feat(kilo-pass): add Google Play publisher SDK

[iscekic]

Summary

No new behavior. This level adds the server-side Google Play purchase verification foundation; no user-facing feature, screen, or option changes yet.

---

Google Play subscription verification is added through the Android Publisher SDK. createGooglePlayAndroidPublisherClient reads the new secret GOOGLE_PLAY_PUBLISHER_SERVICE_ACCOUNT_JSON, rejects JSON without a client email or a private key, and caches the client by that JSON value. getGooglePlaySubscriptionPurchase(purchaseToken) calls subscriptions v2 get for the fixed package com.kilocode.kiloapp and returns the record.

Files

• apps/web/src/lib/kilo-pass/google-play-sdk.ts — adds the package name, the cached publisher client, credential parsing, and the subscriptions v2 get helper.
• apps/web/package.json — adds the @googleapis/androidpublisher 37.0.0 dependency.

getMobileStoreKiloPassProductByGoogleProductId(googleProductId) is added beside the Apple lookup. It returns the product whose Google product ID matches, or null when nothing matches. The Google product IDs already exist in the product table, so no product data changes.

Files

• apps/web/src/lib/kilo-pass/mobile-store-products.ts — adds the Google product ID lookup helper.

Two Google Play environment values are documented in the catalog. GOOGLE_PLAY_PUBLISHER_SERVICE_ACCOUNT_JSON is a secret service account for the publisher API, and GOOGLE_PLAY_RTDN_PUSH_AUDIENCE is the expected OIDC audience for the later real-time notification push. Neither has a default, and the push audience is not yet read by any code.

Files

• ENVIRONMENT.md — documents the two values under the Apple / In-App Purchases section.

Tests: 2 new test files cover the client cache, the auth scope, the get call, the error paths, and the Google product lookup.
Generated: 1 lockfile updated.

---

Verification

No E2E report is attached at this level. No manual tests were run at this level.

E2E: bot-e2e — runtime verification runs once on the tip PR (level 6) after all levels land. This level is reviewed on its own diff.

Visual Changes

Visual Changes: N/A

Reviewer Notes

Human steps:

• After merge: set GOOGLE_PLAY_PUBLISHER_SERVICE_ACCOUNT_JSON (secret) and GOOGLE_PLAY_RTDN_PUSH_AUDIENCE (server) in the shared web environment. Run pnpm web:env set <VARIABLE> for each. Agents must not run this command because it prompts for secret values and writes to external systems.

Notes:

• E2E: bot-e2e — runtime verification runs once on the tip PR (level 6) after all levels land. This level is reviewed on its own diff.

Stacked PRs — merge bottom to top. Each level shows only its own diff.

Runtime verification (E2E, user advocacy, simplify) runs on the tip PR over every level.
Every level keeps its own checks, its own bot review, and its own threads; each one is answered on its own PR.
Each level is its own deliverable: it builds and passes its own checks alone.
A finding on a level is repaired on that level, then carried upward with stack.sh forward.

1. android-iap-e895 — feat(commerce): add Play Kilo Pass presentation flag #5581
2. android-iap-e895-s2 — feat(kilo-pass): add Google Play publisher SDK #5582 ← this PR
3. android-iap-e895-s3 — feat(kilo-pass): add Google Play purchase verifier #5586
4. android-iap-e895-s4 — feat(kilo-pass): handle Play real-time notifications #5598
5. android-iap-e895-s5 — feat(kilo-pass): add completePlayPurchase mutation #5608
6. android-iap-e895-s6 — feat(mobile): offer Google Play Kilo Pass purchase #5618 (tip)

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (8 files)

• ENVIRONMENT.md
• apps/web/package.json
• apps/web/src/lib/kilo-pass/google-play-sdk.test.ts
• apps/web/src/lib/kilo-pass/google-play-sdk.ts
• apps/web/src/lib/kilo-pass/mobile-store-products.test.ts
• apps/web/src/lib/kilo-pass/mobile-store-products.ts
• pnpm-lock.yaml
• pnpm-workspace.yaml

Previous Review Summary (commit 3265f4b)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 3265f4b)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (7 files)

• ENVIRONMENT.md
• apps/web/package.json
• apps/web/src/lib/kilo-pass/google-play-sdk.test.ts
• apps/web/src/lib/kilo-pass/google-play-sdk.ts
• apps/web/src/lib/kilo-pass/mobile-store-products.test.ts
• apps/web/src/lib/kilo-pass/mobile-store-products.ts
• pnpm-lock.yaml

---

_{Reviewed by grok-4.6 · Input: 141.2K · Output: 8.7K · Cached: 119.9K}

_{Review guidance: REVIEW.md from base branch android-iap-e895}