@hot-updater/cli-tools 1.2.0-rc.12 → 1.2.0-rc.14

package/dist/index.d.mts

@@ -509,12 +509,6 @@ interface CredentialResolver {
    */
   dispose(): Promise<void>;
 }
-/**
- * A command to print, broken at spaces with ` \` once a line would pass
- * 74 columns, each continuation indented two spaces, so a terminal never
- * wraps it mid-word and it still pastes as one command.
- */
-declare const formatCommand: (command: string) => string;
 /** The credentials Hot Updater issues itself after a sign-in. */
 type IssuedCredentialKind = "asc-api-key";
 /** The credentials `secrets put <name> <file>` stores from one file. */
@@ -920,8 +914,11 @@ declare const nonInteractiveReason: ({ env, input }?: {
 //#region src/interfaceFingerprint.d.ts
 /**
  * The engine fingerprint.json records for the interface fingerprint. Change
- * it with any change to what is hashed or how, so the new hashes are reported
- * as an engine change rather than a native one.
+ * it with any change to what is hashed or how that moves every project's
+ * hash, so the new hashes are reported as an engine change rather than a
+ * native one. The name is part of every digest, so changing it moves them all:
+ * tracking an input nothing tracked before keeps the name, moves only the
+ * projects that have that input, and is reported as a change to its files.
  */
 declare const INTERFACE_FINGERPRINT_ENGINE = "hot-updater/interface@1";
 /**
@@ -1093,6 +1090,13 @@ declare const loadPlatformConfigs: <TPlatform extends Platform>(platforms: reado
   readonly platform: TPlatform;
   readonly config: ConfigResponse;
 }[]>;
+/**
+ * The names the config's build credentials reference, such as
+ * `release-keystore`, which builds read from the `secrets` adapter for their
+ * kind: `signing`'s, and each scheme's `signing.ascApiKey` and
+ * `signing.keystore`.
+ */
+declare const getBuildSecretNames: (config: ConfigResponse) => readonly string[];
 /**
  * The names the config's `secret()`s reference for its adapters, such as
  * `HOT_UPDATER_CLOUDFLARE_API_TOKEN`, in the order the config created
@@ -1196,6 +1200,32 @@ declare const createMigrator: ({ database, plugins }: ToolingSource) => Migrator
 /** The schema file `hot-updater db generate` writes for a definition's database. */
 declare const generateSchema: ({ database, plugins }: ToolingSource, version: Parameters<SchemaGenerator>[0], name?: Parameters<SchemaGenerator>[1]) => ReturnType<SchemaGenerator>;
 //#endregion
+//#region src/expoSdk.d.ts
+/**
+ * The lowest Expo SDK Hot Updater supports, the floor of `@hot-updater/expo`'s
+ * `expo` peer range. doctor, the config plugin and the build adapter read it.
+ */
+declare const MINIMUM_EXPO_SDK = 55;
+/** The command that moves a project to the minimum Expo SDK. */
+declare const EXPO_SDK_UPGRADE_COMMAND = "npx expo install expo@^55.0.0 --fix";
+interface ExpoSdk {
+  /** The SDK's major version. */
+  readonly sdk: number;
+  /** The installed version, or the range's lowest when Expo isn't installed. */
+  readonly version: string;
+  readonly installed: boolean;
+}
+/**
+ * A project's Expo SDK: the installed `expo` the project resolves, else the
+ * lowest version its declared range allows. Null without either.
+ */
+declare const readExpoSdk: (cwd: string) => ExpoSdk | null;
+/**
+ * Refuses a project whose installed Expo is below the minimum SDK. A project
+ * without Expo installed passes: nothing could build it yet.
+ */
+declare const assertSupportedExpoSdk: (cwd: string) => void;
+//#endregion
 //#region src/log.d.ts
 type LogMessage = string | number | null | undefined;
 declare const log: {
@@ -1212,6 +1242,11 @@ type EnvVarValue = string | {
   comment: string;
   value: string;
 };
+/**
+ * Replaces `filePath` whole or not at all, through a new 0600 file beside it,
+ * so the result is 0600 whatever the mode of the file it replaces.
+ */
+declare const writeEnvAtomically: (filePath: string, content: string) => Promise<void>;
 declare const makeEnv: (newEnvVars: Record<string, EnvVarValue>, filePath?: string, options?: {
   readonly preserveKeys?: readonly string[];
   readonly removeKeys?: readonly string[];
@@ -1219,10 +1254,29 @@ declare const makeEnv: (newEnvVars: Record<string, EnvVarValue>, filePath?: stri
   readonly expectedContent?: string;
 }) => Promise<string>;
 //#endregion
+//#region src/mergeEnvFile.d.ts
+/**
+ * `value` as an env file's value, in the first form `parseLoadedEnv` reads
+ * back exactly: bare, single-quoted on one line, double-quoted with its
+ * newlines as `\n`, in backticks, or single-quoted across lines. Undefined
+ * for a value no form holds, such as one with every quote mark and a newline.
+ */
+declare const formatEnvValue: (value: string) => string | undefined;
+/**
+ * `content`, an env file, with `values` set, already as `formatEnvValue`
+ * gives them: a variable it assigns has only that value replaced, the last
+ * assignment when it repeats, which is the one that counts, and a new one
+ * goes at the end. Every other byte stays: other lines, comments, an
+ * `export`, an inline comment. Undefined when `parseLoadedEnv` wouldn't read
+ * exactly that back, so a file this can't follow is never rewritten.
+ */
+declare const mergeEnvContent: (content: string, values: ReadonlyMap<string, string>) => string | undefined;
+//#endregion
 //#region src/messageLines.d.ts
 /**
- * The widest line of a message the CLI prints: clack puts it after its
- * 3-column gutter (`│  `), and the whole line stays within 76 columns.
+ * Where the CLI wraps a message's prose, so it reads well after clack's
+ * 3-column gutter. It is a default for readability: a command, a URL, or a
+ * path stays whole, however long.
  */
 declare const MESSAGE_WIDTH = 73;
 /**
@@ -1236,12 +1290,33 @@ declare const displayWidth: (text: string) => number;
  */
 declare const truncateLine: (text: string, width: number) => string;
 /**
- * A message of `lines`, each at most `MESSAGE_WIDTH` columns, broken at
- * spaces, so a name, a path, or a list it embeds never widens a line. A
- * word longer than a line, such as a URL or a path, gets a line of its
- * own. Lines that fit, such as an indented command, stay as they are.
+ * Whether a line is a command to copy, by the program it runs, rather than
+ * prose: the next word is an argument, so "aws CLI not found" is prose.
+ */
+declare const isCommandLine: (line: string) => boolean;
+/**
+ * What the CLI prints for people, readable: prose wraps at spaces around
+ * `width` display columns, and a command to copy, a table's row, and a word
+ * longer than a line, such as a URL or a path, stay whole on their lines.
+ * A line that fits stays as it is, so fitting twice changes nothing. `p`
+ * applies it to all it prints; text printed another way, such as to stderr
+ * under `--json`, calls it.
+ */
+declare const fitText: (text: string, width?: number) => string;
+/**
+ * A message of `lines`, each fitted as `fitText` does, so a name, a path, or
+ * a list it embeds doesn't run on.
  */
 declare const fitMessage: (lines: readonly string[]) => string;
+/**
+ * `text` with each JSON body in it, such as the response an SDK's error
+ * embeds, replaced with the message the body says, as people read an error:
+ * Cloudflare's `errors[].message`, or a `message` or an `error`. A body that
+ * says none is cut. Printed errors go through it; `--json` keeps the body.
+ * A registered value is masked before anything is cut, as a cut one no longer
+ * matches, and again after, as a body's string may have escaped it.
+ */
+declare const withProviderMessages: (message: string) => string;
 //#endregion
 //#region src/minBundleId.d.ts
 /**
@@ -2468,10 +2543,20 @@ declare const taskLog: (opts: TaskLogOptions) => {
 };
 //#endregion
 //#region src/prompts.d.ts
+/**
+ * What a tool wrote, such as a build's output: masked, but printed as the
+ * tool wrote it, while everything the CLI writes goes through `p`.
+ */
+declare const toolOutput: {
+  error: (message: string, options?: LogMessageOptions | undefined) => void;
+  note: (message: string, title?: string, options?: Parameters<typeof note>[2]) => void;
+};
 /**
  * `@clack/prompts` with CI-safe spinners, with every message a registered
- * credential value appears in masked (`registerSecretValue`), and with
- * prompts that refuse to ask without a terminal.
+ * credential value appears in masked (`registerSecretValue`) and its prose
+ * wrapped (`fitText`), with a provider's JSON body in an error or a warning
+ * replaced with its message, and with prompts that refuse to ask without a
+ * terminal.
  */
 declare const p: typeof index_d_exports;
 type PromptProgress = ReturnType<typeof p.progress>;
@@ -2518,7 +2603,10 @@ declare const resolveHotUpdaterServerVersion: (currentPackageName: string, optio
  * masked.
  */
 declare const registerSecretValue: (value: string) => void;
-/** Replaces every registered credential value in `text` with a mask. */
+/**
+ * Replaces every registered credential value in `text`, and any JSON Web Token,
+ * with a mask.
+ */
 declare const maskSecretValues: (text: string) => string;
 //#endregion
 //#region src/localKeyStore.d.ts
@@ -2857,4 +2945,4 @@ type TransformTemplateArgs<T extends string> = { [Key in ExtractPlaceholders<T>]
  */
 declare function transformTemplate<T extends string>(templateString: T, values: TransformTemplateArgs<T>): string;
 //#endregion
-export { AddSigningSecretResult, AppClientCredential, AppClientPlugin, AssembleServerOptions, AssembledServer, BUNDLE_SIGNING_KEY_SECRET, BuildFailedError, BuildFailureSummaryConfig, BuildLogger, BuildLoggerConfig, BuildPhaseReader, BuildType, BundleSigningKeyError, BundleSigningOptions, BundleSigningSession, BundleSigningState, CREDENTIAL_ENV_NAMES, CREDENTIAL_LOGIN_GROUPS, ClientAuthSpec, ClientCredentialSpec, ConfigBuilder, ConfigBuilderScaffold, ConfigResponse, CreateCredentialResolverOptions, CreateHotUpdaterConfigScaffoldFromBuilderOptions, CreateHotUpdaterConfigScaffoldOptions, type CredentialFiles, CredentialKind, CredentialRequest, CredentialResolver, CredentialUnavailableError, Credentials, FileCredentialKind, HOT_UPDATER_HOME_ENV, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, HotUpdaterConfigOptions, HotUpdaterConfigScaffold, HotUpdaterInitEnv, HotUpdaterLogWriter, INTERFACE_FINGERPRINT_ENGINE, INVALID_SIGNING_MESSAGE, INVALID_SIGNING_NEXT_STEP, ISSUE_SIGNING_KEY_COMMAND, ImportInfo, InitEnvFileError, InitError, InitProviderDefinition, InitProviderInputDefinition, InitProviderInputPersistence, IssuedCredentialKind, LOCAL_SECRETS_NAME, LegacyInfrastructureError, LocalSecretsOptions, LocalSecretsStore, MANAGED_CLIENT_CREDENTIAL_ENV, MESSAGE_WIDTH, ManagedHelperStatement, ManagedHelperStrategy, MissingInitInputsError, NativeDependency, NativeInterface, PUT_SIGNING_KEY_COMMAND, PromptProgress, PromptSpinner, ProviderConfig, ProvisionedClientCredential, ReactNativeMetadata, ReadPackageUpResult, RunInitOptions, SecretsScope, ServerClientEndpoint, ServerDefinition, ServerDefinitionError, Step, StepLevel, UNSIGNED_BUNDLES_NEXT_STEP, UNSIGNED_BUNDLES_WARNING, WriteHotUpdaterConfigResult, addSigningSecretToConfig, addSigningSecretToConfigText, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, assertUnreservedEnv, autolinkingConfigCommand, banner, bundleSigningPutCommand, bundleSigningSecretRef, clientAuthOf, typedColors as colors, configSetsTeamSecrets, confirmInitInputPersistence, copyDirToTmp, createCredentialResolver, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createInterfaceFingerprint, createLocalSecretsStore, createLogWriter, createMigrator, createMinBundleId, createStep, createTarBrTargetFiles, createZip, credentialIssueCommand, credentialLoginCommand, credentialPutCommand, credentialStoreCommand, decryptJson, defineInitProvider, describeMissingSecret, describeSecret, describeStoredSecret, displayWidth, encryptJson, ensureInstallPackages, failActiveStep, fitMessage, formatCommand, formatDuration, generateClientCredential, generateSchema, generatesSchema, getAndroidSdkPath, getBundleSigningPublicKey, getConfiguredAdapter, getConfiguredSecrets, getCwd, getDeploySecretNames, getHotUpdaterEnvValue, getHotUpdaterHome, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getLocalKeyFile, getLocalKeyStoreDir, getLocalSecretsStore, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getProjectKey, getReactNativeMetadatas, getStorageFileByteSize, isCI, isCodegenSpecFile, isReservedVariableName, isSecretName, isSecretRef, isServerDefinition, keepsKeysOnThisMachine, link, loadConfig, loadPlatformConfigs, loadTeamSecrets, localSecrets, log, makeEnv, maskSecretValues, moduleSpecifiersOf, nonInteractiveReason, p, parseLoadedEnv, parseSecretReference, prepareBundleSigning, printAppSetup, printBanner, provisionClientCredential, putStorageFile, reactNativeCliFingerprint, reactNativeConfigCommand, readBundleSigningPublicKeyFile, readBundleSigningState, readHotUpdaterInitEnv, readLoadedEnvFile, readLoadedHotUpdaterEnv, readLocalKey, readMissingFromTeamSecrets, readPackageUp, readReactNativeInterface, readSecretVariables, readSecretWithSource, readSecrets, registerCredentialValue, registerSecretValue, renderAppImports, renderAppSetup, renderImportStatements, resolveExpoAutolinking, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolveLocalSecretsPath, resolvePackageVersion, resolveSecretsAdapter, secret, secretVariableName, serverDefinitionOf, setConfiguredSecrets, shouldAutoSelectOnlyInitResource, startStep, storeEnvFileSecrets, stripAnsi, transformEnv, transformTemplate, truncateLine, withCredentialResolver, withDuration, withSecretsScope, withStep, writeHotUpdaterConfig, writeHotUpdaterFiles, writeLocalKey };
+export { AddSigningSecretResult, AppClientCredential, AppClientPlugin, AssembleServerOptions, AssembledServer, BUNDLE_SIGNING_KEY_SECRET, BuildFailedError, BuildFailureSummaryConfig, BuildLogger, BuildLoggerConfig, BuildPhaseReader, BuildType, BundleSigningKeyError, BundleSigningOptions, BundleSigningSession, BundleSigningState, CREDENTIAL_ENV_NAMES, CREDENTIAL_LOGIN_GROUPS, ClientAuthSpec, ClientCredentialSpec, ConfigBuilder, ConfigBuilderScaffold, ConfigResponse, CreateCredentialResolverOptions, CreateHotUpdaterConfigScaffoldFromBuilderOptions, CreateHotUpdaterConfigScaffoldOptions, type CredentialFiles, CredentialKind, CredentialRequest, CredentialResolver, CredentialUnavailableError, Credentials, EXPO_SDK_UPGRADE_COMMAND, ExpoSdk, FileCredentialKind, HOT_UPDATER_HOME_ENV, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, HotUpdaterConfigOptions, HotUpdaterConfigScaffold, HotUpdaterInitEnv, HotUpdaterLogWriter, INTERFACE_FINGERPRINT_ENGINE, INVALID_SIGNING_MESSAGE, INVALID_SIGNING_NEXT_STEP, ISSUE_SIGNING_KEY_COMMAND, ImportInfo, InitEnvFileError, InitError, InitProviderDefinition, InitProviderInputDefinition, InitProviderInputPersistence, IssuedCredentialKind, LOCAL_SECRETS_NAME, LegacyInfrastructureError, LocalSecretsOptions, LocalSecretsStore, MANAGED_CLIENT_CREDENTIAL_ENV, MESSAGE_WIDTH, MINIMUM_EXPO_SDK, ManagedHelperStatement, ManagedHelperStrategy, MissingInitInputsError, NativeDependency, NativeInterface, PUT_SIGNING_KEY_COMMAND, PromptProgress, PromptSpinner, ProviderConfig, ProvisionedClientCredential, ReactNativeMetadata, ReadPackageUpResult, RunInitOptions, SecretsScope, ServerClientEndpoint, ServerDefinition, ServerDefinitionError, Step, StepLevel, UNSIGNED_BUNDLES_NEXT_STEP, UNSIGNED_BUNDLES_WARNING, WriteHotUpdaterConfigResult, addSigningSecretToConfig, addSigningSecretToConfigText, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, assertSupportedExpoSdk, assertUnreservedEnv, autolinkingConfigCommand, banner, bundleSigningPutCommand, bundleSigningSecretRef, clientAuthOf, typedColors as colors, configSetsTeamSecrets, confirmInitInputPersistence, copyDirToTmp, createCredentialResolver, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createInterfaceFingerprint, createLocalSecretsStore, createLogWriter, createMigrator, createMinBundleId, createStep, createTarBrTargetFiles, createZip, credentialIssueCommand, credentialLoginCommand, credentialPutCommand, credentialStoreCommand, decryptJson, defineInitProvider, describeMissingSecret, describeSecret, describeStoredSecret, displayWidth, encryptJson, ensureInstallPackages, failActiveStep, fitMessage, fitText, formatDuration, formatEnvValue, generateClientCredential, generateSchema, generatesSchema, getAndroidSdkPath, getBuildSecretNames, getBundleSigningPublicKey, getConfiguredAdapter, getConfiguredSecrets, getCwd, getDeploySecretNames, getHotUpdaterEnvValue, getHotUpdaterHome, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getLocalKeyFile, getLocalKeyStoreDir, getLocalSecretsStore, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getProjectKey, getReactNativeMetadatas, getStorageFileByteSize, isCI, isCodegenSpecFile, isCommandLine, isReservedVariableName, isSecretName, isSecretRef, isServerDefinition, keepsKeysOnThisMachine, link, loadConfig, loadPlatformConfigs, loadTeamSecrets, localSecrets, log, makeEnv, maskSecretValues, mergeEnvContent, moduleSpecifiersOf, nonInteractiveReason, p, parseLoadedEnv, parseSecretReference, prepareBundleSigning, printAppSetup, printBanner, provisionClientCredential, putStorageFile, reactNativeCliFingerprint, reactNativeConfigCommand, readBundleSigningPublicKeyFile, readBundleSigningState, readExpoSdk, readHotUpdaterInitEnv, readLoadedEnvFile, readLoadedHotUpdaterEnv, readLocalKey, readMissingFromTeamSecrets, readPackageUp, readReactNativeInterface, readSecretVariables, readSecretWithSource, readSecrets, registerCredentialValue, registerSecretValue, renderAppImports, renderAppSetup, renderImportStatements, resolveExpoAutolinking, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolveLocalSecretsPath, resolvePackageVersion, resolveSecretsAdapter, secret, secretVariableName, serverDefinitionOf, setConfiguredSecrets, shouldAutoSelectOnlyInitResource, startStep, storeEnvFileSecrets, stripAnsi, toolOutput, transformEnv, transformTemplate, truncateLine, withCredentialResolver, withDuration, withProviderMessages, withSecretsScope, withStep, writeEnvAtomically, writeHotUpdaterConfig, writeHotUpdaterFiles, writeLocalKey };

package/dist/index.mjs

@@ -22584,14 +22584,221 @@ const registerSecretValue = (value) => {
 	registry.secretValuesLongestFirst = longestFirst(secretValues);
 	registry.shortSecretPattern = shortSecretValues.size > 0 ? new RegExp(`${SHORT_SECRET_BEFORE}(?:${longestFirst(shortSecretValues).map(escapeRegExp).join("|")})${SHORT_SECRET_AFTER}`, "g") : void 0;
 };
-/** Replaces every registered credential value in `text` with a mask. */
+/**
+* A JSON Web Token, whether or not it was registered: Xcode mints its own from
+* the App Store Connect API key and may print it, and a build's log is uploaded
+* when the build fails.
+*/
+const JSON_WEB_TOKEN = /\beyJ[\w-]{8,}\.[\w-]{8,}\.[\w-]{8,}/g;
+/**
+* Replaces every registered credential value in `text`, and any JSON Web Token,
+* with a mask.
+*/
 const maskSecretValues = (text) => {
 	let masked = text;
 	for (const value of registry.secretValuesLongestFirst) if (masked.includes(value)) masked = masked.split(value).join(SECRET_MASK);
+	masked = masked.replace(JSON_WEB_TOKEN, SECRET_MASK);
 	const { shortSecretPattern } = registry;
 	return shortSecretPattern ? masked.replace(shortSecretPattern, SECRET_MASK) : masked;
 };
 //#endregion
+//#region src/messageLines.ts
+/**
+* Where the CLI wraps a message's prose, so it reads well after clack's
+* 3-column gutter. It is a default for readability: a command, a URL, or a
+* path stays whole, however long.
+*/
+const MESSAGE_WIDTH = 73;
+const graphemes = new Intl.Segmenter();
+/** Combining marks, format and control characters: they take no column. */
+const ZERO_WIDTH = /^[\p{M}\p{Cf}\p{Cc}]+$/u;
+/** East Asian wide and fullwidth characters, and emoji: two columns each. */
+const WIDE = /[\u1100-\u115F\u2E80-\u303E\u3041-\u33FF\u3400-\u4DBF\u4E00-\u9FFF\uA000-\uA4CF\uAC00-\uD7A3\uF900-\uFAFF\uFE30-\uFE4F\uFF00-\uFF60\uFFE0-\uFFE6\u{20000}-\u{3FFFD}]|\p{Emoji_Presentation}/u;
+/** The columns one grapheme takes. */
+const segmentWidth = (segment) => ZERO_WIDTH.test(segment) ? 0 : WIDE.test(segment) ? 2 : 1;
+/**
+* The columns `text` takes in a terminal, without its colors: `│`, `■`,
+* and `…` take one each, though each is several bytes.
+*/
+const displayWidth = (text) => {
+	let width = 0;
+	for (const { segment } of graphemes.segment(stripVTControlCharacters(text))) width += segmentWidth(segment);
+	return width;
+};
+/**
+* `text` cut to `width` display columns, with `…` for the rest, never
+* inside a character: a cut line loses its colors.
+*/
+const truncateLine = (text, width) => {
+	const plain = stripVTControlCharacters(text);
+	if (displayWidth(plain) <= width) return text;
+	let cut = "";
+	let used = 0;
+	for (const { segment } of graphemes.segment(plain)) {
+		used += segmentWidth(segment);
+		if (used > width - 1) break;
+		cut += segment;
+	}
+	return `${cut.trimEnd()}…`;
+};
+const COLOR_CODE = /\u001B\[(\d+)(?:;\d+)*m/gu;
+/** The code that ends a color or style, by the code that starts it. */
+const closingCode = (code) => {
+	if (code >= 30 && code <= 38 || code >= 90 && code <= 97) return 39;
+	if (code >= 40 && code <= 48 || code >= 100 && code <= 107) return 49;
+	return {
+		1: 22,
+		2: 22,
+		3: 23,
+		4: 24,
+		7: 27,
+		8: 28,
+		9: 29
+	}[code];
+};
+/**
+* `lines` with each color that runs past a line's end closed there and
+* reopened on the next, as clack's gutter, colored between them, ends it.
+*/
+const carryColors = (lines) => {
+	const open = /* @__PURE__ */ new Map();
+	return lines.map((line) => {
+		const reopened = [...open.values()].join("");
+		for (const match of line.matchAll(COLOR_CODE)) {
+			const code = Number(match[1]);
+			const closing = closingCode(code);
+			if (code === 0) open.clear();
+			else if (closing === void 0) open.delete(code);
+			else open.set(closing, match[0]);
+		}
+		return `${reopened}${line}${[...open.keys()].reverse().map((code) => `\u001B[${code}m`).join("")}`;
+	});
+};
+/** A line's words, with a color code on its own joined to the next word. */
+const wordsOf = (line) => {
+	const words = [];
+	let colors = "";
+	for (const word of line.match(/\S+/gu) ?? []) if (displayWidth(word) === 0) colors += word;
+	else {
+		words.push(`${colors}${word}`);
+		colors = "";
+	}
+	if (colors && words.length > 0) words[words.length - 1] += colors;
+	return words;
+};
+/**
+* Whether a line is a command to copy, by the program it runs, rather than
+* prose: the next word is an argument, so "aws CLI not found" is prose.
+*/
+const isCommandLine = (line) => /^\s*(?:\$ )?(?:npx|pnpx|bunx|pnpm|npm|yarn|bun|hot-updater|aws|az|gcloud|gh|git)\s+[a-z0-9@./<-]/u.test(stripVTControlCharacters(line));
+/** A row of a bordered table, which a line break would garble. */
+const isTableRow = (line) => /^\s*[┌├└│]/u.test(stripVTControlCharacters(line));
+/** Prose's lines, broken at spaces, each with the line's indentation. */
+const wrapProse = (line, width) => {
+	const indent = /^\s*/u.exec(stripVTControlCharacters(line))?.[0] ?? "";
+	const lines = [];
+	let current = "";
+	for (const word of wordsOf(line)) if (current && displayWidth(`${indent}${current} ${word}`) > width) {
+		lines.push(`${indent}${current}`);
+		current = word;
+	} else current = current ? `${current} ${word}` : word;
+	return [...lines, `${indent}${current}`];
+};
+/**
+* What the CLI prints for people, readable: prose wraps at spaces around
+* `width` display columns, and a command to copy, a table's row, and a word
+* longer than a line, such as a URL or a path, stay whole on their lines.
+* A line that fits stays as it is, so fitting twice changes nothing. `p`
+* applies it to all it prints; text printed another way, such as to stderr
+* under `--json`, calls it.
+*/
+const fitText = (text, width = 73) => {
+	const lines = text.split("\n").flatMap((line) => displayWidth(line) <= width || isCommandLine(line) || isTableRow(line) ? [line] : wrapProse(line, width));
+	return (text.includes("\x1B[") ? carryColors(lines) : lines).join("\n");
+};
+/**
+* A message of `lines`, each fitted as `fitText` does, so a name, a path, or
+* a list it embeds doesn't run on.
+*/
+const fitMessage = (lines) => fitText(lines.join("\n"));
+/** The most a provider's message takes: two lines of a message. */
+const PROVIDER_MESSAGE_WIDTH = 146;
+/** What a response with no message it says shows of itself. */
+const UNREAD_BODY_WIDTH = 40;
+/** Where an error body says what went wrong, most specific first. */
+const MESSAGE_KEYS = [
+	"errors",
+	"error_description",
+	"message",
+	"error",
+	"detail",
+	"title",
+	"msg"
+];
+const messagesIn = (body) => {
+	if (typeof body === "string") return body.trim() ? [body.trim()] : [];
+	if (Array.isArray(body)) return body.flatMap(messagesIn);
+	if (!body || typeof body !== "object") return [];
+	for (const key of MESSAGE_KEYS) {
+		const messages = messagesIn(body[key]);
+		if (messages.length > 0) return messages;
+	}
+	return [];
+};
+/** Where the JSON value that opens at `start` closes, or -1. */
+const closingIndex = (text, start) => {
+	let depth = 0;
+	let inString = false;
+	for (let index = start; index < text.length; index += 1) {
+		const char = text[index];
+		if (inString) {
+			if (char === "\\") index += 1;
+			else if (char === "\"") inString = false;
+		} else if (char === "\"") inString = true;
+		else if (char === "{" || char === "[") depth += 1;
+		else if (char === "}" || char === "]") {
+			depth -= 1;
+			if (depth === 0) return index;
+		}
+	}
+	return -1;
+};
+const parseBody = (text) => {
+	try {
+		const value = JSON.parse(text);
+		return value && typeof value === "object" && (!Array.isArray(value) || value.every((entry) => entry && typeof entry === "object")) ? value : void 0;
+	} catch {
+		return;
+	}
+};
+/**
+* `text` with each JSON body in it, such as the response an SDK's error
+* embeds, replaced with the message the body says, as people read an error:
+* Cloudflare's `errors[].message`, or a `message` or an `error`. A body that
+* says none is cut. Printed errors go through it; `--json` keeps the body.
+* A registered value is masked before anything is cut, as a cut one no longer
+* matches, and again after, as a body's string may have escaped it.
+*/
+const withProviderMessages = (message) => {
+	const text = maskSecretValues(message);
+	let result = "";
+	let index = 0;
+	while (index < text.length) {
+		const char = text[index];
+		const end = char === "{" || char === "[" ? closingIndex(text, index) : -1;
+		const body = end === -1 ? void 0 : parseBody(text.slice(index, end + 1));
+		if (body === void 0) {
+			result += char;
+			index += 1;
+			continue;
+		}
+		const messages = [...new Set(messagesIn(body))];
+		result += messages.length ? truncateLine(messages.join("; "), PROVIDER_MESSAGE_WIDTH) : truncateLine(text.slice(index, end + 1), UNREAD_BODY_WIDTH);
+		index = end + 1;
+	}
+	return maskSecretValues(result);
+};
+//#endregion
 //#region src/stepCapture.ts
 let current;
 const stepCapture = () => current;
@@ -22600,7 +22807,15 @@ const setStepCapture = (capture) => {
 };
 //#endregion
 //#region src/prompts.ts
-const maskMessage = (message) => message === void 0 ? message : maskSecretValues(message);
+/**
+* A message as people read it: masked first, so a line break never splits
+* a value, then its prose wrapped.
+*/
+const printable = (message) => fitText(maskSecretValues(message));
+/** An error or a warning, which says what a provider's JSON body says. */
+const printableFailure = (message) => printable(withProviderMessages(message));
+const printableMessage = (message) => message === void 0 ? message : printable(message);
+const printableFailureMessage = (message) => message === void 0 ? message : printableFailure(message);
 /**
 * Prints a log line, or, while a step runs, holds it until the step's line
 * prints. An info line says what the step is doing, so it shows as the
@@ -22623,13 +22838,21 @@ const logThroughStep = (write, { inStep = "hold" } = {}) => (...args) => {
 	capture.hold(() => write(...args));
 };
 const log$1 = {
-	message: logThroughStep((message, options) => log$2.message(Array.isArray(message) ? message.map(maskSecretValues) : maskMessage(message), options)),
-	info: logThroughStep((message, options) => log$2.info(maskSecretValues(message), options), { inStep: "detail" }),
-	success: logThroughStep((message, options) => log$2.success(maskSecretValues(message), options)),
-	step: logThroughStep((message, options) => log$2.step(maskSecretValues(message), options)),
-	warn: logThroughStep((message, options) => log$2.warn(maskSecretValues(message), options)),
-	warning: logThroughStep((message, options) => log$2.warning(maskSecretValues(message), options)),
-	error: logThroughStep((message, options) => log$2.error(maskSecretValues(message), options), { inStep: "interrupt" })
+	message: logThroughStep((message, options) => log$2.message(Array.isArray(message) ? message.map((line) => printable(line)) : printableMessage(message), options)),
+	info: logThroughStep((message, options) => log$2.info(printable(message), options), { inStep: "detail" }),
+	success: logThroughStep((message, options) => log$2.success(printable(message), options)),
+	step: logThroughStep((message, options) => log$2.step(printable(message), options)),
+	warn: logThroughStep((message, options) => log$2.warn(printableFailure(message), options)),
+	warning: logThroughStep((message, options) => log$2.warning(printableFailure(message), options)),
+	error: logThroughStep((message, options) => log$2.error(printableFailure(message), options), { inStep: "interrupt" })
+};
+/**
+* What a tool wrote, such as a build's output: masked, but printed as the
+* tool wrote it, while everything the CLI writes goes through `p`.
+*/
+const toolOutput = {
+	error: logThroughStep((message, options) => log$2.error(maskSecretValues(message), options), { inStep: "interrupt" }),
+	note: (message, title, options) => note(maskSecretValues(message), title === void 0 ? title : maskSecretValues(title), options)
 };
 /** A spinner inside a running step, whose messages are the step's detail. */
 const spinnerInStep = (capture) => ({
@@ -22643,20 +22866,20 @@ const spinnerInStep = (capture) => ({
 		return false;
 	}
 });
-const maskSpinner = (target) => ({
-	start: (message) => target.start(maskMessage(message)),
-	stop: (message) => target.stop(maskMessage(message)),
-	cancel: (message) => target.cancel(maskMessage(message)),
-	error: (message) => target.error(maskMessage(message)),
-	message: (message) => target.message(maskMessage(message)),
+const printableSpinner = (target) => ({
+	start: (message) => target.start(printableMessage(message)),
+	stop: (message) => target.stop(printableMessage(message)),
+	cancel: (message) => target.cancel(printableFailureMessage(message)),
+	error: (message) => target.error(printableFailureMessage(message)),
+	message: (message) => target.message(printableMessage(message)),
 	clear: () => target.clear(),
 	get isCancelled() {
 		return target.isCancelled;
 	}
 });
-const maskProgress = (target) => ({
-	...maskSpinner(target),
-	advance: (step, message) => target.advance(step, maskMessage(message)),
+const printableProgress = (target) => ({
+	...printableSpinner(target),
+	advance: (step, message) => target.advance(step, printableMessage(message)),
 	get isCancelled() {
 		return target.isCancelled;
 	}
@@ -22705,7 +22928,7 @@ const spinner = (options = {}) => {
 	if (capture) return spinnerInStep(capture);
 	const output = options.output ?? process.stdout;
 	const isInteractive = isTTY(output) && !isCI$1();
-	return maskSpinner(isInteractive ? spinner$1(options) : createStaticSpinner(options));
+	return printableSpinner(isInteractive ? spinner$1(options) : createStaticSpinner(options));
 };
 const progress = (options = {}) => {
 	const capture = stepCapture();
@@ -22719,8 +22942,8 @@ const progress = (options = {}) => {
 		}
 	};
 	const output = options.output ?? process.stdout;
-	if (isTTY(output) && !isCI$1()) return maskProgress(progress$1(options));
-	const staticSpinner = maskSpinner(createStaticSpinner(options));
+	if (isTTY(output) && !isCI$1()) return printableProgress(progress$1(options));
+	const staticSpinner = printableSpinner(createStaticSpinner(options));
 	return {
 		...staticSpinner,
 		advance: (_step, message) => staticSpinner.message(message),
@@ -22756,13 +22979,23 @@ const requireTerminal = (prompt) => {
 			const message = options.message;
 			return Promise.reject(/* @__PURE__ */ new Error(`${typeof message === "string" ? `${message} ` : ""}The CLI asks nothing ${reason}: pass the command's options instead (see --help).`));
 		}
-		return prompt(options);
+		return prompt(fitPromptMessage(options));
 	};
 };
+/** Prompt `options` whose message, when it has one, is fitted. */
+const fitPromptMessage = (options) => {
+	const { message } = options;
+	return typeof message === "string" ? {
+		...options,
+		message: printable(message)
+	} : options;
+};
 /**
 * `@clack/prompts` with CI-safe spinners, with every message a registered
-* credential value appears in masked (`registerSecretValue`), and with
-* prompts that refuse to ask without a terminal.
+* credential value appears in masked (`registerSecretValue`) and its prose
+* wrapped (`fitText`), with a provider's JSON body in an error or a warning
+* replaced with its message, and with prompts that refuse to ask without a
+* terminal.
 */
 const p = {
 	...dist_exports,
@@ -22779,10 +23012,10 @@ const p = {
 	selectKey: requireTerminal(selectKey),
 	text: requireTerminal(text),
 	log: log$1,
-	cancel: (message, options) => cancel(maskMessage(message), options),
-	intro: (title, options) => intro(maskMessage(title), options),
-	note: (message, title, options) => note(maskMessage(message), maskMessage(title), options),
-	outro: (message, options) => outro(maskMessage(message), options),
+	cancel: (message, options) => cancel(printableFailureMessage(message), options),
+	intro: (title, options) => intro(printableMessage(title), options),
+	note: (message, title, options) => note(message === void 0 ? message : maskSecretValues(message), title === void 0 ? title : maskSecretValues(title), options),
+	outro: (message, options) => outro(printableMessage(message), options),
 	progress,
 	spinner,
 	tasks
@@ -22886,61 +23119,6 @@ const createLogWriter = async ({ prefix, logFilePath }) => {
 	}
 };
 //#endregion
-//#region src/messageLines.ts
-/**
-* The widest line of a message the CLI prints: clack puts it after its
-* 3-column gutter (`│  `), and the whole line stays within 76 columns.
-*/
-const MESSAGE_WIDTH = 73;
-const graphemes = new Intl.Segmenter();
-/** Combining marks, format and control characters: they take no column. */
-const ZERO_WIDTH = /^[\p{M}\p{Cf}\p{Cc}]+$/u;
-/** East Asian wide and fullwidth characters, and emoji: two columns each. */
-const WIDE = /[\u1100-\u115F\u2E80-\u303E\u3041-\u33FF\u3400-\u4DBF\u4E00-\u9FFF\uA000-\uA4CF\uAC00-\uD7A3\uF900-\uFAFF\uFE30-\uFE4F\uFF00-\uFF60\uFFE0-\uFFE6\u{20000}-\u{3FFFD}]|\p{Emoji_Presentation}/u;
-/** The columns one grapheme takes. */
-const segmentWidth = (segment) => ZERO_WIDTH.test(segment) ? 0 : WIDE.test(segment) ? 2 : 1;
-/**
-* The columns `text` takes in a terminal, without its colors: `│`, `■`,
-* and `…` take one each, though each is several bytes.
-*/
-const displayWidth = (text) => {
-	let width = 0;
-	for (const { segment } of graphemes.segment(stripVTControlCharacters(text))) width += segmentWidth(segment);
-	return width;
-};
-/**
-* `text` cut to `width` display columns, with `…` for the rest, never
-* inside a character: a cut line loses its colors.
-*/
-const truncateLine = (text, width) => {
-	const plain = stripVTControlCharacters(text);
-	if (displayWidth(plain) <= width) return text;
-	let cut = "";
-	let used = 0;
-	for (const { segment } of graphemes.segment(plain)) {
-		used += segmentWidth(segment);
-		if (used > width - 1) break;
-		cut += segment;
-	}
-	return `${cut.trimEnd()}…`;
-};
-/**
-* A message of `lines`, each at most `MESSAGE_WIDTH` columns, broken at
-* spaces, so a name, a path, or a list it embeds never widens a line. A
-* word longer than a line, such as a URL or a path, gets a line of its
-* own. Lines that fit, such as an indented command, stay as they are.
-*/
-const fitMessage = (lines) => lines.flatMap((line) => {
-	if (displayWidth(line) <= 73) return [line];
-	const fitted = [];
-	let current = "";
-	for (const word of line.split(" ").filter(Boolean)) if (current && displayWidth(current) + 1 + displayWidth(word) > 73) {
-		fitted.push(current);
-		current = word;
-	} else current = current ? `${current} ${word}` : word;
-	return [...fitted, current];
-}).join("\n");
-//#endregion
 //#region src/colors.ts
 var import_picocolors = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	let p = process || {};
@@ -23013,8 +23191,6 @@ var import_picocolors = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin((
 const typedColors = import_picocolors.default;
 //#endregion
 //#region src/step.ts
-/** The widest a finished step's line is, after clack's 3-column gutter. */
-const STEP_WIDTH = 73;
 /** The room the spinner's symbol and its `[12m 34s]` timer take. */
 const LIVE_LINE_CHROME = 13;
 /** `4.2s`, `38s`, `6m41s`, `1h02m`. */
@@ -23030,7 +23206,7 @@ const formatDuration = (ms) => {
 * `message` with `duration` at the right edge of a step's line, the message
 * cut with `…` when the line would be wider.
 */
-const withDuration = (message, ms, width = STEP_WIDTH) => {
+const withDuration = (message, ms, width = 73) => {
 	const duration = formatDuration(ms);
 	const text = truncateLine(message, width - duration.length - 2);
 	const gap = Math.max(2, width - displayWidth(text) - duration.length);
@@ -23127,7 +23303,7 @@ const createStep = (title, { output = process.stdout } = {}) => {
 				return;
 			}
 			finish(() => {
-				log$2.error(maskSecretValues(withDuration(message, elapsed)), logOptions());
+				log$2.error(maskSecretValues(withDuration(withProviderMessages(message), elapsed)), logOptions());
 			});
 		},
 		get elapsedMs() {
@@ -23266,7 +23442,7 @@ var BuildLogger = class {
 		const first = lines.findIndex((line) => line.trim());
 		const last = lines.findLastIndex((line) => line.trim());
 		const summary = first === -1 ? [] : lines.slice(first, last + 1);
-		return maxWidth ? summary.map((line) => truncateLine(line, maxWidth)) : summary;
+		return maxWidth ? summary.map((line) => truncateLine(maskSecretValues(line), maxWidth)) : summary;
 	}
 	async consumeSummaryStream(input) {
 		const lineReader = createInterface({
@@ -23362,7 +23538,7 @@ var BuildLogger = class {
 		const summary = this.failureSummary;
 		const logPath = this.logPath;
 		const message = [...summary, ...logPath ? [...summary.length ? [""] : [], `Build log: ${logPath}`] : []].join("\n");
-		if (message) p.log.error(message, { output: process.stderr });
+		if (message) toolOutput.error(message, { output: process.stderr });
 	}
 };
 //#endregion
@@ -25716,12 +25892,7 @@ const assertPrivateDirectory = async (directory) => {
 	if (!root) return;
 	const top = realpath(root);
 	if (isIgnoredByGit(top, real)) return;
-	throw new Error(fitMessage([
-		`localSecrets() refuses ${directory}: its secrets could be committed.`,
-		`The git repository ${top} doesn't ignore it.`,
-		`Add ${path$1.relative(top, real).split(path$1.sep).join("/")}/ to its .gitignore,`,
-		"or set localSecrets({ path })."
-	]));
+	throw new Error(fitMessage([`localSecrets() refuses ${directory}: its secrets could be committed.`, `Add ${path$1.relative(top, real).split(path$1.sep).join("/")}/ to ${top}'s .gitignore, or set localSecrets({ path }).`]));
 };
 /** Makes `directory` 0700, and every directory it creates on the way. */
 const makePrivateDirectory = async (directory) => {
@@ -26071,11 +26242,7 @@ const readSecretRef = async (name, scope) => {
 		return fromEnv;
 	}
 	const secrets = getConfiguredAdapter(scope?.secrets ?? getConfiguredSecrets());
-	if (secrets === void 0) throw new Error(fitMessage([
-		`secret("${name}") has no value.`,
-		`Set ${variable} in the environment or .env.hotupdater.`,
-		"Or set the config's secrets to a team store."
-	]));
+	if (secrets === void 0) throw new Error(fitMessage([`secret("${name}") has no value.`, `Set ${variable} in the environment or .env.hotupdater.`]));
 	let values;
 	if (scope) {
 		scope.read ??= readSecrets(secrets, batchedNames(scope, name, fileEnv), cwd).catch((error) => {
@@ -26105,28 +26272,10 @@ const describeFields = (fields) => {
 	return `${described.slice(0, -1).join(", ")}, and ${described.at(-1)}`;
 };
 /**
-* A command to print, broken at spaces with ` \` once a line would pass
-* 74 columns, each continuation indented two spaces, so a terminal never
-* wraps it mid-word and it still pastes as one command.
+* `lead` and the command it names on one line when they fit, else the
+* command on the lines after it.
 */
-const formatCommand = (command) => {
-	const lines = [];
-	let line = "";
-	for (const word of command.split(" ")) {
-		const next = line ? `${line} ${word}` : word;
-		if (line && next.length > 72) {
-			lines.push(`${line} \\`);
-			line = `  ${word}`;
-		} else line = next;
-	}
-	lines.push(line);
-	return lines.join("\n");
-};
-/**
-* `lead` and the command it names on one line when they fit 77 columns,
-* else the command on the lines after it.
-*/
-const withLead = (lead, command) => lead.length + 1 + command.length <= 77 ? `${lead} ${command}` : `${lead}\n${formatCommand(command)}`;
+const withLead = (lead, command) => displayWidth(`${lead} ${command}`) <= 73 ? `${lead} ${command}` : `${lead}\n${command}`;
 /**
 * Why a build has no upload keystore, steering away from a second key:
 * Play rejects builds signed with a key it does not have. Under a team's
@@ -26139,7 +26288,7 @@ const describeMissingKeystore = (store, item, name) => {
 	if (configured) return [
 		`No ${item} in ${describeSecret(configured, name)}.`,
 		"Ask whoever set it up to store it there, or import it with:",
-		formatCommand(credentialPutCommand("android-keystore", name))
+		credentialPutCommand("android-keystore", name)
 	].join("\n");
 	return [
 		`No ${item} in the ${store.name} secrets adapter.`,
@@ -26183,7 +26332,7 @@ const credentialStoreCommand = (kind, name = kind) => kind === "asc-api-key" ? c
 * trusted by a shipped app or a store. Under a team's adapter the name or
 * the access is wrong; under `localSecrets()` this machine lacks it.
 */
-const describeMissingSecret = (secrets, name, { action = "import your key", command }) => [fitMessage(getConfiguredAdapter(secrets) ? [`${name} isn't in the ${secrets.name} secrets adapter.`, `Check the name and your access, or ${action}:`] : [`${name} isn't on this machine.`, `Check the name, set ${secretVariableName(name)}, or ${action}:`]), formatCommand(command)].join("\n");
+const describeMissingSecret = (secrets, name, { action = "import your key", command }) => [fitMessage(getConfiguredAdapter(secrets) ? [`${name} isn't in the ${secrets.name} secrets adapter.`, `Check the name and your access, or ${action}:`] : [`${name} isn't on this machine.`, `Check the name, set ${secretVariableName(name)}, or ${action}:`]), command].join("\n");
 var CredentialUnavailableError = class extends Error {
 	kind;
 	/** The environment variables that can provide this credential. */
@@ -26432,7 +26581,7 @@ const createCredentialResolver = ({ env = {}, secrets, cwd } = {}) => {
 			const reason = error instanceof Error ? error.message : String(error);
 			throw new CredentialUnavailableError(kind, `Couldn't read ${item} from the ${store.name} secrets adapter.\n${reason}`, { cause: error });
 		}
-		if (value === void 0) throw new CredentialUnavailableError(kind, kind === "android-keystore" ? describeMissingKeystore(store, item, name) : `No ${item} in the ${store.name} secrets adapter.\nStore it once with:\n${formatCommand(credentialStoreCommand(kind, name))}`);
+		if (value === void 0) throw new CredentialUnavailableError(kind, kind === "android-keystore" ? describeMissingKeystore(store, item, name) : `No ${item} in the ${store.name} secrets adapter.\nStore it once with:\n${credentialStoreCommand(kind, name)}`);
 		registerSecretValue(value);
 		return fromSecretValue[kind](value, {
 			files,
@@ -46600,8 +46749,11 @@ var import_readYaml = require_readYaml();
 const require$2 = createRequire(import.meta.url);
 /**
 * The engine fingerprint.json records for the interface fingerprint. Change
-* it with any change to what is hashed or how, so the new hashes are reported
-* as an engine change rather than a native one.
+* it with any change to what is hashed or how that moves every project's
+* hash, so the new hashes are reported as an engine change rather than a
+* native one. The name is part of every digest, so changing it moves them all:
+* tracking an input nothing tracked before keeps the name, moves only the
+* projects that have that input, and is reported as a change to its files.
 */
 const INTERFACE_FINGERPRINT_ENGINE = "hot-updater/interface@1";
 const GENERATED_DIRS = [
@@ -46648,6 +46800,9 @@ const nativeSourceDir = (platform, config) => {
 	if (typeof value !== "string") return void 0;
 	return platform === "ios" ? path$1.dirname(value) : value;
 };
+const isInNodeModules = (dir) => dir.split(path$1.sep).includes("node_modules");
+/** A folder of native code that exists, outside what an install wrote. */
+const isLinkedSourceDir = (dir) => !isInNodeModules(dir) && existsSync(dir);
 const readManifest = async (dir) => {
 	try {
 		return JSON.parse(await fs$2.readFile(path$1.join(dir, "package.json"), "utf8"));
@@ -46662,6 +46817,25 @@ const parseJsonOutput = (stdout, command) => {
 	} catch {}
 	throw new Error(`\`${command}\` printed no JSON configuration. Check that it runs in this project.`);
 };
+const EXPO_MODULE_CONFIGS = ["expo-module.config.json", "unimodule.json"];
+/**
+* The folder of an Expo module autolinking found outside node_modules: the
+* nearest one above `anchor` that holds its registration or its package.json.
+* `create-expo-module --local` writes no package.json, and an empty `name`
+* reaches here when the module's package.json has none.
+*/
+const findLocalExpoModuleRoot = async (anchor, name) => {
+	const start = await fs$2.realpath(anchor).catch(() => anchor);
+	if (isInNodeModules(start)) return null;
+	let dir = start;
+	while (true) {
+		if (name && (await readManifest(dir))?.name === name) return dir;
+		for (const config of EXPO_MODULE_CONFIGS) if (existsSync(path$1.join(dir, config))) return dir;
+		const parent = path$1.dirname(dir);
+		if (parent === dir) return start;
+		dir = parent;
+	}
+};
 const findPackageRoot = async (from, name) => {
 	let dir = from;
 	while (true) {
@@ -46679,7 +46853,7 @@ const findPackageRoot = async (from, name) => {
 */
 const readExpoModuleConfig = async (root, platform) => {
 	let file = null;
-	for (const name of ["expo-module.config.json", "unimodule.json"]) {
+	for (const name of EXPO_MODULE_CONFIGS) {
 		file = await fs$2.readFile(path$1.join(root, name), "utf8").catch(() => null);
 		if (file !== null) break;
 	}
@@ -46795,8 +46969,7 @@ const readExpoModules = async (cwd, platform) => {
 	};
 };
 const readExpoModuleDependencies = (modules) => Promise.all(modules.flatMap((module) => {
-	const name = module.packageName;
-	if (!name) return [];
+	const name = module.packageName ?? "";
 	const sourceDirs = [
 		...(module.projects ?? []).map(({ sourceDir }) => sourceDir),
 		...(module.plugins ?? []).map(({ sourceDir }) => sourceDir),
@@ -46804,19 +46977,65 @@ const readExpoModuleDependencies = (modules) => Promise.all(modules.flatMap((mod
 	].filter((dir) => Boolean(dir));
 	const files = [...(module.projects ?? []).flatMap(({ aarProjects }) => aarProjects ?? []), ...module.aarProjects ?? []].map(({ aarFilePath }) => aarFilePath).filter((file) => Boolean(file));
 	return [(async () => {
-		const anchor = sourceDirs[0] ?? files[0];
-		const root = anchor ? await findPackageRoot(anchor, name) : null;
-		return root ? {
-			name,
+		const anchor = sourceDirs[0] ?? (files[0] ? path$1.dirname(files[0]) : void 0);
+		const root = (anchor ? await findLocalExpoModuleRoot(anchor, name) : null) ?? (anchor && name ? await findPackageRoot(anchor, name) : null);
+		if (root) return [{
+			name: name || path$1.basename(root),
 			root,
 			sourceDirs,
 			...files.length > 0 ? { files } : {}
-		} : {
+		}];
+		return name ? [{
 			name,
 			version: module.packageVersion ?? "unknown"
-		};
+		}] : [];
 	})()];
-}));
+})).then((dependencies) => dependencies.flat());
+/** The packages an autolinking config links on the platform. */
+const linkedDependencies = (config, platform) => Object.entries(config.dependencies ?? {}).flatMap(([key, dependency]) => {
+	const platformConfig = dependency.platforms?.[platform];
+	if (!platformConfig) return [];
+	const sourceDir = nativeSourceDir(platform, platformConfig);
+	if (dependency.name && dependency.root) {
+		const { name, root } = dependency;
+		return [sourceDir ? {
+			name,
+			root,
+			sourceDirs: [sourceDir]
+		} : {
+			name,
+			root
+		}];
+	}
+	return sourceDir && isLinkedSourceDir(sourceDir) ? [{
+		name: key,
+		root: sourceDir,
+		sourceDirs: [sourceDir]
+	}] : [];
+});
+/**
+* The local packages of a bare app with Expo modules that only Expo's
+* `react-native-config` lists. `install-expo-modules` makes its native project
+* link through that command, which also reads autolinking's search paths, such
+* as `modules/`. Packages it lists in node_modules stay out, so an app with no
+* such package keeps its fingerprint.
+*/
+const readExpoLocalPackages = async (cwd, platform) => {
+	const { bin, linksReactNative } = resolveExpoAutolinking(cwd);
+	if (!linksReactNative || process.env["EXPO_USE_COMMUNITY_AUTOLINKING"] === "1") return [];
+	const { exitCode, stdout } = await execa(process.execPath, [
+		bin,
+		"react-native-config",
+		"--platform",
+		platform,
+		"--json"
+	], {
+		cwd,
+		reject: false
+	});
+	if (exitCode !== 0 || !stdout.includes("{")) return [];
+	return linkedDependencies(parseJsonOutput(stdout, "react-native-config"), platform).filter((dependency) => "root" in dependency && !isInNodeModules(dependency.root));
+};
 const GRADLE_FLAGS = [
 	"hermesEnabled",
 	"hermesV1Enabled",
@@ -46869,24 +47088,23 @@ const readReactNativeInterface = async ({ cwd, command, args, platform, settings
 	const { stdout } = await execa(command, args, { cwd });
 	const config = parseJsonOutput(stdout, [path$1.basename(command), ...args].join(" "));
 	const reactNative = config.reactNativePath ? await readManifest(config.reactNativePath) : null;
-	const dependencies = Object.values(config.dependencies ?? {}).flatMap((dependency) => dependency.name && dependency.root && dependency.platforms?.[platform] ? [{
-		name: dependency.name,
-		root: dependency.root,
-		sourceDir: nativeSourceDir(platform, dependency.platforms[platform])
-	}].map(({ sourceDir, ...rest }) => sourceDir ? {
-		...rest,
-		sourceDirs: [sourceDir]
-	} : rest) : []);
-	const expo = dependencies.some(({ name }) => name === "expo") ? await readExpoModules(cwd, platform) : {
+	const dependencies = linkedDependencies(config, platform);
+	const linksExpoModules = dependencies.some(({ name }) => name === "expo");
+	const expo = linksExpoModules ? await readExpoModules(cwd, platform) : {
 		dependencies: [],
 		output: null
 	};
 	const expoModules = expo.dependencies;
 	const names = new Set(dependencies.map(({ name }) => name));
+	const expoLocalPackages = linksExpoModules && command === process.execPath && !args.includes("react-native-config") ? await readExpoLocalPackages(cwd, platform) : [];
 	const settings = declaredSettings ?? (platform === "android" ? await readGradleFlags(config.project?.android?.sourceDir ?? path$1.join(cwd, "android")) : {});
 	return {
 		runtime: `react-native@${reactNative?.version ?? "unknown"}`,
-		dependencies: [...dependencies, ...expoModules.filter(({ name }) => !names.has(name))],
+		dependencies: [
+			...dependencies,
+			...expoModules.filter(({ name }) => !names.has(name)),
+			...expoLocalPackages.filter(({ name }) => !names.has(name) && !expoModules.some((module) => module.name === name))
+		],
 		settings,
 		autolinking: {
 			reactNative: config,
@@ -46982,6 +47200,18 @@ const findConfiguredPatches = async (root) => {
 	return patches;
 };
 /**
+* Whether the app's package.json installs `name` from a `file:` folder. pnpm,
+* Yarn, and Bun copy the folder into node_modules where npm links it, and the
+* version stays the same while its code changes. A tarball has a version of
+* its own, like a package from a registry or Git.
+*/
+const isFileFolderDependency = async (cwd, name) => {
+	const manifest = await readManifest(cwd);
+	const specifier = manifest?.dependencies?.[name] ?? manifest?.devDependencies?.[name] ?? manifest?.optionalDependencies?.[name];
+	if (!specifier?.startsWith("file:")) return false;
+	return fs$2.stat(path$1.resolve(cwd, specifier.slice(5))).then((stat) => stat.isDirectory(), () => false);
+};
+/**
 * Fingerprints the native interface JavaScript depends on, not the native
 * build: the runtime and its native settings, each registry package as
 * `name@version`, the codegen
@@ -47034,7 +47264,7 @@ const createInterfaceFingerprint = async (cwd, options, nativeInterface) => {
 			continue;
 		}
 		const root = await fs$2.realpath(dependency.root);
-		if (root.split(path$1.sep).includes("node_modules")) {
+		if (isInNodeModules(root) && !await isFileFolderDependency(cwd, dependency.name)) {
 			const version = (await readManifest(root))?.version ?? "unknown";
 			addContents(`dependency:${dependency.name}`, `${dependency.name}@${version}`, "native-dependency");
 			continue;
@@ -47419,6 +47649,13 @@ const resolveConfig = (config, scopes) => {
 	Object.defineProperty(resolved, DEPLOY_SECRET_NAMES, { value: [...new Set(scopes.flatMap((scope) => [...scope.names ?? []]))].filter((name) => !buildNames.includes(name)) });
 	return resolved;
 };
+/**
+* The names the config's build credentials reference, such as
+* `release-keystore`, which builds read from the `secrets` adapter for their
+* kind: `signing`'s, and each scheme's `signing.ascApiKey` and
+* `signing.keystore`.
+*/
+const getBuildSecretNames = (config) => [...new Set(buildSecretNames(config))];
 const DEPLOY_SECRET_NAMES = Symbol.for("@hot-updater/cli-tools/deploy-secret-names");
 /**
 * The names the config's `secret()`s reference for its adapters, such as
@@ -47521,8 +47758,82 @@ const generateSchema = ({ database, plugins }, version, name) => {
 	return database.generateSchema(version, name, toolingTargetOf(plugins));
 };
 //#endregion
+//#region src/expoSdk.ts
+/**
+* The lowest Expo SDK Hot Updater supports, the floor of `@hot-updater/expo`'s
+* `expo` peer range. doctor, the config plugin and the build adapter read it.
+*/
+const MINIMUM_EXPO_SDK = 55;
+/** The command that moves a project to the minimum Expo SDK. */
+const EXPO_SDK_UPGRADE_COMMAND = `npx expo install expo@^55.0.0 --fix`;
+const readJson = (file) => {
+	try {
+		return JSON.parse(Ei.readFileSync(file, "utf-8"));
+	} catch {
+		return null;
+	}
+};
+/**
+* The `expo` a build in `cwd` loads: the nearest `node_modules/expo` up from
+* it, as Node resolves a package. `NODE_PATH` isn't read, since package
+* managers point it at a store that isn't the project's.
+*/
+const installedExpoVersion = (cwd) => {
+	let dir = path$1.resolve(cwd);
+	while (true) {
+		const manifest = readJson(path$1.join(dir, "node_modules", "expo", "package.json"));
+		if (manifest?.version) return manifest.version;
+		const parent = path$1.dirname(dir);
+		if (parent === dir) return null;
+		dir = parent;
+	}
+};
+/**
+* The lowest version a declared range allows, for an exact version, `^`, `~`,
+* `>=`, `=` or an x-range. Null for anything else, such as `catalog:sdk55`,
+* `workspace:*`, `latest` or a union, whose digits name no version.
+*/
+const lowestOfRange = (range) => {
+	const match = /^\s*(?:\^|~|>=|=)?\s*v?(\d+)(?:\.(\d+|x|\*))?(?:\.(\d+|x|\*))?(?:-[0-9A-Za-z.-]+)?\s*$/u.exec(range);
+	if (!match) return null;
+	const part = (value) => value === void 0 || value === "x" || value === "*" ? "0" : value;
+	return `${match[1]}.${part(match[2])}.${part(match[3])}`;
+};
+/**
+* A project's Expo SDK: the installed `expo` the project resolves, else the
+* lowest version its declared range allows. Null without either.
+*/
+const readExpoSdk = (cwd) => {
+	const installed = installedExpoVersion(cwd);
+	if (installed !== null) {
+		const sdk = Number.parseInt(installed, 10);
+		return Number.isNaN(sdk) ? null : {
+			sdk,
+			version: installed,
+			installed: true
+		};
+	}
+	const manifest = readJson(path$1.join(cwd, "package.json"));
+	const declared = manifest?.dependencies?.["expo"] ?? manifest?.devDependencies?.["expo"];
+	const lowest = declared === void 0 ? null : lowestOfRange(declared);
+	if (lowest === null) return null;
+	return {
+		sdk: Number.parseInt(lowest, 10),
+		version: lowest,
+		installed: false
+	};
+};
+/**
+* Refuses a project whose installed Expo is below the minimum SDK. A project
+* without Expo installed passes: nothing could build it yet.
+*/
+const assertSupportedExpoSdk = (cwd) => {
+	const expo = readExpoSdk(cwd);
+	if (expo?.installed && expo.sdk < 55) throw new Error(`Hot Updater requires Expo SDK 55 or later. Run:\n${EXPO_SDK_UPGRADE_COMMAND}`);
+};
+//#endregion
 //#region src/log.ts
-const mask = (message) => typeof message === "string" ? maskSecretValues(message) : message;
+const mask = (message) => typeof message === "string" ? fitText(maskSecretValues(message)) : message;
 const log = {
 	normal: (message) => console.log(mask(message)),
 	success: (message) => console.log(import_picocolors.default.green(mask(message))),
@@ -47555,6 +47866,10 @@ const formatComment = (comment) => {
 	if (comment.includes("\0") || comment.includes("\r") || comment.includes("\n")) throw new Error("Environment comments cannot contain NUL or newlines.");
 	return `# ${comment}`;
 };
+/**
+* Replaces `filePath` whole or not at all, through a new 0600 file beside it,
+* so the result is 0600 whatever the mode of the file it replaces.
+*/
 const writeEnvAtomically = async (filePath, content) => {
 	const resolvedPath = path$1.resolve(filePath);
 	const temporaryPath = path$1.join(path$1.dirname(resolvedPath), `.${path$1.basename(resolvedPath)}.${randomUUID()}.tmp`);
@@ -47632,11 +47947,96 @@ const makeEnv = async (newEnvVars, filePath = ".env.hotupdater", options) => {
 		await writeEnvAtomically(resolvedFilePath, updatedContent);
 		return updatedContent;
 	} catch (error) {
-		console.error("Error while updating .env.hotupdater file:", error);
+		p.log.error(`Error while updating .env.hotupdater file: ${error instanceof Error ? error.message : String(error)}`);
 		throw error;
 	}
 };
 //#endregion
+//#region src/mergeEnvFile.ts
+const BARE_VALUE = /^[A-Za-z0-9_./:@%+,=-]+$/u;
+/**
+* `value` as an env file's value, in the first form `parseLoadedEnv` reads
+* back exactly: bare, single-quoted on one line, double-quoted with its
+* newlines as `\n`, in backticks, or single-quoted across lines. Undefined
+* for a value no form holds, such as one with every quote mark and a newline.
+*/
+const formatEnvValue = (value) => {
+	return [
+		...BARE_VALUE.test(value) ? [value] : [],
+		...value.includes("\n") ? [] : [`'${value}'`],
+		`"${value.replaceAll("\n", "\\n")}"`,
+		`\`${value}\``,
+		`'${value}'`
+	].find((form) => parseLoadedEnv(`V=${form}\n`)["V"] === value);
+};
+const ASSIGNMENT = /^\s*(?:export\s+)?([^\s=#]+)[ \t]*=[ \t]*/u;
+/** The file's assignments in order, read as `parseLoadedEnv` reads them. */
+const scanEntries = (content) => {
+	const entries = [];
+	const lineEnd = (from) => {
+		const newline = content.indexOf("\n", from);
+		return newline === -1 ? content.length : newline;
+	};
+	let position = 0;
+	while (position < content.length) {
+		const end = lineEnd(position);
+		const match = ASSIGNMENT.exec(content.slice(position, end));
+		if (!match) {
+			position = end + 1;
+			continue;
+		}
+		const start = position + match[0].length;
+		const quote = content[start];
+		const closing = quote === "\"" || quote === "'" || quote === "`" ? content.indexOf(quote, start + 1) : -1;
+		if (closing !== -1) {
+			entries.push({
+				key: match[1],
+				start,
+				end: closing + 1
+			});
+			position = lineEnd(closing + 1) + 1;
+			continue;
+		}
+		const comment = content.indexOf("#", start);
+		const stop = comment !== -1 && comment < end ? comment : end;
+		entries.push({
+			key: match[1],
+			start,
+			end: start + content.slice(start, stop).trimEnd().length
+		});
+		position = end + 1;
+	}
+	return entries;
+};
+const sameEnv = (left, right) => Object.keys(left).length === Object.keys(right).length && Object.keys(left).every((key) => Object.hasOwn(right, key) && left[key] === right[key]);
+/**
+* `content`, an env file, with `values` set, already as `formatEnvValue`
+* gives them: a variable it assigns has only that value replaced, the last
+* assignment when it repeats, which is the one that counts, and a new one
+* goes at the end. Every other byte stays: other lines, comments, an
+* `export`, an inline comment. Undefined when `parseLoadedEnv` wouldn't read
+* exactly that back, so a file this can't follow is never rewritten.
+*/
+const mergeEnvContent = (content, values) => {
+	const entries = scanEntries(content);
+	const last = new Map(entries.map((entry) => [entry.key, entry]));
+	const replaced = [...values.keys()].flatMap((key) => last.get(key) ?? []).sort((left, right) => right.start - left.start);
+	let merged = content;
+	for (const entry of replaced) {
+		const gap = merged[entry.end] === "#" ? " " : "";
+		merged = `${merged.slice(0, entry.start)}${values.get(entry.key)}${gap}${merged.slice(entry.end)}`;
+	}
+	const eol = content.includes("\r\n") ? "\r\n" : "\n";
+	const added = [...values].filter(([key]) => !last.has(key));
+	if (added.length > 0) {
+		const gap = merged === "" || merged.endsWith("\n") ? "" : eol;
+		merged += `${gap}${added.map(([key, value]) => `${key}=${value}${eol}`).join("")}`;
+	}
+	const expected = { ...parseLoadedEnv(content) };
+	for (const [key, value] of values) expected[key] = parseLoadedEnv(`V=${value}\n`)["V"] ?? "";
+	return sameEnv(parseLoadedEnv(merged), expected) ? merged : void 0;
+};
+//#endregion
 //#region src/minBundleId.ts
 /**
 * The MIN_BUNDLE_ID a native build compiles in, which is also the ID of its
@@ -47840,4 +48240,4 @@ function transformTemplate(templateString, values) {
 	return result;
 }
 //#endregion
-export { BUNDLE_SIGNING_KEY_SECRET, BuildFailedError, BuildLogger, BundleSigningKeyError, CREDENTIAL_ENV_NAMES, CREDENTIAL_LOGIN_GROUPS, ConfigBuilder, CredentialUnavailableError, HOT_UPDATER_HOME_ENV, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, INTERFACE_FINGERPRINT_ENGINE, INVALID_SIGNING_MESSAGE, INVALID_SIGNING_NEXT_STEP, ISSUE_SIGNING_KEY_COMMAND, InitEnvFileError, InitError, LOCAL_SECRETS_NAME, LegacyInfrastructureError, MANAGED_CLIENT_CREDENTIAL_ENV, MESSAGE_WIDTH, MissingInitInputsError, PUT_SIGNING_KEY_COMMAND, ServerDefinitionError, UNSIGNED_BUNDLES_NEXT_STEP, UNSIGNED_BUNDLES_WARNING, addSigningSecretToConfig, addSigningSecretToConfigText, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, assertUnreservedEnv, autolinkingConfigCommand, banner, bundleSigningPutCommand, bundleSigningSecretRef, clientAuthOf, typedColors as colors, configSetsTeamSecrets, confirmInitInputPersistence, copyDirToTmp, createCredentialResolver, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createInterfaceFingerprint, createLocalSecretsStore, createLogWriter, createMigrator, createMinBundleId, createStep, createTarBrTargetFiles, createZip, credentialIssueCommand, credentialLoginCommand, credentialPutCommand, credentialStoreCommand, decryptJson, defineInitProvider, describeMissingSecret, describeSecret, describeStoredSecret, displayWidth, encryptJson, ensureInstallPackages, failActiveStep, fitMessage, formatCommand, formatDuration, generateClientCredential, generateSchema, generatesSchema, getAndroidSdkPath, getBundleSigningPublicKey, getConfiguredAdapter, getConfiguredSecrets, getCwd, getDeploySecretNames, getHotUpdaterEnvValue, getHotUpdaterHome, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getLocalKeyFile, getLocalKeyStoreDir, getLocalSecretsStore, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getProjectKey, getReactNativeMetadatas, getStorageFileByteSize, isCI, isCodegenSpecFile, isReservedVariableName, isSecretName, isSecretRef, isServerDefinition, keepsKeysOnThisMachine, link, loadConfig, loadPlatformConfigs, loadTeamSecrets, localSecrets, log, makeEnv, maskSecretValues, moduleSpecifiersOf, nonInteractiveReason, p, parseLoadedEnv, parseSecretReference, prepareBundleSigning, printAppSetup, printBanner, provisionClientCredential, putStorageFile, reactNativeCliFingerprint, reactNativeConfigCommand, readBundleSigningPublicKeyFile, readBundleSigningState, readHotUpdaterInitEnv, readLoadedEnvFile, readLoadedHotUpdaterEnv, readLocalKey, readMissingFromTeamSecrets, readPackageUp, readReactNativeInterface, readSecretVariables, readSecretWithSource, readSecrets, registerCredentialValue, registerSecretValue, renderAppImports, renderAppSetup, renderImportStatements, resolveExpoAutolinking, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolveLocalSecretsPath, resolvePackageVersion, resolveSecretsAdapter, secret, secretVariableName, serverDefinitionOf, setConfiguredSecrets, shouldAutoSelectOnlyInitResource, startStep, storeEnvFileSecrets, stripAnsi, transformEnv, transformTemplate, truncateLine, withCredentialResolver, withDuration, withSecretsScope, withStep, writeHotUpdaterConfig, writeHotUpdaterFiles, writeLocalKey };
+export { BUNDLE_SIGNING_KEY_SECRET, BuildFailedError, BuildLogger, BundleSigningKeyError, CREDENTIAL_ENV_NAMES, CREDENTIAL_LOGIN_GROUPS, ConfigBuilder, CredentialUnavailableError, EXPO_SDK_UPGRADE_COMMAND, HOT_UPDATER_HOME_ENV, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, INTERFACE_FINGERPRINT_ENGINE, INVALID_SIGNING_MESSAGE, INVALID_SIGNING_NEXT_STEP, ISSUE_SIGNING_KEY_COMMAND, InitEnvFileError, InitError, LOCAL_SECRETS_NAME, LegacyInfrastructureError, MANAGED_CLIENT_CREDENTIAL_ENV, MESSAGE_WIDTH, MINIMUM_EXPO_SDK, MissingInitInputsError, PUT_SIGNING_KEY_COMMAND, ServerDefinitionError, UNSIGNED_BUNDLES_NEXT_STEP, UNSIGNED_BUNDLES_WARNING, addSigningSecretToConfig, addSigningSecretToConfigText, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, assertSupportedExpoSdk, assertUnreservedEnv, autolinkingConfigCommand, banner, bundleSigningPutCommand, bundleSigningSecretRef, clientAuthOf, typedColors as colors, configSetsTeamSecrets, confirmInitInputPersistence, copyDirToTmp, createCredentialResolver, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createInterfaceFingerprint, createLocalSecretsStore, createLogWriter, createMigrator, createMinBundleId, createStep, createTarBrTargetFiles, createZip, credentialIssueCommand, credentialLoginCommand, credentialPutCommand, credentialStoreCommand, decryptJson, defineInitProvider, describeMissingSecret, describeSecret, describeStoredSecret, displayWidth, encryptJson, ensureInstallPackages, failActiveStep, fitMessage, fitText, formatDuration, formatEnvValue, generateClientCredential, generateSchema, generatesSchema, getAndroidSdkPath, getBuildSecretNames, getBundleSigningPublicKey, getConfiguredAdapter, getConfiguredSecrets, getCwd, getDeploySecretNames, getHotUpdaterEnvValue, getHotUpdaterHome, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getLocalKeyFile, getLocalKeyStoreDir, getLocalSecretsStore, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getProjectKey, getReactNativeMetadatas, getStorageFileByteSize, isCI, isCodegenSpecFile, isCommandLine, isReservedVariableName, isSecretName, isSecretRef, isServerDefinition, keepsKeysOnThisMachine, link, loadConfig, loadPlatformConfigs, loadTeamSecrets, localSecrets, log, makeEnv, maskSecretValues, mergeEnvContent, moduleSpecifiersOf, nonInteractiveReason, p, parseLoadedEnv, parseSecretReference, prepareBundleSigning, printAppSetup, printBanner, provisionClientCredential, putStorageFile, reactNativeCliFingerprint, reactNativeConfigCommand, readBundleSigningPublicKeyFile, readBundleSigningState, readExpoSdk, readHotUpdaterInitEnv, readLoadedEnvFile, readLoadedHotUpdaterEnv, readLocalKey, readMissingFromTeamSecrets, readPackageUp, readReactNativeInterface, readSecretVariables, readSecretWithSource, readSecrets, registerCredentialValue, registerSecretValue, renderAppImports, renderAppSetup, renderImportStatements, resolveExpoAutolinking, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolveLocalSecretsPath, resolvePackageVersion, resolveSecretsAdapter, secret, secretVariableName, serverDefinitionOf, setConfiguredSecrets, shouldAutoSelectOnlyInitResource, startStep, storeEnvFileSecrets, stripAnsi, toolOutput, transformEnv, transformTemplate, truncateLine, withCredentialResolver, withDuration, withProviderMessages, withSecretsScope, withStep, writeEnvAtomically, writeHotUpdaterConfig, writeHotUpdaterFiles, writeLocalKey };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hot-updater/cli-tools",
-  "version": "1.2.0-rc.12",
+  "version": "1.2.0-rc.14",
   "type": "module",
   "engines": {
     "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
@@ -49,9 +49,9 @@
     "oxc-parser": "0.141.0",
     "oxc-transform": "0.141.0",
     "unconfig": "7.5.0",
-    "@hot-updater/protocol": "1.2.0-rc.12",
-    "@hot-updater/plugin-core": "1.2.0-rc.12",
-    "@hot-updater/server": "1.2.0-rc.12"
+    "@hot-updater/protocol": "1.2.0-rc.14",
+    "@hot-updater/plugin-core": "1.2.0-rc.14",
+    "@hot-updater/server": "1.2.0-rc.14"
   },
   "devDependencies": {
     "@clack/prompts": "1.7.0",
@@ -65,7 +65,7 @@
     "tar": "^7.5.16",
     "verkit": "0.4.0",
     "workspace-tools": "^0.41.7",
-    "@hot-updater/test-utils": "1.2.0-rc.12"
+    "@hot-updater/test-utils": "1.2.0-rc.14"
   },
   "inlinedDependencies": {
     "@babel/code-frame": "7.29.0",