Wydaj aplikację kierowcy 1.0.63 (116)

.gitignore

@@ -9,3 +9,5 @@ keystore.properties
 *.jks
 release-artifacts/
 app/src/main/res_bak/
+scripts/*.json
+scripts/*.json:Zone.Identifier

README.md

@@ -31,9 +31,51 @@ Przed wydaniem zapisz wszystkie zmiany źródłowe w commicie. Następnie urucho
 ```
 
 Skrypt automatycznie zwiększa `versionCode` i ostatni człon `versionName`, uruchamia testy,
-buduje podpisany APK dla Gitea oraz AAB dla Google Play Console, tworzy commit wersji,
-tag, push i Gitea Release. Artefakty zostają również zapisane lokalnie w
-`release-artifacts/<tag>/`.
+buduje podpisany APK oraz AAB, a po poprawnym buildzie pyta, czy wysłać aktualizację do
+Google Play. Po odpowiedzi „tak” publikuje AAB w skonfigurowanym teście zamkniętym i
+wysyła zmiany do weryfikacji. Następnie tworzy commit wersji, tag, push i Gitea Release.
+Artefakty zostają również zapisane lokalnie w `release-artifacts/<tag>/`.
+
+Do publikacji Google Play konto serwisowe musi mieć dla aplikacji
+`pl.firmatpp.kierowca` uprawnienia „Wyświetlanie informacji o aplikacji (tylko do odczytu)”
+oraz „Publikowanie aplikacji na ścieżkach testowych”. Pobrany klucz JSON umieść
+bezpośrednio w folderze `scripts`, na przykład:
+
+```text
+scripts/google-play-service-account.json
+```
+
+Skrypt sam znajduje jedyny plik `scripts/*.json`, sprawdza, czy jest prawidłowym kluczem
+konta serwisowego, i używa go do autoryzacji. Pliki `scripts/*.json` są ignorowane przez
+Git i nie mogą zostać przypadkowo dodane do repozytorium. Jeśli w folderze znajduje się
+więcej niż jeden prawidłowy klucz, skrypt przerwie działanie i poprosi o pozostawienie
+jednego.
+
+`GOOGLE_PLAY_TRACK` musi być identyfikatorem istniejącego testu zamkniętego. Domyślna
+wartość to `alpha`. Opcjonalnie można ustawić `GOOGLE_PLAY_PACKAGE_NAME` i
+`GOOGLE_PLAY_RELEASE_LANGUAGE` (domyślnie `pl-PL`). Zmienna
+`GOOGLE_PLAY_SERVICE_ACCOUNT_CREDENTIALS` pozostaje opcjonalnym sposobem wskazania klucza
+spoza folderu `scripts`. Skrypt nie zapisuje tokenu ani klucza w repozytorium; prywatny
+klucz tymczasowy jest usuwany po zakończeniu.
+
+Przed zatwierdzeniem skrypt waliduje edycję Google Play. Commit edycji jawnie wysyła
+zmiany do weryfikacji. Jeżeli inne zmiany są już sprawdzane, skrypt nie anuluje ich —
+kończy się błędem i można go wznowić po zakończeniu poprzedniej weryfikacji.
+Jeżeli na koncie jest włączone publikowanie zarządzane, po akceptacji Google nadal trzeba
+wybrać „Opublikuj zmiany” w Play Console; bez publikowania zarządzanego zaakceptowane
+wydanie zostanie udostępnione testerom automatycznie.
+
+Awaryjne wydanie wyłącznie do Gitea, bez Google Play:
+
+```bash
+./scripts/release-android.sh --skip-google-play
+```
+
+W środowisku bez interaktywnego terminala decyzję trzeba podać jawnie:
+
+```bash
+./scripts/release-android.sh --publish-google-play
+```
 
 Do autoryzacji Gitea używany jest `GITEA_TOKEN` albo dane zapisane w Git credential helper.
 Jeśli publikacja została przerwana już po utworzeniu commita wersji, można ją wznowić:

app/build.gradle.kts

@@ -34,8 +34,8 @@ android {
         applicationId = "pl.firmatpp.kierowca"
         minSdk = 26
         targetSdk = 35
-        versionCode = 112
-        versionName = "1.0.59"
+        versionCode = 116
+        versionName = "1.0.63"
         setProperty("archivesBaseName", "pl.firmatpp.kierowca")
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
 
@@ -130,6 +130,8 @@ dependencies {
     implementation(libs.okhttp.logging)
     implementation(libs.play.services.auth)
     implementation(libs.play.services.auth.api.phone)
+    implementation(libs.play.app.update)
+    implementation(libs.play.app.update.ktx)
     implementation(libs.retrofit)
     implementation(libs.retrofit.gson)
 

app/src/main/java/pl/firmatpp/kierowca/MainActivity.kt

@@ -3,6 +3,7 @@ package pl.firmatpp.kierowca
 import android.os.Bundle
 import androidx.activity.ComponentActivity
 import androidx.activity.compose.setContent
+import androidx.activity.result.contract.ActivityResultContracts
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.setValue
@@ -11,17 +12,33 @@ import androidx.lifecycle.viewmodel.compose.viewModel
 import pl.firmatpp.kierowca.ui.DriverApp
 import pl.firmatpp.kierowca.ui.DriverViewModel
 import pl.firmatpp.kierowca.ui.theme.TppKierowcaTheme
+import pl.firmatpp.kierowca.update.PlayAppUpdateState
+import pl.firmatpp.kierowca.update.PlayInAppUpdateController
 
 class MainActivity : ComponentActivity() {
     private var notificationRouteId by mutableStateOf<String?>(null)
     private var notificationRouteTarget by mutableStateOf<String?>(null)
     private var notificationLeaveRequestId by mutableStateOf<String?>(null)
+    private var playAppUpdateState by mutableStateOf(PlayAppUpdateState())
+    private lateinit var playInAppUpdates: PlayInAppUpdateController
+    private val appUpdateLauncher = registerForActivityResult(
+        ActivityResultContracts.StartIntentSenderForResult(),
+    ) { result ->
+        if (::playInAppUpdates.isInitialized) {
+            playInAppUpdates.onUpdateFlowResult(result.resultCode)
+        }
+    }
 
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
         notificationRouteId = intent.getStringExtra(EXTRA_ROUTE_ID)
         notificationRouteTarget = intent.getStringExtra(EXTRA_ROUTE_TARGET)
         notificationLeaveRequestId = intent.getStringExtra(EXTRA_LEAVE_REQUEST_ID)
+        playInAppUpdates = PlayInAppUpdateController(
+            activity = this,
+            launcher = appUpdateLauncher,
+            onStateChanged = { playAppUpdateState = it },
+        )
         setContent {
             val viewModel: DriverViewModel = viewModel()
             val state by viewModel.state.collectAsStateWithLifecycle()
@@ -32,9 +49,27 @@ class MainActivity : ComponentActivity() {
                     initialRouteId = notificationRouteId,
                     initialRouteTarget = notificationRouteTarget,
                     initialLeaveRequestId = notificationLeaveRequestId,
+                    playAppUpdateState = playAppUpdateState,
+                    onStartAppUpdate = playInAppUpdates::startUpdate,
+                    onCompleteAppUpdate = playInAppUpdates::completeDownloadedUpdate,
                 )
             }
         }
+        playInAppUpdates.checkForUpdate()
+    }
+
+    override fun onResume() {
+        super.onResume()
+        if (::playInAppUpdates.isInitialized) {
+            playInAppUpdates.checkForUpdate()
+        }
+    }
+
+    override fun onDestroy() {
+        if (::playInAppUpdates.isInitialized) {
+            playInAppUpdates.dispose()
+        }
+        super.onDestroy()
     }
 
     override fun onNewIntent(intent: android.content.Intent) {

app/src/main/java/pl/firmatpp/kierowca/data/model/DriverModels.kt

@@ -50,6 +50,16 @@ data class BootstrapResponse(
     val notificationPreferences: NotificationPreferencesDto? = null,
     val realtime: RealtimeConfigDto? = null,
     val syncState: SyncStateResponse? = null,
+    val appUpdate: AppUpdateDto? = null,
+)
+
+data class AppUpdateDto(
+    val latestVersionCode: Int? = null,
+    val latestVersionName: String? = null,
+    val minimumSupportedVersionCode: Int = 0,
+    val playStoreUrl: String? = null,
+    val track: String? = null,
+    val checkedAt: String? = null,
 )
 
 data class DriverAppSettingsDto(

app/src/main/java/pl/firmatpp/kierowca/data/upload/RoutePointWorker.kt

@@ -67,9 +67,11 @@ class RoutePointWorker(
                     "retryable" to error.retryable,
                 ),
             )
+            if (shouldStopRouteTrackingAfterPointError(error.kind, error.code)) {
+                ActiveRouteTrackingService.stop(applicationContext, routeId)
+            }
             if (isInactiveRoutePointError(error.code)) {
                 dao.delete(pointIds)
-                ActiveRouteTrackingService.stop(applicationContext, routeId)
                 continue
             }
 
@@ -105,3 +107,6 @@ class RoutePointWorker(
 }
 
 internal fun isInactiveRoutePointError(code: String?): Boolean = code == "ROUTE_POINTS_INVALID_STATUS"
+
+internal fun shouldStopRouteTrackingAfterPointError(kind: ApiErrorKind, code: String?): Boolean =
+    kind == ApiErrorKind.Auth || isInactiveRoutePointError(code)

app/src/main/java/pl/firmatpp/kierowca/tracking/ActiveRouteTrackingService.kt

@@ -136,6 +136,13 @@ class ActiveRouteTrackingService : Service(), LocationListener {
 
     override fun onDestroy() {
         runCatching { locationManager.removeUpdates(this) }
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {
+            stopForeground(STOP_FOREGROUND_REMOVE)
+        } else {
+            @Suppress("DEPRECATION")
+            stopForeground(true)
+        }
+        getSystemService(NotificationManager::class.java).cancel(NOTIFICATION_ID)
         getSharedPreferences(TRACKING_PREFERENCES, Context.MODE_PRIVATE)
             .edit()
             .remove(ACTIVE_ROUTE_ID)

app/src/main/java/pl/firmatpp/kierowca/ui/DriverApp.kt

@@ -2,6 +2,7 @@ package pl.firmatpp.kierowca.ui
 
 import android.Manifest
 import android.app.Activity
+import android.content.ActivityNotFoundException
 import android.content.BroadcastReceiver
 import android.content.Context
 import android.content.Intent
@@ -12,6 +13,7 @@ import android.location.LocationManager
 import android.net.Uri
 import android.os.Build
 import android.provider.Settings
+import android.widget.Toast
 import androidx.compose.animation.AnimatedContent
 import androidx.compose.animation.AnimatedVisibility
 import androidx.compose.animation.fadeIn
@@ -72,6 +74,7 @@ import androidx.compose.material.icons.outlined.Navigation
 import androidx.compose.material.icons.outlined.Person
 import androidx.compose.material.icons.outlined.Phone
 import androidx.compose.material.icons.outlined.Refresh
+import androidx.compose.material.icons.outlined.SystemUpdate
 import androidx.compose.material.ExperimentalMaterialApi
 import androidx.compose.material.pullrefresh.PullRefreshIndicator
 import androidx.compose.material.pullrefresh.pullRefresh
@@ -147,6 +150,7 @@ import kotlinx.coroutines.delay
 import kotlinx.coroutines.flow.distinctUntilChanged
 import java.util.Locale
 import pl.firmatpp.kierowca.R
+import pl.firmatpp.kierowca.BuildConfig
 import pl.firmatpp.kierowca.data.PhotoUploadMetadata
 import pl.firmatpp.kierowca.data.model.DispatchSheetReminderDto
 import pl.firmatpp.kierowca.data.model.DriverLeaveCalendarEntryDto
@@ -167,6 +171,7 @@ import pl.firmatpp.kierowca.domain.RouteDisplayMapper
 import pl.firmatpp.kierowca.domain.StartupSessionPolicy
 import pl.firmatpp.kierowca.ui.theme.AppThemeMode
 import pl.firmatpp.kierowca.ui.theme.TppTheme
+import pl.firmatpp.kierowca.update.PlayAppUpdateState
 
 @Composable
 fun DriverApp(
@@ -174,8 +179,27 @@ fun DriverApp(
     initialRouteId: String? = null,
     initialRouteTarget: String? = null,
     initialLeaveRequestId: String? = null,
+    playAppUpdateState: PlayAppUpdateState = PlayAppUpdateState(),
+    onStartAppUpdate: (required: Boolean, playStoreUrl: String?) -> Unit = { _, _ -> },
+    onCompleteAppUpdate: () -> Unit = {},
 ) {
     val state by viewModel.state.collectAsState()
+    val updateUi = appUpdateBannerUi(
+        currentVersionCode = BuildConfig.VERSION_CODE,
+        latestVersionCode = state.appUpdate?.latestVersionCode,
+        latestVersionName = state.appUpdate?.latestVersionName,
+        minimumSupportedVersionCode = state.appUpdate?.minimumSupportedVersionCode ?: 0,
+        playUpdateAvailable = playAppUpdateState.updateAvailable,
+        playAvailableVersionCode = playAppUpdateState.availableVersionCode,
+        updateDownloaded = playAppUpdateState.downloaded,
+    )
+    val runUpdate = {
+        if (updateUi?.downloaded == true) {
+            onCompleteAppUpdate()
+        } else {
+            onStartAppUpdate(updateUi?.required == true, state.appUpdate?.playStoreUrl)
+        }
+    }
     val lifecycleOwner = LocalLifecycleOwner.current
     val context = LocalContext.current
     var appInForeground by remember { mutableStateOf(true) }
@@ -397,6 +421,80 @@ fun DriverApp(
                 CircularProgressIndicator(color = TppTheme.colors.forest)
             }
         }
+
+        if (updateUi != null && !updateUi.required) {
+            AppUpdateBanner(
+                update = updateUi,
+                onUpdate = runUpdate,
+                modifier = Modifier
+                    .align(Alignment.TopCenter)
+                    .statusBarsPadding()
+                    .padding(horizontal = 12.dp, vertical = 8.dp),
+            )
+        }
+    }
+
+    if (updateUi?.required == true) {
+        AlertDialog(
+            onDismissRequest = {},
+            title = {
+                Text(
+                    "Wymagana aktualizacja",
+                    color = TppTheme.colors.ink,
+                    fontWeight = FontWeight.Bold,
+                )
+            },
+            text = { Text(updateUi.message, color = TppTheme.colors.muted) },
+            confirmButton = {
+                Button(
+                    onClick = runUpdate,
+                    colors = ButtonDefaults.buttonColors(containerColor = TppTheme.colors.forest),
+                ) {
+                    Text(updateUi.actionLabel, color = Color.White, fontWeight = FontWeight.Bold)
+                }
+            },
+        )
+    }
+}
+
+@Composable
+private fun AppUpdateBanner(
+    update: AppUpdateBannerUi,
+    onUpdate: () -> Unit,
+    modifier: Modifier = Modifier,
+) {
+    Card(
+        colors = CardDefaults.cardColors(containerColor = TppTheme.colors.warningContainer),
+        border = BorderStroke(1.dp, TppTheme.colors.warningOutline),
+        shape = MaterialTheme.shapes.medium,
+        modifier = modifier.fillMaxWidth(),
+    ) {
+        Row(
+            Modifier.fillMaxWidth().padding(14.dp),
+            verticalAlignment = Alignment.CenterVertically,
+            horizontalArrangement = Arrangement.spacedBy(12.dp),
+        ) {
+            Box(
+                Modifier.size(40.dp).background(Color.White, RoundedCornerShape(6.dp)),
+                contentAlignment = Alignment.Center,
+            ) {
+                Icon(Icons.Outlined.SystemUpdate, contentDescription = null, tint = TppTheme.colors.forest)
+            }
+            Text(
+                update.message,
+                color = Color(0xFF5F4200),
+                fontWeight = FontWeight.Bold,
+                modifier = Modifier.weight(1f),
+            )
+            Button(
+                onClick = onUpdate,
+                colors = ButtonDefaults.buttonColors(containerColor = TppTheme.colors.forest),
+                shape = MaterialTheme.shapes.small,
+                contentPadding = PaddingValues(horizontal = 14.dp, vertical = 10.dp),
+            ) {
+                Text(update.actionLabel, color = Color.White, fontWeight = FontWeight.Bold)
+            }
+        }
     }
 }
 
@@ -3565,7 +3663,10 @@ private fun RoutePointBlock(
                 Text(subtitle, color = TppTheme.colors.muted, style = MaterialTheme.typography.bodyLarge)
             }
         }
-        if (navigationPoint?.hasCoordinates() == true) {
+        if (
+            navigationPoint != null &&
+            hasValidNavigationCoordinates(navigationPoint.latitude, navigationPoint.longitude)
+        ) {
             IconButton(
                 onClick = { onNavigate(navigationPoint) },
                 modifier = Modifier.size(42.dp).background(TppTheme.colors.forest, RoundedCornerShape(21.dp)),
@@ -4356,24 +4457,29 @@ private fun createCameraUri(context: Context): Uri {
     return FileProvider.getUriForFile(context, "${context.packageName}.fileprovider", file)
 }
 
-private fun NavigationPointDto.hasCoordinates(): Boolean = latitude != null && longitude != null
-
 private fun openNavigation(context: Context, point: NavigationPointDto) {
-    val latitude = point.latitude ?: return
-    val longitude = point.longitude ?: return
-    val googleMapsIntent = Intent(Intent.ACTION_VIEW, Uri.parse("google.navigation:q=$latitude,$longitude"))
-        .setPackage("com.google.android.apps.maps")
+    val candidates = navigationIntentCandidates(point.latitude, point.longitude, point.label)
 
-    if (googleMapsIntent.resolveActivity(context.packageManager) != null) {
-        context.startActivity(googleMapsIntent)
-        return
+    for (candidate in candidates) {
+        val intent = Intent(Intent.ACTION_VIEW, Uri.parse(candidate.uri)).apply {
+            candidate.packageName?.let(::setPackage)
+        }
+
+        try {
+            context.startActivity(intent)
+            return
+        } catch (_: ActivityNotFoundException) {
+            // Try the next navigation provider.
+        } catch (_: SecurityException) {
+            // The provider is unavailable to this app; use the next fallback.
+        }
     }
 
-    val label = Uri.encode(point.label?.takeIf { it.isNotBlank() } ?: "Cel")
-    val geoIntent = Intent(Intent.ACTION_VIEW, Uri.parse("geo:0,0?q=$latitude,$longitude($label)"))
-    if (geoIntent.resolveActivity(context.packageManager) != null) {
-        context.startActivity(geoIntent)
-    }
+    Toast.makeText(
+        context,
+        "Nie znaleziono aplikacji, która może otworzyć nawigację.",
+        Toast.LENGTH_LONG,
+    ).show()
 }
 
 private fun cameraCapturePermissions(context: Context, requirePreciseLocation: Boolean): Array<String> = buildList {

app/src/main/java/pl/firmatpp/kierowca/ui/DriverUiRules.kt

@@ -3,6 +3,7 @@ package pl.firmatpp.kierowca.ui
 import java.io.File
 import java.math.BigDecimal
 import java.math.RoundingMode
+import java.net.URLEncoder
 import java.time.DayOfWeek
 import java.time.LocalDate
 import java.time.OffsetDateTime
@@ -24,6 +25,84 @@ import pl.firmatpp.kierowca.data.upload.RouteActionType
 private val shortDateFormatter: DateTimeFormatter = DateTimeFormatter.ofPattern("dd.MM")
 private val routeWeightKilogramInputThreshold = BigDecimal("1000")
 private const val routeWeightMaxTons = 999.999
+private const val googleMapsPackage = "com.google.android.apps.maps"
+
+data class NavigationIntentCandidate(
+    val uri: String,
+    val packageName: String? = null,
+)
+
+data class AppUpdateBannerUi(
+    val message: String,
+    val actionLabel: String,
+    val required: Boolean,
+    val downloaded: Boolean,
+)
+
+fun appUpdateBannerUi(
+    currentVersionCode: Int,
+    latestVersionCode: Int?,
+    latestVersionName: String?,
+    minimumSupportedVersionCode: Int,
+    playUpdateAvailable: Boolean,
+    playAvailableVersionCode: Int?,
+    updateDownloaded: Boolean,
+): AppUpdateBannerUi? {
+    val highestAvailableVersion = listOfNotNull(latestVersionCode, playAvailableVersionCode).maxOrNull()
+    val required = minimumSupportedVersionCode > 0 && currentVersionCode < minimumSupportedVersionCode
+    val available = updateDownloaded ||
+        playUpdateAvailable ||
+        highestAvailableVersion?.let { it > currentVersionCode } == true ||
+        required
+    if (!available) return null
+
+    val versionLabel = latestVersionName
+        ?.takeIf { it.isNotBlank() }
+        ?.let { " $it" }
+        .orEmpty()
+    val message = when {
+        updateDownloaded -> "Aktualizacja$versionLabel jest pobrana i gotowa do instalacji."
+        required -> "Ta wersja aplikacji nie jest już obsługiwana. Zaktualizuj ją, aby kontynuować."
+        else -> "Dostępna jest nowa wersja aplikacji$versionLabel."
+    }
+
+    return AppUpdateBannerUi(
+        message = message,
+        actionLabel = if (updateDownloaded) "Zainstaluj" else "Aktualizuj",
+        required = required,
+        downloaded = updateDownloaded,
+    )
+}
+
+fun hasValidNavigationCoordinates(latitude: Double?, longitude: Double?): Boolean =
+    latitude != null &&
+        longitude != null &&
+        latitude.isFinite() &&
+        longitude.isFinite() &&
+        latitude in -90.0..90.0 &&
+        longitude in -180.0..180.0
+
+fun navigationIntentCandidates(
+    latitude: Double?,
+    longitude: Double?,
+    label: String?,
+): List<NavigationIntentCandidate> {
+    if (!hasValidNavigationCoordinates(latitude, longitude)) return emptyList()
+
+    val coordinates = "$latitude,$longitude"
+    val encodedLabel = URLEncoder
+        .encode(label?.takeIf { it.isNotBlank() } ?: "Cel", Charsets.UTF_8.name())
+        .replace("+", "%20")
+
+    return listOf(
+        NavigationIntentCandidate(
+            uri = "google.navigation:q=$coordinates",
+            packageName = googleMapsPackage,
+        ),
+        NavigationIntentCandidate(uri = "geo:0,0?q=$coordinates($encodedLabel)"),
+        NavigationIntentCandidate(uri = "https://www.google.com/maps/dir/?api=1&destination=$coordinates"),
+    )
+}
 
 enum class RouteFlowStepState {
     Todo,

app/src/main/java/pl/firmatpp/kierowca/ui/DriverViewModel.kt

@@ -24,6 +24,7 @@ import pl.firmatpp.kierowca.data.sync.DriverSyncRepository
 import pl.firmatpp.kierowca.data.sync.NetworkMonitor
 import pl.firmatpp.kierowca.data.sync.StartupOfflineFallbackLoader
 import pl.firmatpp.kierowca.data.model.DispatchSheetReminderDto
+import pl.firmatpp.kierowca.data.model.AppUpdateDto
 import pl.firmatpp.kierowca.data.model.DriverDto
 import pl.firmatpp.kierowca.data.model.DriverLeaveCalendarEntryDto
 import pl.firmatpp.kierowca.data.model.DriverLeaveRequestDto
@@ -92,6 +93,7 @@ data class DriverUiState(
     val photoUploads: List<PhotoUploadEntity> = emptyList(),
     val queuedPhotoUploads: List<PhotoUploadEntity> = emptyList(),
     val dispatchSheetReminder: DispatchSheetReminderDto? = null,
+    val appUpdate: AppUpdateDto? = null,
     val dispatchSheetUploads: List<DispatchSheetUploadEntity> = emptyList(),
     val leaveRequestsConfig: LeaveRequestsConfig? = null,
     val leaveRequests: List<DriverLeaveRequestDto> = emptyList(),
@@ -422,6 +424,7 @@ class DriverViewModel(application: Application) : AndroidViewModel(application)
                         driver = response.session.driver,
                         routes = response.routes.today,
                         dispatchSheetReminder = response.dispatchSheetReminder,
+                        appUpdate = response.appUpdate ?: it.appUpdate,
                         selectedDate = settings?.selectedDate ?: date ?: it.selectedDate,
                         minRouteDate = settings?.minDate ?: it.minRouteDate,
                         maxRouteDate = settings?.maxDate ?: it.maxRouteDate,
@@ -460,15 +463,14 @@ class DriverViewModel(application: Application) : AndroidViewModel(application)
             }.onFailure { throwable ->
                 if (generation != routesRequestGeneration) return@onFailure
                 reportHandledException("load_routes", throwable, mapOf("date" to date))
-                _state.update {
-                    val apiError = ApiErrorMapper.map(throwable)
-                    it.withApiError(throwable).copy(
-                        screen = when {
-                            apiError.kind == ApiErrorKind.Auth -> DriverScreen.Phone
-                            it.screen == DriverScreen.Initializing -> DriverScreen.Routes
-                            else -> it.screen
-                        },
-                    )
+                if (ApiErrorMapper.map(throwable).kind == ApiErrorKind.Auth) {
+                    handleExpiredSession()
+                } else {
+                    _state.update {
+                        it.withApiError(throwable).copy(
+                            screen = if (it.screen == DriverScreen.Initializing) DriverScreen.Routes else it.screen,
+                        )
+                    }
                 }
             }
 
@@ -545,7 +547,12 @@ class DriverViewModel(application: Application) : AndroidViewModel(application)
                     }
                 }
                 .onFailure { throwable ->
-                    if (generation == routeDetailRequestGeneration) _state.update { it.withApiError(throwable) }
+                    if (generation != routeDetailRequestGeneration) return@onFailure
+                    if (ApiErrorMapper.map(throwable).kind == ApiErrorKind.Auth) {
+                        handleExpiredSession()
+                    } else {
+                        _state.update { it.withApiError(throwable) }
+                    }
                 }
 
             if (generation == routeDetailRequestGeneration) _state.update { it.copy(refreshing = false) }
@@ -1452,6 +1459,7 @@ class DriverViewModel(application: Application) : AndroidViewModel(application)
         dispatchSheetUploadsJob?.cancel()
         realtimeBannerJob?.cancel()
         liveSyncClient.stop()
+        ActiveRouteTrackingService.stop(getApplication())
         offlineOutboxManager.clearAll()
         repository.logout(notifyServer = _state.value.isOnline)
         syncRepository.clearCache()
@@ -1662,6 +1670,7 @@ class DriverViewModel(application: Application) : AndroidViewModel(application)
 
     private suspend fun handleExpiredSession() {
         liveSyncClient.stop()
+        ActiveRouteTrackingService.stop(getApplication())
         offlineOutboxManager.clearAll()
         repository.logout(notifyServer = false)
         syncRepository.clearCache()

app/src/main/java/pl/firmatpp/kierowca/update/PlayInAppUpdateController.kt

@@ -0,0 +1,146 @@
+package pl.firmatpp.kierowca.update
+
+import android.app.Activity
+import android.content.ActivityNotFoundException
+import android.content.Intent
+import android.net.Uri
+import androidx.activity.ComponentActivity
+import androidx.activity.result.ActivityResultLauncher
+import androidx.activity.result.IntentSenderRequest
+import com.google.android.play.core.appupdate.AppUpdateInfo
+import com.google.android.play.core.appupdate.AppUpdateManager
+import com.google.android.play.core.appupdate.AppUpdateManagerFactory
+import com.google.android.play.core.appupdate.AppUpdateOptions
+import com.google.android.play.core.install.InstallStateUpdatedListener
+import com.google.android.play.core.install.model.AppUpdateType
+import com.google.android.play.core.install.model.InstallStatus
+import com.google.android.play.core.install.model.UpdateAvailability
+
+data class PlayAppUpdateState(
+    val updateAvailable: Boolean = false,
+    val availableVersionCode: Int? = null,
+    val downloaded: Boolean = false,
+    val checking: Boolean = false,
+)
+
+class PlayInAppUpdateController(
+    private val activity: ComponentActivity,
+    private val launcher: ActivityResultLauncher<IntentSenderRequest>,
+    private val onStateChanged: (PlayAppUpdateState) -> Unit,
+    private val appUpdateManager: AppUpdateManager = AppUpdateManagerFactory.create(activity),
+) {
+    private var state = PlayAppUpdateState()
+    private val installStateListener = InstallStateUpdatedListener { installState ->
+        when (installState.installStatus()) {
+            InstallStatus.DOWNLOADED -> updateState(state.copy(downloaded = true, updateAvailable = true))
+            InstallStatus.INSTALLED -> updateState(PlayAppUpdateState())
+            else -> Unit
+        }
+    }
+
+    init {
+        appUpdateManager.registerListener(installStateListener)
+    }
+
+    fun checkForUpdate() {
+        updateState(state.copy(checking = true))
+        appUpdateManager.appUpdateInfo
+            .addOnSuccessListener(::handleUpdateInfo)
+            .addOnFailureListener { updateState(state.copy(checking = false)) }
+    }
+
+    fun startUpdate(required: Boolean, playStoreUrl: String?) {
+        appUpdateManager.appUpdateInfo
+            .addOnSuccessListener { info ->
+                if (info.updateAvailability() != UpdateAvailability.UPDATE_AVAILABLE) {
+                    openPlayStore(playStoreUrl)
+                    return@addOnSuccessListener
+                }
+
+                val preferredType = if (required) AppUpdateType.IMMEDIATE else AppUpdateType.FLEXIBLE
+                val updateType = when {
+                    info.isUpdateTypeAllowed(preferredType) -> preferredType
+                    info.isUpdateTypeAllowed(AppUpdateType.FLEXIBLE) -> AppUpdateType.FLEXIBLE
+                    info.isUpdateTypeAllowed(AppUpdateType.IMMEDIATE) -> AppUpdateType.IMMEDIATE
+                    else -> null
+                }
+
+                if (updateType == null || !launchUpdate(info, updateType)) {
+                    openPlayStore(playStoreUrl)
+                }
+            }
+            .addOnFailureListener { openPlayStore(playStoreUrl) }
+    }
+
+    fun completeDownloadedUpdate() {
+        appUpdateManager.completeUpdate()
+    }
+
+    fun onUpdateFlowResult(resultCode: Int) {
+        if (resultCode != Activity.RESULT_OK) {
+            checkForUpdate()
+        }
+    }
+
+    fun dispose() {
+        appUpdateManager.unregisterListener(installStateListener)
+    }
+
+    private fun handleUpdateInfo(info: AppUpdateInfo) {
+        val downloaded = info.installStatus() == InstallStatus.DOWNLOADED
+        val available = info.updateAvailability() == UpdateAvailability.UPDATE_AVAILABLE ||
+            info.updateAvailability() == UpdateAvailability.DEVELOPER_TRIGGERED_UPDATE_IN_PROGRESS ||
+            downloaded
+
+        updateState(
+            PlayAppUpdateState(
+                updateAvailable = available,
+                availableVersionCode = info.availableVersionCode().takeIf { it > 0 },
+                downloaded = downloaded,
+                checking = false,
+            ),
+        )
+
+        if (
+            info.updateAvailability() == UpdateAvailability.DEVELOPER_TRIGGERED_UPDATE_IN_PROGRESS &&
+            info.isUpdateTypeAllowed(AppUpdateType.IMMEDIATE)
+        ) {
+            launchUpdate(info, AppUpdateType.IMMEDIATE)
+        }
+    }
+
+    private fun launchUpdate(info: AppUpdateInfo, updateType: Int): Boolean =
+        appUpdateManager.startUpdateFlowForResult(
+            info,
+            launcher,
+            AppUpdateOptions.newBuilder(updateType).build(),
+        )
+
+    private fun openPlayStore(playStoreUrl: String?) {
+        val packageName = activity.packageName
+        val candidates = listOf(
+            Intent(Intent.ACTION_VIEW, Uri.parse("market://details?id=$packageName")).setPackage("com.android.vending"),
+            Intent(
+                Intent.ACTION_VIEW,
+                Uri.parse(playStoreUrl?.takeIf { it.isNotBlank() }
+                    ?: "https://play.google.com/store/apps/details?id=$packageName"),
+            ),
+        )
+
+        for (intent in candidates) {
+            try {
+                activity.startActivity(intent)
+                return
+            } catch (_: ActivityNotFoundException) {
+                // Try the browser fallback.
+            } catch (_: SecurityException) {
+                // Try the browser fallback.
+            }
+        }
+    }
+
+    private fun updateState(next: PlayAppUpdateState) {
+        state = next
+        onStateChanged(next)
+    }
+}

app/src/test/java/pl/firmatpp/kierowca/data/upload/RoutePointWorkerRulesTest.kt

@@ -3,6 +3,7 @@ package pl.firmatpp.kierowca.data.upload
 import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
 import org.junit.Test
+import pl.firmatpp.kierowca.data.ApiErrorKind
 
 class RoutePointWorkerRulesTest {
     @Test
@@ -15,4 +16,14 @@ class RoutePointWorkerRulesTest {
         assertFalse(isInactiveRoutePointError("SERVER_UNAVAILABLE"))
         assertFalse(isInactiveRoutePointError(null))
     }
+
+    @Test
+    fun revokedSessionStopsRouteTracking() {
+        assertTrue(shouldStopRouteTrackingAfterPointError(ApiErrorKind.Auth, null))
+    }
+
+    @Test
+    fun temporaryFailureKeepsRouteTrackingActive() {
+        assertFalse(shouldStopRouteTrackingAfterPointError(ApiErrorKind.Server, "SERVER_UNAVAILABLE"))
+    }
 }

app/src/test/java/pl/firmatpp/kierowca/ui/DriverUiRulesTest.kt

@@ -82,6 +82,108 @@ class DriverUiRulesTest {
         assertEquals("—", routeDateChipLabel("", today))
     }
 
+    @Test
+    fun buildsNavigationCandidatesFromGeofenceCoordinatesWithFallbacks() {
+        val candidates = navigationIntentCandidates(
+            latitude = 50.0619474,
+            longitude = 19.9368564,
+            label = "Brama główna",
+        )
+
+        assertEquals(3, candidates.size)
+        assertEquals("com.google.android.apps.maps", candidates[0].packageName)
+        assertEquals("google.navigation:q=50.0619474,19.9368564", candidates[0].uri)
+        assertEquals(null, candidates[1].packageName)
+        assertEquals(
+            "geo:0,0?q=50.0619474,19.9368564(Brama%20g%C5%82%C3%B3wna)",
+            candidates[1].uri,
+        )
+        assertEquals(
+            "https://www.google.com/maps/dir/?api=1&destination=50.0619474,19.9368564",
+            candidates[2].uri,
+        )
+    }
+
+    @Test
+    fun doesNotBuildNavigationCandidatesForMissingOrInvalidCoordinates() {
+        assertFalse(hasValidNavigationCoordinates(null, 19.9368564))
+        assertFalse(hasValidNavigationCoordinates(50.0619474, null))
+        assertFalse(hasValidNavigationCoordinates(Double.NaN, 19.9368564))
+        assertFalse(hasValidNavigationCoordinates(91.0, 19.9368564))
+        assertFalse(hasValidNavigationCoordinates(50.0619474, 181.0))
+        assertTrue(hasValidNavigationCoordinates(50.0619474, 19.9368564))
+        assertTrue(navigationIntentCandidates(null, null, "Cel").isEmpty())
+    }
+
+    @Test
+    fun showsAnOptionalUpdateWhenGooglePlayOrBackendHasANewerVersion() {
+        val fromPlay = appUpdateBannerUi(
+            currentVersionCode = 113,
+            latestVersionCode = null,
+            latestVersionName = null,
+            minimumSupportedVersionCode = 0,
+            playUpdateAvailable = true,
+            playAvailableVersionCode = 114,
+            updateDownloaded = false,
+        )
+        val fromBackend = appUpdateBannerUi(
+            currentVersionCode = 113,
+            latestVersionCode = 114,
+            latestVersionName = "1.0.61",
+            minimumSupportedVersionCode = 0,
+            playUpdateAvailable = false,
+            playAvailableVersionCode = null,
+            updateDownloaded = false,
+        )
+
+        assertEquals(false, fromPlay?.required)
+        assertEquals("Aktualizuj", fromPlay?.actionLabel)
+        assertEquals("Dostępna jest nowa wersja aplikacji 1.0.61.", fromBackend?.message)
+    }
+
+    @Test
+    fun requiresAnUpdateOnlyBelowTheConfiguredMinimumVersion() {
+        val required = appUpdateBannerUi(
+            currentVersionCode = 111,
+            latestVersionCode = 114,
+            latestVersionName = "1.0.61",
+            minimumSupportedVersionCode = 112,
+            playUpdateAvailable = true,
+            playAvailableVersionCode = 114,
+            updateDownloaded = false,
+        )
+        val current = appUpdateBannerUi(
+            currentVersionCode = 114,
+            latestVersionCode = 114,
+            latestVersionName = "1.0.61",
+            minimumSupportedVersionCode = 112,
+            playUpdateAvailable = false,
+            playAvailableVersionCode = null,
+            updateDownloaded = false,
+        )
+
+        assertEquals(true, required?.required)
+        assertTrue(required?.message?.contains("nie jest już obsługiwana") == true)
+        assertEquals(null, current)
+    }
+
+    @Test
+    fun downloadedUpdateUsesInstallAction() {
+        val update = appUpdateBannerUi(
+            currentVersionCode = 113,
+            latestVersionCode = 114,
+            latestVersionName = "1.0.61",
+            minimumSupportedVersionCode = 0,
+            playUpdateAvailable = true,
+            playAvailableVersionCode = 114,
+            updateDownloaded = true,
+        )
+
+        assertEquals("Zainstaluj", update?.actionLabel)
+        assertEquals(true, update?.downloaded)
+        assertTrue(update?.message?.contains("gotowa do instalacji") == true)
+    }
+
     @Test
     fun calculatesPhotoGridRowsForTwoColumnInlineGallery() {
         assertEquals(0, inlinePhotoGridRows(0))

gradle/libs.versions.toml

@@ -17,6 +17,7 @@ room = "2.7.0"
 ksp = "2.1.10-1.0.31"
 playServicesAuth = "21.6.0"
 playServicesAuthApiPhone = "18.3.0"
+playAppUpdate = "2.1.0"
 junit = "4.13.2"
 firebaseBom = "33.7.0"
 googleServices = "4.4.2"
@@ -52,6 +53,8 @@ okhttp = { group = "com.squareup.okhttp3", name = "okhttp", version.ref = "okhtt
 okhttp-logging = { group = "com.squareup.okhttp3", name = "logging-interceptor", version.ref = "okhttp" }
 play-services-auth = { group = "com.google.android.gms", name = "play-services-auth", version.ref = "playServicesAuth" }
 play-services-auth-api-phone = { group = "com.google.android.gms", name = "play-services-auth-api-phone", version.ref = "playServicesAuthApiPhone" }
+play-app-update = { group = "com.google.android.play", name = "app-update", version.ref = "playAppUpdate" }
+play-app-update-ktx = { group = "com.google.android.play", name = "app-update-ktx", version.ref = "playAppUpdate" }
 retrofit = { group = "com.squareup.retrofit2", name = "retrofit", version.ref = "retrofit" }
 retrofit-gson = { group = "com.squareup.retrofit2", name = "converter-gson", version.ref = "retrofit" }
 firebase-bom = { group = "com.google.firebase", name = "firebase-bom", version.ref = "firebaseBom" }

scripts/release-android.sh

@@ -7,11 +7,17 @@ VERSION_FILE="$ROOT_DIR/app/build.gradle.kts"
 REMOTE_NAME="${GIT_REMOTE:-origin}"
 NOTES_FILE=""
 SKIP_TESTS=0
+GOOGLE_PLAY_MODE="ask"
 REUSE_CURRENT=0
 VERSION_FILE_CHANGED=0
 VERSION_COMMITTED=0
 VERSION_BACKUP=""
 RELEASE_SUCCEEDED=0
+GOOGLE_PLAY_ACCESS_TOKEN=""
+GOOGLE_PLAY_EDIT_ID=""
+GOOGLE_PLAY_TEMP_DIR=""
+GOOGLE_PLAY_CURRENT_VERSION_STATE=""
+GOOGLE_PLAY_SUMMARY="pominięto"
 
 usage() {
     cat <<'EOF'
@@ -21,13 +27,17 @@ Buduje i publikuje kolejną wersję aplikacji kierowcy:
   - automatycznie zwiększa versionCode o 1 i patch versionName o 1,
   - uruchamia testy jednostkowe,
   - buduje podpisany APK dla Gitea Release,
-  - buduje podpisany AAB dla Google Play Console,
+  - buduje podpisany AAB i publikuje go w teście zamkniętym Google Play,
+  - wysyła zmiany Google Play do weryfikacji,
   - zapisuje zmianę wersji w commicie, tworzy tag i wykonuje push,
   - tworzy lub aktualizuje Gitea Release i wysyła APK oraz SHA256SUMS.
 
 Opcje:
   --notes-file PLIK   Treść release notes z podanego pliku.
   --skip-tests        Pomiń testDebugUnitTest.
+  --skip-google-play  Nie pytaj i pomiń wysyłanie AAB do Google Play.
+  --publish-google-play
+                      Nie pytaj i wyślij AAB do Google Play.
   --reuse-current     Nie zwiększaj wersji. Wznów publikację wersji zapisanej
                       obecnie w app/build.gradle.kts.
   -h, --help          Pokaż pomoc.
@@ -37,9 +47,19 @@ Zmienne środowiskowe:
   GITEA_BASE_URL      Nadpisuje adres Gitea, np. https://gitea.example.com.
   GITEA_REPOSITORY    Nadpisuje owner/repository.
   GIT_REMOTE          Remote Git, domyślnie origin.
+  GOOGLE_PLAY_SERVICE_ACCOUNT_CREDENTIALS
+                      Opcjonalne nadpisanie automatycznie znalezionego klucza JSON.
+                      Domyślnie skrypt znajduje konto serwisowe w scripts/*.json.
+                      Alternatywnie: GOOGLE_APPLICATION_CREDENTIALS.
+  GOOGLE_PLAY_PACKAGE_NAME
+                      Identyfikator aplikacji, domyślnie pl.firmatpp.kierowca.
+  GOOGLE_PLAY_TRACK   Nazwa testu zamkniętego, domyślnie alpha.
+  GOOGLE_PLAY_RELEASE_LANGUAGE
+                      Język informacji o wersji, domyślnie pl-PL.
 
 Wersja początkowa jest zawsze odczytywana z app/build.gradle.kts.
-Google Play Console otrzymuje plik AAB, ponieważ jest to właściwy format publikacyjny.
+Google Play otrzymuje AAB przez Android Publisher API. Konto serwisowe musi mieć
+uprawnienie „Publikowanie aplikacji na ścieżkach testowych”.
 EOF
 }
 
@@ -54,6 +74,14 @@ while (($# > 0)); do
             SKIP_TESTS=1
             shift
             ;;
+        --skip-google-play)
+            GOOGLE_PLAY_MODE="skip"
+            shift
+            ;;
+        --publish-google-play)
+            GOOGLE_PLAY_MODE="publish"
+            shift
+            ;;
         --reuse-current)
             REUSE_CURRENT=1
             shift
@@ -82,6 +110,10 @@ done
 [[ -x ./gradlew ]] || { echo "Brak wykonywalnego ./gradlew." >&2; exit 1; }
 [[ -f keystore.properties ]] || { echo "Brak keystore.properties wymaganego do podpisania release." >&2; exit 1; }
 [[ -f "$VERSION_FILE" ]] || { echo "Brak $VERSION_FILE." >&2; exit 1; }
+if [[ -n "$NOTES_FILE" && ! -f "$NOTES_FILE" ]]; then
+    echo "Nie istnieje plik release notes: $NOTES_FILE" >&2
+    exit 1
+fi
 
 branch="$(git branch --show-current)"
 [[ -n "$branch" ]] || { echo "Release nie może być wykonany z detached HEAD." >&2; exit 1; }
@@ -165,11 +197,24 @@ play_aab_name="TPP-Kierowca-${next_name}-${next_code}.aab"
 
 cleanup_on_exit() {
     local exit_code=$?
+    if ((RELEASE_SUCCEEDED == 0)) && [[ -n "$GOOGLE_PLAY_EDIT_ID" && -n "$GOOGLE_PLAY_ACCESS_TOKEN" ]]; then
+        package_encoded="$(urlencode "$google_play_package")"
+        edit_encoded="$(urlencode "$GOOGLE_PLAY_EDIT_ID")"
+        curl -sS -o /dev/null \
+            --connect-timeout 20 \
+            --max-time 60 \
+            -X DELETE \
+            -H "@$GOOGLE_PLAY_TEMP_DIR/auth-header.txt" \
+            "https://androidpublisher.googleapis.com/androidpublisher/v3/applications/$package_encoded/edits/$edit_encoded" || true
+    fi
     if ((RELEASE_SUCCEEDED == 0 && VERSION_FILE_CHANGED == 1 && VERSION_COMMITTED == 0)) && [[ -n "$VERSION_BACKUP" && -f "$VERSION_BACKUP" ]]; then
         cp "$VERSION_BACKUP" "$VERSION_FILE"
         echo "Przywrócono poprzednią wersję w app/build.gradle.kts." >&2
     fi
     [[ -n "$VERSION_BACKUP" && -f "$VERSION_BACKUP" ]] && rm -f "$VERSION_BACKUP"
+    if [[ -n "$GOOGLE_PLAY_TEMP_DIR" && -d "$GOOGLE_PLAY_TEMP_DIR" ]]; then
+        rm -rf -- "$GOOGLE_PLAY_TEMP_DIR"
+    fi
     if ((RELEASE_SUCCEEDED == 0)); then
         echo "Release nie został ukończony. Po usunięciu przyczyny użyj --reuse-current, jeśli commit wersji już powstał." >&2
     fi
@@ -180,6 +225,391 @@ trap cleanup_on_exit EXIT
 trap 'exit 130' INT
 trap 'exit 143' TERM
 
+urlencode() {
+    jq -rn --arg value "$1" '$value | @uri'
+}
+
+base64url() {
+    openssl base64 -A | tr '+/' '-_' | tr -d '='
+}
+
+show_google_play_error() {
+    local response_file="$1"
+    jq '.error | {code, message, status, details}' "$response_file" >&2 2>/dev/null || true
+}
+
+decide_google_play_upload() {
+    local answer
+
+    case "$GOOGLE_PLAY_MODE" in
+        publish)
+            return 0
+            ;;
+        skip)
+            GOOGLE_PLAY_SUMMARY="pominięto (--skip-google-play)"
+            return 0
+            ;;
+        ask)
+            if [[ ! -t 0 ]]; then
+                echo "Nie można zapytać o publikację Google Play bez interaktywnego terminala." >&2
+                echo "Użyj --publish-google-play albo --skip-google-play." >&2
+                return 1
+            fi
+            while true; do
+                printf "\nBuild %s (%s) zakończony poprawnie. Czy wysłać aktualizację do Google Play? [t/N] " "$next_name" "$next_code"
+                if ! IFS= read -r answer; then
+                    echo "Nie udało się odczytać odpowiedzi." >&2
+                    return 1
+                fi
+                case "${answer,,}" in
+                    t|tak|y|yes)
+                        GOOGLE_PLAY_MODE="publish"
+                        break
+                        ;;
+                    ""|n|nie|no)
+                        GOOGLE_PLAY_MODE="skip"
+                        GOOGLE_PLAY_SUMMARY="pominięto przez użytkownika"
+                        break
+                        ;;
+                    *)
+                        echo "Nie rozpoznano odpowiedzi. Wpisz tak albo nie." >&2
+                        ;;
+                esac
+            done
+            ;;
+        *)
+            echo "Niepoprawny tryb publikacji Google Play: $GOOGLE_PLAY_MODE" >&2
+            return 1
+            ;;
+    esac
+}
+
+prepare_google_play() {
+    local credentials_path client_email now expires header payload unsigned_jwt signature assertion previous_umask
+    local token_response token_status preflight_response preflight_status package_encoded track_encoded
+    local candidate
+    local -a credentials_candidates=()
+
+    google_play_package="${GOOGLE_PLAY_PACKAGE_NAME:-pl.firmatpp.kierowca}"
+    google_play_track="${GOOGLE_PLAY_TRACK:-alpha}"
+    google_play_release_language="${GOOGLE_PLAY_RELEASE_LANGUAGE:-pl-PL}"
+    credentials_path="${GOOGLE_PLAY_SERVICE_ACCOUNT_CREDENTIALS:-${GOOGLE_APPLICATION_CREDENTIALS:-}}"
+
+    if [[ -z "$credentials_path" ]]; then
+        while IFS= read -r -d '' candidate; do
+            if jq -e '
+                .type == "service_account"
+                and (.client_email | type == "string" and length > 0)
+                and (.private_key | type == "string" and length > 0)
+            ' "$candidate" >/dev/null 2>&1; then
+                credentials_candidates+=("$candidate")
+            fi
+        done < <(find "$ROOT_DIR/scripts" -maxdepth 1 -type f -name '*.json' -print0)
+
+        case "${#credentials_candidates[@]}" in
+            0)
+                echo "Nie znaleziono klucza konta serwisowego w $ROOT_DIR/scripts/*.json." >&2
+                echo "Umieść dokładnie jeden poprawny plik JSON konta serwisowego w folderze scripts." >&2
+                return 1
+                ;;
+            1)
+                credentials_path="${credentials_candidates[0]}"
+                ;;
+            *)
+                echo "Znaleziono więcej niż jeden klucz konta serwisowego w folderze scripts:" >&2
+                for candidate in "${credentials_candidates[@]}"; do
+                    printf '  - %s\n' "$(basename "$candidate")" >&2
+                done
+                echo "Pozostaw jeden plik albo ustaw GOOGLE_PLAY_SERVICE_ACCOUNT_CREDENTIALS." >&2
+                return 1
+                ;;
+        esac
+    fi
+
+    command -v openssl >/dev/null 2>&1 || {
+        echo "Brak wymaganego polecenia: openssl" >&2
+        return 1
+    }
+
+    [[ "$google_play_package" =~ ^[A-Za-z0-9._]+$ ]] || {
+        echo "Niepoprawne GOOGLE_PLAY_PACKAGE_NAME: $google_play_package" >&2
+        return 1
+    }
+    [[ -n "$google_play_track" ]] || { echo "GOOGLE_PLAY_TRACK nie może być puste." >&2; return 1; }
+    [[ "$google_play_release_language" =~ ^[A-Za-z0-9-]+$ ]] || {
+        echo "Niepoprawne GOOGLE_PLAY_RELEASE_LANGUAGE: $google_play_release_language" >&2
+        return 1
+    }
+    [[ -n "$credentials_path" ]] || {
+        echo "Nie wskazano ani nie znaleziono klucza konta serwisowego Google Play." >&2
+        return 1
+    }
+    [[ -r "$credentials_path" ]] || {
+        echo "Nie można odczytać klucza konta serwisowego: $credentials_path" >&2
+        return 1
+    }
+
+    GOOGLE_PLAY_TEMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/tpp-google-play.XXXXXX")"
+    chmod 700 "$GOOGLE_PLAY_TEMP_DIR"
+    client_email="$(jq -er '.client_email | select(type == "string" and length > 0)' "$credentials_path")" || {
+        echo "Klucz Google Play nie zawiera client_email." >&2
+        return 1
+    }
+    previous_umask="$(umask)"
+    umask 077
+    if ! jq -er '.private_key | select(type == "string" and length > 0)' "$credentials_path" > "$GOOGLE_PLAY_TEMP_DIR/private-key.pem"; then
+        umask "$previous_umask"
+        echo "Klucz Google Play nie zawiera private_key." >&2
+        return 1
+    fi
+    umask "$previous_umask"
+
+    now="$(date +%s)"
+    expires=$((now + 3600))
+    header="$(printf '%s' '{"alg":"RS256","typ":"JWT"}' | base64url)"
+    payload="$(jq -cn \
+        --arg iss "$client_email" \
+        --arg scope 'https://www.googleapis.com/auth/androidpublisher' \
+        --arg aud 'https://oauth2.googleapis.com/token' \
+        --argjson iat "$now" \
+        --argjson exp "$expires" \
+        '{iss:$iss,scope:$scope,aud:$aud,iat:$iat,exp:$exp}' | base64url)"
+    unsigned_jwt="$header.$payload"
+    signature="$(printf '%s' "$unsigned_jwt" \
+        | openssl dgst -sha256 -sign "$GOOGLE_PLAY_TEMP_DIR/private-key.pem" \
+        | base64url)"
+    assertion="$unsigned_jwt.$signature"
+    printf '%s' "$assertion" > "$GOOGLE_PLAY_TEMP_DIR/assertion.txt"
+    chmod 600 "$GOOGLE_PLAY_TEMP_DIR/assertion.txt"
+
+    token_response="$GOOGLE_PLAY_TEMP_DIR/token.json"
+    token_status="$(curl -sS \
+        --connect-timeout 20 \
+        --max-time 60 \
+        -o "$token_response" \
+        -w '%{http_code}' \
+        -X POST \
+        -H 'Content-Type: application/x-www-form-urlencoded' \
+        --data-urlencode 'grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer' \
+        --data-urlencode "assertion@$GOOGLE_PLAY_TEMP_DIR/assertion.txt" \
+        'https://oauth2.googleapis.com/token')"
+    [[ "$token_status" == "200" ]] || {
+        echo "Nie udało się pobrać tokenu Google Play (HTTP $token_status)." >&2
+        jq '{error, error_description}' "$token_response" >&2 2>/dev/null || true
+        return 1
+    }
+    GOOGLE_PLAY_ACCESS_TOKEN="$(jq -er '.access_token | select(type == "string" and length > 0)' "$token_response")" || {
+        echo "Google OAuth nie zwrócił access_token." >&2
+        return 1
+    }
+    printf 'Authorization: Bearer %s\n' "$GOOGLE_PLAY_ACCESS_TOKEN" > "$GOOGLE_PLAY_TEMP_DIR/auth-header.txt"
+    chmod 600 "$GOOGLE_PLAY_TEMP_DIR/auth-header.txt"
+    rm -f "$GOOGLE_PLAY_TEMP_DIR/private-key.pem" "$GOOGLE_PLAY_TEMP_DIR/assertion.txt" "$token_response"
+
+    package_encoded="$(urlencode "$google_play_package")"
+    track_encoded="$(urlencode "$google_play_track")"
+    preflight_response="$GOOGLE_PLAY_TEMP_DIR/preflight.json"
+    preflight_status="$(curl -sS \
+        --connect-timeout 20 \
+        --max-time 60 \
+        -o "$preflight_response" \
+        -w '%{http_code}' \
+        -H "@$GOOGLE_PLAY_TEMP_DIR/auth-header.txt" \
+        "https://androidpublisher.googleapis.com/androidpublisher/v3/applications/$package_encoded/tracks/$track_encoded/releases")"
+    [[ "$preflight_status" == "200" ]] || {
+        echo "Brak dostępu do ścieżki Google Play $google_play_track dla $google_play_package (HTTP $preflight_status)." >&2
+        show_google_play_error "$preflight_response"
+        return 1
+    }
+
+    GOOGLE_PLAY_CURRENT_VERSION_STATE="$(jq -r --argjson code "$next_code" '
+        .releases[]?
+        | select(any(.activeArtifacts[]?; .versionCode == $code))
+        | .releaseLifecycleState // empty
+    ' "$preflight_response" | sed -n '1p')"
+    if [[ -n "$GOOGLE_PLAY_CURRENT_VERSION_STATE" && "$REUSE_CURRENT" == "0" ]]; then
+        echo "Google Play ma już versionCode $next_code na ścieżce $google_play_track ($GOOGLE_PLAY_CURRENT_VERSION_STATE)." >&2
+        echo "Zwiększ wersję lokalną albo świadomie użyj --reuse-current." >&2
+        return 1
+    fi
+    if [[ "$GOOGLE_PLAY_CURRENT_VERSION_STATE" == "RELEASE_LIFECYCLE_STATE_NOT_APPROVED" ]]; then
+        echo "Wersja $next_code została odrzucona w Google Play. Zwiększ versionCode i utwórz nowe wydanie." >&2
+        return 1
+    fi
+
+    echo "Google Play: używam klucza $(basename "$credentials_path")."
+    echo "Google Play: zweryfikowano dostęp do $google_play_package, ścieżka $google_play_track."
+}
+
+publish_to_google_play() {
+    local release_notes="$1"
+    local package_encoded track_encoded edit_encoded api_base
+    local response status bundle_version_code existing_sha256 local_sha256
+    local play_notes track_payload release_name
+
+    case "$GOOGLE_PLAY_CURRENT_VERSION_STATE" in
+        RELEASE_LIFECYCLE_STATE_IN_REVIEW|RELEASE_LIFECYCLE_STATE_APPROVED_NOT_PUBLISHED|RELEASE_LIFECYCLE_STATE_PUBLISHED)
+            GOOGLE_PLAY_SUMMARY="już istnieje: $GOOGLE_PLAY_CURRENT_VERSION_STATE"
+            echo "Google Play: wersja $next_name ($next_code) ma już stan $GOOGLE_PLAY_CURRENT_VERSION_STATE; pomijam ponowną publikację."
+            return 0
+            ;;
+    esac
+
+    package_encoded="$(urlencode "$google_play_package")"
+    track_encoded="$(urlencode "$google_play_track")"
+    api_base="https://androidpublisher.googleapis.com/androidpublisher/v3/applications/$package_encoded"
+
+    response="$GOOGLE_PLAY_TEMP_DIR/edit-create.json"
+    status="$(curl -sS \
+        --connect-timeout 20 \
+        --max-time 60 \
+        -o "$response" \
+        -w '%{http_code}' \
+        -X POST \
+        -H "@$GOOGLE_PLAY_TEMP_DIR/auth-header.txt" \
+        -H 'Content-Type: application/json' \
+        -d '{}' \
+        "$api_base/edits")"
+    [[ "$status" == "200" ]] || {
+        echo "Nie udało się utworzyć edycji Google Play (HTTP $status)." >&2
+        show_google_play_error "$response"
+        return 1
+    }
+    GOOGLE_PLAY_EDIT_ID="$(jq -er '.id | select(type == "string" and length > 0)' "$response")" || {
+        echo "Google Play nie zwrócił identyfikatora edycji." >&2
+        return 1
+    }
+    edit_encoded="$(urlencode "$GOOGLE_PLAY_EDIT_ID")"
+
+    response="$GOOGLE_PLAY_TEMP_DIR/track-get.json"
+    status="$(curl -sS \
+        --connect-timeout 20 \
+        --max-time 60 \
+        -o "$response" \
+        -w '%{http_code}' \
+        -H "@$GOOGLE_PLAY_TEMP_DIR/auth-header.txt" \
+        "$api_base/edits/$edit_encoded/tracks/$track_encoded")"
+    [[ "$status" == "200" ]] || {
+        echo "Nie znaleziono ścieżki Google Play $google_play_track (HTTP $status)." >&2
+        show_google_play_error "$response"
+        return 1
+    }
+
+    response="$GOOGLE_PLAY_TEMP_DIR/bundles.json"
+    status="$(curl -sS \
+        --connect-timeout 20 \
+        --max-time 60 \
+        -o "$response" \
+        -w '%{http_code}' \
+        -H "@$GOOGLE_PLAY_TEMP_DIR/auth-header.txt" \
+        "$api_base/edits/$edit_encoded/bundles")"
+    [[ "$status" == "200" ]] || {
+        echo "Nie udało się sprawdzić pakietów Google Play (HTTP $status)." >&2
+        show_google_play_error "$response"
+        return 1
+    }
+
+    existing_sha256="$(jq -r --argjson code "$next_code" '.bundles[]? | select(.versionCode == $code) | .sha256 // empty' "$response" | sed -n '1p')"
+    local_sha256="$(sha256sum "$artifact_dir/google-play/$play_aab_name" | awk '{print $1}')"
+    if [[ -n "$existing_sha256" ]]; then
+        if [[ "${existing_sha256,,}" != "${local_sha256,,}" && "$REUSE_CURRENT" == "0" ]]; then
+            echo "Google Play ma już versionCode $next_code z inną sumą SHA-256." >&2
+            return 1
+        fi
+        if [[ "${existing_sha256,,}" != "${local_sha256,,}" ]]; then
+            echo "Uwaga: lokalny AAB ma inną sumę niż istniejący versionCode $next_code; --reuse-current zachowuje pakiet już wysłany do Google Play." >&2
+        fi
+        bundle_version_code="$next_code"
+        echo "Google Play ma już AAB $next_name ($next_code); pomijam ponowny upload."
+    else
+        response="$GOOGLE_PLAY_TEMP_DIR/bundle-upload.json"
+        status="$(curl -sS \
+            --connect-timeout 20 \
+            --max-time 600 \
+            -o "$response" \
+            -w '%{http_code}' \
+            -X POST \
+            -H "@$GOOGLE_PLAY_TEMP_DIR/auth-header.txt" \
+            -H 'Content-Type: application/octet-stream' \
+            --data-binary "@$artifact_dir/google-play/$play_aab_name" \
+            "https://androidpublisher.googleapis.com/upload/androidpublisher/v3/applications/$package_encoded/edits/$edit_encoded/bundles?uploadType=media")"
+        [[ "$status" == "200" ]] || {
+            echo "Nie udało się wysłać AAB do Google Play (HTTP $status)." >&2
+            show_google_play_error "$response"
+            return 1
+        }
+        bundle_version_code="$(jq -er '.versionCode' "$response")" || {
+            echo "Google Play nie zwrócił versionCode przesłanego AAB." >&2
+            return 1
+        }
+        [[ "$bundle_version_code" == "$next_code" ]] || {
+            echo "Google Play odczytał versionCode $bundle_version_code zamiast $next_code." >&2
+            return 1
+        }
+    fi
+
+    play_notes="$(jq -rn --arg notes "$release_notes" '$notes | if length > 500 then .[0:497] + "..." else . end')"
+    release_name="TPP Kierowca $next_name ($next_code)"
+    track_payload="$(jq -n \
+        --arg track "$google_play_track" \
+        --arg release_name "$release_name" \
+        --arg version_code "$bundle_version_code" \
+        --arg language "$google_play_release_language" \
+        --arg notes "$play_notes" \
+        '{track:$track,releases:[{name:$release_name,versionCodes:[$version_code],status:"completed",releaseNotes:[{language:$language,text:$notes}]}]}')"
+
+    response="$GOOGLE_PLAY_TEMP_DIR/track-update.json"
+    status="$(curl -sS \
+        --connect-timeout 20 \
+        --max-time 60 \
+        -o "$response" \
+        -w '%{http_code}' \
+        -X PUT \
+        -H "@$GOOGLE_PLAY_TEMP_DIR/auth-header.txt" \
+        -H 'Content-Type: application/json' \
+        -d "$track_payload" \
+        "$api_base/edits/$edit_encoded/tracks/$track_encoded")"
+    [[ "$status" == "200" ]] || {
+        echo "Nie udało się przypisać AAB do ścieżki $google_play_track (HTTP $status)." >&2
+        show_google_play_error "$response"
+        return 1
+    }
+
+    response="$GOOGLE_PLAY_TEMP_DIR/edit-validate.json"
+    status="$(curl -sS \
+        --connect-timeout 20 \
+        --max-time 120 \
+        -o "$response" \
+        -w '%{http_code}' \
+        -X POST \
+        -H "@$GOOGLE_PLAY_TEMP_DIR/auth-header.txt" \
+        "$api_base/edits/$edit_encoded:validate")"
+    [[ "$status" == "200" ]] || {
+        echo "Walidacja edycji Google Play nie powiodła się (HTTP $status)." >&2
+        show_google_play_error "$response"
+        return 1
+    }
+
+    response="$GOOGLE_PLAY_TEMP_DIR/edit-commit.json"
+    status="$(curl -sS \
+        --connect-timeout 20 \
+        --max-time 120 \
+        -o "$response" \
+        -w '%{http_code}' \
+        -X POST \
+        -H "@$GOOGLE_PLAY_TEMP_DIR/auth-header.txt" \
+        "$api_base/edits/$edit_encoded:commit?changesNotSentForReview=false&changesInReviewBehavior=ERROR_IF_IN_REVIEW")"
+    [[ "$status" == "200" ]] || {
+        echo "Nie udało się zatwierdzić i wysłać zmian Google Play do weryfikacji (HTTP $status)." >&2
+        show_google_play_error "$response"
+        return 1
+    }
+
+    GOOGLE_PLAY_EDIT_ID=""
+    GOOGLE_PLAY_SUMMARY="wysłano do weryfikacji"
+    echo "Google Play: $release_name wysłano na ścieżkę $google_play_track i przekazano do weryfikacji."
+}
+
 if ((REUSE_CURRENT == 0)); then
     if git show-ref --verify --quiet "refs/tags/$tag_name" || git ls-remote --exit-code --tags "$REMOTE_NAME" "refs/tags/$tag_name" >/dev/null 2>&1; then
         echo "Tag $tag_name już istnieje. Użyj --reuse-current albo zwiększ wersję ręcznie." >&2
@@ -235,14 +665,18 @@ cp "$aab_source" "$artifact_dir/google-play/$play_aab_name"
     sha256sum "gitea/$gitea_apk_name" "google-play/$play_aab_name" > SHA256SUMS.txt
 )
 
+decide_google_play_upload
+if [[ "$GOOGLE_PLAY_MODE" == "publish" ]]; then
+    prepare_google_play
+fi
+
 if ((REUSE_CURRENT == 0)); then
     git add "$VERSION_FILE"
     git diff --cached --check
-    git commit -m "chore: release android driver $next_name ($next_code)"
+    git commit -m "Wydaj aplikację kierowcy $next_name ($next_code)"
     VERSION_COMMITTED=1
 fi
 
-git push "$REMOTE_NAME" "$branch"
 if ! git show-ref --verify --quiet "refs/tags/$tag_name"; then
     git tag -a "$tag_name" -m "TPP Kierowca $next_name ($next_code)"
 fi
@@ -252,10 +686,8 @@ head_commit="$(git rev-parse HEAD)"
     echo "Tag $tag_name nie wskazuje aktualnego commita ($head_commit)." >&2
     exit 1
 }
-git push "$REMOTE_NAME" "$tag_name"
 
 if [[ -n "$NOTES_FILE" ]]; then
-    [[ -f "$NOTES_FILE" ]] || { echo "Nie istnieje plik release notes: $NOTES_FILE" >&2; exit 1; }
     release_notes="$(<"$NOTES_FILE")"
 else
     previous_tag="$(git tag --sort=-version:refname | grep -Fxv "$tag_name" | sed -n '1p' || true)"
@@ -264,7 +696,7 @@ else
     else
         changes="$(git log -20 --format='- %s (%h)')"
     fi
-    release_notes="TPP Kierowca $next_name ($next_code)
+release_notes="TPP Kierowca $next_name ($next_code)
 
 Zmiany:
 ${changes:-'- Wydanie techniczne.'}
@@ -273,6 +705,15 @@ Artefakt Google Play Console (AAB) znajduje się lokalnie w:
 release-artifacts/$tag_name/google-play/$play_aab_name"
 fi
 
+if [[ "$GOOGLE_PLAY_MODE" == "publish" ]]; then
+    publish_to_google_play "$release_notes"
+    GOOGLE_PLAY_ACCESS_TOKEN=""
+    rm -f "$GOOGLE_PLAY_TEMP_DIR/auth-header.txt"
+fi
+
+git push "$REMOTE_NAME" "$branch"
+git push "$REMOTE_NAME" "$tag_name"
+
 release_response="$(mktemp)"
 release_status="$(curl -sS "${auth_args[@]}" -o "$release_response" -w '%{http_code}' "$api_base/releases/tags/$tag_name")"
 if [[ "$release_status" == "200" ]]; then
@@ -348,8 +789,12 @@ published_apk_hash="$(sha256sum "$downloaded_apk" | awk '{print $1}')"
 
 release_url="$gitea_base_url/$gitea_repository/releases/tag/$tag_name"
 RELEASE_SUCCEEDED=1
-trap - EXIT INT TERM
 [[ -n "$VERSION_BACKUP" ]] && rm -f "$VERSION_BACKUP"
+if [[ -n "$GOOGLE_PLAY_TEMP_DIR" && -d "$GOOGLE_PLAY_TEMP_DIR" ]]; then
+    rm -rf -- "$GOOGLE_PLAY_TEMP_DIR"
+    GOOGLE_PLAY_TEMP_DIR=""
+fi
+trap - EXIT INT TERM
 
 cat <<EOF
 
@@ -358,6 +803,8 @@ Release zakończony:
   Tag:          $tag_name
   Gitea:        $release_url
   APK:          $artifact_dir/gitea/$gitea_apk_name
-  Google Play:  $artifact_dir/google-play/$play_aab_name
+  AAB:          $artifact_dir/google-play/$play_aab_name
+  Google Play:  $GOOGLE_PLAY_SUMMARY
+  Play track:   ${google_play_track:-pominięto}
   Checksumy:    $artifact_dir/SHA256SUMS.txt
 EOF