@hot-updater/aws 0.35.8 → 0.35.10

package/dist/iac/index.mjs

@@ -1,6 +1,5 @@
 import { createRequire } from "node:module";
-import { fromIni, fromNodeProviderChain, fromSSO } from "@aws-sdk/credential-providers";
-import { ConfigBuilder, colors, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, createZip, ensureInstallPackages, getCwd, link, makeEnv, p, transformEnv, transformTemplate, writeHotUpdaterConfig } from "@hot-updater/cli-tools";
+import { ConfigBuilder, MissingInitInputsError, assertInitProviderInputs, colors, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, createZip, ensureInstallPackages, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, readHotUpdaterInitEnv, resolveInitProviderInput, transformEnv, transformTemplate, writeHotUpdaterConfig } from "@hot-updater/cli-tools";
 import { fileURLToPath } from "node:url";
 import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process";
 import { StringDecoder } from "node:string_decoder";
@@ -17,6 +16,7 @@ import { appendFileSync, createReadStream, createWriteStream, readFileSync, stat
 import { finished } from "node:stream/promises";
 import { Duplex, PassThrough, Readable, Transform, Writable, getDefaultHighWaterMark } from "node:stream";
 import { Buffer as Buffer$1 } from "node:buffer";
+import { fromIni, fromNodeProviderChain, fromSSO } from "@aws-sdk/credential-providers";
 import crypto from "crypto";
 import { CloudFront } from "@aws-sdk/client-cloudfront";
 import { IAM } from "@aws-sdk/client-iam";
@@ -6209,6 +6209,380 @@ createExeca(mapNode);
 createExeca(mapScriptAsync, {}, deepScriptOptions, setScriptSync);
 const { sendMessage, getOneMessage, getEachMessage, getCancelSignal } = getIpcExport();
 //#endregion
+//#region iac/init/index.ts
+const AWS_AUTH_MODES = [
+	"local-session",
+	"shared-profile",
+	"sso",
+	"account"
+];
+const isAwsAuthMode = (value) => value !== void 0 && AWS_AUTH_MODES.some((mode) => mode === value);
+const AWS_REGION_VALUES = [
+	"af-south-1",
+	"ap-east-1",
+	"ap-east-2",
+	"ap-northeast-1",
+	"ap-northeast-2",
+	"ap-northeast-3",
+	"ap-south-1",
+	"ap-south-2",
+	"ap-southeast-1",
+	"ap-southeast-2",
+	"ap-southeast-3",
+	"ap-southeast-4",
+	"ap-southeast-5",
+	"ap-southeast-6",
+	"ap-southeast-7",
+	"ca-central-1",
+	"ca-west-1",
+	"cn-north-1",
+	"cn-northwest-1",
+	"eu-central-1",
+	"eu-central-2",
+	"eu-north-1",
+	"eu-south-1",
+	"eu-south-2",
+	"eu-west-1",
+	"eu-west-2",
+	"eu-west-3",
+	"il-central-1",
+	"me-central-1",
+	"me-south-1",
+	"mx-central-1",
+	"sa-east-1",
+	"us-east-1",
+	"us-east-2",
+	"us-gov-east-1",
+	"us-gov-west-1",
+	"us-west-1",
+	"us-west-2"
+];
+const isAwsRegionValue = (value) => value !== void 0 && AWS_REGION_VALUES.some((region) => region === value);
+const initProvider = {
+	label: "AWS S3 + Lambda@Edge",
+	inputs: {
+		authMode: {
+			envKey: "HOT_UPDATER_AWS_AUTH_MODE",
+			help: "AWS authentication mode: local-session, shared-profile, sso, or account",
+			prompt: {
+				message: "Select the mode to login to AWS",
+				type: "select"
+			},
+			validate: isAwsAuthMode
+		},
+		profile: {
+			envKey: "HOT_UPDATER_AWS_PROFILE",
+			help: "AWS profile name",
+			requiredWhen: (inputs) => inputs.authMode === "shared-profile" || inputs.authMode === "sso",
+			requirementHint: "required for shared-profile and sso auth",
+			prompt: {
+				defaultValue: "default",
+				message: "Enter the AWS profile name",
+				placeholder: "default",
+				type: "text"
+			}
+		},
+		accessKeyId: {
+			envKey: "HOT_UPDATER_S3_ACCESS_KEY_ID",
+			help: "AWS access key ID",
+			persistence: "with-consent",
+			requiredWhen: (inputs) => inputs.authMode === "account",
+			requirementHint: "required for account auth",
+			prompt: {
+				message: "Enter your AWS Access Key ID",
+				placeholder: "AKIA...",
+				type: "text"
+			}
+		},
+		secretAccessKey: {
+			envKey: "HOT_UPDATER_S3_SECRET_ACCESS_KEY",
+			help: "AWS secret access key",
+			persistence: "with-consent",
+			requiredWhen: (inputs) => inputs.authMode === "account",
+			requirementHint: "required for account auth",
+			prompt: {
+				message: "Enter your AWS Secret Access Key",
+				type: "password"
+			}
+		},
+		bucketName: {
+			envKey: "HOT_UPDATER_S3_BUCKET_NAME",
+			help: "S3 bucket name",
+			prompt: {
+				defaultValue: "hot-updater-storage",
+				message: "Enter the name of the new S3 Bucket",
+				placeholder: "hot-updater-storage",
+				type: "text"
+			}
+		},
+		bucketRegion: {
+			envKey: "HOT_UPDATER_S3_REGION",
+			help: "S3 bucket region",
+			prompt: {
+				message: "Enter AWS region for the S3 bucket",
+				type: "select"
+			},
+			validate: isAwsRegionValue
+		},
+		lambdaName: {
+			envKey: "HOT_UPDATER_AWS_LAMBDA_NAME",
+			help: "Lambda@Edge function name",
+			prompt: {
+				defaultValue: "hot-updater-edge",
+				message: "Enter the name of the Lambda@Edge function",
+				placeholder: "hot-updater-edge",
+				type: "text"
+			}
+		},
+		distributionId: {
+			envKey: "HOT_UPDATER_CLOUDFRONT_DISTRIBUTION_ID",
+			help: "Existing CloudFront distribution ID",
+			optional: true
+		},
+		migrationApproved: {
+			envKey: "HOT_UPDATER_AWS_MIGRATION_APPROVED",
+			help: "Allow pending Hot Updater S3 migrations (true)",
+			optional: true,
+			prompt: {
+				message: "Apply pending Hot Updater S3 migrations during init and future infrastructure updates?",
+				type: "confirm"
+			},
+			validate: (value) => value === "true"
+		}
+	}
+};
+//#endregion
+//#region iac/regionLocationMap.ts
+const regionLocationMap = {
+	"af-south-1": "Cape Town, South Africa",
+	"ap-east-1": "Hong Kong",
+	"ap-east-2": "Taipei, Taiwan",
+	"ap-northeast-1": "Tokyo, Japan",
+	"ap-northeast-2": "Seoul, South Korea",
+	"ap-northeast-3": "Osaka, Japan",
+	"ap-south-1": "Mumbai, India",
+	"ap-south-2": "Hyderabad, India",
+	"ap-southeast-1": "Singapore",
+	"ap-southeast-2": "Sydney, Australia",
+	"ap-southeast-3": "Jakarta, Indonesia",
+	"ap-southeast-4": "Melbourne, Australia",
+	"ap-southeast-5": "Auckland, New Zealand",
+	"ap-southeast-6": "New Zealand",
+	"ap-southeast-7": "Thailand",
+	"ca-central-1": "Montreal, Canada",
+	"ca-west-1": "Calgary, Canada",
+	"cn-north-1": "Beijing, China",
+	"cn-northwest-1": "Ningxia, China",
+	"eu-central-1": "Frankfurt, Germany",
+	"eu-north-1": "Stockholm, Sweden",
+	"eu-south-1": "Milan, Italy",
+	"eu-south-2": "Spain",
+	"eu-west-1": "Ireland",
+	"eu-west-2": "London, UK",
+	"eu-west-3": "Paris, France",
+	"il-central-1": "Tel Aviv, Israel",
+	"me-central-1": "UAE",
+	"me-south-1": "Bahrain",
+	"mx-central-1": "Mexico",
+	"sa-east-1": "São Paulo, Brazil",
+	"us-east-1": "Virginia, USA",
+	"us-east-2": "Ohio, USA",
+	"us-gov-east-1": "US Gov East (Virginia, USA)",
+	"us-gov-west-1": "US Gov West (Oregon, USA)",
+	"us-west-1": "California, USA",
+	"us-west-2": "Oregon, USA",
+	"eu-central-2": "Zurich, Switzerland"
+};
+//#endregion
+//#region iac/awsInitInputs.ts
+const resolveAwsInitInputs = (existingEnv) => {
+	const { inputs } = initProvider;
+	const savedAuthMode = resolveInitProviderInput(existingEnv, inputs.authMode);
+	return {
+		accessKeyId: resolveInitProviderInput(existingEnv, inputs.accessKeyId),
+		authMode: isAwsAuthMode(savedAuthMode) ? savedAuthMode : void 0,
+		bucketName: resolveInitProviderInput(existingEnv, inputs.bucketName),
+		bucketRegion: resolveInitProviderInput(existingEnv, inputs.bucketRegion),
+		distributionId: resolveInitProviderInput(existingEnv, inputs.distributionId),
+		lambdaName: resolveInitProviderInput(existingEnv, inputs.lambdaName),
+		migrationApproved: resolveInitProviderInput(existingEnv, inputs.migrationApproved),
+		profile: resolveInitProviderInput(existingEnv, inputs.profile),
+		secretAccessKey: resolveInitProviderInput(existingEnv, inputs.secretAccessKey)
+	};
+};
+const assertAwsNonInteractiveInputs = (inputs, nonInteractive) => {
+	assertInitProviderInputs({
+		inputs: {
+			...inputs,
+			bucketRegion: inputs.bucketRegion && Object.hasOwn(regionLocationMap, inputs.bucketRegion) ? inputs.bucketRegion : void 0
+		},
+		provider: initProvider,
+		strict: nonInteractive
+	});
+};
+//#endregion
+//#region iac/awsAuth.ts
+const exitWithCredentialError = (error) => {
+	if (error instanceof ExecaError) p.log.error(error.stdout || error.stderr || error.message);
+	else p.log.error(error.message);
+	process.exit(1);
+};
+const resolveAwsAuth = async (existingEnv, nonInteractive = false) => {
+	const inputDefinitions = initProvider.inputs;
+	const savedMode = resolveInitProviderInput(existingEnv, inputDefinitions.authMode);
+	const mode = isAwsAuthMode(savedMode) ? savedMode : void 0;
+	const savedProfile = resolveInitProviderInput(existingEnv, inputDefinitions.profile);
+	const savedAccessKeyId = resolveInitProviderInput(existingEnv, inputDefinitions.accessKeyId);
+	const savedSecretAccessKey = resolveInitProviderInput(existingEnv, inputDefinitions.secretAccessKey);
+	if (nonInteractive && mode === "account" && savedAccessKeyId && savedSecretAccessKey) return {
+		awsProfile: null,
+		configAuthMode: { mode: "account" },
+		credentials: {
+			accessKeyId: savedAccessKeyId,
+			secretAccessKey: savedSecretAccessKey
+		},
+		mode
+	};
+	const inputs = await p.group({
+		mode: () => nonInteractive && mode ? Promise.resolve(mode) : p.select({
+			initialValue: mode,
+			message: inputDefinitions.authMode.prompt.message,
+			options: [
+				{
+					label: "Current AWS CLI Session / Default Credential Chain",
+					value: "local-session"
+				},
+				{
+					label: "Shared AWS Profile",
+					value: "shared-profile"
+				},
+				{
+					label: "AWS SSO Login",
+					value: "sso"
+				},
+				{
+					label: "AWS Access Key ID & Secret Access Key",
+					value: "account"
+				}
+			]
+		}),
+		profile: ({ results }) => {
+			if (results.mode !== "shared-profile" && results.mode !== "sso") return Promise.resolve(void 0);
+			if (nonInteractive && savedProfile) return Promise.resolve(savedProfile);
+			const prompt = inputDefinitions.profile.prompt;
+			return p.text({
+				...getInitProviderTextPromptValues(prompt, savedProfile ?? process.env.AWS_PROFILE),
+				message: prompt.message,
+				validate: (value) => (value ?? "").trim() ? void 0 : "AWS profile name is required"
+			});
+		},
+		accessKeyId: ({ results }) => {
+			if (results.mode !== "account") return Promise.resolve(void 0);
+			if (nonInteractive && savedAccessKeyId) return Promise.resolve(savedAccessKeyId);
+			const prompt = inputDefinitions.accessKeyId.prompt;
+			return p.text({
+				...getInitProviderTextPromptValues(prompt, savedAccessKeyId),
+				message: prompt.message,
+				validate: (value) => value ? void 0 : "Access Key ID is required"
+			});
+		},
+		secretAccessKey: ({ results }) => {
+			if (results.mode !== "account") return Promise.resolve(void 0);
+			if (nonInteractive && savedSecretAccessKey) return Promise.resolve(savedSecretAccessKey);
+			return p.password({
+				message: inputDefinitions.secretAccessKey.prompt.message,
+				validate: (value) => value ? void 0 : "Secret Access Key is required"
+			});
+		}
+	}, { onCancel: () => process.exit(1) });
+	switch (inputs.mode) {
+		case "account":
+			if (!inputs.accessKeyId || !inputs.secretAccessKey) {
+				p.log.error("AWS access key credentials are required.");
+				process.exit(1);
+			}
+			return {
+				awsProfile: null,
+				configAuthMode: { mode: "account" },
+				credentials: {
+					accessKeyId: inputs.accessKeyId,
+					secretAccessKey: inputs.secretAccessKey
+				},
+				mode: inputs.mode
+			};
+		case "local-session": try {
+			return {
+				awsProfile: null,
+				configAuthMode: {
+					mode: "local",
+					profile: null
+				},
+				credentials: await fromNodeProviderChain()(),
+				mode: inputs.mode
+			};
+		} catch (error) {
+			if (error instanceof Error) return exitWithCredentialError(error);
+			throw error;
+		}
+		case "shared-profile": {
+			if (!inputs.profile) {
+				p.log.error("AWS profile is required.");
+				process.exit(1);
+			}
+			const profile = inputs.profile.trim();
+			try {
+				return {
+					awsProfile: profile,
+					configAuthMode: {
+						mode: "local",
+						profile
+					},
+					credentials: await fromIni({ profile })(),
+					mode: inputs.mode
+				};
+			} catch (error) {
+				if (error instanceof Error) return exitWithCredentialError(error);
+				throw error;
+			}
+		}
+		case "sso": {
+			if (!inputs.profile) {
+				p.log.error("AWS SSO profile is required.");
+				process.exit(1);
+			}
+			const profile = inputs.profile.trim();
+			try {
+				let credentials;
+				try {
+					credentials = await fromSSO({ profile })();
+				} catch {
+					if (nonInteractive) throw new MissingInitInputsError(["active AWS SSO session (`aws sso login`)"]);
+					await execa("aws", [
+						"sso",
+						"login",
+						"--profile",
+						profile
+					], { stdio: "inherit" });
+					credentials = await fromSSO({ profile })();
+				}
+				return {
+					awsProfile: profile,
+					configAuthMode: {
+						mode: "sso",
+						profile
+					},
+					credentials,
+					mode: inputs.mode
+				};
+			} catch (error) {
+				if (error instanceof MissingInitInputsError) throw error;
+				if (error instanceof Error) return exitWithCredentialError(error);
+				throw error;
+			}
+		}
+	}
+};
+//#endregion
 //#region ../../node_modules/.pnpm/es-toolkit@1.47.0/node_modules/es-toolkit/dist/_internal/globalThis.mjs
 const globalThis_ = typeof globalThis === "object" && globalThis || typeof window === "object" && window || typeof self === "object" && self || typeof global === "object" && global || (function() {
 	return this;
@@ -6591,6 +6965,16 @@ const buildDistributionConfig = (options) => sanitizeDistributionConfig({
 });
 //#endregion
 //#region iac/cloudfrontPagination.ts
+const collectPaginatedCloudFrontList = async ({ listPage }) => {
+	const items = [];
+	let marker;
+	do {
+		const page = await listPage(marker);
+		items.push(...page.items);
+		marker = page.nextMarker;
+	} while (marker);
+	return items;
+};
 const findInPaginatedCloudFrontList = async ({ listPage, matches }) => {
 	let marker;
 	do {
@@ -6670,6 +7054,11 @@ var CloudFrontManager = class {
 			region: this.region,
 			credentials: this.credentials
 		});
+		const selectedDistribution = options.distribution === void 0 ? await this.selectDistribution({
+			bucketName: options.bucketName,
+			distributionId: options.distributionId,
+			nonInteractive: options.nonInteractive
+		}) : options.distribution;
 		let oacId;
 		if (!options.functionArn.split(":")[4]) throw new Error("Failed to get AWS account ID");
 		try {
@@ -6696,29 +7085,6 @@ var CloudFrontManager = class {
 		} catch (error) {
 			throw new Error(`Failed to get or create shared cache policy: ${error instanceof Error ? error.message : String(error)}`);
 		}
-		const matchingDistributions = [];
-		try {
-			const items = (await cloudfrontClient.listDistributions({})).DistributionList?.Items || [];
-			for (const dist of items) if ((dist.Origins?.Items || []).some((origin) => origin.DomainName === bucketDomain)) matchingDistributions.push({
-				Id: dist.Id,
-				DomainName: dist.DomainName
-			});
-		} catch (error) {
-			console.error("Error listing CloudFront distributions:", error);
-		}
-		let selectedDistribution = null;
-		if (matchingDistributions.length === 1) selectedDistribution = matchingDistributions[0];
-		else if (matchingDistributions.length > 1) {
-			const selectedDistributionStr = await p.select({
-				message: "Multiple CloudFront distributions found. Please select one to use:",
-				options: matchingDistributions.map((dist) => ({
-					value: JSON.stringify(dist),
-					label: `${dist.Id} (${dist.DomainName})`
-				}))
-			});
-			if (p.isCancel(selectedDistributionStr)) process.exit(0);
-			selectedDistribution = JSON.parse(selectedDistributionStr);
-		}
 		const newOverrides = buildDistributionConfigOverrides({
 			bucketName: options.bucketName,
 			bucketDomain,
@@ -6728,6 +7094,7 @@ var CloudFrontManager = class {
 			sharedCachePolicyId
 		});
 		if (selectedDistribution) {
+			await makeEnv({ HOT_UPDATER_CLOUDFRONT_DISTRIBUTION_ID: selectedDistribution.Id });
 			p.log.success(`Existing CloudFront distribution selected. Distribution ID: ${selectedDistribution.Id}.`);
 			try {
 				const { DistributionConfig, ETag } = await cloudfrontClient.getDistributionConfig({ Id: selectedDistribution.Id });
@@ -6772,6 +7139,7 @@ var CloudFrontManager = class {
 			if (!distResp.Distribution?.Id || !distResp.Distribution?.DomainName) throw new Error("Failed to create CloudFront distribution: No ID or DomainName returned");
 			const distributionId = distResp.Distribution.Id;
 			const distributionDomain = distResp.Distribution.DomainName;
+			await makeEnv({ HOT_UPDATER_CLOUDFRONT_DISTRIBUTION_ID: distributionId });
 			p.log.success(`Created new CloudFront distribution. Distribution ID: ${distributionId}`);
 			let retryCount = 0;
 			await p.tasks([{
@@ -6797,6 +7165,53 @@ var CloudFrontManager = class {
 			throw error;
 		}
 	}
+	async selectDistribution({ bucketName, distributionId, nonInteractive }) {
+		const bucketDomain = `${bucketName}.s3.${this.region}.amazonaws.com`;
+		const cloudfrontClient = new CloudFront({
+			region: this.region,
+			credentials: this.credentials
+		});
+		const distributions = await collectPaginatedCloudFrontList({ listPage: async (marker) => {
+			const options = marker ? { Marker: marker } : {};
+			const response = await cloudfrontClient.listDistributions(options);
+			return {
+				items: response.DistributionList?.Items ?? [],
+				nextMarker: response.DistributionList?.NextMarker
+			};
+		} });
+		const matchingDistributions = distributions.flatMap((distribution) => {
+			return (distribution.Origins?.Items ?? []).some((origin) => origin.DomainName === bucketDomain) && distribution.Id && distribution.DomainName ? [{
+				Id: distribution.Id,
+				DomainName: distribution.DomainName
+			}] : [];
+		});
+		const savedDistribution = matchingDistributions.find((distribution) => distribution.Id === distributionId);
+		const savedDistributionExists = distributions.some((distribution) => distribution.Id === distributionId);
+		if (nonInteractive && savedDistribution) return savedDistribution;
+		if (distributionId && !savedDistribution) {
+			if (matchingDistributions.length === 0 && !savedDistributionExists) {
+				p.log.warn("Saved CloudFront distribution was not found. A new distribution will be created.");
+				return null;
+			}
+			if (nonInteractive) throw new MissingInitInputsError(["HOT_UPDATER_CLOUDFRONT_DISTRIBUTION_ID"]);
+			p.log.warn("Saved CloudFront distribution was not found. Select a distribution again.");
+		}
+		if (matchingDistributions.length === 0) return null;
+		if (nonInteractive) {
+			if (!distributionId && matchingDistributions.length === 1) return matchingDistributions[0] ?? null;
+			throw new MissingInitInputsError(["HOT_UPDATER_CLOUDFRONT_DISTRIBUTION_ID"]);
+		}
+		const selectedDistributionId = await p.select({
+			initialValue: savedDistribution?.Id ?? matchingDistributions[0]?.Id,
+			message: "Select a CloudFront distribution:",
+			options: matchingDistributions.map((distribution) => ({
+				value: distribution.Id,
+				label: `${distribution.Id} (${distribution.DomainName})`
+			}))
+		});
+		if (p.isCancel(selectedDistributionId)) process.exit(0);
+		return matchingDistributions.find((distribution) => distribution.Id === selectedDistributionId) ?? null;
+	}
 };
 //#endregion
 //#region iac/iam.ts
@@ -6893,14 +7308,8 @@ var LambdaEdgeDeployer = class {
 	constructor(credentials) {
 		this.credentials = credentials;
 	}
-	async deploy(lambdaRoleArn, config) {
+	async deploy(lambdaRoleArn, lambdaName, config) {
 		const cwd = getCwd();
-		const lambdaName = await p.text({
-			message: "Enter the name of the Lambda@Edge function",
-			defaultValue: "hot-updater-edge",
-			placeholder: "hot-updater-edge"
-		});
-		if (p.isCancel(lambdaName)) process.exit(1);
 		const lambdaPath = __require.resolve("@hot-updater/aws/lambda");
 		const { tmpDir, removeTmpDir } = await copyDirToTmp(path$1.dirname(lambdaPath));
 		const indexPath = path$1.join(tmpDir, "index.cjs");
@@ -7297,48 +7706,6 @@ var Migration0001HotUpdater0_18_0 = class extends S3Migration {
 	}
 };
 //#endregion
-//#region iac/regionLocationMap.ts
-const regionLocationMap = {
-	"af-south-1": "Cape Town, South Africa",
-	"ap-east-1": "Hong Kong",
-	"ap-east-2": "Taipei, Taiwan",
-	"ap-northeast-1": "Tokyo, Japan",
-	"ap-northeast-2": "Seoul, South Korea",
-	"ap-northeast-3": "Osaka, Japan",
-	"ap-south-1": "Mumbai, India",
-	"ap-south-2": "Hyderabad, India",
-	"ap-southeast-1": "Singapore",
-	"ap-southeast-2": "Sydney, Australia",
-	"ap-southeast-3": "Jakarta, Indonesia",
-	"ap-southeast-4": "Melbourne, Australia",
-	"ap-southeast-5": "Auckland, New Zealand",
-	"ap-southeast-6": "New Zealand",
-	"ap-southeast-7": "Thailand",
-	"ca-central-1": "Montreal, Canada",
-	"ca-west-1": "Calgary, Canada",
-	"cn-north-1": "Beijing, China",
-	"cn-northwest-1": "Ningxia, China",
-	"eu-central-1": "Frankfurt, Germany",
-	"eu-north-1": "Stockholm, Sweden",
-	"eu-south-1": "Milan, Italy",
-	"eu-south-2": "Spain",
-	"eu-west-1": "Ireland",
-	"eu-west-2": "London, UK",
-	"eu-west-3": "Paris, France",
-	"il-central-1": "Tel Aviv, Israel",
-	"me-central-1": "UAE",
-	"me-south-1": "Bahrain",
-	"mx-central-1": "Mexico",
-	"sa-east-1": "São Paulo, Brazil",
-	"us-east-1": "Virginia, USA",
-	"us-east-2": "Ohio, USA",
-	"us-gov-east-1": "US Gov East (Virginia, USA)",
-	"us-gov-west-1": "US Gov West (Oregon, USA)",
-	"us-west-1": "California, USA",
-	"us-west-2": "Oregon, USA",
-	"eu-central-2": "Zurich, Switzerland"
-};
-//#endregion
 //#region iac/s3.ts
 function normalizeBucketRegion(region) {
 	if (region == null) return "us-east-1";
@@ -7356,7 +7723,7 @@ var S3Manager = class {
 			credentials: this.credentials
 		});
 		const buckets = (await s3Client.listBuckets({})).Buckets ?? [];
-		return await Promise.all(buckets.filter((bucket) => bucket.Name).map(async (bucket) => {
+		return await Promise.all(buckets.filter((bucket) => typeof bucket.Name === "string").map(async (bucket) => {
 			const { LocationConstraint } = await s3Client.getBucketLocation({ Bucket: bucket.Name });
 			return {
 				name: bucket.Name,
@@ -7374,7 +7741,7 @@ var S3Manager = class {
 		});
 		p.log.info(`Created S3 bucket: ${bucketName}`);
 	}
-	async runMigrations({ bucketName, region, migrations }) {
+	async runMigrations({ approved, bucketName, nonInteractive, region, migrations }) {
 		const migrator = new S3Migrator({
 			s3: new S3({
 				region,
@@ -7385,16 +7752,22 @@ var S3Manager = class {
 		});
 		const { pending } = await migrator.list();
 		await migrator.migrate({ dryRun: true });
-		if (pending.length > 0) {
-			p.log.step("Pending migrations:");
-			for (const m of pending) p.log.step(`- ${m.name}`);
-		}
-		const confirm = await p.confirm({ message: "Do you want to continue?" });
-		if (p.isCancel(confirm) || !confirm) {
-			p.log.info("Migration cancelled.");
-			process.exit(1);
+		if (pending.length === 0) return false;
+		p.log.step("Pending migrations:");
+		for (const migration of pending) p.log.step(`- ${migration.name}`);
+		if (!nonInteractive || !approved) {
+			if (nonInteractive) throw new MissingInitInputsError(["HOT_UPDATER_AWS_MIGRATION_APPROVED"]);
+			const confirm = await p.confirm({
+				initialValue: approved,
+				message: "Do you want to continue?"
+			});
+			if (p.isCancel(confirm) || !confirm) {
+				p.log.info("Migration cancelled.");
+				process.exit(1);
+			}
 		}
 		await migrator.migrate({ dryRun: false });
+		return true;
 	}
 	async updateBucketPolicy({ bucketName, region, distributionId, accountId }) {
 		const s3Client = new S3({
@@ -7590,118 +7963,34 @@ const checkIfAwsCliInstalled = async () => {
 		return false;
 	}
 };
-const runInit = async ({ build }) => {
+const isAwsRegion = (value) => {
+	return value !== void 0 && Object.hasOwn(regionLocationMap, value);
+};
+const runInit = async ({ build, envFile }) => {
+	const nonInteractive = envFile !== void 0;
+	const initEnvSources = await readHotUpdaterInitEnv(process.cwd(), envFile);
+	const { managedEnv } = initEnvSources;
+	const providerEnv = getHotUpdaterInitInputEnv(initEnvSources, nonInteractive);
+	const savedInputs = resolveAwsInitInputs(providerEnv);
+	assertAwsNonInteractiveInputs(savedInputs, nonInteractive);
 	if (!await checkIfAwsCliInstalled()) {
 		p.log.error(`AWS CLI is not installed. Please visit ${link("https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html")} for installation instructions`);
 		process.exit(1);
 	}
-	let credentials;
-	let configAuthMode = { mode: "account" };
-	let awsProfile = null;
-	const mode = await p.select({
-		message: "Select the mode to login to AWS",
-		options: [
-			{
-				label: "Current AWS CLI Session / Default Credential Chain",
-				value: "local-session"
-			},
-			{
-				label: "Shared AWS Profile",
-				value: "shared-profile"
-			},
-			{
-				label: "AWS SSO Login",
-				value: "sso"
-			},
-			{
-				label: "AWS Access Key ID & Secret Access Key",
-				value: "account"
-			}
-		]
-	});
-	if (p.isCancel(mode)) process.exit(1);
 	p.log.message(colors.blue("The following permissions are required:"));
 	p.log.message(`${colors.blue("AmazonS3FullAccess")}: Create and read S3 buckets`);
 	p.log.message(`${colors.blue("AWSLambda_FullAccess")}: Create and update Lambda functions`);
 	p.log.message(`${colors.blue("CloudFrontFullAccess")}: Create and update CloudFront distributions`);
 	p.log.message(`${colors.blue("IAMFullAccess")}: Get or create IAM roles for Lambda@Edge`);
 	p.log.message(`${colors.blue("AmazonSSMFullAccess")}: Access to SSM Parameters for storing CloudFront key pairs`);
-	if (mode === "sso") try {
-		const profile = await p.text({
-			message: "Enter the SSO profile name",
-			defaultValue: "default",
-			placeholder: "default"
-		});
-		if (p.isCancel(profile)) process.exit(1);
-		awsProfile = profile;
-		configAuthMode = {
-			mode: "sso",
-			profile
-		};
-		await execa("aws", [
-			"sso",
-			"login",
-			"--profile",
-			profile
-		], {
-			stdio: "inherit",
-			shell: true
-		});
-		credentials = await fromSSO({ profile })();
-	} catch (error) {
-		if (error instanceof ExecaError) p.log.error(error.stdout || error.stderr || error.message);
-		process.exit(1);
-	}
-	else if (mode === "local-session") try {
-		configAuthMode = {
-			mode: "local",
-			profile: null
-		};
-		credentials = await fromNodeProviderChain()();
-	} catch (error) {
-		if (error instanceof Error) p.log.error(error.message);
-		process.exit(1);
-	}
-	else if (mode === "shared-profile") try {
-		const profile = await p.text({
-			message: "Enter the AWS profile name",
-			defaultValue: process.env.AWS_PROFILE ?? "default",
-			placeholder: process.env.AWS_PROFILE ?? "default",
-			validate: (value) => (value ?? "").trim() ? void 0 : "AWS profile name is required"
-		});
-		if (p.isCancel(profile)) process.exit(1);
-		awsProfile = profile.trim();
-		configAuthMode = {
-			mode: "local",
-			profile: awsProfile
-		};
-		credentials = await fromIni({ profile: awsProfile })();
-	} catch (error) {
-		if (error instanceof Error) p.log.error(error.message);
-		process.exit(1);
-	}
-	else {
-		const creds = await p.group({
-			accessKeyId: () => p.text({
-				message: "Enter your AWS Access Key ID",
-				validate: (value) => value ? void 0 : "Access Key ID is required"
-			}),
-			secretAccessKey: () => p.password({
-				message: "Enter your AWS Secret Access Key",
-				validate: (value) => value ? void 0 : "Secret Access Key is required"
-			})
-		});
-		if (p.isCancel(creds)) process.exit(1);
-		credentials = {
-			accessKeyId: creds.accessKeyId,
-			secretAccessKey: creds.secretAccessKey
-		};
-		configAuthMode = { mode: "account" };
-	}
-	if (!credentials) {
-		p.log.error("Couldn't fetch the credentials.");
-		process.exit(1);
-	}
+	const { awsProfile, configAuthMode, credentials, mode } = await resolveAwsAuth(providerEnv, nonInteractive);
+	const resolvedAuthInputs = {
+		...savedInputs,
+		accessKeyId: mode === "account" ? credentials.accessKeyId : savedInputs.accessKeyId,
+		authMode: mode,
+		profile: awsProfile ?? void 0,
+		secretAccessKey: mode === "account" ? credentials.secretAccessKey : savedInputs.secretAccessKey
+	};
 	const s3Manager = new S3Manager(credentials);
 	let availableBuckets = [];
 	try {
@@ -7716,54 +8005,109 @@ const runInit = async ({ build }) => {
 		throw e;
 	}
 	const createKey = `create/${Math.random().toString(36).substring(2, 15)}`;
-	let bucketName = await p.select({
-		message: "S3 Bucket List",
-		options: [...availableBuckets.map((bucket) => ({
-			value: bucket.name,
-			label: `${bucket.name} (${bucket.region})`
-		})), {
-			value: createKey,
-			label: "Create New S3 Bucket"
-		}]
-	});
-	if (p.isCancel(bucketName)) process.exit(1);
-	let bucketRegion = availableBuckets.find((bucket) => bucket.name === bucketName)?.region;
-	if (bucketName === createKey) {
-		const name = await p.text({
-			message: "Enter the name of the new S3 Bucket",
-			defaultValue: "hot-updater-storage",
-			placeholder: "hot-updater-storage"
-		});
-		if (p.isCancel(name)) process.exit(1);
-		bucketName = name;
-		const selectedRegion = await p.select({
-			message: "Enter AWS region for the S3 bucket",
+	const savedBucketName = savedInputs.bucketName;
+	const savedBucketRegion = savedInputs.bucketRegion;
+	const existingBucket = availableBuckets.find((bucket) => bucket.name === savedBucketName);
+	const createSavedBucket = nonInteractive && savedBucketName !== void 0 && isAwsRegion(savedBucketRegion) && !existingBucket;
+	if (createSavedBucket && savedInputs.migrationApproved !== "true") throw new MissingInitInputsError(["HOT_UPDATER_AWS_MIGRATION_APPROVED"]);
+	if (savedBucketName && !existingBucket && !createSavedBucket) p.log.warn("Saved S3 bucket was not found. Select a bucket again.");
+	const savedLambdaName = savedInputs.lambdaName;
+	const resourceInputs = await p.group({
+		bucketSelection: () => {
+			if (nonInteractive && existingBucket) return Promise.resolve(existingBucket.name);
+			if (createSavedBucket) return Promise.resolve(createKey);
+			return p.select({
+				initialValue: existingBucket?.name ?? availableBuckets[0]?.name,
+				message: "S3 Bucket List",
+				options: [...availableBuckets.map((bucket) => ({
+					value: bucket.name,
+					label: `${bucket.name} (${bucket.region})`
+				})), {
+					value: createKey,
+					label: "Create New S3 Bucket"
+				}]
+			});
+		},
+		bucketName: ({ results }) => results.bucketSelection === createKey ? createSavedBucket ? Promise.resolve(savedBucketName) : p.text({
+			...getInitProviderTextPromptValues(initProvider.inputs.bucketName.prompt, savedBucketName),
+			message: initProvider.inputs.bucketName.prompt.message,
+			validate: (value) => value ? void 0 : "S3 bucket name is required"
+		}) : Promise.resolve(results.bucketSelection),
+		bucketRegion: ({ results }) => results.bucketSelection === createKey ? createSavedBucket ? Promise.resolve(savedBucketRegion) : p.select({
+			initialValue: isAwsRegion(savedBucketRegion) ? savedBucketRegion : void 0,
+			message: initProvider.inputs.bucketRegion.prompt.message,
 			options: Object.entries(regionLocationMap).map(([region, location]) => ({
 				label: `${region} (${location})`,
 				value: region
 			}))
-		});
-		if (p.isCancel(selectedRegion)) process.exit(1);
-		bucketRegion = selectedRegion;
-		await s3Manager.createBucket(bucketName, bucketRegion);
+		}) : Promise.resolve(availableBuckets.find((bucket) => bucket.name === results.bucketSelection)?.region),
+		lambdaName: () => nonInteractive && savedLambdaName ? Promise.resolve(savedLambdaName) : p.text({
+			...getInitProviderTextPromptValues(initProvider.inputs.lambdaName.prompt, savedLambdaName),
+			message: initProvider.inputs.lambdaName.prompt.message,
+			validate: (value) => value ? void 0 : "Lambda function name is required"
+		})
+	}, { onCancel: () => process.exit(1) });
+	const { bucketName, bucketRegion, lambdaName } = resourceInputs;
+	if (!bucketName || !lambdaName) {
+		p.log.error("AWS resource names are required.");
+		process.exit(1);
 	}
-	if (!bucketRegion) {
-		p.log.error("Failed to get S3 bucket region");
+	if (!isAwsRegion(bucketRegion)) {
+		p.log.error("AWS bucket region is required.");
 		process.exit(1);
 	}
+	const cloudFrontManager = new CloudFrontManager(bucketRegion, credentials);
+	const selectedDistribution = await cloudFrontManager.selectDistribution({
+		bucketName,
+		distributionId: savedInputs.distributionId,
+		nonInteractive
+	});
+	const resolvedInputs = {
+		...resolvedAuthInputs,
+		bucketName,
+		bucketRegion,
+		distributionId: selectedDistribution?.Id,
+		lambdaName,
+		migrationApproved: savedInputs.migrationApproved
+	};
+	const initEnv = getInitProviderEnvVars({
+		includeConsentInputs: await confirmInitInputPersistence({
+			existingEnv: managedEnv,
+			inputs: resolvedInputs,
+			nonInteractive,
+			provider: initProvider
+		}),
+		inputs: resolvedInputs,
+		provider: initProvider
+	});
+	const accessKeyEnvKey = initProvider.inputs.accessKeyId.envKey;
+	const secretAccessKeyEnvKey = initProvider.inputs.secretAccessKey.envKey;
+	await makeEnv({
+		...initEnv,
+		...initEnv[accessKeyEnvKey] ? { [accessKeyEnvKey]: {
+			comment: "The current key may have excessive permissions. Update it with an S3FullAccess and CloudFrontFullAccess key.",
+			value: initEnv[accessKeyEnvKey]
+		} } : {},
+		...initEnv[secretAccessKeyEnvKey] ? { [secretAccessKeyEnvKey]: {
+			comment: "The current key may have excessive permissions. Update it with an S3FullAccess and CloudFrontFullAccess key.",
+			value: initEnv[secretAccessKeyEnvKey]
+		} } : {}
+	});
+	if (resourceInputs.bucketSelection === createKey) await s3Manager.createBucket(bucketName, bucketRegion);
 	p.log.info(`Selected S3 Bucket: ${bucketName} (${bucketRegion})`);
-	await s3Manager.runMigrations({
+	if (await s3Manager.runMigrations({
+		approved: savedInputs.migrationApproved === "true",
 		bucketName,
+		nonInteractive,
 		region: bucketRegion,
 		migrations: [new Migration0001HotUpdater0_13_0(), new Migration0001HotUpdater0_18_0()]
-	});
+	}) && savedInputs.migrationApproved !== "true") await makeEnv({ [initProvider.inputs.migrationApproved.envKey]: "true" });
 	const lambdaRoleArn = await new IAMManager(bucketRegion, credentials).createOrSelectRole();
 	const keyPair = await new SSMKeyPairManager(bucketRegion, credentials).getOrCreateKeyPair(`/hot-updater/${bucketName}/keypair`);
-	const cloudFrontManager = new CloudFrontManager(bucketRegion, credentials);
 	const { publicKeyId, keyGroupId } = await cloudFrontManager.getOrCreateKeyGroup(keyPair.publicKey);
 	const lambdaEdgeDeployer = new LambdaEdgeDeployer(credentials);
 	const ssmParameterName = `/hot-updater/${bucketName}/keypair`;
-	const { functionArn } = await lambdaEdgeDeployer.deploy(lambdaRoleArn, {
+	const { functionArn } = await lambdaEdgeDeployer.deploy(lambdaRoleArn, lambdaName, {
 		bucketName,
 		publicKeyId,
 		ssmParameterName,
@@ -7772,6 +8116,7 @@ const runInit = async ({ build }) => {
 	const { distributionDomain, distributionId } = await cloudFrontManager.createOrUpdateDistribution({
 		keyGroupId,
 		bucketName,
+		distribution: selectedDistribution,
 		functionArn
 	});
 	const accountId = functionArn.split(":")[4];
@@ -7782,22 +8127,7 @@ const runInit = async ({ build }) => {
 		accountId
 	});
 	const configWriteResult = await writeHotUpdaterConfig(getConfigScaffold(build, configAuthMode));
-	await makeEnv({
-		HOT_UPDATER_S3_BUCKET_NAME: bucketName,
-		HOT_UPDATER_S3_REGION: bucketRegion,
-		...mode === "account" ? {
-			HOT_UPDATER_S3_ACCESS_KEY_ID: {
-				comment: "The current key may have excessive permissions. Update it with an S3FullAccess and CloudFrontFullAccess key.",
-				value: credentials.accessKeyId
-			},
-			HOT_UPDATER_S3_SECRET_ACCESS_KEY: {
-				comment: "The current key may have excessive permissions. Update it with an S3FullAccess and CloudFrontFullAccess key.",
-				value: credentials.secretAccessKey
-			}
-		} : {},
-		...awsProfile !== null ? { HOT_UPDATER_AWS_PROFILE: awsProfile } : {},
-		HOT_UPDATER_CLOUDFRONT_DISTRIBUTION_ID: distributionId
-	});
+	await makeEnv({ [initProvider.inputs.distributionId.envKey]: distributionId });
 	if (mode === "sso") await ensureInstallPackages({ devDependencies: ["@aws-sdk/credential-provider-sso"] });
 	else if (mode === "local-session" || mode === "shared-profile") await ensureInstallPackages({ devDependencies: ["@aws-sdk/credential-providers"] });
 	p.log.success("Generated '.env.hotupdater' file with AWS settings.");