@hot-updater/firebase 1.1.4 → 1.2.0-rc.1

package/dist/index.cjs

@@ -183,11 +183,20 @@ const adapterOf = ({ databaseId, collection = FIREBASE_V1_COLLECTION, aggregateB
 * after deploying the indexes.
 */
 const migrateFirebaseDatabase = (config, plugins = []) => (0, _hot_updater_plugin_core.migrateCoreSchema)(adapterOf(config), "firebaseDatabase", plugins);
+/**
+* The resource this database reaches, without credentials, under the key
+* `hot-updater doctor` reads to tell the database `hot-updater init` saved
+* from another (a convention CLAUDE.md documents).
+*/
+const DATABASE_TARGET = Symbol.for("@hot-updater/database-target");
 /** Hot Updater's database in one Firestore collection, through the storage engine. */
-const firebaseDatabase = (config) => (0, _hot_updater_plugin_core.createEngineDatabase)({
-	name: "firebaseDatabase",
-	adapter: adapterOf(config),
-	aggregateBatching: config.aggregateBatching ?? {}
+const firebaseDatabase = (config) => ({
+	...(0, _hot_updater_plugin_core.createEngineDatabase)({
+		name: "firebaseDatabase",
+		adapter: adapterOf(config),
+		aggregateBatching: config.aggregateBatching ?? {}
+	}),
+	...config.projectId === void 0 ? {} : { [DATABASE_TARGET]: `firestore/${config.projectId}/${config.databaseId ?? "(default)"}` }
 });
 //#endregion
 //#region src/firebaseStorage.ts
@@ -195,7 +204,8 @@ const firebaseDatabase = (config) => (0, _hot_updater_plugin_core.createEngineDa
 const MAX_CACHED_SIGNED_URLS = 1e4;
 const firebaseStorage = (config) => {
 	const app = (0, firebase_admin_app.getApps)().length ? (0, firebase_admin_app.getApp)() : (0, firebase_admin_app.initializeApp)(config);
-	const bucket = (0, firebase_admin_storage.getStorage)(app).bucket(config.storageBucket);
+	let opened;
+	const bucket = () => opened ??= (0, firebase_admin_storage.getStorage)(app).bucket(config.storageBucket);
 	const getStorageKey = (0, _hot_updater_plugin_core.createStorageKeyBuilder)(config.basePath);
 	/**
 	* Signed URLs by object. Without a private key, as in Cloud Functions, each
@@ -206,7 +216,7 @@ const firebaseStorage = (config) => {
 	const signedUrls = /* @__PURE__ */ new Map();
 	const signUrl = async (key) => {
 		const expiresAt = Date.now() + (config.signedUrlExpiresIn ?? 3600) * 1e3;
-		const [url] = await bucket.file(key).getSignedUrl({
+		const [url] = await bucket().file(key).getSignedUrl({
 			action: "read",
 			expires: expiresAt
 		});
@@ -239,11 +249,11 @@ const firebaseStorage = (config) => {
 		protocol: "gs",
 		async put({ key, body, contentType }) {
 			const storageKey = getStorageKey(key);
-			const bytes = new Uint8Array(await new Response(body).arrayBuffer());
-			await bucket.file(storageKey).save(bytes, { metadata: {
+			const [{ Readable }, { pipeline }] = await Promise.all([import("node:stream"), import("node:stream/promises")]);
+			await pipeline(Readable.fromWeb(body), bucket().file(storageKey).createWriteStream({ metadata: {
 				contentType,
 				cacheControl: "public, max-age=31536000, immutable"
-			} });
+			} }));
 			return { storageUri: (0, _hot_updater_plugin_core.createStorageUri)({
 				bucket: config.storageBucket,
 				key: storageKey,
@@ -253,7 +263,7 @@ const firebaseStorage = (config) => {
 		async get({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
 			try {
-				const file = bucket.file(key);
+				const file = bucket().file(key);
 				const [[body], [metadata]] = await Promise.all([file.download(), file.getMetadata()]);
 				const headers = new Headers();
 				if (metadata.contentType) headers.set("content-type", metadata.contentType);
@@ -278,17 +288,354 @@ const firebaseStorage = (config) => {
 		},
 		async exists({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
-			const [exists] = await bucket.file(key).exists();
+			const [exists] = await bucket().file(key).exists();
 			return { exists };
 		},
 		async delete({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
-			await bucket.file(key).delete({ ignoreNotFound: true });
+			await bucket().file(key).delete({ ignoreNotFound: true });
 			return { deleted: true };
 		}
 	});
 };
 //#endregion
+//#region src/secretManager.ts
+const ADAPTER_NAME = "secretManager";
+const API_URL = "https://secretmanager.googleapis.com/v1";
+const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
+/**
+* Variables an access token is read from as it is: gcloud's, and the one
+* Terraform's Google provider reads, which a job sets from
+* `google-github-actions/auth`'s `access_token` output.
+*/
+const ACCESS_TOKEN_ENV_NAMES = ["CLOUDSDK_AUTH_ACCESS_TOKEN", "GOOGLE_OAUTH_ACCESS_TOKEN"];
+const PROJECT_PATTERN = /^[a-z0-9][a-z0-9.:-]*$/u;
+const SECRET_ID_PATTERN = /^[A-Za-z0-9_-]{1,255}$/u;
+const PREFIX_PATTERN = /^[A-Za-z0-9_-]*$/u;
+const VERSION_ID_PATTERN = /^[1-9]\d*$/u;
+/**
+* The secret's annotation that lists the versions this adapter added and
+* has not destroyed yet: the only versions it ever destroys.
+*/
+const VERSIONS_ANNOTATION = "hot-updater-versions";
+/** What `set` needs on the secret, checked before it adds a version. */
+const SET_PERMISSIONS = [
+	"secretmanager.versions.add",
+	"secretmanager.versions.access",
+	"secretmanager.versions.destroy",
+	"secretmanager.secrets.update"
+];
+/**
+* How long `set` waits, between reads, for the `latest` alias to resolve to
+* the version it added: `latest` is eventually consistent. About 30 seconds.
+*/
+const LATEST_RETRY_DELAYS_MS = [
+	250,
+	500,
+	1e3,
+	2e3,
+	4e3,
+	8e3,
+	15e3
+];
+/** How often `set` re-reads the secret when another writer changed it. */
+const ANNOTATION_ATTEMPTS = 5;
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const delay = (ms) => new Promise((resolve) => {
+	setTimeout(resolve, ms);
+});
+/** The CRC32C (Castagnoli) checksum Secret Manager verifies payloads with. */
+const crc32c = (bytes) => {
+	let crc = 4294967295;
+	for (const byte of bytes) {
+		crc ^= byte;
+		for (let bit = 0; bit < 8; bit += 1) crc = crc >>> 1 ^ (crc & 1 ? 2197175160 : 0);
+	}
+	return (crc ^ 4294967295) >>> 0;
+};
+/** The version IDs the secret's annotation lists. */
+const trackedVersions = (secret) => (secret.annotations?.[VERSIONS_ANNOTATION] ?? "").split(",").map((entry) => entry.trim()).filter((entry) => VERSION_ID_PATTERN.test(entry));
+const versionOf = (name) => typeof name === "string" ? name.slice(name.lastIndexOf("/") + 1) : "";
+const hint = (response, permission) => {
+	const { status, error } = response;
+	if (error.details?.some((detail) => detail.reason === "SERVICE_DISABLED")) return " Enable the Secret Manager API (secretmanager.googleapis.com) in the project: gcloud services enable secretmanager.googleapis.com --project <project>.";
+	if (status === 401) return " Google rejected the access token: sign in again with `gcloud auth application-default login`, or check the job's Workload Identity Federation.";
+	if (status === 403) return ` The Google identity needs ${permission}.`;
+	if (status === 429) return " Secret Manager's quota is exhausted: try again later.";
+	return "";
+};
+/**
+* An error for a failed request: the HTTP status, Google's status and
+* message, which name resources but never a value, and what to fix.
+*/
+const requestError = (action, response, permission) => {
+	const { status, message } = response.error;
+	const detail = [status, message?.slice(0, 300)].filter(Boolean).join(": ");
+	return /* @__PURE__ */ new Error(`${ADAPTER_NAME} could not ${action} (${response.status}${detail ? ` ${detail}` : ""}).${hint(response, permission)}`);
+};
+/** Masks a value in the CLI's output, which loads `@hot-updater/cli-tools`. */
+const mask = async (value) => {
+	const { registerSecretValue } = await import("@hot-updater/cli-tools");
+	registerSecretValue(value);
+};
+const tokenOf = (result) => {
+	if (typeof result === "string") return result;
+	if (!result) return void 0;
+	if ("token" in result) return result.token ?? void 0;
+	if ("access_token" in result) return result.access_token;
+};
+/**
+* Returns a function that resolves an access token with the
+* `cloud-platform` scope: from `credentials`, else from an access token
+* variable, else from Application Default Credentials through
+* `google-auth-library`, which loads on first use. Each token is masked in
+* the CLI's output.
+*/
+const createAccessToken = (credentials, projectId) => {
+	let auth;
+	const resolve = async () => {
+		if (typeof credentials === "function") return credentials();
+		if (credentials) return tokenOf(await credentials.getAccessToken());
+		for (const name of ACCESS_TOKEN_ENV_NAMES) {
+			const token = process.env[name]?.trim();
+			if (token) return token;
+		}
+		auth ??= import("google-auth-library").then(({ GoogleAuth }) => new GoogleAuth({
+			scopes: [CLOUD_PLATFORM_SCOPE],
+			projectId
+		})).catch((error) => {
+			auth = void 0;
+			throw error;
+		});
+		const client = await auth;
+		try {
+			return await client.getAccessToken() ?? void 0;
+		} catch (error) {
+			throw new Error(`${ADAPTER_NAME} found no Google credentials (${error instanceof Error ? error.message.split("\n")[0] : String(error)}). Sign in with \`gcloud auth application-default login\`, use google-github-actions/auth in CI, set GOOGLE_APPLICATION_CREDENTIALS, or set ${ACCESS_TOKEN_ENV_NAMES.join(" or ")} to an access token.`, { cause: error });
+		}
+	};
+	return async () => {
+		const token = (await resolve())?.trim();
+		if (!token) throw new Error(`${ADAPTER_NAME} got no Google access token.`);
+		await mask(token);
+		return token;
+	};
+};
+/**
+* Secrets from Google Cloud Secret Manager: each name is the secret
+* `<prefix><name>`, read at its `latest` version. Requests go to the REST
+* API, signed by `google-auth-library`, which firebase-admin already
+* installs and which loads on the first read or write, so a config that
+* only uses `firebaseStorage` never loads it.
+*
+* @example
+* secrets: secretManager({ projectId: "my-project" })
+*/
+const secretManager = ({ projectId, prefix = "hot-updater-", credentials }) => {
+	const accessToken = createAccessToken(credentials, projectId);
+	const projectPath = () => {
+		if (typeof projectId !== "string" || !PROJECT_PATTERN.test(projectId)) throw new Error(`${ADAPTER_NAME} needs the Google Cloud project ID or number as projectId, and ${JSON.stringify(projectId)} is not one.`);
+		if (!PREFIX_PATTERN.test(prefix)) throw new Error(`${ADAPTER_NAME}'s prefix takes letters, digits, "-", and "_", and ${JSON.stringify(prefix)} has others.`);
+		return `projects/${projectId}`;
+	};
+	const secretId = (name) => {
+		const id = `${prefix}${name}`;
+		if (!SECRET_ID_PATTERN.test(id)) throw new Error(`${ADAPTER_NAME} keeps ${JSON.stringify(name)} as the secret ID ${JSON.stringify(id)}, and Secret Manager's IDs take only letters, digits, "-", and "_", up to 255 characters.`);
+		return id;
+	};
+	const request = async (token, method, path, body) => {
+		const authorization = `Bearer ${token}`;
+		const response = await fetch(`${API_URL}/${path}`, body === void 0 ? {
+			method,
+			headers: { authorization },
+			redirect: "error"
+		} : {
+			method,
+			headers: {
+				authorization,
+				"content-type": "application/json"
+			},
+			body: JSON.stringify(body),
+			redirect: "error"
+		});
+		let parsed;
+		try {
+			parsed = await response.json();
+		} catch {
+			parsed = void 0;
+		}
+		return {
+			status: response.status,
+			ok: response.ok,
+			body: parsed,
+			error: isRecord(parsed) && isRecord(parsed.error) ? parsed.error : {}
+		};
+	};
+	/** The `latest` version's ID and value, or undefined when there is none. */
+	const accessLatest = async (token, secret) => {
+		const response = await request(token, "GET", `${secret}/versions/latest:access`);
+		if (response.status === 404) return void 0;
+		if (!response.ok) throw requestError(`read ${secret}`, response, "roles/secretmanager.secretAccessor on the secret");
+		const body = isRecord(response.body) ? response.body : void 0;
+		const payload = body?.payload;
+		const data = isRecord(payload) ? payload.data : void 0;
+		if (typeof data !== "string") throw new Error(`${ADAPTER_NAME} read no payload for ${secret}.`);
+		const bytes = Buffer.from(data, "base64");
+		const checksum = isRecord(payload) ? payload.dataCrc32c : void 0;
+		if (checksum !== void 0 && Number(checksum) !== crc32c(bytes)) throw new Error(`${ADAPTER_NAME} read ${secret} with a checksum that does not match its payload.`);
+		const value = bytes.toString("utf8");
+		await mask(value);
+		return {
+			version: versionOf(body?.name),
+			value
+		};
+	};
+	/**
+	* Whether `latest` resolves to `version`, or a newer one another writer
+	* added, within about 30 seconds. While `latest` still names an older
+	* version, which may be missing or disabled, it reads again; it never
+	* throws, so the version `set` stored is always listed.
+	*/
+	const waitForLatest = async (token, secret, version) => {
+		for (const ms of [0, ...LATEST_RETRY_DELAYS_MS]) {
+			if (ms > 0) await delay(ms);
+			let response;
+			try {
+				response = await request(token, "GET", `${secret}/versions/latest:access`);
+			} catch {
+				return false;
+			}
+			if (response.ok) {
+				const latest = versionOf(isRecord(response.body) ? response.body.name : void 0);
+				if (Number(latest) >= Number(version)) return true;
+			} else if (response.status !== 404 && response.error.status !== "FAILED_PRECONDITION") return false;
+		}
+		return false;
+	};
+	const readSecret = async (token, secret) => {
+		const response = await request(token, "GET", secret);
+		if (response.status === 404) return void 0;
+		if (!response.ok) throw requestError(`read ${secret}`, response, "secretmanager.secrets.get on the secret");
+		return response.body;
+	};
+	const getOrCreateSecret = async (token, parent, id) => {
+		const secret = `${parent}/secrets/${id}`;
+		const existing = await readSecret(token, secret);
+		if (existing) return existing;
+		const created = await request(token, "POST", `${parent}/secrets?secretId=${encodeURIComponent(id)}`, { replication: { automatic: {} } });
+		if (created.ok) return created.body;
+		if (created.status === 409) {
+			const raced = await readSecret(token, secret);
+			if (raced) return raced;
+		}
+		throw requestError(`create ${secret}`, created, `secretmanager.secrets.create on ${parent}`);
+	};
+	const assertCanSet = async (token, secret) => {
+		const response = await request(token, "POST", `${secret}:testIamPermissions`, { permissions: SET_PERMISSIONS });
+		if (!response.ok) throw requestError(`check its permissions on ${secret}`, response, SET_PERMISSIONS.join(", "));
+		const held = isRecord(response.body) && Array.isArray(response.body.permissions) ? response.body.permissions : [];
+		const missing = SET_PERMISSIONS.filter((name) => !held.includes(name));
+		if (missing.length > 0) throw new Error(`${ADAPTER_NAME} stores a value as a new version of ${secret} and destroys the versions it added before, and the Google identity lacks ${missing.join(", ")} on it: grant a custom role with secretmanager.secrets.get, secretmanager.secrets.update, secretmanager.versions.add, secretmanager.versions.destroy, and secretmanager.versions.access on it, or roles/secretmanager.admin.`);
+	};
+	/**
+	* Destroys `version` of `secret`: true once it is destroyed, or already
+	* was, false when it could not be, even for a network failure, so it
+	* stays listed for the next `set`.
+	*/
+	const destroy = async (token, secret, version) => {
+		let response;
+		try {
+			response = await request(token, "POST", `${secret}/versions/${version}:destroy`, {});
+		} catch {
+			return false;
+		}
+		return response.ok || response.status === 404 || response.error.status === "FAILED_PRECONDITION";
+	};
+	return {
+		name: ADAPTER_NAME,
+		get: async (names) => {
+			const parent = projectPath();
+			const secrets = names.map((name) => `${parent}/secrets/${secretId(name)}`);
+			const values = Object.create(null);
+			if (names.length === 0) return values;
+			const token = await accessToken();
+			const read = await Promise.all(secrets.map((secret) => accessLatest(token, secret)));
+			names.forEach((name, index) => {
+				values[name] = read[index]?.value;
+			});
+			return values;
+		},
+		/**
+		* Adds `value` as the secret's newest version, creating the secret when
+		* it is missing, and waits until the `latest` alias resolves to it. Then
+		* it destroys the older versions this adapter added, which the secret's
+		* `hot-updater-versions` annotation lists: versions added any other way
+		* are never touched. The permissions this needs are checked before
+		* anything is written. A version that could not be destroyed stays
+		* listed for the next `set`. The annotation is updated against the
+		* secret's etag, so a concurrent `set` loses no listed version. When
+		* `latest` does not resolve to the new version in time, or the
+		* annotation cannot be updated, `set` throws, naming the version it
+		* stored.
+		*/
+		set: async (name, value) => {
+			const parent = projectPath();
+			const id = secretId(name);
+			const secret = `${parent}/secrets/${id}`;
+			if (typeof value !== "string" || value === "") throw new Error(`${ADAPTER_NAME} cannot store an empty ${secret}.`);
+			await mask(value);
+			const token = await accessToken();
+			const current = await getOrCreateSecret(token, parent, id);
+			await assertCanSet(token, secret);
+			const data = Buffer.from(value, "utf8");
+			const added = await request(token, "POST", `${secret}:addVersion`, { payload: {
+				data: data.toString("base64"),
+				dataCrc32c: String(crc32c(data))
+			} });
+			const version = versionOf(isRecord(added.body) ? added.body.name : void 0);
+			if (!added.ok || !VERSION_ID_PATTERN.test(version)) throw requestError(`add a version to ${secret}`, added, "secretmanager.versions.add on the secret");
+			const visible = await waitForLatest(token, secret, version);
+			const destroyed = /* @__PURE__ */ new Set();
+			if (visible) {
+				const older = trackedVersions(current).filter((entry) => Number(entry) < Number(version));
+				const results = await Promise.all(older.map((entry) => destroy(token, secret, entry)));
+				older.forEach((entry, index) => {
+					if (results[index]) destroyed.add(entry);
+				});
+			}
+			const notListed = `list version ${version}, which it stored, in ${secret}'s ${VERSIONS_ANNOTATION} annotation, so the next set will not destroy it`;
+			let base = current;
+			let updated;
+			try {
+				for (let attempt = 0; attempt < ANNOTATION_ATTEMPTS; attempt += 1) {
+					if (attempt > 0) {
+						await delay(LATEST_RETRY_DELAYS_MS[attempt - 1] ?? 0);
+						base = await readSecret(token, secret) ?? {};
+					}
+					const listed = [.../* @__PURE__ */ new Set([version, ...trackedVersions(base)])].filter((entry) => !destroyed.has(entry));
+					updated = await request(token, "PATCH", `${secret}?updateMask=annotations`, {
+						...base.etag === void 0 ? {} : { etag: base.etag },
+						annotations: {
+							...base.annotations,
+							[VERSIONS_ANNOTATION]: listed.join(",")
+						}
+					});
+					if (updated.error.status !== "FAILED_PRECONDITION") break;
+				}
+			} catch (error) {
+				throw new Error(`${ADAPTER_NAME} could not ${notListed} (${error instanceof Error ? error.message : String(error)}).`, { cause: error });
+			}
+			if (!updated?.ok) throw requestError(notListed, updated, "secretmanager.secrets.update on the secret");
+			if (!visible) throw new Error(`${ADAPTER_NAME} stored ${secret} as version ${version}, and its latest alias does not resolve to that version yet, so it kept the versions it added before; the next set destroys them.`);
+		},
+		describe: (name) => {
+			const id = `${prefix}${name}`;
+			return `projects/${projectId}/secrets/${id} (https://console.cloud.google.com/security/secret-manager/secret/${encodeURIComponent(id)}/versions?project=${encodeURIComponent(projectId)})`;
+		}
+	};
+};
+//#endregion
 exports.firebaseDatabase = firebaseDatabase;
 exports.firebaseStorage = firebaseStorage;
 exports.migrateFirebaseDatabase = migrateFirebaseDatabase;
+exports.secretManager = secretManager;

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { EngineDatabase, PluginTables, StorageAdapterWith } from "@hot-updater/plugin-core";
+import { EngineDatabase, PluginTables, SecretsAdapter, StorageAdapterWith } from "@hot-updater/plugin-core";
 import { AppOptions } from "firebase-admin/app";
 //#region src/firebaseDatabase.d.ts
 type FirebaseDatabaseConfig = AppOptions & {
@@ -39,4 +39,49 @@ interface FirebaseStorageConfig extends AppOptions {
 }
 declare const firebaseStorage: (config: FirebaseStorageConfig) => StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
 //#endregion
-export { FirebaseDatabaseConfig, FirebaseStorageConfig, firebaseDatabase, firebaseStorage, migrateFirebaseDatabase };
+//#region src/secretManager.d.ts
+/**
+ * What signs the requests: anything with `getAccessToken()`, such as
+ * `google-auth-library`'s `GoogleAuth` or an `AuthClient`, or firebase-admin's
+ * `cert(...)`, or a function that returns an access token.
+ */
+type SecretManagerCredentials = {
+  getAccessToken(): Promise<string | null | undefined | {
+    readonly token?: string | null;
+  } | {
+    readonly access_token?: string;
+  }>;
+} | (() => Promise<string>);
+interface SecretManagerOptions {
+  /** The Google Cloud project ID or number that holds the secrets. */
+  readonly projectId: string;
+  /**
+   * Put before each name to make its secret ID, so `secret:asc-api-key`
+   * reads `hot-updater-asc-api-key`. Letters, digits, `-`, and `_`.
+   *
+   * @default "hot-updater-"
+   */
+  readonly prefix?: string;
+  /**
+   * What signs the requests. Without it, `CLOUDSDK_AUTH_ACCESS_TOKEN` or
+   * `GOOGLE_OAUTH_ACCESS_TOKEN` as it is, then Application Default
+   * Credentials: `gcloud auth application-default login` on your machine,
+   * the Workload Identity Federation file `google-github-actions/auth`
+   * writes in CI, a service account key in `GOOGLE_APPLICATION_CREDENTIALS`,
+   * or the runtime's service account.
+   */
+  readonly credentials?: SecretManagerCredentials;
+}
+/**
+ * Secrets from Google Cloud Secret Manager: each name is the secret
+ * `<prefix><name>`, read at its `latest` version. Requests go to the REST
+ * API, signed by `google-auth-library`, which firebase-admin already
+ * installs and which loads on the first read or write, so a config that
+ * only uses `firebaseStorage` never loads it.
+ *
+ * @example
+ * secrets: secretManager({ projectId: "my-project" })
+ */
+declare const secretManager: ({ projectId, prefix, credentials }: SecretManagerOptions) => SecretsAdapter;
+//#endregion
+export { FirebaseDatabaseConfig, FirebaseStorageConfig, SecretManagerCredentials, SecretManagerOptions, firebaseDatabase, firebaseStorage, migrateFirebaseDatabase, secretManager };

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { EngineDatabase, PluginTables, StorageAdapterWith } from "@hot-updater/plugin-core";
+import { EngineDatabase, PluginTables, SecretsAdapter, StorageAdapterWith } from "@hot-updater/plugin-core";
 import { AppOptions } from "firebase-admin/app";
 //#region src/firebaseDatabase.d.ts
 type FirebaseDatabaseConfig = AppOptions & {
@@ -39,4 +39,49 @@ interface FirebaseStorageConfig extends AppOptions {
 }
 declare const firebaseStorage: (config: FirebaseStorageConfig) => StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
 //#endregion
-export { FirebaseDatabaseConfig, FirebaseStorageConfig, firebaseDatabase, firebaseStorage, migrateFirebaseDatabase };
+//#region src/secretManager.d.ts
+/**
+ * What signs the requests: anything with `getAccessToken()`, such as
+ * `google-auth-library`'s `GoogleAuth` or an `AuthClient`, or firebase-admin's
+ * `cert(...)`, or a function that returns an access token.
+ */
+type SecretManagerCredentials = {
+  getAccessToken(): Promise<string | null | undefined | {
+    readonly token?: string | null;
+  } | {
+    readonly access_token?: string;
+  }>;
+} | (() => Promise<string>);
+interface SecretManagerOptions {
+  /** The Google Cloud project ID or number that holds the secrets. */
+  readonly projectId: string;
+  /**
+   * Put before each name to make its secret ID, so `secret:asc-api-key`
+   * reads `hot-updater-asc-api-key`. Letters, digits, `-`, and `_`.
+   *
+   * @default "hot-updater-"
+   */
+  readonly prefix?: string;
+  /**
+   * What signs the requests. Without it, `CLOUDSDK_AUTH_ACCESS_TOKEN` or
+   * `GOOGLE_OAUTH_ACCESS_TOKEN` as it is, then Application Default
+   * Credentials: `gcloud auth application-default login` on your machine,
+   * the Workload Identity Federation file `google-github-actions/auth`
+   * writes in CI, a service account key in `GOOGLE_APPLICATION_CREDENTIALS`,
+   * or the runtime's service account.
+   */
+  readonly credentials?: SecretManagerCredentials;
+}
+/**
+ * Secrets from Google Cloud Secret Manager: each name is the secret
+ * `<prefix><name>`, read at its `latest` version. Requests go to the REST
+ * API, signed by `google-auth-library`, which firebase-admin already
+ * installs and which loads on the first read or write, so a config that
+ * only uses `firebaseStorage` never loads it.
+ *
+ * @example
+ * secrets: secretManager({ projectId: "my-project" })
+ */
+declare const secretManager: ({ projectId, prefix, credentials }: SecretManagerOptions) => SecretsAdapter;
+//#endregion
+export { FirebaseDatabaseConfig, FirebaseStorageConfig, SecretManagerCredentials, SecretManagerOptions, firebaseDatabase, firebaseStorage, migrateFirebaseDatabase, secretManager };