@hot-updater/cli-tools 1.2.0-rc.7 → 1.2.0-rc.9

package/dist/index.mjs

@@ -37,78 +37,6 @@ import { Buffer as Buffer$2 } from "node:buffer";
 import { Visitor, parseSync } from "oxc-parser";
 import { loadConfig as loadConfig$1 } from "unconfig";
 import { transformSync } from "oxc-transform";
-//#endregion
-//#region src/colors.ts
-var import_picocolors = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
-	let p = process || {};
-	let argv = p.argv || [];
-	let env = p.env || {};
-	let isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env.TERM !== "dumb" || !!env.CI);
-	let formatter = (open, close, replace = open) => (input) => {
-		let string = "" + input, index = string.indexOf(close, open.length);
-		return ~index ? open + replaceClose(string, close, replace, index) + close : open + string + close;
-	};
-	let replaceClose = (string, close, replace, index) => {
-		let result = "", cursor = 0;
-		do {
-			result += string.substring(cursor, index) + replace;
-			cursor = index + close.length;
-			index = string.indexOf(close, cursor);
-		} while (~index);
-		return result + string.substring(cursor);
-	};
-	let createColors = (enabled = isColorSupported) => {
-		let f = enabled ? formatter : () => String;
-		return {
-			isColorSupported: enabled,
-			reset: f("\x1B[0m", "\x1B[0m"),
-			bold: f("\x1B[1m", "\x1B[22m", "\x1B[22m\x1B[1m"),
-			dim: f("\x1B[2m", "\x1B[22m", "\x1B[22m\x1B[2m"),
-			italic: f("\x1B[3m", "\x1B[23m"),
-			underline: f("\x1B[4m", "\x1B[24m"),
-			inverse: f("\x1B[7m", "\x1B[27m"),
-			hidden: f("\x1B[8m", "\x1B[28m"),
-			strikethrough: f("\x1B[9m", "\x1B[29m"),
-			black: f("\x1B[30m", "\x1B[39m"),
-			red: f("\x1B[31m", "\x1B[39m"),
-			green: f("\x1B[32m", "\x1B[39m"),
-			yellow: f("\x1B[33m", "\x1B[39m"),
-			blue: f("\x1B[34m", "\x1B[39m"),
-			magenta: f("\x1B[35m", "\x1B[39m"),
-			cyan: f("\x1B[36m", "\x1B[39m"),
-			white: f("\x1B[37m", "\x1B[39m"),
-			gray: f("\x1B[90m", "\x1B[39m"),
-			bgBlack: f("\x1B[40m", "\x1B[49m"),
-			bgRed: f("\x1B[41m", "\x1B[49m"),
-			bgGreen: f("\x1B[42m", "\x1B[49m"),
-			bgYellow: f("\x1B[43m", "\x1B[49m"),
-			bgBlue: f("\x1B[44m", "\x1B[49m"),
-			bgMagenta: f("\x1B[45m", "\x1B[49m"),
-			bgCyan: f("\x1B[46m", "\x1B[49m"),
-			bgWhite: f("\x1B[47m", "\x1B[49m"),
-			blackBright: f("\x1B[90m", "\x1B[39m"),
-			redBright: f("\x1B[91m", "\x1B[39m"),
-			greenBright: f("\x1B[92m", "\x1B[39m"),
-			yellowBright: f("\x1B[93m", "\x1B[39m"),
-			blueBright: f("\x1B[94m", "\x1B[39m"),
-			magentaBright: f("\x1B[95m", "\x1B[39m"),
-			cyanBright: f("\x1B[96m", "\x1B[39m"),
-			whiteBright: f("\x1B[97m", "\x1B[39m"),
-			bgBlackBright: f("\x1B[100m", "\x1B[49m"),
-			bgRedBright: f("\x1B[101m", "\x1B[49m"),
-			bgGreenBright: f("\x1B[102m", "\x1B[49m"),
-			bgYellowBright: f("\x1B[103m", "\x1B[49m"),
-			bgBlueBright: f("\x1B[104m", "\x1B[49m"),
-			bgMagentaBright: f("\x1B[105m", "\x1B[49m"),
-			bgCyanBright: f("\x1B[106m", "\x1B[49m"),
-			bgWhiteBright: f("\x1B[107m", "\x1B[49m")
-		};
-	};
-	module.exports = createColors();
-	module.exports.createColors = createColors;
-})))(), 1);
-const typedColors = import_picocolors.default;
-//#endregion
 //#region ../../node_modules/.pnpm/workspace-tools@0.41.7/node_modules/workspace-tools/lib/graph/getPackageDependencies.js
 var require_getPackageDependencies = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
@@ -22628,7 +22556,7 @@ const MASKING_REGISTRY = Symbol.for("@hot-updater/cli-tools/secret-masking");
 /**
 * The values to mask, kept on `globalThis`: the config file loads its own
 * copy of Hot Updater's modules, and a value it resolves, such as through
-* `secretEnv`, must be masked by the CLI's log sinks too.
+* `secret()`, must be masked by the CLI's log sinks too.
 */
 const registry = globalThis[MASKING_REGISTRY] ??= {
 	secretValues: /* @__PURE__ */ new Set(),
@@ -22664,17 +22592,57 @@ const maskSecretValues = (text) => {
 	return shortSecretPattern ? masked.replace(shortSecretPattern, SECRET_MASK) : masked;
 };
 //#endregion
+//#region src/stepCapture.ts
+let current;
+const stepCapture = () => current;
+const setStepCapture = (capture) => {
+	current = capture;
+};
+//#endregion
 //#region src/prompts.ts
 const maskMessage = (message) => message === void 0 ? message : maskSecretValues(message);
-const log$1 = {
-	message: (message, options) => log$2.message(Array.isArray(message) ? message.map(maskSecretValues) : maskMessage(message), options),
-	info: (message, options) => log$2.info(maskSecretValues(message), options),
-	success: (message, options) => log$2.success(maskSecretValues(message), options),
-	step: (message, options) => log$2.step(maskSecretValues(message), options),
-	warn: (message, options) => log$2.warn(maskSecretValues(message), options),
-	warning: (message, options) => log$2.warning(maskSecretValues(message), options),
-	error: (message, options) => log$2.error(maskSecretValues(message), options)
+/**
+* Prints a log line, or, while a step runs, holds it until the step's line
+* prints. An info line says what the step is doing, so it shows as the
+* step's detail instead; an error ends the step first and prints at once,
+* since the process may exit right after it.
+*/
+const logThroughStep = (write, { inStep = "hold" } = {}) => (...args) => {
+	const capture = stepCapture();
+	if (!capture) return write(...args);
+	if (inStep === "interrupt") {
+		capture.interrupt();
+		return write(...args);
+	}
+	if (inStep === "detail") {
+		const message = args[0];
+		const text = Array.isArray(message) ? message.join("\n") : message ?? "";
+		capture.update(maskSecretValues(text.split("\n")[0] ?? ""));
+		return;
+	}
+	capture.hold(() => write(...args));
 };
+const log$1 = {
+	message: logThroughStep((message, options) => log$2.message(Array.isArray(message) ? message.map(maskSecretValues) : maskMessage(message), options)),
+	info: logThroughStep((message, options) => log$2.info(maskSecretValues(message), options), { inStep: "detail" }),
+	success: logThroughStep((message, options) => log$2.success(maskSecretValues(message), options)),
+	step: logThroughStep((message, options) => log$2.step(maskSecretValues(message), options)),
+	warn: logThroughStep((message, options) => log$2.warn(maskSecretValues(message), options)),
+	warning: logThroughStep((message, options) => log$2.warning(maskSecretValues(message), options)),
+	error: logThroughStep((message, options) => log$2.error(maskSecretValues(message), options), { inStep: "interrupt" })
+};
+/** A spinner inside a running step, whose messages are the step's detail. */
+const spinnerInStep = (capture) => ({
+	start: (message) => capture.update(message),
+	message: (message) => capture.update(message),
+	stop: () => capture.update(void 0),
+	cancel: () => capture.update(void 0),
+	error: (message) => capture.interrupt(message || void 0),
+	clear: () => capture.update(void 0),
+	get isCancelled() {
+		return false;
+	}
+});
 const maskSpinner = (target) => ({
 	start: (message) => target.start(maskMessage(message)),
 	stop: (message) => target.stop(maskMessage(message)),
@@ -22733,11 +22701,23 @@ const createStaticSpinner = ({ onCancel, output = process.stdout, withGuide } =
 	};
 };
 const spinner = (options = {}) => {
+	const capture = stepCapture();
+	if (capture) return spinnerInStep(capture);
 	const output = options.output ?? process.stdout;
 	const isInteractive = isTTY(output) && !isCI$1();
 	return maskSpinner(isInteractive ? spinner$1(options) : createStaticSpinner(options));
 };
 const progress = (options = {}) => {
+	const capture = stepCapture();
+	if (capture) return {
+		...spinnerInStep(capture),
+		advance: (_step, message) => {
+			if (message) capture.update(message);
+		},
+		get isCancelled() {
+			return false;
+		}
+	};
 	const output = options.output ?? process.stdout;
 	if (isTTY(output) && !isCI$1()) return maskProgress(progress$1(options));
 	const staticSpinner = maskSpinner(createStaticSpinner(options));
@@ -22870,6 +22850,9 @@ const createLogWriter = async ({ prefix, logFilePath }) => {
 			}
 			if (partialLine) writeChunk(partialLine);
 		};
+		const writeLines = (lines) => {
+			writeChunk(`${lines.join("\n")}\n`);
+		};
 		const writeError = (error) => {
 			const message = error instanceof Error ? error.stack ?? error.message : String(error);
 			writeChunk(`${message}\n`);
@@ -22886,6 +22869,7 @@ const createLogWriter = async ({ prefix, logFilePath }) => {
 		return {
 			logFilePath: resolvedLogFilePath,
 			writeStream,
+			writeLines,
 			writeError,
 			close
 		};
@@ -22895,67 +22879,241 @@ const createLogWriter = async ({ prefix, logFilePath }) => {
 		return {
 			logFilePath: null,
 			writeStream: async () => {},
+			writeLines: () => {},
 			writeError: () => {},
 			close: async () => {}
 		};
 	}
 };
 //#endregion
-//#region src/BuildLogger.ts
-const createInitialState = () => ({
-	completedStages: 0,
-	latestMessage: "",
-	started: false,
-	stopped: false
-});
-const normalizeLine = (line) => {
-	return (line.length > 50 ? `${line.slice(0, 50)}...` : line).replace(/[\r\n]/g, " ").trim();
-};
-const matchesAnyPattern = ({ line, patterns }) => {
-	const trimmedLine = line.trim();
-	const normalizedLine = trimmedLine.toLowerCase();
-	return patterns.some((pattern) => {
-		if (pattern instanceof RegExp) {
-			pattern.lastIndex = 0;
-			return pattern.test(trimmedLine);
-		}
-		return normalizedLine.includes(pattern.toLowerCase());
-	});
-};
-const getPatternMatchScore = ({ line, patterns }) => {
-	const trimmedLine = line.trim();
-	const normalizedLine = trimmedLine.toLowerCase();
-	return patterns.reduce((bestScore, pattern) => {
-		if (pattern instanceof RegExp) {
-			pattern.lastIndex = 0;
-			if (!pattern.test(trimmedLine)) return bestScore;
-			return Math.max(bestScore, pattern.source.length);
-		}
-		const normalizedPattern = pattern.toLowerCase();
-		if (!normalizedLine.includes(normalizedPattern)) return bestScore;
-		return Math.max(bestScore, normalizedPattern.length);
-	}, 0);
-};
-const resolveNextCompletedStage = ({ line, progressStages, completedStages }) => {
-	let nextCompletedStages = completedStages;
-	let bestMatchScore = 0;
-	for (let stageIndex = completedStages; stageIndex < progressStages.length; stageIndex += 1) {
-		const matchScore = getPatternMatchScore({
-			line,
-			patterns: progressStages[stageIndex]
-		});
-		if (matchScore <= 0) continue;
-		const candidateStage = stageIndex + 1;
-		if (matchScore > bestMatchScore || matchScore === bestMatchScore && candidateStage > nextCompletedStages) {
-			nextCompletedStages = candidateStage;
-			bestMatchScore = matchScore;
+//#region src/colors.ts
+var import_picocolors = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
+	let p = process || {};
+	let argv = p.argv || [];
+	let env = p.env || {};
+	let isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env.TERM !== "dumb" || !!env.CI);
+	let formatter = (open, close, replace = open) => (input) => {
+		let string = "" + input, index = string.indexOf(close, open.length);
+		return ~index ? open + replaceClose(string, close, replace, index) + close : open + string + close;
+	};
+	let replaceClose = (string, close, replace, index) => {
+		let result = "", cursor = 0;
+		do {
+			result += string.substring(cursor, index) + replace;
+			cursor = index + close.length;
+			index = string.indexOf(close, cursor);
+		} while (~index);
+		return result + string.substring(cursor);
+	};
+	let createColors = (enabled = isColorSupported) => {
+		let f = enabled ? formatter : () => String;
+		return {
+			isColorSupported: enabled,
+			reset: f("\x1B[0m", "\x1B[0m"),
+			bold: f("\x1B[1m", "\x1B[22m", "\x1B[22m\x1B[1m"),
+			dim: f("\x1B[2m", "\x1B[22m", "\x1B[22m\x1B[2m"),
+			italic: f("\x1B[3m", "\x1B[23m"),
+			underline: f("\x1B[4m", "\x1B[24m"),
+			inverse: f("\x1B[7m", "\x1B[27m"),
+			hidden: f("\x1B[8m", "\x1B[28m"),
+			strikethrough: f("\x1B[9m", "\x1B[29m"),
+			black: f("\x1B[30m", "\x1B[39m"),
+			red: f("\x1B[31m", "\x1B[39m"),
+			green: f("\x1B[32m", "\x1B[39m"),
+			yellow: f("\x1B[33m", "\x1B[39m"),
+			blue: f("\x1B[34m", "\x1B[39m"),
+			magenta: f("\x1B[35m", "\x1B[39m"),
+			cyan: f("\x1B[36m", "\x1B[39m"),
+			white: f("\x1B[37m", "\x1B[39m"),
+			gray: f("\x1B[90m", "\x1B[39m"),
+			bgBlack: f("\x1B[40m", "\x1B[49m"),
+			bgRed: f("\x1B[41m", "\x1B[49m"),
+			bgGreen: f("\x1B[42m", "\x1B[49m"),
+			bgYellow: f("\x1B[43m", "\x1B[49m"),
+			bgBlue: f("\x1B[44m", "\x1B[49m"),
+			bgMagenta: f("\x1B[45m", "\x1B[49m"),
+			bgCyan: f("\x1B[46m", "\x1B[49m"),
+			bgWhite: f("\x1B[47m", "\x1B[49m"),
+			blackBright: f("\x1B[90m", "\x1B[39m"),
+			redBright: f("\x1B[91m", "\x1B[39m"),
+			greenBright: f("\x1B[92m", "\x1B[39m"),
+			yellowBright: f("\x1B[93m", "\x1B[39m"),
+			blueBright: f("\x1B[94m", "\x1B[39m"),
+			magentaBright: f("\x1B[95m", "\x1B[39m"),
+			cyanBright: f("\x1B[96m", "\x1B[39m"),
+			whiteBright: f("\x1B[97m", "\x1B[39m"),
+			bgBlackBright: f("\x1B[100m", "\x1B[49m"),
+			bgRedBright: f("\x1B[101m", "\x1B[49m"),
+			bgGreenBright: f("\x1B[102m", "\x1B[49m"),
+			bgYellowBright: f("\x1B[103m", "\x1B[49m"),
+			bgBlueBright: f("\x1B[104m", "\x1B[49m"),
+			bgMagentaBright: f("\x1B[105m", "\x1B[49m"),
+			bgCyanBright: f("\x1B[106m", "\x1B[49m"),
+			bgWhiteBright: f("\x1B[107m", "\x1B[49m")
+		};
+	};
+	module.exports = createColors();
+	module.exports.createColors = createColors;
+})))(), 1);
+const typedColors = import_picocolors.default;
+//#endregion
+//#region src/step.ts
+/** The widest a finished step's line is, after clack's 3-column gutter. */
+const STEP_WIDTH = 73;
+/** The room the spinner's symbol and its `[12m 34s]` timer take. */
+const LIVE_LINE_CHROME = 13;
+/** `4.2s`, `38s`, `6m41s`, `1h02m`. */
+const formatDuration = (ms) => {
+	if (ms < 9950) return `${(Math.max(0, ms) / 1e3).toFixed(1)}s`;
+	const seconds = Math.round(ms / 1e3);
+	if (seconds < 60) return `${seconds}s`;
+	const minutes = Math.floor(seconds / 60);
+	if (minutes < 60) return `${minutes}m${String(seconds % 60).padStart(2, "0")}s`;
+	return `${Math.floor(minutes / 60)}h${String(minutes % 60).padStart(2, "0")}m`;
+};
+const visibleLength = (text) => stripVTControlCharacters(text).length;
+/**
+* `message` with `duration` at the right edge of a step's line, the message
+* cut with `…` when the line would be wider.
+*/
+const withDuration = (message, ms, width = STEP_WIDTH) => {
+	const duration = formatDuration(ms);
+	const text = truncateLine(message, width - duration.length - 2);
+	const gap = Math.max(2, width - visibleLength(text) - duration.length);
+	return `${text}${" ".repeat(gap)}${typedColors.dim(duration)}`;
+};
+/** `text` cut to `width` visible columns, with `…` for the rest. */
+const truncateLine = (text, width) => {
+	const plain = stripVTControlCharacters(text);
+	if (plain.length <= width) return text;
+	return `${plain.slice(0, Math.max(0, width - 1))}…`;
+};
+const isLive = (output) => isTTY(output) && !isCI$1();
+/**
+* A step that shows nothing until `start()`. A step created while another
+* runs is part of it: its title and detail become the running step's detail.
+*/
+const createStep = (title, { output = process.stdout } = {}) => {
+	let startedAt;
+	let ended = false;
+	let detail;
+	let spinner;
+	let ticker;
+	let held = [];
+	let outer;
+	const liveMessage = () => {
+		const text = maskSecretValues(detail ? `${title} · ${detail}` : title);
+		const columns = output.columns || 80;
+		return truncateLine(text, Math.max(20, columns - LIVE_LINE_CHROME));
+	};
+	const finish = (write) => {
+		if (startedAt === void 0 || ended) return;
+		ended = true;
+		if (ticker) clearInterval(ticker);
+		if (outer) {
+			outer.update(void 0);
+			return;
 		}
+		setStepCapture(void 0);
+		if (spinner) spinner.clear();
+		write();
+		const logs = held;
+		held = [];
+		for (const log of logs) log();
+	};
+	const logOptions = () => ({
+		output,
+		spacing: spinner ? 0 : 1
+	});
+	const step = {
+		start() {
+			if (startedAt !== void 0) return step;
+			startedAt = performance.now();
+			outer = stepCapture();
+			if (outer) {
+				outer.update(title);
+				return step;
+			}
+			setStepCapture({
+				update: (value) => step.update(value),
+				hold: (log) => {
+					held.push(log);
+				},
+				interrupt: (message) => step.fail(message)
+			});
+			if (isLive(output)) {
+				spinner = spinner$1({
+					indicator: "timer",
+					output
+				});
+				spinner.start(liveMessage());
+				ticker = setInterval(() => spinner?.message(liveMessage()), 1e3);
+				ticker.unref?.();
+			}
+			return step;
+		},
+		update(value) {
+			if (startedAt === void 0 || ended) return;
+			if (outer) {
+				outer.update(value ? `${title} · ${value}` : title);
+				return;
+			}
+			detail = value;
+			spinner?.message(liveMessage());
+		},
+		succeed(message = title, { level = "step" } = {}) {
+			const elapsed = step.elapsedMs;
+			finish(() => {
+				const line = maskSecretValues(withDuration(message, elapsed));
+				if (level === "info") log$2.info(line, logOptions());
+				else if (level === "warn") log$2.warn(line, logOptions());
+				else log$2.step(line, logOptions());
+			});
+		},
+		fail(message = `${title} failed`) {
+			const elapsed = step.elapsedMs;
+			finish(() => {
+				log$2.error(maskSecretValues(withDuration(message, elapsed)), logOptions());
+			});
+		},
+		get elapsedMs() {
+			return startedAt === void 0 ? 0 : performance.now() - startedAt;
+		},
+		get active() {
+			return startedAt !== void 0 && !ended;
+		}
+	};
+	return step;
+};
+/**
+* Ends the running step as failed, if one runs, before a command prints
+* its error.
+*/
+const failActiveStep = () => {
+	stepCapture()?.interrupt();
+};
+/** A step, started. */
+const startStep = (title, options) => createStep(title, options).start();
+/**
+* Runs `run` as a step titled `title`, which ends with `done(result)`, or as
+* failed when `run` throws.
+*/
+const withStep = async (title, run, done = () => title, options) => {
+	const step = startStep(title, options);
+	try {
+		const result = await run(step);
+		step.succeed(done(result));
+		return result;
+	} catch (error) {
+		step.fail();
+		throw error;
 	}
-	return nextCompletedStages;
 };
+//#endregion
+//#region src/BuildLogger.ts
 /** The most lines a failure summary prints, and the tail it falls back to. */
-const MAX_SUMMARY_LINES = 60;
-const TAIL_LINES = 40;
+const MAX_SUMMARY_LINES = 20;
+const TAIL_LINES = 15;
 const matchesSummaryPattern = (line, pattern) => {
 	if (pattern instanceof RegExp) {
 		pattern.lastIndex = 0;
@@ -22973,52 +23131,58 @@ var BuildFailedError = class extends Error {
 	logPath;
 	/** The lines of the tool's output the summary printed. */
 	summary;
-	constructor(message, { logPath, summary, cause }) {
+	/**
+	* What to do about it, such as accepting an agreement, which the summary
+	* doesn't say: the one line a command prints after it, or null.
+	*/
+	hint;
+	constructor(message, { logPath, summary, hint = null, cause }) {
 		super(message, { cause });
 		this.logPath = logPath;
 		this.summary = summary;
+		this.hint = hint;
 	}
 };
+/**
+* Runs a native build tool's output through a step: the step's live line
+* shows the phase its reader finds, the log file keeps the raw output, and a
+* failure prints the summary of it on stderr.
+*/
 var BuildLogger = class {
 	config;
-	state = createInitialState();
 	logWriter;
+	step;
 	summaryLines = [];
 	tailLines = [];
 	openBlock;
-	promptProgress;
-	stageCount;
 	constructor(config) {
 		this.config = config;
-		this.stageCount = config.progressStages.length;
-		this.promptProgress = p.progress({
-			indicator: "timer",
-			max: config.progressStages.length,
-			delay: 500
-		});
 	}
-	async start() {
-		this.state = {
-			...createInitialState(),
-			started: true
-		};
+	/**
+	* Opens the log, writes `header` to it, such as the tool's command line,
+	* which the terminal doesn't show, and starts the step titled `title`.
+	*/
+	async start({ title, header = [] }) {
 		this.summaryLines = [];
 		this.tailLines = [];
 		this.openBlock = void 0;
-		this.logWriter = await createLogWriter({ prefix: this.config.logPrefix });
-		this.promptProgress.start();
+		this.logWriter = await createLogWriter({
+			prefix: this.config.logPrefix,
+			logFilePath: this.config.logFilePath
+		});
+		if (header.length) this.logWriter.writeLines(header);
+		this.step = startStep(title);
 	}
 	/**
-	* Writes the tool's raw output to the log file and reads its failure
-	* summary from it, and shows progress from `display`, a formatter's
-	* output of it such as xcbeautify's, or from the raw output without one.
+	* Writes the tool's raw output to the log file, reads its failure summary
+	* from it, and shows its phases on the step's line.
 	*/
-	async processStream(input, { display } = {}) {
+	async processStream(input) {
 		if (!this.logWriter) throw new Error("BuildLogger has not been started. Call start() first.");
 		const progressInput = new PassThrough();
 		const logInput = new PassThrough();
 		const summaryInput = new PassThrough();
-		(display ?? input).pipe(progressInput);
+		input.pipe(progressInput);
 		input.pipe(logInput);
 		input.pipe(summaryInput);
 		await Promise.all([
@@ -23031,6 +23195,10 @@ var BuildLogger = class {
 	get logPath() {
 		return this.logWriter?.logFilePath ? path.relative(getCwd(), this.logWriter.logFilePath) : null;
 	}
+	/** The build log's absolute path, or null without one. */
+	get logFilePath() {
+		return this.logWriter?.logFilePath ?? null;
+	}
 	/**
 	* The lines of the raw output a failure prints: the ones the config's
 	* `failureSummary` keeps, deduplicated, or the last lines without any.
@@ -23079,36 +23247,28 @@ var BuildLogger = class {
 			crlfDelay: Infinity,
 			terminal: false
 		});
-		for await (const line of lineReader) this.processProgressLine(line);
-	}
-	processProgressLine(line) {
-		const normalizedLine = normalizeLine(line);
-		if (!normalizedLine) return;
-		const nextCompletedStages = resolveNextCompletedStage({
-			line: normalizedLine,
-			progressStages: this.config.progressStages,
-			completedStages: this.state.completedStages
-		});
-		this.updateProgress({
-			nextCompletedStages,
-			latestMessage: normalizedLine
-		});
+		const readPhase = this.config.createPhaseReader();
+		let phase;
+		for await (const line of lineReader) {
+			const next = readPhase(stripAnsi(line).replace(/\r/g, "").trim());
+			if (next !== void 0 && next !== phase) {
+				phase = next;
+				this.step?.update(phase);
+			}
+		}
 	}
+	/**
+	* Ends the step with `message` and its duration, or, for a failure, as
+	* failed, then prints the failure summary and the log's path.
+	*/
 	stop(message, success = true) {
-		if (!this.state.started || this.state.stopped) return;
-		if (success) this.finishRemainingProgress();
-		const finalMessage = message || (success ? "Build completed successfully" : "Build failed");
-		if (success) {
-			this.promptProgress.stop(finalMessage);
-			this.showLogFileLocation();
-		} else {
-			this.promptProgress.error(finalMessage);
+		const step = this.step;
+		if (!step?.active) return;
+		if (success) step.succeed(message);
+		else {
+			step.fail(message);
 			this.showFailureSummary();
 		}
-		this.state = {
-			...this.state,
-			stopped: true
-		};
 	}
 	writeError(error) {
 		this.logWriter?.writeError(error);
@@ -23118,32 +23278,6 @@ var BuildLogger = class {
 		await this.logWriter.close();
 		this.logWriter = void 0;
 	}
-	updateProgress({ nextCompletedStages, latestMessage }) {
-		if (this.state.stopped) return;
-		const progressDelta = nextCompletedStages - this.state.completedStages;
-		if (progressDelta > 0) this.promptProgress.advance(progressDelta, latestMessage);
-		else if (latestMessage && latestMessage !== this.state.latestMessage && this.shouldLogLine(latestMessage)) this.promptProgress.message(latestMessage);
-		this.state = {
-			...this.state,
-			completedStages: Math.max(this.state.completedStages, nextCompletedStages),
-			latestMessage
-		};
-	}
-	finishRemainingProgress() {
-		if (!this.promptProgress || this.state.completedStages >= this.stageCount) return;
-		const remainingStages = this.stageCount - this.state.completedStages;
-		this.promptProgress.advance(remainingStages, this.state.latestMessage);
-		this.state = {
-			...this.state,
-			completedStages: this.stageCount
-		};
-	}
-	shouldLogLine(line) {
-		return matchesAnyPattern({
-			line,
-			patterns: this.config.importantLogPatterns
-		});
-	}
 	/**
 	* Prints the failure summary and the log's path to stderr, so a `--json`
 	* command's stdout stays its JSON.
@@ -23154,12 +23288,6 @@ var BuildLogger = class {
 		const message = [...summary, ...logPath ? [...summary.length ? [""] : [], `Build log: ${logPath}`] : []].join("\n");
 		if (message) p.log.error(message, { output: process.stderr });
 	}
-	showLogFileLocation() {
-		if (!this.logWriter?.logFilePath) return;
-		const relativePath = path.relative(getCwd(), this.logWriter.logFilePath);
-		const highlightedPath = typedColors.blueBright(relativePath);
-		p.log.info(`Build log stored at ${highlightedPath}`);
-	}
 };
 //#endregion
 //#region src/appSetup.ts
@@ -25182,6 +25310,103 @@ const printBanner = (version) => {
 	console.log(banner(version));
 };
 //#endregion
+//#region src/credentialEnvNames.ts
+/**
+* The environment variables that override each kind, one entry per field.
+* A field with two names takes a file path or the file's contents; the path
+* wins when both are set.
+*/
+const CREDENTIAL_ENV_NAMES = {
+	"asc-api-key": [
+		["HOT_UPDATER_ASC_KEY_PATH", "HOT_UPDATER_ASC_KEY"],
+		["HOT_UPDATER_ASC_KEY_ID"],
+		["HOT_UPDATER_ASC_ISSUER_ID"]
+	],
+	"android-keystore": [
+		["HOT_UPDATER_ANDROID_KEYSTORE_PATH", "HOT_UPDATER_ANDROID_KEYSTORE_BASE64"],
+		["HOT_UPDATER_ANDROID_KEYSTORE_PASSWORD"],
+		["HOT_UPDATER_ANDROID_KEY_ALIAS"],
+		["HOT_UPDATER_ANDROID_KEY_PASSWORD"]
+	],
+	"play-service-account": [["HOT_UPDATER_PLAY_SERVICE_ACCOUNT_PATH", "HOT_UPDATER_PLAY_SERVICE_ACCOUNT_JSON"]]
+};
+//#endregion
+//#region src/credentialFiles.ts
+const TERMINATION_SIGNALS = [
+	"SIGHUP",
+	"SIGINT",
+	"SIGTERM"
+];
+const liveDirectories = /* @__PURE__ */ new Set();
+const onSignal = (signal) => {
+	removeLiveDirectories();
+	if (process.listenerCount(signal) === 0) process.kill(process.pid, signal);
+};
+const removeLiveDirectories = () => {
+	for (const directory of liveDirectories) rmSync(directory, {
+		force: true,
+		recursive: true
+	});
+	liveDirectories.clear();
+	stopListening();
+};
+const startListening = () => {
+	process.on("exit", removeLiveDirectories);
+	for (const signal of TERMINATION_SIGNALS) process.on(signal, onSignal);
+};
+const stopListening = () => {
+	process.off("exit", removeLiveDirectories);
+	for (const signal of TERMINATION_SIGNALS) process.off(signal, onSignal);
+};
+const trackDirectory = (directory) => {
+	if (liveDirectories.size === 0) startListening();
+	liveDirectories.add(directory);
+};
+const untrackDirectory = (directory) => {
+	if (liveDirectories.delete(directory) && liveDirectories.size === 0) stopListening();
+};
+/**
+* Creates the temporary files of one credential resolver: a `mkdtemp`
+* directory, created on the first write and removed by `dispose` or, if the
+* process exits first, on `exit` or a termination signal.
+*/
+const createCredentialFiles = () => {
+	let directory;
+	let disposal;
+	const ensureDirectory = () => {
+		directory ??= fs$2.mkdtemp(path$1.join(os.tmpdir(), "hot-updater-credentials-")).then((created) => {
+			trackDirectory(created);
+			return created;
+		});
+		return directory;
+	};
+	return {
+		write: async (fileName, contents) => {
+			if (disposal) throw new Error("The credential files have been disposed.");
+			if (typeof contents === "string") registerSecretValue(contents);
+			const fileDirectory = await fs$2.mkdtemp(path$1.join(await ensureDirectory(), "item-"));
+			const filePath = path$1.join(fileDirectory, path$1.basename(fileName));
+			await fs$2.writeFile(filePath, contents, {
+				flag: "wx",
+				mode: 384
+			});
+			return filePath;
+		},
+		dispose: () => {
+			disposal ??= (async () => {
+				const created = await directory?.catch(() => void 0);
+				if (!created) return;
+				await fs$2.rm(created, {
+					force: true,
+					recursive: true
+				});
+				untrackDirectory(created);
+			})();
+			return disposal;
+		}
+	};
+};
+//#endregion
 //#region src/initOptions.ts
 var InitError = class extends Error {
 	name = "InitError";
@@ -25407,7 +25632,7 @@ const assertPrivateDirectory = async (directory) => {
 		if (isMissing(error)) return void 0;
 		throw error;
 	});
-	if (stats && !stats.isDirectory()) throw new Error(`localSecrets() keeps secrets in a directory, and ${directory} is not one. Set its path to a directory.`);
+	if (stats && !stats.isDirectory()) throw new Error([`localSecrets() can't keep secrets in ${directory}.`, "It is not a directory: set its path to one."].join("\n"));
 	const real = realpathThroughParents(directory);
 	let probe = real;
 	while (!existsSync(probe) && path$1.dirname(probe) !== probe) probe = path$1.dirname(probe);
@@ -25415,7 +25640,11 @@ const assertPrivateDirectory = async (directory) => {
 	if (!root) return;
 	const top = realpath(root);
 	if (isIgnoredByGit(top, real)) return;
-	throw new Error(`localSecrets() refuses ${directory}: it is in the git repository ${top}, which does not ignore it, so the secrets in it could be committed. Add ${path$1.relative(top, real).split(path$1.sep).join("/")}/ to that repository's .gitignore, or keep the secrets outside it with localSecrets({ path }).`);
+	throw new Error([
+		`localSecrets() refuses ${directory}: its secrets could be committed.`,
+		`The git repository ${top} doesn't ignore it.`,
+		`Add ${path$1.relative(top, real).split(path$1.sep).join("/")}/ to its .gitignore, or set localSecrets({ path }).`
+	].join("\n"));
 };
 /** Makes `directory` 0700, and every directory it creates on the way. */
 const makePrivateDirectory = async (directory) => {
@@ -25483,27 +25712,6 @@ const readLocalKey = (name, cwd) => defaultStore.read(name, cwd);
 /** Stores `value` as `name` in `localSecrets()`'s default store. */
 const writeLocalKey = (name, value, cwd) => defaultStore.write(name, value, cwd);
 //#endregion
-//#region src/credentialEnvNames.ts
-/**
-* The environment variables that override each kind, one entry per field.
-* A field with two names takes a file path or the file's contents; the path
-* wins when both are set.
-*/
-const CREDENTIAL_ENV_NAMES = {
-	"asc-api-key": [
-		["HOT_UPDATER_ASC_KEY_PATH", "HOT_UPDATER_ASC_KEY"],
-		["HOT_UPDATER_ASC_KEY_ID"],
-		["HOT_UPDATER_ASC_ISSUER_ID"]
-	],
-	"android-keystore": [
-		["HOT_UPDATER_ANDROID_KEYSTORE_PATH", "HOT_UPDATER_ANDROID_KEYSTORE_BASE64"],
-		["HOT_UPDATER_ANDROID_KEYSTORE_PASSWORD"],
-		["HOT_UPDATER_ANDROID_KEY_ALIAS"],
-		["HOT_UPDATER_ANDROID_KEY_PASSWORD"]
-	],
-	"play-service-account": [["HOT_UPDATER_PLAY_SERVICE_ACCOUNT_PATH", "HOT_UPDATER_PLAY_SERVICE_ACCOUNT_JSON"]]
-};
-//#endregion
 //#region src/reservedVariables.ts
 /**
 * Variables that change how a process loads code or which credentials Hot
@@ -25523,21 +25731,21 @@ const RESERVED_NAMES = /* @__PURE__ */ new Set([
 	"PYTHONSTARTUP",
 	"PERL5OPT",
 	...Object.values(CREDENTIAL_ENV_NAMES).flat(2),
-	"HOT_UPDATER_SIGNING_TOKEN",
 	"HOT_UPDATER_HOME"
 ]);
 const RESERVED_PREFIXES = [
 	"LD_",
 	"DYLD_",
 	"GIT_",
-	"NPM_CONFIG_"
+	"NPM_CONFIG_",
+	"INFISICAL_"
 ];
 /**
 * Whether `name` is a variable no secret may set: one a loader or
 * interpreter reads (`NODE_*` but `NODE_ENV`, `PATH`, `LD_*`, `DYLD_*`,
 * `BASH_ENV`, `ENV`, `GIT_*`, `npm_config_*`, the JVM's, Gradle's, Ruby's,
 * Python's, and Perl's options), or one Hot Updater reads its credentials
-* from. `secretEnv` refuses these names, and so does every environment the
+* from. `secret()` refuses these names, and so does every environment the
 * CLI gives a child process from resolved secrets.
 */
 const isReservedVariableName = (name) => {
@@ -25557,20 +25765,25 @@ const assertUnreservedEnv = (env, what) => {
 //#endregion
 //#region src/secrets.ts
 const ENV_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/u;
-/** A secret's name, as `secret:<name>` takes one. */
+/** A secret's name, as `secret("<name>")` takes one. */
 const SECRET_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
-const SECRET_REFERENCE_PREFIX = "secret:";
-/** Whether `name` is a secret's name, as `secret:<name>` takes one. */
+/**
+* The brand `secret()` sets, which plugin-core's `SecretRef` types. It is a
+* `Symbol.for` key: the config file loads its own copy of this module.
+*/
+const SECRET_REF = Symbol.for("@hot-updater/secret-ref");
+/** Whether `name` is a secret's name, as `secret("<name>")` takes one. */
 const isSecretName = (name) => SECRET_NAME_PATTERN.test(name);
+/** Whether `value` is a `secret("<name>")` reference. */
+const isSecretRef = (value) => typeof value === "function" && Reflect.get(value, SECRET_REF) === true && isSecretName(value.name);
 /**
-* The secret name a config's `secret:<name>` reference names, such as
-* `release-keystore` for `"secret:release-keystore"`. `field` is the config
-* field the reference is in, which the error names.
+* The secret name a config's `secret("<name>")` names, such as
+* `release-keystore` for `secret("release-keystore")`. `field` is the
+* config field it is in, which the error names.
 */
 const parseSecretReference = (reference, field) => {
-	const name = reference.startsWith(SECRET_REFERENCE_PREFIX) ? reference.slice(7) : void 0;
-	if (name === void 0 || !SECRET_NAME_PATTERN.test(name)) throw new Error(`${field} names a secret as secret:<name>, such as "secret:release-keystore", and ${JSON.stringify(reference)} is not one.`);
-	return name;
+	if (!isSecretRef(reference)) throw new Error(`${field} takes secret("<name>").`);
+	return reference.name;
 };
 /**
 * The environment variable the default store reads a secret from: a name
@@ -25635,8 +25848,8 @@ const createLocalSecrets = (store) => {
 const getLocalSecretsStore = (secrets) => isLocalKeyStoreSecrets(secrets) ? secrets[LOCAL_KEY_STORE].store : void 0;
 /**
 * The config's own `secrets` adapter: undefined for `localSecrets()`,
-* which is the adapter when the config sets none. `secretEnv` reads deploy
-* credentials from it.
+* which is the adapter when the config sets none. A called `secret()` reads
+* from it.
 */
 const getConfiguredAdapter = (secrets) => isLocalKeyStoreSecrets(secrets) ? void 0 : secrets;
 /**
@@ -25682,7 +25895,7 @@ const CONFIGURED_SECRETS = Symbol.for("@hot-updater/cli-tools/secrets");
 const LOADING_SCOPE = Symbol.for("@hot-updater/cli-tools/secrets-scope");
 /**
 * Evaluates a config, the file or a config function, with `scope` as the
-* scope of every `secretEnv` it creates, so each reads the `secrets` of the
+* scope of every `secret()` it creates, so each reads the `secrets` of the
 * config that created it, whatever config loads after. It is kept on
 * `globalThis`: the config file loads its own copy of Hot Updater's modules.
 */
@@ -25698,7 +25911,7 @@ const withSecretsScope = async (scope, evaluate) => {
 };
 /**
 * Makes `secrets` the adapter a credential resolver reads from by default,
-* and a `secretEnv` created outside any config load, as `loadConfig` does
+* and a `secret()` created outside any config load, as `loadConfig` does
 * with the config's. It is kept on `globalThis`: the config file loads Hot
 * Updater's modules again, as its own copies.
 */
@@ -25727,218 +25940,518 @@ const secretReadError = (secrets, names, error) => new Error(`Couldn't read ${li
 const describeSecret = (secrets, name) => secrets.describe?.(name) ?? `${name} in ${secrets.name}`;
 const list$1 = (names) => names.length <= 2 ? names.join(" and ") : `${names.slice(0, -1).join(", ")}, and ${names.at(-1)}`;
 /**
-* Environment variables from the `secrets` adapter of the config that
-* creates it, as a function a config calls when an adapter needs them, so loading
-* `hot-updater.config.ts` reads no secret. Each name set in the environment
-* or `.env.hotupdater` wins; the others are read from the config's
-* `secrets` adapter in one call, and without one they must be set. The values go only to the caller: they are never set in
-* `process.env`, and are masked in the CLI's logs. Names a loader or
-* interpreter reads, such as `NODE_OPTIONS`, are refused.
+* `secret("<name>")`: the secret `name` in `hot-updater.config.ts`, for a
+* build credential, such as `signing.keystore`, or any adapter credential,
+* which calls it on first use, so loading the config reads no secret.
+* Called, it reads `name`'s variable (`secretVariableName`) in the
+* environment or `.env.hotupdater`, else the config's `secrets` adapter:
+* the first call reads every name the config's `secret()`s reference and
+* the environment doesn't set, in one `get`. With `localSecrets()`, the
+* variable must be set: its files hold only the keys Hot Updater stores.
+* Values are masked in the CLI's logs and never set in `process.env`.
+* Names a loader or interpreter reads, such as `NODE_OPTIONS`, are refused.
+* A server passes its own environment's values instead.
 *
 * @example
-* const deploy = secretEnv(["S3_ACCESS_KEY_ID", "S3_SECRET_ACCESS_KEY"]);
-* s3Storage({
+* r2Storage({
 *   bucketName: "bundles",
-*   region: "us-east-1",
-*   credentials: async () => {
-*     const env = await deploy();
-*     return {
-*       accessKeyId: env.S3_ACCESS_KEY_ID,
-*       secretAccessKey: env.S3_SECRET_ACCESS_KEY,
-*     };
+*   accountId: "<account-id>",
+*   credentials: {
+*     accessKeyId: secret("HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID"),
+*     secretAccessKey: secret("HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY"),
 *   },
 * });
 */
-const secretEnv = (names) => {
-	const wanted = [...new Set(names)];
-	const invalid = wanted.filter((name) => !ENV_NAME_PATTERN.test(name));
-	if (invalid.length > 0) throw new Error(`secretEnv takes environment variable names: letters, digits, and underscores, not starting with a digit, and ${invalid.map((name) => JSON.stringify(name)).join(", ")} ${invalid.length === 1 ? "is" : "are"} not.`);
-	const reserved = wanted.filter(isReservedVariableName);
-	if (reserved.length > 0) throw new Error(`secretEnv refuses ${list$1(reserved)}: ${reserved.length === 1 ? "it changes" : "they change"} how a process loads code or which credentials Hot Updater uses.`);
+const secret = (name) => {
+	if (typeof name !== "string" || !isSecretName(name)) throw new Error([`secret() can't take the name ${JSON.stringify(name)}.`, "Use up to 64 letters, digits, \".\", \"_\", \"-\"; start with a letter or digit."].join("\n"));
+	if (isReservedVariableName(name)) throw new Error([`secret() refuses ${name}.`, "It changes how a process loads code, or the credentials Hot Updater uses."].join("\n"));
 	const scope = globalThis[LOADING_SCOPE];
-	if (scope) {
-		scope.names ??= /* @__PURE__ */ new Set();
-		for (const name of wanted) scope.names.add(name);
-	}
+	if (scope) (scope.names ??= /* @__PURE__ */ new Set()).add(name);
 	let read;
-	return () => read ??= readSecretEnv(wanted, scope).catch((error) => {
+	const ref = () => read ??= readSecretRef(name, scope).catch((error) => {
 		read = void 0;
 		throw error;
 	});
+	Object.defineProperty(ref, "name", { value: name });
+	Object.defineProperty(ref, SECRET_REF, { value: true });
+	return Object.freeze(ref);
+};
+/**
+* The scope's names to read in one `get`: those no build credential takes
+* and the environment doesn't set, with `name`.
+*/
+const batchedNames = (scope, name, fileEnv) => {
+	const names = [...scope.names ?? []].filter((candidate) => !scope.buildNames?.has(candidate) && getHotUpdaterEnvValue(fileEnv, secretVariableName(candidate)) === void 0);
+	return names.includes(name) ? names : [...names, name];
 };
-const readSecretEnv = async (wanted, scope) => {
+const readSecretRef = async (name, scope) => {
 	const cwd = getCwd();
 	const fileEnv = await readLoadedHotUpdaterEnv(cwd);
-	const variables = Object.create(null);
-	const fromStore = [];
-	for (const name of wanted) {
-		const value = getHotUpdaterEnvValue(fileEnv, name);
-		if (value === void 0) fromStore.push(name);
-		else variables[name] = value;
-	}
-	if (fromStore.length > 0) {
-		const secrets = getConfiguredAdapter(scope?.secrets ?? getConfiguredSecrets());
-		const read = secrets ? await readSecrets(secrets, fromStore, cwd) : {};
-		const missing = fromStore.filter((name) => {
-			const value = Object.hasOwn(read, name) ? read[name] : void 0;
-			if (typeof value !== "string" || value === "") return true;
-			variables[name] = value;
-			return false;
+	const variable = secretVariableName(name);
+	const fromEnv = getHotUpdaterEnvValue(fileEnv, variable);
+	if (fromEnv !== void 0 && fromEnv !== "") {
+		registerSecretValue(fromEnv);
+		return fromEnv;
+	}
+	const secrets = getConfiguredAdapter(scope?.secrets ?? getConfiguredSecrets());
+	if (secrets === void 0) throw new Error([
+		`secret("${name}") has no value.`,
+		`Set ${variable} in the environment or .env.hotupdater.`,
+		"Or set the config's secrets to a team store."
+	].join("\n"));
+	let values;
+	if (scope) {
+		scope.read ??= readSecrets(secrets, batchedNames(scope, name, fileEnv), cwd).catch((error) => {
+			scope.read = void 0;
+			throw error;
 		});
-		if (missing.length > 0) {
-			const them = missing.length === 1 ? "it" : "them";
-			throw new Error(secrets === void 0 ? `secretEnv found no value for ${list$1(missing)}: set ${them} in the environment or .env.hotupdater, or read ${them} from a secrets store with the config's secrets.` : `secretEnv found no value for ${list$1(missing)}: ${missing.length === 1 ? "it is" : "they are"} not set in the environment or .env.hotupdater, and the ${secrets.name} secrets adapter does not hold ${them} (${missing.map((name) => describeSecret(secrets, name)).join("; ")}).`);
-		}
-	}
-	for (const value of Object.values(variables)) registerSecretValue(value);
-	return Object.freeze(variables);
+		values = await scope.read;
+	}
+	if (!values || !Object.hasOwn(values, name)) values = await readSecrets(secrets, [name], cwd);
+	const value = Object.hasOwn(values, name) ? values[name] : void 0;
+	if (typeof value !== "string" || value === "") throw new Error([
+		`secret("${name}") has no value.`,
+		`It isn't in ${describeSecret(secrets, name)}.`,
+		`Store it there, or set ${variable}.`
+	].join("\n"));
+	registerSecretValue(value);
+	return value;
 };
 //#endregion
-//#region src/localBundleSigning.ts
-/** The secret `keys generate --secret` stores the private key as by default. */
-const DEFAULT_SIGNING_KEY_SECRET = "bundle-signing-key";
+//#region src/credentialResolver.ts
+/** Passwords are read as set: trimming would change them. */
+const UNTRIMMED_ENV_NAMES = /* @__PURE__ */ new Set(["HOT_UPDATER_ANDROID_KEYSTORE_PASSWORD", "HOT_UPDATER_ANDROID_KEY_PASSWORD"]);
+const describeField = ([name, alternative]) => alternative ? `${name} (or ${alternative})` : name;
+const describeFields = (fields) => {
+	const described = fields.map(describeField);
+	if (described.length <= 2) return described.join(" and ");
+	return `${described.slice(0, -1).join(", ")}, and ${described.at(-1)}`;
+};
 /**
-* A local signing failure whose message the CLI prints as it is: it names
-* the secret and how to store it, and quotes no key material.
+* A command to print, broken at spaces with ` \` once a line would pass
+* 74 columns, each continuation indented two spaces, so a terminal never
+* wraps it mid-word and it still pastes as one command.
 */
-var LocalSigningKeyError = class extends Error {
-	constructor(message, options) {
+const formatCommand = (command) => {
+	const lines = [];
+	let line = "";
+	for (const word of command.split(" ")) {
+		const next = line ? `${line} ${word}` : word;
+		if (line && next.length > 72) {
+			lines.push(`${line} \\`);
+			line = `  ${word}`;
+		} else line = next;
+	}
+	lines.push(line);
+	return lines.join("\n");
+};
+/**
+* `lead` and the command it names on one line when they fit 77 columns,
+* else the command on the lines after it.
+*/
+const withLead = (lead, command) => lead.length + 1 + command.length <= 77 ? `${lead} ${command}` : `${lead}\n${formatCommand(command)}`;
+/**
+* Why a build has no upload keystore, steering away from a second key:
+* Play rejects builds signed with a key it does not have. Under a team's
+* adapter the keystore is someone's already, so it is imported, never
+* created; only `localSecrets()` alone offers a new one, for an app with
+* no `.aab` on Play yet.
+*/
+const describeMissingKeystore = (store, item, name) => {
+	const configured = getConfiguredAdapter(store);
+	if (configured) return [
+		`No ${item} in ${describeSecret(configured, name)}.`,
+		"Ask whoever set it up to store it there, or import it with:",
+		formatCommand(credentialPutCommand("android-keystore", name))
+	].join("\n");
+	return [
+		`No ${item} in the ${store.name} secrets adapter.`,
+		withLead("Store the app's upload key:", credentialPutCommand("android-keystore", name)),
+		withLead("No .aab on Play yet? Create one:", credentialIssueCommand("android-keystore", name))
+	].join("\n");
+};
+/** The file each `secrets put <name> <file>` command names. */
+const PUT_FILES = {
+	"android-keystore": "<upload.jks>",
+	"play-service-account": "<key.json>"
+};
+/**
+* The command that stores the file you have as `name`: the service
+* account's JSON key, or the app's upload keystore. `--kind` is named only
+* for a name that is not the kind.
+*/
+const credentialPutCommand = (kind, name = kind) => `npx hot-updater secrets put ${name}${name === kind ? "" : ` --kind ${kind}`} ${PUT_FILES[kind]}`;
+/**
+* The command that stores the key Hot Updater issues as `name`: an App
+* Store Connect API key after an Apple Account sign-in, and an upload
+* keystore it creates.
+*/
+const credentialIssueCommand = (kind, name = kind) => `npx hot-updater secrets issue ${kind}${name === kind ? "" : ` ${name}`}`;
+/** The command group of each issued kind's shortcut, `<group> login`. */
+const CREDENTIAL_LOGIN_GROUPS = { "asc-api-key": "apple" };
+/**
+* The command people meet first that issues `kind` as `name`: its shortcut,
+* `apple login` for an App Store Connect API key, which takes nothing and
+* stores the kind's own name; for another name, `credentialIssueCommand`.
+*/
+const credentialLoginCommand = (kind, name = kind) => name === kind ? `npx hot-updater ${CREDENTIAL_LOGIN_GROUPS[kind]} login` : credentialIssueCommand(kind, name);
+/**
+* The command that stores a missing credential of `kind` as `name`: the
+* key Hot Updater issues after an Apple sign-in, or the file you have.
+*/
+const credentialStoreCommand = (kind, name = kind) => kind === "asc-api-key" ? credentialLoginCommand(kind, name) : credentialPutCommand(kind, name);
+var CredentialUnavailableError = class extends Error {
+	kind;
+	/** The environment variables that can provide this credential. */
+	envNames;
+	constructor(kind, message, options) {
 		super(message, options);
-		this.name = "HotUpdaterLocalSigningKeyError";
+		this.name = "CredentialUnavailableError";
+		this.kind = kind;
+		this.envNames = CREDENTIAL_ENV_NAMES[kind].flat();
 	}
 };
-const resolvePath$1 = (cwd, filePath) => path$1.isAbsolute(filePath) ? filePath : path$1.resolve(cwd, filePath);
-const parsePrivateKey = (pem) => {
-	try {
-		const privateKey = crypto$1.createPrivateKey(pem);
-		if (privateKey.asymmetricKeyType !== "rsa" || (privateKey.asymmetricKeyDetails?.modulusLength ?? 0) < 2048) throw new Error("not rsa");
-		return privateKey;
-	} catch {
-		throw new Error("Failed to load the local bundle signing private key.");
+const readEnvField = (env, field) => {
+	for (const name of field) {
+		const value = UNTRIMMED_ENV_NAMES.has(name) ? (process.env[name] ?? env[name]) || void 0 : getHotUpdaterEnvValue(env, name);
+		if (value !== void 0) return {
+			name,
+			value
+		};
 	}
 };
-const loadPrivateKeyFile = async (privateKeyPath) => {
-	let pem;
+const readFileField = async (kind, { name, value }) => {
+	const filePath = path$1.resolve(value);
+	if (!await fs$2.stat(filePath).then(async (stats) => {
+		await fs$2.access(filePath, fs$2.constants.R_OK);
+		return stats.isFile();
+	}).catch(() => false)) throw new CredentialUnavailableError(kind, `${name} does not point to a readable file.`);
+	return filePath;
+};
+const parseServiceAccount = (json) => {
 	try {
-		pem = await fs$2.readFile(privateKeyPath, "utf8");
+		return JSON.parse(json);
 	} catch {
-		throw new Error("Failed to load the local bundle signing private key.");
+		return;
 	}
-	return parsePrivateKey(pem);
 };
+const fromEnv = {
+	"asc-api-key": async ([key, keyId, issuerId], { files }) => ({
+		keyPath: key.name === "HOT_UPDATER_ASC_KEY_PATH" ? await readFileField("asc-api-key", key) : await files.write(`AuthKey_${keyId.value}.p8`, key.value.includes("\n") ? key.value : key.value.replaceAll("\\n", "\n")),
+		keyId: keyId.value,
+		issuerId: issuerId.value
+	}),
+	"android-keystore": async ([keystore, storePassword, keyAlias, keyPassword], { files, name }) => {
+		let storeFile;
+		if (keystore.name === "HOT_UPDATER_ANDROID_KEYSTORE_PATH") storeFile = await readFileField("android-keystore", keystore);
+		else {
+			registerSecretValue(keystore.value);
+			const contents = decodeBase64(keystore.value);
+			if (!contents) throw new CredentialUnavailableError("android-keystore", `${keystore.name} is not a base64-encoded keystore.`);
+			storeFile = await files.write(`${name}.keystore`, contents);
+		}
+		return {
+			storeFile,
+			storePassword: storePassword.value,
+			keyAlias: keyAlias.value,
+			keyPassword: keyPassword.value
+		};
+	},
+	"play-service-account": async ([serviceAccount]) => {
+		const json = serviceAccount.name === "HOT_UPDATER_PLAY_SERVICE_ACCOUNT_PATH" ? await fs$2.readFile(await readFileField("play-service-account", serviceAccount), "utf-8") : serviceAccount.value;
+		const parsed = parseServiceAccount(json);
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new CredentialUnavailableError("play-service-account", `${serviceAccount.name} is not a service account JSON object.`);
+		return { json };
+	}
+};
+/** Fields of a service account that are no secret: its type and Google's endpoints. */
 /**
-* The private key the `secrets` adapter holds as `name`: masked in the CLI's
-* output before it is parsed, and kept only as a key object. A PEM written
-* on one line, with `\n` for its line breaks, as a `.env.hotupdater` value
-* or a CI variable may hold it, reads as the PEM.
+* Fields of a JSON credential that identify it rather than grant access:
+* its IDs, key alias, and a service account's email, project, type, and
+* Google's endpoints. They stay readable, as messages name them, and a
+* short one, such as the alias `release`, would mask every word it is in.
 */
-const loadPrivateKeySecret = async (secrets, name, cwd) => {
-	let value;
-	try {
-		const read = await secrets.get([name], { cwd });
-		value = Object.hasOwn(read, name) ? read[name] : void 0;
-	} catch (error) {
-		const reason = error instanceof Error ? error.message : String(error);
-		throw new LocalSigningKeyError(`The ${secrets.name} secrets adapter could not read the bundle signing key ${name}: ${reason}`, { cause: error });
-	}
-	if (typeof value !== "string" || !value.trim()) throw new LocalSigningKeyError(`signing.privateKey reads the bundle signing key ${name}, which is not in the ${secrets.name} secrets adapter (${describeSecret(secrets, name)}). Set it to the RSA private key in PEM, or generate a key pair with \`npx hot-updater keys generate --secret ${name}\`.`);
+const isIdentifierField = (field) => [
+	"keyId",
+	"issuerId",
+	"keyAlias",
+	"type",
+	"project_id",
+	"client_email",
+	"client_id",
+	"private_key_id",
+	"universe_domain"
+].includes(field) || field.endsWith("_uri") || field.endsWith("_url");
+const registerJsonSecrets = (value, fields) => {
 	registerSecretValue(value);
-	const pem = value.includes("\n") ? value : value.replaceAll("\\n", "\n");
-	if (pem !== value) registerSecretValue(pem);
-	try {
-		return parsePrivateKey(pem);
-	} catch {
-		throw new LocalSigningKeyError(`The bundle signing key ${name} in the ${secrets.name} secrets adapter is not an RSA private key in PEM of at least 2048 bits.`);
+	for (const [field, entry] of Object.entries(fields)) if (typeof entry === "string" && !isIdentifierField(field)) registerSecretValue(entry);
+};
+/**
+* Masks a credential's JSON value in the CLI's output: the whole value, and
+* each field but those that identify it, such as `keyId` and `keyAlias`,
+* so a password or a key a log prints alone stays masked. A value that is
+* no JSON object is masked whole.
+*/
+const registerCredentialValue = (value) => {
+	const parsed = parseObject(value);
+	if (parsed) registerJsonSecrets(value, parsed);
+	else registerSecretValue(value);
+};
+const parseObject = (value) => {
+	const parsed = parseServiceAccount(value);
+	return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
+};
+/**
+* The fields of a JSON credential, each a non-empty string, or an error
+* naming the shape `kind` takes.
+*/
+const readJsonFields = (kind, item, value, fields) => {
+	const parsed = parseObject(value);
+	const shape = `{${fields.map((field) => `"${field}"`).join(", ")}}`;
+	if (!parsed) throw new CredentialUnavailableError(kind, `${item} is not a JSON object.\n${capitalize(aKind(kind))} is one JSON value: ${shape}`);
+	registerJsonSecrets(value, parsed);
+	const missing = fields.filter((field) => typeof parsed[field] !== "string" || !parsed[field]);
+	if (missing.length > 0) throw new CredentialUnavailableError(kind, `${item} has no ${missing.join(", ")}.\n${capitalize(aKind(kind))} is one JSON value: ${shape}`);
+	return parsed;
+};
+const aKind = (kind) => `${/^[aeiou]/u.test(kind) ? "an" : "a"} ${kind}`;
+const capitalize = (text) => text.charAt(0).toUpperCase() + text.slice(1);
+/** A base64 value's bytes, or undefined when it is not base64. */
+const decodeBase64 = (value) => {
+	const base64 = value.replace(/\s/g, "");
+	const contents = Buffer.from(base64, "base64");
+	return contents.length > 0 && contents.toString("base64").replace(/=+$/, "") === base64.replace(/=+$/, "") ? contents : void 0;
+};
+/**
+* Each kind from the one string a secrets adapter holds for it: a JSON
+* object for the App Store Connect key (`p8` is the PEM) and the keystore
+* (`keystore` is base64), and the service account's own JSON. File values
+* are written with `files`; every value is masked.
+*/
+const fromSecretValue = {
+	"asc-api-key": async (value, { files, item }) => {
+		const { keyId, issuerId, p8 } = readJsonFields("asc-api-key", item, value, [
+			"keyId",
+			"issuerId",
+			"p8"
+		]);
+		return {
+			keyPath: await files.write(`AuthKey_${keyId}.p8`, p8.includes("\n") ? p8 : p8.replaceAll("\\n", "\n")),
+			keyId,
+			issuerId
+		};
+	},
+	"android-keystore": async (value, { files, name, item }) => {
+		const { keystore, storePassword, keyAlias, keyPassword } = readJsonFields("android-keystore", item, value, [
+			"keystore",
+			"storePassword",
+			"keyAlias",
+			"keyPassword"
+		]);
+		const contents = decodeBase64(keystore);
+		if (!contents) throw new CredentialUnavailableError("android-keystore", `${item}'s keystore is not a base64-encoded keystore.`);
+		return {
+			storeFile: await files.write(`${name}.keystore`, contents),
+			storePassword,
+			keyAlias,
+			keyPassword
+		};
+	},
+	"play-service-account": async (value, { item }) => {
+		const parsed = parseObject(value);
+		if (!parsed) throw new CredentialUnavailableError("play-service-account", `${item} is not a service account JSON object.`);
+		registerJsonSecrets(value, parsed);
+		return { json: value };
+	}
+};
+const registerCredentialSecrets = (kind, credential) => {
+	if (kind === "android-keystore") {
+		const keystore = credential;
+		registerSecretValue(keystore.storePassword);
+		registerSecretValue(keystore.keyPassword);
+	}
+	if (kind === "play-service-account") {
+		const { json } = credential;
+		registerSecretValue(json);
+		const privateKey = parseServiceAccount(json)?.private_key;
+		if (typeof privateKey === "string") registerSecretValue(privateKey);
 	}
 };
 /**
-* The built-in local signer. Its private key is read on first use, once:
-* from `privateKeyPath`, or from the config's `secrets` adapter for
-* `privateKey: "secret:<name>"`, and is never written anywhere.
+* Reads names from `secrets`, the names asked for in one turn of the event
+* loop, such as a build's credentials, in one `get`. Nothing is cached.
 */
-const createLocalSigningAdapter = (config, { secrets } = {}) => {
-	const privateKeys = /* @__PURE__ */ new Map();
-	const { privateKeyPath } = config;
-	const secretName = privateKeyPath === void 0 ? parseSecretReference(config.privateKey, "signing.privateKey") : void 0;
-	const getPrivateKey = (cwd = process.cwd()) => {
-		const cacheKey = privateKeyPath === void 0 ? "" : resolvePath$1(cwd, privateKeyPath);
-		const cached = privateKeys.get(cacheKey);
-		if (cached) return cached;
-		const pending = (secretName === void 0 ? loadPrivateKeyFile(cacheKey) : loadPrivateKeySecret(secrets ?? getConfiguredSecrets(), secretName, cwd)).catch((error) => {
-			privateKeys.delete(cacheKey);
-			throw error;
+const createSecretLoader = (secrets, cwd) => {
+	let batch;
+	const flush = async (names) => {
+		try {
+			const read = await secrets().get([...names.keys()], { cwd: cwd() });
+			for (const [name, waiters] of names) {
+				const value = Object.hasOwn(read, name) ? read[name] : void 0;
+				for (const waiter of waiters) waiter.resolve(typeof value === "string" && value ? value : void 0);
+			}
+		} catch (error) {
+			for (const waiters of names.values()) for (const waiter of waiters) waiter.reject(error);
+		}
+	};
+	return (name) => new Promise((resolve, reject) => {
+		if (batch === void 0) {
+			const names = /* @__PURE__ */ new Map();
+			batch = names;
+			setTimeout(() => {
+				batch = void 0;
+				flush(names);
+			}, 0);
+		}
+		const waiters = batch.get(name) ?? [];
+		waiters.push({
+			resolve,
+			reject
+		});
+		batch.set(name, waiters);
+	});
+};
+/**
+* Resolves each item from its environment overrides when any is set, and
+* otherwise from the config's `secrets` adapter as one value named by the
+* item, so overrides never reach the store. When the adapter fails or holds
+* no such value, the error names the environment variables that can
+* provide the item instead. Nothing is cached, values are never written to
+* disk except as 0600 temporary files, are never set in `process.env`, and
+* every secret is masked in logs.
+*/
+const createCredentialResolver = ({ env = {}, secrets, cwd } = {}) => {
+	const files = createCredentialFiles();
+	const resolved = /* @__PURE__ */ new Map();
+	let disposal;
+	const adapter = () => typeof secrets === "function" ? secrets() : secrets ?? getConfiguredSecrets();
+	const load = createSecretLoader(adapter, () => cwd ?? getCwd());
+	const resolveItem = async (kind, name) => {
+		const fields = CREDENTIAL_ENV_NAMES[kind];
+		const values = fields.map((field) => readEnvField(env, field));
+		if (values.some((value) => value !== void 0)) {
+			const missing = fields.filter((_, index) => !values[index]);
+			if (missing.length > 0) throw new CredentialUnavailableError(kind, `The environment overrides ${kind} but ${describeFields(missing)} ${missing.length === 1 ? "is" : "are"} not set.`);
+			const credential = await fromEnv[kind](values, {
+				files,
+				name
+			});
+			registerCredentialSecrets(kind, credential);
+			return credential;
+		}
+		const store = adapter();
+		const item = name === kind ? kind : `${name} (${kind})`;
+		let value;
+		try {
+			value = await load(name);
+		} catch (error) {
+			const reason = error instanceof Error ? error.message : String(error);
+			throw new CredentialUnavailableError(kind, `Couldn't read ${item} from the ${store.name} secrets adapter.\n${reason}`, { cause: error });
+		}
+		if (value === void 0) throw new CredentialUnavailableError(kind, kind === "android-keystore" ? describeMissingKeystore(store, item, name) : `No ${item} in the ${store.name} secrets adapter.\nStore it once with:\n${formatCommand(credentialStoreCommand(kind, name))}`);
+		registerSecretValue(value);
+		return fromSecretValue[kind](value, {
+			files,
+			name,
+			item: `The ${store.name} secrets adapter's ${item}`
 		});
-		privateKeys.set(cacheKey, pending);
-		return pending;
 	};
 	return {
-		name: "localSigning",
-		async getPublicKey({ cwd } = {}) {
-			const privateKey = await getPrivateKey(cwd);
-			return { publicKey: crypto$1.createPublicKey(privateKey).export({
-				format: "pem",
-				type: "spki"
-			}).toString() };
+		resolve: ({ kind, name = kind }) => {
+			if (disposal) return Promise.reject(/* @__PURE__ */ new Error("The credential resolver has been disposed."));
+			const key = `${kind}\u0000${name}`;
+			let pending = resolved.get(key);
+			if (!pending) {
+				pending = resolveItem(kind, name);
+				resolved.set(key, pending);
+				pending.catch(() => resolved.delete(key));
+			}
+			return pending;
 		},
-		async sign({ message, cwd }) {
-			if (!(message instanceof Uint8Array) || message.byteLength !== 32) throw new Error("Local bundle signing messages must be exactly 32 bytes.");
-			const privateKey = await getPrivateKey(cwd);
-			return { signature: crypto$1.sign("RSA-SHA256", message, privateKey) };
+		dispose: () => {
+			disposal ??= (async () => {
+				await Promise.allSettled(resolved.values());
+				resolved.clear();
+				await files.dispose();
+			})();
+			return disposal;
 		}
 	};
 };
 /**
-* The `secrets` adapter of the config each normalized `privateKey` config
-* came from, so a config function's per-platform configs each read their
-* own store, whichever config loaded last.
+* Runs `run` with a credential resolver and deletes its temporary files
+* when `run` settles.
 */
-const signingSecrets = /* @__PURE__ */ new WeakMap();
-/** The `secrets` adapter `normalizeSigningConfig` bound `signing` to. */
-const getSigningSecrets = (signing) => signingSecrets.get(signing);
-const invalidSigningConfig = () => /* @__PURE__ */ new Error("Bundle signing must be a local key config or signing adapter. Omit signing to disable it.");
-const normalizeSigningConfig = (signing, { secrets } = {}) => {
-	if (signing === void 0) return void 0;
-	if (typeof signing !== "object" || signing === null) throw invalidSigningConfig();
-	const hasLocalFields = [
-		"enabled",
-		"privateKeyPath",
-		"privateKey"
-	].some((key) => Reflect.has(signing, key));
-	const hasPluginMembers = [
-		"name",
-		"getPublicKey",
-		"sign"
-	].some((key) => Reflect.has(signing, key));
-	if (hasLocalFields && hasPluginMembers) throw new Error("Bundle signing config cannot combine local signing fields with signing adapter fields.");
-	if (!hasPluginMembers) {
-		if (Object.keys(signing).some((key) => key !== "enabled" && key !== "privateKeyPath" && key !== "privateKey")) throw new Error("Local bundle signing accepts only enabled, and privateKeyPath or privateKey.");
-		const enabled = Reflect.get(signing, "enabled");
-		if (enabled === false) return void 0;
-		if (enabled !== true) throw invalidSigningConfig();
-		const privateKeyPath = Reflect.get(signing, "privateKeyPath");
-		const privateKey = Reflect.get(signing, "privateKey");
-		if (privateKeyPath !== void 0 && privateKey !== void 0) throw new Error("Local bundle signing takes its private key from privateKeyPath or from privateKey, not both.");
-		if (privateKey !== void 0) {
-			if (typeof privateKey !== "string") throw new Error("signing.privateKey names a secret as secret:<name>, such as \"secret:bundle-signing-key\".");
-			parseSecretReference(privateKey, "signing.privateKey");
-			const normalized = {
-				enabled: true,
-				privateKey
-			};
-			if (secrets) signingSecrets.set(normalized, secrets);
-			return normalized;
-		}
-		if (typeof privateKeyPath !== "string" || !privateKeyPath.trim()) throw new Error("Enabled local bundle signing requires privateKeyPath, or privateKey as \"secret:<name>\".");
-		return {
-			enabled: true,
-			privateKeyPath
-		};
+const withCredentialResolver = async (run, options) => {
+	const resolver = createCredentialResolver(options);
+	try {
+		return await run(resolver);
+	} finally {
+		await resolver.dispose();
 	}
-	if (typeof Reflect.get(signing, "name") !== "string" || typeof Reflect.get(signing, "getPublicKey") !== "function" || typeof Reflect.get(signing, "sign") !== "function") throw invalidSigningConfig();
-	return signing;
 };
 //#endregion
 //#region src/bundleSigning.ts
+/** The secret `signing: secret("bundle-signing-key")` names, which `secrets issue` creates. */
+const BUNDLE_SIGNING_KEY_SECRET = "bundle-signing-key";
+/** The command that creates and stores a bundle signing key. */
+const ISSUE_SIGNING_KEY_COMMAND = `npx hot-updater secrets issue ${BUNDLE_SIGNING_KEY_SECRET}`;
+/** The command that stores a bundle signing key you have. */
+const PUT_SIGNING_KEY_COMMAND = `npx hot-updater secrets put ${BUNDLE_SIGNING_KEY_SECRET} <key.pem>`;
+/** What deploy and doctor say when the config sets no `signing`. */
+const UNSIGNED_BUNDLES_WARNING = "Bundles are unsigned.";
+/** The next step after `UNSIGNED_BUNDLES_WARNING`. */
+const UNSIGNED_BUNDLES_NEXT_STEP = "To sign them, run:";
+/** What deploy and doctor say when `signing` is no shape it takes. */
+const INVALID_SIGNING_MESSAGE = `signing takes secret("${BUNDLE_SIGNING_KEY_SECRET}").`;
+/** The next step after `INVALID_SIGNING_MESSAGE`. */
+const INVALID_SIGNING_NEXT_STEP = "Store your key:";
+const invalid = (message) => ({
+	status: "invalid",
+	message
+});
+const LOCAL_FIELDS = [
+	"enabled",
+	"privateKeyPath",
+	"privateKey"
+];
+const readBundleSigningState = (signing) => {
+	if (signing === void 0) return { status: "unsigned" };
+	if (isSecretRef(signing)) return {
+		status: "on",
+		key: { secret: signing.name }
+	};
+	if (typeof signing !== "object" || signing === null || !Object.keys(signing).every((key) => LOCAL_FIELDS.includes(key))) return invalid(INVALID_SIGNING_MESSAGE);
+	const { enabled, privateKey, privateKeyPath } = signing;
+	if (enabled === false) return { status: "off" };
+	if (enabled !== true) return invalid(INVALID_SIGNING_MESSAGE);
+	if (privateKey !== void 0 && privateKeyPath !== void 0) return invalid("signing takes privateKey or privateKeyPath, not both.");
+	if (privateKey !== void 0) return isSecretRef(privateKey) ? {
+		status: "on",
+		key: { secret: privateKey.name }
+	} : invalid("signing.privateKey takes secret(\"<name>\").");
+	if (typeof privateKeyPath !== "string" || !privateKeyPath.trim()) return invalid("signing takes privateKeyPath, or privateKey as secret(\"<name>\").");
+	return {
+		status: "on",
+		key: { privateKeyPath }
+	};
+};
+/** The `secret()` the config's `signing` reads its private key from, if any. */
+const bundleSigningSecretRef = (signing) => {
+	if (isSecretRef(signing)) return signing;
+	const privateKey = typeof signing === "object" && signing !== null ? Reflect.get(signing, "privateKey") : void 0;
+	return isSecretRef(privateKey) ? privateKey : void 0;
+};
+/**
+* A bundle signing failure whose message the CLI prints as it is: it names
+* the secret and the next step, and quotes no key material.
+*/
+var BundleSigningKeyError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "HotUpdaterBundleSigningKeyError";
+	}
+};
 const FILE_HASH_PATTERN = /^[a-f\d]{64}$/iu;
 const resolvePath = (cwd, filePath) => path$1.isAbsolute(filePath) ? filePath : path$1.resolve(cwd, filePath);
 const parseRsaPublicKey = (publicKeyPEM) => {
@@ -25952,7 +26465,8 @@ const parseRsaPublicKey = (publicKeyPEM) => {
 		throw new Error("Bundle signing public key must be a valid RSA SPKI PEM key with a modulus of at least 2048 bits.");
 	}
 };
-const exportPublicKey = (publicKey) => publicKey.export({
+/** The SPKI PEM of `key`, a public key or the private key it derives from. */
+const exportPublicKey = (key) => (key.type === "private" ? crypto$1.createPublicKey(key) : key).export({
 	type: "spki",
 	format: "pem"
 }).toString();
@@ -25965,93 +26479,119 @@ const readBundleSigningPublicKeyFile = async (publicKeyPath, options = {}) => {
 		throw new Error("Failed to read the bundle signing public key file.");
 	}
 };
+const parsePrivateKey = (pem) => {
+	const privateKey = crypto$1.createPrivateKey(pem);
+	if (privateKey.asymmetricKeyType !== "rsa" || (privateKey.asymmetricKeyDetails?.modulusLength ?? 0) < 2048) throw new Error("not rsa");
+	return privateKey;
+};
+const loadPrivateKeyFile = async (file) => {
+	try {
+		return parsePrivateKey(await fs$2.readFile(file, "utf8"));
+	} catch {
+		throw new BundleSigningKeyError("Failed to load the bundle signing private key from privateKeyPath.");
+	}
+};
+/**
+* The private key the `secrets` adapter holds as `name`: masked in the CLI's
+* output before it is parsed, and kept only as a key object. A PEM written
+* on one line, with `\n` for its line breaks, as a `.env.hotupdater` value
+* or a CI variable may hold it, reads as the PEM.
+*/
+const loadPrivateKeySecret = async (secrets, name, cwd) => {
+	let value;
+	try {
+		const read = await secrets.get([name], { cwd });
+		value = Object.hasOwn(read, name) ? read[name] : void 0;
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : String(error);
+		throw new BundleSigningKeyError(`Couldn't read ${name} from the ${secrets.name} secrets adapter.\n${reason}`, { cause: error });
+	}
+	if (typeof value !== "string" || !value.trim()) {
+		const [missing, check] = getConfiguredAdapter(secrets) ? [`${name} isn't in the ${secrets.name} secrets adapter.`, "Check the name and your access, or import your key:"] : [`${name} isn't on this machine.`, `Check the name, set ${secretVariableName(name)}, or import your key:`];
+		throw new BundleSigningKeyError([
+			missing,
+			check,
+			formatCommand(`npx hot-updater secrets put ${name}${name === "bundle-signing-key" ? "" : ` --kind ${BUNDLE_SIGNING_KEY_SECRET}`} <key.pem>`)
+		].join("\n"));
+	}
+	registerSecretValue(value);
+	const pem = value.includes("\n") ? value : value.replaceAll("\\n", "\n");
+	if (pem !== value) registerSecretValue(pem);
+	try {
+		return parsePrivateKey(pem);
+	} catch {
+		throw new BundleSigningKeyError([`${name} in the ${secrets.name} secrets adapter is no signing key.`, "Store an RSA private key in PEM, of 2048 bits or more."].join("\n"));
+	}
+};
 /**
-* `remoteSigning`'s errors with a reason it wrote itself, by name, as it may
-* come from another copy of plugin-core, and the local signer's errors that
-* name its secret. Any other signing adapter error is redacted: it may quote
-* key material.
+* The private keys each `signing` value has read, by file or by secrets
+* adapter, so the commands of one run that sign and derive the public key
+* read the key once.
 */
-const REMOTE_SIGNING_ERROR_NAME = "HotUpdaterRemoteSigningError";
-const signingFailure = (summary, error) => new Error(error instanceof Error && (error.name === REMOTE_SIGNING_ERROR_NAME || error instanceof LocalSigningKeyError) ? `${summary} ${error.message}` : summary);
+const privateKeys = /* @__PURE__ */ new WeakMap();
 /**
-* The local signer of each config's `signing` that reads its private key
-* from a secret, so the commands of one run that sign and derive the public
-* key read the secret once.
+* The private key `signing` signs with, or null when it signs nothing.
+* Throws `INVALID_SIGNING_MESSAGE`, with the next step, for a value
+* `signing` doesn't take.
 */
-const secretSigners = /* @__PURE__ */ new WeakMap();
-const getSigningProvider = (signing) => {
-	const normalized = normalizeSigningConfig(signing);
-	if (!normalized) return null;
-	if (!("enabled" in normalized)) return normalized;
-	if (normalized.privateKey === void 0) return createLocalSigningAdapter(normalized);
-	const key = signing;
-	const cached = secretSigners.get(key);
+const loadSigningKey = (signing, { cwd = getCwd(), secrets }) => {
+	const state = readBundleSigningState(signing);
+	if (state.status === "invalid") throw new BundleSigningKeyError(`${state.message}\n${INVALID_SIGNING_NEXT_STEP} ${PUT_SIGNING_KEY_COMMAND}`);
+	if (state.status !== "on") return null;
+	const store = secrets ?? getConfiguredSecrets();
+	const cacheKey = "secret" in state.key ? store : resolvePath(cwd, state.key.privateKeyPath);
+	const cache = privateKeys.get(signing) ?? /* @__PURE__ */ new Map();
+	privateKeys.set(signing, cache);
+	const cached = cache.get(cacheKey);
 	if (cached) return cached;
-	const local = createLocalSigningAdapter(normalized, { secrets: getSigningSecrets(key) });
-	secretSigners.set(key, local);
-	return local;
+	const pending = ("secret" in state.key ? loadPrivateKeySecret(store, state.key.secret, cwd) : loadPrivateKeyFile(cacheKey)).catch((error) => {
+		cache.delete(cacheKey);
+		throw error;
+	});
+	cache.set(cacheKey, pending);
+	return pending;
 };
-const getProviderPublicKey = async (provider, cwd) => {
+const signingFailure = (summary, error) => new Error(error instanceof BundleSigningKeyError ? error.message : `${summary} ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+/**
+* Prepares the run's bundle signing: the public key the app must embed, and
+* a signer of SHA-256 file hashes that signs each hash once. Null when
+* `signing` is omitted or `{ enabled: false }`.
+*/
+const prepareBundleSigning = async (signing, options = {}) => {
+	const loading = loadSigningKey(signing, options);
+	if (!loading) return null;
+	let privateKey;
 	try {
-		const result = await provider.getPublicKey({ cwd });
-		if (!result || typeof result.publicKey !== "string") throw new Error("invalid result");
-		return parseRsaPublicKey(result.publicKey);
+		privateKey = await loading;
 	} catch (error) {
-		throw signingFailure("Failed to resolve the bundle signing provider public key.", error);
+		throw signingFailure("Failed to read the bundle signing key.", error);
 	}
-};
-const createMemoizedSigner = ({ publicKey, sign }) => {
 	const signatures = /* @__PURE__ */ new Map();
-	return (fileHash) => {
-		if (!FILE_HASH_PATTERN.test(fileHash)) return Promise.reject(/* @__PURE__ */ new Error("Bundle signing requires a 64-character hexadecimal file hash."));
-		const normalizedFileHash = fileHash.toLowerCase();
-		const cached = signatures.get(normalizedFileHash);
-		if (cached) return cached;
-		const pending = (async () => {
-			const message = Buffer.from(normalizedFileHash, "hex");
-			let signature;
-			try {
-				signature = await sign(new Uint8Array(message));
-			} catch (error) {
-				throw signingFailure("Bundle signing provider failed to sign the file hash.", error);
-			}
-			if (!(signature instanceof Uint8Array) || signature.byteLength === 0) throw new Error("Bundle signing provider returned an invalid signature.");
-			if (!crypto$1.verify("RSA-SHA256", message, publicKey, signature)) throw new Error("Bundle signing provider returned a signature that does not match the configured public key.");
-			return Buffer.from(signature).toString("base64");
-		})().catch((error) => {
-			signatures.delete(normalizedFileHash);
-			throw error;
-		});
-		signatures.set(normalizedFileHash, pending);
-		return pending;
-	};
-};
-const preparePluginSigning = async (signing, cwd) => {
-	const providerPublicKey = await getProviderPublicKey(signing, cwd);
 	return {
-		name: signing.name,
-		publicKey: exportPublicKey(providerPublicKey),
-		signFileHash: createMemoizedSigner({
-			publicKey: providerPublicKey,
-			sign: async (message) => {
-				return (await signing.sign({
-					cwd,
-					message
-				})).signature;
-			}
-		})
+		publicKey: exportPublicKey(privateKey),
+		signFileHash: async (fileHash) => {
+			if (!FILE_HASH_PATTERN.test(fileHash)) throw new Error("Bundle signing requires a 64-character hexadecimal file hash.");
+			const normalized = fileHash.toLowerCase();
+			const cached = signatures.get(normalized);
+			if (cached) return cached;
+			const signature = crypto$1.sign("RSA-SHA256", Buffer.from(normalized, "hex"), privateKey).toString("base64");
+			signatures.set(normalized, signature);
+			return signature;
+		}
 	};
 };
-const prepareBundleSigning = async (signing, options = {}) => {
-	const provider = getSigningProvider(signing);
-	if (!provider) return null;
-	return preparePluginSigning(provider, options.cwd ?? getCwd());
-};
-/** Resolves the public identity of the configured bundle signer. */
+/**
+* The public key of the configured bundle signing key, in SPKI PEM; null
+* when `signing` signs nothing.
+*/
 const getBundleSigningPublicKey = async (signing, options = {}) => {
-	const provider = getSigningProvider(signing);
-	if (!provider) return null;
-	return exportPublicKey(await getProviderPublicKey(provider, options.cwd ?? getCwd()));
+	const loading = loadSigningKey(signing, options);
+	if (!loading) return null;
+	try {
+		return exportPublicKey(await loading);
+	} catch (error) {
+		throw signingFailure("Failed to read the bundle signing key.", error);
+	}
 };
 //#endregion
 //#region src/ConfigBuilder.ts
@@ -38647,448 +39187,6 @@ const createZip = async ({ outfile, targetDir, excludeExts = [] }) => {
 	return outfile;
 };
 //#endregion
-//#region src/credentialFiles.ts
-const TERMINATION_SIGNALS = [
-	"SIGHUP",
-	"SIGINT",
-	"SIGTERM"
-];
-const liveDirectories = /* @__PURE__ */ new Set();
-const onSignal = (signal) => {
-	removeLiveDirectories();
-	if (process.listenerCount(signal) === 0) process.kill(process.pid, signal);
-};
-const removeLiveDirectories = () => {
-	for (const directory of liveDirectories) rmSync(directory, {
-		force: true,
-		recursive: true
-	});
-	liveDirectories.clear();
-	stopListening();
-};
-const startListening = () => {
-	process.on("exit", removeLiveDirectories);
-	for (const signal of TERMINATION_SIGNALS) process.on(signal, onSignal);
-};
-const stopListening = () => {
-	process.off("exit", removeLiveDirectories);
-	for (const signal of TERMINATION_SIGNALS) process.off(signal, onSignal);
-};
-const trackDirectory = (directory) => {
-	if (liveDirectories.size === 0) startListening();
-	liveDirectories.add(directory);
-};
-const untrackDirectory = (directory) => {
-	if (liveDirectories.delete(directory) && liveDirectories.size === 0) stopListening();
-};
-/**
-* Creates the temporary files of one credential resolver: a `mkdtemp`
-* directory, created on the first write and removed by `dispose` or, if the
-* process exits first, on `exit` or a termination signal.
-*/
-const createCredentialFiles = () => {
-	let directory;
-	let disposal;
-	const ensureDirectory = () => {
-		directory ??= fs$2.mkdtemp(path$1.join(os.tmpdir(), "hot-updater-credentials-")).then((created) => {
-			trackDirectory(created);
-			return created;
-		});
-		return directory;
-	};
-	return {
-		write: async (fileName, contents) => {
-			if (disposal) throw new Error("The credential files have been disposed.");
-			if (typeof contents === "string") registerSecretValue(contents);
-			const fileDirectory = await fs$2.mkdtemp(path$1.join(await ensureDirectory(), "item-"));
-			const filePath = path$1.join(fileDirectory, path$1.basename(fileName));
-			await fs$2.writeFile(filePath, contents, {
-				flag: "wx",
-				mode: 384
-			});
-			return filePath;
-		},
-		dispose: () => {
-			disposal ??= (async () => {
-				const created = await directory?.catch(() => void 0);
-				if (!created) return;
-				await fs$2.rm(created, {
-					force: true,
-					recursive: true
-				});
-				untrackDirectory(created);
-			})();
-			return disposal;
-		}
-	};
-};
-//#endregion
-//#region src/credentialResolver.ts
-/** Passwords are read as set: trimming would change them. */
-const UNTRIMMED_ENV_NAMES = /* @__PURE__ */ new Set(["HOT_UPDATER_ANDROID_KEYSTORE_PASSWORD", "HOT_UPDATER_ANDROID_KEY_PASSWORD"]);
-const describeField = ([name, alternative]) => alternative ? `${name} (or ${alternative})` : name;
-const describeFields = (fields) => {
-	const described = fields.map(describeField);
-	if (described.length <= 2) return described.join(" and ");
-	return `${described.slice(0, -1).join(", ")}, and ${described.at(-1)}`;
-};
-/**
-* A command to print, broken at spaces with ` \` once a line would pass
-* 74 columns, each continuation indented two spaces, so a terminal never
-* wraps it mid-word and it still pastes as one command.
-*/
-const formatCommand = (command) => {
-	const lines = [];
-	let line = "";
-	for (const word of command.split(" ")) {
-		const next = line ? `${line} ${word}` : word;
-		if (line && next.length > 72) {
-			lines.push(`${line} \\`);
-			line = `  ${word}`;
-		} else line = next;
-	}
-	lines.push(line);
-	return lines.join("\n");
-};
-/**
-* `lead` and the command it names on one line when they fit 77 columns,
-* else the command on the lines after it.
-*/
-const withLead = (lead, command) => lead.length + 1 + command.length <= 77 ? `${lead} ${command}` : `${lead}\n${formatCommand(command)}`;
-/**
-* Why a build has no upload keystore, in three lines, steering away from a
-* second key: Play rejects builds signed with a key it does not have.
-* Under a team's adapter the keystore is someone's already, so it is
-* imported, never created; only `localSecrets()` alone offers a new one.
-*/
-const describeMissingKeystore = (store, item, name) => {
-	const configured = getConfiguredAdapter(store);
-	if (configured) return [
-		`No ${item} in ${describeSecret(configured, name)}.`,
-		"Ask whoever set it up to store it there, or import it with:",
-		"npx hot-updater google-play login"
-	].join("\n");
-	return [
-		`No ${item} in the ${store.name} secrets adapter.`,
-		"Play rejects a new key if the app has one: import it with google-play login.",
-		withLead("Otherwise:", credentialStoreCommand("android-keystore", name))
-	].join("\n");
-};
-/**
-* The command that stores the key Hot Updater issues as `name`: an App
-* Store Connect API key after an Apple Account sign-in, a Play service
-* account after a Google one, and an upload keystore it creates.
-*/
-const credentialIssueCommand = (kind, name = kind) => `npx hot-updater secrets issue ${kind}${name === kind ? "" : ` ${name}`}`;
-/** The command group of each issued kind's shortcut, `<group> login`. */
-const CREDENTIAL_LOGIN_GROUPS = {
-	"asc-api-key": "apple",
-	"play-service-account": "google-play"
-};
-/**
-* The command people meet first that issues `kind` as `name`: its shortcut,
-* `apple login` for an App Store Connect API key or `google-play login`
-* for a Play service account, which takes nothing and stores the kind's
-* own name; for another name, `credentialIssueCommand`.
-*/
-const credentialLoginCommand = (kind, name = kind) => name === kind ? `npx hot-updater ${CREDENTIAL_LOGIN_GROUPS[kind]} login` : credentialIssueCommand(kind, name);
-/**
-* The command that stores a missing credential of `kind` as `name`: the
-* upload keystore Hot Updater creates, or the key it issues after a
-* sign-in.
-*/
-const credentialStoreCommand = (kind, name = kind) => kind === "android-keystore" ? credentialIssueCommand(kind, name) : credentialLoginCommand(kind, name);
-var CredentialUnavailableError = class extends Error {
-	kind;
-	/** The environment variables that can provide this credential. */
-	envNames;
-	constructor(kind, message, options) {
-		super(message, options);
-		this.name = "CredentialUnavailableError";
-		this.kind = kind;
-		this.envNames = CREDENTIAL_ENV_NAMES[kind].flat();
-	}
-};
-const readEnvField = (env, field) => {
-	for (const name of field) {
-		const value = UNTRIMMED_ENV_NAMES.has(name) ? (process.env[name] ?? env[name]) || void 0 : getHotUpdaterEnvValue(env, name);
-		if (value !== void 0) return {
-			name,
-			value
-		};
-	}
-};
-const readFileField = async (kind, { name, value }) => {
-	const filePath = path$1.resolve(value);
-	if (!await fs$2.stat(filePath).then(async (stats) => {
-		await fs$2.access(filePath, fs$2.constants.R_OK);
-		return stats.isFile();
-	}).catch(() => false)) throw new CredentialUnavailableError(kind, `${name} does not point to a readable file.`);
-	return filePath;
-};
-const parseServiceAccount = (json) => {
-	try {
-		return JSON.parse(json);
-	} catch {
-		return;
-	}
-};
-const fromEnv = {
-	"asc-api-key": async ([key, keyId, issuerId], { files }) => ({
-		keyPath: key.name === "HOT_UPDATER_ASC_KEY_PATH" ? await readFileField("asc-api-key", key) : await files.write(`AuthKey_${keyId.value}.p8`, key.value.includes("\n") ? key.value : key.value.replaceAll("\\n", "\n")),
-		keyId: keyId.value,
-		issuerId: issuerId.value
-	}),
-	"android-keystore": async ([keystore, storePassword, keyAlias, keyPassword], { files, name }) => {
-		let storeFile;
-		if (keystore.name === "HOT_UPDATER_ANDROID_KEYSTORE_PATH") storeFile = await readFileField("android-keystore", keystore);
-		else {
-			registerSecretValue(keystore.value);
-			const contents = decodeBase64(keystore.value);
-			if (!contents) throw new CredentialUnavailableError("android-keystore", `${keystore.name} is not a base64-encoded keystore.`);
-			storeFile = await files.write(`${name}.keystore`, contents);
-		}
-		return {
-			storeFile,
-			storePassword: storePassword.value,
-			keyAlias: keyAlias.value,
-			keyPassword: keyPassword.value
-		};
-	},
-	"play-service-account": async ([serviceAccount]) => {
-		const json = serviceAccount.name === "HOT_UPDATER_PLAY_SERVICE_ACCOUNT_PATH" ? await fs$2.readFile(await readFileField("play-service-account", serviceAccount), "utf-8") : serviceAccount.value;
-		const parsed = parseServiceAccount(json);
-		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new CredentialUnavailableError("play-service-account", `${serviceAccount.name} is not a service account JSON object.`);
-		return { json };
-	}
-};
-/** Fields of a service account that are no secret: its type and Google's endpoints. */
-/**
-* Fields of a JSON credential that identify it rather than grant access:
-* its IDs, key alias, and a service account's email, project, type, and
-* Google's endpoints. They stay readable, as messages name them, and a
-* short one, such as the alias `release`, would mask every word it is in.
-*/
-const isIdentifierField = (field) => [
-	"keyId",
-	"issuerId",
-	"keyAlias",
-	"type",
-	"project_id",
-	"client_email",
-	"client_id",
-	"private_key_id",
-	"universe_domain"
-].includes(field) || field.endsWith("_uri") || field.endsWith("_url");
-const registerJsonSecrets = (value, fields) => {
-	registerSecretValue(value);
-	for (const [field, entry] of Object.entries(fields)) if (typeof entry === "string" && !isIdentifierField(field)) registerSecretValue(entry);
-};
-/**
-* Masks a credential's JSON value in the CLI's output: the whole value, and
-* each field but those that identify it, such as `keyId` and `keyAlias`,
-* so a password or a key a log prints alone stays masked. A value that is
-* no JSON object is masked whole.
-*/
-const registerCredentialValue = (value) => {
-	const parsed = parseObject(value);
-	if (parsed) registerJsonSecrets(value, parsed);
-	else registerSecretValue(value);
-};
-const parseObject = (value) => {
-	const parsed = parseServiceAccount(value);
-	return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
-};
-/**
-* The fields of a JSON credential, each a non-empty string, or an error
-* naming the shape `kind` takes.
-*/
-const readJsonFields = (kind, item, value, fields) => {
-	const parsed = parseObject(value);
-	const shape = `{${fields.map((field) => `"${field}"`).join(", ")}}`;
-	if (!parsed) throw new CredentialUnavailableError(kind, `${item} is not a JSON object.\n${capitalize(aKind(kind))} is one JSON value: ${shape}`);
-	registerJsonSecrets(value, parsed);
-	const missing = fields.filter((field) => typeof parsed[field] !== "string" || !parsed[field]);
-	if (missing.length > 0) throw new CredentialUnavailableError(kind, `${item} has no ${missing.join(", ")}.\n${capitalize(aKind(kind))} is one JSON value: ${shape}`);
-	return parsed;
-};
-const aKind = (kind) => `${/^[aeiou]/u.test(kind) ? "an" : "a"} ${kind}`;
-const capitalize = (text) => text.charAt(0).toUpperCase() + text.slice(1);
-/** A base64 value's bytes, or undefined when it is not base64. */
-const decodeBase64 = (value) => {
-	const base64 = value.replace(/\s/g, "");
-	const contents = Buffer.from(base64, "base64");
-	return contents.length > 0 && contents.toString("base64").replace(/=+$/, "") === base64.replace(/=+$/, "") ? contents : void 0;
-};
-/**
-* Each kind from the one string a secrets adapter holds for it: a JSON
-* object for the App Store Connect key (`p8` is the PEM) and the keystore
-* (`keystore` is base64), and the service account's own JSON. File values
-* are written with `files`; every value is masked.
-*/
-const fromSecretValue = {
-	"asc-api-key": async (value, { files, item }) => {
-		const { keyId, issuerId, p8 } = readJsonFields("asc-api-key", item, value, [
-			"keyId",
-			"issuerId",
-			"p8"
-		]);
-		return {
-			keyPath: await files.write(`AuthKey_${keyId}.p8`, p8.includes("\n") ? p8 : p8.replaceAll("\\n", "\n")),
-			keyId,
-			issuerId
-		};
-	},
-	"android-keystore": async (value, { files, name, item }) => {
-		const { keystore, storePassword, keyAlias, keyPassword } = readJsonFields("android-keystore", item, value, [
-			"keystore",
-			"storePassword",
-			"keyAlias",
-			"keyPassword"
-		]);
-		const contents = decodeBase64(keystore);
-		if (!contents) throw new CredentialUnavailableError("android-keystore", `${item}'s keystore is not a base64-encoded keystore.`);
-		return {
-			storeFile: await files.write(`${name}.keystore`, contents),
-			storePassword,
-			keyAlias,
-			keyPassword
-		};
-	},
-	"play-service-account": async (value, { item }) => {
-		const parsed = parseObject(value);
-		if (!parsed) throw new CredentialUnavailableError("play-service-account", `${item} is not a service account JSON object.`);
-		registerJsonSecrets(value, parsed);
-		return { json: value };
-	}
-};
-const registerCredentialSecrets = (kind, credential) => {
-	if (kind === "android-keystore") {
-		const keystore = credential;
-		registerSecretValue(keystore.storePassword);
-		registerSecretValue(keystore.keyPassword);
-	}
-	if (kind === "play-service-account") {
-		const { json } = credential;
-		registerSecretValue(json);
-		const privateKey = parseServiceAccount(json)?.private_key;
-		if (typeof privateKey === "string") registerSecretValue(privateKey);
-	}
-};
-/**
-* Reads names from `secrets`, the names asked for in one turn of the event
-* loop, such as a build's credentials, in one `get`. Nothing is cached.
-*/
-const createSecretLoader = (secrets, cwd) => {
-	let batch;
-	const flush = async (names) => {
-		try {
-			const read = await secrets().get([...names.keys()], { cwd: cwd() });
-			for (const [name, waiters] of names) {
-				const value = Object.hasOwn(read, name) ? read[name] : void 0;
-				for (const waiter of waiters) waiter.resolve(typeof value === "string" && value ? value : void 0);
-			}
-		} catch (error) {
-			for (const waiters of names.values()) for (const waiter of waiters) waiter.reject(error);
-		}
-	};
-	return (name) => new Promise((resolve, reject) => {
-		if (batch === void 0) {
-			const names = /* @__PURE__ */ new Map();
-			batch = names;
-			setTimeout(() => {
-				batch = void 0;
-				flush(names);
-			}, 0);
-		}
-		const waiters = batch.get(name) ?? [];
-		waiters.push({
-			resolve,
-			reject
-		});
-		batch.set(name, waiters);
-	});
-};
-/**
-* Resolves each item from its environment overrides when any is set, and
-* otherwise from the config's `secrets` adapter as one value named by the
-* item, so overrides never reach the store. When the adapter fails or holds
-* no such value, the error names the environment variables that can
-* provide the item instead. Nothing is cached, values are never written to
-* disk except as 0600 temporary files, are never set in `process.env`, and
-* every secret is masked in logs.
-*/
-const createCredentialResolver = ({ env = {}, secrets, cwd } = {}) => {
-	const files = createCredentialFiles();
-	const resolved = /* @__PURE__ */ new Map();
-	let disposal;
-	const adapter = () => typeof secrets === "function" ? secrets() : secrets ?? getConfiguredSecrets();
-	const load = createSecretLoader(adapter, () => cwd ?? getCwd());
-	const resolveItem = async (kind, name) => {
-		const fields = CREDENTIAL_ENV_NAMES[kind];
-		const values = fields.map((field) => readEnvField(env, field));
-		if (values.some((value) => value !== void 0)) {
-			const missing = fields.filter((_, index) => !values[index]);
-			if (missing.length > 0) throw new CredentialUnavailableError(kind, `The environment overrides ${kind} but ${describeFields(missing)} ${missing.length === 1 ? "is" : "are"} not set.`);
-			const credential = await fromEnv[kind](values, {
-				files,
-				name
-			});
-			registerCredentialSecrets(kind, credential);
-			return credential;
-		}
-		const store = adapter();
-		const item = name === kind ? kind : `${name} (${kind})`;
-		let value;
-		try {
-			value = await load(name);
-		} catch (error) {
-			const reason = error instanceof Error ? error.message : String(error);
-			throw new CredentialUnavailableError(kind, `Couldn't read ${item} from the ${store.name} secrets adapter.\n${reason}`, { cause: error });
-		}
-		if (value === void 0) throw new CredentialUnavailableError(kind, kind === "android-keystore" ? describeMissingKeystore(store, item, name) : `No ${item} in the ${store.name} secrets adapter.\nStore it once with:\n${formatCommand(credentialStoreCommand(kind, name))}`);
-		registerSecretValue(value);
-		return fromSecretValue[kind](value, {
-			files,
-			name,
-			item: `The ${store.name} secrets adapter's ${item}`
-		});
-	};
-	return {
-		resolve: ({ kind, name = kind }) => {
-			if (disposal) return Promise.reject(/* @__PURE__ */ new Error("The credential resolver has been disposed."));
-			const key = `${kind}\u0000${name}`;
-			let pending = resolved.get(key);
-			if (!pending) {
-				pending = resolveItem(kind, name);
-				resolved.set(key, pending);
-				pending.catch(() => resolved.delete(key));
-			}
-			return pending;
-		},
-		dispose: () => {
-			disposal ??= (async () => {
-				await Promise.allSettled(resolved.values());
-				resolved.clear();
-				await files.dispose();
-			})();
-			return disposal;
-		}
-	};
-};
-/**
-* Runs `run` with a credential resolver and deletes its temporary files
-* when `run` settles.
-*/
-const withCredentialResolver = async (run, options) => {
-	const resolver = createCredentialResolver(options);
-	try {
-		return await run(resolver);
-	} finally {
-		await resolver.dispose();
-	}
-};
-//#endregion
 //#region src/isObject.ts
 const isObject$2 = (value) => {
 	return !!value && value.constructor === Object;
@@ -45557,19 +45655,6 @@ const MANAGED_HELPER_NAMES = /* @__PURE__ */ new Set([
 	"deploySecrets",
 	"storageSecrets"
 ]);
-/**
-* `const <name> = secretEnv([...names])`, a helper a managed config reads
-* credentials with: from the environment and `.env.hotupdater` first, then
-* from the config's `secrets` adapter. `storageSecrets` and
-* `databaseSecrets` read each adapter's own, so a command that reaches only
-* one needs only its credentials; `deploySecrets` reads what both share.
-* Its builder imports `secretEnv` from `hot-updater`.
-*/
-const secretEnvHelper = (name, names) => ({
-	name,
-	strategy: "replace",
-	code: `const ${name} = secretEnv([\n${names.map((variable) => `  ${JSON.stringify(variable)},`).join("\n")}\n]);`
-});
 const KNOWN_BUILD_CALLEES = /* @__PURE__ */ new Set([
 	"bare",
 	"expo",
@@ -45646,13 +45731,16 @@ const isHotUpdaterEnvRead = (expression) => {
 	const read = expression.type === "TSNonNullExpression" ? expression.expression : expression;
 	return read.type === "MemberExpression" && !read.computed && read.property.type === "Identifier" && read.property.name.startsWith("HOT_UPDATER_") && read.object.type === "MemberExpression" && !read.object.computed && read.object.object.type === "Identifier" && read.object.object.name === "process" && read.object.property.type === "Identifier" && read.object.property.name === "env";
 };
+/** `secret("<name>")`, the credential init writes. */
+const isSecretCall = (expression) => expression.type === "CallExpression" && expression.callee.type === "Identifier" && expression.callee.name === "secret" && expression.arguments.length === 1 && expression.arguments[0]?.type === "Literal" && typeof expression.arguments[0].value === "string";
 /**
 * A value init writes into a managed adapter's options: a string, a
-* `process.env.HOT_UPDATER_*` read, as configs of 1.1 read every value, or
-* an object of only those, such as `credentials`. Init replaces it with
-* what its run resolves; any other value is the project's own and kept.
+* `process.env.HOT_UPDATER_*` read, as configs of 1.1 read every value, a
+* `secret("<name>")`, or an object of only those, such as `credentials`.
+* Init replaces it with what its run resolves; any other value is the
+* project's own and kept.
 */
-const isInitWrittenValue = (expression) => expression.type === "Literal" && typeof expression.value === "string" || isHotUpdaterEnvRead(expression) || expression.type === "ObjectExpression" && expression.properties.length > 0 && expression.properties.every((property) => isDataProperty(property) && isInitWrittenValue(property.value));
+const isInitWrittenValue = (expression) => expression.type === "Literal" && typeof expression.value === "string" || isHotUpdaterEnvRead(expression) || isSecretCall(expression) || expression.type === "ObjectExpression" && expression.properties.length > 0 && expression.properties.every((property) => isDataProperty(property) && isInitWrittenValue(property.value));
 const dedentBlock = (text) => {
 	const lines = text.replace(/\s+$/, "").split("\n");
 	const indents = lines.filter((line) => line.trim() !== "").map((line) => line.match(/^\s*/)?.[0].length ?? 0);
@@ -46217,6 +46305,22 @@ const readTextFile = (filePath) => fs$1.readFile(filePath, "utf-8").catch((error
 * existing config with the scaffold's build, storage, database, plugins, and
 * helpers merged in, keeping the project's own settings.
 */
+/**
+* Whether `hot-updater.config.ts` in `cwd` sets a team `secrets` adapter,
+* read from its text: a `secrets` property other than `localSecrets(...)`,
+* or a config whose shape init can't read. False without the file. Init
+* reads the store through the loaded config, so one that sets a store but
+* doesn't load must be fixed first.
+*/
+const configSetsTeamSecrets = async (cwd) => {
+	const text = await readTextFile(path.join(cwd, HOT_UPDATER_CONFIG_PATH));
+	if (text === null) return false;
+	const source = parseConfigSource(text);
+	const config = source && findDefineConfigObject(source);
+	if (!config) return true;
+	const secrets = findAnyProperty(config.objectExpression, "secrets");
+	return secrets !== null && getCallCallee(secrets.value) !== "localSecrets";
+};
 const writeHotUpdaterConfig = async (scaffold, filePath = HOT_UPDATER_CONFIG_PATH) => {
 	const existingText = await readTextFile(filePath);
 	if (existingText === null) {
@@ -46272,6 +46376,75 @@ const writeHotUpdaterFiles = async (scaffold, { cwd = process.cwd(), settings })
 	].join("\n"));
 	return { config };
 };
+/**
+* The config text with `signing: secret("<name>")` added, and `secret` in
+* its `hot-updater` import, once. A config that sets `signing` in any form,
+* such as 1.1's `{ enabled: true, privateKeyPath }`, is kept.
+*/
+const addSigningSecretToConfigText = (text, name) => {
+	const source = parseConfigSource(text);
+	const config = source && findDefineConfigObject(source);
+	if (!source || !config) return { status: "unsupported" };
+	const { objectExpression } = config;
+	if (objectExpression.properties.some((property) => property.type === "SpreadElement" || getObjectPropertyName(property) === "signing")) return { status: "kept" };
+	const edits = [];
+	const property = `signing: secret(${JSON.stringify(name)})`;
+	const last = objectExpression.properties.at(-1);
+	if (!last) edits.push({
+		start: objectExpression.start,
+		end: objectExpression.end,
+		text: `{\n  ${property},\n}`
+	});
+	else {
+		const lineStart = text.lastIndexOf("\n", last.start) + 1;
+		const indent = /^[ \t]*/u.exec(text.slice(lineStart, last.start))[0];
+		const between = text.slice(last.end, objectExpression.end - 1);
+		const comma = /^\s*,/u.exec(between);
+		let at = last.end + (comma?.[0].length ?? 0);
+		const lineEnd = text.indexOf("\n", at);
+		if (lineEnd !== -1 && text.slice(at, lineEnd).trim().startsWith("//")) at = lineEnd;
+		edits.push({
+			start: at,
+			end: at,
+			text: `\n${indent}${property},`
+		});
+		if (!comma) edits.push({
+			start: last.end,
+			end: last.end,
+			text: ","
+		});
+	}
+	const hotUpdaterImports = importDeclarationsOf(source).filter((declaration) => declaration.source.value === "hot-updater" && declaration.importKind !== "type");
+	if (!hotUpdaterImports.some((declaration) => declaration.specifiers.some((specifier) => specifier.type === "ImportSpecifier" && specifier.local.name === "secret"))) {
+		const named = hotUpdaterImports.find((declaration) => declaration.specifiers.some((specifier) => specifier.type === "ImportSpecifier"));
+		const lastSpecifier = named?.specifiers.at(-1);
+		edits.push(named && lastSpecifier ? {
+			start: lastSpecifier.end,
+			end: lastSpecifier.end,
+			text: ", secret"
+		} : {
+			start: 0,
+			end: 0,
+			text: "import { secret } from \"hot-updater\";\n"
+		});
+	}
+	return {
+		status: "added",
+		text: applyTextEdits(text, edits)
+	};
+};
+/**
+* Adds `signing: secret("<name>")` to `hot-updater.config.ts` in `cwd`, as
+* `addSigningSecretToConfigText` does. Without the file, nothing is written.
+*/
+const addSigningSecretToConfig = async (cwd, name) => {
+	const filePath = path.join(cwd, HOT_UPDATER_CONFIG_PATH);
+	const text = await readTextFile(filePath);
+	if (text === null) return "missing";
+	const result = addSigningSecretToConfigText(text, name);
+	if (result.status === "added") await fs$1.writeFile(filePath, result.text, "utf-8");
+	return result.status;
+};
 //#endregion
 //#region src/infrastructureGeneration.ts
 const assertInfrastructureGenerationPayload = ({ payload, provider, resource }) => {
@@ -47105,8 +47278,8 @@ const loadConfigFile = async () => {
 };
 /**
 * The config `options` select, resolved: a config function runs in a scope
-* of its own, so the `secretEnv` it creates reads this config's `secrets`,
-* and the file's top-level `secretEnv` reads the first config's.
+* of its own, so the `secret()` it creates reads this config's `secrets`,
+* and the file's top-level `secret()` reads the first config's.
 */
 const configFor = async ({ source, scope: fileScope }, options) => {
 	if (typeof source !== "function") return resolveConfig(source, [fileScope]);
@@ -47134,31 +47307,48 @@ const loadPlatformConfigs = async (platforms, { channel }) => {
 	return configs;
 };
 /**
+* The names the config's build credentials reference, which the CLI reads
+* for their kind: `signing`'s, and each scheme's
+* `signing.ascApiKey` and `signing.keystore`.
+*/
+const buildSecretNames = (config) => {
+	return [
+		bundleSigningSecretRef(config.signing),
+		...Object.values(config.nativeBuild?.ios ?? {}).map((scheme) => scheme?.signing?.ascApiKey),
+		...Object.values(config.nativeBuild?.android ?? {}).map((scheme) => scheme?.signing?.keystore)
+	].filter(isSecretRef).map(({ name }) => name);
+};
+/**
 * The config with its defaults. Its `secrets` adapter fills `scopes` not yet
-* filled, which the `secretEnv` its evaluation created read, and becomes the
+* filled, which the `secret()` its evaluation created read, and becomes the
 * default of credential resolvers.
 */
 const resolveConfig = (config, scopes) => {
 	const mergedConfig = mergeConfigSources(config, getDefaultConfig());
 	const secrets = resolveSecretsAdapter(mergedConfig.secrets);
-	const signing = normalizeSigningConfig(mergedConfig.signing, { secrets });
-	for (const scope of scopes) scope.secrets ??= secrets;
+	const buildNames = buildSecretNames(mergedConfig);
+	for (const scope of scopes) {
+		scope.secrets ??= secrets;
+		scope.buildNames ??= /* @__PURE__ */ new Set();
+		for (const name of buildNames) scope.buildNames.add(name);
+	}
 	setConfiguredSecrets(secrets);
 	const resolved = {
 		...mergedConfig,
-		signing,
 		secrets
 	};
-	Object.defineProperty(resolved, SECRET_ENV_NAMES, { value: [...new Set(scopes.flatMap((scope) => [...scope.names ?? []]))] });
+	Object.defineProperty(resolved, DEPLOY_SECRET_NAMES, { value: [...new Set(scopes.flatMap((scope) => [...scope.names ?? []]))].filter((name) => !buildNames.includes(name)) });
 	return resolved;
 };
-const SECRET_ENV_NAMES = Symbol.for("@hot-updater/cli-tools/secret-env-names");
+const DEPLOY_SECRET_NAMES = Symbol.for("@hot-updater/cli-tools/deploy-secret-names");
 /**
-* The names every `secretEnv` the config created while it loaded reads,
-* such as `HOT_UPDATER_CLOUDFLARE_API_TOKEN`, in the order it created them.
+* The names the config's `secret()`s reference for its adapters, such as
+* `HOT_UPDATER_CLOUDFLARE_API_TOKEN`, in the order the config created
+* them: every name but those of build credentials, which `doctor` lists
+* by field.
 */
-const getSecretEnvNames = (config) => {
-	const names = Reflect.get(config, SECRET_ENV_NAMES);
+const getDeploySecretNames = (config) => {
+	const names = Reflect.get(config, DEPLOY_SECRET_NAMES);
 	return Array.isArray(names) ? names : [];
 };
 //#endregion
@@ -47504,7 +47694,8 @@ const storeEnvFileSecrets = async (secrets, names, cwd, envFile) => {
 	const file = envFile === void 0 ? await readLoadedHotUpdaterEnv(cwd) : await readLoadedEnvFile(envFile, cwd);
 	const values = /* @__PURE__ */ new Map();
 	for (const name of names) {
-		const value = Object.hasOwn(file, name) ? file[name]?.trim() : void 0;
+		const variable = secretVariableName(name);
+		const value = Object.hasOwn(file, variable) ? file[variable]?.trim() : void 0;
 		if (value) values.set(name, value);
 	}
 	if (values.size === 0) return [];
@@ -47570,4 +47761,4 @@ function transformTemplate(templateString, values) {
 	return result;
 }
 //#endregion
-export { BuildFailedError, BuildLogger, CREDENTIAL_ENV_NAMES, CREDENTIAL_LOGIN_GROUPS, ConfigBuilder, CredentialUnavailableError, DEFAULT_SIGNING_KEY_SECRET, HOT_UPDATER_HOME_ENV, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, INTERFACE_FINGERPRINT_ENGINE, InitEnvFileError, InitError, LOCAL_SECRETS_NAME, LegacyInfrastructureError, MANAGED_CLIENT_CREDENTIAL_ENV, MissingInitInputsError, ServerDefinitionError, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, assertUnreservedEnv, autolinkingConfigCommand, banner, clientAuthOf, typedColors as colors, confirmInitInputPersistence, copyDirToTmp, createCredentialResolver, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createInterfaceFingerprint, createLocalSecretsStore, createLogWriter, createMigrator, createMinBundleId, createTarBrTargetFiles, createZip, credentialIssueCommand, credentialLoginCommand, credentialStoreCommand, decryptJson, defineInitProvider, describeSecret, describeStoredSecret, encryptJson, ensureInstallPackages, generateClientCredential, generateSchema, generatesSchema, getAndroidSdkPath, getBundleSigningPublicKey, getConfiguredAdapter, getConfiguredSecrets, getCwd, getHotUpdaterEnvValue, getHotUpdaterHome, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getLocalKeyFile, getLocalKeyStoreDir, getLocalSecretsStore, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getProjectKey, getReactNativeMetadatas, getSecretEnvNames, getStorageFileByteSize, isCI, isCodegenSpecFile, isReservedVariableName, isSecretName, isServerDefinition, keepsKeysOnThisMachine, link, loadConfig, loadPlatformConfigs, loadTeamSecrets, localSecrets, log, makeEnv, maskSecretValues, moduleSpecifiersOf, nonInteractiveReason, p, parseLoadedEnv, parseSecretReference, prepareBundleSigning, printAppSetup, printBanner, provisionClientCredential, putStorageFile, reactNativeCliFingerprint, reactNativeConfigCommand, readBundleSigningPublicKeyFile, readHotUpdaterInitEnv, readLoadedEnvFile, readLoadedHotUpdaterEnv, readLocalKey, readMissingFromTeamSecrets, readPackageUp, readReactNativeInterface, readSecretVariables, readSecretWithSource, readSecrets, registerCredentialValue, registerSecretValue, renderAppImports, renderAppSetup, renderImportStatements, resolveExpoAutolinking, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolveLocalSecretsPath, resolvePackageVersion, resolveSecretsAdapter, secretEnv, secretEnvHelper, secretVariableName, serverDefinitionOf, setConfiguredSecrets, shouldAutoSelectOnlyInitResource, storeEnvFileSecrets, stripAnsi, transformEnv, transformTemplate, withCredentialResolver, withSecretsScope, writeHotUpdaterConfig, writeHotUpdaterFiles, writeLocalKey };
+export { BUNDLE_SIGNING_KEY_SECRET, BuildFailedError, BuildLogger, BundleSigningKeyError, CREDENTIAL_ENV_NAMES, CREDENTIAL_LOGIN_GROUPS, ConfigBuilder, CredentialUnavailableError, HOT_UPDATER_HOME_ENV, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, INTERFACE_FINGERPRINT_ENGINE, INVALID_SIGNING_MESSAGE, INVALID_SIGNING_NEXT_STEP, ISSUE_SIGNING_KEY_COMMAND, InitEnvFileError, InitError, LOCAL_SECRETS_NAME, LegacyInfrastructureError, MANAGED_CLIENT_CREDENTIAL_ENV, MissingInitInputsError, PUT_SIGNING_KEY_COMMAND, ServerDefinitionError, UNSIGNED_BUNDLES_NEXT_STEP, UNSIGNED_BUNDLES_WARNING, addSigningSecretToConfig, addSigningSecretToConfigText, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, assertUnreservedEnv, autolinkingConfigCommand, banner, bundleSigningSecretRef, clientAuthOf, typedColors as colors, configSetsTeamSecrets, confirmInitInputPersistence, copyDirToTmp, createCredentialResolver, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createInterfaceFingerprint, createLocalSecretsStore, createLogWriter, createMigrator, createMinBundleId, createStep, createTarBrTargetFiles, createZip, credentialIssueCommand, credentialLoginCommand, credentialPutCommand, credentialStoreCommand, decryptJson, defineInitProvider, describeSecret, describeStoredSecret, encryptJson, ensureInstallPackages, failActiveStep, formatCommand, formatDuration, generateClientCredential, generateSchema, generatesSchema, getAndroidSdkPath, getBundleSigningPublicKey, getConfiguredAdapter, getConfiguredSecrets, getCwd, getDeploySecretNames, getHotUpdaterEnvValue, getHotUpdaterHome, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getLocalKeyFile, getLocalKeyStoreDir, getLocalSecretsStore, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getProjectKey, getReactNativeMetadatas, getStorageFileByteSize, isCI, isCodegenSpecFile, isReservedVariableName, isSecretName, isSecretRef, isServerDefinition, keepsKeysOnThisMachine, link, loadConfig, loadPlatformConfigs, loadTeamSecrets, localSecrets, log, makeEnv, maskSecretValues, moduleSpecifiersOf, nonInteractiveReason, p, parseLoadedEnv, parseSecretReference, prepareBundleSigning, printAppSetup, printBanner, provisionClientCredential, putStorageFile, reactNativeCliFingerprint, reactNativeConfigCommand, readBundleSigningPublicKeyFile, readBundleSigningState, readHotUpdaterInitEnv, readLoadedEnvFile, readLoadedHotUpdaterEnv, readLocalKey, readMissingFromTeamSecrets, readPackageUp, readReactNativeInterface, readSecretVariables, readSecretWithSource, readSecrets, registerCredentialValue, registerSecretValue, renderAppImports, renderAppSetup, renderImportStatements, resolveExpoAutolinking, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolveLocalSecretsPath, resolvePackageVersion, resolveSecretsAdapter, secret, secretVariableName, serverDefinitionOf, setConfiguredSecrets, shouldAutoSelectOnlyInitResource, startStep, storeEnvFileSecrets, stripAnsi, transformEnv, transformTemplate, truncateLine, withCredentialResolver, withDuration, withSecretsScope, withStep, writeHotUpdaterConfig, writeHotUpdaterFiles, writeLocalKey };