@hot-updater/vercel 1.2.0-rc.4 → 1.2.0-rc.6

package/dist/function/index.mjs

@@ -17667,6 +17667,7 @@ var import_lib$1 = /* @__PURE__ */ __toESM(require_lib$2(), 1);
 const { Pool } = import_lib$1.default;
 const DATABASE_TARGET = Symbol.for("@hot-updater/database-target");
 const targetOf = ({ connectionString, host, port, database }) => {
+	if (typeof connectionString === "function") return void 0;
 	if (connectionString !== void 0) try {
 		const url = new URL(connectionString);
 		return `postgres/${url.hostname}:${url.port || "5432"}/${decodeURIComponent(url.pathname.slice(1))}`;
@@ -17678,7 +17679,14 @@ const targetOf = ({ connectionString, host, port, database }) => {
 const postgres = (config) => {
 	const { dialect, ...poolConfig } = config;
 	const target = targetOf(poolConfig);
-	const db = new Kysely({ dialect: dialect ?? new PostgresDialect({ pool: new Pool(poolConfig) }) });
+	const { connectionString } = poolConfig;
+	const db = new Kysely({ dialect: dialect ?? new PostgresDialect({ pool: typeof connectionString === "function" ? async () => new Pool({
+		...poolConfig,
+		connectionString: await connectionString()
+	}) : new Pool({
+		...poolConfig,
+		connectionString
+	}) }) });
 	return {
 		...createEngineDatabase({
 			name: "postgres",
@@ -17690,7 +17698,7 @@ const postgres = (config) => {
 };
 //#endregion
 //#region ../../packages/server/dist/version.mjs
-const HOT_UPDATER_SERVER_VERSION = "1.2.0-rc.4";
+const HOT_UPDATER_SERVER_VERSION = "1.2.0-rc.6";
 //#endregion
 //#region ../../packages/server/dist/handlerVersionRoutes.mjs
 const createVersionRouteHandlers = (plugins = []) => {
@@ -53985,9 +53993,17 @@ const storeIdOf = (token) => {
 };
 const access = "private";
 const vercelBlobStorage = (config) => {
-	const { token } = config;
-	let store;
-	const storeId = () => store ??= storeIdOf(token);
+	let resolved;
+	const store = () => resolved ??= (async () => {
+		const token = typeof config.token === "function" ? await config.token() : config.token;
+		return {
+			token,
+			storeId: storeIdOf(token)
+		};
+	})().catch((error) => {
+		resolved = void 0;
+		throw error;
+	});
 	const normalizedBasePath = config.basePath?.replace(/^\/+|\/+$/g, "") ?? "";
 	const getStorageKey = createStorageKeyBuilder(normalizedBasePath);
 	const expiresIn = config.signedUrlExpiresIn ?? 3600;
@@ -53997,6 +54013,7 @@ const vercelBlobStorage = (config) => {
 	const delegationUntil = async (validUntil) => {
 		const current = await delegation?.catch(() => void 0);
 		if (current !== void 0 && current.validUntil >= validUntil) return current;
+		const { token } = await store();
 		const issued = issueSignedToken({
 			token,
 			operations: ["get"],
@@ -54005,10 +54022,14 @@ const vercelBlobStorage = (config) => {
 		delegation = issued;
 		return issued;
 	};
-	const parseAndValidate = (storageUri) => {
+	const parseAndValidate = async (storageUri) => {
 		const parsed = parseStorageUri(storageUri, PROTOCOL);
-		if (parsed.bucket !== storeId()) throw new Error(`Blob store mismatch: expected "${storeId()}", but found "${parsed.bucket}".`);
-		return parsed;
+		const { token, storeId } = await store();
+		if (parsed.bucket !== storeId) throw new Error(`Blob store mismatch: expected "${storeId}", but found "${parsed.bucket}".`);
+		return {
+			...parsed,
+			token
+		};
 	};
 	const getListPrefix = (prefix = "") => {
 		const value = [normalizedBasePath, prefix.replace(/^\/+|\/+$/g, "")].filter(Boolean).join("/");
@@ -54024,9 +54045,10 @@ const vercelBlobStorage = (config) => {
 		protocol: PROTOCOL,
 		async put({ key, body, contentLength, contentType }) {
 			const storageKey = getStorageKey(key);
+			const { token, storeId } = await store();
 			const storageUri = createStorageUri({
 				protocol: PROTOCOL,
-				bucket: storeId(),
+				bucket: storeId,
 				key: storageKey
 			});
 			await put(toPathname(storageKey), body, {
@@ -54041,7 +54063,7 @@ const vercelBlobStorage = (config) => {
 			return { storageUri };
 		},
 		async get({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
+			const { key, token } = await parseAndValidate(storageUri);
 			const result = await get(toPathname(key), {
 				access,
 				token,
@@ -54055,7 +54077,7 @@ const vercelBlobStorage = (config) => {
 			} }) };
 		},
 		async getDownloadUrl({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
+			const { key } = await parseAndValidate(storageUri);
 			const pathname = toPathname(key);
 			const validUntil = Date.now() + expiresInMs;
 			const { presignedUrl } = await presignUrl(await delegationUntil(validUntil), {
@@ -54067,7 +54089,7 @@ const vercelBlobStorage = (config) => {
 			return { url: presignedUrl };
 		},
 		async exists({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
+			const { key, token } = await parseAndValidate(storageUri);
 			try {
 				await head(toPathname(key), { token });
 				return { exists: true };
@@ -54077,11 +54099,12 @@ const vercelBlobStorage = (config) => {
 			}
 		},
 		async delete({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
+			const { key, token } = await parseAndValidate(storageUri);
 			await del(toPathname(key), { token });
 			return { deleted: true };
 		},
 		async listObjects(prefix) {
+			const { token, storeId } = await store();
 			const objects = [];
 			let cursor;
 			do {
@@ -54098,7 +54121,7 @@ const vercelBlobStorage = (config) => {
 					try {
 						storageUri = createStorageUri({
 							protocol: PROTOCOL,
-							bucket: storeId(),
+							bucket: storeId,
 							key
 						});
 					} catch {
@@ -54116,6 +54139,7 @@ const vercelBlobStorage = (config) => {
 			return objects;
 		},
 		async deleteObjects(relativeKeys) {
+			const { token } = await store();
 			const pathnames = relativeKeys.map((key) => toPathname(getStorageKey(key)));
 			for (let offset = 0; offset < pathnames.length; offset += DELETE_BATCH_SIZE) await del(pathnames.slice(offset, offset + DELETE_BATCH_SIZE), { token });
 		}

package/dist/index.cjs

@@ -69,9 +69,17 @@ const access = "private";
 * that expire, so the store's objects never sit at a public address.
 */
 const vercelBlobStorage = (config) => {
-	const { token } = config;
-	let store;
-	const storeId = () => store ??= storeIdOf(token);
+	let resolved;
+	const store = () => resolved ??= (async () => {
+		const token = typeof config.token === "function" ? await config.token() : config.token;
+		return {
+			token,
+			storeId: storeIdOf(token)
+		};
+	})().catch((error) => {
+		resolved = void 0;
+		throw error;
+	});
 	const normalizedBasePath = config.basePath?.replace(/^\/+|\/+$/g, "") ?? "";
 	const getStorageKey = (0, _hot_updater_plugin_core.createStorageKeyBuilder)(normalizedBasePath);
 	const expiresIn = config.signedUrlExpiresIn ?? 3600;
@@ -82,6 +90,7 @@ const vercelBlobStorage = (config) => {
 	const delegationUntil = async (validUntil) => {
 		const current = await delegation?.catch(() => void 0);
 		if (current !== void 0 && current.validUntil >= validUntil) return current;
+		const { token } = await store();
 		const issued = (0, _vercel_blob.issueSignedToken)({
 			token,
 			operations: ["get"],
@@ -90,10 +99,14 @@ const vercelBlobStorage = (config) => {
 		delegation = issued;
 		return issued;
 	};
-	const parseAndValidate = (storageUri) => {
+	const parseAndValidate = async (storageUri) => {
 		const parsed = (0, _hot_updater_plugin_core.parseStorageUri)(storageUri, PROTOCOL);
-		if (parsed.bucket !== storeId()) throw new Error(`Blob store mismatch: expected "${storeId()}", but found "${parsed.bucket}".`);
-		return parsed;
+		const { token, storeId } = await store();
+		if (parsed.bucket !== storeId) throw new Error(`Blob store mismatch: expected "${storeId}", but found "${parsed.bucket}".`);
+		return {
+			...parsed,
+			token
+		};
 	};
 	const getListPrefix = (prefix = "") => {
 		const value = [normalizedBasePath, prefix.replace(/^\/+|\/+$/g, "")].filter(Boolean).join("/");
@@ -109,9 +122,10 @@ const vercelBlobStorage = (config) => {
 		protocol: PROTOCOL,
 		async put({ key, body, contentLength, contentType }) {
 			const storageKey = getStorageKey(key);
+			const { token, storeId } = await store();
 			const storageUri = (0, _hot_updater_plugin_core.createStorageUri)({
 				protocol: PROTOCOL,
-				bucket: storeId(),
+				bucket: storeId,
 				key: storageKey
 			});
 			await (0, _vercel_blob.put)(toPathname(storageKey), body, {
@@ -126,7 +140,7 @@ const vercelBlobStorage = (config) => {
 			return { storageUri };
 		},
 		async get({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
+			const { key, token } = await parseAndValidate(storageUri);
 			const result = await (0, _vercel_blob.get)(toPathname(key), {
 				access,
 				token,
@@ -140,7 +154,7 @@ const vercelBlobStorage = (config) => {
 			} }) };
 		},
 		async getDownloadUrl({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
+			const { key } = await parseAndValidate(storageUri);
 			const pathname = toPathname(key);
 			const validUntil = Date.now() + expiresInMs;
 			const { presignedUrl } = await (0, _vercel_blob.presignUrl)(await delegationUntil(validUntil), {
@@ -152,7 +166,7 @@ const vercelBlobStorage = (config) => {
 			return { url: presignedUrl };
 		},
 		async exists({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
+			const { key, token } = await parseAndValidate(storageUri);
 			try {
 				await (0, _vercel_blob.head)(toPathname(key), { token });
 				return { exists: true };
@@ -162,11 +176,12 @@ const vercelBlobStorage = (config) => {
 			}
 		},
 		async delete({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
+			const { key, token } = await parseAndValidate(storageUri);
 			await (0, _vercel_blob.del)(toPathname(key), { token });
 			return { deleted: true };
 		},
 		async listObjects(prefix) {
+			const { token, storeId } = await store();
 			const objects = [];
 			let cursor;
 			do {
@@ -183,7 +198,7 @@ const vercelBlobStorage = (config) => {
 					try {
 						storageUri = (0, _hot_updater_plugin_core.createStorageUri)({
 							protocol: PROTOCOL,
-							bucket: storeId(),
+							bucket: storeId,
 							key
 						});
 					} catch {
@@ -201,6 +216,7 @@ const vercelBlobStorage = (config) => {
 			return objects;
 		},
 		async deleteObjects(relativeKeys) {
+			const { token } = await store();
 			const pathnames = relativeKeys.map((key) => toPathname(getStorageKey(key)));
 			for (let offset = 0; offset < pathnames.length; offset += DELETE_BATCH_SIZE) await (0, _vercel_blob.del)(pathnames.slice(offset, offset + DELETE_BATCH_SIZE), { token });
 		}

package/dist/index.d.cts

@@ -4,9 +4,11 @@ import { PostgresConfig, postgres } from "@hot-updater/postgres";
 interface VercelBlobStorageConfig {
   /**
    * The Blob store's read-write token, `vercel_blob_rw_<storeId>_<secret>`:
-   * the `BLOB_READ_WRITE_TOKEN` Vercel adds to a project the store connects to.
+   * the `BLOB_READ_WRITE_TOKEN` Vercel adds to a project the store connects
+   * to. Or a function that returns it, such as one that reads it with
+   * `secretEnv`: called on first use, so a config loads without the token.
    */
-  token: string;
+  token: string | (() => string | Promise<string>);
   /** Base path where bundles will be stored in the store. */
   basePath?: string;
   /**

package/dist/index.d.mts

@@ -4,9 +4,11 @@ import { PostgresConfig, postgres } from "@hot-updater/postgres";
 interface VercelBlobStorageConfig {
   /**
    * The Blob store's read-write token, `vercel_blob_rw_<storeId>_<secret>`:
-   * the `BLOB_READ_WRITE_TOKEN` Vercel adds to a project the store connects to.
+   * the `BLOB_READ_WRITE_TOKEN` Vercel adds to a project the store connects
+   * to. Or a function that returns it, such as one that reads it with
+   * `secretEnv`: called on first use, so a config loads without the token.
    */
-  token: string;
+  token: string | (() => string | Promise<string>);
   /** Base path where bundles will be stored in the store. */
   basePath?: string;
   /**

package/dist/index.mjs

@@ -68,9 +68,17 @@ const access = "private";
 * that expire, so the store's objects never sit at a public address.
 */
 const vercelBlobStorage = (config) => {
-	const { token } = config;
-	let store;
-	const storeId = () => store ??= storeIdOf(token);
+	let resolved;
+	const store = () => resolved ??= (async () => {
+		const token = typeof config.token === "function" ? await config.token() : config.token;
+		return {
+			token,
+			storeId: storeIdOf(token)
+		};
+	})().catch((error) => {
+		resolved = void 0;
+		throw error;
+	});
 	const normalizedBasePath = config.basePath?.replace(/^\/+|\/+$/g, "") ?? "";
 	const getStorageKey = createStorageKeyBuilder(normalizedBasePath);
 	const expiresIn = config.signedUrlExpiresIn ?? 3600;
@@ -81,6 +89,7 @@ const vercelBlobStorage = (config) => {
 	const delegationUntil = async (validUntil) => {
 		const current = await delegation?.catch(() => void 0);
 		if (current !== void 0 && current.validUntil >= validUntil) return current;
+		const { token } = await store();
 		const issued = issueSignedToken({
 			token,
 			operations: ["get"],
@@ -89,10 +98,14 @@ const vercelBlobStorage = (config) => {
 		delegation = issued;
 		return issued;
 	};
-	const parseAndValidate = (storageUri) => {
+	const parseAndValidate = async (storageUri) => {
 		const parsed = parseStorageUri(storageUri, PROTOCOL);
-		if (parsed.bucket !== storeId()) throw new Error(`Blob store mismatch: expected "${storeId()}", but found "${parsed.bucket}".`);
-		return parsed;
+		const { token, storeId } = await store();
+		if (parsed.bucket !== storeId) throw new Error(`Blob store mismatch: expected "${storeId}", but found "${parsed.bucket}".`);
+		return {
+			...parsed,
+			token
+		};
 	};
 	const getListPrefix = (prefix = "") => {
 		const value = [normalizedBasePath, prefix.replace(/^\/+|\/+$/g, "")].filter(Boolean).join("/");
@@ -108,9 +121,10 @@ const vercelBlobStorage = (config) => {
 		protocol: PROTOCOL,
 		async put({ key, body, contentLength, contentType }) {
 			const storageKey = getStorageKey(key);
+			const { token, storeId } = await store();
 			const storageUri = createStorageUri({
 				protocol: PROTOCOL,
-				bucket: storeId(),
+				bucket: storeId,
 				key: storageKey
 			});
 			await put(toPathname(storageKey), body, {
@@ -125,7 +139,7 @@ const vercelBlobStorage = (config) => {
 			return { storageUri };
 		},
 		async get({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
+			const { key, token } = await parseAndValidate(storageUri);
 			const result = await get(toPathname(key), {
 				access,
 				token,
@@ -139,7 +153,7 @@ const vercelBlobStorage = (config) => {
 			} }) };
 		},
 		async getDownloadUrl({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
+			const { key } = await parseAndValidate(storageUri);
 			const pathname = toPathname(key);
 			const validUntil = Date.now() + expiresInMs;
 			const { presignedUrl } = await presignUrl(await delegationUntil(validUntil), {
@@ -151,7 +165,7 @@ const vercelBlobStorage = (config) => {
 			return { url: presignedUrl };
 		},
 		async exists({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
+			const { key, token } = await parseAndValidate(storageUri);
 			try {
 				await head(toPathname(key), { token });
 				return { exists: true };
@@ -161,11 +175,12 @@ const vercelBlobStorage = (config) => {
 			}
 		},
 		async delete({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
+			const { key, token } = await parseAndValidate(storageUri);
 			await del(toPathname(key), { token });
 			return { deleted: true };
 		},
 		async listObjects(prefix) {
+			const { token, storeId } = await store();
 			const objects = [];
 			let cursor;
 			do {
@@ -182,7 +197,7 @@ const vercelBlobStorage = (config) => {
 					try {
 						storageUri = createStorageUri({
 							protocol: PROTOCOL,
-							bucket: storeId(),
+							bucket: storeId,
 							key
 						});
 					} catch {
@@ -200,6 +215,7 @@ const vercelBlobStorage = (config) => {
 			return objects;
 		},
 		async deleteObjects(relativeKeys) {
+			const { token } = await store();
 			const pathnames = relativeKeys.map((key) => toPathname(getStorageKey(key)));
 			for (let offset = 0; offset < pathnames.length; offset += DELETE_BATCH_SIZE) await del(pathnames.slice(offset, offset + DELETE_BATCH_SIZE), { token });
 		}

package/dist/init/index.cjs

@@ -6268,24 +6268,29 @@ createExeca(mapScriptAsync, {}, deepScriptOptions, setScriptSync);
 const { sendMessage, getOneMessage, getEachMessage, getCancelSignal } = getIpcExport();
 //#endregion
 //#region iac/configTemplate.ts
-const getConfigScaffold = (build) => {
-	return (0, _hot_updater_cli_tools.createHotUpdaterConfigScaffoldFromBuilder)(new _hot_updater_cli_tools.ConfigBuilder().setBuildType(build).setStorage({
+const getConfigScaffold = (build, { secretEnv } = { secretEnv: false }) => {
+	const read = (reader, name) => secretEnv ? `async () =>
+      (await ${reader}()).${name}` : `process.env.${name}!`;
+	const storageConfig = {
 		imports: [{
 			pkg: "@hot-updater/vercel",
 			named: ["vercelBlobStorage"]
 		}],
 		configString: `vercelBlobStorage({
-    token: process.env.HOT_UPDATER_VERCEL_BLOB_READ_WRITE_TOKEN!,
+    token: ${read("storageSecrets", "HOT_UPDATER_VERCEL_BLOB_READ_WRITE_TOKEN")},
   })`
-	}).setDatabase({
+	};
+	const databaseConfig = {
 		imports: [{
 			pkg: "@hot-updater/vercel",
 			named: ["postgres"]
 		}],
 		configString: `postgres({
-    connectionString: process.env.HOT_UPDATER_VERCEL_DATABASE_URL!,
+    connectionString: ${read("databaseSecrets", "HOT_UPDATER_VERCEL_DATABASE_URL")},
   })`
-	}).setPlugins({
+	};
+	const helperStatements = secretEnv ? [(0, _hot_updater_cli_tools.secretEnvHelper)("storageSecrets", ["HOT_UPDATER_VERCEL_BLOB_READ_WRITE_TOKEN"]), (0, _hot_updater_cli_tools.secretEnvHelper)("databaseSecrets", ["HOT_UPDATER_VERCEL_DATABASE_URL"])] : [];
+	const builder = new _hot_updater_cli_tools.ConfigBuilder().setBuildType(build).setStorage(storageConfig).setDatabase(databaseConfig).setPlugins({
 		imports: [{
 			pkg: "hot-updater/plugins",
 			named: [
@@ -6295,7 +6300,12 @@ const getConfigScaffold = (build) => {
 			]
 		}],
 		configString: "[apiKeys(), insights(), remoteConfig()]"
-	}));
+	});
+	if (secretEnv) builder.addImport({
+		pkg: "hot-updater",
+		named: ["secretEnv"]
+	}).setIntermediateCode(helperStatements.map(({ code }) => code).join("\n\n"));
+	return (0, _hot_updater_cli_tools.createHotUpdaterConfigScaffoldFromBuilder)(builder, { helperStatements });
 };
 //#endregion
 //#region iac/init/index.ts
@@ -6382,7 +6392,8 @@ const initProvider = {
 			persistence: "with-consent",
 			preflight: false
 		}
-	}
+	},
+	secrets: ["HOT_UPDATER_VERCEL_BLOB_READ_WRITE_TOKEN", "HOT_UPDATER_VERCEL_DATABASE_URL"]
 };
 //#endregion
 //#region iac/vercelApi.ts
@@ -7002,10 +7013,10 @@ const selectDatabaseUrl = async ({ api, cwd, project, savedUrl, scope, token })
 		validate: (value) => isPostgresUrl(value) ? void 0 : "Enter a postgres:// or postgresql:// URL."
 	}));
 };
-const runInit = async ({ build, envFile }) => {
+const runInit = async ({ build, envFile, secretsEnv }) => {
 	const cwd = (0, _hot_updater_cli_tools.getCwd)();
 	const nonInteractive = envFile !== void 0;
-	const initEnvSources = await (0, _hot_updater_cli_tools.readHotUpdaterInitEnv)(cwd, envFile);
+	const initEnvSources = await (0, _hot_updater_cli_tools.readHotUpdaterInitEnv)(cwd, envFile, secretsEnv);
 	const { managedEnv } = initEnvSources;
 	const initInputEnv = (0, _hot_updater_cli_tools.getHotUpdaterInitInputEnv)(initEnvSources, nonInteractive);
 	const saved = Object.fromEntries(Object.entries(inputs).map(([name, input]) => [name, initInputEnv[input.envKey]?.trim() || void 0]));
@@ -7133,7 +7144,7 @@ const runInit = async ({ build, envFile }) => {
 		await database.dispose?.();
 	}
 	_hot_updater_cli_tools.p.log.success("Generated '.env.hotupdater' file with Vercel settings.");
-	await (0, _hot_updater_cli_tools.writeHotUpdaterFiles)(getConfigScaffold(build), {
+	await (0, _hot_updater_cli_tools.writeHotUpdaterFiles)(getConfigScaffold(build, { secretEnv: true }), {
 		cwd,
 		settings: "Vercel"
 	});

package/dist/init/index.d.cts

@@ -68,6 +68,7 @@ declare const initProvider: {
       readonly preflight: false;
     };
   };
+  readonly secrets: readonly ["HOT_UPDATER_VERCEL_BLOB_READ_WRITE_TOKEN", "HOT_UPDATER_VERCEL_DATABASE_URL"];
 };
 //#endregion
 //#region iac/vercelFunction.d.ts
@@ -86,6 +87,6 @@ declare const VERCEL_FUNCTION_CONFIG: {
 };
 //#endregion
 //#region iac/index.d.ts
-declare const runInit: ({ build, envFile }: RunInitOptions) => Promise<void>;
+declare const runInit: ({ build, envFile, secretsEnv }: RunInitOptions) => Promise<void>;
 //#endregion
 export { VERCEL_FUNCTION_CONFIG, initProvider, runInit };

package/dist/init/index.d.mts

@@ -68,6 +68,7 @@ declare const initProvider: {
       readonly preflight: false;
     };
   };
+  readonly secrets: readonly ["HOT_UPDATER_VERCEL_BLOB_READ_WRITE_TOKEN", "HOT_UPDATER_VERCEL_DATABASE_URL"];
 };
 //#endregion
 //#region iac/vercelFunction.d.ts
@@ -86,6 +87,6 @@ declare const VERCEL_FUNCTION_CONFIG: {
 };
 //#endregion
 //#region iac/index.d.ts
-declare const runInit: ({ build, envFile }: RunInitOptions) => Promise<void>;
+declare const runInit: ({ build, envFile, secretsEnv }: RunInitOptions) => Promise<void>;
 //#endregion
 export { VERCEL_FUNCTION_CONFIG, initProvider, runInit };

package/dist/init/index.mjs

@@ -2,7 +2,7 @@ import { createRequire } from "node:module";
 import fs from "fs/promises";
 import os from "os";
 import path from "path";
-import { ConfigBuilder, InitError, LegacyInfrastructureError, assembleServer, assertInfrastructureGenerationPayload, confirmInitInputPersistence, createHotUpdaterConfigScaffoldFromBuilder, createMigrator, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, printAppSetup, provisionClientCredential, readHotUpdaterInitEnv, shouldAutoSelectOnlyInitResource, writeHotUpdaterFiles } from "@hot-updater/cli-tools";
+import { ConfigBuilder, InitError, LegacyInfrastructureError, assembleServer, assertInfrastructureGenerationPayload, confirmInitInputPersistence, createHotUpdaterConfigScaffoldFromBuilder, createMigrator, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, printAppSetup, provisionClientCredential, readHotUpdaterInitEnv, secretEnvHelper, shouldAutoSelectOnlyInitResource, writeHotUpdaterFiles } from "@hot-updater/cli-tools";
 import { postgres } from "@hot-updater/postgres";
 import { apiKeys, insights, remoteConfig } from "@hot-updater/server/plugins";
 import { fileURLToPath } from "node:url";
@@ -6262,24 +6262,29 @@ createExeca(mapScriptAsync, {}, deepScriptOptions, setScriptSync);
 const { sendMessage, getOneMessage, getEachMessage, getCancelSignal } = getIpcExport();
 //#endregion
 //#region iac/configTemplate.ts
-const getConfigScaffold = (build) => {
-	return createHotUpdaterConfigScaffoldFromBuilder(new ConfigBuilder().setBuildType(build).setStorage({
+const getConfigScaffold = (build, { secretEnv } = { secretEnv: false }) => {
+	const read = (reader, name) => secretEnv ? `async () =>
+      (await ${reader}()).${name}` : `process.env.${name}!`;
+	const storageConfig = {
 		imports: [{
 			pkg: "@hot-updater/vercel",
 			named: ["vercelBlobStorage"]
 		}],
 		configString: `vercelBlobStorage({
-    token: process.env.HOT_UPDATER_VERCEL_BLOB_READ_WRITE_TOKEN!,
+    token: ${read("storageSecrets", "HOT_UPDATER_VERCEL_BLOB_READ_WRITE_TOKEN")},
   })`
-	}).setDatabase({
+	};
+	const databaseConfig = {
 		imports: [{
 			pkg: "@hot-updater/vercel",
 			named: ["postgres"]
 		}],
 		configString: `postgres({
-    connectionString: process.env.HOT_UPDATER_VERCEL_DATABASE_URL!,
+    connectionString: ${read("databaseSecrets", "HOT_UPDATER_VERCEL_DATABASE_URL")},
   })`
-	}).setPlugins({
+	};
+	const helperStatements = secretEnv ? [secretEnvHelper("storageSecrets", ["HOT_UPDATER_VERCEL_BLOB_READ_WRITE_TOKEN"]), secretEnvHelper("databaseSecrets", ["HOT_UPDATER_VERCEL_DATABASE_URL"])] : [];
+	const builder = new ConfigBuilder().setBuildType(build).setStorage(storageConfig).setDatabase(databaseConfig).setPlugins({
 		imports: [{
 			pkg: "hot-updater/plugins",
 			named: [
@@ -6289,7 +6294,12 @@ const getConfigScaffold = (build) => {
 			]
 		}],
 		configString: "[apiKeys(), insights(), remoteConfig()]"
-	}));
+	});
+	if (secretEnv) builder.addImport({
+		pkg: "hot-updater",
+		named: ["secretEnv"]
+	}).setIntermediateCode(helperStatements.map(({ code }) => code).join("\n\n"));
+	return createHotUpdaterConfigScaffoldFromBuilder(builder, { helperStatements });
 };
 //#endregion
 //#region iac/init/index.ts
@@ -6376,7 +6386,8 @@ const initProvider = {
 			persistence: "with-consent",
 			preflight: false
 		}
-	}
+	},
+	secrets: ["HOT_UPDATER_VERCEL_BLOB_READ_WRITE_TOKEN", "HOT_UPDATER_VERCEL_DATABASE_URL"]
 };
 //#endregion
 //#region iac/vercelApi.ts
@@ -6996,10 +7007,10 @@ const selectDatabaseUrl = async ({ api, cwd, project, savedUrl, scope, token })
 		validate: (value) => isPostgresUrl(value) ? void 0 : "Enter a postgres:// or postgresql:// URL."
 	}));
 };
-const runInit = async ({ build, envFile }) => {
+const runInit = async ({ build, envFile, secretsEnv }) => {
 	const cwd = getCwd();
 	const nonInteractive = envFile !== void 0;
-	const initEnvSources = await readHotUpdaterInitEnv(cwd, envFile);
+	const initEnvSources = await readHotUpdaterInitEnv(cwd, envFile, secretsEnv);
 	const { managedEnv } = initEnvSources;
 	const initInputEnv = getHotUpdaterInitInputEnv(initEnvSources, nonInteractive);
 	const saved = Object.fromEntries(Object.entries(inputs).map(([name, input]) => [name, initInputEnv[input.envKey]?.trim() || void 0]));
@@ -7127,7 +7138,7 @@ const runInit = async ({ build, envFile }) => {
 		await database.dispose?.();
 	}
 	p.log.success("Generated '.env.hotupdater' file with Vercel settings.");
-	await writeHotUpdaterFiles(getConfigScaffold(build), {
+	await writeHotUpdaterFiles(getConfigScaffold(build, { secretEnv: true }), {
 		cwd,
 		settings: "Vercel"
 	});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hot-updater/vercel",
   "type": "module",
-  "version": "1.2.0-rc.4",
+  "version": "1.2.0-rc.6",
   "description": "React Native OTA solution for self-hosted",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -41,11 +41,11 @@
     "@vercel/cli-auth": "0.3.10",
     "@vercel/cli-config": "0.3.1",
     "pg": "8.13.1",
-    "@hot-updater/cli-tools": "1.2.0-rc.4",
-    "@hot-updater/plugin-core": "1.2.0-rc.4",
-    "@hot-updater/postgres": "1.2.0-rc.4",
-    "@hot-updater/protocol": "1.2.0-rc.4",
-    "@hot-updater/server": "1.2.0-rc.4"
+    "@hot-updater/cli-tools": "1.2.0-rc.6",
+    "@hot-updater/plugin-core": "1.2.0-rc.6",
+    "@hot-updater/postgres": "1.2.0-rc.6",
+    "@hot-updater/protocol": "1.2.0-rc.6",
+    "@hot-updater/server": "1.2.0-rc.6"
   },
   "devDependencies": {
     "@types/node": "^20",
@@ -54,7 +54,7 @@
     "execa": "9.5.2",
     "kysely": "0.28.17",
     "vitest": "4.1.4",
-    "@hot-updater/test-utils": "1.2.0-rc.4"
+    "@hot-updater/test-utils": "1.2.0-rc.6"
   },
   "scripts": {
     "build": "tsdown",