@rawdash/connector-google-play-console 0.28.0 → 0.29.0

package/dist/index.js

@@ -1,8 +1,181 @@
-// ../../connector-shared/dist/index.js
+// ../gcp-shared/dist/index.js
+import { z } from "zod";
+import { z as z2 } from "zod";
+import { z as z3 } from "zod";
+var serviceAccountKeySchema = z.object({
+  client_email: z.string().min(1),
+  private_key: z.string().min(1),
+  token_uri: z.string().url().optional(),
+  project_id: z.string().optional()
+});
+var tokenResponseSchema = z.object({
+  access_token: z.string().min(1),
+  expires_in: z.number().int().positive().optional()
+});
+function base64urlFromBytes(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function base64urlFromString(str) {
+  return base64urlFromBytes(new TextEncoder().encode(str));
+}
+async function signRS256JWT(payload, privateKeyPem) {
+  const header = { alg: "RS256", typ: "JWT" };
+  const headerB64 = base64urlFromString(JSON.stringify(header));
+  const payloadB64 = base64urlFromString(JSON.stringify(payload));
+  const signingInput = `${headerB64}.${payloadB64}`;
+  const pemContent = privateKeyPem.replace(/-----BEGIN PRIVATE KEY-----/g, "").replace(/-----END PRIVATE KEY-----/g, "").replace(/\s/g, "");
+  const der = Uint8Array.from(atob(pemContent), (c) => c.charCodeAt(0));
+  const key = await globalThis.crypto.subtle.importKey(
+    "pkcs8",
+    der,
+    { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await globalThis.crypto.subtle.sign(
+    "RSASSA-PKCS1-v1_5",
+    key,
+    new TextEncoder().encode(signingInput)
+  );
+  return `${signingInput}.${base64urlFromBytes(new Uint8Array(signature))}`;
+}
+function parseServiceAccountJson(value) {
+  if (typeof value === "object" && value !== null) {
+    return serviceAccountKeySchema.parse(value);
+  }
+  if (typeof value !== "string") {
+    throw new Error(
+      `serviceAccountJson must be a JSON object, raw JSON string, or base64-encoded JSON, but received ${typeof value}`
+    );
+  }
+  const trimmed = value.trim();
+  if (trimmed.startsWith("{")) {
+    return serviceAccountKeySchema.parse(JSON.parse(trimmed));
+  }
+  const binary = atob(trimmed);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  const decoded = new TextDecoder().decode(bytes);
+  return serviceAccountKeySchema.parse(JSON.parse(decoded));
+}
+async function buildServiceAccountJwt(serviceAccountJson, scope) {
+  const sa = parseServiceAccountJson(serviceAccountJson);
+  const now = Math.floor(Date.now() / 1e3);
+  const jwt = await signRS256JWT(
+    {
+      iss: sa.client_email,
+      scope,
+      aud: sa.token_uri ?? "https://oauth2.googleapis.com/token",
+      exp: now + 3600,
+      iat: now
+    },
+    sa.private_key
+  );
+  const body = new URLSearchParams({
+    grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+    assertion: jwt
+  }).toString();
+  return {
+    url: sa.token_uri ?? "https://oauth2.googleapis.com/token",
+    body
+  };
+}
+function buildRefreshTokenGrant(credentials) {
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: credentials.refreshToken,
+    client_id: credentials.clientId,
+    client_secret: credentials.clientSecret
+  }).toString();
+  return { url: "https://oauth2.googleapis.com/token", body };
+}
+var gcpAuthConfigShape = {
+  serviceAccountJson: z2.object({ $secret: z2.string().trim().min(1) }).meta({
+    label: "Service Account JSON",
+    description: "Contents of the JSON key file for a Google service account with the role required by this connector. Create one at Google Cloud -> IAM & Admin -> Service Accounts and store the JSON as a secret.",
+    secret: true
+  })
+};
+var HttpClientError = class extends Error {
+  response;
+  constructor(message, response) {
+    super(message);
+    this.name = new.target.name;
+    this.response = response;
+  }
+};
+var AuthError = class extends HttpClientError {
+  kind = "auth";
+};
 var HTTP_CLIENT_VERSION = "0.0.0";
 var DEFAULT_USER_AGENT = `rawdash-connector/${HTTP_CLIENT_VERSION} (+https://rawdash.dev)`;
+var bqQueryResponseSchema = z3.object({
+  jobComplete: z3.boolean().optional(),
+  schema: z3.object({
+    fields: z3.array(z3.object({ name: z3.string(), type: z3.string() }))
+  }).optional(),
+  rows: z3.array(
+    z3.object({
+      f: z3.array(z3.object({ v: z3.string().nullable().optional() }))
+    })
+  ).optional(),
+  pageToken: z3.string().optional(),
+  jobReference: z3.object({
+    projectId: z3.string(),
+    jobId: z3.string(),
+    location: z3.string().optional()
+  }).optional()
+});
+var GcpAccessTokenProvider = class {
+  constructor(opts) {
+    this.opts = opts;
+  }
+  opts;
+  cached = null;
+  async resolveGrant() {
+    const serviceAccountJson = this.opts.getServiceAccountJson();
+    if (serviceAccountJson) {
+      return buildServiceAccountJwt(serviceAccountJson, this.opts.scope);
+    }
+    const refreshTokenCredentials = this.opts.getRefreshTokenCredentials?.();
+    if (refreshTokenCredentials) {
+      return buildRefreshTokenGrant(refreshTokenCredentials);
+    }
+    throw new AuthError(
+      `${this.opts.connectorId}: missing serviceAccountJson or refresh-token credentials`
+    );
+  }
+  async getToken(signal) {
+    if (this.cached && Date.now() < this.cached.expiresAt) {
+      return this.cached.token;
+    }
+    const { url, body } = await this.resolveGrant();
+    const res = await this.opts.post(url, {
+      resource: "oauth_token",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body,
+      signal
+    });
+    const expiresIn = res.body.expires_in ?? 3600;
+    this.cached = {
+      token: res.body.access_token,
+      expiresAt: Date.now() + (expiresIn - 60) * 1e3
+    };
+    return this.cached.token;
+  }
+};
+
+// ../../connector-shared/dist/index.js
+var HTTP_CLIENT_VERSION2 = "0.0.0";
+var DEFAULT_USER_AGENT2 = `rawdash-connector/${HTTP_CLIENT_VERSION2} (+https://rawdash.dev)`;
 function connectorUserAgent(connectorId) {
-  return `rawdash-connector-${connectorId}/${HTTP_CLIENT_VERSION} (+https://rawdash.dev)`;
+  return `rawdash-connector-${connectorId}/${HTTP_CLIENT_VERSION2} (+https://rawdash.dev)`;
 }
 
 // src/google-play-console.ts
@@ -14,30 +187,276 @@ import {
   schemasFromResources,
   selectActivePhases
 } from "@rawdash/core";
-import { z } from "zod";
+import { z as z4 } from "zod";
+
+// src/installs.ts
+var INSTALLS_BREAKDOWNS = [
+  {
+    resource: "gplay_installs_overview_by_day",
+    fileDimension: "overview",
+    phase: "installs_overview",
+    responseTag: "installs_overview",
+    dimensionAttr: null,
+    dimensionDescription: "",
+    description: "Daily install statistics for the app from the Play Console monthly installs report (stats/installs overview CSV). Primary value is Daily Device Installs; uninstalls, upgrades, active-device installs and user-keyed counts are carried as additional attributes."
+  },
+  {
+    resource: "gplay_installs_by_country",
+    fileDimension: "country",
+    phase: "installs_country",
+    responseTag: "installs_country",
+    dimensionAttr: "country",
+    dimensionDescription: "ISO 3166-1 alpha-2 country/region code the installs are attributed to.",
+    description: "Daily install statistics broken down by country/region from the Play Console monthly installs report (stats/installs country CSV)."
+  },
+  {
+    resource: "gplay_installs_by_app_version",
+    fileDimension: "app_version",
+    phase: "installs_app_version",
+    responseTag: "installs_app_version",
+    dimensionAttr: "app_version_code",
+    dimensionDescription: "Android versionCode the installs are attributed to.",
+    description: "Daily install statistics broken down by app version code from the Play Console monthly installs report (stats/installs app_version CSV)."
+  },
+  {
+    resource: "gplay_installs_by_device",
+    fileDimension: "device",
+    phase: "installs_device",
+    responseTag: "installs_device",
+    dimensionAttr: "device",
+    dimensionDescription: "Device codename the installs are attributed to.",
+    description: "Daily install statistics broken down by device from the Play Console monthly installs report (stats/installs device CSV)."
+  },
+  {
+    resource: "gplay_installs_by_os_version",
+    fileDimension: "os_version",
+    phase: "installs_os_version",
+    responseTag: "installs_os_version",
+    dimensionAttr: "android_os_version",
+    dimensionDescription: "Android API level (SDK version) the installs are attributed to.",
+    description: "Daily install statistics broken down by Android OS version from the Play Console monthly installs report (stats/installs os_version CSV)."
+  },
+  {
+    resource: "gplay_installs_by_language",
+    fileDimension: "language",
+    phase: "installs_language",
+    responseTag: "installs_language",
+    dimensionAttr: "language",
+    dimensionDescription: "BCP-47 language/locale code the installs are attributed to.",
+    description: "Daily install statistics broken down by language from the Play Console monthly installs report (stats/installs language CSV)."
+  },
+  {
+    resource: "gplay_installs_by_carrier",
+    fileDimension: "carrier",
+    phase: "installs_carrier",
+    responseTag: "installs_carrier",
+    dimensionAttr: "carrier",
+    dimensionDescription: "Mobile carrier the installs are attributed to.",
+    description: "Daily install statistics broken down by carrier from the Play Console monthly installs report (stats/installs carrier CSV)."
+  }
+];
+var INSTALLS_METRIC_ATTRIBUTES = [
+  "current_device_installs",
+  "active_device_installs",
+  "daily_device_installs",
+  "daily_device_uninstalls",
+  "daily_device_upgrades",
+  "current_user_installs",
+  "total_user_installs",
+  "daily_user_installs",
+  "daily_user_uninstalls"
+];
+var PRIMARY_METRIC_KEY = "daily_device_installs";
+var METRIC_KEY_ALIASES = {
+  installs_on_active_devices: "active_device_installs"
+};
+var KNOWN_METRIC_KEYS = /* @__PURE__ */ new Set([
+  ...INSTALLS_METRIC_ATTRIBUTES,
+  "installs_on_active_devices"
+]);
+var INSTALLS_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+function normalizeInstallsBucketId(value) {
+  return value.trim().replace(/^gs:\/\//i, "").replace(/\/.*$/, "").replace(/\/+$/, "");
+}
+function installsObjectPath(packageName, yyyymm, fileDimension) {
+  return `stats/installs/installs_${packageName}_${yyyymm}_${fileDimension}.csv`;
+}
+function installsMonthsForRange(startDate, endDate) {
+  const start = monthIndex(startDate);
+  const end = monthIndex(endDate);
+  if (start === null || end === null || end < start) {
+    return [];
+  }
+  const months = [];
+  for (let m = start; m <= end; m++) {
+    const year = Math.floor(m / 12);
+    const month = m % 12 + 1;
+    months.push(
+      `${String(year).padStart(4, "0")}${String(month).padStart(2, "0")}`
+    );
+  }
+  return months;
+}
+function monthIndex(date) {
+  if (!INSTALLS_DATE_RE.test(date)) {
+    return null;
+  }
+  const year = Number(date.slice(0, 4));
+  const month = Number(date.slice(5, 7));
+  return year * 12 + (month - 1);
+}
+function decodeUtf16Csv(bytes) {
+  const littleEndian = !(bytes[0] === 254 && bytes[1] === 255);
+  const decoder = new TextDecoder(littleEndian ? "utf-16le" : "utf-16be");
+  const text = decoder.decode(bytes);
+  return text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+}
+function parseCsvRows(text) {
+  const rows = [];
+  let field = "";
+  let row = [];
+  let inQuotes = false;
+  let sawContent = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (inQuotes) {
+      if (c === '"') {
+        if (text[i + 1] === '"') {
+          field += '"';
+          i++;
+        } else {
+          inQuotes = false;
+        }
+      } else {
+        field += c;
+      }
+      continue;
+    }
+    if (c === '"') {
+      inQuotes = true;
+      sawContent = true;
+    } else if (c === ",") {
+      row.push(field);
+      field = "";
+      sawContent = true;
+    } else if (c === "\n" || c === "\r") {
+      if (c === "\r" && text[i + 1] === "\n") {
+        i++;
+      }
+      if (sawContent || field.length > 0 || row.length > 0) {
+        row.push(field);
+        rows.push(row);
+      }
+      field = "";
+      row = [];
+      sawContent = false;
+    } else {
+      field += c;
+      sawContent = true;
+    }
+  }
+  if (sawContent || field.length > 0 || row.length > 0) {
+    row.push(field);
+    rows.push(row);
+  }
+  return rows;
+}
+function normalizeHeaderKey(header) {
+  return header.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+}
+function installsDateToMs(date) {
+  return Date.UTC(
+    Number(date.slice(0, 4)),
+    Number(date.slice(5, 7)) - 1,
+    Number(date.slice(8, 10))
+  );
+}
+function parseInstallsCsv(text, breakdown, packageName) {
+  const rows = parseCsvRows(text);
+  if (rows.length < 2) {
+    return [];
+  }
+  const header = rows[0].map(normalizeHeaderKey);
+  const dateIdx = header.indexOf("date");
+  if (dateIdx < 0) {
+    return [];
+  }
+  const metricCols = [];
+  let dimIdx = -1;
+  for (let i = 0; i < header.length; i++) {
+    const key = header[i];
+    if (i === dateIdx || key === "package_name") {
+      continue;
+    }
+    if (KNOWN_METRIC_KEYS.has(key)) {
+      metricCols.push({ idx: i, key: METRIC_KEY_ALIASES[key] ?? key });
+    } else if (breakdown.dimensionAttr && dimIdx < 0) {
+      dimIdx = i;
+    }
+  }
+  if (!metricCols.some((mc) => mc.key === PRIMARY_METRIC_KEY)) {
+    return [];
+  }
+  const samples = [];
+  for (let r = 1; r < rows.length; r++) {
+    const cols = rows[r];
+    const dateStr = (cols[dateIdx] ?? "").trim();
+    if (!INSTALLS_DATE_RE.test(dateStr)) {
+      continue;
+    }
+    const attributes = {
+      date: dateStr,
+      package_name: packageName
+    };
+    if (breakdown.dimensionAttr && dimIdx >= 0) {
+      attributes[breakdown.dimensionAttr] = (cols[dimIdx] ?? "").trim();
+    }
+    for (const mc of metricCols) {
+      const raw = (cols[mc.idx] ?? "").trim();
+      const parsed = raw === "" ? 0 : Number(raw);
+      attributes[mc.key] = Number.isFinite(parsed) ? parsed : 0;
+    }
+    const primary = attributes[PRIMARY_METRIC_KEY];
+    const value = typeof primary === "number" ? primary : 0;
+    samples.push({
+      name: breakdown.resource,
+      ts: installsDateToMs(dateStr),
+      value,
+      attributes
+    });
+  }
+  return samples;
+}
+
+// src/google-play-console.ts
 var configFields = defineConfigFields(
-  z.object({
-    packageName: z.string().trim().regex(/^[a-zA-Z][a-zA-Z0-9_]*(\.[a-zA-Z][a-zA-Z0-9_]*)+$/, {
+  z4.object({
+    packageName: z4.string().trim().regex(/^[a-zA-Z][a-zA-Z0-9_]*(\.[a-zA-Z][a-zA-Z0-9_]*)+$/, {
       message: "packageName must be a reverse-DNS application id (e.g. com.example.app)."
     }).meta({
       label: "Package name",
       description: 'Reverse-DNS application id of the Android app (e.g. com.example.app). Visible in the Play Console URL and on Google Play under "About".',
       placeholder: "com.example.app"
     }),
-    serviceAccountJson: z.object({ $secret: z.string().trim().min(1) }).meta({
+    serviceAccountJson: z4.object({ $secret: z4.string().trim().min(1) }).meta({
       label: "Service Account JSON",
       description: 'Contents of the JSON key file for a Google service account that has been granted access to your Play Console developer account with at least the "View app information and download bulk reports" permission. Create one at Google Cloud -> IAM & Admin -> Service Accounts.',
       secret: true
     }),
-    lookbackDays: z.number().int().positive().optional().meta({
+    lookbackDays: z4.number().int().positive().optional().meta({
       label: "Lookback days (full sync)",
       description: "How many calendar days to fetch on a full sync. Defaults to 30. The Play Developer Reporting API exposes daily metrics with a typical 2-3 day reporting lag.",
       placeholder: "30"
     }),
-    reviewLimit: z.number().int().positive().max(2e3).optional().meta({
+    reviewLimit: z4.number().int().positive().max(2e3).optional().meta({
       label: "Review sample size",
       description: "How many of the most-recent user reviews to emit as gplay_app_ratings samples. Defaults to 200. Reviews are fetched then ranked newest-first before this cap is applied. The Android Publisher reviews API only surfaces reviews from roughly the past week, so this is a rolling sample, not a full history.",
       placeholder: "200"
+    }),
+    installsBucketId: z4.string().trim().min(1).optional().meta({
+      label: "Installs report bucket id",
+      description: 'Cloud Storage bucket id that holds your Play Console reports (e.g. `pubsite_prod_rev_01234567890987654321`), shown via "Copy Cloud Storage URI" on the Play Console Download reports page. Required only for the `gplay_installs_*` resources, which read the monthly stats/installs CSV reports. The bucket is Google-managed; the service account is granted access through Play Console (Users & permissions -> "View app information and download bulk reports", set to Global), not Google Cloud IAM.',
+      placeholder: "pubsite_prod_rev_01234567890987654321"
     })
   })
 );
@@ -58,6 +477,7 @@ var doc = defineConnectorDoc({
       "In Google Cloud, create a service account at IAM & Admin -> Service Accounts and download a JSON key.",
       'Enable both the "Google Play Developer Reporting API" and the "Google Play Android Developer API" on the Cloud project.',
       'In Google Play Console open Setup -> API access, link the same Cloud project, then invite the service account email and grant it at least the "View app information and download bulk reports" permission for the app you want to sync.',
+      'For the `gplay_installs_*` resources, grant bucket access inside Play Console, not Google Cloud IAM: the install reports live in a Google-managed Cloud Storage bucket provisioned for your developer account. In Play Console -> Users & permissions, give the service account the account-level "View app information and download bulk reports" permission set to Global (changes can take a few hours to propagate), then copy the bucket id from the Download reports page (the Cloud Storage URI starts with `gs://pubsite_prod_...`) into installsBucketId.',
       'Store the service account JSON as a secret and reference it as serviceAccountJson: secret("GPLAY_SA_JSON").',
       "Set packageName to the reverse-DNS application id of the app (e.g. com.example.app)."
     ]
@@ -67,7 +487,7 @@ var doc = defineConnectorDoc({
     "Daily vitals (crash rate, ANR rate, error counts) have a 2-3 day reporting lag on the Play Developer Reporting API; incremental syncs refetch the trailing 3 days. Metric days are reported on the America/Los_Angeles calendar, the only timezone the API supports for daily aggregation.",
     "gplay_app_ratings is a rolling sample of recent reviews from the Android Publisher reviews API (default 200, configurable via reviewLimit). Each sample carries one review with its star rating (1-5) as the value; this is not the lifetime average shown on the Play Store, and the reviews API only surfaces reviews from roughly the past week.",
     "The apps entity carries only the configured package name; the Play Store listing title is available solely through an Android Publisher edit, which this connector does not create.",
-    "Install counts and earnings are not exposed through the Reporting API - Google delivers them only as monthly CSV reports in a private Cloud Storage bucket. Those metrics are out of scope for this connector and will land in a follow-up."
+    'The `gplay_installs_*` resources read the monthly stats/installs CSV reports from your Play Console Cloud Storage bucket, not the Reporting API; they require installsBucketId plus the account-level "View app information and download bulk reports" permission granted to the service account in Play Console (the bucket is Google-managed; access is not configured through Google Cloud IAM). Files are published monthly (with daily rows) and a few days in arrears, so the current month fills in over time and the most recent days lag. Earnings/financial reports remain out of scope.'
   ]
 });
 var gplayCredentials = {
@@ -81,8 +501,16 @@ var PHASE_ORDER = [
   "crash_rate",
   "anr_rate",
   "errors",
+  "installs_overview",
+  "installs_country",
+  "installs_app_version",
+  "installs_device",
+  "installs_os_version",
+  "installs_language",
+  "installs_carrier",
   "reviews"
 ];
+var INSTALLS_PHASE_TO_BREAKDOWN = Object.fromEntries(INSTALLS_BREAKDOWNS.map((b) => [b.phase, b]));
 var GPLAY_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 function isGplayDateString(value) {
   return typeof value === "string" && GPLAY_DATE_RE.test(value);
@@ -136,84 +564,24 @@ var RESOURCE_TO_PHASE = {
   gplay_crash_rate_by_day: "crash_rate",
   gplay_anr_rate_by_day: "anr_rate",
   gplay_error_count_by_day: "errors",
-  [GPLAY_APP_RATINGS_METRIC]: "reviews"
+  [GPLAY_APP_RATINGS_METRIC]: "reviews",
+  ...Object.fromEntries(
+    INSTALLS_BREAKDOWNS.map((b) => [b.resource, b.phase])
+  )
 };
 var SCOPES = [
   "https://www.googleapis.com/auth/playdeveloperreporting",
-  "https://www.googleapis.com/auth/androidpublisher"
+  "https://www.googleapis.com/auth/androidpublisher",
+  "https://www.googleapis.com/auth/devstorage.read_only"
 ].join(" ");
 var REPORTING_BASE = "https://playdeveloperreporting.googleapis.com";
 var PUBLISHER_BASE = "https://androidpublisher.googleapis.com";
+var GCS_BASE = "https://storage.googleapis.com";
+var INSTALLS_DOWNLOAD_TIMEOUT_MS = 3e4;
 var DAILY_TIME_ZONE = "America/Los_Angeles";
 var DEFAULT_REVIEW_LIMIT = 200;
 var REVIEWS_PAGE_SIZE = 100;
 var MAX_REVIEW_PAGES = 50;
-function base64urlFromBytes(bytes) {
-  let binary = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binary += String.fromCharCode(bytes[i]);
-  }
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-function base64urlFromString(str) {
-  return base64urlFromBytes(new TextEncoder().encode(str));
-}
-async function signRS256JWT(payload, privateKeyPem) {
-  const header = { alg: "RS256", typ: "JWT" };
-  const headerB64 = base64urlFromString(JSON.stringify(header));
-  const payloadB64 = base64urlFromString(JSON.stringify(payload));
-  const signingInput = `${headerB64}.${payloadB64}`;
-  const pemContent = privateKeyPem.replace(/-----BEGIN PRIVATE KEY-----/g, "").replace(/-----END PRIVATE KEY-----/g, "").replace(/\s/g, "");
-  const der = Uint8Array.from(atob(pemContent), (c) => c.charCodeAt(0));
-  const key = await globalThis.crypto.subtle.importKey(
-    "pkcs8",
-    der,
-    { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const signature = await globalThis.crypto.subtle.sign(
-    "RSASSA-PKCS1-v1_5",
-    key,
-    new TextEncoder().encode(signingInput)
-  );
-  return `${signingInput}.${base64urlFromBytes(new Uint8Array(signature))}`;
-}
-function parseServiceAccountJson(value) {
-  const trimmed = value.trim();
-  if (trimmed.startsWith("{")) {
-    return JSON.parse(trimmed);
-  }
-  const binary = atob(trimmed);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
-  }
-  const decoded = new TextDecoder().decode(bytes);
-  return JSON.parse(decoded);
-}
-async function buildServiceAccountJwt(serviceAccountJson) {
-  const sa = parseServiceAccountJson(serviceAccountJson);
-  const now = Math.floor(Date.now() / 1e3);
-  const jwt = await signRS256JWT(
-    {
-      iss: sa.client_email,
-      scope: SCOPES,
-      aud: sa.token_uri ?? "https://oauth2.googleapis.com/token",
-      exp: now + 3600,
-      iat: now
-    },
-    sa.private_key
-  );
-  const body = new URLSearchParams({
-    grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
-    assertion: jwt
-  }).toString();
-  return {
-    url: sa.token_uri ?? "https://oauth2.googleapis.com/token",
-    body
-  };
-}
 var gplayDateFormatter = new Intl.DateTimeFormat("en-CA", {
   timeZone: DAILY_TIME_ZONE,
   year: "numeric",
@@ -241,6 +609,14 @@ function partsToGplayDate(parts) {
 }
 var MS_PER_DAY = 24 * 60 * 60 * 1e3;
 var INCREMENTAL_LOOKBACK_DAYS = 3;
+function dateRangeToReplaceWindow(range) {
+  const start = gplayDateToMs(range.startDate);
+  const end = gplayDateToMs(range.endDate) + MS_PER_DAY - 1;
+  if (start > end) {
+    return void 0;
+  }
+  return { start, end };
+}
 function getDateRange(options, lookbackDays) {
   const now = Date.now();
   const endDate = toGplayDate(new Date(now));
@@ -336,55 +712,122 @@ function reviewToRatingSample(review, packageName) {
     attributes
   };
 }
-var dateOnlyTimeline = z.object({
-  startTime: z.object({
-    year: z.number().int(),
-    month: z.number().int(),
-    day: z.number().int()
+var dateOnlyTimeline = z4.object({
+  startTime: z4.object({
+    year: z4.number().int(),
+    month: z4.number().int(),
+    day: z4.number().int()
   })
 });
-var metricEntry = z.object({
-  metric: z.string(),
-  decimalValue: z.object({
-    value: z.string()
+var metricEntry = z4.object({
+  metric: z4.string(),
+  decimalValue: z4.object({
+    value: z4.string()
   }).optional()
 });
 function metricSetSchema() {
-  return z.object({
-    rows: z.array(
+  return z4.object({
+    rows: z4.array(
       dateOnlyTimeline.extend({
-        metrics: z.array(metricEntry).optional()
+        metrics: z4.array(metricEntry).optional()
       })
     ).optional(),
-    nextPageToken: z.string().optional()
+    nextPageToken: z4.string().optional()
   });
 }
-var reviewsResponseSchema = z.object({
-  reviews: z.array(
-    z.object({
-      reviewId: z.string().optional(),
-      authorName: z.string().optional(),
-      comments: z.array(
-        z.object({
-          userComment: z.object({
-            text: z.string().optional(),
-            lastModified: z.object({
-              seconds: z.string().optional(),
-              nanos: z.number().optional()
+var reviewsResponseSchema = z4.object({
+  reviews: z4.array(
+    z4.object({
+      reviewId: z4.string().optional(),
+      authorName: z4.string().optional(),
+      comments: z4.array(
+        z4.object({
+          userComment: z4.object({
+            text: z4.string().optional(),
+            lastModified: z4.object({
+              seconds: z4.string().optional(),
+              nanos: z4.number().optional()
             }).optional(),
-            starRating: z.number().int().optional(),
-            reviewerLanguage: z.string().optional(),
-            device: z.string().optional(),
-            androidOsVersion: z.number().int().optional(),
-            appVersionCode: z.number().int().optional(),
-            appVersionName: z.string().optional()
+            starRating: z4.number().int().optional(),
+            reviewerLanguage: z4.string().optional(),
+            device: z4.string().optional(),
+            androidOsVersion: z4.number().int().optional(),
+            appVersionCode: z4.number().int().optional(),
+            appVersionName: z4.string().optional()
           }).optional()
         })
       ).optional()
     })
   ).optional(),
-  tokenPagination: z.object({ nextPageToken: z.string().optional() }).optional()
+  tokenPagination: z4.object({ nextPageToken: z4.string().optional() }).optional()
 });
+var installsCsvResponse = z4.string();
+var INSTALLS_DATE_DIMENSION = {
+  name: "date",
+  description: "Calendar day of the install statistics row, as delivered in the monthly stats/installs CSV."
+};
+var INSTALLS_PACKAGE_DIMENSION = {
+  name: "package_name",
+  description: "Reverse-DNS application id these install statistics are reported against."
+};
+var INSTALLS_MEASURES = [
+  {
+    name: "daily_device_installs",
+    description: "Devices that newly installed the app on this day (also the primary metric value)."
+  },
+  {
+    name: "daily_device_uninstalls",
+    description: "Devices that uninstalled the app on this day."
+  },
+  {
+    name: "daily_device_upgrades",
+    description: "Devices that upgraded the app on this day."
+  },
+  {
+    name: "current_device_installs",
+    description: "Active devices that have the app installed at end of day."
+  },
+  {
+    name: "active_device_installs",
+    description: "Installs on active devices (devices active in the trailing 30 days)."
+  },
+  {
+    name: "current_user_installs",
+    description: "Users that have the app installed at end of day."
+  },
+  {
+    name: "total_user_installs",
+    description: "Total users that have ever installed the app."
+  },
+  {
+    name: "daily_user_installs",
+    description: "Users that newly installed the app on this day."
+  },
+  {
+    name: "daily_user_uninstalls",
+    description: "Users that uninstalled the app on this day."
+  }
+];
+function installsResource(breakdown) {
+  const dimensions = [INSTALLS_DATE_DIMENSION, INSTALLS_PACKAGE_DIMENSION];
+  if (breakdown.dimensionAttr) {
+    dimensions.push({
+      name: breakdown.dimensionAttr,
+      description: breakdown.dimensionDescription
+    });
+  }
+  return {
+    shape: "metric",
+    description: breakdown.description,
+    unit: "installs",
+    granularity: "day",
+    endpoint: `GET /storage/v1/b/{installsBucketId}/o/stats%2Finstalls%2Finstalls_{packageName}_{YYYYMM}_${breakdown.fileDimension}.csv`,
+    notes: "Sourced from the Play Console monthly stats/installs CSV in Cloud Storage. Files are monthly with daily rows and arrive a few days in arrears; the connector refetches the months overlapping the sync window.",
+    dimensions,
+    measures: INSTALLS_MEASURES,
+    responses: { [breakdown.responseTag]: installsCsvResponse }
+  };
+}
 var googlePlayConsoleResources = defineResources({
   apps: {
     shape: "entity",
@@ -481,7 +924,14 @@ var googlePlayConsoleResources = defineResources({
       }
     ],
     responses: { reviews: reviewsResponseSchema }
-  }
+  },
+  gplay_installs_overview_by_day: installsResource(INSTALLS_BREAKDOWNS[0]),
+  gplay_installs_by_country: installsResource(INSTALLS_BREAKDOWNS[1]),
+  gplay_installs_by_app_version: installsResource(INSTALLS_BREAKDOWNS[2]),
+  gplay_installs_by_device: installsResource(INSTALLS_BREAKDOWNS[3]),
+  gplay_installs_by_os_version: installsResource(INSTALLS_BREAKDOWNS[4]),
+  gplay_installs_by_language: installsResource(INSTALLS_BREAKDOWNS[5]),
+  gplay_installs_by_carrier: installsResource(INSTALLS_BREAKDOWNS[6])
 });
 var id = "google-play-console";
 var GooglePlayConsoleConnector = class _GooglePlayConsoleConnector extends BaseConnector {
@@ -490,11 +940,21 @@ var GooglePlayConsoleConnector = class _GooglePlayConsoleConnector extends BaseC
   static schemas = schemasFromResources(googlePlayConsoleResources);
   static create(input, ctx) {
     const parsed = configFields.parse(input);
+    let installsBucketId;
+    if (parsed.installsBucketId !== void 0) {
+      installsBucketId = normalizeInstallsBucketId(parsed.installsBucketId);
+      if (installsBucketId.length === 0) {
+        throw new Error(
+          "Google Play Console connector: installsBucketId must include a bucket name (e.g. pubsite_prod_rev_...)"
+        );
+      }
+    }
     return new _GooglePlayConsoleConnector(
       {
         packageName: parsed.packageName,
         lookbackDays: parsed.lookbackDays,
-        reviewLimit: parsed.reviewLimit
+        reviewLimit: parsed.reviewLimit,
+        installsBucketId
       },
       {
         serviceAccountJson: parsed.serviceAccountJson
@@ -504,33 +964,15 @@ var GooglePlayConsoleConnector = class _GooglePlayConsoleConnector extends BaseC
   }
   id = id;
   credentials = gplayCredentials;
-  cachedToken = null;
-  async fetchOAuthToken(url, body, signal) {
-    const res = await this.post(url, {
-      resource: "oauth_token",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body,
-      signal
+  tokenProvider;
+  getAccessToken(signal) {
+    this.tokenProvider ??= new GcpAccessTokenProvider({
+      connectorId: this.id,
+      scope: SCOPES,
+      getServiceAccountJson: () => this.creds.serviceAccountJson,
+      post: (url, opts) => this.post(url, opts)
     });
-    const expiresIn = res.body.expires_in ?? 3600;
-    return {
-      token: res.body.access_token,
-      expiresAt: Date.now() + (expiresIn - 60) * 1e3
-    };
-  }
-  async getAccessToken(signal) {
-    if (this.cachedToken && Date.now() < this.cachedToken.expiresAt) {
-      return this.cachedToken.token;
-    }
-    const { serviceAccountJson } = this.creds;
-    if (!serviceAccountJson) {
-      throw new Error(
-        "Google Play Console connector: serviceAccountJson credential is required"
-      );
-    }
-    const { url, body } = await buildServiceAccountJwt(serviceAccountJson);
-    this.cachedToken = await this.fetchOAuthToken(url, body, signal);
-    return this.cachedToken.token;
+    return this.tokenProvider.getToken(signal);
   }
   async runMetricQuery(accessToken, cfg, dateRange, pageToken, signal) {
     const url = `${REPORTING_BASE}/v1beta1/apps/${encodeURIComponent(this.settings.packageName)}/${cfg.metricSet}:query`;
@@ -642,10 +1084,78 @@ var GooglePlayConsoleConnector = class _GooglePlayConsoleConnector extends BaseC
     }
     return rows;
   }
+  async downloadInstallsCsv(accessToken, bucket, yyyymm, breakdown, signal) {
+    const objectPath = installsObjectPath(
+      this.settings.packageName,
+      yyyymm,
+      breakdown.fileDimension
+    );
+    const url = `${GCS_BASE}/storage/v1/b/${encodeURIComponent(bucket)}/o/${encodeURIComponent(objectPath)}?alt=media`;
+    try {
+      const res = await this.request(
+        {
+          url,
+          method: "GET",
+          headers: {
+            Authorization: `Bearer ${accessToken}`,
+            "User-Agent": connectorUserAgent("google-play-console")
+          },
+          parseJson: false,
+          binary: true,
+          timeoutMs: INSTALLS_DOWNLOAD_TIMEOUT_MS,
+          signal
+        },
+        { resource: breakdown.responseTag }
+      );
+      return decodeUtf16Csv(res.body);
+    } catch (err) {
+      const status = err.response?.status;
+      if (status === 404) {
+        return null;
+      }
+      throw err;
+    }
+  }
+  async syncInstallsBreakdown(accessToken, breakdown, dateRange, storage, signal) {
+    const bucket = this.settings.installsBucketId;
+    if (!bucket) {
+      return;
+    }
+    const months = installsMonthsForRange(
+      dateRange.startDate,
+      dateRange.endDate
+    );
+    const samples = [];
+    for (const month of months) {
+      signal?.throwIfAborted();
+      const csv = await this.downloadInstallsCsv(
+        accessToken,
+        bucket,
+        month,
+        breakdown,
+        signal
+      );
+      if (csv === null) {
+        continue;
+      }
+      for (const sample of parseInstallsCsv(
+        csv,
+        breakdown,
+        this.settings.packageName
+      )) {
+        const date = sample.attributes["date"];
+        if (typeof date === "string" && date >= dateRange.startDate && date <= dateRange.endDate) {
+          samples.push(sample);
+        }
+      }
+    }
+    await storage.metrics(samples, { names: [breakdown.resource] });
+  }
   async sync(options, storage, signal) {
     const lookbackDays = this.settings.lookbackDays ?? 30;
     const cursor = isGplaySyncCursor(options.cursor) ? options.cursor : void 0;
     const dateRange = cursor?.dateRange ?? getDateRange(options, lookbackDays);
+    const replaceWindow = dateRangeToReplaceWindow(dateRange);
     let accessToken = null;
     const getToken = async (sig) => {
       if (!accessToken) {
@@ -675,6 +1185,25 @@ var GooglePlayConsoleConnector = class _GooglePlayConsoleConnector extends BaseC
           await this.syncReviews(token2, storage, signal);
           continue;
         }
+        const breakdown = INSTALLS_PHASE_TO_BREAKDOWN[phase];
+        if (breakdown) {
+          if (!this.settings.installsBucketId) {
+            this.logger.warn(
+              "Skipping Google Play installs resource because installsBucketId is not configured",
+              { resource: breakdown.resource }
+            );
+            continue;
+          }
+          const token2 = await getToken(signal);
+          await this.syncInstallsBreakdown(
+            token2,
+            breakdown,
+            dateRange,
+            storage,
+            signal
+          );
+          continue;
+        }
         const cfg = METRIC_PHASE_CONFIGS[phase];
         const token = await getToken(signal);
         const rows = await this.drainMetricPhase(token, cfg, dateRange, signal);
@@ -687,7 +1216,10 @@ var GooglePlayConsoleConnector = class _GooglePlayConsoleConnector extends BaseC
             this.settings.packageName
           )
         ).filter((s) => s !== null);
-        await storage.metrics(samples, { names: [cfg.metricName] });
+        await storage.metrics(samples, {
+          names: [cfg.metricName],
+          ...replaceWindow ? { replaceWindow } : {}
+        });
       } catch (err) {
         if (signal?.aborted) {
           return { done: false, cursor: { phase, dateRange } };