@hot-updater/android-helper 1.2.0-rc.6 → 1.2.0-rc.7

package/dist/index.cjs

@@ -1233,13 +1233,28 @@ const isConflict = (error) => error instanceof GoogleApiError && error.status ==
 /** The API is disabled in another project than the one set up: waiting does not help. */
 const consumerApiDisabled = (error) => new PlayServiceAccountError("api-not-enabled", `${error.apiMessage}\nEnable it in ${error.consumer ?? "that project"}, then run this again.`, { cause: error });
 const isDenied = (error) => error instanceof GoogleApiError && (error.status === 403 || error.apiStatus === "PERMISSION_DENIED");
-/** The Google Account gcloud uses, if one is active. */
-const activeAccount = async (run) => (await run("gcloud", [
-	"auth",
-	"list",
-	"--filter=status:ACTIVE",
-	"--format=value(account)"
-])).trim().split("\n")[0]?.trim() || void 0;
+const lines = (output) => output.split("\n").map((line) => line.trim()).filter(Boolean);
+/** The Google Accounts gcloud holds, the active one, if any, first. */
+const credentialedAccounts = async (run) => {
+	const accounts = lines(await run("gcloud", [
+		"auth",
+		"list",
+		"--format=value(account)"
+	]));
+	const [active] = lines(await run("gcloud", [
+		"auth",
+		"list",
+		"--filter=status:ACTIVE",
+		"--format=value(account)"
+	]));
+	return active !== void 0 && accounts.includes(active) ? [active, ...accounts.filter((account) => account !== active)].map((email) => ({
+		email,
+		active: email === active
+	})) : accounts.map((email) => ({
+		email,
+		active: false
+	}));
+};
 /** Stops before anything else, a prompt included, when gcloud is not installed. */
 const requireGcloud = async (run) => {
 	try {
@@ -1252,16 +1267,26 @@ const requireGcloud = async (run) => {
 		].join("\n"), { cause: error });
 	}
 };
-/** gcloud's access token, after `gcloud auth login` when no account is active. */
-const signInWithGcloud = async ({ run, onStep }) => {
-	let account = await activeAccount(run);
+/**
+* The access token of the Google Account the developer picks among those
+* gcloud holds, or of the one `gcloud auth login` adds, when they pick
+* another or gcloud holds none. gcloud's active account stays as it was.
+*/
+const signInWithGcloud = async ({ run, request, onStep }) => {
+	const before = await credentialedAccounts(run);
+	let account = before.length > 0 ? await request.chooseGoogleAccount(before) ?? void 0 : void 0;
 	if (account === void 0) {
-		await run("gcloud", ["auth", "login"], { interactive: true }).catch(() => {});
-		account = await activeAccount(run);
-		if (account === void 0) throw new PlayServiceAccountError("gcloud-not-signed-in", "gcloud has no active Google Account.\nRun gcloud auth login, then run this again.");
+		const signedIn = await run("gcloud", ["auth", "login"], { interactive: true }).then(() => true, () => false);
+		const after = await credentialedAccounts(run);
+		account = after.find(({ email }) => !before.some((known) => known.email === email))?.email ?? (signedIn ? after.find(({ active }) => active)?.email : void 0);
+		if (account === void 0) throw new PlayServiceAccountError("gcloud-not-signed-in", before.length === 0 ? "gcloud has no active Google Account.\nRun gcloud auth login, then run this again." : "gcloud auth login didn't finish.\nRun this again to choose a Google Account.");
 	}
 	onStep(`Signed in to gcloud as ${account}`);
-	const accessToken = (await run("gcloud", ["auth", "print-access-token"])).trim();
+	const accessToken = (await run("gcloud", [
+		"auth",
+		"print-access-token",
+		account
+	])).trim();
 	(0, _hot_updater_cli_tools.registerSecretValue)(accessToken);
 	return accessToken;
 };
@@ -1269,9 +1294,9 @@ const signInWithGcloud = async ({ run, onStep }) => {
 * `IssuePlayServiceAccount` with the gcloud CLI's sign-in and Google's own
 * APIs:
 *
-* 1. once gcloud is found, `askPackageName` names the app, and gcloud's
-*    Google Account, signed in with `gcloud auth login` when none is
-*    active, the access token the Google Cloud steps use;
+* 1. once gcloud is found, `askPackageName` names the app, and the Google
+*    Account `chooseGoogleAccount` picks among gcloud's, or the one
+*    `gcloud auth login` adds, the access token the Google Cloud steps use;
 * 2. the account's only project with the Play Developer API, else the one
 *    `chooseProject` picks, else a new one, gets the IAM and Play Developer
 *    APIs enabled, and the service account `hot-updater-play` its JSON key;
@@ -1289,6 +1314,7 @@ const createGoogleKeyIssuer = ({ fetch = globalThis.fetch, sleep = sleepFor, run
 	const packageName = await request.askPackageName();
 	const accessToken = await signInWithGcloud({
 		run,
+		request,
 		onStep
 	});
 	const google = createGoogleRequest({
@@ -1343,8 +1369,9 @@ const createGoogleKeyIssuer = ({ fetch = globalThis.fetch, sleep = sleepFor, run
 		const deleted = await revoke();
 		throw new PlayServiceAccountError("play-access-pending", [
 			`The key can't release ${packageName} yet.`,
-			"Invite the service account in Play Console with release access:",
+			"Invite the service account in Play Console:",
 			email,
+			"App permission: Release apps to testing tracks",
 			inviteUrl,
 			"A new app needs its first .aab uploaded in Play Console.",
 			...deleted ? [] : [`Delete its unused key ${key.keyId} in Google Cloud:`, `https://console.cloud.google.com/iam-admin/serviceaccounts?project=${encodeURIComponent(projectId)}`],

package/dist/index.d.cts

@@ -158,7 +158,7 @@ declare const readBuiltVersionCode: ({ artifactPath, androidProjectPath }: {
 type PlayServiceAccountErrorCode =
 /** The gcloud CLI, which signs in to Google, is not installed. */
 "gcloud-not-installed" |
-/** `gcloud auth login` ended with no active Google Account. */
+/** gcloud ended with no Google Account to use: none signed in, or the sign-in was cancelled. */
 "gcloud-not-signed-in" |
 /** The Google Account may not create a Google Cloud project. */
 "project-create-denied" |
@@ -190,6 +190,12 @@ interface GoogleCloudProject {
   /** Whether the Google Play Android Developer API is enabled in it. */
   readonly playApiEnabled: boolean;
 }
+/** A Google Account the gcloud CLI holds credentials for. */
+interface GoogleAccount {
+  readonly email: string;
+  /** Whether it is gcloud's active account. */
+  readonly active: boolean;
+}
 interface IssuePlayServiceAccountRequest {
   /**
    * Asks for the app's package name in Google Play, which the service
@@ -197,6 +203,12 @@ interface IssuePlayServiceAccountRequest {
    * anything else.
    */
   readonly askPackageName: () => Promise<string>;
+  /**
+   * Sees the Google Accounts gcloud already holds, the active one first,
+   * after the package name, and returns the one to use, or null to sign in
+   * with another. Never called when gcloud holds none: it signs in.
+   */
+  readonly chooseGoogleAccount: (accounts: readonly GoogleAccount[]) => Promise<string | null>;
   /**
    * Sees Play Console's page that invites the service account `email`, to
    * print it and open it in a browser; the issuer then waits for the invite.
@@ -243,4 +255,4 @@ type IssuePlayServiceAccount = (request: IssuePlayServiceAccountRequest) => Prom
  */
 declare const issuePlayServiceAccount: IssuePlayServiceAccount;
 //#endregion
-export { type EnrichedNativeBuildAndroidScheme, type GoogleCloudProject, type IssuePlayServiceAccount, type IssuePlayServiceAccountRequest, type IssuedPlayServiceAccount, PLAY_SERVICE_ACCOUNT_ID, PlayServiceAccountError, type PlayServiceAccountErrorCode, PlayVersionCodeUsedError, type UploadToPlayResult, assertPlaySigned, buildAndroid, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, hasPlayReleases, issuePlayServiceAccount, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };
+export { type EnrichedNativeBuildAndroidScheme, type GoogleAccount, type GoogleCloudProject, type IssuePlayServiceAccount, type IssuePlayServiceAccountRequest, type IssuedPlayServiceAccount, PLAY_SERVICE_ACCOUNT_ID, PlayServiceAccountError, type PlayServiceAccountErrorCode, PlayVersionCodeUsedError, type UploadToPlayResult, assertPlaySigned, buildAndroid, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, hasPlayReleases, issuePlayServiceAccount, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };

package/dist/index.d.mts

@@ -159,7 +159,7 @@ declare const readBuiltVersionCode: ({ artifactPath, androidProjectPath }: {
 type PlayServiceAccountErrorCode =
 /** The gcloud CLI, which signs in to Google, is not installed. */
 "gcloud-not-installed" |
-/** `gcloud auth login` ended with no active Google Account. */
+/** gcloud ended with no Google Account to use: none signed in, or the sign-in was cancelled. */
 "gcloud-not-signed-in" |
 /** The Google Account may not create a Google Cloud project. */
 "project-create-denied" |
@@ -191,6 +191,12 @@ interface GoogleCloudProject {
   /** Whether the Google Play Android Developer API is enabled in it. */
   readonly playApiEnabled: boolean;
 }
+/** A Google Account the gcloud CLI holds credentials for. */
+interface GoogleAccount {
+  readonly email: string;
+  /** Whether it is gcloud's active account. */
+  readonly active: boolean;
+}
 interface IssuePlayServiceAccountRequest {
   /**
    * Asks for the app's package name in Google Play, which the service
@@ -198,6 +204,12 @@ interface IssuePlayServiceAccountRequest {
    * anything else.
    */
   readonly askPackageName: () => Promise<string>;
+  /**
+   * Sees the Google Accounts gcloud already holds, the active one first,
+   * after the package name, and returns the one to use, or null to sign in
+   * with another. Never called when gcloud holds none: it signs in.
+   */
+  readonly chooseGoogleAccount: (accounts: readonly GoogleAccount[]) => Promise<string | null>;
   /**
    * Sees Play Console's page that invites the service account `email`, to
    * print it and open it in a browser; the issuer then waits for the invite.
@@ -244,4 +256,4 @@ type IssuePlayServiceAccount = (request: IssuePlayServiceAccountRequest) => Prom
  */
 declare const issuePlayServiceAccount: IssuePlayServiceAccount;
 //#endregion
-export { type EnrichedNativeBuildAndroidScheme, type GoogleCloudProject, type IssuePlayServiceAccount, type IssuePlayServiceAccountRequest, type IssuedPlayServiceAccount, PLAY_SERVICE_ACCOUNT_ID, PlayServiceAccountError, type PlayServiceAccountErrorCode, PlayVersionCodeUsedError, type UploadToPlayResult, assertPlaySigned, buildAndroid, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, hasPlayReleases, issuePlayServiceAccount, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };
+export { type EnrichedNativeBuildAndroidScheme, type GoogleAccount, type GoogleCloudProject, type IssuePlayServiceAccount, type IssuePlayServiceAccountRequest, type IssuedPlayServiceAccount, PLAY_SERVICE_ACCOUNT_ID, PlayServiceAccountError, type PlayServiceAccountErrorCode, PlayVersionCodeUsedError, type UploadToPlayResult, assertPlaySigned, buildAndroid, enrichNativeBuildAndroidScheme, extractBuiltInBundle, findPlayInternalRelease, hasPlayReleases, issuePlayServiceAccount, readBuiltApp, readBuiltPackageName, readBuiltVersionCode, resolvePlayUploadServiceAccount, uploadToPlay };

package/dist/index.mjs

@@ -1204,13 +1204,28 @@ const isConflict = (error) => error instanceof GoogleApiError && error.status ==
 /** The API is disabled in another project than the one set up: waiting does not help. */
 const consumerApiDisabled = (error) => new PlayServiceAccountError("api-not-enabled", `${error.apiMessage}\nEnable it in ${error.consumer ?? "that project"}, then run this again.`, { cause: error });
 const isDenied = (error) => error instanceof GoogleApiError && (error.status === 403 || error.apiStatus === "PERMISSION_DENIED");
-/** The Google Account gcloud uses, if one is active. */
-const activeAccount = async (run) => (await run("gcloud", [
-	"auth",
-	"list",
-	"--filter=status:ACTIVE",
-	"--format=value(account)"
-])).trim().split("\n")[0]?.trim() || void 0;
+const lines = (output) => output.split("\n").map((line) => line.trim()).filter(Boolean);
+/** The Google Accounts gcloud holds, the active one, if any, first. */
+const credentialedAccounts = async (run) => {
+	const accounts = lines(await run("gcloud", [
+		"auth",
+		"list",
+		"--format=value(account)"
+	]));
+	const [active] = lines(await run("gcloud", [
+		"auth",
+		"list",
+		"--filter=status:ACTIVE",
+		"--format=value(account)"
+	]));
+	return active !== void 0 && accounts.includes(active) ? [active, ...accounts.filter((account) => account !== active)].map((email) => ({
+		email,
+		active: email === active
+	})) : accounts.map((email) => ({
+		email,
+		active: false
+	}));
+};
 /** Stops before anything else, a prompt included, when gcloud is not installed. */
 const requireGcloud = async (run) => {
 	try {
@@ -1223,16 +1238,26 @@ const requireGcloud = async (run) => {
 		].join("\n"), { cause: error });
 	}
 };
-/** gcloud's access token, after `gcloud auth login` when no account is active. */
-const signInWithGcloud = async ({ run, onStep }) => {
-	let account = await activeAccount(run);
+/**
+* The access token of the Google Account the developer picks among those
+* gcloud holds, or of the one `gcloud auth login` adds, when they pick
+* another or gcloud holds none. gcloud's active account stays as it was.
+*/
+const signInWithGcloud = async ({ run, request, onStep }) => {
+	const before = await credentialedAccounts(run);
+	let account = before.length > 0 ? await request.chooseGoogleAccount(before) ?? void 0 : void 0;
 	if (account === void 0) {
-		await run("gcloud", ["auth", "login"], { interactive: true }).catch(() => {});
-		account = await activeAccount(run);
-		if (account === void 0) throw new PlayServiceAccountError("gcloud-not-signed-in", "gcloud has no active Google Account.\nRun gcloud auth login, then run this again.");
+		const signedIn = await run("gcloud", ["auth", "login"], { interactive: true }).then(() => true, () => false);
+		const after = await credentialedAccounts(run);
+		account = after.find(({ email }) => !before.some((known) => known.email === email))?.email ?? (signedIn ? after.find(({ active }) => active)?.email : void 0);
+		if (account === void 0) throw new PlayServiceAccountError("gcloud-not-signed-in", before.length === 0 ? "gcloud has no active Google Account.\nRun gcloud auth login, then run this again." : "gcloud auth login didn't finish.\nRun this again to choose a Google Account.");
 	}
 	onStep(`Signed in to gcloud as ${account}`);
-	const accessToken = (await run("gcloud", ["auth", "print-access-token"])).trim();
+	const accessToken = (await run("gcloud", [
+		"auth",
+		"print-access-token",
+		account
+	])).trim();
 	registerSecretValue(accessToken);
 	return accessToken;
 };
@@ -1240,9 +1265,9 @@ const signInWithGcloud = async ({ run, onStep }) => {
 * `IssuePlayServiceAccount` with the gcloud CLI's sign-in and Google's own
 * APIs:
 *
-* 1. once gcloud is found, `askPackageName` names the app, and gcloud's
-*    Google Account, signed in with `gcloud auth login` when none is
-*    active, the access token the Google Cloud steps use;
+* 1. once gcloud is found, `askPackageName` names the app, and the Google
+*    Account `chooseGoogleAccount` picks among gcloud's, or the one
+*    `gcloud auth login` adds, the access token the Google Cloud steps use;
 * 2. the account's only project with the Play Developer API, else the one
 *    `chooseProject` picks, else a new one, gets the IAM and Play Developer
 *    APIs enabled, and the service account `hot-updater-play` its JSON key;
@@ -1260,6 +1285,7 @@ const createGoogleKeyIssuer = ({ fetch = globalThis.fetch, sleep = sleepFor, run
 	const packageName = await request.askPackageName();
 	const accessToken = await signInWithGcloud({
 		run,
+		request,
 		onStep
 	});
 	const google = createGoogleRequest({
@@ -1314,8 +1340,9 @@ const createGoogleKeyIssuer = ({ fetch = globalThis.fetch, sleep = sleepFor, run
 		const deleted = await revoke();
 		throw new PlayServiceAccountError("play-access-pending", [
 			`The key can't release ${packageName} yet.`,
-			"Invite the service account in Play Console with release access:",
+			"Invite the service account in Play Console:",
 			email,
+			"App permission: Release apps to testing tracks",
 			inviteUrl,
 			"A new app needs its first .aab uploaded in Play Console.",
 			...deleted ? [] : [`Delete its unused key ${key.keyId} in Google Cloud:`, `https://console.cloud.google.com/iam-admin/serviceaccounts?project=${encodeURIComponent(projectId)}`],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hot-updater/android-helper",
-  "version": "1.2.0-rc.6",
+  "version": "1.2.0-rc.7",
   "type": "module",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -29,9 +29,9 @@
   "dependencies": {
     "execa": "9.5.2",
     "jszip": "^3.10.1",
-    "@hot-updater/cli-tools": "1.2.0-rc.6",
-    "@hot-updater/plugin-core": "1.2.0-rc.6",
-    "@hot-updater/protocol": "1.2.0-rc.6"
+    "@hot-updater/cli-tools": "1.2.0-rc.7",
+    "@hot-updater/protocol": "1.2.0-rc.7",
+    "@hot-updater/plugin-core": "1.2.0-rc.7"
   },
   "devDependencies": {
     "@types/node": "^20"