@hot-updater/server 1.0.0-rc.2 → 1.0.0-rc.21

package/dist/createHotUpdaterCore.cjs

@@ -1,103 +1,84 @@
+const require_clientPlugins = require("./assembly/clientPlugins.cjs");
+const require_assemblePlugins = require("./assembly/assemblePlugins.cjs");
 const require_handler = require("./handler.cjs");
-const require_provider = require("./insights/provider.cjs");
-const require_apiKeys = require("./apiKeys.cjs");
-const require_databasePluginCore = require("./db/databasePluginCore.cjs");
-const require_schemaReadiness = require("./db/schemaReadiness.cjs");
-const require_types = require("./db/types.cjs");
 const require_storageAccess = require("./storageAccess.cjs");
 let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
 //#region src/createHotUpdaterCore.ts
-const normalizeClientAccess = (value) => {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new TypeError("clientAccess must be an object.");
-	const policy = value;
-	if (policy.type === "public") return { type: "public" };
-	if (policy.type === "api-key") return {
-		headerName: require_apiKeys.normalizeApiKeyHeaderName(policy.headerName),
-		type: "api-key"
-	};
-	throw new TypeError("clientAccess.type must be either \"public\" or \"api-key\".");
+const isRecord = (value) => typeof value === "object" && value !== null;
+const isAdapter = (value) => isRecord(value) && [
+	"fits",
+	"get",
+	"query",
+	"write"
+].every((method) => typeof value[method] === "function");
+/** The configured database, when it runs on the storage engine. */
+const databaseOf = (value) => {
+	if (isRecord(value) && typeof value.name === "string") {
+		if (isAdapter(value.adapter)) return value;
+		if ("core" in value && "fetchAdmin" in value) throw new _hot_updater_plugin_core.HotUpdaterConfigError("standaloneRepository reaches a server's admin API from the CLI and console. createHotUpdater needs the server's own database, such as kyselyAdapter(...).");
+	}
+	throw new _hot_updater_plugin_core.HotUpdaterConfigError("database must be a Hot Updater 1.0 database, such as kyselyAdapter(...) or postgres(...). Upgrade the provider package that created it.");
 };
-const hotUpdaterCoreMetadata = Symbol.for("@hot-updater/server/core-metadata");
-function getHotUpdaterCoreMetadata(hotUpdater) {
-	return hotUpdater[hotUpdaterCoreMetadata];
-}
-function createHotUpdaterCore(options) {
+/** `"public"`, or nothing; a `clientAccess` object says what replaced it. */
+const isPublic = (value) => {
+	if (value === void 0) return false;
+	if (value === "public") return true;
+	throw new _hot_updater_plugin_core.HotUpdaterConfigError(isRecord(value) ? "clientAccess objects were removed in 1.0. Set clientAccess: \"public\", or add a plugin that provides clientAuth to plugins." : "clientAccess must be \"public\"; to protect client routes, add a plugin that provides clientAuth to plugins.");
+};
+function createHotUpdater(options) {
 	for (const key of ["authorityId", "catalogId"]) if (Object.hasOwn(options, key)) throw new TypeError(`Remove ${key} from createHotUpdater options. Catalog identity is managed internally.`);
-	const database = options.database;
-	const storagePlugins = (options.storage ?? []).map((storage) => {
-		(0, _hot_updater_plugin_core.assertStorageOperations)(storage, ["get", "getDownloadUrl"]);
-		return storage;
-	});
-	const { downloadStorageObject, readStorageText, resolveFileUrl } = require_storageAccess.createStorageAccess(storagePlugins);
-	const adapterCapabilities = database;
-	if (!require_types.isDatabasePlugin(database)) throw new Error("@hot-updater/server only supports database plugins.");
-	const plugin = database;
-	const adapterName = adapterCapabilities.adapterName ?? plugin.name;
-	const assertSchemaReady = require_schemaReadiness.createSchemaReadinessChecker(adapterName, adapterCapabilities.createMigrator);
-	const core = require_databasePluginCore.createDatabasePluginCore(plugin, resolveFileUrl, {
-		beforeOperation: assertSchemaReady,
-		readStorageText
-	});
-	const clientAccess = normalizeClientAccess(options.clientAccess);
-	const insights = require_provider.createInsightsProvider({
-		async record(input) {
-			await assertSchemaReady();
-			return plugin.models.insights.record(input);
-		},
-		async listEvents(input) {
-			await assertSchemaReady();
-			return plugin.models.insights.listEvents(input);
-		},
-		async findInstallations(input) {
-			await assertSchemaReady();
-			return plugin.models.insights.findInstallations(input);
-		},
-		async countInstallations(input) {
-			await assertSchemaReady();
-			return plugin.models.insights.countInstallations(input);
-		},
-		async countEvents(input) {
-			await assertSchemaReady();
-			return plugin.models.insights.countEvents(input);
-		}
-	});
-	const apiKeys = require_apiKeys.createApiKeyManagement({
-		apiKeys: plugin.models.apiKeys,
-		beforeOperation: assertSchemaReady
-	});
-	const handlers = require_handler.createHotUpdaterHandlers(core.api, insights, clientAccess.type === "api-key" ? {
-		authenticate: (request) => require_apiKeys.authenticateApiKey({
-			apiKeys: plugin.models.apiKeys,
-			beforeLookup: assertSchemaReady,
-			headerName: clientAccess.headerName,
-			request
-		}),
-		headerName: clientAccess.headerName
-	} : void 0, downloadStorageObject);
-	const api = Object.assign({
-		adapterName: adapterCapabilities.adapterName ?? core.adapterName,
-		insights,
-		apiKeys,
-		handlers
-	}, core.api);
-	Object.defineProperty(api, hotUpdaterCoreMetadata, {
-		enumerable: false,
-		value: {
-			adapterCapabilities,
-			core
-		}
+	const database = databaseOf(options.database);
+	const storage = Object.freeze([...options.storage ?? []]);
+	const { downloadStorageObject, readStorageText, resolveFileUrl } = require_storageAccess.createStorageAccess(storage);
+	const publicClients = isPublic(options.clientAccess);
+	const configured = Object.freeze([...options.plugins ?? []]);
+	const plugins = require_assemblePlugins.assemblePlugins(configured, database, { storage: {
+		readStorageText,
+		resolveFileUrl
+	} });
+	const clientPlugins = Object.freeze(require_clientPlugins.clientPluginsOf(configured));
+	const clientAuth = plugins.clientAuth;
+	if (clientAuth !== void 0 && publicClients) throw new _hot_updater_plugin_core.HotUpdaterConfigError(`Plugin "${clientAuth.plugin}" provides clientAuth, so remove clientAccess.`);
+	if (clientAuth === void 0 && !publicClients) throw new _hot_updater_plugin_core.HotUpdaterConfigError("Set clientAccess to \"public\", or add a plugin that provides clientAuth.");
+	const varyHeaders = Object.freeze((clientAuth?.varyHeaders ?? []).map((header) => header.toLowerCase()));
+	const clientPolicy = clientAuth === void 0 ? void 0 : {
+		varyHeaders,
+		authenticate: (request) => clientAuth.authenticate(request.headers)
+	};
+	const handlers = require_handler.createHotUpdaterHandlers({
+		api: { core: plugins.core },
+		...clientPolicy === void 0 ? {} : { clientPolicy },
+		downloadStorageObject,
+		endpoints: plugins.endpoints,
+		plugins: Object.keys(plugins.api)
 	});
+	let serving = false;
 	return {
-		api,
-		adapterCapabilities,
-		core
+		adapterName: database.name,
+		get handlers() {
+			if (!serving) {
+				for (const adapter of storage) (0, _hot_updater_plugin_core.assertStorageOperations)(adapter, ["get", "getDownloadUrl"]);
+				serving = true;
+			}
+			return handlers;
+		},
+		core: plugins.core,
+		api: plugins.api,
+		flush: plugins.flush,
+		database,
+		storage,
+		plugins: configured,
+		clientPlugins,
+		clientEndpoints: Object.freeze(plugins.endpoints.filter((endpoint) => endpoint.access === "client").map(({ plugin, method, path }) => Object.freeze({
+			plugin,
+			method,
+			path
+		}))),
+		...clientAuth === void 0 ? {} : { clientAuth: Object.freeze({
+			plugin: clientAuth.plugin,
+			varyHeaders
+		}) }
 	};
 }
-function createHotUpdater(options) {
-	return createHotUpdaterCore(options).api;
-}
 //#endregion
 exports.createHotUpdater = createHotUpdater;
-exports.createHotUpdaterCore = createHotUpdaterCore;
-exports.getHotUpdaterCoreMetadata = getHotUpdaterCoreMetadata;
-exports.hotUpdaterCoreMetadata = hotUpdaterCoreMetadata;

package/dist/createHotUpdaterCore.d.cts

@@ -1,57 +1,125 @@
-import { ApiKeyManagementAPI } from "./apiKeys.cjs";
+import { CoreApi } from "./core/api.cjs";
+import { AnyHotUpdaterPlugin, PluginApis } from "./plugins/definePlugin.cjs";
 import { HotUpdaterHandlers } from "./handlerTypes.cjs";
-import { InsightsProvider } from "./insights/types.cjs";
 import "./handler.cjs";
-import { DatabaseAPI, DatabasePlugin as DatabasePlugin$1 } from "./db/types.cjs";
-import { StoragePlugin } from "@hot-updater/plugin-core";
+import { PluginClientPlugin, StorageAdapter, ToolingDatabase } from "@hot-updater/plugin-core";
 //#region src/createHotUpdaterCore.d.ts
-type RuntimeHotUpdaterAPI = DatabaseAPI & {
+/** A plugin's endpoint on `handlers.client`. */
+interface ClientEndpoint {
+  /** The id of the plugin that adds it. */
+  readonly plugin: string;
+  readonly method: string;
+  /** Relative to the handler's mount; `:name` segments are parameters. */
+  readonly path: string;
+}
+/** The plugin that decides who may call client routes. */
+interface ClientAuthProvider {
+  /** Its id. */
+  readonly plugin: string;
+  /**
+   * The request headers its decision reads, lowercase: what a cache in
+   * front of the server, such as a CDN, keys client routes on.
+   */
+  readonly varyHeaders: readonly string[];
+}
+type RuntimeHotUpdaterAPI<TPlugins extends readonly AnyHotUpdaterPlugin[] = readonly AnyHotUpdaterPlugin[]> = {
+  /**
+   * The routes a host mounts. On first access every storage adapter must
+   * serve downloads (`get` and `getDownloadUrl`), so a server fails where it
+   * mounts them, while tooling that only reads the definition, such as the
+   * CLI, can list storage that only uploads.
+   */
   readonly handlers: HotUpdaterHandlers;
-  readonly adapterName: string;
   /**
-   * Built-in Insights provider. Client ingestion and admin query routes are
-   * always mounted; React Native clients report lifecycle events by default
-   * and can opt out with `HotUpdater.init({ insights: false })`.
+   * Core's reads and typed writes: bundles, Releases, Catalogs, and
+   * channels. The CLI and the console write through it, so their writes
+   * take the server's path: the plugins' schema fence, pruning during
+   * writes, the storage's file URLs, and the database's CDN purge.
    */
-  readonly insights: InsightsProvider;
+  readonly core: CoreApi;
+  /** Each plugin's API by plugin id, which the CLI's and the console's plugin features call. */
+  readonly api: PluginApis<TPlugins>;
+  /** The database's name, which `hot-updater db` commands read. */
+  readonly adapterName: string;
   /**
-   * In-process API key lifecycle operations for trusted server tooling.
-   * Creation returns the plaintext once; list and revoke expose only metadata.
-   * This capability is never mounted on the client or admin HTTP handlers.
+   * Applies aggregate changes the database batches that are still pending:
+   * this process's buffer, and the log rows no compaction has merged yet.
+   * A long-lived server with `aggregateBatching: { mode: "memory" }` calls
+   * it before it exits.
    */
-  readonly apiKeys: ApiKeyManagementAPI;
-};
-type HotUpdaterAPI = RuntimeHotUpdaterAPI;
-type ClientAccessPolicy = {
+  readonly flush: () => Promise<void>;
   /**
-   * Leaves Release Catalog, artifact, and Insights ingestion routes
-   * publicly accessible without a client credential.
+   * The database as configured. `hot-updater db` runs its tooling
+   * (`createMigrator`, `generateSchema`), and tooling done with the server
+   * closes it (`dispose`).
    */
-  readonly type: "public";
-} | {
+  readonly database: ToolingDatabase;
+  /** The storage as configured, in order, as a frozen copy. */
+  readonly storage: readonly StorageAdapter[];
+  /** The plugins as configured, as a frozen copy, whose tables tooling creates. */
+  readonly plugins: TPlugins;
   /**
-   * Requires a key registered in `database.models.apiKeys` for
-   * Release Catalog, artifact, and Insights ingestion requests.
+   * The client plugins an app adds to `HotUpdater.init`'s `plugins` for
+   * these plugins, each once, in plugin order: what init prints.
    */
-  readonly type: "api-key";
+  readonly clientPlugins: readonly PluginClientPlugin[];
   /**
-   * Request header containing the API key. Defaults to
-   * `x-api-key`. Clients must send the same header; Release Catalog
-   * responses include it in `Vary` to preserve cache isolation.
+   * The plugins' endpoints on `handlers.client`, which a host that routes
+   * by path, such as a CDN in front of the server, sends to it.
    */
+  readonly clientEndpoints: readonly ClientEndpoint[];
+  /** The plugin that guards client routes; absent when they are public. */
+  readonly clientAuth?: ClientAuthProvider;
+};
+type HotUpdaterAPI = RuntimeHotUpdaterAPI;
+declare const REMOVED_CLIENT_ACCESS = "clientAccess objects were removed in 1.0: set clientAccess: \"public\", or add a plugin that provides clientAuth";
+/**
+ * A `clientAccess` object from before 1.0. Its `type` names the fix, so
+ * TypeScript reports it where the object is written.
+ */
+interface RemovedClientAccess {
+  readonly type: typeof REMOVED_CLIENT_ACCESS;
   readonly headerName?: string;
+}
+type ClientAccessPolicy =
+/** Leaves client routes public; required when no plugin provides clientAuth. */
+"public" | RemovedClientAccess;
+type ProvidesClientAuth<TPlugin> = TPlugin extends {
+  readonly provides?: infer TProvides;
+} ? TProvides extends {
+  readonly clientAuth: true;
+} ? true : false : false;
+type ClientAuthIds<TPlugins extends readonly unknown[], TFound extends string[] = []> = TPlugins extends readonly [infer THead, ...infer TTail] ? ClientAuthIds<TTail, ProvidesClientAuth<THead> extends true ? [...TFound, THead extends {
+  readonly id: infer TId extends string;
+} ? TId : string] : TFound> : TFound;
+type JoinIds<TIds extends string[]> = TIds extends [infer TFirst extends string, ...infer TRest extends string[]] ? TRest extends [] ? `"${TFirst}"` : `"${TFirst}", ${JoinIds<TRest>}` : "";
+/**
+ * Client routes have one policy source: exactly one plugin that provides
+ * clientAuth, or an explicit `clientAccess`. Tuples are counted here; an
+ * untyped list that may hold a clientAuth plugin is left to startup.
+ */
+type ClientAccessRule<TPlugins extends readonly AnyHotUpdaterPlugin[]> = number extends TPlugins["length"] ? true extends ProvidesClientAuth<TPlugins[number]> ? {
+  readonly clientAccess?: "Remove clientAccess: a plugin in this list may provide clientAuth";
+} : {
+  readonly clientAccess: ClientAccessPolicy;
+} : ClientAuthIds<TPlugins> extends [] ? {
+  readonly clientAccess: ClientAccessPolicy;
+} : ClientAuthIds<TPlugins> extends [infer TId extends string] ? {
+  readonly clientAccess?: `Remove clientAccess: plugin "${TId}" provides clientAuth`;
+} : {
+  readonly clientAuth: `Keep one clientAuth plugin: ${JoinIds<ClientAuthIds<TPlugins>>} all provide it`;
 };
-interface CreateHotUpdaterOptions {
-  readonly database: DatabasePlugin$1;
+type CreateHotUpdaterOptions<TPlugins extends readonly AnyHotUpdaterPlugin[] = readonly []> = {
+  /** A provider's database on the storage engine, such as `kyselyAdapter(...)` or `postgres(...)`. */
+  readonly database: ToolingDatabase;
   /**
-   * Required client-route access policy. This choice is explicit so a server
-   * cannot accidentally change between public and authenticated OTA access.
-   * `/version`, storage downloads, and admin-handler routes are unaffected.
+   * Where bundles are stored: the server reads and signs the URIs of each
+   * adapter's protocol.
    */
-  readonly clientAccess: ClientAccessPolicy;
-  /** Storage implementations used to read provider-specific storage URIs. */
-  readonly storage?: readonly StoragePlugin[];
-}
-declare function createHotUpdater(options: CreateHotUpdaterOptions): RuntimeHotUpdaterAPI;
+  readonly storage?: readonly StorageAdapter[];
+  /** The plugins the server runs; at most one provides clientAuth. Defaults to none. */
+  readonly plugins?: TPlugins;
+} & ClientAccessRule<TPlugins>;
+declare function createHotUpdater<const TPlugins extends readonly AnyHotUpdaterPlugin[] = readonly []>(options: CreateHotUpdaterOptions<TPlugins>): RuntimeHotUpdaterAPI<NoInfer<TPlugins>>;
 //#endregion
-export { ClientAccessPolicy, CreateHotUpdaterOptions, HotUpdaterAPI, RuntimeHotUpdaterAPI, createHotUpdater };
+export { ClientAccessPolicy, ClientAccessRule, ClientAuthProvider, ClientEndpoint, CreateHotUpdaterOptions, HotUpdaterAPI, RemovedClientAccess, RuntimeHotUpdaterAPI, createHotUpdater };

package/dist/createHotUpdaterCore.d.mts

@@ -1,57 +1,125 @@
-import { ApiKeyManagementAPI } from "./apiKeys.mjs";
+import { CoreApi } from "./core/api.mjs";
+import { AnyHotUpdaterPlugin, PluginApis } from "./plugins/definePlugin.mjs";
 import { HotUpdaterHandlers } from "./handlerTypes.mjs";
-import { InsightsProvider } from "./insights/types.mjs";
 import "./handler.mjs";
-import { DatabaseAPI, DatabasePlugin as DatabasePlugin$1 } from "./db/types.mjs";
-import { StoragePlugin } from "@hot-updater/plugin-core";
+import { PluginClientPlugin, StorageAdapter, ToolingDatabase } from "@hot-updater/plugin-core";
 //#region src/createHotUpdaterCore.d.ts
-type RuntimeHotUpdaterAPI = DatabaseAPI & {
+/** A plugin's endpoint on `handlers.client`. */
+interface ClientEndpoint {
+  /** The id of the plugin that adds it. */
+  readonly plugin: string;
+  readonly method: string;
+  /** Relative to the handler's mount; `:name` segments are parameters. */
+  readonly path: string;
+}
+/** The plugin that decides who may call client routes. */
+interface ClientAuthProvider {
+  /** Its id. */
+  readonly plugin: string;
+  /**
+   * The request headers its decision reads, lowercase: what a cache in
+   * front of the server, such as a CDN, keys client routes on.
+   */
+  readonly varyHeaders: readonly string[];
+}
+type RuntimeHotUpdaterAPI<TPlugins extends readonly AnyHotUpdaterPlugin[] = readonly AnyHotUpdaterPlugin[]> = {
+  /**
+   * The routes a host mounts. On first access every storage adapter must
+   * serve downloads (`get` and `getDownloadUrl`), so a server fails where it
+   * mounts them, while tooling that only reads the definition, such as the
+   * CLI, can list storage that only uploads.
+   */
   readonly handlers: HotUpdaterHandlers;
-  readonly adapterName: string;
   /**
-   * Built-in Insights provider. Client ingestion and admin query routes are
-   * always mounted; React Native clients report lifecycle events by default
-   * and can opt out with `HotUpdater.init({ insights: false })`.
+   * Core's reads and typed writes: bundles, Releases, Catalogs, and
+   * channels. The CLI and the console write through it, so their writes
+   * take the server's path: the plugins' schema fence, pruning during
+   * writes, the storage's file URLs, and the database's CDN purge.
    */
-  readonly insights: InsightsProvider;
+  readonly core: CoreApi;
+  /** Each plugin's API by plugin id, which the CLI's and the console's plugin features call. */
+  readonly api: PluginApis<TPlugins>;
+  /** The database's name, which `hot-updater db` commands read. */
+  readonly adapterName: string;
   /**
-   * In-process API key lifecycle operations for trusted server tooling.
-   * Creation returns the plaintext once; list and revoke expose only metadata.
-   * This capability is never mounted on the client or admin HTTP handlers.
+   * Applies aggregate changes the database batches that are still pending:
+   * this process's buffer, and the log rows no compaction has merged yet.
+   * A long-lived server with `aggregateBatching: { mode: "memory" }` calls
+   * it before it exits.
    */
-  readonly apiKeys: ApiKeyManagementAPI;
-};
-type HotUpdaterAPI = RuntimeHotUpdaterAPI;
-type ClientAccessPolicy = {
+  readonly flush: () => Promise<void>;
   /**
-   * Leaves Release Catalog, artifact, and Insights ingestion routes
-   * publicly accessible without a client credential.
+   * The database as configured. `hot-updater db` runs its tooling
+   * (`createMigrator`, `generateSchema`), and tooling done with the server
+   * closes it (`dispose`).
    */
-  readonly type: "public";
-} | {
+  readonly database: ToolingDatabase;
+  /** The storage as configured, in order, as a frozen copy. */
+  readonly storage: readonly StorageAdapter[];
+  /** The plugins as configured, as a frozen copy, whose tables tooling creates. */
+  readonly plugins: TPlugins;
   /**
-   * Requires a key registered in `database.models.apiKeys` for
-   * Release Catalog, artifact, and Insights ingestion requests.
+   * The client plugins an app adds to `HotUpdater.init`'s `plugins` for
+   * these plugins, each once, in plugin order: what init prints.
    */
-  readonly type: "api-key";
+  readonly clientPlugins: readonly PluginClientPlugin[];
   /**
-   * Request header containing the API key. Defaults to
-   * `x-api-key`. Clients must send the same header; Release Catalog
-   * responses include it in `Vary` to preserve cache isolation.
+   * The plugins' endpoints on `handlers.client`, which a host that routes
+   * by path, such as a CDN in front of the server, sends to it.
    */
+  readonly clientEndpoints: readonly ClientEndpoint[];
+  /** The plugin that guards client routes; absent when they are public. */
+  readonly clientAuth?: ClientAuthProvider;
+};
+type HotUpdaterAPI = RuntimeHotUpdaterAPI;
+declare const REMOVED_CLIENT_ACCESS = "clientAccess objects were removed in 1.0: set clientAccess: \"public\", or add a plugin that provides clientAuth";
+/**
+ * A `clientAccess` object from before 1.0. Its `type` names the fix, so
+ * TypeScript reports it where the object is written.
+ */
+interface RemovedClientAccess {
+  readonly type: typeof REMOVED_CLIENT_ACCESS;
   readonly headerName?: string;
+}
+type ClientAccessPolicy =
+/** Leaves client routes public; required when no plugin provides clientAuth. */
+"public" | RemovedClientAccess;
+type ProvidesClientAuth<TPlugin> = TPlugin extends {
+  readonly provides?: infer TProvides;
+} ? TProvides extends {
+  readonly clientAuth: true;
+} ? true : false : false;
+type ClientAuthIds<TPlugins extends readonly unknown[], TFound extends string[] = []> = TPlugins extends readonly [infer THead, ...infer TTail] ? ClientAuthIds<TTail, ProvidesClientAuth<THead> extends true ? [...TFound, THead extends {
+  readonly id: infer TId extends string;
+} ? TId : string] : TFound> : TFound;
+type JoinIds<TIds extends string[]> = TIds extends [infer TFirst extends string, ...infer TRest extends string[]] ? TRest extends [] ? `"${TFirst}"` : `"${TFirst}", ${JoinIds<TRest>}` : "";
+/**
+ * Client routes have one policy source: exactly one plugin that provides
+ * clientAuth, or an explicit `clientAccess`. Tuples are counted here; an
+ * untyped list that may hold a clientAuth plugin is left to startup.
+ */
+type ClientAccessRule<TPlugins extends readonly AnyHotUpdaterPlugin[]> = number extends TPlugins["length"] ? true extends ProvidesClientAuth<TPlugins[number]> ? {
+  readonly clientAccess?: "Remove clientAccess: a plugin in this list may provide clientAuth";
+} : {
+  readonly clientAccess: ClientAccessPolicy;
+} : ClientAuthIds<TPlugins> extends [] ? {
+  readonly clientAccess: ClientAccessPolicy;
+} : ClientAuthIds<TPlugins> extends [infer TId extends string] ? {
+  readonly clientAccess?: `Remove clientAccess: plugin "${TId}" provides clientAuth`;
+} : {
+  readonly clientAuth: `Keep one clientAuth plugin: ${JoinIds<ClientAuthIds<TPlugins>>} all provide it`;
 };
-interface CreateHotUpdaterOptions {
-  readonly database: DatabasePlugin$1;
+type CreateHotUpdaterOptions<TPlugins extends readonly AnyHotUpdaterPlugin[] = readonly []> = {
+  /** A provider's database on the storage engine, such as `kyselyAdapter(...)` or `postgres(...)`. */
+  readonly database: ToolingDatabase;
   /**
-   * Required client-route access policy. This choice is explicit so a server
-   * cannot accidentally change between public and authenticated OTA access.
-   * `/version`, storage downloads, and admin-handler routes are unaffected.
+   * Where bundles are stored: the server reads and signs the URIs of each
+   * adapter's protocol.
    */
-  readonly clientAccess: ClientAccessPolicy;
-  /** Storage implementations used to read provider-specific storage URIs. */
-  readonly storage?: readonly StoragePlugin[];
-}
-declare function createHotUpdater(options: CreateHotUpdaterOptions): RuntimeHotUpdaterAPI;
+  readonly storage?: readonly StorageAdapter[];
+  /** The plugins the server runs; at most one provides clientAuth. Defaults to none. */
+  readonly plugins?: TPlugins;
+} & ClientAccessRule<TPlugins>;
+declare function createHotUpdater<const TPlugins extends readonly AnyHotUpdaterPlugin[] = readonly []>(options: CreateHotUpdaterOptions<TPlugins>): RuntimeHotUpdaterAPI<NoInfer<TPlugins>>;
 //#endregion
-export { ClientAccessPolicy, CreateHotUpdaterOptions, HotUpdaterAPI, RuntimeHotUpdaterAPI, createHotUpdater };
+export { ClientAccessPolicy, ClientAccessRule, ClientAuthProvider, ClientEndpoint, CreateHotUpdaterOptions, HotUpdaterAPI, RemovedClientAccess, RuntimeHotUpdaterAPI, createHotUpdater };