mkit-cli 0.3.1__py3-none-any.whl

mkit/commands/dev.py

@@ -0,0 +1,256 @@
+"""Everyday development: run on a device, emulators, logs, version bump."""
+import os
+import sys
+
+from .. import device as dev
+from .. import kinds, proc, toolchain
+from ..errors import UsageError
+from ..git import BUMP_PREFIX, Repo
+from ..registry import Arg, command
+
+DEVICE_ARG = Arg('device', 'adb serial to use when several are attached')
+
+
+def default_log_tags(project):
+    tags = project.get('app.log_tags')
+    if tags is not None:
+        return list(tags)
+    return ['flutter:V', 'AndroidRuntime:E'] if project.kind == 'flutter' else []
+
+
+@command('run', 'Build, install and launch the app on a device', risk='read',
+         args=(Arg('phone', 'use a physical phone', kind='flag', short='p'),
+               Arg('emulator', 'use a running emulator', kind='flag', short='e'),
+               Arg('clean', 'first-install state: uninstall for every user and wipe backup first',
+                   kind='flag', short='c'),
+               Arg('test', "run the project's tests on the device instead", kind='flag', short='t'),
+               Arg('release', 'build the release variant', kind='flag', short='r'),
+               Arg('logs', "native apps: follow this app's logcat afterwards "
+                           "(Shift+R rebuilds, installs and restarts)", kind='flag', short='l'),
+               Arg('install', 'Flutter apps: build, install and open without attaching '
+                              '(no hot reload); used automatically when not at a terminal', kind='flag'),
+               DEVICE_ARG),
+         examples=('mkit run', 'mkit run -p', 'mkit run -c -p', 'mkit run -r', 'mkit run -t',
+                   'mkit run --install -l'),
+         description='Flutter apps run through `flutter run`: r hot reload, R hot restart, q quit, '
+                     'logs in the same terminal. Native apps are built with Gradle, installed and '
+                     'opened; -l then follows logcat, where Shift+R builds and installs the '
+                     'current code and restarts the app.')
+def run(ctx, args):
+    if args.phone and args.emulator:
+        raise UsageError('pass only one of -p or -e')
+    out, project = ctx.out, ctx.project
+    kind = kinds.for_project(project)
+    adb = dev.Adb(project.root)
+    serial = dev.pick(adb, 'phone' if args.phone else 'emulator' if args.emulator else None, args.device)
+    env = dict(os.environ, ANDROID_SERIAL=serial)
+    model = adb.model(serial)
+    variant = 'release' if args.release else 'debug'
+    package = kind.installed_package(args.release)
+    if not args.release and package == project.package:
+        # Same id as the store build, and a different signature: Android can
+        # only install one over the other by removing it, data and all.
+        out.warn(f'debug builds install as {package}, the same package as the Play app, so '
+                 'installing replaces it. Give the debug build type an applicationIdSuffix '
+                 '(".debug") to keep both.')
+
+    # flutter run stays attached to the terminal, so it is only for a person
+    # at one; an agent's shell gets the install-and-open path instead.
+    attached = not out.json and sys.stdin.isatty()
+    if project.kind == 'flutter' and not args.test and not args.install and attached:
+        if args.clean:
+            dev.clean_state(adb, serial, package)
+        out.line(f'flutter run on {model} ({serial})   r hot reload, R hot restart, q quit', 'bold')
+        ctx.exit_code = proc.interactive(
+            [toolchain.tool('flutter'), 'run', '-d', serial] + (['--release'] if args.release else []),
+            cwd=project.root, env=env)
+        return {'device': serial, 'flutter_run': True}
+
+    if args.test:
+        toolchain.find_jdk(project)
+        env.update({k: os.environ[k] for k in ('JAVA_HOME', 'ANDROID_HOME') if k in os.environ})
+        out.line(f'testing on {model} ({serial})', 'bold')
+        ctx.exit_code = kind.test(serial, env)
+        return {'device': serial, 'tests': 'passed' if ctx.exit_code == 0 else 'failed'}
+
+    steps = 4 if args.clean else 3
+    out.start(f'{project.name} run', steps, f'{variant} on {model}')
+    out.step(f'Build {variant} APK')
+    toolchain.find_jdk(project)
+    env.update({k: os.environ[k] for k in ('JAVA_HOME', 'ANDROID_HOME') if k in os.environ})
+    package, apk = kind.assemble(variant, env)
+    out.done(f'{apk.stat().st_size / 1_000_000:.1f} MB')
+
+    if args.clean:
+        out.step('Clean install state')
+        removed, transports = dev.clean_state(adb, serial, package)
+        out.done(f'removed for {removed} user(s), backup wiped on {transports} transport(s)'
+                 if removed or transports else 'nothing installed')
+
+    def install(built):
+        result = adb('install', '-r', str(built), device=serial, timeout=600)
+        if 'Success' not in result:
+            raise UsageError(f'install failed: {result.strip()[-300:]}', code='INSTALL_FAILED',
+                             hint='If the signatures differ, uninstall the app first (mkit run -c).')
+
+    out.step('Install')
+    install(apk)
+    out.done(package)
+
+    out.step('Launch')
+    component = dev.launch(adb, serial, package)
+    out.done(component)
+    out.finish(f'{package} running on {model}')
+    if args.logs:
+        def rebuild():
+            """What Shift+R does: the same build and install this command just did.
+
+            Shift+R used to relaunch whatever was already installed, so somebody who had edited
+            a file and pressed it watched the log of the code they had changed away from, with
+            nothing on screen saying why it had not taken.
+            """
+            _, built = kind.assemble(variant, env)
+            install(built)
+
+        dev.follow_logs(adb, serial, package, default_log_tags(project), rebuild=rebuild)
+    return {'device': serial, 'model': model, 'package': package, 'variant': variant, 'apk': str(apk)}
+
+
+@command('devices', 'List attached devices and emulators', risk='read', needs_project=False)
+def devices(ctx, args):
+    adb = dev.Adb(ctx.project.root if ctx.project else None)
+    rows = [{'serial': s, 'state': st, 'type': 'emulator' if dev.is_emulator(s) else 'phone',
+             'model': adb.model(s) if st == 'device' else ''} for s, st in adb.devices()]
+    if not ctx.out.json:
+        if rows:
+            ctx.out.table([(r['serial'], r['type'], r['state'], r['model']) for r in rows],
+                          ('serial', 'type', 'state', 'model'))
+        else:
+            ctx.out.line('no devices attached')
+    return {'devices': rows}
+
+
+@command('logs', "Follow the app's logcat (Shift+R restarts the app)", risk='read',
+         args=(DEVICE_ARG, Arg('all', "the whole device log, not just this app's", kind='flag'),
+               Arg('release', 'the release (Play) install instead of the debug one',
+                   kind='flag', short='r')),
+         description='Follows the debug install by default, the same one `mkit run` puts on the '
+                     'device; Shift+R restarts that app. -r switches to the release install.')
+def logs(ctx, args):
+    adb = dev.Adb(ctx.project.root)
+    serial = dev.pick(adb, None, args.device)
+    # The debug install unless asked: it is the one being developed, and the
+    # store package used to be restarted by Shift+R here instead.
+    package = kinds.for_project(ctx.project).installed_package(args.release)
+    dev.follow_logs(adb, serial, package, default_log_tags(ctx.project), everything=args.all)
+    return {'device': serial, 'package': package}
+
+
+@command('emu', 'Start an Android emulator (cold boot) and wait for it', risk='read',
+         needs_project=False,
+         args=(Arg('avd', 'emulator name (default: ask, or the only one)', kind='positional', nargs='?'),
+               Arg('list', 'only list the emulators', kind='flag')),
+         examples=('mkit emu', 'mkit emu Pixel_8_API_35', 'mkit emu --list'))
+def emu(ctx, args):
+    root = ctx.project.root if ctx.project else None
+    exe, names = dev.avds(root)
+    out = ctx.out
+    if args.list or not names:
+        if not out.json:
+            for n in names:
+                out.line(f'  {n}')
+            if not names:
+                out.line("no emulators; create one in Android Studio's Device Manager")
+        return {'avds': names}
+    if args.avd:
+        if args.avd not in names:
+            raise UsageError(f'unknown emulator "{args.avd}"; have: {", ".join(names)}')
+        avd = args.avd
+    elif len(names) == 1 or out.json:
+        avd = names[0]
+    else:
+        for i, n in enumerate(names, 1):
+            out.line(f'  {i}) {n}')
+        choice = input(f'\nWhich one? (1-{len(names)}, Enter for 1) ').strip() or '1'
+        try:
+            avd = names[int(choice) - 1]
+        except (ValueError, IndexError):
+            raise UsageError(f'not one of the choices: {choice}') from None
+    out.start('emulator', 1, avd)
+    out.step(f'Boot {avd}')
+    serial = dev.start_emulator(dev.Adb(root), exe, avd, root)
+    out.done(serial)
+    out.finish(f'{avd} ready')
+    return {'avd': avd, 'serial': serial}
+
+
+@command('studio', 'Open this app in Android Studio', risk='read',
+         args=(Arg('android', 'Flutter apps: open the android/ Gradle project instead',
+                   kind='flag', short='a', long=False),),
+         examples=('mkit studio', 'mkit studio -a'),
+         description="Opens the folder Android Studio should have: the repo root for a Flutter "
+                     "app, where the Flutter plugin gives Dart analysis, hot reload and the "
+                     "device list, with android/ indexed underneath. -a opens android/ on its "
+                     "own instead, a plain Gradle project for native work (manifests, AGP, "
+                     "Gradle plugins) with no Dart support. Native apps open at their Gradle "
+                     "root either way. Studio is left running when mkit exits.")
+def studio(ctx, args):
+    project = ctx.project
+    kind = kinds.for_project(project)
+    folder = kind.android_dir if args.android else project.root
+    exe = toolchain.studio(project)
+    if ctx.dry_run:
+        if not ctx.out.json:
+            ctx.out.line(f'would open {folder} in {exe}')
+        return {'folder': str(folder), 'studio': exe, 'pid': None, 'dry_run': True}
+    pid = proc.detach([exe, str(folder)], cwd=project.root)
+    if not ctx.out.json:
+        where = folder if folder == project.root else folder.relative_to(project.root)
+        ctx.out.line(f'Android Studio opening {where}')
+    return {'folder': str(folder), 'studio': exe, 'pid': pid}
+
+
+@command('version', "Show this app's version, as the version file has it", risk='read')
+def version(ctx, args):
+    kind = kinds.for_project(ctx.project)
+    name, code = kind.current_version()
+    if not ctx.out.json:
+        ctx.out.line(f'{name} ({code})   {kind.version.path.relative_to(ctx.project.root)}')
+    return {'versionName': name, 'versionCode': code, 'file': str(kind.version.path)}
+
+
+@command('bump', 'Bump the version name and code (and commit it, unless --no-commit)', risk='write',
+         args=(Arg('level', 'which part of the name', kind='positional', nargs='?',
+                   choices=('major', 'minor', 'patch'), default='patch'),
+               Arg('no_commit', 'change the file only', kind='flag')),
+         examples=('mkit bump', 'mkit bump minor', 'mkit bump --no-commit'))
+def bump(ctx, args):
+    kind = kinds.for_project(ctx.project)
+    old_name, old_code, name, code = kind.bump(args.level)
+    committed = None
+    if not args.no_commit:
+        repo = Repo(ctx.project.root)
+        committed = repo.commit_files([kind.version.path],
+                                      f'{BUMP_PREFIX}{name} (versionCode {code})')[:8]
+    if not ctx.out.json:
+        ctx.out.line(f'{old_name} ({old_code}) -> {name} ({code})' + (f'   commit {committed}' if committed else ''))
+    return {'from': {'versionName': old_name, 'versionCode': old_code},
+            'to': {'versionName': name, 'versionCode': code}, 'commit': committed}
+
+
+@command('gradle', "Run Gradle tasks with the right JDK and folder (lint, clean, test, profiles...)",
+         risk='write',
+         args=(Arg('tasks', 'Gradle tasks and flags, passed through as-is', kind='positional', nargs='...'),),
+         examples=('mkit gradle :app:lintDebug', 'mkit gradle clean', 'mkit gradle :app:testDebugUnitTest',
+                   'mkit gradle :app:generateBaselineProfile'))
+def gradle(ctx, args):
+    """Anything a project did through Gradle before, with the JDK mkit picks and
+    from the Gradle root (android/ for Flutter apps). Output streams as-is."""
+    if not args.tasks:
+        raise UsageError('name at least one Gradle task, e.g. mkit gradle :app:lintDebug')
+    kind = kinds.for_project(ctx.project)
+    jdk = toolchain.find_jdk(ctx.project)
+    env = dict(os.environ, JAVA_HOME=jdk)
+    ctx.exit_code = proc.interactive([toolchain.gradlew(kind.android_dir), *args.tasks],
+                                     cwd=kind.android_dir, env=env)
+    return {'tasks': args.tasks, 'exit': ctx.exit_code}

mkit/commands/doctor.py

@@ -0,0 +1,191 @@
+"""`mkit doctor`: what this project uses, and whether each part can work.
+
+Every feature in mkit.toml is shown as one of:
+
+    on       switched on and everything it needs is present
+    broken   switched on but a credential or tool is missing; steps using it
+             are skipped in pipelines and fail when asked for directly
+    off      not in mkit.toml; this app does not use it
+
+Credentials are opened and parsed, and the non-secret parts (the service
+account email and its Cloud project) are shown, because "the key is there but
+it belongs to another project" is the mistake worth catching early.
+"""
+import os
+import platform
+import shutil
+import sys
+from pathlib import Path
+
+from .. import __version__, config
+from ..errors import FAILED, MkitError
+from ..registry import command
+
+# feature -> credentials it cannot work without
+FEATURE_CREDENTIALS = {
+    'play': ('PLAY_SERVICE_ACCOUNT',),
+    'firebase': ('FIREBASE_SERVICE_ACCOUNT',),
+    'notify.telegram': ('TELEGRAM',),
+}
+
+# Store keys with **no default**, and the commands that cannot run without
+# them. Only these: `listing_dir` falls back to docs/store-listing, `art_dir` to
+# store/ (or [art] out), and `icon` to the art folder's own icon.png, so their
+# absence blocks nothing. The first version of this check listed all five and
+# told two apps their art was broken when it was not.
+#
+# Not a problem either, even for these three: an app with no in-app purchases
+# has no products file on purpose. It is a note about what this app cannot do.
+STORE_KEYS = {
+    'whatsnew_dir': "whatsnew check, and release notes on deploy",
+    'datasafety': 'datasafety build/check/apply',
+    'products': 'products plan/apply',
+}
+
+FEATURE_WHAT = {
+    'play': 'Google Play: upload, tracks, listing, products, reviews, vitals',
+    'store': 'store listing, art, what\'s new and data safety files',
+    'firebase': 'Firestore rules, update doc, Remote Config, symbols',
+    'notify.telegram': 'Telegram message after deploy and promote',
+    'aso': 'keyword rank and winnability checks',
+    'hooks': 'project-specific scripts at fixed pipeline points',
+    'art': 'Play screenshots and the feature graphic, drawn from device captures',
+}
+
+
+def sdk_dir(project=None):
+    for key in ('ANDROID_HOME', 'ANDROID_SDK_ROOT'):
+        if os.environ.get(key):
+            return Path(os.environ[key])
+    if project:
+        for props in (project.root / 'local.properties', project.root / 'android' / 'local.properties'):
+            if props.is_file():
+                for line in props.read_text(encoding='utf-8', errors='replace').splitlines():
+                    if line.startswith('sdk.dir='):
+                        return Path(line[8:].replace('\\:', ':').replace('\\\\', '\\'))
+    guess = Path.home() / ('AppData/Local/Android/Sdk' if os.name == 'nt' else 'Android/Sdk')
+    return guess if guess.is_dir() else None
+
+
+def find_tool(name, project=None):
+    if name == 'adb':
+        # The SDK's adb first: other tools (scrcpy, phone suites) ship their own
+        # adb on PATH, and two adb versions keep killing each other's server.
+        sdk = sdk_dir(project)
+        if sdk:
+            exe = sdk / 'platform-tools' / ('adb.exe' if os.name == 'nt' else 'adb')
+            if exe.is_file():
+                return str(exe)
+    return shutil.which(name)
+
+
+def _credential(ctx, name):
+    source = ctx.secrets.source(name)
+    if not source:
+        return {'name': name, 'status': 'missing'}
+    try:
+        data = ctx.secrets.json(name)
+    except MkitError as e:
+        return {'name': name, 'status': 'unreadable', 'source': source, 'error': e.message}
+    info = {'name': name, 'status': 'ok', 'source': source}
+    for key in ('client_email', 'project_id'):
+        if data.get(key):
+            info[key] = data[key]
+    if name == 'TELEGRAM' and not (data.get('bot_token') and data.get('chat_id')):
+        info.update(status='unreadable', error='needs bot_token and chat_id')
+    return info
+
+
+@command('doctor', 'Check tools, settings and credentials for this project', risk='read',
+         needs_project=False, examples=('mkit doctor', 'mkit doctor --json'))
+def doctor(ctx, args):
+    out = ctx.out
+    project = ctx.project
+    report = {
+        'engine': {'version': __version__, 'python': platform.python_version(),
+                   'executable': sys.executable, 'home': str(config.home())},
+        'project': None, 'tools': [], 'features': [], 'problems': [], 'unavailable': [],
+    }
+
+    if project is None:
+        report['problems'].append('no mkit.toml here or above; run `mkit init` in the app folder')
+    else:
+        report['project'] = {'root': str(project.root), 'name': project.name,
+                             'kind': project.kind, 'package': project.package}
+        for key in ('app.kind', 'app.package'):
+            if not project.get(key):
+                report['problems'].append(f'{key} is not set in mkit.toml')
+
+    wanted = ['git', 'adb']
+    if project and project.kind == 'flutter':
+        wanted.append('flutter')
+    if project and project.section('firebase').get('rules'):
+        wanted.append('firebase')
+    for tool in wanted:
+        path = find_tool(tool, project)
+        report['tools'].append({'name': tool, 'path': path, 'status': 'ok' if path else 'missing'})
+        if not path:
+            report['problems'].append(f'{tool} not found on PATH')
+
+    if project:
+        for feature in config.FEATURES:
+            entry = {'feature': feature, 'what': FEATURE_WHAT.get(feature, ''), 'credentials': []}
+            if not project.has(feature):
+                entry['status'] = 'off'
+            else:
+                creds = [_credential(ctx, n) for n in FEATURE_CREDENTIALS.get(feature, ())]
+                entry['credentials'] = creds
+                bad = [c for c in creds if c['status'] != 'ok']
+                entry['status'] = 'broken' if bad else 'on'
+                if feature == 'store':
+                    missing = [k for k in STORE_KEYS if not project.get(f'store.{k}')]
+                    entry['missing'] = missing
+                    for key in missing:
+                        report['unavailable'].append(
+                            f'[store] has no {key}, so `mkit {STORE_KEYS[key]}` cannot run')
+                for c in bad:
+                    report['problems'].append(
+                        f'[{feature}] {c["name"]} is {c["status"]}'
+                        + (f': {c["error"]}' if c.get('error') else
+                           f'; add MKIT_{c["name"]}_JSON_BASE64 to .env'))
+            report['features'].append(entry)
+
+    if not out.json:
+        _print_report(out, report)
+    if report['problems']:
+        ctx.exit_code = FAILED
+    return report
+
+
+def _print_report(out, report):
+    eng = report['engine']
+    out.heading(f'mkit {eng["version"]}')
+    out.line(f'  python {eng["python"]}   user settings {eng["home"]}', 'dim')
+    proj = report['project']
+    if proj:
+        out.heading(f'{proj["name"]}   {proj["kind"] or "?"}   {proj["package"] or "?"}')
+        out.line(f'  {proj["root"]}', 'dim')
+    out.heading('tools')
+    out.table([(t['name'], t['status'], t['path'] or '') for t in report['tools']],
+              ('tool', 'status', 'path'))
+    if report['features']:
+        out.heading('features')
+        rows = []
+        for f in report['features']:
+            creds = ', '.join(
+                f'{c["name"]}: {c["status"]}' + (f' ({c["client_email"]})' if c.get('client_email') else '')
+                for c in f['credentials'])
+            rows.append((f['feature'], f['status'], creds or f['what']))
+        out.table(rows, ('feature', 'status', 'details'))
+    out.line()
+    if report.get('unavailable'):
+        out.line('not configured, so these cannot run:', 'dim')
+        for note in report['unavailable']:
+            out.line(f'  {note}', 'dim')
+        out.line()
+    if report['problems']:
+        out.line(f'{len(report["problems"])} problem(s):', 'yellow')
+        for p in report['problems']:
+            out.line(f'  - {p}', 'yellow')
+    else:
+        out.line('All good.', 'green')

mkit/commands/firebase_cmds.py

@@ -0,0 +1,194 @@
+"""Remote Config, Firebase app settings, internal app sharing."""
+import json
+import os
+import subprocess
+from pathlib import Path
+
+from .. import kinds, safety, toolchain
+from ..cloud import auth, fbproject
+from ..errors import DRIFT, MkitError, UsageError
+from ..registry import Arg, command, group
+
+group('remoteconfig', 'Firebase Remote Config template')
+group('firebase', 'Firebase app settings (SHA fingerprints, google-services.json)')
+
+
+@command('remoteconfig pull', 'Save the live Remote Config template to the template file', risk='write',
+         needs=('firebase',))
+def rc_pull(ctx, args):
+    template, etag = fbproject.rc_get(ctx)
+    path = fbproject.template_path(ctx)
+    body = {k: template[k] for k in fbproject.TEMPLATE_KEYS if k in template}
+    path.write_text(json.dumps(body, ensure_ascii=False, indent=2) + '\n', encoding='utf-8')
+    version = template.get('version', {}).get('versionNumber')
+    if not ctx.out.json:
+        ctx.out.line(f'version {version}: {len(body.get("parameters", {}))} parameter(s) -> {path}')
+    return {'file': str(path), 'version': version}
+
+
+@command('remoteconfig plan', 'Compare the template file with the live Remote Config', risk='plan',
+         needs=('firebase',))
+def rc_plan(ctx, args):
+    remote, _ = fbproject.rc_get(ctx)
+    changes = fbproject.rc_diff(remote, fbproject.local_template(ctx))
+    if not ctx.out.json:
+        for c in changes:
+            ctx.out.line(f'  {c["change"]:7} {c["parameter"]}')
+        if not changes:
+            ctx.out.line('  no changes', 'green')
+    if changes:
+        ctx.exit_code = DRIFT
+    return {'version': remote.get('version', {}).get('versionNumber'), 'changes': changes}
+
+
+@command('remoteconfig apply', 'Publish the template file as the live Remote Config', risk='publish',
+         needs=('firebase',))
+def rc_apply(ctx, args):
+    remote, etag = fbproject.rc_get(ctx)
+    local = fbproject.local_template(ctx)
+    changes = fbproject.rc_diff(remote, local)
+    if not changes:
+        return {'changes': [], 'changed': False}
+    safety.confirm(ctx, f'Publish Remote Config ({len(changes)} change(s)) to {fbproject.project_id(ctx)}',
+                   [f'{c["change"]} {c["parameter"]}' for c in changes])
+    version = fbproject.rc_publish(ctx, local, etag, validate_only=ctx.dry_run)
+    if not ctx.out.json:
+        ctx.out.line('validated, not published (dry run)' if ctx.dry_run
+                     else f'published version {version.get("versionNumber")}', 'green')
+    return {'changes': changes, 'changed': not ctx.dry_run, 'version': version.get('versionNumber')}
+
+
+@command('remoteconfig versions', 'Recent Remote Config versions', risk='read', needs=('firebase',),
+         args=(Arg('limit', 'how many', type=int, default=10),))
+def rc_versions(ctx, args):
+    versions = fbproject.rc_versions(ctx, args.limit)
+    if not ctx.out.json:
+        ctx.out.table([(v.get('versionNumber'), v.get('updateTime', '')[:19], v.get('updateType', ''),
+                        (v.get('updateUser') or {}).get('email', ''), v.get('description', ''))
+                       for v in versions], ('version', 'time', 'type', 'by', 'description'))
+    return {'versions': versions}
+
+
+@command('remoteconfig rollback', 'Make an earlier Remote Config version live again', risk='publish',
+         needs=('firebase',), args=(Arg('version', 'version number', kind='positional', type=int),))
+def rc_rollback(ctx, args):
+    safety.confirm(ctx, f'Roll Remote Config back to version {args.version}')
+    if ctx.dry_run:
+        return {'version': args.version, 'dry_run': True}
+    version = fbproject.rc_rollback(ctx, args.version)
+    return {'version': version.get('versionNumber'), 'rolledBackTo': args.version}
+
+
+@command('firebase sha', 'SHA fingerprints registered for this app in Firebase', risk='read',
+         needs=('firebase',))
+def fb_sha(ctx, args):
+    app, certs = fbproject.sha_list(ctx)
+    if not ctx.out.json:
+        ctx.out.line(f'{app.get("displayName") or app["packageName"]}  ({app["appId"]})', 'bold')
+        for c in certs:
+            ctx.out.line(f'  {c.get("certType")}  {c.get("shaHash")}')
+        ctx.out.line('Add the Play App Signing key too: Play Console > Setup > App signing.', 'dim')
+    return {'appId': app['appId'], 'certificates': certs}
+
+
+@command('firebase sha-add', 'Register a signing SHA-1/SHA-256 with Firebase (then pull the config)',
+         risk='write', needs=('firebase',), args=(Arg('sha', 'fingerprint, with or without colons', kind='positional'),))
+def fb_sha_add(ctx, args):
+    result = fbproject.sha_add(ctx, args.sha)
+    if not ctx.out.json:
+        ctx.out.line(('added ' if result['changed'] else 'already registered: ') + result['certType'])
+    return result
+
+
+def _write_config(ctx, out=None):
+    """Pull google-services.json into the app module. It lists every Android app
+    in the project, so it carries the debug client too once that exists."""
+    text = fbproject.config_file(ctx)
+    kind = kinds.for_project(ctx.project)
+    module_dir = kind.android_dir / ('app' if ctx.project.kind == 'flutter' else kind.module)
+    path = ctx.project.root / out if out else module_dir / 'google-services.json'
+    changed = not path.is_file() or path.read_text(encoding='utf-8') != text
+    if changed:
+        path.write_text(text, encoding='utf-8')
+    return path, changed
+
+
+@command('firebase config', 'Download google-services.json for this app', risk='write', needs=('firebase',),
+         args=(Arg('out', 'where to write it (default: the Android app module)'),))
+def fb_config(ctx, args):
+    path, changed = _write_config(ctx, args.out)
+    if not ctx.out.json:
+        ctx.out.line(f'{"wrote" if changed else "unchanged"} {path}')
+    return {'file': str(path), 'changed': changed}
+
+
+def _debug_key_fingerprints(ctx):
+    """SHA-1 and SHA-256 of this computer's Android debug key, or {} without one."""
+    keystore = Path.home() / '.android' / 'debug.keystore'
+    if not keystore.is_file():
+        return {}
+    jdk = Path(toolchain.find_jdk(ctx.project))
+    keytool = jdk / 'bin' / ('keytool.exe' if os.name == 'nt' else 'keytool')
+    result = subprocess.run([str(keytool), '-list', '-v', '-keystore', str(keystore),
+                             '-alias', 'androiddebugkey', '-storepass', 'android', '-keypass', 'android'],
+                            capture_output=True, text=True, timeout=60)
+    return fbproject.parse_fingerprints(result.stdout) if result.returncode == 0 else {}
+
+
+@command('firebase debug-app', "Register the debug build's package with Firebase, then pull the config",
+         risk='write', needs=('firebase',),
+         description='For a debug build type with an applicationIdSuffix: Firebase, and the '
+                     'google-services Gradle plugin, only accept packages registered in the '
+                     "project. Registers it when missing, adds this computer's debug key "
+                     '(SHA-1 and SHA-256, for Google sign-in) and writes google-services.json. '
+                     'Safe to run again.')
+def fb_debug_app(ctx, args):
+    out, project = ctx.out, ctx.project
+    package = kinds.for_project(project).debug_package()
+    if package == project.package:
+        raise UsageError(f'debug builds install as {package}, the store package, so there is nothing '
+                         'to register',
+                         hint='Give the debug build type an applicationIdSuffix (".debug") first.',
+                         code='NO_DEBUG_SUFFIX')
+    app, created = fbproject.ensure_android_app(ctx, package, f'{project.name} (debug)')
+    certificates = []
+    for cert_type, sha in _debug_key_fingerprints(ctx).items():
+        certificates.append(fbproject.sha_add(ctx, sha, package))
+    path, changed = _write_config(ctx)
+    if not out.json:
+        out.line(f'{"registered" if created else "already registered"} {package}')
+        for c in certificates:
+            out.line(f'  {c["certType"]} {"added" if c["changed"] else "already there"}')
+        if not certificates:
+            out.line('  no debug key found in ~/.android; Google sign-in in debug builds needs one', 'dim')
+        out.line(f'{"wrote" if changed else "unchanged"} {path}')
+    return {'package': package, 'appId': app.get('appId'), 'created': created,
+            'certificates': certificates, 'file': str(path), 'config_changed': changed}
+
+
+@command('share', 'Build the release bundle and get an internal app sharing link', risk='write',
+         needs=('play',), args=(Arg('no_build', 'upload the bundle already built', kind='flag'),))
+def share(ctx, args):
+    kind = kinds.for_project(ctx.project)
+    out = ctx.out
+    out.start(f'{ctx.project.name} share', 2, 'internal app sharing')
+    out.step('Build release bundle')
+    if not args.no_build:
+        jdk = toolchain.find_jdk(ctx.project)
+        kind.bundle(dict(os.environ, JAVA_HOME=jdk))
+    module = kind.modules()[0]
+    if not module.aab.is_file():
+        raise MkitError(f'no bundle at {module.aab}', code='NO_BUNDLE')
+    out.done(f'{module.aab.stat().st_size / 1_000_000:.1f} MB')
+    out.step('Upload')
+    from googleapiclient.http import MediaFileUpload
+    svc = auth.play(ctx)
+    try:
+        result = svc.internalappsharingartifacts().uploadbundle(
+            packageName=ctx.project.package,
+            media_body=MediaFileUpload(str(module.aab), mimetype='application/octet-stream')).execute()
+    except Exception as e:
+        raise auth.translate(e, 'Play') from None
+    out.done()
+    out.finish(result.get('downloadUrl', ''))
+    return {'downloadUrl': result.get('downloadUrl'), 'sha256': result.get('sha256')}