@hot-updater/cli-tools 1.2.0-rc.8 → 1.2.0-rc.9

package/dist/index.mjs

@@ -25310,6 +25310,103 @@ const printBanner = (version) => {
 	console.log(banner(version));
 };
 //#endregion
+//#region src/credentialEnvNames.ts
+/**
+* The environment variables that override each kind, one entry per field.
+* A field with two names takes a file path or the file's contents; the path
+* wins when both are set.
+*/
+const CREDENTIAL_ENV_NAMES = {
+	"asc-api-key": [
+		["HOT_UPDATER_ASC_KEY_PATH", "HOT_UPDATER_ASC_KEY"],
+		["HOT_UPDATER_ASC_KEY_ID"],
+		["HOT_UPDATER_ASC_ISSUER_ID"]
+	],
+	"android-keystore": [
+		["HOT_UPDATER_ANDROID_KEYSTORE_PATH", "HOT_UPDATER_ANDROID_KEYSTORE_BASE64"],
+		["HOT_UPDATER_ANDROID_KEYSTORE_PASSWORD"],
+		["HOT_UPDATER_ANDROID_KEY_ALIAS"],
+		["HOT_UPDATER_ANDROID_KEY_PASSWORD"]
+	],
+	"play-service-account": [["HOT_UPDATER_PLAY_SERVICE_ACCOUNT_PATH", "HOT_UPDATER_PLAY_SERVICE_ACCOUNT_JSON"]]
+};
+//#endregion
+//#region src/credentialFiles.ts
+const TERMINATION_SIGNALS = [
+	"SIGHUP",
+	"SIGINT",
+	"SIGTERM"
+];
+const liveDirectories = /* @__PURE__ */ new Set();
+const onSignal = (signal) => {
+	removeLiveDirectories();
+	if (process.listenerCount(signal) === 0) process.kill(process.pid, signal);
+};
+const removeLiveDirectories = () => {
+	for (const directory of liveDirectories) rmSync(directory, {
+		force: true,
+		recursive: true
+	});
+	liveDirectories.clear();
+	stopListening();
+};
+const startListening = () => {
+	process.on("exit", removeLiveDirectories);
+	for (const signal of TERMINATION_SIGNALS) process.on(signal, onSignal);
+};
+const stopListening = () => {
+	process.off("exit", removeLiveDirectories);
+	for (const signal of TERMINATION_SIGNALS) process.off(signal, onSignal);
+};
+const trackDirectory = (directory) => {
+	if (liveDirectories.size === 0) startListening();
+	liveDirectories.add(directory);
+};
+const untrackDirectory = (directory) => {
+	if (liveDirectories.delete(directory) && liveDirectories.size === 0) stopListening();
+};
+/**
+* Creates the temporary files of one credential resolver: a `mkdtemp`
+* directory, created on the first write and removed by `dispose` or, if the
+* process exits first, on `exit` or a termination signal.
+*/
+const createCredentialFiles = () => {
+	let directory;
+	let disposal;
+	const ensureDirectory = () => {
+		directory ??= fs$2.mkdtemp(path$1.join(os.tmpdir(), "hot-updater-credentials-")).then((created) => {
+			trackDirectory(created);
+			return created;
+		});
+		return directory;
+	};
+	return {
+		write: async (fileName, contents) => {
+			if (disposal) throw new Error("The credential files have been disposed.");
+			if (typeof contents === "string") registerSecretValue(contents);
+			const fileDirectory = await fs$2.mkdtemp(path$1.join(await ensureDirectory(), "item-"));
+			const filePath = path$1.join(fileDirectory, path$1.basename(fileName));
+			await fs$2.writeFile(filePath, contents, {
+				flag: "wx",
+				mode: 384
+			});
+			return filePath;
+		},
+		dispose: () => {
+			disposal ??= (async () => {
+				const created = await directory?.catch(() => void 0);
+				if (!created) return;
+				await fs$2.rm(created, {
+					force: true,
+					recursive: true
+				});
+				untrackDirectory(created);
+			})();
+			return disposal;
+		}
+	};
+};
+//#endregion
 //#region src/initOptions.ts
 var InitError = class extends Error {
 	name = "InitError";
@@ -25535,7 +25632,7 @@ const assertPrivateDirectory = async (directory) => {
 		if (isMissing(error)) return void 0;
 		throw error;
 	});
-	if (stats && !stats.isDirectory()) throw new Error(`localSecrets() keeps secrets in a directory, and ${directory} is not one. Set its path to a directory.`);
+	if (stats && !stats.isDirectory()) throw new Error([`localSecrets() can't keep secrets in ${directory}.`, "It is not a directory: set its path to one."].join("\n"));
 	const real = realpathThroughParents(directory);
 	let probe = real;
 	while (!existsSync(probe) && path$1.dirname(probe) !== probe) probe = path$1.dirname(probe);
@@ -25543,7 +25640,11 @@ const assertPrivateDirectory = async (directory) => {
 	if (!root) return;
 	const top = realpath(root);
 	if (isIgnoredByGit(top, real)) return;
-	throw new Error(`localSecrets() refuses ${directory}: it is in the git repository ${top}, which does not ignore it, so the secrets in it could be committed. Add ${path$1.relative(top, real).split(path$1.sep).join("/")}/ to that repository's .gitignore, or keep the secrets outside it with localSecrets({ path }).`);
+	throw new Error([
+		`localSecrets() refuses ${directory}: its secrets could be committed.`,
+		`The git repository ${top} doesn't ignore it.`,
+		`Add ${path$1.relative(top, real).split(path$1.sep).join("/")}/ to its .gitignore, or set localSecrets({ path }).`
+	].join("\n"));
 };
 /** Makes `directory` 0700, and every directory it creates on the way. */
 const makePrivateDirectory = async (directory) => {
@@ -25611,27 +25712,6 @@ const readLocalKey = (name, cwd) => defaultStore.read(name, cwd);
 /** Stores `value` as `name` in `localSecrets()`'s default store. */
 const writeLocalKey = (name, value, cwd) => defaultStore.write(name, value, cwd);
 //#endregion
-//#region src/credentialEnvNames.ts
-/**
-* The environment variables that override each kind, one entry per field.
-* A field with two names takes a file path or the file's contents; the path
-* wins when both are set.
-*/
-const CREDENTIAL_ENV_NAMES = {
-	"asc-api-key": [
-		["HOT_UPDATER_ASC_KEY_PATH", "HOT_UPDATER_ASC_KEY"],
-		["HOT_UPDATER_ASC_KEY_ID"],
-		["HOT_UPDATER_ASC_ISSUER_ID"]
-	],
-	"android-keystore": [
-		["HOT_UPDATER_ANDROID_KEYSTORE_PATH", "HOT_UPDATER_ANDROID_KEYSTORE_BASE64"],
-		["HOT_UPDATER_ANDROID_KEYSTORE_PASSWORD"],
-		["HOT_UPDATER_ANDROID_KEY_ALIAS"],
-		["HOT_UPDATER_ANDROID_KEY_PASSWORD"]
-	],
-	"play-service-account": [["HOT_UPDATER_PLAY_SERVICE_ACCOUNT_PATH", "HOT_UPDATER_PLAY_SERVICE_ACCOUNT_JSON"]]
-};
-//#endregion
 //#region src/reservedVariables.ts
 /**
 * Variables that change how a process loads code or which credentials Hot
@@ -25883,8 +25963,8 @@ const list$1 = (names) => names.length <= 2 ? names.join(" and ") : `${names.sli
 * });
 */
 const secret = (name) => {
-	if (typeof name !== "string" || !isSecretName(name)) throw new Error(`secret() takes up to 64 letters, digits, ".", "_", and "-", starting with a letter or digit, and ${JSON.stringify(name)} is not that.`);
-	if (isReservedVariableName(name)) throw new Error(`secret() refuses ${name}: it changes how a process loads code or which credentials Hot Updater uses.`);
+	if (typeof name !== "string" || !isSecretName(name)) throw new Error([`secret() can't take the name ${JSON.stringify(name)}.`, "Use up to 64 letters, digits, \".\", \"_\", \"-\"; start with a letter or digit."].join("\n"));
+	if (isReservedVariableName(name)) throw new Error([`secret() refuses ${name}.`, "It changes how a process loads code, or the credentials Hot Updater uses."].join("\n"));
 	const scope = globalThis[LOADING_SCOPE];
 	if (scope) (scope.names ??= /* @__PURE__ */ new Set()).add(name);
 	let read;
@@ -25914,7 +25994,11 @@ const readSecretRef = async (name, scope) => {
 		return fromEnv;
 	}
 	const secrets = getConfiguredAdapter(scope?.secrets ?? getConfiguredSecrets());
-	if (secrets === void 0) throw new Error(`secret("${name}") has no value: set ${variable} in the environment or .env.hotupdater, or set the config's secrets to a team store.`);
+	if (secrets === void 0) throw new Error([
+		`secret("${name}") has no value.`,
+		`Set ${variable} in the environment or .env.hotupdater.`,
+		"Or set the config's secrets to a team store."
+	].join("\n"));
 	let values;
 	if (scope) {
 		scope.read ??= readSecrets(secrets, batchedNames(scope, name, fileEnv), cwd).catch((error) => {
@@ -25925,690 +26009,1071 @@ const readSecretRef = async (name, scope) => {
 	}
 	if (!values || !Object.hasOwn(values, name)) values = await readSecrets(secrets, [name], cwd);
 	const value = Object.hasOwn(values, name) ? values[name] : void 0;
-	if (typeof value !== "string" || value === "") throw new Error(`secret("${name}") has no value: ${variable} is not set in the environment or .env.hotupdater, and the ${secrets.name} secrets adapter does not hold it (${describeSecret(secrets, name)}).`);
+	if (typeof value !== "string" || value === "") throw new Error([
+		`secret("${name}") has no value.`,
+		`It isn't in ${describeSecret(secrets, name)}.`,
+		`Store it there, or set ${variable}.`
+	].join("\n"));
 	registerSecretValue(value);
 	return value;
 };
 //#endregion
-//#region src/bundleSigning.ts
-/** The secret `signing: secret("bundle-signing-key")` names, which `secrets issue` creates. */
-const BUNDLE_SIGNING_KEY_SECRET = "bundle-signing-key";
-/** The command that creates and stores a bundle signing key. */
-const ISSUE_SIGNING_KEY_COMMAND = `npx hot-updater secrets issue ${BUNDLE_SIGNING_KEY_SECRET}`;
-/** The command that stores a bundle signing key you have. */
-const PUT_SIGNING_KEY_COMMAND = `npx hot-updater secrets put ${BUNDLE_SIGNING_KEY_SECRET} <key.pem>`;
-/** What deploy and doctor say when the config sets no `signing`. */
-const UNSIGNED_BUNDLES_WARNING = "Bundles are unsigned.";
-/** The next step after `UNSIGNED_BUNDLES_WARNING`. */
-const UNSIGNED_BUNDLES_NEXT_STEP = "To sign them, run:";
-/** What deploy and doctor say when `signing` is no shape it takes. */
-const INVALID_SIGNING_MESSAGE = `signing takes secret("${BUNDLE_SIGNING_KEY_SECRET}").`;
-/** The next step after `INVALID_SIGNING_MESSAGE`. */
-const INVALID_SIGNING_NEXT_STEP = "Store your key:";
-const invalid = (message) => ({
-	status: "invalid",
-	message
-});
-const LOCAL_FIELDS = [
-	"enabled",
-	"privateKeyPath",
-	"privateKey"
-];
-const readBundleSigningState = (signing) => {
-	if (signing === void 0) return { status: "unsigned" };
-	if (isSecretRef(signing)) return {
-		status: "on",
-		key: { secret: signing.name }
-	};
-	if (typeof signing !== "object" || signing === null || !Object.keys(signing).every((key) => LOCAL_FIELDS.includes(key))) return invalid(INVALID_SIGNING_MESSAGE);
-	const { enabled, privateKey, privateKeyPath } = signing;
-	if (enabled === false) return { status: "off" };
-	if (enabled !== true) return invalid(INVALID_SIGNING_MESSAGE);
-	if (privateKey !== void 0 && privateKeyPath !== void 0) return invalid("signing takes privateKey or privateKeyPath, not both.");
-	if (privateKey !== void 0) return isSecretRef(privateKey) ? {
-		status: "on",
-		key: { secret: privateKey.name }
-	} : invalid("signing.privateKey takes secret(\"<name>\").");
-	if (typeof privateKeyPath !== "string" || !privateKeyPath.trim()) return invalid("signing takes privateKeyPath, or privateKey as secret(\"<name>\").");
-	return {
-		status: "on",
-		key: { privateKeyPath }
-	};
-};
-/** The `secret()` the config's `signing` reads its private key from, if any. */
-const bundleSigningSecretRef = (signing) => {
-	if (isSecretRef(signing)) return signing;
-	const privateKey = typeof signing === "object" && signing !== null ? Reflect.get(signing, "privateKey") : void 0;
-	return isSecretRef(privateKey) ? privateKey : void 0;
+//#region src/credentialResolver.ts
+/** Passwords are read as set: trimming would change them. */
+const UNTRIMMED_ENV_NAMES = /* @__PURE__ */ new Set(["HOT_UPDATER_ANDROID_KEYSTORE_PASSWORD", "HOT_UPDATER_ANDROID_KEY_PASSWORD"]);
+const describeField = ([name, alternative]) => alternative ? `${name} (or ${alternative})` : name;
+const describeFields = (fields) => {
+	const described = fields.map(describeField);
+	if (described.length <= 2) return described.join(" and ");
+	return `${described.slice(0, -1).join(", ")}, and ${described.at(-1)}`;
 };
 /**
-* A bundle signing failure whose message the CLI prints as it is: it names
-* the secret and the next step, and quotes no key material.
+* A command to print, broken at spaces with ` \` once a line would pass
+* 74 columns, each continuation indented two spaces, so a terminal never
+* wraps it mid-word and it still pastes as one command.
 */
-var BundleSigningKeyError = class extends Error {
-	constructor(message, options) {
-		super(message, options);
-		this.name = "HotUpdaterBundleSigningKeyError";
-	}
-};
-const FILE_HASH_PATTERN = /^[a-f\d]{64}$/iu;
-const resolvePath = (cwd, filePath) => path$1.isAbsolute(filePath) ? filePath : path$1.resolve(cwd, filePath);
-const parseRsaPublicKey = (publicKeyPEM) => {
-	try {
-		const normalizedPublicKey = publicKeyPEM.trim();
-		if (!normalizedPublicKey.startsWith("-----BEGIN PUBLIC KEY-----") || !normalizedPublicKey.endsWith("-----END PUBLIC KEY-----")) throw new Error("not spki");
-		const publicKey = crypto$1.createPublicKey(normalizedPublicKey);
-		if (publicKey.asymmetricKeyType !== "rsa" || (publicKey.asymmetricKeyDetails?.modulusLength ?? 0) < 2048) throw new Error("not rsa");
-		return publicKey;
-	} catch {
-		throw new Error("Bundle signing public key must be a valid RSA SPKI PEM key with a modulus of at least 2048 bits.");
-	}
-};
-/** The SPKI PEM of `key`, a public key or the private key it derives from. */
-const exportPublicKey = (key) => (key.type === "private" ? crypto$1.createPublicKey(key) : key).export({
-	type: "spki",
-	format: "pem"
-}).toString();
-const readBundleSigningPublicKeyFile = async (publicKeyPath, options = {}) => {
-	if (!publicKeyPath.trim()) throw new Error("Bundle signing public key path is required.");
-	try {
-		const publicKeyPEM = await fs$2.readFile(resolvePath(options.cwd ?? getCwd(), publicKeyPath), "utf8");
-		return exportPublicKey(parseRsaPublicKey(publicKeyPEM));
-	} catch {
-		throw new Error("Failed to read the bundle signing public key file.");
-	}
-};
-const parsePrivateKey = (pem) => {
-	const privateKey = crypto$1.createPrivateKey(pem);
-	if (privateKey.asymmetricKeyType !== "rsa" || (privateKey.asymmetricKeyDetails?.modulusLength ?? 0) < 2048) throw new Error("not rsa");
-	return privateKey;
-};
-const loadPrivateKeyFile = async (file) => {
-	try {
-		return parsePrivateKey(await fs$2.readFile(file, "utf8"));
-	} catch {
-		throw new BundleSigningKeyError("Failed to load the bundle signing private key from privateKeyPath.");
+const formatCommand = (command) => {
+	const lines = [];
+	let line = "";
+	for (const word of command.split(" ")) {
+		const next = line ? `${line} ${word}` : word;
+		if (line && next.length > 72) {
+			lines.push(`${line} \\`);
+			line = `  ${word}`;
+		} else line = next;
 	}
+	lines.push(line);
+	return lines.join("\n");
 };
 /**
-* The private key the `secrets` adapter holds as `name`: masked in the CLI's
-* output before it is parsed, and kept only as a key object. A PEM written
-* on one line, with `\n` for its line breaks, as a `.env.hotupdater` value
-* or a CI variable may hold it, reads as the PEM.
+* `lead` and the command it names on one line when they fit 77 columns,
+* else the command on the lines after it.
 */
-const loadPrivateKeySecret = async (secrets, name, cwd) => {
-	let value;
-	try {
-		const read = await secrets.get([name], { cwd });
-		value = Object.hasOwn(read, name) ? read[name] : void 0;
-	} catch (error) {
-		const reason = error instanceof Error ? error.message : String(error);
-		throw new BundleSigningKeyError(`The ${secrets.name} secrets adapter could not read the bundle signing key ${name}: ${reason}`, { cause: error });
-	}
-	if (typeof value !== "string" || !value.trim()) {
-		const issue = `npx hot-updater secrets issue ${BUNDLE_SIGNING_KEY_SECRET}${name === "bundle-signing-key" ? "" : ` ${name}`}`;
-		throw new BundleSigningKeyError(`signing reads the bundle signing key ${name}, which is not in the ${secrets.name} secrets adapter (${describeSecret(secrets, name)}).\nTo create one, run: ${issue}`);
-	}
-	registerSecretValue(value);
-	const pem = value.includes("\n") ? value : value.replaceAll("\\n", "\n");
-	if (pem !== value) registerSecretValue(pem);
-	try {
-		return parsePrivateKey(pem);
-	} catch {
-		throw new BundleSigningKeyError(`The bundle signing key ${name} in the ${secrets.name} secrets adapter is not an RSA private key in PEM of at least 2048 bits.`);
-	}
+const withLead = (lead, command) => lead.length + 1 + command.length <= 77 ? `${lead} ${command}` : `${lead}\n${formatCommand(command)}`;
+/**
+* Why a build has no upload keystore, steering away from a second key:
+* Play rejects builds signed with a key it does not have. Under a team's
+* adapter the keystore is someone's already, so it is imported, never
+* created; only `localSecrets()` alone offers a new one, for an app with
+* no `.aab` on Play yet.
+*/
+const describeMissingKeystore = (store, item, name) => {
+	const configured = getConfiguredAdapter(store);
+	if (configured) return [
+		`No ${item} in ${describeSecret(configured, name)}.`,
+		"Ask whoever set it up to store it there, or import it with:",
+		formatCommand(credentialPutCommand("android-keystore", name))
+	].join("\n");
+	return [
+		`No ${item} in the ${store.name} secrets adapter.`,
+		withLead("Store the app's upload key:", credentialPutCommand("android-keystore", name)),
+		withLead("No .aab on Play yet? Create one:", credentialIssueCommand("android-keystore", name))
+	].join("\n");
+};
+/** The file each `secrets put <name> <file>` command names. */
+const PUT_FILES = {
+	"android-keystore": "<upload.jks>",
+	"play-service-account": "<key.json>"
 };
 /**
-* The private keys each `signing` value has read, by file or by secrets
-* adapter, so the commands of one run that sign and derive the public key
-* read the key once.
+* The command that stores the file you have as `name`: the service
+* account's JSON key, or the app's upload keystore. `--kind` is named only
+* for a name that is not the kind.
 */
-const privateKeys = /* @__PURE__ */ new WeakMap();
+const credentialPutCommand = (kind, name = kind) => `npx hot-updater secrets put ${name}${name === kind ? "" : ` --kind ${kind}`} ${PUT_FILES[kind]}`;
 /**
-* The private key `signing` signs with, or null when it signs nothing.
-* Throws `INVALID_SIGNING_MESSAGE`, with the next step, for a value
-* `signing` doesn't take.
+* The command that stores the key Hot Updater issues as `name`: an App
+* Store Connect API key after an Apple Account sign-in, and an upload
+* keystore it creates.
 */
-const loadSigningKey = (signing, { cwd = getCwd(), secrets }) => {
-	const state = readBundleSigningState(signing);
-	if (state.status === "invalid") throw new BundleSigningKeyError(`${state.message}\n${INVALID_SIGNING_NEXT_STEP} ${PUT_SIGNING_KEY_COMMAND}`);
-	if (state.status !== "on") return null;
-	const store = secrets ?? getConfiguredSecrets();
-	const cacheKey = "secret" in state.key ? store : resolvePath(cwd, state.key.privateKeyPath);
-	const cache = privateKeys.get(signing) ?? /* @__PURE__ */ new Map();
-	privateKeys.set(signing, cache);
-	const cached = cache.get(cacheKey);
-	if (cached) return cached;
-	const pending = ("secret" in state.key ? loadPrivateKeySecret(store, state.key.secret, cwd) : loadPrivateKeyFile(cacheKey)).catch((error) => {
-		cache.delete(cacheKey);
-		throw error;
-	});
-	cache.set(cacheKey, pending);
-	return pending;
-};
-const signingFailure = (summary, error) => new Error(error instanceof BundleSigningKeyError ? error.message : `${summary} ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+const credentialIssueCommand = (kind, name = kind) => `npx hot-updater secrets issue ${kind}${name === kind ? "" : ` ${name}`}`;
+/** The command group of each issued kind's shortcut, `<group> login`. */
+const CREDENTIAL_LOGIN_GROUPS = { "asc-api-key": "apple" };
 /**
-* Prepares the run's bundle signing: the public key the app must embed, and
-* a signer of SHA-256 file hashes that signs each hash once. Null when
-* `signing` is omitted or `{ enabled: false }`.
+* The command people meet first that issues `kind` as `name`: its shortcut,
+* `apple login` for an App Store Connect API key, which takes nothing and
+* stores the kind's own name; for another name, `credentialIssueCommand`.
 */
-const prepareBundleSigning = async (signing, options = {}) => {
-	const loading = loadSigningKey(signing, options);
-	if (!loading) return null;
-	let privateKey;
-	try {
-		privateKey = await loading;
-	} catch (error) {
-		throw signingFailure("Failed to read the bundle signing key.", error);
-	}
-	const signatures = /* @__PURE__ */ new Map();
-	return {
-		publicKey: exportPublicKey(privateKey),
-		signFileHash: async (fileHash) => {
-			if (!FILE_HASH_PATTERN.test(fileHash)) throw new Error("Bundle signing requires a 64-character hexadecimal file hash.");
-			const normalized = fileHash.toLowerCase();
-			const cached = signatures.get(normalized);
-			if (cached) return cached;
-			const signature = crypto$1.sign("RSA-SHA256", Buffer.from(normalized, "hex"), privateKey).toString("base64");
-			signatures.set(normalized, signature);
-			return signature;
-		}
-	};
-};
+const credentialLoginCommand = (kind, name = kind) => name === kind ? `npx hot-updater ${CREDENTIAL_LOGIN_GROUPS[kind]} login` : credentialIssueCommand(kind, name);
 /**
-* The public key of the configured bundle signing key, in SPKI PEM; null
-* when `signing` signs nothing.
+* The command that stores a missing credential of `kind` as `name`: the
+* key Hot Updater issues after an Apple sign-in, or the file you have.
 */
-const getBundleSigningPublicKey = async (signing, options = {}) => {
-	const loading = loadSigningKey(signing, options);
-	if (!loading) return null;
-	try {
-		return exportPublicKey(await loading);
-	} catch (error) {
-		throw signingFailure("Failed to read the bundle signing key.", error);
+const credentialStoreCommand = (kind, name = kind) => kind === "asc-api-key" ? credentialLoginCommand(kind, name) : credentialPutCommand(kind, name);
+var CredentialUnavailableError = class extends Error {
+	kind;
+	/** The environment variables that can provide this credential. */
+	envNames;
+	constructor(kind, message, options) {
+		super(message, options);
+		this.name = "CredentialUnavailableError";
+		this.kind = kind;
+		this.envNames = CREDENTIAL_ENV_NAMES[kind].flat();
 	}
 };
-//#endregion
-//#region src/ConfigBuilder.ts
-const normalizeImportInfos = (imports) => {
-	const collectedImports = /* @__PURE__ */ new Map();
-	for (const info of imports) {
-		const existing = collectedImports.get(info.pkg);
-		if (existing) {
-			if (info.named) for (const namedImport of info.named) existing.named.add(namedImport);
-			if (info.defaultOrNamespace && !existing.defaultOrNamespace) existing.defaultOrNamespace = info.defaultOrNamespace;
-			if (info.sideEffect && !existing.sideEffect) existing.sideEffect = true;
-			continue;
-		}
-		collectedImports.set(info.pkg, {
-			named: new Set(info.named ?? []),
-			defaultOrNamespace: info.defaultOrNamespace,
-			sideEffect: info.sideEffect ?? false
-		});
+const readEnvField = (env, field) => {
+	for (const name of field) {
+		const value = UNTRIMMED_ENV_NAMES.has(name) ? (process.env[name] ?? env[name]) || void 0 : getHotUpdaterEnvValue(env, name);
+		if (value !== void 0) return {
+			name,
+			value
+		};
 	}
-	return Array.from(collectedImports.entries()).sort(([a], [b]) => {
-		const isABuild = a.startsWith("@hot-updater/");
-		if (isABuild !== b.startsWith("@hot-updater/")) return isABuild ? -1 : 1;
-		const isAdminA = a === "firebase-admin";
-		if (isAdminA !== (b === "firebase-admin")) return isAdminA ? -1 : 1;
-		return a.localeCompare(b);
-	}).map(([pkg, info]) => ({
-		pkg,
-		named: Array.from(info.named).sort(),
-		defaultOrNamespace: info.defaultOrNamespace,
-		sideEffect: info.sideEffect ?? false
-	}));
 };
-const renderImportStatements = (imports) => {
-	const importLines = [];
-	for (const info of normalizeImportInfos(imports)) {
-		if (info.sideEffect) {
-			importLines.push(`import "${info.pkg}";`);
-			continue;
-		}
-		if (info.defaultOrNamespace) {
-			if (info.pkg === "firebase-admin" && (info.named?.length ?? 0) > 0) importLines.push(`import ${info.defaultOrNamespace}, { ${info.named.join(", ")} } from "${info.pkg}";`);
-			else importLines.push(`import ${info.defaultOrNamespace} from "${info.pkg}";`);
-			continue;
+const readFileField = async (kind, { name, value }) => {
+	const filePath = path$1.resolve(value);
+	if (!await fs$2.stat(filePath).then(async (stats) => {
+		await fs$2.access(filePath, fs$2.constants.R_OK);
+		return stats.isFile();
+	}).catch(() => false)) throw new CredentialUnavailableError(kind, `${name} does not point to a readable file.`);
+	return filePath;
+};
+const parseServiceAccount = (json) => {
+	try {
+		return JSON.parse(json);
+	} catch {
+		return;
+	}
+};
+const fromEnv = {
+	"asc-api-key": async ([key, keyId, issuerId], { files }) => ({
+		keyPath: key.name === "HOT_UPDATER_ASC_KEY_PATH" ? await readFileField("asc-api-key", key) : await files.write(`AuthKey_${keyId.value}.p8`, key.value.includes("\n") ? key.value : key.value.replaceAll("\\n", "\n")),
+		keyId: keyId.value,
+		issuerId: issuerId.value
+	}),
+	"android-keystore": async ([keystore, storePassword, keyAlias, keyPassword], { files, name }) => {
+		let storeFile;
+		if (keystore.name === "HOT_UPDATER_ANDROID_KEYSTORE_PATH") storeFile = await readFileField("android-keystore", keystore);
+		else {
+			registerSecretValue(keystore.value);
+			const contents = decodeBase64(keystore.value);
+			if (!contents) throw new CredentialUnavailableError("android-keystore", `${keystore.name} is not a base64-encoded keystore.`);
+			storeFile = await files.write(`${name}.keystore`, contents);
 		}
-		if ((info.named?.length ?? 0) > 0) importLines.push(`import { ${info.named.join(", ")} } from "${info.pkg}";`);
+		return {
+			storeFile,
+			storePassword: storePassword.value,
+			keyAlias: keyAlias.value,
+			keyPassword: keyPassword.value
+		};
+	},
+	"play-service-account": async ([serviceAccount]) => {
+		const json = serviceAccount.name === "HOT_UPDATER_PLAY_SERVICE_ACCOUNT_PATH" ? await fs$2.readFile(await readFileField("play-service-account", serviceAccount), "utf-8") : serviceAccount.value;
+		const parsed = parseServiceAccount(json);
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new CredentialUnavailableError("play-service-account", `${serviceAccount.name} is not a service account JSON object.`);
+		return { json };
 	}
-	return importLines.join("\n");
 };
+/** Fields of a service account that are no secret: its type and Google's endpoints. */
 /**
-* Renders the hot-updater.config.ts init writes: the build, the server's
-* storage, database, and plugins, and the deploy settings.
+* Fields of a JSON credential that identify it rather than grant access:
+* its IDs, key alias, and a service account's email, project, type, and
+* Google's endpoints. They stay readable, as messages name them, and a
+* short one, such as the alias `release`, would mask every word it is in.
 */
-var ConfigBuilder = class {
-	buildType = null;
-	storageInfo = null;
-	databaseInfo = null;
-	pluginsInfo = null;
-	intermediateCode = "";
-	imports = [{
-		pkg: "hot-updater",
-		named: ["defineConfig", "localSecrets"]
-	}, {
-		pkg: "node:fs",
-		named: ["existsSync"]
-	}];
-	/** Adds an import, such as a credentials helper's. */
-	addImport(info) {
-		this.imports.push(info);
-		return this;
-	}
-	generateBuildConfigString() {
-		if (!this.buildType) throw new Error("Build type must be set using .setBuildType()");
-		switch (this.buildType) {
-			case "bare": return "bare({ enableHermes: true })";
-			case "rock": return "rock()";
-			case "expo": return "expo()";
-			default: throw new Error(`Invalid build type: ${this.buildType}`);
-		}
-	}
-	/** Sets the build type ('bare', 'rock', or 'expo') and its import. */
-	setBuildType(buildType) {
-		this.buildType = buildType;
-		this.imports.push({
-			pkg: `@hot-updater/${buildType}`,
-			named: [buildType]
-		});
-		return this;
-	}
-	/** Sets the storage the CLI uploads to, which the server lists, and its imports. */
-	setStorage(storageConfig) {
-		this.storageInfo = storageConfig;
-		this.imports.push(...storageConfig.imports);
-		return this;
-	}
-	/** Sets the server's database and its imports. */
-	setDatabase(databaseConfig) {
-		this.databaseInfo = databaseConfig;
-		this.imports.push(...databaseConfig.imports);
-		return this;
-	}
-	/** Sets the server's plugin factory array and its imports. */
-	setPlugins(pluginsConfig) {
-		this.pluginsInfo = pluginsConfig;
-		this.imports.push(...pluginsConfig.imports);
-		return this;
-	}
-	/** Sets the code between the environment loading and the config, such as a credentials helper. */
-	setIntermediateCode(code) {
-		this.intermediateCode = code.trim();
-		return this;
-	}
-	getScaffold() {
-		if (!this.buildType) throw new Error("Build type must be set using .setBuildType()");
-		if (!this.storageInfo) throw new Error("Storage config must be set using .setStorage()");
-		if (!this.databaseInfo) throw new Error("Database config must be set using .setDatabase()");
-		if (!this.pluginsInfo) throw new Error("Plugins config must be set using .setPlugins()");
-		const imports = normalizeImportInfos(this.imports);
-		const buildConfigString = this.generateBuildConfigString();
-		const plugins = this.pluginsInfo.configString;
-		const text = `
-${renderImportStatements(imports)}
-
-if (existsSync(".env.hotupdater")) {
-  process.loadEnvFile(".env.hotupdater");
-}
-
-${this.intermediateCode ? `${this.intermediateCode}\n\n` : ""}export default defineConfig({
-  build: ${buildConfigString},
-  storage: ${this.storageInfo.configString},
-  database: ${this.databaseInfo.configString},
-  ${plugins === "plugins" ? "plugins" : `plugins: ${plugins}`},
-  secrets: localSecrets(),
-  updateStrategy: "appVersion", // or "fingerprint"
-});
-`.trim();
-		return {
-			imports,
-			buildConfigString,
-			storageConfigString: this.storageInfo.configString,
-			databaseConfigString: this.databaseInfo.configString,
-			pluginsConfigString: plugins,
-			intermediateCode: this.intermediateCode,
-			text
-		};
-	}
-	/** hot-updater.config.ts's text. */
-	getResult() {
-		return this.getScaffold().text;
-	}
+const isIdentifierField = (field) => [
+	"keyId",
+	"issuerId",
+	"keyAlias",
+	"type",
+	"project_id",
+	"client_email",
+	"client_id",
+	"private_key_id",
+	"universe_domain"
+].includes(field) || field.endsWith("_uri") || field.endsWith("_url");
+const registerJsonSecrets = (value, fields) => {
+	registerSecretValue(value);
+	for (const [field, entry] of Object.entries(fields)) if (typeof entry === "string" && !isIdentifierField(field)) registerSecretValue(entry);
 };
-//#endregion
-//#region src/HotUpdateDirUtil.ts
-const HOT_UPDATE_DIR_NAME = ".hot-updater";
-const HOT_UPDATE_OUTPUT_DIR_NAME = "output";
-const HOT_UPDATE_LOG_DIR_NAME = "log";
-const HotUpdateDirUtil = {
-	dirName: HOT_UPDATE_DIR_NAME,
-	outputDirName: HOT_UPDATE_OUTPUT_DIR_NAME,
-	logDirName: HOT_UPDATE_LOG_DIR_NAME,
-	outputGitignorePath: `${HOT_UPDATE_DIR_NAME}/${HOT_UPDATE_OUTPUT_DIR_NAME}`,
-	logGitignorePath: `${HOT_UPDATE_DIR_NAME}/${HOT_UPDATE_LOG_DIR_NAME}`,
-	getDirPath: ({ cwd }) => {
-		return path$1.join(cwd, HOT_UPDATE_DIR_NAME);
-	},
-	getDefaultOutputPath: ({ cwd }) => {
-		return path$1.join(cwd, HOT_UPDATE_DIR_NAME, HOT_UPDATE_OUTPUT_DIR_NAME);
-	},
-	getLogDirPath: ({ cwd }) => {
-		return path$1.join(cwd, HOT_UPDATE_DIR_NAME, HOT_UPDATE_LOG_DIR_NAME);
-	}
+/**
+* Masks a credential's JSON value in the CLI's output: the whole value, and
+* each field but those that identify it, such as `keyId` and `keyAlias`,
+* so a password or a key a log prints alone stays masked. A value that is
+* no JSON object is masked whole.
+*/
+const registerCredentialValue = (value) => {
+	const parsed = parseObject(value);
+	if (parsed) registerJsonSecrets(value, parsed);
+	else registerSecretValue(value);
 };
-//#endregion
-//#region src/copyDirToTmp.ts
-const copyDirToTmp = async (dir, childDirname) => {
-	const cwd = getCwd();
-	const hotUpdaterDir = HotUpdateDirUtil.getDirPath({ cwd });
-	const tmpDir = childDirname ? path.join(hotUpdaterDir, childDirname) : hotUpdaterDir;
-	try {
-		await fs$1.rm(tmpDir, {
-			recursive: true,
-			force: true
-		});
-	} catch {}
-	await fs$1.mkdir(tmpDir, { recursive: true });
-	await fs$1.cp(dir, tmpDir, { recursive: true });
-	return {
-		tmpDir: hotUpdaterDir,
-		removeTmpDir: () => fs$1.rm(hotUpdaterDir, { recursive: true })
-	};
+const parseObject = (value) => {
+	const parsed = parseServiceAccount(value);
+	return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
 };
-//#endregion
-//#region ../../node_modules/.pnpm/tar@7.5.16/node_modules/tar/dist/esm/index.min.js
-var Mr = Object.defineProperty;
-var Br = (s, t) => {
-	for (var e in t) Mr(s, e, {
-		get: t[e],
-		enumerable: !0
-	});
+/**
+* The fields of a JSON credential, each a non-empty string, or an error
+* naming the shape `kind` takes.
+*/
+const readJsonFields = (kind, item, value, fields) => {
+	const parsed = parseObject(value);
+	const shape = `{${fields.map((field) => `"${field}"`).join(", ")}}`;
+	if (!parsed) throw new CredentialUnavailableError(kind, `${item} is not a JSON object.\n${capitalize(aKind(kind))} is one JSON value: ${shape}`);
+	registerJsonSecrets(value, parsed);
+	const missing = fields.filter((field) => typeof parsed[field] !== "string" || !parsed[field]);
+	if (missing.length > 0) throw new CredentialUnavailableError(kind, `${item} has no ${missing.join(", ")}.\n${capitalize(aKind(kind))} is one JSON value: ${shape}`);
+	return parsed;
 };
-var xs = typeof process == "object" && process ? process : {
-	stdout: null,
-	stderr: null
+const aKind = (kind) => `${/^[aeiou]/u.test(kind) ? "an" : "a"} ${kind}`;
+const capitalize = (text) => text.charAt(0).toUpperCase() + text.slice(1);
+/** A base64 value's bytes, or undefined when it is not base64. */
+const decodeBase64 = (value) => {
+	const base64 = value.replace(/\s/g, "");
+	const contents = Buffer.from(base64, "base64");
+	return contents.length > 0 && contents.toString("base64").replace(/=+$/, "") === base64.replace(/=+$/, "") ? contents : void 0;
 };
-var zr = (s) => !!s && typeof s == "object" && (s instanceof A || s instanceof As || Ur(s) || Hr(s));
-var Ur = (s) => !!s && typeof s == "object" && s instanceof EventEmitter$1 && typeof s.pipe == "function" && s.pipe !== As.Writable.prototype.pipe;
-var Hr = (s) => !!s && typeof s == "object" && s instanceof EventEmitter$1 && typeof s.write == "function" && typeof s.end == "function";
-var q = Symbol("EOF");
-var Q = Symbol("maybeEmitEnd");
-var rt = Symbol("emittedEnd");
-var Le = Symbol("emittingEnd");
-var qt = Symbol("emittedError");
-var Ne = Symbol("closed");
-var Ls = Symbol("read");
-var De = Symbol("flush");
-var Ns = Symbol("flushChunk");
-var z = Symbol("encoding");
-var Mt = Symbol("decoder");
-var g = Symbol("flowing");
-var Qt = Symbol("paused");
-var Bt = Symbol("resume");
-var b = Symbol("buffer");
-var D = Symbol("pipes");
-var _ = Symbol("bufferLength");
-var gi = Symbol("bufferPush");
-var Ae = Symbol("bufferShift");
-var L = Symbol("objectMode");
-var w = Symbol("destroyed");
-var bi = Symbol("error");
-var _i = Symbol("emitData");
-var Ds = Symbol("emitEnd");
-var Oi = Symbol("emitEnd2");
-var Z = Symbol("async");
-var Ti = Symbol("abort");
-var Ie = Symbol("aborted");
-var Jt = Symbol("signal");
-var Rt = Symbol("dataListeners");
-var F = Symbol("discarded");
-var jt = (s) => Promise.resolve().then(s);
-var Wr = (s) => s();
-var Gr = (s) => s === "end" || s === "finish" || s === "prefinish";
-var Zr = (s) => s instanceof ArrayBuffer || !!s && typeof s == "object" && s.constructor && s.constructor.name === "ArrayBuffer" && s.byteLength >= 0;
-var Yr = (s) => !Buffer.isBuffer(s) && ArrayBuffer.isView(s);
-var Fe = class {
-	src;
-	dest;
-	opts;
-	ondrain;
-	constructor(t, e, i) {
-		this.src = t, this.dest = e, this.opts = i, this.ondrain = () => t[Bt](), this.dest.on("drain", this.ondrain);
+/**
+* Each kind from the one string a secrets adapter holds for it: a JSON
+* object for the App Store Connect key (`p8` is the PEM) and the keystore
+* (`keystore` is base64), and the service account's own JSON. File values
+* are written with `files`; every value is masked.
+*/
+const fromSecretValue = {
+	"asc-api-key": async (value, { files, item }) => {
+		const { keyId, issuerId, p8 } = readJsonFields("asc-api-key", item, value, [
+			"keyId",
+			"issuerId",
+			"p8"
+		]);
+		return {
+			keyPath: await files.write(`AuthKey_${keyId}.p8`, p8.includes("\n") ? p8 : p8.replaceAll("\\n", "\n")),
+			keyId,
+			issuerId
+		};
+	},
+	"android-keystore": async (value, { files, name, item }) => {
+		const { keystore, storePassword, keyAlias, keyPassword } = readJsonFields("android-keystore", item, value, [
+			"keystore",
+			"storePassword",
+			"keyAlias",
+			"keyPassword"
+		]);
+		const contents = decodeBase64(keystore);
+		if (!contents) throw new CredentialUnavailableError("android-keystore", `${item}'s keystore is not a base64-encoded keystore.`);
+		return {
+			storeFile: await files.write(`${name}.keystore`, contents),
+			storePassword,
+			keyAlias,
+			keyPassword
+		};
+	},
+	"play-service-account": async (value, { item }) => {
+		const parsed = parseObject(value);
+		if (!parsed) throw new CredentialUnavailableError("play-service-account", `${item} is not a service account JSON object.`);
+		registerJsonSecrets(value, parsed);
+		return { json: value };
 	}
-	unpipe() {
-		this.dest.removeListener("drain", this.ondrain);
+};
+const registerCredentialSecrets = (kind, credential) => {
+	if (kind === "android-keystore") {
+		const keystore = credential;
+		registerSecretValue(keystore.storePassword);
+		registerSecretValue(keystore.keyPassword);
 	}
-	proxyErrors(t) {}
-	end() {
-		this.unpipe(), this.opts.end && this.dest.end();
+	if (kind === "play-service-account") {
+		const { json } = credential;
+		registerSecretValue(json);
+		const privateKey = parseServiceAccount(json)?.private_key;
+		if (typeof privateKey === "string") registerSecretValue(privateKey);
 	}
 };
-var xi = class extends Fe {
-	unpipe() {
-		this.src.removeListener("error", this.proxyErrors), super.unpipe();
-	}
-	constructor(t, e, i) {
-		super(t, e, i), this.proxyErrors = (r) => this.dest.emit("error", r), t.on("error", this.proxyErrors);
-	}
+/**
+* Reads names from `secrets`, the names asked for in one turn of the event
+* loop, such as a build's credentials, in one `get`. Nothing is cached.
+*/
+const createSecretLoader = (secrets, cwd) => {
+	let batch;
+	const flush = async (names) => {
+		try {
+			const read = await secrets().get([...names.keys()], { cwd: cwd() });
+			for (const [name, waiters] of names) {
+				const value = Object.hasOwn(read, name) ? read[name] : void 0;
+				for (const waiter of waiters) waiter.resolve(typeof value === "string" && value ? value : void 0);
+			}
+		} catch (error) {
+			for (const waiters of names.values()) for (const waiter of waiters) waiter.reject(error);
+		}
+	};
+	return (name) => new Promise((resolve, reject) => {
+		if (batch === void 0) {
+			const names = /* @__PURE__ */ new Map();
+			batch = names;
+			setTimeout(() => {
+				batch = void 0;
+				flush(names);
+			}, 0);
+		}
+		const waiters = batch.get(name) ?? [];
+		waiters.push({
+			resolve,
+			reject
+		});
+		batch.set(name, waiters);
+	});
 };
-var Kr = (s) => !!s.objectMode;
-var Vr = (s) => !s.objectMode && !!s.encoding && s.encoding !== "buffer";
-var A = class extends EventEmitter$1 {
-	[g] = !1;
-	[Qt] = !1;
-	[D] = [];
-	[b] = [];
-	[L];
-	[z];
-	[Z];
-	[Mt];
-	[q] = !1;
-	[rt] = !1;
-	[Le] = !1;
-	[Ne] = !1;
-	[qt] = null;
-	[_] = 0;
-	[w] = !1;
-	[Jt];
-	[Ie] = !1;
-	[Rt] = 0;
-	[F] = !1;
-	writable = !0;
-	readable = !0;
-	constructor(...t) {
-		let e = t[0] || {};
-		if (super(), e.objectMode && typeof e.encoding == "string") throw new TypeError("Encoding and objectMode may not be used together");
-		Kr(e) ? (this[L] = !0, this[z] = null) : Vr(e) ? (this[z] = e.encoding, this[L] = !1) : (this[L] = !1, this[z] = null), this[Z] = !!e.async, this[Mt] = this[z] ? new StringDecoder(this[z]) : null, e && e.debugExposeBuffer === !0 && Object.defineProperty(this, "buffer", { get: () => this[b] }), e && e.debugExposePipes === !0 && Object.defineProperty(this, "pipes", { get: () => this[D] });
-		let { signal: i } = e;
-		i && (this[Jt] = i, i.aborted ? this[Ti]() : i.addEventListener("abort", () => this[Ti]()));
-	}
-	get bufferLength() {
-		return this[_];
-	}
-	get encoding() {
-		return this[z];
-	}
-	set encoding(t) {
-		throw new Error("Encoding must be set at instantiation time");
+/**
+* Resolves each item from its environment overrides when any is set, and
+* otherwise from the config's `secrets` adapter as one value named by the
+* item, so overrides never reach the store. When the adapter fails or holds
+* no such value, the error names the environment variables that can
+* provide the item instead. Nothing is cached, values are never written to
+* disk except as 0600 temporary files, are never set in `process.env`, and
+* every secret is masked in logs.
+*/
+const createCredentialResolver = ({ env = {}, secrets, cwd } = {}) => {
+	const files = createCredentialFiles();
+	const resolved = /* @__PURE__ */ new Map();
+	let disposal;
+	const adapter = () => typeof secrets === "function" ? secrets() : secrets ?? getConfiguredSecrets();
+	const load = createSecretLoader(adapter, () => cwd ?? getCwd());
+	const resolveItem = async (kind, name) => {
+		const fields = CREDENTIAL_ENV_NAMES[kind];
+		const values = fields.map((field) => readEnvField(env, field));
+		if (values.some((value) => value !== void 0)) {
+			const missing = fields.filter((_, index) => !values[index]);
+			if (missing.length > 0) throw new CredentialUnavailableError(kind, `The environment overrides ${kind} but ${describeFields(missing)} ${missing.length === 1 ? "is" : "are"} not set.`);
+			const credential = await fromEnv[kind](values, {
+				files,
+				name
+			});
+			registerCredentialSecrets(kind, credential);
+			return credential;
+		}
+		const store = adapter();
+		const item = name === kind ? kind : `${name} (${kind})`;
+		let value;
+		try {
+			value = await load(name);
+		} catch (error) {
+			const reason = error instanceof Error ? error.message : String(error);
+			throw new CredentialUnavailableError(kind, `Couldn't read ${item} from the ${store.name} secrets adapter.\n${reason}`, { cause: error });
+		}
+		if (value === void 0) throw new CredentialUnavailableError(kind, kind === "android-keystore" ? describeMissingKeystore(store, item, name) : `No ${item} in the ${store.name} secrets adapter.\nStore it once with:\n${formatCommand(credentialStoreCommand(kind, name))}`);
+		registerSecretValue(value);
+		return fromSecretValue[kind](value, {
+			files,
+			name,
+			item: `The ${store.name} secrets adapter's ${item}`
+		});
+	};
+	return {
+		resolve: ({ kind, name = kind }) => {
+			if (disposal) return Promise.reject(/* @__PURE__ */ new Error("The credential resolver has been disposed."));
+			const key = `${kind}\u0000${name}`;
+			let pending = resolved.get(key);
+			if (!pending) {
+				pending = resolveItem(kind, name);
+				resolved.set(key, pending);
+				pending.catch(() => resolved.delete(key));
+			}
+			return pending;
+		},
+		dispose: () => {
+			disposal ??= (async () => {
+				await Promise.allSettled(resolved.values());
+				resolved.clear();
+				await files.dispose();
+			})();
+			return disposal;
+		}
+	};
+};
+/**
+* Runs `run` with a credential resolver and deletes its temporary files
+* when `run` settles.
+*/
+const withCredentialResolver = async (run, options) => {
+	const resolver = createCredentialResolver(options);
+	try {
+		return await run(resolver);
+	} finally {
+		await resolver.dispose();
 	}
-	setEncoding(t) {
-		throw new Error("Encoding must be set at instantiation time");
+};
+//#endregion
+//#region src/bundleSigning.ts
+/** The secret `signing: secret("bundle-signing-key")` names, which `secrets issue` creates. */
+const BUNDLE_SIGNING_KEY_SECRET = "bundle-signing-key";
+/** The command that creates and stores a bundle signing key. */
+const ISSUE_SIGNING_KEY_COMMAND = `npx hot-updater secrets issue ${BUNDLE_SIGNING_KEY_SECRET}`;
+/** The command that stores a bundle signing key you have. */
+const PUT_SIGNING_KEY_COMMAND = `npx hot-updater secrets put ${BUNDLE_SIGNING_KEY_SECRET} <key.pem>`;
+/** What deploy and doctor say when the config sets no `signing`. */
+const UNSIGNED_BUNDLES_WARNING = "Bundles are unsigned.";
+/** The next step after `UNSIGNED_BUNDLES_WARNING`. */
+const UNSIGNED_BUNDLES_NEXT_STEP = "To sign them, run:";
+/** What deploy and doctor say when `signing` is no shape it takes. */
+const INVALID_SIGNING_MESSAGE = `signing takes secret("${BUNDLE_SIGNING_KEY_SECRET}").`;
+/** The next step after `INVALID_SIGNING_MESSAGE`. */
+const INVALID_SIGNING_NEXT_STEP = "Store your key:";
+const invalid = (message) => ({
+	status: "invalid",
+	message
+});
+const LOCAL_FIELDS = [
+	"enabled",
+	"privateKeyPath",
+	"privateKey"
+];
+const readBundleSigningState = (signing) => {
+	if (signing === void 0) return { status: "unsigned" };
+	if (isSecretRef(signing)) return {
+		status: "on",
+		key: { secret: signing.name }
+	};
+	if (typeof signing !== "object" || signing === null || !Object.keys(signing).every((key) => LOCAL_FIELDS.includes(key))) return invalid(INVALID_SIGNING_MESSAGE);
+	const { enabled, privateKey, privateKeyPath } = signing;
+	if (enabled === false) return { status: "off" };
+	if (enabled !== true) return invalid(INVALID_SIGNING_MESSAGE);
+	if (privateKey !== void 0 && privateKeyPath !== void 0) return invalid("signing takes privateKey or privateKeyPath, not both.");
+	if (privateKey !== void 0) return isSecretRef(privateKey) ? {
+		status: "on",
+		key: { secret: privateKey.name }
+	} : invalid("signing.privateKey takes secret(\"<name>\").");
+	if (typeof privateKeyPath !== "string" || !privateKeyPath.trim()) return invalid("signing takes privateKeyPath, or privateKey as secret(\"<name>\").");
+	return {
+		status: "on",
+		key: { privateKeyPath }
+	};
+};
+/** The `secret()` the config's `signing` reads its private key from, if any. */
+const bundleSigningSecretRef = (signing) => {
+	if (isSecretRef(signing)) return signing;
+	const privateKey = typeof signing === "object" && signing !== null ? Reflect.get(signing, "privateKey") : void 0;
+	return isSecretRef(privateKey) ? privateKey : void 0;
+};
+/**
+* A bundle signing failure whose message the CLI prints as it is: it names
+* the secret and the next step, and quotes no key material.
+*/
+var BundleSigningKeyError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "HotUpdaterBundleSigningKeyError";
 	}
-	get objectMode() {
-		return this[L];
+};
+const FILE_HASH_PATTERN = /^[a-f\d]{64}$/iu;
+const resolvePath = (cwd, filePath) => path$1.isAbsolute(filePath) ? filePath : path$1.resolve(cwd, filePath);
+const parseRsaPublicKey = (publicKeyPEM) => {
+	try {
+		const normalizedPublicKey = publicKeyPEM.trim();
+		if (!normalizedPublicKey.startsWith("-----BEGIN PUBLIC KEY-----") || !normalizedPublicKey.endsWith("-----END PUBLIC KEY-----")) throw new Error("not spki");
+		const publicKey = crypto$1.createPublicKey(normalizedPublicKey);
+		if (publicKey.asymmetricKeyType !== "rsa" || (publicKey.asymmetricKeyDetails?.modulusLength ?? 0) < 2048) throw new Error("not rsa");
+		return publicKey;
+	} catch {
+		throw new Error("Bundle signing public key must be a valid RSA SPKI PEM key with a modulus of at least 2048 bits.");
 	}
-	set objectMode(t) {
-		throw new Error("objectMode must be set at instantiation time");
+};
+/** The SPKI PEM of `key`, a public key or the private key it derives from. */
+const exportPublicKey = (key) => (key.type === "private" ? crypto$1.createPublicKey(key) : key).export({
+	type: "spki",
+	format: "pem"
+}).toString();
+const readBundleSigningPublicKeyFile = async (publicKeyPath, options = {}) => {
+	if (!publicKeyPath.trim()) throw new Error("Bundle signing public key path is required.");
+	try {
+		const publicKeyPEM = await fs$2.readFile(resolvePath(options.cwd ?? getCwd(), publicKeyPath), "utf8");
+		return exportPublicKey(parseRsaPublicKey(publicKeyPEM));
+	} catch {
+		throw new Error("Failed to read the bundle signing public key file.");
 	}
-	get async() {
-		return this[Z];
+};
+const parsePrivateKey = (pem) => {
+	const privateKey = crypto$1.createPrivateKey(pem);
+	if (privateKey.asymmetricKeyType !== "rsa" || (privateKey.asymmetricKeyDetails?.modulusLength ?? 0) < 2048) throw new Error("not rsa");
+	return privateKey;
+};
+const loadPrivateKeyFile = async (file) => {
+	try {
+		return parsePrivateKey(await fs$2.readFile(file, "utf8"));
+	} catch {
+		throw new BundleSigningKeyError("Failed to load the bundle signing private key from privateKeyPath.");
 	}
-	set async(t) {
-		this[Z] = this[Z] || !!t;
-	}
-	[Ti]() {
-		this[Ie] = !0, this.emit("abort", this[Jt]?.reason), this.destroy(this[Jt]?.reason);
+};
+/**
+* The private key the `secrets` adapter holds as `name`: masked in the CLI's
+* output before it is parsed, and kept only as a key object. A PEM written
+* on one line, with `\n` for its line breaks, as a `.env.hotupdater` value
+* or a CI variable may hold it, reads as the PEM.
+*/
+const loadPrivateKeySecret = async (secrets, name, cwd) => {
+	let value;
+	try {
+		const read = await secrets.get([name], { cwd });
+		value = Object.hasOwn(read, name) ? read[name] : void 0;
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : String(error);
+		throw new BundleSigningKeyError(`Couldn't read ${name} from the ${secrets.name} secrets adapter.\n${reason}`, { cause: error });
 	}
-	get aborted() {
-		return this[Ie];
+	if (typeof value !== "string" || !value.trim()) {
+		const [missing, check] = getConfiguredAdapter(secrets) ? [`${name} isn't in the ${secrets.name} secrets adapter.`, "Check the name and your access, or import your key:"] : [`${name} isn't on this machine.`, `Check the name, set ${secretVariableName(name)}, or import your key:`];
+		throw new BundleSigningKeyError([
+			missing,
+			check,
+			formatCommand(`npx hot-updater secrets put ${name}${name === "bundle-signing-key" ? "" : ` --kind ${BUNDLE_SIGNING_KEY_SECRET}`} <key.pem>`)
+		].join("\n"));
 	}
-	set aborted(t) {}
-	write(t, e, i) {
-		if (this[Ie]) return !1;
-		if (this[q]) throw new Error("write after end");
-		if (this[w]) return this.emit("error", Object.assign(/* @__PURE__ */ new Error("Cannot call write after a stream was destroyed"), { code: "ERR_STREAM_DESTROYED" })), !0;
-		typeof e == "function" && (i = e, e = "utf8"), e || (e = "utf8");
-		let r = this[Z] ? jt : Wr;
-		if (!this[L] && !Buffer.isBuffer(t)) {
-			if (Yr(t)) t = Buffer.from(t.buffer, t.byteOffset, t.byteLength);
-			else if (Zr(t)) t = Buffer.from(t);
-			else if (typeof t != "string") throw new Error("Non-contiguous data written to non-objectMode stream");
-		}
-		return this[L] ? (this[g] && this[_] !== 0 && this[De](!0), this[g] ? this.emit("data", t) : this[gi](t), this[_] !== 0 && this.emit("readable"), i && r(i), this[g]) : t.length ? (typeof t == "string" && !(e === this[z] && !this[Mt]?.lastNeed) && (t = Buffer.from(t, e)), Buffer.isBuffer(t) && this[z] && (t = this[Mt].write(t)), this[g] && this[_] !== 0 && this[De](!0), this[g] ? this.emit("data", t) : this[gi](t), this[_] !== 0 && this.emit("readable"), i && r(i), this[g]) : (this[_] !== 0 && this.emit("readable"), i && r(i), this[g]);
+	registerSecretValue(value);
+	const pem = value.includes("\n") ? value : value.replaceAll("\\n", "\n");
+	if (pem !== value) registerSecretValue(pem);
+	try {
+		return parsePrivateKey(pem);
+	} catch {
+		throw new BundleSigningKeyError([`${name} in the ${secrets.name} secrets adapter is no signing key.`, "Store an RSA private key in PEM, of 2048 bits or more."].join("\n"));
 	}
-	read(t) {
-		if (this[w]) return null;
-		if (this[F] = !1, this[_] === 0 || t === 0 || t && t > this[_]) return this[Q](), null;
-		this[L] && (t = null), this[b].length > 1 && !this[L] && (this[b] = [this[z] ? this[b].join("") : Buffer.concat(this[b], this[_])]);
-		let e = this[Ls](t || null, this[b][0]);
-		return this[Q](), e;
+};
+/**
+* The private keys each `signing` value has read, by file or by secrets
+* adapter, so the commands of one run that sign and derive the public key
+* read the key once.
+*/
+const privateKeys = /* @__PURE__ */ new WeakMap();
+/**
+* The private key `signing` signs with, or null when it signs nothing.
+* Throws `INVALID_SIGNING_MESSAGE`, with the next step, for a value
+* `signing` doesn't take.
+*/
+const loadSigningKey = (signing, { cwd = getCwd(), secrets }) => {
+	const state = readBundleSigningState(signing);
+	if (state.status === "invalid") throw new BundleSigningKeyError(`${state.message}\n${INVALID_SIGNING_NEXT_STEP} ${PUT_SIGNING_KEY_COMMAND}`);
+	if (state.status !== "on") return null;
+	const store = secrets ?? getConfiguredSecrets();
+	const cacheKey = "secret" in state.key ? store : resolvePath(cwd, state.key.privateKeyPath);
+	const cache = privateKeys.get(signing) ?? /* @__PURE__ */ new Map();
+	privateKeys.set(signing, cache);
+	const cached = cache.get(cacheKey);
+	if (cached) return cached;
+	const pending = ("secret" in state.key ? loadPrivateKeySecret(store, state.key.secret, cwd) : loadPrivateKeyFile(cacheKey)).catch((error) => {
+		cache.delete(cacheKey);
+		throw error;
+	});
+	cache.set(cacheKey, pending);
+	return pending;
+};
+const signingFailure = (summary, error) => new Error(error instanceof BundleSigningKeyError ? error.message : `${summary} ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+/**
+* Prepares the run's bundle signing: the public key the app must embed, and
+* a signer of SHA-256 file hashes that signs each hash once. Null when
+* `signing` is omitted or `{ enabled: false }`.
+*/
+const prepareBundleSigning = async (signing, options = {}) => {
+	const loading = loadSigningKey(signing, options);
+	if (!loading) return null;
+	let privateKey;
+	try {
+		privateKey = await loading;
+	} catch (error) {
+		throw signingFailure("Failed to read the bundle signing key.", error);
 	}
-	[Ls](t, e) {
-		if (this[L]) this[Ae]();
-		else {
-			let i = e;
-			t === i.length || t === null ? this[Ae]() : typeof i == "string" ? (this[b][0] = i.slice(t), e = i.slice(0, t), this[_] -= t) : (this[b][0] = i.subarray(t), e = i.subarray(0, t), this[_] -= t);
+	const signatures = /* @__PURE__ */ new Map();
+	return {
+		publicKey: exportPublicKey(privateKey),
+		signFileHash: async (fileHash) => {
+			if (!FILE_HASH_PATTERN.test(fileHash)) throw new Error("Bundle signing requires a 64-character hexadecimal file hash.");
+			const normalized = fileHash.toLowerCase();
+			const cached = signatures.get(normalized);
+			if (cached) return cached;
+			const signature = crypto$1.sign("RSA-SHA256", Buffer.from(normalized, "hex"), privateKey).toString("base64");
+			signatures.set(normalized, signature);
+			return signature;
 		}
-		return this.emit("data", e), !this[b].length && !this[q] && this.emit("drain"), e;
-	}
-	end(t, e, i) {
-		return typeof t == "function" && (i = t, t = void 0), typeof e == "function" && (i = e, e = "utf8"), t !== void 0 && this.write(t, e), i && this.once("end", i), this[q] = !0, this.writable = !1, (this[g] || !this[Qt]) && this[Q](), this;
-	}
-	[Bt]() {
-		this[w] || (!this[Rt] && !this[D].length && (this[F] = !0), this[Qt] = !1, this[g] = !0, this.emit("resume"), this[b].length ? this[De]() : this[q] ? this[Q]() : this.emit("drain"));
-	}
-	resume() {
-		return this[Bt]();
+	};
+};
+/**
+* The public key of the configured bundle signing key, in SPKI PEM; null
+* when `signing` signs nothing.
+*/
+const getBundleSigningPublicKey = async (signing, options = {}) => {
+	const loading = loadSigningKey(signing, options);
+	if (!loading) return null;
+	try {
+		return exportPublicKey(await loading);
+	} catch (error) {
+		throw signingFailure("Failed to read the bundle signing key.", error);
 	}
-	pause() {
-		this[g] = !1, this[Qt] = !0, this[F] = !1;
+};
+//#endregion
+//#region src/ConfigBuilder.ts
+const normalizeImportInfos = (imports) => {
+	const collectedImports = /* @__PURE__ */ new Map();
+	for (const info of imports) {
+		const existing = collectedImports.get(info.pkg);
+		if (existing) {
+			if (info.named) for (const namedImport of info.named) existing.named.add(namedImport);
+			if (info.defaultOrNamespace && !existing.defaultOrNamespace) existing.defaultOrNamespace = info.defaultOrNamespace;
+			if (info.sideEffect && !existing.sideEffect) existing.sideEffect = true;
+			continue;
+		}
+		collectedImports.set(info.pkg, {
+			named: new Set(info.named ?? []),
+			defaultOrNamespace: info.defaultOrNamespace,
+			sideEffect: info.sideEffect ?? false
+		});
 	}
-	get destroyed() {
-		return this[w];
+	return Array.from(collectedImports.entries()).sort(([a], [b]) => {
+		const isABuild = a.startsWith("@hot-updater/");
+		if (isABuild !== b.startsWith("@hot-updater/")) return isABuild ? -1 : 1;
+		const isAdminA = a === "firebase-admin";
+		if (isAdminA !== (b === "firebase-admin")) return isAdminA ? -1 : 1;
+		return a.localeCompare(b);
+	}).map(([pkg, info]) => ({
+		pkg,
+		named: Array.from(info.named).sort(),
+		defaultOrNamespace: info.defaultOrNamespace,
+		sideEffect: info.sideEffect ?? false
+	}));
+};
+const renderImportStatements = (imports) => {
+	const importLines = [];
+	for (const info of normalizeImportInfos(imports)) {
+		if (info.sideEffect) {
+			importLines.push(`import "${info.pkg}";`);
+			continue;
+		}
+		if (info.defaultOrNamespace) {
+			if (info.pkg === "firebase-admin" && (info.named?.length ?? 0) > 0) importLines.push(`import ${info.defaultOrNamespace}, { ${info.named.join(", ")} } from "${info.pkg}";`);
+			else importLines.push(`import ${info.defaultOrNamespace} from "${info.pkg}";`);
+			continue;
+		}
+		if ((info.named?.length ?? 0) > 0) importLines.push(`import { ${info.named.join(", ")} } from "${info.pkg}";`);
 	}
-	get flowing() {
-		return this[g];
+	return importLines.join("\n");
+};
+/**
+* Renders the hot-updater.config.ts init writes: the build, the server's
+* storage, database, and plugins, and the deploy settings.
+*/
+var ConfigBuilder = class {
+	buildType = null;
+	storageInfo = null;
+	databaseInfo = null;
+	pluginsInfo = null;
+	intermediateCode = "";
+	imports = [{
+		pkg: "hot-updater",
+		named: ["defineConfig", "localSecrets"]
+	}, {
+		pkg: "node:fs",
+		named: ["existsSync"]
+	}];
+	/** Adds an import, such as a credentials helper's. */
+	addImport(info) {
+		this.imports.push(info);
+		return this;
 	}
-	get paused() {
-		return this[Qt];
+	generateBuildConfigString() {
+		if (!this.buildType) throw new Error("Build type must be set using .setBuildType()");
+		switch (this.buildType) {
+			case "bare": return "bare({ enableHermes: true })";
+			case "rock": return "rock()";
+			case "expo": return "expo()";
+			default: throw new Error(`Invalid build type: ${this.buildType}`);
+		}
 	}
-	[gi](t) {
-		this[L] ? this[_] += 1 : this[_] += t.length, this[b].push(t);
+	/** Sets the build type ('bare', 'rock', or 'expo') and its import. */
+	setBuildType(buildType) {
+		this.buildType = buildType;
+		this.imports.push({
+			pkg: `@hot-updater/${buildType}`,
+			named: [buildType]
+		});
+		return this;
 	}
-	[Ae]() {
-		return this[L] ? this[_] -= 1 : this[_] -= this[b][0].length, this[b].shift();
+	/** Sets the storage the CLI uploads to, which the server lists, and its imports. */
+	setStorage(storageConfig) {
+		this.storageInfo = storageConfig;
+		this.imports.push(...storageConfig.imports);
+		return this;
 	}
-	[De](t = !1) {
-		do		;
-while (this[Ns](this[Ae]()) && this[b].length);
-		!t && !this[b].length && !this[q] && this.emit("drain");
+	/** Sets the server's database and its imports. */
+	setDatabase(databaseConfig) {
+		this.databaseInfo = databaseConfig;
+		this.imports.push(...databaseConfig.imports);
+		return this;
 	}
-	[Ns](t) {
-		return this.emit("data", t), this[g];
+	/** Sets the server's plugin factory array and its imports. */
+	setPlugins(pluginsConfig) {
+		this.pluginsInfo = pluginsConfig;
+		this.imports.push(...pluginsConfig.imports);
+		return this;
 	}
-	pipe(t, e) {
-		if (this[w]) return t;
-		this[F] = !1;
-		let i = this[rt];
-		return e = e || {}, t === xs.stdout || t === xs.stderr ? e.end = !1 : e.end = e.end !== !1, e.proxyErrors = !!e.proxyErrors, i ? e.end && t.end() : (this[D].push(e.proxyErrors ? new xi(this, t, e) : new Fe(this, t, e)), this[Z] ? jt(() => this[Bt]()) : this[Bt]()), t;
+	/** Sets the code between the environment loading and the config, such as a credentials helper. */
+	setIntermediateCode(code) {
+		this.intermediateCode = code.trim();
+		return this;
 	}
-	unpipe(t) {
-		let e = this[D].find((i) => i.dest === t);
-		e && (this[D].length === 1 ? (this[g] && this[Rt] === 0 && (this[g] = !1), this[D] = []) : this[D].splice(this[D].indexOf(e), 1), e.unpipe());
+	getScaffold() {
+		if (!this.buildType) throw new Error("Build type must be set using .setBuildType()");
+		if (!this.storageInfo) throw new Error("Storage config must be set using .setStorage()");
+		if (!this.databaseInfo) throw new Error("Database config must be set using .setDatabase()");
+		if (!this.pluginsInfo) throw new Error("Plugins config must be set using .setPlugins()");
+		const imports = normalizeImportInfos(this.imports);
+		const buildConfigString = this.generateBuildConfigString();
+		const plugins = this.pluginsInfo.configString;
+		const text = `
+${renderImportStatements(imports)}
+
+if (existsSync(".env.hotupdater")) {
+  process.loadEnvFile(".env.hotupdater");
+}
+
+${this.intermediateCode ? `${this.intermediateCode}\n\n` : ""}export default defineConfig({
+  build: ${buildConfigString},
+  storage: ${this.storageInfo.configString},
+  database: ${this.databaseInfo.configString},
+  ${plugins === "plugins" ? "plugins" : `plugins: ${plugins}`},
+  secrets: localSecrets(),
+  updateStrategy: "appVersion", // or "fingerprint"
+});
+`.trim();
+		return {
+			imports,
+			buildConfigString,
+			storageConfigString: this.storageInfo.configString,
+			databaseConfigString: this.databaseInfo.configString,
+			pluginsConfigString: plugins,
+			intermediateCode: this.intermediateCode,
+			text
+		};
 	}
-	addListener(t, e) {
-		return this.on(t, e);
+	/** hot-updater.config.ts's text. */
+	getResult() {
+		return this.getScaffold().text;
 	}
-	on(t, e) {
-		let i = super.on(t, e);
-		if (t === "data") this[F] = !1, this[Rt]++, !this[D].length && !this[g] && this[Bt]();
-		else if (t === "readable" && this[_] !== 0) super.emit("readable");
-		else if (Gr(t) && this[rt]) super.emit(t), this.removeAllListeners(t);
-		else if (t === "error" && this[qt]) {
-			let r = e;
-			this[Z] ? jt(() => r.call(this, this[qt])) : r.call(this, this[qt]);
-		}
-		return i;
+};
+//#endregion
+//#region src/HotUpdateDirUtil.ts
+const HOT_UPDATE_DIR_NAME = ".hot-updater";
+const HOT_UPDATE_OUTPUT_DIR_NAME = "output";
+const HOT_UPDATE_LOG_DIR_NAME = "log";
+const HotUpdateDirUtil = {
+	dirName: HOT_UPDATE_DIR_NAME,
+	outputDirName: HOT_UPDATE_OUTPUT_DIR_NAME,
+	logDirName: HOT_UPDATE_LOG_DIR_NAME,
+	outputGitignorePath: `${HOT_UPDATE_DIR_NAME}/${HOT_UPDATE_OUTPUT_DIR_NAME}`,
+	logGitignorePath: `${HOT_UPDATE_DIR_NAME}/${HOT_UPDATE_LOG_DIR_NAME}`,
+	getDirPath: ({ cwd }) => {
+		return path$1.join(cwd, HOT_UPDATE_DIR_NAME);
+	},
+	getDefaultOutputPath: ({ cwd }) => {
+		return path$1.join(cwd, HOT_UPDATE_DIR_NAME, HOT_UPDATE_OUTPUT_DIR_NAME);
+	},
+	getLogDirPath: ({ cwd }) => {
+		return path$1.join(cwd, HOT_UPDATE_DIR_NAME, HOT_UPDATE_LOG_DIR_NAME);
 	}
-	removeListener(t, e) {
-		return this.off(t, e);
+};
+//#endregion
+//#region src/copyDirToTmp.ts
+const copyDirToTmp = async (dir, childDirname) => {
+	const cwd = getCwd();
+	const hotUpdaterDir = HotUpdateDirUtil.getDirPath({ cwd });
+	const tmpDir = childDirname ? path.join(hotUpdaterDir, childDirname) : hotUpdaterDir;
+	try {
+		await fs$1.rm(tmpDir, {
+			recursive: true,
+			force: true
+		});
+	} catch {}
+	await fs$1.mkdir(tmpDir, { recursive: true });
+	await fs$1.cp(dir, tmpDir, { recursive: true });
+	return {
+		tmpDir: hotUpdaterDir,
+		removeTmpDir: () => fs$1.rm(hotUpdaterDir, { recursive: true })
+	};
+};
+//#endregion
+//#region ../../node_modules/.pnpm/tar@7.5.16/node_modules/tar/dist/esm/index.min.js
+var Mr = Object.defineProperty;
+var Br = (s, t) => {
+	for (var e in t) Mr(s, e, {
+		get: t[e],
+		enumerable: !0
+	});
+};
+var xs = typeof process == "object" && process ? process : {
+	stdout: null,
+	stderr: null
+};
+var zr = (s) => !!s && typeof s == "object" && (s instanceof A || s instanceof As || Ur(s) || Hr(s));
+var Ur = (s) => !!s && typeof s == "object" && s instanceof EventEmitter$1 && typeof s.pipe == "function" && s.pipe !== As.Writable.prototype.pipe;
+var Hr = (s) => !!s && typeof s == "object" && s instanceof EventEmitter$1 && typeof s.write == "function" && typeof s.end == "function";
+var q = Symbol("EOF");
+var Q = Symbol("maybeEmitEnd");
+var rt = Symbol("emittedEnd");
+var Le = Symbol("emittingEnd");
+var qt = Symbol("emittedError");
+var Ne = Symbol("closed");
+var Ls = Symbol("read");
+var De = Symbol("flush");
+var Ns = Symbol("flushChunk");
+var z = Symbol("encoding");
+var Mt = Symbol("decoder");
+var g = Symbol("flowing");
+var Qt = Symbol("paused");
+var Bt = Symbol("resume");
+var b = Symbol("buffer");
+var D = Symbol("pipes");
+var _ = Symbol("bufferLength");
+var gi = Symbol("bufferPush");
+var Ae = Symbol("bufferShift");
+var L = Symbol("objectMode");
+var w = Symbol("destroyed");
+var bi = Symbol("error");
+var _i = Symbol("emitData");
+var Ds = Symbol("emitEnd");
+var Oi = Symbol("emitEnd2");
+var Z = Symbol("async");
+var Ti = Symbol("abort");
+var Ie = Symbol("aborted");
+var Jt = Symbol("signal");
+var Rt = Symbol("dataListeners");
+var F = Symbol("discarded");
+var jt = (s) => Promise.resolve().then(s);
+var Wr = (s) => s();
+var Gr = (s) => s === "end" || s === "finish" || s === "prefinish";
+var Zr = (s) => s instanceof ArrayBuffer || !!s && typeof s == "object" && s.constructor && s.constructor.name === "ArrayBuffer" && s.byteLength >= 0;
+var Yr = (s) => !Buffer.isBuffer(s) && ArrayBuffer.isView(s);
+var Fe = class {
+	src;
+	dest;
+	opts;
+	ondrain;
+	constructor(t, e, i) {
+		this.src = t, this.dest = e, this.opts = i, this.ondrain = () => t[Bt](), this.dest.on("drain", this.ondrain);
 	}
-	off(t, e) {
-		let i = super.off(t, e);
-		return t === "data" && (this[Rt] = this.listeners("data").length, this[Rt] === 0 && !this[F] && !this[D].length && (this[g] = !1)), i;
+	unpipe() {
+		this.dest.removeListener("drain", this.ondrain);
 	}
-	removeAllListeners(t) {
-		let e = super.removeAllListeners(t);
-		return (t === "data" || t === void 0) && (this[Rt] = 0, !this[F] && !this[D].length && (this[g] = !1)), e;
+	proxyErrors(t) {}
+	end() {
+		this.unpipe(), this.opts.end && this.dest.end();
 	}
-	get emittedEnd() {
-		return this[rt];
+};
+var xi = class extends Fe {
+	unpipe() {
+		this.src.removeListener("error", this.proxyErrors), super.unpipe();
 	}
-	[Q]() {
-		!this[Le] && !this[rt] && !this[w] && this[b].length === 0 && this[q] && (this[Le] = !0, this.emit("end"), this.emit("prefinish"), this.emit("finish"), this[Ne] && this.emit("close"), this[Le] = !1);
+	constructor(t, e, i) {
+		super(t, e, i), this.proxyErrors = (r) => this.dest.emit("error", r), t.on("error", this.proxyErrors);
 	}
-	emit(t, ...e) {
-		let i = e[0];
-		if (t !== "error" && t !== "close" && t !== w && this[w]) return !1;
-		if (t === "data") return !this[L] && !i ? !1 : this[Z] ? (jt(() => this[_i](i)), !0) : this[_i](i);
-		if (t === "end") return this[Ds]();
-		if (t === "close") {
-			if (this[Ne] = !0, !this[rt] && !this[w]) return !1;
-			let n = super.emit("close");
-			return this.removeAllListeners("close"), n;
-		} else if (t === "error") {
-			this[qt] = i, super.emit(bi, i);
-			let n = !this[Jt] || this.listeners("error").length ? super.emit("error", i) : !1;
-			return this[Q](), n;
-		} else if (t === "resume") {
-			let n = super.emit("resume");
-			return this[Q](), n;
-		} else if (t === "finish" || t === "prefinish") {
-			let n = super.emit(t);
-			return this.removeAllListeners(t), n;
-		}
-		let r = super.emit(t, ...e);
-		return this[Q](), r;
+};
+var Kr = (s) => !!s.objectMode;
+var Vr = (s) => !s.objectMode && !!s.encoding && s.encoding !== "buffer";
+var A = class extends EventEmitter$1 {
+	[g] = !1;
+	[Qt] = !1;
+	[D] = [];
+	[b] = [];
+	[L];
+	[z];
+	[Z];
+	[Mt];
+	[q] = !1;
+	[rt] = !1;
+	[Le] = !1;
+	[Ne] = !1;
+	[qt] = null;
+	[_] = 0;
+	[w] = !1;
+	[Jt];
+	[Ie] = !1;
+	[Rt] = 0;
+	[F] = !1;
+	writable = !0;
+	readable = !0;
+	constructor(...t) {
+		let e = t[0] || {};
+		if (super(), e.objectMode && typeof e.encoding == "string") throw new TypeError("Encoding and objectMode may not be used together");
+		Kr(e) ? (this[L] = !0, this[z] = null) : Vr(e) ? (this[z] = e.encoding, this[L] = !1) : (this[L] = !1, this[z] = null), this[Z] = !!e.async, this[Mt] = this[z] ? new StringDecoder(this[z]) : null, e && e.debugExposeBuffer === !0 && Object.defineProperty(this, "buffer", { get: () => this[b] }), e && e.debugExposePipes === !0 && Object.defineProperty(this, "pipes", { get: () => this[D] });
+		let { signal: i } = e;
+		i && (this[Jt] = i, i.aborted ? this[Ti]() : i.addEventListener("abort", () => this[Ti]()));
 	}
-	[_i](t) {
-		for (let i of this[D]) i.dest.write(t) === !1 && this.pause();
-		let e = this[F] ? !1 : super.emit("data", t);
-		return this[Q](), e;
+	get bufferLength() {
+		return this[_];
 	}
-	[Ds]() {
-		return this[rt] ? !1 : (this[rt] = !0, this.readable = !1, this[Z] ? (jt(() => this[Oi]()), !0) : this[Oi]());
+	get encoding() {
+		return this[z];
 	}
-	[Oi]() {
-		if (this[Mt]) {
-			let e = this[Mt].end();
-			if (e) {
-				for (let i of this[D]) i.dest.write(e);
-				this[F] || super.emit("data", e);
-			}
-		}
-		for (let e of this[D]) e.end();
-		let t = super.emit("end");
-		return this.removeAllListeners("end"), t;
+	set encoding(t) {
+		throw new Error("Encoding must be set at instantiation time");
 	}
-	async collect() {
-		let t = Object.assign([], { dataLength: 0 });
-		this[L] || (t.dataLength = 0);
-		let e = this.promise();
-		return this.on("data", (i) => {
-			t.push(i), this[L] || (t.dataLength += i.length);
-		}), await e, t;
+	setEncoding(t) {
+		throw new Error("Encoding must be set at instantiation time");
+	}
+	get objectMode() {
+		return this[L];
+	}
+	set objectMode(t) {
+		throw new Error("objectMode must be set at instantiation time");
+	}
+	get async() {
+		return this[Z];
+	}
+	set async(t) {
+		this[Z] = this[Z] || !!t;
+	}
+	[Ti]() {
+		this[Ie] = !0, this.emit("abort", this[Jt]?.reason), this.destroy(this[Jt]?.reason);
+	}
+	get aborted() {
+		return this[Ie];
+	}
+	set aborted(t) {}
+	write(t, e, i) {
+		if (this[Ie]) return !1;
+		if (this[q]) throw new Error("write after end");
+		if (this[w]) return this.emit("error", Object.assign(/* @__PURE__ */ new Error("Cannot call write after a stream was destroyed"), { code: "ERR_STREAM_DESTROYED" })), !0;
+		typeof e == "function" && (i = e, e = "utf8"), e || (e = "utf8");
+		let r = this[Z] ? jt : Wr;
+		if (!this[L] && !Buffer.isBuffer(t)) {
+			if (Yr(t)) t = Buffer.from(t.buffer, t.byteOffset, t.byteLength);
+			else if (Zr(t)) t = Buffer.from(t);
+			else if (typeof t != "string") throw new Error("Non-contiguous data written to non-objectMode stream");
+		}
+		return this[L] ? (this[g] && this[_] !== 0 && this[De](!0), this[g] ? this.emit("data", t) : this[gi](t), this[_] !== 0 && this.emit("readable"), i && r(i), this[g]) : t.length ? (typeof t == "string" && !(e === this[z] && !this[Mt]?.lastNeed) && (t = Buffer.from(t, e)), Buffer.isBuffer(t) && this[z] && (t = this[Mt].write(t)), this[g] && this[_] !== 0 && this[De](!0), this[g] ? this.emit("data", t) : this[gi](t), this[_] !== 0 && this.emit("readable"), i && r(i), this[g]) : (this[_] !== 0 && this.emit("readable"), i && r(i), this[g]);
+	}
+	read(t) {
+		if (this[w]) return null;
+		if (this[F] = !1, this[_] === 0 || t === 0 || t && t > this[_]) return this[Q](), null;
+		this[L] && (t = null), this[b].length > 1 && !this[L] && (this[b] = [this[z] ? this[b].join("") : Buffer.concat(this[b], this[_])]);
+		let e = this[Ls](t || null, this[b][0]);
+		return this[Q](), e;
+	}
+	[Ls](t, e) {
+		if (this[L]) this[Ae]();
+		else {
+			let i = e;
+			t === i.length || t === null ? this[Ae]() : typeof i == "string" ? (this[b][0] = i.slice(t), e = i.slice(0, t), this[_] -= t) : (this[b][0] = i.subarray(t), e = i.subarray(0, t), this[_] -= t);
+		}
+		return this.emit("data", e), !this[b].length && !this[q] && this.emit("drain"), e;
+	}
+	end(t, e, i) {
+		return typeof t == "function" && (i = t, t = void 0), typeof e == "function" && (i = e, e = "utf8"), t !== void 0 && this.write(t, e), i && this.once("end", i), this[q] = !0, this.writable = !1, (this[g] || !this[Qt]) && this[Q](), this;
+	}
+	[Bt]() {
+		this[w] || (!this[Rt] && !this[D].length && (this[F] = !0), this[Qt] = !1, this[g] = !0, this.emit("resume"), this[b].length ? this[De]() : this[q] ? this[Q]() : this.emit("drain"));
+	}
+	resume() {
+		return this[Bt]();
+	}
+	pause() {
+		this[g] = !1, this[Qt] = !0, this[F] = !1;
+	}
+	get destroyed() {
+		return this[w];
+	}
+	get flowing() {
+		return this[g];
+	}
+	get paused() {
+		return this[Qt];
+	}
+	[gi](t) {
+		this[L] ? this[_] += 1 : this[_] += t.length, this[b].push(t);
+	}
+	[Ae]() {
+		return this[L] ? this[_] -= 1 : this[_] -= this[b][0].length, this[b].shift();
+	}
+	[De](t = !1) {
+		do		;
+while (this[Ns](this[Ae]()) && this[b].length);
+		!t && !this[b].length && !this[q] && this.emit("drain");
+	}
+	[Ns](t) {
+		return this.emit("data", t), this[g];
+	}
+	pipe(t, e) {
+		if (this[w]) return t;
+		this[F] = !1;
+		let i = this[rt];
+		return e = e || {}, t === xs.stdout || t === xs.stderr ? e.end = !1 : e.end = e.end !== !1, e.proxyErrors = !!e.proxyErrors, i ? e.end && t.end() : (this[D].push(e.proxyErrors ? new xi(this, t, e) : new Fe(this, t, e)), this[Z] ? jt(() => this[Bt]()) : this[Bt]()), t;
+	}
+	unpipe(t) {
+		let e = this[D].find((i) => i.dest === t);
+		e && (this[D].length === 1 ? (this[g] && this[Rt] === 0 && (this[g] = !1), this[D] = []) : this[D].splice(this[D].indexOf(e), 1), e.unpipe());
+	}
+	addListener(t, e) {
+		return this.on(t, e);
+	}
+	on(t, e) {
+		let i = super.on(t, e);
+		if (t === "data") this[F] = !1, this[Rt]++, !this[D].length && !this[g] && this[Bt]();
+		else if (t === "readable" && this[_] !== 0) super.emit("readable");
+		else if (Gr(t) && this[rt]) super.emit(t), this.removeAllListeners(t);
+		else if (t === "error" && this[qt]) {
+			let r = e;
+			this[Z] ? jt(() => r.call(this, this[qt])) : r.call(this, this[qt]);
+		}
+		return i;
+	}
+	removeListener(t, e) {
+		return this.off(t, e);
+	}
+	off(t, e) {
+		let i = super.off(t, e);
+		return t === "data" && (this[Rt] = this.listeners("data").length, this[Rt] === 0 && !this[F] && !this[D].length && (this[g] = !1)), i;
+	}
+	removeAllListeners(t) {
+		let e = super.removeAllListeners(t);
+		return (t === "data" || t === void 0) && (this[Rt] = 0, !this[F] && !this[D].length && (this[g] = !1)), e;
+	}
+	get emittedEnd() {
+		return this[rt];
+	}
+	[Q]() {
+		!this[Le] && !this[rt] && !this[w] && this[b].length === 0 && this[q] && (this[Le] = !0, this.emit("end"), this.emit("prefinish"), this.emit("finish"), this[Ne] && this.emit("close"), this[Le] = !1);
+	}
+	emit(t, ...e) {
+		let i = e[0];
+		if (t !== "error" && t !== "close" && t !== w && this[w]) return !1;
+		if (t === "data") return !this[L] && !i ? !1 : this[Z] ? (jt(() => this[_i](i)), !0) : this[_i](i);
+		if (t === "end") return this[Ds]();
+		if (t === "close") {
+			if (this[Ne] = !0, !this[rt] && !this[w]) return !1;
+			let n = super.emit("close");
+			return this.removeAllListeners("close"), n;
+		} else if (t === "error") {
+			this[qt] = i, super.emit(bi, i);
+			let n = !this[Jt] || this.listeners("error").length ? super.emit("error", i) : !1;
+			return this[Q](), n;
+		} else if (t === "resume") {
+			let n = super.emit("resume");
+			return this[Q](), n;
+		} else if (t === "finish" || t === "prefinish") {
+			let n = super.emit(t);
+			return this.removeAllListeners(t), n;
+		}
+		let r = super.emit(t, ...e);
+		return this[Q](), r;
+	}
+	[_i](t) {
+		for (let i of this[D]) i.dest.write(t) === !1 && this.pause();
+		let e = this[F] ? !1 : super.emit("data", t);
+		return this[Q](), e;
+	}
+	[Ds]() {
+		return this[rt] ? !1 : (this[rt] = !0, this.readable = !1, this[Z] ? (jt(() => this[Oi]()), !0) : this[Oi]());
+	}
+	[Oi]() {
+		if (this[Mt]) {
+			let e = this[Mt].end();
+			if (e) {
+				for (let i of this[D]) i.dest.write(e);
+				this[F] || super.emit("data", e);
+			}
+		}
+		for (let e of this[D]) e.end();
+		let t = super.emit("end");
+		return this.removeAllListeners("end"), t;
+	}
+	async collect() {
+		let t = Object.assign([], { dataLength: 0 });
+		this[L] || (t.dataLength = 0);
+		let e = this.promise();
+		return this.on("data", (i) => {
+			t.push(i), this[L] || (t.dataLength += i.length);
+		}), await e, t;
 	}
 	async concat() {
 		if (this[L]) throw new Error("cannot concat in objectMode");
@@ -38546,629 +39011,180 @@ var require_zipEntries = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				else throw new Error("Corrupted zip: can't find end of central directory");
 			}
 			this.reader.setIndex(offset);
-			var endOfCentralDirOffset = offset;
-			this.checkSignature(sig.CENTRAL_DIRECTORY_END);
-			this.readBlockEndOfCentral();
-			if (this.diskNumber === utils.MAX_VALUE_16BITS || this.diskWithCentralDirStart === utils.MAX_VALUE_16BITS || this.centralDirRecordsOnThisDisk === utils.MAX_VALUE_16BITS || this.centralDirRecords === utils.MAX_VALUE_16BITS || this.centralDirSize === utils.MAX_VALUE_32BITS || this.centralDirOffset === utils.MAX_VALUE_32BITS) {
-				this.zip64 = true;
-				offset = this.reader.lastIndexOfSignature(sig.ZIP64_CENTRAL_DIRECTORY_LOCATOR);
-				if (offset < 0) throw new Error("Corrupted zip: can't find the ZIP64 end of central directory locator");
-				this.reader.setIndex(offset);
-				this.checkSignature(sig.ZIP64_CENTRAL_DIRECTORY_LOCATOR);
-				this.readBlockZip64EndOfCentralLocator();
-				if (!this.isSignature(this.relativeOffsetEndOfZip64CentralDir, sig.ZIP64_CENTRAL_DIRECTORY_END)) {
-					this.relativeOffsetEndOfZip64CentralDir = this.reader.lastIndexOfSignature(sig.ZIP64_CENTRAL_DIRECTORY_END);
-					if (this.relativeOffsetEndOfZip64CentralDir < 0) throw new Error("Corrupted zip: can't find the ZIP64 end of central directory");
-				}
-				this.reader.setIndex(this.relativeOffsetEndOfZip64CentralDir);
-				this.checkSignature(sig.ZIP64_CENTRAL_DIRECTORY_END);
-				this.readBlockZip64EndOfCentral();
-			}
-			var expectedEndOfCentralDirOffset = this.centralDirOffset + this.centralDirSize;
-			if (this.zip64) {
-				expectedEndOfCentralDirOffset += 20;
-				expectedEndOfCentralDirOffset += 12 + this.zip64EndOfCentralSize;
-			}
-			var extraBytes = endOfCentralDirOffset - expectedEndOfCentralDirOffset;
-			if (extraBytes > 0) {
-				if (this.isSignature(endOfCentralDirOffset, sig.CENTRAL_FILE_HEADER)) {} else this.reader.zero = extraBytes;
-			} else if (extraBytes < 0) throw new Error("Corrupted zip: missing " + Math.abs(extraBytes) + " bytes.");
-		},
-		prepareReader: function(data) {
-			this.reader = readerFor(data);
-		},
-		/**
-		* Read a zip file and create ZipEntries.
-		* @param {String|ArrayBuffer|Uint8Array|Buffer} data the binary string representing a zip file.
-		*/
-		load: function(data) {
-			this.prepareReader(data);
-			this.readEndOfCentral();
-			this.readCentralDir();
-			this.readLocalFiles();
-		}
-	};
-	module.exports = ZipEntries;
-}));
-//#endregion
-//#region ../../node_modules/.pnpm/jszip@3.10.1/node_modules/jszip/lib/load.js
-var require_load = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var utils = require_utils();
-	var external = require_external();
-	var utf8 = require_utf8();
-	var ZipEntries = require_zipEntries();
-	var Crc32Probe = require_Crc32Probe();
-	var nodejsUtils = require_nodejsUtils();
-	/**
-	* Check the CRC32 of an entry.
-	* @param {ZipEntry} zipEntry the zip entry to check.
-	* @return {Promise} the result.
-	*/
-	function checkEntryCRC32(zipEntry) {
-		return new external.Promise(function(resolve, reject) {
-			var worker = zipEntry.decompressed.getContentWorker().pipe(new Crc32Probe());
-			worker.on("error", function(e) {
-				reject(e);
-			}).on("end", function() {
-				if (worker.streamInfo.crc32 !== zipEntry.decompressed.crc32) reject(/* @__PURE__ */ new Error("Corrupted zip : CRC32 mismatch"));
-				else resolve();
-			}).resume();
-		});
-	}
-	module.exports = function(data, options) {
-		var zip = this;
-		options = utils.extend(options || {}, {
-			base64: false,
-			checkCRC32: false,
-			optimizedBinaryString: false,
-			createFolders: false,
-			decodeFileName: utf8.utf8decode
-		});
-		if (nodejsUtils.isNode && nodejsUtils.isStream(data)) return external.Promise.reject(/* @__PURE__ */ new Error("JSZip can't accept a stream when loading a zip file."));
-		return utils.prepareContent("the loaded zip file", data, true, options.optimizedBinaryString, options.base64).then(function(data) {
-			var zipEntries = new ZipEntries(options);
-			zipEntries.load(data);
-			return zipEntries;
-		}).then(function checkCRC32(zipEntries) {
-			var promises = [external.Promise.resolve(zipEntries)];
-			var files = zipEntries.files;
-			if (options.checkCRC32) for (var i = 0; i < files.length; i++) promises.push(checkEntryCRC32(files[i]));
-			return external.Promise.all(promises);
-		}).then(function addFiles(results) {
-			var zipEntries = results.shift();
-			var files = zipEntries.files;
-			for (var i = 0; i < files.length; i++) {
-				var input = files[i];
-				var unsafeName = input.fileNameStr;
-				var safeName = utils.resolve(input.fileNameStr);
-				zip.file(safeName, input.decompressed, {
-					binary: true,
-					optimizedBinaryString: true,
-					date: input.date,
-					dir: input.dir,
-					comment: input.fileCommentStr.length ? input.fileCommentStr : null,
-					unixPermissions: input.unixPermissions,
-					dosPermissions: input.dosPermissions,
-					createFolders: options.createFolders
-				});
-				if (!input.dir) zip.file(safeName).unsafeOriginalName = unsafeName;
-			}
-			if (zipEntries.zipComment.length) zip.comment = zipEntries.zipComment;
-			return zip;
-		});
-	};
-}));
-//#endregion
-//#region src/createZip.ts
-var import_lib = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
-	/**
-	* Representation a of zip file in js
-	* @constructor
-	*/
-	function JSZip() {
-		if (!(this instanceof JSZip)) return new JSZip();
-		if (arguments.length) throw new Error("The constructor with parameters has been removed in JSZip 3.0, please check the upgrade guide.");
-		this.files = Object.create(null);
-		this.comment = null;
-		this.root = "";
-		this.clone = function() {
-			var newObj = new JSZip();
-			for (var i in this) if (typeof this[i] !== "function") newObj[i] = this[i];
-			return newObj;
-		};
-	}
-	JSZip.prototype = require_object();
-	JSZip.prototype.loadAsync = require_load();
-	JSZip.support = require_support();
-	JSZip.defaults = require_defaults();
-	JSZip.version = "3.10.1";
-	JSZip.loadAsync = function(content, options) {
-		return new JSZip().loadAsync(content, options);
-	};
-	JSZip.external = require_external();
-	module.exports = JSZip;
-})))(), 1);
-const createZip = async ({ outfile, targetDir, excludeExts = [] }) => {
-	const zip = new import_lib.default();
-	await fs$1.rm(outfile, { force: true });
-	async function addFiles(dir, zipFolder) {
-		const files = await fs$1.readdir(dir);
-		files.sort();
-		for (const file of files) {
-			if (excludeExts.some((pattern) => file.includes(pattern))) continue;
-			const fullPath = path.join(dir, file);
-			if ((await fs$1.stat(fullPath)).isDirectory()) {
-				const folder = zipFolder.folder(file);
-				if (!folder) continue;
-				await addFiles(fullPath, folder);
-			} else {
-				const data = await fs$1.readFile(fullPath);
-				zipFolder.file(file, data);
-			}
-		}
-	}
-	await addFiles(targetDir, zip);
-	zip.forEach((_, file) => {
-		file.date = /* @__PURE__ */ new Date(0);
-	});
-	const content = await zip.generateAsync({
-		type: "nodebuffer",
-		compression: "DEFLATE",
-		compressionOptions: { level: 9 },
-		platform: "UNIX"
-	});
-	await fs$1.mkdir(path.dirname(outfile), { recursive: true });
-	await fs$1.writeFile(outfile, content);
-	return outfile;
-};
-//#endregion
-//#region src/credentialFiles.ts
-const TERMINATION_SIGNALS = [
-	"SIGHUP",
-	"SIGINT",
-	"SIGTERM"
-];
-const liveDirectories = /* @__PURE__ */ new Set();
-const onSignal = (signal) => {
-	removeLiveDirectories();
-	if (process.listenerCount(signal) === 0) process.kill(process.pid, signal);
-};
-const removeLiveDirectories = () => {
-	for (const directory of liveDirectories) rmSync(directory, {
-		force: true,
-		recursive: true
-	});
-	liveDirectories.clear();
-	stopListening();
-};
-const startListening = () => {
-	process.on("exit", removeLiveDirectories);
-	for (const signal of TERMINATION_SIGNALS) process.on(signal, onSignal);
-};
-const stopListening = () => {
-	process.off("exit", removeLiveDirectories);
-	for (const signal of TERMINATION_SIGNALS) process.off(signal, onSignal);
-};
-const trackDirectory = (directory) => {
-	if (liveDirectories.size === 0) startListening();
-	liveDirectories.add(directory);
-};
-const untrackDirectory = (directory) => {
-	if (liveDirectories.delete(directory) && liveDirectories.size === 0) stopListening();
-};
-/**
-* Creates the temporary files of one credential resolver: a `mkdtemp`
-* directory, created on the first write and removed by `dispose` or, if the
-* process exits first, on `exit` or a termination signal.
-*/
-const createCredentialFiles = () => {
-	let directory;
-	let disposal;
-	const ensureDirectory = () => {
-		directory ??= fs$2.mkdtemp(path$1.join(os.tmpdir(), "hot-updater-credentials-")).then((created) => {
-			trackDirectory(created);
-			return created;
-		});
-		return directory;
-	};
-	return {
-		write: async (fileName, contents) => {
-			if (disposal) throw new Error("The credential files have been disposed.");
-			if (typeof contents === "string") registerSecretValue(contents);
-			const fileDirectory = await fs$2.mkdtemp(path$1.join(await ensureDirectory(), "item-"));
-			const filePath = path$1.join(fileDirectory, path$1.basename(fileName));
-			await fs$2.writeFile(filePath, contents, {
-				flag: "wx",
-				mode: 384
-			});
-			return filePath;
-		},
-		dispose: () => {
-			disposal ??= (async () => {
-				const created = await directory?.catch(() => void 0);
-				if (!created) return;
-				await fs$2.rm(created, {
-					force: true,
-					recursive: true
-				});
-				untrackDirectory(created);
-			})();
-			return disposal;
-		}
-	};
-};
-//#endregion
-//#region src/credentialResolver.ts
-/** Passwords are read as set: trimming would change them. */
-const UNTRIMMED_ENV_NAMES = /* @__PURE__ */ new Set(["HOT_UPDATER_ANDROID_KEYSTORE_PASSWORD", "HOT_UPDATER_ANDROID_KEY_PASSWORD"]);
-const describeField = ([name, alternative]) => alternative ? `${name} (or ${alternative})` : name;
-const describeFields = (fields) => {
-	const described = fields.map(describeField);
-	if (described.length <= 2) return described.join(" and ");
-	return `${described.slice(0, -1).join(", ")}, and ${described.at(-1)}`;
-};
-/**
-* A command to print, broken at spaces with ` \` once a line would pass
-* 74 columns, each continuation indented two spaces, so a terminal never
-* wraps it mid-word and it still pastes as one command.
-*/
-const formatCommand = (command) => {
-	const lines = [];
-	let line = "";
-	for (const word of command.split(" ")) {
-		const next = line ? `${line} ${word}` : word;
-		if (line && next.length > 72) {
-			lines.push(`${line} \\`);
-			line = `  ${word}`;
-		} else line = next;
-	}
-	lines.push(line);
-	return lines.join("\n");
-};
-/**
-* `lead` and the command it names on one line when they fit 77 columns,
-* else the command on the lines after it.
-*/
-const withLead = (lead, command) => lead.length + 1 + command.length <= 77 ? `${lead} ${command}` : `${lead}\n${formatCommand(command)}`;
-/**
-* Why a build has no upload keystore, steering away from a second key:
-* Play rejects builds signed with a key it does not have. Under a team's
-* adapter the keystore is someone's already, so it is imported, never
-* created; only `localSecrets()` alone offers a new one, for an app with
-* no `.aab` on Play yet.
-*/
-const describeMissingKeystore = (store, item, name) => {
-	const configured = getConfiguredAdapter(store);
-	if (configured) return [
-		`No ${item} in ${describeSecret(configured, name)}.`,
-		"Ask whoever set it up to store it there, or import it with:",
-		formatCommand(credentialPutCommand("android-keystore", name))
-	].join("\n");
-	return [
-		`No ${item} in the ${store.name} secrets adapter.`,
-		withLead("Store the app's upload key:", credentialPutCommand("android-keystore", name)),
-		withLead("No .aab on Play yet? Create one:", credentialIssueCommand("android-keystore", name))
-	].join("\n");
-};
-/** The file each `secrets put <name> <file>` command names. */
-const PUT_FILES = {
-	"android-keystore": "<upload.jks>",
-	"play-service-account": "<key.json>"
-};
-/**
-* The command that stores the file you have as `name`: the service
-* account's JSON key, or the app's upload keystore. `--kind` is named only
-* for a name that is not the kind.
-*/
-const credentialPutCommand = (kind, name = kind) => `npx hot-updater secrets put ${name}${name === kind ? "" : ` --kind ${kind}`} ${PUT_FILES[kind]}`;
-/**
-* The command that stores the key Hot Updater issues as `name`: an App
-* Store Connect API key after an Apple Account sign-in, and an upload
-* keystore it creates.
-*/
-const credentialIssueCommand = (kind, name = kind) => `npx hot-updater secrets issue ${kind}${name === kind ? "" : ` ${name}`}`;
-/** The command group of each issued kind's shortcut, `<group> login`. */
-const CREDENTIAL_LOGIN_GROUPS = { "asc-api-key": "apple" };
-/**
-* The command people meet first that issues `kind` as `name`: its shortcut,
-* `apple login` for an App Store Connect API key, which takes nothing and
-* stores the kind's own name; for another name, `credentialIssueCommand`.
-*/
-const credentialLoginCommand = (kind, name = kind) => name === kind ? `npx hot-updater ${CREDENTIAL_LOGIN_GROUPS[kind]} login` : credentialIssueCommand(kind, name);
-/**
-* The command that stores a missing credential of `kind` as `name`: the
-* key Hot Updater issues after an Apple sign-in, or the file you have.
-*/
-const credentialStoreCommand = (kind, name = kind) => kind === "asc-api-key" ? credentialLoginCommand(kind, name) : credentialPutCommand(kind, name);
-var CredentialUnavailableError = class extends Error {
-	kind;
-	/** The environment variables that can provide this credential. */
-	envNames;
-	constructor(kind, message, options) {
-		super(message, options);
-		this.name = "CredentialUnavailableError";
-		this.kind = kind;
-		this.envNames = CREDENTIAL_ENV_NAMES[kind].flat();
-	}
-};
-const readEnvField = (env, field) => {
-	for (const name of field) {
-		const value = UNTRIMMED_ENV_NAMES.has(name) ? (process.env[name] ?? env[name]) || void 0 : getHotUpdaterEnvValue(env, name);
-		if (value !== void 0) return {
-			name,
-			value
-		};
-	}
-};
-const readFileField = async (kind, { name, value }) => {
-	const filePath = path$1.resolve(value);
-	if (!await fs$2.stat(filePath).then(async (stats) => {
-		await fs$2.access(filePath, fs$2.constants.R_OK);
-		return stats.isFile();
-	}).catch(() => false)) throw new CredentialUnavailableError(kind, `${name} does not point to a readable file.`);
-	return filePath;
-};
-const parseServiceAccount = (json) => {
-	try {
-		return JSON.parse(json);
-	} catch {
-		return;
-	}
-};
-const fromEnv = {
-	"asc-api-key": async ([key, keyId, issuerId], { files }) => ({
-		keyPath: key.name === "HOT_UPDATER_ASC_KEY_PATH" ? await readFileField("asc-api-key", key) : await files.write(`AuthKey_${keyId.value}.p8`, key.value.includes("\n") ? key.value : key.value.replaceAll("\\n", "\n")),
-		keyId: keyId.value,
-		issuerId: issuerId.value
-	}),
-	"android-keystore": async ([keystore, storePassword, keyAlias, keyPassword], { files, name }) => {
-		let storeFile;
-		if (keystore.name === "HOT_UPDATER_ANDROID_KEYSTORE_PATH") storeFile = await readFileField("android-keystore", keystore);
-		else {
-			registerSecretValue(keystore.value);
-			const contents = decodeBase64(keystore.value);
-			if (!contents) throw new CredentialUnavailableError("android-keystore", `${keystore.name} is not a base64-encoded keystore.`);
-			storeFile = await files.write(`${name}.keystore`, contents);
-		}
-		return {
-			storeFile,
-			storePassword: storePassword.value,
-			keyAlias: keyAlias.value,
-			keyPassword: keyPassword.value
-		};
-	},
-	"play-service-account": async ([serviceAccount]) => {
-		const json = serviceAccount.name === "HOT_UPDATER_PLAY_SERVICE_ACCOUNT_PATH" ? await fs$2.readFile(await readFileField("play-service-account", serviceAccount), "utf-8") : serviceAccount.value;
-		const parsed = parseServiceAccount(json);
-		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new CredentialUnavailableError("play-service-account", `${serviceAccount.name} is not a service account JSON object.`);
-		return { json };
-	}
-};
-/** Fields of a service account that are no secret: its type and Google's endpoints. */
-/**
-* Fields of a JSON credential that identify it rather than grant access:
-* its IDs, key alias, and a service account's email, project, type, and
-* Google's endpoints. They stay readable, as messages name them, and a
-* short one, such as the alias `release`, would mask every word it is in.
-*/
-const isIdentifierField = (field) => [
-	"keyId",
-	"issuerId",
-	"keyAlias",
-	"type",
-	"project_id",
-	"client_email",
-	"client_id",
-	"private_key_id",
-	"universe_domain"
-].includes(field) || field.endsWith("_uri") || field.endsWith("_url");
-const registerJsonSecrets = (value, fields) => {
-	registerSecretValue(value);
-	for (const [field, entry] of Object.entries(fields)) if (typeof entry === "string" && !isIdentifierField(field)) registerSecretValue(entry);
-};
-/**
-* Masks a credential's JSON value in the CLI's output: the whole value, and
-* each field but those that identify it, such as `keyId` and `keyAlias`,
-* so a password or a key a log prints alone stays masked. A value that is
-* no JSON object is masked whole.
-*/
-const registerCredentialValue = (value) => {
-	const parsed = parseObject(value);
-	if (parsed) registerJsonSecrets(value, parsed);
-	else registerSecretValue(value);
-};
-const parseObject = (value) => {
-	const parsed = parseServiceAccount(value);
-	return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
-};
-/**
-* The fields of a JSON credential, each a non-empty string, or an error
-* naming the shape `kind` takes.
-*/
-const readJsonFields = (kind, item, value, fields) => {
-	const parsed = parseObject(value);
-	const shape = `{${fields.map((field) => `"${field}"`).join(", ")}}`;
-	if (!parsed) throw new CredentialUnavailableError(kind, `${item} is not a JSON object.\n${capitalize(aKind(kind))} is one JSON value: ${shape}`);
-	registerJsonSecrets(value, parsed);
-	const missing = fields.filter((field) => typeof parsed[field] !== "string" || !parsed[field]);
-	if (missing.length > 0) throw new CredentialUnavailableError(kind, `${item} has no ${missing.join(", ")}.\n${capitalize(aKind(kind))} is one JSON value: ${shape}`);
-	return parsed;
-};
-const aKind = (kind) => `${/^[aeiou]/u.test(kind) ? "an" : "a"} ${kind}`;
-const capitalize = (text) => text.charAt(0).toUpperCase() + text.slice(1);
-/** A base64 value's bytes, or undefined when it is not base64. */
-const decodeBase64 = (value) => {
-	const base64 = value.replace(/\s/g, "");
-	const contents = Buffer.from(base64, "base64");
-	return contents.length > 0 && contents.toString("base64").replace(/=+$/, "") === base64.replace(/=+$/, "") ? contents : void 0;
-};
-/**
-* Each kind from the one string a secrets adapter holds for it: a JSON
-* object for the App Store Connect key (`p8` is the PEM) and the keystore
-* (`keystore` is base64), and the service account's own JSON. File values
-* are written with `files`; every value is masked.
-*/
-const fromSecretValue = {
-	"asc-api-key": async (value, { files, item }) => {
-		const { keyId, issuerId, p8 } = readJsonFields("asc-api-key", item, value, [
-			"keyId",
-			"issuerId",
-			"p8"
-		]);
-		return {
-			keyPath: await files.write(`AuthKey_${keyId}.p8`, p8.includes("\n") ? p8 : p8.replaceAll("\\n", "\n")),
-			keyId,
-			issuerId
-		};
-	},
-	"android-keystore": async (value, { files, name, item }) => {
-		const { keystore, storePassword, keyAlias, keyPassword } = readJsonFields("android-keystore", item, value, [
-			"keystore",
-			"storePassword",
-			"keyAlias",
-			"keyPassword"
-		]);
-		const contents = decodeBase64(keystore);
-		if (!contents) throw new CredentialUnavailableError("android-keystore", `${item}'s keystore is not a base64-encoded keystore.`);
-		return {
-			storeFile: await files.write(`${name}.keystore`, contents),
-			storePassword,
-			keyAlias,
-			keyPassword
-		};
-	},
-	"play-service-account": async (value, { item }) => {
-		const parsed = parseObject(value);
-		if (!parsed) throw new CredentialUnavailableError("play-service-account", `${item} is not a service account JSON object.`);
-		registerJsonSecrets(value, parsed);
-		return { json: value };
-	}
-};
-const registerCredentialSecrets = (kind, credential) => {
-	if (kind === "android-keystore") {
-		const keystore = credential;
-		registerSecretValue(keystore.storePassword);
-		registerSecretValue(keystore.keyPassword);
-	}
-	if (kind === "play-service-account") {
-		const { json } = credential;
-		registerSecretValue(json);
-		const privateKey = parseServiceAccount(json)?.private_key;
-		if (typeof privateKey === "string") registerSecretValue(privateKey);
-	}
-};
-/**
-* Reads names from `secrets`, the names asked for in one turn of the event
-* loop, such as a build's credentials, in one `get`. Nothing is cached.
-*/
-const createSecretLoader = (secrets, cwd) => {
-	let batch;
-	const flush = async (names) => {
-		try {
-			const read = await secrets().get([...names.keys()], { cwd: cwd() });
-			for (const [name, waiters] of names) {
-				const value = Object.hasOwn(read, name) ? read[name] : void 0;
-				for (const waiter of waiters) waiter.resolve(typeof value === "string" && value ? value : void 0);
+			var endOfCentralDirOffset = offset;
+			this.checkSignature(sig.CENTRAL_DIRECTORY_END);
+			this.readBlockEndOfCentral();
+			if (this.diskNumber === utils.MAX_VALUE_16BITS || this.diskWithCentralDirStart === utils.MAX_VALUE_16BITS || this.centralDirRecordsOnThisDisk === utils.MAX_VALUE_16BITS || this.centralDirRecords === utils.MAX_VALUE_16BITS || this.centralDirSize === utils.MAX_VALUE_32BITS || this.centralDirOffset === utils.MAX_VALUE_32BITS) {
+				this.zip64 = true;
+				offset = this.reader.lastIndexOfSignature(sig.ZIP64_CENTRAL_DIRECTORY_LOCATOR);
+				if (offset < 0) throw new Error("Corrupted zip: can't find the ZIP64 end of central directory locator");
+				this.reader.setIndex(offset);
+				this.checkSignature(sig.ZIP64_CENTRAL_DIRECTORY_LOCATOR);
+				this.readBlockZip64EndOfCentralLocator();
+				if (!this.isSignature(this.relativeOffsetEndOfZip64CentralDir, sig.ZIP64_CENTRAL_DIRECTORY_END)) {
+					this.relativeOffsetEndOfZip64CentralDir = this.reader.lastIndexOfSignature(sig.ZIP64_CENTRAL_DIRECTORY_END);
+					if (this.relativeOffsetEndOfZip64CentralDir < 0) throw new Error("Corrupted zip: can't find the ZIP64 end of central directory");
+				}
+				this.reader.setIndex(this.relativeOffsetEndOfZip64CentralDir);
+				this.checkSignature(sig.ZIP64_CENTRAL_DIRECTORY_END);
+				this.readBlockZip64EndOfCentral();
 			}
-		} catch (error) {
-			for (const waiters of names.values()) for (const waiter of waiters) waiter.reject(error);
+			var expectedEndOfCentralDirOffset = this.centralDirOffset + this.centralDirSize;
+			if (this.zip64) {
+				expectedEndOfCentralDirOffset += 20;
+				expectedEndOfCentralDirOffset += 12 + this.zip64EndOfCentralSize;
+			}
+			var extraBytes = endOfCentralDirOffset - expectedEndOfCentralDirOffset;
+			if (extraBytes > 0) {
+				if (this.isSignature(endOfCentralDirOffset, sig.CENTRAL_FILE_HEADER)) {} else this.reader.zero = extraBytes;
+			} else if (extraBytes < 0) throw new Error("Corrupted zip: missing " + Math.abs(extraBytes) + " bytes.");
+		},
+		prepareReader: function(data) {
+			this.reader = readerFor(data);
+		},
+		/**
+		* Read a zip file and create ZipEntries.
+		* @param {String|ArrayBuffer|Uint8Array|Buffer} data the binary string representing a zip file.
+		*/
+		load: function(data) {
+			this.prepareReader(data);
+			this.readEndOfCentral();
+			this.readCentralDir();
+			this.readLocalFiles();
 		}
 	};
-	return (name) => new Promise((resolve, reject) => {
-		if (batch === void 0) {
-			const names = /* @__PURE__ */ new Map();
-			batch = names;
-			setTimeout(() => {
-				batch = void 0;
-				flush(names);
-			}, 0);
-		}
-		const waiters = batch.get(name) ?? [];
-		waiters.push({
-			resolve,
-			reject
+	module.exports = ZipEntries;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/jszip@3.10.1/node_modules/jszip/lib/load.js
+var require_load = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var utils = require_utils();
+	var external = require_external();
+	var utf8 = require_utf8();
+	var ZipEntries = require_zipEntries();
+	var Crc32Probe = require_Crc32Probe();
+	var nodejsUtils = require_nodejsUtils();
+	/**
+	* Check the CRC32 of an entry.
+	* @param {ZipEntry} zipEntry the zip entry to check.
+	* @return {Promise} the result.
+	*/
+	function checkEntryCRC32(zipEntry) {
+		return new external.Promise(function(resolve, reject) {
+			var worker = zipEntry.decompressed.getContentWorker().pipe(new Crc32Probe());
+			worker.on("error", function(e) {
+				reject(e);
+			}).on("end", function() {
+				if (worker.streamInfo.crc32 !== zipEntry.decompressed.crc32) reject(/* @__PURE__ */ new Error("Corrupted zip : CRC32 mismatch"));
+				else resolve();
+			}).resume();
 		});
-		batch.set(name, waiters);
-	});
-};
-/**
-* Resolves each item from its environment overrides when any is set, and
-* otherwise from the config's `secrets` adapter as one value named by the
-* item, so overrides never reach the store. When the adapter fails or holds
-* no such value, the error names the environment variables that can
-* provide the item instead. Nothing is cached, values are never written to
-* disk except as 0600 temporary files, are never set in `process.env`, and
-* every secret is masked in logs.
-*/
-const createCredentialResolver = ({ env = {}, secrets, cwd } = {}) => {
-	const files = createCredentialFiles();
-	const resolved = /* @__PURE__ */ new Map();
-	let disposal;
-	const adapter = () => typeof secrets === "function" ? secrets() : secrets ?? getConfiguredSecrets();
-	const load = createSecretLoader(adapter, () => cwd ?? getCwd());
-	const resolveItem = async (kind, name) => {
-		const fields = CREDENTIAL_ENV_NAMES[kind];
-		const values = fields.map((field) => readEnvField(env, field));
-		if (values.some((value) => value !== void 0)) {
-			const missing = fields.filter((_, index) => !values[index]);
-			if (missing.length > 0) throw new CredentialUnavailableError(kind, `The environment overrides ${kind} but ${describeFields(missing)} ${missing.length === 1 ? "is" : "are"} not set.`);
-			const credential = await fromEnv[kind](values, {
-				files,
-				name
-			});
-			registerCredentialSecrets(kind, credential);
-			return credential;
-		}
-		const store = adapter();
-		const item = name === kind ? kind : `${name} (${kind})`;
-		let value;
-		try {
-			value = await load(name);
-		} catch (error) {
-			const reason = error instanceof Error ? error.message : String(error);
-			throw new CredentialUnavailableError(kind, `Couldn't read ${item} from the ${store.name} secrets adapter.\n${reason}`, { cause: error });
-		}
-		if (value === void 0) throw new CredentialUnavailableError(kind, kind === "android-keystore" ? describeMissingKeystore(store, item, name) : `No ${item} in the ${store.name} secrets adapter.\nStore it once with:\n${formatCommand(credentialStoreCommand(kind, name))}`);
-		registerSecretValue(value);
-		return fromSecretValue[kind](value, {
-			files,
-			name,
-			item: `The ${store.name} secrets adapter's ${item}`
+	}
+	module.exports = function(data, options) {
+		var zip = this;
+		options = utils.extend(options || {}, {
+			base64: false,
+			checkCRC32: false,
+			optimizedBinaryString: false,
+			createFolders: false,
+			decodeFileName: utf8.utf8decode
+		});
+		if (nodejsUtils.isNode && nodejsUtils.isStream(data)) return external.Promise.reject(/* @__PURE__ */ new Error("JSZip can't accept a stream when loading a zip file."));
+		return utils.prepareContent("the loaded zip file", data, true, options.optimizedBinaryString, options.base64).then(function(data) {
+			var zipEntries = new ZipEntries(options);
+			zipEntries.load(data);
+			return zipEntries;
+		}).then(function checkCRC32(zipEntries) {
+			var promises = [external.Promise.resolve(zipEntries)];
+			var files = zipEntries.files;
+			if (options.checkCRC32) for (var i = 0; i < files.length; i++) promises.push(checkEntryCRC32(files[i]));
+			return external.Promise.all(promises);
+		}).then(function addFiles(results) {
+			var zipEntries = results.shift();
+			var files = zipEntries.files;
+			for (var i = 0; i < files.length; i++) {
+				var input = files[i];
+				var unsafeName = input.fileNameStr;
+				var safeName = utils.resolve(input.fileNameStr);
+				zip.file(safeName, input.decompressed, {
+					binary: true,
+					optimizedBinaryString: true,
+					date: input.date,
+					dir: input.dir,
+					comment: input.fileCommentStr.length ? input.fileCommentStr : null,
+					unixPermissions: input.unixPermissions,
+					dosPermissions: input.dosPermissions,
+					createFolders: options.createFolders
+				});
+				if (!input.dir) zip.file(safeName).unsafeOriginalName = unsafeName;
+			}
+			if (zipEntries.zipComment.length) zip.comment = zipEntries.zipComment;
+			return zip;
 		});
 	};
-	return {
-		resolve: ({ kind, name = kind }) => {
-			if (disposal) return Promise.reject(/* @__PURE__ */ new Error("The credential resolver has been disposed."));
-			const key = `${kind}\u0000${name}`;
-			let pending = resolved.get(key);
-			if (!pending) {
-				pending = resolveItem(kind, name);
-				resolved.set(key, pending);
-				pending.catch(() => resolved.delete(key));
+}));
+//#endregion
+//#region src/createZip.ts
+var import_lib = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
+	/**
+	* Representation a of zip file in js
+	* @constructor
+	*/
+	function JSZip() {
+		if (!(this instanceof JSZip)) return new JSZip();
+		if (arguments.length) throw new Error("The constructor with parameters has been removed in JSZip 3.0, please check the upgrade guide.");
+		this.files = Object.create(null);
+		this.comment = null;
+		this.root = "";
+		this.clone = function() {
+			var newObj = new JSZip();
+			for (var i in this) if (typeof this[i] !== "function") newObj[i] = this[i];
+			return newObj;
+		};
+	}
+	JSZip.prototype = require_object();
+	JSZip.prototype.loadAsync = require_load();
+	JSZip.support = require_support();
+	JSZip.defaults = require_defaults();
+	JSZip.version = "3.10.1";
+	JSZip.loadAsync = function(content, options) {
+		return new JSZip().loadAsync(content, options);
+	};
+	JSZip.external = require_external();
+	module.exports = JSZip;
+})))(), 1);
+const createZip = async ({ outfile, targetDir, excludeExts = [] }) => {
+	const zip = new import_lib.default();
+	await fs$1.rm(outfile, { force: true });
+	async function addFiles(dir, zipFolder) {
+		const files = await fs$1.readdir(dir);
+		files.sort();
+		for (const file of files) {
+			if (excludeExts.some((pattern) => file.includes(pattern))) continue;
+			const fullPath = path.join(dir, file);
+			if ((await fs$1.stat(fullPath)).isDirectory()) {
+				const folder = zipFolder.folder(file);
+				if (!folder) continue;
+				await addFiles(fullPath, folder);
+			} else {
+				const data = await fs$1.readFile(fullPath);
+				zipFolder.file(file, data);
 			}
-			return pending;
-		},
-		dispose: () => {
-			disposal ??= (async () => {
-				await Promise.allSettled(resolved.values());
-				resolved.clear();
-				await files.dispose();
-			})();
-			return disposal;
 		}
-	};
-};
-/**
-* Runs `run` with a credential resolver and deletes its temporary files
-* when `run` settles.
-*/
-const withCredentialResolver = async (run, options) => {
-	const resolver = createCredentialResolver(options);
-	try {
-		return await run(resolver);
-	} finally {
-		await resolver.dispose();
 	}
+	await addFiles(targetDir, zip);
+	zip.forEach((_, file) => {
+		file.date = /* @__PURE__ */ new Date(0);
+	});
+	const content = await zip.generateAsync({
+		type: "nodebuffer",
+		compression: "DEFLATE",
+		compressionOptions: { level: 9 },
+		platform: "UNIX"
+	});
+	await fs$1.mkdir(path.dirname(outfile), { recursive: true });
+	await fs$1.writeFile(outfile, content);
+	return outfile;
 };
 //#endregion
 //#region src/isObject.ts
@@ -47745,4 +47761,4 @@ function transformTemplate(templateString, values) {
 	return result;
 }
 //#endregion
-export { BUNDLE_SIGNING_KEY_SECRET, BuildFailedError, BuildLogger, BundleSigningKeyError, CREDENTIAL_ENV_NAMES, CREDENTIAL_LOGIN_GROUPS, ConfigBuilder, CredentialUnavailableError, HOT_UPDATER_HOME_ENV, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, INTERFACE_FINGERPRINT_ENGINE, INVALID_SIGNING_MESSAGE, INVALID_SIGNING_NEXT_STEP, ISSUE_SIGNING_KEY_COMMAND, InitEnvFileError, InitError, LOCAL_SECRETS_NAME, LegacyInfrastructureError, MANAGED_CLIENT_CREDENTIAL_ENV, MissingInitInputsError, PUT_SIGNING_KEY_COMMAND, ServerDefinitionError, UNSIGNED_BUNDLES_NEXT_STEP, UNSIGNED_BUNDLES_WARNING, addSigningSecretToConfig, addSigningSecretToConfigText, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, assertUnreservedEnv, autolinkingConfigCommand, banner, bundleSigningSecretRef, clientAuthOf, typedColors as colors, configSetsTeamSecrets, confirmInitInputPersistence, copyDirToTmp, createCredentialResolver, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createInterfaceFingerprint, createLocalSecretsStore, createLogWriter, createMigrator, createMinBundleId, createStep, createTarBrTargetFiles, createZip, credentialIssueCommand, credentialLoginCommand, credentialPutCommand, credentialStoreCommand, decryptJson, defineInitProvider, describeSecret, describeStoredSecret, encryptJson, ensureInstallPackages, failActiveStep, formatDuration, generateClientCredential, generateSchema, generatesSchema, getAndroidSdkPath, getBundleSigningPublicKey, getConfiguredAdapter, getConfiguredSecrets, getCwd, getDeploySecretNames, getHotUpdaterEnvValue, getHotUpdaterHome, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getLocalKeyFile, getLocalKeyStoreDir, getLocalSecretsStore, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getProjectKey, getReactNativeMetadatas, getStorageFileByteSize, isCI, isCodegenSpecFile, isReservedVariableName, isSecretName, isSecretRef, isServerDefinition, keepsKeysOnThisMachine, link, loadConfig, loadPlatformConfigs, loadTeamSecrets, localSecrets, log, makeEnv, maskSecretValues, moduleSpecifiersOf, nonInteractiveReason, p, parseLoadedEnv, parseSecretReference, prepareBundleSigning, printAppSetup, printBanner, provisionClientCredential, putStorageFile, reactNativeCliFingerprint, reactNativeConfigCommand, readBundleSigningPublicKeyFile, readBundleSigningState, readHotUpdaterInitEnv, readLoadedEnvFile, readLoadedHotUpdaterEnv, readLocalKey, readMissingFromTeamSecrets, readPackageUp, readReactNativeInterface, readSecretVariables, readSecretWithSource, readSecrets, registerCredentialValue, registerSecretValue, renderAppImports, renderAppSetup, renderImportStatements, resolveExpoAutolinking, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolveLocalSecretsPath, resolvePackageVersion, resolveSecretsAdapter, secret, secretVariableName, serverDefinitionOf, setConfiguredSecrets, shouldAutoSelectOnlyInitResource, startStep, storeEnvFileSecrets, stripAnsi, transformEnv, transformTemplate, truncateLine, withCredentialResolver, withDuration, withSecretsScope, withStep, writeHotUpdaterConfig, writeHotUpdaterFiles, writeLocalKey };
+export { BUNDLE_SIGNING_KEY_SECRET, BuildFailedError, BuildLogger, BundleSigningKeyError, CREDENTIAL_ENV_NAMES, CREDENTIAL_LOGIN_GROUPS, ConfigBuilder, CredentialUnavailableError, HOT_UPDATER_HOME_ENV, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, INTERFACE_FINGERPRINT_ENGINE, INVALID_SIGNING_MESSAGE, INVALID_SIGNING_NEXT_STEP, ISSUE_SIGNING_KEY_COMMAND, InitEnvFileError, InitError, LOCAL_SECRETS_NAME, LegacyInfrastructureError, MANAGED_CLIENT_CREDENTIAL_ENV, MissingInitInputsError, PUT_SIGNING_KEY_COMMAND, ServerDefinitionError, UNSIGNED_BUNDLES_NEXT_STEP, UNSIGNED_BUNDLES_WARNING, addSigningSecretToConfig, addSigningSecretToConfigText, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, assertUnreservedEnv, autolinkingConfigCommand, banner, bundleSigningSecretRef, clientAuthOf, typedColors as colors, configSetsTeamSecrets, confirmInitInputPersistence, copyDirToTmp, createCredentialResolver, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createInterfaceFingerprint, createLocalSecretsStore, createLogWriter, createMigrator, createMinBundleId, createStep, createTarBrTargetFiles, createZip, credentialIssueCommand, credentialLoginCommand, credentialPutCommand, credentialStoreCommand, decryptJson, defineInitProvider, describeSecret, describeStoredSecret, encryptJson, ensureInstallPackages, failActiveStep, formatCommand, formatDuration, generateClientCredential, generateSchema, generatesSchema, getAndroidSdkPath, getBundleSigningPublicKey, getConfiguredAdapter, getConfiguredSecrets, getCwd, getDeploySecretNames, getHotUpdaterEnvValue, getHotUpdaterHome, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getLocalKeyFile, getLocalKeyStoreDir, getLocalSecretsStore, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getProjectKey, getReactNativeMetadatas, getStorageFileByteSize, isCI, isCodegenSpecFile, isReservedVariableName, isSecretName, isSecretRef, isServerDefinition, keepsKeysOnThisMachine, link, loadConfig, loadPlatformConfigs, loadTeamSecrets, localSecrets, log, makeEnv, maskSecretValues, moduleSpecifiersOf, nonInteractiveReason, p, parseLoadedEnv, parseSecretReference, prepareBundleSigning, printAppSetup, printBanner, provisionClientCredential, putStorageFile, reactNativeCliFingerprint, reactNativeConfigCommand, readBundleSigningPublicKeyFile, readBundleSigningState, readHotUpdaterInitEnv, readLoadedEnvFile, readLoadedHotUpdaterEnv, readLocalKey, readMissingFromTeamSecrets, readPackageUp, readReactNativeInterface, readSecretVariables, readSecretWithSource, readSecrets, registerCredentialValue, registerSecretValue, renderAppImports, renderAppSetup, renderImportStatements, resolveExpoAutolinking, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolveLocalSecretsPath, resolvePackageVersion, resolveSecretsAdapter, secret, secretVariableName, serverDefinitionOf, setConfiguredSecrets, shouldAutoSelectOnlyInitResource, startStep, storeEnvFileSecrets, stripAnsi, transformEnv, transformTemplate, truncateLine, withCredentialResolver, withDuration, withSecretsScope, withStep, writeHotUpdaterConfig, writeHotUpdaterFiles, writeLocalKey };