (!response.ok) throw new Error(`Google refused the Play service account (HTTP ${response.status}): ${await readApiMessage(response) || "check that its key is current and the service account is enabled."}`);
+			if (!response.ok) throw new Error(`Google refused the Play service account (HTTP ${response.status}).\n${await readApiMessage(response) || "Check that its key is current and the service account is enabled."}`);
 			const { access_token } = await response.json();
 			if (typeof access_token !== "string" || !access_token) throw new Error("Google answered the Play service account with no access token.");
 			(0, _hot_updater_cli_tools.registerSecretValue)(access_token);
@@ -699,6 +648,66 @@ const createPlayClient = ({ json, packageName, fetch }) => {
 	};
 };
 /**
+* Play Console's page that invites `email` as a user. `_` stands for the
+* developer account the browser is signed in to, so no ID is needed.
+*/
+const playConsoleInviteUrl = (email) => `https://play.google.com/console/u/0/developers/_/users-and-permissions?invite=${encodeURIComponent(email)}`;
+const readClientEmail = (json) => {
+	try {
+		const { client_email } = JSON.parse(json);
+		return typeof client_email === "string" ? client_email : "";
+	} catch {
+		return "";
+	}
+};
+/**
+* Checks once whether the service account's key reaches `packageName`: it
+* opens an edit of the app and deletes it again, which changes nothing.
+* Throws only for what says nothing about access, such as a network error.
+*/
+const checkPlayAccess = async ({ serviceAccount: { json }, packageName, fetch = globalThis.fetch }) => {
+	const email = readClientEmail(json);
+	const refused = (error) => ({
+		status: "refused",
+		email,
+		reason: error instanceof Error ? error.message : String(error)
+	});
+	let play;
+	try {
+		play = createPlayClient({
+			json,
+			packageName,
+			fetch
+		});
+	} catch (error) {
+		return refused(error);
+	}
+	try {
+		await play.authorization();
+	} catch (error) {
+		if (error instanceof TypeError) throw error;
+		return refused(error);
+	}
+	const edits = `${API_URL}${play.app}/edits`;
+	try {
+		const edit = await play.request(`Opening an edit of ${packageName}`, "POST", edits, {});
+		if (edit?.id) await play.request("Deleting the edit", "DELETE", `${edits}/${encodeURIComponent(edit.id)}`).catch(() => {});
+		return { status: "ready" };
+	} catch (error) {
+		if (error instanceof GooglePlayError) {
+			if (error.status === 401 || error.status === 403) return {
+				status: "denied",
+				email
+			};
+			if (error.status === 404) return {
+				status: "not-found",
+				email
+			};
+		}
+		throw error;
+	}
+};
+/**
 * Whether Google Play's internal testing track already releases the
 * `.aab`'s version code, as when a reused native build was uploaded
 * before. It reads the track in an edit it then deletes, changing nothing.
@@ -746,7 +755,11 @@ const assertPlaySigned = async (aabPath) => {
 		"-jarfile",
 		aabPath
 	], { reject: false });
-	if (exitCode === 0 && ANDROID_DEBUG_SIGNER.test(String(stdout))) throw new Error(`Google Play refuses an .aab signed with the Android debug keystore, and ${aabPath} is. Set the scheme's signing.keystore, or a release signingConfig in android/app/build.gradle, then build again.`);
+	if (exitCode === 0 && ANDROID_DEBUG_SIGNER.test(String(stdout))) throw new Error([
+		"Google Play refuses an .aab signed with the Android debug keystore.",
+		"Set the scheme's signing.keystore, or a release signingConfig in",
+		"android/app/build.gradle, then build again."
+	].join("\n"));
 };
 /**
 * Uploads an `.aab` to Google Play's internal testing track with the Google
@@ -797,7 +810,7 @@ const uploadToPlay = async ({ aabPath, packageName, serviceAccount: { json }, fe
 			};
 		} catch (error) {
 			if (!(error instanceof GooglePlayError) || !DRAFT_APP_ERRORS.some((message) => error.apiMessage.includes(message))) throw error;
-			_hot_updater_cli_tools.p.log.warn(`Play Console has not published ${packageName} yet, which takes only draft releases. The internal release of version code ${versionCode} is a draft: roll it out in Play Console.`);
+			_hot_updater_cli_tools.p.log.warn(`${packageName} isn't published yet, so version code ${versionCode} is a draft.\nRoll it out in Play Console.`);
 			await release("draft");
 			return {
 				versionCode,
@@ -819,10 +832,14 @@ const commit = async ({ request, edit, retryDelayMs }) => {
 	let changesNotSentForReview = false;
 	for (let attempt = 1;; attempt++) try {
 		await request("Committing the Google Play edit", "POST", `${edit}:commit${changesNotSentForReview ? "?changesNotSentForReview=true" : ""}`);
-		if (changesNotSentForReview) _hot_updater_cli_tools.p.log.warn("Google Play saved the release without sending it for review, as the app's state requires. Send the changes for review in Play Console.");
+		if (changesNotSentForReview) _hot_updater_cli_tools.p.log.warn("Google Play saved the release without sending it for review.\nSend the changes for review in Play Console.");
 		return;
 	} catch (error) {
-		if (!(error instanceof GooglePlayError) || error.status >= 500 || error.status === 429) throw new Error(`Google Play did not confirm the release: ${error instanceof Error ? error.message : String(error)} Check internal testing in Play Console before you upload this version code again.`, { cause: error });
+		if (!(error instanceof GooglePlayError) || error.status >= 500 || error.status === 429) throw new Error([
+			"Google Play didn't confirm the release.",
+			error instanceof Error ? error.message : String(error),
+			"Check internal testing in Play Console before you upload it again."
+		].join("\n"), { cause: error });
 		if (error.status !== 400) throw error;
 		if (!changesNotSentForReview && error.apiMessage.includes(NEEDS_CHANGES_NOT_SENT_FOR_REVIEW)) {
 			changesNotSentForReview = true;
@@ -925,9 +942,9 @@ const confirmedOffset = (response) => {
 * from new apps, or a debug variant, which Play refuses.
 */
 const resolvePlayUploadServiceAccount = ({ scheme, androidScheme }) => {
-	if (androidScheme.aab === false) throw new Error(`Google Play takes an .aab, and the scheme ${scheme} builds an .apk (aab: false).`);
+	if (androidScheme.aab === false) throw new Error(`The scheme ${scheme} builds an .apk (aab: false); Google Play takes an .aab.`);
 	const variant = androidScheme.variant ?? "Release";
-	if (/debug$/i.test(variant)) throw new Error(`Google Play takes a release build, and the scheme ${scheme} builds the ${variant} variant, which is debuggable and loads its JavaScript from Metro.`);
+	if (/debug$/i.test(variant)) throw new Error(`The scheme ${scheme} builds ${variant}; Google Play takes a release build.`);
 	return {
 		kind: "play-service-account",
 		name: "play-service-account"
@@ -1060,606 +1077,14 @@ const extractBuiltInBundle = async ({ artifactPath, outputPath }) => {
 	await (entry.method === 8 ? (0, stream_promises.pipeline)(source, (0, zlib.createInflateRaw)(), fs.default.createWriteStream(outputPath)) : (0, stream_promises.pipeline)(source, fs.default.createWriteStream(outputPath)));
 };
 //#endregion
-//#region src/google/googleApi.ts
-/** A Google Cloud or Google Play API request that failed, with Google's error. */
-var GoogleApiError = class extends Error {
-	status;
-	/** Google's canonical status, such as `PERMISSION_DENIED`. */
-	apiStatus;
-	apiMessage;
-	/** The `ErrorInfo` reasons, such as `SERVICE_DISABLED`. */
-	reasons;
-	/** The `PreconditionFailure` violation types, such as an org policy constraint. */
-	violations;
-	/** The `ErrorInfo` consumer of a disabled service, such as `projects/123`. */
-	consumer;
-	constructor(action, status, body = {}) {
-		const apiMessage = body.apiMessage ?? "";
-		super(`${action} failed (HTTP ${status})${apiMessage ? `: ${apiMessage}` : "."}`);
-		this.name = "GoogleApiError";
-		this.status = status;
-		this.apiStatus = body.apiStatus;
-		this.apiMessage = apiMessage;
-		this.reasons = body.reasons ?? [];
-		this.violations = body.violations ?? [];
-		this.consumer = body.consumer;
-	}
-};
-/** Google's error body, `{ error: { code, status, message, details } }`. */
-const readError = async (action, response) => {
-	let error;
-	try {
-		error = (await response.json()).error;
-	} catch {}
-	const details = Array.isArray(error?.details) ? error.details : [];
-	const info = details.filter((detail) => typeof detail.reason === "string");
-	return new GoogleApiError(action, response.status, {
-		...typeof error?.status === "string" ? { apiStatus: error.status } : {},
-		...typeof error?.message === "string" ? { apiMessage: error.message } : {},
-		reasons: info.map((detail) => detail.reason),
-		violations: details.flatMap((detail) => (detail.violations ?? []).flatMap((violation) => typeof violation.type === "string" ? [violation.type] : [])),
-		...info.find((detail) => detail.metadata?.["consumer"]) ? { consumer: info.find((detail) => detail.metadata?.["consumer"]).metadata["consumer"] } : {}
-	});
-};
-/** Whether Google answered that a service is disabled in a project. */
-const isServiceDisabled = (error) => error instanceof GoogleApiError && (error.reasons.includes("SERVICE_DISABLED") || /has not been used in project .* or it is disabled/i.test(error.apiMessage));
-/** Requests with the signed-in user's access token, throwing `GoogleApiError`. */
-const createGoogleRequest = ({ accessToken, fetch }) => async (action, method, url, body) => {
-	const response = await fetch(url, {
-		method,
-		headers: {
-			authorization: `Bearer ${accessToken}`,
-			...body === void 0 ? {} : { "content-type": "application/json" }
-		},
-		...body === void 0 ? {} : { body: JSON.stringify(body) }
-	});
-	if (!response.ok) throw await readError(action, response);
-	const text = await response.text();
-	return text ? JSON.parse(text) : {};
-};
-/**
-* Polls `operation` at `origin` until it is done, returning its response or
-* throwing its error as a `GoogleApiError` with the operation's code.
-*/
-const waitForOperation = async ({ request, origin, operation, action, sleep, intervalMs = 2e3, attempts = 60 }) => {
-	let current = operation;
-	for (let attempt = 0; !current.done; attempt++) {
-		if (attempt >= attempts || !current.name) throw new Error(`${action} did not finish in time.`);
-		await sleep(intervalMs);
-		current = await request(action, "GET", `${origin}/${current.name}`);
-	}
-	if (current.error) throw new GoogleApiError(action, 400, {
-		apiMessage: current.error.message ?? "",
-		...current.error.code === 7 ? { apiStatus: "PERMISSION_DENIED" } : {},
-		...current.error.code === 8 ? { apiStatus: "RESOURCE_EXHAUSTED" } : {}
-	});
-	return current.response;
-};
-//#endregion
-//#region src/google/types.ts
-/** A named failure of `issuePlayServiceAccount`, with what to do in its message. */
-var PlayServiceAccountError = class extends Error {
-	code;
-	constructor(code, message, options) {
-		super(message, options);
-		this.name = "PlayServiceAccountError";
-		this.code = code;
-	}
-};
-/** The environment variables that replace Hot Updater's Google OAuth client. */
-const GOOGLE_OAUTH_CLIENT_ENV_NAMES = {
-	clientId: "HOT_UPDATER_GOOGLE_OAUTH_CLIENT_ID",
-	clientSecret: "HOT_UPDATER_GOOGLE_OAUTH_CLIENT_SECRET"
-};
-/** The service account Hot Updater creates, `hot-updater-play@<project>.iam.gserviceaccount.com`. */
-const PLAY_SERVICE_ACCOUNT_ID = "hot-updater-play";
-/** Where a Play Console admin finds the developer account ID. */
-const PLAY_CONSOLE_URL = "https://play.google.com/console";
-//#endregion
-//#region src/google/googleSignIn.ts
-const AUTHORIZATION_URL = "https://accounts.google.com/o/oauth2/v2/auth";
-const TOKEN_URL = "https://oauth2.googleapis.com/token";
-const REVOKE_URL = "https://oauth2.googleapis.com/revoke";
-/** How long the browser has to come back with the sign-in. */
-const SIGN_IN_TIMEOUT_MS = 3e5;
-const base64url = (bytes) => bytes.toString("base64url");
-const page = (message) => `<!doctype html><meta charset="utf-8"><title>Hot Updater</title><body style="font-family:system-ui;margin:3rem"><p>${message}</p></body>`;
-/**
-* Signs in with Google as an installed app does (RFC 8252): the browser
-* opens Google's own consent screen, so the password and the second factor
-* stay with Google, and the authorization code comes back to a loopback
-* server on 127.0.0.1, bound to a random port for this sign-in only. The
-* code is exchanged with PKCE (S256), and `state` ties the answer to this
-* request.
-*
-* @param onUrl Sees the sign-in URL, to print and open in a browser.
-*/
-const signInWithGoogle = async ({ client, scopes, onUrl, fetch = globalThis.fetch, timeoutMs = SIGN_IN_TIMEOUT_MS }) => {
-	const verifier = base64url(node_crypto.default.randomBytes(32));
-	const challenge = base64url(node_crypto.default.createHash("sha256").update(verifier).digest());
-	const state = base64url(node_crypto.default.randomBytes(16));
-	const server = node_http.default.createServer();
-	await new Promise((resolve, reject) => {
-		server.once("error", reject);
-		server.listen(0, "127.0.0.1", () => resolve());
-	});
-	try {
-		const { port } = server.address();
-		const redirectUri = `http://127.0.0.1:${port}`;
-		const code = new Promise((resolve, reject) => {
-			const timer = setTimeout(() => reject(new PlayServiceAccountError("sign-in-cancelled", "The Google sign-in did not finish in time.")), timeoutMs);
-			timer.unref();
-			server.on("request", (req, res) => {
-				const query = new URL(req.url ?? "/", redirectUri).searchParams;
-				if (query.get("state") !== state) {
-					res.writeHead(404).end();
-					return;
-				}
-				const error = query.get("error");
-				const answer = query.get("code");
-				res.writeHead(error || !answer ? 400 : 200, { "content-type": "text/html; charset=utf-8" }).end(page(error || !answer ? "The sign-in did not finish. Return to the terminal." : "Signed in. Close this tab and return to the terminal."));
-				clearTimeout(timer);
-				if (error || !answer) reject(new PlayServiceAccountError("sign-in-cancelled", error === "access_denied" ? "The Google sign-in was cancelled." : `The Google sign-in failed: ${error ?? "no authorization code"}.`));
-				else resolve(answer);
-			});
-		});
-		code.catch(() => {});
-		const url = new URL(AUTHORIZATION_URL);
-		url.search = new URLSearchParams({
-			client_id: client.clientId,
-			redirect_uri: redirectUri,
-			response_type: "code",
-			scope: scopes.join(" "),
-			code_challenge: challenge,
-			code_challenge_method: "S256",
-			state,
-			prompt: "select_account"
-		}).toString();
-		await onUrl(url.toString());
-		const authorizationCode = await code;
-		(0, _hot_updater_cli_tools.registerSecretValue)(authorizationCode);
-		const response = await fetch(TOKEN_URL, {
-			method: "POST",
-			headers: { "content-type": "application/x-www-form-urlencoded" },
-			body: new URLSearchParams({
-				code: authorizationCode,
-				client_id: client.clientId,
-				...client.clientSecret ? { client_secret: client.clientSecret } : {},
-				redirect_uri: redirectUri,
-				grant_type: "authorization_code",
-				code_verifier: verifier
-			}).toString()
-		});
-		const token = await response.json().catch(() => ({}));
-		if (!response.ok || typeof token.access_token !== "string") throw new PlayServiceAccountError(token.error === "invalid_client" ? "sign-in-not-configured" : "sign-in-cancelled", `Google refused the sign-in (HTTP ${response.status})${typeof token.error_description === "string" ? `: ${token.error_description}` : typeof token.error === "string" ? `: ${token.error}` : "."}`);
-		(0, _hot_updater_cli_tools.registerSecretValue)(token.access_token);
-		return {
-			accessToken: token.access_token,
-			scopes: typeof token.scope === "string" ? token.scope.split(" ") : []
-		};
-	} finally {
-		server.closeAllConnections();
-		await new Promise((resolve) => server.close(() => resolve()));
-	}
-};
-/** Ends a sign-in: Google revokes its access token. Whether Google did. */
-const revokeGoogleToken = async (accessToken, fetch = globalThis.fetch) => {
-	try {
-		return (await fetch(REVOKE_URL, {
-			method: "POST",
-			headers: { "content-type": "application/x-www-form-urlencoded" },
-			body: new URLSearchParams({ token: accessToken }).toString()
-		})).ok;
-	} catch {
-		return false;
-	}
-};
-//#endregion
-//#region src/google/googleKeyIssuer.ts
-const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
-const ANDROID_PUBLISHER_SCOPE = "https://www.googleapis.com/auth/androidpublisher";
-const SCOPES = [CLOUD_PLATFORM_SCOPE, ANDROID_PUBLISHER_SCOPE];
-const PUBLISHER_API = "https://androidpublisher.googleapis.com/androidpublisher/v3";
-const RESOURCE_MANAGER_API = "https://cloudresourcemanager.googleapis.com";
-const SERVICE_USAGE_API = "https://serviceusage.googleapis.com";
-const IAM_API = "https://iam.googleapis.com/v1";
-/** IAM creates the service account; the Play Developer API is what it calls. */
-const SERVICES = ["iam.googleapis.com", "androidpublisher.googleapis.com"];
-/**
-* What the service account may do in Play Console, for the app only: read
-* it, and release to testing tracks, which `--submit play-internal` does.
-*/
-const APP_PERMISSIONS = ["CAN_VIEW_NON_FINANCIAL_DATA", "CAN_MANAGE_TRACK_APKS"];
-const KEY_CREATION_CONSTRAINT = "constraints/iam.disableServiceAccountKeyCreation";
-/** Retries while Google enables an API or creates a service account. */
-const PROPAGATION_ATTEMPTS = 12;
-const PROPAGATION_DELAY_MS = 1e4;
-const sleepFor = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-/** The developer account ID in `input`, a number or a Play Console URL. */
-const parseDeveloperId = (input) => {
-	const trimmed = input.trim();
-	if (/^\d+$/u.test(trimmed)) return trimmed;
-	return trimmed.match(/\/developers\/(\d+)(?:[/?#]|$)/u)?.[1];
-};
-/** A project ID nobody has: Google Cloud's are global. */
-const newProjectId = () => `${PLAY_SERVICE_ACCOUNT_ID}-${node_crypto.default.randomBytes(3).toString("hex")}`;
-const isNotFound = (error) => error instanceof GoogleApiError && error.status === 404;
-const isConflict = (error) => error instanceof GoogleApiError && error.status === 409;
-/** The API is disabled in the OAuth client's own project: waiting does not help. */
-const clientApiDisabled = (error) => new PlayServiceAccountError("api-not-enabled", `${error.apiMessage} The Google OAuth client Hot Updater signs in with belongs to that project, which must enable the API (see ${GOOGLE_OAUTH_CLIENT_ENV_NAMES.clientId}).`, { cause: error });
-/** Google's own words, after a message that names the likely cause. */
-const googleSays = (error) => error instanceof GoogleApiError && error.apiMessage ? ` (Google: ${error.apiMessage})` : "";
-/** A Play Console refusal, as `not-play-admin`. */
-const notPlayAdmin = (developerId, error) => new PlayServiceAccountError("not-play-admin", `The Google Account you signed in with is not an admin of the Play Console developer account ${developerId}. Sign in with an account that has the Admin permission there (Users and permissions in ${PLAY_CONSOLE_URL})${googleSays(error)}.`, { cause: error });
-const isDenied = (error) => error instanceof GoogleApiError && (error.status === 403 || error.apiStatus === "PERMISSION_DENIED");
-/**
-* `IssuePlayServiceAccount` with Google's own APIs, after a sign-in on
-* Google's consent screen (OAuth for installed apps, with PKCE and a
-* loopback redirect):
-*
-* 1. the Play Console side is checked first, with no change anywhere: the
-*    developer account answers to the account as its admin, and has the app;
-* 2. the chosen Google Cloud project, or a new one, gets the IAM and Play
-*    Developer APIs enabled, and the service account `hot-updater-play`;
-* 3. the service account becomes a Play Console user that may release the
-*    app to testing tracks;
-* 4. only then is its JSON key created, the last step, so a failure before
-*    it leaves no key behind.
-*
-* Each step reuses what an earlier run created: the project, the service
-* account, and its Play Console access.
-*/
-const createGoogleKeyIssuer = ({ fetch = globalThis.fetch, sleep = sleepFor } = {}) => async (request) => {
-	const { packageName, oauthClient, onStep = () => {} } = request;
-	if (!oauthClient?.clientId) throw new PlayServiceAccountError("sign-in-not-configured", `This build of Hot Updater has no Google OAuth client to sign in with. Set ${GOOGLE_OAUTH_CLIENT_ENV_NAMES.clientId} and ${GOOGLE_OAUTH_CLIENT_ENV_NAMES.clientSecret} to a "Desktop app" OAuth client.`);
-	const signIn = await signInWithGoogle({
-		client: oauthClient,
-		scopes: SCOPES,
-		onUrl: request.onSignInUrl,
-		fetch
-	});
-	const dispose = async () => {
-		await revokeGoogleToken(signIn.accessToken, fetch);
-	};
-	try {
-		const missing = SCOPES.filter((scope) => !signIn.scopes.includes(scope));
-		if (missing.length > 0) throw new PlayServiceAccountError("scope-not-granted", `The sign-in did not allow ${missing.map((scope) => scope === ANDROID_PUBLISHER_SCOPE ? "managing Google Play" : "managing Google Cloud").join(" or ")}. Run this again and keep every box on Google's consent screen ticked.`);
-		const google = createGoogleRequest({
-			accessToken: signIn.accessToken,
-			fetch
-		});
-		const developerInput = await request.askDeveloperId();
-		const developerId = parseDeveloperId(developerInput);
-		if (developerId === void 0) throw new PlayServiceAccountError("developer-not-found", `"${developerInput.trim()}" is no developer account ID. Open ${PLAY_CONSOLE_URL}: it is the number after /developers/ in the address.`);
-		onStep("Checking the Play Console developer account");
-		await checkPlayConsole({
-			google,
-			developerId,
-			packageName
-		});
-		const project = await chooseProject({
-			google,
-			request,
-			sleep,
-			onStep
-		});
-		const { projectId } = project;
-		onStep(`Enabling the Google Play Developer API in ${projectId}`);
-		await enableServices({
-			google,
-			projectId,
-			sleep
-		});
-		onStep(`Creating the service account in ${projectId}`);
-		const email = await ensureServiceAccount({
-			google,
-			project,
-			sleep
-		});
-		onStep(`Giving ${email} release access to ${packageName}`);
-		await grantPlayAccess({
-			google,
-			developerId,
-			email,
-			packageName
-		});
-		onStep("Creating the service account's JSON key");
-		const key = await createKey({
-			google,
-			project,
-			email,
-			sleep
-		});
-		return {
-			json: key.json,
-			keyId: key.keyId,
-			email,
-			projectId,
-			developerId,
-			revoke: async () => {
-				try {
-					await google("Deleting the key", "DELETE", `${IAM_API}/${key.name}`);
-					return true;
-				} catch (error) {
-					return isNotFound(error);
-				}
-			},
-			dispose
-		};
-	} catch (error) {
-		await dispose();
-		throw error;
-	}
-};
-/**
-* Whether the signed-in account administers `developerId`, and Google Play
-* has `packageName` there, asked without changing anything: listing the
-* account's users takes the admin permission, and an edit opened on the app
-* is deleted again.
-*/
-const checkPlayConsole = async ({ google, developerId, packageName }) => {
-	try {
-		await google("Listing the Play Console users", "GET", `${PUBLISHER_API}/developers/${developerId}/users?pageSize=1`);
-	} catch (error) {
-		if (isServiceDisabled(error)) throw clientApiDisabled(error);
-		if (isNotFound(error)) throw new PlayServiceAccountError("developer-not-found", `Play Console has no developer account ${developerId}. Open ${PLAY_CONSOLE_URL}: the developer account ID is the number after /developers/ in the address${googleSays(error)}.`, { cause: error });
-		if (isDenied(error)) throw notPlayAdmin(developerId, error);
-		throw error;
-	}
-	let edit;
-	try {
-		edit = await google(`Opening an edit of ${packageName}`, "POST", `${PUBLISHER_API}/applications/${encodeURIComponent(packageName)}/edits`);
-	} catch (error) {
-		if (isServiceDisabled(error)) throw clientApiDisabled(error);
-		if (isNotFound(error) || isDenied(error)) throw appNotFound(packageName, developerId, error);
-		throw error;
-	}
-	if (edit.id) await google("Deleting the edit", "DELETE", `${PUBLISHER_API}/applications/${encodeURIComponent(packageName)}/edits/${edit.id}`).catch(() => {});
-};
-const appNotFound = (packageName, developerId, cause) => new PlayServiceAccountError("app-not-found", `Google Play has no app ${packageName} in the developer account ${developerId}. Google takes the first .aab of a new app only in Play Console: create the app there, upload one .aab by hand (for example to internal testing), then run this again${googleSays(cause)}.`, { cause });
-/** The account's active projects, every page of them. */
-const listProjects = async (google) => {
-	const projects = [];
-	let pageToken;
-	do {
-		const page = await google("Listing the Google Cloud projects", "GET", `${RESOURCE_MANAGER_API}/v3/projects:search?${new URLSearchParams({
-			query: "state:ACTIVE",
-			...pageToken ? { pageToken } : {}
-		})}`);
-		for (const project of page.projects ?? []) if (project.projectId) projects.push({
-			projectId: project.projectId,
-			...project.displayName ? { displayName: project.displayName } : {},
-			...projectNumberOf(project.name)
-		});
-		pageToken = page.nextPageToken || void 0;
-	} while (pageToken);
-	return projects;
-};
-/** The project the developer picks, or a new one when there is none or they ask. */
-const chooseProject = async ({ google, request, sleep, onStep }) => {
-	const projects = await listProjects(google);
-	const chosen = projects.length > 0 ? await request.chooseProject(projects.map(({ projectId, displayName }) => ({
-		projectId,
-		...displayName ? { displayName } : {}
-	}))) : void 0;
-	if (chosen !== void 0) return projects.find((project) => project.projectId === chosen) ?? { projectId: chosen };
-	const projectId = newProjectId();
-	onStep(`Creating the Google Cloud project ${projectId}`);
-	try {
-		const operation = await google("Creating the Google Cloud project", "POST", `${RESOURCE_MANAGER_API}/v3/projects`, {
-			projectId,
-			displayName: "Hot Updater Play"
-		});
-		const created = await waitForOperation({
-			request: google,
-			origin: `${RESOURCE_MANAGER_API}/v3`,
-			operation,
-			action: "Creating the Google Cloud project",
-			sleep
-		});
-		return {
-			projectId,
-			...projectNumberOf(created?.name)
-		};
-	} catch (error) {
-		if (!(error instanceof GoogleApiError)) throw error;
-		if (error.status === 429 || error.apiStatus === "RESOURCE_EXHAUSTED" || /quota/iu.test(error.apiMessage)) throw new PlayServiceAccountError("project-quota", `Google Cloud has no project quota left for this account: ${error.apiMessage || "quota exceeded"}. Delete a project you no longer use (https://console.cloud.google.com/cloud-resource-manager), or run this again and pick an existing project.`, { cause: error });
-		if (/terms of service/iu.test(error.apiMessage)) throw new PlayServiceAccountError("project-create-denied", "This Google Account has not accepted the Google Cloud Terms of Service. Open https://console.cloud.google.com once to accept them, then run this again.", { cause: error });
-		if (isDenied(error) || error.apiStatus === "FAILED_PRECONDITION") throw new PlayServiceAccountError("project-create-denied", `This Google Account may not create Google Cloud projects: ${error.apiMessage || "permission denied"}. Ask your organization's admin for the Project Creator role, or run this again and pick an existing project.`, { cause: error });
-		throw error;
-	}
-};
-/** `projectNumber` from a resource name `projects/<number>`. */
-const projectNumberOf = (name) => {
-	const number = name?.match(/^projects\/(\d+)$/u)?.[1];
-	return number === void 0 ? {} : { projectNumber: number };
-};
-/**
-* Runs `run` again while Google is still enabling an API in `project`,
-* or, with `notFound`, still creating what it reads.
-*/
-const whilePropagating = async ({ run, project, sleep, notFound = false }) => {
-	for (let attempt = 1;; attempt++) try {
-		return await run();
-	} catch (error) {
-		const disabled = isServiceDisabled(error);
-		if (disabled && !consumerIs(error, project)) throw clientApiDisabled(error);
-		if (!disabled && !(notFound && isNotFound(error)) || attempt >= PROPAGATION_ATTEMPTS) {
-			if (disabled) throw new PlayServiceAccountError("api-not-enabled", `Google is still enabling the APIs in ${project.projectId}: ${error.apiMessage} Wait a few minutes, then run this again.`, { cause: error });
-			throw error;
-		}
-		await sleep(PROPAGATION_DELAY_MS);
-	}
-};
-/**
-* Whether a disabled-service error is about `project` itself, which waiting
-* fixes: Google names the consumer by number, and an error naming none
-* counts as the project's own.
-*/
-const consumerIs = (error, project) => error.consumer === void 0 || error.consumer === `projects/${project.projectId}` || (project.projectNumber === void 0 ? true : error.consumer === `projects/${project.projectNumber}`);
-const enableServices = async ({ google, projectId, sleep }) => {
-	try {
-		const operation = await google("Enabling the APIs", "POST", `${SERVICE_USAGE_API}/v1/projects/${projectId}/services:batchEnable`, { serviceIds: SERVICES });
-		await waitForOperation({
-			request: google,
-			origin: `${SERVICE_USAGE_API}/v1`,
-			operation,
-			action: "Enabling the APIs",
-			sleep
-		});
-	} catch (error) {
-		if (isDenied(error) && !isServiceDisabled(error)) throw new PlayServiceAccountError("project-access-denied", `This Google Account may not enable APIs in ${projectId}: ${error.apiMessage || "permission denied"}. Pick a project you own, or ask its owner for the Editor role.`, { cause: error });
-		throw error;
-	}
-};
-/** The `hot-updater-play` service account's email, created unless it exists. */
-const ensureServiceAccount = async ({ google, project, sleep }) => {
-	const { projectId } = project;
-	const email = `${PLAY_SERVICE_ACCOUNT_ID}@${projectId}.iam.gserviceaccount.com`;
-	try {
-		return (await whilePropagating({
-			project,
-			sleep,
-			run: () => google("Creating the service account", "POST", `${IAM_API}/projects/${projectId}/serviceAccounts`, {
-				accountId: "hot-updater-play",
-				serviceAccount: {
-					displayName: "Hot Updater Play uploads",
-					description: "Uploads Android App Bundles to Google Play for hot-updater native-build android --submit play-internal."
-				}
-			})
-		})).email ?? email;
-	} catch (error) {
-		if (isConflict(error)) return email;
-		if (isDenied(error) && !isServiceDisabled(error)) throw new PlayServiceAccountError("project-access-denied", `This Google Account may not create service accounts in ${projectId}: ${error.apiMessage || "permission denied"}. Pick a project you own, or ask its owner for the Service Account Admin role.`, { cause: error });
-		throw error;
-	}
-};
-/**
-* Makes `email` a Play Console user that may release `packageName`, keeping
-* any permission it has: the user and the app's grant are created, or the
-* grant gains the release permissions.
-*/
-const grantPlayAccess = async ({ google, developerId, email, packageName }) => {
-	const developer = `${PUBLISHER_API}/developers/${developerId}`;
-	const user = `${developer}/users/${encodeURIComponent(email)}`;
-	try {
-		await google("Adding the Play Console user", "POST", `${developer}/users`, {
-			name: `developers/${developerId}/users/${email}`,
-			email
-		});
-	} catch (error) {
-		if (isDenied(error)) throw notPlayAdmin(developerId, error);
-		if (!isConflict(error)) throw error;
-	}
-	try {
-		await google("Granting access to the app", "POST", `${user}/grants`, {
-			name: `developers/${developerId}/users/${email}/grants/${packageName}`,
-			packageName,
-			appLevelPermissions: APP_PERMISSIONS
-		});
-		return;
-	} catch (error) {
-		if (isNotFound(error)) throw appNotFound(packageName, developerId, error);
-		if (isDenied(error)) throw notPlayAdmin(developerId, error);
-		if (!isConflict(error)) throw error;
-	}
-	const granted = await findGrant({
-		google,
-		developer,
-		email,
-		packageName
-	});
-	const missing = APP_PERMISSIONS.filter((permission) => !granted.includes(permission));
-	if (missing.length === 0) return;
-	await google("Granting access to the app", "PATCH", `${user}/grants/${encodeURIComponent(packageName)}?updateMask=appLevelPermissions`, { appLevelPermissions: [...granted, ...missing] });
-};
-/** The app permissions `email` holds on `packageName`, from the user list. */
-const findGrant = async ({ google, developer, email, packageName }) => {
-	let pageToken;
-	do {
-		const page = await google("Listing the Play Console users", "GET", `${developer}/users?${new URLSearchParams({
-			pageSize: "100",
-			...pageToken ? { pageToken } : {}
-		})}`);
-		const found = page.users?.find((candidate) => candidate.email === email);
-		if (found) return found.grants?.find((grant) => grant.packageName === packageName)?.appLevelPermissions ?? [];
-		pageToken = page.nextPageToken || void 0;
-	} while (pageToken);
-	return [];
-};
-/** A new JSON key of the service account, checked and masked in the CLI's output. */
-const createKey = async ({ google, project, email, sleep }) => {
-	const { projectId } = project;
-	let key;
-	try {
-		key = await whilePropagating({
-			project,
-			sleep,
-			notFound: true,
-			run: () => google("Creating the key", "POST", `${IAM_API}/projects/${projectId}/serviceAccounts/${email}/keys`, {
-				privateKeyType: "TYPE_GOOGLE_CREDENTIALS_FILE",
-				keyAlgorithm: "KEY_ALG_RSA_2048"
-			})
-		});
-	} catch (error) {
-		if (error instanceof GoogleApiError && (error.violations.includes(KEY_CREATION_CONSTRAINT) || /disableServiceAccountKeyCreation/u.test(error.apiMessage))) throw new PlayServiceAccountError("key-creation-disabled", `An organization policy (iam.disableServiceAccountKeyCreation) forbids service account keys in ${projectId}; organizations created since 2024 enforce it by default. Ask an organization policy admin to allow keys for this project, or run this again with a project outside the organization. The service account ${email} and its Play Console access remain for the next run.`, { cause: error });
-		throw error;
-	}
-	if (!key.name || !key.privateKeyData) throw new Error("Google Cloud created the key without its JSON file.");
-	(0, _hot_updater_cli_tools.registerSecretValue)(key.privateKeyData);
-	const json = Buffer.from(key.privateKeyData, "base64").toString("utf-8");
-	(0, _hot_updater_cli_tools.registerSecretValue)(json);
-	let parsed;
-	try {
-		parsed = JSON.parse(json);
-	} catch {
-		parsed = {};
-	}
-	if (typeof parsed.private_key !== "string") {
-		await google("Deleting the key", "DELETE", `${IAM_API}/${key.name}`).catch(() => {});
-		throw new Error("Google Cloud created a key that is no JSON key file.");
-	}
-	(0, _hot_updater_cli_tools.registerSecretValue)(parsed.private_key);
-	return {
-		json,
-		name: key.name,
-		keyId: key.name.split("/").pop()
-	};
-};
-//#endregion
-//#region src/playServiceAccount.ts
-/**
-* Hot Updater's Google OAuth client, a "Desktop app" client the sign-in
-* opens Google's consent screen for. Empty in a build that has none, where
-* `HOT_UPDATER_GOOGLE_OAUTH_CLIENT_ID` and `_SECRET` name one.
-*/
-const HOT_UPDATER_GOOGLE_OAUTH_CLIENT = {
-	clientId: "",
-	clientSecret: ""
-};
-/**
-* Hot Updater's issuer, the one place that picks how it is done: Google's
-* OAuth for installed apps, then the Cloud Resource Manager, Service Usage,
-* IAM, and Play Developer APIs. Another implementation of
-* `IssuePlayServiceAccount` replaces it here without touching its callers.
-*/
-const issuePlayServiceAccount = (request) => createGoogleKeyIssuer()({
-	...request,
-	oauthClient: request.oauthClient ?? HOT_UPDATER_GOOGLE_OAUTH_CLIENT
-});
-//#endregion
-exports.GOOGLE_OAUTH_CLIENT_ENV_NAMES = GOOGLE_OAUTH_CLIENT_ENV_NAMES;
-exports.HOT_UPDATER_GOOGLE_OAUTH_CLIENT = HOT_UPDATER_GOOGLE_OAUTH_CLIENT;
-exports.PLAY_CONSOLE_URL = PLAY_CONSOLE_URL;
-exports.PLAY_SERVICE_ACCOUNT_ID = PLAY_SERVICE_ACCOUNT_ID;
-exports.PlayServiceAccountError = PlayServiceAccountError;
 exports.PlayVersionCodeUsedError = PlayVersionCodeUsedError;
 exports.assertPlaySigned = assertPlaySigned;
 exports.buildAndroid = buildAndroid;
+exports.checkPlayAccess = checkPlayAccess;
 exports.enrichNativeBuildAndroidScheme = enrichNativeBuildAndroidScheme;
 exports.extractBuiltInBundle = extractBuiltInBundle;
 exports.findPlayInternalRelease = findPlayInternalRelease;
-exports.issuePlayServiceAccount = issuePlayServiceAccount;
+exports.playConsoleInviteUrl = playConsoleInviteUrl;
 exports.readBuiltApp = readBuiltApp;
 exports.readBuiltPackageName = readBuiltPackageName;
 exports.readBuiltVersionCode = readBuiltVersionCode;