@hot-updater/android-helper 1.2.0-rc.3 → 1.2.0-rc.5

package/dist/index.d.cts

@@ -54,6 +54,16 @@ declare const findPlayInternalRelease: ({ versionCode, packageName, serviceAccou
   serviceAccount: Credentials["play-service-account"];
   fetch?: typeof globalThis.fetch;
 }) => Promise<boolean>;
+/**
+ * Whether Google Play releases any version of `packageName` on any track,
+ * which means Play has the app's upload key. It reads the tracks in an edit
+ * it then deletes, changing nothing.
+ */
+declare const hasPlayReleases: ({ packageName, serviceAccount: { json }, fetch }: {
+  packageName: string;
+  serviceAccount: Credentials["play-service-account"];
+  fetch?: typeof globalThis.fetch;
+}) => Promise<boolean>;
 /**
  * Throws when the `.aab` is signed with the Android debug keystore, which
  * Google Play refuses: a release build type left on `signingConfigs.debug`,
@@ -146,28 +156,22 @@ declare const readBuiltVersionCode: ({ artifactPath, androidProjectPath }: {
 //#region src/google/types.d.ts
 /** What stopped Hot Updater from issuing the Play service account key. */
 type PlayServiceAccountErrorCode =
-/** No OAuth client to sign in with, or Google refused it. */
-"sign-in-not-configured" |
-/** The browser sign-in was cancelled, refused, or timed out. */
-"sign-in-cancelled" |
-/** The account unticked a scope the setup needs on Google's consent screen. */
-"scope-not-granted" |
-/** The developer account ID names no Play Console account. */
-"developer-not-found" |
-/** The Google Account is no admin of the Play Console developer account. */
-"not-play-admin" |
-/** Google Play has no app with the package name in the developer account. */
-"app-not-found" |
+/** The gcloud CLI, which signs in to Google, is not installed. */
+"gcloud-not-installed" |
+/** `gcloud auth login` ended with no active Google Account. */
+"gcloud-not-signed-in" |
 /** The Google Account may not create a Google Cloud project. */
 "project-create-denied" |
 /** The Google Account has no Google Cloud project quota left. */
 "project-quota" |
 /** The Google Account may not enable APIs or create service accounts in the project. */
 "project-access-denied" |
-/** Google is still enabling an API, or it is disabled in the OAuth client's project. */
+/** Google is still enabling an API, or it is disabled in another project. */
 "api-not-enabled" |
 /** An organization policy (`iam.disableServiceAccountKeyCreation`) forbids keys. */
-"key-creation-disabled";
+"key-creation-disabled" |
+/** The key never reached the app: the Play Console invite, or the app's first upload, is missing. */
+"play-access-pending";
 /** A named failure of `issuePlayServiceAccount`, with what to do in its message. */
 declare class PlayServiceAccountError extends Error {
   readonly code: PlayServiceAccountErrorCode;
@@ -175,31 +179,10 @@ declare class PlayServiceAccountError extends Error {
     cause?: unknown;
   });
 }
-/**
- * A Google OAuth client of type "Desktop app". Google treats an installed
- * app's client secret as public, so it ships with the client ID.
- */
-interface GoogleOAuthClient {
-  readonly clientId: string;
-  readonly clientSecret?: string;
-}
-/** The environment variables that replace Hot Updater's Google OAuth client. */
-declare const GOOGLE_OAUTH_CLIENT_ENV_NAMES: {
-  readonly clientId: "HOT_UPDATER_GOOGLE_OAUTH_CLIENT_ID";
-  readonly clientSecret: "HOT_UPDATER_GOOGLE_OAUTH_CLIENT_SECRET";
-};
 /** The service account Hot Updater creates, `hot-updater-play@<project>.iam.gserviceaccount.com`. */
 declare const PLAY_SERVICE_ACCOUNT_ID = "hot-updater-play";
-/** Where a Play Console admin finds the developer account ID. */
-declare const PLAY_CONSOLE_URL = "https://play.google.com/console";
 //#endregion
 //#region src/playServiceAccount.d.ts
-/**
- * Hot Updater's Google OAuth client, a "Desktop app" client the sign-in
- * opens Google's consent screen for. Empty in a build that has none, where
- * `HOT_UPDATER_GOOGLE_OAUTH_CLIENT_ID` and `_SECRET` name one.
- */
-declare const HOT_UPDATER_GOOGLE_OAUTH_CLIENT: GoogleOAuthClient;
 /** A Google Cloud project the signed-in account can use. */
 interface GoogleCloudProject {
   readonly projectId: string;
@@ -208,24 +191,23 @@ interface GoogleCloudProject {
 interface IssuePlayServiceAccountRequest {
   /** The app's package name in Google Play, which the service account may release. */
   readonly packageName: string;
-  /** The OAuth client to sign in with; Hot Updater's unless set. */
-  readonly oauthClient?: GoogleOAuthClient;
-  /** Sees the sign-in URL, to print it and open it in a browser. */
-  readonly onSignInUrl: (url: string) => Promise<void> | void;
-  /** Asks for the Play Console developer account ID, after the sign-in. */
-  readonly askDeveloperId: () => Promise<string>;
   /**
-   * Sees the account's projects when there are any, and returns the one to
-   * create the service account in, or undefined to create a project.
+   * Sees Play Console's page that invites the service account `email`, to
+   * print it and open it in a browser; the issuer then waits for the invite.
+   */
+  readonly onInvite: (url: string, email: string) => Promise<void> | void;
+  /**
+   * Sees the account's projects when Google refuses to create one for it,
+   * and returns the one to create the service account in, or undefined to
+   * stop with Google's refusal.
    */
   readonly chooseProject: (projects: readonly GoogleCloudProject[]) => Promise<string | undefined>;
   /** Reports each step, such as "Creating the service account". */
   readonly onStep?: (message: string) => void;
 }
 /**
- * A Play service account's JSON key, just created, with the access token
- * of the sign-in it was created in. `revoke` deletes the key while the
- * sign-in lasts, and `dispose` ends the sign-in.
+ * A Play service account's JSON key, just created, which already reaches
+ * the app in Google Play. `revoke` deletes the key with gcloud's sign-in.
  */
 interface IssuedPlayServiceAccount {
   /** The JSON key file, as Google Cloud downloads it. */
@@ -233,27 +215,25 @@ interface IssuedPlayServiceAccount {
   /** The service account's email, the Play Console user it releases as. */
   readonly email: string;
   readonly projectId: string;
-  readonly developerId: string;
   /** The key's ID, as Google Cloud lists it under the service account's keys. */
   readonly keyId: string;
-  /** Deletes the key with the same sign-in; whether Google Cloud did. */
+  /** Deletes the key with gcloud's sign-in; whether Google Cloud did. */
   revoke(): Promise<boolean>;
-  /** Ends the sign-in: Google revokes its access token. */
+  /** Releases what the issue held; gcloud keeps its own sign-in. */
   dispose(): Promise<void>;
 }
 /**
- * Signs in with Google and issues a service account key that releases the
- * app to Google Play: the developer signs in on Google's own consent
- * screen, in a browser, and the caller never sees the password. Nothing of
- * the sign-in outlives `dispose`.
+ * Issues a service account key that releases the app to Google Play, with
+ * the gcloud CLI's Google sign-in: the caller never sees the password, and
+ * the developer invites the service account in Play Console once.
  */
 type IssuePlayServiceAccount = (request: IssuePlayServiceAccountRequest) => Promise<IssuedPlayServiceAccount>;
 /**
- * Hot Updater's issuer, the one place that picks how it is done: Google's
- * OAuth for installed apps, then the Cloud Resource Manager, Service Usage,
- * IAM, and Play Developer APIs. Another implementation of
- * `IssuePlayServiceAccount` replaces it here without touching its callers.
+ * Hot Updater's issuer, the one place that picks how it is done: gcloud's
+ * sign-in, then the Cloud Resource Manager, Service Usage, IAM, and Play
+ * Developer APIs. Another implementation of `IssuePlayServiceAccount`
+ * replaces it here without touching its callers.
  */
 declare const issuePlayServiceAccount: IssuePlayServiceAccount;
 //#endregion
-export { type EnrichedNativeBuildAndroidScheme, GOOGLE_OAUTH_CLIENT_ENV_NAMES, type GoogleCloudProject, type GoogleOAuthClient, HOT_UPDATER_GOOGLE_OAUTH_CLIENT, type IssuePlayServiceAccount, type IssuePlayServiceAccountRequest, type IssuedPlayServiceAccount, PLAY_CONSOLE_URL, PLAY_SERVICE_ACCOUNT_ID, PlayServiceAccountError, type PlayServiceAccountErrorCode, PlayVersionCodeUsedError, type UploadToPlayResult, assertPlaySigned, buildAndroid, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, issuePlayServiceAccount, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };
+export { type EnrichedNativeBuildAndroidScheme, type GoogleCloudProject, type IssuePlayServiceAccount, type IssuePlayServiceAccountRequest, type IssuedPlayServiceAccount, PLAY_SERVICE_ACCOUNT_ID, PlayServiceAccountError, type PlayServiceAccountErrorCode, PlayVersionCodeUsedError, type UploadToPlayResult, assertPlaySigned, buildAndroid, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, hasPlayReleases, issuePlayServiceAccount, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };

package/dist/index.d.mts

@@ -55,6 +55,16 @@ declare const findPlayInternalRelease: ({ versionCode, packageName, serviceAccou
   serviceAccount: Credentials["play-service-account"];
   fetch?: typeof globalThis.fetch;
 }) => Promise<boolean>;
+/**
+ * Whether Google Play releases any version of `packageName` on any track,
+ * which means Play has the app's upload key. It reads the tracks in an edit
+ * it then deletes, changing nothing.
+ */
+declare const hasPlayReleases: ({ packageName, serviceAccount: { json }, fetch }: {
+  packageName: string;
+  serviceAccount: Credentials["play-service-account"];
+  fetch?: typeof globalThis.fetch;
+}) => Promise<boolean>;
 /**
  * Throws when the `.aab` is signed with the Android debug keystore, which
  * Google Play refuses: a release build type left on `signingConfigs.debug`,
@@ -147,28 +157,22 @@ declare const readBuiltVersionCode: ({ artifactPath, androidProjectPath }: {
 //#region src/google/types.d.ts
 /** What stopped Hot Updater from issuing the Play service account key. */
 type PlayServiceAccountErrorCode =
-/** No OAuth client to sign in with, or Google refused it. */
-"sign-in-not-configured" |
-/** The browser sign-in was cancelled, refused, or timed out. */
-"sign-in-cancelled" |
-/** The account unticked a scope the setup needs on Google's consent screen. */
-"scope-not-granted" |
-/** The developer account ID names no Play Console account. */
-"developer-not-found" |
-/** The Google Account is no admin of the Play Console developer account. */
-"not-play-admin" |
-/** Google Play has no app with the package name in the developer account. */
-"app-not-found" |
+/** The gcloud CLI, which signs in to Google, is not installed. */
+"gcloud-not-installed" |
+/** `gcloud auth login` ended with no active Google Account. */
+"gcloud-not-signed-in" |
 /** The Google Account may not create a Google Cloud project. */
 "project-create-denied" |
 /** The Google Account has no Google Cloud project quota left. */
 "project-quota" |
 /** The Google Account may not enable APIs or create service accounts in the project. */
 "project-access-denied" |
-/** Google is still enabling an API, or it is disabled in the OAuth client's project. */
+/** Google is still enabling an API, or it is disabled in another project. */
 "api-not-enabled" |
 /** An organization policy (`iam.disableServiceAccountKeyCreation`) forbids keys. */
-"key-creation-disabled";
+"key-creation-disabled" |
+/** The key never reached the app: the Play Console invite, or the app's first upload, is missing. */
+"play-access-pending";
 /** A named failure of `issuePlayServiceAccount`, with what to do in its message. */
 declare class PlayServiceAccountError extends Error {
   readonly code: PlayServiceAccountErrorCode;
@@ -176,31 +180,10 @@ declare class PlayServiceAccountError extends Error {
     cause?: unknown;
   });
 }
-/**
- * A Google OAuth client of type "Desktop app". Google treats an installed
- * app's client secret as public, so it ships with the client ID.
- */
-interface GoogleOAuthClient {
-  readonly clientId: string;
-  readonly clientSecret?: string;
-}
-/** The environment variables that replace Hot Updater's Google OAuth client. */
-declare const GOOGLE_OAUTH_CLIENT_ENV_NAMES: {
-  readonly clientId: "HOT_UPDATER_GOOGLE_OAUTH_CLIENT_ID";
-  readonly clientSecret: "HOT_UPDATER_GOOGLE_OAUTH_CLIENT_SECRET";
-};
 /** The service account Hot Updater creates, `hot-updater-play@<project>.iam.gserviceaccount.com`. */
 declare const PLAY_SERVICE_ACCOUNT_ID = "hot-updater-play";
-/** Where a Play Console admin finds the developer account ID. */
-declare const PLAY_CONSOLE_URL = "https://play.google.com/console";
 //#endregion
 //#region src/playServiceAccount.d.ts
-/**
- * Hot Updater's Google OAuth client, a "Desktop app" client the sign-in
- * opens Google's consent screen for. Empty in a build that has none, where
- * `HOT_UPDATER_GOOGLE_OAUTH_CLIENT_ID` and `_SECRET` name one.
- */
-declare const HOT_UPDATER_GOOGLE_OAUTH_CLIENT: GoogleOAuthClient;
 /** A Google Cloud project the signed-in account can use. */
 interface GoogleCloudProject {
   readonly projectId: string;
@@ -209,24 +192,23 @@ interface GoogleCloudProject {
 interface IssuePlayServiceAccountRequest {
   /** The app's package name in Google Play, which the service account may release. */
   readonly packageName: string;
-  /** The OAuth client to sign in with; Hot Updater's unless set. */
-  readonly oauthClient?: GoogleOAuthClient;
-  /** Sees the sign-in URL, to print it and open it in a browser. */
-  readonly onSignInUrl: (url: string) => Promise<void> | void;
-  /** Asks for the Play Console developer account ID, after the sign-in. */
-  readonly askDeveloperId: () => Promise<string>;
   /**
-   * Sees the account's projects when there are any, and returns the one to
-   * create the service account in, or undefined to create a project.
+   * Sees Play Console's page that invites the service account `email`, to
+   * print it and open it in a browser; the issuer then waits for the invite.
+   */
+  readonly onInvite: (url: string, email: string) => Promise<void> | void;
+  /**
+   * Sees the account's projects when Google refuses to create one for it,
+   * and returns the one to create the service account in, or undefined to
+   * stop with Google's refusal.
    */
   readonly chooseProject: (projects: readonly GoogleCloudProject[]) => Promise<string | undefined>;
   /** Reports each step, such as "Creating the service account". */
   readonly onStep?: (message: string) => void;
 }
 /**
- * A Play service account's JSON key, just created, with the access token
- * of the sign-in it was created in. `revoke` deletes the key while the
- * sign-in lasts, and `dispose` ends the sign-in.
+ * A Play service account's JSON key, just created, which already reaches
+ * the app in Google Play. `revoke` deletes the key with gcloud's sign-in.
  */
 interface IssuedPlayServiceAccount {
   /** The JSON key file, as Google Cloud downloads it. */
@@ -234,27 +216,25 @@ interface IssuedPlayServiceAccount {
   /** The service account's email, the Play Console user it releases as. */
   readonly email: string;
   readonly projectId: string;
-  readonly developerId: string;
   /** The key's ID, as Google Cloud lists it under the service account's keys. */
   readonly keyId: string;
-  /** Deletes the key with the same sign-in; whether Google Cloud did. */
+  /** Deletes the key with gcloud's sign-in; whether Google Cloud did. */
   revoke(): Promise<boolean>;
-  /** Ends the sign-in: Google revokes its access token. */
+  /** Releases what the issue held; gcloud keeps its own sign-in. */
   dispose(): Promise<void>;
 }
 /**
- * Signs in with Google and issues a service account key that releases the
- * app to Google Play: the developer signs in on Google's own consent
- * screen, in a browser, and the caller never sees the password. Nothing of
- * the sign-in outlives `dispose`.
+ * Issues a service account key that releases the app to Google Play, with
+ * the gcloud CLI's Google sign-in: the caller never sees the password, and
+ * the developer invites the service account in Play Console once.
  */
 type IssuePlayServiceAccount = (request: IssuePlayServiceAccountRequest) => Promise<IssuedPlayServiceAccount>;
 /**
- * Hot Updater's issuer, the one place that picks how it is done: Google's
- * OAuth for installed apps, then the Cloud Resource Manager, Service Usage,
- * IAM, and Play Developer APIs. Another implementation of
- * `IssuePlayServiceAccount` replaces it here without touching its callers.
+ * Hot Updater's issuer, the one place that picks how it is done: gcloud's
+ * sign-in, then the Cloud Resource Manager, Service Usage, IAM, and Play
+ * Developer APIs. Another implementation of `IssuePlayServiceAccount`
+ * replaces it here without touching its callers.
  */
 declare const issuePlayServiceAccount: IssuePlayServiceAccount;
 //#endregion
-export { type EnrichedNativeBuildAndroidScheme, GOOGLE_OAUTH_CLIENT_ENV_NAMES, type GoogleCloudProject, type GoogleOAuthClient, HOT_UPDATER_GOOGLE_OAUTH_CLIENT, type IssuePlayServiceAccount, type IssuePlayServiceAccountRequest, type IssuedPlayServiceAccount, PLAY_CONSOLE_URL, PLAY_SERVICE_ACCOUNT_ID, PlayServiceAccountError, type PlayServiceAccountErrorCode, PlayVersionCodeUsedError, type UploadToPlayResult, assertPlaySigned, buildAndroid, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, issuePlayServiceAccount, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };
+export { type EnrichedNativeBuildAndroidScheme, type GoogleCloudProject, type IssuePlayServiceAccount, type IssuePlayServiceAccountRequest, type IssuedPlayServiceAccount, PLAY_SERVICE_ACCOUNT_ID, PlayServiceAccountError, type PlayServiceAccountErrorCode, PlayVersionCodeUsedError, type UploadToPlayResult, assertPlaySigned, buildAndroid, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, hasPlayReleases, issuePlayServiceAccount, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };