@everystack/cli 0.2.6 → 0.2.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/cli/aws.ts

@@ -136,6 +136,16 @@ export async function createInvalidation(
 /**
  * Write a versioning key to CloudFront KeyValueStore.
  * KVS requires ETag for optimistic concurrency — DescribeKeyValueStore first.
+ *
+ * KVS endpoints require SigV4a (asymmetric) signing. The SDK discovers the
+ * SigV4a implementation via a mutable singleton in @smithy/signature-v4 that
+ * @smithy/signature-v4a populates as a side-effect import. When the dependency
+ * tree resolves duplicate copies of @smithy/signature-v4, the singleton splits:
+ * the signer registers into one copy while the KVS client reads from another.
+ *
+ * We bypass this entirely by constructing SignatureV4a explicitly and passing it
+ * as `signer` to the client. When `config.signer` is set, resolveAwsSdkSigV4Config
+ * uses it directly — SignatureV4MultiRegion and the container are never consulted.
  */
 export async function putKvsKey(
   region: string,
@@ -143,15 +153,24 @@ export async function putKvsKey(
   key: string,
   value: string,
 ): Promise<void> {
-  // KVS requires SigV4a (asymmetric) signing — load pure-JS implementation
-  await import('@aws-sdk/signature-v4a');
+  const { SignatureV4a } = await import('@aws-sdk/signature-v4a');
+  const { defaultProvider } = await import('@aws-sdk/credential-provider-node');
+  const { Hash } = await import('@smithy/core/serde');
   const {
     CloudFrontKeyValueStoreClient,
     DescribeKeyValueStoreCommand,
     PutKeyCommand,
   } = await import('@aws-sdk/client-cloudfront-keyvaluestore');
 
-  if (!kvsClient) kvsClient = new CloudFrontKeyValueStoreClient({ region });
+  if (!kvsClient) {
+    const signer = new SignatureV4a({
+      credentials: defaultProvider(),
+      region: '*',
+      service: 'cloudfront-keyvaluestore',
+      sha256: Hash.bind(null, 'sha256'),
+    });
+    kvsClient = new CloudFrontKeyValueStoreClient({ region, signer });
+  }
 
   const desc = await kvsClient.send(
     new DescribeKeyValueStoreCommand({ KvsARN: kvsArn })