@hot-updater/android-helper 1.2.0-rc.7 → 1.2.0-rc.8

package/dist/index.mjs

@@ -7,118 +7,34 @@ import JSZip from "jszip";
 import crypto from "crypto";
 import { pipeline } from "stream/promises";
 import { createInflateRaw } from "zlib";
-import crypto$1 from "node:crypto";
+//#region src/utils/gradlePhase.ts
+/** `> Task :app:compileReleaseKotlin`, with an outcome such as `UP-TO-DATE`. */
+const TASK = /^> Task (:\S+)/;
+const CONFIGURE = /^> Configure project (:\S*)/;
+/**
+* Reads the phase of a Gradle build from its plain console output: the
+* task it runs, after how many it has run, such as
+* `312 tasks · :app:mergeReleaseResources`.
+*/
+const createGradlePhaseReader = () => {
+	let tasks = 0;
+	return (line) => {
+		const task = TASK.exec(line)?.[1];
+		if (task) {
+			tasks += 1;
+			return `${tasks} task${tasks === 1 ? "" : "s"} · ${task}`;
+		}
+		const project = CONFIGURE.exec(line)?.[1];
+		if (project) return `Configuring ${project}`;
+		if (line.startsWith("Starting a Gradle Daemon")) return "Starting the Gradle daemon";
+		if (line.startsWith("Downloading https://services.gradle.org/")) return "Downloading Gradle";
+	};
+};
+//#endregion
 //#region src/utils/createGradleLogger.ts
 const createGradleLogger = ({ logPrefix }) => new BuildLogger({
 	logPrefix,
-	importantLogPatterns: [
-		"error:",
-		"Error:",
-		"ERROR:",
-		"> Task :",
-		"BUILD FAILED",
-		"BUILD SUCCESSFUL",
-		"FAILURE: Build failed with an exception.",
-		"* What went wrong:",
-		"Execution failed for task",
-		"Could not resolve",
-		"Failed to",
-		"Unable to load script",
-		"Metro encountered an error",
-		"React Native CLI",
-		"Android resource compilation failed",
-		"Duplicate class",
-		"Program type already present",
-		"actionable tasks:",
-		"Deprecated Gradle features were used",
-		":app:configureCMake",
-		":app:buildCMake",
-		":app:compileDebugKotlin",
-		":app:compileReleaseKotlin",
-		":app:compileDebugJavaWithJavac",
-		":app:compileReleaseJavaWithJavac",
-		":app:mergeDebugResources",
-		":app:mergeReleaseResources",
-		":app:processDebugResources",
-		":app:processReleaseResources",
-		":app:packageDebug",
-		":app:packageRelease",
-		":app:assembleDebug",
-		":app:assembleRelease"
-	],
-	progressStages: [
-		[
-			"buildKotlinToolingMetadata",
-			"generateAutolinkingNewArchitectureFiles",
-			"generateAutolinkingPackageList",
-			"generateCodegenSchemaFromJavaScript",
-			"generateCodegenArtifactsFromSchema",
-			"generateReactNativeEntryPoint"
-		],
-		[
-			"createBundleReleaseJsAndAssets",
-			"bundleReleaseJsAndAssets",
-			"bundleDebugJsAndAssets"
-		],
-		[
-			"generateReleaseResValues",
-			"generateDebugResValues",
-			"generateReleaseResources",
-			"generateDebugResources",
-			"mergeReleaseResources",
-			"mergeDebugResources"
-		],
-		[
-			"processReleaseResources",
-			"processDebugResources",
-			"processReleaseManifest",
-			"processDebugManifest",
-			"processDebugMainManifest",
-			"parseReleaseLocalResources",
-			"parseDebugLocalResources"
-		],
-		["compileReleaseKotlin", "compileDebugKotlin"],
-		["compileReleaseJavaWithJavac", "compileDebugJavaWithJavac"],
-		[
-			/configureCMake\w+\[/,
-			/buildCMake\w+\[/,
-			"mergeReleaseJniLibFolders",
-			"mergeDebugJniLibFolders",
-			"mergeReleaseNativeLibs",
-			"mergeDebugNativeLibs"
-		],
-		[
-			"desugarReleaseFileDependencies",
-			"desugarDebugFileDependencies",
-			"dexBuilderRelease",
-			"dexBuilderDebug",
-			"mergeDexRelease",
-			"mergeExtDexRelease",
-			"mergeExtDexDebug",
-			"mergeProjectDexRelease",
-			"mergeProjectDexDebug",
-			"mergeLibDexRelease",
-			"mergeLibDexDebug",
-			"mergeDebugGlobalSynthetics",
-			"mergeReleaseGlobalSynthetics",
-			"transformClassesWithDex"
-		],
-		[
-			"compressReleaseAssets",
-			"compressDebugAssets",
-			"optimizeReleaseResources",
-			"mergeReleaseAssets",
-			"mergeDebugAssets"
-		],
-		[
-			"packageRelease",
-			"packageDebug",
-			"assembleRelease",
-			"assembleDebug"
-		],
-		["bundleRelease", "bundleDebug"],
-		["BUILD SUCCESSFUL", /\d+ actionable tasks:/]
-	],
+	createPhaseReader: createGradlePhaseReader,
 	failureSummary: {
 		lines: [
 			/^e: /,
@@ -175,21 +91,24 @@ const getGradleWrapper = () => process.platform.startsWith("win") ? "gradlew.bat
 /**
 * Run gradle build with specified tasks and arguments
 */
-async function runGradle({ tasks, logPrefix, args, env, androidProjectPath, appModuleName }) {
+async function runGradle({ tasks, logPrefix, args, env, androidProjectPath, appModuleName, logHeader = [] }) {
 	const gradleArgs = getTaskNames(appModuleName, tasks);
 	gradleArgs.push("-x", "lint");
 	if (args.extraParams) gradleArgs.push(...args.extraParams);
-	p.log.info([
-		"Gradle build",
-		`Project     ${path.relative(getCwd(), androidProjectPath) || "."}`,
-		`App module  ${appModuleName}`,
-		`Tasks       ${tasks.join(", ")}`,
-		"Command",
-		formatCommand([path.basename(getGradleWrapper()), ...gradleArgs])
-	].join("\n"));
 	if ("port" in args && args.port != null) gradleArgs.push(`-PreactNativeDevServerPort=${args.port}`);
 	const logger = createGradleLogger({ logPrefix });
-	await logger.start();
+	await logger.start({
+		title: `Building ${tasks.join(", ")}`,
+		header: [
+			...logHeader,
+			`Project     ${path.relative(getCwd(), androidProjectPath) || "."}`,
+			`App module  ${appModuleName}`,
+			`Tasks       ${tasks.join(", ")}`,
+			`$ ${formatCommand([path.basename(getGradleWrapper()), ...gradleArgs])}`,
+			""
+		]
+	});
+	let logFilePath = null;
 	try {
 		const gradle = execa(getGradleWrapper(), gradleArgs, {
 			cwd: androidProjectPath,
@@ -201,11 +120,13 @@ async function runGradle({ tasks, logPrefix, args, env, androidProjectPath, appM
 		const [gradleResult, loggingResult] = await Promise.allSettled([gradle, outputStream ? logger.processStream(outputStream) : void 0]);
 		if (gradleResult.status === "rejected") throw gradleResult.reason;
 		if (loggingResult.status === "rejected") throw loggingResult.reason;
-		logger.stop();
+		logger.stop(`Built ${tasks.join(", ")}`);
+		logFilePath = logger.logFilePath;
 	} catch (e) {
 		logger.writeError(e);
-		logger.stop("Build failed", false);
-		throw new BuildFailedError(`Build failed: ${describeFailure(e)}`, {
+		const reason = describeFailure(e);
+		logger.stop(`Build failed · ${reason.replace(/\.$/, "")}`, false);
+		throw new BuildFailedError(`Build failed: ${reason}`, {
 			logPath: logger.logPath,
 			summary: logger.failureSummary,
 			cause: e
@@ -213,11 +134,14 @@ async function runGradle({ tasks, logPrefix, args, env, androidProjectPath, appM
 	} finally {
 		await logger.close();
 	}
-	return findBuildDirectory({
-		androidProjectPath,
-		moduleName: appModuleName,
-		tasks
-	});
+	return {
+		...await findBuildDirectory({
+			androidProjectPath,
+			moduleName: appModuleName,
+			tasks
+		}),
+		logFilePath
+	};
 }
 /**
 * Find the build output directory and artifact path
@@ -511,7 +435,7 @@ const readBuiltVersionCode = async ({ artifactPath, androidProjectPath }) => {
 };
 //#endregion
 //#region src/buildAndroid.ts
-const buildAndroid = async ({ schemeConfig, minBundleId = createMinBundleId(), credentials }) => {
+const buildAndroid = async ({ schemeConfig, minBundleId = createMinBundleId(), credentials, logHeader }) => {
 	const androidProjectPath = path.join(getCwd(), "android");
 	const result = await runGradle({
 		args: { extraParams: [`-PMIN_BUNDLE_ID=${minBundleId}`] },
@@ -522,7 +446,8 @@ const buildAndroid = async ({ schemeConfig, minBundleId = createMinBundleId(), c
 		appModuleName: schemeConfig.appModuleName,
 		tasks: schemeConfig.aab ? [`bundle${schemeConfig.variant}`] : [`assemble${schemeConfig.variant}`],
 		logPrefix: `android-${schemeConfig.hotUpdaterSchemeName}-build`,
-		androidProjectPath
+		androidProjectPath,
+		logHeader
 	});
 	return {
 		...result,
@@ -645,8 +570,8 @@ const explain = (error, packageName) => {
 /**
 * Requests to the Google Play Developer API for `packageName`, as the
 * service account: each carries an access token, exchanged for a signed
-* assertion and replaced well before it expires. The key issuer checks a
-* new key's access with it too.
+* assertion and replaced well before it expires. `checkPlayAccess`
+* checks a key's access with it too.
 */
 const createPlayClient = ({ json, packageName, fetch }) => {
 	const account = readServiceAccount(json);
@@ -695,6 +620,66 @@ const createPlayClient = ({ json, packageName, fetch }) => {
 	};
 };
 /**
+* Play Console's page that invites `email` as a user. `_` stands for the
+* developer account the browser is signed in to, so no ID is needed.
+*/
+const playConsoleInviteUrl = (email) => `https://play.google.com/console/u/0/developers/_/users-and-permissions?invite=${encodeURIComponent(email)}`;
+const readClientEmail = (json) => {
+	try {
+		const { client_email } = JSON.parse(json);
+		return typeof client_email === "string" ? client_email : "";
+	} catch {
+		return "";
+	}
+};
+/**
+* Checks once whether the service account's key reaches `packageName`: it
+* opens an edit of the app and deletes it again, which changes nothing.
+* Throws only for what says nothing about access, such as a network error.
+*/
+const checkPlayAccess = async ({ serviceAccount: { json }, packageName, fetch = globalThis.fetch }) => {
+	const email = readClientEmail(json);
+	const refused = (error) => ({
+		status: "refused",
+		email,
+		reason: error instanceof Error ? error.message : String(error)
+	});
+	let play;
+	try {
+		play = createPlayClient({
+			json,
+			packageName,
+			fetch
+		});
+	} catch (error) {
+		return refused(error);
+	}
+	try {
+		await play.authorization();
+	} catch (error) {
+		if (error instanceof TypeError) throw error;
+		return refused(error);
+	}
+	const edits = `${API_URL}${play.app}/edits`;
+	try {
+		const edit = await play.request(`Opening an edit of ${packageName}`, "POST", edits, {});
+		if (edit?.id) await play.request("Deleting the edit", "DELETE", `${edits}/${encodeURIComponent(edit.id)}`).catch(() => {});
+		return { status: "ready" };
+	} catch (error) {
+		if (error instanceof GooglePlayError) {
+			if (error.status === 401 || error.status === 403) return {
+				status: "denied",
+				email
+			};
+			if (error.status === 404) return {
+				status: "not-found",
+				email
+			};
+		}
+		throw error;
+	}
+};
+/**
 * Whether Google Play's internal testing track already releases the
 * `.aab`'s version code, as when a reused native build was uploaded
 * before. It reads the track in an edit it then deletes, changing nothing.
@@ -722,26 +707,6 @@ const findPlayInternalRelease = async ({ versionCode, packageName, serviceAccoun
 	}
 };
 /**
-* Whether Google Play releases any version of `packageName` on any track,
-* which means Play has the app's upload key. It reads the tracks in an edit
-* it then deletes, changing nothing.
-*/
-const hasPlayReleases = async ({ packageName, serviceAccount: { json }, fetch = globalThis.fetch }) => {
-	const { app, request } = createPlayClient({
-		json,
-		packageName,
-		fetch
-	});
-	const { id: editId } = await request("Opening a Google Play edit", "POST", `${API_URL}${app}/edits`, {});
-	const edit = `${API_URL}${app}/edits/${encodeURIComponent(editId)}`;
-	try {
-		const { tracks = [] } = await request("Reading the tracks", "GET", `${edit}/tracks`);
-		return tracks.some(({ releases = [] }) => releases.some(({ versionCodes = [] }) => versionCodes.length > 0));
-	} finally {
-		await request("Deleting the Google Play edit", "DELETE", edit).catch(() => void 0);
-	}
-};
-/**
 * The common name of every Android debug certificate: Android Studio's and
 * the Android Gradle plugin's (`CN=Android Debug, O=Android, C=US`), and React
 * Native's template `debug.keystore` (`CN=Android Debug, OU=Android,
@@ -1084,542 +1049,4 @@ const extractBuiltInBundle = async ({ artifactPath, outputPath }) => {
 	await (entry.method === 8 ? pipeline(source, createInflateRaw(), fs.createWriteStream(outputPath)) : pipeline(source, fs.createWriteStream(outputPath)));
 };
 //#endregion
-//#region src/google/googleApi.ts
-/** A Google Cloud or Google Play API request that failed, with Google's error. */
-var GoogleApiError = class extends Error {
-	status;
-	/** Google's canonical status, such as `PERMISSION_DENIED`. */
-	apiStatus;
-	apiMessage;
-	/** The `ErrorInfo` reasons, such as `SERVICE_DISABLED`. */
-	reasons;
-	/** The `PreconditionFailure` violation types, such as an org policy constraint. */
-	violations;
-	/** The `ErrorInfo` consumer of a disabled service, such as `projects/123`. */
-	consumer;
-	constructor(action, status, body = {}) {
-		const apiMessage = body.apiMessage ?? "";
-		super(`${action} failed (HTTP ${status})${apiMessage ? `: ${apiMessage}` : "."}`);
-		this.name = "GoogleApiError";
-		this.status = status;
-		this.apiStatus = body.apiStatus;
-		this.apiMessage = apiMessage;
-		this.reasons = body.reasons ?? [];
-		this.violations = body.violations ?? [];
-		this.consumer = body.consumer;
-	}
-};
-/** Google's error body, `{ error: { code, status, message, details } }`. */
-const readError = async (action, response) => {
-	let error;
-	try {
-		error = (await response.json()).error;
-	} catch {}
-	const details = Array.isArray(error?.details) ? error.details : [];
-	const info = details.filter((detail) => typeof detail.reason === "string");
-	return new GoogleApiError(action, response.status, {
-		...typeof error?.status === "string" ? { apiStatus: error.status } : {},
-		...typeof error?.message === "string" ? { apiMessage: error.message } : {},
-		reasons: info.map((detail) => detail.reason),
-		violations: details.flatMap((detail) => (detail.violations ?? []).flatMap((violation) => typeof violation.type === "string" ? [violation.type] : [])),
-		...info.find((detail) => detail.metadata?.["consumer"]) ? { consumer: info.find((detail) => detail.metadata?.["consumer"]).metadata["consumer"] } : {}
-	});
-};
-/** Whether Google answered that a service is disabled in a project. */
-const isServiceDisabled = (error) => error instanceof GoogleApiError && (error.reasons.includes("SERVICE_DISABLED") || /has not been used in project .* or it is disabled/i.test(error.apiMessage));
-/** Requests with the signed-in user's access token, throwing `GoogleApiError`. */
-const createGoogleRequest = ({ accessToken, fetch }) => async (action, method, url, body) => {
-	const response = await fetch(url, {
-		method,
-		headers: {
-			authorization: `Bearer ${accessToken}`,
-			...body === void 0 ? {} : { "content-type": "application/json" }
-		},
-		...body === void 0 ? {} : { body: JSON.stringify(body) }
-	});
-	if (!response.ok) throw await readError(action, response);
-	const text = await response.text();
-	return text ? JSON.parse(text) : {};
-};
-/**
-* Polls `operation` at `origin` until it is done, returning its response or
-* throwing its error as a `GoogleApiError` with the operation's code.
-*/
-const waitForOperation = async ({ request, origin, operation, action, sleep, intervalMs = 2e3, attempts = 60 }) => {
-	let current = operation;
-	for (let attempt = 0; !current.done; attempt++) {
-		if (attempt >= attempts || !current.name) throw new Error(`${action} did not finish in time.`);
-		await sleep(intervalMs);
-		current = await request(action, "GET", `${origin}/${current.name}`);
-	}
-	if (current.error) throw new GoogleApiError(action, 400, {
-		apiMessage: current.error.message ?? "",
-		...current.error.code === 7 ? { apiStatus: "PERMISSION_DENIED" } : {},
-		...current.error.code === 8 ? { apiStatus: "RESOURCE_EXHAUSTED" } : {}
-	});
-	return current.response;
-};
-//#endregion
-//#region src/google/types.ts
-/** A named failure of `issuePlayServiceAccount`, with what to do in its message. */
-var PlayServiceAccountError = class extends Error {
-	code;
-	constructor(code, message, options) {
-		super(message, options);
-		this.name = "PlayServiceAccountError";
-		this.code = code;
-	}
-};
-/** The service account Hot Updater creates, `hot-updater-play@<project>.iam.gserviceaccount.com`. */
-const PLAY_SERVICE_ACCOUNT_ID = "hot-updater-play";
-//#endregion
-//#region src/google/googleKeyIssuer.ts
-const PUBLISHER_API = "https://androidpublisher.googleapis.com/androidpublisher/v3";
-const RESOURCE_MANAGER_API = "https://cloudresourcemanager.googleapis.com";
-const SERVICE_USAGE_API = "https://serviceusage.googleapis.com";
-const IAM_API = "https://iam.googleapis.com/v1";
-const GCLOUD_INSTALL_URL = "https://cloud.google.com/sdk/docs/install";
-/** The Google Play Android Developer API, which the service account calls. */
-const PLAY_API = "androidpublisher.googleapis.com";
-/** IAM creates the service account; the Play Developer API is what it calls. */
-const SERVICES = ["iam.googleapis.com", PLAY_API];
-const KEY_CREATION_CONSTRAINT = "constraints/iam.disableServiceAccountKeyCreation";
-/** Retries while Google enables an API or creates a service account. */
-const PROPAGATION_ATTEMPTS = 12;
-const PROPAGATION_DELAY_MS = 1e4;
-/** Checks of the key's access to the app, about ten minutes of them. */
-const ACCESS_ATTEMPTS = 120;
-const ACCESS_DELAY_MS = 5e3;
-const sleepFor = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-const runWithExeca = async (file, args, options) => (await execa(file, args, options?.interactive ? { stdio: "inherit" } : { stdin: "ignore" })).stdout ?? "";
-/**
-* Play Console's page that invites `email` as a user. `_` stands for the
-* developer account the browser is signed in to, so no ID is needed.
-*/
-const playConsoleInviteUrl = (email) => `https://play.google.com/console/u/0/developers/_/users-and-permissions?invite=${encodeURIComponent(email)}`;
-/** A project ID nobody has: Google Cloud's are global. */
-const newProjectId = () => `${PLAY_SERVICE_ACCOUNT_ID}-${crypto$1.randomBytes(3).toString("hex")}`;
-const isNotFound = (error) => error instanceof GoogleApiError && error.status === 404;
-const isConflict = (error) => error instanceof GoogleApiError && error.status === 409;
-/** The API is disabled in another project than the one set up: waiting does not help. */
-const consumerApiDisabled = (error) => new PlayServiceAccountError("api-not-enabled", `${error.apiMessage}\nEnable it in ${error.consumer ?? "that project"}, then run this again.`, { cause: error });
-const isDenied = (error) => error instanceof GoogleApiError && (error.status === 403 || error.apiStatus === "PERMISSION_DENIED");
-const lines = (output) => output.split("\n").map((line) => line.trim()).filter(Boolean);
-/** The Google Accounts gcloud holds, the active one, if any, first. */
-const credentialedAccounts = async (run) => {
-	const accounts = lines(await run("gcloud", [
-		"auth",
-		"list",
-		"--format=value(account)"
-	]));
-	const [active] = lines(await run("gcloud", [
-		"auth",
-		"list",
-		"--filter=status:ACTIVE",
-		"--format=value(account)"
-	]));
-	return active !== void 0 && accounts.includes(active) ? [active, ...accounts.filter((account) => account !== active)].map((email) => ({
-		email,
-		active: email === active
-	})) : accounts.map((email) => ({
-		email,
-		active: false
-	}));
-};
-/** Stops before anything else, a prompt included, when gcloud is not installed. */
-const requireGcloud = async (run) => {
-	try {
-		await run("gcloud", ["--version"]);
-	} catch (error) {
-		throw new PlayServiceAccountError("gcloud-not-installed", [
-			"gcloud CLI is not installed.",
-			"Install it, then run this again:",
-			GCLOUD_INSTALL_URL
-		].join("\n"), { cause: error });
-	}
-};
-/**
-* The access token of the Google Account the developer picks among those
-* gcloud holds, or of the one `gcloud auth login` adds, when they pick
-* another or gcloud holds none. gcloud's active account stays as it was.
-*/
-const signInWithGcloud = async ({ run, request, onStep }) => {
-	const before = await credentialedAccounts(run);
-	let account = before.length > 0 ? await request.chooseGoogleAccount(before) ?? void 0 : void 0;
-	if (account === void 0) {
-		const signedIn = await run("gcloud", ["auth", "login"], { interactive: true }).then(() => true, () => false);
-		const after = await credentialedAccounts(run);
-		account = after.find(({ email }) => !before.some((known) => known.email === email))?.email ?? (signedIn ? after.find(({ active }) => active)?.email : void 0);
-		if (account === void 0) throw new PlayServiceAccountError("gcloud-not-signed-in", before.length === 0 ? "gcloud has no active Google Account.\nRun gcloud auth login, then run this again." : "gcloud auth login didn't finish.\nRun this again to choose a Google Account.");
-	}
-	onStep(`Signed in to gcloud as ${account}`);
-	const accessToken = (await run("gcloud", [
-		"auth",
-		"print-access-token",
-		account
-	])).trim();
-	registerSecretValue(accessToken);
-	return accessToken;
-};
-/**
-* `IssuePlayServiceAccount` with the gcloud CLI's sign-in and Google's own
-* APIs:
-*
-* 1. once gcloud is found, `askPackageName` names the app, and the Google
-*    Account `chooseGoogleAccount` picks among gcloud's, or the one
-*    `gcloud auth login` adds, the access token the Google Cloud steps use;
-* 2. the account's only project with the Play Developer API, else the one
-*    `chooseProject` picks, else a new one, gets the IAM and Play Developer
-*    APIs enabled, and the service account `hot-updater-play` its JSON key;
-* 3. the developer invites the service account in Play Console, which
-*    `onInvite` opens: gcloud's token may not manage Google Play users;
-* 4. the key itself opens an edit of the app until Google Play lets it,
-*    and is deleted again when it never does.
-*
-* Each step reuses what an earlier run created: the project and the
-* service account.
-*/
-const createGoogleKeyIssuer = ({ fetch = globalThis.fetch, sleep = sleepFor, run = runWithExeca } = {}) => async (request) => {
-	const { onStep = () => {} } = request;
-	await requireGcloud(run);
-	const packageName = await request.askPackageName();
-	const accessToken = await signInWithGcloud({
-		run,
-		request,
-		onStep
-	});
-	const google = createGoogleRequest({
-		accessToken,
-		fetch
-	});
-	const project = await chooseProject({
-		google,
-		request,
-		sleep,
-		onStep
-	});
-	const { projectId } = project;
-	onStep(`Enabling the APIs in ${projectId}`);
-	await enableServices({
-		google,
-		projectId,
-		sleep
-	});
-	onStep(`Creating the service account in ${projectId}`);
-	const email = await ensureServiceAccount({
-		google,
-		project,
-		sleep
-	});
-	onStep("Creating the service account's JSON key");
-	const key = await createKey({
-		google,
-		project,
-		email,
-		sleep
-	});
-	const revoke = async () => {
-		try {
-			await google("Deleting the key", "DELETE", `${IAM_API}/${key.name}`);
-			return true;
-		} catch (error) {
-			return isNotFound(error);
-		}
-	};
-	const inviteUrl = playConsoleInviteUrl(email);
-	try {
-		await request.onInvite(inviteUrl, email);
-		onStep("Waiting for the Play Console invite");
-		await waitForPlayAccess({
-			json: key.json,
-			packageName,
-			fetch,
-			sleep
-		});
-	} catch (error) {
-		const deleted = await revoke();
-		throw new PlayServiceAccountError("play-access-pending", [
-			`The key can't release ${packageName} yet.`,
-			"Invite the service account in Play Console:",
-			email,
-			"App permission: Release apps to testing tracks",
-			inviteUrl,
-			"A new app needs its first .aab uploaded in Play Console.",
-			...deleted ? [] : [`Delete its unused key ${key.keyId} in Google Cloud:`, `https://console.cloud.google.com/iam-admin/serviceaccounts?project=${encodeURIComponent(projectId)}`],
-			"Then run: npx hot-updater google-play login"
-		].join("\n"), { cause: error });
-	}
-	return {
-		json: key.json,
-		keyId: key.keyId,
-		email,
-		projectId,
-		revoke,
-		dispose: async () => {}
-	};
-};
-/**
-* Waits until the key opens an edit of `packageName`, which Google Play
-* allows once the service account is a Play Console user with access to
-* the app, then deletes the edit, which changed nothing. Google may not
-* take a key just created for a while either.
-*/
-const waitForPlayAccess = async ({ json, packageName, fetch, sleep }) => {
-	const play = createPlayClient({
-		json,
-		packageName,
-		fetch
-	});
-	const edits = `${PUBLISHER_API}/applications/${encodeURIComponent(packageName)}/edits`;
-	for (let attempt = 1;; attempt++) {
-		if (attempt > 1) await sleep(ACCESS_DELAY_MS);
-		let ready = true;
-		try {
-			await play.authorization();
-		} catch {
-			ready = false;
-		}
-		if (ready) try {
-			const edit = await play.request(`Opening an edit of ${packageName}`, "POST", edits);
-			if (edit?.id) await play.request("Deleting the edit", "DELETE", `${edits}/${edit.id}`).catch(() => {});
-			return;
-		} catch (error) {
-			if (!(error instanceof GooglePlayError) || ![
-				401,
-				403,
-				404
-			].includes(error.status)) throw error;
-		}
-		if (attempt >= ACCESS_ATTEMPTS) throw new Error("Google Play did not let the key reach the app in time.");
-	}
-};
-/** The account's active projects, every page of them. */
-const listProjects = async (google) => {
-	const projects = [];
-	let pageToken;
-	do {
-		const page = await google("Listing the Google Cloud projects", "GET", `${RESOURCE_MANAGER_API}/v3/projects:search?${new URLSearchParams({
-			query: "state:ACTIVE",
-			...pageToken ? { pageToken } : {}
-		})}`);
-		for (const project of page.projects ?? []) if (project.projectId) projects.push({
-			projectId: project.projectId,
-			...project.displayName ? { displayName: project.displayName } : {},
-			...projectNumberOf(project.name)
-		});
-		pageToken = page.nextPageToken || void 0;
-	} while (pageToken);
-	return projects;
-};
-/** Service Usage reads of the projects' Play Developer API, at most this many at once. */
-const API_CHECK_CONCURRENCY = 8;
-/**
-* Whether each project has the Google Play Developer API enabled, by one
-* Service Usage read each; a project this account may not read counts as
-* without it.
-*/
-const withPlayApiState = async (google, projects) => {
-	const states = [];
-	for (let start = 0; start < projects.length; start += API_CHECK_CONCURRENCY) states.push(...await Promise.all(projects.slice(start, start + API_CHECK_CONCURRENCY).map(({ projectId }) => google("Reading the project's APIs", "GET", `${SERVICE_USAGE_API}/v1/projects/${encodeURIComponent(projectId)}/services/${PLAY_API}`).then(({ state }) => state === "ENABLED", () => false))));
-	return projects.map((project, index) => ({
-		...project,
-		playApiEnabled: states[index]
-	}));
-};
-/** The display name of the project Hot Updater creates. */
-const PROJECT_DISPLAY_NAME = "Hot Updater Play";
-/**
-* The project the service account goes in: a new one for an account
-* without projects; the only project with the Play Developer API, without
-* asking; else the one the developer picks, or a new one.
-*/
-const chooseProject = async ({ google, request, sleep, onStep }) => {
-	const listed = await listProjects(google);
-	if (listed.length === 0) return createProject({
-		google,
-		sleep,
-		onStep
-	});
-	const projects = await withPlayApiState(google, listed);
-	const enabled = projects.filter(({ playApiEnabled }) => playApiEnabled);
-	if (enabled.length === 1) {
-		const [only] = enabled;
-		onStep(`Using ${only.projectId}, the project with the Play Developer API`);
-		return only;
-	}
-	const chosen = await request.chooseProject(projects.map(({ projectId, displayName, playApiEnabled }) => ({
-		projectId,
-		...displayName ? { displayName } : {},
-		playApiEnabled
-	})));
-	if (chosen === null) return createProject({
-		google,
-		sleep,
-		onStep
-	});
-	return projects.find((project) => project.projectId === chosen) ?? { projectId: chosen };
-};
-/** A new project, `hot-updater-play-<random>`, once Google has created it. */
-const createProject = async ({ google, sleep, onStep }) => {
-	const projectId = newProjectId();
-	onStep(`Creating the Google Cloud project ${projectId}`);
-	try {
-		const operation = await google("Creating the Google Cloud project", "POST", `${RESOURCE_MANAGER_API}/v3/projects`, {
-			projectId,
-			displayName: PROJECT_DISPLAY_NAME
-		});
-		const created = await waitForOperation({
-			request: google,
-			origin: `${RESOURCE_MANAGER_API}/v3`,
-			operation,
-			action: "Creating the Google Cloud project",
-			sleep
-		});
-		return {
-			projectId,
-			...projectNumberOf(created?.name)
-		};
-	} catch (error) {
-		if (!(error instanceof GoogleApiError)) throw error;
-		if (error.status === 429 || error.apiStatus === "RESOURCE_EXHAUSTED" || /quota/iu.test(error.apiMessage)) throw new PlayServiceAccountError("project-quota", [
-			"Google Cloud has no project quota left for this account.",
-			error.apiMessage || "Quota exceeded.",
-			"Delete a project you no longer use, then run this again:",
-			"https://console.cloud.google.com/cloud-resource-manager"
-		].join("\n"), { cause: error });
-		if (/terms of service/iu.test(error.apiMessage)) throw new PlayServiceAccountError("project-create-denied", "This Google Account hasn't accepted the Google Cloud Terms of Service.\nAccept them at https://console.cloud.google.com, then run this again.", { cause: error });
-		if (isDenied(error) || error.apiStatus === "FAILED_PRECONDITION") throw new PlayServiceAccountError("project-create-denied", [
-			"This Google Account may not create Google Cloud projects.",
-			error.apiMessage || "Permission denied.",
-			"Ask an admin for the Project Creator role."
-		].join("\n"), { cause: error });
-		throw error;
-	}
-};
-/** `projectNumber` from a resource name `projects/<number>`. */
-const projectNumberOf = (name) => {
-	const number = name?.match(/^projects\/(\d+)$/u)?.[1];
-	return number === void 0 ? {} : { projectNumber: number };
-};
-/**
-* Runs `run` again while Google is still enabling an API in `project`,
-* or, with `notFound`, still creating what it reads.
-*/
-const whilePropagating = async ({ run, project, sleep, notFound = false }) => {
-	for (let attempt = 1;; attempt++) try {
-		return await run();
-	} catch (error) {
-		const disabled = isServiceDisabled(error);
-		if (disabled && !consumerIs(error, project)) throw consumerApiDisabled(error);
-		if (!disabled && !(notFound && isNotFound(error)) || attempt >= PROPAGATION_ATTEMPTS) {
-			if (disabled) throw new PlayServiceAccountError("api-not-enabled", `Google is still enabling the APIs in ${project.projectId}.\n${error.apiMessage}\nWait a few minutes, then run this again.`, { cause: error });
-			throw error;
-		}
-		await sleep(PROPAGATION_DELAY_MS);
-	}
-};
-/**
-* Whether a disabled-service error is about `project` itself, which waiting
-* fixes: Google names the consumer by number, and an error naming none
-* counts as the project's own.
-*/
-const consumerIs = (error, project) => error.consumer === void 0 || error.consumer === `projects/${project.projectId}` || (project.projectNumber === void 0 ? true : error.consumer === `projects/${project.projectNumber}`);
-const enableServices = async ({ google, projectId, sleep }) => {
-	try {
-		const operation = await google("Enabling the APIs", "POST", `${SERVICE_USAGE_API}/v1/projects/${projectId}/services:batchEnable`, { serviceIds: SERVICES });
-		await waitForOperation({
-			request: google,
-			origin: `${SERVICE_USAGE_API}/v1`,
-			operation,
-			action: "Enabling the APIs",
-			sleep
-		});
-	} catch (error) {
-		if (isDenied(error) && !isServiceDisabled(error)) throw new PlayServiceAccountError("project-access-denied", [
-			`This Google Account may not enable APIs in ${projectId}.`,
-			error.apiMessage || "Permission denied.",
-			"Pick a project you own, or ask its owner for the Editor role."
-		].join("\n"), { cause: error });
-		throw error;
-	}
-};
-/** The `hot-updater-play` service account's email, created unless it exists. */
-const ensureServiceAccount = async ({ google, project, sleep }) => {
-	const { projectId } = project;
-	const email = `${PLAY_SERVICE_ACCOUNT_ID}@${projectId}.iam.gserviceaccount.com`;
-	try {
-		return (await whilePropagating({
-			project,
-			sleep,
-			run: () => google("Creating the service account", "POST", `${IAM_API}/projects/${projectId}/serviceAccounts`, {
-				accountId: "hot-updater-play",
-				serviceAccount: {
-					displayName: "Hot Updater Play uploads",
-					description: "Uploads Android App Bundles to Google Play for hot-updater native-build android --submit play-internal."
-				}
-			})
-		})).email ?? email;
-	} catch (error) {
-		if (isConflict(error)) return email;
-		if (isDenied(error) && !isServiceDisabled(error)) throw new PlayServiceAccountError("project-access-denied", [
-			`This Google Account may not create service accounts in ${projectId}.`,
-			error.apiMessage || "Permission denied.",
-			"Pick a project you own, or ask for the Service Account Admin role."
-		].join("\n"), { cause: error });
-		throw error;
-	}
-};
-/** A new JSON key of the service account, checked and masked in the CLI's output. */
-const createKey = async ({ google, project, email, sleep }) => {
-	const { projectId } = project;
-	let key;
-	try {
-		key = await whilePropagating({
-			project,
-			sleep,
-			notFound: true,
-			run: () => google("Creating the key", "POST", `${IAM_API}/projects/${projectId}/serviceAccounts/${email}/keys`, {
-				privateKeyType: "TYPE_GOOGLE_CREDENTIALS_FILE",
-				keyAlgorithm: "KEY_ALG_RSA_2048"
-			})
-		});
-	} catch (error) {
-		if (error instanceof GoogleApiError && (error.violations.includes(KEY_CREATION_CONSTRAINT) || /disableServiceAccountKeyCreation/u.test(error.apiMessage))) throw new PlayServiceAccountError("key-creation-disabled", [
-			`iam.disableServiceAccountKeyCreation forbids keys in ${projectId}.`,
-			"Ask an organization policy admin to allow keys for this project,",
-			"or run this again with a project outside the organization."
-		].join("\n"), { cause: error });
-		throw error;
-	}
-	if (!key.name || !key.privateKeyData) throw new Error("Google Cloud created the key without its JSON file.");
-	registerSecretValue(key.privateKeyData);
-	const json = Buffer.from(key.privateKeyData, "base64").toString("utf-8");
-	registerSecretValue(json);
-	let parsed;
-	try {
-		parsed = JSON.parse(json);
-	} catch {
-		parsed = {};
-	}
-	if (typeof parsed.private_key !== "string") {
-		await google("Deleting the key", "DELETE", `${IAM_API}/${key.name}`).catch(() => {});
-		throw new Error("Google Cloud created a key that is no JSON key file.");
-	}
-	registerSecretValue(parsed.private_key);
-	return {
-		json,
-		name: key.name,
-		keyId: key.name.split("/").pop()
-	};
-};
-//#endregion
-//#region src/playServiceAccount.ts
-/**
-* Hot Updater's issuer, the one place that picks how it is done: gcloud's
-* sign-in, then the Cloud Resource Manager, Service Usage, IAM, and Play
-* Developer APIs. Another implementation of `IssuePlayServiceAccount`
-* replaces it here without touching its callers.
-*/
-const issuePlayServiceAccount = (request) => createGoogleKeyIssuer()(request);
-//#endregion
-export { PLAY_SERVICE_ACCOUNT_ID, PlayServiceAccountError, PlayVersionCodeUsedError, assertPlaySigned, buildAndroid, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, hasPlayReleases, issuePlayServiceAccount, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };
+export { PlayVersionCodeUsedError, assertPlaySigned, buildAndroid, checkPlayAccess, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, playConsoleInviteUrl, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };