android-publisher-cli 0.0.0-stage → 0.2.0-dev

package/build/channels/http.js

@@ -0,0 +1,189 @@
+import { createHmac, randomBytes } from 'node:crypto';
+import fs from 'node:fs';
+import { Readable } from 'node:stream';
+import { parseStrictJSON } from '../model.js';
+import { hashFile } from '../private-file.js';
+export const ORIGINS = {
+    huawei: 'https://connect-api.cloud.huawei.com',
+    honor: 'https://appmarket-openapi-drcn.cloud.honor.com',
+    xiaomi: 'https://api.developer.xiaomi.com',
+    oppo: 'https://oop-openapi-cn.heytapmobi.com',
+    vivo: 'https://developer-api.vivo.com.cn',
+    tencent: 'https://p.open.qq.com',
+};
+export class ChannelError extends Error {
+    code;
+    effect;
+    constructor(code, effect = 'unknown') {
+        super(`channel protocol: ${code} (${effect})`);
+        this.code = code;
+        this.effect = effect;
+    }
+}
+export const unknown = () => new ChannelError('missing_or_unrecognized_evidence');
+export const object = (value) => {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw unknown();
+    return value;
+};
+export const list = (value) => Array.isArray(value) ? value.map(object) : [];
+export const str = (value) => typeof value === 'string' ? value : '';
+export const id = (value) => {
+    if (typeof value === 'string')
+        return value;
+    if (typeof value === 'bigint' && value >= 0n)
+        return value.toString();
+    if (typeof value === 'number' && Number.isSafeInteger(value) && value >= 0)
+        return String(value);
+    return '';
+};
+export const num = (value) => typeof value === 'number' && Number.isSafeInteger(value) ? value : null;
+export const decimal = (value) => typeof value === 'string' && /^[0-9]+$/.test(value) ? value :
+    typeof value === 'bigint' && value >= 0n ? value.toString() :
+        typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? String(value) : '';
+export const required = (...values) => { if (values.some(value => !value))
+    throw new ChannelError('missing_required_input', 'not_sent'); };
+export function check(obj, key) {
+    const value = num(obj[key]);
+    if (value === null)
+        throw unknown();
+    if (value !== 0)
+        throw new ChannelError('vendor_business_error');
+}
+export function hmacSign(fields, secret, omit = []) {
+    const signed = Object.keys(fields).filter(k => !omit.includes(k)).sort().map(k => `${k}=${fields[k]}`).join('&');
+    return createHmac('sha256', secret).update(signed).digest('hex');
+}
+function allowedUpload(channel, endpoint) {
+    const host = endpoint.hostname.toLowerCase();
+    if (channel === 'tencent')
+        return host.endsWith('.myqcloud.com') && host.includes('.cos.');
+    if (channel === 'huawei')
+        return host === 'connect-api.cloud.huawei.com' || host === 'nsp-appgallery-agcfs-drcn.obs.cn-north-2.myhuaweicloud.cn' || host.endsWith('.dbankcdn.com');
+    if (channel === 'oppo')
+        return host === 'api.open.oppomobile.com' || host === 'oop-openapi-cn.heytapmobi.com' || host.endsWith('.heytapmobi.com');
+    if (channel === 'honor')
+        return host === 'appmarket-openapi-drcn.cloud.honor.com';
+    return false;
+}
+export class ChannelHTTP {
+    channel;
+    fetcher;
+    writeGuard;
+    constructor(channel, fetcher = fetch, writeGuard = () => false) {
+        this.channel = channel;
+        this.fetcher = fetcher;
+        this.writeGuard = writeGuard;
+    }
+    async send(q) {
+        if (q.class === 'write' && (!q.operationId || !this.writeGuard(q.operationId)))
+            throw new ChannelError('unlogged_write', 'not_sent');
+        if (q.class !== 'write' && q.operationId)
+            throw new ChannelError('unexpected_operation', 'not_sent');
+        if (q.path === undefined && q.url === undefined || q.path !== undefined && q.url !== undefined)
+            throw new ChannelError('invalid_endpoint', 'not_sent');
+        const endpoint = new URL(q.path === undefined ? q.url : `${ORIGINS[this.channel]}${q.path}`);
+        if (endpoint.protocol !== 'https:' || endpoint.username || endpoint.password || endpoint.hash || endpoint.port ||
+            (q.upload ? !allowedUpload(this.channel, endpoint) : endpoint.origin !== ORIGINS[this.channel] && !(this.channel === 'honor' && q.class === 'lifecycle' && endpoint.origin === 'https://iam.developer.honor.com')))
+            throw new ChannelError('endpoint_not_allowed', 'not_sent');
+        const body = q.body;
+        if (q.method === 'GET' && body)
+            throw new ChannelError('GET_body_rejected', 'not_sent');
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), q.class === 'read' ? 30000 : 90000);
+        let response;
+        try {
+            response = await this.fetcher(endpoint, { method: q.method, ...(q.headers ? { headers: q.headers } : {}),
+                body: body ? body : null, redirect: 'manual', signal: controller.signal,
+                ...(body instanceof Readable ? { duplex: 'half' } : {}) });
+        }
+        catch {
+            throw new ChannelError('network_or_timeout', q.class === 'read' ? 'not_sent' : 'unknown');
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (response.status < 200 || response.status > 299)
+            throw new ChannelError('http_status', q.class === 'read' ? 'not_sent' : 'unknown');
+        if (q.rawUpload) {
+            if (response.status !== 200)
+                throw unknown();
+            return {};
+        }
+        const contentLength = Number(response.headers.get('content-length') ?? 0);
+        if (contentLength > 4 * 1024 * 1024)
+            throw unknown();
+        const chunks = [];
+        let size = 0;
+        if (!response.body)
+            throw unknown();
+        for await (const chunk of response.body) {
+            size += chunk.byteLength;
+            if (size > 4 * 1024 * 1024)
+                throw unknown();
+            chunks.push(chunk);
+        }
+        try {
+            return object(parseStrictJSON(Buffer.concat(chunks).toString('utf8')));
+        }
+        catch {
+            throw unknown();
+        }
+    }
+    json(path, method, kind, value, operationId, headers) {
+        const body = value === undefined ? undefined : Buffer.from(JSON.stringify(value));
+        return this.send({ method, path, class: kind, ...(operationId ? { operationId } : {}),
+            headers: { 'Content-Type': 'application/json; charset=utf-8', ...headers }, ...(body ? { body, size: body.length } : {}) });
+    }
+    rawJSON(path, method, kind, source, operationId, headers) {
+        parseStrictJSON(source);
+        const body = Buffer.from(source);
+        return this.send({ method, path, class: kind, ...(operationId ? { operationId } : {}),
+            headers: { 'Content-Type': 'application/json; charset=utf-8', ...headers }, body, size: body.length });
+    }
+    form(path, kind, fields, operationId, headers) {
+        const body = Buffer.from(new URLSearchParams(fields).toString());
+        return this.send({ method: 'POST', path, class: kind, ...(operationId ? { operationId } : {}),
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded; charset=utf-8', ...headers }, body, size: body.length });
+    }
+    async upload(url, file, operationId, headers = {}) {
+        const current = hashFile(file.path);
+        if (current.sha256 !== file.sha256 || current.size !== file.size)
+            throw new ChannelError('frozen_apk_changed', 'not_sent');
+        await this.send({ method: 'PUT', url, class: 'write', operationId, upload: true, rawUpload: true, body: fs.createReadStream(file.path), size: file.size,
+            headers: { 'Content-Type': 'application/octet-stream', 'Content-Length': String(file.size), ...headers } });
+    }
+    async multipart(endpoint, fields, files, kind, operationId, headers = {}, upload = false) {
+        const boundary = `publisher-${randomBytes(16).toString('hex')}`;
+        const parts = [];
+        for (const [key, value] of Object.entries(fields).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
+            if (!/^[A-Za-z0-9_]+$/.test(key))
+                throw new ChannelError('invalid_multipart_field', 'not_sent');
+            parts.push(Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="${key}"\r\nContent-Type: text/plain; charset=utf-8\r\n\r\n${value}\r\n`));
+        }
+        for (const [key, file] of Object.entries(files).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
+            if (!/^[A-Za-z0-9_]+$/.test(key))
+                throw new ChannelError('invalid_multipart_field', 'not_sent');
+            const current = hashFile(file.path);
+            if (current.sha256 !== file.sha256 || current.size !== file.size || !/^[A-Za-z0-9._-]+$/.test(file.filename))
+                throw new ChannelError('invalid_frozen_file', 'not_sent');
+            parts.push(Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="${key}"; filename="${file.filename}"\r\nContent-Type: application/octet-stream\r\n\r\n`));
+            parts.push(file);
+            parts.push(Buffer.from('\r\n'));
+        }
+        parts.push(Buffer.from(`--${boundary}--\r\n`));
+        const size = parts.reduce((total, part) => total + (Buffer.isBuffer(part) ? part.length : part.size), 0);
+        const body = Readable.from((async function* () {
+            for (const part of parts) {
+                if (Buffer.isBuffer(part))
+                    yield part;
+                else
+                    for await (const chunk of fs.createReadStream(part.path))
+                        yield chunk;
+            }
+        })());
+        return this.send({ method: 'POST', ...(endpoint.startsWith('https://') ? { url: endpoint } : { path: endpoint }), class: kind,
+            ...(operationId ? { operationId } : {}), upload, body, size,
+            headers: { 'Content-Type': `multipart/form-data; boundary=${boundary}`, 'Content-Length': String(size), ...headers } });
+    }
+}

package/build/channels/huawei.js

@@ -0,0 +1,138 @@
+import { bearer } from './auth.js';
+import { BaseAdapter } from './types.js';
+import { check, decimal, list, object, required, str, unknown } from './http.js';
+export class HuaweiAdapter extends BaseAdapter {
+    channel = 'huawei';
+    steps = ['authorize', 'upload', 'bind', 'metadata', 'submit'];
+    async call(path, method, kind, value, operationId) {
+        const token = await bearer('huawei', this.target.account, '', this.secrets, this.store, this.http);
+        const response = await this.http.json(path, method, kind, value, operationId, { Authorization: `Bearer ${token}` });
+        check(object(response.ret), 'code');
+        return response;
+    }
+    async details() {
+        const query = new URLSearchParams({ packageName: this.batch.package_name, packageTypes: '1' });
+        const bound = await this.call(`/api/publish/v2/appid-list?${query}`, 'GET', 'read');
+        const apps = list(bound.appids);
+        if (apps.length !== 1 || apps[0]?.value !== this.target.app_id)
+            throw unknown();
+        const response = await this.call(`/api/publish/v2/app-info?${new URLSearchParams({ appId: this.target.app_id })}`, 'GET', 'read');
+        const info = object(response.appInfo);
+        const version = decimal(info.versionCode);
+        if (!version || BigInt(version) <= 0n)
+            throw unknown();
+        const languages = list(response.languages);
+        let language = this.target.language_id ?? '';
+        if (!language) {
+            const matches = languages.filter(row => str(row.lang).replaceAll('_', '-').toLowerCase() === 'zh-cn');
+            if (matches.length !== 1)
+                throw new Error('Huawei Chinese language is missing or ambiguous');
+            language = str(matches[0]?.lang);
+        }
+        const selected = languages.filter(row => row.lang === language);
+        if (selected.length !== 1)
+            throw unknown();
+        const row = selected[0];
+        const metadata = { language_id: language, app_name: str(row.appName), intro: str(row.appDesc),
+            brief_intro: str(row.briefInfo), prior_notes: str(row.newFeatures) };
+        if (!metadata.app_name || !metadata.intro)
+            throw unknown();
+        return { version, metadata, versionId: str(info.versionId) };
+    }
+    async preflight() {
+        const details = await this.details();
+        if (BigInt(details.version) >= BigInt(this.batch.version_code))
+            throw new Error('Huawei target version must exceed the editable version');
+        return this.preflightRecord({ remote_version_code: details.version, remote_ref: details.versionId,
+            metadata: details.metadata });
+    }
+    async waitBeforeStep(step) {
+        if (step !== 'submit')
+            return;
+        const bound = this.store.latestOperation(this.batch.batch_id, 'huawei', 'bind');
+        if (!bound || bound.effect !== 'confirmed_applied')
+            throw new Error('Huawei bind receipt missing');
+        const remaining = Date.parse(bound.completed_at) + 120_000 - Date.now();
+        if (remaining > 0)
+            await new Promise(resolve => setTimeout(resolve, remaining));
+    }
+    async execute(step, operationId) {
+        const appId = this.target.app_id;
+        if (step === 'authorize') {
+            const started = Date.now();
+            const query = new URLSearchParams({ appId, fileName: this.target.artifact.filename,
+                sha256: this.target.artifact.sha256, contentLength: String(this.target.artifact.size), releaseType: '1' });
+            const response = await this.call(`/api/publish/v2/upload-url/for-obs?${query}`, 'GET', 'write', undefined, operationId);
+            const info = object(response.urlInfo);
+            const url = str(info.url);
+            const ref = str(info.objectId);
+            const method = str(info.method);
+            let endpoint;
+            try {
+                endpoint = new URL(url);
+            }
+            catch {
+                throw unknown();
+            }
+            const host = endpoint.hostname.toLowerCase();
+            if (!ref || method !== 'PUT' || endpoint.protocol !== 'https:' || endpoint.username || endpoint.password || endpoint.port || endpoint.hash ||
+                !(host === 'connect-api.cloud.huawei.com' || host === 'nsp-appgallery-agcfs-drcn.obs.cn-north-2.myhuaweicloud.cn' || host.endsWith('.dbankcdn.com')))
+                throw unknown();
+            const headers = object(info.headers);
+            const expected = ['Authorization', 'X-Amz-Content-Sha256', 'X-Amz-Date', 'Host', 'User-Agent', 'Content-Type'];
+            const values = {};
+            for (const name of expected) {
+                const key = Object.keys(headers).find(k => k.toLowerCase() === name.toLowerCase());
+                if (!key || typeof headers[key] !== 'string' || !headers[key] || /[\r\n]/.test(headers[key]))
+                    throw unknown();
+                values[name] = headers[key];
+            }
+            if (!values.Authorization?.startsWith('AWS4-HMAC-SHA256 ') && !values.Authorization?.startsWith('OBS '))
+                throw unknown();
+            if (values['X-Amz-Content-Sha256'] !== this.target.artifact.sha256 || values.Host?.toLowerCase() !== endpoint.host.toLowerCase() || values['Content-Type'] !== 'application/octet-stream')
+                throw unknown();
+            const grant = { url, ref, headers: values, expires_at: new Date(started + 4 * 60_000).toISOString() };
+            return { ref, material: { value: grant, expiresAt: grant.expires_at } };
+        }
+        if (step === 'upload') {
+            const grant = this.material('authorize');
+            if (grant.ref !== this.ref('authorize'))
+                throw new Error('Huawei upload grant differs from authorization receipt');
+            const { Host: _host, ...headers } = grant.headers;
+            await this.http.upload(grant.url, this.target.artifact, operationId, headers);
+            return { ref: grant.ref };
+        }
+        if (step === 'bind') {
+            const ref = this.ref('upload');
+            await this.call(`/api/publish/v2/app-file-info?${new URLSearchParams({ appId })}`, 'PUT', 'write', { fileType: 5, files: [{ fileName: this.target.artifact.filename, fileDestUrl: ref }] }, operationId);
+            return { ref };
+        }
+        if (step === 'metadata') {
+            const baseline = this.savedPreflight().metadata;
+            if (!baseline)
+                throw new Error('Huawei language baseline missing');
+            required(baseline.language_id ?? '', baseline.app_name ?? '', baseline.intro ?? '', this.batch.release_notes);
+            if ([...this.batch.release_notes].length > 500)
+                throw new Error('Huawei notes exceed 500 characters');
+            await this.call(`/api/publish/v2/app-language-info?${new URLSearchParams({ appId, releaseType: '1' })}`, 'PUT', 'write', { lang: baseline.language_id, appName: baseline.app_name, appDesc: baseline.intro,
+                briefInfo: baseline.brief_intro ?? '', newFeatures: this.batch.release_notes }, operationId);
+            return { ref: `ack-${operationId}` };
+        }
+        if (step === 'submit') {
+            await this.call(`/api/publish/v2/app-submit?${new URLSearchParams({ appId, releaseType: '1' })}`, 'POST', 'write', undefined, operationId);
+            return { ref: `ack-${operationId}` };
+        }
+        throw new Error('unsupported Huawei step');
+    }
+    async observe(_remoteRef) {
+        const response = await this.call(`/api/publish/v2/app-info?${new URLSearchParams({ appId: this.target.app_id })}`, 'GET', 'read');
+        const app = object(response.appInfo);
+        const version = decimal(app.versionCode);
+        const onShelf = decimal(app.onShelfVersionCode);
+        if (version !== this.batch.version_code)
+            return this.observation('unknown', 'unknown', 'unconfirmed', 'huawei_app_info', undefined, { observed_version_code: version });
+        const state = decimal(app.releaseState);
+        const review = state === '0' ? 'approved' : ['1', '8', '13'].includes(state) ? 'rejected' : ['4', '5', '12'].includes(state) ? 'in_review' : 'unknown';
+        return this.observation(review, onShelf === this.batch.version_code ? 'live' : 'unknown', 'confirmed', 'huawei_target_version', str(app.versionId));
+    }
+}

package/build/channels/index.js

@@ -0,0 +1,17 @@
+import { HuaweiAdapter } from './huawei.js';
+import { HonorAdapter } from './honor.js';
+import { XiaomiAdapter } from './xiaomi.js';
+import { OPPOAdapter } from './oppo.js';
+import { VivoAdapter } from './vivo.js';
+import { TencentAdapter } from './tencent.js';
+export function channelAdapter(batch, target, credentials, store, fetcher = fetch) {
+    const args = [batch, target, credentials, store, fetcher];
+    switch (target.channel) {
+        case 'huawei': return new HuaweiAdapter(...args);
+        case 'honor': return new HonorAdapter(...args);
+        case 'xiaomi': return new XiaomiAdapter(...args);
+        case 'oppo': return new OPPOAdapter(...args);
+        case 'vivo': return new VivoAdapter(...args);
+        case 'tencent': return new TencentAdapter(...args);
+    }
+}

package/build/channels/oppo.js

@@ -0,0 +1,169 @@
+import { md5File } from '../private-file.js';
+import { bearer } from './auth.js';
+import { BaseAdapter } from './types.js';
+import { check, decimal, hmacSign, id, object, required, str, unknown } from './http.js';
+const metadataFields = ['app_name', 'app_subname', 'second_category_id', 'third_category_id', 'summary',
+    'detail_desc', 'update_desc', 'privacy_source_url', 'icon_url', 'pic_url', 'landscape_pic_url',
+    'video_url', 'online_type', 'sche_online_time', 'test_desc', 'electronic_cert_url', 'copyright_url',
+    'icp_url', 'special_url', 'special_file_url', 'business_username', 'business_email', 'business_mobile',
+    'business_qq', 'business_position', 'business_address', 'age_level', 'adaptive_equipment',
+    'adaptive_type', 'customer_contact', 'audit_status', 'audit_status_name', 'state', 'apk_md5', 'version_id'];
+const requiredFields = ['app_name', 'second_category_id', 'third_category_id', 'summary', 'detail_desc',
+    'privacy_source_url', 'icon_url', 'pic_url', 'test_desc', 'business_username', 'business_email',
+    'business_mobile', 'age_level', 'adaptive_equipment'];
+export class OPPOAdapter extends BaseAdapter {
+    channel = 'oppo';
+    steps = ['authorize', 'upload', 'submit'];
+    async signed(fields) {
+        const clientId = this.target.client_id ?? this.target.account;
+        const token = await bearer('oppo', this.target.account, clientId, this.secrets, this.store, this.http);
+        const secret = this.secrets.client_secret ?? '';
+        required(token, secret);
+        const values = { ...fields, access_token: token, timestamp: String(Math.floor(Date.now() / 1000)) };
+        return { ...values, api_sign: hmacSign(values, secret) };
+    }
+    async query(path, fields) {
+        const response = await this.http.send({ method: 'GET', path: `${path}?${new URLSearchParams(await this.signed(fields))}`, class: 'read' });
+        check(response, 'errno');
+        return response;
+    }
+    async details(version = '') {
+        const fields = { pkg_name: this.batch.package_name };
+        if (version)
+            fields.version_code = version;
+        const response = await this.query('/resource/v1/app/info', fields);
+        const data = object(response.data);
+        const code = decimal(data.version_code);
+        const appId = id(data.app_id);
+        if (!code || BigInt(code) <= 0n || data.pkg_name !== this.batch.package_name || !appId || version && code !== version)
+            throw unknown();
+        const metadata = {};
+        for (const key of metadataFields) {
+            const value = data[key];
+            if (typeof value === 'string')
+                metadata[key] = value;
+            else if (typeof value === 'number' || typeof value === 'bigint')
+                metadata[key] = String(value);
+        }
+        return { version: code, appId, metadata };
+    }
+    copyright(metadata) {
+        if (metadata.copyright_url)
+            return metadata.copyright_url;
+        try {
+            if (new URL(metadata.electronic_cert_url ?? '').protocol === 'https:')
+                return metadata.electronic_cert_url ?? '';
+        }
+        catch { /* no usable existing proof */ }
+        return '';
+    }
+    updateFields(baseline, file) {
+        const fields = {};
+        for (const key of metadataFields) {
+            if (['audit_status', 'audit_status_name', 'state', 'apk_md5', 'version_id'].includes(key))
+                continue;
+            if (baseline[key])
+                fields[key] = baseline[key];
+        }
+        fields.update_desc = this.batch.release_notes;
+        fields.copyright_url = this.copyright(fields);
+        fields.online_type = '1';
+        delete fields.sche_online_time;
+        for (const field of requiredFields)
+            required(fields[field] ?? '');
+        required(fields.update_desc, fields.copyright_url);
+        if ([...(fields.summary ?? '')].length > 13 || /[\s\p{P}]/u.test(fields.summary ?? '') ||
+            [...(fields.detail_desc ?? '')].length < 20 || [...fields.update_desc].length < 5 ||
+            [...(fields.test_desc ?? '')].length > 400 || !['4', '5', '6'].includes(fields.adaptive_equipment ?? '') ||
+            ['second_category_id', 'third_category_id', 'age_level'].some(k => !/^[1-9][0-9]*$/.test(fields[k] ?? '')) ||
+            (fields.pic_url ?? '').split(',').length < 2)
+            throw new Error('OPPO baseline metadata is incomplete or invalid');
+        fields.pkg_name = this.batch.package_name;
+        fields.version_code = this.batch.version_code;
+        fields.apk_url = JSON.stringify([{ url: file.url, md5: file.md5, cpu_code: 0 }]);
+        return fields;
+    }
+    async preflight() {
+        const details = await this.details();
+        if (BigInt(details.version) >= BigInt(this.batch.version_code))
+            throw new Error('OPPO existing version differs');
+        const synthetic = { url: 'https://example.invalid/file', md5: '0'.repeat(32), ref: 'preview', size: 1 };
+        this.updateFields(details.metadata, synthetic);
+        return this.preflightRecord({ remote_version_code: details.version, remote_ref: details.appId,
+            metadata: details.metadata });
+    }
+    async execute(step, operationId) {
+        if (step === 'authorize') {
+            const signed = await this.signed({});
+            const response = await this.http.send({ method: 'GET', path: `/resource/v1/upload/get-upload-url?${new URLSearchParams(signed)}`,
+                class: 'write', operationId });
+            check(response, 'errno');
+            const data = object(response.data);
+            const url = str(data.upload_url);
+            const sign = str(data.sign);
+            let endpoint;
+            try {
+                endpoint = new URL(url);
+            }
+            catch {
+                throw unknown();
+            }
+            const host = endpoint.hostname.toLowerCase();
+            if (!sign || endpoint.protocol !== 'https:' || endpoint.username || endpoint.password || endpoint.port || endpoint.hash ||
+                !(host === 'api.open.oppomobile.com' || host === 'oop-openapi-cn.heytapmobi.com' || host.endsWith('.heytapmobi.com')))
+                throw unknown();
+            const grant = { url, sign, expires_at: new Date(Date.now() + 30_000).toISOString() };
+            return { ref: `grant-${operationId}`, material: { value: grant, expiresAt: grant.expires_at } };
+        }
+        if (step === 'upload') {
+            const grant = this.material('authorize');
+            const response = await this.http.multipart(grant.url, { type: 'apk', sign: grant.sign }, { file: this.target.artifact }, 'write', operationId, {}, true);
+            check(response, 'errno');
+            const data = object(response.data);
+            const fileUrl = str(data.url);
+            const size = Number(decimal(data.file_size));
+            const md5 = md5File(this.target.artifact.path, this.target.artifact.sha256);
+            const ref = id(data.id);
+            let endpoint;
+            try {
+                endpoint = new URL(fileUrl);
+            }
+            catch {
+                throw unknown();
+            }
+            if (!['https:', 'http:'].includes(endpoint.protocol) || !endpoint.host || endpoint.username || endpoint.password || endpoint.hash ||
+                size !== this.target.artifact.size || str(data.md5).toLowerCase() !== md5 || data.file_extension !== 'apk' || !ref)
+                throw unknown();
+            const uploaded = { url: fileUrl, md5, ref, size };
+            return { ref, material: { value: uploaded, expiresAt: '9999-12-31T00:00:00.000Z' } };
+        }
+        if (step === 'submit') {
+            const file = this.material('upload');
+            if (file.ref !== this.ref('upload'))
+                throw new Error('OPPO upload receipt differs from file');
+            const baseline = this.savedPreflight().metadata;
+            if (!baseline)
+                throw new Error('OPPO baseline missing');
+            const fields = this.updateFields(baseline, file);
+            const response = await this.http.form('/resource/v1/app/upd', 'write', await this.signed(fields), operationId);
+            check(response, 'errno');
+            if (object(response.data).success !== true)
+                throw unknown();
+            return { ref: `ack-${operationId}` };
+        }
+        throw new Error('unsupported OPPO step');
+    }
+    async observe(_remoteRef) {
+        const details = await this.details(this.batch.version_code);
+        const file = this.material('upload');
+        if (details.appId !== this.savedPreflight().remote_ref || details.metadata.apk_md5?.toLowerCase() !== file.md5 || !details.metadata.version_id)
+            return this.observation('unknown', 'unknown', 'unconfirmed', 'oppo_version_unbound');
+        const code = details.metadata.audit_status;
+        const review = ['1', '4', '00'].includes(code ?? '') ? 'in_review' :
+            ['2', '6', '7', '111'].includes(code ?? '') ? 'approved' :
+                ['3', '5', '-11', '444'].includes(code ?? '') ? 'rejected' : 'unknown';
+        const availability = code === '111' && details.metadata.state === '1' ? 'live' :
+            code === '222' && details.metadata.state === '2' ? 'not_live' : 'unknown';
+        return this.observation(review, availability, 'confirmed', 'oppo_version_audit', details.metadata.version_id);
+    }
+}

package/build/channels/tencent.js

@@ -0,0 +1,96 @@
+import { md5File } from '../private-file.js';
+import { BaseAdapter } from './types.js';
+import { check, decimal, hmacSign, required, str, unknown } from './http.js';
+export class TencentAdapter extends BaseAdapter {
+    channel = 'tencent';
+    steps = ['authorize', 'upload', 'submit'];
+    async call(verb, fields, operationId) {
+        const secret = this.secrets.api_secret ?? '';
+        const userId = this.target.client_id ?? '';
+        required(secret, userId);
+        const signed = { ...fields, user_id: userId, timestamp: String(Math.floor(Date.now() / 1000)) };
+        const form = { ...signed, sign: hmacSign(signed, secret) };
+        const response = await this.http.form(`/open_file/developer_api/${verb}`, operationId ? 'write' : 'read', form, operationId);
+        check(response, 'ret');
+        return response;
+    }
+    async details() {
+        const response = await this.call('query_app_detail', { pkg_name: this.batch.package_name, app_id: this.target.app_id });
+        if (response.pkg_name !== this.batch.package_name)
+            throw unknown();
+        let version = '';
+        for (const key of ['VersionCode', 'version_code']) {
+            if (!(key in response))
+                continue;
+            const raw = response[key];
+            if (!(typeof raw === 'number' && Number.isSafeInteger(raw) || typeof raw === 'bigint'))
+                throw unknown();
+            const next = decimal(raw);
+            if (!next || BigInt(next) <= 0n || BigInt(next) > 9223372036854775807n || version && version !== next)
+                throw unknown();
+            version = next;
+        }
+        if (!version)
+            throw unknown();
+        return { version, appName: str(response.app_name), description: str(response.introduce) };
+    }
+    async preflight() {
+        const details = await this.details();
+        if (BigInt(details.version) >= BigInt(this.batch.version_code))
+            throw new Error('Tencent target version must exceed the existing version');
+        return this.preflightRecord({ remote_version_code: details.version,
+            metadata: { app_name: details.appName, description: details.description } });
+    }
+    async execute(step, operationId) {
+        if (step === 'authorize') {
+            const response = await this.call('get_file_upload_info', { pkg_name: this.batch.package_name,
+                app_id: this.target.app_id, file_type: 'apk', file_name: this.target.artifact.filename }, operationId);
+            const url = str(response.pre_sign_url);
+            const serial = str(response.serial_number);
+            let parsed;
+            try {
+                parsed = new URL(url);
+            }
+            catch {
+                throw unknown();
+            }
+            if (parsed.protocol !== 'https:' || !parsed.hostname.endsWith('.myqcloud.com') || !parsed.hostname.includes('.cos.') || !serial)
+                throw unknown();
+            const signedTime = parsed.searchParams.get('q-sign-time')?.split(';') ?? [];
+            const end = Number(signedTime[1]);
+            if (signedTime.length !== 2 || !Number.isSafeInteger(end) || end <= Date.now() / 1000)
+                throw unknown();
+            const grant = { url, serial, expires_at: new Date(end * 1000).toISOString() };
+            return { ref: serial, material: { value: grant, expiresAt: grant.expires_at } };
+        }
+        if (step === 'upload') {
+            const grant = this.material('authorize');
+            if (grant.serial !== this.ref('authorize'))
+                throw new Error('Tencent upload grant does not match its receipt');
+            await this.http.upload(grant.url, this.target.artifact, operationId);
+            return { ref: grant.serial };
+        }
+        if (step === 'submit') {
+            const serial = this.ref('upload');
+            const abis = this.target.artifact.abis;
+            if (!abis.length || abis.some(abi => !['armeabi-v7a', 'x86', 'arm64-v8a', 'x86_64'].includes(abi)))
+                throw new Error('Tencent APK ABI is missing or unsupported');
+            const slot = abis.some(abi => ['armeabi-v7a', 'x86'].includes(abi)) ? '32' : '64';
+            const fields = { pkg_name: this.batch.package_name, app_id: this.target.app_id,
+                feature: this.batch.release_notes, deploy_type: '1', apk32_flag: '2', apk64_flag: '2',
+                [`apk${slot}_flag`]: '1', [`apk${slot}_file_serial_number`]: serial,
+                [`apk${slot}_file_md5`]: md5File(this.target.artifact.path, this.target.artifact.sha256) };
+            await this.call('update_app', fields, operationId);
+            return { ref: `ack-${operationId}` };
+        }
+        throw new Error('unsupported Tencent step');
+    }
+    async observe(_remoteRef) {
+        const response = await this.call('query_app_update_status', { pkg_name: this.batch.package_name, app_id: this.target.app_id });
+        const code = decimal(response.audit_status);
+        if (!code)
+            throw unknown();
+        const label = { '1': 'in_review', '2': 'rejected', '3': 'approved', '8': 'withdrawn' };
+        return this.observation('unknown', 'unknown', 'unconfirmed', 'tencent_unversioned_audit', undefined, { audit_code: code, audit_status: label[code] ?? 'unknown' });
+    }
+}