@hot-updater/android-helper 1.2.0-rc.5 → 1.2.0-rc.7

package/dist/index.cjs

@@ -1208,8 +1208,10 @@ const RESOURCE_MANAGER_API = "https://cloudresourcemanager.googleapis.com";
 const SERVICE_USAGE_API = "https://serviceusage.googleapis.com";
 const IAM_API = "https://iam.googleapis.com/v1";
 const GCLOUD_INSTALL_URL = "https://cloud.google.com/sdk/docs/install";
+/** The Google Play Android Developer API, which the service account calls. */
+const PLAY_API = "androidpublisher.googleapis.com";
 /** IAM creates the service account; the Play Developer API is what it calls. */
-const SERVICES = ["iam.googleapis.com", "androidpublisher.googleapis.com"];
+const SERVICES = ["iam.googleapis.com", PLAY_API];
 const KEY_CREATION_CONSTRAINT = "constraints/iam.disableServiceAccountKeyCreation";
 /** Retries while Google enables an API or creates a service account. */
 const PROPAGATION_ATTEMPTS = 12;
@@ -1231,18 +1233,30 @@ const isConflict = (error) => error instanceof GoogleApiError && error.status ==
 /** The API is disabled in another project than the one set up: waiting does not help. */
 const consumerApiDisabled = (error) => new PlayServiceAccountError("api-not-enabled", `${error.apiMessage}\nEnable it in ${error.consumer ?? "that project"}, then run this again.`, { cause: error });
 const isDenied = (error) => error instanceof GoogleApiError && (error.status === 403 || error.apiStatus === "PERMISSION_DENIED");
-/** The Google Account gcloud uses, if one is active. */
-const activeAccount = async (run) => (await run("gcloud", [
-	"auth",
-	"list",
-	"--filter=status:ACTIVE",
-	"--format=value(account)"
-])).trim().split("\n")[0]?.trim() || void 0;
-/**
-* gcloud's access token, after `gcloud auth login` when no account is
-* active. Stops before any change when gcloud is not installed.
-*/
-const signInWithGcloud = async ({ run, onStep }) => {
+const lines = (output) => output.split("\n").map((line) => line.trim()).filter(Boolean);
+/** The Google Accounts gcloud holds, the active one, if any, first. */
+const credentialedAccounts = async (run) => {
+	const accounts = lines(await run("gcloud", [
+		"auth",
+		"list",
+		"--format=value(account)"
+	]));
+	const [active] = lines(await run("gcloud", [
+		"auth",
+		"list",
+		"--filter=status:ACTIVE",
+		"--format=value(account)"
+	]));
+	return active !== void 0 && accounts.includes(active) ? [active, ...accounts.filter((account) => account !== active)].map((email) => ({
+		email,
+		active: email === active
+	})) : accounts.map((email) => ({
+		email,
+		active: false
+	}));
+};
+/** Stops before anything else, a prompt included, when gcloud is not installed. */
+const requireGcloud = async (run) => {
 	try {
 		await run("gcloud", ["--version"]);
 	} catch (error) {
@@ -1252,14 +1266,27 @@ const signInWithGcloud = async ({ run, onStep }) => {
 			GCLOUD_INSTALL_URL
 		].join("\n"), { cause: error });
 	}
-	let account = await activeAccount(run);
+};
+/**
+* The access token of the Google Account the developer picks among those
+* gcloud holds, or of the one `gcloud auth login` adds, when they pick
+* another or gcloud holds none. gcloud's active account stays as it was.
+*/
+const signInWithGcloud = async ({ run, request, onStep }) => {
+	const before = await credentialedAccounts(run);
+	let account = before.length > 0 ? await request.chooseGoogleAccount(before) ?? void 0 : void 0;
 	if (account === void 0) {
-		await run("gcloud", ["auth", "login"], { interactive: true }).catch(() => {});
-		account = await activeAccount(run);
-		if (account === void 0) throw new PlayServiceAccountError("gcloud-not-signed-in", "gcloud has no active Google Account.\nRun gcloud auth login, then run this again.");
+		const signedIn = await run("gcloud", ["auth", "login"], { interactive: true }).then(() => true, () => false);
+		const after = await credentialedAccounts(run);
+		account = after.find(({ email }) => !before.some((known) => known.email === email))?.email ?? (signedIn ? after.find(({ active }) => active)?.email : void 0);
+		if (account === void 0) throw new PlayServiceAccountError("gcloud-not-signed-in", before.length === 0 ? "gcloud has no active Google Account.\nRun gcloud auth login, then run this again." : "gcloud auth login didn't finish.\nRun this again to choose a Google Account.");
 	}
 	onStep(`Signed in to gcloud as ${account}`);
-	const accessToken = (await run("gcloud", ["auth", "print-access-token"])).trim();
+	const accessToken = (await run("gcloud", [
+		"auth",
+		"print-access-token",
+		account
+	])).trim();
 	(0, _hot_updater_cli_tools.registerSecretValue)(accessToken);
 	return accessToken;
 };
@@ -1267,11 +1294,12 @@ const signInWithGcloud = async ({ run, onStep }) => {
 * `IssuePlayServiceAccount` with the gcloud CLI's sign-in and Google's own
 * APIs:
 *
-* 1. gcloud's Google Account, signed in with `gcloud auth login` when none
-*    is active, names the access token the Google Cloud steps use;
-* 2. the Google Cloud project "Hot Updater Play" an earlier run created, or
-*    a new one, gets the IAM and Play Developer APIs enabled, and the
-*    service account `hot-updater-play` its JSON key;
+* 1. once gcloud is found, `askPackageName` names the app, and the Google
+*    Account `chooseGoogleAccount` picks among gcloud's, or the one
+*    `gcloud auth login` adds, the access token the Google Cloud steps use;
+* 2. the account's only project with the Play Developer API, else the one
+*    `chooseProject` picks, else a new one, gets the IAM and Play Developer
+*    APIs enabled, and the service account `hot-updater-play` its JSON key;
 * 3. the developer invites the service account in Play Console, which
 *    `onInvite` opens: gcloud's token may not manage Google Play users;
 * 4. the key itself opens an edit of the app until Google Play lets it,
@@ -1281,9 +1309,12 @@ const signInWithGcloud = async ({ run, onStep }) => {
 * service account.
 */
 const createGoogleKeyIssuer = ({ fetch = globalThis.fetch, sleep = sleepFor, run = runWithExeca } = {}) => async (request) => {
-	const { packageName, onStep = () => {} } = request;
+	const { onStep = () => {} } = request;
+	await requireGcloud(run);
+	const packageName = await request.askPackageName();
 	const accessToken = await signInWithGcloud({
 		run,
+		request,
 		onStep
 	});
 	const google = createGoogleRequest({
@@ -1297,7 +1328,7 @@ const createGoogleKeyIssuer = ({ fetch = globalThis.fetch, sleep = sleepFor, run
 		onStep
 	});
 	const { projectId } = project;
-	onStep(`Enabling the Google Play Developer API in ${projectId}`);
+	onStep(`Enabling the APIs in ${projectId}`);
 	await enableServices({
 		google,
 		projectId,
@@ -1338,8 +1369,9 @@ const createGoogleKeyIssuer = ({ fetch = globalThis.fetch, sleep = sleepFor, run
 		const deleted = await revoke();
 		throw new PlayServiceAccountError("play-access-pending", [
 			`The key can't release ${packageName} yet.`,
-			"Invite the service account in Play Console with release access:",
+			"Invite the service account in Play Console:",
 			email,
+			"App permission: Release apps to testing tracks",
 			inviteUrl,
 			"A new app needs its first .aab uploaded in Play Console.",
 			...deleted ? [] : [`Delete its unused key ${key.keyId} in Google Cloud:`, `https://console.cloud.google.com/iam-admin/serviceaccounts?project=${encodeURIComponent(projectId)}`],
@@ -1408,32 +1440,53 @@ const listProjects = async (google) => {
 	} while (pageToken);
 	return projects;
 };
-/** The display name of the project Hot Updater creates, which later runs reuse. */
+/** Service Usage reads of the projects' Play Developer API, at most this many at once. */
+const API_CHECK_CONCURRENCY = 8;
+/**
+* Whether each project has the Google Play Developer API enabled, by one
+* Service Usage read each; a project this account may not read counts as
+* without it.
+*/
+const withPlayApiState = async (google, projects) => {
+	const states = [];
+	for (let start = 0; start < projects.length; start += API_CHECK_CONCURRENCY) states.push(...await Promise.all(projects.slice(start, start + API_CHECK_CONCURRENCY).map(({ projectId }) => google("Reading the project's APIs", "GET", `${SERVICE_USAGE_API}/v1/projects/${encodeURIComponent(projectId)}/services/${PLAY_API}`).then(({ state }) => state === "ENABLED", () => false))));
+	return projects.map((project, index) => ({
+		...project,
+		playApiEnabled: states[index]
+	}));
+};
+/** The display name of the project Hot Updater creates. */
 const PROJECT_DISPLAY_NAME = "Hot Updater Play";
 /**
-* The project the service account goes in, without asking: the one an
-* earlier run created, else a new one. Only when Google refuses to create
-* one does the developer pick among the account's projects.
+* The project the service account goes in: a new one for an account
+* without projects; the only project with the Play Developer API, without
+* asking; else the one the developer picks, or a new one.
 */
 const chooseProject = async ({ google, request, sleep, onStep }) => {
-	const projects = await listProjects(google);
-	const reused = projects.find((project) => project.displayName === PROJECT_DISPLAY_NAME);
-	if (reused) return reused;
-	try {
-		return await createProject({
-			google,
-			sleep,
-			onStep
-		});
-	} catch (error) {
-		if (!(error instanceof PlayServiceAccountError) || error.code !== "project-quota" && error.code !== "project-create-denied" || projects.length === 0) throw error;
-		const chosen = await request.chooseProject(projects.map(({ projectId, displayName }) => ({
-			projectId,
-			...displayName ? { displayName } : {}
-		})));
-		if (chosen === void 0) throw error;
-		return projects.find((project) => project.projectId === chosen) ?? { projectId: chosen };
+	const listed = await listProjects(google);
+	if (listed.length === 0) return createProject({
+		google,
+		sleep,
+		onStep
+	});
+	const projects = await withPlayApiState(google, listed);
+	const enabled = projects.filter(({ playApiEnabled }) => playApiEnabled);
+	if (enabled.length === 1) {
+		const [only] = enabled;
+		onStep(`Using ${only.projectId}, the project with the Play Developer API`);
+		return only;
 	}
+	const chosen = await request.chooseProject(projects.map(({ projectId, displayName, playApiEnabled }) => ({
+		projectId,
+		...displayName ? { displayName } : {},
+		playApiEnabled
+	})));
+	if (chosen === null) return createProject({
+		google,
+		sleep,
+		onStep
+	});
+	return projects.find((project) => project.projectId === chosen) ?? { projectId: chosen };
 };
 /** A new project, `hot-updater-play-<random>`, once Google has created it. */
 const createProject = async ({ google, sleep, onStep }) => {

package/dist/index.d.cts

@@ -158,7 +158,7 @@ declare const readBuiltVersionCode: ({ artifactPath, androidProjectPath }: {
 type PlayServiceAccountErrorCode =
 /** The gcloud CLI, which signs in to Google, is not installed. */
 "gcloud-not-installed" |
-/** `gcloud auth login` ended with no active Google Account. */
+/** gcloud ended with no Google Account to use: none signed in, or the sign-in was cancelled. */
 "gcloud-not-signed-in" |
 /** The Google Account may not create a Google Cloud project. */
 "project-create-denied" |
@@ -187,21 +187,40 @@ declare const PLAY_SERVICE_ACCOUNT_ID = "hot-updater-play";
 interface GoogleCloudProject {
   readonly projectId: string;
   readonly displayName?: string;
+  /** Whether the Google Play Android Developer API is enabled in it. */
+  readonly playApiEnabled: boolean;
+}
+/** A Google Account the gcloud CLI holds credentials for. */
+interface GoogleAccount {
+  readonly email: string;
+  /** Whether it is gcloud's active account. */
+  readonly active: boolean;
 }
 interface IssuePlayServiceAccountRequest {
-  /** The app's package name in Google Play, which the service account may release. */
-  readonly packageName: string;
+  /**
+   * Asks for the app's package name in Google Play, which the service
+   * account may release: after the sign-in's own tool is found, before
+   * anything else.
+   */
+  readonly askPackageName: () => Promise<string>;
+  /**
+   * Sees the Google Accounts gcloud already holds, the active one first,
+   * after the package name, and returns the one to use, or null to sign in
+   * with another. Never called when gcloud holds none: it signs in.
+   */
+  readonly chooseGoogleAccount: (accounts: readonly GoogleAccount[]) => Promise<string | null>;
   /**
    * Sees Play Console's page that invites the service account `email`, to
    * print it and open it in a browser; the issuer then waits for the invite.
    */
   readonly onInvite: (url: string, email: string) => Promise<void> | void;
   /**
-   * Sees the account's projects when Google refuses to create one for it,
-   * and returns the one to create the service account in, or undefined to
-   * stop with Google's refusal.
+   * Sees the account's projects when no one of them is the obvious home of
+   * the service account, the only one with the Google Play Developer API,
+   * and returns the project ID to create it in, or null for a new project.
+   * Never called for an account without projects: a new one is created.
    */
-  readonly chooseProject: (projects: readonly GoogleCloudProject[]) => Promise<string | undefined>;
+  readonly chooseProject: (projects: readonly GoogleCloudProject[]) => Promise<string | null>;
   /** Reports each step, such as "Creating the service account". */
   readonly onStep?: (message: string) => void;
 }
@@ -236,4 +255,4 @@ type IssuePlayServiceAccount = (request: IssuePlayServiceAccountRequest) => Prom
  */
 declare const issuePlayServiceAccount: IssuePlayServiceAccount;
 //#endregion
-export { type EnrichedNativeBuildAndroidScheme, type GoogleCloudProject, type IssuePlayServiceAccount, type IssuePlayServiceAccountRequest, type IssuedPlayServiceAccount, PLAY_SERVICE_ACCOUNT_ID, PlayServiceAccountError, type PlayServiceAccountErrorCode, PlayVersionCodeUsedError, type UploadToPlayResult, assertPlaySigned, buildAndroid, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, hasPlayReleases, issuePlayServiceAccount, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };
+export { type EnrichedNativeBuildAndroidScheme, type GoogleAccount, type GoogleCloudProject, type IssuePlayServiceAccount, type IssuePlayServiceAccountRequest, type IssuedPlayServiceAccount, PLAY_SERVICE_ACCOUNT_ID, PlayServiceAccountError, type PlayServiceAccountErrorCode, PlayVersionCodeUsedError, type UploadToPlayResult, assertPlaySigned, buildAndroid, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, hasPlayReleases, issuePlayServiceAccount, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };

package/dist/index.d.mts

@@ -159,7 +159,7 @@ declare const readBuiltVersionCode: ({ artifactPath, androidProjectPath }: {
 type PlayServiceAccountErrorCode =
 /** The gcloud CLI, which signs in to Google, is not installed. */
 "gcloud-not-installed" |
-/** `gcloud auth login` ended with no active Google Account. */
+/** gcloud ended with no Google Account to use: none signed in, or the sign-in was cancelled. */
 "gcloud-not-signed-in" |
 /** The Google Account may not create a Google Cloud project. */
 "project-create-denied" |
@@ -188,21 +188,40 @@ declare const PLAY_SERVICE_ACCOUNT_ID = "hot-updater-play";
 interface GoogleCloudProject {
   readonly projectId: string;
   readonly displayName?: string;
+  /** Whether the Google Play Android Developer API is enabled in it. */
+  readonly playApiEnabled: boolean;
+}
+/** A Google Account the gcloud CLI holds credentials for. */
+interface GoogleAccount {
+  readonly email: string;
+  /** Whether it is gcloud's active account. */
+  readonly active: boolean;
 }
 interface IssuePlayServiceAccountRequest {
-  /** The app's package name in Google Play, which the service account may release. */
-  readonly packageName: string;
+  /**
+   * Asks for the app's package name in Google Play, which the service
+   * account may release: after the sign-in's own tool is found, before
+   * anything else.
+   */
+  readonly askPackageName: () => Promise<string>;
+  /**
+   * Sees the Google Accounts gcloud already holds, the active one first,
+   * after the package name, and returns the one to use, or null to sign in
+   * with another. Never called when gcloud holds none: it signs in.
+   */
+  readonly chooseGoogleAccount: (accounts: readonly GoogleAccount[]) => Promise<string | null>;
   /**
    * Sees Play Console's page that invites the service account `email`, to
    * print it and open it in a browser; the issuer then waits for the invite.
    */
   readonly onInvite: (url: string, email: string) => Promise<void> | void;
   /**
-   * Sees the account's projects when Google refuses to create one for it,
-   * and returns the one to create the service account in, or undefined to
-   * stop with Google's refusal.
+   * Sees the account's projects when no one of them is the obvious home of
+   * the service account, the only one with the Google Play Developer API,
+   * and returns the project ID to create it in, or null for a new project.
+   * Never called for an account without projects: a new one is created.
    */
-  readonly chooseProject: (projects: readonly GoogleCloudProject[]) => Promise<string | undefined>;
+  readonly chooseProject: (projects: readonly GoogleCloudProject[]) => Promise<string | null>;
   /** Reports each step, such as "Creating the service account". */
   readonly onStep?: (message: string) => void;
 }
@@ -237,4 +256,4 @@ type IssuePlayServiceAccount = (request: IssuePlayServiceAccountRequest) => Prom
  */
 declare const issuePlayServiceAccount: IssuePlayServiceAccount;
 //#endregion
-export { type EnrichedNativeBuildAndroidScheme, type GoogleCloudProject, type IssuePlayServiceAccount, type IssuePlayServiceAccountRequest, type IssuedPlayServiceAccount, PLAY_SERVICE_ACCOUNT_ID, PlayServiceAccountError, type PlayServiceAccountErrorCode, PlayVersionCodeUsedError, type UploadToPlayResult, assertPlaySigned, buildAndroid, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, hasPlayReleases, issuePlayServiceAccount, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };
+export { type EnrichedNativeBuildAndroidScheme, type GoogleAccount, type GoogleCloudProject, type IssuePlayServiceAccount, type IssuePlayServiceAccountRequest, type IssuedPlayServiceAccount, PLAY_SERVICE_ACCOUNT_ID, PlayServiceAccountError, type PlayServiceAccountErrorCode, PlayVersionCodeUsedError, type UploadToPlayResult, assertPlaySigned, buildAndroid, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, hasPlayReleases, issuePlayServiceAccount, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };

package/dist/index.mjs

@@ -1179,8 +1179,10 @@ const RESOURCE_MANAGER_API = "https://cloudresourcemanager.googleapis.com";
 const SERVICE_USAGE_API = "https://serviceusage.googleapis.com";
 const IAM_API = "https://iam.googleapis.com/v1";
 const GCLOUD_INSTALL_URL = "https://cloud.google.com/sdk/docs/install";
+/** The Google Play Android Developer API, which the service account calls. */
+const PLAY_API = "androidpublisher.googleapis.com";
 /** IAM creates the service account; the Play Developer API is what it calls. */
-const SERVICES = ["iam.googleapis.com", "androidpublisher.googleapis.com"];
+const SERVICES = ["iam.googleapis.com", PLAY_API];
 const KEY_CREATION_CONSTRAINT = "constraints/iam.disableServiceAccountKeyCreation";
 /** Retries while Google enables an API or creates a service account. */
 const PROPAGATION_ATTEMPTS = 12;
@@ -1202,18 +1204,30 @@ const isConflict = (error) => error instanceof GoogleApiError && error.status ==
 /** The API is disabled in another project than the one set up: waiting does not help. */
 const consumerApiDisabled = (error) => new PlayServiceAccountError("api-not-enabled", `${error.apiMessage}\nEnable it in ${error.consumer ?? "that project"}, then run this again.`, { cause: error });
 const isDenied = (error) => error instanceof GoogleApiError && (error.status === 403 || error.apiStatus === "PERMISSION_DENIED");
-/** The Google Account gcloud uses, if one is active. */
-const activeAccount = async (run) => (await run("gcloud", [
-	"auth",
-	"list",
-	"--filter=status:ACTIVE",
-	"--format=value(account)"
-])).trim().split("\n")[0]?.trim() || void 0;
-/**
-* gcloud's access token, after `gcloud auth login` when no account is
-* active. Stops before any change when gcloud is not installed.
-*/
-const signInWithGcloud = async ({ run, onStep }) => {
+const lines = (output) => output.split("\n").map((line) => line.trim()).filter(Boolean);
+/** The Google Accounts gcloud holds, the active one, if any, first. */
+const credentialedAccounts = async (run) => {
+	const accounts = lines(await run("gcloud", [
+		"auth",
+		"list",
+		"--format=value(account)"
+	]));
+	const [active] = lines(await run("gcloud", [
+		"auth",
+		"list",
+		"--filter=status:ACTIVE",
+		"--format=value(account)"
+	]));
+	return active !== void 0 && accounts.includes(active) ? [active, ...accounts.filter((account) => account !== active)].map((email) => ({
+		email,
+		active: email === active
+	})) : accounts.map((email) => ({
+		email,
+		active: false
+	}));
+};
+/** Stops before anything else, a prompt included, when gcloud is not installed. */
+const requireGcloud = async (run) => {
 	try {
 		await run("gcloud", ["--version"]);
 	} catch (error) {
@@ -1223,14 +1237,27 @@ const signInWithGcloud = async ({ run, onStep }) => {
 			GCLOUD_INSTALL_URL
 		].join("\n"), { cause: error });
 	}
-	let account = await activeAccount(run);
+};
+/**
+* The access token of the Google Account the developer picks among those
+* gcloud holds, or of the one `gcloud auth login` adds, when they pick
+* another or gcloud holds none. gcloud's active account stays as it was.
+*/
+const signInWithGcloud = async ({ run, request, onStep }) => {
+	const before = await credentialedAccounts(run);
+	let account = before.length > 0 ? await request.chooseGoogleAccount(before) ?? void 0 : void 0;
 	if (account === void 0) {
-		await run("gcloud", ["auth", "login"], { interactive: true }).catch(() => {});
-		account = await activeAccount(run);
-		if (account === void 0) throw new PlayServiceAccountError("gcloud-not-signed-in", "gcloud has no active Google Account.\nRun gcloud auth login, then run this again.");
+		const signedIn = await run("gcloud", ["auth", "login"], { interactive: true }).then(() => true, () => false);
+		const after = await credentialedAccounts(run);
+		account = after.find(({ email }) => !before.some((known) => known.email === email))?.email ?? (signedIn ? after.find(({ active }) => active)?.email : void 0);
+		if (account === void 0) throw new PlayServiceAccountError("gcloud-not-signed-in", before.length === 0 ? "gcloud has no active Google Account.\nRun gcloud auth login, then run this again." : "gcloud auth login didn't finish.\nRun this again to choose a Google Account.");
 	}
 	onStep(`Signed in to gcloud as ${account}`);
-	const accessToken = (await run("gcloud", ["auth", "print-access-token"])).trim();
+	const accessToken = (await run("gcloud", [
+		"auth",
+		"print-access-token",
+		account
+	])).trim();
 	registerSecretValue(accessToken);
 	return accessToken;
 };
@@ -1238,11 +1265,12 @@ const signInWithGcloud = async ({ run, onStep }) => {
 * `IssuePlayServiceAccount` with the gcloud CLI's sign-in and Google's own
 * APIs:
 *
-* 1. gcloud's Google Account, signed in with `gcloud auth login` when none
-*    is active, names the access token the Google Cloud steps use;
-* 2. the Google Cloud project "Hot Updater Play" an earlier run created, or
-*    a new one, gets the IAM and Play Developer APIs enabled, and the
-*    service account `hot-updater-play` its JSON key;
+* 1. once gcloud is found, `askPackageName` names the app, and the Google
+*    Account `chooseGoogleAccount` picks among gcloud's, or the one
+*    `gcloud auth login` adds, the access token the Google Cloud steps use;
+* 2. the account's only project with the Play Developer API, else the one
+*    `chooseProject` picks, else a new one, gets the IAM and Play Developer
+*    APIs enabled, and the service account `hot-updater-play` its JSON key;
 * 3. the developer invites the service account in Play Console, which
 *    `onInvite` opens: gcloud's token may not manage Google Play users;
 * 4. the key itself opens an edit of the app until Google Play lets it,
@@ -1252,9 +1280,12 @@ const signInWithGcloud = async ({ run, onStep }) => {
 * service account.
 */
 const createGoogleKeyIssuer = ({ fetch = globalThis.fetch, sleep = sleepFor, run = runWithExeca } = {}) => async (request) => {
-	const { packageName, onStep = () => {} } = request;
+	const { onStep = () => {} } = request;
+	await requireGcloud(run);
+	const packageName = await request.askPackageName();
 	const accessToken = await signInWithGcloud({
 		run,
+		request,
 		onStep
 	});
 	const google = createGoogleRequest({
@@ -1268,7 +1299,7 @@ const createGoogleKeyIssuer = ({ fetch = globalThis.fetch, sleep = sleepFor, run
 		onStep
 	});
 	const { projectId } = project;
-	onStep(`Enabling the Google Play Developer API in ${projectId}`);
+	onStep(`Enabling the APIs in ${projectId}`);
 	await enableServices({
 		google,
 		projectId,
@@ -1309,8 +1340,9 @@ const createGoogleKeyIssuer = ({ fetch = globalThis.fetch, sleep = sleepFor, run
 		const deleted = await revoke();
 		throw new PlayServiceAccountError("play-access-pending", [
 			`The key can't release ${packageName} yet.`,
-			"Invite the service account in Play Console with release access:",
+			"Invite the service account in Play Console:",
 			email,
+			"App permission: Release apps to testing tracks",
 			inviteUrl,
 			"A new app needs its first .aab uploaded in Play Console.",
 			...deleted ? [] : [`Delete its unused key ${key.keyId} in Google Cloud:`, `https://console.cloud.google.com/iam-admin/serviceaccounts?project=${encodeURIComponent(projectId)}`],
@@ -1379,32 +1411,53 @@ const listProjects = async (google) => {
 	} while (pageToken);
 	return projects;
 };
-/** The display name of the project Hot Updater creates, which later runs reuse. */
+/** Service Usage reads of the projects' Play Developer API, at most this many at once. */
+const API_CHECK_CONCURRENCY = 8;
+/**
+* Whether each project has the Google Play Developer API enabled, by one
+* Service Usage read each; a project this account may not read counts as
+* without it.
+*/
+const withPlayApiState = async (google, projects) => {
+	const states = [];
+	for (let start = 0; start < projects.length; start += API_CHECK_CONCURRENCY) states.push(...await Promise.all(projects.slice(start, start + API_CHECK_CONCURRENCY).map(({ projectId }) => google("Reading the project's APIs", "GET", `${SERVICE_USAGE_API}/v1/projects/${encodeURIComponent(projectId)}/services/${PLAY_API}`).then(({ state }) => state === "ENABLED", () => false))));
+	return projects.map((project, index) => ({
+		...project,
+		playApiEnabled: states[index]
+	}));
+};
+/** The display name of the project Hot Updater creates. */
 const PROJECT_DISPLAY_NAME = "Hot Updater Play";
 /**
-* The project the service account goes in, without asking: the one an
-* earlier run created, else a new one. Only when Google refuses to create
-* one does the developer pick among the account's projects.
+* The project the service account goes in: a new one for an account
+* without projects; the only project with the Play Developer API, without
+* asking; else the one the developer picks, or a new one.
 */
 const chooseProject = async ({ google, request, sleep, onStep }) => {
-	const projects = await listProjects(google);
-	const reused = projects.find((project) => project.displayName === PROJECT_DISPLAY_NAME);
-	if (reused) return reused;
-	try {
-		return await createProject({
-			google,
-			sleep,
-			onStep
-		});
-	} catch (error) {
-		if (!(error instanceof PlayServiceAccountError) || error.code !== "project-quota" && error.code !== "project-create-denied" || projects.length === 0) throw error;
-		const chosen = await request.chooseProject(projects.map(({ projectId, displayName }) => ({
-			projectId,
-			...displayName ? { displayName } : {}
-		})));
-		if (chosen === void 0) throw error;
-		return projects.find((project) => project.projectId === chosen) ?? { projectId: chosen };
+	const listed = await listProjects(google);
+	if (listed.length === 0) return createProject({
+		google,
+		sleep,
+		onStep
+	});
+	const projects = await withPlayApiState(google, listed);
+	const enabled = projects.filter(({ playApiEnabled }) => playApiEnabled);
+	if (enabled.length === 1) {
+		const [only] = enabled;
+		onStep(`Using ${only.projectId}, the project with the Play Developer API`);
+		return only;
 	}
+	const chosen = await request.chooseProject(projects.map(({ projectId, displayName, playApiEnabled }) => ({
+		projectId,
+		...displayName ? { displayName } : {},
+		playApiEnabled
+	})));
+	if (chosen === null) return createProject({
+		google,
+		sleep,
+		onStep
+	});
+	return projects.find((project) => project.projectId === chosen) ?? { projectId: chosen };
 };
 /** A new project, `hot-updater-play-<random>`, once Google has created it. */
 const createProject = async ({ google, sleep, onStep }) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hot-updater/android-helper",
-  "version": "1.2.0-rc.5",
+  "version": "1.2.0-rc.7",
   "type": "module",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -29,9 +29,9 @@
   "dependencies": {
     "execa": "9.5.2",
     "jszip": "^3.10.1",
-    "@hot-updater/cli-tools": "1.2.0-rc.5",
-    "@hot-updater/plugin-core": "1.2.0-rc.5",
-    "@hot-updater/protocol": "1.2.0-rc.5"
+    "@hot-updater/cli-tools": "1.2.0-rc.7",
+    "@hot-updater/protocol": "1.2.0-rc.7",
+    "@hot-updater/plugin-core": "1.2.0-rc.7"
   },
   "devDependencies": {
     "@types/node": "^20"