@awsless/cli 0.1.37 → 0.1.39

package/dist/bin.js

@@ -126318,6 +126318,11 @@ function useColor() {
 // ../../node_modules/.pnpm/commander@15.0.0/node_modules/commander/index.js
 var program = new Command;
 
+// src/util/remote-agent.ts
+var isRemoteAgent = () => {
+  return !!process.env.AWSLESS_REMOTE_AGENT && process.env.AWSLESS_REMOTE_AGENT !== "0";
+};
+
 // src/cli/command/auth/user/create.ts
 import {
   AdminAddUserToGroupCommand as AdminAddUserToGroupCommand2,
@@ -155252,7 +155257,20 @@ var isError = (error52, name) => {
   return error52 instanceof Error && error52.name === name;
 };
 var hasRuntimeAwsCredentials = () => !!(process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI || process.env.AWS_CONTAINER_CREDENTIALS_FULL_URI || process.env.AWS_ACCESS_KEY_ID || process.env.AWS_WEB_IDENTITY_TOKEN_FILE);
+var getRemoteAgentCredentials = async (profile) => {
+  process.env.AWS_EC2_METADATA_DISABLED ??= "true";
+  const provider = fromNodeProviderChain();
+  try {
+    await provider();
+  } catch (error52) {
+    throw new ExpectedError(`No AWS credentials found for the ${profile} profile while running as a remote agent. ` + `Set AWS_ACCESS_KEY_ID & AWS_SECRET_ACCESS_KEY in the environment.`, { cause: error52 });
+  }
+  return provider;
+};
 var getCredentials = async (profile) => {
+  if (isRemoteAgent()) {
+    return getRemoteAgentCredentials(profile);
+  }
   if (hasRuntimeAwsCredentials()) {
     return fromNodeProviderChain();
   }
@@ -166956,6 +166974,10 @@ var LuaRuntime = class LuaRuntime2 {
         return this.raiseError("ERR First argument must be a number (log level).");
       return 0;
     });
+    register("replicate_commands", (L3) => {
+      import_fengari.lua.lua_pushboolean(L3, 1);
+      return 1;
+    });
     register("setresp", (L3) => {
       if (import_fengari.lua.lua_tonumber(L3, 1) === 2)
         return 0;
@@ -168027,8 +168049,32 @@ var persist = async () => {
   await mkdir5(dirname6(file3), { recursive: true });
   await writeFile7(file3, JSON.stringify([...tracked.values()]));
 };
+var proxyEnvNames = [
+  "NODE_EXTRA_CA_CERTS",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR",
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "NO_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "no_proxy"
+];
+var proxyEnv = () => {
+  const env2 = {};
+  for (const name of proxyEnvNames) {
+    const value = process.env[name];
+    if (value) {
+      env2[name] = value;
+    }
+  }
+  return env2;
+};
 var spawnDevChild = (command, args, options2 = {}) => {
-  const child = spawn3(command, args, options2);
+  const child = spawn3(command, args, {
+    ...options2,
+    env: options2.env ? { ...proxyEnv(), ...options2.env } : options2.env
+  });
   if (child.pid) {
     tracked.set(child.pid, { pid: child.pid, command: [command, ...args].join(" ") });
     persist().catch(() => {});
@@ -199939,8 +199985,78 @@ var deployments = (program3) => {
 };
 
 // src/config/load/watch.ts
+import { basename as basename4, sep as sep4 } from "path";
+
+// src/dev/watch-tree.ts
 import { watch } from "fs";
-import { basename as basename4, sep as sep3 } from "path";
+import { readdir as readdir5, stat as stat6 } from "fs/promises";
+import { join as join45, relative as relative11, sep as sep3 } from "path";
+var watchTree = async (root4, ignored, listener, options2 = {}) => {
+  const native = options2.native ?? (process.platform === "darwin" || process.platform === "win32");
+  if (native) {
+    const watcher = watch(root4, { recursive: true }, (_event, filename) => {
+      if (filename) {
+        listener(filename);
+      }
+    });
+    return { close: () => watcher.close() };
+  }
+  const watchers = new Map;
+  let closed = false;
+  const add = async (dir) => {
+    if (closed || watchers.has(dir)) {
+      return;
+    }
+    let watcher;
+    try {
+      watcher = watch(dir, (event, filename) => {
+        if (!filename) {
+          return;
+        }
+        const path6 = join45(dir, filename);
+        const name = relative11(root4, path6);
+        if (name.split(sep3).some((segment) => ignored.has(segment))) {
+          return;
+        }
+        listener(name);
+        if (event === "rename" && !ignored.has(filename)) {
+          stat6(path6).then((info3) => info3.isDirectory() ? walk2(path6) : undefined).catch(() => {});
+        }
+      });
+    } catch (error53) {
+      debug(`Can't watch ${dir}`, error53);
+      return;
+    }
+    watcher.on("error", (error53) => debug(`Watcher error in ${dir}`, error53));
+    watchers.set(dir, watcher);
+  };
+  const walk2 = async (dir) => {
+    await add(dir);
+    let entries2;
+    try {
+      entries2 = await readdir5(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries2) {
+      if (entry.isDirectory() && !entry.isSymbolicLink() && !ignored.has(entry.name)) {
+        await walk2(join45(dir, entry.name));
+      }
+    }
+  };
+  await walk2(root4);
+  return {
+    close: () => {
+      closed = true;
+      for (const watcher of watchers.values()) {
+        watcher.close();
+      }
+      watchers.clear();
+    }
+  };
+};
+
+// src/config/load/watch.ts
 var ignoredDirectories = new Set(["node_modules", ".awsless", "dist", ".git"]);
 var isConfigFile = (path6) => {
   const base = basename4(path6);
@@ -199950,11 +200066,8 @@ var watchConfig = async (options2, resolve5, reject) => {
   await loadAppConfig(options2);
   debug("Start watching...");
   let reloadTimer;
-  const watcher = watch(directories.root, { recursive: true }, (_event, filename) => {
-    if (!filename) {
-      return;
-    }
-    if (filename.split(sep3).some((segment) => ignoredDirectories.has(segment))) {
+  const watcher = await watchTree(directories.root, ignoredDirectories, (filename) => {
+    if (filename.split(sep4).some((segment) => ignoredDirectories.has(segment))) {
       return;
     }
     if (!isConfigFile(filename)) {
@@ -199978,18 +200091,18 @@ var watchConfig = async (options2, resolve5, reject) => {
 // src/dev/index.ts
 import { watch as watch2 } from "fs";
 import { mkdir as mkdir12, rm as rm13, writeFile as writeFile16 } from "fs/promises";
-import { basename as basename5, dirname as dirname26, join as join51, sep as sep6 } from "path";
+import { basename as basename5, dirname as dirname26, join as join52, sep as sep7 } from "path";
 import { loadWorkspace as loadWorkspace3 } from "@awsless/ts-file-cache";
 
 // src/dev/context.ts
-import { join as join46 } from "path";
+import { join as join47 } from "path";
 import { DynamoDBServer } from "@awsless/dynamodb-server";
 
 // src/dev/servers/s3.ts
 import { createHash as createHash21 } from "crypto";
-import { mkdir as mkdir10, readdir as readdir5, readFile as readFile19, rm as rm11, stat as stat6, writeFile as writeFile13 } from "fs/promises";
+import { mkdir as mkdir10, readdir as readdir6, readFile as readFile19, rm as rm11, stat as stat7, writeFile as writeFile13 } from "fs/promises";
 import { createServer as createServer9 } from "http";
-import { dirname as dirname24, isAbsolute as isAbsolute6, join as join45, relative as relative11, sep as sep4 } from "path";
+import { dirname as dirname24, isAbsolute as isAbsolute6, join as join46, relative as relative12, sep as sep5 } from "path";
 var escapeXml = (value) => {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
 };
@@ -200054,10 +200167,10 @@ var createS3Server = (props) => {
       res.end(xmlError("InvalidRequest", "Missing bucket name"));
       return;
     }
-    const bucketDir = join45(props.root, bucket);
-    const file3 = join45(bucketDir, ...keyParts);
+    const bucketDir = join46(props.root, bucket);
+    const file3 = join46(bucketDir, ...keyParts);
     const escapes = (base, path6) => {
-      const rel = relative11(base, path6);
+      const rel = relative12(base, path6);
       return rel.startsWith("..") || isAbsolute6(rel);
     };
     if (escapes(props.root, bucketDir) || escapes(bucketDir, file3)) {
@@ -200071,20 +200184,20 @@ var createS3Server = (props) => {
       const walk2 = async (dir) => {
         let entries2;
         try {
-          entries2 = await readdir5(dir, { withFileTypes: true });
+          entries2 = await readdir6(dir, { withFileTypes: true });
         } catch {
           return;
         }
         for (const entry of entries2) {
-          const path6 = join45(dir, entry.name);
+          const path6 = join46(dir, entry.name);
           if (entry.isDirectory()) {
             await walk2(path6);
           } else {
-            const objectKey = relative11(bucketDir, path6).split(sep4).join("/");
+            const objectKey = relative12(bucketDir, path6).split(sep5).join("/");
             if (!objectKey.startsWith(prefix)) {
               continue;
             }
-            const info3 = await stat6(path6);
+            const info3 = await stat7(path6);
             contents.push(`<Contents><Key>${escapeXml(objectKey)}</Key><Size>${info3.size}</Size><LastModified>${info3.mtime.toISOString()}</LastModified><ETag>&quot;local&quot;</ETag></Contents>`);
           }
         }
@@ -200550,7 +200663,7 @@ var createDevContext = (props) => {
       const value = await props.pool.keep("store", null, async () => {
         const rules = [];
         const server = createS3Server({
-          root: join46(directories.output, "local", "store"),
+          root: join47(directories.output, "local", "store"),
           region: props.appConfig.region,
           rules
         });
@@ -200678,16 +200791,16 @@ var createDevContext = (props) => {
 // src/dev/dashboard/index.ts
 var import_ioredis4 = __toESM(require_built3(), 1);
 import { randomUUID as randomUUID8 } from "crypto";
-import { readdir as readdir6, readFile as readFile20, stat as stat7, writeFile as writeFile15 } from "fs/promises";
+import { readdir as readdir7, readFile as readFile20, stat as stat8, writeFile as writeFile15 } from "fs/promises";
 import { createServer as createServer11 } from "http";
-import { join as join48, relative as relative12, sep as sep5 } from "path";
+import { join as join49, relative as relative13, sep as sep6 } from "path";
 import { DynamoDBClient as DynamoDBClient6 } from "@aws-sdk/client-dynamodb";
 import { DynamoDBDocumentClient, ScanCommand as ScanCommand2 } from "@aws-sdk/lib-dynamodb";
 
 // src/dev/worker.ts
 import { writeFile as writeFile14 } from "fs/promises";
 import { availableParallelism as availableParallelism2 } from "os";
-import { join as join47 } from "path";
+import { join as join48 } from "path";
 class WorkerError extends Error {
   name;
   constructor(name, message3, stack) {
@@ -200907,7 +201020,7 @@ var createBundleWorker = (props) => {
     throw new Error("The bundle worker never became ready.");
   };
   const startWorker = async () => {
-    const entry = join47(props.buildDir, "worker.mjs");
+    const entry = join48(props.buildDir, "worker.mjs");
     const port = await findFreePort();
     const child = spawnDevChild("node", ["--enable-source-maps", entry], {
       cwd: props.buildDir,
@@ -200968,7 +201081,7 @@ var createBundleWorker = (props) => {
     return worker;
   };
   const doStart = async () => {
-    await writeFile14(join47(props.buildDir, "worker.mjs"), WORKER_ENTRY);
+    await writeFile14(join48(props.buildDir, "worker.mjs"), WORKER_ENTRY);
     const results = await Promise.allSettled(Array.from({ length: concurrency }, () => startWorker()));
     const started = results.filter((result) => result.status === "fulfilled").map((result) => result.value);
     const failed = results.find((result) => result.status === "rejected");
@@ -203416,18 +203529,18 @@ var createDashboardServer = (props) => {
       const walk2 = async (dir) => {
         let entries2;
         try {
-          entries2 = await readdir6(dir, { withFileTypes: true });
+          entries2 = await readdir7(dir, { withFileTypes: true });
         } catch {
           return;
         }
         for (const entry of entries2) {
-          const path6 = join48(dir, entry.name);
+          const path6 = join49(dir, entry.name);
           if (entry.isDirectory()) {
             await walk2(path6);
           } else {
-            const key = relative12(props.storeRoot, path6).split(sep5).slice(1).join("/");
+            const key = relative13(props.storeRoot, path6).split(sep6).slice(1).join("/");
             if (key.startsWith(prefix)) {
-              const info3 = await stat7(path6);
+              const info3 = await stat8(path6);
               files.push({ key, size: info3.size, modified: info3.mtime.toISOString() });
             }
           }
@@ -203636,17 +203749,17 @@ var createFailureReporter = (props) => {
 };
 
 // src/dev/sdk.ts
-import { readdir as readdir7, readFile as readFile21, mkdir as mkdir11, rm as rm12, stat as stat8, symlink } from "fs/promises";
+import { readdir as readdir8, readFile as readFile21, mkdir as mkdir11, rm as rm12, stat as stat9, symlink } from "fs/promises";
 import { createRequire } from "module";
-import { dirname as dirname25, join as join49 } from "path";
+import { dirname as dirname25, join as join50 } from "path";
 var linkSdkPackages = async (workspace, buildDir, onWarn) => {
-  const filesDir = join49(buildDir, "files");
+  const filesDir = join50(buildDir, "files");
   const packages = new Set;
-  for (const file3 of await readdir7(filesDir)) {
+  for (const file3 of await readdir8(filesDir)) {
     if (!file3.endsWith(".mjs")) {
       continue;
     }
-    const code = await readFile21(join49(filesDir, file3), "utf8");
+    const code = await readFile21(join50(filesDir, file3), "utf8");
     for (const match3 of code.matchAll(/(?:from\s*|import\()\s*["'](@aws-sdk\/[a-z0-9-]+|sharp)["']/g)) {
       packages.add(match3[1]);
     }
@@ -203654,7 +203767,7 @@ var linkSdkPackages = async (workspace, buildDir, onWarn) => {
   const ownRequire = createRequire(import.meta.url);
   const isProjectDep = async (name) => {
     try {
-      await stat8(join49(directories.root, "node_modules", name, "package.json"));
+      await stat9(join50(directories.root, "node_modules", name, "package.json"));
       return true;
     } catch {
       return false;
@@ -203663,19 +203776,19 @@ var linkSdkPackages = async (workspace, buildDir, onWarn) => {
   const resolveFromDependents = async (name) => {
     const roots = Object.values(workspace.packages).flatMap((pkg) => [
       pkg.path,
-      ...Object.entries(pkg.dependencies).map(([dependency, info3]) => info3.type === "workspace" ? workspace.packages[info3.link]?.path : join49(pkg.path, "node_modules", dependency))
+      ...Object.entries(pkg.dependencies).map(([dependency, info3]) => info3.type === "workspace" ? workspace.packages[info3.link]?.path : join50(pkg.path, "node_modules", dependency))
     ]);
     for (const root4 of roots.filter((root5) => typeof root5 === "string").toSorted()) {
-      const path6 = join49(root4, "node_modules", name);
+      const path6 = join50(root4, "node_modules", name);
       try {
-        await stat8(join49(path6, "package.json"));
+        await stat9(join50(path6, "package.json"));
         return path6;
       } catch {}
     }
     return;
   };
   for (const name of packages) {
-    const target2 = join49(buildDir, "node_modules", name);
+    const target2 = join50(buildDir, "node_modules", name);
     try {
       if (await isProjectDep(name)) {
         await rm12(target2, { recursive: true, force: true });
@@ -203694,7 +203807,7 @@ var linkSdkPackages = async (workspace, buildDir, onWarn) => {
       await mkdir11(dirname25(target2), { recursive: true });
       await rm12(target2, { recursive: true, force: true });
       await symlink(source, target2, "dir");
-      await stat8(join49(target2, "package.json"));
+      await stat9(join50(target2, "package.json"));
       debug(`Sdk link ${name}: ${source}`);
     } catch (error53) {
       onWarn?.(`Linking the "${name}" sdk package failed: ${error53 instanceof Error ? error53.message : String(error53)}`);
@@ -203704,9 +203817,9 @@ var linkSdkPackages = async (workspace, buildDir, onWarn) => {
 
 // src/dev/seed.ts
 import { spawn as spawn5 } from "child_process";
-import { isAbsolute as isAbsolute7, join as join50 } from "path";
+import { isAbsolute as isAbsolute7, join as join51 } from "path";
 var createSeedRunner = (props) => {
-  const file3 = props.seed && (isAbsolute7(props.seed) ? props.seed : join50(directories.root, props.seed));
+  const file3 = props.seed && (isAbsolute7(props.seed) ? props.seed : join51(directories.root, props.seed));
   let running;
   const run = () => {
     running ??= (async () => {
@@ -203882,7 +203995,7 @@ var startDev = async (props) => {
     dev: true
   });
   ready2();
-  await mkdir12(join51(directories.output, "local"), { recursive: true });
+  await mkdir12(join52(directories.output, "local"), { recursive: true });
   await writeFile16(watchdogPath(), WATCHDOG_SOURCE);
   const routerPorts = {};
   Object.keys(appConfig.router ?? {}).forEach((id, index) => {
@@ -203960,7 +204073,7 @@ var startDev = async (props) => {
     for (const [id, port] of Object.entries(routerPorts)) {
       env4[`ROUTER_${constantCase(id)}_ENDPOINT`] = `localhost:${port}`;
     }
-    await writeFile16(join51(directories.output, "local", "env.json"), JSON.stringify(env4, null, "\t") + `
+    await writeFile16(join52(directories.output, "local", "env.json"), JSON.stringify(env4, null, "\t") + `
 `);
     return { env: env4, lambda: lambda2 };
   });
@@ -204214,8 +204327,8 @@ var startDev = async (props) => {
     resources: dev.resources,
     routes: dev.routes,
     env: env3,
-    storeRoot: join51(directories.output, "local", "store"),
-    configFile: join51(directories.output, "local", "config.json"),
+    storeRoot: join52(directories.output, "local", "store"),
+    configFile: join52(directories.output, "local", "config.json"),
     getEmails: () => props.pool.peek("shim:ses-email")?.server.list() ?? [],
     getAlerts: () => props.pool.peek("shim:sns")?.alerts ?? [],
     getSession: () => ({ startedAt, workers: worker.size() }),
@@ -204231,11 +204344,8 @@ var startDev = async (props) => {
   await dashboard.listen(dashboardPort);
   const ignoredDirectories2 = new Set(["node_modules", ".awsless", "dist", ".git"]);
   let rebuildTimer;
-  const watcher = watch2(directories.root, { recursive: true }, (_event, filename) => {
-    if (!filename) {
-      return;
-    }
-    if (filename.split(sep6).some((segment) => ignoredDirectories2.has(segment))) {
+  const watcher = await watchTree(directories.root, ignoredDirectories2, (filename) => {
+    if (filename.split(sep7).some((segment) => ignoredDirectories2.has(segment))) {
       return;
     }
     const base = basename5(filename);
@@ -204278,7 +204388,7 @@ var startDev = async (props) => {
     routerPorts,
     async stop() {
       stopping = true;
-      await rm13(join51(directories.output, "local", "env.json"), { force: true });
+      await rm13(join52(directories.output, "local", "env.json"), { force: true });
       clearTimeout(rebuildTimer);
       watcher.close();
       for (const restartWatcher of restartWatchers) {
@@ -204346,7 +204456,7 @@ var createServerPool = () => {
 
 // src/type-gen/generate.ts
 import { mkdir as mkdir13, writeFile as writeFile17 } from "fs/promises";
-import { dirname as dirname27, join as join52, relative as relative13 } from "path";
+import { dirname as dirname27, join as join53, relative as relative14 } from "path";
 var generateTypes = async (props) => {
   const files = [];
   await Promise.all(features.map(async (feature) => {
@@ -204354,10 +204464,10 @@ var generateTypes = async (props) => {
       ...props,
       async write(file3, data, include = false) {
         const code = data?.toString("utf8");
-        const path6 = join52(directories.types, file3);
+        const path6 = join53(directories.types, file3);
         if (code) {
           if (include) {
-            files.push(relative13(directories.root, path6));
+            files.push(relative14(directories.root, path6));
           }
           await mkdir13(dirname27(path6), { recursive: true });
           await writeFile17(path6, code);
@@ -204368,7 +204478,7 @@ var generateTypes = async (props) => {
   if (files.length) {
     const code = files.map((file3) => `/// <reference path='${file3}' />`).join(`
 `);
-    await writeFile17(join52(directories.root, `awsless.d.ts`), code);
+    await writeFile17(join53(directories.root, `awsless.d.ts`), code);
   }
 };
 
@@ -205177,6 +205287,255 @@ var prune = (program3) => {
   });
 };
 
+// src/cli/command/remote-agent/credentials/shared.ts
+import { IAMClient as IAMClient2 } from "@aws-sdk/client-iam";
+
+// src/util/remote-agent-iam.ts
+import {
+  CreateAccessKeyCommand,
+  CreateUserCommand,
+  DeleteAccessKeyCommand,
+  DeleteUserCommand,
+  DeleteUserPolicyCommand,
+  GetUserCommand,
+  GetUserPolicyCommand,
+  ListAccessKeysCommand,
+  PutUserPolicyCommand
+} from "@aws-sdk/client-iam";
+var remoteAgentUserName = (appName) => `awsless-remote-agent-${appName}`;
+var remoteAgentPolicyName = "awsless-remote-agent";
+var buildRemoteAgentPolicy = ({ appName, region, accountId, auth: auth2 }) => {
+  return {
+    Version: "2012-10-17",
+    Statement: [
+      {
+        Sid: "ReadConfig",
+        Effect: "Allow",
+        Action: ["ssm:GetParametersByPath", "ssm:GetParameter", "ssm:GetParameters"],
+        Resource: `arn:aws:ssm:${region}:${accountId}:parameter${configParameterPrefix(appName)}/*`
+      },
+      {
+        Sid: "DecryptConfig",
+        Effect: "Allow",
+        Action: "kms:Decrypt",
+        Resource: `arn:aws:kms:${region}:${accountId}:key/*`,
+        Condition: { StringEquals: { "kms:ViaService": `ssm.${region}.amazonaws.com` } }
+      },
+      ...auth2 ? [
+        {
+          Sid: "ResolveAuthPools",
+          Effect: "Allow",
+          Action: ["cognito-idp:ListUserPools", "cognito-idp:ListUserPoolClients"],
+          Resource: "*"
+        }
+      ] : []
+    ]
+  };
+};
+
+class RemoteAgentIam {
+  client;
+  appName;
+  constructor(client2, appName) {
+    this.client = client2;
+    this.appName = appName;
+  }
+  get userName() {
+    return remoteAgentUserName(this.appName);
+  }
+  async ensureUser() {
+    try {
+      await this.client.send(new GetUserCommand({ UserName: this.userName }));
+      return "existing";
+    } catch (error53) {
+      if (!isError(error53, "NoSuchEntityException")) {
+        throw error53;
+      }
+    }
+    await this.client.send(new CreateUserCommand({
+      UserName: this.userName,
+      Tags: [
+        { Key: "awsless:app", Value: this.appName },
+        { Key: "awsless:purpose", Value: "remote-agent" }
+      ]
+    }));
+    return "created";
+  }
+  async ensurePolicy(policy) {
+    const document2 = JSON.stringify(policy);
+    let current;
+    try {
+      const result = await this.client.send(new GetUserPolicyCommand({ UserName: this.userName, PolicyName: remoteAgentPolicyName }));
+      current = result.PolicyDocument ? JSON.stringify(JSON.parse(decodeURIComponent(result.PolicyDocument))) : undefined;
+    } catch (error53) {
+      if (!isError(error53, "NoSuchEntityException")) {
+        throw error53;
+      }
+    }
+    if (current === document2) {
+      return "unchanged";
+    }
+    await this.client.send(new PutUserPolicyCommand({
+      UserName: this.userName,
+      PolicyName: remoteAgentPolicyName,
+      PolicyDocument: document2
+    }));
+    return current === undefined ? "created" : "updated";
+  }
+  async listKeys() {
+    try {
+      const result = await this.client.send(new ListAccessKeysCommand({ UserName: this.userName }));
+      return (result.AccessKeyMetadata ?? []).filter((key) => key.AccessKeyId).map((key) => ({ id: key.AccessKeyId, createdAt: key.CreateDate }));
+    } catch (error53) {
+      if (isError(error53, "NoSuchEntityException")) {
+        return [];
+      }
+      throw error53;
+    }
+  }
+  async createKey() {
+    const result = await this.client.send(new CreateAccessKeyCommand({ UserName: this.userName }));
+    const key = result.AccessKey;
+    if (!key?.AccessKeyId || !key.SecretAccessKey) {
+      throw new Error("IAM returned an access key without an id or secret.");
+    }
+    return { id: key.AccessKeyId, secret: key.SecretAccessKey };
+  }
+  async deleteKey(id) {
+    await this.client.send(new DeleteAccessKeyCommand({ UserName: this.userName, AccessKeyId: id }));
+  }
+  async deleteUser() {
+    try {
+      await this.client.send(new GetUserCommand({ UserName: this.userName }));
+    } catch (error53) {
+      if (isError(error53, "NoSuchEntityException")) {
+        return false;
+      }
+      throw error53;
+    }
+    for (const key of await this.listKeys()) {
+      await this.deleteKey(key.id);
+    }
+    try {
+      await this.client.send(new DeleteUserPolicyCommand({ UserName: this.userName, PolicyName: remoteAgentPolicyName }));
+    } catch (error53) {
+      if (!isError(error53, "NoSuchEntityException")) {
+        throw error53;
+      }
+    }
+    await this.client.send(new DeleteUserCommand({ UserName: this.userName }));
+    return true;
+  }
+}
+
+// src/cli/command/remote-agent/credentials/shared.ts
+var createRemoteAgentIam = async (appConfig) => {
+  const credentials2 = await getCredentials(appConfig.profile);
+  const accountId = await getAccountId(credentials2, appConfig.region);
+  const client2 = new IAMClient2({ region: appConfig.region, credentials: credentials2 });
+  const iam = new RemoteAgentIam(client2, appConfig.name);
+  const policy = buildRemoteAgentPolicy({
+    appName: appConfig.name,
+    region: appConfig.region,
+    accountId,
+    auth: Object.keys(appConfig.auth ?? {}).length > 0
+  });
+  return { iam, policy };
+};
+var ensureRemoteAgentUser = async (iam, policy) => {
+  const user2 = await logs_exports.task({
+    initialMessage: `Ensuring the ${iam.userName} IAM user...`,
+    successMessage: `The ${iam.userName} IAM user is in place.`,
+    errorMessage: `Failed to ensure the ${iam.userName} IAM user.`,
+    task: () => iam.ensureUser()
+  });
+  const state = await logs_exports.task({
+    initialMessage: "Ensuring the remote agent policy...",
+    successMessage: "The remote agent policy is in place.",
+    errorMessage: "Failed to ensure the remote agent policy.",
+    task: () => iam.ensurePolicy(policy)
+  });
+  return { user: user2, policy: state };
+};
+var printCredentials = (appConfig, key) => {
+  logs_exports.list("Remote agent environment", {
+    AWSLESS_REMOTE_AGENT: "1",
+    AWS_REGION: appConfig.region,
+    AWS_ACCESS_KEY_ID: key.id,
+    AWS_SECRET_ACCESS_KEY: key.secret
+  });
+  logs_exports.warning(`The secret access key is shown only once. Copy these variables into the agent environment now - ` + `run ${color2.info("awsless remote-agent credentials rotate")} to get a new one later.`);
+};
+
+// src/cli/command/remote-agent/credentials/create.ts
+var create2 = (program3) => {
+  program3.command("create").description("Create the IAM user & access key a remote agent needs to run the dev & test commands").action(async () => {
+    await layout("remote-agent credentials create", async ({ appConfig }) => {
+      const { iam, policy } = await createRemoteAgentIam(appConfig);
+      await ensureRemoteAgentUser(iam, policy);
+      const keys = await iam.listKeys();
+      if (keys.length > 0) {
+        const key2 = keys[0];
+        const created = key2.createdAt ? ` created ${key2.createdAt.toISOString()}` : "";
+        throw new ExpectedError(`The ${iam.userName} user already has an access key (${key2.id}${created}). ` + `Its secret can't be shown again - run ${color2.info("awsless remote-agent credentials rotate")} to replace it.`);
+      }
+      const key = await iam.createKey();
+      printCredentials(appConfig, key);
+    });
+  });
+};
+
+// src/cli/command/remote-agent/credentials/delete.ts
+var del5 = (program3) => {
+  program3.command("delete").description("Delete the remote agent IAM user, its policy & access keys").action(async () => {
+    await layout("remote-agent credentials delete", async ({ appConfig }) => {
+      const { iam } = await createRemoteAgentIam(appConfig);
+      const deleted = await logs_exports.task({
+        initialMessage: `Deleting the ${iam.userName} IAM user...`,
+        successMessage: `Deleted the ${iam.userName} IAM user.`,
+        errorMessage: `Failed to delete the ${iam.userName} IAM user.`,
+        task: () => iam.deleteUser()
+      });
+      if (!deleted) {
+        logs_exports.info(`The ${iam.userName} IAM user doesn't exist - nothing to delete.`);
+      }
+    });
+  });
+};
+
+// src/cli/command/remote-agent/credentials/rotate.ts
+var rotate = (program3) => {
+  program3.command("rotate").description("Replace the access key of the remote agent IAM user").action(async () => {
+    await layout("remote-agent credentials rotate", async ({ appConfig }) => {
+      const { iam, policy } = await createRemoteAgentIam(appConfig);
+      await ensureRemoteAgentUser(iam, policy);
+      const old = await iam.listKeys();
+      const key = await iam.createKey();
+      for (const entry of old) {
+        await iam.deleteKey(entry.id);
+      }
+      if (old.length > 0) {
+        logs_exports.info(`Deleted ${old.length} previous access key${old.length === 1 ? "" : "s"}.`);
+      }
+      printCredentials(appConfig, key);
+    });
+  });
+};
+
+// src/cli/command/remote-agent/credentials/index.ts
+var commands10 = [create2, rotate, del5];
+var credentials2 = (program3) => {
+  const command3 = program3.command("credentials").description("Manage the AWS credentials a remote agent uses for the dev & test commands");
+  commands10.forEach((cb) => cb(command3));
+};
+
+// src/cli/command/remote-agent/index.ts
+var commands11 = [credentials2];
+var remoteAgent = (program3) => {
+  const command3 = program3.command("remote-agent").description("Manage the setup for remote agents, like the Claude cloud sandbox");
+  commands11.forEach((cb) => cb(command3));
+};
+
 // src/cli/command/resources.ts
 var import_wildstring4 = __toESM(require_wildstring(), 1);
 import { DynamoDBClient as DynamoDBClient7 } from "@awsless/dynamodb";
@@ -205185,14 +205544,14 @@ var resources = (program3) => {
     await layout("resources", async ({ appConfig, stackConfigs }) => {
       const region = appConfig.region;
       const profile = appConfig.profile;
-      const credentials2 = await getCredentials(profile);
-      const accountId = await getAccountId(credentials2, region);
-      const dynamo = new DynamoDBClient7({ credentials: credentials2, region });
+      const credentials3 = await getCredentials(profile);
+      const accountId = await getAccountId(credentials3, region);
+      const dynamo = new DynamoDBClient7({ credentials: credentials3, region });
       const deployment = await currentDeployment(dynamo, generateGlobalAppId({ accountId, region, appName: appConfig.name }));
       const { app, ready: ready2 } = createApp({ appConfig, stackConfigs, accountId, deploymentId: deployment?.id });
       ready2();
       const { workspace } = await createWorkSpace({
-        credentials: credentials2,
+        credentials: credentials3,
         accountId,
         region
       });
@@ -206349,8 +206708,8 @@ var getHttpAuthExtensionConfiguration3 = (runtimeConfig) => {
     httpAuthSchemeProvider() {
       return _httpAuthSchemeProvider;
     },
-    setCredentials(credentials2) {
-      _credentials = credentials2;
+    setCredentials(credentials3) {
+      _credentials = credentials3;
     },
     credentials() {
       return _credentials;
@@ -206515,7 +206874,7 @@ var sinon;
   const arraySlice = arrayProto.slice;
   const concat = arrayProto.concat;
   const forEach = arrayProto.forEach;
-  const join53 = arrayProto.join;
+  const join54 = arrayProto.join;
   const splice = arrayProto.splice;
   function applyDefaults(obj, defaults2) {
     for (const key of Object.keys(defaults2)) {
@@ -206551,7 +206910,7 @@ var sinon;
         let actual = "";
         if (!calledInOrder(arguments)) {
           try {
-            expected = join53(arguments, ", ");
+            expected = join54(arguments, ", ");
             const calls = arraySlice(arguments);
             let i5 = calls.length;
             while (i5) {
@@ -206559,7 +206918,7 @@ var sinon;
                 splice(calls, i5, 1);
               }
             }
-            actual = join53(orderByFirstCall(calls), ", ");
+            actual = join54(orderByFirstCall(calls), ", ");
           } catch (e5) {}
           failAssertion(this, `expected ${expected} to be called in order but were called as ${actual}`);
         } else {
@@ -206604,7 +206963,7 @@ var sinon;
             `    expected = ${inspect2(expectation)}`,
             `    actual = ${inspect2(actual)}`
           ];
-          failAssertion(this, join53(formatted, `
+          failAssertion(this, join54(formatted, `
 `));
         }
       }
@@ -206709,7 +207068,7 @@ var sinon;
   const valueToString = require2("@sinonjs/commons").valueToString;
   const exportAsyncBehaviors = require2("./util/core/export-async-behaviors");
   const concat = arrayProto.concat;
-  const join53 = arrayProto.join;
+  const join54 = arrayProto.join;
   const reverse = arrayProto.reverse;
   const slice = arrayProto.slice;
   const useLeftMostCallback = -1;
@@ -206746,7 +207105,7 @@ var sinon;
         msg = `${functionName(behavior.stub)} expected to yield, but no callback was passed.`;
       }
       if (args.length > 0) {
-        msg += ` Received [${join53(args, ", ")}]`;
+        msg += ` Received [${join54(args, ", ")}]`;
       }
       return msg;
     }
@@ -206777,7 +207136,7 @@ var sinon;
     return;
   }
   const proto2 = {
-    create: function create2(stub) {
+    create: function create3(stub) {
       const behavior = extend2({}, proto2);
       delete behavior.create;
       delete behavior.addBehavior;
@@ -207386,7 +207745,7 @@ var sinon;
   const mockExpectation = {
     minCalls: 1,
     maxCalls: 1,
-    create: function create2(methodName) {
+    create: function create3(methodName) {
       const expectation = extend2.nonEnum(stub(), mockExpectation);
       delete expectation.create;
       expectation.method = methodName;
@@ -207556,7 +207915,7 @@ var sinon;
   const filter2 = arrayProto.filter;
   const forEach = arrayProto.forEach;
   const every = arrayProto.every;
-  const join53 = arrayProto.join;
+  const join54 = arrayProto.join;
   const push2 = arrayProto.push;
   const slice = arrayProto.slice;
   const unshift = arrayProto.unshift;
@@ -207579,7 +207938,7 @@ var sinon;
     });
   }
   extend2(mock, {
-    create: function create2(object3) {
+    create: function create3(object3) {
       if (!object3) {
         throw new TypeError("object is null");
       }
@@ -207633,10 +207992,10 @@ var sinon;
       });
       this.restore();
       if (messages.length > 0) {
-        mockExpectation.fail(join53(concat(messages, met), `
+        mockExpectation.fail(join54(concat(messages, met), `
 `));
       } else if (met.length > 0) {
-        mockExpectation.pass(join53(concat(messages, met), `
+        mockExpectation.pass(join54(concat(messages, met), `
 `));
       }
       return true;
@@ -207689,7 +208048,7 @@ var sinon;
         args,
         stack: err.stack
       })}`);
-      mockExpectation.fail(join53(messages, `
+      mockExpectation.fail(join54(messages, `
 `));
     }
   });
@@ -207796,14 +208155,14 @@ var sinon;
   const valueToString = require2("@sinonjs/commons").valueToString;
   const concat = arrayProto.concat;
   const filter2 = arrayProto.filter;
-  const join53 = arrayProto.join;
+  const join54 = arrayProto.join;
   const map3 = arrayProto.map;
   const reduce2 = arrayProto.reduce;
   const slice = arrayProto.slice;
   function throwYieldError(proxy, text2, args) {
     let msg = functionName(proxy) + text2;
     if (args.length) {
-      msg += ` Received [${join53(slice(args), ", ")}]`;
+      msg += ` Received [${join54(slice(args), ", ")}]`;
     }
     throw new Error(msg);
   }
@@ -207925,7 +208284,7 @@ var sinon;
       const formattedArgs = map3(this.args, function(arg) {
         return inspect2(arg);
       });
-      callStr = `${callStr + join53(formattedArgs, ", ")})`;
+      callStr = `${callStr + join54(formattedArgs, ", ")})`;
       if (typeof this.returnValue !== "undefined") {
         callStr += ` => ${inspect2(this.returnValue)}`;
       }
@@ -208656,7 +209015,7 @@ var sinon;
   const timesInWords = require2("./util/core/times-in-words");
   const inspect2 = require2("util").inspect;
   const jsDiff = require2("diff");
-  const join53 = arrayProto.join;
+  const join54 = arrayProto.join;
   const map3 = arrayProto.map;
   const push2 = arrayProto.push;
   const slice = arrayProto.slice;
@@ -208684,7 +209043,7 @@ var sinon;
       }
       return text2;
     });
-    return join53(objects, "");
+    return join54(objects, "");
   }
   function quoteStringValue(value) {
     if (typeof value === "string") {
@@ -208742,7 +209101,7 @@ ${stringifiedCall}`;
         push2(calls, stringifiedCall);
       }
       return calls.length > 0 ? `
-${join53(calls, `
+${join54(calls, `
 `)}` : "";
     },
     t: function(spyInstance) {
@@ -208750,10 +209109,10 @@ ${join53(calls, `
       for (let i5 = 0, l4 = spyInstance.callCount;i5 < l4; ++i5) {
         push2(objects, inspect2(spyInstance.thisValues[i5]));
       }
-      return join53(objects, ", ");
+      return join54(objects, ", ");
     },
     "*": function(spyInstance, args) {
-      return join53(map3(args, function(arg) {
+      return join54(map3(args, function(arg) {
         return inspect2(arg);
       }), ", ");
     }
@@ -209085,7 +209444,7 @@ ${join53(calls, `
 }, { "@sinonjs/commons": 48 }], 26: [function(require2, module, exports) {
   const arrayProto = require2("@sinonjs/commons").prototypes.array;
   const hasOwnProperty2 = require2("@sinonjs/commons").prototypes.object.hasOwnProperty;
-  const join53 = arrayProto.join;
+  const join54 = arrayProto.join;
   const push2 = arrayProto.push;
   const hasDontEnumBug = function() {
     const obj = {
@@ -209126,7 +209485,7 @@ ${join53(calls, `
         push2(result, obj[prop]());
       }
     }
-    return join53(result, "") !== "0123456789";
+    return join54(result, "") !== "0123456789";
   }();
   function extendCommon(target2, sources, doCopy) {
     let source, i5, prop;
@@ -211191,7 +211550,7 @@ ${job.error.stack.split(`
   module.exports = matcherPrototype;
 }, { "../create-matcher": 63 }], 71: [function(require2, module, exports) {
   var functionName = require2("@sinonjs/commons").functionName;
-  var join53 = require2("@sinonjs/commons").prototypes.array.join;
+  var join54 = require2("@sinonjs/commons").prototypes.array.join;
   var map3 = require2("@sinonjs/commons").prototypes.array.map;
   var stringIndexOf = require2("@sinonjs/commons").prototypes.string.indexOf;
   var valueToString = require2("@sinonjs/commons").valueToString;
@@ -211222,7 +211581,7 @@ ${job.error.stack.split(`
         m4.test = function(actual) {
           return matchObject(actual, expectation, match3);
         };
-        m4.message = `match(${join53(array3, ", ")})`;
+        m4.message = `match(${join54(array3, ", ")})`;
         return m4;
       },
       regexp: function(m4, expectation) {
@@ -214546,7 +214905,7 @@ ${job.error.stack.split(`
       tokenize: function tokenize(value) {
         return value.split("");
       },
-      join: function join53(chars) {
+      join: function join54(chars) {
         return chars.join("");
       }
     };
@@ -218786,21 +219145,21 @@ var run = (program3) => {
   program3.command("run").allowUnknownOption(true).argument("[command]", "The command you want to run").description("Run one of your defined commands.").action(async (selected) => {
     await layout(`run ${selected ?? ""}`, async ({ appConfig, stackConfigs }) => {
       const region = appConfig.region;
-      const credentials2 = await getCredentials(appConfig.profile);
-      const accountId = await getAccountId(credentials2, region);
-      const { commands: commands10, appId } = createApp({ appConfig, stackConfigs, accountId });
+      const credentials3 = await getCredentials(appConfig.profile);
+      const accountId = await getAccountId(credentials3, region);
+      const { commands: commands12, appId } = createApp({ appConfig, stackConfigs, accountId });
       let command3;
       if (selected) {
-        command3 = commands10.find((cmd) => {
+        command3 = commands12.find((cmd) => {
           return cmd.name === selected;
         });
       } else if (process.env.SKIP_PROMPT) {
-        throw new ExpectedError(`Pass the command argument when running with --skip-prompt: [ ${commands10.map((cmd) => cmd.name).join(", ")} ]`);
+        throw new ExpectedError(`Pass the command argument when running with --skip-prompt: [ ${commands12.map((cmd) => cmd.name).join(", ")} ]`);
       } else {
         command3 = await prompts_exports.select({
           message: "Pick the command you want to run:",
-          initialValue: commands10[0],
-          options: commands10.map((cmd) => ({
+          initialValue: commands12[0],
+          options: commands12.map((cmd) => ({
             value: cmd,
             label: cmd.name,
             hint: cmd.description
@@ -218824,15 +219183,15 @@ var run = (program3) => {
       if (!handler) {
         throw new ExpectedError(`No "${command3.handler}" handler found.`);
       }
-      dynamoDBClient.set(new DynamoDBClient8({ region, credentials: credentials2 }));
-      lambdaClient.set(new LambdaClient7({ region, credentials: credentials2 }));
-      snsClient.set(new SNSClient2({ region, credentials: credentials2 }));
-      iotClient.set(new IoTDataPlaneClient({ region, credentials: credentials2 }));
-      sqsClient.set(new SQSClient({ region, credentials: credentials2 }));
-      s3Client.set(new S3Client8({ region, credentials: credentials2 }));
+      dynamoDBClient.set(new DynamoDBClient8({ region, credentials: credentials3 }));
+      lambdaClient.set(new LambdaClient7({ region, credentials: credentials3 }));
+      snsClient.set(new SNSClient2({ region, credentials: credentials3 }));
+      iotClient.set(new IoTDataPlaneClient({ region, credentials: credentials3 }));
+      sqsClient.set(new SQSClient({ region, credentials: credentials3 }));
+      s3Client.set(new S3Client8({ region, credentials: credentials3 }));
       await handler({
         region,
-        credentials: credentials2,
+        credentials: credentials3,
         accountId
       });
     });
@@ -218845,10 +219204,10 @@ var pull = (program3) => {
     await layout("state pull", async ({ appConfig, stackConfigs }) => {
       const region = appConfig.region;
       const profile = appConfig.profile;
-      const credentials2 = await getCredentials(profile);
-      const accountId = await getAccountId(credentials2, region);
+      const credentials3 = await getCredentials(profile);
+      const accountId = await getAccountId(credentials3, region);
       const { app } = createApp({ appConfig, stackConfigs, accountId });
-      const { state } = await createWorkSpace({ credentials: credentials2, region, accountId });
+      const { state } = await createWorkSpace({ credentials: credentials3, region, accountId });
       await pullRemoteState(app, state);
       return "State pull was successful.";
     });
@@ -218861,10 +219220,10 @@ var push2 = (program3) => {
     await layout("state pull", async ({ appConfig, stackConfigs }) => {
       const region = appConfig.region;
       const profile = appConfig.profile;
-      const credentials2 = await getCredentials(profile);
-      const accountId = await getAccountId(credentials2, region);
+      const credentials3 = await getCredentials(profile);
+      const accountId = await getAccountId(credentials3, region);
       const { app } = createApp({ appConfig, stackConfigs, accountId });
-      const { state } = await createWorkSpace({ credentials: credentials2, region, accountId });
+      const { state } = await createWorkSpace({ credentials: credentials3, region, accountId });
       if (!process.env.SKIP_PROMPT) {
         const ok2 = await prompts_exports.confirm({
           message: "Pushing up the local state might corrupt your remote state. Are you sure?",
@@ -220836,10 +221195,10 @@ var refresh2 = (program3) => {
     await layout("state refresh", async ({ appConfig, stackConfigs }) => {
       const region = appConfig.region;
       const profile = appConfig.profile;
-      const credentials2 = await getCredentials(profile);
-      const accountId = await getAccountId(credentials2, region);
+      const credentials3 = await getCredentials(profile);
+      const accountId = await getAccountId(credentials3, region);
       const { app } = createApp({ appConfig, stackConfigs, accountId });
-      const { workspace } = await createWorkSpace({ credentials: credentials2, region, accountId });
+      const { workspace } = await createWorkSpace({ credentials: credentials3, region, accountId });
       const stackNames = app.stacks.filter((stack) => {
         return !!filters.find((f4) => import_wildstring5.default.match(f4, stack.name));
       }).map((s2) => s2.name);
@@ -220930,10 +221289,10 @@ var unlock2 = (program3) => {
     await layout("state unlock", async ({ appConfig, stackConfigs }) => {
       const region = appConfig.region;
       const profile = appConfig.profile;
-      const credentials2 = await getCredentials(profile);
-      const accountId = await getAccountId(credentials2, region);
+      const credentials3 = await getCredentials(profile);
+      const accountId = await getAccountId(credentials3, region);
       const { app } = createApp({ appConfig, stackConfigs, accountId });
-      const { lock: lock2 } = createDeploymentBackends({ credentials: credentials2, region, accountId });
+      const { lock: lock2 } = createDeploymentBackends({ credentials: credentials3, region, accountId });
       const releaseUrn = getAppReleaseLockUrn(generateGlobalAppId({ accountId, region, appName: appConfig.name }));
       const lockedUrns = [];
       for (const urn of [app.urn, releaseUrn]) {
@@ -220962,10 +221321,10 @@ var unlock2 = (program3) => {
 };
 
 // src/cli/command/state/index.ts
-var commands10 = [pull, push2, unlock2, refresh2];
+var commands12 = [pull, push2, unlock2, refresh2];
 var state = (program3) => {
   const command3 = program3.command("state").description(`Manage app state`);
-  commands10.forEach((cb) => cb(command3));
+  commands12.forEach((cb) => cb(command3));
 };
 
 // src/cli/command/test.ts
@@ -221010,7 +221369,7 @@ var types2 = (program3) => {
 };
 
 // src/cli/command/index.ts
-var commands11 = [
+var commands13 = [
   bootstrap,
   types2,
   build2,
@@ -221028,6 +221387,7 @@ var commands11 = [
   state,
   resources,
   config3,
+  remoteAgent,
   test2,
   cron,
   image,
@@ -221047,10 +221407,13 @@ program2.exitOverride((error53) => {
 program2.on("option:skip-prompt", () => {
   process.env.SKIP_PROMPT = program2.opts().skipPrompt ? "1" : undefined;
 });
+if (isRemoteAgent()) {
+  process.env.SKIP_PROMPT = "1";
+}
 program2.on("option:no-cache", () => {
   process.env.NO_CACHE = program2.opts().cache === false ? "1" : undefined;
 });
-commands11.forEach((fn) => fn(program2));
+commands13.forEach((fn) => fn(program2));
 
 // src/bin.ts
 clearDebugLog();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awsless/cli",
-  "version": "0.1.37",
+  "version": "0.1.39",
   "bugs": {
     "url": "https://github.com/awsless/awsless/issues"
   },
@@ -29,6 +29,7 @@
     "@aws-sdk/client-cloudwatch-logs": "3.1113.0",
     "@aws-sdk/client-cognito-identity-provider": "3.1113.0",
     "@aws-sdk/client-dynamodb": "3.1113.0",
+    "@aws-sdk/client-iam": "3.1113.0",
     "@aws-sdk/client-lambda": "3.1113.0",
     "@aws-sdk/client-route-53": "3.1113.0",
     "@aws-sdk/client-s3": "3.1113.0",
@@ -82,32 +83,33 @@
     "wrap-ansi": "10.0.1",
     "zod": "4.4.3",
     "@awsless/big-float": "^0.1.8",
-    "@awsless/cloudwatch": "^0.0.2",
+    "@awsless/clui": "^0.0.10",
     "@awsless/duration": "^0.0.4",
     "@awsless/dynamodb": "^0.3.28",
-    "@awsless/clui": "^0.0.10",
+    "@awsless/cloudwatch": "^0.0.2",
     "@awsless/dynamodb-server": "^0.1.11",
-    "@awsless/json": "^0.0.12",
+    "@awsless/lambda": "^0.0.50",
     "@awsless/open-search": "^0.0.32",
-    "@awsless/open-search-server": "^0.0.1",
     "@awsless/iot": "^0.0.6",
-    "@awsless/lambda": "^0.0.50",
-    "@awsless/redis-server": "^0.1.0",
-    "@awsless/redis": "^0.1.15",
+    "@awsless/json": "^0.0.12",
+    "@awsless/open-search-server": "^0.0.1",
+    "@awsless/redis-server": "^0.1.1",
+    "@awsless/redis": "^0.1.16",
     "@awsless/s3": "^0.0.23",
-    "@awsless/ts-file-cache": "^0.0.22",
-    "@awsless/size": "^0.0.3",
-    "awsless": "^0.1.11",
-    "@awsless/sns": "^0.0.12",
     "@awsless/sqs": "^0.0.25",
+    "@awsless/sns": "^0.0.12",
     "@awsless/validate": "^0.2.1",
-    "@awsless/weak-cache": "^0.0.2"
+    "@awsless/size": "^0.0.3",
+    "awsless": "^0.1.11",
+    "@awsless/weak-cache": "^0.0.2",
+    "@awsless/ts-file-cache": "^0.0.22"
   },
   "peerDependencies": {
     "@aws-sdk/client-cloudfront-keyvaluestore": "3.1113.0",
     "@aws-sdk/client-cloudwatch-logs": "3.1113.0",
     "@aws-sdk/client-cognito-identity-provider": "3.1113.0",
     "@aws-sdk/client-dynamodb": "3.1113.0",
+    "@aws-sdk/client-iam": "3.1113.0",
     "@aws-sdk/client-lambda": "3.1113.0",
     "@aws-sdk/client-route-53": "3.1113.0",
     "@aws-sdk/client-s3": "3.1113.0",
@@ -119,16 +121,16 @@
     "@aws-sdk/lib-dynamodb": "3.1113.0",
     "@opensearch-project/opensearch": "3.6.0",
     "@awsless/duration": "^0.0.4",
+    "@awsless/dynamodb-server": "^0.1.11",
     "@awsless/dynamodb": "^0.3.28",
-    "@awsless/big-float": "^0.1.8",
-    "@awsless/lambda": "^0.0.50",
     "@awsless/json": "^0.0.12",
+    "@awsless/lambda": "^0.0.50",
     "@awsless/validate": "^0.2.1",
-    "@awsless/ts-file-cache": "^0.0.22",
-    "@awsless/dynamodb-server": "^0.1.11",
     "@awsless/weak-cache": "^0.0.2",
+    "@awsless/ts-file-cache": "^0.0.22",
     "awsless": "^0.1.11",
-    "@awsless/s3": "^0.0.23"
+    "@awsless/s3": "^0.0.23",
+    "@awsless/big-float": "^0.1.8"
   },
   "scripts": {
     "test": "bun cli/build-handlers.ts && pnpm vitest run",