@hot-updater/cli-tools 1.2.0-rc.4 → 1.2.0-rc.5

package/dist/index.d.mts

@@ -411,19 +411,14 @@ interface CredentialResolver {
    */
   dispose(): Promise<void>;
 }
-/**
- * The command that stores a credential of `kind` you have as `name` through
- * the config's `secrets` adapter, from its files.
- */
-declare const credentialPutCommand: (kind: CredentialKind, name?: string) => string;
 /** The credentials Hot Updater issues itself after a sign-in. */
 type IssuedCredentialKind = Exclude<CredentialKind, "android-keystore">;
 /**
- * The command that signs in once, at a terminal, and stores the key Hot
- * Updater issues as `name`: an App Store Connect API key after an Apple
- * Account sign-in, a Play service account after a Google one.
+ * The command that stores the key Hot Updater issues as `name`: an App
+ * Store Connect API key after an Apple Account sign-in, a Play service
+ * account after a Google one, and an upload keystore it creates.
  */
-declare const credentialIssueCommand: (kind: IssuedCredentialKind, name?: string) => string;
+declare const credentialIssueCommand: (kind: CredentialKind, name?: string) => string;
 /** The command group of each issued kind's shortcut, `<group> login`. */
 declare const CREDENTIAL_LOGIN_GROUPS: {
   readonly "asc-api-key": "apple";
@@ -438,7 +433,8 @@ declare const CREDENTIAL_LOGIN_GROUPS: {
 declare const credentialLoginCommand: (kind: IssuedCredentialKind, name?: string) => string;
 /**
  * The command that stores a missing credential of `kind` as `name`: the
- * keystore you have, or the key Hot Updater issues after a sign-in.
+ * upload keystore Hot Updater creates, or the key it issues after a
+ * sign-in.
  */
 declare const credentialStoreCommand: (kind: CredentialKind, name?: string) => string;
 declare class CredentialUnavailableError extends Error {
@@ -569,6 +565,15 @@ type WriteHotUpdaterConfigResult = {
   path: string;
   reason?: string;
 };
+/**
+ * `const <name> = secretEnv([...names])`, a helper a managed config reads
+ * credentials with: from the environment and `.env.hotupdater` first, then
+ * from the config's `secrets` adapter. `storageSecrets` and
+ * `databaseSecrets` read each adapter's own, so a command that reaches only
+ * one needs only its credentials; `deploySecrets` reads what both share.
+ * Its builder imports `secretEnv` from `hot-updater`.
+ */
+declare const secretEnvHelper: (name: "databaseSecrets" | "deploySecrets" | "storageSecrets", names: readonly string[]) => ManagedHelperStatement;
 declare const createHotUpdaterConfigScaffold: ({ build, storage, database, plugins, extraImports, helperStatements, updateStrategy }: CreateHotUpdaterConfigScaffoldOptions) => HotUpdaterConfigScaffold;
 declare const createHotUpdaterConfigScaffoldFromBuilder: (builder: ConfigBuilder, { helperStatements, updateStrategy }?: CreateHotUpdaterConfigScaffoldFromBuilderOptions) => HotUpdaterConfigScaffold;
 /**
@@ -596,7 +601,12 @@ type HotUpdaterInitEnv = {
   readonly managedEnv: Readonly<Record<string, string>>;
 };
 declare const getHotUpdaterInitInputEnv: ({ env, managedEnv }: HotUpdaterInitEnv, nonInteractive: boolean) => Readonly<Record<string, string>>;
-declare const readHotUpdaterInitEnv: (cwd: string, envFile?: string) => Promise<HotUpdaterInitEnv>;
+/**
+ * Init's inputs: `.env.hotupdater` (`managedEnv`), with `envFile`'s over
+ * it (`env`). `secretsEnv`, the credentials init read from a team secrets
+ * store, sits under both, as values the file would hold.
+ */
+declare const readHotUpdaterInitEnv: (cwd: string, envFile?: string, secretsEnv?: Readonly<Record<string, string>>) => Promise<HotUpdaterInitEnv>;
 declare const getHotUpdaterEnvValue: (env: Readonly<Record<string, string>>, key: string) => string | undefined;
 /**
  * An env file's variables as `process.loadEnvFile` sets them, the way
@@ -668,6 +678,13 @@ type InitProviderInputsDefinition = Readonly<Record<string, InitProviderInputDef
 type InitProviderDefinition<TInputs extends InitProviderInputsDefinition = InitProviderInputsDefinition> = {
   readonly inputs: TInputs;
   readonly label: string;
+  /**
+   * The variables of the credentials the config init writes reads with
+   * `secretEnv`, such as an API token. With a team `secrets` adapter, init
+   * stores them there with the app's API key, and reads one the
+   * environment and the env file lack from it.
+   */
+  readonly secrets?: readonly string[];
 };
 declare const defineInitProvider: <const TInputs extends InitProviderInputsDefinition>(provider: InitProviderDefinition<TInputs>) => InitProviderDefinition<TInputs>;
 declare const shouldAutoSelectOnlyInitResource: ({ availableResourceCount, savedIdentifier }: {
@@ -706,6 +723,12 @@ declare const getInitProviderEnvVars: <TInputs extends InitProviderInputsDefinit
 type RunInitOptions = {
   readonly build: BuildType;
   readonly envFile?: string;
+  /**
+   * Credentials the environment and the env files lack, read from the
+   * config's team `secrets` adapter (`InitProviderDefinition.secrets`):
+   * init reads them as if `.env.hotupdater` held them.
+   */
+  readonly secretsEnv?: Readonly<Record<string, string>>;
 };
 declare class InitError extends Error {
   readonly name: string;
@@ -909,8 +932,8 @@ type ConfigResponse = RequiredDeep<Omit<ConfigInput, "database" | "storage" | "p
   signing?: ReturnType<typeof normalizeSigningConfig>;
   /**
    * Where `secret:` references and issued keys are read and stored: the
-   * config's adapter with `localSecrets()`'s store after it (`withLocalKeyStore`),
-   * or `localSecrets()` when it sets none.
+   * config's adapter alone, or `localSecrets()` when it sets none
+   * (`resolveSecretsAdapter`).
    */
   secrets: SecretsAdapter;
 };
@@ -927,6 +950,11 @@ declare const loadPlatformConfigs: <TPlatform extends Platform>(platforms: reado
   readonly platform: TPlatform;
   readonly config: ConfigResponse;
 }[]>;
+/**
+ * The names every `secretEnv` the config created while it loaded reads,
+ * such as `HOT_UPDATER_CLOUDFLARE_API_TOKEN`, in the order it created them.
+ */
+declare const getSecretEnvNames: (config: ConfigResponse) => readonly string[];
 //#endregion
 //#region src/serverDefinition.d.ts
 /** A plugin's endpoint on a server's `handlers.client`. */
@@ -2410,9 +2438,9 @@ declare const LOCAL_SECRETS_NAME = "localSecrets";
  * `~/.hot-updater/secrets/<project-key>/<name>.json`; `set` writes that
  * file, 0600 in a 0700 directory, outside the project, so it survives
  * `node_modules` and is never committed. `HOT_UPDATER_HOME` moves
- * `~/.hot-updater`. The project key is the same for every clone of one app
- * on a machine (its `origin` remote and its directory in the repository),
- * so another machine signs in and issues a key of its own.
+ * `~/.hot-updater`. The project key hashes the checkout's real path
+ * (`getProjectKey`), so each clone of an app has its own directory, and
+ * another clone or machine signs in and issues a key of its own.
  *
  * @example
  * export default defineConfig({ secrets: localSecrets(), ... });
@@ -2424,36 +2452,31 @@ interface LocalSecretsOptions {
    * each, such as `~/.hot-updater/secrets/my-app`: `~` is the home
    * directory, and a relative path is the project's. A directory in a git
    * work tree must be one git ignores. Defaults to
-   * `~/.hot-updater/secrets/<project-key>`, whose key is the same for every
-   * clone of the app on a machine (`getProjectKey`).
+   * `~/.hot-updater/secrets/<project-key>`, whose key hashes the
+   * checkout's real path, one per clone (`getProjectKey`).
    */
   readonly path?: string;
 }
 /**
- * The config's `secrets` adapter with `localSecrets()`'s store after it:
- * `get` reads each name the adapter does not hold from
- * `~/.hot-updater/secrets/<project-key>/<name>.json`, and `set` stores there
- * when the adapter stores nothing. Without an adapter, it is
- * `localSecrets()` itself. Keys Hot Updater issues, and credentials
- * `secrets put` imports, are reused by the next build on this machine with
- * no step in between.
+ * The `secrets` adapter a config load uses: the config's own adapter as it
+ * is, with no store on this machine under it, or `localSecrets()` when the
+ * config sets none.
  */
-declare const withLocalKeyStore: (configured?: SecretsAdapter) => SecretsAdapter;
+declare const resolveSecretsAdapter: (configured?: SecretsAdapter) => SecretsAdapter;
 /**
- * The `localSecrets()` store `secrets` reads after its adapter, and stores
- * in when the adapter stores nothing: `localSecrets({ path })`'s, else the
- * default one.
+ * `localSecrets()`'s store, for `localSecrets()` itself; undefined for any
+ * other adapter, which keeps nothing on this machine.
  */
-declare const getLocalSecretsStore: (secrets: SecretsAdapter) => LocalSecretsStore;
+declare const getLocalSecretsStore: (secrets: SecretsAdapter) => LocalSecretsStore | undefined;
 /**
- * The config's own `secrets` adapter, without `localSecrets()`'s store
- * after it: undefined for `localSecrets()`, and when the config sets none.
- * `secretEnv` reads deploy credentials from it.
+ * The config's own `secrets` adapter: undefined for `localSecrets()`,
+ * which is the adapter when the config sets none. `secretEnv` reads deploy
+ * credentials from it.
  */
 declare const getConfiguredAdapter: (secrets: SecretsAdapter) => SecretsAdapter | undefined;
 /**
- * Where `secrets.set` stores `name`, for messages: the config's adapter
- * when it stores values, else `localSecrets()`'s file.
+ * Where `secrets.set` stores `name`, for messages: the config's adapter,
+ * else `localSecrets()`'s file.
  */
 declare const describeStoredSecret: (secrets: SecretsAdapter, name: string) => string;
 /**
@@ -2473,10 +2496,12 @@ declare const readSecretWithSource: (secrets: SecretsAdapter, name: string, cwd:
 declare const keepsKeysOnThisMachine: (secrets: SecretsAdapter) => boolean;
 /**
  * The `secrets` adapter of one config load, filled once the config it
- * evaluates resolves: each `secretEnv` the evaluation creates reads from it.
+ * evaluates resolves: each `secretEnv` the evaluation creates reads from it,
+ * and adds the names it reads to `names`.
  */
 interface SecretsScope {
   secrets?: SecretsAdapter;
+  names?: Set<string>;
 }
 /**
  * Evaluates a config, the file or a config function, with `scope` as the
@@ -2493,8 +2518,8 @@ declare const withSecretsScope: <T>(scope: SecretsScope, evaluate: () => Promise
  */
 declare const setConfiguredSecrets: (secrets: SecretsAdapter) => void;
 /**
- * The config's `secrets` adapter with `localSecrets()`'s store after it
- * (`withLocalKeyStore`), `localSecrets()` until a config loads.
+ * The config's `secrets` adapter (`resolveSecretsAdapter`), `localSecrets()`
+ * until a config loads.
  */
 declare const getConfiguredSecrets: () => SecretsAdapter;
 /** Where an adapter keeps `name`, for messages. */
@@ -2524,6 +2549,38 @@ declare const describeSecret: (secrets: SecretsAdapter, name: string) => string;
  */
 declare const secretEnv: <const TName extends string>(names: readonly TName[]) => (() => Promise<Readonly<Record<TName, string>>>);
 //#endregion
+//#region src/teamSecrets.d.ts
+/**
+ * The client API key the managed servers' `apiKeys()` gives an app, which
+ * init saves (`API_KEY_ENV` in `@hot-updater/plugin-api-keys`). The config
+ * never reads it; a team store shares it with the deploy credentials, so a
+ * teammate's init registers the same key again rather than a new one.
+ */
+declare const MANAGED_CLIENT_CREDENTIAL_ENV = "HOT_UPDATER_API_KEY";
+/**
+ * The config's own `secrets` adapter, the team store: undefined when the
+ * config sets none, which is `localSecrets()`. Loading the config runs its
+ * `process.loadEnvFile(".env.hotupdater")`, which init must not see, so
+ * `process.env` is restored after it.
+ */
+declare const loadTeamSecrets: () => Promise<SecretsAdapter | undefined>;
+/**
+ * `names` neither the environment nor `env`, init's env files, sets, read
+ * from `secrets` in one call: the values a teammate's init, or a run after
+ * the file's lines were deleted, replays with.
+ */
+declare const readMissingFromTeamSecrets: (secrets: SecretsAdapter, names: readonly string[], { env, cwd }: {
+  readonly env: Readonly<Record<string, string>>;
+  readonly cwd: string;
+}) => Promise<Readonly<Record<string, string>>>;
+/**
+ * Stores each of `names` that `.env.hotupdater` holds through `secrets`,
+ * then reads them back in one call. The file is left as it is. Returns the
+ * names stored, in the order of `names`; throws when the adapter reads
+ * back another value.
+ */
+declare const storeEnvFileSecrets: (secrets: SecretsAdapter, names: readonly string[], cwd: string) => Promise<readonly string[]>;
+//#endregion
 //#region src/storageFiles.d.ts
 declare const getStorageFileByteSize: (filePath: string) => Promise<number>;
 declare const putStorageFile: (storage: StorageAdapterWith<"put">, key: string, filePath: string) => Promise<StoragePutResult & {
@@ -2547,4 +2604,4 @@ type TransformTemplateArgs<T extends string> = { [Key in ExtractPlaceholders<T>]
  */
 declare function transformTemplate<T extends string>(templateString: T, values: TransformTemplateArgs<T>): string;
 //#endregion
-export { AppClientCredential, AppClientPlugin, AssembleServerOptions, AssembledServer, BuildFailedError, BuildFailureSummaryConfig, BuildLogger, BuildLoggerConfig, BuildType, BundleSigningSession, CREDENTIAL_ENV_NAMES, CREDENTIAL_LOGIN_GROUPS, ClientAuthSpec, ClientCredentialSpec, ConfigBuilder, ConfigBuilderScaffold, ConfigResponse, CreateCredentialResolverOptions, CreateHotUpdaterConfigScaffoldFromBuilderOptions, CreateHotUpdaterConfigScaffoldOptions, type CredentialFiles, CredentialKind, CredentialRequest, CredentialResolver, CredentialUnavailableError, Credentials, DEFAULT_SIGNING_KEY_SECRET, HOT_UPDATER_HOME_ENV, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, HotUpdaterConfigOptions, HotUpdaterConfigScaffold, HotUpdaterInitEnv, HotUpdaterLogWriter, INTERFACE_FINGERPRINT_ENGINE, ImportInfo, InitEnvFileError, InitError, InitProviderDefinition, InitProviderInputDefinition, InitProviderInputPersistence, IssuedCredentialKind, LOCAL_SECRETS_NAME, LegacyInfrastructureError, LocalSecretsOptions, LocalSecretsStore, ManagedHelperStatement, ManagedHelperStrategy, MissingInitInputsError, NativeDependency, NativeInterface, PromptProgress, PromptSpinner, ProviderConfig, ProvisionedClientCredential, ReactNativeMetadata, ReadPackageUpResult, RunInitOptions, SecretsScope, ServerClientEndpoint, ServerDefinition, ServerDefinitionError, WriteHotUpdaterConfigResult, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, assertUnreservedEnv, autolinkingConfigCommand, banner, clientAuthOf, typedColors as colors, confirmInitInputPersistence, copyDirToTmp, createCredentialResolver, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createInterfaceFingerprint, createLocalSecretsStore, createLogWriter, createMigrator, createMinBundleId, createTarBrTargetFiles, createZip, credentialIssueCommand, credentialLoginCommand, credentialPutCommand, credentialStoreCommand, decryptJson, defineInitProvider, describeSecret, describeStoredSecret, encryptJson, ensureInstallPackages, generateClientCredential, generateSchema, generatesSchema, getAndroidSdkPath, getBundleSigningPublicKey, getConfiguredAdapter, getConfiguredSecrets, getCwd, getHotUpdaterEnvValue, getHotUpdaterHome, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getLocalKeyFile, getLocalKeyStoreDir, getLocalSecretsStore, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getProjectKey, getReactNativeMetadatas, getStorageFileByteSize, isCI, isCodegenSpecFile, isReservedVariableName, isSecretName, isServerDefinition, keepsKeysOnThisMachine, link, loadConfig, loadPlatformConfigs, localSecrets, log, makeEnv, maskSecretValues, moduleSpecifiersOf, nonInteractiveReason, p, parseLoadedEnv, parseSecretReference, prepareBundleSigning, printAppSetup, printBanner, provisionClientCredential, putStorageFile, reactNativeCliFingerprint, reactNativeConfigCommand, readBundleSigningPublicKeyFile, readHotUpdaterInitEnv, readLoadedHotUpdaterEnv, readLocalKey, readPackageUp, readReactNativeInterface, readSecretVariables, readSecretWithSource, registerCredentialValue, registerSecretValue, renderAppImports, renderAppSetup, renderImportStatements, resolveExpoAutolinking, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolveLocalSecretsPath, resolvePackageVersion, secretEnv, secretVariableName, serverDefinitionOf, setConfiguredSecrets, shouldAutoSelectOnlyInitResource, stripAnsi, transformEnv, transformTemplate, withCredentialResolver, withLocalKeyStore, withSecretsScope, writeHotUpdaterConfig, writeHotUpdaterFiles, writeLocalKey };
+export { AppClientCredential, AppClientPlugin, AssembleServerOptions, AssembledServer, BuildFailedError, BuildFailureSummaryConfig, BuildLogger, BuildLoggerConfig, BuildType, BundleSigningSession, CREDENTIAL_ENV_NAMES, CREDENTIAL_LOGIN_GROUPS, ClientAuthSpec, ClientCredentialSpec, ConfigBuilder, ConfigBuilderScaffold, ConfigResponse, CreateCredentialResolverOptions, CreateHotUpdaterConfigScaffoldFromBuilderOptions, CreateHotUpdaterConfigScaffoldOptions, type CredentialFiles, CredentialKind, CredentialRequest, CredentialResolver, CredentialUnavailableError, Credentials, DEFAULT_SIGNING_KEY_SECRET, HOT_UPDATER_HOME_ENV, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, HotUpdaterConfigOptions, HotUpdaterConfigScaffold, HotUpdaterInitEnv, HotUpdaterLogWriter, INTERFACE_FINGERPRINT_ENGINE, ImportInfo, InitEnvFileError, InitError, InitProviderDefinition, InitProviderInputDefinition, InitProviderInputPersistence, IssuedCredentialKind, LOCAL_SECRETS_NAME, LegacyInfrastructureError, LocalSecretsOptions, LocalSecretsStore, MANAGED_CLIENT_CREDENTIAL_ENV, ManagedHelperStatement, ManagedHelperStrategy, MissingInitInputsError, NativeDependency, NativeInterface, PromptProgress, PromptSpinner, ProviderConfig, ProvisionedClientCredential, ReactNativeMetadata, ReadPackageUpResult, RunInitOptions, SecretsScope, ServerClientEndpoint, ServerDefinition, ServerDefinitionError, WriteHotUpdaterConfigResult, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, assertUnreservedEnv, autolinkingConfigCommand, banner, clientAuthOf, typedColors as colors, confirmInitInputPersistence, copyDirToTmp, createCredentialResolver, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createInterfaceFingerprint, createLocalSecretsStore, createLogWriter, createMigrator, createMinBundleId, createTarBrTargetFiles, createZip, credentialIssueCommand, credentialLoginCommand, credentialStoreCommand, decryptJson, defineInitProvider, describeSecret, describeStoredSecret, encryptJson, ensureInstallPackages, generateClientCredential, generateSchema, generatesSchema, getAndroidSdkPath, getBundleSigningPublicKey, getConfiguredAdapter, getConfiguredSecrets, getCwd, getHotUpdaterEnvValue, getHotUpdaterHome, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getLocalKeyFile, getLocalKeyStoreDir, getLocalSecretsStore, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getProjectKey, getReactNativeMetadatas, getSecretEnvNames, getStorageFileByteSize, isCI, isCodegenSpecFile, isReservedVariableName, isSecretName, isServerDefinition, keepsKeysOnThisMachine, link, loadConfig, loadPlatformConfigs, loadTeamSecrets, localSecrets, log, makeEnv, maskSecretValues, moduleSpecifiersOf, nonInteractiveReason, p, parseLoadedEnv, parseSecretReference, prepareBundleSigning, printAppSetup, printBanner, provisionClientCredential, putStorageFile, reactNativeCliFingerprint, reactNativeConfigCommand, readBundleSigningPublicKeyFile, readHotUpdaterInitEnv, readLoadedHotUpdaterEnv, readLocalKey, readMissingFromTeamSecrets, readPackageUp, readReactNativeInterface, readSecretVariables, readSecretWithSource, registerCredentialValue, registerSecretValue, renderAppImports, renderAppSetup, renderImportStatements, resolveExpoAutolinking, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolveLocalSecretsPath, resolvePackageVersion, resolveSecretsAdapter, secretEnv, secretEnvHelper, secretVariableName, serverDefinitionOf, setConfiguredSecrets, shouldAutoSelectOnlyInitResource, storeEnvFileSecrets, stripAnsi, transformEnv, transformTemplate, withCredentialResolver, withSecretsScope, writeHotUpdaterConfig, writeHotUpdaterFiles, writeLocalKey };

package/dist/index.mjs

@@ -25247,9 +25247,17 @@ const readEnvFile = async (filePath, allowMissing) => {
 	return parseEnv$1(content);
 };
 const getHotUpdaterInitInputEnv = ({ env, managedEnv }, nonInteractive) => nonInteractive ? env : managedEnv;
-const readHotUpdaterInitEnv = async (cwd, envFile) => {
+/**
+* Init's inputs: `.env.hotupdater` (`managedEnv`), with `envFile`'s over
+* it (`env`). `secretsEnv`, the credentials init read from a team secrets
+* store, sits under both, as values the file would hold.
+*/
+const readHotUpdaterInitEnv = async (cwd, envFile, secretsEnv = {}) => {
 	const savedEnvPath = path.resolve(cwd, HOT_UPDATER_ENV_PATH);
-	const savedEnv = await readEnvFile(savedEnvPath, true);
+	const savedEnv = {
+		...secretsEnv,
+		...await readEnvFile(savedEnvPath, true)
+	};
 	if (!envFile) return {
 		env: {},
 		managedEnv: savedEnv
@@ -25511,8 +25519,7 @@ const RESERVED_PREFIXES = [
 	"LD_",
 	"DYLD_",
 	"GIT_",
-	"NPM_CONFIG_",
-	"HOT_UPDATER_GOOGLE_OAUTH_CLIENT_"
+	"NPM_CONFIG_"
 ];
 /**
 * Whether `name` is a variable no secret may set: one a loader or
@@ -25572,8 +25579,6 @@ const readSecretVariables = async (names, cwd) => {
 /** `localSecrets()`'s name, the `secrets` adapter when the config sets none. */
 const LOCAL_SECRETS_NAME = "localSecrets";
 const LOCAL_KEY_STORE = Symbol.for("@hot-updater/cli-tools/local-key-store");
-/** `localSecrets()`'s store without a `path`, the one after any adapter. */
-const defaultLocalSecretsStore = createLocalSecretsStore();
 const isLocalKeyStoreSecrets = (secrets) => LOCAL_KEY_STORE in secrets;
 /**
 * Secrets in JSON files on this machine, the `secrets` adapter when the
@@ -25582,77 +25587,52 @@ const isLocalKeyStoreSecrets = (secrets) => LOCAL_KEY_STORE in secrets;
 * `~/.hot-updater/secrets/<project-key>/<name>.json`; `set` writes that
 * file, 0600 in a 0700 directory, outside the project, so it survives
 * `node_modules` and is never committed. `HOT_UPDATER_HOME` moves
-* `~/.hot-updater`. The project key is the same for every clone of one app
-* on a machine (its `origin` remote and its directory in the repository),
-* so another machine signs in and issues a key of its own.
+* `~/.hot-updater`. The project key hashes the checkout's real path
+* (`getProjectKey`), so each clone of an app has its own directory, and
+* another clone or machine signs in and issues a key of its own.
 *
 * @example
 * export default defineConfig({ secrets: localSecrets(), ... });
 */
-const localSecrets = (options = {}) => createLocalKeyStoreSecrets(void 0, createLocalSecretsStore(options));
+const localSecrets = (options = {}) => createLocalSecrets(createLocalSecretsStore(options));
 /**
-* The config's `secrets` adapter with `localSecrets()`'s store after it:
-* `get` reads each name the adapter does not hold from
-* `~/.hot-updater/secrets/<project-key>/<name>.json`, and `set` stores there
-* when the adapter stores nothing. Without an adapter, it is
-* `localSecrets()` itself. Keys Hot Updater issues, and credentials
-* `secrets put` imports, are reused by the next build on this machine with
-* no step in between.
+* The `secrets` adapter a config load uses: the config's own adapter as it
+* is, with no store on this machine under it, or `localSecrets()` when the
+* config sets none.
 */
-const withLocalKeyStore = (configured) => configured && isLocalKeyStoreSecrets(configured) ? configured : createLocalKeyStoreSecrets(configured, defaultLocalSecretsStore);
-const createLocalKeyStoreSecrets = (configured, store) => {
-	const describeFile = (name) => store.file(name, getCwd());
+const resolveSecretsAdapter = (configured) => configured ?? localSecrets();
+const createLocalSecrets = (store) => {
 	return {
-		name: configured?.name ?? "localSecrets",
-		[LOCAL_KEY_STORE]: configured ? {
-			configured,
-			store
-		} : { store },
+		name: LOCAL_SECRETS_NAME,
+		[LOCAL_KEY_STORE]: { store },
 		get: async (names, context) => {
-			const values = configured ? { ...await configured.get(names, context) } : await readSecretVariables(names, context.cwd);
+			const values = await readSecretVariables(names, context.cwd);
 			const read = Object.create(null);
-			for (const name of names) {
-				const value = Object.hasOwn(values, name) ? values[name] : void 0;
-				read[name] = typeof value === "string" && value ? value : await store.read(name, context.cwd);
-			}
+			for (const name of names) read[name] = values[name] || await store.read(name, context.cwd);
 			return read;
 		},
 		set: async (name, value, context) => {
-			if (configured?.set) {
-				await configured.set(name, value, context);
-				if (await store.read(name, context.cwd) === void 0) return;
-				try {
-					await store.write(name, value, context.cwd);
-				} catch (error) {
-					p.log.warn(`The ${configured.name} secrets adapter stored ${name}, and the copy on this machine at ${store.file(name, context.cwd)} still holds the value it replaced: ${error instanceof Error ? error.message : String(error)}. Delete that file.`);
-				}
-				return;
-			}
 			await store.write(name, value, context.cwd);
 		},
-		describe: (name) => configured ? `${describeSecret(configured, name)}, or ${describeFile(name)} on this machine` : `${secretVariableName(name)} in the environment, or ${describeFile(name)} on this machine`
+		describe: (name) => `${secretVariableName(name)} in the environment, or ${store.file(name, getCwd())} on this machine`
 	};
 };
 /**
-* The `localSecrets()` store `secrets` reads after its adapter, and stores
-* in when the adapter stores nothing: `localSecrets({ path })`'s, else the
-* default one.
+* `localSecrets()`'s store, for `localSecrets()` itself; undefined for any
+* other adapter, which keeps nothing on this machine.
 */
-const getLocalSecretsStore = (secrets) => isLocalKeyStoreSecrets(secrets) ? secrets[LOCAL_KEY_STORE].store : defaultLocalSecretsStore;
+const getLocalSecretsStore = (secrets) => isLocalKeyStoreSecrets(secrets) ? secrets[LOCAL_KEY_STORE].store : void 0;
 /**
-* The config's own `secrets` adapter, without `localSecrets()`'s store
-* after it: undefined for `localSecrets()`, and when the config sets none.
-* `secretEnv` reads deploy credentials from it.
+* The config's own `secrets` adapter: undefined for `localSecrets()`,
+* which is the adapter when the config sets none. `secretEnv` reads deploy
+* credentials from it.
 */
-const getConfiguredAdapter = (secrets) => isLocalKeyStoreSecrets(secrets) ? secrets[LOCAL_KEY_STORE].configured : secrets;
+const getConfiguredAdapter = (secrets) => isLocalKeyStoreSecrets(secrets) ? void 0 : secrets;
 /**
-* Where `secrets.set` stores `name`, for messages: the config's adapter
-* when it stores values, else `localSecrets()`'s file.
+* Where `secrets.set` stores `name`, for messages: the config's adapter,
+* else `localSecrets()`'s file.
 */
-const describeStoredSecret = (secrets, name) => {
-	const configured = getConfiguredAdapter(secrets);
-	return configured?.set ? describeSecret(configured, name) : getLocalSecretsStore(secrets).file(name, getCwd());
-};
+const describeStoredSecret = (secrets, name) => getLocalSecretsStore(secrets)?.file(name, getCwd()) ?? describeSecret(secrets, name);
 /**
 * `name`'s value, read in the order `secrets.get` reads it, with the one
 * place it came from, for messages: the config's adapter
@@ -25661,27 +25641,19 @@ const describeStoredSecret = (secrets, name) => {
 */
 const readSecretWithSource = async (secrets, name, cwd) => {
 	const held = (value) => typeof value === "string" && value.length > 0;
-	if (!isLocalKeyStoreSecrets(secrets)) {
+	const store = getLocalSecretsStore(secrets);
+	if (!store) {
 		const value = (await secrets.get([name], { cwd }))[name];
 		return held(value) ? {
 			value,
 			source: describeSecret(secrets, name)
 		} : void 0;
 	}
-	const { configured, store } = secrets[LOCAL_KEY_STORE];
-	if (configured) {
-		const value = (await configured.get([name], { cwd }))[name];
-		if (held(value)) return {
-			value,
-			source: describeSecret(configured, name)
-		};
-	} else {
-		const value = (await readSecretVariables([name], cwd))[name];
-		if (held(value)) return {
-			value,
-			source: `${secretVariableName(name)} (environment)`
-		};
-	}
+	const variable = (await readSecretVariables([name], cwd))[name];
+	if (held(variable)) return {
+		value: variable,
+		source: `${secretVariableName(name)} (environment)`
+	};
 	const value = await store.read(name, cwd);
 	return held(value) ? {
 		value,
@@ -25721,13 +25693,13 @@ const setConfiguredSecrets = (secrets) => {
 	globalThis[CONFIGURED_SECRETS] = secrets;
 };
 /**
-* The config's `secrets` adapter with `localSecrets()`'s store after it
-* (`withLocalKeyStore`), `localSecrets()` until a config loads.
+* The config's `secrets` adapter (`resolveSecretsAdapter`), `localSecrets()`
+* until a config loads.
 */
 const getConfiguredSecrets = () => globalThis[CONFIGURED_SECRETS] ?? localSecrets();
 /** Where an adapter keeps `name`, for messages. */
 const describeSecret = (secrets, name) => secrets.describe?.(name) ?? `${name} in ${secrets.name}`;
-const list = (names) => names.length <= 2 ? names.join(" and ") : `${names.slice(0, -1).join(", ")}, and ${names.at(-1)}`;
+const list$1 = (names) => names.length <= 2 ? names.join(" and ") : `${names.slice(0, -1).join(", ")}, and ${names.at(-1)}`;
 /**
 * Environment variables from the `secrets` adapter of the config that
 * creates it, as a function a config calls when an adapter needs them, so loading
@@ -25756,35 +25728,44 @@ const secretEnv = (names) => {
 	const invalid = wanted.filter((name) => !ENV_NAME_PATTERN.test(name));
 	if (invalid.length > 0) throw new Error(`secretEnv takes environment variable names: letters, digits, and underscores, not starting with a digit, and ${invalid.map((name) => JSON.stringify(name)).join(", ")} ${invalid.length === 1 ? "is" : "are"} not.`);
 	const reserved = wanted.filter(isReservedVariableName);
-	if (reserved.length > 0) throw new Error(`secretEnv refuses ${list(reserved)}: ${reserved.length === 1 ? "it changes" : "they change"} how a process loads code or which credentials Hot Updater uses.`);
+	if (reserved.length > 0) throw new Error(`secretEnv refuses ${list$1(reserved)}: ${reserved.length === 1 ? "it changes" : "they change"} how a process loads code or which credentials Hot Updater uses.`);
 	const scope = globalThis[LOADING_SCOPE];
-	return async () => {
-		const cwd = getCwd();
-		const fileEnv = await readLoadedHotUpdaterEnv(cwd);
-		const variables = Object.create(null);
-		const fromStore = [];
-		for (const name of wanted) {
-			const value = getHotUpdaterEnvValue(fileEnv, name);
-			if (value === void 0) fromStore.push(name);
-			else variables[name] = value;
-		}
-		if (fromStore.length > 0) {
-			const secrets = getConfiguredAdapter(scope?.secrets ?? getConfiguredSecrets());
-			const read = secrets ? await secrets.get(fromStore, { cwd }) : {};
-			const missing = fromStore.filter((name) => {
-				const value = Object.hasOwn(read, name) ? read[name] : void 0;
-				if (typeof value !== "string" || value === "") return true;
-				variables[name] = value;
-				return false;
-			});
-			if (missing.length > 0) {
-				const them = missing.length === 1 ? "it" : "them";
-				throw new Error(secrets === void 0 ? `secretEnv found no value for ${list(missing)}: set ${them} in the environment or .env.hotupdater, or read ${them} from a secrets store with the config's secrets.` : `secretEnv found no value for ${list(missing)}: ${missing.length === 1 ? "it is" : "they are"} not set in the environment or .env.hotupdater, and the ${secrets.name} secrets adapter does not hold ${them} (${missing.map((name) => describeSecret(secrets, name)).join("; ")}).`);
-			}
+	if (scope) {
+		scope.names ??= /* @__PURE__ */ new Set();
+		for (const name of wanted) scope.names.add(name);
+	}
+	let read;
+	return () => read ??= readSecretEnv(wanted, scope).catch((error) => {
+		read = void 0;
+		throw error;
+	});
+};
+const readSecretEnv = async (wanted, scope) => {
+	const cwd = getCwd();
+	const fileEnv = await readLoadedHotUpdaterEnv(cwd);
+	const variables = Object.create(null);
+	const fromStore = [];
+	for (const name of wanted) {
+		const value = getHotUpdaterEnvValue(fileEnv, name);
+		if (value === void 0) fromStore.push(name);
+		else variables[name] = value;
+	}
+	if (fromStore.length > 0) {
+		const secrets = getConfiguredAdapter(scope?.secrets ?? getConfiguredSecrets());
+		const read = secrets ? await secrets.get(fromStore, { cwd }) : {};
+		const missing = fromStore.filter((name) => {
+			const value = Object.hasOwn(read, name) ? read[name] : void 0;
+			if (typeof value !== "string" || value === "") return true;
+			variables[name] = value;
+			return false;
+		});
+		if (missing.length > 0) {
+			const them = missing.length === 1 ? "it" : "them";
+			throw new Error(secrets === void 0 ? `secretEnv found no value for ${list$1(missing)}: set ${them} in the environment or .env.hotupdater, or read ${them} from a secrets store with the config's secrets.` : `secretEnv found no value for ${list$1(missing)}: ${missing.length === 1 ? "it is" : "they are"} not set in the environment or .env.hotupdater, and the ${secrets.name} secrets adapter does not hold ${them} (${missing.map((name) => describeSecret(secrets, name)).join("; ")}).`);
 		}
-		for (const value of Object.values(variables)) registerSecretValue(value);
-		return Object.freeze(variables);
-	};
+	}
+	for (const value of Object.values(variables)) registerSecretValue(value);
+	return Object.freeze(variables);
 };
 //#endregion
 //#region src/localBundleSigning.ts
@@ -38744,21 +38725,33 @@ const formatCommand = (command) => {
 	return lines.join("\n");
 };
 /**
-* The command that stores a credential of `kind` you have as `name` through
-* the config's `secrets` adapter, from its files.
+* `lead` and the command it names on one line when they fit 77 columns,
+* else the command on the lines after it.
 */
-const credentialPutCommand = (kind, name = kind) => {
-	const put = `npx hot-updater secrets put ${name} --kind ${kind}`;
-	switch (kind) {
-		case "android-keystore": return `${put} --keystore <release.jks> --key-alias <alias>`;
-		case "asc-api-key": return `${put} --p8 <AuthKey.p8> --key-id <id> --issuer-id <id>`;
-		case "play-service-account": return `${put} --service-account <key.json>`;
-	}
+const withLead = (lead, command) => lead.length + 1 + command.length <= 77 ? `${lead} ${command}` : `${lead}\n${formatCommand(command)}`;
+/**
+* Why a build has no upload keystore, in three lines, steering away from a
+* second key: Play rejects builds signed with a key it does not have.
+* Under a team's adapter the keystore is someone's already, so it is
+* imported, never created; only `localSecrets()` alone offers a new one.
+*/
+const describeMissingKeystore = (store, item, name) => {
+	const configured = getConfiguredAdapter(store);
+	if (configured) return [
+		`No ${item} in ${describeSecret(configured, name)}.`,
+		"Ask whoever set it up to store it there, or import it with:",
+		"npx hot-updater google-play login"
+	].join("\n");
+	return [
+		`No ${item} in the ${store.name} secrets adapter.`,
+		"Play rejects a new key if the app has one: import it with google-play login.",
+		withLead("Otherwise:", credentialStoreCommand("android-keystore", name))
+	].join("\n");
 };
 /**
-* The command that signs in once, at a terminal, and stores the key Hot
-* Updater issues as `name`: an App Store Connect API key after an Apple
-* Account sign-in, a Play service account after a Google one.
+* The command that stores the key Hot Updater issues as `name`: an App
+* Store Connect API key after an Apple Account sign-in, a Play service
+* account after a Google one, and an upload keystore it creates.
 */
 const credentialIssueCommand = (kind, name = kind) => `npx hot-updater secrets issue ${kind}${name === kind ? "" : ` ${name}`}`;
 /** The command group of each issued kind's shortcut, `<group> login`. */
@@ -38775,9 +38768,10 @@ const CREDENTIAL_LOGIN_GROUPS = {
 const credentialLoginCommand = (kind, name = kind) => name === kind ? `npx hot-updater ${CREDENTIAL_LOGIN_GROUPS[kind]} login` : credentialIssueCommand(kind, name);
 /**
 * The command that stores a missing credential of `kind` as `name`: the
-* keystore you have, or the key Hot Updater issues after a sign-in.
+* upload keystore Hot Updater creates, or the key it issues after a
+* sign-in.
 */
-const credentialStoreCommand = (kind, name = kind) => kind === "android-keystore" ? credentialPutCommand(kind, name) : credentialLoginCommand(kind, name);
+const credentialStoreCommand = (kind, name = kind) => kind === "android-keystore" ? credentialIssueCommand(kind, name) : credentialLoginCommand(kind, name);
 var CredentialUnavailableError = class extends Error {
 	kind;
 	/** The environment variables that can provide this credential. */
@@ -39026,7 +39020,7 @@ const createCredentialResolver = ({ env = {}, secrets, cwd } = {}) => {
 			const reason = error instanceof Error ? error.message : String(error);
 			throw new CredentialUnavailableError(kind, `Couldn't read ${item} from the ${store.name} secrets adapter.\n${reason}`, { cause: error });
 		}
-		if (value === void 0) throw new CredentialUnavailableError(kind, `No ${item} in the ${store.name} secrets adapter.\nStore it once with:\n${formatCommand(credentialStoreCommand(kind, name))}`);
+		if (value === void 0) throw new CredentialUnavailableError(kind, kind === "android-keystore" ? describeMissingKeystore(store, item, name) : `No ${item} in the ${store.name} secrets adapter.\nStore it once with:\n${formatCommand(credentialStoreCommand(kind, name))}`);
 		registerSecretValue(value);
 		return fromSecretValue[kind](value, {
 			files,
@@ -45532,8 +45526,24 @@ const MANAGED_IMPORT_PACKAGES = /* @__PURE__ */ new Set([
 const MANAGED_HELPER_NAMES = /* @__PURE__ */ new Set([
 	"awsOptions",
 	"commonOptions",
-	"credential"
+	"credential",
+	"databaseSecrets",
+	"deploySecrets",
+	"storageSecrets"
 ]);
+/**
+* `const <name> = secretEnv([...names])`, a helper a managed config reads
+* credentials with: from the environment and `.env.hotupdater` first, then
+* from the config's `secrets` adapter. `storageSecrets` and
+* `databaseSecrets` read each adapter's own, so a command that reaches only
+* one needs only its credentials; `deploySecrets` reads what both share.
+* Its builder imports `secretEnv` from `hot-updater`.
+*/
+const secretEnvHelper = (name, names) => ({
+	name,
+	strategy: "replace",
+	code: `const ${name} = secretEnv([\n${names.map((variable) => `  ${JSON.stringify(variable)},`).join("\n")}\n]);`
+});
 const KNOWN_BUILD_CALLEES = /* @__PURE__ */ new Set([
 	"bare",
 	"expo",
@@ -45605,6 +45615,18 @@ const getObjectPropertyName = (property) => {
 	return null;
 };
 const isDataProperty = (property) => property.type === "Property" && property.kind === "init" && !property.method && !property.shorthand;
+/** `process.env.HOT_UPDATER_*`, with or without `!`. */
+const isHotUpdaterEnvRead = (expression) => {
+	const read = expression.type === "TSNonNullExpression" ? expression.expression : expression;
+	return read.type === "MemberExpression" && !read.computed && read.property.type === "Identifier" && read.property.name.startsWith("HOT_UPDATER_") && read.object.type === "MemberExpression" && !read.object.computed && read.object.object.type === "Identifier" && read.object.object.name === "process" && read.object.property.type === "Identifier" && read.object.property.name === "env";
+};
+/**
+* A value init writes into a managed adapter's options: a string, a
+* `process.env.HOT_UPDATER_*` read, as configs of 1.1 read every value, or
+* an object of only those, such as `credentials`. Init replaces it with
+* what its run resolves; any other value is the project's own and kept.
+*/
+const isInitWrittenValue = (expression) => expression.type === "Literal" && typeof expression.value === "string" || isHotUpdaterEnvRead(expression) || expression.type === "ObjectExpression" && expression.properties.length > 0 && expression.properties.every((property) => isDataProperty(property) && isInitWrittenValue(property.value));
 const dedentBlock = (text) => {
 	const lines = text.replace(/\s+$/, "").split("\n");
 	const indents = lines.filter((line) => line.trim() !== "").map((line) => line.match(/^\s*/)?.[0].length ?? 0);
@@ -45677,9 +45699,17 @@ const mergeObjectLiteralText = (existingObject, newObject, replaceIncompatiblePr
 		existingPropertyNames.add(propertyName);
 		const nextProperty = newObject.objectExpression.properties.find((candidate) => getObjectPropertyName(candidate) === propertyName);
 		if (!nextProperty || !isDataProperty(property) || !isDataProperty(nextProperty)) continue;
+		if (isInitWrittenValue(property.value)) {
+			edits.push({
+				start: property.value.start - existingObject.objectExpression.start,
+				end: property.value.end - existingObject.objectExpression.start,
+				text: getNodeText(newObject.source, nextProperty.value)
+			});
+			continue;
+		}
 		const existingCallee = getCallCallee(property.value);
 		const nextCallee = getCallCallee(nextProperty.value);
-		const hasIncompatibleValue = existingCallee !== null && nextCallee !== null && existingCallee !== nextCallee || property.value.type === "ObjectExpression" !== (nextProperty.value.type === "ObjectExpression");
+		const hasIncompatibleValue = existingCallee !== null && nextCallee !== null && existingCallee !== nextCallee || property.value.type !== nextProperty.value.type;
 		if (replaceIncompatibleProperties.includes(propertyName) && hasIncompatibleValue) {
 			edits.push({
 				start: property.value.start - existingObject.objectExpression.start,
@@ -47084,15 +47114,26 @@ const loadPlatformConfigs = async (platforms, { channel }) => {
 */
 const resolveConfig = (config, scopes) => {
 	const mergedConfig = mergeConfigSources(config, getDefaultConfig());
-	const secrets = withLocalKeyStore(mergedConfig.secrets);
+	const secrets = resolveSecretsAdapter(mergedConfig.secrets);
 	const signing = normalizeSigningConfig(mergedConfig.signing, { secrets });
 	for (const scope of scopes) scope.secrets ??= secrets;
 	setConfiguredSecrets(secrets);
-	return {
+	const resolved = {
 		...mergedConfig,
 		signing,
 		secrets
 	};
+	Object.defineProperty(resolved, SECRET_ENV_NAMES, { value: [...new Set(scopes.flatMap((scope) => [...scope.names ?? []]))] });
+	return resolved;
+};
+const SECRET_ENV_NAMES = Symbol.for("@hot-updater/cli-tools/secret-env-names");
+/**
+* The names every `secretEnv` the config created while it loaded reads,
+* such as `HOT_UPDATER_CLOUDFLARE_API_TOKEN`, in the order it created them.
+*/
+const getSecretEnvNames = (config) => {
+	const names = Reflect.get(config, SECRET_ENV_NAMES);
+	return Array.isArray(names) ? names : [];
 };
 //#endregion
 //#region src/serverDefinition.ts
@@ -47384,6 +47425,74 @@ const resolveHotUpdaterServerVersion = (currentPackageName, options) => {
 	return process.env["HOT_UPDATER_SERVER_PACKAGE_VERSION"]?.trim() || resolvePackageVersion(currentPackageName, options);
 };
 //#endregion
+//#region src/teamSecrets.ts
+/**
+* The client API key the managed servers' `apiKeys()` gives an app, which
+* init saves (`API_KEY_ENV` in `@hot-updater/plugin-api-keys`). The config
+* never reads it; a team store shares it with the deploy credentials, so a
+* teammate's init registers the same key again rather than a new one.
+*/
+const MANAGED_CLIENT_CREDENTIAL_ENV = "HOT_UPDATER_API_KEY";
+/**
+* The config's own `secrets` adapter, the team store: undefined when the
+* config sets none, which is `localSecrets()`. Loading the config runs its
+* `process.loadEnvFile(".env.hotupdater")`, which init must not see, so
+* `process.env` is restored after it.
+*/
+const loadTeamSecrets = async () => {
+	const before = { ...process.env };
+	try {
+		return getConfiguredAdapter((await loadConfig(null)).secrets);
+	} finally {
+		for (const key of Object.keys(process.env)) if (!Object.hasOwn(before, key)) delete process.env[key];
+		Object.assign(process.env, before);
+	}
+};
+/**
+* `names` neither the environment nor `env`, init's env files, sets, read
+* from `secrets` in one call: the values a teammate's init, or a run after
+* the file's lines were deleted, replays with.
+*/
+const readMissingFromTeamSecrets = async (secrets, names, { env, cwd }) => {
+	const missing = names.filter((name) => getHotUpdaterEnvValue(env, name) === void 0);
+	if (missing.length === 0) return {};
+	const held = await secrets.get(missing, { cwd });
+	const values = Object.create(null);
+	for (const name of missing) {
+		const value = Object.hasOwn(held, name) ? held[name] : void 0;
+		if (typeof value === "string" && value !== "") {
+			registerSecretValue(value);
+			values[name] = value;
+		}
+	}
+	return values;
+};
+/**
+* Stores each of `names` that `.env.hotupdater` holds through `secrets`,
+* then reads them back in one call. The file is left as it is. Returns the
+* names stored, in the order of `names`; throws when the adapter reads
+* back another value.
+*/
+const storeEnvFileSecrets = async (secrets, names, cwd) => {
+	const file = await readLoadedHotUpdaterEnv(cwd);
+	const values = /* @__PURE__ */ new Map();
+	for (const name of names) {
+		const value = Object.hasOwn(file, name) ? file[name]?.trim() : void 0;
+		if (value) values.set(name, value);
+	}
+	if (values.size === 0) return [];
+	const stored = [...values.keys()];
+	for (const [name, value] of values) {
+		registerSecretValue(value);
+		await secrets.set(name, value, { cwd });
+	}
+	const read = await secrets.get(stored, { cwd });
+	const unread = stored.filter((name) => (Object.hasOwn(read, name) ? read[name] : void 0) !== values.get(name));
+	if (unread.length > 0) throw new Error(`The ${secrets.name} secrets adapter did not read back ${list(unread)} (${unread.map((name) => describeSecret(secrets, name)).join("; ")}).`);
+	return stored;
+};
+const list = (names) => names.length <= 2 ? names.join(" and ") : `${names.slice(0, -1).join(", ")}, and ${names.at(-1)}`;
+//#endregion
 //#region src/storageFiles.ts
 const getStorageFileByteSize = async (filePath) => {
 	const { size } = await fs$2.stat(filePath, { bigint: true });
@@ -47434,4 +47543,4 @@ function transformTemplate(templateString, values) {
 	return result;
 }
 //#endregion
-export { BuildFailedError, BuildLogger, CREDENTIAL_ENV_NAMES, CREDENTIAL_LOGIN_GROUPS, ConfigBuilder, CredentialUnavailableError, DEFAULT_SIGNING_KEY_SECRET, HOT_UPDATER_HOME_ENV, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, INTERFACE_FINGERPRINT_ENGINE, InitEnvFileError, InitError, LOCAL_SECRETS_NAME, LegacyInfrastructureError, MissingInitInputsError, ServerDefinitionError, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, assertUnreservedEnv, autolinkingConfigCommand, banner, clientAuthOf, typedColors as colors, confirmInitInputPersistence, copyDirToTmp, createCredentialResolver, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createInterfaceFingerprint, createLocalSecretsStore, createLogWriter, createMigrator, createMinBundleId, createTarBrTargetFiles, createZip, credentialIssueCommand, credentialLoginCommand, credentialPutCommand, credentialStoreCommand, decryptJson, defineInitProvider, describeSecret, describeStoredSecret, encryptJson, ensureInstallPackages, generateClientCredential, generateSchema, generatesSchema, getAndroidSdkPath, getBundleSigningPublicKey, getConfiguredAdapter, getConfiguredSecrets, getCwd, getHotUpdaterEnvValue, getHotUpdaterHome, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getLocalKeyFile, getLocalKeyStoreDir, getLocalSecretsStore, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getProjectKey, getReactNativeMetadatas, getStorageFileByteSize, isCI, isCodegenSpecFile, isReservedVariableName, isSecretName, isServerDefinition, keepsKeysOnThisMachine, link, loadConfig, loadPlatformConfigs, localSecrets, log, makeEnv, maskSecretValues, moduleSpecifiersOf, nonInteractiveReason, p, parseLoadedEnv, parseSecretReference, prepareBundleSigning, printAppSetup, printBanner, provisionClientCredential, putStorageFile, reactNativeCliFingerprint, reactNativeConfigCommand, readBundleSigningPublicKeyFile, readHotUpdaterInitEnv, readLoadedHotUpdaterEnv, readLocalKey, readPackageUp, readReactNativeInterface, readSecretVariables, readSecretWithSource, registerCredentialValue, registerSecretValue, renderAppImports, renderAppSetup, renderImportStatements, resolveExpoAutolinking, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolveLocalSecretsPath, resolvePackageVersion, secretEnv, secretVariableName, serverDefinitionOf, setConfiguredSecrets, shouldAutoSelectOnlyInitResource, stripAnsi, transformEnv, transformTemplate, withCredentialResolver, withLocalKeyStore, withSecretsScope, writeHotUpdaterConfig, writeHotUpdaterFiles, writeLocalKey };
+export { BuildFailedError, BuildLogger, CREDENTIAL_ENV_NAMES, CREDENTIAL_LOGIN_GROUPS, ConfigBuilder, CredentialUnavailableError, DEFAULT_SIGNING_KEY_SECRET, HOT_UPDATER_HOME_ENV, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, INTERFACE_FINGERPRINT_ENGINE, InitEnvFileError, InitError, LOCAL_SECRETS_NAME, LegacyInfrastructureError, MANAGED_CLIENT_CREDENTIAL_ENV, MissingInitInputsError, ServerDefinitionError, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, assertUnreservedEnv, autolinkingConfigCommand, banner, clientAuthOf, typedColors as colors, confirmInitInputPersistence, copyDirToTmp, createCredentialResolver, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createInterfaceFingerprint, createLocalSecretsStore, createLogWriter, createMigrator, createMinBundleId, createTarBrTargetFiles, createZip, credentialIssueCommand, credentialLoginCommand, credentialStoreCommand, decryptJson, defineInitProvider, describeSecret, describeStoredSecret, encryptJson, ensureInstallPackages, generateClientCredential, generateSchema, generatesSchema, getAndroidSdkPath, getBundleSigningPublicKey, getConfiguredAdapter, getConfiguredSecrets, getCwd, getHotUpdaterEnvValue, getHotUpdaterHome, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getLocalKeyFile, getLocalKeyStoreDir, getLocalSecretsStore, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getProjectKey, getReactNativeMetadatas, getSecretEnvNames, getStorageFileByteSize, isCI, isCodegenSpecFile, isReservedVariableName, isSecretName, isServerDefinition, keepsKeysOnThisMachine, link, loadConfig, loadPlatformConfigs, loadTeamSecrets, localSecrets, log, makeEnv, maskSecretValues, moduleSpecifiersOf, nonInteractiveReason, p, parseLoadedEnv, parseSecretReference, prepareBundleSigning, printAppSetup, printBanner, provisionClientCredential, putStorageFile, reactNativeCliFingerprint, reactNativeConfigCommand, readBundleSigningPublicKeyFile, readHotUpdaterInitEnv, readLoadedHotUpdaterEnv, readLocalKey, readMissingFromTeamSecrets, readPackageUp, readReactNativeInterface, readSecretVariables, readSecretWithSource, registerCredentialValue, registerSecretValue, renderAppImports, renderAppSetup, renderImportStatements, resolveExpoAutolinking, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolveLocalSecretsPath, resolvePackageVersion, resolveSecretsAdapter, secretEnv, secretEnvHelper, secretVariableName, serverDefinitionOf, setConfiguredSecrets, shouldAutoSelectOnlyInitResource, storeEnvFileSecrets, stripAnsi, transformEnv, transformTemplate, withCredentialResolver, withSecretsScope, writeHotUpdaterConfig, writeHotUpdaterFiles, writeLocalKey };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hot-updater/cli-tools",
-  "version": "1.2.0-rc.4",
+  "version": "1.2.0-rc.5",
   "type": "module",
   "engines": {
     "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
@@ -49,9 +49,9 @@
     "oxc-parser": "0.141.0",
     "oxc-transform": "0.141.0",
     "unconfig": "7.5.0",
-    "@hot-updater/server": "1.2.0-rc.4",
-    "@hot-updater/protocol": "1.2.0-rc.4",
-    "@hot-updater/plugin-core": "1.2.0-rc.4"
+    "@hot-updater/plugin-core": "1.2.0-rc.5",
+    "@hot-updater/protocol": "1.2.0-rc.5",
+    "@hot-updater/server": "1.2.0-rc.5"
   },
   "devDependencies": {
     "@clack/prompts": "1.7.0",
@@ -65,7 +65,7 @@
     "tar": "^7.5.16",
     "verkit": "0.4.0",
     "workspace-tools": "^0.41.7",
-    "@hot-updater/test-utils": "1.2.0-rc.4"
+    "@hot-updater/test-utils": "1.2.0-rc.5"
   },
   "inlinedDependencies": {
     "@babel/code-frame": "7.29.0",