@mpgd/cli 0.34.0 → 0.36.0

package/dist/android-bundle-signer.d.ts

@@ -0,0 +1,2 @@
+/** Recheck the signer of these AAB bytes before persisting or submitting them. */
+export declare function inspectAndroidBundleSigner(aabFile: string): Promise<string>;

package/dist/android-bundle-signer.js

@@ -0,0 +1,38 @@
+import path from 'node:path';
+import { runReleaseProcess } from './deploy-process.js';
+import { artifactInspectionEnvironment } from './artifact-inspection-environment.js';
+const signerPattern = /\bSHA256:\s*((?:[A-Fa-f0-9]{2}:){31}[A-Fa-f0-9]{2})/u;
+const timeoutMs = 60_000;
+const maxOutputBytes = 1024 * 1024;
+/** Recheck the signer of these AAB bytes before persisting or submitting them. */
+export async function inspectAndroidBundleSigner(aabFile) {
+    const bundle = path.resolve(aabFile);
+    const options = {
+        cwd: path.dirname(bundle),
+        timeoutMs,
+        maxOutputBytes,
+        environment: artifactInspectionEnvironment(),
+    };
+    const verified = await runReleaseProcess({
+        ...options,
+        command: 'jarsigner',
+        args: ['-verify', '-verbose', bundle],
+    });
+    if (verified.truncated || !/\bjar verified\./u.test(verified.output)
+        || /jar is unsigned|contains unsigned entries|has expired/iu.test(verified.output)) {
+        throw new Error('Android App Bundle JAR signature verification failed.');
+    }
+    const certificate = await runReleaseProcess({
+        ...options,
+        command: 'keytool',
+        args: ['-J-Duser.language=en', '-printcert', '-jarfile', bundle],
+    });
+    const signer = /\bSigner #1:/u.test(certificate.output)
+        ? signerPattern.exec(certificate.output)?.[1]
+        : undefined;
+    if (certificate.truncated || /\bSigner #2:/u.test(certificate.output)
+        || signer === undefined) {
+        throw new Error('Android App Bundle must have exactly one inspectable signer.');
+    }
+    return signer.replaceAll(':', '').toLowerCase();
+}

package/dist/android-signing-session.d.ts

@@ -0,0 +1,22 @@
+export interface AndroidUploadSigningInput {
+  readonly keystoreFile: string;
+  readonly storePassword: string;
+  readonly keyAlias: string;
+  readonly keyPassword: string;
+  readonly expectedCertSha256: string;
+  readonly environment?: NodeJS.ProcessEnv;
+  readonly signal?: AbortSignal;
+  readonly temporaryParent?: string;
+}
+export interface AndroidUploadSigningSession {
+  readonly environment: NodeJS.ProcessEnv;
+  readonly expectedCertSha256: string;
+  readonly temporaryKeystore: string;
+  readonly gradleInitScript: string;
+  readonly secretValues: readonly string[];
+  dispose(): void;
+}
+/** Restore one upload key to an owned temporary path and preflight its identity. */
+export declare function prepareAndroidUploadSigningSession(input: AndroidUploadSigningInput): Promise<AndroidUploadSigningSession>;
+/** Always remove the restored key after a build, failure, or cancellation. */
+export declare function withAndroidUploadSigningSession<T>(input: AndroidUploadSigningInput, action: (session: AndroidUploadSigningSession) => Promise<T>): Promise<T>;

package/dist/android-signing-session.js

@@ -0,0 +1,198 @@
+import { chmodSync, copyFileSync, mkdtempSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { runReleaseProcess } from './deploy-process.js';
+const fingerprintPattern = /^[0-9A-F]{64}$/u;
+const maximumKeystoreBytes = 64 * 1024 * 1024;
+const initScript = `gradle.beforeProject { project ->
+  if (project.path != ':app') return
+  project.pluginManager.withPlugin('com.android.application') {
+    def android = project.extensions.getByName('android')
+    def signing = android.signingConfigs.findByName('mpgdUpload')
+      ?: android.signingConfigs.create('mpgdUpload')
+    signing.storeFile = project.file(System.getenv('MPGD_ANDROID_SIGNING_KEYSTORE'))
+    signing.storePassword = System.getenv('MPGD_ANDROID_SIGNING_STORE_PASSWORD')
+    signing.keyAlias = System.getenv('MPGD_ANDROID_SIGNING_KEY_ALIAS')
+    signing.keyPassword = System.getenv('MPGD_ANDROID_SIGNING_KEY_PASSWORD')
+    android.buildTypes.getByName('release').signingConfig = signing
+  }
+}
+gradle.projectsEvaluated {
+  def app = gradle.rootProject.findProject(':app')
+  if (app == null || app.extensions.findByName('android') == null
+      || app.extensions.getByName('android').buildTypes.getByName('release').signingConfig?.name
+        != 'mpgdUpload') {
+    throw new GradleException('The game shell did not accept mpgd upload signing.')
+  }
+}
+`;
+/** Restore one upload key to an owned temporary path and preflight its identity. */
+export async function prepareAndroidUploadSigningSession(input) {
+    const expectedCertSha256 = input.expectedCertSha256.replace(/:/gu, '').toUpperCase();
+    const keyAlias = input.keyAlias.trim();
+    if (!fingerprintPattern.test(expectedCertSha256) || keyAlias === ''
+        || input.storePassword === '' || input.keyPassword === '') {
+        throw new Error('Android upload signing requires an alias, passwords and SHA-256 certificate.');
+    }
+    const source = path.resolve(input.keystoreFile);
+    let sourceStat;
+    try {
+        sourceStat = statSync(source);
+    }
+    catch {
+        throw new Error(`Android upload keystore is missing or unreadable: ${source}`);
+    }
+    if (!sourceStat.isFile() || sourceStat.size < 1 || sourceStat.size > maximumKeystoreBytes) {
+        throw new Error('Android upload keystore must be a nonempty regular file under 64 MiB.');
+    }
+    const parent = input.temporaryParent ?? tmpdir();
+    const ownedRoot = mkdtempSync(path.join(parent, 'mpgd-android-upload-'));
+    const temporaryKeystore = path.join(ownedRoot, 'upload-keystore');
+    const gradleInitScript = path.join(ownedRoot, 'upload-signing.init.gradle');
+    const environment = {
+        ...(input.environment ?? process.env),
+        MPGD_ANDROID_SIGNING_KEYSTORE: temporaryKeystore,
+        MPGD_ANDROID_SIGNING_STORE_PASSWORD: input.storePassword,
+        MPGD_ANDROID_SIGNING_KEY_ALIAS: keyAlias,
+        MPGD_ANDROID_SIGNING_KEY_PASSWORD: input.keyPassword,
+        MPGD_ANDROID_SIGNING_INIT_SCRIPT: gradleInitScript,
+        MPGD_ANDROID_UPLOAD_CERT_SHA256: expectedCertSha256,
+    };
+    delete environment.MPGD_ANDROID_UPLOAD_KEYSTORE;
+    const secretValues = [input.storePassword, input.keyPassword];
+    try {
+        if (process.platform !== 'win32') {
+            chmodSync(ownedRoot, 0o700);
+        }
+        copyFileSync(source, temporaryKeystore);
+        chmodSync(temporaryKeystore, 0o600);
+        const javaHome = environment.JAVA_HOME?.trim();
+        const keytoolExecutable = process.platform === 'win32' ? 'keytool.exe' : 'keytool';
+        const keytool = javaHome === undefined || javaHome === ''
+            ? keytoolExecutable
+            : path.join(javaHome, 'bin', keytoolExecutable);
+        const listed = await runReleaseProcess({
+            command: keytool,
+            args: [
+                '-J-Duser.language=en',
+                '-list',
+                '-v',
+                '-keystore',
+                temporaryKeystore,
+                '-alias',
+                keyAlias,
+                '-storepass:env',
+                'MPGD_ANDROID_SIGNING_STORE_PASSWORD',
+            ],
+            cwd: ownedRoot,
+            environment,
+            timeoutMs: 30_000,
+            signal: input.signal,
+            secretValues,
+            captureMachineStdout: true,
+        });
+        if (listed.truncated || listed.machineStdout === undefined) {
+            throw new Error('Android upload certificate inspection output was truncated.');
+        }
+        const observed = /\bSHA256:\s*((?:[0-9A-Fa-f]{2}:){31}[0-9A-Fa-f]{2})/u
+            .exec(listed.machineStdout)?.[1]?.replace(/:/gu, '').toUpperCase();
+        if (observed !== expectedCertSha256) {
+            throw new Error('Android upload keystore certificate does not match the expected SHA-256.');
+        }
+        const typeListing = await runReleaseProcess({
+            command: keytool,
+            args: [
+                '-J-Duser.language=en',
+                '-list',
+                '-keystore',
+                temporaryKeystore,
+                '-storepass:env',
+                'MPGD_ANDROID_SIGNING_STORE_PASSWORD',
+            ],
+            cwd: ownedRoot,
+            environment,
+            timeoutMs: 30_000,
+            signal: input.signal,
+            secretValues,
+            captureMachineStdout: true,
+        });
+        if (typeListing.truncated || typeListing.machineStdout === undefined) {
+            throw new Error('Android upload keystore type inspection output was truncated.');
+        }
+        // -list -v with -alias omits the keystore type. PKCS12 ignores a distinct
+        // key password during -certreq, so Gradle must receive the store password.
+        if (/^Keystore type:\s*PKCS12\s*$/imu.test(typeListing.machineStdout)
+            && input.keyPassword !== input.storePassword) {
+            throw new Error('PKCS12 upload signing requires the key password to equal the store password.');
+        }
+        await runReleaseProcess({
+            command: keytool,
+            args: [
+                '-J-Duser.language=en',
+                '-certreq',
+                '-keystore',
+                temporaryKeystore,
+                '-alias',
+                keyAlias,
+                '-file',
+                path.join(ownedRoot, 'upload.csr'),
+                '-storepass:env',
+                'MPGD_ANDROID_SIGNING_STORE_PASSWORD',
+                '-keypass:env',
+                'MPGD_ANDROID_SIGNING_KEY_PASSWORD',
+            ],
+            cwd: ownedRoot,
+            environment,
+            timeoutMs: 30_000,
+            signal: input.signal,
+            secretValues,
+        });
+        writeFileSync(gradleInitScript, initScript, { flag: 'wx', mode: 0o600 });
+        return {
+            environment,
+            expectedCertSha256,
+            temporaryKeystore,
+            gradleInitScript,
+            secretValues,
+            dispose() {
+                removeOwnedSigningRoot(ownedRoot);
+            },
+        };
+    }
+    catch (error) {
+        try {
+            removeOwnedSigningRoot(ownedRoot);
+        }
+        catch (cleanupError) {
+            throw new AggregateError([error, cleanupError], 'Android upload signing preparation and cleanup both failed.');
+        }
+        throw error;
+    }
+}
+/** Always remove the restored key after a build, failure, or cancellation. */
+export async function withAndroidUploadSigningSession(input, action) {
+    const session = await prepareAndroidUploadSigningSession(input);
+    let outcome;
+    try {
+        outcome = { ok: true, value: await action(session) };
+    }
+    catch (error) {
+        outcome = { ok: false, error };
+    }
+    try {
+        session.dispose();
+    }
+    catch (cleanupError) {
+        if (!outcome.ok) {
+            throw new AggregateError([outcome.error, cleanupError], 'Android upload signing action and cleanup both failed.');
+        }
+        throw cleanupError;
+    }
+    if (!outcome.ok) {
+        throw outcome.error;
+    }
+    return outcome.value;
+}
+function removeOwnedSigningRoot(root) {
+    rmSync(root, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+}

package/dist/artifact-inspection-environment.d.ts

@@ -0,0 +1,2 @@
+/** Artifact inspectors need tool locations, never release-state or signing credentials. */
+export declare function artifactInspectionEnvironment(source?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;

package/dist/artifact-inspection-environment.js

@@ -0,0 +1,31 @@
+const allowedInspectionEnvironmentNames = [
+    'PATH',
+    'Path',
+    'HOME',
+    'TMPDIR',
+    'TMP',
+    'TEMP',
+    'LANG',
+    'LC_ALL',
+    'LC_CTYPE',
+    'JAVA_HOME',
+    'ANDROID_HOME',
+    'ANDROID_SDK_ROOT',
+    'DEVELOPER_DIR',
+    'SDKROOT',
+    'SystemRoot',
+    'windir',
+    'PATHEXT',
+    'USERPROFILE',
+];
+/** Artifact inspectors need tool locations, never release-state or signing credentials. */
+export function artifactInspectionEnvironment(source = process.env) {
+    const result = {};
+    for (const name of allowedInspectionEnvironmentNames) {
+        const value = source[name];
+        if (value !== undefined) {
+            result[name] = value;
+        }
+    }
+    return result;
+}

package/dist/asc-pin.json

@@ -0,0 +1,26 @@
+{
+  "repository": "rorkai/App-Store-Connect-CLI",
+  "version": "5.5.0",
+  "assets": {
+    "darwin-arm64": {
+      "name": "asc_5.5.0_macOS_arm64",
+      "sha256": "8d0c38ad9c7e3094d2fc9b7b5a86d7c9a08fd2b36a3df081aefbf60503035b29"
+    },
+    "darwin-x64": {
+      "name": "asc_5.5.0_macOS_amd64",
+      "sha256": "296553af9cd63f9f93782f22dc12077c3d6678ee57cf52e05aee7e850fe13f63"
+    },
+    "linux-arm64": {
+      "name": "asc_5.5.0_linux_arm64",
+      "sha256": "c8f6d0adf7ca3ad41391adda3c83ff2023b921f4f9b077c6498c6d18b39aaebd"
+    },
+    "linux-x64": {
+      "name": "asc_5.5.0_linux_amd64",
+      "sha256": "712b29762c7ad8c2624bccc9752a30ff3c1d4c5b4cb689a00680f45081939239"
+    },
+    "win32-x64": {
+      "name": "asc_5.5.0_windows_amd64.exe",
+      "sha256": "52d1eb290139570b377b8fca439c84be7275934209dd342bb2a8b44f14e00c89"
+    }
+  }
+}

package/dist/capacitor-shell-starter.d.ts

@@ -24,6 +24,7 @@ export interface CapacitorShellStarterPlan {
 * never rewritten by this initializer.
 */
 export declare function planCapacitorShellStarter(input: CapacitorShellStarterInput): CapacitorShellStarterPlan;
+export declare function assertCapacitorAppId(appId: string): void;
 export declare function applyCapacitorShellStarter(plan: CapacitorShellStarterPlan, installStagedFile?: (temporary: string, destination: string) => void): void;
 export interface CapacitorShellCommandRunner {
   run(command: string, args: readonly string[], cwd: string): void;

package/dist/capacitor-shell-starter.js

@@ -31,12 +31,7 @@ export function planCapacitorShellStarter(input) {
     if (!lstatSync(gameRoot).isDirectory()) {
         throw new Error('Capacitor shell game root must be a directory.');
     }
-    if (!appIdPattern.test(input.appId)) {
-        throw new Error('Capacitor app ID must be a lowercase reverse-domain identifier.');
-    }
-    if (input.appId.split('.').some((segment) => javaKeywords.has(segment))) {
-        throw new Error('Capacitor app ID cannot contain Java keyword segments.');
-    }
+    assertCapacitorAppId(input.appId);
     if (input.displayName.trim() !== input.displayName
         || input.displayName.length === 0 || input.displayName.length > 80) {
         throw new Error('Capacitor display name must be 1-80 characters without outer whitespace.');
@@ -349,6 +344,14 @@ export function planCapacitorShellStarter(input) {
         nativePlatformsToAdd,
     };
 }
+export function assertCapacitorAppId(appId) {
+    if (!appIdPattern.test(appId)) {
+        throw new Error('Capacitor app ID must be a lowercase reverse-domain identifier.');
+    }
+    if (appId.split('.').some((segment) => javaKeywords.has(segment))) {
+        throw new Error('Capacitor app ID cannot contain Java keyword segments.');
+    }
+}
 export function applyCapacitorShellStarter(plan, installStagedFile = renameSync) {
     const staged = plan.files.filter((file) => !plan.nativePlatformsToAdd.some((platform) => file.path.startsWith(`${shellPath}/${platform}/`))).map((file) => {
         const destination = safeDestination(plan.gameRoot, file.path);

package/dist/deploy-planning.d.ts

@@ -0,0 +1,64 @@
+export type NativeDeployTarget = 'android' | 'ios';
+export interface CredentialReference {
+  readonly env: string;
+}
+export interface DeployTargetProfile {
+  readonly destination: 'play-internal' | 'testflight';
+  readonly signingCredential: CredentialReference;
+  readonly submissionCredential: CredentialReference;
+  readonly testGroup?: string;
+}
+export interface DeployProfile {
+  readonly buildProfile: 'production';
+  readonly approval: 'manual' | 'preapproved-internal-test';
+  readonly targets: Partial<Record<NativeDeployTarget, DeployTargetProfile>>;
+}
+export interface DeployConfig {
+  readonly schemaVersion: 1;
+  readonly profiles: Record<string, DeployProfile>;
+}
+export interface PlannedDeployTarget {
+  readonly target: NativeDeployTarget;
+  readonly destination: 'play-internal' | 'testflight';
+  readonly appId: string;
+  readonly testGroup?: string;
+}
+export interface NativeDeploymentPlan {
+  readonly schemaVersion: 1;
+  readonly gameRoot: string;
+  readonly profile: string;
+  readonly buildProfile: 'production';
+  readonly approval: DeployProfile['approval'];
+  readonly targetConfigSha256: string;
+  readonly deployConfigSha256: string;
+  readonly targets: readonly PlannedDeployTarget[];
+}
+export interface DeployDoctorCheck {
+  readonly name: string;
+  readonly status: 'ok' | 'missing' | 'warning';
+  readonly detail: string;
+}
+export interface DeployDoctorResult {
+  readonly checks: readonly DeployDoctorCheck[];
+  readonly healthy: boolean;
+}
+export declare function initializeDeployConfig(game: string): string;
+export declare function planNativeDeployment(input: {
+  readonly game: string;
+  readonly profile: string;
+  readonly targets?: readonly NativeDeployTarget[];
+}): NativeDeploymentPlan;
+export declare function writeNativeDeploymentPlan(file: string, plan: NativeDeploymentPlan): void;
+/** Load a saved plan only if it still equals the game-owned current configuration. */
+export declare function readNativeDeploymentPlan(file: string, gameRootOverride?: string): NativeDeploymentPlan;
+/** Resolve credential references from the one authoritative game-owned profile. */
+export declare function readNativeDeployTargetProfile(plan: NativeDeploymentPlan, target: NativeDeployTarget): DeployTargetProfile;
+/** Credential names across every configured profile, including unselected targets. */
+export declare function readNativeDeployCredentialNames(plan: NativeDeploymentPlan): readonly string[];
+export declare function doctorNativeDeployment(input: {
+  readonly game: string;
+  readonly profile: string;
+  readonly targets?: readonly NativeDeployTarget[];
+  readonly environment?: NodeJS.ProcessEnv;
+}): DeployDoctorResult;
+export declare function parseDeployTargets(value: string | undefined): readonly NativeDeployTarget[] | undefined;