@hot-updater/cli-tools 1.0.0-rc.2 → 1.0.0-rc.21

package/dist/index.mjs

@@ -3,7 +3,7 @@ import { createRequire } from "node:module";
 import path, { dirname, parse } from "path";
 import { createInterface } from "readline";
 import { PassThrough } from "stream";
-import fs, { createWriteStream } from "fs";
+import fs from "fs";
 import fs$1 from "fs/promises";
 import $r, { EventEmitter } from "events";
 import Pi from "assert";
@@ -14,29 +14,29 @@ import process$1, { execArgv, execPath, hrtime, platform, stdin, stdout } from "
 import * as l from "node:readline";
 import l__default from "node:readline";
 import tty, { ReadStream } from "node:tty";
-import Ei, { appendFileSync, createReadStream, createWriteStream as createWriteStream$1, existsSync, lstatSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import Ei, { appendFileSync, createReadStream, createWriteStream, existsSync, lstatSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import path$1, { basename, dirname as dirname$1, join, posix, win32 } from "node:path";
+import { createBundleStorageKey, createMemoryAdapter, createStorageRootUriWithPath, getContentType, getManifestAssetDownloadPath, getManifestAssetStoragePath, isContentAddressedAssetFileHash, isRemoteDatabase, resolveManifestAssetStorageUri, toolingTargetOf } from "@hot-updater/plugin-core";
+import { createHotUpdater } from "@hot-updater/server";
 import os, { constants } from "node:os";
-import crypto$1, { randomBytes, randomUUID } from "node:crypto";
+import crypto$1, { createHash, randomBytes, randomUUID } from "node:crypto";
 import fs$2 from "node:fs/promises";
-import { pipeline } from "stream/promises";
-import * as Ms from "zlib";
-import Jr, { constants as constants$1, createBrotliCompress } from "zlib";
-import { EventEmitter as EventEmitter$1, addAbortListener, on, once, setMaxListeners } from "node:events";
 import As, { Duplex, PassThrough as PassThrough$1, Readable as Readable$1, Transform, Writable, getDefaultHighWaterMark } from "node:stream";
+import { finished, pipeline } from "node:stream/promises";
+import { brotliDecompressSync, constants as constants$1, createBrotliCompress } from "node:zlib";
+import { EventEmitter as EventEmitter$1, addAbortListener, on, once, setMaxListeners } from "node:events";
 import { StringDecoder } from "node:string_decoder";
+import * as Ms from "zlib";
+import Jr from "zlib";
 import no from "node:assert";
 import { fileURLToPath } from "node:url";
 import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process";
 import { scheduler, setImmediate as setImmediate$1, setTimeout as setTimeout$1 } from "node:timers/promises";
 import { serialize } from "node:v8";
-import { finished, pipeline as pipeline$1 } from "node:stream/promises";
 import { Buffer as Buffer$2 } from "node:buffer";
-import { parseSync } from "oxc-parser";
-import { createBundleStorageKey, createDatabasePlugin, createStoragePlugin, createStorageRootUriWithPath, detectCompressionFormat, getContentType, getManifestAssetDownloadPath, getManifestAssetStoragePath, isContentAddressedAssetFileHash, parseStorageUri, resolveManifestAssetStorageUri } from "@hot-updater/plugin-core";
+import { Visitor, parseSync } from "oxc-parser";
 import { loadConfig as loadConfig$1 } from "unconfig";
-import { brotliDecompressSync, constants as constants$2, createBrotliCompress as createBrotliCompress$1 } from "node:zlib";
-import { getManifestFileHash, stripBundleArtifactMetadata } from "@hot-updater/core";
+import { getManifestFileHash, stripBundleArtifactMetadata } from "@hot-updater/protocol";
 import { transformSync } from "oxc-transform";
 //#endregion
 //#region src/colors.ts
@@ -22906,8 +22906,99 @@ var BuildLogger = class {
 	}
 };
 //#endregion
-//#region src/apiKeyNote.ts
-const formatApiKeyNote = (apiKey) => apiKey;
+//#region src/appSetup.ts
+/** The SDK, which exports `HotUpdater` and built-in client plugins such as `insights`. */
+const SDK_MODULE = "@hot-updater/react-native";
+/**
+* The app's import lines for `HotUpdater` and `clientPlugins`: one line per
+* module, the SDK's first, so a built-in plugin joins `HotUpdater`'s import.
+* The agent scaffold renders the same lines in hot-updater's
+* `commands/infra/clientAuth.ts`, which imports no package.
+*/
+const renderAppImports = (clientPlugins) => {
+	const namesByModule = /* @__PURE__ */ new Map([[SDK_MODULE, ["HotUpdater"]]]);
+	for (const { module, name } of clientPlugins) {
+		const names = namesByModule.get(module) ?? [];
+		if (!names.includes(name)) names.push(name);
+		namesByModule.set(module, names);
+	}
+	return [...namesByModule].map(([module, names]) => `import { ${names.join(", ")} } from ${JSON.stringify(module)};`);
+};
+/**
+* The App.tsx code init prints: `HotUpdater.init` with the server's URL,
+* the header that carries the client credential when the server takes one,
+* and the client plugins the server's plugins ask for.
+*/
+const renderAppSetup = ({ baseURL, credential, clientPlugins = [] }) => [
+	"// Add this to your App.tsx",
+	...renderAppImports(clientPlugins),
+	"",
+	"function App() {",
+	"  return null; // Replace with your app root.",
+	"}",
+	"",
+	"HotUpdater.init({",
+	`  baseURL: ${JSON.stringify(baseURL)},`,
+	...credential === void 0 ? [] : [
+		"  requestHeaders: {",
+		`    ${JSON.stringify(credential.header)}: ${JSON.stringify(credential.value)},`,
+		"  },"
+	],
+	...clientPlugins.length === 0 ? [] : [`  plugins: [${clientPlugins.map(({ name }) => `${name}()`).join(", ")}],`],
+	"});",
+	"",
+	"// Call HotUpdater.checkForUpdate({ updateStrategy: \"appVersion\" })",
+	"// when your app is ready to check.",
+	"export default App;"
+].join("\n");
+/** Prints the App.tsx code, when the URL is known, and the app's credential. */
+const printAppSetup = ({ baseURL, ...setup }) => {
+	if (baseURL !== void 0) p.note(renderAppSetup({
+		baseURL,
+		...setup
+	}));
+	const { credential } = setup;
+	if (credential !== void 0) {
+		p.note(credential.value, credential.label);
+		p.log.message(`Store this ${credential.label} separately in a secure place.`);
+	}
+};
+//#endregion
+//#region src/assembleServer.ts
+/** `createHotUpdater`, with public client routes unless a plugin provides clientAuth. */
+const createServer = (database, storage, plugins) => createHotUpdater({
+	database,
+	storage,
+	plugins,
+	...plugins.some((plugin) => plugin.provides?.clientAuth) ? {} : { clientAccess: "public" }
+});
+function assembleServer({ database, storage, plugins = [] }) {
+	if (isRemoteDatabase(database)) {
+		const shape = createServer({
+			name: "memory",
+			adapter: createMemoryAdapter()
+		}, [], plugins);
+		return {
+			database,
+			core: database.core,
+			storage,
+			plugins: shape.plugins,
+			api: void 0,
+			clientPlugins: shape.clientPlugins,
+			...shape.clientAuth === void 0 ? {} : { clientAuth: shape.clientAuth }
+		};
+	}
+	const server = createServer(database, storage === void 0 ? [] : [storage], plugins);
+	return {
+		database,
+		core: server.core,
+		storage,
+		plugins: server.plugins,
+		api: server.api,
+		clientPlugins: server.clientPlugins,
+		...server.clientAuth === void 0 ? {} : { clientAuth: server.clientAuth }
+	};
+}
 //#endregion
 //#region ../../node_modules/.pnpm/ansi-regex@6.2.2/node_modules/ansi-regex/index.js
 function ansiRegex({ onlyFirst = false } = {}) {
@@ -24838,7 +24929,7 @@ const loadPrivateKey = async (privateKeyPath) => {
 		throw new Error("Failed to load the local bundle signing private key.");
 	}
 };
-const createLocalSigningPlugin = ({ privateKeyPath }) => {
+const createLocalSigningAdapter = ({ privateKeyPath }) => {
 	const privateKeys = /* @__PURE__ */ new Map();
 	const getPrivateKey = (cwd = process.cwd()) => {
 		const resolvedPath = resolvePath$1(cwd, privateKeyPath);
@@ -24867,7 +24958,7 @@ const createLocalSigningPlugin = ({ privateKeyPath }) => {
 		}
 	};
 };
-const invalidSigningConfig = () => /* @__PURE__ */ new Error("Bundle signing must be a local key config or signing plugin. Omit signing to disable it.");
+const invalidSigningConfig = () => /* @__PURE__ */ new Error("Bundle signing must be a local key config or signing adapter. Omit signing to disable it.");
 const normalizeSigningConfig = (signing) => {
 	if (signing === void 0) return void 0;
 	if (typeof signing !== "object" || signing === null) throw invalidSigningConfig();
@@ -24878,7 +24969,7 @@ const normalizeSigningConfig = (signing) => {
 		"getPublicKey",
 		"sign"
 	].some((key) => Reflect.has(signing, key));
-	if ((hasPrivateKeyPath || hasEnabled) && hasPluginMembers) throw new Error("Bundle signing config cannot combine local signing fields with signing plugin fields.");
+	if ((hasPrivateKeyPath || hasEnabled) && hasPluginMembers) throw new Error("Bundle signing config cannot combine local signing fields with signing adapter fields.");
 	if (!hasPluginMembers) {
 		if (Object.keys(signing).some((key) => key !== "enabled" && key !== "privateKeyPath")) throw new Error("Local bundle signing accepts only enabled and privateKeyPath.");
 		const enabled = Reflect.get(signing, "enabled");
@@ -24977,14 +25068,14 @@ const prepareBundleSigning = async (signing, options = {}) => {
 	const normalized = normalizeSigningConfig(signing);
 	if (!normalized) return null;
 	const cwd = options.cwd ?? getCwd();
-	return preparePluginSigning("enabled" in normalized ? createLocalSigningPlugin(normalized) : normalized, cwd);
+	return preparePluginSigning("enabled" in normalized ? createLocalSigningAdapter(normalized) : normalized, cwd);
 };
 /** Resolves the public identity of the configured bundle signer. */
 const getBundleSigningPublicKey = async (signing, options = {}) => {
 	const normalized = normalizeSigningConfig(signing);
 	if (!normalized) return null;
 	const cwd = options.cwd ?? getCwd();
-	const provider = "enabled" in normalized ? createLocalSigningPlugin(normalized) : normalized;
+	const provider = "enabled" in normalized ? createLocalSigningAdapter(normalized) : normalized;
 	return exportPublicKey(await getProviderPublicKey(provider, cwd));
 };
 //#endregion
@@ -25036,47 +25127,28 @@ const renderImportStatements = (imports) => {
 	}
 	return importLines.join("\n");
 };
+/**
+* Renders the hot-updater.config.ts init writes: the build, the server's
+* storage, database, and plugins, and the deploy settings.
+*/
 var ConfigBuilder = class {
 	buildType = null;
 	storageInfo = null;
 	databaseInfo = null;
+	pluginsInfo = null;
 	intermediateCode = "";
-	collectedImports = /* @__PURE__ */ new Map();
-	constructor() {
-		this.addImport({
-			pkg: "dotenv",
-			named: ["config"]
-		});
-		this.addImport({
-			pkg: "hot-updater",
-			named: ["defineConfig"]
-		});
-	}
+	imports = [{
+		pkg: "hot-updater",
+		named: ["defineConfig"]
+	}, {
+		pkg: "node:fs",
+		named: ["existsSync"]
+	}];
+	/** Adds an import, such as a credentials helper's. */
 	addImport(info) {
-		const pkg = info.pkg;
-		const existing = this.collectedImports.get(pkg);
-		if (existing) {
-			if (info.named) for (const n of info.named) existing.named.add(n);
-			if (info.defaultOrNamespace && !existing.defaultOrNamespace) existing.defaultOrNamespace = info.defaultOrNamespace;
-			if (info.sideEffect && !existing.sideEffect) existing.sideEffect = true;
-		} else this.collectedImports.set(pkg, {
-			named: new Set(info.named ?? []),
-			defaultOrNamespace: info.defaultOrNamespace,
-			sideEffect: info.sideEffect ?? false
-		});
+		this.imports.push(info);
 		return this;
 	}
-	addImports(imports) {
-		for (const imp of imports) this.addImport(imp);
-	}
-	getImportInfos() {
-		return normalizeImportInfos(Array.from(this.collectedImports.entries()).map(([pkg, info]) => ({
-			pkg,
-			named: Array.from(info.named),
-			defaultOrNamespace: info.defaultOrNamespace,
-			sideEffect: info.sideEffect ?? false
-		})));
-	}
 	generateBuildConfigString() {
 		if (!this.buildType) throw new Error("Build type must be set using .setBuildType()");
 		switch (this.buildType) {
@@ -25086,33 +25158,34 @@ var ConfigBuilder = class {
 			default: throw new Error(`Invalid build type: ${this.buildType}`);
 		}
 	}
+	/** Sets the build type ('bare', 'rock', or 'expo') and its import. */
 	setBuildType(buildType) {
-		if (this.buildType) console.warn("Build type is being set multiple times. Overwriting previous value.");
 		this.buildType = buildType;
-		this.addImport({
+		this.imports.push({
 			pkg: `@hot-updater/${buildType}`,
 			named: [buildType]
 		});
 		return this;
 	}
+	/** Sets the storage the CLI uploads to, which the server lists, and its imports. */
 	setStorage(storageConfig) {
 		this.storageInfo = storageConfig;
-		this.addImports(storageConfig.imports);
-		if (storageConfig.imports.some((imp) => imp.pkg.includes("firebase"))) this.addImport({
-			pkg: "firebase-admin/app",
-			named: ["applicationDefault"]
-		});
+		this.imports.push(...storageConfig.imports);
 		return this;
 	}
+	/** Sets the server's database and its imports. */
 	setDatabase(databaseConfig) {
 		this.databaseInfo = databaseConfig;
-		this.addImports(databaseConfig.imports);
-		if (databaseConfig.imports.some((imp) => imp.pkg.includes("firebase"))) this.addImport({
-			pkg: "firebase-admin/app",
-			named: ["applicationDefault"]
-		});
+		this.imports.push(...databaseConfig.imports);
+		return this;
+	}
+	/** Sets the plugins the server runs, such as a provider package's `plugins`. */
+	setPlugins(pluginsConfig) {
+		this.pluginsInfo = pluginsConfig;
+		this.imports.push(...pluginsConfig.imports);
 		return this;
 	}
+	/** Sets the code between the environment loading and the config, such as a credentials helper. */
 	setIntermediateCode(code) {
 		this.intermediateCode = code.trim();
 		return this;
@@ -25121,19 +25194,22 @@ var ConfigBuilder = class {
 		if (!this.buildType) throw new Error("Build type must be set using .setBuildType()");
 		if (!this.storageInfo) throw new Error("Storage config must be set using .setStorage()");
 		if (!this.databaseInfo) throw new Error("Database config must be set using .setDatabase()");
-		const imports = this.getImportInfos();
-		const importStatements = renderImportStatements(imports);
+		if (!this.pluginsInfo) throw new Error("Plugins config must be set using .setPlugins()");
+		const imports = normalizeImportInfos(this.imports);
 		const buildConfigString = this.generateBuildConfigString();
+		const plugins = this.pluginsInfo.configString;
 		const text = `
-${importStatements}
+${renderImportStatements(imports)}
 
-config({ path: ".env.hotupdater" });
+if (existsSync(".env.hotupdater")) {
+  process.loadEnvFile(".env.hotupdater");
+}
 
-${this.intermediateCode ? `${this.intermediateCode}\n` : ""}
-export default defineConfig({
+${this.intermediateCode ? `${this.intermediateCode}\n\n` : ""}export default defineConfig({
   build: ${buildConfigString},
   storage: ${this.storageInfo.configString},
   database: ${this.databaseInfo.configString},
+  ${plugins === "plugins" ? "plugins" : `plugins: ${plugins}`},
   updateStrategy: "appVersion", // or "fingerprint"
 });
 `.trim();
@@ -25142,10 +25218,12 @@ export default defineConfig({
 			buildConfigString,
 			storageConfigString: this.storageInfo.configString,
 			databaseConfigString: this.databaseInfo.configString,
+			pluginsConfigString: plugins,
 			intermediateCode: this.intermediateCode,
 			text
 		};
 	}
+	/** hot-updater.config.ts's text. */
 	getResult() {
 		return this.getScaffold().text;
 	}
@@ -28325,7 +28403,7 @@ var fo = (s, t) => {
 		});
 	});
 };
-var uo = K(co, fo, (s) => new Te(s), (s) => new Xt(s), (s, t) => {
+K(co, fo, (s) => new Te(s), (s) => new Xt(s), (s, t) => {
 	t?.length && Xi(s, t);
 });
 var mo = (s, t) => {
@@ -28439,150 +28517,47 @@ var Ro = (s) => {
 };
 //#endregion
 //#region src/createTarBr.ts
-const createTarBrTargetFiles = async ({ outfile, targetFiles }) => {
-	await fs$1.rm(outfile, { force: true });
-	const tmpDir = path.join(path.dirname(outfile), `.tmp-tar-${Date.now()}`);
-	await fs$1.mkdir(tmpDir, { recursive: true });
+/** Build the one supported bulk transport from the exact manifest file set. */
+async function createTarBrTargetFiles({ outfile, targetFiles }) {
+	await fs$2.mkdir(path$1.dirname(outfile), { recursive: true });
+	const staging = await fs$2.mkdtemp(path$1.join(path$1.dirname(outfile), ".tar-br-"));
 	try {
+		const names = /* @__PURE__ */ new Set();
 		for (const target of targetFiles) {
-			const sourcePath = target.path;
-			const destPath = path.join(tmpDir, target.name);
-			await fs$1.mkdir(path.dirname(destPath), { recursive: true });
-			if ((await fs$1.stat(sourcePath)).isDirectory()) await copyDir$1(sourcePath, destPath);
-			else await fs$1.copyFile(sourcePath, destPath);
-		}
-		await fs$1.mkdir(path.dirname(outfile), { recursive: true });
+			const name = target.name;
+			if (!name || name !== name.trim() || name.includes("\\") || name.includes("\0") || name.startsWith("/") || /^[A-Za-z]:/.test(name) || name.split("/").some((part) => !part || part === "." || part === "..") || name === "manifest.json" || name === "bundle.tar.br" || names.has(name)) throw new Error(`Invalid or duplicate archive asset path: ${name}`);
+			if (!(await fs$2.lstat(target.path)).isFile()) throw new Error(`Archive asset is not a regular file: ${name}`);
+			names.add(name);
+			const destination = path$1.join(staging, name);
+			await fs$2.mkdir(path$1.dirname(destination), { recursive: true });
+			await fs$2.copyFile(target.path, destination);
+			await fs$2.chmod(destination, 420);
+		}
+		let tarByteSize = 0;
+		const countTarBytes = new Transform({ transform(chunk, _encoding, callback) {
+			tarByteSize += chunk.length;
+			callback(null, chunk);
+		} });
 		await pipeline(Kn({
-			cwd: tmpDir,
+			cwd: staging,
 			portable: true,
 			mtime: /* @__PURE__ */ new Date(0),
 			gzip: false
-		}, await fs$1.readdir(tmpDir)), createBrotliCompress({ params: {
-			[constants$1.BROTLI_PARAM_QUALITY]: 11,
-			[constants$1.BROTLI_PARAM_LGWIN]: 24
-		} }), createWriteStream(outfile));
-		return outfile;
-	} finally {
-		await fs$1.rm(tmpDir, {
-			recursive: true,
-			force: true
-		});
-	}
-};
-async function copyDir$1(src, dest) {
-	await fs$1.mkdir(dest, { recursive: true });
-	const entries = await fs$1.readdir(src, { withFileTypes: true });
-	for (const entry of entries) {
-		const srcPath = path.join(src, entry.name);
-		const destPath = path.join(dest, entry.name);
-		if (entry.isDirectory()) await copyDir$1(srcPath, destPath);
-		else await fs$1.copyFile(srcPath, destPath);
-	}
-}
-const createBrotliTar = async ({ cwd, files, outfile }) => {
-	await fs$1.mkdir(path.dirname(outfile), { recursive: true });
-	await pipeline(Kn({
-		cwd,
-		portable: true,
-		mtime: /* @__PURE__ */ new Date(0),
-		gzip: false
-	}, files), createBrotliCompress({ params: {
-		[constants$1.BROTLI_PARAM_QUALITY]: 11,
-		[constants$1.BROTLI_PARAM_LGWIN]: 24
-	} }), createWriteStream(outfile));
-};
-const createTarBr = async ({ outfile, targetDir, excludeExts = [] }) => {
-	await fs$1.rm(outfile, { force: true });
-	async function getFiles(dir, baseDir = "") {
-		const entries = await fs$1.readdir(dir, { withFileTypes: true });
-		const files = [];
-		for (const entry of entries) {
-			if (excludeExts.some((pattern) => entry.name.includes(pattern))) continue;
-			const fullPath = path.join(dir, entry.name);
-			const relativePath = path.join(baseDir, entry.name);
-			if (entry.isDirectory()) {
-				const subFiles = await getFiles(fullPath, relativePath);
-				files.push(...subFiles);
-			} else files.push(relativePath);
-		}
-		return files;
-	}
-	const filesToInclude = await getFiles(targetDir);
-	filesToInclude.sort();
-	await createBrotliTar({
-		cwd: targetDir,
-		files: filesToInclude,
-		outfile
-	});
-	return outfile;
-};
-//#endregion
-//#region src/createTarGz.ts
-const createTarGzTargetFiles = async ({ outfile, targetFiles }) => {
-	await fs$1.rm(outfile, { force: true });
-	const tmpDir = path.join(path.dirname(outfile), `.tmp-tar-${Date.now()}`);
-	await fs$1.mkdir(tmpDir, { recursive: true });
-	try {
-		for (const target of targetFiles) {
-			const sourcePath = target.path;
-			const destPath = path.join(tmpDir, target.name);
-			await fs$1.mkdir(path.dirname(destPath), { recursive: true });
-			if ((await fs$1.stat(sourcePath)).isDirectory()) await copyDir(sourcePath, destPath);
-			else await fs$1.copyFile(sourcePath, destPath);
-		}
-		await fs$1.mkdir(path.dirname(outfile), { recursive: true });
-		await Kn({
-			file: outfile,
-			cwd: tmpDir,
-			portable: true,
-			mtime: /* @__PURE__ */ new Date(0),
-			gzip: true
-		}, await fs$1.readdir(tmpDir));
-		return outfile;
+		}, [...names].sort()), countTarBytes, createBrotliCompress({ params: { [constants$1.BROTLI_PARAM_QUALITY]: 11 } }), createWriteStream(outfile));
+		const hash = createHash("sha256");
+		for await (const chunk of createReadStream(outfile)) hash.update(chunk);
+		return {
+			downloadFileHash: hash.digest("hex"),
+			downloadByteSize: (await fs$2.stat(outfile)).size,
+			tarByteSize
+		};
 	} finally {
-		await fs$1.rm(tmpDir, {
+		await fs$2.rm(staging, {
 			recursive: true,
 			force: true
 		});
 	}
-};
-async function copyDir(src, dest) {
-	await fs$1.mkdir(dest, { recursive: true });
-	const entries = await fs$1.readdir(src, { withFileTypes: true });
-	for (const entry of entries) {
-		const srcPath = path.join(src, entry.name);
-		const destPath = path.join(dest, entry.name);
-		if (entry.isDirectory()) await copyDir(srcPath, destPath);
-		else await fs$1.copyFile(srcPath, destPath);
-	}
 }
-const createTarGz = async ({ outfile, targetDir, excludeExts = [] }) => {
-	await fs$1.rm(outfile, { force: true });
-	async function getFiles(dir, baseDir = "") {
-		const entries = await fs$1.readdir(dir, { withFileTypes: true });
-		const files = [];
-		for (const entry of entries) {
-			if (excludeExts.some((pattern) => entry.name.includes(pattern))) continue;
-			const fullPath = path.join(dir, entry.name);
-			const relativePath = path.join(baseDir, entry.name);
-			if (entry.isDirectory()) {
-				const subFiles = await getFiles(fullPath, relativePath);
-				files.push(...subFiles);
-			} else files.push(relativePath);
-		}
-		return files;
-	}
-	const filesToInclude = await getFiles(targetDir);
-	filesToInclude.sort();
-	await Kn({
-		file: outfile,
-		cwd: targetDir,
-		portable: true,
-		mtime: /* @__PURE__ */ new Date(0),
-		gzip: true
-	}, filesToInclude);
-	return outfile;
-};
 //#endregion
 //#region ../../node_modules/.pnpm/process-nextick-args@2.0.1/node_modules/process-nextick-args/index.js
 var require_process_nextick_args = /* @__PURE__ */ __commonJSMin(((exports, module) => {
@@ -37664,41 +37639,6 @@ var import_lib = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((export
 	JSZip.external = require_external();
 	module.exports = JSZip;
 })))(), 1);
-const createZipTargetFiles = async ({ outfile, targetFiles }) => {
-	const zip = new import_lib.default();
-	await fs$1.rm(outfile, { force: true });
-	async function addFiles(dir, zipFolder) {
-		const files = await fs$1.readdir(dir);
-		files.sort();
-		for (const file of files) {
-			const fullPath = path.join(dir, file);
-			if ((await fs$1.stat(fullPath)).isDirectory()) {
-				const folder = zipFolder.folder(file);
-				if (!folder) continue;
-				await addFiles(fullPath, folder);
-			} else {
-				const data = await fs$1.readFile(fullPath);
-				zipFolder.file(file, data);
-			}
-		}
-	}
-	for (const target of targetFiles) if ((await fs$1.stat(target.path)).isDirectory()) {
-		const folder = zip.folder(target.name);
-		if (folder) await addFiles(target.path, folder);
-	} else {
-		const data = await fs$1.readFile(target.path);
-		zip.file(target.name, data);
-	}
-	const content = await zip.generateAsync({
-		type: "nodebuffer",
-		compression: "DEFLATE",
-		compressionOptions: { level: 9 },
-		platform: "UNIX"
-	});
-	await fs$1.mkdir(path.dirname(outfile), { recursive: true });
-	await fs$1.writeFile(outfile, content);
-	return outfile;
-};
 const createZip = async ({ outfile, targetDir, excludeExts = [] }) => {
 	const zip = new import_lib.default();
 	await fs$1.rm(outfile, { force: true });
@@ -37734,13 +37674,13 @@ const createZip = async ({ outfile, targetDir, excludeExts = [] }) => {
 };
 //#endregion
 //#region src/isObject.ts
-const isObject$1 = (value) => {
+const isObject$2 = (value) => {
 	return !!value && value.constructor === Object;
 };
 //#endregion
 //#region src/crypto.ts
 const encryptJson = (jsonData, secretKey) => {
-	if (isObject$1(jsonData) === false) throw new Error("jsonData must be an object");
+	if (isObject$2(jsonData) === false) throw new Error("jsonData must be an object");
 	const iv = crypto.randomBytes(16);
 	const cipher = crypto.createCipheriv("aes-256-cbc", Buffer.from(secretKey, "hex"), iv);
 	let encrypted = cipher.update(JSON.stringify(jsonData));
@@ -40943,9 +40883,9 @@ const isReadableStream = (value) => Object.prototype.toString.call(value) === "[
 const isWritableStream = (value) => Object.prototype.toString.call(value) === "[object WritableStream]";
 const isWebStream = (value) => isReadableStream(value) || isWritableStream(value);
 const isTransformStream = (value) => isReadableStream(value?.readable) && isWritableStream(value?.writable);
-const isAsyncIterableObject = (value) => isObject(value) && typeof value[Symbol.asyncIterator] === "function";
-const isIterableObject = (value) => isObject(value) && typeof value[Symbol.iterator] === "function";
-const isObject = (value) => typeof value === "object" && value !== null;
+const isAsyncIterableObject = (value) => isObject$1(value) && typeof value[Symbol.asyncIterator] === "function";
+const isIterableObject = (value) => isObject$1(value) && typeof value[Symbol.iterator] === "function";
+const isObject$1 = (value) => typeof value === "object" && value !== null;
 const TRANSFORM_TYPES = /* @__PURE__ */ new Set([
 	"generator",
 	"asyncGenerator",
@@ -42298,8 +42238,8 @@ const addPropertiesAsync = {
 	},
 	output: {
 		...addProperties,
-		fileUrl: ({ value }) => ({ stream: createWriteStream$1(value) }),
-		filePath: ({ value: { file, append } }) => ({ stream: createWriteStream$1(file, append ? { flags: "a" } : {}) }),
+		fileUrl: ({ value }) => ({ stream: createWriteStream(value) }),
+		filePath: ({ value: { file, append } }) => ({ stream: createWriteStream(file, append ? { flags: "a" } : {}) }),
 		webStream: ({ value }) => ({ stream: Writable.fromWeb(value) }),
 		iterable: forbiddenIfAsync,
 		asyncIterable: forbiddenIfAsync,
@@ -44175,7 +44115,6 @@ const getReactNativeMetadatas = (cwd) => {
 const HOT_UPDATER_CONFIG_PATH = "hot-updater.config.ts";
 const CONFIG_FILE_NAME = "hot-updater.config.ts";
 const MANAGED_IMPORT_PACKAGES = /* @__PURE__ */ new Set([
-	"dotenv",
 	"firebase-admin",
 	"firebase-admin/app",
 	"hot-updater",
@@ -44200,6 +44139,9 @@ const KNOWN_BUILD_CALLEES = /* @__PURE__ */ new Set([
 	"expo",
 	"rock"
 ]);
+/** Build adapter packages, whose imports a kept build still needs. */
+const BUILD_IMPORT_PACKAGES = new Set([...KNOWN_BUILD_CALLEES].map((callee) => `@hot-updater/${callee}`));
+const importDeclarationsOf = (source) => source.program.body.filter((statement) => statement.type === "ImportDeclaration");
 const parseConfigSource = (text) => {
 	const result = parseSync(CONFIG_FILE_NAME, text, {
 		astType: "js",
@@ -44263,13 +44205,6 @@ const getObjectPropertyName = (property) => {
 	return null;
 };
 const isDataProperty = (property) => property.type === "Property" && property.kind === "init" && !property.method && !property.shorthand;
-const hasTrailingComma = (text) => {
-	const closeBraceIndex = text.lastIndexOf("}");
-	if (closeBraceIndex === -1) return false;
-	let index = closeBraceIndex - 1;
-	while (index >= 0 && /\s/.test(text[index] ?? "")) index -= 1;
-	return (text[index] ?? "") === ",";
-};
 const dedentBlock = (text) => {
 	const lines = text.replace(/\s+$/, "").split("\n");
 	const indents = lines.filter((line) => line.trim() !== "").map((line) => line.match(/^\s*/)?.[0].length ?? 0);
@@ -44277,16 +44212,55 @@ const dedentBlock = (text) => {
 	return lines.map((line) => line.slice(minIndent)).join("\n");
 };
 const indentBlock = (text, indent) => dedentBlock(text).split("\n").map((line) => `${indent}${line}`).join("\n");
-const appendMissingProperties = (objectText, propertyTexts, hasExistingProperties) => {
-	if (propertyTexts.length === 0) return objectText;
-	const closingIndent = /\n([ \t]*)\}$/.exec(objectText)?.[1] ?? "";
-	const childIndent = objectText.match(/\n([ \t]+)[^\s]/)?.[1] ?? `${closingIndent}  `;
-	const formattedProperties = propertyTexts.map((propertyText) => indentBlock(propertyText, childIndent)).join(",\n");
-	const closeBraceIndex = objectText.lastIndexOf("}");
-	if (closeBraceIndex === -1) return objectText;
-	const prefix = hasExistingProperties ? hasTrailingComma(objectText) ? "\n" : ",\n" : "\n";
-	const suffix = `,\n${closingIndent}`;
-	return `${objectText.slice(0, closeBraceIndex)}${prefix}${formattedProperties}${suffix}${objectText.slice(closeBraceIndex)}`;
+const lineStartOf = (text, position) => text.lastIndexOf("\n", position - 1) + 1;
+/** The indentation of the line `position` is on. */
+const lineIndentAt = (text, position) => /^[ \t]*/.exec(text.slice(lineStartOf(text, position)))?.[0] ?? "";
+/** Whether `node` is the first thing on its line. */
+const startsLine = (text, node) => /^[ \t]*$/.test(text.slice(lineStartOf(text, node.start), node.start));
+/**
+* A property's text with the indentation of its line, so that a property
+* spanning lines dedents and indents as one block.
+*/
+const getPropertyBlockText = (source, property) => source.text.slice(startsLine(source.text, property) ? lineStartOf(source.text, property.start) : property.start, property.end);
+/**
+* The edits, relative to `object`'s start, that add `propertyTexts` after its
+* last property: each on a line of its own, after that property's comma and
+* whatever comment shares its line, or after it on the line of a one-line
+* object.
+*/
+const appendPropertiesEdits = (source, object, propertyTexts) => {
+	if (propertyTexts.length === 0) return [];
+	const { text } = source;
+	const closeBrace = object.end - 1;
+	const relative = (position) => position - object.start;
+	const closingIndent = lineIndentAt(text, closeBrace);
+	const last = object.properties.at(-1);
+	if (!last) {
+		const childIndent = `${closingIndent}  `;
+		return [{
+			start: relative(object.start + 1),
+			end: relative(closeBrace),
+			text: `\n${propertyTexts.map((propertyText) => indentBlock(propertyText, childIndent)).join(",\n")},\n${closingIndent}`
+		}];
+	}
+	const comma = /^\s*,/.exec(text.slice(last.end, closeBrace));
+	const afterLast = last.end + (comma?.[0].length ?? 0);
+	const lineEnd = text.indexOf("\n", afterLast);
+	if (!startsLine(text, last) || lineEnd === -1 || lineEnd > closeBrace) return [{
+		start: relative(afterLast),
+		end: relative(afterLast),
+		text: `${comma ? " " : ", "}${propertyTexts.map((propertyText) => dedentBlock(propertyText)).join(", ")}`
+	}];
+	const childIndent = lineIndentAt(text, last.start);
+	return [...comma ? [] : [{
+		start: relative(last.end),
+		end: relative(last.end),
+		text: ","
+	}], {
+		start: relative(lineEnd),
+		end: relative(lineEnd),
+		text: `\n${propertyTexts.map((propertyText) => indentBlock(propertyText, childIndent)).join(",\n")},`
+	}];
 };
 const mergeObjectLiteralText = (existingObject, newObject, replaceIncompatibleProperties = []) => {
 	const existingText = getNodeText(existingObject.source, existingObject.objectExpression);
@@ -44330,14 +44304,12 @@ const mergeObjectLiteralText = (existingObject, newObject, replaceIncompatiblePr
 			});
 		}
 	}
-	let mergedText = existingText;
-	for (const edit of edits.sort((left, right) => right.start - left.start)) mergedText = mergedText.slice(0, edit.start) + edit.text + mergedText.slice(edit.end);
 	const missingPropertyTexts = newObject.objectExpression.properties.filter((property) => {
 		if (property.type === "SpreadElement") return !existingSpreadTexts.has(getNodeText(newObject.source, property.argument).trim());
 		const propertyName = getObjectPropertyName(property);
 		return propertyName ? !existingPropertyNames.has(propertyName) : false;
-	}).map((property) => getNodeText(newObject.source, property));
-	return appendMissingProperties(mergedText, missingPropertyTexts, existingObject.objectExpression.properties.length > 0);
+	}).map((property) => getPropertyBlockText(newObject.source, property));
+	return applyTextEdits(existingText, [...edits, ...appendPropertiesEdits(existingObject.source, existingObject.objectExpression, missingPropertyTexts)]);
 };
 const buildMergedCallInitializer = (existing, next) => {
 	const [existingArgument] = existing.callExpression.arguments;
@@ -44359,6 +44331,11 @@ const findManagedProperty = (objectExpression, propertyName) => {
 	const property = objectExpression.properties.find((candidate) => candidate.type === "Property" && candidate.kind === "init" && !candidate.method && !candidate.shorthand && getObjectPropertyName(candidate) === propertyName);
 	return property?.type === "Property" ? property : null;
 };
+/** The `plugins` property, written either way: `plugins: [...]` or `plugins`. */
+const findPluginsProperty = (objectExpression) => {
+	const property = objectExpression.properties.find((candidate) => candidate.type === "Property" && candidate.kind === "init" && !candidate.method && getObjectPropertyName(candidate) === "plugins");
+	return property?.type === "Property" ? property : null;
+};
 const getCallCallee = (expression) => {
 	if (expression.type !== "CallExpression" || expression.callee.type !== "Identifier") return null;
 	return expression.callee.name;
@@ -44382,11 +44359,20 @@ const mergeHelperStatement = (existingStatementText, helper) => {
 	if (!mergedInitializer) return null;
 	return `${existingStatement.statement.kind === "let" || existingStatement.statement.kind === "var" ? existingStatement.statement.kind : "const"} ${helper.name} = ${mergedInitializer};`;
 };
+/**
+* The config object with the scaffold's `build`, `storage`, `database`, and
+* `plugins`: a call to the same adapter keeps the project's arguments and
+* gains the scaffold's missing ones, and `plugins` is the scaffold's. A build
+* that is not a plain build adapter, such as `withSentry(bare())`, stays the
+* project's (`keptBuild`). Null when `build`, `storage`, or `database` is no
+* call.
+*/
 const updateManagedObject = (existing, next) => {
 	const objectStart = existing.objectExpression.start;
 	const objectText = getNodeText(existing.source, existing.objectExpression);
 	const propertyEdits = [];
 	const missingPropertyTexts = [];
+	let keptBuild = false;
 	for (const propertyName of [
 		"build",
 		"storage",
@@ -44396,7 +44382,7 @@ const updateManagedObject = (existing, next) => {
 		const nextProperty = findManagedProperty(next.objectExpression, propertyName);
 		if (!nextProperty) continue;
 		if (!existingProperty) {
-			missingPropertyTexts.push(getNodeText(next.source, nextProperty));
+			missingPropertyTexts.push(getPropertyBlockText(next.source, nextProperty));
 			continue;
 		}
 		const existingCallee = getCallCallee(existingProperty.value);
@@ -44404,8 +44390,11 @@ const updateManagedObject = (existing, next) => {
 		if (!existingCallee || !nextCallee) return null;
 		let nextInitializerText = getNodeText(next.source, nextProperty.value);
 		if (propertyName === "build") {
+			if (!KNOWN_BUILD_CALLEES.has(existingCallee)) {
+				keptBuild = true;
+				continue;
+			}
 			if (existingCallee === nextCallee) continue;
-			if (!KNOWN_BUILD_CALLEES.has(existingCallee)) return null;
 		} else if (existingCallee === nextCallee) {
 			if (existingProperty.value.type !== "CallExpression" || nextProperty.value.type !== "CallExpression") return null;
 			const mergedInitializer = buildMergedCallInitializer({
@@ -44424,29 +44413,96 @@ const updateManagedObject = (existing, next) => {
 			text: nextInitializerText
 		});
 	}
-	let mergedText = objectText;
-	for (const edit of propertyEdits.sort((left, right) => right.start - left.start)) mergedText = mergedText.slice(0, edit.start) + edit.text + mergedText.slice(edit.end);
-	return appendMissingProperties(mergedText, missingPropertyTexts, existing.objectExpression.properties.length > 0);
+	const existingPlugins = findPluginsProperty(existing.objectExpression);
+	const nextPlugins = findPluginsProperty(next.objectExpression);
+	if (nextPlugins) {
+		const nextPluginsText = getNodeText(next.source, nextPlugins);
+		if (!existingPlugins) missingPropertyTexts.push(getPropertyBlockText(next.source, nextPlugins));
+		else if (getNodeText(existing.source, existingPlugins).replace(/\s+/gu, "") !== nextPluginsText.replace(/\s+/gu, "")) propertyEdits.push({
+			start: existingPlugins.start - objectStart,
+			end: existingPlugins.end - objectStart,
+			text: nextPluginsText
+		});
+	}
+	return {
+		text: applyTextEdits(objectText, [...propertyEdits, ...appendPropertiesEdits(existing.source, existing.objectExpression, missingPropertyTexts)]),
+		keptBuild
+	};
 };
-const isConfigCallStatement = (statement) => statement.type === "ExpressionStatement" && statement.expression.type === "CallExpression" && statement.expression.callee.type === "Identifier" && statement.expression.callee.name === "config";
 const getManagedHelperName = (statement) => {
 	if (statement.type !== "VariableDeclaration") return null;
 	const declaration = statement.declarations[0];
 	if (declaration?.id.type !== "Identifier") return null;
 	return declaration.id.name;
 };
-const rebuildImportBlock = (source, scaffold) => {
-	const importDeclarations = source.program.body.filter((statement) => statement.type === "ImportDeclaration");
+/** Whether `text` refers to `name` as an identifier. */
+const usesIdentifier = (text, name) => new RegExp(`(?<![\\w$])${name.replace(/\$/g, "\\$")}(?![\\w$])`).test(text);
+/**
+* What a managed package's existing imports bring that the rebuilt config
+* still uses and the scaffold doesn't import, such as a project's own `cert`
+* from firebase-admin/app beside the `credential` helper init keeps. Named
+* value imports join the scaffold's import of that package; default,
+* namespace, and type imports keep a declaration of their own.
+*/
+const keptManagedImports = (declarations, scaffoldImports, usedText) => {
+	const bound = new Set(scaffoldImports.flatMap((info) => [...(info.named ?? []).map((name) => name.split(/\s+as\s+/).at(-1)), ...info.defaultOrNamespace === void 0 ? [] : [info.defaultOrNamespace.replace(/^\*\s+as\s+/, "")]]));
+	const imports = [];
+	const texts = [];
+	for (const declaration of declarations) {
+		const pkg = declaration.source.value;
+		const named = [];
+		let defaultName;
+		let namespaceName;
+		for (const specifier of declaration.specifiers) {
+			const local = specifier.local.name;
+			if (bound.has(local) || !usesIdentifier(usedText, local)) continue;
+			if (specifier.type === "ImportDefaultSpecifier") defaultName = local;
+			else if (specifier.type === "ImportNamespaceSpecifier") namespaceName = local;
+			else {
+				const imported = specifier.imported.type === "Identifier" ? specifier.imported.name : JSON.stringify(specifier.imported.value);
+				const name = imported === local ? local : `${imported} as ${local}`;
+				named.push(specifier.importKind === "type" ? `type ${name}` : name);
+			}
+		}
+		if (named.length === 0 && !defaultName && !namespaceName) continue;
+		if (declaration.importKind === "type") {
+			texts.push(`import type { ${named.join(", ")} } from "${pkg}";`);
+			continue;
+		}
+		if (named.length > 0) imports.push({
+			pkg,
+			named
+		});
+		if (namespaceName) texts.push(`import * as ${namespaceName} from "${pkg}";`);
+		if (defaultName) texts.push(`import ${defaultName} from "${pkg}";`);
+	}
+	return {
+		imports,
+		texts
+	};
+};
+const rebuildImportBlock = (source, scaffold, { keptBuild, usedText }) => {
+	const imports = scaffold.imports.filter((info) => !(keptBuild && BUILD_IMPORT_PACKAGES.has(info.pkg))).map((info) => info.pkg === "node:fs" ? {
+		...info,
+		named: info.named?.filter((name) => name !== "existsSync")
+	} : info);
+	const importDeclarations = importDeclarationsOf(source);
 	const firstImport = importDeclarations[0];
 	const lastImport = importDeclarations.at(-1);
 	if (!firstImport || !lastImport) return {
 		start: 0,
 		end: 0,
-		text: `${renderImportStatements(scaffold.imports)}\n\n`
-	};
-	const preservedImportTexts = importDeclarations.filter((declaration) => !MANAGED_IMPORT_PACKAGES.has(declaration.source.value)).map((declaration) => source.text.slice(getTopLevelFullStart(source, declaration), declaration.end).trim());
-	const managedImportText = renderImportStatements(scaffold.imports);
-	const nextImportBlock = [...preservedImportTexts, managedImportText].filter(Boolean).join("\n");
+		text: `${renderImportStatements(imports)}\n\n`
+	};
+	const isPreserved = (declaration) => !MANAGED_IMPORT_PACKAGES.has(declaration.source.value) || keptBuild && BUILD_IMPORT_PACKAGES.has(declaration.source.value);
+	const preservedImportTexts = importDeclarations.filter(isPreserved).map((declaration) => source.text.slice(getTopLevelFullStart(source, declaration), declaration.end).trim());
+	const kept = keptManagedImports(importDeclarations.filter((declaration) => !isPreserved(declaration)), imports, usedText);
+	const managedImportText = renderImportStatements([...imports, ...kept.imports]);
+	const nextImportBlock = [
+		...preservedImportTexts,
+		...kept.texts,
+		managedImportText
+	].filter(Boolean).join("\n");
 	return {
 		start: getTopLevelFullStart(source, firstImport),
 		end: lastImport.end,
@@ -44458,12 +44514,7 @@ const rebuildManagedBody = (source, exportStart, scaffold) => {
 	const managedHelpers = new Map(scaffold.helperStatements.map((statement) => [statement.name, statement]));
 	const emittedHelpers = /* @__PURE__ */ new Set();
 	const bodyStatements = [];
-	const configStatements = [];
 	for (const statement of statementsBeforeExport) {
-		if (isConfigCallStatement(statement)) {
-			configStatements.push(getStatementText(source, statement));
-			continue;
-		}
 		const helperName = getManagedHelperName(statement);
 		if (!helperName || !MANAGED_HELPER_NAMES.has(helperName)) {
 			bodyStatements.push(getStatementText(source, statement));
@@ -44478,8 +44529,7 @@ const rebuildManagedBody = (source, exportStart, scaffold) => {
 	}
 	for (const helper of scaffold.helperStatements) if (!emittedHelpers.has(helper.name)) bodyStatements.push(helper.code.trim());
 	const bodyText = bodyStatements.filter(Boolean).join("\n\n");
-	const configStatement = configStatements.join("\n\n") || `config({ path: ".env.hotupdater" });`;
-	const managedBody = bodyText ? `\n\n${configStatement}\n\n${bodyText}\n\n` : `\n\n${configStatement}\n\n`;
+	const managedBody = bodyText ? `\n\n${bodyText}\n\n` : "\n\n";
 	return {
 		start: source.program.body.filter((statement) => statement.type === "ImportDeclaration").at(-1)?.end ?? 0,
 		end: exportStart,
@@ -44498,27 +44548,49 @@ const mergeHotUpdaterConfigText = (existingText, scaffold) => {
 	const existingConfig = findDefineConfigObject(existingSource);
 	const nextConfig = findDefineConfigObject(nextSource);
 	if (!existingConfig || !nextConfig) return { reason: "Existing config is not a supported `export default defineConfig({ ... })` shape." };
-	const nextObjectText = updateManagedObject({
+	const nextObject = updateManagedObject({
 		objectExpression: existingConfig.objectExpression,
 		source: existingSource
 	}, {
 		objectExpression: nextConfig.objectExpression,
 		source: nextSource
 	});
-	if (!nextObjectText) return { reason: "Existing config uses dynamic build/storage/database expressions that cannot be merged safely." };
+	if (!nextObject) return { reason: "Existing config uses dynamic build/storage/database expressions that cannot be merged safely." };
 	const exportFullStart = getTopLevelFullStart(existingSource, existingConfig.exportDeclaration);
 	const firstTriviaContent = existingText.slice(exportFullStart, existingConfig.exportDeclaration.start).search(/\S/);
 	const managedBodyEnd = firstTriviaContent === -1 ? existingConfig.exportDeclaration.start : exportFullStart + firstTriviaContent;
 	const bodyEdit = rebuildManagedBody(existingSource, managedBodyEnd, scaffold);
 	if (!bodyEdit) return { reason: "Existing helper declarations could not be merged safely." };
+	const scaffoldNames = new Map(scaffold.imports.flatMap((info) => (info.named ?? []).map((name) => [name.split(/\s+as\s+/).at(-1), info.pkg])));
+	for (const declaration of importDeclarationsOf(existingSource)) {
+		const pkg = declaration.source.value;
+		if (MANAGED_IMPORT_PACKAGES.has(pkg) && !(nextObject.keptBuild && BUILD_IMPORT_PACKAGES.has(pkg))) continue;
+		for (const specifier of declaration.specifiers) {
+			const scaffoldPackage = scaffoldNames.get(specifier.local.name);
+			if (scaffoldPackage !== void 0 && scaffoldPackage !== pkg) return { reason: `The import of ${specifier.local.name} from "${pkg}" takes the name init imports from "${scaffoldPackage}".` };
+		}
+	}
+	const objectEdit = {
+		start: existingConfig.objectExpression.start,
+		end: existingConfig.objectExpression.end,
+		text: nextObject.text
+	};
+	const usedText = applyTextEdits(existingText, [
+		objectEdit,
+		bodyEdit,
+		...importDeclarationsOf(existingSource).map((declaration) => ({
+			start: declaration.start,
+			end: declaration.end,
+			text: ""
+		}))
+	]);
 	return { text: applyTextEdits(existingText, [
-		{
-			start: existingConfig.objectExpression.start,
-			end: existingConfig.objectExpression.end,
-			text: nextObjectText
-		},
+		objectEdit,
 		bodyEdit,
-		rebuildImportBlock(existingSource, scaffold)
+		rebuildImportBlock(existingSource, scaffold, {
+			keptBuild: nextObject.keptBuild,
+			usedText
+		})
 	]) };
 };
 const extractCallIdentifier = (initializer) => {
@@ -44526,9 +44598,9 @@ const extractCallIdentifier = (initializer) => {
 	if (!match) throw new Error(`Failed to extract call identifier from "${initializer}"`);
 	return match[1];
 };
-const createHotUpdaterConfigScaffold = ({ build, storage, database, extraImports = [], helperStatements = [], updateStrategy = "appVersion" }) => {
+const createHotUpdaterConfigScaffold = ({ build, storage, database, plugins, extraImports = [], helperStatements = [], updateStrategy = "appVersion" }) => {
 	const intermediateCode = helperStatements.map((statement) => statement.code.trim()).filter(Boolean).join("\n\n");
-	const builder = new ConfigBuilder().setBuildType(build).setStorage(storage).setDatabase(database);
+	const builder = new ConfigBuilder().setBuildType(build).setStorage(storage).setDatabase(database).setPlugins(plugins);
 	for (const extraImport of extraImports) builder.addImport(extraImport);
 	if (intermediateCode) builder.setIntermediateCode(intermediateCode);
 	return createHotUpdaterConfigScaffoldFromBuilder(builder, {
@@ -44553,15 +44625,22 @@ const createHotUpdaterConfigScaffoldFromBuilder = (builder, { helperStatements =
 			initializer: scaffold.databaseConfigString,
 			callee: extractCallIdentifier(scaffold.databaseConfigString)
 		},
+		plugins: { initializer: scaffold.pluginsConfigString },
 		helperStatements,
 		updateStrategy: `"${updateStrategy}"`
 	};
 };
+const readTextFile = (filePath) => fs$1.readFile(filePath, "utf-8").catch((error) => {
+	if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
+	throw error;
+});
+/**
+* Writes hot-updater.config.ts: the scaffold's when there is none, or the
+* existing config with the scaffold's build, storage, database, plugins, and
+* helpers merged in, keeping the project's own settings.
+*/
 const writeHotUpdaterConfig = async (scaffold, filePath = HOT_UPDATER_CONFIG_PATH) => {
-	const existingText = await fs$1.readFile(filePath, "utf-8").catch((error) => {
-		if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
-		throw error;
-	});
+	const existingText = await readTextFile(filePath);
 	if (existingText === null) {
 		await fs$1.writeFile(filePath, `${scaffold.text}\n`, "utf-8");
 		return {
@@ -44581,6 +44660,63 @@ const writeHotUpdaterConfig = async (scaffold, filePath = HOT_UPDATER_CONFIG_PAT
 		path: filePath
 	};
 };
+/**
+* What a config needs for the scaffold's storage, database, and plugins:
+* their imports, the helpers they read, and the properties themselves.
+*/
+const renderServerSettings = (scaffold) => {
+	const imports = scaffold.imports.filter(({ pkg }) => pkg !== "hot-updater" && pkg !== "node:fs" && !BUILD_IMPORT_PACKAGES.has(pkg));
+	const plugins = scaffold.plugins.initializer;
+	return [
+		renderImportStatements(imports),
+		...scaffold.helperStatements.map(({ code }) => code.trim()),
+		[
+			`  storage: ${scaffold.storage.initializer},`,
+			`  database: ${scaffold.database.initializer},`,
+			`  ${plugins === "plugins" ? "plugins" : `plugins: ${plugins}`},`
+		].join("\n")
+	].filter(Boolean).join("\n\n");
+};
+/** Where an older init wrote a managed server's plugins, which the config lists now. */
+const PLUGINS_FILE_PATH = "hotUpdater.plugins.ts";
+/**
+* Whether `text` is the plugins file an older init wrote: comments and a
+* re-export of a provider package's `plugins`, which the config imports now.
+*/
+const isGeneratedPluginsFile = (text) => /^export\{plugins\}from(["'])@hot-updater\/[\w-]+\1;?$/u.test(text.replace(/^\s*\/\/.*$/gmu, "").replace(/\s+/gu, ""));
+/**
+* Writes hot-updater.config.ts and says what it did. `settings` names the
+* provider in messages, such as "Supabase". A config it cannot merge is
+* kept, with what to add to it. The plugins file an older init wrote is
+* removed; one the project wrote is named, since nothing reads it.
+*/
+const writeHotUpdaterFiles = async (scaffold, { cwd = process.cwd(), settings }) => {
+	const config = await writeHotUpdaterConfig(scaffold, path.join(cwd, HOT_UPDATER_CONFIG_PATH));
+	if (config.status === "created") p.log.success(`Generated '${HOT_UPDATER_CONFIG_PATH}' file with ${settings} settings.`);
+	else if (config.status === "merged") p.log.success(`Updated '${HOT_UPDATER_CONFIG_PATH}' file with ${settings} settings.`);
+	else p.log.warn([
+		`Kept existing '${HOT_UPDATER_CONFIG_PATH}' unchanged: ${config.reason}`,
+		`Set storage, database, and plugins in its config, as init writes them for ${settings}:`,
+		"",
+		renderServerSettings(scaffold)
+	].join("\n"));
+	const pluginsPath = path.join(cwd, PLUGINS_FILE_PATH);
+	const pluginsText = await readTextFile(pluginsPath);
+	if (pluginsText === null) return { config };
+	if (isGeneratedPluginsFile(pluginsText)) {
+		await fs$1.rm(pluginsPath);
+		p.log.success(`Removed '${PLUGINS_FILE_PATH}': \`plugins\` in '${HOT_UPDATER_CONFIG_PATH}' lists the plugins the server runs.`);
+		return {
+			config,
+			pluginsFile: "removed"
+		};
+	}
+	p.log.warn(`Nothing reads '${pluginsPath}' anymore: \`plugins\` in '${HOT_UPDATER_CONFIG_PATH}' lists the plugins the server runs. Delete it.`);
+	return {
+		config,
+		pluginsFile: "kept"
+	};
+};
 //#endregion
 //#region src/initOptions.ts
 var InitError = class extends Error {
@@ -44873,100 +45009,6 @@ function isMergeableValue(value) {
 //#endregion
 //#region src/loadConfig.ts
 var import_out = /* @__PURE__ */ __toESM(require_out(), 1);
-const missingDatabase = createDatabasePlugin({
-	name: "missingDatabase",
-	models: {
-		bundles: {
-			findById: async () => {
-				throw new Error("database plugin is required");
-			},
-			findMany: async () => {
-				throw new Error("database plugin is required");
-			},
-			count: async () => {
-				throw new Error("database plugin is required");
-			}
-		},
-		bundlePatches: { findByBundleIds: async () => {
-			throw new Error("database plugin is required");
-		} },
-		releases: {
-			findById: async () => {
-				throw new Error("database plugin is required");
-			},
-			findMany: async () => {
-				throw new Error("database plugin is required");
-			},
-			findManyByScope: async () => {
-				throw new Error("database plugin is required");
-			}
-		},
-		releaseCatalogs: {
-			findByScopeKey: async () => {
-				throw new Error("database plugin is required");
-			},
-			findMany: async () => {
-				throw new Error("database plugin is required");
-			}
-		},
-		channels: {
-			insert: async () => {
-				throw new Error("database plugin is required");
-			},
-			list: async () => {
-				throw new Error("database plugin is required");
-			},
-			delete: async () => {
-				throw new Error("database plugin is required");
-			}
-		},
-		insights: {
-			record: async () => {
-				throw new Error("database plugin is required");
-			},
-			listEvents: async () => {
-				throw new Error("database plugin is required");
-			},
-			findInstallations: async () => {
-				throw new Error("database plugin is required");
-			},
-			countInstallations: async () => {
-				throw new Error("database plugin is required");
-			},
-			countEvents: async () => {
-				throw new Error("database plugin is required");
-			}
-		},
-		apiKeys: {
-			create: async () => {
-				throw new Error("database plugin is required");
-			},
-			findByHash: async () => {
-				throw new Error("database plugin is required");
-			},
-			list: async () => {
-				throw new Error("database plugin is required");
-			},
-			revoke: async () => {
-				throw new Error("database plugin is required");
-			}
-		}
-	},
-	commit: async () => {
-		throw new Error("database plugin is required");
-	}
-});
-const missingStorageError = async () => {
-	throw new Error("storage plugin is required");
-};
-const missingStorage = createStoragePlugin({
-	name: "missingStorage",
-	protocol: "missing",
-	put: missingStorageError,
-	get: missingStorageError,
-	exists: missingStorageError,
-	delete: missingStorageError
-});
 const getDefaultPlatformConfig = () => {
 	let infoPlistPaths = [];
 	try {
@@ -45003,7 +45045,6 @@ const getDefaultConfig = () => {
 	return {
 		cacheDir: path.join("node_modules", ".hot-updater"),
 		updateStrategy: "appVersion",
-		compressStrategy: "zip",
 		fingerprint: {},
 		patch: {
 			enabled: true,
@@ -45016,25 +45057,26 @@ const getDefaultConfig = () => {
 			ios: {}
 		},
 		build: () => {
-			throw new Error("build plugin is required");
+			throw new Error("build adapter is required");
 		},
-		storage: missingStorage,
-		database: missingDatabase
+		plugins: []
 	};
 };
 const mergeConfigSources = (...sources) => {
 	const mergedConfig = sources.reduceRight((mergedConfig, source) => merge(mergedConfig, source ?? {}), {});
 	const database = sources.find((source) => source?.database)?.database;
+	const plugins = sources.find((source) => source?.plugins)?.plugins;
 	const signing = sources.find((source) => source?.signing)?.signing;
 	const storage = sources.find((source) => source?.storage)?.storage;
 	return {
 		...mergedConfig,
 		...database ? { database } : {},
+		...plugins ? { plugins } : {},
 		...signing ? { signing } : {},
 		...storage ? { storage } : {}
 	};
 };
-const getConfigLoaderOptions = (options) => {
+const getConfigLoaderOptions = () => {
 	const cwd = getCwd();
 	return {
 		cwd,
@@ -45049,16 +45091,38 @@ const getConfigLoaderOptions = (options) => {
 				"cts",
 				"mjs",
 				"mts"
-			],
-			rewrite: async (config) => {
-				return typeof config === "function" ? config(options) : config;
-			}
+			]
 		}]
 	};
 };
-const loadConfig = async (options) => {
-	const { config } = await loadConfig$1(getConfigLoaderOptions(options));
+/** Each load runs the config file again, which creates its adapters again. */
+const loadConfigFile = async () => {
+	const { config } = await loadConfig$1(getConfigLoaderOptions());
+	return config;
+};
+const configFor = async (source, options) => typeof source === "function" ? await source(options) : source;
+const loadConfig = async (options) => resolveConfig(await configFor(await loadConfigFile(), options));
+/**
+* hot-updater.config for each of `platforms`, with the file loaded once. A
+* config object gives every platform the same database, storage, and
+* plugins; a config function runs once per platform, so the adapters it
+* creates are that platform's own.
+*/
+const loadPlatformConfigs = async (platforms, { channel }) => {
+	const source = await loadConfigFile();
+	const configs = [];
+	for (const platform of platforms) configs.push({
+		platform,
+		config: resolveConfig(await configFor(source, {
+			channel,
+			platform
+		}))
+	});
+	return configs;
+};
+const resolveConfig = (config) => {
 	for (const key of ["authorityId", "catalogId"]) if (config && Object.hasOwn(config, key)) throw new Error(`Remove ${key} from hot-updater.config. Catalog identity is managed internally.`);
+	if (config && Object.hasOwn(config, "compressStrategy")) throw new Error("Remove compressStrategy from hot-updater.config. OTA artifacts use manifest files with per-file Brotli compression.");
 	const mergedConfig = mergeConfigSources(config, getDefaultConfig());
 	const signing = normalizeSigningConfig(mergedConfig.signing);
 	return {
@@ -45067,6 +45131,97 @@ const loadConfig = async (options) => {
 	};
 };
 //#endregion
+//#region src/serverDefinition.ts
+/** A server definition tooling cannot use, with what to do about it. */
+var ServerDefinitionError = class extends Error {
+	name = "ServerDefinitionError";
+};
+const isRecord = (value) => typeof value === "object" && value !== null;
+/** Whether `value` has the public properties tooling reads from a server definition. */
+const isServerDefinition = (value) => isRecord(value) && isRecord(value.database) && typeof value.database.name === "string" && Array.isArray(value.storage) && Array.isArray(value.plugins) && Array.isArray(value.clientPlugins) && Array.isArray(value.clientEndpoints) && isRecord(value.core) && isRecord(value.api);
+/**
+* `value` as a server definition, or a `ServerDefinitionError` that says
+* what `source`, the module it came from, must export instead.
+*/
+const serverDefinitionOf = (value, source = "The server definition") => {
+	if (isServerDefinition(value)) return value;
+	if (isRecord(value) && "handlers" in value) throw new ServerDefinitionError(`${source} exports a hotUpdater from an older @hot-updater/server. Upgrade @hot-updater/server to the version of hot-updater.`);
+	throw new ServerDefinitionError(`${source} must export hotUpdater: the server createHotUpdater({ database, storage, plugins }) returns.`);
+};
+const fail = (message) => {
+	throw new ServerDefinitionError(message);
+};
+const isObject = (value) => isRecord(value) && !Array.isArray(value);
+/** The clientAuth plugin's credential contribution, checked. */
+const credentialOf = ({ plugins, clientAuth }) => {
+	if (clientAuth === void 0) return void 0;
+	const id = clientAuth.plugin;
+	const credential = plugins.find((plugin) => plugin.id === id)?.cli?.clientCredential;
+	if (!isObject(credential) || typeof credential.label !== "string" || typeof credential.header !== "string" || typeof credential.env !== "string" || typeof credential.generate !== "function" || typeof credential.provision !== "function") return fail(`Plugin "${id}" provides clientAuth but no cli.clientCredential with a label, header, env, generate, and provision, so init cannot give an app its credential.`);
+	return {
+		plugin: id,
+		credential
+	};
+};
+/**
+* The client-route policy a definition's plugins set: the plugin that
+* provides clientAuth, the headers its decision reads, and the credential an
+* app sends. Undefined when client routes are public.
+*/
+const clientAuthOf = (definition) => {
+	const found = credentialOf(definition);
+	if (found === void 0) return void 0;
+	const { label, header, env } = found.credential;
+	return {
+		plugin: found.plugin,
+		varyHeaders: definition.clientAuth?.varyHeaders ?? [],
+		credential: {
+			label,
+			header: header.toLowerCase(),
+			env
+		}
+	};
+};
+/**
+* A new client credential, made without a database, so tooling can save it
+* before it registers it. Undefined when client routes are public.
+*/
+const generateClientCredential = (definition) => credentialOf(definition)?.credential.generate();
+/**
+* Provisions the credential an app sends to client routes, through the
+* plugin that provides clientAuth, on the definition's database: a
+* credential saved in `env` is registered again rather than replaced.
+* Undefined when client routes are public.
+*/
+const provisionClientCredential = async (definition, input) => {
+	const found = credentialOf(definition);
+	if (found === void 0) return void 0;
+	const { label, header, env, provision } = found.credential;
+	const existing = input.env[env]?.trim();
+	const value = await provision(definition.api[found.plugin], {
+		...existing ? { existing } : {},
+		name: input.name
+	});
+	return {
+		label,
+		header: header.toLowerCase(),
+		env,
+		value
+	};
+};
+/** Whether `hot-updater db generate` writes schema files for a definition's database. */
+const generatesSchema = ({ database }) => database.generateSchema !== void 0;
+/** The migrator for a definition's database: core's tables and its plugins' tables. */
+const createMigrator = ({ database, plugins }) => {
+	if (database.createMigrator === void 0) throw new ServerDefinitionError(database.generateSchema === void 0 ? `The ${database.name} database has no migrator; its provider applies the schema.` : `The ${database.name} database applies its schema from migration files: run \`hot-updater db generate\`, then apply the file with the provider's tooling.`);
+	return database.createMigrator(toolingTargetOf(plugins));
+};
+/** The schema file `hot-updater db generate` writes for a definition's database. */
+const generateSchema = ({ database, plugins }, version, name) => {
+	if (database.generateSchema === void 0) throw new ServerDefinitionError(`The ${database.name} database has no schema generator; run \`hot-updater db migrate\` instead.`);
+	return database.generateSchema(version, name, toolingTargetOf(plugins));
+};
+//#endregion
 //#region src/log.ts
 const log = {
 	normal: (message) => console.log(message),
@@ -45181,6 +45336,31 @@ const makeEnv = async (newEnvVars, filePath = ".env.hotupdater", options) => {
 	}
 };
 //#endregion
+//#region src/moduleSpecifiers.ts
+/**
+* The modules `source` imports or re-exports, statically or with an
+* `import()` of a string literal or a template without substitutions: what a
+* runtime that loads it unbundled, such as Deno through an import map,
+* resolves. An `import()` of a computed specifier, such as
+* `import("dayjs/locale/" + name + ".js")`, names no module to resolve.
+* Minified code reads the same as formatted code. `fileName` gives the
+* language, such as `.ts`.
+*/
+const moduleSpecifiersOf = (fileName, source) => {
+	const { errors, module, program } = parseSync(fileName, source);
+	if (errors.length > 0) throw new Error(`Could not read the imports of ${fileName}: ${errors[0].message}`);
+	const dynamicImports = [];
+	new Visitor({ ImportExpression({ source: specifier }) {
+		if (specifier.type === "Literal" && typeof specifier.value === "string") dynamicImports.push(specifier.value);
+		else if (specifier.type === "TemplateLiteral" && specifier.expressions.length === 0 && typeof specifier.quasis[0]?.value.cooked === "string") dynamicImports.push(specifier.quasis[0].value.cooked);
+	} }).visit(program);
+	return [.../* @__PURE__ */ new Set([
+		...module.staticImports.map(({ moduleRequest }) => moduleRequest.value),
+		...module.staticExports.flatMap(({ entries }) => entries.flatMap(({ moduleRequest }) => moduleRequest === null ? [] : [moduleRequest.value])),
+		...dynamicImports
+	])];
+};
+//#endregion
 //#region src/storageFiles.ts
 const getStorageFileByteSize = async (filePath) => {
 	const { size } = await fs$2.stat(filePath, { bigint: true });
@@ -45216,7 +45396,7 @@ const writeStorageResponseFile = async (response, filePath) => {
 		return;
 	}
 	try {
-		await pipeline$1(Readable$1.fromWeb(response.body), createWriteStream$1(filePath));
+		await pipeline(Readable$1.fromWeb(response.body), createWriteStream(filePath));
 	} catch (error) {
 		await fs$2.rm(filePath, { force: true });
 		throw error;
@@ -45252,11 +45432,6 @@ function verifySignedFileHash({ actualFileHash, publicKey, signedFileHash }) {
 		return false;
 	}
 }
-function getArchiveFilename(storageUri) {
-	const protocol = new URL(storageUri).protocol.replace(":", "");
-	const { key } = parseStorageUri(storageUri, protocol);
-	return path$1.posix.basename(key) || "bundle.zip";
-}
 const getRelativeStorageDir = (relativePath) => {
 	const normalized = relativePath.replace(/\\/g, "/");
 	const dirname = path$1.posix.dirname(normalized);
@@ -45273,7 +45448,7 @@ async function prepareManifestAssetUploadFile({ assetPath, sourcePath, workDir }
 	if (getManifestAssetDownloadPath(assetPath) === assetPath) return sourcePath;
 	const uploadPath = resolvePreparedUploadPath(workDir, assetPath);
 	await fs$2.mkdir(path$1.dirname(uploadPath), { recursive: true });
-	await pipeline$1(createReadStream(sourcePath), createBrotliCompress$1({ params: { [constants$2.BROTLI_PARAM_QUALITY]: 11 } }), createWriteStream$1(uploadPath));
+	await pipeline(createReadStream(sourcePath), createBrotliCompress({ params: { [constants$1.BROTLI_PARAM_QUALITY]: 11 } }), createWriteStream(uploadPath));
 	return uploadPath;
 }
 async function prepareContentAddressedUploadFile({ sourcePath, storagePath, workDir }) {
@@ -45290,9 +45465,10 @@ async function prepareManifestAssetUploadTargets({ extractDir, manifest, workDir
 	for (const assetPath of assetPaths) {
 		const asset = manifest.assets?.[assetPath];
 		if (!asset?.fileHash) throw new Error(`Manifest file hash not found for ${assetPath}`);
+		const sourcePath = resolveExtractedPath(extractDir, assetPath);
 		const uploadSourcePath = await prepareManifestAssetUploadFile({
 			assetPath,
-			sourcePath: resolveExtractedPath(extractDir, assetPath),
+			sourcePath,
 			workDir
 		});
 		const downloadByteSize = await getStorageFileByteSize(uploadSourcePath);
@@ -45301,6 +45477,7 @@ async function prepareManifestAssetUploadTargets({ extractDir, manifest, workDir
 		if (downloadFileHash !== void 0 && !isContentAddressedAssetFileHash(downloadFileHash)) throw new Error(`Prepared asset hash must be a lowercase SHA-256 hash: ${assetPath}`);
 		const nextAsset = {
 			...asset,
+			byteSize: (await fs$2.stat(sourcePath)).size,
 			downloadByteSize
 		};
 		delete nextAsset.downloadFileHash;
@@ -45330,143 +45507,81 @@ function resolveExtractedPath(rootDir, entryName) {
 	const normalizedEntryName = entryName.replaceAll("\\", "/");
 	const entryPath = path$1.resolve(rootDir, normalizedEntryName);
 	const relativePath = path$1.relative(rootDir, entryPath);
-	if (relativePath.startsWith("..") || path$1.isAbsolute(relativePath) || normalizedEntryName.startsWith("/")) throw new Error(`Invalid archive entry path: ${entryName}`);
+	if (relativePath.startsWith("..") || path$1.isAbsolute(relativePath) || normalizedEntryName.startsWith("/")) throw new Error(`Invalid manifest asset path: ${entryName}`);
 	return entryPath;
 }
-async function downloadArchive(storageUri, storagePlugin, archivePath) {
+async function downloadStorageObject(storageUri, storageAdapter, outputPath) {
 	const protocol = new URL(storageUri).protocol.replace(":", "");
-	if (storagePlugin?.protocol === protocol) {
-		await writeStorageFile(storagePlugin, storageUri, archivePath);
+	if (storageAdapter?.protocol === protocol) {
+		await writeStorageFile(storageAdapter, storageUri, outputPath);
 		return;
 	}
 	if (protocol === "http" || protocol === "https") {
-		await downloadFromUrl(storageUri, archivePath);
+		await downloadFromUrl(storageUri, outputPath);
 		return;
 	}
-	throw new Error(`No storage plugin for protocol: ${protocol}`);
+	throw new Error(`No storage adapter for protocol: ${protocol}`);
 }
 async function downloadFromUrl(fileUrl, filePath) {
 	const response = await fetch(fileUrl);
-	if (!response.ok) throw new Error(`Failed to download bundle archive: ${response.statusText}`);
+	if (!response.ok) throw new Error(`Failed to download storage object: ${response.statusText}`);
 	await writeStorageResponseFile(response, filePath);
 }
-async function extractZipArchive(archivePath, extractDir) {
-	const zip = await import_lib.default.loadAsync(await fs$2.readFile(archivePath));
-	const entries = Object.values(zip.files).sort((left, right) => left.name.localeCompare(right.name));
-	for (const entry of entries) {
-		const outputPath = resolveExtractedPath(extractDir, entry.name);
-		if (entry.dir) {
-			await fs$2.mkdir(outputPath, { recursive: true });
-			continue;
+async function downloadManifestAssets({ bundle, manifest, outputDir, storageAdapter, workDir }) {
+	await runWithConcurrency(Object.keys(manifest.assets ?? {}).sort((left, right) => left.localeCompare(right)), PROMOTE_ASSET_CONCURRENCY, async (assetPath) => {
+		const asset = manifest.assets?.[assetPath];
+		if (!asset?.fileHash) throw new Error(`Manifest file hash not found for ${assetPath}`);
+		const downloadPath = getManifestAssetDownloadPath(assetPath);
+		const storageUri = resolveManifestAssetStorageUri({
+			assetBaseStorageUri: bundle.assetBaseStorageUri,
+			assetPath: downloadPath,
+			downloadFileHash: asset.downloadFileHash,
+			fileHash: asset.fileHash
+		});
+		const transferPath = resolveExtractedPath(workDir, `downloads/${downloadPath}`);
+		await fs$2.mkdir(path$1.dirname(transferPath), { recursive: true });
+		await downloadStorageObject(storageUri, storageAdapter, transferPath);
+		if (asset.downloadFileHash) {
+			if (await getFileHash(transferPath) !== asset.downloadFileHash.toLowerCase()) throw new Error(`Manifest download hash mismatch for ${assetPath}`);
 		}
+		const outputPath = resolveExtractedPath(outputDir, assetPath);
 		await fs$2.mkdir(path$1.dirname(outputPath), { recursive: true });
-		await fs$2.writeFile(outputPath, await entry.async("nodebuffer"));
-	}
-}
-async function extractTarBrArchive(archivePath, extractDir) {
-	const tarPath = path$1.join(extractDir, "bundle.tar");
-	const compressedBuffer = await fs$2.readFile(archivePath);
-	const tarBuffer = brotliDecompressSync(compressedBuffer);
-	await fs$2.writeFile(tarPath, tarBuffer);
-	try {
-		await uo({
-			file: tarPath,
-			cwd: extractDir,
-			gzip: false,
-			strict: true
-		});
-	} finally {
-		await fs$2.rm(tarPath, { force: true });
-	}
-}
-async function extractArchive(archivePath, extractDir) {
-	const { format } = detectCompressionFormat(path$1.basename(archivePath));
-	switch (format) {
-		case "zip":
-			await extractZipArchive(archivePath, extractDir);
-			return format;
-		case "tar.gz":
-			await uo({
-				file: archivePath,
-				cwd: extractDir,
-				gzip: true,
-				strict: true
-			});
-			return format;
-		case "tar.br":
-			await extractTarBrArchive(archivePath, extractDir);
-			return format;
-	}
-}
-async function getArchiveTargetFiles(bundleDir) {
-	const entries = await fs$2.readdir(bundleDir, { withFileTypes: true });
-	entries.sort((left, right) => left.name.localeCompare(right.name));
-	return entries.map((entry) => ({
-		path: path$1.join(bundleDir, entry.name),
-		name: entry.name
-	}));
-}
-async function createArchiveFromDirectory(sourceDir, archivePath, format) {
-	const targetFiles = await getArchiveTargetFiles(sourceDir);
-	switch (format) {
-		case "zip":
-			await createZipTargetFiles({
-				outfile: archivePath,
-				targetFiles
-			});
-			return;
-		case "tar.gz":
-			await createTarGzTargetFiles({
-				outfile: archivePath,
-				targetFiles
-			});
-			return;
-		case "tar.br":
-			await createTarBrTargetFiles({
-				outfile: archivePath,
-				targetFiles
-			});
-			return;
-	}
-}
-async function readCopiedBundleManifest(extractDir, nextBundleId) {
-	const manifestPath = path$1.join(extractDir, "manifest.json");
-	try {
-		await fs$2.access(manifestPath);
-	} catch {
-		throw new Error(LEGACY_BUNDLE_ERROR);
-	}
-	const manifest = JSON.parse(await fs$2.readFile(manifestPath, "utf8"));
-	manifest.bundleId = nextBundleId;
-	return {
-		manifest,
-		manifestPath
-	};
+		if (downloadPath === assetPath) await fs$2.copyFile(transferPath, outputPath);
+		else await fs$2.writeFile(outputPath, brotliDecompressSync(await fs$2.readFile(transferPath)));
+		if (await getFileHash(outputPath) !== asset.fileHash.toLowerCase()) throw new Error(`Manifest file hash mismatch for ${assetPath}`);
+	});
 }
-async function createCopiedBundleArchive({ bundle, config, nextBundleId, storagePlugin }) {
-	const archiveFilename = getArchiveFilename(bundle.storageUri);
+async function createCopiedBundleArtifacts({ bundle, config, nextBundleId, storageAdapter }) {
 	const workDir = await fs$2.mkdtemp(path$1.join(os.tmpdir(), "hot-updater-console-promote-"));
-	const sourceArchivePath = path$1.join(workDir, archiveFilename);
 	const extractDir = path$1.join(workDir, "bundle");
-	const outputArchivePath = path$1.join(workDir, archiveFilename);
+	const sourceManifestPath = path$1.join(workDir, "source-manifest.json");
+	const manifestPath = path$1.join(extractDir, "manifest.json");
 	const uploadedStorageUris = [];
 	await fs$2.mkdir(extractDir, { recursive: true });
 	try {
-		await downloadArchive(bundle.storageUri, storagePlugin, sourceArchivePath);
-		const actualSourceFileHash = await getFileHash(sourceArchivePath);
+		await downloadStorageObject(bundle.manifestStorageUri, storageAdapter, sourceManifestPath);
+		const actualManifestHash = await getFileHash(sourceManifestPath);
 		const signingSession = await prepareBundleSigning(config.signing);
-		if (isSignedFileHash(bundle.fileHash)) {
+		if (isSignedFileHash(bundle.manifestFileHash)) {
 			if (!signingSession) throw new Error("Cannot copy a signed bundle without enabled bundle signing configuration.");
 			if (!verifySignedFileHash({
-				actualFileHash: actualSourceFileHash,
+				actualFileHash: actualManifestHash,
 				publicKey: signingSession.publicKey,
-				signedFileHash: bundle.fileHash
-			})) throw new Error("Source bundle signature verification failed.");
-		} else if (actualSourceFileHash !== bundle.fileHash.toLowerCase()) throw new Error("Source bundle file hash verification failed.");
-		const format = await extractArchive(sourceArchivePath, extractDir);
-		const { manifest, manifestPath } = await readCopiedBundleManifest(extractDir, nextBundleId);
+				signedFileHash: bundle.manifestFileHash
+			})) throw new Error("Source manifest signature verification failed.");
+		} else if (actualManifestHash !== bundle.manifestFileHash.toLowerCase()) throw new Error("Source manifest file hash verification failed.");
+		const manifest = JSON.parse(await fs$2.readFile(sourceManifestPath, "utf8"));
+		if (!manifest.assets || typeof manifest.assets !== "object") throw new Error(LEGACY_BUNDLE_ERROR);
+		await downloadManifestAssets({
+			bundle,
+			manifest,
+			outputDir: extractDir,
+			storageAdapter,
+			workDir
+		});
+		manifest.bundleId = nextBundleId;
 		const assetPaths = Object.keys(manifest.assets ?? {}).sort((left, right) => left.localeCompare(right));
-		const sourceIsSigned = [bundle.fileHash, getManifestFileHash(bundle)].filter((hash) => Boolean(hash)).some((hash) => isSignedFileHash(hash));
+		const sourceIsSigned = isSignedFileHash(getManifestFileHash(bundle));
 		const manifestHasSignatures = assetPaths.some((assetPath) => Boolean(manifest.assets?.[assetPath]?.signature));
 		if (!signingSession && (sourceIsSigned || manifestHasSignatures)) throw new Error("Cannot copy a signed bundle without enabled bundle signing configuration.");
 		if (signingSession) {
@@ -45486,16 +45601,22 @@ async function createCopiedBundleArchive({ bundle, config, nextBundleId, storage
 			manifest,
 			workDir
 		});
+		const archivePath = path$1.join(workDir, "bundle.tar.br");
+		manifest.archive = await createTarBrTargetFiles({
+			outfile: archivePath,
+			targetFiles: assetPaths.map((name) => ({
+				name,
+				path: resolveExtractedPath(extractDir, name)
+			}))
+		});
 		await fs$2.writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
-		await fs$2.rm(sourceArchivePath, { force: true });
-		await createArchiveFromDirectory(extractDir, outputArchivePath, format);
-		const fileHash = await getFileHash(outputArchivePath);
 		const manifestHash = await getFileHash(manifestPath);
-		const nextFileHash = signingSession ? `${SIGNED_HASH_PREFIX}${await signingSession.signFileHash(fileHash)}` : fileHash;
 		const nextManifestFileHash = signingSession ? `${SIGNED_HASH_PREFIX}${await signingSession.signFileHash(manifestHash)}` : manifestHash;
-		const archiveUpload = await putStorageFile(storagePlugin, createBundleStorageKey(nextBundleId), outputArchivePath);
+		const archiveUpload = await putStorageFile(storageAdapter, createBundleStorageKey(nextBundleId), archivePath);
 		uploadedStorageUris.push(archiveUpload.storageUri);
-		const assetBaseStorageUri = createStorageRootUriWithPath(archiveUpload.storageUri, nextBundleId, "assets");
+		const manifestUpload = await putStorageFile(storageAdapter, createBundleStorageKey(nextBundleId), manifestPath);
+		uploadedStorageUris.push(manifestUpload.storageUri);
+		const assetBaseStorageUri = createStorageRootUriWithPath(manifestUpload.storageUri, nextBundleId, "assets");
 		for (const assetUploadTarget of assetUploadTargets) {
 			const storageUri = resolveManifestAssetStorageUri({
 				assetBaseStorageUri,
@@ -45503,18 +45624,13 @@ async function createCopiedBundleArchive({ bundle, config, nextBundleId, storage
 				downloadFileHash: assetUploadTarget.downloadFileHash,
 				fileHash: assetUploadTarget.fileHash
 			});
-			const { exists } = await storagePlugin.exists({ storageUri });
-			if (!exists) await putStorageFile(storagePlugin, getRelativeStorageDir(assetUploadTarget.storagePath) ? `assets/${getRelativeStorageDir(assetUploadTarget.storagePath)}` : "assets", assetUploadTarget.uploadSourcePath);
+			const { exists } = await storageAdapter.exists({ storageUri });
+			if (!exists) await putStorageFile(storageAdapter, getRelativeStorageDir(assetUploadTarget.storagePath) ? `assets/${getRelativeStorageDir(assetUploadTarget.storagePath)}` : "assets", assetUploadTarget.uploadSourcePath);
 		}
-		const manifestUpload = await putStorageFile(storagePlugin, createBundleStorageKey(nextBundleId), manifestPath);
-		uploadedStorageUris.push(manifestUpload.storageUri);
 		return {
 			bundle: {
 				...bundle,
 				id: nextBundleId,
-				archiveByteSize: archiveUpload.byteSize,
-				storageUri: archiveUpload.storageUri,
-				fileHash: nextFileHash,
 				metadata: stripBundleArtifactMetadata(bundle.metadata),
 				assetBaseStorageUri,
 				patches: [],
@@ -45524,7 +45640,7 @@ async function createCopiedBundleArchive({ bundle, config, nextBundleId, storage
 			uploadedStorageUris
 		};
 	} catch (error) {
-		await deleteUploadedCopy(storagePlugin, uploadedStorageUris);
+		await deleteUploadedCopy(storageAdapter, uploadedStorageUris);
 		throw error;
 	} finally {
 		await fs$2.rm(workDir, {
@@ -45533,12 +45649,12 @@ async function createCopiedBundleArchive({ bundle, config, nextBundleId, storage
 		});
 	}
 }
-async function deleteUploadedCopy(storagePlugin, storageUris) {
+async function deleteUploadedCopy(storageAdapter, storageUris) {
 	if (storageUris.length === 0) return;
 	for (const storageUri of new Set(storageUris)) try {
 		const protocol = new URL(storageUri).protocol.replace(":", "");
-		if (storagePlugin.protocol === protocol) await storagePlugin.delete({ storageUri });
-		else if (protocol !== "http" && protocol !== "https") throw new Error(`No storage plugin for protocol: ${protocol}`);
+		if (storageAdapter.protocol === protocol) await storageAdapter.delete({ storageUri });
+		else if (protocol !== "http" && protocol !== "https") throw new Error(`No storage adapter for protocol: ${protocol}`);
 	} catch (error) {
 		console.error("Failed to delete uploaded bundle copy:", error);
 	}
@@ -45611,4 +45727,4 @@ function transformTemplate(templateString, values) {
 	return result;
 }
 //#endregion
-export { BuildLogger, ConfigBuilder, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, InitEnvFileError, InitError, LEGACY_BUNDLE_ERROR, LegacyInfrastructureError, MissingInitInputsError, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, banner, typedColors as colors, confirmInitInputPersistence, copyDirToTmp, createCopiedBundleArchive, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createLogWriter, createTarBr, createTarBrTargetFiles, createTarGz, createTarGzTargetFiles, createZip, createZipTargetFiles, decryptJson, defineInitProvider, encryptJson, ensureInstallPackages, formatApiKeyNote, getAndroidSdkPath, getBundleSigningPublicKey, getCwd, getHotUpdaterEnvValue, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getReactNativeMetadatas, getStorageFileByteSize, link, loadConfig, log, makeEnv, p, prepareBundleSigning, printBanner, putStorageFile, readBundleSigningPublicKeyFile, readHotUpdaterEnv, readHotUpdaterInitEnv, readPackageUp, renderImportStatements, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolvePackageVersion, shouldAutoSelectOnlyInitResource, stripAnsi, transformEnv, transformTemplate, writeHotUpdaterConfig, writeStorageFile, writeStorageResponseFile };
+export { BuildLogger, ConfigBuilder, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, InitEnvFileError, InitError, LEGACY_BUNDLE_ERROR, LegacyInfrastructureError, MissingInitInputsError, ServerDefinitionError, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, banner, clientAuthOf, typedColors as colors, confirmInitInputPersistence, copyDirToTmp, createCopiedBundleArtifacts, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createLogWriter, createMigrator, createTarBrTargetFiles, createZip, decryptJson, defineInitProvider, encryptJson, ensureInstallPackages, generateClientCredential, generateSchema, generatesSchema, getAndroidSdkPath, getBundleSigningPublicKey, getCwd, getHotUpdaterEnvValue, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getReactNativeMetadatas, getStorageFileByteSize, isServerDefinition, link, loadConfig, loadPlatformConfigs, log, makeEnv, moduleSpecifiersOf, p, prepareBundleSigning, printAppSetup, printBanner, provisionClientCredential, putStorageFile, readBundleSigningPublicKeyFile, readHotUpdaterEnv, readHotUpdaterInitEnv, readPackageUp, renderAppImports, renderAppSetup, renderImportStatements, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolvePackageVersion, serverDefinitionOf, shouldAutoSelectOnlyInitResource, stripAnsi, transformEnv, transformTemplate, writeHotUpdaterConfig, writeHotUpdaterFiles, writeStorageFile, writeStorageResponseFile };