@_nazmiforreal/flutter-ota 0.1.0 → 0.1.2

package/dart-src/plugins/aws/lib/src/aws_cloudfront_client.dart

@@ -0,0 +1,207 @@
+import 'dart:convert' show utf8;
+import 'dart:typed_data' show Uint8List;
+
+import 'package:crypto/crypto.dart' show Hmac, sha256;
+import 'package:http/http.dart' show Client, Request, Response;
+
+const String _cloudfrontService = 'cloudfront';
+const String _cloudfrontRegion = 'us-east-1';
+const String _cloudfrontApiBase = 'https://cloudfront.amazonaws.com';
+
+/// Configuration for the CloudFront invalidation client.
+class AwsCloudFrontConfig {
+  const AwsCloudFrontConfig({
+    required this.accessKeyId,
+    required this.secretAccessKey,
+    this.sessionToken,
+  });
+
+  final String accessKeyId;
+  final String secretAccessKey;
+  final String? sessionToken;
+}
+
+/// CloudFront cache-invalidation client (mirrors the subset of
+/// `@aws-sdk/client-cloudfront` used by hot-updater's `s3Database.ts`).
+abstract class AwsCloudFrontClientLike {
+  const AwsCloudFrontClientLike();
+
+  Future<void> createInvalidation(
+    String distributionId,
+    List<String> paths, {
+    bool shouldWait = false,
+  });
+}
+
+/// Real CloudFront client backed by `package:http` + AWS SigV4 signing
+/// (service `cloudfront`, global region `us-east-1`).
+class AwsCloudFrontClient implements AwsCloudFrontClientLike {
+  AwsCloudFrontClient(this.config, {Client? http}) : _http = http ?? Client();
+
+  final AwsCloudFrontConfig config;
+  final Client _http;
+
+  static const Duration _pollInterval = Duration(seconds: 2);
+  static const Duration _timeout = Duration(minutes: 5);
+
+  @override
+  Future<void> createInvalidation(
+    String distributionId,
+    List<String> paths, {
+    bool shouldWait = false,
+  }) async {
+    if (paths.isEmpty) return;
+
+    final timestamp = DateTime.now();
+    final callerReference = 'invalidation-${timestamp.millisecondsSinceEpoch}';
+    final body = _buildInvalidationXml(callerReference, paths);
+    final uri = Uri.parse(
+      '$_cloudfrontApiBase/2020-05-31/distribution/$distributionId/invalidation',
+    );
+
+    try {
+      final response = await _send('POST', uri, utf8.encode(body));
+      _assertStatus(response, [200, 201], 'CreateInvalidation');
+
+      if (!shouldWait) return;
+
+      final invalidationId = _extractInvalidationId(response.body);
+      if (invalidationId == null) {
+        throw StateError('CloudFront invalidation response missing Id');
+      }
+      if (response.body.contains('<Status>Completed</Status>')) return;
+
+      final deadline = DateTime.now().add(_timeout);
+      while (DateTime.now().isBefore(deadline)) {
+        await Future.delayed(_pollInterval);
+        final statusResp = await _send(
+          'GET',
+          Uri.parse(
+            '$_cloudfrontApiBase/2020-05-31/distribution/$distributionId/'
+            'invalidation/$invalidationId',
+          ),
+          null,
+        );
+        if (statusResp.body.contains('<Status>Completed</Status>')) return;
+      }
+      throw StateError(
+        'Timed out waiting for CloudFront invalidation $invalidationId',
+      );
+    } catch (error) {
+      if (shouldWait) rethrow;
+      // When not waiting, surface invalidation failures as warnings and
+      // continue (mirrors hot-updater's s3Database behaviour).
+      // ignore: avoid_print
+      print(
+        '[flutter_patcher/aws] CloudFront invalidation failed for '
+        '$distributionId; continuing without cache invalidation: $error',
+      );
+    }
+  }
+
+  String _buildInvalidationXml(String callerReference, List<String> paths) {
+    final items = paths
+        .map((p) => '    <Path>${_xmlEscape(p)}</Path>')
+        .join('\n');
+    return '<?xml version="1.0" encoding="UTF-8"?>\n'
+        '<InvalidationBatch xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">\n'
+        '  <CallerReference>$callerReference</CallerReference>\n'
+        '  <Paths>\n'
+        '    <Quantity>${paths.length}</Quantity>\n'
+        '    <Items>\n$items\n    </Items>\n'
+        '  </Paths>\n'
+        '</InvalidationBatch>';
+  }
+
+  String? _extractInvalidationId(String xml) {
+    final m = RegExp(r'<Id>([^<]+)</Id>').firstMatch(xml);
+    return m?.group(1);
+  }
+
+  Map<String, String> _authHeaders(
+    String method,
+    Uri uri,
+    List<int>? body,
+  ) {
+    final now = DateTime.now().toUtc();
+    final amzDate = _amzDate(now);
+    final dateStamp = amzDate.substring(0, 8);
+    final scope =
+        '$dateStamp/$_cloudfrontRegion/$_cloudfrontService/aws4_request';
+    final payloadHash = body == null ? _hashHex(const []) : _hashHex(body);
+
+    final canonicalHeaders = 'host:${uri.host}\n'
+        'x-amz-content-sha256:$payloadHash\n'
+        'x-amz-date:$amzDate\n'
+        '${config.sessionToken != null ? 'x-amz-security-token:${config.sessionToken}\n' : ''}';
+    final signedHeaders = config.sessionToken != null
+        ? 'host;x-amz-content-sha256;x-amz-date;x-amz-security-token'
+        : 'host;x-amz-content-sha256;x-amz-date';
+
+    final canonicalRequest = '$method\n${uri.path}\n'
+        '\n$canonicalHeaders$signedHeaders\n$payloadHash';
+    final stringToSign = _stringToSign(amzDate, scope, canonicalRequest);
+    final signingKey = _signingKey(dateStamp);
+    final signature = _toHex(_hmac(signingKey, stringToSign));
+
+    final headers = {
+      'x-amz-date': amzDate,
+      'x-amz-content-sha256': payloadHash,
+      'Authorization':
+          'AWS4-HMAC-SHA256 Credential=${config.accessKeyId}/$scope, '
+          'SignedHeaders=$signedHeaders, Signature=$signature',
+    };
+    if (config.sessionToken != null) {
+      headers['x-amz-security-token'] = config.sessionToken!;
+    }
+    return headers;
+  }
+
+  Future<Response> _send(String method, Uri uri, List<int>? body) async {
+    final request = Request(method, uri);
+    request.headers.addAll(_authHeaders(method, uri, body));
+    request.headers['Content-Type'] = 'application/xml';
+    if (body != null) request.bodyBytes = body;
+    final streamed = await _http.send(request);
+    return await Response.fromStream(streamed);
+  }
+
+  List<int> _signingKey(String dateStamp) {
+    var key = utf8.encode('AWS4${config.secretAccessKey}');
+    key = _hmac(key, dateStamp);
+    key = _hmac(key, _cloudfrontRegion);
+    key = _hmac(key, _cloudfrontService);
+    key = _hmac(key, 'aws4_request');
+    return key;
+  }
+
+  String _stringToSign(String amzDate, String scope, String canonicalRequest) =>
+      'AWS4-HMAC-SHA256\n$amzDate\n$scope\n${_hashHex(utf8.encode(canonicalRequest))}';
+
+  static String _amzDate(DateTime utc) =>
+      '${utc.toIso8601String().replaceAll('-', '').replaceAll(':', '').split('.').first}Z';
+
+  static String _xmlEscape(String value) =>
+      value.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;');
+
+  static Uint8List _hmac(List<int> key, String data) =>
+      Hmac(sha256, key).convert(utf8.encode(data)).bytes as Uint8List;
+
+  static String _hashHex(List<int> data) =>
+      _toHex(sha256.convert(data).bytes);
+
+  static String _toHex(List<int> bytes) =>
+      bytes.map((b) => b.toRadixString(16).padLeft(2, '0')).join();
+
+  static void _assertStatus(
+    Response response,
+    List<int> ok,
+    String operation,
+  ) {
+    if (!ok.contains(response.statusCode)) {
+      throw Exception(
+        'CloudFront $operation failed (${response.statusCode}): ${response.body}',
+      );
+    }
+  }
+}

package/dart-src/plugins/aws/lib/src/aws_cloudfront_signer.dart

@@ -0,0 +1,130 @@
+import 'dart:convert' show base64Decode, base64Encode, jsonEncode, utf8;
+import 'dart:typed_data' show Uint8List;
+
+import 'package:asn1lib/asn1lib.dart';
+import 'package:pointycastle/export.dart'
+    show
+        PrivateKeyParameter,
+        PublicKeyParameter,
+        RSAPrivateKey,
+        RSAPublicKey,
+        RSASignature,
+        RSASigner,
+        SHA1Digest;
+
+/// ASN.1 DigestInfo prefix for SHA1, used by pointycastle's PKCS#1 v1.5 signer.
+const String _sha1DigestIdentifierHex = '3021300906052b0e03021a05000414';
+
+String _base64UrlNoPad(List<int> bytes) =>
+    base64Encode(bytes).replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '');
+
+/// Parse a PEM-encoded RSA private key (PKCS#1 `RSA PRIVATE KEY` or PKCS#8
+/// `PRIVATE KEY`) into a [RSAPrivateKey].
+RSAPrivateKey parseRsaPrivateKeyPem(String pem) {
+  final lines = pem
+      .split('\n')
+      .where((l) => l.isNotEmpty && !l.startsWith('-----'))
+      .join('');
+  final der = base64DecodeToBytes(lines);
+  final seq = ASN1Parser(der).nextObject() as ASN1Sequence;
+
+  late final ASN1Sequence keySeq;
+  if (seq.elements.length == 3) {
+    // PKCS#8: SEQUENCE { version, AlgorithmIdentifier, BIT STRING }
+    final bitString = seq.elements[2] as ASN1BitString;
+    keySeq = ASN1Parser(bitString.contentBytes()).nextObject() as ASN1Sequence;
+  } else {
+    // PKCS#1: RSAPrivateKey ::= SEQUENCE { version, n, e, d, p, q, dP, dQ, qInv }
+    keySeq = seq;
+  }
+
+  final modulus = (keySeq.elements[1] as ASN1Integer).valueAsBigInteger;
+  final privateExponent = (keySeq.elements[3] as ASN1Integer).valueAsBigInteger;
+  final p = (keySeq.elements[4] as ASN1Integer).valueAsBigInteger;
+  final q = (keySeq.elements[5] as ASN1Integer).valueAsBigInteger;
+  return RSAPrivateKey(modulus, privateExponent, p, q);
+}
+
+Uint8List base64DecodeToBytes(String s) => _base64Decode(s);
+
+Uint8List _base64Decode(String s) {
+  final normalized = s.replaceAll('-', '+').replaceAll('_', '/');
+  final padded = normalized.padRight(
+    normalized.length + (4 - normalized.length % 4) % 4,
+    '=',
+  );
+  return base64Decode(padded);
+}
+
+/// Build a CloudFront signed URL (custom policy, RSA-SHA1) for [url].
+///
+/// Faithful port of `@aws-sdk/cloudfront-signer`'s `getSignedUrl`.
+String cloudfrontSignedUrl({
+  required String url,
+  required String keyPairId,
+  required String privateKeyPem,
+  required DateTime dateLessThan,
+}) {
+  final privateKey = parseRsaPrivateKeyPem(privateKeyPem);
+
+  final policy = jsonEncode({
+    'Statement': [
+      {
+        'Resource': url,
+        'Condition': {
+          'DateLessThan': {
+            'AWS:EpochTime': dateLessThan.millisecondsSinceEpoch ~/ 1000,
+          },
+        },
+      },
+    ],
+  });
+  final policyBytes = utf8.encode(policy);
+  final policyB64 = _base64UrlNoPad(policyBytes);
+
+  final signer = RSASigner(SHA1Digest(), _sha1DigestIdentifierHex);
+  signer.init(true, PrivateKeyParameter<RSAPrivateKey>(privateKey));
+  final signature = signer.generateSignature(Uint8List.fromList(policyBytes)).bytes;
+  final signatureB64 = _base64UrlNoPad(signature);
+
+  return '$url?Policy=$policyB64&Signature=$signatureB64'
+      '&Key-Pair-Id=$keyPairId';
+}
+
+/// Verify a CloudFront signed URL's signature against [publicKeyPem] (test seam).
+bool verifyCloudfrontSignedUrl({
+  required String signedUrl,
+  required String publicKeyPem,
+}) {
+  final uri = Uri.parse(signedUrl);
+  final policy = uri.queryParameters['Policy'];
+  final signature = uri.queryParameters['Signature'];
+  if (policy == null || signature == null) return false;
+
+  final policyBytes = _base64Decode(policy);
+  final sigBytes = _base64Decode(signature);
+
+  final pub = parseRsaPublicKeyPem(publicKeyPem);
+  final signer = RSASigner(SHA1Digest(), _sha1DigestIdentifierHex);
+  signer.init(false, PublicKeyParameter<RSAPublicKey>(pub));
+  return signer.verifySignature(
+    Uint8List.fromList(policyBytes),
+    RSASignature(Uint8List.fromList(sigBytes)),
+  );
+}
+
+/// Parse a PEM-encoded RSA public key into [RSAPublicKey].
+RSAPublicKey parseRsaPublicKeyPem(String pem) {
+  final lines = pem
+      .split('\n')
+      .where((l) => l.isNotEmpty && !l.startsWith('-----'))
+      .join('');
+  final der = base64DecodeToBytes(lines);
+  final seq = ASN1Parser(der).nextObject() as ASN1Sequence;
+  // SubjectPublicKeyInfo: SEQUENCE { AlgorithmIdentifier, BIT STRING }
+  final bitString = seq.elements[1] as ASN1BitString;
+  final key = ASN1Parser(bitString.contentBytes()).nextObject() as ASN1Sequence;
+  final modulus = (key.elements[0] as ASN1Integer).valueAsBigInteger;
+  final exponent = (key.elements[1] as ASN1Integer).valueAsBigInteger;
+  return RSAPublicKey(modulus, exponent);
+}

package/dart-src/plugins/aws/lib/src/aws_config.dart

@@ -0,0 +1,59 @@
+import 'dart:io' show Platform;
+
+import 'aws_s3_client.dart' show AwsS3Client, AwsS3ClientLike;
+
+/// Configuration for the AWS S3 storage plugin.
+///
+/// Faithful port of hot-updater `S3StorageConfig` (extends the AWS SDK
+/// `S3ClientConfig` with `bucketName` and `basePath`).
+class AwsS3StorageConfig {
+  AwsS3StorageConfig({
+    required this.bucketName,
+    required this.region,
+    required this.accessKeyId,
+    required this.secretAccessKey,
+    this.basePath,
+    this.endpoint,
+    this.sessionToken,
+    this.clientFactory = defaultAwsS3ClientFactory,
+  });
+
+  final String bucketName;
+  final String region;
+  final String accessKeyId;
+  final String secretAccessKey;
+  final String? basePath;
+  final String? endpoint;
+  final String? sessionToken;
+
+  /// Test seam: override the concrete S3 client.
+  final AwsS3ClientLike Function(AwsS3StorageConfig config) clientFactory;
+}
+
+/// Default factory producing a real [AwsS3Client] with runtime region applied.
+AwsS3ClientLike defaultAwsS3ClientFactory(AwsS3StorageConfig config) =>
+    AwsS3Client(applyS3RuntimeAwsConfig(config));
+
+/// Fill in a default region from the environment when one is not supplied
+/// (mirrors hot-updater's `applyS3RuntimeAwsConfig`).
+AwsS3StorageConfig applyS3RuntimeAwsConfig(AwsS3StorageConfig config) {
+  if (config.region.isNotEmpty) return config;
+  final envRegion =
+      Platform.environment['AWS_REGION'] ??
+      Platform.environment['AWS_DEFAULT_REGION'];
+  if (envRegion == null || envRegion.isEmpty) return config;
+  return AwsS3StorageConfig(
+    bucketName: config.bucketName,
+    region: envRegion,
+    accessKeyId: config.accessKeyId,
+    secretAccessKey: config.secretAccessKey,
+    basePath: config.basePath,
+    endpoint: config.endpoint,
+    sessionToken: config.sessionToken,
+    clientFactory: config.clientFactory,
+  );
+}
+
+/// Resolve the concrete S3 client from config (seam for tests).
+AwsS3ClientLike resolveAwsS3Client(AwsS3StorageConfig config) =>
+    config.clientFactory(config);

package/dart-src/plugins/aws/lib/src/aws_database.dart

@@ -0,0 +1,198 @@
+import 'dart:convert' show jsonDecode, jsonEncode, utf8;
+
+import 'package:flutter_patcher_plugin_core/flutter_patcher_plugin_core.dart'
+    show BlobOperations, createBlobDatabasePlugin;
+
+import 'aws_cloudfront_client.dart'
+    show AwsCloudFrontClient, AwsCloudFrontClientLike, AwsCloudFrontConfig;
+import 'aws_config.dart' show AwsS3StorageConfig, applyS3RuntimeAwsConfig;
+import 'aws_s3_client.dart' show AwsS3Client, AwsS3ClientLike;
+
+/// Thrown when an S3 object is archived (Glacier) and cannot be read.
+class S3ArchivedObjectError implements Exception {
+  S3ArchivedObjectError({required this.key, required this.cause});
+
+  final String key;
+  final Object cause;
+
+  @override
+  String toString() =>
+      'S3ArchivedObjectError: object "$key" is archived and cannot be read.';
+}
+
+/// Build `toStorageKey` / `fromStorageKey` transformers for a base path.
+/// Faithful port of hot-updater `createDatabaseKeyBuilder.ts`.
+(String Function(String), String Function(String)) createDatabaseKeyBuilder(
+  String? basePath,
+) {
+  final normalized = basePath?.replaceAll(RegExp(r'^/+|/+$'), '') ?? '';
+  String toStorageKey(String key) =>
+      [normalized, key].where((s) => s.isNotEmpty).join('/');
+  String fromStorageKey(String key) {
+    if (normalized.isEmpty) return key;
+    final prefix = '$normalized/';
+    return key.startsWith(prefix) ? key.substring(prefix.length) : key;
+  }
+
+  return (toStorageKey, fromStorageKey);
+}
+
+/// Configuration for the AWS S3 blob database plugin.
+class S3DatabaseConfig {
+  S3DatabaseConfig({
+    required this.bucketName,
+    required this.region,
+    required this.accessKeyId,
+    required this.secretAccessKey,
+    this.basePath,
+    this.cloudfrontDistributionId,
+    this.shouldWaitForInvalidation = false,
+    this.apiBasePath = '/api/check-update',
+    this.endpoint,
+    this.sessionToken,
+    this.clientFactory = defaultAwsS3DatabaseClientFactory,
+    this.cloudfrontClientFactory = defaultAwsCloudFrontClientFactory,
+  });
+
+  final String bucketName;
+  final String region;
+  final String accessKeyId;
+  final String secretAccessKey;
+  final String? basePath;
+  final String? cloudfrontDistributionId;
+  final bool shouldWaitForInvalidation;
+  final String apiBasePath;
+  final String? endpoint;
+  final String? sessionToken;
+
+  /// Test seam: override the concrete S3 client.
+  final AwsS3ClientLike Function(S3DatabaseConfig config) clientFactory;
+
+  /// Test seam: override the concrete CloudFront client.
+  final AwsCloudFrontClientLike Function(S3DatabaseConfig config)
+      cloudfrontClientFactory;
+}
+
+/// Default factory producing a real [AwsS3Client] with runtime region applied.
+AwsS3ClientLike defaultAwsS3DatabaseClientFactory(S3DatabaseConfig config) =>
+    AwsS3Client(
+      applyS3RuntimeAwsConfig(
+        AwsS3StorageConfig(
+          bucketName: config.bucketName,
+          region: config.region,
+          accessKeyId: config.accessKeyId,
+          secretAccessKey: config.secretAccessKey,
+          basePath: config.basePath,
+          endpoint: config.endpoint,
+          sessionToken: config.sessionToken,
+        ),
+      ),
+    );
+
+/// Default factory producing a real [AwsCloudFrontClient].
+AwsCloudFrontClientLike defaultAwsCloudFrontClientFactory(
+  S3DatabaseConfig config,
+) =>
+    AwsCloudFrontClient(
+      AwsCloudFrontConfig(
+        accessKeyId: config.accessKeyId,
+        secretAccessKey: config.secretAccessKey,
+        sessionToken: config.sessionToken,
+      ),
+    );
+
+bool _isUpdateJsonKey(String key) =>
+    RegExp(r'^[^/]+/(?:ios|android)/[^/]+/update\.json$').hasMatch(key);
+
+/// S3-backed [BlobOperations] for the AWS `s3Database` plugin.
+class S3BlobOperations implements BlobOperations {
+  S3BlobOperations(this.config)
+      : _client = config.clientFactory(config),
+        _cloudfront = config.cloudfrontDistributionId != null
+            ? config.cloudfrontClientFactory(config)
+            : null {
+    final keyBuilder = createDatabaseKeyBuilder(config.basePath);
+    _toStorageKey = keyBuilder.$1;
+    _fromStorageKey = keyBuilder.$2;
+  }
+
+  final S3DatabaseConfig config;
+  final AwsS3ClientLike _client;
+  final AwsCloudFrontClientLike? _cloudfront;
+  late final String Function(String) _toStorageKey;
+  late final String Function(String) _fromStorageKey;
+
+  @override
+  String get apiBasePath => config.apiBasePath;
+
+  @override
+  Future<List<String>> listObjects(String prefix) async {
+    final objects = await _client.listObjects(_toStorageKey(prefix));
+    return objects
+        .map((o) => _fromStorageKey(o.key))
+        .where(_isUpdateJsonKey)
+        .toList();
+  }
+
+  @override
+  Future<T?> loadObject<T>(String key) async {
+    final fullKey = _toStorageKey(key);
+    try {
+      final body = await _client.getObjectAsString(fullKey);
+      return jsonDecode(body) as T?;
+    } on Exception catch (e) {
+      if (e.toString().contains('NoSuchKey')) return null;
+      if (e.toString().contains('InvalidObjectState') ||
+          e.toString().contains('Archived')) {
+        throw S3ArchivedObjectError(key: fullKey, cause: e);
+      }
+      rethrow;
+    }
+  }
+
+  @override
+  Future<void> uploadObject<T>(String key, T data) async {
+    await _client.putObject(
+      _toStorageKey(key),
+      utf8.encode(jsonEncode(data)),
+      'application/json',
+    );
+  }
+
+  @override
+  Future<void> deleteObject(String key) async {
+    await _client.deleteObject(_toStorageKey(key));
+  }
+
+  @override
+  bool shouldSkipLoadObjectError(Object error, String key) =>
+      error is S3ArchivedObjectError;
+
+  @override
+  void validateChannel(String channel) {
+    // hot-updater's s3Database leaves channel validation optional (no-op).
+  }
+
+  @override
+  Future<void> invalidatePaths(List<String> paths) async {
+    final distributionId = config.cloudfrontDistributionId;
+    if (_cloudfront == null || distributionId == null || paths.isEmpty) {
+      return;
+    }
+    await _cloudfront.createInvalidation(
+      distributionId,
+      paths,
+      shouldWait: config.shouldWaitForInvalidation,
+    );
+  }
+}
+
+/// AWS S3 blob database plugin (faithful port of hot-updater `s3Database.ts`).
+///
+/// Stores bundles as JSON (`update.json`) under
+/// `channel/platform/targetAppVersion/` paths and serves them via
+/// `createBlobDatabasePlugin`, invalidating CloudFront paths on writes.
+final s3Database = createBlobDatabasePlugin<S3DatabaseConfig>(
+  name: 's3Database',
+  blobFactory: (config) => S3BlobOperations(config),
+);

package/dart-src/plugins/aws/lib/src/aws_lambda_edge_storage.dart

@@ -0,0 +1,72 @@
+import 'package:flutter_patcher_plugin_core/flutter_patcher_plugin_core.dart'
+    show StoragePlugin, StoragePluginHooks;
+
+import 'aws_config.dart' show AwsS3StorageConfig;
+import 'aws_storage.dart' show s3Storage;
+import 'with_cloudfront_signed_url.dart'
+    show WithCloudFrontSignedUrlOptions, withCloudFrontSignedUrl;
+
+/// Configuration for the AWS Lambda@Edge S3 storage plugin.
+///
+/// Combines `S3StorageConfig` (credentials/bucket) with the CloudFront signed
+/// URL options. Faithful port of hot-updater `AwsLambdaEdgeStorageConfig`.
+class AwsLambdaEdgeStorageConfig extends AwsS3StorageConfig {
+  AwsLambdaEdgeStorageConfig({
+    required super.bucketName,
+    required super.region,
+    required super.accessKeyId,
+    required super.secretAccessKey,
+    super.basePath,
+    super.endpoint,
+    super.sessionToken,
+    super.clientFactory,
+    required this.keyPairId,
+    this.publicBaseUrl,
+    this.publicBaseUrlResolver,
+    this.getPrivateKey,
+    this.ssmParameterName,
+    this.ssmRegion,
+    this.expiresSeconds,
+  });
+
+  final String keyPairId;
+  final String? publicBaseUrl;
+  final Future<String> Function()? publicBaseUrlResolver;
+  final Future<String> Function()? getPrivateKey;
+  final String? ssmParameterName;
+  final String? ssmRegion;
+  final int? expiresSeconds;
+
+  WithCloudFrontSignedUrlOptions toSignedUrlOptions() =>
+      WithCloudFrontSignedUrlOptions(
+        keyPairId: keyPairId,
+        publicBaseUrl: publicBaseUrl,
+        publicBaseUrlResolver: publicBaseUrlResolver,
+        getPrivateKey: getPrivateKey,
+        ssmParameterName: ssmParameterName,
+        ssmRegion: ssmRegion,
+        expiresSeconds: expiresSeconds,
+        accessKeyId: accessKeyId,
+        secretAccessKey: secretAccessKey,
+        sessionToken: sessionToken,
+      );
+}
+
+/// AWS Lambda@Edge S3 storage plugin: S3 storage whose `s3://` download URLs
+/// are rewritten as CloudFront signed URLs. Faithful port of
+/// `s3LambdaEdgeStorage.ts` / `awsLambdaEdgeStorage.ts`.
+StoragePlugin s3LambdaEdgeStorage(
+  AwsLambdaEdgeStorageConfig config, [
+  StoragePluginHooks? hooks,
+]) =>
+    withCloudFrontSignedUrl(
+      () => s3Storage(config, hooks),
+      config.toSignedUrlOptions(),
+    )();
+
+/// Alias matching hot-updater's `awsLambdaEdgeStorage` export.
+StoragePlugin awsLambdaEdgeStorage(
+  AwsLambdaEdgeStorageConfig config, [
+  StoragePluginHooks? hooks,
+]) =>
+    s3LambdaEdgeStorage(config, hooks);