@hot-updater/cli-tools 1.1.4 → 1.2.0-rc.0

package/dist/index.mjs

@@ -9,18 +9,19 @@ import $r, { EventEmitter } from "events";
 import Pi from "assert";
 import crypto from "crypto";
 import { Buffer as Buffer$1 } from "buffer";
-import { aborted, callbackify, debuglog, inspect, promisify, stripVTControlCharacters, styleText } from "node:util";
+import { aborted, callbackify, debuglog, inspect, parseEnv, promisify, stripVTControlCharacters, styleText } from "node:util";
 import process$1, { execArgv, execPath, hrtime, platform, stdin, stdout } from "node:process";
 import * as l from "node:readline";
 import l__default from "node:readline";
 import tty, { ReadStream } from "node:tty";
-import Ei, { appendFileSync, createReadStream, createWriteStream, existsSync, lstatSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import Ei, { appendFileSync, createReadStream, createWriteStream, existsSync, lstatSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import path$1, { basename, dirname as dirname$1, join, posix, win32 } from "node:path";
 import { createMemoryAdapter, createStorageAdapter, getContentType, isRemoteDatabase, toolingTargetOf } from "@hot-updater/plugin-core";
 import { createHotUpdater } from "@hot-updater/server";
 import os, { constants } from "node:os";
 import crypto$1, { createHash, randomBytes, randomUUID } from "node:crypto";
 import fs$2 from "node:fs/promises";
+import { ChildProcess, execFile, execFileSync, spawn, spawnSync } from "node:child_process";
 import As, { Duplex, PassThrough as PassThrough$1, Readable as Readable$1, Transform, Writable, getDefaultHighWaterMark } from "node:stream";
 import { finished, pipeline } from "node:stream/promises";
 import { constants as constants$1, createBrotliCompress } from "node:zlib";
@@ -30,7 +31,6 @@ import * as Ms from "zlib";
 import Jr from "zlib";
 import no from "node:assert";
 import { fileURLToPath } from "node:url";
-import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process";
 import { scheduler, setImmediate as setImmediate$1, setTimeout as setTimeout$1 } from "node:timers/promises";
 import { serialize } from "node:v8";
 import { Buffer as Buffer$2 } from "node:buffer";
@@ -21393,11 +21393,11 @@ var dist_exports = /* @__PURE__ */ __exportAll({
 	group: () => group,
 	groupMultiselect: () => groupMultiselect,
 	intro: () => intro,
-	isCI: () => isCI,
+	isCI: () => isCI$1,
 	isCancel: () => isCancel,
 	isTTY: () => isTTY,
 	limitOptions: () => limitOptions,
-	log: () => log$1,
+	log: () => log$2,
 	multiline: () => multiline,
 	multiselect: () => multiselect,
 	note: () => note,
@@ -21424,7 +21424,7 @@ function isUnicodeSupported$1() {
 	return Boolean(process$1.env.CI) || Boolean(process$1.env.WT_SESSION) || Boolean(process$1.env.TERMINUS_SUBLIME) || process$1.env.ConEmuTask === "{cmd::Cmder}" || process$1.env.TERM_PROGRAM === "Terminus-Sublime" || process$1.env.TERM_PROGRAM === "vscode" || process$1.env.TERM === "xterm-256color" || process$1.env.TERM === "alacritty" || process$1.env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
 const unicode = isUnicodeSupported$1();
-const isCI = () => process.env.CI === "true";
+const isCI$1 = () => process.env.CI === "true";
 const isTTY = (o) => o.isTTY === true;
 const unicodeOr = (o, e) => unicode ? o : e;
 const S_STEP_ACTIVE = unicodeOr("◆", "*");
@@ -21987,7 +21987,7 @@ ${r}
 		}
 	}).prompt();
 };
-const log$1 = {
+const log$2 = {
 	message: (s = [], { symbol: e = styleText("gray", S_BAR), secondarySymbol: r = styleText("gray", S_BAR), output: m = process.stdout, spacing: l = 1, withGuide: c } = {}) => {
 		const t = [], o = c ?? settings.withGuide, f = o ? r : "", O = o ? `${e}  ` : "", u = o ? `${r}  ` : "";
 		for (let i = 0; i < l; i++) t.push(f);
@@ -22003,35 +22003,35 @@ const log$1 = {
 `);
 	},
 	info: (s, e) => {
-		log$1.message(s, {
+		log$2.message(s, {
 			...e,
 			symbol: styleText("blue", S_INFO)
 		});
 	},
 	success: (s, e) => {
-		log$1.message(s, {
+		log$2.message(s, {
 			...e,
 			symbol: styleText("green", S_SUCCESS)
 		});
 	},
 	step: (s, e) => {
-		log$1.message(s, {
+		log$2.message(s, {
 			...e,
 			symbol: styleText("green", S_STEP_SUBMIT)
 		});
 	},
 	warn: (s, e) => {
-		log$1.message(s, {
+		log$2.message(s, {
 			...e,
 			symbol: styleText("yellow", S_WARN)
 		});
 	},
 	/** alias for `log.warn()`. */
 	warning: (s, e) => {
-		log$1.warn(s, e);
+		log$2.warn(s, e);
 	},
 	error: (s, e) => {
-		log$1.message(s, {
+		log$2.message(s, {
 			...e,
 			symbol: styleText("red", S_ERROR)
 		});
@@ -22191,7 +22191,7 @@ const spinner$1 = ({ indicator: l = "dots", onCancel: h, output: n = process.std
 	"O",
 	"0"
 ], delay: F = unicode ? 80 : 120, signal: m, ...I } = {}) => {
-	const u = isCI();
+	const u = isCI$1();
 	let M, T, d = false, S = false, s = "", p, w = performance.now();
 	const x = getColumns(n), k = I?.styleFrame ?? W$2, g = (e) => {
 		const r = e > 1 ? O ?? settings.messages.error : G ?? settings.messages.cancel;
@@ -22429,7 +22429,7 @@ const tasks$1 = async (o, e) => {
 };
 const A$2 = (l) => l.replace(/\x1b\[(?:\d+;)*\d*[ABCDEFGHfJKSTsu]|\x1b\[(s|u)/g, "");
 const taskLog = (l) => {
-	const r = l.output ?? process.stdout, O = getColumns(r), i = styleText("gray", S_BAR), p = l.spacing ?? 1, k = 3, m = l.retainLog === true, d = !isCI() && isTTY(r);
+	const r = l.output ?? process.stdout, O = getColumns(r), i = styleText("gray", S_BAR), p = l.spacing ?? 1, k = 3, m = l.retainLog === true, d = !isCI$1() && isTTY(r);
 	r.write(`${i}
 `), r.write(`${styleText("green", S_STEP_SUBMIT)}  ${l.title}
 `);
@@ -22458,13 +22458,13 @@ ${t.header}`);
 	}, h = (e, s, t) => {
 		const o = t ? `${e.full}
 ${e.value}` : e.value;
-		e.header !== void 0 && e.header !== "" && log$1.message(e.header.split(`
+		e.header !== void 0 && e.header !== "" && log$2.message(e.header.split(`
 `).map((a) => styleText("bold", a)), {
 			output: r,
 			secondarySymbol: i,
 			symbol: i,
 			spacing: 0
-		}), log$1.message(o.split(`
+		}), log$2.message(o.split(`
 `).map((a) => styleText("dim", a)), {
 			output: r,
 			secondarySymbol: i,
@@ -22492,11 +22492,11 @@ ${e.value}` : e.value;
 		}
 		d && y();
 	}, y = () => {
-		for (const e of n) e.result ? e.result.status === "error" ? log$1.error(e.result.message, {
+		for (const e of n) e.result ? e.result.status === "error" ? log$2.error(e.result.message, {
 			output: r,
 			secondarySymbol: i,
 			spacing: 0
-		}) : log$1.success(e.result.message, {
+		}) : log$2.success(e.result.message, {
 			output: r,
 			secondarySymbol: i,
 			spacing: 0
@@ -22533,14 +22533,14 @@ ${e.value}` : e.value;
 			};
 		},
 		error(e, s) {
-			f(true), log$1.error(e, {
+			f(true), log$2.error(e, {
 				output: r,
 				secondarySymbol: i,
 				spacing: 1
 			}), s?.showLog !== false && T(), n.splice(1, n.length - 1), n[0].value = "", n[0].full = "";
 		},
 		success(e, s) {
-			f(true), log$1.success(e, {
+			f(true), log$2.success(e, {
 				output: r,
 				secondarySymbol: i,
 				spacing: 1
@@ -22584,7 +22584,115 @@ ${i ? styleText("cyan", S_BAR_END) : ""}
 	}
 }).prompt();
 //#endregion
+//#region src/interactive.ts
+/**
+* Whether the environment is a CI run: `CI` is set to anything but empty,
+* `0`, or `false`. GitHub Actions, GitLab CI, CircleCI, Buildkite, Bitrise,
+* and Codemagic set it.
+*/
+const isCI = (env = process.env) => {
+	const value = env["CI"]?.trim().toLowerCase();
+	return value !== void 0 && value !== "" && value !== "0" && value !== "false";
+};
+/**
+* Why the CLI can't ask anything here, or undefined when it can: in CI,
+* where a runner may give the job a terminal nobody answers in, and without
+* a terminal on stdin. Prompts and sign-ins both check it.
+*/
+const nonInteractiveReason = ({ env = process.env, input = process.stdin } = {}) => {
+	if (isCI(env)) return "in CI (CI is set)";
+	if (!input.isTTY) return "without a terminal";
+};
+//#endregion
+//#region src/secretMasking.ts
+const SECRET_MASK = "********";
+/**
+* A value shorter than this is masked only where it is a whole token, so a
+* keystore password `a` masks `-Ppassword=a` but leaves `Gradle failed`
+* readable, and a value `1` leaves `http://127.0.0.1:3941` whole. The lines
+* of a multi-line value are registered only from this length: masking the
+* `{` line of a JSON file would redact every brace.
+*/
+const MIN_SUBSTRING_SECRET_LENGTH = 6;
+/**
+* What separates the tokens a short value must be whole: whitespace, quotes,
+* `=`, `&`, `|`, brackets, commas, and semicolons. Characters such as `.`,
+* `:`, `/`, `-`, and `@` join a run into one token, as in a URL or a version,
+* except a `.`, `:`, `!`, or `?` that ends a sentence.
+*/
+const TOKEN_SEPARATOR = "\\s\"'`=&|,;()[\\]{}<>";
+const SHORT_SECRET_BEFORE = `(?<=^|[${TOKEN_SEPARATOR}])`;
+const SHORT_SECRET_AFTER = `(?=$|[${TOKEN_SEPARATOR}]|[.:!?](?:$|[${TOKEN_SEPARATOR}]))`;
+const PEM_ARMOR_LINE = /^-----(BEGIN|END) [A-Z0-9 ]+-----$/;
+const MASKING_REGISTRY = Symbol.for("@hot-updater/cli-tools/secret-masking");
+/**
+* The values to mask, kept on `globalThis`: the config file loads its own
+* copy of Hot Updater's modules, and a value it resolves, such as through
+* `secretEnv`, must be masked by the CLI's log sinks too.
+*/
+const registry = globalThis[MASKING_REGISTRY] ??= {
+	secretValues: /* @__PURE__ */ new Set(),
+	shortSecretValues: /* @__PURE__ */ new Set(),
+	secretValuesLongestFirst: [],
+	shortSecretPattern: void 0
+};
+const { secretValues, shortSecretValues } = registry;
+const longestFirst = (values) => [...values].sort((left, right) => right.length - left.length);
+const escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/**
+* Registers a credential value so every CLI log sink (`p`, `log`, and the
+* build log files) prints it masked, however short it is. A multi-line value
+* is also registered line by line, so a PEM printed one line at a time stays
+* masked.
+*/
+const registerSecretValue = (value) => {
+	const whole = value.trim();
+	if (whole.length >= MIN_SUBSTRING_SECRET_LENGTH) secretValues.add(whole);
+	else if (whole) shortSecretValues.add(whole);
+	for (const line of value.split(/\r?\n/)) {
+		const trimmed = line.trim();
+		if (trimmed.length >= MIN_SUBSTRING_SECRET_LENGTH && !PEM_ARMOR_LINE.test(trimmed)) secretValues.add(trimmed);
+	}
+	registry.secretValuesLongestFirst = longestFirst(secretValues);
+	registry.shortSecretPattern = shortSecretValues.size > 0 ? new RegExp(`${SHORT_SECRET_BEFORE}(?:${longestFirst(shortSecretValues).map(escapeRegExp).join("|")})${SHORT_SECRET_AFTER}`, "g") : void 0;
+};
+/** Replaces every registered credential value in `text` with a mask. */
+const maskSecretValues = (text) => {
+	let masked = text;
+	for (const value of registry.secretValuesLongestFirst) if (masked.includes(value)) masked = masked.split(value).join(SECRET_MASK);
+	const { shortSecretPattern } = registry;
+	return shortSecretPattern ? masked.replace(shortSecretPattern, SECRET_MASK) : masked;
+};
+//#endregion
 //#region src/prompts.ts
+const maskMessage = (message) => message === void 0 ? message : maskSecretValues(message);
+const log$1 = {
+	message: (message, options) => log$2.message(Array.isArray(message) ? message.map(maskSecretValues) : maskMessage(message), options),
+	info: (message, options) => log$2.info(maskSecretValues(message), options),
+	success: (message, options) => log$2.success(maskSecretValues(message), options),
+	step: (message, options) => log$2.step(maskSecretValues(message), options),
+	warn: (message, options) => log$2.warn(maskSecretValues(message), options),
+	warning: (message, options) => log$2.warning(maskSecretValues(message), options),
+	error: (message, options) => log$2.error(maskSecretValues(message), options)
+};
+const maskSpinner = (target) => ({
+	start: (message) => target.start(maskMessage(message)),
+	stop: (message) => target.stop(maskMessage(message)),
+	cancel: (message) => target.cancel(maskMessage(message)),
+	error: (message) => target.error(maskMessage(message)),
+	message: (message) => target.message(maskMessage(message)),
+	clear: () => target.clear(),
+	get isCancelled() {
+		return target.isCancelled;
+	}
+});
+const maskProgress = (target) => ({
+	...maskSpinner(target),
+	advance: (step, message) => target.advance(step, maskMessage(message)),
+	get isCancelled() {
+		return target.isCancelled;
+	}
+});
 const createStaticSpinner = ({ onCancel, output = process.stdout, withGuide } = {}) => {
 	let active = false;
 	let cancelled = false;
@@ -22593,26 +22701,26 @@ const createStaticSpinner = ({ onCancel, output = process.stdout, withGuide } =
 		output,
 		withGuide
 	};
-	const finish = (message, log) => {
+	const finish = (message, logLine) => {
 		if (!active) return;
 		active = false;
 		const finalMessage = message || latestMessage;
-		if (finalMessage) log(finalMessage, logOptions);
+		if (finalMessage) logLine(finalMessage, logOptions);
 	};
 	return {
 		start: (message = "") => {
 			active = true;
 			latestMessage = message;
-			if (message) log$1.step(message, logOptions);
+			if (message) log$2.step(message, logOptions);
 		},
-		stop: (message) => finish(message, log$1.success),
+		stop: (message) => finish(message, log$2.success),
 		cancel: (message) => {
 			const wasActive = active;
 			cancelled = wasActive;
-			finish(message, log$1.warn);
+			finish(message, log$2.warn);
 			if (wasActive) onCancel?.();
 		},
-		error: (message) => finish(message, log$1.error),
+		error: (message) => finish(message, log$2.error),
 		message: (message = "") => {
 			latestMessage = message;
 		},
@@ -22626,12 +22734,13 @@ const createStaticSpinner = ({ onCancel, output = process.stdout, withGuide } =
 };
 const spinner = (options = {}) => {
 	const output = options.output ?? process.stdout;
-	return isTTY(output) && !isCI() ? spinner$1(options) : createStaticSpinner(options);
+	const isInteractive = isTTY(output) && !isCI$1();
+	return maskSpinner(isInteractive ? spinner$1(options) : createStaticSpinner(options));
 };
 const progress = (options = {}) => {
 	const output = options.output ?? process.stdout;
-	if (isTTY(output) && !isCI()) return progress$1(options);
-	const staticSpinner = createStaticSpinner(options);
+	if (isTTY(output) && !isCI$1()) return maskProgress(progress$1(options));
+	const staticSpinner = maskSpinner(createStaticSpinner(options));
 	return {
 		...staticSpinner,
 		advance: (_step, message) => staticSpinner.message(message),
@@ -22654,8 +22763,46 @@ const tasks = async (taskList, options) => {
 		}
 	}
 };
+/**
+* The prompt, refusing to ask in CI or without a terminal: a prompt on a
+* closed or piped stdin would end as a cancel or wait forever, and one in CI
+* waits on a terminal nobody answers in. A command that can skip a prompt
+* says which option does before it asks.
+*/
+const requireTerminal = (prompt) => {
+	return (options) => {
+		const reason = nonInteractiveReason({ input: options.input ?? process.stdin });
+		if (reason !== void 0) {
+			const message = options.message;
+			return Promise.reject(/* @__PURE__ */ new Error(`${typeof message === "string" ? `${message} ` : ""}The CLI asks nothing ${reason}: pass the command's options instead (see --help).`));
+		}
+		return prompt(options);
+	};
+};
+/**
+* `@clack/prompts` with CI-safe spinners, with every message a registered
+* credential value appears in masked (`registerSecretValue`), and with
+* prompts that refuse to ask without a terminal.
+*/
 const p = {
 	...dist_exports,
+	autocomplete: requireTerminal(autocomplete),
+	autocompleteMultiselect: requireTerminal(autocompleteMultiselect),
+	confirm: requireTerminal(confirm),
+	date: requireTerminal(date),
+	groupMultiselect: requireTerminal(groupMultiselect),
+	multiline: requireTerminal(multiline),
+	multiselect: requireTerminal(multiselect),
+	password: requireTerminal(password),
+	path: requireTerminal(path$5),
+	select: requireTerminal(select),
+	selectKey: requireTerminal(selectKey),
+	text: requireTerminal(text),
+	log: log$1,
+	cancel: (message, options) => cancel(maskMessage(message), options),
+	intro: (title, options) => intro(maskMessage(title), options),
+	note: (message, title, options) => note(maskMessage(message), maskMessage(title), options),
+	outro: (message, options) => outro(maskMessage(message), options),
 	progress,
 	spinner,
 	tasks
@@ -22710,11 +22857,18 @@ const createLogWriter = async ({ prefix, logFilePath }) => {
 		});
 		const writeChunk = (value) => {
 			if (!stream.writable || stream.destroyed) return;
-			const plainText = stripAnsi(normalizeChunk({ chunk: value })).replace(/\r/g, "");
+			const plainText = maskSecretValues(stripAnsi(normalizeChunk({ chunk: value })).replace(/\r/g, ""));
 			stream.write(plainText);
 		};
 		const writeStream = async (input) => {
-			for await (const chunk of input) writeChunk(normalizeChunk({ chunk }));
+			let partialLine = "";
+			for await (const chunk of input) {
+				const text = partialLine + normalizeChunk({ chunk });
+				const lineEnd = Math.max(text.lastIndexOf("\n"), text.lastIndexOf("\r")) + 1;
+				partialLine = text.slice(lineEnd);
+				if (lineEnd > 0) writeChunk(text.slice(0, lineEnd));
+			}
+			if (partialLine) writeChunk(partialLine);
 		};
 		const writeError = (error) => {
 			const message = error instanceof Error ? error.stack ?? error.message : String(error);
@@ -22799,10 +22953,39 @@ const resolveNextCompletedStage = ({ line, progressStages, completedStages }) =>
 	}
 	return nextCompletedStages;
 };
+/** The most lines a failure summary prints, and the tail it falls back to. */
+const MAX_SUMMARY_LINES = 60;
+const TAIL_LINES = 40;
+const matchesSummaryPattern = (line, pattern) => {
+	if (pattern instanceof RegExp) {
+		pattern.lastIndex = 0;
+		return pattern.test(line);
+	}
+	return line.includes(pattern);
+};
+/**
+* A native build that failed, after its logger printed the summary of the
+* tool's output and the log file's path, so its message is one line.
+*/
+var BuildFailedError = class extends Error {
+	name = "BuildFailedError";
+	/** The build log, relative to the project, or null without one. */
+	logPath;
+	/** The lines of the tool's output the summary printed. */
+	summary;
+	constructor(message, { logPath, summary, cause }) {
+		super(message, { cause });
+		this.logPath = logPath;
+		this.summary = summary;
+	}
+};
 var BuildLogger = class {
 	config;
 	state = createInitialState();
 	logWriter;
+	summaryLines = [];
+	tailLines = [];
+	openBlock;
 	promptProgress;
 	stageCount;
 	constructor(config) {
@@ -22819,16 +23002,76 @@ var BuildLogger = class {
 			...createInitialState(),
 			started: true
 		};
+		this.summaryLines = [];
+		this.tailLines = [];
+		this.openBlock = void 0;
 		this.logWriter = await createLogWriter({ prefix: this.config.logPrefix });
 		this.promptProgress.start();
 	}
-	async processStream(input) {
+	/**
+	* Writes the tool's raw output to the log file and reads its failure
+	* summary from it, and shows progress from `display`, a formatter's
+	* output of it such as xcbeautify's, or from the raw output without one.
+	*/
+	async processStream(input, { display } = {}) {
 		if (!this.logWriter) throw new Error("BuildLogger has not been started. Call start() first.");
 		const progressInput = new PassThrough();
 		const logInput = new PassThrough();
-		input.pipe(progressInput);
+		const summaryInput = new PassThrough();
+		(display ?? input).pipe(progressInput);
 		input.pipe(logInput);
-		await Promise.all([this.consumeProgressStream(progressInput), this.logWriter.writeStream(logInput)]);
+		input.pipe(summaryInput);
+		await Promise.all([
+			this.consumeProgressStream(progressInput),
+			this.logWriter.writeStream(logInput),
+			this.consumeSummaryStream(summaryInput)
+		]);
+	}
+	/** The build log, relative to the project, or null without one. */
+	get logPath() {
+		return this.logWriter?.logFilePath ? path.relative(getCwd(), this.logWriter.logFilePath) : null;
+	}
+	/**
+	* The lines of the raw output a failure prints: the ones the config's
+	* `failureSummary` keeps, deduplicated, or the last lines without any.
+	*/
+	get failureSummary() {
+		const lines = this.summaryLines.length ? this.summaryLines : this.tailLines.filter((line) => line.trim());
+		const first = lines.findIndex((line) => line.trim());
+		const last = lines.findLastIndex((line) => line.trim());
+		return first === -1 ? [] : lines.slice(first, last + 1);
+	}
+	async consumeSummaryStream(input) {
+		const lineReader = createInterface({
+			input,
+			crlfDelay: Infinity,
+			terminal: false
+		});
+		for await (const rawLine of lineReader) this.processSummaryLine(stripAnsi(rawLine).replace(/\r/g, "").trimEnd());
+	}
+	processSummaryLine(line) {
+		this.tailLines.push(line);
+		if (this.tailLines.length > TAIL_LINES) this.tailLines.shift();
+		const { lines, blocks } = this.config.failureSummary;
+		const trimmedLine = line.trim();
+		if (this.openBlock) {
+			if (matchesSummaryPattern(trimmedLine, this.openBlock.end)) {
+				if (this.openBlock.includeEnd) this.keepSummaryLine(line);
+				this.openBlock = void 0;
+			} else this.keepSummaryLine(line);
+			return;
+		}
+		const block = blocks.find(({ start }) => matchesSummaryPattern(trimmedLine, start));
+		if (block) {
+			this.openBlock = block;
+			this.keepSummaryLine(line);
+			return;
+		}
+		if (lines.some((pattern) => matchesSummaryPattern(trimmedLine, pattern))) this.keepSummaryLine(line);
+	}
+	keepSummaryLine(line) {
+		if (this.summaryLines.length >= MAX_SUMMARY_LINES || line.trim() && this.summaryLines.includes(line)) return;
+		this.summaryLines.push(line);
 	}
 	async consumeProgressStream(input) {
 		const lineReader = createInterface({
@@ -22855,9 +23098,13 @@ var BuildLogger = class {
 		if (!this.state.started || this.state.stopped) return;
 		if (success) this.finishRemainingProgress();
 		const finalMessage = message || (success ? "Build completed successfully" : "Build failed");
-		if (success) this.promptProgress.stop(finalMessage);
-		else this.promptProgress.error(finalMessage);
-		this.showLogFileLocation();
+		if (success) {
+			this.promptProgress.stop(finalMessage);
+			this.showLogFileLocation();
+		} else {
+			this.promptProgress.error(finalMessage);
+			this.showFailureSummary();
+		}
 		this.state = {
 			...this.state,
 			stopped: true
@@ -22897,6 +23144,16 @@ var BuildLogger = class {
 			patterns: this.config.importantLogPatterns
 		});
 	}
+	/**
+	* Prints the failure summary and the log's path to stderr, so a `--json`
+	* command's stdout stays its JSON.
+	*/
+	showFailureSummary() {
+		const summary = this.failureSummary;
+		const logPath = this.logPath;
+		const message = [...summary, ...logPath ? [...summary.length ? [""] : [], `Build log: ${logPath}`] : []].join("\n");
+		if (message) p.log.error(message, { output: process.stderr });
+	}
 	showLogFileLocation() {
 		if (!this.logWriter?.logFilePath) return;
 		const relativePath = path.relative(getCwd(), this.logWriter.logFilePath);
@@ -24925,28 +25182,651 @@ const printBanner = (version) => {
 	console.log(banner(version));
 };
 //#endregion
+//#region src/initOptions.ts
+var InitError = class extends Error {
+	name = "InitError";
+};
+var MissingInitInputsError = class extends InitError {
+	missingInputs;
+	name = "MissingInitInputsError";
+	constructor(missingInputs) {
+		super(["Init is missing required inputs:", ...missingInputs.map((input) => `- ${input}`)].join("\n"));
+		this.missingInputs = missingInputs;
+	}
+};
+var InitEnvFileError = class extends InitError {
+	name = "InitEnvFileError";
+};
+var LegacyInfrastructureError = class extends InitError {
+	name = "LegacyInfrastructureError";
+	constructor(provider, resource) {
+		super(`${provider} v0 infrastructure was detected at ${resource}. Hot Updater v1 cannot upgrade it in place. Run init with new provider resources and ship the new endpoint in a new native build. The existing infrastructure was not changed.`);
+	}
+};
+const assertInitInputs = ({ inputs, strict }) => {
+	if (!strict) return;
+	const missingInputs = getMissingInitInputs(inputs);
+	if (missingInputs.length > 0) throw new MissingInitInputsError(missingInputs);
+};
+const getMissingInitInputs = (inputs) => Object.entries(inputs).filter(([, value]) => !value?.trim()).map(([key]) => key);
+//#endregion
+//#region src/hotUpdaterEnv.ts
+const HOT_UPDATER_ENV_PATH = ".env.hotupdater";
+const unquoteEnvValue = (value) => {
+	const trimmed = value.trim();
+	if (trimmed.startsWith("\"") && trimmed.endsWith("\"")) try {
+		const parsed = JSON.parse(trimmed);
+		return typeof parsed === "string" ? parsed : trimmed.slice(1, -1);
+	} catch {
+		return trimmed.slice(1, -1);
+	}
+	return trimmed.startsWith("'") && trimmed.endsWith("'") ? trimmed.slice(1, -1) : trimmed;
+};
+const parseEnv$1 = (content) => {
+	const env = {};
+	for (const line of content.split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed || trimmed.startsWith("#") || !trimmed.includes("=")) continue;
+		const separatorIndex = trimmed.indexOf("=");
+		const key = trimmed.slice(0, separatorIndex).trim();
+		if (key) env[key] = unquoteEnvValue(trimmed.slice(separatorIndex + 1));
+	}
+	return env;
+};
+const readEnvFile = async (filePath, allowMissing) => {
+	let content;
+	try {
+		content = await fs$1.readFile(filePath, "utf-8");
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+			if (allowMissing) return {};
+			throw new InitEnvFileError(`Init environment file not found: ${filePath}`);
+		}
+		throw error;
+	}
+	return parseEnv$1(content);
+};
+const getHotUpdaterInitInputEnv = ({ env, managedEnv }, nonInteractive) => nonInteractive ? env : managedEnv;
+const readHotUpdaterInitEnv = async (cwd, envFile) => {
+	const savedEnvPath = path.resolve(cwd, HOT_UPDATER_ENV_PATH);
+	const savedEnv = await readEnvFile(savedEnvPath, true);
+	if (!envFile) return {
+		env: {},
+		managedEnv: savedEnv
+	};
+	const inputEnvPath = path.resolve(cwd, envFile);
+	if (inputEnvPath === savedEnvPath) return {
+		env: savedEnv,
+		managedEnv: savedEnv
+	};
+	const inputEnv = await readEnvFile(inputEnvPath, false);
+	return {
+		env: {
+			...savedEnv,
+			...inputEnv
+		},
+		inputEnv,
+		managedEnv: savedEnv
+	};
+};
+/** `key`'s own value in `record`, never a member such as `__proto__`. */
+const ownValue = (record, key) => Object.hasOwn(record, key) ? record[key] : void 0;
+const getHotUpdaterEnvValue = (env, key) => {
+	const fromProcess = ownValue(process.env, key);
+	if (fromProcess !== void 0) return fromProcess.trim() || void 0;
+	return ownValue(env, key)?.trim() || void 0;
+};
+/**
+* An env file's variables as `process.loadEnvFile` sets them, the way
+* `hot-updater.config.ts` loads `.env.hotupdater`: inline comments, quotes,
+* and `export` prefixes included.
+*/
+const parseLoadedEnv = (content) => Object.fromEntries(Object.entries(parseEnv(content)).filter((entry) => entry[1] !== void 0));
+/** `cwd`'s `.env.hotupdater` as the config loads it; empty when there is none. */
+const readLoadedHotUpdaterEnv = async (cwd) => {
+	try {
+		return parseLoadedEnv(await fs$1.readFile(path.resolve(cwd, HOT_UPDATER_ENV_PATH), "utf-8"));
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return {};
+		throw error;
+	}
+};
+//#endregion
+//#region src/localKeyStore.ts
+/**
+* Relocates Hot Updater's per-user directory, `~/.hot-updater` by default,
+* such as for CI caches or tests.
+*/
+const HOT_UPDATER_HOME_ENV = "HOT_UPDATER_HOME";
+/** Hot Updater's per-user directory: `$HOT_UPDATER_HOME`, else `~/.hot-updater`. */
+const getHotUpdaterHome = () => {
+	const home = process.env[HOT_UPDATER_HOME_ENV]?.trim();
+	return home ? path$1.resolve(home) : path$1.join(os.homedir(), ".hot-updater");
+};
+const git = (cwd, args) => {
+	try {
+		return execFileSync("git", args, {
+			cwd,
+			encoding: "utf-8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			],
+			timeout: 1e4
+		}).trim();
+	} catch {
+		return;
+	}
+};
+const realpath = (directory) => {
+	try {
+		return realpathSync(directory);
+	} catch {
+		return path$1.resolve(directory);
+	}
+};
+/**
+* The project's directory name in the store: the project directory's name
+* and the first 12 hex digits of the SHA-256 of its real path, such as
+* `my-app-3f2a9c1d04be`. Each checkout of an app has its own.
+*/
+const getProjectKey = (cwd) => {
+	const directory = realpath(cwd);
+	return `${path$1.basename(directory).replace(/[^A-Za-z0-9._-]/gu, "-").replace(/^[.-]+/u, "").slice(0, 40) || "project"}-${createHash("sha256").update(directory).digest("hex").slice(0, 12)}`;
+};
+/**
+* The directory `localSecrets()` keeps a project's secrets in without a
+* `path`: `<home>/secrets/<project-key>` (`getHotUpdaterHome`,
+* `getProjectKey`).
+*/
+const getLocalKeyStoreDir = (cwd) => path$1.join(getHotUpdaterHome(), "secrets", getProjectKey(cwd));
+/**
+* `localSecrets({ path })`'s directory: `~` is the home directory, and a
+* relative path is the project's (`cwd`).
+*/
+const resolveLocalSecretsPath = (value, cwd) => {
+	if (value === "~") return os.homedir();
+	if (value.startsWith("~/") || value.startsWith("~\\")) return path$1.join(os.homedir(), value.slice(2));
+	return path$1.resolve(cwd, value);
+};
+const isMissing = (error) => error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
+/** `target`'s real path, through its nearest parent that exists. */
+const realpathThroughParents = (target) => {
+	const missing = [];
+	let current = target;
+	for (;;) try {
+		return path$1.join(realpathSync(current), ...missing.reverse());
+	} catch {
+		const parent = path$1.dirname(current);
+		if (parent === current) return target;
+		missing.push(path$1.basename(current));
+		current = parent;
+	}
+};
+/** Whether git ignores `directory`, a path in the work tree at `root`. */
+const isIgnoredByGit = (root, directory) => {
+	const relative = path$1.relative(root, directory).split(path$1.sep).join("/");
+	return spawnSync("git", [
+		"check-ignore",
+		"--quiet",
+		"--",
+		`${relative}/`
+	], {
+		cwd: root,
+		stdio: "ignore",
+		timeout: 1e4
+	}).status === 0;
+};
+/**
+* Refuses a directory secrets must not go in: a path that exists and is no
+* directory, or one in a git work tree that git does not ignore, whose
+* secrets could be committed.
+*/
+const assertPrivateDirectory = async (directory) => {
+	const stats = await fs$2.stat(directory).catch((error) => {
+		if (isMissing(error)) return void 0;
+		throw error;
+	});
+	if (stats && !stats.isDirectory()) throw new Error(`localSecrets() keeps secrets in a directory, and ${directory} is not one. Set its path to a directory.`);
+	const real = realpathThroughParents(directory);
+	let probe = real;
+	while (!existsSync(probe) && path$1.dirname(probe) !== probe) probe = path$1.dirname(probe);
+	const root = git(probe, ["rev-parse", "--show-toplevel"]);
+	if (!root) return;
+	const top = realpath(root);
+	if (isIgnoredByGit(top, real)) return;
+	throw new Error(`localSecrets() refuses ${directory}: it is in the git repository ${top}, which does not ignore it, so the secrets in it could be committed. Add ${path$1.relative(top, real).split(path$1.sep).join("/")}/ to that repository's .gitignore, or keep the secrets outside it with localSecrets({ path }).`);
+};
+/** Makes `directory` 0700, and every directory it creates on the way. */
+const makePrivateDirectory = async (directory) => {
+	await fs$2.mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	if (process.platform !== "win32") await fs$2.chmod(directory, 448);
+};
+/**
+* The store `localSecrets({ path })` reads and writes: `path`, or
+* `getLocalKeyStoreDir` without one. Its first use refuses a directory
+* secrets must not go in (`assertPrivateDirectory`).
+*/
+const createLocalSecretsStore = ({ path: configured } = {}) => {
+	const checked = /* @__PURE__ */ new Map();
+	const directory = (cwd) => configured === void 0 ? getLocalKeyStoreDir(cwd) : resolveLocalSecretsPath(configured, cwd);
+	const check = (target) => {
+		let pending = checked.get(target);
+		if (!pending) {
+			pending = assertPrivateDirectory(target);
+			checked.set(target, pending);
+			pending.catch(() => checked.delete(target));
+		}
+		return pending;
+	};
+	const file = (name, cwd) => path$1.join(directory(cwd), `${name}.json`);
+	return {
+		directory,
+		file,
+		read: async (name, cwd) => {
+			await check(directory(cwd));
+			try {
+				return await fs$2.readFile(file(name, cwd), "utf-8") || void 0;
+			} catch (error) {
+				if (isMissing(error)) return void 0;
+				throw error;
+			}
+		},
+		write: async (name, value, cwd) => {
+			const target = directory(cwd);
+			await check(target);
+			await makePrivateDirectory(target);
+			const destination = file(name, cwd);
+			const temporary = `${destination}.${randomUUID()}.tmp`;
+			try {
+				await fs$2.writeFile(temporary, value, {
+					mode: 384,
+					flag: "wx"
+				});
+				await fs$2.rename(temporary, destination);
+			} catch (error) {
+				await fs$2.rm(temporary, { force: true });
+				throw error;
+			}
+			return destination;
+		}
+	};
+};
+const defaultStore = createLocalSecretsStore();
+/** The file `localSecrets()` without a `path` keeps `name` in. */
+const getLocalKeyFile = (name, cwd) => defaultStore.file(name, cwd);
+/** `name`'s value in `localSecrets()`'s default store, or undefined. */
+const readLocalKey = (name, cwd) => defaultStore.read(name, cwd);
+/** Stores `value` as `name` in `localSecrets()`'s default store. */
+const writeLocalKey = (name, value, cwd) => defaultStore.write(name, value, cwd);
+//#endregion
+//#region src/credentialEnvNames.ts
+/**
+* The environment variables that override each kind, one entry per field.
+* A field with two names takes a file path or the file's contents; the path
+* wins when both are set.
+*/
+const CREDENTIAL_ENV_NAMES = {
+	"asc-api-key": [
+		["HOT_UPDATER_ASC_KEY_PATH", "HOT_UPDATER_ASC_KEY"],
+		["HOT_UPDATER_ASC_KEY_ID"],
+		["HOT_UPDATER_ASC_ISSUER_ID"]
+	],
+	"android-keystore": [
+		["HOT_UPDATER_ANDROID_KEYSTORE_PATH", "HOT_UPDATER_ANDROID_KEYSTORE_BASE64"],
+		["HOT_UPDATER_ANDROID_KEYSTORE_PASSWORD"],
+		["HOT_UPDATER_ANDROID_KEY_ALIAS"],
+		["HOT_UPDATER_ANDROID_KEY_PASSWORD"]
+	],
+	"play-service-account": [["HOT_UPDATER_PLAY_SERVICE_ACCOUNT_PATH", "HOT_UPDATER_PLAY_SERVICE_ACCOUNT_JSON"]]
+};
+//#endregion
+//#region src/reservedVariables.ts
+/**
+* Variables that change how a process loads code or which credentials Hot
+* Updater uses, compared case-insensitively, as Windows and npm read them.
+*/
+const RESERVED_NAMES = /* @__PURE__ */ new Set([
+	"PATH",
+	"BASH_ENV",
+	"ENV",
+	"JAVA_TOOL_OPTIONS",
+	"_JAVA_OPTIONS",
+	"JDK_JAVA_OPTIONS",
+	"GRADLE_OPTS",
+	"RUBYOPT",
+	"RUBYLIB",
+	"PYTHONPATH",
+	"PYTHONSTARTUP",
+	"PERL5OPT",
+	...Object.values(CREDENTIAL_ENV_NAMES).flat(2),
+	"HOT_UPDATER_SIGNING_TOKEN",
+	"HOT_UPDATER_HOME"
+]);
+const RESERVED_PREFIXES = [
+	"LD_",
+	"DYLD_",
+	"GIT_",
+	"NPM_CONFIG_",
+	"HOT_UPDATER_GOOGLE_OAUTH_CLIENT_"
+];
+/**
+* Whether `name` is a variable no secret may set: one a loader or
+* interpreter reads (`NODE_*` but `NODE_ENV`, `PATH`, `LD_*`, `DYLD_*`,
+* `BASH_ENV`, `ENV`, `GIT_*`, `npm_config_*`, the JVM's, Gradle's, Ruby's,
+* Python's, and Perl's options), or one Hot Updater reads its credentials
+* from. `secretEnv` refuses these names, and so does every environment the
+* CLI gives a child process from resolved secrets.
+*/
+const isReservedVariableName = (name) => {
+	const upper = name.toUpperCase();
+	return RESERVED_NAMES.has(upper) || upper.startsWith("NODE_") && upper !== "NODE_ENV" || RESERVED_PREFIXES.some((prefix) => upper.startsWith(prefix));
+};
+/**
+* Throws when `env`, an environment the CLI gives a child process from
+* resolved secrets, sets a reserved variable, naming it and `what` sets it.
+* Returns `env`.
+*/
+const assertUnreservedEnv = (env, what) => {
+	const reserved = Object.keys(env).filter(isReservedVariableName);
+	if (reserved.length > 0) throw new Error(`${what} would set ${reserved.join(", ")}, which no secret may set: ${reserved.length === 1 ? "it changes" : "they change"} how a process loads code or which credentials Hot Updater uses.`);
+	return env;
+};
+//#endregion
+//#region src/secrets.ts
+const ENV_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/u;
+/** A secret's name, as `secret:<name>` takes one. */
+const SECRET_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+const SECRET_REFERENCE_PREFIX = "secret:";
+/** Whether `name` is a secret's name, as `secret:<name>` takes one. */
+const isSecretName = (name) => SECRET_NAME_PATTERN.test(name);
+/**
+* The secret name a config's `secret:<name>` reference names, such as
+* `release-keystore` for `"secret:release-keystore"`. `field` is the config
+* field the reference is in, which the error names.
+*/
+const parseSecretReference = (reference, field) => {
+	const name = reference.startsWith(SECRET_REFERENCE_PREFIX) ? reference.slice(7) : void 0;
+	if (name === void 0 || !SECRET_NAME_PATTERN.test(name)) throw new Error(`${field} names a secret as secret:<name>, such as "secret:release-keystore", and ${JSON.stringify(reference)} is not one.`);
+	return name;
+};
+/**
+* The environment variable the default store reads a secret from: a name
+* that is a variable name already, such as `CLOUDFLARE_API_TOKEN`, as it
+* is, and any other, such as `asc-api-key`, upper-cased with `HOT_UPDATER_`
+* before it and every character but letters and digits as `_`
+* (`HOT_UPDATER_ASC_API_KEY`).
+*/
+const secretVariableName = (name) => ENV_NAME_PATTERN.test(name) ? name : `HOT_UPDATER_${name.toUpperCase().replace(/[^A-Z0-9]/gu, "_")}`;
+/** `name` from its variable in `process.env` or the project's `.env.hotupdater`. */
+const readSecretVariables = async (names, cwd) => {
+	const fileEnv = await readLoadedHotUpdaterEnv(cwd);
+	const values = Object.create(null);
+	for (const name of names) values[name] = getHotUpdaterEnvValue(fileEnv, secretVariableName(name));
+	return values;
+};
+/** `localSecrets()`'s name, the `secrets` adapter when the config sets none. */
+const LOCAL_SECRETS_NAME = "localSecrets";
+const LOCAL_KEY_STORE = Symbol.for("@hot-updater/cli-tools/local-key-store");
+/** `localSecrets()`'s store without a `path`, the one after any adapter. */
+const defaultLocalSecretsStore = createLocalSecretsStore();
+const isLocalKeyStoreSecrets = (secrets) => LOCAL_KEY_STORE in secrets;
+/**
+* Secrets in JSON files on this machine, the `secrets` adapter when the
+* config sets none: `get` reads each name from its environment variable
+* (`secretVariableName`, in `process.env` or `.env.hotupdater`), then from
+* `~/.hot-updater/secrets/<project-key>/<name>.json`; `set` writes that
+* file, 0600 in a 0700 directory, outside the project, so it survives
+* `node_modules` and is never committed. `HOT_UPDATER_HOME` moves
+* `~/.hot-updater`. The project key is the same for every clone of one app
+* on a machine (its `origin` remote and its directory in the repository),
+* so another machine signs in and issues a key of its own.
+*
+* @example
+* export default defineConfig({ secrets: localSecrets(), ... });
+*/
+const localSecrets = (options = {}) => createLocalKeyStoreSecrets(void 0, createLocalSecretsStore(options));
+/**
+* The config's `secrets` adapter with `localSecrets()`'s store after it:
+* `get` reads each name the adapter does not hold from
+* `~/.hot-updater/secrets/<project-key>/<name>.json`, and `set` stores there
+* when the adapter stores nothing. Without an adapter, it is
+* `localSecrets()` itself. Keys Hot Updater issues, and credentials
+* `secrets put` imports, are reused by the next build on this machine with
+* no step in between.
+*/
+const withLocalKeyStore = (configured) => configured && isLocalKeyStoreSecrets(configured) ? configured : createLocalKeyStoreSecrets(configured, defaultLocalSecretsStore);
+const createLocalKeyStoreSecrets = (configured, store) => {
+	const describeFile = (name) => store.file(name, getCwd());
+	return {
+		name: configured?.name ?? "localSecrets",
+		[LOCAL_KEY_STORE]: configured ? {
+			configured,
+			store
+		} : { store },
+		get: async (names, context) => {
+			const values = configured ? { ...await configured.get(names, context) } : await readSecretVariables(names, context.cwd);
+			const read = Object.create(null);
+			for (const name of names) {
+				const value = Object.hasOwn(values, name) ? values[name] : void 0;
+				read[name] = typeof value === "string" && value ? value : await store.read(name, context.cwd);
+			}
+			return read;
+		},
+		set: async (name, value, context) => {
+			if (configured?.set) {
+				await configured.set(name, value, context);
+				if (await store.read(name, context.cwd) === void 0) return;
+				try {
+					await store.write(name, value, context.cwd);
+				} catch (error) {
+					p.log.warn(`The ${configured.name} secrets adapter stored ${name}, and the copy on this machine at ${store.file(name, context.cwd)} still holds the value it replaced: ${error instanceof Error ? error.message : String(error)}. Delete that file.`);
+				}
+				return;
+			}
+			await store.write(name, value, context.cwd);
+		},
+		describe: (name) => configured ? `${describeSecret(configured, name)}, or ${describeFile(name)} on this machine` : `${secretVariableName(name)} in the environment, or ${describeFile(name)} on this machine`
+	};
+};
+/**
+* The `localSecrets()` store `secrets` reads after its adapter, and stores
+* in when the adapter stores nothing: `localSecrets({ path })`'s, else the
+* default one.
+*/
+const getLocalSecretsStore = (secrets) => isLocalKeyStoreSecrets(secrets) ? secrets[LOCAL_KEY_STORE].store : defaultLocalSecretsStore;
+/**
+* The config's own `secrets` adapter, without `localSecrets()`'s store
+* after it: undefined for `localSecrets()`, and when the config sets none.
+* `secretEnv` reads deploy credentials from it.
+*/
+const getConfiguredAdapter = (secrets) => isLocalKeyStoreSecrets(secrets) ? secrets[LOCAL_KEY_STORE].configured : secrets;
+/**
+* Where `secrets.set` stores `name`, for messages: the config's adapter
+* when it stores values, else `localSecrets()`'s file.
+*/
+const describeStoredSecret = (secrets, name) => {
+	const configured = getConfiguredAdapter(secrets);
+	return configured?.set ? describeSecret(configured, name) : getLocalSecretsStore(secrets).file(name, getCwd());
+};
+/**
+* Whether a key `secrets` stores stays on this machine: it is `localSecrets()`,
+* whose files no other machine reads.
+*/
+const keepsKeysOnThisMachine = (secrets) => getConfiguredAdapter(secrets) === void 0;
+const CONFIGURED_SECRETS = Symbol.for("@hot-updater/cli-tools/secrets");
+const LOADING_SCOPE = Symbol.for("@hot-updater/cli-tools/secrets-scope");
+/**
+* Evaluates a config, the file or a config function, with `scope` as the
+* scope of every `secretEnv` it creates, so each reads the `secrets` of the
+* config that created it, whatever config loads after. It is kept on
+* `globalThis`: the config file loads its own copy of Hot Updater's modules.
+*/
+const withSecretsScope = async (scope, evaluate) => {
+	const slot = globalThis;
+	const previous = slot[LOADING_SCOPE];
+	slot[LOADING_SCOPE] = scope;
+	try {
+		return await evaluate();
+	} finally {
+		slot[LOADING_SCOPE] = previous;
+	}
+};
+/**
+* Makes `secrets` the adapter a credential resolver reads from by default,
+* and a `secretEnv` created outside any config load, as `loadConfig` does
+* with the config's. It is kept on `globalThis`: the config file loads Hot
+* Updater's modules again, as its own copies.
+*/
+const setConfiguredSecrets = (secrets) => {
+	globalThis[CONFIGURED_SECRETS] = secrets;
+};
+/**
+* The config's `secrets` adapter with `localSecrets()`'s store after it
+* (`withLocalKeyStore`), `localSecrets()` until a config loads.
+*/
+const getConfiguredSecrets = () => globalThis[CONFIGURED_SECRETS] ?? localSecrets();
+/** Where an adapter keeps `name`, for messages. */
+const describeSecret = (secrets, name) => secrets.describe?.(name) ?? `${name} in ${secrets.name}`;
+const list = (names) => names.length <= 2 ? names.join(" and ") : `${names.slice(0, -1).join(", ")}, and ${names.at(-1)}`;
+/**
+* Environment variables from the `secrets` adapter of the config that
+* creates it, as a function a config calls when an adapter needs them, so loading
+* `hot-updater.config.ts` reads no secret. Each name set in the environment
+* or `.env.hotupdater` wins; the others are read from the config's
+* `secrets` adapter in one call, and without one they must be set. The values go only to the caller: they are never set in
+* `process.env`, and are masked in the CLI's logs. Names a loader or
+* interpreter reads, such as `NODE_OPTIONS`, are refused.
+*
+* @example
+* const deploy = secretEnv(["S3_ACCESS_KEY_ID", "S3_SECRET_ACCESS_KEY"]);
+* s3Storage({
+*   bucketName: "bundles",
+*   region: "us-east-1",
+*   credentials: async () => {
+*     const env = await deploy();
+*     return {
+*       accessKeyId: env.S3_ACCESS_KEY_ID,
+*       secretAccessKey: env.S3_SECRET_ACCESS_KEY,
+*     };
+*   },
+* });
+*/
+const secretEnv = (names) => {
+	const wanted = [...new Set(names)];
+	const invalid = wanted.filter((name) => !ENV_NAME_PATTERN.test(name));
+	if (invalid.length > 0) throw new Error(`secretEnv takes environment variable names: letters, digits, and underscores, not starting with a digit, and ${invalid.map((name) => JSON.stringify(name)).join(", ")} ${invalid.length === 1 ? "is" : "are"} not.`);
+	const reserved = wanted.filter(isReservedVariableName);
+	if (reserved.length > 0) throw new Error(`secretEnv refuses ${list(reserved)}: ${reserved.length === 1 ? "it changes" : "they change"} how a process loads code or which credentials Hot Updater uses.`);
+	const scope = globalThis[LOADING_SCOPE];
+	return async () => {
+		const cwd = getCwd();
+		const fileEnv = await readLoadedHotUpdaterEnv(cwd);
+		const variables = Object.create(null);
+		const fromStore = [];
+		for (const name of wanted) {
+			const value = getHotUpdaterEnvValue(fileEnv, name);
+			if (value === void 0) fromStore.push(name);
+			else variables[name] = value;
+		}
+		if (fromStore.length > 0) {
+			const secrets = getConfiguredAdapter(scope?.secrets ?? getConfiguredSecrets());
+			const read = secrets ? await secrets.get(fromStore, { cwd }) : {};
+			const missing = fromStore.filter((name) => {
+				const value = Object.hasOwn(read, name) ? read[name] : void 0;
+				if (typeof value !== "string" || value === "") return true;
+				variables[name] = value;
+				return false;
+			});
+			if (missing.length > 0) {
+				const them = missing.length === 1 ? "it" : "them";
+				throw new Error(secrets === void 0 ? `secretEnv found no value for ${list(missing)}: set ${them} in the environment or .env.hotupdater, or read ${them} from a secrets store with the config's secrets.` : `secretEnv found no value for ${list(missing)}: ${missing.length === 1 ? "it is" : "they are"} not set in the environment or .env.hotupdater, and the ${secrets.name} secrets adapter does not hold ${them} (${missing.map((name) => describeSecret(secrets, name)).join("; ")}).`);
+			}
+		}
+		for (const value of Object.values(variables)) registerSecretValue(value);
+		return Object.freeze(variables);
+	};
+};
+//#endregion
 //#region src/localBundleSigning.ts
+/** The secret `keys generate --secret` stores the private key as by default. */
+const DEFAULT_SIGNING_KEY_SECRET = "bundle-signing-key";
+/**
+* A local signing failure whose message the CLI prints as it is: it names
+* the secret and how to store it, and quotes no key material.
+*/
+var LocalSigningKeyError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "HotUpdaterLocalSigningKeyError";
+	}
+};
 const resolvePath$1 = (cwd, filePath) => path$1.isAbsolute(filePath) ? filePath : path$1.resolve(cwd, filePath);
-const loadPrivateKey = async (privateKeyPath) => {
+const parsePrivateKey = (pem) => {
 	try {
-		const privateKey = crypto$1.createPrivateKey(await fs$2.readFile(privateKeyPath, "utf8"));
+		const privateKey = crypto$1.createPrivateKey(pem);
 		if (privateKey.asymmetricKeyType !== "rsa" || (privateKey.asymmetricKeyDetails?.modulusLength ?? 0) < 2048) throw new Error("not rsa");
 		return privateKey;
 	} catch {
 		throw new Error("Failed to load the local bundle signing private key.");
 	}
 };
-const createLocalSigningAdapter = ({ privateKeyPath }) => {
+const loadPrivateKeyFile = async (privateKeyPath) => {
+	let pem;
+	try {
+		pem = await fs$2.readFile(privateKeyPath, "utf8");
+	} catch {
+		throw new Error("Failed to load the local bundle signing private key.");
+	}
+	return parsePrivateKey(pem);
+};
+/**
+* The private key the `secrets` adapter holds as `name`: masked in the CLI's
+* output before it is parsed, and kept only as a key object. A PEM written
+* on one line, with `\n` for its line breaks, as a `.env.hotupdater` value
+* or a CI variable may hold it, reads as the PEM.
+*/
+const loadPrivateKeySecret = async (secrets, name, cwd) => {
+	let value;
+	try {
+		const read = await secrets.get([name], { cwd });
+		value = Object.hasOwn(read, name) ? read[name] : void 0;
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : String(error);
+		throw new LocalSigningKeyError(`The ${secrets.name} secrets adapter could not read the bundle signing key ${name}: ${reason}`, { cause: error });
+	}
+	if (typeof value !== "string" || !value.trim()) throw new LocalSigningKeyError(`signing.privateKey reads the bundle signing key ${name}, which is not in the ${secrets.name} secrets adapter (${describeSecret(secrets, name)}). Set it to the RSA private key in PEM, or generate a key pair with \`npx hot-updater keys generate --secret ${name}\`.`);
+	registerSecretValue(value);
+	const pem = value.includes("\n") ? value : value.replaceAll("\\n", "\n");
+	if (pem !== value) registerSecretValue(pem);
+	try {
+		return parsePrivateKey(pem);
+	} catch {
+		throw new LocalSigningKeyError(`The bundle signing key ${name} in the ${secrets.name} secrets adapter is not an RSA private key in PEM of at least 2048 bits.`);
+	}
+};
+/**
+* The built-in local signer. Its private key is read on first use, once:
+* from `privateKeyPath`, or from the config's `secrets` adapter for
+* `privateKey: "secret:<name>"`, and is never written anywhere.
+*/
+const createLocalSigningAdapter = (config, { secrets } = {}) => {
 	const privateKeys = /* @__PURE__ */ new Map();
+	const { privateKeyPath } = config;
+	const secretName = privateKeyPath === void 0 ? parseSecretReference(config.privateKey, "signing.privateKey") : void 0;
 	const getPrivateKey = (cwd = process.cwd()) => {
-		const resolvedPath = resolvePath$1(cwd, privateKeyPath);
-		const cached = privateKeys.get(resolvedPath);
+		const cacheKey = privateKeyPath === void 0 ? "" : resolvePath$1(cwd, privateKeyPath);
+		const cached = privateKeys.get(cacheKey);
 		if (cached) return cached;
-		const pending = loadPrivateKey(resolvedPath).catch((error) => {
-			privateKeys.delete(resolvedPath);
+		const pending = (secretName === void 0 ? loadPrivateKeyFile(cacheKey) : loadPrivateKeySecret(secrets ?? getConfiguredSecrets(), secretName, cwd)).catch((error) => {
+			privateKeys.delete(cacheKey);
 			throw error;
 		});
-		privateKeys.set(resolvedPath, pending);
+		privateKeys.set(cacheKey, pending);
 		return pending;
 	};
 	return {
@@ -24965,25 +25845,48 @@ const createLocalSigningAdapter = ({ privateKeyPath }) => {
 		}
 	};
 };
+/**
+* The `secrets` adapter of the config each normalized `privateKey` config
+* came from, so a config function's per-platform configs each read their
+* own store, whichever config loaded last.
+*/
+const signingSecrets = /* @__PURE__ */ new WeakMap();
+/** The `secrets` adapter `normalizeSigningConfig` bound `signing` to. */
+const getSigningSecrets = (signing) => signingSecrets.get(signing);
 const invalidSigningConfig = () => /* @__PURE__ */ new Error("Bundle signing must be a local key config or signing adapter. Omit signing to disable it.");
-const normalizeSigningConfig = (signing) => {
+const normalizeSigningConfig = (signing, { secrets } = {}) => {
 	if (signing === void 0) return void 0;
 	if (typeof signing !== "object" || signing === null) throw invalidSigningConfig();
-	const hasPrivateKeyPath = Reflect.has(signing, "privateKeyPath");
-	const hasEnabled = Reflect.has(signing, "enabled");
+	const hasLocalFields = [
+		"enabled",
+		"privateKeyPath",
+		"privateKey"
+	].some((key) => Reflect.has(signing, key));
 	const hasPluginMembers = [
 		"name",
 		"getPublicKey",
 		"sign"
 	].some((key) => Reflect.has(signing, key));
-	if ((hasPrivateKeyPath || hasEnabled) && hasPluginMembers) throw new Error("Bundle signing config cannot combine local signing fields with signing adapter fields.");
+	if (hasLocalFields && hasPluginMembers) throw new Error("Bundle signing config cannot combine local signing fields with signing adapter fields.");
 	if (!hasPluginMembers) {
-		if (Object.keys(signing).some((key) => key !== "enabled" && key !== "privateKeyPath")) throw new Error("Local bundle signing accepts only enabled and privateKeyPath.");
+		if (Object.keys(signing).some((key) => key !== "enabled" && key !== "privateKeyPath" && key !== "privateKey")) throw new Error("Local bundle signing accepts only enabled, and privateKeyPath or privateKey.");
 		const enabled = Reflect.get(signing, "enabled");
 		if (enabled === false) return void 0;
 		if (enabled !== true) throw invalidSigningConfig();
 		const privateKeyPath = Reflect.get(signing, "privateKeyPath");
-		if (typeof privateKeyPath !== "string" || !privateKeyPath.trim()) throw new Error("Enabled local bundle signing requires privateKeyPath.");
+		const privateKey = Reflect.get(signing, "privateKey");
+		if (privateKeyPath !== void 0 && privateKey !== void 0) throw new Error("Local bundle signing takes its private key from privateKeyPath or from privateKey, not both.");
+		if (privateKey !== void 0) {
+			if (typeof privateKey !== "string") throw new Error("signing.privateKey names a secret as secret:<name>, such as \"secret:bundle-signing-key\".");
+			parseSecretReference(privateKey, "signing.privateKey");
+			const normalized = {
+				enabled: true,
+				privateKey
+			};
+			if (secrets) signingSecrets.set(normalized, secrets);
+			return normalized;
+		}
+		if (typeof privateKeyPath !== "string" || !privateKeyPath.trim()) throw new Error("Enabled local bundle signing requires privateKeyPath, or privateKey as \"secret:<name>\".");
 		return {
 			enabled: true,
 			privateKeyPath
@@ -25020,13 +25923,39 @@ const readBundleSigningPublicKeyFile = async (publicKeyPath, options = {}) => {
 		throw new Error("Failed to read the bundle signing public key file.");
 	}
 };
+/**
+* `remoteSigning`'s errors with a reason it wrote itself, by name, as it may
+* come from another copy of plugin-core, and the local signer's errors that
+* name its secret. Any other signing adapter error is redacted: it may quote
+* key material.
+*/
+const REMOTE_SIGNING_ERROR_NAME = "HotUpdaterRemoteSigningError";
+const signingFailure = (summary, error) => new Error(error instanceof Error && (error.name === REMOTE_SIGNING_ERROR_NAME || error instanceof LocalSigningKeyError) ? `${summary} ${error.message}` : summary);
+/**
+* The local signer of each config's `signing` that reads its private key
+* from a secret, so the commands of one run that sign and derive the public
+* key read the secret once.
+*/
+const secretSigners = /* @__PURE__ */ new WeakMap();
+const getSigningProvider = (signing) => {
+	const normalized = normalizeSigningConfig(signing);
+	if (!normalized) return null;
+	if (!("enabled" in normalized)) return normalized;
+	if (normalized.privateKey === void 0) return createLocalSigningAdapter(normalized);
+	const key = signing;
+	const cached = secretSigners.get(key);
+	if (cached) return cached;
+	const local = createLocalSigningAdapter(normalized, { secrets: getSigningSecrets(key) });
+	secretSigners.set(key, local);
+	return local;
+};
 const getProviderPublicKey = async (provider, cwd) => {
 	try {
 		const result = await provider.getPublicKey({ cwd });
 		if (!result || typeof result.publicKey !== "string") throw new Error("invalid result");
 		return parseRsaPublicKey(result.publicKey);
-	} catch {
-		throw new Error("Failed to resolve the bundle signing provider public key.");
+	} catch (error) {
+		throw signingFailure("Failed to resolve the bundle signing provider public key.", error);
 	}
 };
 const createMemoizedSigner = ({ publicKey, sign }) => {
@@ -25041,8 +25970,8 @@ const createMemoizedSigner = ({ publicKey, sign }) => {
 			let signature;
 			try {
 				signature = await sign(new Uint8Array(message));
-			} catch {
-				throw new Error("Bundle signing provider failed to sign the file hash.");
+			} catch (error) {
+				throw signingFailure("Bundle signing provider failed to sign the file hash.", error);
 			}
 			if (!(signature instanceof Uint8Array) || signature.byteLength === 0) throw new Error("Bundle signing provider returned an invalid signature.");
 			if (!crypto$1.verify("RSA-SHA256", message, publicKey, signature)) throw new Error("Bundle signing provider returned a signature that does not match the configured public key.");
@@ -25072,18 +26001,15 @@ const preparePluginSigning = async (signing, cwd) => {
 	};
 };
 const prepareBundleSigning = async (signing, options = {}) => {
-	const normalized = normalizeSigningConfig(signing);
-	if (!normalized) return null;
-	const cwd = options.cwd ?? getCwd();
-	return preparePluginSigning("enabled" in normalized ? createLocalSigningAdapter(normalized) : normalized, cwd);
+	const provider = getSigningProvider(signing);
+	if (!provider) return null;
+	return preparePluginSigning(provider, options.cwd ?? getCwd());
 };
 /** Resolves the public identity of the configured bundle signer. */
 const getBundleSigningPublicKey = async (signing, options = {}) => {
-	const normalized = normalizeSigningConfig(signing);
-	if (!normalized) return null;
-	const cwd = options.cwd ?? getCwd();
-	const provider = "enabled" in normalized ? createLocalSigningAdapter(normalized) : normalized;
-	return exportPublicKey(await getProviderPublicKey(provider, cwd));
+	const provider = getSigningProvider(signing);
+	if (!provider) return null;
+	return exportPublicKey(await getProviderPublicKey(provider, options.cwd ?? getCwd()));
 };
 //#endregion
 //#region src/ConfigBuilder.ts
@@ -25144,7 +26070,7 @@ var ConfigBuilder = class {
 	intermediateCode = "";
 	imports = [{
 		pkg: "hot-updater",
-		named: ["defineConfig"]
+		named: ["defineConfig", "localSecrets"]
 	}, {
 		pkg: "node:fs",
 		named: ["existsSync"]
@@ -25215,6 +26141,7 @@ ${this.intermediateCode ? `${this.intermediateCode}\n\n` : ""}export default def
   storage: ${this.storageInfo.configString},
   database: ${this.databaseInfo.configString},
   ${plugins === "plugins" ? "plugins" : `plugins: ${plugins}`},
+  secrets: localSecrets(),
   updateStrategy: "appVersion", // or "fingerprint"
 });
 `.trim();
@@ -37678,6 +38605,421 @@ const createZip = async ({ outfile, targetDir, excludeExts = [] }) => {
 	return outfile;
 };
 //#endregion
+//#region src/credentialFiles.ts
+const TERMINATION_SIGNALS = [
+	"SIGHUP",
+	"SIGINT",
+	"SIGTERM"
+];
+const liveDirectories = /* @__PURE__ */ new Set();
+const onSignal = (signal) => {
+	removeLiveDirectories();
+	if (process.listenerCount(signal) === 0) process.kill(process.pid, signal);
+};
+const removeLiveDirectories = () => {
+	for (const directory of liveDirectories) rmSync(directory, {
+		force: true,
+		recursive: true
+	});
+	liveDirectories.clear();
+	stopListening();
+};
+const startListening = () => {
+	process.on("exit", removeLiveDirectories);
+	for (const signal of TERMINATION_SIGNALS) process.on(signal, onSignal);
+};
+const stopListening = () => {
+	process.off("exit", removeLiveDirectories);
+	for (const signal of TERMINATION_SIGNALS) process.off(signal, onSignal);
+};
+const trackDirectory = (directory) => {
+	if (liveDirectories.size === 0) startListening();
+	liveDirectories.add(directory);
+};
+const untrackDirectory = (directory) => {
+	if (liveDirectories.delete(directory) && liveDirectories.size === 0) stopListening();
+};
+/**
+* Creates the temporary files of one credential resolver: a `mkdtemp`
+* directory, created on the first write and removed by `dispose` or, if the
+* process exits first, on `exit` or a termination signal.
+*/
+const createCredentialFiles = () => {
+	let directory;
+	let disposal;
+	const ensureDirectory = () => {
+		directory ??= fs$2.mkdtemp(path$1.join(os.tmpdir(), "hot-updater-credentials-")).then((created) => {
+			trackDirectory(created);
+			return created;
+		});
+		return directory;
+	};
+	return {
+		write: async (fileName, contents) => {
+			if (disposal) throw new Error("The credential files have been disposed.");
+			if (typeof contents === "string") registerSecretValue(contents);
+			const fileDirectory = await fs$2.mkdtemp(path$1.join(await ensureDirectory(), "item-"));
+			const filePath = path$1.join(fileDirectory, path$1.basename(fileName));
+			await fs$2.writeFile(filePath, contents, {
+				flag: "wx",
+				mode: 384
+			});
+			return filePath;
+		},
+		dispose: () => {
+			disposal ??= (async () => {
+				const created = await directory?.catch(() => void 0);
+				if (!created) return;
+				await fs$2.rm(created, {
+					force: true,
+					recursive: true
+				});
+				untrackDirectory(created);
+			})();
+			return disposal;
+		}
+	};
+};
+//#endregion
+//#region src/credentialResolver.ts
+/** Passwords are read as set: trimming would change them. */
+const UNTRIMMED_ENV_NAMES = /* @__PURE__ */ new Set(["HOT_UPDATER_ANDROID_KEYSTORE_PASSWORD", "HOT_UPDATER_ANDROID_KEY_PASSWORD"]);
+const describeField = ([name, alternative]) => alternative ? `${name} (or ${alternative})` : name;
+const describeFields = (fields) => {
+	const described = fields.map(describeField);
+	if (described.length <= 2) return described.join(" and ");
+	return `${described.slice(0, -1).join(", ")}, and ${described.at(-1)}`;
+};
+/**
+* The sentence every "credential unavailable" message ends with: the
+* environment variables that provide `kind` whatever the secrets adapter.
+*/
+const credentialOverrideHint = (kind) => `Or set ${describeFields(CREDENTIAL_ENV_NAMES[kind])} to provide ${kind} from the environment.`;
+/**
+* The command that stores a credential of `kind` you have as `name` through
+* the config's `secrets` adapter, from its files.
+*/
+const credentialPutCommand = (kind, name = kind) => {
+	const put = `npx hot-updater secrets put ${name} --kind ${kind}`;
+	switch (kind) {
+		case "android-keystore": return `${put} --keystore <release.jks> --key-alias <alias>`;
+		case "asc-api-key": return `${put} --p8 <AuthKey.p8> --key-id <id> --issuer-id <id>`;
+		case "play-service-account": return `${put} --service-account <key.json>`;
+	}
+};
+/**
+* The command that signs in once, at a terminal, and stores the key Hot
+* Updater issues as `name`: an App Store Connect API key after an Apple
+* Account sign-in, a Play service account after a Google one.
+*/
+const credentialIssueCommand = (kind, name = kind) => `npx hot-updater secrets issue ${kind}${name === kind ? "" : ` ${name}`}`;
+/** The command group of each issued kind's shortcut, `<group> login`. */
+const CREDENTIAL_LOGIN_GROUPS = {
+	"asc-api-key": "apple",
+	"play-service-account": "google-play"
+};
+/**
+* The command people meet first that issues `kind` as `name`: its shortcut,
+* `apple login` for an App Store Connect API key or `google-play login`
+* for a Play service account, which takes nothing and stores the kind's
+* own name; for another name, `credentialIssueCommand`.
+*/
+const credentialLoginCommand = (kind, name = kind) => name === kind ? `npx hot-updater ${CREDENTIAL_LOGIN_GROUPS[kind]} login` : credentialIssueCommand(kind, name);
+/**
+* The command that stores a missing credential of `kind` as `name`: the
+* keystore you have, or the key Hot Updater issues after a sign-in.
+*/
+const credentialStoreCommand = (kind, name = kind) => kind === "android-keystore" ? credentialPutCommand(kind, name) : credentialLoginCommand(kind, name);
+var CredentialUnavailableError = class extends Error {
+	kind;
+	/** The environment variables that can provide this credential. */
+	envNames;
+	constructor(kind, message, options) {
+		super(message, options);
+		this.name = "CredentialUnavailableError";
+		this.kind = kind;
+		this.envNames = CREDENTIAL_ENV_NAMES[kind].flat();
+	}
+};
+const readEnvField = (env, field) => {
+	for (const name of field) {
+		const value = UNTRIMMED_ENV_NAMES.has(name) ? (process.env[name] ?? env[name]) || void 0 : getHotUpdaterEnvValue(env, name);
+		if (value !== void 0) return {
+			name,
+			value
+		};
+	}
+};
+const readFileField = async (kind, { name, value }) => {
+	const filePath = path$1.resolve(value);
+	if (!await fs$2.stat(filePath).then(async (stats) => {
+		await fs$2.access(filePath, fs$2.constants.R_OK);
+		return stats.isFile();
+	}).catch(() => false)) throw new CredentialUnavailableError(kind, `${name} does not point to a readable file.`);
+	return filePath;
+};
+const parseServiceAccount = (json) => {
+	try {
+		return JSON.parse(json);
+	} catch {
+		return;
+	}
+};
+const fromEnv = {
+	"asc-api-key": async ([key, keyId, issuerId], { files }) => ({
+		keyPath: key.name === "HOT_UPDATER_ASC_KEY_PATH" ? await readFileField("asc-api-key", key) : await files.write(`AuthKey_${keyId.value}.p8`, key.value.includes("\n") ? key.value : key.value.replaceAll("\\n", "\n")),
+		keyId: keyId.value,
+		issuerId: issuerId.value
+	}),
+	"android-keystore": async ([keystore, storePassword, keyAlias, keyPassword], { files, name }) => {
+		let storeFile;
+		if (keystore.name === "HOT_UPDATER_ANDROID_KEYSTORE_PATH") storeFile = await readFileField("android-keystore", keystore);
+		else {
+			registerSecretValue(keystore.value);
+			const contents = decodeBase64(keystore.value);
+			if (!contents) throw new CredentialUnavailableError("android-keystore", `${keystore.name} is not a base64-encoded keystore.`);
+			storeFile = await files.write(`${name}.keystore`, contents);
+		}
+		return {
+			storeFile,
+			storePassword: storePassword.value,
+			keyAlias: keyAlias.value,
+			keyPassword: keyPassword.value
+		};
+	},
+	"play-service-account": async ([serviceAccount]) => {
+		const json = serviceAccount.name === "HOT_UPDATER_PLAY_SERVICE_ACCOUNT_PATH" ? await fs$2.readFile(await readFileField("play-service-account", serviceAccount), "utf-8") : serviceAccount.value;
+		const parsed = parseServiceAccount(json);
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new CredentialUnavailableError("play-service-account", `${serviceAccount.name} is not a service account JSON object.`);
+		return { json };
+	}
+};
+/** Fields of a service account that are no secret: its type and Google's endpoints. */
+/**
+* Fields of a JSON credential that identify it rather than grant access:
+* its IDs, key alias, and a service account's email, project, type, and
+* Google's endpoints. They stay readable, as messages name them, and a
+* short one, such as the alias `release`, would mask every word it is in.
+*/
+const isIdentifierField = (field) => [
+	"keyId",
+	"issuerId",
+	"keyAlias",
+	"type",
+	"project_id",
+	"client_email",
+	"client_id",
+	"private_key_id",
+	"universe_domain"
+].includes(field) || field.endsWith("_uri") || field.endsWith("_url");
+const registerJsonSecrets = (value, fields) => {
+	registerSecretValue(value);
+	for (const [field, entry] of Object.entries(fields)) if (typeof entry === "string" && !isIdentifierField(field)) registerSecretValue(entry);
+};
+/**
+* Masks a credential's JSON value in the CLI's output: the whole value, and
+* each field but those that identify it, such as `keyId` and `keyAlias`,
+* so a password or a key a log prints alone stays masked. A value that is
+* no JSON object is masked whole.
+*/
+const registerCredentialValue = (value) => {
+	const parsed = parseObject(value);
+	if (parsed) registerJsonSecrets(value, parsed);
+	else registerSecretValue(value);
+};
+const parseObject = (value) => {
+	const parsed = parseServiceAccount(value);
+	return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
+};
+/**
+* The fields of a JSON credential, each a non-empty string, or an error
+* naming the shape `kind` takes.
+*/
+const readJsonFields = (kind, item, value, fields) => {
+	const parsed = parseObject(value);
+	const shape = `{${fields.map((field) => `"${field}"`).join(", ")}}`;
+	if (!parsed) throw new CredentialUnavailableError(kind, `${item} is not a JSON object: ${aKind(kind)} is one JSON value, ${shape}.`);
+	registerJsonSecrets(value, parsed);
+	const missing = fields.filter((field) => typeof parsed[field] !== "string" || !parsed[field]);
+	if (missing.length > 0) throw new CredentialUnavailableError(kind, `${item} has no ${missing.join(", ")}: ${aKind(kind)} is one JSON value, ${shape}.`);
+	return parsed;
+};
+const aKind = (kind) => `${/^[aeiou]/u.test(kind) ? "an" : "a"} ${kind}`;
+/** A base64 value's bytes, or undefined when it is not base64. */
+const decodeBase64 = (value) => {
+	const base64 = value.replace(/\s/g, "");
+	const contents = Buffer.from(base64, "base64");
+	return contents.length > 0 && contents.toString("base64").replace(/=+$/, "") === base64.replace(/=+$/, "") ? contents : void 0;
+};
+/**
+* Each kind from the one string a secrets adapter holds for it: a JSON
+* object for the App Store Connect key (`p8` is the PEM) and the keystore
+* (`keystore` is base64), and the service account's own JSON. File values
+* are written with `files`; every value is masked.
+*/
+const fromSecretValue = {
+	"asc-api-key": async (value, { files, item }) => {
+		const { keyId, issuerId, p8 } = readJsonFields("asc-api-key", item, value, [
+			"keyId",
+			"issuerId",
+			"p8"
+		]);
+		return {
+			keyPath: await files.write(`AuthKey_${keyId}.p8`, p8.includes("\n") ? p8 : p8.replaceAll("\\n", "\n")),
+			keyId,
+			issuerId
+		};
+	},
+	"android-keystore": async (value, { files, name, item }) => {
+		const { keystore, storePassword, keyAlias, keyPassword } = readJsonFields("android-keystore", item, value, [
+			"keystore",
+			"storePassword",
+			"keyAlias",
+			"keyPassword"
+		]);
+		const contents = decodeBase64(keystore);
+		if (!contents) throw new CredentialUnavailableError("android-keystore", `${item}'s keystore is not a base64-encoded keystore.`);
+		return {
+			storeFile: await files.write(`${name}.keystore`, contents),
+			storePassword,
+			keyAlias,
+			keyPassword
+		};
+	},
+	"play-service-account": async (value, { item }) => {
+		const parsed = parseObject(value);
+		if (!parsed) throw new CredentialUnavailableError("play-service-account", `${item} is not a service account JSON object.`);
+		registerJsonSecrets(value, parsed);
+		return { json: value };
+	}
+};
+const registerCredentialSecrets = (kind, credential) => {
+	if (kind === "android-keystore") {
+		const keystore = credential;
+		registerSecretValue(keystore.storePassword);
+		registerSecretValue(keystore.keyPassword);
+	}
+	if (kind === "play-service-account") {
+		const { json } = credential;
+		registerSecretValue(json);
+		const privateKey = parseServiceAccount(json)?.private_key;
+		if (typeof privateKey === "string") registerSecretValue(privateKey);
+	}
+};
+/**
+* Reads names from `secrets`, the names asked for in one turn of the event
+* loop, such as a build's credentials, in one `get`. Nothing is cached.
+*/
+const createSecretLoader = (secrets, cwd) => {
+	let batch;
+	const flush = async (names) => {
+		try {
+			const read = await secrets().get([...names.keys()], { cwd: cwd() });
+			for (const [name, waiters] of names) {
+				const value = Object.hasOwn(read, name) ? read[name] : void 0;
+				for (const waiter of waiters) waiter.resolve(typeof value === "string" && value ? value : void 0);
+			}
+		} catch (error) {
+			for (const waiters of names.values()) for (const waiter of waiters) waiter.reject(error);
+		}
+	};
+	return (name) => new Promise((resolve, reject) => {
+		if (batch === void 0) {
+			const names = /* @__PURE__ */ new Map();
+			batch = names;
+			setTimeout(() => {
+				batch = void 0;
+				flush(names);
+			}, 0);
+		}
+		const waiters = batch.get(name) ?? [];
+		waiters.push({
+			resolve,
+			reject
+		});
+		batch.set(name, waiters);
+	});
+};
+/**
+* Resolves each item from its environment overrides when any is set, and
+* otherwise from the config's `secrets` adapter as one value named by the
+* item, so overrides never reach the store. When the adapter fails or holds
+* no such value, the error names the environment variables that can
+* provide the item instead. Nothing is cached, values are never written to
+* disk except as 0600 temporary files, are never set in `process.env`, and
+* every secret is masked in logs.
+*/
+const createCredentialResolver = ({ env = {}, secrets, cwd } = {}) => {
+	const files = createCredentialFiles();
+	const resolved = /* @__PURE__ */ new Map();
+	let disposal;
+	const adapter = () => typeof secrets === "function" ? secrets() : secrets ?? getConfiguredSecrets();
+	const load = createSecretLoader(adapter, () => cwd ?? getCwd());
+	const resolveItem = async (kind, name) => {
+		const fields = CREDENTIAL_ENV_NAMES[kind];
+		const values = fields.map((field) => readEnvField(env, field));
+		if (values.some((value) => value !== void 0)) {
+			const missing = fields.filter((_, index) => !values[index]);
+			if (missing.length > 0) throw new CredentialUnavailableError(kind, `The environment overrides ${kind} but ${describeFields(missing)} ${missing.length === 1 ? "is" : "are"} not set.`);
+			const credential = await fromEnv[kind](values, {
+				files,
+				name
+			});
+			registerCredentialSecrets(kind, credential);
+			return credential;
+		}
+		const store = adapter();
+		const item = name === kind ? kind : `${name} (${kind})`;
+		let value;
+		try {
+			value = await load(name);
+		} catch (error) {
+			const reason = error instanceof Error ? error.message : String(error);
+			throw new CredentialUnavailableError(kind, `The ${store.name} secrets adapter could not read ${item}: ${reason} ${credentialOverrideHint(kind)}`, { cause: error });
+		}
+		if (value === void 0) throw new CredentialUnavailableError(kind, `${item} is not in the ${store.name} secrets adapter (${describeSecret(store, name)}). Store it once with \`${credentialStoreCommand(kind, name)}\`. ${credentialOverrideHint(kind)}`);
+		registerSecretValue(value);
+		return fromSecretValue[kind](value, {
+			files,
+			name,
+			item: `The ${store.name} secrets adapter's ${item}`
+		});
+	};
+	return {
+		resolve: ({ kind, name = kind }) => {
+			if (disposal) return Promise.reject(/* @__PURE__ */ new Error("The credential resolver has been disposed."));
+			const key = `${kind}\u0000${name}`;
+			let pending = resolved.get(key);
+			if (!pending) {
+				pending = resolveItem(kind, name);
+				resolved.set(key, pending);
+				pending.catch(() => resolved.delete(key));
+			}
+			return pending;
+		},
+		dispose: () => {
+			disposal ??= (async () => {
+				await Promise.allSettled(resolved.values());
+				resolved.clear();
+				await files.dispose();
+			})();
+			return disposal;
+		}
+	};
+};
+/**
+* Runs `run` with a credential resolver and deletes its temporary files
+* when `run` settles.
+*/
+const withCredentialResolver = async (run, options) => {
+	const resolver = createCredentialResolver(options);
+	try {
+		return await run(resolver);
+	} finally {
+		await resolver.dispose();
+	}
+};
+//#endregion
 //#region src/isObject.ts
 const isObject$2 = (value) => {
 	return !!value && value.constructor === Object;
@@ -44397,11 +45739,13 @@ const findManagedProperty = (objectExpression, propertyName) => {
 	const property = objectExpression.properties.find((candidate) => candidate.type === "Property" && candidate.kind === "init" && !candidate.method && !candidate.shorthand && getObjectPropertyName(candidate) === propertyName);
 	return property?.type === "Property" ? property : null;
 };
-/** The `plugins` property, written either way: `plugins: [...]` or `plugins`. */
-const findPluginsProperty = (objectExpression) => {
-	const property = objectExpression.properties.find((candidate) => candidate.type === "Property" && candidate.kind === "init" && !candidate.method && getObjectPropertyName(candidate) === "plugins");
+/** The `name` property, written either way: `name: value` or `name`. */
+const findAnyProperty = (objectExpression, name) => {
+	const property = objectExpression.properties.find((candidate) => candidate.type === "Property" && candidate.kind === "init" && !candidate.method && getObjectPropertyName(candidate) === name);
 	return property?.type === "Property" ? property : null;
 };
+/** The `plugins` property, written either way: `plugins: [...]` or `plugins`. */
+const findPluginsProperty = (objectExpression) => findAnyProperty(objectExpression, "plugins");
 const getCallCallee = (expression) => {
 	if (expression.type !== "CallExpression" || expression.callee.type !== "Identifier") return null;
 	return expression.callee.name;
@@ -44492,6 +45836,8 @@ const updateManagedObject = (existing, next, droppedHelpers) => {
 			text: nextPluginsText
 		});
 	}
+	const nextSecrets = findAnyProperty(next.objectExpression, "secrets");
+	if (nextSecrets && !findAnyProperty(existing.objectExpression, "secrets")) missingPropertyTexts.push(getPropertyBlockText(next.source, nextSecrets));
 	return {
 		text: applyTextEdits(objectText, [...propertyEdits, ...appendPropertiesEdits(existing.source, existing.objectExpression, missingPropertyTexts)]),
 		keptBuild
@@ -44570,9 +45916,13 @@ const keptManagedImports = (declarations, scaffoldImports, usedText) => {
 	};
 };
 const rebuildImportBlock = (source, scaffold, { keptBuild, usedText }) => {
+	const references = usedIdentifiers(usedText);
 	const imports = scaffold.imports.filter((info) => !(keptBuild && BUILD_IMPORT_PACKAGES.has(info.pkg))).map((info) => info.pkg === "node:fs" ? {
 		...info,
 		named: info.named?.filter((name) => name !== "existsSync")
+	} : info.pkg === "hot-updater" && references && !references.has("localSecrets") ? {
+		...info,
+		named: info.named?.filter((name) => name !== "localSecrets")
 	} : info);
 	const importDeclarations = importDeclarationsOf(source);
 	const firstImport = importDeclarations[0];
@@ -44818,102 +46168,6 @@ const writeHotUpdaterFiles = async (scaffold, { cwd = process.cwd(), settings })
 	return { config };
 };
 //#endregion
-//#region src/initOptions.ts
-var InitError = class extends Error {
-	name = "InitError";
-};
-var MissingInitInputsError = class extends InitError {
-	missingInputs;
-	name = "MissingInitInputsError";
-	constructor(missingInputs) {
-		super(["Init is missing required inputs:", ...missingInputs.map((input) => `- ${input}`)].join("\n"));
-		this.missingInputs = missingInputs;
-	}
-};
-var InitEnvFileError = class extends InitError {
-	name = "InitEnvFileError";
-};
-var LegacyInfrastructureError = class extends InitError {
-	name = "LegacyInfrastructureError";
-	constructor(provider, resource) {
-		super(`${provider} v0 infrastructure was detected at ${resource}. Hot Updater v1 cannot upgrade it in place. Run init with new provider resources and ship the new endpoint in a new native build. The existing infrastructure was not changed.`);
-	}
-};
-const assertInitInputs = ({ inputs, strict }) => {
-	if (!strict) return;
-	const missingInputs = getMissingInitInputs(inputs);
-	if (missingInputs.length > 0) throw new MissingInitInputsError(missingInputs);
-};
-const getMissingInitInputs = (inputs) => Object.entries(inputs).filter(([, value]) => !value?.trim()).map(([key]) => key);
-//#endregion
-//#region src/hotUpdaterEnv.ts
-const HOT_UPDATER_ENV_PATH = ".env.hotupdater";
-const unquoteEnvValue = (value) => {
-	const trimmed = value.trim();
-	if (trimmed.startsWith("\"") && trimmed.endsWith("\"")) try {
-		const parsed = JSON.parse(trimmed);
-		return typeof parsed === "string" ? parsed : trimmed.slice(1, -1);
-	} catch {
-		return trimmed.slice(1, -1);
-	}
-	return trimmed.startsWith("'") && trimmed.endsWith("'") ? trimmed.slice(1, -1) : trimmed;
-};
-const parseEnv = (content) => {
-	const env = {};
-	for (const line of content.split("\n")) {
-		const trimmed = line.trim();
-		if (!trimmed || trimmed.startsWith("#") || !trimmed.includes("=")) continue;
-		const separatorIndex = trimmed.indexOf("=");
-		const key = trimmed.slice(0, separatorIndex).trim();
-		if (key) env[key] = unquoteEnvValue(trimmed.slice(separatorIndex + 1));
-	}
-	return env;
-};
-const readEnvFile = async (filePath, allowMissing) => {
-	let content;
-	try {
-		content = await fs$1.readFile(filePath, "utf-8");
-	} catch (error) {
-		if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-			if (allowMissing) return {};
-			throw new InitEnvFileError(`Init environment file not found: ${filePath}`);
-		}
-		throw error;
-	}
-	return parseEnv(content);
-};
-const getHotUpdaterInitInputEnv = ({ env, managedEnv }, nonInteractive) => nonInteractive ? env : managedEnv;
-const readHotUpdaterInitEnv = async (cwd, envFile) => {
-	const savedEnvPath = path.resolve(cwd, HOT_UPDATER_ENV_PATH);
-	const savedEnv = await readEnvFile(savedEnvPath, true);
-	if (!envFile) return {
-		env: {},
-		managedEnv: savedEnv
-	};
-	const inputEnvPath = path.resolve(cwd, envFile);
-	if (inputEnvPath === savedEnvPath) return {
-		env: savedEnv,
-		managedEnv: savedEnv
-	};
-	const inputEnv = await readEnvFile(inputEnvPath, false);
-	return {
-		env: {
-			...savedEnv,
-			...inputEnv
-		},
-		inputEnv,
-		managedEnv: savedEnv
-	};
-};
-const readHotUpdaterEnv = async (cwd) => {
-	const { managedEnv } = await readHotUpdaterInitEnv(cwd);
-	return managedEnv;
-};
-const getHotUpdaterEnvValue = (env, key) => {
-	if (process.env[key] !== void 0) return process.env[key]?.trim() || void 0;
-	return env[key]?.trim() || void 0;
-};
-//#endregion
 //#region src/infrastructureGeneration.ts
 const assertInfrastructureGenerationPayload = ({ payload, provider, resource }) => {
 	if (typeof payload !== "object" || payload === null || !("infrastructureGeneration" in payload) || payload.infrastructureGeneration !== 1) throw new LegacyInfrastructureError(provider, resource);
@@ -45090,6 +46344,51 @@ const atLeast = (version, minimum) => {
 	}
 	return true;
 };
+/** The arguments that run React Native CLI's `config` with Node.js. */
+const reactNativeCliConfig = (cwd) => [path$1.join(path$1.dirname(require$2.resolve("react-native/package.json", { paths: [cwd] })), "cli.js"), "config"];
+/**
+* The command, run with Node.js, that lists the React Native packages a
+* build links, chosen as Expo and @expo/fingerprint choose it: Expo's
+* autolinking from expo-modules-autolinking 1.12 (SDK 52), else React Native
+* CLI, as for an app without Expo. The native templates also fall back to
+* React Native CLI when `EXPO_USE_COMMUNITY_AUTOLINKING=1`, as Expo
+* documents.
+*/
+const reactNativeConfigCommand = (cwd, platform, env = process.env) => {
+	let autolinking = null;
+	try {
+		autolinking = resolveExpoAutolinking(cwd);
+	} catch {}
+	if (autolinking?.linksReactNative && env["EXPO_USE_COMMUNITY_AUTOLINKING"] !== "1") return [
+		autolinking.bin,
+		"react-native-config",
+		"--platform",
+		platform,
+		"--json"
+	];
+	return reactNativeCliConfig(cwd);
+};
+/**
+* The command that lists the React Native packages the native project of a
+* build adapter links, as the adapter's own fingerprint runs it: `rock config`
+* for Rock, React Native CLI's `config` for the bare adapter, and
+* {@link reactNativeConfigCommand} for Expo and any other adapter.
+*/
+const autolinkingConfigCommand = (cwd, platform, { buildAdapter, env = process.env } = {}) => {
+	if (buildAdapter === "rock") return {
+		command: "npx",
+		args: [
+			"rock",
+			"config",
+			"-p",
+			platform
+		]
+	};
+	return {
+		command: process.execPath,
+		args: buildAdapter === "bare" ? reactNativeCliConfig(cwd) : reactNativeConfigCommand(cwd, platform, env)
+	};
+};
 /**
 * The expo-modules-autolinking an Expo app builds with, resolved from its
 * `expo` package as the native templates resolve it.
@@ -45132,8 +46431,11 @@ const readExpoModules = async (cwd, platform) => {
 		reject: false
 	});
 	if (result.exitCode !== 0) throw new Error("`expo-modules-autolinking resolve` failed.");
-	const { modules = [] } = parseJsonOutput(result.stdout, "expo-modules-autolinking resolve");
-	return readExpoModuleDependencies(modules);
+	const output = parseJsonOutput(result.stdout, "expo-modules-autolinking resolve");
+	return {
+		dependencies: await readExpoModuleDependencies(output.modules ?? []),
+		output
+	};
 };
 const readExpoModuleDependencies = (modules) => Promise.all(modules.flatMap((module) => {
 	const name = module.packageName;
@@ -45218,13 +46520,21 @@ const readReactNativeInterface = async ({ cwd, command, args, platform, settings
 		...rest,
 		sourceDirs: [sourceDir]
 	} : rest) : []);
-	const expoModules = dependencies.some(({ name }) => name === "expo") ? await readExpoModules(cwd, platform) : [];
+	const expo = dependencies.some(({ name }) => name === "expo") ? await readExpoModules(cwd, platform) : {
+		dependencies: [],
+		output: null
+	};
+	const expoModules = expo.dependencies;
 	const names = new Set(dependencies.map(({ name }) => name));
 	const settings = declaredSettings ?? (platform === "android" ? await readGradleFlags(config.project?.android?.sourceDir ?? path$1.join(cwd, "android")) : {});
 	return {
 		runtime: `react-native@${reactNative?.version ?? "unknown"}`,
 		dependencies: [...dependencies, ...expoModules.filter(({ name }) => !names.has(name))],
-		settings
+		settings,
+		autolinking: {
+			reactNative: config,
+			expoModules: expo.output
+		}
 	};
 };
 const sha256 = (data) => createHash("sha256").update(data).digest("hex");
@@ -45447,7 +46757,7 @@ const createInterfaceFingerprint = async (cwd, options, nativeInterface) => {
 const reactNativeCliFingerprint = async (cwd, options) => createInterfaceFingerprint(cwd, options, await readReactNativeInterface({
 	cwd,
 	command: process.execPath,
-	args: [path$1.join(path$1.dirname(require$2.resolve("react-native/package.json", { paths: [cwd] })), "cli.js"), "config"],
+	args: reactNativeCliConfig(cwd),
 	platform: options.platform
 }));
 //#endregion
@@ -45648,12 +46958,14 @@ const mergeConfigSources = (...sources) => {
 	const mergedConfig = sources.reduceRight((mergedConfig, source) => mergeWith(mergedConfig, source ?? {}, replaceArrays), {});
 	const database = sources.find((source) => source?.database)?.database;
 	const plugins = sources.find((source) => source?.plugins)?.plugins;
+	const secrets = sources.find((source) => source?.secrets)?.secrets;
 	const signing = sources.find((source) => source?.signing)?.signing;
 	const storage = sources.find((source) => source?.storage)?.storage;
 	return {
 		...mergedConfig,
 		...database ? { database } : {},
 		...plugins ? { plugins } : {},
+		...secrets ? { secrets } : {},
 		...signing ? { signing } : {},
 		...storage ? { storage } : {}
 	};
@@ -45679,11 +46991,25 @@ const getConfigLoaderOptions = () => {
 };
 /** Each load runs the config file again, which creates its adapters again. */
 const loadConfigFile = async () => {
-	const { config } = await loadConfig$1(getConfigLoaderOptions());
-	return config;
+	const scope = {};
+	const { config } = await withSecretsScope(scope, () => loadConfig$1(getConfigLoaderOptions()));
+	return {
+		source: config,
+		scope
+	};
+};
+/**
+* The config `options` select, resolved: a config function runs in a scope
+* of its own, so the `secretEnv` it creates reads this config's `secrets`,
+* and the file's top-level `secretEnv` reads the first config's.
+*/
+const configFor = async ({ source, scope: fileScope }, options) => {
+	if (typeof source !== "function") return resolveConfig(source, [fileScope]);
+	const scope = {};
+	const config = await withSecretsScope(scope, () => source(options));
+	return resolveConfig(config, [scope, fileScope]);
 };
-const configFor = async (source, options) => typeof source === "function" ? await source(options) : source;
-const loadConfig = async (options) => resolveConfig(await configFor(await loadConfigFile(), options));
+const loadConfig = async (options) => configFor(await loadConfigFile(), options);
 /**
 * hot-updater.config for each of `platforms`, with the file loaded once. A
 * config object gives every platform the same database, storage, and
@@ -45691,23 +47017,32 @@ const loadConfig = async (options) => resolveConfig(await configFor(await loadCo
 * creates are that platform's own.
 */
 const loadPlatformConfigs = async (platforms, { channel }) => {
-	const source = await loadConfigFile();
+	const file = await loadConfigFile();
 	const configs = [];
 	for (const platform of platforms) configs.push({
 		platform,
-		config: resolveConfig(await configFor(source, {
+		config: await configFor(file, {
 			channel,
 			platform
-		}))
+		})
 	});
 	return configs;
 };
-const resolveConfig = (config) => {
+/**
+* The config with its defaults. Its `secrets` adapter fills `scopes` not yet
+* filled, which the `secretEnv` its evaluation created read, and becomes the
+* default of credential resolvers.
+*/
+const resolveConfig = (config, scopes) => {
 	const mergedConfig = mergeConfigSources(config, getDefaultConfig());
-	const signing = normalizeSigningConfig(mergedConfig.signing);
+	const secrets = withLocalKeyStore(mergedConfig.secrets);
+	const signing = normalizeSigningConfig(mergedConfig.signing, { secrets });
+	for (const scope of scopes) scope.secrets ??= secrets;
+	setConfiguredSecrets(secrets);
 	return {
 		...mergedConfig,
-		signing
+		signing,
+		secrets
 	};
 };
 //#endregion
@@ -45802,13 +47137,14 @@ const generateSchema = ({ database, plugins }, version, name) => {
 };
 //#endregion
 //#region src/log.ts
+const mask = (message) => typeof message === "string" ? maskSecretValues(message) : message;
 const log = {
-	normal: (message) => console.log(message),
-	success: (message) => console.log(import_picocolors.default.green(message)),
-	info: (message) => console.log(import_picocolors.default.blue(message)),
-	error: (message) => console.log(import_picocolors.default.red(message)),
-	warn: (message) => console.log(import_picocolors.default.yellow(message)),
-	debug: (message) => console.log(import_picocolors.default.gray(message))
+	normal: (message) => console.log(mask(message)),
+	success: (message) => console.log(import_picocolors.default.green(mask(message))),
+	info: (message) => console.log(import_picocolors.default.blue(mask(message))),
+	error: (message) => console.log(import_picocolors.default.red(mask(message))),
+	warn: (message) => console.log(import_picocolors.default.yellow(mask(message))),
+	debug: (message) => console.log(import_picocolors.default.gray(mask(message)))
 };
 //#endregion
 //#region src/makeEnv.ts
@@ -45860,6 +47196,7 @@ const makeEnv = async (newEnvVars, filePath = ".env.hotupdater", options) => {
 			if (isFileSystemError(error) && error.code === "ENOENT") return "";
 			throw error;
 		});
+		if (options?.expectedContent !== void 0 && existingContent !== options.expectedContent) throw new Error(`${filePath} changed since it was read, so it was not rewritten.`);
 		const lines = existingContent ? existingContent.split("\n") : [];
 		const processedKeys = /* @__PURE__ */ new Set();
 		const updatedLines = [];
@@ -45915,6 +47252,23 @@ const makeEnv = async (newEnvVars, filePath = ".env.hotupdater", options) => {
 	}
 };
 //#endregion
+//#region src/minBundleId.ts
+/**
+* The MIN_BUNDLE_ID a native build compiles in, which is also the ID of its
+* built-in bundle: a UUIDv7 of the build's millisecond whose random bits are
+* all zero, `<ts>-<ts>-7000-8000-000000000000`, as the SDK's podspec script
+* phase and Gradle task generate it. The bundles `hot-updater deploy` issued
+* before the build sort before it, and the ones it issues afterwards sort
+* after it. Bundle IDs share one space across platforms, so two builds that
+* start in the same millisecond get the same one: `native-build ios|android`
+* steps past an ID the registry holds before it builds, and the registry
+* refuses a second registration of one.
+*/
+const createMinBundleId = (nowMs = Date.now()) => {
+	const timestamp = nowMs.toString(16).padStart(12, "0");
+	return `${timestamp.slice(0, 8)}-${timestamp.slice(8)}-7000-8000-000000000000`;
+};
+//#endregion
 //#region src/moduleSpecifiers.ts
 /**
 * The modules `source` imports or re-exports, statically or with an
@@ -46031,4 +47385,4 @@ function transformTemplate(templateString, values) {
 	return result;
 }
 //#endregion
-export { BuildLogger, ConfigBuilder, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, INTERFACE_FINGERPRINT_ENGINE, InitEnvFileError, InitError, LegacyInfrastructureError, MissingInitInputsError, ServerDefinitionError, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, banner, clientAuthOf, typedColors as colors, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createInterfaceFingerprint, createLogWriter, createMigrator, createTarBrTargetFiles, createZip, decryptJson, defineInitProvider, encryptJson, ensureInstallPackages, generateClientCredential, generateSchema, generatesSchema, getAndroidSdkPath, getBundleSigningPublicKey, getCwd, getHotUpdaterEnvValue, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getReactNativeMetadatas, getStorageFileByteSize, isCodegenSpecFile, isServerDefinition, link, loadConfig, loadPlatformConfigs, log, makeEnv, moduleSpecifiersOf, p, prepareBundleSigning, printAppSetup, printBanner, provisionClientCredential, putStorageFile, reactNativeCliFingerprint, readBundleSigningPublicKeyFile, readHotUpdaterEnv, readHotUpdaterInitEnv, readPackageUp, readReactNativeInterface, renderAppImports, renderAppSetup, renderImportStatements, resolveExpoAutolinking, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolvePackageVersion, serverDefinitionOf, shouldAutoSelectOnlyInitResource, stripAnsi, transformEnv, transformTemplate, writeHotUpdaterConfig, writeHotUpdaterFiles };
+export { BuildFailedError, BuildLogger, CREDENTIAL_ENV_NAMES, CREDENTIAL_LOGIN_GROUPS, ConfigBuilder, CredentialUnavailableError, DEFAULT_SIGNING_KEY_SECRET, HOT_UPDATER_HOME_ENV, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, INTERFACE_FINGERPRINT_ENGINE, InitEnvFileError, InitError, LOCAL_SECRETS_NAME, LegacyInfrastructureError, MissingInitInputsError, ServerDefinitionError, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, assertUnreservedEnv, autolinkingConfigCommand, banner, clientAuthOf, typedColors as colors, confirmInitInputPersistence, copyDirToTmp, createCredentialResolver, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createInterfaceFingerprint, createLocalSecretsStore, createLogWriter, createMigrator, createMinBundleId, createTarBrTargetFiles, createZip, credentialIssueCommand, credentialLoginCommand, credentialOverrideHint, credentialPutCommand, credentialStoreCommand, decryptJson, defineInitProvider, describeSecret, describeStoredSecret, encryptJson, ensureInstallPackages, generateClientCredential, generateSchema, generatesSchema, getAndroidSdkPath, getBundleSigningPublicKey, getConfiguredAdapter, getConfiguredSecrets, getCwd, getHotUpdaterEnvValue, getHotUpdaterHome, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getLocalKeyFile, getLocalKeyStoreDir, getLocalSecretsStore, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getProjectKey, getReactNativeMetadatas, getStorageFileByteSize, isCI, isCodegenSpecFile, isReservedVariableName, isSecretName, isServerDefinition, keepsKeysOnThisMachine, link, loadConfig, loadPlatformConfigs, localSecrets, log, makeEnv, maskSecretValues, moduleSpecifiersOf, nonInteractiveReason, p, parseLoadedEnv, parseSecretReference, prepareBundleSigning, printAppSetup, printBanner, provisionClientCredential, putStorageFile, reactNativeCliFingerprint, reactNativeConfigCommand, readBundleSigningPublicKeyFile, readHotUpdaterInitEnv, readLoadedHotUpdaterEnv, readLocalKey, readPackageUp, readReactNativeInterface, readSecretVariables, registerCredentialValue, registerSecretValue, renderAppImports, renderAppSetup, renderImportStatements, resolveExpoAutolinking, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolveLocalSecretsPath, resolvePackageVersion, secretEnv, secretVariableName, serverDefinitionOf, setConfiguredSecrets, shouldAutoSelectOnlyInitResource, stripAnsi, transformEnv, transformTemplate, withCredentialResolver, withLocalKeyStore, withSecretsScope, writeHotUpdaterConfig, writeHotUpdaterFiles, writeLocalKey };