@hot-updater/cloudflare 1.2.0-rc.4 → 1.2.0-rc.5

package/dist/index.cjs

@@ -86,7 +86,12 @@ const encode = ({ sql, params }) => ({
 * time, or a batch D1 runs in one transaction.
 */
 const d1RestRunner = (config) => {
-	const cloudflare$1 = new cloudflare.default({ apiToken: config.cloudflareApiToken });
+	const { cloudflareApiToken } = config;
+	let client;
+	const connect = () => client ??= (async () => new cloudflare.default({ apiToken: typeof cloudflareApiToken === "function" ? await cloudflareApiToken() : cloudflareApiToken }))().catch((error) => {
+		client = void 0;
+		throw error;
+	});
 	const batch = async (statements) => {
 		const [first] = statements;
 		if (first === void 0) return [];
@@ -97,7 +102,7 @@ const d1RestRunner = (config) => {
 			account_id: config.accountId,
 			batch: statements.map(encode)
 		};
-		const page = await cloudflare$1.d1.database.query(config.databaseId, body);
+		const page = await (await connect()).d1.database.query(config.databaseId, body);
 		const results = [];
 		for await (const resultPage of page.iterPages()) for (const result of resultPage.result) results.push(toSqlResult(result));
 		if (results.length !== statements.length) throw new D1ExecutionError();

package/dist/index.d.cts

@@ -4,7 +4,12 @@ import { S3ClientConfig } from "@aws-sdk/client-s3";
 interface D1RestConfig {
   readonly databaseId: string;
   readonly accountId: string;
-  readonly cloudflareApiToken: string;
+  /**
+   * An API token with D1 edit permission, or a function that returns it,
+   * such as one that reads it with `secretEnv`: called on the first query,
+   * so a config loads without the token.
+   */
+  readonly cloudflareApiToken: string | (() => string | Promise<string>);
 }
 //#endregion
 //#region src/d1Executor.d.ts

package/dist/index.d.mts

@@ -4,7 +4,12 @@ import { S3ClientConfig } from "@aws-sdk/client-s3";
 interface D1RestConfig {
   readonly databaseId: string;
   readonly accountId: string;
-  readonly cloudflareApiToken: string;
+  /**
+   * An API token with D1 edit permission, or a function that returns it,
+   * such as one that reads it with `secretEnv`: called on the first query,
+   * so a config loads without the token.
+   */
+  readonly cloudflareApiToken: string | (() => string | Promise<string>);
 }
 //#endregion
 //#region src/d1Executor.d.ts

package/dist/index.mjs

@@ -62,7 +62,12 @@ const encode = ({ sql, params }) => ({
 * time, or a batch D1 runs in one transaction.
 */
 const d1RestRunner = (config) => {
-	const cloudflare = new Cloudflare({ apiToken: config.cloudflareApiToken });
+	const { cloudflareApiToken } = config;
+	let client;
+	const connect = () => client ??= (async () => new Cloudflare({ apiToken: typeof cloudflareApiToken === "function" ? await cloudflareApiToken() : cloudflareApiToken }))().catch((error) => {
+		client = void 0;
+		throw error;
+	});
 	const batch = async (statements) => {
 		const [first] = statements;
 		if (first === void 0) return [];
@@ -73,7 +78,7 @@ const d1RestRunner = (config) => {
 			account_id: config.accountId,
 			batch: statements.map(encode)
 		};
-		const page = await cloudflare.d1.database.query(config.databaseId, body);
+		const page = await (await connect()).d1.database.query(config.databaseId, body);
 		const results = [];
 		for await (const resultPage of page.iterPages()) for (const result of resultPage.result) results.push(toSqlResult(result));
 		if (results.length !== statements.length) throw new D1ExecutionError();

package/dist/init/index.cjs

@@ -113,7 +113,12 @@ const encode = ({ sql, params }) => ({
 * time, or a batch D1 runs in one transaction.
 */
 const d1RestRunner = (config) => {
-	const cloudflare$1 = new cloudflare.default({ apiToken: config.cloudflareApiToken });
+	const { cloudflareApiToken } = config;
+	let client;
+	const connect = () => client ??= (async () => new cloudflare.default({ apiToken: typeof cloudflareApiToken === "function" ? await cloudflareApiToken() : cloudflareApiToken }))().catch((error) => {
+		client = void 0;
+		throw error;
+	});
 	const batch = async (statements) => {
 		const [first] = statements;
 		if (first === void 0) return [];
@@ -124,7 +129,7 @@ const d1RestRunner = (config) => {
 			account_id: config.accountId,
 			batch: statements.map(encode)
 		};
-		const page = await cloudflare$1.d1.database.query(config.databaseId, body);
+		const page = await (await connect()).d1.database.query(config.databaseId, body);
 		const results = [];
 		for await (const resultPage of page.iterPages()) for (const result of resultPage.result) results.push(toSqlResult(result));
 		if (results.length !== statements.length) throw new D1ExecutionError();
@@ -11320,7 +11325,12 @@ const initProvider = {
 			},
 			validate: (value) => value === "true" || value === "false"
 		}
-	}
+	},
+	secrets: [
+		"HOT_UPDATER_CLOUDFLARE_API_TOKEN",
+		"HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID",
+		"HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY"
+	]
 };
 //#endregion
 //#region iac/cloudflareInitInputs.ts
@@ -11408,8 +11418,26 @@ const inputCloudflareInitSecrets = async ({ accountId, bucketName, apiToken, acc
 };
 //#endregion
 //#region iac/configTemplate.ts
-const getConfigScaffold = (build) => {
-	return (0, _hot_updater_cli_tools.createHotUpdaterConfigScaffoldFromBuilder)(new _hot_updater_cli_tools.ConfigBuilder().setBuildType(build).setStorage({
+/**
+* The config init writes. With the `resources` init set up, it names them,
+* and reads the API token and R2 keys with `secretEnv`, from the
+* environment and `.env.hotupdater`, then the config's `secrets` adapter.
+* Without them, as the agent scaffold writes it, it reads every value from
+* the environment.
+*/
+const getConfigScaffold = (build, resources) => {
+	const builder = new _hot_updater_cli_tools.ConfigBuilder().setBuildType(build).setPlugins({
+		imports: [{
+			pkg: "hot-updater/plugins",
+			named: [
+				"apiKeys",
+				"insights",
+				"remoteConfig"
+			]
+		}],
+		configString: "[apiKeys(), insights(), remoteConfig()]"
+	});
+	if (resources === void 0) return (0, _hot_updater_cli_tools.createHotUpdaterConfigScaffoldFromBuilder)(builder.setStorage({
 		imports: [{
 			pkg: "@hot-updater/cloudflare",
 			named: ["r2Storage"]
@@ -11432,17 +11460,42 @@ const getConfigScaffold = (build) => {
     accountId: process.env.HOT_UPDATER_CLOUDFLARE_ACCOUNT_ID!,
     cloudflareApiToken: process.env.HOT_UPDATER_CLOUDFLARE_API_TOKEN!,
   })`
-	}).setPlugins({
+	}));
+	const accountId = JSON.stringify(resources.accountId);
+	const storageConfig = {
 		imports: [{
-			pkg: "hot-updater/plugins",
-			named: [
-				"apiKeys",
-				"insights",
-				"remoteConfig"
-			]
+			pkg: "@hot-updater/cloudflare",
+			named: ["r2Storage"]
 		}],
-		configString: "[apiKeys(), insights(), remoteConfig()]"
-	}));
+		configString: `r2Storage({
+    bucketName: ${JSON.stringify(resources.bucketName)},
+    accountId: ${accountId},
+    credentials: async () => {
+      const env = await storageSecrets();
+      return {
+        accessKeyId: env.HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID,
+        secretAccessKey: env.HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY,
+      };
+    },
+  })`
+	};
+	const databaseConfig = {
+		imports: [{
+			pkg: "@hot-updater/cloudflare",
+			named: ["d1Database"]
+		}],
+		configString: `d1Database({
+    databaseId: ${JSON.stringify(resources.d1DatabaseId)},
+    accountId: ${accountId},
+    cloudflareApiToken: async () =>
+      (await databaseSecrets()).HOT_UPDATER_CLOUDFLARE_API_TOKEN,
+  })`
+	};
+	const helperStatements = [(0, _hot_updater_cli_tools.secretEnvHelper)("storageSecrets", ["HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID", "HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY"]), (0, _hot_updater_cli_tools.secretEnvHelper)("databaseSecrets", ["HOT_UPDATER_CLOUDFLARE_API_TOKEN"])];
+	return (0, _hot_updater_cli_tools.createHotUpdaterConfigScaffoldFromBuilder)(builder.setStorage(storageConfig).setDatabase(databaseConfig).addImport({
+		pkg: "hot-updater",
+		named: ["secretEnv"]
+	}).setIntermediateCode(helperStatements.map(({ code }) => code).join("\n\n")), { helperStatements });
 };
 //#endregion
 //#region iac/managedWorker.ts
@@ -11514,10 +11567,10 @@ const deployWorker = async (apiToken, accountId, { credentialSource, d1DatabaseI
 		await removeTmpDir();
 	}
 };
-const runInit = async ({ build, envFile }) => {
+const runInit = async ({ build, envFile, secretsEnv }) => {
 	const cwd = (0, _hot_updater_cli_tools.getCwd)();
 	const nonInteractive = envFile !== void 0;
-	const initEnvSources = await (0, _hot_updater_cli_tools.readHotUpdaterInitEnv)(cwd, envFile);
+	const initEnvSources = await (0, _hot_updater_cli_tools.readHotUpdaterInitEnv)(cwd, envFile, secretsEnv);
 	const { managedEnv } = initEnvSources;
 	const initInputEnv = (0, _hot_updater_cli_tools.getHotUpdaterInitInputEnv)(initEnvSources, nonInteractive);
 	const existingInputs = resolveCloudflareInitInputs(initInputEnv);
@@ -11867,7 +11920,11 @@ const runInit = async ({ build, envFile }) => {
 		await database.dispose?.();
 	}
 	_hot_updater_cli_tools.p.log.success("Generated '.env.hotupdater' file with Cloudflare settings.");
-	await (0, _hot_updater_cli_tools.writeHotUpdaterFiles)(getConfigScaffold(build), {
+	await (0, _hot_updater_cli_tools.writeHotUpdaterFiles)(getConfigScaffold(build, {
+		accountId,
+		bucketName: selectedBucketName,
+		d1DatabaseId: selectedD1DatabaseId
+	}), {
 		cwd,
 		settings: "Cloudflare"
 	});

package/dist/init/index.d.cts

@@ -82,9 +82,10 @@ declare const initProvider: {
       readonly validate: (value: string | undefined) => value is "true" | "false";
     };
   };
+  readonly secrets: readonly ["HOT_UPDATER_CLOUDFLARE_API_TOKEN", "HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID", "HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY"];
 };
 //#endregion
 //#region iac/index.d.ts
-declare const runInit: ({ build, envFile }: RunInitOptions) => Promise<void>;
+declare const runInit: ({ build, envFile, secretsEnv }: RunInitOptions) => Promise<void>;
 //#endregion
 export { initProvider, runInit };

package/dist/init/index.d.mts

@@ -82,9 +82,10 @@ declare const initProvider: {
       readonly validate: (value: string | undefined) => value is "true" | "false";
     };
   };
+  readonly secrets: readonly ["HOT_UPDATER_CLOUDFLARE_API_TOKEN", "HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID", "HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY"];
 };
 //#endregion
 //#region iac/index.d.ts
-declare const runInit: ({ build, envFile }: RunInitOptions) => Promise<void>;
+declare const runInit: ({ build, envFile, secretsEnv }: RunInitOptions) => Promise<void>;
 //#endregion
 export { initProvider, runInit };

package/dist/init/index.mjs

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
 import path from "path";
-import { ConfigBuilder, InitError, LegacyInfrastructureError, assembleServer, assertInfrastructureGenerationAtUrl, assertInitInputs, assertInitProviderInputs, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, printAppSetup, provisionClientCredential, readHotUpdaterInitEnv, resolveInitProviderInput, writeHotUpdaterFiles } from "@hot-updater/cli-tools";
+import { ConfigBuilder, InitError, LegacyInfrastructureError, assembleServer, assertInfrastructureGenerationAtUrl, assertInitInputs, assertInitProviderInputs, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, printAppSetup, provisionClientCredential, readHotUpdaterInitEnv, resolveInitProviderInput, secretEnvHelper, writeHotUpdaterFiles } from "@hot-updater/cli-tools";
 import { apiKeys, insights, remoteConfig } from "@hot-updater/server/plugins";
 import Cloudflare$1, { Cloudflare } from "cloudflare";
 import { WRITE_GUARD_TABLE, coreSettings, coreTarget, createEngineDatabase, createSqlAdapter, createTableStatements, generateEngineSql } from "@hot-updater/plugin-core";
@@ -106,7 +106,12 @@ const encode = ({ sql, params }) => ({
 * time, or a batch D1 runs in one transaction.
 */
 const d1RestRunner = (config) => {
-	const cloudflare = new Cloudflare$1({ apiToken: config.cloudflareApiToken });
+	const { cloudflareApiToken } = config;
+	let client;
+	const connect = () => client ??= (async () => new Cloudflare$1({ apiToken: typeof cloudflareApiToken === "function" ? await cloudflareApiToken() : cloudflareApiToken }))().catch((error) => {
+		client = void 0;
+		throw error;
+	});
 	const batch = async (statements) => {
 		const [first] = statements;
 		if (first === void 0) return [];
@@ -117,7 +122,7 @@ const d1RestRunner = (config) => {
 			account_id: config.accountId,
 			batch: statements.map(encode)
 		};
-		const page = await cloudflare.d1.database.query(config.databaseId, body);
+		const page = await (await connect()).d1.database.query(config.databaseId, body);
 		const results = [];
 		for await (const resultPage of page.iterPages()) for (const result of resultPage.result) results.push(toSqlResult(result));
 		if (results.length !== statements.length) throw new D1ExecutionError();
@@ -11313,7 +11318,12 @@ const initProvider = {
 			},
 			validate: (value) => value === "true" || value === "false"
 		}
-	}
+	},
+	secrets: [
+		"HOT_UPDATER_CLOUDFLARE_API_TOKEN",
+		"HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID",
+		"HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY"
+	]
 };
 //#endregion
 //#region iac/cloudflareInitInputs.ts
@@ -11401,8 +11411,26 @@ const inputCloudflareInitSecrets = async ({ accountId, bucketName, apiToken, acc
 };
 //#endregion
 //#region iac/configTemplate.ts
-const getConfigScaffold = (build) => {
-	return createHotUpdaterConfigScaffoldFromBuilder(new ConfigBuilder().setBuildType(build).setStorage({
+/**
+* The config init writes. With the `resources` init set up, it names them,
+* and reads the API token and R2 keys with `secretEnv`, from the
+* environment and `.env.hotupdater`, then the config's `secrets` adapter.
+* Without them, as the agent scaffold writes it, it reads every value from
+* the environment.
+*/
+const getConfigScaffold = (build, resources) => {
+	const builder = new ConfigBuilder().setBuildType(build).setPlugins({
+		imports: [{
+			pkg: "hot-updater/plugins",
+			named: [
+				"apiKeys",
+				"insights",
+				"remoteConfig"
+			]
+		}],
+		configString: "[apiKeys(), insights(), remoteConfig()]"
+	});
+	if (resources === void 0) return createHotUpdaterConfigScaffoldFromBuilder(builder.setStorage({
 		imports: [{
 			pkg: "@hot-updater/cloudflare",
 			named: ["r2Storage"]
@@ -11425,17 +11453,42 @@ const getConfigScaffold = (build) => {
     accountId: process.env.HOT_UPDATER_CLOUDFLARE_ACCOUNT_ID!,
     cloudflareApiToken: process.env.HOT_UPDATER_CLOUDFLARE_API_TOKEN!,
   })`
-	}).setPlugins({
+	}));
+	const accountId = JSON.stringify(resources.accountId);
+	const storageConfig = {
 		imports: [{
-			pkg: "hot-updater/plugins",
-			named: [
-				"apiKeys",
-				"insights",
-				"remoteConfig"
-			]
+			pkg: "@hot-updater/cloudflare",
+			named: ["r2Storage"]
 		}],
-		configString: "[apiKeys(), insights(), remoteConfig()]"
-	}));
+		configString: `r2Storage({
+    bucketName: ${JSON.stringify(resources.bucketName)},
+    accountId: ${accountId},
+    credentials: async () => {
+      const env = await storageSecrets();
+      return {
+        accessKeyId: env.HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID,
+        secretAccessKey: env.HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY,
+      };
+    },
+  })`
+	};
+	const databaseConfig = {
+		imports: [{
+			pkg: "@hot-updater/cloudflare",
+			named: ["d1Database"]
+		}],
+		configString: `d1Database({
+    databaseId: ${JSON.stringify(resources.d1DatabaseId)},
+    accountId: ${accountId},
+    cloudflareApiToken: async () =>
+      (await databaseSecrets()).HOT_UPDATER_CLOUDFLARE_API_TOKEN,
+  })`
+	};
+	const helperStatements = [secretEnvHelper("storageSecrets", ["HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID", "HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY"]), secretEnvHelper("databaseSecrets", ["HOT_UPDATER_CLOUDFLARE_API_TOKEN"])];
+	return createHotUpdaterConfigScaffoldFromBuilder(builder.setStorage(storageConfig).setDatabase(databaseConfig).addImport({
+		pkg: "hot-updater",
+		named: ["secretEnv"]
+	}).setIntermediateCode(helperStatements.map(({ code }) => code).join("\n\n")), { helperStatements });
 };
 //#endregion
 //#region iac/managedWorker.ts
@@ -11507,10 +11560,10 @@ const deployWorker = async (apiToken, accountId, { credentialSource, d1DatabaseI
 		await removeTmpDir();
 	}
 };
-const runInit = async ({ build, envFile }) => {
+const runInit = async ({ build, envFile, secretsEnv }) => {
 	const cwd = getCwd();
 	const nonInteractive = envFile !== void 0;
-	const initEnvSources = await readHotUpdaterInitEnv(cwd, envFile);
+	const initEnvSources = await readHotUpdaterInitEnv(cwd, envFile, secretsEnv);
 	const { managedEnv } = initEnvSources;
 	const initInputEnv = getHotUpdaterInitInputEnv(initEnvSources, nonInteractive);
 	const existingInputs = resolveCloudflareInitInputs(initInputEnv);
@@ -11860,7 +11913,11 @@ const runInit = async ({ build, envFile }) => {
 		await database.dispose?.();
 	}
 	p.log.success("Generated '.env.hotupdater' file with Cloudflare settings.");
-	await writeHotUpdaterFiles(getConfigScaffold(build), {
+	await writeHotUpdaterFiles(getConfigScaffold(build, {
+		accountId,
+		bucketName: selectedBucketName,
+		d1DatabaseId: selectedD1DatabaseId
+	}), {
 		cwd,
 		settings: "Cloudflare"
 	});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hot-updater/cloudflare",
   "type": "module",
-  "version": "1.2.0-rc.4",
+  "version": "1.2.0-rc.5",
   "description": "React Native OTA solution for self-hosted",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -55,10 +55,10 @@
     "cloudflare": "4.2.0",
     "hono": "4.12.34",
     "uuidv7": "^1.0.2",
-    "@hot-updater/protocol": "1.2.0-rc.4",
-    "@hot-updater/plugin-core": "1.2.0-rc.4",
-    "@hot-updater/cli-tools": "1.2.0-rc.4",
-    "@hot-updater/server": "1.2.0-rc.4"
+    "@hot-updater/cli-tools": "1.2.0-rc.5",
+    "@hot-updater/protocol": "1.2.0-rc.5",
+    "@hot-updater/plugin-core": "1.2.0-rc.5",
+    "@hot-updater/server": "1.2.0-rc.5"
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "0.13.0",
@@ -74,7 +74,7 @@
     "vitest": "4.1.4",
     "wrangler": "^4.69.0",
     "xdg-app-paths": "^8.3.0",
-    "@hot-updater/test-utils": "1.2.0-rc.4"
+    "@hot-updater/test-utils": "1.2.0-rc.5"
   },
   "scripts": {
     "build": "tsdown && pnpm build:worker",

package/src/d1Rest.ts

@@ -6,7 +6,12 @@ import { D1ExecutionError, type D1ResultLike, toSqlResult } from "./d1Executor";
 export interface D1RestConfig {
   readonly databaseId: string;
   readonly accountId: string;
-  readonly cloudflareApiToken: string;
+  /**
+   * An API token with D1 edit permission, or a function that returns it,
+   * such as one that reads it with `secretEnv`: called on the first query,
+   * so a config loads without the token.
+   */
+  readonly cloudflareApiToken: string | (() => string | Promise<string>);
 }
 
 /** The REST API binds text: each value goes as JSON and is read back with `json_extract`. */
@@ -21,9 +26,19 @@ const encode = ({ sql, params }: SqlStatement) => ({
  * time, or a batch D1 runs in one transaction.
  */
 export const d1RestRunner = (config: D1RestConfig) => {
-  const cloudflare = new Cloudflare({
-    apiToken: config.cloudflareApiToken,
-  });
+  const { cloudflareApiToken } = config;
+  let client: Promise<Cloudflare> | undefined;
+  const connect = () =>
+    (client ??= (async () =>
+      new Cloudflare({
+        apiToken:
+          typeof cloudflareApiToken === "function"
+            ? await cloudflareApiToken()
+            : cloudflareApiToken,
+      }))().catch((error: unknown) => {
+      client = undefined;
+      throw error;
+    }));
   const batch = async (
     statements: readonly SqlStatement[],
   ): Promise<SqlResult[]> => {
@@ -33,6 +48,7 @@ export const d1RestRunner = (config: D1RestConfig) => {
       statements.length === 1
         ? { account_id: config.accountId, ...encode(first) }
         : { account_id: config.accountId, batch: statements.map(encode) };
+    const cloudflare = await connect();
     // cloudflare@4 predates the D1 REST API's parameterized batch body type.
     const page = await cloudflare.d1.database.query(
       config.databaseId,

package/worker/dist/README.md

@@ -1 +1 @@
-This folder contains the built output assets for the worker "hot-updater" generated at 2026-10-28T12:42:02.480Z.
+This folder contains the built output assets for the worker "hot-updater" generated at 2026-10-28T17:24:58.490Z.

package/worker/dist/index.js

@@ -4632,7 +4632,7 @@ var createSqlAdapter = /* @__PURE__ */ __name(({ executor, tablePrefix = "", max
 }, "createSqlAdapter");
 
 // ../../packages/server/dist/package.mjs
-var version = "1.2.0-rc.4";
+var version = "1.2.0-rc.5";
 
 // ../../packages/server/dist/version.mjs
 var HOT_UPDATER_SERVER_VERSION = version;