@mpgd/cli 0.35.0 → 0.36.0

package/dist/native-deploy-submission.js

@@ -0,0 +1,244 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { readFileSync, realpathSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { checkpointNativeSubmission, freshSubmissionLeaseExpiresAt, isNativeSubmissionSettled, readNativeReleaseStatus, reclaimNativeSubmission, releaseNativeSubmissionLease, } from './release-state.js';
+import { PlaySubmissionUncertainError, submitVerifiedAndroidBundle, } from './play-internal-submission.js';
+import { IosSubmissionUncertainError, submitVerifiedIosBuild, } from './testflight-submission.js';
+const productionPorts = {
+    readStatus: readNativeReleaseStatus,
+    checkpoint: checkpointNativeSubmission,
+    reclaim: reclaimNativeSubmission,
+    releaseLease: releaseNativeSubmissionLease,
+    submitAndroid: submitVerifiedAndroidBundle,
+    submitIos: submitVerifiedIosBuild,
+};
+/** Resume exactly one verified build; never rebuild or allocate another version here. */
+export async function submitRecordedNativeTarget(input) {
+    return submitRecordedNativeTargetWithPorts(input, productionPorts);
+}
+export async function submitRecordedNativeTargetWithPorts(input, ports) {
+    const target = input.credential.target;
+    const planned = input.plan.targets.find((entry) => entry.target === target);
+    if (planned === undefined || !input.approved) {
+        throw new Error('Native store submission requires a planned target and explicit approval.');
+    }
+    const stateInput = {
+        gameRoot: input.plan.gameRoot,
+        gameId: input.gameId,
+        ...(input.environment === undefined ? {} : { environment: input.environment }),
+        ...(input.signal === undefined ? {} : { signal: input.signal }),
+    };
+    const status = await ports.readStatus({ ...stateInput, releaseKey: input.releaseKey });
+    if (status.plan.targetConfigDigest !== input.plan.targetConfigSha256
+        || status.plan.gameId !== input.gameId
+        || status.plan.targets[target] === undefined) {
+        throw new Error('Store submission plan differs from the reserved release.');
+    }
+    const record = status.builds[target];
+    if (record === undefined || record.releaseKey !== input.releaseKey
+        || record.target !== target || record.inspectedAppId !== planned.appId
+        || record.deployConfigSha256 !== input.plan.deployConfigSha256
+        || record.deploymentProfile !== input.plan.profile
+        || record.deploymentDestination !== planned.destination
+        || record.internalTestGroupId !== planned.testGroup) {
+        throw new Error('Store submission requires a matching immutable native build record.');
+    }
+    const artifactFile = resolveRecordedArtifact(input.plan.gameRoot, record.artifactLocation);
+    let checkpoint = status.submissions[target];
+    if (checkpoint !== undefined && isNativeSubmissionSettled(checkpoint.status)) {
+        return checkpoint;
+    }
+    if (input.environment?.MPGD_VERIFY_RELEASE_MANIFEST === '1') {
+        verifyRecordedReleaseManifest(input.plan.gameRoot, record);
+    }
+    if (checkpoint?.status === 'failed'
+        || (checkpoint?.status === 'action-required'
+            && checkpoint.remoteUploadId === undefined && checkpoint.remoteBuildId === undefined)
+        || (checkpoint?.status === 'unknown'
+            && checkpoint.remoteEditId === undefined && checkpoint.remoteUploadId === undefined
+            && checkpoint.remoteBuildId === undefined)) {
+        throw new Error('Submission requires operator reconciliation before another store call.');
+    }
+    if (checkpoint === undefined) {
+        checkpoint = (await ports.checkpoint({
+            ...stateInput,
+            checkpoint: {
+                releaseKey: input.releaseKey,
+                target,
+                buildRunId: record.buildRunId,
+                artifactSha256: record.artifactSha256,
+                attemptId: randomBytes(16).toString('hex'),
+                leaseExpiresAt: freshSubmissionLeaseExpiresAt(),
+                status: 'started',
+            },
+        })).checkpoint;
+    }
+    else if (Date.parse(checkpoint.leaseExpiresAt) <= Date.now()) {
+        checkpoint = (await ports.reclaim({
+            ...stateInput,
+            releaseKey: input.releaseKey,
+            target,
+            expectedStateCommit: status.stateCommit,
+            attemptId: randomBytes(16).toString('hex'),
+        })).checkpoint;
+    }
+    else if (input.attemptId !== checkpoint.attemptId) {
+        throw new Error('Another submission attempt owns the active release lease.');
+    }
+    if (checkpoint.buildRunId !== record.buildRunId
+        || checkpoint.artifactSha256 !== record.artifactSha256) {
+        throw new Error('Submission checkpoint no longer matches its immutable build.');
+    }
+    let activeCheckpoint = checkpoint;
+    const save = async (patch) => {
+        activeCheckpoint = (await ports.checkpoint({
+            ...stateInput,
+            checkpoint: {
+                ...activeCheckpoint,
+                ...patch,
+                leaseExpiresAt: freshSubmissionLeaseExpiresAt(),
+            },
+        })).checkpoint;
+    };
+    const releaseLease = async () => {
+        activeCheckpoint = await ports.releaseLease({
+            ...stateInput,
+            releaseKey: input.releaseKey,
+            target,
+            attemptId: activeCheckpoint.attemptId,
+        });
+    };
+    if (input.credential.target === 'android') {
+        let result;
+        try {
+            result = await ports.submitAndroid({
+                record,
+                aabFile: artifactFile,
+                packageName: planned.appId,
+                serviceAccountFile: input.credential.serviceAccountFile,
+                ...(activeCheckpoint.remoteEditId === undefined ? {} : {
+                    resumeEditId: activeCheckpoint.remoteEditId,
+                }),
+                onEditCreated: async (editId) => {
+                    await save({ status: 'edit-open', remoteEditId: editId });
+                },
+                ...(input.signal === undefined ? {} : { signal: input.signal }),
+            });
+        }
+        catch (error) {
+            try {
+                if (error instanceof PlaySubmissionUncertainError) {
+                    if (error.stage === 'checkpoint'
+                        && activeCheckpoint.remoteEditId !== undefined
+                        && activeCheckpoint.remoteEditId !== error.editId) {
+                        await save({ status: 'edit-open', remoteEditId: error.editId });
+                    }
+                    await save({ status: 'unknown', remoteEditId: error.editId });
+                }
+                else {
+                    await save({
+                        status: activeCheckpoint.remoteEditId === undefined ? 'started' : 'unknown',
+                    });
+                }
+                await releaseLease();
+            }
+            catch (persistenceError) {
+                throw new AggregateError([error, persistenceError], `Google Play submission failed and its checkpoint could not be persisted${error instanceof PlaySubmissionUncertainError ? ` for edit ${error.editId}` : ''}.`);
+            }
+            throw error;
+        }
+        await save({ status: 'committed', remoteEditId: result.editId });
+    }
+    else {
+        if (planned.testGroup === undefined) {
+            throw new Error('TestFlight submission requires an internal group ID.');
+        }
+        let result;
+        try {
+            result = await ports.submitIos({
+                record,
+                ipaFile: artifactFile,
+                bundleId: planned.appId,
+                appStoreAppId: input.credential.appStoreAppId,
+                internalGroupId: planned.testGroup,
+                ascBinary: input.credential.ascBinary,
+                apiKeyId: input.credential.apiKeyId,
+                apiIssuerId: input.credential.apiIssuerId,
+                apiPrivateKeyBase64: input.credential.apiPrivateKeyBase64,
+                ...(activeCheckpoint.remoteUploadId === undefined ? {} : {
+                    resumeUploadId: activeCheckpoint.remoteUploadId,
+                    resumeArtifactSha256: activeCheckpoint.artifactSha256,
+                }),
+                ...(activeCheckpoint.remoteBuildId === undefined ? {} : {
+                    resumeBuildId: activeCheckpoint.remoteBuildId,
+                }),
+                onUploadCommitted: async (uploadId) => {
+                    await save({ status: 'upload-committed', remoteUploadId: uploadId });
+                },
+                ...(input.signal === undefined ? {} : { signal: input.signal }),
+            });
+        }
+        catch (error) {
+            try {
+                if (error instanceof IosSubmissionUncertainError) {
+                    await save({ status: 'unknown', remoteUploadId: error.uploadId });
+                }
+                else {
+                    await save({
+                        status: activeCheckpoint.remoteUploadId === undefined
+                            && activeCheckpoint.remoteBuildId === undefined ? 'started' : 'unknown',
+                    });
+                }
+                await releaseLease();
+            }
+            catch (persistenceError) {
+                throw new AggregateError([error, persistenceError], `TestFlight submission failed and its checkpoint could not be persisted${error instanceof IosSubmissionUncertainError ? ` for upload ${error.uploadId}` : ''}.`);
+            }
+            throw error;
+        }
+        await save({
+            status: result.status,
+            ...(result.uploadId === undefined ? {} : { remoteUploadId: result.uploadId }),
+            ...(result.buildId === undefined ? {} : { remoteBuildId: result.buildId }),
+        });
+        if (activeCheckpoint.status !== 'testflight-ready') {
+            await releaseLease();
+        }
+    }
+    return activeCheckpoint;
+}
+/** Validate the workflow-restored manifest against the immutable release-state hash. */
+export function verifyRecordedReleaseManifest(gameRoot, record) {
+    if (!/^[0-9a-f]{64}$/u.test(record.releaseManifestSha256)) {
+        throw new Error('Recorded release manifest hash is invalid.');
+    }
+    const location = path.posix.join(path.posix.dirname(record.artifactLocation), `${record.target}-manifest-${record.releaseManifestSha256}.json`);
+    let manifestFile;
+    try {
+        manifestFile = resolveRecordedArtifact(gameRoot, location);
+    }
+    catch {
+        throw new Error('Recorded release manifest is missing or outside the game directory.');
+    }
+    const metadata = statSync(manifestFile);
+    if (!metadata.isFile() || metadata.size > 2 * 1024 * 1024) {
+        throw new Error('Recorded release manifest is not a bounded file.');
+    }
+    const digest = createHash('sha256').update(readFileSync(manifestFile)).digest('hex');
+    if (digest !== record.releaseManifestSha256) {
+        throw new Error('Restored release manifest differs from the immutable build record.');
+    }
+}
+function resolveRecordedArtifact(gameRoot, recordedLocation) {
+    if (path.isAbsolute(recordedLocation)) {
+        throw new Error('Native artifact location must be game-relative.');
+    }
+    const root = realpathSync(gameRoot);
+    const artifact = realpathSync(path.resolve(root, recordedLocation));
+    const relative = path.relative(root, artifact);
+    if (relative === '' || relative === '..' || relative.startsWith(`..${path.sep}`)
+        || path.isAbsolute(relative)) {
+        throw new Error('Native artifact location escapes the game directory.');
+    }
+    return artifact;
+}

package/dist/native-deploy-workflow.d.ts

@@ -0,0 +1,11 @@
+import { type NativeDeployTarget } from './deploy-planning.js';
+export interface InitializeNativeDeployWorkflowInput {
+  readonly game: string;
+  readonly profile: string;
+  readonly releaseBranch: string;
+  readonly targets?: readonly NativeDeployTarget[];
+  readonly gameId?: string;
+  readonly approvalEnvironment?: string;
+}
+/** Write a game-owned, non-overwriting workflow that calls the installed CLI. */
+export declare function initializeNativeDeployWorkflow(input: InitializeNativeDeployWorkflowInput): string;

package/dist/native-deploy-workflow.js

@@ -0,0 +1,328 @@
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, mkdirSync, realpathSync, writeFileSync } from 'node:fs';
+import { isAbsolute, join, relative, sep } from 'node:path';
+import { planNativeDeployment, readNativeDeployCredentialNames, readNativeDeployTargetProfile, } from './deploy-planning.js';
+import { pinnedAscVersion } from './testflight-submission.js';
+const reservedWorkflowEnvironmentNames = new Set([
+    'PATH',
+    'HOME',
+    'JAVA_HOME',
+    'ANDROID_HOME',
+    'ANDROID_SDK_ROOT',
+    'NODE_OPTIONS',
+    'PNPM_HOME',
+    'COREPACK_HOME',
+    'CI',
+    'NPM_TOKEN',
+    'GITHUB_TOKEN',
+    'GH_TOKEN',
+    'RUNNER_TEMP',
+    'GITHUB_ENV',
+    'GITHUB_SERVER_URL',
+    'GITHUB_WORKSPACE',
+    'SIGNING_B64',
+    'SUBMISSION_B64',
+    'PROFILE_B64',
+    'GAME_PATH',
+    'GAME_ID',
+    'PROFILE',
+    'TARGET',
+    'RELEASE_ID',
+    'RELEASE_KEY',
+    'GAME_VERSION',
+    'INITIAL_LEDGER',
+    'ARTIFACT_RUN_ID',
+    'MPGD_ASC_BINARY',
+    'MPGD_IOS_PROVISIONING_PROFILE',
+    'MPGD_ANDROID_UPLOAD_STORE_PASSWORD',
+    'MPGD_ANDROID_UPLOAD_KEY_ALIAS',
+    'MPGD_ANDROID_UPLOAD_KEY_PASSWORD',
+    'MPGD_ANDROID_UPLOAD_CERT_SHA256',
+    'MPGD_IOS_SIGNING_P12_PASSWORD',
+    'MPGD_IOS_TEAM_ID',
+    'MPGD_ASC_APP_ID',
+    'MPGD_ASC_KEY_ID',
+    'MPGD_ASC_ISSUER_ID',
+    'MPGD_DEPENDENCY_INSTALL_ENV_NAMES',
+    'MPGD_VERIFY_RELEASE_MANIFEST',
+    'MPGD_RECORDED_BUILD_MARKER',
+    'MPGD_NEW_BUILD',
+    'MPGD_CLI_ARGV',
+    'ASC_TELEMETRY_DISABLED',
+]);
+/** Write a game-owned, non-overwriting workflow that calls the installed CLI. */
+export function initializeNativeDeployWorkflow(input) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._/-]*$/u.test(input.releaseBranch)
+        || input.releaseBranch.includes('..') || input.releaseBranch.includes('//')
+        || input.releaseBranch.endsWith('/')) {
+        throw new Error('The native deployment release branch is invalid.');
+    }
+    try {
+        execFileSync('git', ['check-ref-format', '--branch', input.releaseBranch], {
+            stdio: ['ignore', 'ignore', 'ignore'],
+        });
+    }
+    catch {
+        throw new Error('The native deployment release branch is invalid.');
+    }
+    const plan = planNativeDeployment({
+        game: input.game,
+        profile: input.profile,
+        ...(input.targets === undefined ? {} : { targets: input.targets }),
+    });
+    const gameRoot = realpathSync(plan.gameRoot);
+    let repositoryRoot;
+    try {
+        repositoryRoot = realpathSync(execFileSync('git', [
+            '-C', gameRoot, 'rev-parse', '--show-toplevel',
+        ], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim());
+    }
+    catch {
+        throw new Error(`The game must live inside a Git repository: ${gameRoot}`);
+    }
+    const relativeGame = relative(repositoryRoot, gameRoot).split(sep).join('/');
+    if (relativeGame === '..' || relativeGame.startsWith('../')
+        || isAbsolute(relativeGame) || !/^[A-Za-z0-9._/-]*$/u.test(relativeGame)) {
+        throw new Error('The game must use a simple path inside its Git repository.');
+    }
+    const readableName = relativeGame === '' ? 'root' : relativeGame.replaceAll('/', '-');
+    const digest = createHash('sha256').update(relativeGame).digest('hex').slice(0, 8);
+    const slug = `${readableName.slice(0, 40)}-${digest}`.toLowerCase();
+    const gameId = input.gameId ?? slug;
+    if (!/^[a-z0-9][a-z0-9._-]{0,127}$/u.test(gameId)) {
+        const reason = input.gameId === undefined
+            ? 'The game directory must start with a letter or digit, or pass --game-id.'
+            : 'The native deployment game ID is invalid.';
+        throw new Error(reason);
+    }
+    const approvalEnvironment = input.approvalEnvironment ?? `native-${input.profile}`;
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/u.test(approvalEnvironment)) {
+        const reason = input.approvalEnvironment === undefined
+            ? 'The profile name cannot form a CI environment; pass --approval-environment.'
+            : 'The native deployment approval environment is invalid.';
+        throw new Error(reason);
+    }
+    const workflowName = `mpgd-native-${slug}.yml`;
+    const githubDirectory = join(repositoryRoot, '.github');
+    const workflowDirectory = join(githubDirectory, 'workflows');
+    for (const directory of [githubDirectory, workflowDirectory]) {
+        if (existsSync(directory) && lstatSync(directory).isSymbolicLink()) {
+            throw new Error('Native deployment workflow directories must not be symlinks.');
+        }
+    }
+    mkdirSync(workflowDirectory, { recursive: true });
+    const file = join(workflowDirectory, workflowName);
+    const secretPrefix = `MPGD_${slug.toUpperCase().replaceAll(/[^A-Z0-9]/gu, '_')}`;
+    const signingNames = {};
+    const submissionNames = {};
+    for (const name of readNativeDeployCredentialNames(plan)) {
+        if (!name.startsWith('MPGD_') || reservedWorkflowEnvironmentNames.has(name)) {
+            throw new Error(`Credential ${name} must use an unreserved MPGD_ prefix in CI.`);
+        }
+    }
+    for (const entry of plan.targets) {
+        const profile = readNativeDeployTargetProfile(plan, entry.target);
+        if (profile.signingCredential.env === profile.submissionCredential.env) {
+            throw new Error(`${entry.target} credentials need distinct environment names.`);
+        }
+        signingNames[entry.target] = profile.signingCredential.env;
+        submissionNames[entry.target] = profile.submissionCredential.env;
+    }
+    const renderInput = {
+        gamePath: relativeGame === '' ? '.' : relativeGame,
+        gameId,
+        profile: plan.profile,
+        releaseBranch: input.releaseBranch,
+        approvalEnvironment,
+        targets: plan.targets.map((entry) => entry.target),
+        appIds: Object.fromEntries(plan.targets.map((entry) => [entry.target, entry.appId])),
+        secretPrefix,
+        signingNames,
+        submissionNames,
+    };
+    const content = renderNativeDeployWorkflow(renderInput);
+    writeFileSync(file, content, { flag: 'wx', mode: 0o644 });
+    return file;
+}
+function expression(value) {
+    return '$' + `{{ ${value} }}`;
+}
+function quoted(value) {
+    return `'${value.replaceAll("'", "''")}'`;
+}
+function renderNativeDeployWorkflow(input) {
+    const options = input.targets.map((target) => `          - ${target}`);
+    const lines = [
+        '# Generated by mpgd deploy workflow init. Configure the protected environment first.',
+        `name: mpgd-native-${input.gameId}`,
+        '',
+        'on:',
+        '  pull_request:',
+        '  workflow_dispatch:',
+        '    inputs:',
+        '      target:',
+        '        description: Native target to deploy',
+        '        type: choice',
+        '        required: true',
+        '        options:',
+        ...options,
+        '      release:',
+        '        description: Unique release label; the target suffix is added automatically',
+        '        type: string',
+        '        required: true',
+        '      game_version:',
+        '        description: Game SemVer version',
+        '        type: string',
+        '        required: true',
+        '      initial_ledger:',
+        '        description: Committed initial ledger path for a first release only',
+        '        type: string',
+        '        required: false',
+        '      artifact_run_id:',
+        '        description: Earlier workflow run ID to restore an identical recorded binary',
+        '        type: string',
+        '        required: false',
+        '',
+        'permissions:',
+        '  contents: read',
+        '',
+        'jobs:',
+        '  validate:',
+        "    if: github.event_name == 'pull_request'",
+        '    runs-on: ubuntu-latest',
+        '    steps:',
+        '      - uses: actions/checkout@v5',
+        '        with:',
+        '          persist-credentials: false',
+        '      - uses: pnpm/action-setup@v6',
+        '        with:',
+        '          version: 11.7.0',
+        '      - uses: actions/setup-node@v5',
+        '        with:',
+        '          node-version: 24',
+        '          cache: pnpm',
+        '      - run: pnpm install --frozen-lockfile',
+        '      - name: Validate deployment plan without secrets',
+        '        env:',
+        `          GAME_PATH: ${quoted(input.gamePath)}`,
+        `          PROFILE: ${quoted(input.profile)}`,
+        `          TARGETS: ${quoted(input.targets.join(','))}`,
+        '        run: |',
+        '          pnpm --dir "$GAME_PATH" exec mpgd deploy plan --game . --profile "$PROFILE" \\',
+        '            --targets "$TARGETS" --out "$RUNNER_TEMP/mpgd-pr-plan.json"',
+        '      - run: pnpm --dir ' + quoted(input.gamePath)
+            + ' run --if-present test:deploy-mock',
+    ];
+    for (const target of input.targets) {
+        lines.push(...renderDeployJob(input, target));
+    }
+    return `${lines.join('\n')}\n`;
+}
+function renderDeployJob(input, target) {
+    const appId = input.appIds[target];
+    if (appId === undefined) {
+        throw new Error(`Missing ${target} app ID in the deployment plan.`);
+    }
+    const secret = (suffix) => expression(`secrets.${input.secretPrefix}_${suffix}`);
+    const lines = [
+        `  deploy_${target}:`,
+        `    if: github.event_name == 'workflow_dispatch' && github.ref == `
+            + `'refs/heads/${input.releaseBranch}' && inputs.target == '${target}'`,
+        `    runs-on: ${target === 'android' ? 'ubuntu-latest' : 'macos-26'}`,
+        `    environment: ${quoted(input.approvalEnvironment)}`,
+        '    permissions:',
+        '      contents: write',
+        '      actions: read',
+        '    concurrency:',
+        `      group: mpgd-${appId}-${target}-${expression('github.repository')}`,
+        '      cancel-in-progress: false',
+        '    env:',
+        `      GAME_PATH: ${quoted(input.gamePath)}`,
+        `      GAME_ID: ${quoted(input.gameId)}`,
+        `      PROFILE: ${quoted(input.profile)}`,
+        `      TARGET: ${target}`,
+        `      RELEASE_ID: ${expression('inputs.release')}`,
+        `      GAME_VERSION: ${expression('inputs.game_version')}`,
+        `      INITIAL_LEDGER: ${expression('inputs.initial_ledger')}`,
+        `      ARTIFACT_RUN_ID: ${expression('inputs.artifact_run_id')}`,
+        '    steps:',
+        '      - uses: actions/checkout@v5',
+        '        with:',
+        '          fetch-depth: 0',
+        '          persist-credentials: false',
+        '      - uses: pnpm/action-setup@v6',
+        '        with:',
+        '          version: 11.7.0',
+        '      - uses: actions/setup-node@v5',
+        '        with:',
+        '          node-version: 24',
+        '          cache: pnpm',
+    ];
+    if (target === 'android') {
+        lines.push('      - uses: actions/setup-java@v5', '        with:', '          distribution: temurin', '          java-version: 21', '      - uses: android-actions/setup-android@v4', '        with:', "          packages: ''", '      - run: sdkmanager "platforms;android-36" "build-tools;36.0.0"');
+    }
+    lines.push('      - name: Install committed game dependencies', '        env:', `          NPM_TOKEN: ${secret('NPM_READ_TOKEN')}`, '        run: pnpm install --frozen-lockfile', '      - name: Prepare explicit release and read-only plan', '        shell: bash', '        run: |', '          set -euo pipefail', '          [[ "$RELEASE_ID" =~ ^[a-z0-9][a-z0-9._-]{0,100}$ ]]', '          if [[ -n "$ARTIFACT_RUN_ID" ]]; then', '            [[ "$ARTIFACT_RUN_ID" =~ ^[0-9]+$ ]]', '          fi', '          echo "RELEASE_KEY=$RELEASE_ID-$TARGET" >> "$GITHUB_ENV"', '          pnpm --dir "$GAME_PATH" exec mpgd deploy plan --game . --profile "$PROFILE" \\', '            --targets "$TARGET" --out "$RUNNER_TEMP/mpgd-$TARGET-plan.json"', '      - name: Keep release artifacts out of the Git index', '        shell: bash', '        run: |', '          set -euo pipefail', '          if [[ -n "$(git ls-files -- "$GAME_PATH/.mpgd")" ]]; then', '            echo "Tracked .mpgd files would be overwritten by artifact restore" >&2', '            exit 1', '          fi', '          game_prefix="$(git -C "$GAME_PATH" rev-parse --show-prefix)"', '          printf "/%s.mpgd/\\n" "$game_prefix" >> "$(git rev-parse --git-path info/exclude)"', '          git check-ignore -q -- "$GAME_PATH/.mpgd/releases/ignore-probe"', '      - name: Restore the exact recorded release bundle', "        if: inputs.artifact_run_id != ''", '        uses: actions/download-artifact@v7', '        with:', `          name: ${input.gameId}-${target}-${expression('env.RELEASE_KEY')}-release`, `          run-id: ${expression('inputs.artifact_run_id')}`, `          github-token: ${expression('github.token')}`, `          path: ${input.gamePath}/.mpgd/releases/${expression('env.RELEASE_KEY')}`, '      - name: Deploy verified internal-test binary', '        shell: bash', '        env:', `          NPM_TOKEN: ${secret('NPM_READ_TOKEN')}`, `          GITHUB_TOKEN: ${expression('github.token')}`, '          MPGD_VERIFY_RELEASE_MANIFEST: "1"');
+    lines.push(...renderCredentialEnvironment(target, secret));
+    lines.push('        run: |', '          set -euo pipefail', '          umask 077', '          secret_dir="$(mktemp -d)"', '          trap \'rm -rf -- "$secret_dir"\' EXIT', '          git_auth="$(node -e \'process.stdout.write(', '            Buffer.from("x-access-token:"+process.env.GITHUB_TOKEN).toString("base64"))\')"', '          [[ "$GITHUB_SERVER_URL" == https://* ]]', '          export GIT_CONFIG_COUNT=1', '          export GIT_CONFIG_KEY_0="http.${GITHUB_SERVER_URL%/}/.extraheader"', '          export GIT_CONFIG_VALUE_0="AUTHORIZATION: basic $git_auth"', '          write_secret() {', '            node -e \'const fs=require("node:fs"); const name=process.argv[1];', '              const value=process.env[name]; if (!value) throw Error(`Missing ${name}`);', '              const decoded=Buffer.from(value,"base64");', '              if (!decoded.length || decoded.toString("base64") !== value.trim())', '                throw Error(`Invalid ${name}`);', '              fs.writeFileSync(process.argv[2], decoded, {mode:0o600});\' "$1" "$2"', '          }');
+    lines.push(...renderCredentialSetup(input, target));
+    lines.push('          if [[ -n "$NPM_TOKEN" ]]; then', '            export MPGD_DEPENDENCY_INSTALL_ENV_NAMES=NPM_TOKEN', '          fi', '          export MPGD_RECORDED_BUILD_MARKER="$RUNNER_TEMP/mpgd-$TARGET-recorded-build"', '          args=(deploy run --plan "$RUNNER_TEMP/mpgd-$TARGET-plan.json"', '            --game . --game-id "$GAME_ID" --game-version "$GAME_VERSION"', '            --release "$RELEASE_KEY" --approve)', '          if [[ -n "$INITIAL_LEDGER" ]]; then', '            [[ "$INITIAL_LEDGER" =~ ^[A-Za-z0-9._/-]+$ ]]', '            [[ "$INITIAL_LEDGER" != /* && "$INITIAL_LEDGER" != *..* ]]', '            git ls-files --error-unmatch -- "$INITIAL_LEDGER" >/dev/null', '            args+=(--initial-ledger "$GITHUB_WORKSPACE/$INITIAL_LEDGER")', '          fi', '          pnpm --dir "$GAME_PATH" exec mpgd "${args[@]}"', '      - name: Detect a newly recorded binary', "        if: always() && env.RELEASE_KEY != ''", '        shell: bash', '        run: |', '          set -euo pipefail', '          if [[ -f "$RUNNER_TEMP/mpgd-$TARGET-recorded-build" ]] &&', '            grep -Fxq -- "$TARGET" "$RUNNER_TEMP/mpgd-$TARGET-recorded-build"; then', '            echo "MPGD_NEW_BUILD=1" >> "$GITHUB_ENV"', '          fi', '      - name: Retain verified release bundle', "        if: always() && env.RELEASE_KEY != '' && env.MPGD_NEW_BUILD == '1'", '        uses: actions/upload-artifact@v6', '        with:', `          name: ${input.gameId}-${target}-${expression('env.RELEASE_KEY')}-release`, `          path: ${input.gamePath}/.mpgd/releases/${expression('env.RELEASE_KEY')}`, '          if-no-files-found: error', '          include-hidden-files: true', '          retention-days: 30');
+    return lines;
+}
+function renderCredentialEnvironment(target, secret) {
+    if (target === 'android') {
+        return [
+            `          SIGNING_B64: ${secret('ANDROID_KEYSTORE_B64')}`,
+            `          SUBMISSION_B64: ${secret('PLAY_SERVICE_ACCOUNT_B64')}`,
+            `          MPGD_ANDROID_UPLOAD_STORE_PASSWORD: ${secret('ANDROID_STORE_PASSWORD')}`,
+            `          MPGD_ANDROID_UPLOAD_KEY_ALIAS: ${secret('ANDROID_KEY_ALIAS')}`,
+            `          MPGD_ANDROID_UPLOAD_KEY_PASSWORD: ${secret('ANDROID_KEY_PASSWORD')}`,
+            `          MPGD_ANDROID_UPLOAD_CERT_SHA256: ${secret('ANDROID_CERT_SHA256')}`,
+        ];
+    }
+    return [
+        `          SIGNING_B64: ${secret('IOS_P12_B64')}`,
+        `          PROFILE_B64: ${secret('IOS_PROFILE_B64')}`,
+        `          SUBMISSION_B64: ${secret('ASC_API_KEY_B64')}`,
+        `          MPGD_IOS_SIGNING_P12_PASSWORD: ${secret('IOS_P12_PASSWORD')}`,
+        `          MPGD_IOS_TEAM_ID: ${secret('IOS_TEAM_ID')}`,
+        `          MPGD_ASC_APP_ID: ${secret('ASC_APP_ID')}`,
+        `          MPGD_ASC_KEY_ID: ${secret('ASC_KEY_ID')}`,
+        `          MPGD_ASC_ISSUER_ID: ${secret('ASC_ISSUER_ID')}`,
+        '          ASC_TELEMETRY_DISABLED: 1',
+    ];
+}
+function renderCredentialSetup(input, target) {
+    const signingName = input.signingNames[target];
+    const submissionName = input.submissionNames[target];
+    if (signingName === undefined || submissionName === undefined) {
+        throw new Error(`Missing ${target} deployment credential references.`);
+    }
+    if (target === 'android') {
+        return [
+            '          write_secret SIGNING_B64 "$secret_dir/upload.keystore"',
+            '          write_secret SUBMISSION_B64 "$secret_dir/play-service-account.json"',
+            `          export ${signingName}="$secret_dir/upload.keystore"`,
+            `          export ${submissionName}="$secret_dir/play-service-account.json"`,
+            '          unset SIGNING_B64 SUBMISSION_B64',
+        ];
+    }
+    return [
+        '          write_secret SIGNING_B64 "$secret_dir/signing.p12"',
+        '          write_secret PROFILE_B64 "$secret_dir/profile.mobileprovision"',
+        `          export ${signingName}="$secret_dir/signing.p12"`,
+        `          export ${submissionName}="$SUBMISSION_B64"`,
+        '          export MPGD_IOS_PROVISIONING_PROFILE="$secret_dir/profile.mobileprovision"',
+        '          unset SIGNING_B64 PROFILE_B64 SUBMISSION_B64',
+        '          case "$(uname -m)" in',
+        `            arm64) asc_asset=asc_${pinnedAscVersion}_macOS_arm64 ;;`,
+        `            x86_64) asc_asset=asc_${pinnedAscVersion}_macOS_amd64 ;;`,
+        '            *) echo "Unsupported macOS architecture" >&2; exit 1 ;;',
+        '          esac',
+        '          curl -fL --retry 3 \\',
+        `            "https://github.com/rorkai/App-Store-Connect-CLI/releases/download/${pinnedAscVersion}/$asc_asset" \\`,
+        '            -o "$secret_dir/asc"',
+        '          chmod 700 "$secret_dir/asc"',
+        '          export MPGD_ASC_BINARY="$secret_dir/asc"',
+    ];
+}

package/dist/play-internal-submission.d.ts

@@ -0,0 +1,32 @@
+import type { PlayPublisher } from './play-publisher-port.js';
+import type { ImmutableNativeBuildRecord } from './release-state.js';
+export interface PlayInternalSubmissionInput {
+  readonly record: ImmutableNativeBuildRecord;
+  readonly aabFile: string;
+  readonly packageName: string;
+  /** Absolute path to a game-owned Google service account JSON file. */
+  readonly serviceAccountFile: string;
+  /** Reuse the checkpointed edit; never create a replacement after an uncertain response. */
+  readonly resumeEditId?: string;
+  /** Persist this edit ID before any upload begins, for later reconciliation. */
+  readonly onEditCreated?: (editId: string) => Promise<void>;
+  readonly signal?: AbortSignal;
+}
+export interface PlayInternalSubmissionResult {
+  readonly status: 'committed';
+  readonly packageName: string;
+  readonly editId: string;
+  readonly track: 'internal';
+  readonly versionCode: number;
+  readonly bundleSha256: string;
+  readonly alreadyCommitted: boolean;
+}
+export declare class PlaySubmissionUncertainError extends Error {
+  readonly stage: 'checkpoint' | 'upload' | 'track-update' | 'validate' | 'commit';
+  readonly editId: string;
+  constructor(stage: 'checkpoint' | 'upload' | 'track-update' | 'validate' | 'commit', editId: string);
+}
+/** Submit only a previously inspected, immutable Android build record. */
+export declare function submitVerifiedAndroidBundle(input: PlayInternalSubmissionInput): Promise<PlayInternalSubmissionResult>;
+/** Internal injection point for credential-free SDK contract tests. */
+export declare function submitVerifiedAndroidBundleWithPublisher(input: PlayInternalSubmissionInput, publisher: PlayPublisher, requestRootUrl?: string): Promise<PlayInternalSubmissionResult>;