@mpgd/cli 0.34.0 → 0.36.0

package/dist/play-internal-submission.js

@@ -0,0 +1,247 @@
+import { createHash } from 'node:crypto';
+import { createReadStream, existsSync, statSync } from 'node:fs';
+import { inspectAndroidBundleSigner } from './android-bundle-signer.js';
+const sha256Pattern = /^[a-f0-9]{64}$/u;
+const editIdPattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+const trackName = 'internal';
+const bundleUploadTimeoutMs = 120_000;
+export class PlaySubmissionUncertainError extends Error {
+    stage;
+    editId;
+    constructor(stage, editId) {
+        super(`Google Play ${stage} result is uncertain for edit ${editId}; inspect remote state before retry.`);
+        this.stage = stage;
+        this.editId = editId;
+        this.name = 'PlaySubmissionUncertainError';
+    }
+}
+/** Submit only a previously inspected, immutable Android build record. */
+export async function submitVerifiedAndroidBundle(input) {
+    if (!existsSync(input.serviceAccountFile) || !statSync(input.serviceAccountFile).isFile()) {
+        throw new Error('Google Play service account file is missing.');
+    }
+    const { createServiceAccountPublisher } = await import(new URL('./play-sdk-adapter.js', import.meta.url).href);
+    const publisher = createServiceAccountPublisher(input.serviceAccountFile);
+    return submitVerifiedAndroidBundleWithPublisher(input, publisher);
+}
+/** Internal injection point for credential-free SDK contract tests. */
+export async function submitVerifiedAndroidBundleWithPublisher(input, publisher, requestRootUrl) {
+    const versionCode = await preflight(input);
+    const expectedSha256 = input.record.artifactSha256;
+    const packageName = input.packageName;
+    if (input.resumeEditId !== undefined && !editIdPattern.test(input.resumeEditId)) {
+        throw new Error('Google Play resume edit ID is malformed.');
+    }
+    input.signal?.throwIfAborted();
+    let editId = input.resumeEditId ?? await publisher.insertEdit(packageName, input.signal);
+    let freshEdit = input.resumeEditId === undefined;
+    if (input.resumeEditId === undefined) {
+        try {
+            await input.onEditCreated?.(editId);
+        }
+        catch {
+            throw new PlaySubmissionUncertainError('checkpoint', editId);
+        }
+    }
+    let bundles;
+    try {
+        bundles = await publisher.listBundles(packageName, editId, input.signal);
+    }
+    catch (error) {
+        if (input.resumeEditId === undefined || !isHttpStatus(error, 404)) {
+            throw error;
+        }
+        // A successful commit may have invalidated the old edit while its response
+        // was lost. Open a new snapshot solely to inspect the live internal track.
+        editId = await publisher.insertEdit(packageName, input.signal);
+        freshEdit = true;
+        try {
+            await input.onEditCreated?.(editId);
+        }
+        catch {
+            throw new PlaySubmissionUncertainError('checkpoint', editId);
+        }
+        bundles = await publisher.listBundles(packageName, editId, input.signal);
+    }
+    let existing = findVersionBundle(bundles, versionCode, expectedSha256);
+    const currentTrack = await getInternalTrack(publisher, packageName, editId, input.signal);
+    if (hasVersion(currentTrack.releases, versionCode)) {
+        if (existing === undefined) {
+            throw new Error('Google Play internal track has this version without matching bundle bytes.');
+        }
+        if (!hasCompletedVersion(currentTrack.releases, versionCode)) {
+            throw new Error('Google Play internal track version is not completed; inspect it before resubmitting.');
+        }
+        if (freshEdit) {
+            return result(input, editId, versionCode, true);
+        }
+        // A resumed edit sees its own uncommitted track. Publish it before success.
+        await publisher.validateEdit(packageName, editId, input.signal);
+        try {
+            await publisher.commitEdit(packageName, editId, input.signal);
+        }
+        catch {
+            throw new PlaySubmissionUncertainError('commit', editId);
+        }
+        return result(input, editId, versionCode, false);
+    }
+    if (existing === undefined) {
+        try {
+            const uploaded = await publisher.uploadBundle({
+                packageName,
+                editId,
+                aabFile: input.aabFile,
+                timeoutMs: bundleUploadTimeoutMs,
+                ...(input.signal === undefined ? {} : { signal: input.signal }),
+                ...(requestRootUrl === undefined ? {} : { requestRootUrl }),
+            });
+            assertBundle(uploaded, versionCode, expectedSha256);
+        }
+        catch (error) {
+            if (isDefinitiveHttpError(error)) {
+                throw error;
+            }
+            try {
+                bundles = await publisher.listBundles(packageName, editId, input.signal);
+                existing = findVersionBundle(bundles, versionCode, expectedSha256);
+            }
+            catch {
+                throw new PlaySubmissionUncertainError('upload', editId);
+            }
+            if (existing === undefined) {
+                throw new PlaySubmissionUncertainError('upload', editId);
+            }
+        }
+    }
+    const release = {
+        name: input.record.releaseKey,
+        status: 'completed',
+        versionCodes: [String(versionCode)],
+    };
+    const desired = {
+        track: trackName,
+        releases: [...(currentTrack.releases ?? []), release],
+    };
+    try {
+        await publisher.updateTrack(packageName, editId, desired, input.signal);
+    }
+    catch (error) {
+        let applied;
+        try {
+            const observed = await getInternalTrack(publisher, packageName, editId, input.signal);
+            applied = hasCompletedVersion(observed.releases, versionCode);
+        }
+        catch {
+            throw new PlaySubmissionUncertainError('track-update', editId);
+        }
+        if (!applied) {
+            throw error;
+        }
+    }
+    try {
+        await publisher.validateEdit(packageName, editId, input.signal);
+    }
+    catch (error) {
+        if (isDefinitiveHttpError(error)) {
+            throw error;
+        }
+        throw new PlaySubmissionUncertainError('validate', editId);
+    }
+    try {
+        await publisher.commitEdit(packageName, editId, input.signal);
+        return result(input, editId, versionCode, false);
+    }
+    catch {
+        // Inserting a new edit invalidates the first edit for this API user. A
+        // failed commit response cannot safely be reconciled by creating one.
+        throw new PlaySubmissionUncertainError('commit', editId);
+    }
+}
+async function preflight(input) {
+    input.signal?.throwIfAborted();
+    const record = input.record;
+    const versionCode = record.platformVersion.versionCode;
+    if (record.target !== 'android' || input.packageName !== record.inspectedAppId
+        || !Number.isSafeInteger(versionCode) || Number(versionCode) < 1
+        || !sha256Pattern.test(record.artifactSha256)
+        || !sha256Pattern.test(record.inspectedSignerSha256 ?? '')
+        || !input.aabFile.endsWith('.aab')
+        || !existsSync(input.aabFile) || !statSync(input.aabFile).isFile()) {
+        throw new Error('Google Play submission requires a matching verified Android AAB record.');
+    }
+    const hash = createHash('sha256');
+    for await (const chunk of createReadStream(input.aabFile)) {
+        hash.update(chunk);
+    }
+    input.signal?.throwIfAborted();
+    if (hash.digest('hex') !== record.artifactSha256) {
+        throw new Error('Google Play AAB bytes differ from the immutable build record.');
+    }
+    if (await inspectAndroidBundleSigner(input.aabFile)
+        !== record.inspectedSignerSha256?.replaceAll(':', '').toLowerCase()) {
+        throw new Error('Google Play AAB signer differs from the immutable build record.');
+    }
+    return Number(versionCode);
+}
+function assertBundle(bundle, versionCode, sha256) {
+    if (bundle.versionCode !== versionCode || bundle.sha256?.toLowerCase() !== sha256) {
+        throw new Error('Google Play returned a different bundle version or SHA-256.');
+    }
+}
+function findVersionBundle(bundles, versionCode, sha256) {
+    const sameVersion = bundles.find((bundle) => bundle.versionCode === versionCode);
+    if (sameVersion !== undefined) {
+        assertBundle(sameVersion, versionCode, sha256);
+    }
+    return sameVersion;
+}
+async function getInternalTrack(publisher, packageName, editId, signal) {
+    try {
+        return await publisher.getTrack(packageName, editId, signal);
+    }
+    catch (error) {
+        if (isHttpStatus(error, 404)) {
+            return { track: trackName, releases: [] };
+        }
+        throw error;
+    }
+}
+function isHttpStatus(error, status) {
+    if (typeof error !== 'object' || error === null) {
+        return false;
+    }
+    const value = error;
+    return value.code === status || value.response?.status === status;
+}
+function isDefinitiveHttpError(error) {
+    if (typeof error !== 'object' || error === null) {
+        return false;
+    }
+    const value = error;
+    const raw = value.response?.status ?? value.code;
+    const status = typeof raw === 'number'
+        ? raw
+        : typeof raw === 'string' && /^\d{3}$/u.test(raw)
+            ? Number(raw)
+            : undefined;
+    return status !== undefined && status >= 400 && status < 500
+        && status !== 408 && status !== 429;
+}
+function hasVersion(releases, versionCode) {
+    return releases?.some((release) => release.versionCodes?.includes(String(versionCode))) ?? false;
+}
+function hasCompletedVersion(releases, versionCode) {
+    return releases?.some((release) => release.status === 'completed'
+        && release.versionCodes?.includes(String(versionCode))) ?? false;
+}
+function result(input, editId, versionCode, alreadyCommitted) {
+    return {
+        status: 'committed',
+        packageName: input.packageName,
+        editId,
+        track: trackName,
+        versionCode,
+        bundleSha256: input.record.artifactSha256,
+        alreadyCommitted,
+    };
+}

package/dist/play-publisher-port.d.ts

@@ -0,0 +1,30 @@
+/** Minimal store command port. The Google SDK lives under adapters/, not in the CLI. */
+export interface PlayBundle {
+  readonly versionCode?: number | null;
+  readonly sha256?: string | null;
+}
+export interface PlayTrackRelease {
+  readonly name?: string | null | undefined;
+  readonly status?: string | null | undefined;
+  readonly versionCodes?: readonly string[] | null | undefined;
+}
+export interface PlayTrack {
+  readonly track?: string | null | undefined;
+  readonly releases?: readonly PlayTrackRelease[] | null | undefined;
+}
+export interface PlayPublisher {
+  insertEdit(packageName: string, editIdSignal?: AbortSignal): Promise<string>;
+  listBundles(packageName: string, editId: string, signal?: AbortSignal): Promise<PlayBundle[]>;
+  uploadBundle(input: {
+    readonly packageName: string;
+    readonly editId: string;
+    readonly aabFile: string;
+    readonly timeoutMs: number;
+    readonly requestRootUrl?: string;
+    readonly signal?: AbortSignal;
+  }): Promise<PlayBundle>;
+  getTrack(packageName: string, editId: string, signal?: AbortSignal): Promise<PlayTrack>;
+  updateTrack(packageName: string, editId: string, track: PlayTrack, signal?: AbortSignal): Promise<void>;
+  validateEdit(packageName: string, editId: string, signal?: AbortSignal): Promise<void>;
+  commitEdit(packageName: string, editId: string, signal?: AbortSignal): Promise<void>;
+}

package/dist/play-publisher-port.js

@@ -0,0 +1 @@
+export {};

package/dist/play-sdk-adapter.js

@@ -0,0 +1,78 @@
+// adapters/play-publisher/src/index.ts
+import { createReadStream } from "node:fs";
+import { androidpublisher, auth } from "@googleapis/androidpublisher";
+var scope = "https://www.googleapis.com/auth/androidpublisher";
+function createServiceAccountPublisher(serviceAccountFile) {
+  const googleAuth = new auth.GoogleAuth({ keyFile: serviceAccountFile, scopes: [scope] });
+  return wrapPublisher(androidpublisher({ version: "v3", auth: googleAuth }));
+}
+function createMockPublisher(accessToken, rootUrl) {
+  const oauth = new auth.OAuth2();
+  oauth.setCredentials({ access_token: accessToken });
+  return wrapPublisher(androidpublisher({ version: "v3", auth: oauth, rootUrl }));
+}
+function wrapPublisher(publisher) {
+  return {
+    async insertEdit(packageName, signal) {
+      const response = await publisher.edits.insert(
+        { packageName },
+        { retry: false, signal }
+      );
+      if (typeof response.data.id !== "string" || response.data.id.trim() === "") {
+        throw new Error("Google Play did not return an edit ID.");
+      }
+      return response.data.id;
+    },
+    async listBundles(packageName, editId, signal) {
+      return (await publisher.edits.bundles.list(
+        { packageName, editId },
+        { signal }
+      )).data.bundles ?? [];
+    },
+    async uploadBundle(input) {
+      const response = await publisher.edits.bundles.upload({
+        packageName: input.packageName,
+        editId: input.editId,
+        media: { mimeType: "application/octet-stream", body: createReadStream(input.aabFile) }
+      }, {
+        timeout: input.timeoutMs,
+        retry: false,
+        signal: input.signal,
+        // The generated SDK's media endpoint ignores the client's rootUrl.
+        ...input.requestRootUrl === void 0 ? {} : { rootUrl: input.requestRootUrl }
+      });
+      return response.data;
+    },
+    async getTrack(packageName, editId, signal) {
+      return (await publisher.edits.tracks.get(
+        { packageName, editId, track: "internal" },
+        { signal }
+      )).data;
+    },
+    async updateTrack(packageName, editId, track, signal) {
+      await publisher.edits.tracks.update({
+        packageName,
+        editId,
+        track: "internal",
+        requestBody: track
+      }, { retry: false, signal });
+    },
+    async validateEdit(packageName, editId, signal) {
+      await publisher.edits.validate(
+        { packageName, editId },
+        { retry: false, signal }
+      );
+    },
+    async commitEdit(packageName, editId, signal) {
+      await publisher.edits.commit({
+        packageName,
+        editId,
+        changesInReviewBehavior: "ERROR_IF_IN_REVIEW"
+      }, { retry: false, signal });
+    }
+  };
+}
+export {
+  createMockPublisher,
+  createServiceAccountPublisher
+};

package/dist/release-state.d.ts

@@ -0,0 +1,140 @@
+import { type PlatformVersionLedger, type PlatformVersionReleasePlan, type PlatformVersionTargetRequest } from '@mpgd/target-config';
+export interface NativeReleaseReservationInput {
+  readonly gameRoot: string;
+  readonly releaseKey: string;
+  readonly gameId: string;
+  readonly gameVersion: string;
+  readonly sourceGitSha: string;
+  readonly kitGitSha: string;
+  readonly targetConfigDigest: string;
+  readonly targets: readonly PlatformVersionTargetRequest[];
+  /** Required only when a game has no existing release-state ledger. */
+  readonly initialLedger?: PlatformVersionLedger | undefined;
+  readonly environment?: NodeJS.ProcessEnv;
+  readonly signal?: AbortSignal;
+}
+export interface NativeReleaseReservation {
+  readonly plan: PlatformVersionReleasePlan;
+  readonly stateCommit: string;
+  readonly reused: boolean;
+}
+export interface ImmutableNativeBuildRecord {
+  readonly releaseKey: string;
+  readonly target: 'android' | 'ios';
+  readonly buildRunId: string;
+  readonly gameVersion: string;
+  readonly sourceGitSha: string;
+  readonly kitGitSha: string;
+  readonly kitPackageVersion: string;
+  readonly buildConfigDigest: string;
+  readonly targetConfigDigest: string;
+  /** Absent only on historical build records predating deployment-profile binding. */
+  readonly deployConfigSha256?: string;
+  readonly deploymentProfile?: string;
+  readonly deploymentDestination?: 'play-internal' | 'testflight';
+  readonly internalTestGroupId?: string;
+  readonly platformVersion: Readonly<Record<string, unknown>>;
+  readonly artifactLocation: string;
+  readonly artifactSha256: string;
+  readonly releaseManifestSha256: string;
+  readonly inspectedAppId: string;
+  readonly inspectedSignerSha256?: string | undefined;
+  readonly inspectedTeamId?: string | undefined;
+}
+export type NativeSubmissionStatus = 'started' | 'edit-open' | 'upload-committed' | 'uploaded' | 'processing' | 'testflight-ready' | 'action-required' | 'failed' | 'unknown' | 'committed';
+export declare function isNativeSubmissionSettled(status: NativeSubmissionStatus): boolean;
+export interface NativeSubmissionCheckpoint {
+  readonly releaseKey: string;
+  readonly target: 'android' | 'ios';
+  readonly buildRunId: string;
+  readonly artifactSha256: string;
+  readonly attemptId: string;
+  readonly leaseExpiresAt: string;
+  readonly status: NativeSubmissionStatus;
+  readonly remoteEditId?: string;
+  readonly remoteUploadId?: string;
+  readonly remoteBuildId?: string;
+}
+export interface NativeReleaseStatus {
+  readonly plan: PlatformVersionReleasePlan;
+  readonly builds: Partial<Record<'android' | 'ios', ImmutableNativeBuildRecord>>;
+  readonly submissions: Partial<Record<'android' | 'ios', NativeSubmissionCheckpoint>>;
+  readonly stateCommit: string;
+}
+export interface RecordNativeBuildInput {
+  readonly gameRoot: string;
+  readonly gameId: string;
+  readonly releaseKey: string;
+  readonly target: 'android' | 'ios';
+  readonly buildRunId: string;
+  readonly kitPackageVersion: string;
+  readonly buildConfigDigest: string;
+  readonly deployConfigSha256?: string;
+  readonly deploymentProfile?: string;
+  readonly deploymentDestination?: 'play-internal' | 'testflight';
+  readonly internalTestGroupId?: string;
+  readonly artifactFile: string;
+  readonly expectedArtifactSha256: string;
+  readonly artifactLocation: string;
+  readonly releaseManifestFile: string;
+  readonly expectedReleaseManifestSha256: string;
+  readonly inspectedAppId: string;
+  readonly inspectedSignerSha256?: string | undefined;
+  readonly inspectedTeamId?: string | undefined;
+  readonly environment?: NodeJS.ProcessEnv;
+  readonly signal?: AbortSignal;
+}
+/** Leave one minute of clock-skew headroom below the checkpoint lease cap. */
+export declare function freshSubmissionLeaseExpiresAt(): string;
+/** Reserve version numbers by committing the ledger and plan atomically. */
+export declare function reserveNativeRelease(input: NativeReleaseReservationInput): Promise<NativeReleaseReservation>;
+/** Attach one immutable, content-hashed native artifact to a reserved release. */
+export declare function recordNativeReleaseBuild(input: RecordNativeBuildInput): Promise<{
+  readonly record: ImmutableNativeBuildRecord;
+  readonly stateCommit: string;
+}>;
+/** Read one explicitly named release from the authoritative game-owned state branch. */
+export declare function readNativeReleaseStatus(input: {
+  readonly gameRoot: string;
+  readonly gameId: string;
+  readonly releaseKey: string;
+  readonly environment?: NodeJS.ProcessEnv;
+  readonly signal?: AbortSignal;
+}): Promise<NativeReleaseStatus>;
+/** Persist a resumable store checkpoint with the build record in one Git state. */
+export declare function checkpointNativeSubmission(input: {
+  readonly gameRoot: string;
+  readonly gameId: string;
+  readonly checkpoint: NativeSubmissionCheckpoint;
+  readonly environment?: NodeJS.ProcessEnv;
+  readonly signal?: AbortSignal;
+}): Promise<{
+  readonly checkpoint: NativeSubmissionCheckpoint;
+  readonly stateCommit: string;
+}>;
+/** Claim an expired attempt without discarding its remote IDs or changing its status. */
+export declare function reclaimNativeSubmission(input: {
+  readonly gameRoot: string;
+  readonly gameId: string;
+  readonly releaseKey: string;
+  readonly target: 'android' | 'ios';
+  readonly expectedStateCommit: string;
+  readonly attemptId: string;
+  readonly environment?: NodeJS.ProcessEnv;
+  readonly signal?: AbortSignal;
+}): Promise<{
+  readonly checkpoint: NativeSubmissionCheckpoint;
+  readonly stateCommit: string;
+}>;
+/** Relinquish a completed command's lease so an immediate status poll can resume. */
+export declare function releaseNativeSubmissionLease(input: {
+  readonly gameRoot: string;
+  readonly gameId: string;
+  readonly releaseKey: string;
+  readonly target: 'android' | 'ios';
+  readonly attemptId: string;
+  readonly environment?: NodeJS.ProcessEnv;
+  readonly signal?: AbortSignal;
+}): Promise<NativeSubmissionCheckpoint>;
+/** Validate persisted checkpoint shape before any remote mutation or recovery. */
+export declare function assertNativeSubmissionCheckpoint(value: unknown): asserts value is NativeSubmissionCheckpoint;