@hot-updater/android-helper 1.2.0-rc.4 → 1.2.0-rc.6

package/dist/index.mjs

@@ -8,7 +8,6 @@ import crypto from "crypto";
 import { pipeline } from "stream/promises";
 import { createInflateRaw } from "zlib";
 import crypto$1 from "node:crypto";
-import http from "node:http";
 //#region src/utils/createGradleLogger.ts
 const createGradleLogger = ({ logPrefix }) => new BuildLogger({
 	logPrefix,
@@ -646,7 +645,8 @@ const explain = (error, packageName) => {
 /**
 * Requests to the Google Play Developer API for `packageName`, as the
 * service account: each carries an access token, exchanged for a signed
-* assertion and replaced well before it expires.
+* assertion and replaced well before it expires. The key issuer checks a
+* new key's access with it too.
 */
 const createPlayClient = ({ json, packageName, fetch }) => {
 	const account = readServiceAccount(json);
@@ -722,6 +722,26 @@ const findPlayInternalRelease = async ({ versionCode, packageName, serviceAccoun
 	}
 };
 /**
+* Whether Google Play releases any version of `packageName` on any track,
+* which means Play has the app's upload key. It reads the tracks in an edit
+* it then deletes, changing nothing.
+*/
+const hasPlayReleases = async ({ packageName, serviceAccount: { json }, fetch = globalThis.fetch }) => {
+	const { app, request } = createPlayClient({
+		json,
+		packageName,
+		fetch
+	});
+	const { id: editId } = await request("Opening a Google Play edit", "POST", `${API_URL}${app}/edits`, {});
+	const edit = `${API_URL}${app}/edits/${encodeURIComponent(editId)}`;
+	try {
+		const { tracks = [] } = await request("Reading the tracks", "GET", `${edit}/tracks`);
+		return tracks.some(({ releases = [] }) => releases.some(({ versionCodes = [] }) => versionCodes.length > 0));
+	} finally {
+		await request("Deleting the Google Play edit", "DELETE", edit).catch(() => void 0);
+	}
+};
+/**
 * The common name of every Android debug certificate: Android Studio's and
 * the Android Gradle plugin's (`CN=Android Debug, O=Android, C=US`), and React
 * Native's template `debug.keystore` (`CN=Android Debug, OU=Android,
@@ -1150,281 +1170,202 @@ var PlayServiceAccountError = class extends Error {
 		this.code = code;
 	}
 };
-/** The environment variables that replace Hot Updater's Google OAuth client. */
-const GOOGLE_OAUTH_CLIENT_ENV_NAMES = {
-	clientId: "HOT_UPDATER_GOOGLE_OAUTH_CLIENT_ID",
-	clientSecret: "HOT_UPDATER_GOOGLE_OAUTH_CLIENT_SECRET"
-};
 /** The service account Hot Updater creates, `hot-updater-play@<project>.iam.gserviceaccount.com`. */
 const PLAY_SERVICE_ACCOUNT_ID = "hot-updater-play";
-/** Where a Play Console admin finds the developer account ID. */
-const PLAY_CONSOLE_URL = "https://play.google.com/console";
-//#endregion
-//#region src/google/googleSignIn.ts
-const AUTHORIZATION_URL = "https://accounts.google.com/o/oauth2/v2/auth";
-const TOKEN_URL = "https://oauth2.googleapis.com/token";
-const REVOKE_URL = "https://oauth2.googleapis.com/revoke";
-/** How long the browser has to come back with the sign-in. */
-const SIGN_IN_TIMEOUT_MS = 3e5;
-const base64url = (bytes) => bytes.toString("base64url");
-const page = (message) => `<!doctype html><meta charset="utf-8"><title>Hot Updater</title><body style="font-family:system-ui;margin:3rem"><p>${message}</p></body>`;
-/**
-* Signs in with Google as an installed app does (RFC 8252): the browser
-* opens Google's own consent screen, so the password and the second factor
-* stay with Google, and the authorization code comes back to a loopback
-* server on 127.0.0.1, bound to a random port for this sign-in only. The
-* code is exchanged with PKCE (S256), and `state` ties the answer to this
-* request.
-*
-* @param onUrl Sees the sign-in URL, to print and open in a browser.
-*/
-const signInWithGoogle = async ({ client, scopes, onUrl, fetch = globalThis.fetch, timeoutMs = SIGN_IN_TIMEOUT_MS }) => {
-	const verifier = base64url(crypto$1.randomBytes(32));
-	const challenge = base64url(crypto$1.createHash("sha256").update(verifier).digest());
-	const state = base64url(crypto$1.randomBytes(16));
-	const server = http.createServer();
-	await new Promise((resolve, reject) => {
-		server.once("error", reject);
-		server.listen(0, "127.0.0.1", () => resolve());
-	});
-	try {
-		const { port } = server.address();
-		const redirectUri = `http://127.0.0.1:${port}`;
-		const code = new Promise((resolve, reject) => {
-			const timer = setTimeout(() => reject(new PlayServiceAccountError("sign-in-cancelled", "The Google sign-in did not finish in time.")), timeoutMs);
-			timer.unref();
-			server.on("request", (req, res) => {
-				const query = new URL(req.url ?? "/", redirectUri).searchParams;
-				if (query.get("state") !== state) {
-					res.writeHead(404).end();
-					return;
-				}
-				const error = query.get("error");
-				const answer = query.get("code");
-				res.writeHead(error || !answer ? 400 : 200, { "content-type": "text/html; charset=utf-8" }).end(page(error || !answer ? "The sign-in did not finish. Return to the terminal." : "Signed in. Close this tab and return to the terminal."));
-				clearTimeout(timer);
-				if (error || !answer) reject(new PlayServiceAccountError("sign-in-cancelled", error === "access_denied" ? "The Google sign-in was cancelled." : `The Google sign-in failed: ${error ?? "no authorization code"}.`));
-				else resolve(answer);
-			});
-		});
-		code.catch(() => {});
-		const url = new URL(AUTHORIZATION_URL);
-		url.search = new URLSearchParams({
-			client_id: client.clientId,
-			redirect_uri: redirectUri,
-			response_type: "code",
-			scope: scopes.join(" "),
-			code_challenge: challenge,
-			code_challenge_method: "S256",
-			state,
-			prompt: "select_account"
-		}).toString();
-		await onUrl(url.toString());
-		const authorizationCode = await code;
-		registerSecretValue(authorizationCode);
-		const response = await fetch(TOKEN_URL, {
-			method: "POST",
-			headers: { "content-type": "application/x-www-form-urlencoded" },
-			body: new URLSearchParams({
-				code: authorizationCode,
-				client_id: client.clientId,
-				...client.clientSecret ? { client_secret: client.clientSecret } : {},
-				redirect_uri: redirectUri,
-				grant_type: "authorization_code",
-				code_verifier: verifier
-			}).toString()
-		});
-		const token = await response.json().catch(() => ({}));
-		if (!response.ok || typeof token.access_token !== "string") throw new PlayServiceAccountError(token.error === "invalid_client" ? "sign-in-not-configured" : "sign-in-cancelled", `Google refused the sign-in (HTTP ${response.status}).${typeof token.error_description === "string" ? `\n${token.error_description}` : typeof token.error === "string" ? `\n${token.error}` : ""}`);
-		registerSecretValue(token.access_token);
-		return {
-			accessToken: token.access_token,
-			scopes: typeof token.scope === "string" ? token.scope.split(" ") : []
-		};
-	} finally {
-		server.closeAllConnections();
-		await new Promise((resolve) => server.close(() => resolve()));
-	}
-};
-/** Ends a sign-in: Google revokes its access token. Whether Google did. */
-const revokeGoogleToken = async (accessToken, fetch = globalThis.fetch) => {
-	try {
-		return (await fetch(REVOKE_URL, {
-			method: "POST",
-			headers: { "content-type": "application/x-www-form-urlencoded" },
-			body: new URLSearchParams({ token: accessToken }).toString()
-		})).ok;
-	} catch {
-		return false;
-	}
-};
 //#endregion
 //#region src/google/googleKeyIssuer.ts
-const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
-const ANDROID_PUBLISHER_SCOPE = "https://www.googleapis.com/auth/androidpublisher";
-const SCOPES = [CLOUD_PLATFORM_SCOPE, ANDROID_PUBLISHER_SCOPE];
 const PUBLISHER_API = "https://androidpublisher.googleapis.com/androidpublisher/v3";
 const RESOURCE_MANAGER_API = "https://cloudresourcemanager.googleapis.com";
 const SERVICE_USAGE_API = "https://serviceusage.googleapis.com";
 const IAM_API = "https://iam.googleapis.com/v1";
+const GCLOUD_INSTALL_URL = "https://cloud.google.com/sdk/docs/install";
+/** The Google Play Android Developer API, which the service account calls. */
+const PLAY_API = "androidpublisher.googleapis.com";
 /** IAM creates the service account; the Play Developer API is what it calls. */
-const SERVICES = ["iam.googleapis.com", "androidpublisher.googleapis.com"];
-/**
-* What the service account may do in Play Console, for the app only: read
-* it, and release to testing tracks, which `--submit play-internal` does.
-*/
-const APP_PERMISSIONS = ["CAN_VIEW_NON_FINANCIAL_DATA", "CAN_MANAGE_TRACK_APKS"];
+const SERVICES = ["iam.googleapis.com", PLAY_API];
 const KEY_CREATION_CONSTRAINT = "constraints/iam.disableServiceAccountKeyCreation";
 /** Retries while Google enables an API or creates a service account. */
 const PROPAGATION_ATTEMPTS = 12;
 const PROPAGATION_DELAY_MS = 1e4;
+/** Checks of the key's access to the app, about ten minutes of them. */
+const ACCESS_ATTEMPTS = 120;
+const ACCESS_DELAY_MS = 5e3;
 const sleepFor = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-/** The developer account ID in `input`, a number or a Play Console URL. */
-const parseDeveloperId = (input) => {
-	const trimmed = input.trim();
-	if (/^\d+$/u.test(trimmed)) return trimmed;
-	return trimmed.match(/\/developers\/(\d+)(?:[/?#]|$)/u)?.[1];
-};
+const runWithExeca = async (file, args, options) => (await execa(file, args, options?.interactive ? { stdio: "inherit" } : { stdin: "ignore" })).stdout ?? "";
+/**
+* Play Console's page that invites `email` as a user. `_` stands for the
+* developer account the browser is signed in to, so no ID is needed.
+*/
+const playConsoleInviteUrl = (email) => `https://play.google.com/console/u/0/developers/_/users-and-permissions?invite=${encodeURIComponent(email)}`;
 /** A project ID nobody has: Google Cloud's are global. */
 const newProjectId = () => `${PLAY_SERVICE_ACCOUNT_ID}-${crypto$1.randomBytes(3).toString("hex")}`;
 const isNotFound = (error) => error instanceof GoogleApiError && error.status === 404;
 const isConflict = (error) => error instanceof GoogleApiError && error.status === 409;
-/** The API is disabled in the OAuth client's own project: waiting does not help. */
-const clientApiDisabled = (error) => new PlayServiceAccountError("api-not-enabled", `${error.apiMessage}\nEnable it in the OAuth client's project (${GOOGLE_OAUTH_CLIENT_ENV_NAMES.clientId}).`, { cause: error });
-/** Google's own words, after a message that names the likely cause. */
-const googleSays = (error) => error instanceof GoogleApiError && error.apiMessage ? `\nGoogle: ${error.apiMessage}` : "";
-/** A Play Console refusal, as `not-play-admin`. */
-const notPlayAdmin = (developerId, error) => new PlayServiceAccountError("not-play-admin", `This Google Account isn't an admin of Play Console developer ${developerId}.${googleSays(error)}\nSign in with an account that has the Admin permission there.`, { cause: error });
+/** The API is disabled in another project than the one set up: waiting does not help. */
+const consumerApiDisabled = (error) => new PlayServiceAccountError("api-not-enabled", `${error.apiMessage}\nEnable it in ${error.consumer ?? "that project"}, then run this again.`, { cause: error });
 const isDenied = (error) => error instanceof GoogleApiError && (error.status === 403 || error.apiStatus === "PERMISSION_DENIED");
+/** The Google Account gcloud uses, if one is active. */
+const activeAccount = async (run) => (await run("gcloud", [
+	"auth",
+	"list",
+	"--filter=status:ACTIVE",
+	"--format=value(account)"
+])).trim().split("\n")[0]?.trim() || void 0;
+/** Stops before anything else, a prompt included, when gcloud is not installed. */
+const requireGcloud = async (run) => {
+	try {
+		await run("gcloud", ["--version"]);
+	} catch (error) {
+		throw new PlayServiceAccountError("gcloud-not-installed", [
+			"gcloud CLI is not installed.",
+			"Install it, then run this again:",
+			GCLOUD_INSTALL_URL
+		].join("\n"), { cause: error });
+	}
+};
+/** gcloud's access token, after `gcloud auth login` when no account is active. */
+const signInWithGcloud = async ({ run, onStep }) => {
+	let account = await activeAccount(run);
+	if (account === void 0) {
+		await run("gcloud", ["auth", "login"], { interactive: true }).catch(() => {});
+		account = await activeAccount(run);
+		if (account === void 0) throw new PlayServiceAccountError("gcloud-not-signed-in", "gcloud has no active Google Account.\nRun gcloud auth login, then run this again.");
+	}
+	onStep(`Signed in to gcloud as ${account}`);
+	const accessToken = (await run("gcloud", ["auth", "print-access-token"])).trim();
+	registerSecretValue(accessToken);
+	return accessToken;
+};
 /**
-* `IssuePlayServiceAccount` with Google's own APIs, after a sign-in on
-* Google's consent screen (OAuth for installed apps, with PKCE and a
-* loopback redirect):
+* `IssuePlayServiceAccount` with the gcloud CLI's sign-in and Google's own
+* APIs:
 *
-* 1. the Play Console side is checked first, with no change anywhere: the
-*    developer account answers to the account as its admin, and has the app;
-* 2. the chosen Google Cloud project, or a new one, gets the IAM and Play
-*    Developer APIs enabled, and the service account `hot-updater-play`;
-* 3. the service account becomes a Play Console user that may release the
-*    app to testing tracks;
-* 4. only then is its JSON key created, the last step, so a failure before
-*    it leaves no key behind.
+* 1. once gcloud is found, `askPackageName` names the app, and gcloud's
+*    Google Account, signed in with `gcloud auth login` when none is
+*    active, the access token the Google Cloud steps use;
+* 2. the account's only project with the Play Developer API, else the one
+*    `chooseProject` picks, else a new one, gets the IAM and Play Developer
+*    APIs enabled, and the service account `hot-updater-play` its JSON key;
+* 3. the developer invites the service account in Play Console, which
+*    `onInvite` opens: gcloud's token may not manage Google Play users;
+* 4. the key itself opens an edit of the app until Google Play lets it,
+*    and is deleted again when it never does.
 *
-* Each step reuses what an earlier run created: the project, the service
-* account, and its Play Console access.
+* Each step reuses what an earlier run created: the project and the
+* service account.
 */
-const createGoogleKeyIssuer = ({ fetch = globalThis.fetch, sleep = sleepFor } = {}) => async (request) => {
-	const { packageName, oauthClient, onStep = () => {} } = request;
-	if (!oauthClient?.clientId) throw new PlayServiceAccountError("sign-in-not-configured", [
-		"This build of Hot Updater has no Google OAuth client to sign in with.",
-		"Set these to a \"Desktop app\" OAuth client:",
-		`${GOOGLE_OAUTH_CLIENT_ENV_NAMES.clientId}, ${GOOGLE_OAUTH_CLIENT_ENV_NAMES.clientSecret}`
-	].join("\n"));
-	const signIn = await signInWithGoogle({
-		client: oauthClient,
-		scopes: SCOPES,
-		onUrl: request.onSignInUrl,
+const createGoogleKeyIssuer = ({ fetch = globalThis.fetch, sleep = sleepFor, run = runWithExeca } = {}) => async (request) => {
+	const { onStep = () => {} } = request;
+	await requireGcloud(run);
+	const packageName = await request.askPackageName();
+	const accessToken = await signInWithGcloud({
+		run,
+		onStep
+	});
+	const google = createGoogleRequest({
+		accessToken,
 		fetch
 	});
-	const dispose = async () => {
-		await revokeGoogleToken(signIn.accessToken, fetch);
+	const project = await chooseProject({
+		google,
+		request,
+		sleep,
+		onStep
+	});
+	const { projectId } = project;
+	onStep(`Enabling the APIs in ${projectId}`);
+	await enableServices({
+		google,
+		projectId,
+		sleep
+	});
+	onStep(`Creating the service account in ${projectId}`);
+	const email = await ensureServiceAccount({
+		google,
+		project,
+		sleep
+	});
+	onStep("Creating the service account's JSON key");
+	const key = await createKey({
+		google,
+		project,
+		email,
+		sleep
+	});
+	const revoke = async () => {
+		try {
+			await google("Deleting the key", "DELETE", `${IAM_API}/${key.name}`);
+			return true;
+		} catch (error) {
+			return isNotFound(error);
+		}
 	};
+	const inviteUrl = playConsoleInviteUrl(email);
 	try {
-		const missing = SCOPES.filter((scope) => !signIn.scopes.includes(scope));
-		if (missing.length > 0) throw new PlayServiceAccountError("scope-not-granted", `The sign-in didn't allow ${missing.map((scope) => scope === ANDROID_PUBLISHER_SCOPE ? "managing Google Play" : "managing Google Cloud").join(" or ")}.\nRun this again and keep every box on Google's consent screen ticked.`);
-		const google = createGoogleRequest({
-			accessToken: signIn.accessToken,
-			fetch
-		});
-		const developerInput = await request.askDeveloperId();
-		const developerId = parseDeveloperId(developerInput);
-		if (developerId === void 0) throw new PlayServiceAccountError("developer-not-found", `"${developerInput.trim()}" is not a developer account ID.\nIt is the number after /developers/ in Play Console's address.`);
-		onStep("Checking the Play Console developer account");
-		await checkPlayConsole({
-			google,
-			developerId,
-			packageName
-		});
-		const project = await chooseProject({
-			google,
-			request,
-			sleep,
-			onStep
-		});
-		const { projectId } = project;
-		onStep(`Enabling the Google Play Developer API in ${projectId}`);
-		await enableServices({
-			google,
-			projectId,
-			sleep
-		});
-		onStep(`Creating the service account in ${projectId}`);
-		const email = await ensureServiceAccount({
-			google,
-			project,
-			sleep
-		});
-		onStep(`Giving ${email} release access to ${packageName}`);
-		await grantPlayAccess({
-			google,
-			developerId,
-			email,
-			packageName
-		});
-		onStep("Creating the service account's JSON key");
-		const key = await createKey({
-			google,
-			project,
-			email,
+		await request.onInvite(inviteUrl, email);
+		onStep("Waiting for the Play Console invite");
+		await waitForPlayAccess({
+			json: key.json,
+			packageName,
+			fetch,
 			sleep
 		});
-		return {
-			json: key.json,
-			keyId: key.keyId,
-			email,
-			projectId,
-			developerId,
-			revoke: async () => {
-				try {
-					await google("Deleting the key", "DELETE", `${IAM_API}/${key.name}`);
-					return true;
-				} catch (error) {
-					return isNotFound(error);
-				}
-			},
-			dispose
-		};
 	} catch (error) {
-		await dispose();
-		throw error;
+		const deleted = await revoke();
+		throw new PlayServiceAccountError("play-access-pending", [
+			`The key can't release ${packageName} yet.`,
+			"Invite the service account in Play Console with release access:",
+			email,
+			inviteUrl,
+			"A new app needs its first .aab uploaded in Play Console.",
+			...deleted ? [] : [`Delete its unused key ${key.keyId} in Google Cloud:`, `https://console.cloud.google.com/iam-admin/serviceaccounts?project=${encodeURIComponent(projectId)}`],
+			"Then run: npx hot-updater google-play login"
+		].join("\n"), { cause: error });
 	}
+	return {
+		json: key.json,
+		keyId: key.keyId,
+		email,
+		projectId,
+		revoke,
+		dispose: async () => {}
+	};
 };
 /**
-* Whether the signed-in account administers `developerId`, and Google Play
-* has `packageName` there, asked without changing anything: listing the
-* account's users takes the admin permission, and an edit opened on the app
-* is deleted again.
+* Waits until the key opens an edit of `packageName`, which Google Play
+* allows once the service account is a Play Console user with access to
+* the app, then deletes the edit, which changed nothing. Google may not
+* take a key just created for a while either.
 */
-const checkPlayConsole = async ({ google, developerId, packageName }) => {
-	try {
-		await google("Listing the Play Console users", "GET", `${PUBLISHER_API}/developers/${developerId}/users?pageSize=1`);
-	} catch (error) {
-		if (isServiceDisabled(error)) throw clientApiDisabled(error);
-		if (isNotFound(error)) throw new PlayServiceAccountError("developer-not-found", `Play Console has no developer account ${developerId}.${googleSays(error)}\nIt is the number after /developers/ in Play Console's address.`, { cause: error });
-		if (isDenied(error)) throw notPlayAdmin(developerId, error);
-		throw error;
-	}
-	let edit;
-	try {
-		edit = await google(`Opening an edit of ${packageName}`, "POST", `${PUBLISHER_API}/applications/${encodeURIComponent(packageName)}/edits`);
-	} catch (error) {
-		if (isServiceDisabled(error)) throw clientApiDisabled(error);
-		if (isNotFound(error) || isDenied(error)) throw appNotFound(packageName, developerId, error);
-		throw error;
+const waitForPlayAccess = async ({ json, packageName, fetch, sleep }) => {
+	const play = createPlayClient({
+		json,
+		packageName,
+		fetch
+	});
+	const edits = `${PUBLISHER_API}/applications/${encodeURIComponent(packageName)}/edits`;
+	for (let attempt = 1;; attempt++) {
+		if (attempt > 1) await sleep(ACCESS_DELAY_MS);
+		let ready = true;
+		try {
+			await play.authorization();
+		} catch {
+			ready = false;
+		}
+		if (ready) try {
+			const edit = await play.request(`Opening an edit of ${packageName}`, "POST", edits);
+			if (edit?.id) await play.request("Deleting the edit", "DELETE", `${edits}/${edit.id}`).catch(() => {});
+			return;
+		} catch (error) {
+			if (!(error instanceof GooglePlayError) || ![
+				401,
+				403,
+				404
+			].includes(error.status)) throw error;
+		}
+		if (attempt >= ACCESS_ATTEMPTS) throw new Error("Google Play did not let the key reach the app in time.");
 	}
-	if (edit.id) await google("Deleting the edit", "DELETE", `${PUBLISHER_API}/applications/${encodeURIComponent(packageName)}/edits/${edit.id}`).catch(() => {});
 };
-const appNotFound = (packageName, developerId, cause) => new PlayServiceAccountError("app-not-found", `Google Play has no app ${packageName} in the developer account ${developerId}. Google takes the first .aab of a new app only in Play Console: create the app there, upload one .aab by hand (for example to internal testing), then run this again${googleSays(cause)}.`, { cause });
 /** The account's active projects, every page of them. */
 const listProjects = async (google) => {
 	const projects = [];
@@ -1443,20 +1384,62 @@ const listProjects = async (google) => {
 	} while (pageToken);
 	return projects;
 };
-/** The project the developer picks, or a new one when there is none or they ask. */
+/** Service Usage reads of the projects' Play Developer API, at most this many at once. */
+const API_CHECK_CONCURRENCY = 8;
+/**
+* Whether each project has the Google Play Developer API enabled, by one
+* Service Usage read each; a project this account may not read counts as
+* without it.
+*/
+const withPlayApiState = async (google, projects) => {
+	const states = [];
+	for (let start = 0; start < projects.length; start += API_CHECK_CONCURRENCY) states.push(...await Promise.all(projects.slice(start, start + API_CHECK_CONCURRENCY).map(({ projectId }) => google("Reading the project's APIs", "GET", `${SERVICE_USAGE_API}/v1/projects/${encodeURIComponent(projectId)}/services/${PLAY_API}`).then(({ state }) => state === "ENABLED", () => false))));
+	return projects.map((project, index) => ({
+		...project,
+		playApiEnabled: states[index]
+	}));
+};
+/** The display name of the project Hot Updater creates. */
+const PROJECT_DISPLAY_NAME = "Hot Updater Play";
+/**
+* The project the service account goes in: a new one for an account
+* without projects; the only project with the Play Developer API, without
+* asking; else the one the developer picks, or a new one.
+*/
 const chooseProject = async ({ google, request, sleep, onStep }) => {
-	const projects = await listProjects(google);
-	const chosen = projects.length > 0 ? await request.chooseProject(projects.map(({ projectId, displayName }) => ({
+	const listed = await listProjects(google);
+	if (listed.length === 0) return createProject({
+		google,
+		sleep,
+		onStep
+	});
+	const projects = await withPlayApiState(google, listed);
+	const enabled = projects.filter(({ playApiEnabled }) => playApiEnabled);
+	if (enabled.length === 1) {
+		const [only] = enabled;
+		onStep(`Using ${only.projectId}, the project with the Play Developer API`);
+		return only;
+	}
+	const chosen = await request.chooseProject(projects.map(({ projectId, displayName, playApiEnabled }) => ({
 		projectId,
-		...displayName ? { displayName } : {}
-	}))) : void 0;
-	if (chosen !== void 0) return projects.find((project) => project.projectId === chosen) ?? { projectId: chosen };
+		...displayName ? { displayName } : {},
+		playApiEnabled
+	})));
+	if (chosen === null) return createProject({
+		google,
+		sleep,
+		onStep
+	});
+	return projects.find((project) => project.projectId === chosen) ?? { projectId: chosen };
+};
+/** A new project, `hot-updater-play-<random>`, once Google has created it. */
+const createProject = async ({ google, sleep, onStep }) => {
 	const projectId = newProjectId();
 	onStep(`Creating the Google Cloud project ${projectId}`);
 	try {
 		const operation = await google("Creating the Google Cloud project", "POST", `${RESOURCE_MANAGER_API}/v3/projects`, {
 			projectId,
-			displayName: "Hot Updater Play"
+			displayName: PROJECT_DISPLAY_NAME
 		});
 		const created = await waitForOperation({
 			request: google,
@@ -1474,14 +1457,14 @@ const chooseProject = async ({ google, request, sleep, onStep }) => {
 		if (error.status === 429 || error.apiStatus === "RESOURCE_EXHAUSTED" || /quota/iu.test(error.apiMessage)) throw new PlayServiceAccountError("project-quota", [
 			"Google Cloud has no project quota left for this account.",
 			error.apiMessage || "Quota exceeded.",
-			"Run this again and pick an existing project, or delete one at:",
+			"Delete a project you no longer use, then run this again:",
 			"https://console.cloud.google.com/cloud-resource-manager"
 		].join("\n"), { cause: error });
 		if (/terms of service/iu.test(error.apiMessage)) throw new PlayServiceAccountError("project-create-denied", "This Google Account hasn't accepted the Google Cloud Terms of Service.\nAccept them at https://console.cloud.google.com, then run this again.", { cause: error });
 		if (isDenied(error) || error.apiStatus === "FAILED_PRECONDITION") throw new PlayServiceAccountError("project-create-denied", [
 			"This Google Account may not create Google Cloud projects.",
 			error.apiMessage || "Permission denied.",
-			"Pick an existing project, or ask an admin for the Project Creator role."
+			"Ask an admin for the Project Creator role."
 		].join("\n"), { cause: error });
 		throw error;
 	}
@@ -1500,7 +1483,7 @@ const whilePropagating = async ({ run, project, sleep, notFound = false }) => {
 		return await run();
 	} catch (error) {
 		const disabled = isServiceDisabled(error);
-		if (disabled && !consumerIs(error, project)) throw clientApiDisabled(error);
+		if (disabled && !consumerIs(error, project)) throw consumerApiDisabled(error);
 		if (!disabled && !(notFound && isNotFound(error)) || attempt >= PROPAGATION_ATTEMPTS) {
 			if (disabled) throw new PlayServiceAccountError("api-not-enabled", `Google is still enabling the APIs in ${project.projectId}.\n${error.apiMessage}\nWait a few minutes, then run this again.`, { cause: error });
 			throw error;
@@ -1559,59 +1542,6 @@ const ensureServiceAccount = async ({ google, project, sleep }) => {
 		throw error;
 	}
 };
-/**
-* Makes `email` a Play Console user that may release `packageName`, keeping
-* any permission it has: the user and the app's grant are created, or the
-* grant gains the release permissions.
-*/
-const grantPlayAccess = async ({ google, developerId, email, packageName }) => {
-	const developer = `${PUBLISHER_API}/developers/${developerId}`;
-	const user = `${developer}/users/${encodeURIComponent(email)}`;
-	try {
-		await google("Adding the Play Console user", "POST", `${developer}/users`, {
-			name: `developers/${developerId}/users/${email}`,
-			email
-		});
-	} catch (error) {
-		if (isDenied(error)) throw notPlayAdmin(developerId, error);
-		if (!isConflict(error)) throw error;
-	}
-	try {
-		await google("Granting access to the app", "POST", `${user}/grants`, {
-			name: `developers/${developerId}/users/${email}/grants/${packageName}`,
-			packageName,
-			appLevelPermissions: APP_PERMISSIONS
-		});
-		return;
-	} catch (error) {
-		if (isNotFound(error)) throw appNotFound(packageName, developerId, error);
-		if (isDenied(error)) throw notPlayAdmin(developerId, error);
-		if (!isConflict(error)) throw error;
-	}
-	const granted = await findGrant({
-		google,
-		developer,
-		email,
-		packageName
-	});
-	const missing = APP_PERMISSIONS.filter((permission) => !granted.includes(permission));
-	if (missing.length === 0) return;
-	await google("Granting access to the app", "PATCH", `${user}/grants/${encodeURIComponent(packageName)}?updateMask=appLevelPermissions`, { appLevelPermissions: [...granted, ...missing] });
-};
-/** The app permissions `email` holds on `packageName`, from the user list. */
-const findGrant = async ({ google, developer, email, packageName }) => {
-	let pageToken;
-	do {
-		const page = await google("Listing the Play Console users", "GET", `${developer}/users?${new URLSearchParams({
-			pageSize: "100",
-			...pageToken ? { pageToken } : {}
-		})}`);
-		const found = page.users?.find((candidate) => candidate.email === email);
-		if (found) return found.grants?.find((grant) => grant.packageName === packageName)?.appLevelPermissions ?? [];
-		pageToken = page.nextPageToken || void 0;
-	} while (pageToken);
-	return [];
-};
 /** A new JSON key of the service account, checked and masked in the CLI's output. */
 const createKey = async ({ google, project, email, sleep }) => {
 	const { projectId } = project;
@@ -1658,23 +1588,11 @@ const createKey = async ({ google, project, email, sleep }) => {
 //#endregion
 //#region src/playServiceAccount.ts
 /**
-* Hot Updater's Google OAuth client, a "Desktop app" client the sign-in
-* opens Google's consent screen for. Empty in a build that has none, where
-* `HOT_UPDATER_GOOGLE_OAUTH_CLIENT_ID` and `_SECRET` name one.
+* Hot Updater's issuer, the one place that picks how it is done: gcloud's
+* sign-in, then the Cloud Resource Manager, Service Usage, IAM, and Play
+* Developer APIs. Another implementation of `IssuePlayServiceAccount`
+* replaces it here without touching its callers.
 */
-const HOT_UPDATER_GOOGLE_OAUTH_CLIENT = {
-	clientId: "",
-	clientSecret: ""
-};
-/**
-* Hot Updater's issuer, the one place that picks how it is done: Google's
-* OAuth for installed apps, then the Cloud Resource Manager, Service Usage,
-* IAM, and Play Developer APIs. Another implementation of
-* `IssuePlayServiceAccount` replaces it here without touching its callers.
-*/
-const issuePlayServiceAccount = (request) => createGoogleKeyIssuer()({
-	...request,
-	oauthClient: request.oauthClient ?? HOT_UPDATER_GOOGLE_OAUTH_CLIENT
-});
+const issuePlayServiceAccount = (request) => createGoogleKeyIssuer()(request);
 //#endregion
-export { GOOGLE_OAUTH_CLIENT_ENV_NAMES, HOT_UPDATER_GOOGLE_OAUTH_CLIENT, PLAY_CONSOLE_URL, PLAY_SERVICE_ACCOUNT_ID, PlayServiceAccountError, PlayVersionCodeUsedError, assertPlaySigned, buildAndroid, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, issuePlayServiceAccount, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };
+export { PLAY_SERVICE_ACCOUNT_ID, PlayServiceAccountError, PlayVersionCodeUsedError, assertPlaySigned, buildAndroid, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, hasPlayReleases, issuePlayServiceAccount, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };