@hot-updater/android-helper 1.2.0-rc.7 → 1.2.0-rc.8

package/dist/index.d.cts

@@ -13,15 +13,19 @@ declare const enrichNativeBuildAndroidScheme: ({ schemeConfig, hotUpdaterSchemeN
 }) => Promise<EnrichedNativeBuildAndroidScheme>;
 //#endregion
 //#region src/buildAndroid.d.ts
-declare const buildAndroid: ({ schemeConfig, minBundleId, credentials }: {
+declare const buildAndroid: ({ schemeConfig, minBundleId, credentials, logHeader }: {
   schemeConfig: EnrichedNativeBuildAndroidScheme;
   /** The MIN_BUNDLE_ID the build compiles in. */
   minBundleId?: string;
   /** Resolves the scheme's `signing` keystore, when it signs with one. */
   credentials?: Pick<CredentialResolver, "resolve">;
+  /** Lines the build log starts with, such as the native build key. */
+  logHeader?: string[];
 }) => Promise<{
   buildDirectory: string;
   buildArtifactPath: string;
+  /** The build log, or null without one. */
+  logFilePath: string | null;
   /** What the built artifact reports, or undefined without aapt2. */
   builtApp?: {
     appVersion: string | null;
@@ -42,6 +46,44 @@ declare class PlayVersionCodeUsedError extends Error {
   readonly name = "PlayVersionCodeUsedError";
   constructor(options?: ErrorOptions);
 }
+/**
+ * Play Console's page that invites `email` as a user. `_` stands for the
+ * developer account the browser is signed in to, so no ID is needed.
+ */
+declare const playConsoleInviteUrl: (email: string) => string;
+/**
+ * Whether a service account reaches an app in Google Play:
+ * - `ready`: it opened an edit of the app;
+ * - `denied`: Google Play refused it (401/403), so it needs a Play Console
+ *   invite;
+ * - `not-found`: Google Play has no such app it can see (404), as before
+ *   the app's first `.aab` is uploaded in Play Console;
+ * - `refused`: Google's token endpoint refused the key itself, such as a
+ *   deleted key, with Google's reason.
+ */
+type PlayAccess = {
+  readonly status: "ready";
+} | {
+  readonly status: "denied";
+  readonly email: string;
+} | {
+  readonly status: "not-found";
+  readonly email: string;
+} | {
+  readonly status: "refused";
+  readonly email: string;
+  readonly reason: string;
+};
+/**
+ * Checks once whether the service account's key reaches `packageName`: it
+ * opens an edit of the app and deletes it again, which changes nothing.
+ * Throws only for what says nothing about access, such as a network error.
+ */
+declare const checkPlayAccess: ({ serviceAccount: { json }, packageName, fetch }: {
+  serviceAccount: Credentials["play-service-account"];
+  packageName: string;
+  fetch?: typeof globalThis.fetch;
+}) => Promise<PlayAccess>;
 /**
  * Whether Google Play's internal testing track already releases the
  * `.aab`'s version code, as when a reused native build was uploaded
@@ -54,16 +96,6 @@ declare const findPlayInternalRelease: ({ versionCode, packageName, serviceAccou
   serviceAccount: Credentials["play-service-account"];
   fetch?: typeof globalThis.fetch;
 }) => Promise<boolean>;
-/**
- * Whether Google Play releases any version of `packageName` on any track,
- * which means Play has the app's upload key. It reads the tracks in an edit
- * it then deletes, changing nothing.
- */
-declare const hasPlayReleases: ({ packageName, serviceAccount: { json }, fetch }: {
-  packageName: string;
-  serviceAccount: Credentials["play-service-account"];
-  fetch?: typeof globalThis.fetch;
-}) => Promise<boolean>;
 /**
  * Throws when the `.aab` is signed with the Android debug keystore, which
  * Google Play refuses: a release build type left on `signingConfigs.debug`,
@@ -153,106 +185,4 @@ declare const readBuiltVersionCode: ({ artifactPath, androidProjectPath }: {
   androidProjectPath: string;
 }) => Promise<number | undefined>;
 //#endregion
-//#region src/google/types.d.ts
-/** What stopped Hot Updater from issuing the Play service account key. */
-type PlayServiceAccountErrorCode =
-/** The gcloud CLI, which signs in to Google, is not installed. */
-"gcloud-not-installed" |
-/** gcloud ended with no Google Account to use: none signed in, or the sign-in was cancelled. */
-"gcloud-not-signed-in" |
-/** The Google Account may not create a Google Cloud project. */
-"project-create-denied" |
-/** The Google Account has no Google Cloud project quota left. */
-"project-quota" |
-/** The Google Account may not enable APIs or create service accounts in the project. */
-"project-access-denied" |
-/** Google is still enabling an API, or it is disabled in another project. */
-"api-not-enabled" |
-/** An organization policy (`iam.disableServiceAccountKeyCreation`) forbids keys. */
-"key-creation-disabled" |
-/** The key never reached the app: the Play Console invite, or the app's first upload, is missing. */
-"play-access-pending";
-/** A named failure of `issuePlayServiceAccount`, with what to do in its message. */
-declare class PlayServiceAccountError extends Error {
-  readonly code: PlayServiceAccountErrorCode;
-  constructor(code: PlayServiceAccountErrorCode, message: string, options?: {
-    cause?: unknown;
-  });
-}
-/** The service account Hot Updater creates, `hot-updater-play@<project>.iam.gserviceaccount.com`. */
-declare const PLAY_SERVICE_ACCOUNT_ID = "hot-updater-play";
-//#endregion
-//#region src/playServiceAccount.d.ts
-/** A Google Cloud project the signed-in account can use. */
-interface GoogleCloudProject {
-  readonly projectId: string;
-  readonly displayName?: string;
-  /** Whether the Google Play Android Developer API is enabled in it. */
-  readonly playApiEnabled: boolean;
-}
-/** A Google Account the gcloud CLI holds credentials for. */
-interface GoogleAccount {
-  readonly email: string;
-  /** Whether it is gcloud's active account. */
-  readonly active: boolean;
-}
-interface IssuePlayServiceAccountRequest {
-  /**
-   * Asks for the app's package name in Google Play, which the service
-   * account may release: after the sign-in's own tool is found, before
-   * anything else.
-   */
-  readonly askPackageName: () => Promise<string>;
-  /**
-   * Sees the Google Accounts gcloud already holds, the active one first,
-   * after the package name, and returns the one to use, or null to sign in
-   * with another. Never called when gcloud holds none: it signs in.
-   */
-  readonly chooseGoogleAccount: (accounts: readonly GoogleAccount[]) => Promise<string | null>;
-  /**
-   * Sees Play Console's page that invites the service account `email`, to
-   * print it and open it in a browser; the issuer then waits for the invite.
-   */
-  readonly onInvite: (url: string, email: string) => Promise<void> | void;
-  /**
-   * Sees the account's projects when no one of them is the obvious home of
-   * the service account, the only one with the Google Play Developer API,
-   * and returns the project ID to create it in, or null for a new project.
-   * Never called for an account without projects: a new one is created.
-   */
-  readonly chooseProject: (projects: readonly GoogleCloudProject[]) => Promise<string | null>;
-  /** Reports each step, such as "Creating the service account". */
-  readonly onStep?: (message: string) => void;
-}
-/**
- * A Play service account's JSON key, just created, which already reaches
- * the app in Google Play. `revoke` deletes the key with gcloud's sign-in.
- */
-interface IssuedPlayServiceAccount {
-  /** The JSON key file, as Google Cloud downloads it. */
-  readonly json: string;
-  /** The service account's email, the Play Console user it releases as. */
-  readonly email: string;
-  readonly projectId: string;
-  /** The key's ID, as Google Cloud lists it under the service account's keys. */
-  readonly keyId: string;
-  /** Deletes the key with gcloud's sign-in; whether Google Cloud did. */
-  revoke(): Promise<boolean>;
-  /** Releases what the issue held; gcloud keeps its own sign-in. */
-  dispose(): Promise<void>;
-}
-/**
- * Issues a service account key that releases the app to Google Play, with
- * the gcloud CLI's Google sign-in: the caller never sees the password, and
- * the developer invites the service account in Play Console once.
- */
-type IssuePlayServiceAccount = (request: IssuePlayServiceAccountRequest) => Promise<IssuedPlayServiceAccount>;
-/**
- * Hot Updater's issuer, the one place that picks how it is done: gcloud's
- * sign-in, then the Cloud Resource Manager, Service Usage, IAM, and Play
- * Developer APIs. Another implementation of `IssuePlayServiceAccount`
- * replaces it here without touching its callers.
- */
-declare const issuePlayServiceAccount: IssuePlayServiceAccount;
-//#endregion
-export { type EnrichedNativeBuildAndroidScheme, type GoogleAccount, type GoogleCloudProject, type IssuePlayServiceAccount, type IssuePlayServiceAccountRequest, type IssuedPlayServiceAccount, PLAY_SERVICE_ACCOUNT_ID, PlayServiceAccountError, type PlayServiceAccountErrorCode, PlayVersionCodeUsedError, type UploadToPlayResult, assertPlaySigned, buildAndroid, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, hasPlayReleases, issuePlayServiceAccount, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };
+export { type EnrichedNativeBuildAndroidScheme, type PlayAccess, PlayVersionCodeUsedError, type UploadToPlayResult, assertPlaySigned, buildAndroid, checkPlayAccess, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, playConsoleInviteUrl, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };

package/dist/index.d.mts

@@ -14,15 +14,19 @@ declare const enrichNativeBuildAndroidScheme: ({ schemeConfig, hotUpdaterSchemeN
 }) => Promise<EnrichedNativeBuildAndroidScheme>;
 //#endregion
 //#region src/buildAndroid.d.ts
-declare const buildAndroid: ({ schemeConfig, minBundleId, credentials }: {
+declare const buildAndroid: ({ schemeConfig, minBundleId, credentials, logHeader }: {
   schemeConfig: EnrichedNativeBuildAndroidScheme;
   /** The MIN_BUNDLE_ID the build compiles in. */
   minBundleId?: string;
   /** Resolves the scheme's `signing` keystore, when it signs with one. */
   credentials?: Pick<CredentialResolver, "resolve">;
+  /** Lines the build log starts with, such as the native build key. */
+  logHeader?: string[];
 }) => Promise<{
   buildDirectory: string;
   buildArtifactPath: string;
+  /** The build log, or null without one. */
+  logFilePath: string | null;
   /** What the built artifact reports, or undefined without aapt2. */
   builtApp?: {
     appVersion: string | null;
@@ -43,6 +47,44 @@ declare class PlayVersionCodeUsedError extends Error {
   readonly name = "PlayVersionCodeUsedError";
   constructor(options?: ErrorOptions);
 }
+/**
+ * Play Console's page that invites `email` as a user. `_` stands for the
+ * developer account the browser is signed in to, so no ID is needed.
+ */
+declare const playConsoleInviteUrl: (email: string) => string;
+/**
+ * Whether a service account reaches an app in Google Play:
+ * - `ready`: it opened an edit of the app;
+ * - `denied`: Google Play refused it (401/403), so it needs a Play Console
+ *   invite;
+ * - `not-found`: Google Play has no such app it can see (404), as before
+ *   the app's first `.aab` is uploaded in Play Console;
+ * - `refused`: Google's token endpoint refused the key itself, such as a
+ *   deleted key, with Google's reason.
+ */
+type PlayAccess = {
+  readonly status: "ready";
+} | {
+  readonly status: "denied";
+  readonly email: string;
+} | {
+  readonly status: "not-found";
+  readonly email: string;
+} | {
+  readonly status: "refused";
+  readonly email: string;
+  readonly reason: string;
+};
+/**
+ * Checks once whether the service account's key reaches `packageName`: it
+ * opens an edit of the app and deletes it again, which changes nothing.
+ * Throws only for what says nothing about access, such as a network error.
+ */
+declare const checkPlayAccess: ({ serviceAccount: { json }, packageName, fetch }: {
+  serviceAccount: Credentials["play-service-account"];
+  packageName: string;
+  fetch?: typeof globalThis.fetch;
+}) => Promise<PlayAccess>;
 /**
  * Whether Google Play's internal testing track already releases the
  * `.aab`'s version code, as when a reused native build was uploaded
@@ -55,16 +97,6 @@ declare const findPlayInternalRelease: ({ versionCode, packageName, serviceAccou
   serviceAccount: Credentials["play-service-account"];
   fetch?: typeof globalThis.fetch;
 }) => Promise<boolean>;
-/**
- * Whether Google Play releases any version of `packageName` on any track,
- * which means Play has the app's upload key. It reads the tracks in an edit
- * it then deletes, changing nothing.
- */
-declare const hasPlayReleases: ({ packageName, serviceAccount: { json }, fetch }: {
-  packageName: string;
-  serviceAccount: Credentials["play-service-account"];
-  fetch?: typeof globalThis.fetch;
-}) => Promise<boolean>;
 /**
  * Throws when the `.aab` is signed with the Android debug keystore, which
  * Google Play refuses: a release build type left on `signingConfigs.debug`,
@@ -154,106 +186,4 @@ declare const readBuiltVersionCode: ({ artifactPath, androidProjectPath }: {
   androidProjectPath: string;
 }) => Promise<number | undefined>;
 //#endregion
-//#region src/google/types.d.ts
-/** What stopped Hot Updater from issuing the Play service account key. */
-type PlayServiceAccountErrorCode =
-/** The gcloud CLI, which signs in to Google, is not installed. */
-"gcloud-not-installed" |
-/** gcloud ended with no Google Account to use: none signed in, or the sign-in was cancelled. */
-"gcloud-not-signed-in" |
-/** The Google Account may not create a Google Cloud project. */
-"project-create-denied" |
-/** The Google Account has no Google Cloud project quota left. */
-"project-quota" |
-/** The Google Account may not enable APIs or create service accounts in the project. */
-"project-access-denied" |
-/** Google is still enabling an API, or it is disabled in another project. */
-"api-not-enabled" |
-/** An organization policy (`iam.disableServiceAccountKeyCreation`) forbids keys. */
-"key-creation-disabled" |
-/** The key never reached the app: the Play Console invite, or the app's first upload, is missing. */
-"play-access-pending";
-/** A named failure of `issuePlayServiceAccount`, with what to do in its message. */
-declare class PlayServiceAccountError extends Error {
-  readonly code: PlayServiceAccountErrorCode;
-  constructor(code: PlayServiceAccountErrorCode, message: string, options?: {
-    cause?: unknown;
-  });
-}
-/** The service account Hot Updater creates, `hot-updater-play@<project>.iam.gserviceaccount.com`. */
-declare const PLAY_SERVICE_ACCOUNT_ID = "hot-updater-play";
-//#endregion
-//#region src/playServiceAccount.d.ts
-/** A Google Cloud project the signed-in account can use. */
-interface GoogleCloudProject {
-  readonly projectId: string;
-  readonly displayName?: string;
-  /** Whether the Google Play Android Developer API is enabled in it. */
-  readonly playApiEnabled: boolean;
-}
-/** A Google Account the gcloud CLI holds credentials for. */
-interface GoogleAccount {
-  readonly email: string;
-  /** Whether it is gcloud's active account. */
-  readonly active: boolean;
-}
-interface IssuePlayServiceAccountRequest {
-  /**
-   * Asks for the app's package name in Google Play, which the service
-   * account may release: after the sign-in's own tool is found, before
-   * anything else.
-   */
-  readonly askPackageName: () => Promise<string>;
-  /**
-   * Sees the Google Accounts gcloud already holds, the active one first,
-   * after the package name, and returns the one to use, or null to sign in
-   * with another. Never called when gcloud holds none: it signs in.
-   */
-  readonly chooseGoogleAccount: (accounts: readonly GoogleAccount[]) => Promise<string | null>;
-  /**
-   * Sees Play Console's page that invites the service account `email`, to
-   * print it and open it in a browser; the issuer then waits for the invite.
-   */
-  readonly onInvite: (url: string, email: string) => Promise<void> | void;
-  /**
-   * Sees the account's projects when no one of them is the obvious home of
-   * the service account, the only one with the Google Play Developer API,
-   * and returns the project ID to create it in, or null for a new project.
-   * Never called for an account without projects: a new one is created.
-   */
-  readonly chooseProject: (projects: readonly GoogleCloudProject[]) => Promise<string | null>;
-  /** Reports each step, such as "Creating the service account". */
-  readonly onStep?: (message: string) => void;
-}
-/**
- * A Play service account's JSON key, just created, which already reaches
- * the app in Google Play. `revoke` deletes the key with gcloud's sign-in.
- */
-interface IssuedPlayServiceAccount {
-  /** The JSON key file, as Google Cloud downloads it. */
-  readonly json: string;
-  /** The service account's email, the Play Console user it releases as. */
-  readonly email: string;
-  readonly projectId: string;
-  /** The key's ID, as Google Cloud lists it under the service account's keys. */
-  readonly keyId: string;
-  /** Deletes the key with gcloud's sign-in; whether Google Cloud did. */
-  revoke(): Promise<boolean>;
-  /** Releases what the issue held; gcloud keeps its own sign-in. */
-  dispose(): Promise<void>;
-}
-/**
- * Issues a service account key that releases the app to Google Play, with
- * the gcloud CLI's Google sign-in: the caller never sees the password, and
- * the developer invites the service account in Play Console once.
- */
-type IssuePlayServiceAccount = (request: IssuePlayServiceAccountRequest) => Promise<IssuedPlayServiceAccount>;
-/**
- * Hot Updater's issuer, the one place that picks how it is done: gcloud's
- * sign-in, then the Cloud Resource Manager, Service Usage, IAM, and Play
- * Developer APIs. Another implementation of `IssuePlayServiceAccount`
- * replaces it here without touching its callers.
- */
-declare const issuePlayServiceAccount: IssuePlayServiceAccount;
-//#endregion
-export { type EnrichedNativeBuildAndroidScheme, type GoogleAccount, type GoogleCloudProject, type IssuePlayServiceAccount, type IssuePlayServiceAccountRequest, type IssuedPlayServiceAccount, PLAY_SERVICE_ACCOUNT_ID, PlayServiceAccountError, type PlayServiceAccountErrorCode, PlayVersionCodeUsedError, type UploadToPlayResult, assertPlaySigned, buildAndroid, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, hasPlayReleases, issuePlayServiceAccount, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };
+export { type EnrichedNativeBuildAndroidScheme, type PlayAccess, PlayVersionCodeUsedError, type UploadToPlayResult, assertPlaySigned, buildAndroid, checkPlayAccess, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, playConsoleInviteUrl, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };