@hot-updater/cli-tools 1.0.0-rc.17 → 1.0.0-rc.21

package/dist/index.mjs

@@ -16,6 +16,8 @@ import l__default from "node:readline";
 import tty, { ReadStream } from "node:tty";
 import Ei, { appendFileSync, createReadStream, createWriteStream, existsSync, lstatSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import path$1, { basename, dirname as dirname$1, join, posix, win32 } from "node:path";
+import { createBundleStorageKey, createMemoryAdapter, createStorageRootUriWithPath, getContentType, getManifestAssetDownloadPath, getManifestAssetStoragePath, isContentAddressedAssetFileHash, isRemoteDatabase, resolveManifestAssetStorageUri, toolingTargetOf } from "@hot-updater/plugin-core";
+import { createHotUpdater } from "@hot-updater/server";
 import os, { constants } from "node:os";
 import crypto$1, { createHash, randomBytes, randomUUID } from "node:crypto";
 import fs$2 from "node:fs/promises";
@@ -32,10 +34,9 @@ import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process";
 import { scheduler, setImmediate as setImmediate$1, setTimeout as setTimeout$1 } from "node:timers/promises";
 import { serialize } from "node:v8";
 import { Buffer as Buffer$2 } from "node:buffer";
-import { parseSync } from "oxc-parser";
+import { Visitor, parseSync } from "oxc-parser";
 import { loadConfig as loadConfig$1 } from "unconfig";
-import { createBundleStorageKey, createStoragePlugin, createStorageRootUriWithPath, getContentType, getManifestAssetDownloadPath, getManifestAssetStoragePath, isContentAddressedAssetFileHash, resolveManifestAssetStorageUri } from "@hot-updater/plugin-core";
-import { getManifestFileHash, stripBundleArtifactMetadata } from "@hot-updater/core";
+import { getManifestFileHash, stripBundleArtifactMetadata } from "@hot-updater/protocol";
 import { transformSync } from "oxc-transform";
 //#endregion
 //#region src/colors.ts
@@ -22906,6 +22907,23 @@ var BuildLogger = class {
 };
 //#endregion
 //#region src/appSetup.ts
+/** The SDK, which exports `HotUpdater` and built-in client plugins such as `insights`. */
+const SDK_MODULE = "@hot-updater/react-native";
+/**
+* The app's import lines for `HotUpdater` and `clientPlugins`: one line per
+* module, the SDK's first, so a built-in plugin joins `HotUpdater`'s import.
+* The agent scaffold renders the same lines in hot-updater's
+* `commands/infra/clientAuth.ts`, which imports no package.
+*/
+const renderAppImports = (clientPlugins) => {
+	const namesByModule = /* @__PURE__ */ new Map([[SDK_MODULE, ["HotUpdater"]]]);
+	for (const { module, name } of clientPlugins) {
+		const names = namesByModule.get(module) ?? [];
+		if (!names.includes(name)) names.push(name);
+		namesByModule.set(module, names);
+	}
+	return [...namesByModule].map(([module, names]) => `import { ${names.join(", ")} } from ${JSON.stringify(module)};`);
+};
 /**
 * The App.tsx code init prints: `HotUpdater.init` with the server's URL,
 * the header that carries the client credential when the server takes one,
@@ -22913,8 +22931,7 @@ var BuildLogger = class {
 */
 const renderAppSetup = ({ baseURL, credential, clientPlugins = [] }) => [
 	"// Add this to your App.tsx",
-	"import { HotUpdater } from \"@hot-updater/react-native\";",
-	...clientPlugins.map(({ module, name }) => `import { ${name} } from ${JSON.stringify(module)};`),
+	...renderAppImports(clientPlugins),
 	"",
 	"function App() {",
 	"  return null; // Replace with your app root.",
@@ -22947,6 +22964,42 @@ const printAppSetup = ({ baseURL, ...setup }) => {
 	}
 };
 //#endregion
+//#region src/assembleServer.ts
+/** `createHotUpdater`, with public client routes unless a plugin provides clientAuth. */
+const createServer = (database, storage, plugins) => createHotUpdater({
+	database,
+	storage,
+	plugins,
+	...plugins.some((plugin) => plugin.provides?.clientAuth) ? {} : { clientAccess: "public" }
+});
+function assembleServer({ database, storage, plugins = [] }) {
+	if (isRemoteDatabase(database)) {
+		const shape = createServer({
+			name: "memory",
+			adapter: createMemoryAdapter()
+		}, [], plugins);
+		return {
+			database,
+			core: database.core,
+			storage,
+			plugins: shape.plugins,
+			api: void 0,
+			clientPlugins: shape.clientPlugins,
+			...shape.clientAuth === void 0 ? {} : { clientAuth: shape.clientAuth }
+		};
+	}
+	const server = createServer(database, storage === void 0 ? [] : [storage], plugins);
+	return {
+		database,
+		core: server.core,
+		storage,
+		plugins: server.plugins,
+		api: server.api,
+		clientPlugins: server.clientPlugins,
+		...server.clientAuth === void 0 ? {} : { clientAuth: server.clientAuth }
+	};
+}
+//#endregion
 //#region ../../node_modules/.pnpm/ansi-regex@6.2.2/node_modules/ansi-regex/index.js
 function ansiRegex({ onlyFirst = false } = {}) {
 	return new RegExp(`(?:\\u001B\\][\\s\\S]*?(?:\\u0007|\\u001B\\u005C|\\u009C))|[\\u001B\\u009B][[\\]()#;?]*(?:\\d{1,4}(?:[;:]\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]`, onlyFirst ? void 0 : "g");
@@ -24876,7 +24929,7 @@ const loadPrivateKey = async (privateKeyPath) => {
 		throw new Error("Failed to load the local bundle signing private key.");
 	}
 };
-const createLocalSigningPlugin = ({ privateKeyPath }) => {
+const createLocalSigningAdapter = ({ privateKeyPath }) => {
 	const privateKeys = /* @__PURE__ */ new Map();
 	const getPrivateKey = (cwd = process.cwd()) => {
 		const resolvedPath = resolvePath$1(cwd, privateKeyPath);
@@ -24905,7 +24958,7 @@ const createLocalSigningPlugin = ({ privateKeyPath }) => {
 		}
 	};
 };
-const invalidSigningConfig = () => /* @__PURE__ */ new Error("Bundle signing must be a local key config or signing plugin. Omit signing to disable it.");
+const invalidSigningConfig = () => /* @__PURE__ */ new Error("Bundle signing must be a local key config or signing adapter. Omit signing to disable it.");
 const normalizeSigningConfig = (signing) => {
 	if (signing === void 0) return void 0;
 	if (typeof signing !== "object" || signing === null) throw invalidSigningConfig();
@@ -24916,7 +24969,7 @@ const normalizeSigningConfig = (signing) => {
 		"getPublicKey",
 		"sign"
 	].some((key) => Reflect.has(signing, key));
-	if ((hasPrivateKeyPath || hasEnabled) && hasPluginMembers) throw new Error("Bundle signing config cannot combine local signing fields with signing plugin fields.");
+	if ((hasPrivateKeyPath || hasEnabled) && hasPluginMembers) throw new Error("Bundle signing config cannot combine local signing fields with signing adapter fields.");
 	if (!hasPluginMembers) {
 		if (Object.keys(signing).some((key) => key !== "enabled" && key !== "privateKeyPath")) throw new Error("Local bundle signing accepts only enabled and privateKeyPath.");
 		const enabled = Reflect.get(signing, "enabled");
@@ -25015,14 +25068,14 @@ const prepareBundleSigning = async (signing, options = {}) => {
 	const normalized = normalizeSigningConfig(signing);
 	if (!normalized) return null;
 	const cwd = options.cwd ?? getCwd();
-	return preparePluginSigning("enabled" in normalized ? createLocalSigningPlugin(normalized) : normalized, cwd);
+	return preparePluginSigning("enabled" in normalized ? createLocalSigningAdapter(normalized) : normalized, cwd);
 };
 /** Resolves the public identity of the configured bundle signer. */
 const getBundleSigningPublicKey = async (signing, options = {}) => {
 	const normalized = normalizeSigningConfig(signing);
 	if (!normalized) return null;
 	const cwd = options.cwd ?? getCwd();
-	const provider = "enabled" in normalized ? createLocalSigningPlugin(normalized) : normalized;
+	const provider = "enabled" in normalized ? createLocalSigningAdapter(normalized) : normalized;
 	return exportPublicKey(await getProviderPublicKey(provider, cwd));
 };
 //#endregion
@@ -25074,47 +25127,28 @@ const renderImportStatements = (imports) => {
 	}
 	return importLines.join("\n");
 };
+/**
+* Renders the hot-updater.config.ts init writes: the build, the server's
+* storage, database, and plugins, and the deploy settings.
+*/
 var ConfigBuilder = class {
 	buildType = null;
 	storageInfo = null;
 	databaseInfo = null;
+	pluginsInfo = null;
 	intermediateCode = "";
-	collectedImports = /* @__PURE__ */ new Map();
-	constructor() {
-		this.addImport({
-			pkg: "hot-updater",
-			named: ["defineConfig"]
-		});
-		this.addImport({
-			pkg: "node:fs",
-			named: ["existsSync"]
-		});
-	}
+	imports = [{
+		pkg: "hot-updater",
+		named: ["defineConfig"]
+	}, {
+		pkg: "node:fs",
+		named: ["existsSync"]
+	}];
+	/** Adds an import, such as a credentials helper's. */
 	addImport(info) {
-		const pkg = info.pkg;
-		const existing = this.collectedImports.get(pkg);
-		if (existing) {
-			if (info.named) for (const n of info.named) existing.named.add(n);
-			if (info.defaultOrNamespace && !existing.defaultOrNamespace) existing.defaultOrNamespace = info.defaultOrNamespace;
-			if (info.sideEffect && !existing.sideEffect) existing.sideEffect = true;
-		} else this.collectedImports.set(pkg, {
-			named: new Set(info.named ?? []),
-			defaultOrNamespace: info.defaultOrNamespace,
-			sideEffect: info.sideEffect ?? false
-		});
+		this.imports.push(info);
 		return this;
 	}
-	addImports(imports) {
-		for (const imp of imports) this.addImport(imp);
-	}
-	getImportInfos() {
-		return normalizeImportInfos(Array.from(this.collectedImports.entries()).map(([pkg, info]) => ({
-			pkg,
-			named: Array.from(info.named),
-			defaultOrNamespace: info.defaultOrNamespace,
-			sideEffect: info.sideEffect ?? false
-		})));
-	}
 	generateBuildConfigString() {
 		if (!this.buildType) throw new Error("Build type must be set using .setBuildType()");
 		switch (this.buildType) {
@@ -25124,33 +25158,34 @@ var ConfigBuilder = class {
 			default: throw new Error(`Invalid build type: ${this.buildType}`);
 		}
 	}
+	/** Sets the build type ('bare', 'rock', or 'expo') and its import. */
 	setBuildType(buildType) {
-		if (this.buildType) console.warn("Build type is being set multiple times. Overwriting previous value.");
 		this.buildType = buildType;
-		this.addImport({
+		this.imports.push({
 			pkg: `@hot-updater/${buildType}`,
 			named: [buildType]
 		});
 		return this;
 	}
+	/** Sets the storage the CLI uploads to, which the server lists, and its imports. */
 	setStorage(storageConfig) {
 		this.storageInfo = storageConfig;
-		this.addImports(storageConfig.imports);
-		if (storageConfig.imports.some((imp) => imp.pkg.includes("firebase"))) this.addImport({
-			pkg: "firebase-admin/app",
-			named: ["applicationDefault"]
-		});
+		this.imports.push(...storageConfig.imports);
 		return this;
 	}
+	/** Sets the server's database and its imports. */
 	setDatabase(databaseConfig) {
 		this.databaseInfo = databaseConfig;
-		this.addImports(databaseConfig.imports);
-		if (databaseConfig.imports.some((imp) => imp.pkg.includes("firebase"))) this.addImport({
-			pkg: "firebase-admin/app",
-			named: ["applicationDefault"]
-		});
+		this.imports.push(...databaseConfig.imports);
+		return this;
+	}
+	/** Sets the plugins the server runs, such as a provider package's `plugins`. */
+	setPlugins(pluginsConfig) {
+		this.pluginsInfo = pluginsConfig;
+		this.imports.push(...pluginsConfig.imports);
 		return this;
 	}
+	/** Sets the code between the environment loading and the config, such as a credentials helper. */
 	setIntermediateCode(code) {
 		this.intermediateCode = code.trim();
 		return this;
@@ -25159,21 +25194,22 @@ var ConfigBuilder = class {
 		if (!this.buildType) throw new Error("Build type must be set using .setBuildType()");
 		if (!this.storageInfo) throw new Error("Storage config must be set using .setStorage()");
 		if (!this.databaseInfo) throw new Error("Database config must be set using .setDatabase()");
-		const imports = this.getImportInfos();
-		const importStatements = renderImportStatements(imports);
+		if (!this.pluginsInfo) throw new Error("Plugins config must be set using .setPlugins()");
+		const imports = normalizeImportInfos(this.imports);
 		const buildConfigString = this.generateBuildConfigString();
+		const plugins = this.pluginsInfo.configString;
 		const text = `
-${importStatements}
+${renderImportStatements(imports)}
 
 if (existsSync(".env.hotupdater")) {
   process.loadEnvFile(".env.hotupdater");
 }
 
-${this.intermediateCode ? `${this.intermediateCode}\n` : ""}
-export default defineConfig({
+${this.intermediateCode ? `${this.intermediateCode}\n\n` : ""}export default defineConfig({
   build: ${buildConfigString},
   storage: ${this.storageInfo.configString},
   database: ${this.databaseInfo.configString},
+  ${plugins === "plugins" ? "plugins" : `plugins: ${plugins}`},
   updateStrategy: "appVersion", // or "fingerprint"
 });
 `.trim();
@@ -25182,10 +25218,12 @@ export default defineConfig({
 			buildConfigString,
 			storageConfigString: this.storageInfo.configString,
 			databaseConfigString: this.databaseInfo.configString,
+			pluginsConfigString: plugins,
 			intermediateCode: this.intermediateCode,
 			text
 		};
 	}
+	/** hot-updater.config.ts's text. */
 	getResult() {
 		return this.getScaffold().text;
 	}
@@ -37636,13 +37674,13 @@ const createZip = async ({ outfile, targetDir, excludeExts = [] }) => {
 };
 //#endregion
 //#region src/isObject.ts
-const isObject$1 = (value) => {
+const isObject$2 = (value) => {
 	return !!value && value.constructor === Object;
 };
 //#endregion
 //#region src/crypto.ts
 const encryptJson = (jsonData, secretKey) => {
-	if (isObject$1(jsonData) === false) throw new Error("jsonData must be an object");
+	if (isObject$2(jsonData) === false) throw new Error("jsonData must be an object");
 	const iv = crypto.randomBytes(16);
 	const cipher = crypto.createCipheriv("aes-256-cbc", Buffer.from(secretKey, "hex"), iv);
 	let encrypted = cipher.update(JSON.stringify(jsonData));
@@ -40845,9 +40883,9 @@ const isReadableStream = (value) => Object.prototype.toString.call(value) === "[
 const isWritableStream = (value) => Object.prototype.toString.call(value) === "[object WritableStream]";
 const isWebStream = (value) => isReadableStream(value) || isWritableStream(value);
 const isTransformStream = (value) => isReadableStream(value?.readable) && isWritableStream(value?.writable);
-const isAsyncIterableObject = (value) => isObject(value) && typeof value[Symbol.asyncIterator] === "function";
-const isIterableObject = (value) => isObject(value) && typeof value[Symbol.iterator] === "function";
-const isObject = (value) => typeof value === "object" && value !== null;
+const isAsyncIterableObject = (value) => isObject$1(value) && typeof value[Symbol.asyncIterator] === "function";
+const isIterableObject = (value) => isObject$1(value) && typeof value[Symbol.iterator] === "function";
+const isObject$1 = (value) => typeof value === "object" && value !== null;
 const TRANSFORM_TYPES = /* @__PURE__ */ new Set([
 	"generator",
 	"asyncGenerator",
@@ -44101,6 +44139,9 @@ const KNOWN_BUILD_CALLEES = /* @__PURE__ */ new Set([
 	"expo",
 	"rock"
 ]);
+/** Build adapter packages, whose imports a kept build still needs. */
+const BUILD_IMPORT_PACKAGES = new Set([...KNOWN_BUILD_CALLEES].map((callee) => `@hot-updater/${callee}`));
+const importDeclarationsOf = (source) => source.program.body.filter((statement) => statement.type === "ImportDeclaration");
 const parseConfigSource = (text) => {
 	const result = parseSync(CONFIG_FILE_NAME, text, {
 		astType: "js",
@@ -44164,13 +44205,6 @@ const getObjectPropertyName = (property) => {
 	return null;
 };
 const isDataProperty = (property) => property.type === "Property" && property.kind === "init" && !property.method && !property.shorthand;
-const hasTrailingComma = (text) => {
-	const closeBraceIndex = text.lastIndexOf("}");
-	if (closeBraceIndex === -1) return false;
-	let index = closeBraceIndex - 1;
-	while (index >= 0 && /\s/.test(text[index] ?? "")) index -= 1;
-	return (text[index] ?? "") === ",";
-};
 const dedentBlock = (text) => {
 	const lines = text.replace(/\s+$/, "").split("\n");
 	const indents = lines.filter((line) => line.trim() !== "").map((line) => line.match(/^\s*/)?.[0].length ?? 0);
@@ -44178,16 +44212,55 @@ const dedentBlock = (text) => {
 	return lines.map((line) => line.slice(minIndent)).join("\n");
 };
 const indentBlock = (text, indent) => dedentBlock(text).split("\n").map((line) => `${indent}${line}`).join("\n");
-const appendMissingProperties = (objectText, propertyTexts, hasExistingProperties) => {
-	if (propertyTexts.length === 0) return objectText;
-	const closingIndent = /\n([ \t]*)\}$/.exec(objectText)?.[1] ?? "";
-	const childIndent = objectText.match(/\n([ \t]+)[^\s]/)?.[1] ?? `${closingIndent}  `;
-	const formattedProperties = propertyTexts.map((propertyText) => indentBlock(propertyText, childIndent)).join(",\n");
-	const closeBraceIndex = objectText.lastIndexOf("}");
-	if (closeBraceIndex === -1) return objectText;
-	const prefix = hasExistingProperties ? hasTrailingComma(objectText) ? "\n" : ",\n" : "\n";
-	const suffix = `,\n${closingIndent}`;
-	return `${objectText.slice(0, closeBraceIndex)}${prefix}${formattedProperties}${suffix}${objectText.slice(closeBraceIndex)}`;
+const lineStartOf = (text, position) => text.lastIndexOf("\n", position - 1) + 1;
+/** The indentation of the line `position` is on. */
+const lineIndentAt = (text, position) => /^[ \t]*/.exec(text.slice(lineStartOf(text, position)))?.[0] ?? "";
+/** Whether `node` is the first thing on its line. */
+const startsLine = (text, node) => /^[ \t]*$/.test(text.slice(lineStartOf(text, node.start), node.start));
+/**
+* A property's text with the indentation of its line, so that a property
+* spanning lines dedents and indents as one block.
+*/
+const getPropertyBlockText = (source, property) => source.text.slice(startsLine(source.text, property) ? lineStartOf(source.text, property.start) : property.start, property.end);
+/**
+* The edits, relative to `object`'s start, that add `propertyTexts` after its
+* last property: each on a line of its own, after that property's comma and
+* whatever comment shares its line, or after it on the line of a one-line
+* object.
+*/
+const appendPropertiesEdits = (source, object, propertyTexts) => {
+	if (propertyTexts.length === 0) return [];
+	const { text } = source;
+	const closeBrace = object.end - 1;
+	const relative = (position) => position - object.start;
+	const closingIndent = lineIndentAt(text, closeBrace);
+	const last = object.properties.at(-1);
+	if (!last) {
+		const childIndent = `${closingIndent}  `;
+		return [{
+			start: relative(object.start + 1),
+			end: relative(closeBrace),
+			text: `\n${propertyTexts.map((propertyText) => indentBlock(propertyText, childIndent)).join(",\n")},\n${closingIndent}`
+		}];
+	}
+	const comma = /^\s*,/.exec(text.slice(last.end, closeBrace));
+	const afterLast = last.end + (comma?.[0].length ?? 0);
+	const lineEnd = text.indexOf("\n", afterLast);
+	if (!startsLine(text, last) || lineEnd === -1 || lineEnd > closeBrace) return [{
+		start: relative(afterLast),
+		end: relative(afterLast),
+		text: `${comma ? " " : ", "}${propertyTexts.map((propertyText) => dedentBlock(propertyText)).join(", ")}`
+	}];
+	const childIndent = lineIndentAt(text, last.start);
+	return [...comma ? [] : [{
+		start: relative(last.end),
+		end: relative(last.end),
+		text: ","
+	}], {
+		start: relative(lineEnd),
+		end: relative(lineEnd),
+		text: `\n${propertyTexts.map((propertyText) => indentBlock(propertyText, childIndent)).join(",\n")},`
+	}];
 };
 const mergeObjectLiteralText = (existingObject, newObject, replaceIncompatibleProperties = []) => {
 	const existingText = getNodeText(existingObject.source, existingObject.objectExpression);
@@ -44231,14 +44304,12 @@ const mergeObjectLiteralText = (existingObject, newObject, replaceIncompatiblePr
 			});
 		}
 	}
-	let mergedText = existingText;
-	for (const edit of edits.sort((left, right) => right.start - left.start)) mergedText = mergedText.slice(0, edit.start) + edit.text + mergedText.slice(edit.end);
 	const missingPropertyTexts = newObject.objectExpression.properties.filter((property) => {
 		if (property.type === "SpreadElement") return !existingSpreadTexts.has(getNodeText(newObject.source, property.argument).trim());
 		const propertyName = getObjectPropertyName(property);
 		return propertyName ? !existingPropertyNames.has(propertyName) : false;
-	}).map((property) => getNodeText(newObject.source, property));
-	return appendMissingProperties(mergedText, missingPropertyTexts, existingObject.objectExpression.properties.length > 0);
+	}).map((property) => getPropertyBlockText(newObject.source, property));
+	return applyTextEdits(existingText, [...edits, ...appendPropertiesEdits(existingObject.source, existingObject.objectExpression, missingPropertyTexts)]);
 };
 const buildMergedCallInitializer = (existing, next) => {
 	const [existingArgument] = existing.callExpression.arguments;
@@ -44260,6 +44331,11 @@ const findManagedProperty = (objectExpression, propertyName) => {
 	const property = objectExpression.properties.find((candidate) => candidate.type === "Property" && candidate.kind === "init" && !candidate.method && !candidate.shorthand && getObjectPropertyName(candidate) === propertyName);
 	return property?.type === "Property" ? property : null;
 };
+/** The `plugins` property, written either way: `plugins: [...]` or `plugins`. */
+const findPluginsProperty = (objectExpression) => {
+	const property = objectExpression.properties.find((candidate) => candidate.type === "Property" && candidate.kind === "init" && !candidate.method && getObjectPropertyName(candidate) === "plugins");
+	return property?.type === "Property" ? property : null;
+};
 const getCallCallee = (expression) => {
 	if (expression.type !== "CallExpression" || expression.callee.type !== "Identifier") return null;
 	return expression.callee.name;
@@ -44283,11 +44359,20 @@ const mergeHelperStatement = (existingStatementText, helper) => {
 	if (!mergedInitializer) return null;
 	return `${existingStatement.statement.kind === "let" || existingStatement.statement.kind === "var" ? existingStatement.statement.kind : "const"} ${helper.name} = ${mergedInitializer};`;
 };
+/**
+* The config object with the scaffold's `build`, `storage`, `database`, and
+* `plugins`: a call to the same adapter keeps the project's arguments and
+* gains the scaffold's missing ones, and `plugins` is the scaffold's. A build
+* that is not a plain build adapter, such as `withSentry(bare())`, stays the
+* project's (`keptBuild`). Null when `build`, `storage`, or `database` is no
+* call.
+*/
 const updateManagedObject = (existing, next) => {
 	const objectStart = existing.objectExpression.start;
 	const objectText = getNodeText(existing.source, existing.objectExpression);
 	const propertyEdits = [];
 	const missingPropertyTexts = [];
+	let keptBuild = false;
 	for (const propertyName of [
 		"build",
 		"storage",
@@ -44297,7 +44382,7 @@ const updateManagedObject = (existing, next) => {
 		const nextProperty = findManagedProperty(next.objectExpression, propertyName);
 		if (!nextProperty) continue;
 		if (!existingProperty) {
-			missingPropertyTexts.push(getNodeText(next.source, nextProperty));
+			missingPropertyTexts.push(getPropertyBlockText(next.source, nextProperty));
 			continue;
 		}
 		const existingCallee = getCallCallee(existingProperty.value);
@@ -44305,8 +44390,11 @@ const updateManagedObject = (existing, next) => {
 		if (!existingCallee || !nextCallee) return null;
 		let nextInitializerText = getNodeText(next.source, nextProperty.value);
 		if (propertyName === "build") {
+			if (!KNOWN_BUILD_CALLEES.has(existingCallee)) {
+				keptBuild = true;
+				continue;
+			}
 			if (existingCallee === nextCallee) continue;
-			if (!KNOWN_BUILD_CALLEES.has(existingCallee)) return null;
 		} else if (existingCallee === nextCallee) {
 			if (existingProperty.value.type !== "CallExpression" || nextProperty.value.type !== "CallExpression") return null;
 			const mergedInitializer = buildMergedCallInitializer({
@@ -44325,9 +44413,21 @@ const updateManagedObject = (existing, next) => {
 			text: nextInitializerText
 		});
 	}
-	let mergedText = objectText;
-	for (const edit of propertyEdits.sort((left, right) => right.start - left.start)) mergedText = mergedText.slice(0, edit.start) + edit.text + mergedText.slice(edit.end);
-	return appendMissingProperties(mergedText, missingPropertyTexts, existing.objectExpression.properties.length > 0);
+	const existingPlugins = findPluginsProperty(existing.objectExpression);
+	const nextPlugins = findPluginsProperty(next.objectExpression);
+	if (nextPlugins) {
+		const nextPluginsText = getNodeText(next.source, nextPlugins);
+		if (!existingPlugins) missingPropertyTexts.push(getPropertyBlockText(next.source, nextPlugins));
+		else if (getNodeText(existing.source, existingPlugins).replace(/\s+/gu, "") !== nextPluginsText.replace(/\s+/gu, "")) propertyEdits.push({
+			start: existingPlugins.start - objectStart,
+			end: existingPlugins.end - objectStart,
+			text: nextPluginsText
+		});
+	}
+	return {
+		text: applyTextEdits(objectText, [...propertyEdits, ...appendPropertiesEdits(existing.source, existing.objectExpression, missingPropertyTexts)]),
+		keptBuild
+	};
 };
 const getManagedHelperName = (statement) => {
 	if (statement.type !== "VariableDeclaration") return null;
@@ -44335,12 +44435,58 @@ const getManagedHelperName = (statement) => {
 	if (declaration?.id.type !== "Identifier") return null;
 	return declaration.id.name;
 };
-const rebuildImportBlock = (source, scaffold) => {
-	const imports = scaffold.imports.map((info) => info.pkg === "node:fs" ? {
+/** Whether `text` refers to `name` as an identifier. */
+const usesIdentifier = (text, name) => new RegExp(`(?<![\\w$])${name.replace(/\$/g, "\\$")}(?![\\w$])`).test(text);
+/**
+* What a managed package's existing imports bring that the rebuilt config
+* still uses and the scaffold doesn't import, such as a project's own `cert`
+* from firebase-admin/app beside the `credential` helper init keeps. Named
+* value imports join the scaffold's import of that package; default,
+* namespace, and type imports keep a declaration of their own.
+*/
+const keptManagedImports = (declarations, scaffoldImports, usedText) => {
+	const bound = new Set(scaffoldImports.flatMap((info) => [...(info.named ?? []).map((name) => name.split(/\s+as\s+/).at(-1)), ...info.defaultOrNamespace === void 0 ? [] : [info.defaultOrNamespace.replace(/^\*\s+as\s+/, "")]]));
+	const imports = [];
+	const texts = [];
+	for (const declaration of declarations) {
+		const pkg = declaration.source.value;
+		const named = [];
+		let defaultName;
+		let namespaceName;
+		for (const specifier of declaration.specifiers) {
+			const local = specifier.local.name;
+			if (bound.has(local) || !usesIdentifier(usedText, local)) continue;
+			if (specifier.type === "ImportDefaultSpecifier") defaultName = local;
+			else if (specifier.type === "ImportNamespaceSpecifier") namespaceName = local;
+			else {
+				const imported = specifier.imported.type === "Identifier" ? specifier.imported.name : JSON.stringify(specifier.imported.value);
+				const name = imported === local ? local : `${imported} as ${local}`;
+				named.push(specifier.importKind === "type" ? `type ${name}` : name);
+			}
+		}
+		if (named.length === 0 && !defaultName && !namespaceName) continue;
+		if (declaration.importKind === "type") {
+			texts.push(`import type { ${named.join(", ")} } from "${pkg}";`);
+			continue;
+		}
+		if (named.length > 0) imports.push({
+			pkg,
+			named
+		});
+		if (namespaceName) texts.push(`import * as ${namespaceName} from "${pkg}";`);
+		if (defaultName) texts.push(`import ${defaultName} from "${pkg}";`);
+	}
+	return {
+		imports,
+		texts
+	};
+};
+const rebuildImportBlock = (source, scaffold, { keptBuild, usedText }) => {
+	const imports = scaffold.imports.filter((info) => !(keptBuild && BUILD_IMPORT_PACKAGES.has(info.pkg))).map((info) => info.pkg === "node:fs" ? {
 		...info,
 		named: info.named?.filter((name) => name !== "existsSync")
 	} : info);
-	const importDeclarations = source.program.body.filter((statement) => statement.type === "ImportDeclaration");
+	const importDeclarations = importDeclarationsOf(source);
 	const firstImport = importDeclarations[0];
 	const lastImport = importDeclarations.at(-1);
 	if (!firstImport || !lastImport) return {
@@ -44348,9 +44494,15 @@ const rebuildImportBlock = (source, scaffold) => {
 		end: 0,
 		text: `${renderImportStatements(imports)}\n\n`
 	};
-	const preservedImportTexts = importDeclarations.filter((declaration) => !MANAGED_IMPORT_PACKAGES.has(declaration.source.value)).map((declaration) => source.text.slice(getTopLevelFullStart(source, declaration), declaration.end).trim());
-	const managedImportText = renderImportStatements(imports);
-	const nextImportBlock = [...preservedImportTexts, managedImportText].filter(Boolean).join("\n");
+	const isPreserved = (declaration) => !MANAGED_IMPORT_PACKAGES.has(declaration.source.value) || keptBuild && BUILD_IMPORT_PACKAGES.has(declaration.source.value);
+	const preservedImportTexts = importDeclarations.filter(isPreserved).map((declaration) => source.text.slice(getTopLevelFullStart(source, declaration), declaration.end).trim());
+	const kept = keptManagedImports(importDeclarations.filter((declaration) => !isPreserved(declaration)), imports, usedText);
+	const managedImportText = renderImportStatements([...imports, ...kept.imports]);
+	const nextImportBlock = [
+		...preservedImportTexts,
+		...kept.texts,
+		managedImportText
+	].filter(Boolean).join("\n");
 	return {
 		start: getTopLevelFullStart(source, firstImport),
 		end: lastImport.end,
@@ -44396,27 +44548,49 @@ const mergeHotUpdaterConfigText = (existingText, scaffold) => {
 	const existingConfig = findDefineConfigObject(existingSource);
 	const nextConfig = findDefineConfigObject(nextSource);
 	if (!existingConfig || !nextConfig) return { reason: "Existing config is not a supported `export default defineConfig({ ... })` shape." };
-	const nextObjectText = updateManagedObject({
+	const nextObject = updateManagedObject({
 		objectExpression: existingConfig.objectExpression,
 		source: existingSource
 	}, {
 		objectExpression: nextConfig.objectExpression,
 		source: nextSource
 	});
-	if (!nextObjectText) return { reason: "Existing config uses dynamic build/storage/database expressions that cannot be merged safely." };
+	if (!nextObject) return { reason: "Existing config uses dynamic build/storage/database expressions that cannot be merged safely." };
 	const exportFullStart = getTopLevelFullStart(existingSource, existingConfig.exportDeclaration);
 	const firstTriviaContent = existingText.slice(exportFullStart, existingConfig.exportDeclaration.start).search(/\S/);
 	const managedBodyEnd = firstTriviaContent === -1 ? existingConfig.exportDeclaration.start : exportFullStart + firstTriviaContent;
 	const bodyEdit = rebuildManagedBody(existingSource, managedBodyEnd, scaffold);
 	if (!bodyEdit) return { reason: "Existing helper declarations could not be merged safely." };
+	const scaffoldNames = new Map(scaffold.imports.flatMap((info) => (info.named ?? []).map((name) => [name.split(/\s+as\s+/).at(-1), info.pkg])));
+	for (const declaration of importDeclarationsOf(existingSource)) {
+		const pkg = declaration.source.value;
+		if (MANAGED_IMPORT_PACKAGES.has(pkg) && !(nextObject.keptBuild && BUILD_IMPORT_PACKAGES.has(pkg))) continue;
+		for (const specifier of declaration.specifiers) {
+			const scaffoldPackage = scaffoldNames.get(specifier.local.name);
+			if (scaffoldPackage !== void 0 && scaffoldPackage !== pkg) return { reason: `The import of ${specifier.local.name} from "${pkg}" takes the name init imports from "${scaffoldPackage}".` };
+		}
+	}
+	const objectEdit = {
+		start: existingConfig.objectExpression.start,
+		end: existingConfig.objectExpression.end,
+		text: nextObject.text
+	};
+	const usedText = applyTextEdits(existingText, [
+		objectEdit,
+		bodyEdit,
+		...importDeclarationsOf(existingSource).map((declaration) => ({
+			start: declaration.start,
+			end: declaration.end,
+			text: ""
+		}))
+	]);
 	return { text: applyTextEdits(existingText, [
-		{
-			start: existingConfig.objectExpression.start,
-			end: existingConfig.objectExpression.end,
-			text: nextObjectText
-		},
+		objectEdit,
 		bodyEdit,
-		rebuildImportBlock(existingSource, scaffold)
+		rebuildImportBlock(existingSource, scaffold, {
+			keptBuild: nextObject.keptBuild,
+			usedText
+		})
 	]) };
 };
 const extractCallIdentifier = (initializer) => {
@@ -44424,9 +44598,9 @@ const extractCallIdentifier = (initializer) => {
 	if (!match) throw new Error(`Failed to extract call identifier from "${initializer}"`);
 	return match[1];
 };
-const createHotUpdaterConfigScaffold = ({ build, storage, database, extraImports = [], helperStatements = [], updateStrategy = "appVersion" }) => {
+const createHotUpdaterConfigScaffold = ({ build, storage, database, plugins, extraImports = [], helperStatements = [], updateStrategy = "appVersion" }) => {
 	const intermediateCode = helperStatements.map((statement) => statement.code.trim()).filter(Boolean).join("\n\n");
-	const builder = new ConfigBuilder().setBuildType(build).setStorage(storage).setDatabase(database);
+	const builder = new ConfigBuilder().setBuildType(build).setStorage(storage).setDatabase(database).setPlugins(plugins);
 	for (const extraImport of extraImports) builder.addImport(extraImport);
 	if (intermediateCode) builder.setIntermediateCode(intermediateCode);
 	return createHotUpdaterConfigScaffoldFromBuilder(builder, {
@@ -44451,15 +44625,22 @@ const createHotUpdaterConfigScaffoldFromBuilder = (builder, { helperStatements =
 			initializer: scaffold.databaseConfigString,
 			callee: extractCallIdentifier(scaffold.databaseConfigString)
 		},
+		plugins: { initializer: scaffold.pluginsConfigString },
 		helperStatements,
 		updateStrategy: `"${updateStrategy}"`
 	};
 };
+const readTextFile = (filePath) => fs$1.readFile(filePath, "utf-8").catch((error) => {
+	if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
+	throw error;
+});
+/**
+* Writes hot-updater.config.ts: the scaffold's when there is none, or the
+* existing config with the scaffold's build, storage, database, plugins, and
+* helpers merged in, keeping the project's own settings.
+*/
 const writeHotUpdaterConfig = async (scaffold, filePath = HOT_UPDATER_CONFIG_PATH) => {
-	const existingText = await fs$1.readFile(filePath, "utf-8").catch((error) => {
-		if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
-		throw error;
-	});
+	const existingText = await readTextFile(filePath);
 	if (existingText === null) {
 		await fs$1.writeFile(filePath, `${scaffold.text}\n`, "utf-8");
 		return {
@@ -44479,6 +44660,63 @@ const writeHotUpdaterConfig = async (scaffold, filePath = HOT_UPDATER_CONFIG_PAT
 		path: filePath
 	};
 };
+/**
+* What a config needs for the scaffold's storage, database, and plugins:
+* their imports, the helpers they read, and the properties themselves.
+*/
+const renderServerSettings = (scaffold) => {
+	const imports = scaffold.imports.filter(({ pkg }) => pkg !== "hot-updater" && pkg !== "node:fs" && !BUILD_IMPORT_PACKAGES.has(pkg));
+	const plugins = scaffold.plugins.initializer;
+	return [
+		renderImportStatements(imports),
+		...scaffold.helperStatements.map(({ code }) => code.trim()),
+		[
+			`  storage: ${scaffold.storage.initializer},`,
+			`  database: ${scaffold.database.initializer},`,
+			`  ${plugins === "plugins" ? "plugins" : `plugins: ${plugins}`},`
+		].join("\n")
+	].filter(Boolean).join("\n\n");
+};
+/** Where an older init wrote a managed server's plugins, which the config lists now. */
+const PLUGINS_FILE_PATH = "hotUpdater.plugins.ts";
+/**
+* Whether `text` is the plugins file an older init wrote: comments and a
+* re-export of a provider package's `plugins`, which the config imports now.
+*/
+const isGeneratedPluginsFile = (text) => /^export\{plugins\}from(["'])@hot-updater\/[\w-]+\1;?$/u.test(text.replace(/^\s*\/\/.*$/gmu, "").replace(/\s+/gu, ""));
+/**
+* Writes hot-updater.config.ts and says what it did. `settings` names the
+* provider in messages, such as "Supabase". A config it cannot merge is
+* kept, with what to add to it. The plugins file an older init wrote is
+* removed; one the project wrote is named, since nothing reads it.
+*/
+const writeHotUpdaterFiles = async (scaffold, { cwd = process.cwd(), settings }) => {
+	const config = await writeHotUpdaterConfig(scaffold, path.join(cwd, HOT_UPDATER_CONFIG_PATH));
+	if (config.status === "created") p.log.success(`Generated '${HOT_UPDATER_CONFIG_PATH}' file with ${settings} settings.`);
+	else if (config.status === "merged") p.log.success(`Updated '${HOT_UPDATER_CONFIG_PATH}' file with ${settings} settings.`);
+	else p.log.warn([
+		`Kept existing '${HOT_UPDATER_CONFIG_PATH}' unchanged: ${config.reason}`,
+		`Set storage, database, and plugins in its config, as init writes them for ${settings}:`,
+		"",
+		renderServerSettings(scaffold)
+	].join("\n"));
+	const pluginsPath = path.join(cwd, PLUGINS_FILE_PATH);
+	const pluginsText = await readTextFile(pluginsPath);
+	if (pluginsText === null) return { config };
+	if (isGeneratedPluginsFile(pluginsText)) {
+		await fs$1.rm(pluginsPath);
+		p.log.success(`Removed '${PLUGINS_FILE_PATH}': \`plugins\` in '${HOT_UPDATER_CONFIG_PATH}' lists the plugins the server runs.`);
+		return {
+			config,
+			pluginsFile: "removed"
+		};
+	}
+	p.log.warn(`Nothing reads '${pluginsPath}' anymore: \`plugins\` in '${HOT_UPDATER_CONFIG_PATH}' lists the plugins the server runs. Delete it.`);
+	return {
+		config,
+		pluginsFile: "kept"
+	};
+};
 //#endregion
 //#region src/initOptions.ts
 var InitError = class extends Error {
@@ -44576,78 +44814,6 @@ const getHotUpdaterEnvValue = (env, key) => {
 	return env[key]?.trim() || void 0;
 };
 //#endregion
-//#region src/hotUpdaterPlugins.ts
-/** Where `hot-updater init` writes a managed server's plugin list. */
-const HOT_UPDATER_PLUGINS_PATH = "hotUpdater.plugins.ts";
-/**
-* The plugins file for a managed provider: a re-export of the fixed list its
-* package ships, which its prebuilt server runs too.
-*/
-const renderHotUpdaterPlugins = (pkg) => [
-	"// Generated by `hot-updater init`. The managed server runs these plugins,",
-	`// and ${pkg} fixes the list, so the server, CLI, and console agree.`,
-	`export { plugins } from "${pkg}";`,
-	""
-].join("\n");
-/** Writes the plugins file; an existing file that differs is kept. */
-const writeHotUpdaterPlugins = async (pkg, filePath = HOT_UPDATER_PLUGINS_PATH) => {
-	const text = renderHotUpdaterPlugins(pkg);
-	const existingText = await fs$1.readFile(filePath, "utf-8").catch((error) => {
-		if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
-		throw error;
-	});
-	if (existingText === null) {
-		await fs$1.writeFile(filePath, text, "utf-8");
-		return {
-			status: "created",
-			path: filePath
-		};
-	}
-	if (existingText === text) return {
-		status: "unchanged",
-		path: filePath
-	};
-	return {
-		status: "skipped",
-		path: filePath,
-		reason: `it does not re-export the plugins ${pkg} runs; replace it with \`export { plugins } from "${pkg}";\``
-	};
-};
-/** Writes the plugins file for `pkg` and reports what happened. */
-const generateHotUpdaterPlugins = async (pkg, filePath = HOT_UPDATER_PLUGINS_PATH) => {
-	const result = await writeHotUpdaterPlugins(pkg, filePath);
-	if (result.status === "created") p.log.success(`Generated '${filePath}' with the plugins the server runs.`);
-	else if (result.status === "skipped") p.log.warn(`Kept existing '${filePath}' unchanged: ${result.reason}`);
-	return result;
-};
-/**
-* The plugins a project's `hotUpdater.plugins.ts` exports, which its server
-* runs; undefined when the project has no such file. The console and the CLI
-* assemble them in process as the server does, for the features and commands
-* the plugins add.
-*/
-const loadHotUpdaterPlugins = async (cwd = getCwd()) => {
-	const { config, sources } = await loadConfig$1({
-		cwd,
-		stopAt: path.dirname(cwd),
-		merge: false,
-		sources: [{
-			files: "hotUpdater.plugins",
-			extensions: [
-				"ts",
-				"mts",
-				"cts",
-				"js",
-				"mjs",
-				"cjs"
-			]
-		}]
-	});
-	if (sources.length === 0) return void 0;
-	if (!Array.isArray(config?.plugins)) throw new Error(`${path.basename(sources[0])} must export plugins, an array of plugins.`);
-	return config.plugins;
-};
-//#endregion
 //#region src/infrastructureGeneration.ts
 const assertInfrastructureGenerationPayload = ({ payload, provider, resource }) => {
 	if (typeof payload !== "object" || payload === null || !("infrastructureGeneration" in payload) || payload.infrastructureGeneration !== 1) throw new LegacyInfrastructureError(provider, resource);
@@ -44843,31 +45009,6 @@ function isMergeableValue(value) {
 //#endregion
 //#region src/loadConfig.ts
 var import_out = /* @__PURE__ */ __toESM(require_out(), 1);
-const missingDatabaseError = async () => {
-	throw new Error("database is required");
-};
-/** The default until the config names a database: every read and write refuses. */
-const missingDatabase = {
-	name: "missingDatabase",
-	adapter: {
-		id: "missing",
-		fits: () => true,
-		get: missingDatabaseError,
-		query: missingDatabaseError,
-		write: missingDatabaseError
-	}
-};
-const missingStorageError = async () => {
-	throw new Error("storage plugin is required");
-};
-const missingStorage = createStoragePlugin({
-	name: "missingStorage",
-	protocol: "missing",
-	put: missingStorageError,
-	get: missingStorageError,
-	exists: missingStorageError,
-	delete: missingStorageError
-});
 const getDefaultPlatformConfig = () => {
 	let infoPlistPaths = [];
 	try {
@@ -44916,25 +45057,26 @@ const getDefaultConfig = () => {
 			ios: {}
 		},
 		build: () => {
-			throw new Error("build plugin is required");
+			throw new Error("build adapter is required");
 		},
-		storage: missingStorage,
-		database: missingDatabase
+		plugins: []
 	};
 };
 const mergeConfigSources = (...sources) => {
 	const mergedConfig = sources.reduceRight((mergedConfig, source) => merge(mergedConfig, source ?? {}), {});
 	const database = sources.find((source) => source?.database)?.database;
+	const plugins = sources.find((source) => source?.plugins)?.plugins;
 	const signing = sources.find((source) => source?.signing)?.signing;
 	const storage = sources.find((source) => source?.storage)?.storage;
 	return {
 		...mergedConfig,
 		...database ? { database } : {},
+		...plugins ? { plugins } : {},
 		...signing ? { signing } : {},
 		...storage ? { storage } : {}
 	};
 };
-const getConfigLoaderOptions = (options) => {
+const getConfigLoaderOptions = () => {
 	const cwd = getCwd();
 	return {
 		cwd,
@@ -44949,15 +45091,36 @@ const getConfigLoaderOptions = (options) => {
 				"cts",
 				"mjs",
 				"mts"
-			],
-			rewrite: async (config) => {
-				return typeof config === "function" ? config(options) : config;
-			}
+			]
 		}]
 	};
 };
-const loadConfig = async (options) => {
-	const { config } = await loadConfig$1(getConfigLoaderOptions(options));
+/** Each load runs the config file again, which creates its adapters again. */
+const loadConfigFile = async () => {
+	const { config } = await loadConfig$1(getConfigLoaderOptions());
+	return config;
+};
+const configFor = async (source, options) => typeof source === "function" ? await source(options) : source;
+const loadConfig = async (options) => resolveConfig(await configFor(await loadConfigFile(), options));
+/**
+* hot-updater.config for each of `platforms`, with the file loaded once. A
+* config object gives every platform the same database, storage, and
+* plugins; a config function runs once per platform, so the adapters it
+* creates are that platform's own.
+*/
+const loadPlatformConfigs = async (platforms, { channel }) => {
+	const source = await loadConfigFile();
+	const configs = [];
+	for (const platform of platforms) configs.push({
+		platform,
+		config: resolveConfig(await configFor(source, {
+			channel,
+			platform
+		}))
+	});
+	return configs;
+};
+const resolveConfig = (config) => {
 	for (const key of ["authorityId", "catalogId"]) if (config && Object.hasOwn(config, key)) throw new Error(`Remove ${key} from hot-updater.config. Catalog identity is managed internally.`);
 	if (config && Object.hasOwn(config, "compressStrategy")) throw new Error("Remove compressStrategy from hot-updater.config. OTA artifacts use manifest files with per-file Brotli compression.");
 	const mergedConfig = mergeConfigSources(config, getDefaultConfig());
@@ -44968,6 +45131,97 @@ const loadConfig = async (options) => {
 	};
 };
 //#endregion
+//#region src/serverDefinition.ts
+/** A server definition tooling cannot use, with what to do about it. */
+var ServerDefinitionError = class extends Error {
+	name = "ServerDefinitionError";
+};
+const isRecord = (value) => typeof value === "object" && value !== null;
+/** Whether `value` has the public properties tooling reads from a server definition. */
+const isServerDefinition = (value) => isRecord(value) && isRecord(value.database) && typeof value.database.name === "string" && Array.isArray(value.storage) && Array.isArray(value.plugins) && Array.isArray(value.clientPlugins) && Array.isArray(value.clientEndpoints) && isRecord(value.core) && isRecord(value.api);
+/**
+* `value` as a server definition, or a `ServerDefinitionError` that says
+* what `source`, the module it came from, must export instead.
+*/
+const serverDefinitionOf = (value, source = "The server definition") => {
+	if (isServerDefinition(value)) return value;
+	if (isRecord(value) && "handlers" in value) throw new ServerDefinitionError(`${source} exports a hotUpdater from an older @hot-updater/server. Upgrade @hot-updater/server to the version of hot-updater.`);
+	throw new ServerDefinitionError(`${source} must export hotUpdater: the server createHotUpdater({ database, storage, plugins }) returns.`);
+};
+const fail = (message) => {
+	throw new ServerDefinitionError(message);
+};
+const isObject = (value) => isRecord(value) && !Array.isArray(value);
+/** The clientAuth plugin's credential contribution, checked. */
+const credentialOf = ({ plugins, clientAuth }) => {
+	if (clientAuth === void 0) return void 0;
+	const id = clientAuth.plugin;
+	const credential = plugins.find((plugin) => plugin.id === id)?.cli?.clientCredential;
+	if (!isObject(credential) || typeof credential.label !== "string" || typeof credential.header !== "string" || typeof credential.env !== "string" || typeof credential.generate !== "function" || typeof credential.provision !== "function") return fail(`Plugin "${id}" provides clientAuth but no cli.clientCredential with a label, header, env, generate, and provision, so init cannot give an app its credential.`);
+	return {
+		plugin: id,
+		credential
+	};
+};
+/**
+* The client-route policy a definition's plugins set: the plugin that
+* provides clientAuth, the headers its decision reads, and the credential an
+* app sends. Undefined when client routes are public.
+*/
+const clientAuthOf = (definition) => {
+	const found = credentialOf(definition);
+	if (found === void 0) return void 0;
+	const { label, header, env } = found.credential;
+	return {
+		plugin: found.plugin,
+		varyHeaders: definition.clientAuth?.varyHeaders ?? [],
+		credential: {
+			label,
+			header: header.toLowerCase(),
+			env
+		}
+	};
+};
+/**
+* A new client credential, made without a database, so tooling can save it
+* before it registers it. Undefined when client routes are public.
+*/
+const generateClientCredential = (definition) => credentialOf(definition)?.credential.generate();
+/**
+* Provisions the credential an app sends to client routes, through the
+* plugin that provides clientAuth, on the definition's database: a
+* credential saved in `env` is registered again rather than replaced.
+* Undefined when client routes are public.
+*/
+const provisionClientCredential = async (definition, input) => {
+	const found = credentialOf(definition);
+	if (found === void 0) return void 0;
+	const { label, header, env, provision } = found.credential;
+	const existing = input.env[env]?.trim();
+	const value = await provision(definition.api[found.plugin], {
+		...existing ? { existing } : {},
+		name: input.name
+	});
+	return {
+		label,
+		header: header.toLowerCase(),
+		env,
+		value
+	};
+};
+/** Whether `hot-updater db generate` writes schema files for a definition's database. */
+const generatesSchema = ({ database }) => database.generateSchema !== void 0;
+/** The migrator for a definition's database: core's tables and its plugins' tables. */
+const createMigrator = ({ database, plugins }) => {
+	if (database.createMigrator === void 0) throw new ServerDefinitionError(database.generateSchema === void 0 ? `The ${database.name} database has no migrator; its provider applies the schema.` : `The ${database.name} database applies its schema from migration files: run \`hot-updater db generate\`, then apply the file with the provider's tooling.`);
+	return database.createMigrator(toolingTargetOf(plugins));
+};
+/** The schema file `hot-updater db generate` writes for a definition's database. */
+const generateSchema = ({ database, plugins }, version, name) => {
+	if (database.generateSchema === void 0) throw new ServerDefinitionError(`The ${database.name} database has no schema generator; run \`hot-updater db migrate\` instead.`);
+	return database.generateSchema(version, name, toolingTargetOf(plugins));
+};
+//#endregion
 //#region src/log.ts
 const log = {
 	normal: (message) => console.log(message),
@@ -45082,6 +45336,31 @@ const makeEnv = async (newEnvVars, filePath = ".env.hotupdater", options) => {
 	}
 };
 //#endregion
+//#region src/moduleSpecifiers.ts
+/**
+* The modules `source` imports or re-exports, statically or with an
+* `import()` of a string literal or a template without substitutions: what a
+* runtime that loads it unbundled, such as Deno through an import map,
+* resolves. An `import()` of a computed specifier, such as
+* `import("dayjs/locale/" + name + ".js")`, names no module to resolve.
+* Minified code reads the same as formatted code. `fileName` gives the
+* language, such as `.ts`.
+*/
+const moduleSpecifiersOf = (fileName, source) => {
+	const { errors, module, program } = parseSync(fileName, source);
+	if (errors.length > 0) throw new Error(`Could not read the imports of ${fileName}: ${errors[0].message}`);
+	const dynamicImports = [];
+	new Visitor({ ImportExpression({ source: specifier }) {
+		if (specifier.type === "Literal" && typeof specifier.value === "string") dynamicImports.push(specifier.value);
+		else if (specifier.type === "TemplateLiteral" && specifier.expressions.length === 0 && typeof specifier.quasis[0]?.value.cooked === "string") dynamicImports.push(specifier.quasis[0].value.cooked);
+	} }).visit(program);
+	return [.../* @__PURE__ */ new Set([
+		...module.staticImports.map(({ moduleRequest }) => moduleRequest.value),
+		...module.staticExports.flatMap(({ entries }) => entries.flatMap(({ moduleRequest }) => moduleRequest === null ? [] : [moduleRequest.value])),
+		...dynamicImports
+	])];
+};
+//#endregion
 //#region src/storageFiles.ts
 const getStorageFileByteSize = async (filePath) => {
 	const { size } = await fs$2.stat(filePath, { bigint: true });
@@ -45231,24 +45510,24 @@ function resolveExtractedPath(rootDir, entryName) {
 	if (relativePath.startsWith("..") || path$1.isAbsolute(relativePath) || normalizedEntryName.startsWith("/")) throw new Error(`Invalid manifest asset path: ${entryName}`);
 	return entryPath;
 }
-async function downloadStorageObject(storageUri, storagePlugin, outputPath) {
+async function downloadStorageObject(storageUri, storageAdapter, outputPath) {
 	const protocol = new URL(storageUri).protocol.replace(":", "");
-	if (storagePlugin?.protocol === protocol) {
-		await writeStorageFile(storagePlugin, storageUri, outputPath);
+	if (storageAdapter?.protocol === protocol) {
+		await writeStorageFile(storageAdapter, storageUri, outputPath);
 		return;
 	}
 	if (protocol === "http" || protocol === "https") {
 		await downloadFromUrl(storageUri, outputPath);
 		return;
 	}
-	throw new Error(`No storage plugin for protocol: ${protocol}`);
+	throw new Error(`No storage adapter for protocol: ${protocol}`);
 }
 async function downloadFromUrl(fileUrl, filePath) {
 	const response = await fetch(fileUrl);
 	if (!response.ok) throw new Error(`Failed to download storage object: ${response.statusText}`);
 	await writeStorageResponseFile(response, filePath);
 }
-async function downloadManifestAssets({ bundle, manifest, outputDir, storagePlugin, workDir }) {
+async function downloadManifestAssets({ bundle, manifest, outputDir, storageAdapter, workDir }) {
 	await runWithConcurrency(Object.keys(manifest.assets ?? {}).sort((left, right) => left.localeCompare(right)), PROMOTE_ASSET_CONCURRENCY, async (assetPath) => {
 		const asset = manifest.assets?.[assetPath];
 		if (!asset?.fileHash) throw new Error(`Manifest file hash not found for ${assetPath}`);
@@ -45261,7 +45540,7 @@ async function downloadManifestAssets({ bundle, manifest, outputDir, storagePlug
 		});
 		const transferPath = resolveExtractedPath(workDir, `downloads/${downloadPath}`);
 		await fs$2.mkdir(path$1.dirname(transferPath), { recursive: true });
-		await downloadStorageObject(storageUri, storagePlugin, transferPath);
+		await downloadStorageObject(storageUri, storageAdapter, transferPath);
 		if (asset.downloadFileHash) {
 			if (await getFileHash(transferPath) !== asset.downloadFileHash.toLowerCase()) throw new Error(`Manifest download hash mismatch for ${assetPath}`);
 		}
@@ -45272,7 +45551,7 @@ async function downloadManifestAssets({ bundle, manifest, outputDir, storagePlug
 		if (await getFileHash(outputPath) !== asset.fileHash.toLowerCase()) throw new Error(`Manifest file hash mismatch for ${assetPath}`);
 	});
 }
-async function createCopiedBundleArtifacts({ bundle, config, nextBundleId, storagePlugin }) {
+async function createCopiedBundleArtifacts({ bundle, config, nextBundleId, storageAdapter }) {
 	const workDir = await fs$2.mkdtemp(path$1.join(os.tmpdir(), "hot-updater-console-promote-"));
 	const extractDir = path$1.join(workDir, "bundle");
 	const sourceManifestPath = path$1.join(workDir, "source-manifest.json");
@@ -45280,7 +45559,7 @@ async function createCopiedBundleArtifacts({ bundle, config, nextBundleId, stora
 	const uploadedStorageUris = [];
 	await fs$2.mkdir(extractDir, { recursive: true });
 	try {
-		await downloadStorageObject(bundle.manifestStorageUri, storagePlugin, sourceManifestPath);
+		await downloadStorageObject(bundle.manifestStorageUri, storageAdapter, sourceManifestPath);
 		const actualManifestHash = await getFileHash(sourceManifestPath);
 		const signingSession = await prepareBundleSigning(config.signing);
 		if (isSignedFileHash(bundle.manifestFileHash)) {
@@ -45297,7 +45576,7 @@ async function createCopiedBundleArtifacts({ bundle, config, nextBundleId, stora
 			bundle,
 			manifest,
 			outputDir: extractDir,
-			storagePlugin,
+			storageAdapter,
 			workDir
 		});
 		manifest.bundleId = nextBundleId;
@@ -45333,9 +45612,9 @@ async function createCopiedBundleArtifacts({ bundle, config, nextBundleId, stora
 		await fs$2.writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
 		const manifestHash = await getFileHash(manifestPath);
 		const nextManifestFileHash = signingSession ? `${SIGNED_HASH_PREFIX}${await signingSession.signFileHash(manifestHash)}` : manifestHash;
-		const archiveUpload = await putStorageFile(storagePlugin, createBundleStorageKey(nextBundleId), archivePath);
+		const archiveUpload = await putStorageFile(storageAdapter, createBundleStorageKey(nextBundleId), archivePath);
 		uploadedStorageUris.push(archiveUpload.storageUri);
-		const manifestUpload = await putStorageFile(storagePlugin, createBundleStorageKey(nextBundleId), manifestPath);
+		const manifestUpload = await putStorageFile(storageAdapter, createBundleStorageKey(nextBundleId), manifestPath);
 		uploadedStorageUris.push(manifestUpload.storageUri);
 		const assetBaseStorageUri = createStorageRootUriWithPath(manifestUpload.storageUri, nextBundleId, "assets");
 		for (const assetUploadTarget of assetUploadTargets) {
@@ -45345,8 +45624,8 @@ async function createCopiedBundleArtifacts({ bundle, config, nextBundleId, stora
 				downloadFileHash: assetUploadTarget.downloadFileHash,
 				fileHash: assetUploadTarget.fileHash
 			});
-			const { exists } = await storagePlugin.exists({ storageUri });
-			if (!exists) await putStorageFile(storagePlugin, getRelativeStorageDir(assetUploadTarget.storagePath) ? `assets/${getRelativeStorageDir(assetUploadTarget.storagePath)}` : "assets", assetUploadTarget.uploadSourcePath);
+			const { exists } = await storageAdapter.exists({ storageUri });
+			if (!exists) await putStorageFile(storageAdapter, getRelativeStorageDir(assetUploadTarget.storagePath) ? `assets/${getRelativeStorageDir(assetUploadTarget.storagePath)}` : "assets", assetUploadTarget.uploadSourcePath);
 		}
 		return {
 			bundle: {
@@ -45361,7 +45640,7 @@ async function createCopiedBundleArtifacts({ bundle, config, nextBundleId, stora
 			uploadedStorageUris
 		};
 	} catch (error) {
-		await deleteUploadedCopy(storagePlugin, uploadedStorageUris);
+		await deleteUploadedCopy(storageAdapter, uploadedStorageUris);
 		throw error;
 	} finally {
 		await fs$2.rm(workDir, {
@@ -45370,12 +45649,12 @@ async function createCopiedBundleArtifacts({ bundle, config, nextBundleId, stora
 		});
 	}
 }
-async function deleteUploadedCopy(storagePlugin, storageUris) {
+async function deleteUploadedCopy(storageAdapter, storageUris) {
 	if (storageUris.length === 0) return;
 	for (const storageUri of new Set(storageUris)) try {
 		const protocol = new URL(storageUri).protocol.replace(":", "");
-		if (storagePlugin.protocol === protocol) await storagePlugin.delete({ storageUri });
-		else if (protocol !== "http" && protocol !== "https") throw new Error(`No storage plugin for protocol: ${protocol}`);
+		if (storageAdapter.protocol === protocol) await storageAdapter.delete({ storageUri });
+		else if (protocol !== "http" && protocol !== "https") throw new Error(`No storage adapter for protocol: ${protocol}`);
 	} catch (error) {
 		console.error("Failed to delete uploaded bundle copy:", error);
 	}
@@ -45448,4 +45727,4 @@ function transformTemplate(templateString, values) {
 	return result;
 }
 //#endregion
-export { BuildLogger, ConfigBuilder, HOT_UPDATER_PLUGINS_PATH, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, InitEnvFileError, InitError, LEGACY_BUNDLE_ERROR, LegacyInfrastructureError, MissingInitInputsError, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, banner, typedColors as colors, confirmInitInputPersistence, copyDirToTmp, createCopiedBundleArtifacts, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createLogWriter, createTarBrTargetFiles, createZip, decryptJson, defineInitProvider, encryptJson, ensureInstallPackages, generateHotUpdaterPlugins, getAndroidSdkPath, getBundleSigningPublicKey, getCwd, getHotUpdaterEnvValue, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getReactNativeMetadatas, getStorageFileByteSize, link, loadConfig, loadHotUpdaterPlugins, log, makeEnv, p, prepareBundleSigning, printAppSetup, printBanner, putStorageFile, readBundleSigningPublicKeyFile, readHotUpdaterEnv, readHotUpdaterInitEnv, readPackageUp, renderAppSetup, renderHotUpdaterPlugins, renderImportStatements, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolvePackageVersion, shouldAutoSelectOnlyInitResource, stripAnsi, transformEnv, transformTemplate, writeHotUpdaterConfig, writeHotUpdaterPlugins, writeStorageFile, writeStorageResponseFile };
+export { BuildLogger, ConfigBuilder, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, InitEnvFileError, InitError, LEGACY_BUNDLE_ERROR, LegacyInfrastructureError, MissingInitInputsError, ServerDefinitionError, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, banner, clientAuthOf, typedColors as colors, confirmInitInputPersistence, copyDirToTmp, createCopiedBundleArtifacts, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createLogWriter, createMigrator, createTarBrTargetFiles, createZip, decryptJson, defineInitProvider, encryptJson, ensureInstallPackages, generateClientCredential, generateSchema, generatesSchema, getAndroidSdkPath, getBundleSigningPublicKey, getCwd, getHotUpdaterEnvValue, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getReactNativeMetadatas, getStorageFileByteSize, isServerDefinition, link, loadConfig, loadPlatformConfigs, log, makeEnv, moduleSpecifiersOf, p, prepareBundleSigning, printAppSetup, printBanner, provisionClientCredential, putStorageFile, readBundleSigningPublicKeyFile, readHotUpdaterEnv, readHotUpdaterInitEnv, readPackageUp, renderAppImports, renderAppSetup, renderImportStatements, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolvePackageVersion, serverDefinitionOf, shouldAutoSelectOnlyInitResource, stripAnsi, transformEnv, transformTemplate, writeHotUpdaterConfig, writeHotUpdaterFiles, writeStorageFile, writeStorageResponseFile };