@hot-updater/cli-tools 1.2.0-rc.6 → 1.2.0-rc.8

package/dist/index.mjs

@@ -37,78 +37,6 @@ import { Buffer as Buffer$2 } from "node:buffer";
 import { Visitor, parseSync } from "oxc-parser";
 import { loadConfig as loadConfig$1 } from "unconfig";
 import { transformSync } from "oxc-transform";
-//#endregion
-//#region src/colors.ts
-var import_picocolors = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
-	let p = process || {};
-	let argv = p.argv || [];
-	let env = p.env || {};
-	let isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env.TERM !== "dumb" || !!env.CI);
-	let formatter = (open, close, replace = open) => (input) => {
-		let string = "" + input, index = string.indexOf(close, open.length);
-		return ~index ? open + replaceClose(string, close, replace, index) + close : open + string + close;
-	};
-	let replaceClose = (string, close, replace, index) => {
-		let result = "", cursor = 0;
-		do {
-			result += string.substring(cursor, index) + replace;
-			cursor = index + close.length;
-			index = string.indexOf(close, cursor);
-		} while (~index);
-		return result + string.substring(cursor);
-	};
-	let createColors = (enabled = isColorSupported) => {
-		let f = enabled ? formatter : () => String;
-		return {
-			isColorSupported: enabled,
-			reset: f("\x1B[0m", "\x1B[0m"),
-			bold: f("\x1B[1m", "\x1B[22m", "\x1B[22m\x1B[1m"),
-			dim: f("\x1B[2m", "\x1B[22m", "\x1B[22m\x1B[2m"),
-			italic: f("\x1B[3m", "\x1B[23m"),
-			underline: f("\x1B[4m", "\x1B[24m"),
-			inverse: f("\x1B[7m", "\x1B[27m"),
-			hidden: f("\x1B[8m", "\x1B[28m"),
-			strikethrough: f("\x1B[9m", "\x1B[29m"),
-			black: f("\x1B[30m", "\x1B[39m"),
-			red: f("\x1B[31m", "\x1B[39m"),
-			green: f("\x1B[32m", "\x1B[39m"),
-			yellow: f("\x1B[33m", "\x1B[39m"),
-			blue: f("\x1B[34m", "\x1B[39m"),
-			magenta: f("\x1B[35m", "\x1B[39m"),
-			cyan: f("\x1B[36m", "\x1B[39m"),
-			white: f("\x1B[37m", "\x1B[39m"),
-			gray: f("\x1B[90m", "\x1B[39m"),
-			bgBlack: f("\x1B[40m", "\x1B[49m"),
-			bgRed: f("\x1B[41m", "\x1B[49m"),
-			bgGreen: f("\x1B[42m", "\x1B[49m"),
-			bgYellow: f("\x1B[43m", "\x1B[49m"),
-			bgBlue: f("\x1B[44m", "\x1B[49m"),
-			bgMagenta: f("\x1B[45m", "\x1B[49m"),
-			bgCyan: f("\x1B[46m", "\x1B[49m"),
-			bgWhite: f("\x1B[47m", "\x1B[49m"),
-			blackBright: f("\x1B[90m", "\x1B[39m"),
-			redBright: f("\x1B[91m", "\x1B[39m"),
-			greenBright: f("\x1B[92m", "\x1B[39m"),
-			yellowBright: f("\x1B[93m", "\x1B[39m"),
-			blueBright: f("\x1B[94m", "\x1B[39m"),
-			magentaBright: f("\x1B[95m", "\x1B[39m"),
-			cyanBright: f("\x1B[96m", "\x1B[39m"),
-			whiteBright: f("\x1B[97m", "\x1B[39m"),
-			bgBlackBright: f("\x1B[100m", "\x1B[49m"),
-			bgRedBright: f("\x1B[101m", "\x1B[49m"),
-			bgGreenBright: f("\x1B[102m", "\x1B[49m"),
-			bgYellowBright: f("\x1B[103m", "\x1B[49m"),
-			bgBlueBright: f("\x1B[104m", "\x1B[49m"),
-			bgMagentaBright: f("\x1B[105m", "\x1B[49m"),
-			bgCyanBright: f("\x1B[106m", "\x1B[49m"),
-			bgWhiteBright: f("\x1B[107m", "\x1B[49m")
-		};
-	};
-	module.exports = createColors();
-	module.exports.createColors = createColors;
-})))(), 1);
-const typedColors = import_picocolors.default;
-//#endregion
 //#region ../../node_modules/.pnpm/workspace-tools@0.41.7/node_modules/workspace-tools/lib/graph/getPackageDependencies.js
 var require_getPackageDependencies = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
@@ -22628,7 +22556,7 @@ const MASKING_REGISTRY = Symbol.for("@hot-updater/cli-tools/secret-masking");
 /**
 * The values to mask, kept on `globalThis`: the config file loads its own
 * copy of Hot Updater's modules, and a value it resolves, such as through
-* `secretEnv`, must be masked by the CLI's log sinks too.
+* `secret()`, must be masked by the CLI's log sinks too.
 */
 const registry = globalThis[MASKING_REGISTRY] ??= {
 	secretValues: /* @__PURE__ */ new Set(),
@@ -22664,17 +22592,57 @@ const maskSecretValues = (text) => {
 	return shortSecretPattern ? masked.replace(shortSecretPattern, SECRET_MASK) : masked;
 };
 //#endregion
+//#region src/stepCapture.ts
+let current;
+const stepCapture = () => current;
+const setStepCapture = (capture) => {
+	current = capture;
+};
+//#endregion
 //#region src/prompts.ts
 const maskMessage = (message) => message === void 0 ? message : maskSecretValues(message);
-const log$1 = {
-	message: (message, options) => log$2.message(Array.isArray(message) ? message.map(maskSecretValues) : maskMessage(message), options),
-	info: (message, options) => log$2.info(maskSecretValues(message), options),
-	success: (message, options) => log$2.success(maskSecretValues(message), options),
-	step: (message, options) => log$2.step(maskSecretValues(message), options),
-	warn: (message, options) => log$2.warn(maskSecretValues(message), options),
-	warning: (message, options) => log$2.warning(maskSecretValues(message), options),
-	error: (message, options) => log$2.error(maskSecretValues(message), options)
+/**
+* Prints a log line, or, while a step runs, holds it until the step's line
+* prints. An info line says what the step is doing, so it shows as the
+* step's detail instead; an error ends the step first and prints at once,
+* since the process may exit right after it.
+*/
+const logThroughStep = (write, { inStep = "hold" } = {}) => (...args) => {
+	const capture = stepCapture();
+	if (!capture) return write(...args);
+	if (inStep === "interrupt") {
+		capture.interrupt();
+		return write(...args);
+	}
+	if (inStep === "detail") {
+		const message = args[0];
+		const text = Array.isArray(message) ? message.join("\n") : message ?? "";
+		capture.update(maskSecretValues(text.split("\n")[0] ?? ""));
+		return;
+	}
+	capture.hold(() => write(...args));
 };
+const log$1 = {
+	message: logThroughStep((message, options) => log$2.message(Array.isArray(message) ? message.map(maskSecretValues) : maskMessage(message), options)),
+	info: logThroughStep((message, options) => log$2.info(maskSecretValues(message), options), { inStep: "detail" }),
+	success: logThroughStep((message, options) => log$2.success(maskSecretValues(message), options)),
+	step: logThroughStep((message, options) => log$2.step(maskSecretValues(message), options)),
+	warn: logThroughStep((message, options) => log$2.warn(maskSecretValues(message), options)),
+	warning: logThroughStep((message, options) => log$2.warning(maskSecretValues(message), options)),
+	error: logThroughStep((message, options) => log$2.error(maskSecretValues(message), options), { inStep: "interrupt" })
+};
+/** A spinner inside a running step, whose messages are the step's detail. */
+const spinnerInStep = (capture) => ({
+	start: (message) => capture.update(message),
+	message: (message) => capture.update(message),
+	stop: () => capture.update(void 0),
+	cancel: () => capture.update(void 0),
+	error: (message) => capture.interrupt(message || void 0),
+	clear: () => capture.update(void 0),
+	get isCancelled() {
+		return false;
+	}
+});
 const maskSpinner = (target) => ({
 	start: (message) => target.start(maskMessage(message)),
 	stop: (message) => target.stop(maskMessage(message)),
@@ -22733,11 +22701,23 @@ const createStaticSpinner = ({ onCancel, output = process.stdout, withGuide } =
 	};
 };
 const spinner = (options = {}) => {
+	const capture = stepCapture();
+	if (capture) return spinnerInStep(capture);
 	const output = options.output ?? process.stdout;
 	const isInteractive = isTTY(output) && !isCI$1();
 	return maskSpinner(isInteractive ? spinner$1(options) : createStaticSpinner(options));
 };
 const progress = (options = {}) => {
+	const capture = stepCapture();
+	if (capture) return {
+		...spinnerInStep(capture),
+		advance: (_step, message) => {
+			if (message) capture.update(message);
+		},
+		get isCancelled() {
+			return false;
+		}
+	};
 	const output = options.output ?? process.stdout;
 	if (isTTY(output) && !isCI$1()) return maskProgress(progress$1(options));
 	const staticSpinner = maskSpinner(createStaticSpinner(options));
@@ -22870,6 +22850,9 @@ const createLogWriter = async ({ prefix, logFilePath }) => {
 			}
 			if (partialLine) writeChunk(partialLine);
 		};
+		const writeLines = (lines) => {
+			writeChunk(`${lines.join("\n")}\n`);
+		};
 		const writeError = (error) => {
 			const message = error instanceof Error ? error.stack ?? error.message : String(error);
 			writeChunk(`${message}\n`);
@@ -22886,6 +22869,7 @@ const createLogWriter = async ({ prefix, logFilePath }) => {
 		return {
 			logFilePath: resolvedLogFilePath,
 			writeStream,
+			writeLines,
 			writeError,
 			close
 		};
@@ -22895,67 +22879,241 @@ const createLogWriter = async ({ prefix, logFilePath }) => {
 		return {
 			logFilePath: null,
 			writeStream: async () => {},
+			writeLines: () => {},
 			writeError: () => {},
 			close: async () => {}
 		};
 	}
 };
 //#endregion
-//#region src/BuildLogger.ts
-const createInitialState = () => ({
-	completedStages: 0,
-	latestMessage: "",
-	started: false,
-	stopped: false
-});
-const normalizeLine = (line) => {
-	return (line.length > 50 ? `${line.slice(0, 50)}...` : line).replace(/[\r\n]/g, " ").trim();
-};
-const matchesAnyPattern = ({ line, patterns }) => {
-	const trimmedLine = line.trim();
-	const normalizedLine = trimmedLine.toLowerCase();
-	return patterns.some((pattern) => {
-		if (pattern instanceof RegExp) {
-			pattern.lastIndex = 0;
-			return pattern.test(trimmedLine);
-		}
-		return normalizedLine.includes(pattern.toLowerCase());
-	});
-};
-const getPatternMatchScore = ({ line, patterns }) => {
-	const trimmedLine = line.trim();
-	const normalizedLine = trimmedLine.toLowerCase();
-	return patterns.reduce((bestScore, pattern) => {
-		if (pattern instanceof RegExp) {
-			pattern.lastIndex = 0;
-			if (!pattern.test(trimmedLine)) return bestScore;
-			return Math.max(bestScore, pattern.source.length);
-		}
-		const normalizedPattern = pattern.toLowerCase();
-		if (!normalizedLine.includes(normalizedPattern)) return bestScore;
-		return Math.max(bestScore, normalizedPattern.length);
-	}, 0);
-};
-const resolveNextCompletedStage = ({ line, progressStages, completedStages }) => {
-	let nextCompletedStages = completedStages;
-	let bestMatchScore = 0;
-	for (let stageIndex = completedStages; stageIndex < progressStages.length; stageIndex += 1) {
-		const matchScore = getPatternMatchScore({
-			line,
-			patterns: progressStages[stageIndex]
-		});
-		if (matchScore <= 0) continue;
-		const candidateStage = stageIndex + 1;
-		if (matchScore > bestMatchScore || matchScore === bestMatchScore && candidateStage > nextCompletedStages) {
-			nextCompletedStages = candidateStage;
-			bestMatchScore = matchScore;
+//#region src/colors.ts
+var import_picocolors = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
+	let p = process || {};
+	let argv = p.argv || [];
+	let env = p.env || {};
+	let isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env.TERM !== "dumb" || !!env.CI);
+	let formatter = (open, close, replace = open) => (input) => {
+		let string = "" + input, index = string.indexOf(close, open.length);
+		return ~index ? open + replaceClose(string, close, replace, index) + close : open + string + close;
+	};
+	let replaceClose = (string, close, replace, index) => {
+		let result = "", cursor = 0;
+		do {
+			result += string.substring(cursor, index) + replace;
+			cursor = index + close.length;
+			index = string.indexOf(close, cursor);
+		} while (~index);
+		return result + string.substring(cursor);
+	};
+	let createColors = (enabled = isColorSupported) => {
+		let f = enabled ? formatter : () => String;
+		return {
+			isColorSupported: enabled,
+			reset: f("\x1B[0m", "\x1B[0m"),
+			bold: f("\x1B[1m", "\x1B[22m", "\x1B[22m\x1B[1m"),
+			dim: f("\x1B[2m", "\x1B[22m", "\x1B[22m\x1B[2m"),
+			italic: f("\x1B[3m", "\x1B[23m"),
+			underline: f("\x1B[4m", "\x1B[24m"),
+			inverse: f("\x1B[7m", "\x1B[27m"),
+			hidden: f("\x1B[8m", "\x1B[28m"),
+			strikethrough: f("\x1B[9m", "\x1B[29m"),
+			black: f("\x1B[30m", "\x1B[39m"),
+			red: f("\x1B[31m", "\x1B[39m"),
+			green: f("\x1B[32m", "\x1B[39m"),
+			yellow: f("\x1B[33m", "\x1B[39m"),
+			blue: f("\x1B[34m", "\x1B[39m"),
+			magenta: f("\x1B[35m", "\x1B[39m"),
+			cyan: f("\x1B[36m", "\x1B[39m"),
+			white: f("\x1B[37m", "\x1B[39m"),
+			gray: f("\x1B[90m", "\x1B[39m"),
+			bgBlack: f("\x1B[40m", "\x1B[49m"),
+			bgRed: f("\x1B[41m", "\x1B[49m"),
+			bgGreen: f("\x1B[42m", "\x1B[49m"),
+			bgYellow: f("\x1B[43m", "\x1B[49m"),
+			bgBlue: f("\x1B[44m", "\x1B[49m"),
+			bgMagenta: f("\x1B[45m", "\x1B[49m"),
+			bgCyan: f("\x1B[46m", "\x1B[49m"),
+			bgWhite: f("\x1B[47m", "\x1B[49m"),
+			blackBright: f("\x1B[90m", "\x1B[39m"),
+			redBright: f("\x1B[91m", "\x1B[39m"),
+			greenBright: f("\x1B[92m", "\x1B[39m"),
+			yellowBright: f("\x1B[93m", "\x1B[39m"),
+			blueBright: f("\x1B[94m", "\x1B[39m"),
+			magentaBright: f("\x1B[95m", "\x1B[39m"),
+			cyanBright: f("\x1B[96m", "\x1B[39m"),
+			whiteBright: f("\x1B[97m", "\x1B[39m"),
+			bgBlackBright: f("\x1B[100m", "\x1B[49m"),
+			bgRedBright: f("\x1B[101m", "\x1B[49m"),
+			bgGreenBright: f("\x1B[102m", "\x1B[49m"),
+			bgYellowBright: f("\x1B[103m", "\x1B[49m"),
+			bgBlueBright: f("\x1B[104m", "\x1B[49m"),
+			bgMagentaBright: f("\x1B[105m", "\x1B[49m"),
+			bgCyanBright: f("\x1B[106m", "\x1B[49m"),
+			bgWhiteBright: f("\x1B[107m", "\x1B[49m")
+		};
+	};
+	module.exports = createColors();
+	module.exports.createColors = createColors;
+})))(), 1);
+const typedColors = import_picocolors.default;
+//#endregion
+//#region src/step.ts
+/** The widest a finished step's line is, after clack's 3-column gutter. */
+const STEP_WIDTH = 73;
+/** The room the spinner's symbol and its `[12m 34s]` timer take. */
+const LIVE_LINE_CHROME = 13;
+/** `4.2s`, `38s`, `6m41s`, `1h02m`. */
+const formatDuration = (ms) => {
+	if (ms < 9950) return `${(Math.max(0, ms) / 1e3).toFixed(1)}s`;
+	const seconds = Math.round(ms / 1e3);
+	if (seconds < 60) return `${seconds}s`;
+	const minutes = Math.floor(seconds / 60);
+	if (minutes < 60) return `${minutes}m${String(seconds % 60).padStart(2, "0")}s`;
+	return `${Math.floor(minutes / 60)}h${String(minutes % 60).padStart(2, "0")}m`;
+};
+const visibleLength = (text) => stripVTControlCharacters(text).length;
+/**
+* `message` with `duration` at the right edge of a step's line, the message
+* cut with `…` when the line would be wider.
+*/
+const withDuration = (message, ms, width = STEP_WIDTH) => {
+	const duration = formatDuration(ms);
+	const text = truncateLine(message, width - duration.length - 2);
+	const gap = Math.max(2, width - visibleLength(text) - duration.length);
+	return `${text}${" ".repeat(gap)}${typedColors.dim(duration)}`;
+};
+/** `text` cut to `width` visible columns, with `…` for the rest. */
+const truncateLine = (text, width) => {
+	const plain = stripVTControlCharacters(text);
+	if (plain.length <= width) return text;
+	return `${plain.slice(0, Math.max(0, width - 1))}…`;
+};
+const isLive = (output) => isTTY(output) && !isCI$1();
+/**
+* A step that shows nothing until `start()`. A step created while another
+* runs is part of it: its title and detail become the running step's detail.
+*/
+const createStep = (title, { output = process.stdout } = {}) => {
+	let startedAt;
+	let ended = false;
+	let detail;
+	let spinner;
+	let ticker;
+	let held = [];
+	let outer;
+	const liveMessage = () => {
+		const text = maskSecretValues(detail ? `${title} · ${detail}` : title);
+		const columns = output.columns || 80;
+		return truncateLine(text, Math.max(20, columns - LIVE_LINE_CHROME));
+	};
+	const finish = (write) => {
+		if (startedAt === void 0 || ended) return;
+		ended = true;
+		if (ticker) clearInterval(ticker);
+		if (outer) {
+			outer.update(void 0);
+			return;
+		}
+		setStepCapture(void 0);
+		if (spinner) spinner.clear();
+		write();
+		const logs = held;
+		held = [];
+		for (const log of logs) log();
+	};
+	const logOptions = () => ({
+		output,
+		spacing: spinner ? 0 : 1
+	});
+	const step = {
+		start() {
+			if (startedAt !== void 0) return step;
+			startedAt = performance.now();
+			outer = stepCapture();
+			if (outer) {
+				outer.update(title);
+				return step;
+			}
+			setStepCapture({
+				update: (value) => step.update(value),
+				hold: (log) => {
+					held.push(log);
+				},
+				interrupt: (message) => step.fail(message)
+			});
+			if (isLive(output)) {
+				spinner = spinner$1({
+					indicator: "timer",
+					output
+				});
+				spinner.start(liveMessage());
+				ticker = setInterval(() => spinner?.message(liveMessage()), 1e3);
+				ticker.unref?.();
+			}
+			return step;
+		},
+		update(value) {
+			if (startedAt === void 0 || ended) return;
+			if (outer) {
+				outer.update(value ? `${title} · ${value}` : title);
+				return;
+			}
+			detail = value;
+			spinner?.message(liveMessage());
+		},
+		succeed(message = title, { level = "step" } = {}) {
+			const elapsed = step.elapsedMs;
+			finish(() => {
+				const line = maskSecretValues(withDuration(message, elapsed));
+				if (level === "info") log$2.info(line, logOptions());
+				else if (level === "warn") log$2.warn(line, logOptions());
+				else log$2.step(line, logOptions());
+			});
+		},
+		fail(message = `${title} failed`) {
+			const elapsed = step.elapsedMs;
+			finish(() => {
+				log$2.error(maskSecretValues(withDuration(message, elapsed)), logOptions());
+			});
+		},
+		get elapsedMs() {
+			return startedAt === void 0 ? 0 : performance.now() - startedAt;
+		},
+		get active() {
+			return startedAt !== void 0 && !ended;
 		}
+	};
+	return step;
+};
+/**
+* Ends the running step as failed, if one runs, before a command prints
+* its error.
+*/
+const failActiveStep = () => {
+	stepCapture()?.interrupt();
+};
+/** A step, started. */
+const startStep = (title, options) => createStep(title, options).start();
+/**
+* Runs `run` as a step titled `title`, which ends with `done(result)`, or as
+* failed when `run` throws.
+*/
+const withStep = async (title, run, done = () => title, options) => {
+	const step = startStep(title, options);
+	try {
+		const result = await run(step);
+		step.succeed(done(result));
+		return result;
+	} catch (error) {
+		step.fail();
+		throw error;
 	}
-	return nextCompletedStages;
 };
+//#endregion
+//#region src/BuildLogger.ts
 /** The most lines a failure summary prints, and the tail it falls back to. */
-const MAX_SUMMARY_LINES = 60;
-const TAIL_LINES = 40;
+const MAX_SUMMARY_LINES = 20;
+const TAIL_LINES = 15;
 const matchesSummaryPattern = (line, pattern) => {
 	if (pattern instanceof RegExp) {
 		pattern.lastIndex = 0;
@@ -22973,52 +23131,58 @@ var BuildFailedError = class extends Error {
 	logPath;
 	/** The lines of the tool's output the summary printed. */
 	summary;
-	constructor(message, { logPath, summary, cause }) {
+	/**
+	* What to do about it, such as accepting an agreement, which the summary
+	* doesn't say: the one line a command prints after it, or null.
+	*/
+	hint;
+	constructor(message, { logPath, summary, hint = null, cause }) {
 		super(message, { cause });
 		this.logPath = logPath;
 		this.summary = summary;
+		this.hint = hint;
 	}
 };
+/**
+* Runs a native build tool's output through a step: the step's live line
+* shows the phase its reader finds, the log file keeps the raw output, and a
+* failure prints the summary of it on stderr.
+*/
 var BuildLogger = class {
 	config;
-	state = createInitialState();
 	logWriter;
+	step;
 	summaryLines = [];
 	tailLines = [];
 	openBlock;
-	promptProgress;
-	stageCount;
 	constructor(config) {
 		this.config = config;
-		this.stageCount = config.progressStages.length;
-		this.promptProgress = p.progress({
-			indicator: "timer",
-			max: config.progressStages.length,
-			delay: 500
-		});
 	}
-	async start() {
-		this.state = {
-			...createInitialState(),
-			started: true
-		};
+	/**
+	* Opens the log, writes `header` to it, such as the tool's command line,
+	* which the terminal doesn't show, and starts the step titled `title`.
+	*/
+	async start({ title, header = [] }) {
 		this.summaryLines = [];
 		this.tailLines = [];
 		this.openBlock = void 0;
-		this.logWriter = await createLogWriter({ prefix: this.config.logPrefix });
-		this.promptProgress.start();
+		this.logWriter = await createLogWriter({
+			prefix: this.config.logPrefix,
+			logFilePath: this.config.logFilePath
+		});
+		if (header.length) this.logWriter.writeLines(header);
+		this.step = startStep(title);
 	}
 	/**
-	* Writes the tool's raw output to the log file and reads its failure
-	* summary from it, and shows progress from `display`, a formatter's
-	* output of it such as xcbeautify's, or from the raw output without one.
+	* Writes the tool's raw output to the log file, reads its failure summary
+	* from it, and shows its phases on the step's line.
 	*/
-	async processStream(input, { display } = {}) {
+	async processStream(input) {
 		if (!this.logWriter) throw new Error("BuildLogger has not been started. Call start() first.");
 		const progressInput = new PassThrough();
 		const logInput = new PassThrough();
 		const summaryInput = new PassThrough();
-		(display ?? input).pipe(progressInput);
+		input.pipe(progressInput);
 		input.pipe(logInput);
 		input.pipe(summaryInput);
 		await Promise.all([
@@ -23031,6 +23195,10 @@ var BuildLogger = class {
 	get logPath() {
 		return this.logWriter?.logFilePath ? path.relative(getCwd(), this.logWriter.logFilePath) : null;
 	}
+	/** The build log's absolute path, or null without one. */
+	get logFilePath() {
+		return this.logWriter?.logFilePath ?? null;
+	}
 	/**
 	* The lines of the raw output a failure prints: the ones the config's
 	* `failureSummary` keeps, deduplicated, or the last lines without any.
@@ -23079,36 +23247,28 @@ var BuildLogger = class {
 			crlfDelay: Infinity,
 			terminal: false
 		});
-		for await (const line of lineReader) this.processProgressLine(line);
-	}
-	processProgressLine(line) {
-		const normalizedLine = normalizeLine(line);
-		if (!normalizedLine) return;
-		const nextCompletedStages = resolveNextCompletedStage({
-			line: normalizedLine,
-			progressStages: this.config.progressStages,
-			completedStages: this.state.completedStages
-		});
-		this.updateProgress({
-			nextCompletedStages,
-			latestMessage: normalizedLine
-		});
+		const readPhase = this.config.createPhaseReader();
+		let phase;
+		for await (const line of lineReader) {
+			const next = readPhase(stripAnsi(line).replace(/\r/g, "").trim());
+			if (next !== void 0 && next !== phase) {
+				phase = next;
+				this.step?.update(phase);
+			}
+		}
 	}
+	/**
+	* Ends the step with `message` and its duration, or, for a failure, as
+	* failed, then prints the failure summary and the log's path.
+	*/
 	stop(message, success = true) {
-		if (!this.state.started || this.state.stopped) return;
-		if (success) this.finishRemainingProgress();
-		const finalMessage = message || (success ? "Build completed successfully" : "Build failed");
-		if (success) {
-			this.promptProgress.stop(finalMessage);
-			this.showLogFileLocation();
-		} else {
-			this.promptProgress.error(finalMessage);
+		const step = this.step;
+		if (!step?.active) return;
+		if (success) step.succeed(message);
+		else {
+			step.fail(message);
 			this.showFailureSummary();
 		}
-		this.state = {
-			...this.state,
-			stopped: true
-		};
 	}
 	writeError(error) {
 		this.logWriter?.writeError(error);
@@ -23118,32 +23278,6 @@ var BuildLogger = class {
 		await this.logWriter.close();
 		this.logWriter = void 0;
 	}
-	updateProgress({ nextCompletedStages, latestMessage }) {
-		if (this.state.stopped) return;
-		const progressDelta = nextCompletedStages - this.state.completedStages;
-		if (progressDelta > 0) this.promptProgress.advance(progressDelta, latestMessage);
-		else if (latestMessage && latestMessage !== this.state.latestMessage && this.shouldLogLine(latestMessage)) this.promptProgress.message(latestMessage);
-		this.state = {
-			...this.state,
-			completedStages: Math.max(this.state.completedStages, nextCompletedStages),
-			latestMessage
-		};
-	}
-	finishRemainingProgress() {
-		if (!this.promptProgress || this.state.completedStages >= this.stageCount) return;
-		const remainingStages = this.stageCount - this.state.completedStages;
-		this.promptProgress.advance(remainingStages, this.state.latestMessage);
-		this.state = {
-			...this.state,
-			completedStages: this.stageCount
-		};
-	}
-	shouldLogLine(line) {
-		return matchesAnyPattern({
-			line,
-			patterns: this.config.importantLogPatterns
-		});
-	}
 	/**
 	* Prints the failure summary and the log's path to stderr, so a `--json`
 	* command's stdout stays its JSON.
@@ -23154,12 +23288,6 @@ var BuildLogger = class {
 		const message = [...summary, ...logPath ? [...summary.length ? [""] : [], `Build log: ${logPath}`] : []].join("\n");
 		if (message) p.log.error(message, { output: process.stderr });
 	}
-	showLogFileLocation() {
-		if (!this.logWriter?.logFilePath) return;
-		const relativePath = path.relative(getCwd(), this.logWriter.logFilePath);
-		const highlightedPath = typedColors.blueBright(relativePath);
-		p.log.info(`Build log stored at ${highlightedPath}`);
-	}
 };
 //#endregion
 //#region src/appSetup.ts
@@ -25299,6 +25427,17 @@ const readLoadedHotUpdaterEnv = async (cwd) => {
 		throw error;
 	}
 };
+/**
+* `file`, an env file a command was given, relative to `cwd`, as
+* `parseLoadedEnv` reads it; a file that can't be read is refused by name.
+*/
+const readLoadedEnvFile = async (file, cwd) => {
+	try {
+		return parseLoadedEnv(await fs$1.readFile(path.resolve(cwd, file), "utf-8"));
+	} catch (error) {
+		throw new Error(`Can't read ${file}.\n${error instanceof Error ? error.message : String(error)}`, { cause: error });
+	}
+};
 //#endregion
 //#region src/localKeyStore.ts
 /**
@@ -25512,21 +25651,21 @@ const RESERVED_NAMES = /* @__PURE__ */ new Set([
 	"PYTHONSTARTUP",
 	"PERL5OPT",
 	...Object.values(CREDENTIAL_ENV_NAMES).flat(2),
-	"HOT_UPDATER_SIGNING_TOKEN",
 	"HOT_UPDATER_HOME"
 ]);
 const RESERVED_PREFIXES = [
 	"LD_",
 	"DYLD_",
 	"GIT_",
-	"NPM_CONFIG_"
+	"NPM_CONFIG_",
+	"INFISICAL_"
 ];
 /**
 * Whether `name` is a variable no secret may set: one a loader or
 * interpreter reads (`NODE_*` but `NODE_ENV`, `PATH`, `LD_*`, `DYLD_*`,
 * `BASH_ENV`, `ENV`, `GIT_*`, `npm_config_*`, the JVM's, Gradle's, Ruby's,
 * Python's, and Perl's options), or one Hot Updater reads its credentials
-* from. `secretEnv` refuses these names, and so does every environment the
+* from. `secret()` refuses these names, and so does every environment the
 * CLI gives a child process from resolved secrets.
 */
 const isReservedVariableName = (name) => {
@@ -25546,20 +25685,25 @@ const assertUnreservedEnv = (env, what) => {
 //#endregion
 //#region src/secrets.ts
 const ENV_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/u;
-/** A secret's name, as `secret:<name>` takes one. */
+/** A secret's name, as `secret("<name>")` takes one. */
 const SECRET_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
-const SECRET_REFERENCE_PREFIX = "secret:";
-/** Whether `name` is a secret's name, as `secret:<name>` takes one. */
+/**
+* The brand `secret()` sets, which plugin-core's `SecretRef` types. It is a
+* `Symbol.for` key: the config file loads its own copy of this module.
+*/
+const SECRET_REF = Symbol.for("@hot-updater/secret-ref");
+/** Whether `name` is a secret's name, as `secret("<name>")` takes one. */
 const isSecretName = (name) => SECRET_NAME_PATTERN.test(name);
+/** Whether `value` is a `secret("<name>")` reference. */
+const isSecretRef = (value) => typeof value === "function" && Reflect.get(value, SECRET_REF) === true && isSecretName(value.name);
 /**
-* The secret name a config's `secret:<name>` reference names, such as
-* `release-keystore` for `"secret:release-keystore"`. `field` is the config
-* field the reference is in, which the error names.
+* The secret name a config's `secret("<name>")` names, such as
+* `release-keystore` for `secret("release-keystore")`. `field` is the
+* config field it is in, which the error names.
 */
 const parseSecretReference = (reference, field) => {
-	const name = reference.startsWith(SECRET_REFERENCE_PREFIX) ? reference.slice(7) : void 0;
-	if (name === void 0 || !SECRET_NAME_PATTERN.test(name)) throw new Error(`${field} names a secret as secret:<name>, such as "secret:release-keystore", and ${JSON.stringify(reference)} is not one.`);
-	return name;
+	if (!isSecretRef(reference)) throw new Error(`${field} takes secret("<name>").`);
+	return reference.name;
 };
 /**
 * The environment variable the default store reads a secret from: a name
@@ -25624,8 +25768,8 @@ const createLocalSecrets = (store) => {
 const getLocalSecretsStore = (secrets) => isLocalKeyStoreSecrets(secrets) ? secrets[LOCAL_KEY_STORE].store : void 0;
 /**
 * The config's own `secrets` adapter: undefined for `localSecrets()`,
-* which is the adapter when the config sets none. `secretEnv` reads deploy
-* credentials from it.
+* which is the adapter when the config sets none. A called `secret()` reads
+* from it.
 */
 const getConfiguredAdapter = (secrets) => isLocalKeyStoreSecrets(secrets) ? void 0 : secrets;
 /**
@@ -25643,7 +25787,7 @@ const readSecretWithSource = async (secrets, name, cwd) => {
 	const held = (value) => typeof value === "string" && value.length > 0;
 	const store = getLocalSecretsStore(secrets);
 	if (!store) {
-		const value = (await secrets.get([name], { cwd }))[name];
+		const value = (await readSecrets(secrets, [name], cwd))[name];
 		return held(value) ? {
 			value,
 			source: describeSecret(secrets, name)
@@ -25654,7 +25798,9 @@ const readSecretWithSource = async (secrets, name, cwd) => {
 		value: variable,
 		source: `${secretVariableName(name)} (environment)`
 	};
-	const value = await store.read(name, cwd);
+	const value = await store.read(name, cwd).catch((error) => {
+		throw secretReadError(secrets, [name], error);
+	});
 	return held(value) ? {
 		value,
 		source: store.file(name, cwd)
@@ -25669,7 +25815,7 @@ const CONFIGURED_SECRETS = Symbol.for("@hot-updater/cli-tools/secrets");
 const LOADING_SCOPE = Symbol.for("@hot-updater/cli-tools/secrets-scope");
 /**
 * Evaluates a config, the file or a config function, with `scope` as the
-* scope of every `secretEnv` it creates, so each reads the `secrets` of the
+* scope of every `secret()` it creates, so each reads the `secrets` of the
 * config that created it, whatever config loads after. It is kept on
 * `globalThis`: the config file loads its own copy of Hot Updater's modules.
 */
@@ -25685,7 +25831,7 @@ const withSecretsScope = async (scope, evaluate) => {
 };
 /**
 * Makes `secrets` the adapter a credential resolver reads from by default,
-* and a `secretEnv` created outside any config load, as `loadConfig` does
+* and a `secret()` created outside any config load, as `loadConfig` does
 * with the config's. It is kept on `globalThis`: the config file loads Hot
 * Updater's modules again, as its own copies.
 */
@@ -25697,108 +25843,192 @@ const setConfiguredSecrets = (secrets) => {
 * until a config loads.
 */
 const getConfiguredSecrets = () => globalThis[CONFIGURED_SECRETS] ?? localSecrets();
+/**
+* `names` from `secrets` in one `get`. A read that fails names the secrets
+* and the adapter, with the adapter's own error on the next line, such as
+* `EACCES: permission denied, open '<file>'`.
+*/
+const readSecrets = async (secrets, names, cwd) => {
+	try {
+		return await secrets.get(names, { cwd });
+	} catch (error) {
+		throw secretReadError(secrets, names, error);
+	}
+};
+const secretReadError = (secrets, names, error) => new Error(`Couldn't read ${list$1(names)} from the ${secrets.name} secrets adapter.\n${(error instanceof Error ? error.message : String(error)).split("\n")[0]}`, { cause: error });
 /** Where an adapter keeps `name`, for messages. */
 const describeSecret = (secrets, name) => secrets.describe?.(name) ?? `${name} in ${secrets.name}`;
 const list$1 = (names) => names.length <= 2 ? names.join(" and ") : `${names.slice(0, -1).join(", ")}, and ${names.at(-1)}`;
 /**
-* Environment variables from the `secrets` adapter of the config that
-* creates it, as a function a config calls when an adapter needs them, so loading
-* `hot-updater.config.ts` reads no secret. Each name set in the environment
-* or `.env.hotupdater` wins; the others are read from the config's
-* `secrets` adapter in one call, and without one they must be set. The values go only to the caller: they are never set in
-* `process.env`, and are masked in the CLI's logs. Names a loader or
-* interpreter reads, such as `NODE_OPTIONS`, are refused.
+* `secret("<name>")`: the secret `name` in `hot-updater.config.ts`, for a
+* build credential, such as `signing.keystore`, or any adapter credential,
+* which calls it on first use, so loading the config reads no secret.
+* Called, it reads `name`'s variable (`secretVariableName`) in the
+* environment or `.env.hotupdater`, else the config's `secrets` adapter:
+* the first call reads every name the config's `secret()`s reference and
+* the environment doesn't set, in one `get`. With `localSecrets()`, the
+* variable must be set: its files hold only the keys Hot Updater stores.
+* Values are masked in the CLI's logs and never set in `process.env`.
+* Names a loader or interpreter reads, such as `NODE_OPTIONS`, are refused.
+* A server passes its own environment's values instead.
 *
 * @example
-* const deploy = secretEnv(["S3_ACCESS_KEY_ID", "S3_SECRET_ACCESS_KEY"]);
-* s3Storage({
+* r2Storage({
 *   bucketName: "bundles",
-*   region: "us-east-1",
-*   credentials: async () => {
-*     const env = await deploy();
-*     return {
-*       accessKeyId: env.S3_ACCESS_KEY_ID,
-*       secretAccessKey: env.S3_SECRET_ACCESS_KEY,
-*     };
+*   accountId: "<account-id>",
+*   credentials: {
+*     accessKeyId: secret("HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID"),
+*     secretAccessKey: secret("HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY"),
 *   },
 * });
 */
-const secretEnv = (names) => {
-	const wanted = [...new Set(names)];
-	const invalid = wanted.filter((name) => !ENV_NAME_PATTERN.test(name));
-	if (invalid.length > 0) throw new Error(`secretEnv takes environment variable names: letters, digits, and underscores, not starting with a digit, and ${invalid.map((name) => JSON.stringify(name)).join(", ")} ${invalid.length === 1 ? "is" : "are"} not.`);
-	const reserved = wanted.filter(isReservedVariableName);
-	if (reserved.length > 0) throw new Error(`secretEnv refuses ${list$1(reserved)}: ${reserved.length === 1 ? "it changes" : "they change"} how a process loads code or which credentials Hot Updater uses.`);
+const secret = (name) => {
+	if (typeof name !== "string" || !isSecretName(name)) throw new Error(`secret() takes up to 64 letters, digits, ".", "_", and "-", starting with a letter or digit, and ${JSON.stringify(name)} is not that.`);
+	if (isReservedVariableName(name)) throw new Error(`secret() refuses ${name}: it changes how a process loads code or which credentials Hot Updater uses.`);
 	const scope = globalThis[LOADING_SCOPE];
-	if (scope) {
-		scope.names ??= /* @__PURE__ */ new Set();
-		for (const name of wanted) scope.names.add(name);
-	}
+	if (scope) (scope.names ??= /* @__PURE__ */ new Set()).add(name);
 	let read;
-	return () => read ??= readSecretEnv(wanted, scope).catch((error) => {
+	const ref = () => read ??= readSecretRef(name, scope).catch((error) => {
 		read = void 0;
 		throw error;
 	});
+	Object.defineProperty(ref, "name", { value: name });
+	Object.defineProperty(ref, SECRET_REF, { value: true });
+	return Object.freeze(ref);
 };
-const readSecretEnv = async (wanted, scope) => {
+/**
+* The scope's names to read in one `get`: those no build credential takes
+* and the environment doesn't set, with `name`.
+*/
+const batchedNames = (scope, name, fileEnv) => {
+	const names = [...scope.names ?? []].filter((candidate) => !scope.buildNames?.has(candidate) && getHotUpdaterEnvValue(fileEnv, secretVariableName(candidate)) === void 0);
+	return names.includes(name) ? names : [...names, name];
+};
+const readSecretRef = async (name, scope) => {
 	const cwd = getCwd();
 	const fileEnv = await readLoadedHotUpdaterEnv(cwd);
-	const variables = Object.create(null);
-	const fromStore = [];
-	for (const name of wanted) {
-		const value = getHotUpdaterEnvValue(fileEnv, name);
-		if (value === void 0) fromStore.push(name);
-		else variables[name] = value;
-	}
-	if (fromStore.length > 0) {
-		const secrets = getConfiguredAdapter(scope?.secrets ?? getConfiguredSecrets());
-		const read = secrets ? await secrets.get(fromStore, { cwd }) : {};
-		const missing = fromStore.filter((name) => {
-			const value = Object.hasOwn(read, name) ? read[name] : void 0;
-			if (typeof value !== "string" || value === "") return true;
-			variables[name] = value;
-			return false;
+	const variable = secretVariableName(name);
+	const fromEnv = getHotUpdaterEnvValue(fileEnv, variable);
+	if (fromEnv !== void 0 && fromEnv !== "") {
+		registerSecretValue(fromEnv);
+		return fromEnv;
+	}
+	const secrets = getConfiguredAdapter(scope?.secrets ?? getConfiguredSecrets());
+	if (secrets === void 0) throw new Error(`secret("${name}") has no value: set ${variable} in the environment or .env.hotupdater, or set the config's secrets to a team store.`);
+	let values;
+	if (scope) {
+		scope.read ??= readSecrets(secrets, batchedNames(scope, name, fileEnv), cwd).catch((error) => {
+			scope.read = void 0;
+			throw error;
 		});
-		if (missing.length > 0) {
-			const them = missing.length === 1 ? "it" : "them";
-			throw new Error(secrets === void 0 ? `secretEnv found no value for ${list$1(missing)}: set ${them} in the environment or .env.hotupdater, or read ${them} from a secrets store with the config's secrets.` : `secretEnv found no value for ${list$1(missing)}: ${missing.length === 1 ? "it is" : "they are"} not set in the environment or .env.hotupdater, and the ${secrets.name} secrets adapter does not hold ${them} (${missing.map((name) => describeSecret(secrets, name)).join("; ")}).`);
-		}
+		values = await scope.read;
 	}
-	for (const value of Object.values(variables)) registerSecretValue(value);
-	return Object.freeze(variables);
+	if (!values || !Object.hasOwn(values, name)) values = await readSecrets(secrets, [name], cwd);
+	const value = Object.hasOwn(values, name) ? values[name] : void 0;
+	if (typeof value !== "string" || value === "") throw new Error(`secret("${name}") has no value: ${variable} is not set in the environment or .env.hotupdater, and the ${secrets.name} secrets adapter does not hold it (${describeSecret(secrets, name)}).`);
+	registerSecretValue(value);
+	return value;
 };
 //#endregion
-//#region src/localBundleSigning.ts
-/** The secret `keys generate --secret` stores the private key as by default. */
-const DEFAULT_SIGNING_KEY_SECRET = "bundle-signing-key";
+//#region src/bundleSigning.ts
+/** The secret `signing: secret("bundle-signing-key")` names, which `secrets issue` creates. */
+const BUNDLE_SIGNING_KEY_SECRET = "bundle-signing-key";
+/** The command that creates and stores a bundle signing key. */
+const ISSUE_SIGNING_KEY_COMMAND = `npx hot-updater secrets issue ${BUNDLE_SIGNING_KEY_SECRET}`;
+/** The command that stores a bundle signing key you have. */
+const PUT_SIGNING_KEY_COMMAND = `npx hot-updater secrets put ${BUNDLE_SIGNING_KEY_SECRET} <key.pem>`;
+/** What deploy and doctor say when the config sets no `signing`. */
+const UNSIGNED_BUNDLES_WARNING = "Bundles are unsigned.";
+/** The next step after `UNSIGNED_BUNDLES_WARNING`. */
+const UNSIGNED_BUNDLES_NEXT_STEP = "To sign them, run:";
+/** What deploy and doctor say when `signing` is no shape it takes. */
+const INVALID_SIGNING_MESSAGE = `signing takes secret("${BUNDLE_SIGNING_KEY_SECRET}").`;
+/** The next step after `INVALID_SIGNING_MESSAGE`. */
+const INVALID_SIGNING_NEXT_STEP = "Store your key:";
+const invalid = (message) => ({
+	status: "invalid",
+	message
+});
+const LOCAL_FIELDS = [
+	"enabled",
+	"privateKeyPath",
+	"privateKey"
+];
+const readBundleSigningState = (signing) => {
+	if (signing === void 0) return { status: "unsigned" };
+	if (isSecretRef(signing)) return {
+		status: "on",
+		key: { secret: signing.name }
+	};
+	if (typeof signing !== "object" || signing === null || !Object.keys(signing).every((key) => LOCAL_FIELDS.includes(key))) return invalid(INVALID_SIGNING_MESSAGE);
+	const { enabled, privateKey, privateKeyPath } = signing;
+	if (enabled === false) return { status: "off" };
+	if (enabled !== true) return invalid(INVALID_SIGNING_MESSAGE);
+	if (privateKey !== void 0 && privateKeyPath !== void 0) return invalid("signing takes privateKey or privateKeyPath, not both.");
+	if (privateKey !== void 0) return isSecretRef(privateKey) ? {
+		status: "on",
+		key: { secret: privateKey.name }
+	} : invalid("signing.privateKey takes secret(\"<name>\").");
+	if (typeof privateKeyPath !== "string" || !privateKeyPath.trim()) return invalid("signing takes privateKeyPath, or privateKey as secret(\"<name>\").");
+	return {
+		status: "on",
+		key: { privateKeyPath }
+	};
+};
+/** The `secret()` the config's `signing` reads its private key from, if any. */
+const bundleSigningSecretRef = (signing) => {
+	if (isSecretRef(signing)) return signing;
+	const privateKey = typeof signing === "object" && signing !== null ? Reflect.get(signing, "privateKey") : void 0;
+	return isSecretRef(privateKey) ? privateKey : void 0;
+};
 /**
-* A local signing failure whose message the CLI prints as it is: it names
-* the secret and how to store it, and quotes no key material.
+* A bundle signing failure whose message the CLI prints as it is: it names
+* the secret and the next step, and quotes no key material.
 */
-var LocalSigningKeyError = class extends Error {
+var BundleSigningKeyError = class extends Error {
 	constructor(message, options) {
 		super(message, options);
-		this.name = "HotUpdaterLocalSigningKeyError";
+		this.name = "HotUpdaterBundleSigningKeyError";
 	}
 };
-const resolvePath$1 = (cwd, filePath) => path$1.isAbsolute(filePath) ? filePath : path$1.resolve(cwd, filePath);
-const parsePrivateKey = (pem) => {
+const FILE_HASH_PATTERN = /^[a-f\d]{64}$/iu;
+const resolvePath = (cwd, filePath) => path$1.isAbsolute(filePath) ? filePath : path$1.resolve(cwd, filePath);
+const parseRsaPublicKey = (publicKeyPEM) => {
+	try {
+		const normalizedPublicKey = publicKeyPEM.trim();
+		if (!normalizedPublicKey.startsWith("-----BEGIN PUBLIC KEY-----") || !normalizedPublicKey.endsWith("-----END PUBLIC KEY-----")) throw new Error("not spki");
+		const publicKey = crypto$1.createPublicKey(normalizedPublicKey);
+		if (publicKey.asymmetricKeyType !== "rsa" || (publicKey.asymmetricKeyDetails?.modulusLength ?? 0) < 2048) throw new Error("not rsa");
+		return publicKey;
+	} catch {
+		throw new Error("Bundle signing public key must be a valid RSA SPKI PEM key with a modulus of at least 2048 bits.");
+	}
+};
+/** The SPKI PEM of `key`, a public key or the private key it derives from. */
+const exportPublicKey = (key) => (key.type === "private" ? crypto$1.createPublicKey(key) : key).export({
+	type: "spki",
+	format: "pem"
+}).toString();
+const readBundleSigningPublicKeyFile = async (publicKeyPath, options = {}) => {
+	if (!publicKeyPath.trim()) throw new Error("Bundle signing public key path is required.");
 	try {
-		const privateKey = crypto$1.createPrivateKey(pem);
-		if (privateKey.asymmetricKeyType !== "rsa" || (privateKey.asymmetricKeyDetails?.modulusLength ?? 0) < 2048) throw new Error("not rsa");
-		return privateKey;
+		const publicKeyPEM = await fs$2.readFile(resolvePath(options.cwd ?? getCwd(), publicKeyPath), "utf8");
+		return exportPublicKey(parseRsaPublicKey(publicKeyPEM));
 	} catch {
-		throw new Error("Failed to load the local bundle signing private key.");
+		throw new Error("Failed to read the bundle signing public key file.");
 	}
 };
-const loadPrivateKeyFile = async (privateKeyPath) => {
-	let pem;
+const parsePrivateKey = (pem) => {
+	const privateKey = crypto$1.createPrivateKey(pem);
+	if (privateKey.asymmetricKeyType !== "rsa" || (privateKey.asymmetricKeyDetails?.modulusLength ?? 0) < 2048) throw new Error("not rsa");
+	return privateKey;
+};
+const loadPrivateKeyFile = async (file) => {
 	try {
-		pem = await fs$2.readFile(privateKeyPath, "utf8");
+		return parsePrivateKey(await fs$2.readFile(file, "utf8"));
 	} catch {
-		throw new Error("Failed to load the local bundle signing private key.");
+		throw new BundleSigningKeyError("Failed to load the bundle signing private key from privateKeyPath.");
 	}
-	return parsePrivateKey(pem);
 };
 /**
 * The private key the `secrets` adapter holds as `name`: masked in the CLI's
@@ -25813,219 +26043,90 @@ const loadPrivateKeySecret = async (secrets, name, cwd) => {
 		value = Object.hasOwn(read, name) ? read[name] : void 0;
 	} catch (error) {
 		const reason = error instanceof Error ? error.message : String(error);
-		throw new LocalSigningKeyError(`The ${secrets.name} secrets adapter could not read the bundle signing key ${name}: ${reason}`, { cause: error });
+		throw new BundleSigningKeyError(`The ${secrets.name} secrets adapter could not read the bundle signing key ${name}: ${reason}`, { cause: error });
+	}
+	if (typeof value !== "string" || !value.trim()) {
+		const issue = `npx hot-updater secrets issue ${BUNDLE_SIGNING_KEY_SECRET}${name === "bundle-signing-key" ? "" : ` ${name}`}`;
+		throw new BundleSigningKeyError(`signing reads the bundle signing key ${name}, which is not in the ${secrets.name} secrets adapter (${describeSecret(secrets, name)}).\nTo create one, run: ${issue}`);
 	}
-	if (typeof value !== "string" || !value.trim()) throw new LocalSigningKeyError(`signing.privateKey reads the bundle signing key ${name}, which is not in the ${secrets.name} secrets adapter (${describeSecret(secrets, name)}). Set it to the RSA private key in PEM, or generate a key pair with \`npx hot-updater keys generate --secret ${name}\`.`);
 	registerSecretValue(value);
 	const pem = value.includes("\n") ? value : value.replaceAll("\\n", "\n");
 	if (pem !== value) registerSecretValue(pem);
 	try {
 		return parsePrivateKey(pem);
 	} catch {
-		throw new LocalSigningKeyError(`The bundle signing key ${name} in the ${secrets.name} secrets adapter is not an RSA private key in PEM of at least 2048 bits.`);
+		throw new BundleSigningKeyError(`The bundle signing key ${name} in the ${secrets.name} secrets adapter is not an RSA private key in PEM of at least 2048 bits.`);
 	}
 };
 /**
-* The built-in local signer. Its private key is read on first use, once:
-* from `privateKeyPath`, or from the config's `secrets` adapter for
-* `privateKey: "secret:<name>"`, and is never written anywhere.
+* The private keys each `signing` value has read, by file or by secrets
+* adapter, so the commands of one run that sign and derive the public key
+* read the key once.
 */
-const createLocalSigningAdapter = (config, { secrets } = {}) => {
-	const privateKeys = /* @__PURE__ */ new Map();
-	const { privateKeyPath } = config;
-	const secretName = privateKeyPath === void 0 ? parseSecretReference(config.privateKey, "signing.privateKey") : void 0;
-	const getPrivateKey = (cwd = process.cwd()) => {
-		const cacheKey = privateKeyPath === void 0 ? "" : resolvePath$1(cwd, privateKeyPath);
-		const cached = privateKeys.get(cacheKey);
-		if (cached) return cached;
-		const pending = (secretName === void 0 ? loadPrivateKeyFile(cacheKey) : loadPrivateKeySecret(secrets ?? getConfiguredSecrets(), secretName, cwd)).catch((error) => {
-			privateKeys.delete(cacheKey);
-			throw error;
-		});
-		privateKeys.set(cacheKey, pending);
-		return pending;
-	};
-	return {
-		name: "localSigning",
-		async getPublicKey({ cwd } = {}) {
-			const privateKey = await getPrivateKey(cwd);
-			return { publicKey: crypto$1.createPublicKey(privateKey).export({
-				format: "pem",
-				type: "spki"
-			}).toString() };
-		},
-		async sign({ message, cwd }) {
-			if (!(message instanceof Uint8Array) || message.byteLength !== 32) throw new Error("Local bundle signing messages must be exactly 32 bytes.");
-			const privateKey = await getPrivateKey(cwd);
-			return { signature: crypto$1.sign("RSA-SHA256", message, privateKey) };
-		}
-	};
-};
+const privateKeys = /* @__PURE__ */ new WeakMap();
 /**
-* The `secrets` adapter of the config each normalized `privateKey` config
-* came from, so a config function's per-platform configs each read their
-* own store, whichever config loaded last.
+* The private key `signing` signs with, or null when it signs nothing.
+* Throws `INVALID_SIGNING_MESSAGE`, with the next step, for a value
+* `signing` doesn't take.
 */
-const signingSecrets = /* @__PURE__ */ new WeakMap();
-/** The `secrets` adapter `normalizeSigningConfig` bound `signing` to. */
-const getSigningSecrets = (signing) => signingSecrets.get(signing);
-const invalidSigningConfig = () => /* @__PURE__ */ new Error("Bundle signing must be a local key config or signing adapter. Omit signing to disable it.");
-const normalizeSigningConfig = (signing, { secrets } = {}) => {
-	if (signing === void 0) return void 0;
-	if (typeof signing !== "object" || signing === null) throw invalidSigningConfig();
-	const hasLocalFields = [
-		"enabled",
-		"privateKeyPath",
-		"privateKey"
-	].some((key) => Reflect.has(signing, key));
-	const hasPluginMembers = [
-		"name",
-		"getPublicKey",
-		"sign"
-	].some((key) => Reflect.has(signing, key));
-	if (hasLocalFields && hasPluginMembers) throw new Error("Bundle signing config cannot combine local signing fields with signing adapter fields.");
-	if (!hasPluginMembers) {
-		if (Object.keys(signing).some((key) => key !== "enabled" && key !== "privateKeyPath" && key !== "privateKey")) throw new Error("Local bundle signing accepts only enabled, and privateKeyPath or privateKey.");
-		const enabled = Reflect.get(signing, "enabled");
-		if (enabled === false) return void 0;
-		if (enabled !== true) throw invalidSigningConfig();
-		const privateKeyPath = Reflect.get(signing, "privateKeyPath");
-		const privateKey = Reflect.get(signing, "privateKey");
-		if (privateKeyPath !== void 0 && privateKey !== void 0) throw new Error("Local bundle signing takes its private key from privateKeyPath or from privateKey, not both.");
-		if (privateKey !== void 0) {
-			if (typeof privateKey !== "string") throw new Error("signing.privateKey names a secret as secret:<name>, such as \"secret:bundle-signing-key\".");
-			parseSecretReference(privateKey, "signing.privateKey");
-			const normalized = {
-				enabled: true,
-				privateKey
-			};
-			if (secrets) signingSecrets.set(normalized, secrets);
-			return normalized;
-		}
-		if (typeof privateKeyPath !== "string" || !privateKeyPath.trim()) throw new Error("Enabled local bundle signing requires privateKeyPath, or privateKey as \"secret:<name>\".");
-		return {
-			enabled: true,
-			privateKeyPath
-		};
-	}
-	if (typeof Reflect.get(signing, "name") !== "string" || typeof Reflect.get(signing, "getPublicKey") !== "function" || typeof Reflect.get(signing, "sign") !== "function") throw invalidSigningConfig();
-	return signing;
-};
-//#endregion
-//#region src/bundleSigning.ts
-const FILE_HASH_PATTERN = /^[a-f\d]{64}$/iu;
-const resolvePath = (cwd, filePath) => path$1.isAbsolute(filePath) ? filePath : path$1.resolve(cwd, filePath);
-const parseRsaPublicKey = (publicKeyPEM) => {
-	try {
-		const normalizedPublicKey = publicKeyPEM.trim();
-		if (!normalizedPublicKey.startsWith("-----BEGIN PUBLIC KEY-----") || !normalizedPublicKey.endsWith("-----END PUBLIC KEY-----")) throw new Error("not spki");
-		const publicKey = crypto$1.createPublicKey(normalizedPublicKey);
-		if (publicKey.asymmetricKeyType !== "rsa" || (publicKey.asymmetricKeyDetails?.modulusLength ?? 0) < 2048) throw new Error("not rsa");
-		return publicKey;
-	} catch {
-		throw new Error("Bundle signing public key must be a valid RSA SPKI PEM key with a modulus of at least 2048 bits.");
-	}
-};
-const exportPublicKey = (publicKey) => publicKey.export({
-	type: "spki",
-	format: "pem"
-}).toString();
-const readBundleSigningPublicKeyFile = async (publicKeyPath, options = {}) => {
-	if (!publicKeyPath.trim()) throw new Error("Bundle signing public key path is required.");
-	try {
-		const publicKeyPEM = await fs$2.readFile(resolvePath(options.cwd ?? getCwd(), publicKeyPath), "utf8");
-		return exportPublicKey(parseRsaPublicKey(publicKeyPEM));
-	} catch {
-		throw new Error("Failed to read the bundle signing public key file.");
-	}
+const loadSigningKey = (signing, { cwd = getCwd(), secrets }) => {
+	const state = readBundleSigningState(signing);
+	if (state.status === "invalid") throw new BundleSigningKeyError(`${state.message}\n${INVALID_SIGNING_NEXT_STEP} ${PUT_SIGNING_KEY_COMMAND}`);
+	if (state.status !== "on") return null;
+	const store = secrets ?? getConfiguredSecrets();
+	const cacheKey = "secret" in state.key ? store : resolvePath(cwd, state.key.privateKeyPath);
+	const cache = privateKeys.get(signing) ?? /* @__PURE__ */ new Map();
+	privateKeys.set(signing, cache);
+	const cached = cache.get(cacheKey);
+	if (cached) return cached;
+	const pending = ("secret" in state.key ? loadPrivateKeySecret(store, state.key.secret, cwd) : loadPrivateKeyFile(cacheKey)).catch((error) => {
+		cache.delete(cacheKey);
+		throw error;
+	});
+	cache.set(cacheKey, pending);
+	return pending;
 };
+const signingFailure = (summary, error) => new Error(error instanceof BundleSigningKeyError ? error.message : `${summary} ${error instanceof Error ? error.message : String(error)}`, { cause: error });
 /**
-* `remoteSigning`'s errors with a reason it wrote itself, by name, as it may
-* come from another copy of plugin-core, and the local signer's errors that
-* name its secret. Any other signing adapter error is redacted: it may quote
-* key material.
+* Prepares the run's bundle signing: the public key the app must embed, and
+* a signer of SHA-256 file hashes that signs each hash once. Null when
+* `signing` is omitted or `{ enabled: false }`.
 */
-const REMOTE_SIGNING_ERROR_NAME = "HotUpdaterRemoteSigningError";
-const signingFailure = (summary, error) => new Error(error instanceof Error && (error.name === REMOTE_SIGNING_ERROR_NAME || error instanceof LocalSigningKeyError) ? `${summary} ${error.message}` : summary);
-/**
-* The local signer of each config's `signing` that reads its private key
-* from a secret, so the commands of one run that sign and derive the public
-* key read the secret once.
-*/
-const secretSigners = /* @__PURE__ */ new WeakMap();
-const getSigningProvider = (signing) => {
-	const normalized = normalizeSigningConfig(signing);
-	if (!normalized) return null;
-	if (!("enabled" in normalized)) return normalized;
-	if (normalized.privateKey === void 0) return createLocalSigningAdapter(normalized);
-	const key = signing;
-	const cached = secretSigners.get(key);
-	if (cached) return cached;
-	const local = createLocalSigningAdapter(normalized, { secrets: getSigningSecrets(key) });
-	secretSigners.set(key, local);
-	return local;
-};
-const getProviderPublicKey = async (provider, cwd) => {
+const prepareBundleSigning = async (signing, options = {}) => {
+	const loading = loadSigningKey(signing, options);
+	if (!loading) return null;
+	let privateKey;
 	try {
-		const result = await provider.getPublicKey({ cwd });
-		if (!result || typeof result.publicKey !== "string") throw new Error("invalid result");
-		return parseRsaPublicKey(result.publicKey);
+		privateKey = await loading;
 	} catch (error) {
-		throw signingFailure("Failed to resolve the bundle signing provider public key.", error);
+		throw signingFailure("Failed to read the bundle signing key.", error);
 	}
-};
-const createMemoizedSigner = ({ publicKey, sign }) => {
 	const signatures = /* @__PURE__ */ new Map();
-	return (fileHash) => {
-		if (!FILE_HASH_PATTERN.test(fileHash)) return Promise.reject(/* @__PURE__ */ new Error("Bundle signing requires a 64-character hexadecimal file hash."));
-		const normalizedFileHash = fileHash.toLowerCase();
-		const cached = signatures.get(normalizedFileHash);
-		if (cached) return cached;
-		const pending = (async () => {
-			const message = Buffer.from(normalizedFileHash, "hex");
-			let signature;
-			try {
-				signature = await sign(new Uint8Array(message));
-			} catch (error) {
-				throw signingFailure("Bundle signing provider failed to sign the file hash.", error);
-			}
-			if (!(signature instanceof Uint8Array) || signature.byteLength === 0) throw new Error("Bundle signing provider returned an invalid signature.");
-			if (!crypto$1.verify("RSA-SHA256", message, publicKey, signature)) throw new Error("Bundle signing provider returned a signature that does not match the configured public key.");
-			return Buffer.from(signature).toString("base64");
-		})().catch((error) => {
-			signatures.delete(normalizedFileHash);
-			throw error;
-		});
-		signatures.set(normalizedFileHash, pending);
-		return pending;
-	};
-};
-const preparePluginSigning = async (signing, cwd) => {
-	const providerPublicKey = await getProviderPublicKey(signing, cwd);
 	return {
-		name: signing.name,
-		publicKey: exportPublicKey(providerPublicKey),
-		signFileHash: createMemoizedSigner({
-			publicKey: providerPublicKey,
-			sign: async (message) => {
-				return (await signing.sign({
-					cwd,
-					message
-				})).signature;
-			}
-		})
+		publicKey: exportPublicKey(privateKey),
+		signFileHash: async (fileHash) => {
+			if (!FILE_HASH_PATTERN.test(fileHash)) throw new Error("Bundle signing requires a 64-character hexadecimal file hash.");
+			const normalized = fileHash.toLowerCase();
+			const cached = signatures.get(normalized);
+			if (cached) return cached;
+			const signature = crypto$1.sign("RSA-SHA256", Buffer.from(normalized, "hex"), privateKey).toString("base64");
+			signatures.set(normalized, signature);
+			return signature;
+		}
 	};
 };
-const prepareBundleSigning = async (signing, options = {}) => {
-	const provider = getSigningProvider(signing);
-	if (!provider) return null;
-	return preparePluginSigning(provider, options.cwd ?? getCwd());
-};
-/** Resolves the public identity of the configured bundle signer. */
+/**
+* The public key of the configured bundle signing key, in SPKI PEM; null
+* when `signing` signs nothing.
+*/
 const getBundleSigningPublicKey = async (signing, options = {}) => {
-	const provider = getSigningProvider(signing);
-	if (!provider) return null;
-	return exportPublicKey(await getProviderPublicKey(provider, options.cwd ?? getCwd()));
+	const loading = loadSigningKey(signing, options);
+	if (!loading) return null;
+	try {
+		return exportPublicKey(await loading);
+	} catch (error) {
+		throw signingFailure("Failed to read the bundle signing key.", error);
+	}
 };
 //#endregion
 //#region src/ConfigBuilder.ts
@@ -38730,48 +38831,55 @@ const formatCommand = (command) => {
 */
 const withLead = (lead, command) => lead.length + 1 + command.length <= 77 ? `${lead} ${command}` : `${lead}\n${formatCommand(command)}`;
 /**
-* Why a build has no upload keystore, in three lines, steering away from a
-* second key: Play rejects builds signed with a key it does not have.
-* Under a team's adapter the keystore is someone's already, so it is
-* imported, never created; only `localSecrets()` alone offers a new one.
+* Why a build has no upload keystore, steering away from a second key:
+* Play rejects builds signed with a key it does not have. Under a team's
+* adapter the keystore is someone's already, so it is imported, never
+* created; only `localSecrets()` alone offers a new one, for an app with
+* no `.aab` on Play yet.
 */
 const describeMissingKeystore = (store, item, name) => {
 	const configured = getConfiguredAdapter(store);
 	if (configured) return [
 		`No ${item} in ${describeSecret(configured, name)}.`,
 		"Ask whoever set it up to store it there, or import it with:",
-		"npx hot-updater google-play login"
+		formatCommand(credentialPutCommand("android-keystore", name))
 	].join("\n");
 	return [
 		`No ${item} in the ${store.name} secrets adapter.`,
-		"Play rejects a new key if the app has one: import it with google-play login.",
-		withLead("Otherwise:", credentialStoreCommand("android-keystore", name))
+		withLead("Store the app's upload key:", credentialPutCommand("android-keystore", name)),
+		withLead("No .aab on Play yet? Create one:", credentialIssueCommand("android-keystore", name))
 	].join("\n");
 };
+/** The file each `secrets put <name> <file>` command names. */
+const PUT_FILES = {
+	"android-keystore": "<upload.jks>",
+	"play-service-account": "<key.json>"
+};
+/**
+* The command that stores the file you have as `name`: the service
+* account's JSON key, or the app's upload keystore. `--kind` is named only
+* for a name that is not the kind.
+*/
+const credentialPutCommand = (kind, name = kind) => `npx hot-updater secrets put ${name}${name === kind ? "" : ` --kind ${kind}`} ${PUT_FILES[kind]}`;
 /**
 * The command that stores the key Hot Updater issues as `name`: an App
-* Store Connect API key after an Apple Account sign-in, a Play service
-* account after a Google one, and an upload keystore it creates.
+* Store Connect API key after an Apple Account sign-in, and an upload
+* keystore it creates.
 */
 const credentialIssueCommand = (kind, name = kind) => `npx hot-updater secrets issue ${kind}${name === kind ? "" : ` ${name}`}`;
 /** The command group of each issued kind's shortcut, `<group> login`. */
-const CREDENTIAL_LOGIN_GROUPS = {
-	"asc-api-key": "apple",
-	"play-service-account": "google-play"
-};
+const CREDENTIAL_LOGIN_GROUPS = { "asc-api-key": "apple" };
 /**
 * The command people meet first that issues `kind` as `name`: its shortcut,
-* `apple login` for an App Store Connect API key or `google-play login`
-* for a Play service account, which takes nothing and stores the kind's
-* own name; for another name, `credentialIssueCommand`.
+* `apple login` for an App Store Connect API key, which takes nothing and
+* stores the kind's own name; for another name, `credentialIssueCommand`.
 */
 const credentialLoginCommand = (kind, name = kind) => name === kind ? `npx hot-updater ${CREDENTIAL_LOGIN_GROUPS[kind]} login` : credentialIssueCommand(kind, name);
 /**
 * The command that stores a missing credential of `kind` as `name`: the
-* upload keystore Hot Updater creates, or the key it issues after a
-* sign-in.
+* key Hot Updater issues after an Apple sign-in, or the file you have.
 */
-const credentialStoreCommand = (kind, name = kind) => kind === "android-keystore" ? credentialIssueCommand(kind, name) : credentialLoginCommand(kind, name);
+const credentialStoreCommand = (kind, name = kind) => kind === "asc-api-key" ? credentialLoginCommand(kind, name) : credentialPutCommand(kind, name);
 var CredentialUnavailableError = class extends Error {
 	kind;
 	/** The environment variables that can provide this credential. */
@@ -45531,19 +45639,6 @@ const MANAGED_HELPER_NAMES = /* @__PURE__ */ new Set([
 	"deploySecrets",
 	"storageSecrets"
 ]);
-/**
-* `const <name> = secretEnv([...names])`, a helper a managed config reads
-* credentials with: from the environment and `.env.hotupdater` first, then
-* from the config's `secrets` adapter. `storageSecrets` and
-* `databaseSecrets` read each adapter's own, so a command that reaches only
-* one needs only its credentials; `deploySecrets` reads what both share.
-* Its builder imports `secretEnv` from `hot-updater`.
-*/
-const secretEnvHelper = (name, names) => ({
-	name,
-	strategy: "replace",
-	code: `const ${name} = secretEnv([\n${names.map((variable) => `  ${JSON.stringify(variable)},`).join("\n")}\n]);`
-});
 const KNOWN_BUILD_CALLEES = /* @__PURE__ */ new Set([
 	"bare",
 	"expo",
@@ -45620,13 +45715,16 @@ const isHotUpdaterEnvRead = (expression) => {
 	const read = expression.type === "TSNonNullExpression" ? expression.expression : expression;
 	return read.type === "MemberExpression" && !read.computed && read.property.type === "Identifier" && read.property.name.startsWith("HOT_UPDATER_") && read.object.type === "MemberExpression" && !read.object.computed && read.object.object.type === "Identifier" && read.object.object.name === "process" && read.object.property.type === "Identifier" && read.object.property.name === "env";
 };
+/** `secret("<name>")`, the credential init writes. */
+const isSecretCall = (expression) => expression.type === "CallExpression" && expression.callee.type === "Identifier" && expression.callee.name === "secret" && expression.arguments.length === 1 && expression.arguments[0]?.type === "Literal" && typeof expression.arguments[0].value === "string";
 /**
 * A value init writes into a managed adapter's options: a string, a
-* `process.env.HOT_UPDATER_*` read, as configs of 1.1 read every value, or
-* an object of only those, such as `credentials`. Init replaces it with
-* what its run resolves; any other value is the project's own and kept.
+* `process.env.HOT_UPDATER_*` read, as configs of 1.1 read every value, a
+* `secret("<name>")`, or an object of only those, such as `credentials`.
+* Init replaces it with what its run resolves; any other value is the
+* project's own and kept.
 */
-const isInitWrittenValue = (expression) => expression.type === "Literal" && typeof expression.value === "string" || isHotUpdaterEnvRead(expression) || expression.type === "ObjectExpression" && expression.properties.length > 0 && expression.properties.every((property) => isDataProperty(property) && isInitWrittenValue(property.value));
+const isInitWrittenValue = (expression) => expression.type === "Literal" && typeof expression.value === "string" || isHotUpdaterEnvRead(expression) || isSecretCall(expression) || expression.type === "ObjectExpression" && expression.properties.length > 0 && expression.properties.every((property) => isDataProperty(property) && isInitWrittenValue(property.value));
 const dedentBlock = (text) => {
 	const lines = text.replace(/\s+$/, "").split("\n");
 	const indents = lines.filter((line) => line.trim() !== "").map((line) => line.match(/^\s*/)?.[0].length ?? 0);
@@ -46191,6 +46289,22 @@ const readTextFile = (filePath) => fs$1.readFile(filePath, "utf-8").catch((error
 * existing config with the scaffold's build, storage, database, plugins, and
 * helpers merged in, keeping the project's own settings.
 */
+/**
+* Whether `hot-updater.config.ts` in `cwd` sets a team `secrets` adapter,
+* read from its text: a `secrets` property other than `localSecrets(...)`,
+* or a config whose shape init can't read. False without the file. Init
+* reads the store through the loaded config, so one that sets a store but
+* doesn't load must be fixed first.
+*/
+const configSetsTeamSecrets = async (cwd) => {
+	const text = await readTextFile(path.join(cwd, HOT_UPDATER_CONFIG_PATH));
+	if (text === null) return false;
+	const source = parseConfigSource(text);
+	const config = source && findDefineConfigObject(source);
+	if (!config) return true;
+	const secrets = findAnyProperty(config.objectExpression, "secrets");
+	return secrets !== null && getCallCallee(secrets.value) !== "localSecrets";
+};
 const writeHotUpdaterConfig = async (scaffold, filePath = HOT_UPDATER_CONFIG_PATH) => {
 	const existingText = await readTextFile(filePath);
 	if (existingText === null) {
@@ -46246,6 +46360,75 @@ const writeHotUpdaterFiles = async (scaffold, { cwd = process.cwd(), settings })
 	].join("\n"));
 	return { config };
 };
+/**
+* The config text with `signing: secret("<name>")` added, and `secret` in
+* its `hot-updater` import, once. A config that sets `signing` in any form,
+* such as 1.1's `{ enabled: true, privateKeyPath }`, is kept.
+*/
+const addSigningSecretToConfigText = (text, name) => {
+	const source = parseConfigSource(text);
+	const config = source && findDefineConfigObject(source);
+	if (!source || !config) return { status: "unsupported" };
+	const { objectExpression } = config;
+	if (objectExpression.properties.some((property) => property.type === "SpreadElement" || getObjectPropertyName(property) === "signing")) return { status: "kept" };
+	const edits = [];
+	const property = `signing: secret(${JSON.stringify(name)})`;
+	const last = objectExpression.properties.at(-1);
+	if (!last) edits.push({
+		start: objectExpression.start,
+		end: objectExpression.end,
+		text: `{\n  ${property},\n}`
+	});
+	else {
+		const lineStart = text.lastIndexOf("\n", last.start) + 1;
+		const indent = /^[ \t]*/u.exec(text.slice(lineStart, last.start))[0];
+		const between = text.slice(last.end, objectExpression.end - 1);
+		const comma = /^\s*,/u.exec(between);
+		let at = last.end + (comma?.[0].length ?? 0);
+		const lineEnd = text.indexOf("\n", at);
+		if (lineEnd !== -1 && text.slice(at, lineEnd).trim().startsWith("//")) at = lineEnd;
+		edits.push({
+			start: at,
+			end: at,
+			text: `\n${indent}${property},`
+		});
+		if (!comma) edits.push({
+			start: last.end,
+			end: last.end,
+			text: ","
+		});
+	}
+	const hotUpdaterImports = importDeclarationsOf(source).filter((declaration) => declaration.source.value === "hot-updater" && declaration.importKind !== "type");
+	if (!hotUpdaterImports.some((declaration) => declaration.specifiers.some((specifier) => specifier.type === "ImportSpecifier" && specifier.local.name === "secret"))) {
+		const named = hotUpdaterImports.find((declaration) => declaration.specifiers.some((specifier) => specifier.type === "ImportSpecifier"));
+		const lastSpecifier = named?.specifiers.at(-1);
+		edits.push(named && lastSpecifier ? {
+			start: lastSpecifier.end,
+			end: lastSpecifier.end,
+			text: ", secret"
+		} : {
+			start: 0,
+			end: 0,
+			text: "import { secret } from \"hot-updater\";\n"
+		});
+	}
+	return {
+		status: "added",
+		text: applyTextEdits(text, edits)
+	};
+};
+/**
+* Adds `signing: secret("<name>")` to `hot-updater.config.ts` in `cwd`, as
+* `addSigningSecretToConfigText` does. Without the file, nothing is written.
+*/
+const addSigningSecretToConfig = async (cwd, name) => {
+	const filePath = path.join(cwd, HOT_UPDATER_CONFIG_PATH);
+	const text = await readTextFile(filePath);
+	if (text === null) return "missing";
+	const result = addSigningSecretToConfigText(text, name);
+	if (result.status === "added") await fs$1.writeFile(filePath, result.text, "utf-8");
+	return result.status;
+};
 //#endregion
 //#region src/infrastructureGeneration.ts
 const assertInfrastructureGenerationPayload = ({ payload, provider, resource }) => {
@@ -47079,8 +47262,8 @@ const loadConfigFile = async () => {
 };
 /**
 * The config `options` select, resolved: a config function runs in a scope
-* of its own, so the `secretEnv` it creates reads this config's `secrets`,
-* and the file's top-level `secretEnv` reads the first config's.
+* of its own, so the `secret()` it creates reads this config's `secrets`,
+* and the file's top-level `secret()` reads the first config's.
 */
 const configFor = async ({ source, scope: fileScope }, options) => {
 	if (typeof source !== "function") return resolveConfig(source, [fileScope]);
@@ -47108,31 +47291,48 @@ const loadPlatformConfigs = async (platforms, { channel }) => {
 	return configs;
 };
 /**
+* The names the config's build credentials reference, which the CLI reads
+* for their kind: `signing`'s, and each scheme's
+* `signing.ascApiKey` and `signing.keystore`.
+*/
+const buildSecretNames = (config) => {
+	return [
+		bundleSigningSecretRef(config.signing),
+		...Object.values(config.nativeBuild?.ios ?? {}).map((scheme) => scheme?.signing?.ascApiKey),
+		...Object.values(config.nativeBuild?.android ?? {}).map((scheme) => scheme?.signing?.keystore)
+	].filter(isSecretRef).map(({ name }) => name);
+};
+/**
 * The config with its defaults. Its `secrets` adapter fills `scopes` not yet
-* filled, which the `secretEnv` its evaluation created read, and becomes the
+* filled, which the `secret()` its evaluation created read, and becomes the
 * default of credential resolvers.
 */
 const resolveConfig = (config, scopes) => {
 	const mergedConfig = mergeConfigSources(config, getDefaultConfig());
 	const secrets = resolveSecretsAdapter(mergedConfig.secrets);
-	const signing = normalizeSigningConfig(mergedConfig.signing, { secrets });
-	for (const scope of scopes) scope.secrets ??= secrets;
+	const buildNames = buildSecretNames(mergedConfig);
+	for (const scope of scopes) {
+		scope.secrets ??= secrets;
+		scope.buildNames ??= /* @__PURE__ */ new Set();
+		for (const name of buildNames) scope.buildNames.add(name);
+	}
 	setConfiguredSecrets(secrets);
 	const resolved = {
 		...mergedConfig,
-		signing,
 		secrets
 	};
-	Object.defineProperty(resolved, SECRET_ENV_NAMES, { value: [...new Set(scopes.flatMap((scope) => [...scope.names ?? []]))] });
+	Object.defineProperty(resolved, DEPLOY_SECRET_NAMES, { value: [...new Set(scopes.flatMap((scope) => [...scope.names ?? []]))].filter((name) => !buildNames.includes(name)) });
 	return resolved;
 };
-const SECRET_ENV_NAMES = Symbol.for("@hot-updater/cli-tools/secret-env-names");
+const DEPLOY_SECRET_NAMES = Symbol.for("@hot-updater/cli-tools/deploy-secret-names");
 /**
-* The names every `secretEnv` the config created while it loaded reads,
-* such as `HOT_UPDATER_CLOUDFLARE_API_TOKEN`, in the order it created them.
+* The names the config's `secret()`s reference for its adapters, such as
+* `HOT_UPDATER_CLOUDFLARE_API_TOKEN`, in the order the config created
+* them: every name but those of build credentials, which `doctor` lists
+* by field.
 */
-const getSecretEnvNames = (config) => {
-	const names = Reflect.get(config, SECRET_ENV_NAMES);
+const getDeploySecretNames = (config) => {
+	const names = Reflect.get(config, DEPLOY_SECRET_NAMES);
 	return Array.isArray(names) ? names : [];
 };
 //#endregion
@@ -47456,7 +47656,7 @@ const loadTeamSecrets = async () => {
 const readMissingFromTeamSecrets = async (secrets, names, { env, cwd }) => {
 	const missing = names.filter((name) => getHotUpdaterEnvValue(env, name) === void 0);
 	if (missing.length === 0) return {};
-	const held = await secrets.get(missing, { cwd });
+	const held = await readSecrets(secrets, missing, cwd);
 	const values = Object.create(null);
 	for (const name of missing) {
 		const value = Object.hasOwn(held, name) ? held[name] : void 0;
@@ -47468,16 +47668,18 @@ const readMissingFromTeamSecrets = async (secrets, names, { env, cwd }) => {
 	return values;
 };
 /**
-* Stores each of `names` that `.env.hotupdater` holds through `secrets`,
-* then reads them back in one call. The file is left as it is. Returns the
+* Stores each of `names` that `envFile`, `.env.hotupdater` by default,
+* holds through `secrets`, then reads them back in one call. Only the file
+* is read, never the environment. The file is left as it is. Returns the
 * names stored, in the order of `names`; throws when the adapter reads
 * back another value.
 */
-const storeEnvFileSecrets = async (secrets, names, cwd) => {
-	const file = await readLoadedHotUpdaterEnv(cwd);
+const storeEnvFileSecrets = async (secrets, names, cwd, envFile) => {
+	const file = envFile === void 0 ? await readLoadedHotUpdaterEnv(cwd) : await readLoadedEnvFile(envFile, cwd);
 	const values = /* @__PURE__ */ new Map();
 	for (const name of names) {
-		const value = Object.hasOwn(file, name) ? file[name]?.trim() : void 0;
+		const variable = secretVariableName(name);
+		const value = Object.hasOwn(file, variable) ? file[variable]?.trim() : void 0;
 		if (value) values.set(name, value);
 	}
 	if (values.size === 0) return [];
@@ -47543,4 +47745,4 @@ function transformTemplate(templateString, values) {
 	return result;
 }
 //#endregion
-export { BuildFailedError, BuildLogger, CREDENTIAL_ENV_NAMES, CREDENTIAL_LOGIN_GROUPS, ConfigBuilder, CredentialUnavailableError, DEFAULT_SIGNING_KEY_SECRET, HOT_UPDATER_HOME_ENV, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, INTERFACE_FINGERPRINT_ENGINE, InitEnvFileError, InitError, LOCAL_SECRETS_NAME, LegacyInfrastructureError, MANAGED_CLIENT_CREDENTIAL_ENV, MissingInitInputsError, ServerDefinitionError, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, assertUnreservedEnv, autolinkingConfigCommand, banner, clientAuthOf, typedColors as colors, confirmInitInputPersistence, copyDirToTmp, createCredentialResolver, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createInterfaceFingerprint, createLocalSecretsStore, createLogWriter, createMigrator, createMinBundleId, createTarBrTargetFiles, createZip, credentialIssueCommand, credentialLoginCommand, credentialStoreCommand, decryptJson, defineInitProvider, describeSecret, describeStoredSecret, encryptJson, ensureInstallPackages, generateClientCredential, generateSchema, generatesSchema, getAndroidSdkPath, getBundleSigningPublicKey, getConfiguredAdapter, getConfiguredSecrets, getCwd, getHotUpdaterEnvValue, getHotUpdaterHome, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getLocalKeyFile, getLocalKeyStoreDir, getLocalSecretsStore, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getProjectKey, getReactNativeMetadatas, getSecretEnvNames, getStorageFileByteSize, isCI, isCodegenSpecFile, isReservedVariableName, isSecretName, isServerDefinition, keepsKeysOnThisMachine, link, loadConfig, loadPlatformConfigs, loadTeamSecrets, localSecrets, log, makeEnv, maskSecretValues, moduleSpecifiersOf, nonInteractiveReason, p, parseLoadedEnv, parseSecretReference, prepareBundleSigning, printAppSetup, printBanner, provisionClientCredential, putStorageFile, reactNativeCliFingerprint, reactNativeConfigCommand, readBundleSigningPublicKeyFile, readHotUpdaterInitEnv, readLoadedHotUpdaterEnv, readLocalKey, readMissingFromTeamSecrets, readPackageUp, readReactNativeInterface, readSecretVariables, readSecretWithSource, registerCredentialValue, registerSecretValue, renderAppImports, renderAppSetup, renderImportStatements, resolveExpoAutolinking, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolveLocalSecretsPath, resolvePackageVersion, resolveSecretsAdapter, secretEnv, secretEnvHelper, secretVariableName, serverDefinitionOf, setConfiguredSecrets, shouldAutoSelectOnlyInitResource, storeEnvFileSecrets, stripAnsi, transformEnv, transformTemplate, withCredentialResolver, withSecretsScope, writeHotUpdaterConfig, writeHotUpdaterFiles, writeLocalKey };
+export { BUNDLE_SIGNING_KEY_SECRET, BuildFailedError, BuildLogger, BundleSigningKeyError, CREDENTIAL_ENV_NAMES, CREDENTIAL_LOGIN_GROUPS, ConfigBuilder, CredentialUnavailableError, HOT_UPDATER_HOME_ENV, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, INTERFACE_FINGERPRINT_ENGINE, INVALID_SIGNING_MESSAGE, INVALID_SIGNING_NEXT_STEP, ISSUE_SIGNING_KEY_COMMAND, InitEnvFileError, InitError, LOCAL_SECRETS_NAME, LegacyInfrastructureError, MANAGED_CLIENT_CREDENTIAL_ENV, MissingInitInputsError, PUT_SIGNING_KEY_COMMAND, ServerDefinitionError, UNSIGNED_BUNDLES_NEXT_STEP, UNSIGNED_BUNDLES_WARNING, addSigningSecretToConfig, addSigningSecretToConfigText, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, assertUnreservedEnv, autolinkingConfigCommand, banner, bundleSigningSecretRef, clientAuthOf, typedColors as colors, configSetsTeamSecrets, confirmInitInputPersistence, copyDirToTmp, createCredentialResolver, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createInterfaceFingerprint, createLocalSecretsStore, createLogWriter, createMigrator, createMinBundleId, createStep, createTarBrTargetFiles, createZip, credentialIssueCommand, credentialLoginCommand, credentialPutCommand, credentialStoreCommand, decryptJson, defineInitProvider, describeSecret, describeStoredSecret, encryptJson, ensureInstallPackages, failActiveStep, formatDuration, generateClientCredential, generateSchema, generatesSchema, getAndroidSdkPath, getBundleSigningPublicKey, getConfiguredAdapter, getConfiguredSecrets, getCwd, getDeploySecretNames, getHotUpdaterEnvValue, getHotUpdaterHome, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getLocalKeyFile, getLocalKeyStoreDir, getLocalSecretsStore, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getProjectKey, getReactNativeMetadatas, getStorageFileByteSize, isCI, isCodegenSpecFile, isReservedVariableName, isSecretName, isSecretRef, isServerDefinition, keepsKeysOnThisMachine, link, loadConfig, loadPlatformConfigs, loadTeamSecrets, localSecrets, log, makeEnv, maskSecretValues, moduleSpecifiersOf, nonInteractiveReason, p, parseLoadedEnv, parseSecretReference, prepareBundleSigning, printAppSetup, printBanner, provisionClientCredential, putStorageFile, reactNativeCliFingerprint, reactNativeConfigCommand, readBundleSigningPublicKeyFile, readBundleSigningState, readHotUpdaterInitEnv, readLoadedEnvFile, readLoadedHotUpdaterEnv, readLocalKey, readMissingFromTeamSecrets, readPackageUp, readReactNativeInterface, readSecretVariables, readSecretWithSource, readSecrets, registerCredentialValue, registerSecretValue, renderAppImports, renderAppSetup, renderImportStatements, resolveExpoAutolinking, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolveLocalSecretsPath, resolvePackageVersion, resolveSecretsAdapter, secret, secretVariableName, serverDefinitionOf, setConfiguredSecrets, shouldAutoSelectOnlyInitResource, startStep, storeEnvFileSecrets, stripAnsi, transformEnv, transformTemplate, truncateLine, withCredentialResolver, withDuration, withSecretsScope, withStep, writeHotUpdaterConfig, writeHotUpdaterFiles, writeLocalKey };