@hot-updater/aws 0.36.6 → 1.0.0-rc.0

package/dist/iac/index.mjs

@@ -1,5 +1,6 @@
 import { createRequire } from "node:module";
-import { ConfigBuilder, MissingInitInputsError, assertInitProviderInputs, colors, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, createZip, ensureInstallPackages, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, readHotUpdaterInitEnv, resolveInitProviderInput, transformEnv, transformTemplate, writeHotUpdaterConfig } from "@hot-updater/cli-tools";
+import { ConfigBuilder, InitError, MissingInitInputsError, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitProviderInputs, colors, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, createZip, ensureInstallPackages, formatApiKeyNote, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, readHotUpdaterInitEnv, resolveInitProviderInput, transformEnv, transformTemplate, writeHotUpdaterConfig } from "@hot-updater/cli-tools";
+import { provisionApiKey } from "@hot-updater/server";
 import { fileURLToPath } from "node:url";
 import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process";
 import { StringDecoder } from "node:string_decoder";
@@ -16,15 +17,19 @@ import { appendFileSync, createReadStream, createWriteStream, readFileSync, stat
 import { finished } from "node:stream/promises";
 import { Duplex, PassThrough, Readable, Transform, Writable, getDefaultHighWaterMark } from "node:stream";
 import { Buffer as Buffer$1 } from "node:buffer";
+import { CloudFront, CloudFrontClient, CreateInvalidationCommand, GetInvalidationCommand } from "@aws-sdk/client-cloudfront";
+import { DynamoDB, DynamoDBClient, waitUntilTableExists } from "@aws-sdk/client-dynamodb";
+import { BatchGetCommand, DynamoDBDocumentClient, GetCommand, PutCommand, QueryCommand, ScanCommand, TransactWriteCommand } from "@aws-sdk/lib-dynamodb";
+import { createDatabasePlugin, isDatabaseMetadataObject } from "@hot-updater/plugin-core";
+import { createDatabasePluginAdapter } from "@hot-updater/plugin-core/internal";
 import { fromIni, fromNodeProviderChain, fromSSO } from "@aws-sdk/credential-providers";
+import { Lambda } from "@aws-sdk/client-lambda";
 import crypto from "crypto";
-import { CloudFront } from "@aws-sdk/client-cloudfront";
+import { createHash } from "node:crypto";
 import { IAM } from "@aws-sdk/client-iam";
 import { STS } from "@aws-sdk/client-sts";
 import fs from "fs/promises";
-import { Lambda } from "@aws-sdk/client-lambda";
-import { CopyObjectCommand, DeleteObjectCommand, GetObjectCommand, ListObjectsV2Command, S3 } from "@aws-sdk/client-s3";
-import { Upload } from "@aws-sdk/lib-storage";
+import { S3 } from "@aws-sdk/client-s3";
 import { ParameterNotFound, SSM } from "@aws-sdk/client-ssm";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
@@ -51,7 +56,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 //#endregion
 //#region ../../node_modules/.pnpm/is-plain-obj@4.1.0/node_modules/is-plain-obj/index.js
-function isPlainObject$1(value) {
+function isPlainObject(value) {
 	if (typeof value !== "object" || value === null) return false;
 	const prototype = Object.getPrototypeOf(value);
 	return (prototype === null || prototype === Object.prototype || Object.getPrototypeOf(prototype) === null) && !(Symbol.toStringTag in value) && !(Symbol.iterator in value);
@@ -70,13 +75,13 @@ const normalizeFileUrl = (file) => file instanceof URL ? fileURLToPath(file) : f
 //#region ../../node_modules/.pnpm/execa@9.5.2/node_modules/execa/lib/methods/parameters.js
 const normalizeParameters = (rawFile, rawArguments = [], rawOptions = {}) => {
 	const filePath = safeNormalizeFileUrl(rawFile, "First argument");
-	const [commandArguments, options] = isPlainObject$1(rawArguments) ? [[], rawArguments] : [rawArguments, rawOptions];
+	const [commandArguments, options] = isPlainObject(rawArguments) ? [[], rawArguments] : [rawArguments, rawOptions];
 	if (!Array.isArray(commandArguments)) throw new TypeError(`Second argument must be either an array of arguments or an options object: ${commandArguments}`);
 	if (commandArguments.some((commandArgument) => typeof commandArgument === "object" && commandArgument !== null)) throw new TypeError(`Second argument must be an array of strings: ${commandArguments}`);
 	const normalizedArguments = commandArguments.map(String);
 	const nullByteArgument = normalizedArguments.find((normalizedArgument) => normalizedArgument.includes("\0"));
 	if (nullByteArgument !== void 0) throw new TypeError(`Arguments cannot contain null bytes ("\\0"): ${nullByteArgument}`);
-	if (!isPlainObject$1(options)) throw new TypeError(`Last argument must be an options object: ${options}`);
+	if (!isPlainObject(options)) throw new TypeError(`Last argument must be an options object: ${options}`);
 	return [
 		filePath,
 		normalizedArguments,
@@ -200,7 +205,7 @@ const parseExpression = (expression) => {
 	const typeOfExpression = typeof expression;
 	if (typeOfExpression === "string") return expression;
 	if (typeOfExpression === "number") return String(expression);
-	if (isPlainObject$1(expression) && ("stdout" in expression || "isMaxBuffer" in expression)) return getSubprocessResult(expression);
+	if (isPlainObject(expression) && ("stdout" in expression || "isMaxBuffer" in expression)) return getSubprocessResult(expression);
 	if (expression instanceof ChildProcess || Object.prototype.toString.call(expression) === "[object Promise]") throw new TypeError("Unexpected subprocess in template expression. Please use ${await subprocess} instead of ${subprocess}.");
 	throw new TypeError(`Unexpected "${typeOfExpression}" in template expression`);
 };
@@ -236,7 +241,7 @@ const normalizeFdSpecificOption = (options, optionName) => {
 	return addDefaultValue$1(normalizeFdSpecificValue(options[optionName], optionBaseArray, optionName), optionName);
 };
 const getStdioLength = ({ stdio }) => Array.isArray(stdio) ? Math.max(stdio.length, STANDARD_STREAMS_ALIASES.length) : STANDARD_STREAMS_ALIASES.length;
-const normalizeFdSpecificValue = (optionValue, optionArray, optionName) => isPlainObject$1(optionValue) ? normalizeOptionObject(optionValue, optionArray, optionName) : optionArray.fill(optionValue);
+const normalizeFdSpecificValue = (optionValue, optionArray, optionName) => isPlainObject(optionValue) ? normalizeOptionObject(optionValue, optionArray, optionName) : optionArray.fill(optionValue);
 const normalizeOptionObject = (optionValue, optionArray, optionName) => {
 	for (const fdName of Object.keys(optionValue).sort(compareFdName)) for (const fdNumber of parseFdName(fdName, optionName, optionArray)) optionArray[fdNumber] = optionValue[fdName];
 	return optionArray;
@@ -3196,10 +3201,10 @@ const checkBooleanOption = (value, optionName) => {
 const isGenerator = (value) => isAsyncGenerator(value) || isSyncGenerator(value);
 const isAsyncGenerator = (value) => Object.prototype.toString.call(value) === "[object AsyncGeneratorFunction]";
 const isSyncGenerator = (value) => Object.prototype.toString.call(value) === "[object GeneratorFunction]";
-const isTransformOptions = (value) => isPlainObject$1(value) && (value.transform !== void 0 || value.final !== void 0);
+const isTransformOptions = (value) => isPlainObject(value) && (value.transform !== void 0 || value.final !== void 0);
 const isUrl = (value) => Object.prototype.toString.call(value) === "[object URL]";
 const isRegularUrl = (value) => isUrl(value) && value.protocol !== "file:";
-const isFilePathObject = (value) => isPlainObject$1(value) && Object.keys(value).length > 0 && Object.keys(value).every((key) => FILE_PATH_KEYS.has(key)) && isFilePathString(value.file);
+const isFilePathObject = (value) => isPlainObject(value) && Object.keys(value).length > 0 && Object.keys(value).every((key) => FILE_PATH_KEYS.has(key)) && isFilePathString(value.file);
 const FILE_PATH_KEYS = new Set(["file", "append"]);
 const isFilePathString = (file) => typeof file === "string";
 const isUnknownStdioString = (type, value) => type === "native" && typeof value === "string" && !KNOWN_STDIO_STRINGS.has(value);
@@ -3321,7 +3326,7 @@ const normalizeDuplex = ({ stdioItem, stdioItem: { value: { transform, transform
 	};
 };
 const normalizeTransformStream = ({ stdioItem, stdioItem: { value }, index, newTransforms, direction }) => {
-	const { transform, objectMode } = isPlainObject$1(value) ? value : { transform: value };
+	const { transform, objectMode } = isPlainObject(value) ? value : { transform: value };
 	const { writableObjectMode, readableObjectMode } = getTransformObjectModes(objectMode, index, newTransforms, direction);
 	return {
 		...stdioItem,
@@ -3333,7 +3338,7 @@ const normalizeTransformStream = ({ stdioItem, stdioItem: { value }, index, newT
 	};
 };
 const normalizeGenerator = ({ stdioItem, stdioItem: { value }, index, newTransforms, direction, encoding }) => {
-	const { transform, final, binary: binaryOption = false, preserveNewlines = false, objectMode } = isPlainObject$1(value) ? value : { transform: value };
+	const { transform, final, binary: binaryOption = false, preserveNewlines = false, objectMode } = isPlainObject(value) ? value : { transform: value };
 	const binary = binaryOption || BINARY_ENCODINGS.has(encoding);
 	const { writableObjectMode, readableObjectMode } = getTransformObjectModes(objectMode, index, newTransforms, direction);
 	return {
@@ -5173,7 +5178,7 @@ const unpipeOnSignalAbort = async (unpipeSignal, { sourceStream, mergedStream, f
 //#endregion
 //#region ../../node_modules/.pnpm/execa@9.5.2/node_modules/execa/lib/pipe/setup.js
 const pipeToSubprocess = (sourceInfo, ...pipeArguments) => {
-	if (isPlainObject$1(pipeArguments[0])) return pipeToSubprocess.bind(void 0, {
+	if (isPlainObject(pipeArguments[0])) return pipeToSubprocess.bind(void 0, {
 		...sourceInfo,
 		boundOptions: {
 			...sourceInfo.boundOptions,
@@ -6107,7 +6112,7 @@ const mergeOptions = (boundOptions, options) => {
 	};
 };
 const mergeOption = (optionName, boundOptionValue, optionValue) => {
-	if (DEEP_OPTIONS.has(optionName) && isPlainObject$1(boundOptionValue) && isPlainObject$1(optionValue)) return {
+	if (DEEP_OPTIONS.has(optionName) && isPlainObject(boundOptionValue) && isPlainObject(optionValue)) return {
 		...boundOptionValue,
 		...optionValue
 	};
@@ -6129,7 +6134,7 @@ const createExeca = (mapArguments, boundOptions, deepOptions, setBoundExeca) =>
 	return boundExeca;
 };
 const callBoundExeca = ({ mapArguments, deepOptions = {}, boundOptions = {}, setBoundExeca, createNested }, firstArgument, ...nextArguments) => {
-	if (isPlainObject$1(firstArgument)) return createNested(mapArguments, mergeOptions(boundOptions, firstArgument), setBoundExeca);
+	if (isPlainObject(firstArgument)) return createNested(mapArguments, mergeOptions(boundOptions, firstArgument), setBoundExeca);
 	const { file, commandArguments, options, isSync } = parseArguments({
 		mapArguments,
 		firstArgument,
@@ -6209,203 +6214,1977 @@ createExeca(mapNode);
 createExeca(mapScriptAsync, {}, deepScriptOptions, setScriptSync);
 const { sendMessage, getOneMessage, getEachMessage, getCancelSignal } = getIpcExport();
 //#endregion
-//#region iac/init/index.ts
-const AWS_AUTH_MODES = [
-	"local-session",
-	"shared-profile",
-	"sso",
-	"account"
-];
-const isAwsAuthMode = (value) => value !== void 0 && AWS_AUTH_MODES.some((mode) => mode === value);
-const AWS_REGION_VALUES = [
-	"af-south-1",
-	"ap-east-1",
-	"ap-east-2",
-	"ap-northeast-1",
-	"ap-northeast-2",
-	"ap-northeast-3",
-	"ap-south-1",
-	"ap-south-2",
-	"ap-southeast-1",
-	"ap-southeast-2",
-	"ap-southeast-3",
-	"ap-southeast-4",
-	"ap-southeast-5",
-	"ap-southeast-6",
-	"ap-southeast-7",
-	"ca-central-1",
-	"ca-west-1",
-	"cn-north-1",
-	"cn-northwest-1",
-	"eu-central-1",
-	"eu-central-2",
-	"eu-north-1",
-	"eu-south-1",
-	"eu-south-2",
-	"eu-west-1",
-	"eu-west-2",
-	"eu-west-3",
-	"il-central-1",
-	"me-central-1",
-	"me-south-1",
-	"mx-central-1",
-	"sa-east-1",
-	"us-east-1",
-	"us-east-2",
-	"us-gov-east-1",
-	"us-gov-west-1",
-	"us-west-1",
-	"us-west-2"
-];
-const isAwsRegionValue = (value) => value !== void 0 && AWS_REGION_VALUES.some((region) => region === value);
-const initProvider = {
-	label: "AWS S3 + Lambda@Edge",
-	inputs: {
-		authMode: {
-			envKey: "HOT_UPDATER_AWS_AUTH_MODE",
-			help: "AWS authentication mode: local-session, shared-profile, sso, or account",
-			prompt: {
-				message: "Select the mode to login to AWS",
-				type: "select"
-			},
-			validate: isAwsAuthMode
-		},
-		profile: {
-			envKey: "HOT_UPDATER_AWS_PROFILE",
-			help: "AWS profile name",
-			requiredWhen: (inputs) => inputs.authMode === "shared-profile" || inputs.authMode === "sso",
-			requirementHint: "required for shared-profile and sso auth",
-			prompt: {
-				defaultValue: "default",
-				message: "Enter the AWS profile name",
-				placeholder: "default",
-				type: "text"
+//#region src/cloudFrontInvalidation.ts
+const DEFAULT_POLL_INTERVAL_MS = 2e3;
+const DEFAULT_TIMEOUT_MS = 300 * 1e3;
+const sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
+const invalidateCloudFront = async (client, distributionId, paths, options) => {
+	if (paths.length === 0) return;
+	const response = await client.send(new CreateInvalidationCommand({
+		DistributionId: distributionId,
+		InvalidationBatch: {
+			CallerReference: `invalidation-${Date.now()}`,
+			Paths: {
+				Quantity: paths.length,
+				Items: paths.map((path) => encodeURI(path))
 			}
-		},
-		accessKeyId: {
-			envKey: "HOT_UPDATER_S3_ACCESS_KEY_ID",
-			help: "AWS access key ID",
-			persistence: "with-consent",
-			requiredWhen: (inputs) => inputs.authMode === "account",
-			requirementHint: "required for account auth",
-			prompt: {
-				message: "Enter your AWS Access Key ID",
-				placeholder: "AKIA...",
-				type: "text"
+		}
+	}));
+	if (!options.shouldWait || response.Invalidation?.Status === "Completed") return;
+	const invalidationId = response.Invalidation?.Id;
+	if (!invalidationId) throw new Error("CloudFront invalidation response is missing Invalidation.Id");
+	const deadline = Date.now() + DEFAULT_TIMEOUT_MS;
+	while (Date.now() < deadline) {
+		await sleep(DEFAULT_POLL_INTERVAL_MS);
+		if ((await client.send(new GetInvalidationCommand({
+			DistributionId: distributionId,
+			Id: invalidationId
+		}))).Invalidation?.Status === "Completed") return;
+	}
+	throw new Error(`Timed out waiting for CloudFront invalidation ${invalidationId}.`);
+};
+//#endregion
+//#region src/dynamoDB.ts
+const DYNAMODB_MAX_METADATA_ITEM_BYTES = 8 * 1024;
+const DYNAMODB_MAX_CATALOG_ITEM_BYTES = 400 * 1024;
+var DynamoDBMetadataItemSizeError = class extends Error {
+	name = "DynamoDBMetadataItemSizeError";
+	constructor(byteLength) {
+		super(`DynamoDB metadata item is ${byteLength} bytes; maximum is ${DYNAMODB_MAX_METADATA_ITEM_BYTES}`);
+		this.byteLength = byteLength;
+	}
+};
+const boundedDynamoDBMetadataItem = (item) => {
+	const byteLength = new TextEncoder().encode(JSON.stringify(item)).byteLength;
+	if (byteLength > 8192) throw new DynamoDBMetadataItemSizeError(byteLength);
+	return item;
+};
+var DynamoDBCatalogItemSizeError = class extends Error {
+	name = "DynamoDBCatalogItemSizeError";
+	constructor(byteLength) {
+		super(`DynamoDB catalog item is ${byteLength} bytes; maximum is ${DYNAMODB_MAX_CATALOG_ITEM_BYTES}`);
+		this.byteLength = byteLength;
+	}
+};
+const boundedDynamoDBCatalogItem = (item) => {
+	const byteLength = new TextEncoder().encode(JSON.stringify(item)).byteLength;
+	if (byteLength > 409600) throw new DynamoDBCatalogItemSizeError(byteLength);
+	return item;
+};
+const DYNAMODB_CHANNEL_PARTITION = "channels";
+const DYNAMODB_CHANNEL_NAME_PARTITION = "_hot-updater#channel-names";
+var DynamoDBStoredItemError = class extends Error {
+	name = "DynamoDBStoredItemError";
+	constructor() {
+		super("DynamoDB contains an invalid Hot Updater row");
+	}
+};
+const field = (value, name) => Reflect.get(value, name);
+const isNullableString = (value) => value === null || typeof value === "string";
+const isByteSize = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+const withLegacyArchiveByteSize = (value) => typeof value === "object" && value !== null && field(value, "archive_byte_size") === void 0 ? {
+	...value,
+	archive_byte_size: 0
+} : value;
+const isBundleRow = (value) => typeof value === "object" && value !== null && typeof field(value, "id") === "string" && (field(value, "platform") === "ios" || field(value, "platform") === "android") && typeof field(value, "file_hash") === "string" && isNullableString(field(value, "git_commit_hash")) && typeof field(value, "storage_uri") === "string" && isByteSize(field(value, "archive_byte_size")) && isDatabaseMetadataObject(field(value, "metadata")) && isNullableString(field(value, "manifest_storage_uri")) && isNullableString(field(value, "manifest_file_hash")) && isNullableString(field(value, "asset_base_storage_uri"));
+const isPatchRow = (value) => typeof value === "object" && value !== null && typeof field(value, "id") === "string" && typeof field(value, "bundle_id") === "string" && typeof field(value, "base_bundle_id") === "string" && typeof field(value, "base_file_hash") === "string" && typeof field(value, "patch_file_hash") === "string" && typeof field(value, "patch_storage_uri") === "string" && isByteSize(field(value, "byte_size")) && typeof field(value, "order_index") === "number";
+const isChannelRow = (value) => typeof value === "object" && value !== null && typeof field(value, "id") === "string" && typeof field(value, "name") === "string";
+const isReleaseRow = (value) => typeof value === "object" && value !== null && typeof field(value, "id") === "string" && typeof field(value, "revision") === "number" && typeof field(value, "scope_key") === "string" && typeof field(value, "channel_id") === "string" && (field(value, "platform") === "ios" || field(value, "platform") === "android") && (field(value, "kind") === "BUNDLE" || field(value, "kind") === "EMBEDDED") && isNullableString(field(value, "bundle_id")) && (field(value, "strategy") === "APP_VERSION" || field(value, "strategy") === "FINGERPRINT") && isNullableString(field(value, "target_app_version")) && isNullableString(field(value, "fingerprint_hash")) && typeof field(value, "enabled") === "boolean" && typeof field(value, "should_force_update") === "boolean" && isNullableString(field(value, "message")) && typeof field(value, "rollout_cohort_count") === "number" && Array.isArray(field(value, "target_cohorts")) && field(value, "target_cohorts").every((cohort) => typeof cohort === "string") && (field(value, "operation") === "DEPLOY" || field(value, "operation") === "PROMOTE" || field(value, "operation") === "ROLLBACK") && isNullableString(field(value, "source_release_id")) && typeof field(value, "created_at_ms") === "number" && typeof field(value, "updated_at_ms") === "number";
+const isReleaseCatalogRow = (value) => typeof value === "object" && value !== null && typeof field(value, "scope_key") === "string" && typeof field(value, "catalog_id") === "string" && (field(value, "strategy") === "APP_VERSION" || field(value, "strategy") === "FINGERPRINT") && typeof field(value, "channel_id") === "string" && typeof field(value, "channel_key") === "string" && (field(value, "platform") === "ios" || field(value, "platform") === "android") && isNullableString(field(value, "fingerprint_hash")) && typeof field(value, "generation") === "number" && typeof field(value, "payload") === "string" && typeof field(value, "catalog_hash") === "string" && typeof field(value, "byte_size") === "number" && typeof field(value, "is_tombstone") === "boolean" && typeof field(value, "updated_at_ms") === "number";
+const parseDynamoDBItem = (value) => {
+	const pk = value.pk;
+	const sk = value.sk;
+	const version = value.version;
+	const relationCount = value.relation_count;
+	const ownedPatchCount = value.owned_patch_count;
+	const gsi1pk = value.gsi1pk;
+	const gsi1sk = value.gsi1sk;
+	const row = pk === "bundles" ? withLegacyArchiveByteSize(value.row) : value.row;
+	if (typeof sk !== "string" || typeof version !== "number") throw new DynamoDBStoredItemError();
+	if (pk === "channels" && typeof value.reference_count === "number" && isChannelRow(row)) return {
+		pk,
+		sk,
+		version,
+		reference_count: value.reference_count,
+		row
+	};
+	if (typeof pk === "string" && pk.startsWith("release-scope#") && isReleaseRow(row)) return {
+		pk,
+		sk,
+		version,
+		row
+	};
+	if (pk === "release_catalogs" && isReleaseCatalogRow(row)) return {
+		pk,
+		sk,
+		version,
+		row
+	};
+	if (typeof gsi1pk !== "string" || typeof gsi1sk !== "string") throw new DynamoDBStoredItemError();
+	if (pk === "bundles" && isBundleRow(row)) {
+		if (typeof relationCount !== "number" || typeof ownedPatchCount !== "number") throw new DynamoDBStoredItemError();
+		return {
+			pk,
+			sk,
+			version,
+			relation_count: relationCount,
+			owned_patch_count: ownedPatchCount,
+			gsi1pk,
+			gsi1sk,
+			row
+		};
+	}
+	if (pk === "bundle_patches" && isPatchRow(row)) return {
+		pk,
+		sk,
+		version,
+		gsi1pk,
+		gsi1sk,
+		row
+	};
+	throw new DynamoDBStoredItemError();
+};
+const bundlePlatformPartition = (row) => `bundle#${row.platform}`;
+const patchOwnerPartition = (bundleId) => `patch-owner#${bundleId}`;
+const patchOrderKey = (row) => `${row.order_index.toString().padStart(10, "0")}#${row.id}`;
+const toDynamoDBBundleItem = (row, version = 1, relationCount = 0, ownedPatchCount = 0) => ({
+	pk: "bundles",
+	sk: row.id,
+	version,
+	relation_count: relationCount,
+	owned_patch_count: ownedPatchCount,
+	gsi1pk: bundlePlatformPartition(row),
+	gsi1sk: row.id,
+	row
+});
+const toDynamoDBPatchItem = (row, version = 1) => {
+	const orderKey = patchOrderKey(row);
+	return {
+		pk: "bundle_patches",
+		sk: row.id,
+		version,
+		gsi1pk: patchOwnerPartition(row.bundle_id),
+		gsi1sk: orderKey,
+		row
+	};
+};
+const toDynamoDBChannelItem = (row, version = 1, referenceCount = 0) => ({
+	pk: DYNAMODB_CHANNEL_PARTITION,
+	sk: row.id,
+	version,
+	reference_count: referenceCount,
+	row
+});
+const releaseScopePartition = (scopeKey) => `release-scope#${scopeKey}`;
+const toDynamoDBReleaseItem = (row, version = 1) => ({
+	pk: releaseScopePartition(row.scope_key),
+	sk: row.id,
+	version,
+	row
+});
+const toDynamoDBReleaseCatalogItem = (row, version = 1) => ({
+	pk: "release_catalogs",
+	sk: row.scope_key,
+	version,
+	row
+});
+const itemKey = (model, id) => ({
+	pk: model,
+	sk: id
+});
+const exactDynamoDBId = (where) => {
+	if (where?.length !== 1) return void 0;
+	const condition = where[0];
+	if (Reflect.get(condition, "field") !== "id" || (Reflect.get(condition, "operator") ?? "eq") !== "eq" || Reflect.get(condition, "mode") === "insensitive") return;
+	const value = Reflect.get(condition, "value");
+	return typeof value === "string" ? value : void 0;
+};
+const exactDynamoDBPatchOwner = (where) => {
+	const owners = exactDynamoDBPatchOwners(where);
+	return owners?.length === 1 ? owners[0] : void 0;
+};
+const exactDynamoDBPatchOwners = (where) => {
+	if (!where || where.some((condition) => Reflect.get(condition, "connector") === "OR")) return;
+	const ownerConditions = where.filter((condition) => Reflect.get(condition, "field") === "bundle_id");
+	if (ownerConditions.length !== 1) return void 0;
+	const condition = ownerConditions[0];
+	if (Reflect.get(condition, "mode") === "insensitive") return;
+	const operator = Reflect.get(condition, "operator") ?? "eq";
+	const value = Reflect.get(condition, "value");
+	if (operator === "eq") return typeof value === "string" ? [value] : void 0;
+	if (operator === "in" && Array.isArray(value) && value.every((id) => typeof id === "string")) return value;
+};
+const exactDynamoDBBundleIds = (where) => {
+	if (!where || where.some((condition) => Reflect.get(condition, "connector") === "OR")) return;
+	for (const condition of where) {
+		if (Reflect.get(condition, "field") !== "id" || Reflect.get(condition, "mode") === "insensitive") continue;
+		const operator = Reflect.get(condition, "operator") ?? "eq";
+		const value = Reflect.get(condition, "value");
+		if (operator === "eq" && typeof value === "string") return [value];
+		if (operator === "in" && Array.isArray(value) && value.every((id) => typeof id === "string")) return value;
+	}
+};
+const dynamoDBBundlePageStart = (where, direction) => {
+	if ((where ?? []).some((condition) => Reflect.get(condition, "connector") === "OR")) return;
+	let result;
+	for (const condition of where ?? []) {
+		if (Reflect.get(condition, "field") !== "id") continue;
+		const operator = Reflect.get(condition, "operator") ?? "eq";
+		const value = Reflect.get(condition, "value");
+		if (!(direction === "asc" ? operator === "gt" || operator === "gte" : operator === "lt" || operator === "lte") || typeof value !== "string") continue;
+		const inclusive = operator === "gte" || operator === "lte";
+		if (result === void 0 || (direction === "asc" ? value > result.id : value < result.id) || value === result.id && !inclusive) result = {
+			id: value,
+			inclusive
+		};
+	}
+	return result;
+};
+const parseStoredItem = (item) => parseDynamoDBItem(item.pk === "release_catalogs" ? boundedDynamoDBCatalogItem(item) : boundedDynamoDBMetadataItem(item));
+const queryItems = async (store, input) => {
+	let exclusiveStartKey;
+	const items = [];
+	do {
+		const sortCondition = input.minimumSortKey ? " AND #sortKey >= :minimumSortKey" : "";
+		const page = await store.client.send(new QueryCommand({
+			TableName: store.tableName,
+			...input.indexName ? { IndexName: input.indexName } : {},
+			...input.consistentRead ? { ConsistentRead: true } : {},
+			ExclusiveStartKey: exclusiveStartKey,
+			KeyConditionExpression: `#partitionKey = :partition${sortCondition}`,
+			ExpressionAttributeNames: {
+				"#partitionKey": input.indexName ? "gsi1pk" : "pk",
+				...input.minimumSortKey ? { "#sortKey": input.indexName ? "gsi1sk" : "sk" } : {}
+			},
+			ExpressionAttributeValues: {
+				":partition": input.partition,
+				...input.minimumSortKey ? { ":minimumSortKey": input.minimumSortKey } : {}
 			}
+		}));
+		const pageItems = (page.Items ?? []).map(parseStoredItem);
+		items.push(...pageItems);
+		exclusiveStartKey = page.LastEvaluatedKey;
+	} while (exclusiveStartKey !== void 0);
+	return items;
+};
+const queryBundleItemsPage = async (store, input) => {
+	if (input.limit === 0) return [];
+	let exclusiveStartKey;
+	const items = [];
+	do {
+		const startOperator = input.start?.inclusive ? input.direction === "asc" ? ">=" : "<=" : input.direction === "asc" ? ">" : "<";
+		const page = await store.client.send(new QueryCommand({
+			TableName: store.tableName,
+			ExclusiveStartKey: exclusiveStartKey,
+			KeyConditionExpression: input.start ? `#pk = :pk AND #sk ${startOperator} :start` : "#pk = :pk",
+			ExpressionAttributeNames: {
+				"#pk": "pk",
+				...input.start ? { "#sk": "sk" } : {}
+			},
+			ExpressionAttributeValues: {
+				":pk": "bundles",
+				...input.start ? { ":start": input.start.id } : {}
+			},
+			Limit: Math.max(input.limit - items.length, 100),
+			ScanIndexForward: input.direction === "asc"
+		}));
+		for (const item of (page.Items ?? []).map(parseStoredItem)) {
+			if (item.pk === "bundles" && input.matches(item.row)) items.push(item);
+			if (items.length === input.limit) return items;
+		}
+		exclusiveStartKey = page.LastEvaluatedKey;
+	} while (exclusiveStartKey !== void 0);
+	return items;
+};
+const loadModelItems = (store, model) => queryItems(store, {
+	partition: model,
+	consistentRead: true
+});
+const loadModelItem = async (store, model, id) => {
+	const { Item } = await store.client.send(new GetCommand({
+		TableName: store.tableName,
+		Key: itemKey(model, id),
+		ConsistentRead: true
+	}));
+	return Item === void 0 ? void 0 : parseStoredItem(Item);
+};
+const loadBundleItem = async (store, id) => {
+	const item = await loadModelItem(store, "bundles", id);
+	return item?.pk === "bundles" ? item : void 0;
+};
+const loadPatchItem = async (store, id) => {
+	const item = await loadModelItem(store, "bundle_patches", id);
+	return item?.pk === "bundle_patches" ? item : void 0;
+};
+const loadChannelItem = async (store, id) => {
+	const item = await loadModelItem(store, DYNAMODB_CHANNEL_PARTITION, id);
+	return item?.pk === "channels" ? item : void 0;
+};
+const loadBundleItems = async (store) => {
+	return (await loadModelItems(store, "bundles")).filter((item) => item.pk === "bundles");
+};
+const loadPatchItems = async (store) => {
+	return (await loadModelItems(store, "bundle_patches")).filter((item) => item.pk === "bundle_patches");
+};
+const loadChannelItems = async (store) => {
+	return (await loadModelItems(store, DYNAMODB_CHANNEL_PARTITION)).filter((item) => item.pk === DYNAMODB_CHANNEL_PARTITION);
+};
+const DYNAMODB_RELEASE_ID_PARTITION = "_hot-updater#release-scope-by-id";
+const releaseLocatorItem = (row) => ({
+	pk: DYNAMODB_RELEASE_ID_PARTITION,
+	sk: row.id,
+	scope_key: row.scope_key
+});
+const loadReleaseItem = async (store, id) => {
+	const locator = await store.client.send(new GetCommand({
+		TableName: store.tableName,
+		Key: {
+			pk: DYNAMODB_RELEASE_ID_PARTITION,
+			sk: id
 		},
-		secretAccessKey: {
-			envKey: "HOT_UPDATER_S3_SECRET_ACCESS_KEY",
-			help: "AWS secret access key",
-			persistence: "with-consent",
-			requiredWhen: (inputs) => inputs.authMode === "account",
-			requirementHint: "required for account auth",
-			prompt: {
-				message: "Enter your AWS Secret Access Key",
-				type: "password"
-			}
+		ConsistentRead: true
+	}));
+	if (locator.Item === void 0) return void 0;
+	const scopeKey = locator.Item.scope_key;
+	if (typeof scopeKey !== "string") throw new DynamoDBStoredItemError();
+	const result = await store.client.send(new GetCommand({
+		TableName: store.tableName,
+		Key: {
+			pk: releaseScopePartition(scopeKey),
+			sk: id
 		},
-		bucketName: {
-			envKey: "HOT_UPDATER_S3_BUCKET_NAME",
-			help: "S3 bucket name",
-			prompt: {
-				defaultValue: "hot-updater-storage",
-				message: "Enter the name of the new S3 Bucket",
-				placeholder: "hot-updater-storage",
-				type: "text"
-			}
+		ConsistentRead: true
+	}));
+	if (result.Item === void 0) throw new DynamoDBStoredItemError();
+	const item = parseStoredItem(result.Item);
+	if (!isReleaseRow(item.row) || item.sk !== id) throw new DynamoDBStoredItemError();
+	return item;
+};
+const loadReleaseItemsByScope = async (store, scopeKey) => (await queryItems(store, {
+	partition: releaseScopePartition(scopeKey),
+	consistentRead: true
+})).filter((item) => item.pk === releaseScopePartition(scopeKey) && isReleaseRow(item.row));
+const loadReleaseItems = async (store) => {
+	let exclusiveStartKey;
+	const items = [];
+	do {
+		const page = await store.client.send(new ScanCommand({
+			TableName: store.tableName,
+			ExclusiveStartKey: exclusiveStartKey,
+			ConsistentRead: true,
+			FilterExpression: "begins_with(#pk, :prefix)",
+			ExpressionAttributeNames: { "#pk": "pk" },
+			ExpressionAttributeValues: { ":prefix": "release-scope#" }
+		}));
+		for (const value of page.Items ?? []) {
+			const item = parseStoredItem(value);
+			if (isReleaseRow(item.row)) items.push(item);
+		}
+		exclusiveStartKey = page.LastEvaluatedKey;
+	} while (exclusiveStartKey !== void 0);
+	return items;
+};
+const loadReleaseCatalogItem = async (store, scopeKey) => {
+	const result = await store.client.send(new GetCommand({
+		TableName: store.tableName,
+		Key: itemKey("release_catalogs", scopeKey),
+		ConsistentRead: true
+	}));
+	if (result.Item === void 0) return void 0;
+	const item = parseStoredItem(result.Item);
+	return item.pk === "release_catalogs" ? item : void 0;
+};
+const loadReleaseCatalogItems = async (store) => (await queryItems(store, {
+	partition: "release_catalogs",
+	consistentRead: true
+})).filter((item) => item.pk === "release_catalogs");
+const loadChannelByName = async (store, name) => {
+	const { Item } = await store.client.send(new GetCommand({
+		TableName: store.tableName,
+		Key: {
+			pk: DYNAMODB_CHANNEL_NAME_PARTITION,
+			sk: name
 		},
-		bucketRegion: {
-			envKey: "HOT_UPDATER_S3_REGION",
-			help: "S3 bucket region",
-			prompt: {
-				message: "Enter AWS region for the S3 bucket",
-				type: "select"
+		ConsistentRead: true
+	}));
+	const id = Item?.channel_id;
+	if (Item === void 0) return void 0;
+	if (typeof id !== "string") throw new DynamoDBStoredItemError();
+	const channel = await loadChannelItem(store, id);
+	if (channel === void 0 || channel.row.name !== name) throw new DynamoDBStoredItemError();
+	return channel;
+};
+const insertDynamoDBChannel = async (store, input) => {
+	const existing = await loadChannelByName(store, input.row.name);
+	if (existing !== void 0) return {
+		row: existing.row,
+		inserted: false
+	};
+	const existingId = await loadChannelItem(store, input.row.id);
+	if (existingId !== void 0) {
+		if (existingId.row.name === input.row.name) return {
+			row: existingId.row,
+			inserted: false
+		};
+		throw new DynamoDBStoredItemError();
+	}
+	try {
+		await commitDynamoDBTransaction(store, [{ Put: {
+			TableName: store.tableName,
+			Item: boundedDynamoDBMetadataItem(toDynamoDBChannelItem(input.row)),
+			ConditionExpression: "attribute_not_exists(#pk)",
+			ExpressionAttributeNames: { "#pk": "pk" }
+		} }, { Put: {
+			TableName: store.tableName,
+			Item: {
+				pk: DYNAMODB_CHANNEL_NAME_PARTITION,
+				sk: input.row.name,
+				channel_id: input.row.id
 			},
-			validate: isAwsRegionValue
-		},
-		lambdaName: {
-			envKey: "HOT_UPDATER_AWS_LAMBDA_NAME",
-			help: "Lambda@Edge function name",
-			prompt: {
-				defaultValue: "hot-updater-edge",
-				message: "Enter the name of the Lambda@Edge function",
-				placeholder: "hot-updater-edge",
-				type: "text"
+			ConditionExpression: "attribute_not_exists(#pk)",
+			ExpressionAttributeNames: { "#pk": "pk" }
+		} }]);
+		return {
+			row: input.row,
+			inserted: true
+		};
+	} catch (error) {
+		const canonical = await loadChannelByName(store, input.row.name);
+		if (canonical !== void 0) return {
+			row: canonical.row,
+			inserted: false
+		};
+		throw error;
+	}
+};
+const deleteDynamoDBChannel = async (store, input) => {
+	const current = await loadChannelItem(store, input.id);
+	if (current === void 0) return {
+		deleted: false,
+		reason: "not_found"
+	};
+	if (current.reference_count !== 0) return {
+		deleted: false,
+		reason: "not_empty"
+	};
+	try {
+		await commitDynamoDBTransaction(store, [{ Delete: {
+			TableName: store.tableName,
+			Key: itemKey(DYNAMODB_CHANNEL_PARTITION, current.sk),
+			ConditionExpression: "#version = :version AND #referenceCount = :zero",
+			ExpressionAttributeNames: {
+				"#version": "version",
+				"#referenceCount": "reference_count"
+			},
+			ExpressionAttributeValues: {
+				":version": current.version,
+				":zero": 0
 			}
-		},
-		distributionId: {
-			envKey: "HOT_UPDATER_CLOUDFRONT_DISTRIBUTION_ID",
-			help: "Existing CloudFront distribution ID",
-			optional: true
-		},
-		migrationApproved: {
-			envKey: "HOT_UPDATER_AWS_MIGRATION_APPROVED",
-			help: "Allow pending Hot Updater S3 migrations (true)",
-			optional: true,
-			prompt: {
-				message: "Apply pending Hot Updater S3 migrations during init and future infrastructure updates?",
-				type: "confirm"
+		} }, { Delete: {
+			TableName: store.tableName,
+			Key: {
+				pk: DYNAMODB_CHANNEL_NAME_PARTITION,
+				sk: current.row.name
 			},
-			validate: (value) => value === "true"
+			ConditionExpression: "#channelId = :channelId",
+			ExpressionAttributeNames: { "#channelId": "channel_id" },
+			ExpressionAttributeValues: { ":channelId": current.sk }
+		} }]);
+		return { deleted: true };
+	} catch (error) {
+		const latest = await loadChannelItem(store, input.id);
+		if (latest !== void 0 && latest.reference_count > 0) return {
+			deleted: false,
+			reason: "not_empty"
+		};
+		if (latest === void 0) return {
+			deleted: false,
+			reason: "not_found"
+		};
+		throw error;
+	}
+};
+const queryOwnerPatchIds = async (store, indexName, bundleId) => {
+	return (await queryItems(store, {
+		partition: patchOwnerPartition(bundleId),
+		indexName
+	})).filter((item) => item.pk === "bundle_patches").map(({ sk }) => sk);
+};
+var DynamoDBTransactionLimitError = class extends Error {
+	name = "DynamoDBTransactionLimitError";
+	constructor(actionCount) {
+		super(`DynamoDB transaction requires ${actionCount} actions; maximum is 100`);
+		this.actionCount = actionCount;
+	}
+};
+const metadataUpdate = (store, delta) => {
+	const entries = Object.entries(delta).filter(([, value]) => value !== 0);
+	if (entries.length === 0) return void 0;
+	const names = {};
+	const values = {};
+	const updates = [];
+	const conditions = [];
+	for (const [model, change] of entries) {
+		const name = model === "bundles" ? "bundles" : "patches";
+		const valueName = model === "bundles" ? "bundle" : "patch";
+		names[`#${name}`] = name;
+		values[`:${valueName}Delta`] = change;
+		updates.push(`#${name} :${valueName}Delta`);
+		if (change < 0) {
+			values[`:${valueName}Removal`] = -change;
+			conditions.push(`#${name} >= :${valueName}Removal`);
 		}
 	}
+	return { Update: {
+		TableName: store.tableName,
+		Key: {
+			pk: "_hot-updater",
+			sk: "limits.metadata"
+		},
+		UpdateExpression: `ADD ${updates.join(", ")}`,
+		...conditions.length > 0 ? { ConditionExpression: conditions.join(" AND ") } : {},
+		ExpressionAttributeNames: names,
+		ExpressionAttributeValues: values
+	} };
 };
-//#endregion
-//#region iac/regionLocationMap.ts
-const regionLocationMap = {
-	"af-south-1": "Cape Town, South Africa",
-	"ap-east-1": "Hong Kong",
-	"ap-east-2": "Taipei, Taiwan",
-	"ap-northeast-1": "Tokyo, Japan",
-	"ap-northeast-2": "Seoul, South Korea",
-	"ap-northeast-3": "Osaka, Japan",
-	"ap-south-1": "Mumbai, India",
-	"ap-south-2": "Hyderabad, India",
-	"ap-southeast-1": "Singapore",
-	"ap-southeast-2": "Sydney, Australia",
-	"ap-southeast-3": "Jakarta, Indonesia",
-	"ap-southeast-4": "Melbourne, Australia",
-	"ap-southeast-5": "Auckland, New Zealand",
-	"ap-southeast-6": "New Zealand",
-	"ap-southeast-7": "Thailand",
-	"ca-central-1": "Montreal, Canada",
-	"ca-west-1": "Calgary, Canada",
-	"cn-north-1": "Beijing, China",
-	"cn-northwest-1": "Ningxia, China",
-	"eu-central-1": "Frankfurt, Germany",
-	"eu-north-1": "Stockholm, Sweden",
-	"eu-south-1": "Milan, Italy",
-	"eu-south-2": "Spain",
-	"eu-west-1": "Ireland",
-	"eu-west-2": "London, UK",
-	"eu-west-3": "Paris, France",
-	"il-central-1": "Tel Aviv, Israel",
-	"me-central-1": "UAE",
-	"me-south-1": "Bahrain",
-	"mx-central-1": "Mexico",
-	"sa-east-1": "São Paulo, Brazil",
-	"us-east-1": "Virginia, USA",
-	"us-east-2": "Ohio, USA",
-	"us-gov-east-1": "US Gov East (Virginia, USA)",
-	"us-gov-west-1": "US Gov West (Oregon, USA)",
-	"us-west-1": "California, USA",
-	"us-west-2": "Oregon, USA",
-	"eu-central-2": "Zurich, Switzerland"
+const updateBundleRelation = (store, bundleId, delta, ownedPatchDelta = 0) => {
+	const names = {
+		"#pk": "pk",
+		"#version": "version"
+	};
+	const values = { ":one": 1 };
+	const additions = [];
+	let condition = "attribute_exists(#pk)";
+	let update = "SET #version = #version + :one";
+	if (delta !== 0) {
+		names["#relationCount"] = "relation_count";
+		values[":relationDelta"] = delta;
+		additions.push("#relationCount :relationDelta");
+		if (delta < 0) {
+			values[":relationRemoval"] = -delta;
+			condition += " AND #relationCount >= :relationRemoval";
+		}
+	}
+	if (ownedPatchDelta !== 0) {
+		names["#ownedPatchCount"] = "owned_patch_count";
+		values[":ownedPatchDelta"] = ownedPatchDelta;
+		additions.push("#ownedPatchCount :ownedPatchDelta");
+		if (ownedPatchDelta < 0) {
+			values[":ownedPatchRemoval"] = -ownedPatchDelta;
+			condition += " AND #ownedPatchCount >= :ownedPatchRemoval";
+		}
+	}
+	if (additions.length > 0) update += ` ADD ${additions.join(", ")}`;
+	return { Update: {
+		TableName: store.tableName,
+		Key: itemKey("bundles", bundleId),
+		ConditionExpression: condition,
+		ExpressionAttributeNames: names,
+		ExpressionAttributeValues: values,
+		UpdateExpression: update
+	} };
 };
-//#endregion
-//#region iac/awsInitInputs.ts
-const resolveAwsInitInputs = (existingEnv) => {
-	const { inputs } = initProvider;
-	const savedAuthMode = resolveInitProviderInput(existingEnv, inputs.authMode);
-	return {
+const commitDynamoDBTransaction = async (store, actions) => {
+	if (actions.length > 100) throw new DynamoDBTransactionLimitError(actions.length);
+	await store.client.send(new TransactWriteCommand({ TransactItems: [...actions] }));
+};
+const DYNAMODB_BATCH_GET_ATTEMPTS = 5;
+const DYNAMODB_BATCH_GET_BASE_DELAY_MS = 25;
+var DynamoDBBatchGetExhaustedError = class extends Error {
+	name = "DynamoDBBatchGetExhaustedError";
+	constructor(unprocessedKeyCount) {
+		super(`DynamoDB did not process ${unprocessedKeyCount} batch-get keys after ${DYNAMODB_BATCH_GET_ATTEMPTS} attempts`);
+		this.unprocessedKeyCount = unprocessedKeyCount;
+	}
+};
+const waitBeforeRetry = (attempt) => new Promise((resolve) => setTimeout(resolve, DYNAMODB_BATCH_GET_BASE_DELAY_MS * 2 ** attempt));
+const batchGetDynamoDBItems = async (store, keys) => {
+	const items = [];
+	for (let offset = 0; offset < keys.length; offset += 100) {
+		let pending = keys.slice(offset, offset + 100);
+		for (let attempt = 0; attempt < DYNAMODB_BATCH_GET_ATTEMPTS && pending.length > 0; attempt++) {
+			const { Responses, UnprocessedKeys } = await store.client.send(new BatchGetCommand({ RequestItems: { [store.tableName]: {
+				ConsistentRead: true,
+				Keys: pending
+			} } }));
+			items.push(...Responses?.[store.tableName] ?? []);
+			pending = UnprocessedKeys?.[store.tableName]?.Keys ?? [];
+			if (pending.length > 0 && attempt + 1 < DYNAMODB_BATCH_GET_ATTEMPTS) await waitBeforeRetry(attempt);
+		}
+		if (pending.length > 0) throw new DynamoDBBatchGetExhaustedError(pending.length);
+	}
+	return items;
+};
+const parseKeyReadItem = (item) => parseDynamoDBItem(boundedDynamoDBMetadataItem(item));
+const loadBundleItemsById = async (store, ids) => {
+	const uniqueIds = [...new Set(ids)];
+	if (uniqueIds.length === 0) return [];
+	return (await batchGetDynamoDBItems(store, uniqueIds.map((id) => itemKey("bundles", id)))).map(parseKeyReadItem).filter((item) => item.pk === "bundles");
+};
+const loadPatchItemsById = async (store, ids) => {
+	const uniqueIds = [...new Set(ids)];
+	if (uniqueIds.length === 0) return [];
+	return (await batchGetDynamoDBItems(store, uniqueIds.map((id) => itemKey("bundle_patches", id)))).map(parseKeyReadItem).filter((item) => item.pk === "bundle_patches");
+};
+const loadMetadataCount = async (store, model) => {
+	if (model !== "bundles" && model !== "bundle_patches") return void 0;
+	const field = model === "bundles" ? "bundles" : "patches";
+	const { Item } = await store.client.send(new GetCommand({
+		TableName: store.tableName,
+		Key: {
+			pk: "_hot-updater",
+			sk: "limits.metadata"
+		},
+		ConsistentRead: true,
+		ProjectionExpression: "#count",
+		ExpressionAttributeNames: { "#count": field }
+	}));
+	const count = Item?.[field];
+	return typeof count === "number" && Number.isSafeInteger(count) && count >= 0 ? count : void 0;
+};
+var DynamoDBPatchIndexConsistencyError = class extends Error {
+	name = "DynamoDBPatchIndexConsistencyError";
+	constructor(bundleId, expectedCount) {
+		super(`DynamoDB patch index did not converge to ${expectedCount} rows for bundle "${bundleId}"`);
+		this.bundleId = bundleId;
+		this.expectedCount = expectedCount;
+	}
+};
+const waitForIndex = (attempt) => new Promise((resolve) => setTimeout(resolve, 20 * (attempt + 1)));
+const queryCompleteOwnerPatches = async (store, indexName, bundleId) => {
+	const owner = await loadBundleItem(store, bundleId);
+	if (!owner || owner.owned_patch_count === 0) return [];
+	for (let attempt = 0; attempt < 3; attempt++) {
+		const patchIds = await queryOwnerPatchIds(store, indexName, bundleId);
+		const patchIdSet = new Set(patchIds);
+		const patches = (await loadPatchItemsById(store, patchIds)).filter(({ row }) => row.bundle_id === bundleId);
+		if (patchIds.length === owner.owned_patch_count && patchIdSet.size === owner.owned_patch_count && patches.length === owner.owned_patch_count && patches.every(({ sk }) => patchIdSet.has(sk))) return patches.map(({ row }) => row).sort((left, right) => left.order_index - right.order_index || left.id.localeCompare(right.id));
+		if (attempt < 2) await waitForIndex(attempt);
+	}
+	throw new DynamoDBPatchIndexConsistencyError(bundleId, owner.owned_patch_count);
+};
+const queryCompleteOwnersPatches = async (store, indexName, bundleIds) => {
+	const owners = (await loadBundleItemsById(store, bundleIds)).filter(({ owned_patch_count }) => owned_patch_count > 0);
+	const firstOwner = owners[0];
+	if (!firstOwner) return [];
+	let failedOwner = firstOwner;
+	for (let attempt = 0; attempt < 3; attempt++) {
+		const candidateIdsByOwner = await Promise.all(owners.map(({ sk }) => queryOwnerPatchIds(store, indexName, sk)));
+		const patches = await loadPatchItemsById(store, candidateIdsByOwner.flat());
+		const patchesById = new Map(patches.map((patch) => [patch.sk, patch]));
+		const mismatchedOwner = owners.find((owner, ownerIndex) => {
+			const ids = candidateIdsByOwner[ownerIndex] ?? [];
+			const uniqueIds = new Set(ids);
+			return ids.length !== owner.owned_patch_count || uniqueIds.size !== owner.owned_patch_count || ids.some((id) => patchesById.get(id)?.row.bundle_id !== owner.sk);
+		});
+		if (!mismatchedOwner) return patches.map(({ row }) => row);
+		failedOwner = mismatchedOwner;
+		if (attempt < 2) await waitForIndex(attempt);
+	}
+	throw new DynamoDBPatchIndexConsistencyError(failedOwner.sk, failedOwner.owned_patch_count);
+};
+const createDynamoDBBundlePatchTable = (store, indexName) => ({ findByBundleIds: (bundleIds) => bundleIds.length === 0 ? Promise.resolve([]) : queryCompleteOwnersPatches(store, indexName, bundleIds) });
+const compare = (left, right) => {
+	if (typeof left === "number" && typeof right === "number") return left - right;
+	if (left == null) return right == null ? 0 : -1;
+	if (right == null) return 1;
+	return JSON.stringify(left).localeCompare(JSON.stringify(right));
+};
+const compareString = (actual, expected, mode, predicate) => {
+	if (typeof actual !== "string") return false;
+	return mode === "insensitive" ? predicate(actual.toLocaleLowerCase(), expected.toLocaleLowerCase()) : predicate(actual, expected);
+};
+const matchesCondition = (row, condition) => {
+	const actual = Reflect.get(row, condition.field);
+	const expected = Reflect.get(condition, "value");
+	switch (Reflect.get(condition, "operator") ?? "eq") {
+		case "eq": return typeof expected === "string" ? compareString(actual, expected, Reflect.get(condition, "mode"), (value, query) => value === query) : actual === expected;
+		case "ne":
+			if (actual == null) return false;
+			return typeof expected === "string" ? !compareString(actual, expected, Reflect.get(condition, "mode"), (value, query) => value === query) : actual !== expected;
+		case "gt": return actual != null && compare(actual, expected) > 0;
+		case "gte": return actual != null && compare(actual, expected) >= 0;
+		case "lt": return actual != null && compare(actual, expected) < 0;
+		case "lte": return actual != null && compare(actual, expected) <= 0;
+		case "in": return Array.isArray(expected) && expected.some((candidate) => candidate === actual);
+		case "not_in": return Array.isArray(expected) && (expected.length === 0 || actual != null && expected.every((candidate) => candidate !== actual));
+		case "contains": return typeof expected === "string" ? compareString(actual, expected, Reflect.get(condition, "mode"), (value, query) => value.includes(query)) : false;
+		case "starts_with": return typeof expected === "string" ? compareString(actual, expected, Reflect.get(condition, "mode"), (value, query) => value.startsWith(query)) : false;
+		case "ends_with": return typeof expected === "string" ? compareString(actual, expected, Reflect.get(condition, "mode"), (value, query) => value.endsWith(query)) : false;
+		default: return false;
+	}
+};
+const matchesDynamoDBWhere = (row, where) => {
+	if (!where || where.length === 0) return true;
+	let result = matchesCondition(row, where[0]);
+	for (const condition of where.slice(1)) {
+		const current = matchesCondition(row, condition);
+		result = condition.connector === "OR" ? result || current : result && current;
+	}
+	return result;
+};
+const compareRows = (left, right, orderBy) => {
+	for (const clause of orderBy) {
+		const leftValue = Reflect.get(left, clause.field);
+		const rightValue = Reflect.get(right, clause.field);
+		if (leftValue == null || rightValue == null) {
+			if (leftValue == null && rightValue == null) continue;
+			const nulls = clause.nulls ?? (clause.direction === "asc" ? "last" : "first");
+			const order = leftValue == null ? -1 : 1;
+			return nulls === "first" ? order : -order;
+		}
+		const order = compare(leftValue, rightValue);
+		if (order !== 0) return clause.direction === "asc" ? order : -order;
+	}
+	return 0;
+};
+const distinctKey = (row, distinctOn) => JSON.stringify(distinctOn.fields.map((field) => Reflect.get(row, field)));
+const queryDynamoDBRows = (rows, input) => {
+	const filtered = rows.filter((row) => matchesDynamoDBWhere(row, input.where));
+	const orderBy = input.orderBy;
+	const ordered = orderBy ? filtered.toSorted((left, right) => compareRows(left, right, orderBy)) : filtered;
+	const distinctOn = input.distinctOn;
+	const distinct = distinctOn ? (() => {
+		const seen = /* @__PURE__ */ new Set();
+		return ordered.filter((row) => {
+			const key = distinctKey(row, distinctOn);
+			if (seen.has(key)) return false;
+			seen.add(key);
+			return true;
+		});
+	})() : ordered;
+	const offset = input.offset ?? 0;
+	return distinct.slice(offset, offset + (input.limit ?? 100));
+};
+const countDistinctDynamoDBRows = (rows, fields) => {
+	if (fields === void 0) return rows.length;
+	return new Set(rows.map((row) => JSON.stringify(fields.map((field) => Reflect.get(row, field))))).size;
+};
+const createDynamoDBBundle = async (store, row) => {
+	const counter = metadataUpdate(store, { bundles: 1 });
+	if (!counter) return;
+	await commitDynamoDBTransaction(store, [counter, { Put: {
+		TableName: store.tableName,
+		Item: boundedDynamoDBMetadataItem(toDynamoDBBundleItem(row)),
+		ConditionExpression: "attribute_not_exists(#pk)",
+		ExpressionAttributeNames: { "#pk": "pk" }
+	} }]);
+};
+const createDynamoDBPatch = async (store, row) => {
+	const bundleIds = [...new Set([row.bundle_id, row.base_bundle_id])];
+	const counter = metadataUpdate(store, { bundle_patches: 1 });
+	if (!counter) return;
+	await commitDynamoDBTransaction(store, [
+		counter,
+		...bundleIds.map((bundleId) => updateBundleRelation(store, bundleId, 1, bundleId === row.bundle_id ? 1 : 0)),
+		{ Put: {
+			TableName: store.tableName,
+			Item: boundedDynamoDBMetadataItem(toDynamoDBPatchItem(row)),
+			ConditionExpression: "attribute_not_exists(#pk)",
+			ExpressionAttributeNames: { "#pk": "pk" }
+		} }
+	]);
+};
+const replaceDynamoDBBundle = async (store, current, row) => {
+	await store.client.send(new PutCommand({
+		TableName: store.tableName,
+		Item: boundedDynamoDBMetadataItem(toDynamoDBBundleItem(row, current.version + 1, current.relation_count, current.owned_patch_count)),
+		ConditionExpression: "#version = :currentVersion",
+		ExpressionAttributeNames: { "#version": "version" },
+		ExpressionAttributeValues: { ":currentVersion": current.version }
+	}));
+};
+const deleteAction = (store, item) => ({ Delete: {
+	TableName: store.tableName,
+	Key: {
+		pk: item.pk,
+		sk: item.sk
+	},
+	ConditionExpression: "#version = :currentVersion",
+	ExpressionAttributeNames: { "#version": "version" },
+	ExpressionAttributeValues: { ":currentVersion": item.version }
+} });
+const deleteDynamoDBPatch = async (store, item) => {
+	const counter = metadataUpdate(store, { bundle_patches: -1 });
+	if (!counter) return;
+	await commitDynamoDBTransaction(store, [
+		counter,
+		...[...new Set([item.row.bundle_id, item.row.base_bundle_id])].map((id) => updateBundleRelation(store, id, -1, id === item.row.bundle_id ? -1 : 0)),
+		deleteAction(store, item)
+	]);
+};
+const deleteBundle = async (store, bundle, patches) => {
+	const counter = metadataUpdate(store, {
+		bundles: -1,
+		bundle_patches: -patches.length
+	});
+	if (!counter) return;
+	const otherEndpointCounts = /* @__PURE__ */ new Map();
+	for (const { row } of patches) for (const id of new Set([row.bundle_id, row.base_bundle_id])) {
+		if (id === bundle.sk) continue;
+		const current = otherEndpointCounts.get(id) ?? {
+			owned: 0,
+			relations: 0
+		};
+		otherEndpointCounts.set(id, {
+			owned: current.owned + (id === row.bundle_id ? 1 : 0),
+			relations: current.relations + 1
+		});
+	}
+	await commitDynamoDBTransaction(store, [
+		counter,
+		...[...otherEndpointCounts].map(([id, count]) => updateBundleRelation(store, id, -count.relations, -count.owned)),
+		...patches.map((patch) => deleteAction(store, patch)),
+		deleteAction(store, bundle)
+	]);
+};
+const deleteDynamoDBBundles = async (store, bundles, allPatches) => {
+	let patches = [...allPatches];
+	const versionIncrements = /* @__PURE__ */ new Map();
+	for (const originalBundle of bundles) {
+		const bundle = {
+			...originalBundle,
+			version: originalBundle.version + (versionIncrements.get(originalBundle.sk) ?? 0)
+		};
+		const related = patches.filter(({ row }) => row.bundle_id === bundle.sk || row.base_bundle_id === bundle.sk);
+		await deleteBundle(store, bundle, related);
+		const updatedBundleIds = new Set(related.flatMap(({ row }) => [row.bundle_id, row.base_bundle_id]));
+		updatedBundleIds.delete(bundle.sk);
+		for (const id of updatedBundleIds) versionIncrements.set(id, (versionIncrements.get(id) ?? 0) + 1);
+		const removedPatchIds = new Set(related.map(({ sk }) => sk));
+		patches = patches.filter(({ sk }) => !removedPatchIds.has(sk));
+	}
+};
+var DynamoDBUnsupportedModelError = class extends Error {
+	name = "DynamoDBUnsupportedModelError";
+	constructor() {
+		super("DynamoDB received an unsupported database model");
+	}
+};
+const distinctFields = (fields) => fields;
+const exactDynamoDBField = (where, fieldName) => {
+	const conditions = (where ?? []).filter((condition) => Reflect.get(condition, "field") === fieldName);
+	if (conditions.length !== 1) return void 0;
+	const condition = conditions[0];
+	if ((Reflect.get(condition, "operator") ?? "eq") !== "eq" || Reflect.get(condition, "mode") === "insensitive") return;
+	const value = Reflect.get(condition, "value");
+	return typeof value === "string" ? value : void 0;
+};
+const createDynamoDBCrud = (store, updateIndexName) => ({
+	async create(input) {
+		switch (input.model) {
+			case "bundles":
+				await createDynamoDBBundle(store, input.data);
+				return input.data;
+			case "bundle_patches":
+				await createDynamoDBPatch(store, input.data);
+				return input.data;
+			case "releases": {
+				const channel = await loadChannelItem(store, input.data.channel_id);
+				if (channel === void 0) throw new DynamoDBStoredItemError();
+				await commitDynamoDBTransaction(store, [
+					updateChannelReferenceCount(store, channel, 1),
+					{ Put: {
+						TableName: store.tableName,
+						Item: boundedDynamoDBMetadataItem(toDynamoDBReleaseItem(input.data)),
+						ConditionExpression: "attribute_not_exists(#pk)",
+						ExpressionAttributeNames: { "#pk": "pk" }
+					} },
+					{ Put: {
+						TableName: store.tableName,
+						Item: releaseLocatorItem(input.data),
+						ConditionExpression: "attribute_not_exists(#pk)",
+						ExpressionAttributeNames: { "#pk": "pk" }
+					} }
+				]);
+				return input.data;
+			}
+			case "release_catalogs":
+				await store.client.send(new PutCommand({
+					TableName: store.tableName,
+					Item: boundedDynamoDBCatalogItem(toDynamoDBReleaseCatalogItem(input.data)),
+					ConditionExpression: "attribute_not_exists(#pk)",
+					ExpressionAttributeNames: { "#pk": "pk" }
+				}));
+				return input.data;
+			case "channels": return (await insertDynamoDBChannel(store, {
+				row: input.data,
+				onConflict: "returnExisting"
+			})).row;
+		}
+		throw new DynamoDBUnsupportedModelError();
+	},
+	async update(input) {
+		if (input.model === "releases") {
+			const id = exactDynamoDBId(input.where);
+			if (id === void 0) throw new DynamoDBUnsupportedModelError();
+			const current = await loadReleaseItem(store, id);
+			if (current === void 0) return null;
+			const updated = {
+				...current.row,
+				...input.update
+			};
+			const nextPartition = releaseScopePartition(updated.scope_key);
+			const moved = current.pk !== nextPartition;
+			await commitDynamoDBTransaction(store, [
+				...moved ? [{ Delete: {
+					TableName: store.tableName,
+					Key: {
+						pk: current.pk,
+						sk: current.sk
+					},
+					ConditionExpression: "#version = :version",
+					ExpressionAttributeNames: { "#version": "version" },
+					ExpressionAttributeValues: { ":version": current.version }
+				} }] : [],
+				{ Put: {
+					TableName: store.tableName,
+					Item: boundedDynamoDBMetadataItem(toDynamoDBReleaseItem(updated, current.version + 1)),
+					ConditionExpression: moved ? "attribute_not_exists(#pk)" : "#version = :version",
+					ExpressionAttributeNames: moved ? { "#pk": "pk" } : { "#version": "version" },
+					...moved ? {} : { ExpressionAttributeValues: { ":version": current.version } }
+				} },
+				{ Put: {
+					TableName: store.tableName,
+					Item: releaseLocatorItem(updated),
+					ConditionExpression: "#scopeKey = :scopeKey",
+					ExpressionAttributeNames: { "#scopeKey": "scope_key" },
+					ExpressionAttributeValues: { ":scopeKey": current.row.scope_key }
+				} }
+			]);
+			return updated;
+		}
+		if (input.model === "release_catalogs") {
+			const scopeKey = exactDynamoDBField(input.where, "scope_key");
+			if (scopeKey === void 0) throw new DynamoDBUnsupportedModelError();
+			const current = await loadReleaseCatalogItem(store, scopeKey);
+			if (current === void 0) return null;
+			const updated = {
+				...current.row,
+				...input.update
+			};
+			await store.client.send(new PutCommand({
+				TableName: store.tableName,
+				Item: boundedDynamoDBCatalogItem(toDynamoDBReleaseCatalogItem(updated, current.version + 1)),
+				ConditionExpression: "#version = :version",
+				ExpressionAttributeNames: { "#version": "version" },
+				ExpressionAttributeValues: { ":version": current.version }
+			}));
+			return updated;
+		}
+		if (input.model !== "bundles") throw new DynamoDBUnsupportedModelError();
+		const id = exactDynamoDBId(input.where);
+		const current = id === void 0 ? (await loadBundleItems(store)).find(({ row }) => matchesDynamoDBWhere(row, input.where)) : await loadBundleItem(store, id);
+		if (!current) return null;
+		const updated = {
+			...current.row,
+			...input.update
+		};
+		await replaceDynamoDBBundle(store, current, updated);
+		return updated;
+	},
+	async delete(input) {
+		if (input.model === "channels") {
+			const id = exactDynamoDBId(input.where);
+			if (id !== void 0) await deleteDynamoDBChannel(store, { id });
+			return;
+		}
+		if (input.model === "bundle_patches") {
+			const items = (await loadPatchItems(store)).filter(({ row }) => matchesDynamoDBWhere(row, input.where));
+			for (const item of items) await deleteDynamoDBPatch(store, item);
+			return;
+		}
+		if (input.model === "releases") {
+			const items = (await loadReleaseItems(store)).filter(({ row }) => matchesDynamoDBWhere(row, input.where));
+			for (const item of items) {
+				const channel = await loadChannelItem(store, item.row.channel_id);
+				if (channel === void 0) throw new DynamoDBStoredItemError();
+				await commitDynamoDBTransaction(store, [
+					updateChannelReferenceCount(store, channel, -1),
+					deleteAction(store, item),
+					{ Delete: {
+						TableName: store.tableName,
+						Key: {
+							pk: DYNAMODB_RELEASE_ID_PARTITION,
+							sk: item.sk
+						},
+						ConditionExpression: "#scopeKey = :scopeKey",
+						ExpressionAttributeNames: { "#scopeKey": "scope_key" },
+						ExpressionAttributeValues: { ":scopeKey": item.row.scope_key }
+					} }
+				]);
+			}
+			return;
+		}
+		if (input.model !== "bundles") throw new DynamoDBUnsupportedModelError();
+		const bundleItems = (await loadBundleItems(store)).filter(({ row }) => matchesDynamoDBWhere(row, input.where));
+		if (bundleItems.length === 0) return;
+		await deleteDynamoDBBundles(store, bundleItems, await loadPatchItems(store));
+	},
+	async count(input) {
+		if ((input.where === void 0 || input.where.length === 0) && input.distinct === void 0) {
+			const count = await loadMetadataCount(store, input.model);
+			if (count !== void 0) return count;
+		}
+		switch (input.model) {
+			case "bundles": return countDistinctDynamoDBRows((await loadBundleItems(store)).map(({ row }) => row).filter((row) => matchesDynamoDBWhere(row, input.where)), distinctFields(input.distinct));
+			case "bundle_patches": {
+				const ownerId = exactDynamoDBPatchOwner(input.where);
+				return countDistinctDynamoDBRows((ownerId ? await queryCompleteOwnerPatches(store, updateIndexName, ownerId) : (await loadPatchItems(store)).map(({ row }) => row)).filter((row) => matchesDynamoDBWhere(row, input.where)), distinctFields(input.distinct));
+			}
+			case "releases": {
+				const scopeKey = exactDynamoDBField(input.where, "scope_key");
+				return countDistinctDynamoDBRows((scopeKey === void 0 ? await loadReleaseItems(store) : await loadReleaseItemsByScope(store, scopeKey)).map(({ row }) => row).filter((row) => matchesDynamoDBWhere(row, input.where)), distinctFields(input.distinct));
+			}
+		}
+		throw new DynamoDBUnsupportedModelError();
+	},
+	async findOne(input) {
+		const id = exactDynamoDBId(input.where);
+		switch (input.model) {
+			case "bundles":
+				if (id !== void 0) return (await loadBundleItem(store, id))?.row ?? null;
+				return (await loadBundleItems(store)).map(({ row }) => row).find((row) => matchesDynamoDBWhere(row, input.where)) ?? null;
+			case "bundle_patches":
+				if (id !== void 0) return (await loadPatchItem(store, id))?.row ?? null;
+				{
+					const ownerId = exactDynamoDBPatchOwner(input.where);
+					if (ownerId === void 0) break;
+					return (await queryCompleteOwnerPatches(store, updateIndexName, ownerId)).find((row) => matchesDynamoDBWhere(row, input.where)) ?? null;
+				}
+				break;
+			case "channels":
+				if (id !== void 0) return (await loadChannelItem(store, id))?.row ?? null;
+				return (await loadChannelItems(store)).map(({ row }) => row).find((row) => matchesDynamoDBWhere(row, input.where)) ?? null;
+			case "releases":
+				if (id !== void 0) return (await loadReleaseItem(store, id))?.row ?? null;
+				{
+					const scopeKey = exactDynamoDBField(input.where, "scope_key");
+					return (scopeKey === void 0 ? await loadReleaseItems(store) : await loadReleaseItemsByScope(store, scopeKey)).map(({ row }) => row).find((row) => matchesDynamoDBWhere(row, input.where)) ?? null;
+				}
+			case "release_catalogs": {
+				const scopeKey = exactDynamoDBField(input.where, "scope_key");
+				if (scopeKey !== void 0) return (await loadReleaseCatalogItem(store, scopeKey))?.row ?? null;
+				return (await loadReleaseCatalogItems(store)).map(({ row }) => row).find((row) => matchesDynamoDBWhere(row, input.where)) ?? null;
+			}
+		}
+		if (input.model === "bundle_patches") return (await loadPatchItems(store)).map(({ row }) => row).find((row) => matchesDynamoDBWhere(row, input.where)) ?? null;
+		throw new DynamoDBUnsupportedModelError();
+	},
+	async findMany(input) {
+		if (input.limit === 0) return [];
+		switch (input.model) {
+			case "bundles": {
+				const ids = exactDynamoDBBundleIds(input.where);
+				if (ids !== void 0) return queryDynamoDBRows((await loadBundleItemsById(store, ids)).map(({ row }) => row), input);
+				const orderBy = input.orderBy;
+				const direction = orderBy?.[0]?.direction;
+				if ((input.offset ?? 0) === 0 && input.distinctOn === void 0 && orderBy?.length === 1 && orderBy[0]?.field === "id" && (direction === "asc" || direction === "desc")) return (await queryBundleItemsPage(store, {
+					direction,
+					limit: input.limit ?? 100,
+					matches: (row) => matchesDynamoDBWhere(row, input.where),
+					start: dynamoDBBundlePageStart(input.where, direction)
+				})).map(({ row }) => row);
+				return queryDynamoDBRows((await loadBundleItems(store)).map(({ row }) => row), input);
+			}
+			case "bundle_patches": {
+				const ownerIds = exactDynamoDBPatchOwners(input.where);
+				if (ownerIds !== void 0) {
+					const ownerId = ownerIds.length === 1 ? ownerIds[0] : void 0;
+					return queryDynamoDBRows(ownerId !== void 0 ? await queryCompleteOwnerPatches(store, updateIndexName, ownerId) : await queryCompleteOwnersPatches(store, updateIndexName, ownerIds), input);
+				}
+				return queryDynamoDBRows((await loadPatchItems(store)).map(({ row }) => row), input);
+			}
+			case "channels": return queryDynamoDBRows((await loadChannelItems(store)).map(({ row }) => row), input);
+			case "releases": {
+				const scopeKey = exactDynamoDBField(input.where, "scope_key");
+				return queryDynamoDBRows((scopeKey === void 0 ? await loadReleaseItems(store) : await loadReleaseItemsByScope(store, scopeKey)).map(({ row }) => row), input);
+			}
+			case "release_catalogs": return queryDynamoDBRows((await loadReleaseCatalogItems(store)).map(({ row }) => row), input);
+		}
+		throw new DynamoDBUnsupportedModelError();
+	},
+	insertChannel: (input) => insertDynamoDBChannel(store, input),
+	deleteChannel: (input) => deleteDynamoDBChannel(store, input)
+});
+var DynamoDBDuplicatePatchError = class extends Error {
+	name = "DynamoDBDuplicatePatchError";
+	constructor(patchId) {
+		super(`DynamoDB bundle mutation contains duplicate patch "${patchId}"`);
+		this.patchId = patchId;
+	}
+};
+const putNewBundle = (store, row, relationCount, ownedPatchCount = relationCount) => ({ Put: {
+	TableName: store.tableName,
+	Item: boundedDynamoDBMetadataItem(toDynamoDBBundleItem(row, 1, relationCount, ownedPatchCount)),
+	ConditionExpression: "attribute_not_exists(#pk)",
+	ExpressionAttributeNames: { "#pk": "pk" }
+} });
+const putUpdatedBundle = (store, current, row, relationCount, ownedPatchCount) => ({ Put: {
+	TableName: store.tableName,
+	Item: boundedDynamoDBMetadataItem(toDynamoDBBundleItem(row, current.version + 1, relationCount, ownedPatchCount)),
+	ConditionExpression: "#version = :currentVersion",
+	ExpressionAttributeNames: { "#version": "version" },
+	ExpressionAttributeValues: { ":currentVersion": current.version }
+} });
+const putPatch = (store, row, current) => ({ Put: {
+	TableName: store.tableName,
+	Item: boundedDynamoDBMetadataItem(toDynamoDBPatchItem(row, (current?.version ?? 0) + 1)),
+	ConditionExpression: current ? "#version = :currentVersion" : "attribute_not_exists(#pk)",
+	ExpressionAttributeNames: current ? { "#version": "version" } : { "#pk": "pk" },
+	...current ? { ExpressionAttributeValues: { ":currentVersion": current.version } } : {}
+} });
+const deletePatch = (store, item) => ({ Delete: {
+	TableName: store.tableName,
+	Key: itemKey(item.pk, item.sk),
+	ConditionExpression: "#version = :currentVersion",
+	ExpressionAttributeNames: { "#version": "version" },
+	ExpressionAttributeValues: { ":currentVersion": item.version }
+} });
+var DynamoDBCommitStateError = class extends Error {
+	name = "DynamoDBCommitStateError";
+	constructor(message) {
+		super(message);
+	}
+};
+const rowsEqual = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+const putChannel = (store, row, current, referenceCount) => ({ Put: {
+	TableName: store.tableName,
+	Item: boundedDynamoDBMetadataItem(toDynamoDBChannelItem(row, (current?.version ?? 0) + 1, referenceCount)),
+	ConditionExpression: current ? "#version = :version" : "attribute_not_exists(#pk)",
+	ExpressionAttributeNames: current ? { "#version": "version" } : { "#pk": "pk" },
+	...current ? { ExpressionAttributeValues: { ":version": current.version } } : {}
+} });
+const deleteChannelActions = (store, current) => [{ Delete: {
+	TableName: store.tableName,
+	Key: itemKey(DYNAMODB_CHANNEL_PARTITION, current.sk),
+	ConditionExpression: "#version = :version",
+	ExpressionAttributeNames: { "#version": "version" },
+	ExpressionAttributeValues: { ":version": current.version }
+} }, { Delete: {
+	TableName: store.tableName,
+	Key: {
+		pk: DYNAMODB_CHANNEL_NAME_PARTITION,
+		sk: current.row.name
+	},
+	ConditionExpression: "#channelId = :channelId",
+	ExpressionAttributeNames: { "#channelId": "channel_id" },
+	ExpressionAttributeValues: { ":channelId": current.sk }
+} }];
+const updateChannelReferenceCount = (store, current, delta) => ({ Update: {
+	TableName: store.tableName,
+	Key: itemKey(DYNAMODB_CHANNEL_PARTITION, current.sk),
+	ConditionExpression: "#row.#name = :name" + (delta < 0 ? " AND #referenceCount >= :removal" : ""),
+	UpdateExpression: "SET #version = #version + :one ADD #referenceCount :delta",
+	ExpressionAttributeNames: {
+		"#row": "row",
+		"#name": "name",
+		"#version": "version",
+		"#referenceCount": "reference_count"
+	},
+	ExpressionAttributeValues: {
+		":name": current.row.name,
+		":one": 1,
+		":delta": delta,
+		...delta < 0 ? { ":removal": -delta } : {}
+	}
+} });
+const loadApiKeyByHash = async (store, hash) => {
+	const { Item } = await store.client.send(new GetCommand({
+		TableName: store.tableName,
+		Key: {
+			pk: DYNAMODB_API_KEY_HASH_PARTITION,
+			sk: hash
+		},
+		ConsistentRead: true
+	}));
+	if (Item === void 0) return null;
+	const id = Item.api_key_id;
+	if (typeof id !== "string") throw new DynamoDBStoredItemError();
+	return loadApiKey(store, id);
+};
+const compileAndCommitDynamoDBChanges = async (store, input) => {
+	const [originalBundleItems, originalPatchItems, originalChannelItems, originalReleaseItems, originalReleaseCatalogItems] = await Promise.all([
+		loadBundleItems(store),
+		loadPatchItems(store),
+		loadChannelItems(store),
+		loadReleaseItems(store),
+		loadReleaseCatalogItems(store)
+	]);
+	const bundles = new Map(originalBundleItems.map(({ sk, row }) => [sk, row]));
+	const patches = new Map(originalPatchItems.map(({ sk, row }) => [sk, row]));
+	const channels = new Map(originalChannelItems.map(({ sk, row }) => [sk, row]));
+	const channelNames = new Map(originalChannelItems.map(({ sk, row }) => [row.name, sk]));
+	const releases = new Map(originalReleaseItems.map(({ sk, row }) => [sk, row]));
+	const releaseCatalogs = new Map(originalReleaseCatalogItems.map(({ sk, row }) => [sk, row]));
+	const originalApiKeys = /* @__PURE__ */ new Map();
+	const apiKeys = /* @__PURE__ */ new Map();
+	const apiKeyHashes = /* @__PURE__ */ new Map();
+	const analytics = /* @__PURE__ */ new Map();
+	const rememberApiKey = (value) => {
+		if (value === null || apiKeys.has(value.row.id)) return;
+		originalApiKeys.set(value.row.id, value);
+		apiKeys.set(value.row.id, value);
+		apiKeyHashes.set(value.row.hash, value.row.id);
+	};
+	const requireReleaseReferences = (row) => {
+		if (!channels.has(row.channel_id)) throw new DynamoDBCommitStateError(`Release "${row.id}" references an invalid channel`);
+		if (row.bundle_id !== null) {
+			const bundle = bundles.get(row.bundle_id);
+			if (bundle === void 0 || bundle.platform !== row.platform) throw new DynamoDBCommitStateError(`Release "${row.id}" references an invalid bundle`);
+		}
+	};
+	for (const expectation of input.expectations ?? []) {
+		const actualVersion = expectation.model === "releases" ? releases.get(expectation.id)?.revision ?? null : releaseCatalogs.get(expectation.scopeKey)?.generation ?? null;
+		const expectedVersion = expectation.model === "releases" ? expectation.revision : expectation.generation;
+		if (actualVersion !== expectedVersion) return {
+			committed: false,
+			conflict: {
+				actualVersion,
+				changeIndex: -1,
+				expectedVersion,
+				key: expectation.model === "releases" ? expectation.id : expectation.scopeKey,
+				model: expectation.model,
+				reason: "version_conflict"
+			}
+		};
+	}
+	for (const [changeIndex, change] of input.changes.entries()) switch (change.model) {
+		case "channels":
+			if (change.operation === "insert") {
+				if (channelNames.get(change.row.name) !== void 0) break;
+				if (channels.get(change.row.id) !== void 0) throw new DynamoDBCommitStateError(`Channel id "${change.row.id}" already exists`);
+				channels.set(change.row.id, change.row);
+				channelNames.set(change.row.name, change.row.id);
+			} else {
+				const current = channels.get(change.where.id);
+				if (current === void 0) break;
+				if ([...releases.values()].some(({ channel_id }) => channel_id === change.where.id)) return {
+					committed: false,
+					conflict: {
+						changeIndex,
+						reason: "referenced"
+					}
+				};
+				channels.delete(change.where.id);
+				channelNames.delete(current.name);
+			}
+			break;
+		case "bundles":
+			if (change.operation === "insert") {
+				if (bundles.has(change.row.id)) throw new DynamoDBCommitStateError(`Bundle "${change.row.id}" already exists`);
+				bundles.set(change.row.id, change.row);
+			} else {
+				const current = bundles.get(change.where.id);
+				if (current === void 0) {
+					if (change.operation === "update") return {
+						committed: false,
+						conflict: {
+							changeIndex,
+							reason: "not_found"
+						}
+					};
+					break;
+				}
+				if (change.operation === "update") {
+					const row = {
+						...current,
+						...change.update
+					};
+					bundles.set(row.id, row);
+				} else {
+					if ([...releases.values()].some(({ bundle_id }) => bundle_id === change.where.id)) return {
+						committed: false,
+						conflict: {
+							changeIndex,
+							reason: "referenced"
+						}
+					};
+					bundles.delete(change.where.id);
+					for (const [id, patch] of patches) if (patch.bundle_id === change.where.id || patch.base_bundle_id === change.where.id) patches.delete(id);
+				}
+			}
+			break;
+		case "releases":
+			if (change.operation === "insert") {
+				requireReleaseReferences(change.row);
+				if (releases.has(change.row.id)) throw new DynamoDBCommitStateError(`Release "${change.row.id}" already exists`);
+				releases.set(change.row.id, change.row);
+			} else {
+				const current = releases.get(change.where.id);
+				if (current === void 0) {
+					if (change.operation === "update") return {
+						committed: false,
+						conflict: {
+							changeIndex,
+							reason: "not_found"
+						}
+					};
+					break;
+				}
+				if (change.operation === "update") {
+					const row = {
+						...current,
+						...change.update
+					};
+					requireReleaseReferences(row);
+					releases.set(row.id, row);
+				} else releases.delete(change.where.id);
+			}
+			break;
+		case "releaseCatalogs":
+			if (!channels.has(change.row.channel_id)) throw new DynamoDBCommitStateError(`Release catalog "${change.row.scope_key}" references an invalid channel`);
+			releaseCatalogs.set(change.row.scope_key, change.row);
+			break;
+		case "bundlePatches":
+			if (change.operation === "insert") {
+				if (!bundles.has(change.row.bundle_id) || !bundles.has(change.row.base_bundle_id)) throw new DynamoDBCommitStateError(`Patch "${change.row.id}" references a missing bundle`);
+				if (patches.has(change.row.id)) throw new DynamoDBDuplicatePatchError(change.row.id);
+				patches.set(change.row.id, change.row);
+			} else for (const [id, patch] of patches) if (patch.bundle_id === change.where.bundleId) patches.delete(id);
+			break;
+		case "analytics": {
+			const key = analyticsSortKey(change.row);
+			if (analytics.has(key)) throw new DynamoDBCommitStateError(`Analytics event "${change.row.id}" is duplicated`);
+			analytics.set(key, change.row);
+			break;
+		}
+		case "apiKeys":
+			if (change.operation === "insert") {
+				rememberApiKey(await loadApiKeyByHash(store, change.row.hash));
+				if (apiKeyHashes.has(change.row.hash)) break;
+				rememberApiKey(await loadApiKey(store, change.row.id));
+				if (apiKeys.has(change.row.id)) throw new DynamoDBCommitStateError(`API key id "${change.row.id}" already exists`);
+				const inserted = {
+					row: change.row,
+					version: 1
+				};
+				apiKeys.set(change.row.id, inserted);
+				apiKeyHashes.set(change.row.hash, change.row.id);
+			} else {
+				rememberApiKey(await loadApiKey(store, change.where.id));
+				const current = apiKeys.get(change.where.id);
+				if (current === void 0) return {
+					committed: false,
+					conflict: {
+						changeIndex,
+						reason: "not_found"
+					}
+				};
+				apiKeys.set(change.where.id, {
+					row: {
+						...current.row,
+						revoked_at_ms: change.update.revokedAtMs
+					},
+					version: current.version
+				});
+			}
+			break;
+	}
+	const relationCounts = /* @__PURE__ */ new Map();
+	const ownedPatchCounts = /* @__PURE__ */ new Map();
+	for (const patch of patches.values()) {
+		for (const id of new Set([patch.bundle_id, patch.base_bundle_id])) relationCounts.set(id, (relationCounts.get(id) ?? 0) + 1);
+		ownedPatchCounts.set(patch.bundle_id, (ownedPatchCounts.get(patch.bundle_id) ?? 0) + 1);
+	}
+	const channelReferenceCounts = /* @__PURE__ */ new Map();
+	for (const release of releases.values()) channelReferenceCounts.set(release.channel_id, (channelReferenceCounts.get(release.channel_id) ?? 0) + 1);
+	const actions = [];
+	const originalChannels = new Map(originalChannelItems.map((item) => [item.sk, item]));
+	for (const original of originalChannelItems) if (!channels.has(original.sk)) actions.push(...deleteChannelActions(store, original));
+	for (const [id, row] of channels) {
+		const original = originalChannels.get(id);
+		const referenceCount = channelReferenceCounts.get(id) ?? 0;
+		if (original === void 0) {
+			actions.push(putChannel(store, row, original, referenceCount));
+			actions.push({ Put: {
+				TableName: store.tableName,
+				Item: {
+					pk: DYNAMODB_CHANNEL_NAME_PARTITION,
+					sk: row.name,
+					channel_id: id
+				},
+				ConditionExpression: "attribute_not_exists(#pk)",
+				ExpressionAttributeNames: { "#pk": "pk" }
+			} });
+		} else {
+			if (!rowsEqual(original.row, row)) throw new DynamoDBCommitStateError(`Channel "${id}" cannot be updated`);
+			const delta = referenceCount - original.reference_count;
+			if (delta !== 0) actions.push(updateChannelReferenceCount(store, original, delta));
+		}
+	}
+	const originalBundles = new Map(originalBundleItems.map((item) => [item.sk, item]));
+	for (const original of originalBundleItems) if (!bundles.has(original.sk)) actions.push(deleteAction(store, original));
+	for (const [id, row] of bundles) {
+		const original = originalBundles.get(id);
+		const relationCount = relationCounts.get(id) ?? 0;
+		const ownedPatchCount = ownedPatchCounts.get(id) ?? 0;
+		if (original === void 0) actions.push(putNewBundle(store, row, relationCount, ownedPatchCount));
+		else if (!rowsEqual(original.row, row)) actions.push(putUpdatedBundle(store, original, row, relationCount, ownedPatchCount));
+		else {
+			const relationDelta = relationCount - original.relation_count;
+			const ownedPatchDelta = ownedPatchCount - original.owned_patch_count;
+			if (relationDelta !== 0 || ownedPatchDelta !== 0) actions.push(updateBundleRelation(store, id, relationDelta, ownedPatchDelta));
+		}
+	}
+	const originalPatches = new Map(originalPatchItems.map((item) => [item.sk, item]));
+	for (const original of originalPatchItems) if (!patches.has(original.sk)) actions.push(deletePatch(store, original));
+	for (const [id, row] of patches) {
+		const original = originalPatches.get(id);
+		if (original === void 0 || !rowsEqual(original.row, row)) actions.push(putPatch(store, row, original));
+	}
+	const originalReleases = new Map(originalReleaseItems.map((item) => [item.sk, item]));
+	for (const original of originalReleaseItems) {
+		if (releases.get(original.sk) !== void 0) continue;
+		actions.push(deleteAction(store, original));
+		actions.push({ Delete: {
+			TableName: store.tableName,
+			Key: {
+				pk: DYNAMODB_RELEASE_ID_PARTITION,
+				sk: original.sk
+			},
+			ConditionExpression: "#scopeKey = :scopeKey",
+			ExpressionAttributeNames: { "#scopeKey": "scope_key" },
+			ExpressionAttributeValues: { ":scopeKey": original.row.scope_key }
+		} });
+	}
+	for (const [id, row] of releases) {
+		const original = originalReleases.get(id);
+		if (original === void 0) {
+			actions.push({ Put: {
+				TableName: store.tableName,
+				Item: boundedDynamoDBMetadataItem(toDynamoDBReleaseItem(row)),
+				ConditionExpression: "attribute_not_exists(#pk)",
+				ExpressionAttributeNames: { "#pk": "pk" }
+			} });
+			actions.push({ Put: {
+				TableName: store.tableName,
+				Item: releaseLocatorItem(row),
+				ConditionExpression: "attribute_not_exists(#pk)",
+				ExpressionAttributeNames: { "#pk": "pk" }
+			} });
+		} else if (!rowsEqual(original.row, row)) {
+			const moved = original.row.scope_key !== row.scope_key;
+			if (moved) actions.push(deleteAction(store, original));
+			actions.push({ Put: {
+				TableName: store.tableName,
+				Item: boundedDynamoDBMetadataItem(toDynamoDBReleaseItem(row, original.version + 1)),
+				ConditionExpression: moved ? "attribute_not_exists(#pk)" : "#version = :version",
+				ExpressionAttributeNames: moved ? { "#pk": "pk" } : { "#version": "version" },
+				...moved ? {} : { ExpressionAttributeValues: { ":version": original.version } }
+			} });
+			if (moved) actions.push({ Put: {
+				TableName: store.tableName,
+				Item: releaseLocatorItem(row),
+				ConditionExpression: "#scopeKey = :scopeKey",
+				ExpressionAttributeNames: { "#scopeKey": "scope_key" },
+				ExpressionAttributeValues: { ":scopeKey": original.row.scope_key }
+			} });
+		}
+	}
+	const originalReleaseCatalogs = new Map(originalReleaseCatalogItems.map((item) => [item.sk, item]));
+	for (const [scopeKey, row] of releaseCatalogs) {
+		const original = originalReleaseCatalogs.get(scopeKey);
+		if (original === void 0 || !rowsEqual(original.row, row)) actions.push({ Put: {
+			TableName: store.tableName,
+			Item: boundedDynamoDBCatalogItem(toDynamoDBReleaseCatalogItem(row, (original?.version ?? 0) + 1)),
+			ConditionExpression: original ? "#version = :version" : "attribute_not_exists(#pk)",
+			ExpressionAttributeNames: original ? { "#version": "version" } : { "#pk": "pk" },
+			...original ? { ExpressionAttributeValues: { ":version": original.version } } : {}
+		} });
+	}
+	const changedReleaseIds = new Set([...new Set([...originalReleases.keys(), ...releases.keys()])].filter((id) => {
+		const original = originalReleases.get(id)?.row;
+		const next = releases.get(id);
+		return original === void 0 || next === void 0 || !rowsEqual(original, next);
+	}));
+	const changedCatalogScopes = new Set([...releaseCatalogs].flatMap(([scopeKey, row]) => {
+		const original = originalReleaseCatalogs.get(scopeKey)?.row;
+		return original === void 0 || !rowsEqual(original, row) ? [scopeKey] : [];
+	}));
+	for (const expectation of input.expectations ?? []) {
+		if (expectation.model === "releases" && !changedReleaseIds.has(expectation.id)) {
+			const original = originalReleases.get(expectation.id);
+			actions.push({ ConditionCheck: {
+				TableName: store.tableName,
+				Key: original === void 0 ? {
+					pk: DYNAMODB_RELEASE_ID_PARTITION,
+					sk: expectation.id
+				} : {
+					pk: original.pk,
+					sk: original.sk
+				},
+				ConditionExpression: original === void 0 ? "attribute_not_exists(#pk)" : "#version = :version",
+				ExpressionAttributeNames: original === void 0 ? { "#pk": "pk" } : { "#version": "version" },
+				...original === void 0 ? {} : { ExpressionAttributeValues: { ":version": original.version } }
+			} });
+		}
+		if (expectation.model === "releaseCatalogs" && !changedCatalogScopes.has(expectation.scopeKey)) {
+			const original = originalReleaseCatalogs.get(expectation.scopeKey);
+			actions.push({ ConditionCheck: {
+				TableName: store.tableName,
+				Key: itemKey("release_catalogs", expectation.scopeKey),
+				ConditionExpression: original === void 0 ? "attribute_not_exists(#pk)" : "#version = :version",
+				ExpressionAttributeNames: original === void 0 ? { "#pk": "pk" } : { "#version": "version" },
+				...original === void 0 ? {} : { ExpressionAttributeValues: { ":version": original.version } }
+			} });
+		}
+	}
+	const counter = metadataUpdate(store, {
+		bundles: bundles.size - originalBundles.size,
+		bundle_patches: patches.size - originalPatches.size
+	});
+	if (counter !== void 0) actions.push(counter);
+	for (const [key, row] of analytics) actions.push({ Put: {
+		TableName: store.tableName,
+		Item: boundedDynamoDBMetadataItem({
+			pk: DYNAMODB_ANALYTICS_PARTITION,
+			sk: key,
+			version: 1,
+			row
+		}),
+		ConditionExpression: "attribute_not_exists(#pk)",
+		ExpressionAttributeNames: { "#pk": "pk" }
+	} });
+	for (const [id, current] of apiKeys) {
+		const original = originalApiKeys.get(id);
+		if (original !== void 0 && rowsEqual(original.row, current.row)) continue;
+		actions.push({ Put: {
+			TableName: store.tableName,
+			Item: boundedDynamoDBMetadataItem(apiKeyItem(current.row, original === void 0 ? 1 : original.version + 1)),
+			ConditionExpression: original ? "#version = :version" : "attribute_not_exists(#pk)",
+			ExpressionAttributeNames: original ? { "#version": "version" } : { "#pk": "pk" },
+			...original ? { ExpressionAttributeValues: { ":version": original.version } } : {}
+		} });
+		if (original === void 0) actions.push({ Put: {
+			TableName: store.tableName,
+			Item: {
+				pk: DYNAMODB_API_KEY_HASH_PARTITION,
+				sk: current.row.hash,
+				api_key_id: current.row.id
+			},
+			ConditionExpression: "attribute_not_exists(#pk)",
+			ExpressionAttributeNames: { "#pk": "pk" }
+		} });
+	}
+	if (actions.length > 0) await commitDynamoDBTransaction(store, actions);
+	return { committed: true };
+};
+const isDynamoDBTransactionConflict = (error) => typeof error === "object" && error !== null && Reflect.get(error, "name") === "TransactionCanceledException";
+const createDynamoDBCommit = (store) => async (input) => {
+	try {
+		return await compileAndCommitDynamoDBChanges(store, input);
+	} catch (error) {
+		if (!isDynamoDBTransactionConflict(error)) throw error;
+		return compileAndCommitDynamoDBChanges(store, input);
+	}
+};
+const DYNAMODB_ANALYTICS_PARTITION = "bundle_events";
+const DYNAMODB_API_KEY_PARTITION = "api_keys";
+const DYNAMODB_API_KEY_HASH_PARTITION = "_hot-updater#api-key-hashes";
+const hasValidBundleEventShape = (value) => {
+	const type = field(value, "type");
+	const fromBundleId = field(value, "from_bundle_id");
+	const updateStrategy = field(value, "update_strategy");
+	return (type === "UPDATE_APPLIED" || type === "RECOVERED" || type === "RELEASE_ADOPTED") && typeof fromBundleId === "string" && (updateStrategy === "fingerprint" || updateStrategy === "appVersion") || type === "UNCHANGED" && fromBundleId === null && updateStrategy === null;
+};
+const isBundleEventRow = (value) => typeof value === "object" && value !== null && typeof field(value, "id") === "string" && typeof field(value, "install_id") === "string" && isNullableString(field(value, "from_release_id")) && isNullableString(field(value, "to_release_id")) && typeof field(value, "to_bundle_id") === "string" && (field(value, "platform") === "ios" || field(value, "platform") === "android") && typeof field(value, "received_at_ms") === "number" && hasValidBundleEventShape(value);
+const isApiKeyRow = (value) => typeof value === "object" && value !== null && typeof field(value, "id") === "string" && typeof field(value, "hash") === "string" && typeof field(value, "name") === "string" && typeof field(value, "prefix") === "string" && field(value, "role") === "client" && typeof field(value, "created_at_ms") === "number" && (field(value, "revoked_at_ms") === null || typeof field(value, "revoked_at_ms") === "number");
+const parseOfficialRowItem = (value, partition, isRow) => {
+	if (value.pk !== partition || typeof value.sk !== "string" || typeof value.version !== "number" || !isRow(value.row)) throw new DynamoDBStoredItemError();
+	return {
+		row: value.row,
+		version: value.version
+	};
+};
+const timestampSortKey = (timestampMs) => Math.trunc(timestampMs).toString().padStart(16, "0");
+const analyticsSortKey = (row) => `${timestampSortKey(row.received_at_ms)}#${row.id}`;
+const createDynamoDBAnalyticsTable = (store) => ({
+	async append(row) {
+		await store.client.send(new PutCommand({
+			TableName: store.tableName,
+			Item: boundedDynamoDBMetadataItem({
+				pk: DYNAMODB_ANALYTICS_PARTITION,
+				sk: analyticsSortKey(row),
+				version: 1,
+				row
+			}),
+			ConditionExpression: "attribute_not_exists(#pk)",
+			ExpressionAttributeNames: { "#pk": "pk" }
+		}));
+	},
+	async scan(input) {
+		if (input.limit <= 0) return [];
+		if (input.after !== void 0 && input.after.receivedAtMs >= input.beforeReceivedAtMs) return [];
+		const rows = [];
+		const afterKey = input.after === void 0 ? void 0 : `${timestampSortKey(input.after.receivedAtMs)}#${input.after.id}`;
+		let exclusiveStartKey;
+		do {
+			const page = await store.client.send(new QueryCommand({
+				TableName: store.tableName,
+				ExclusiveStartKey: exclusiveStartKey,
+				KeyConditionExpression: afterKey === void 0 ? "#pk = :pk AND #sk < :before" : "#pk = :pk AND #sk BETWEEN :after AND :before",
+				ExpressionAttributeNames: {
+					"#pk": "pk",
+					"#sk": "sk"
+				},
+				ExpressionAttributeValues: {
+					":before": `${timestampSortKey(input.beforeReceivedAtMs)}#`,
+					":pk": DYNAMODB_ANALYTICS_PARTITION,
+					...afterKey === void 0 ? {} : { ":after": afterKey }
+				},
+				Limit: input.limit - rows.length + (afterKey === void 0 ? 0 : 1),
+				ScanIndexForward: true
+			}));
+			for (const item of page.Items ?? []) {
+				if (item.sk === afterKey) continue;
+				rows.push(parseOfficialRowItem(item, DYNAMODB_ANALYTICS_PARTITION, isBundleEventRow).row);
+				if (rows.length === input.limit) return rows;
+			}
+			exclusiveStartKey = page.LastEvaluatedKey;
+		} while (exclusiveStartKey !== void 0);
+		return rows;
+	}
+});
+const apiKeyItem = (row, version) => ({
+	pk: DYNAMODB_API_KEY_PARTITION,
+	sk: row.id,
+	version,
+	row
+});
+const loadApiKey = async (store, id) => {
+	const result = await store.client.send(new GetCommand({
+		TableName: store.tableName,
+		Key: {
+			pk: DYNAMODB_API_KEY_PARTITION,
+			sk: id
+		},
+		ConsistentRead: true
+	}));
+	return result.Item === void 0 ? null : parseOfficialRowItem(result.Item, DYNAMODB_API_KEY_PARTITION, isApiKeyRow);
+};
+const createDynamoDBApiKeyTable = (store) => {
+	const findByHash = async (hash) => {
+		const lookup = await store.client.send(new GetCommand({
+			TableName: store.tableName,
+			Key: {
+				pk: DYNAMODB_API_KEY_HASH_PARTITION,
+				sk: hash
+			},
+			ConsistentRead: true
+		}));
+		const id = lookup.Item?.api_key_id;
+		if (lookup.Item === void 0) return null;
+		if (typeof id !== "string") throw new DynamoDBStoredItemError();
+		return (await loadApiKey(store, id))?.row ?? null;
+	};
+	return {
+		async create(row) {
+			if (await findByHash(row.hash) !== null) return "existing";
+			try {
+				await commitDynamoDBTransaction(store, [{ Put: {
+					TableName: store.tableName,
+					Item: boundedDynamoDBMetadataItem(apiKeyItem(row, 1)),
+					ConditionExpression: "attribute_not_exists(#pk)",
+					ExpressionAttributeNames: { "#pk": "pk" }
+				} }, { Put: {
+					TableName: store.tableName,
+					Item: {
+						pk: DYNAMODB_API_KEY_HASH_PARTITION,
+						sk: row.hash,
+						api_key_id: row.id
+					},
+					ConditionExpression: "attribute_not_exists(#pk)",
+					ExpressionAttributeNames: { "#pk": "pk" }
+				} }]);
+				return "created";
+			} catch (error) {
+				if (await findByHash(row.hash) !== null) return "existing";
+				throw error;
+			}
+		},
+		findByHash,
+		async list() {
+			const rows = [];
+			let exclusiveStartKey;
+			do {
+				const page = await store.client.send(new QueryCommand({
+					TableName: store.tableName,
+					ExclusiveStartKey: exclusiveStartKey,
+					KeyConditionExpression: "#pk = :pk",
+					ExpressionAttributeNames: { "#pk": "pk" },
+					ExpressionAttributeValues: { ":pk": DYNAMODB_API_KEY_PARTITION },
+					ConsistentRead: true
+				}));
+				rows.push(...(page.Items ?? []).map((item) => parseOfficialRowItem(item, DYNAMODB_API_KEY_PARTITION, isApiKeyRow).row));
+				exclusiveStartKey = page.LastEvaluatedKey;
+			} while (exclusiveStartKey !== void 0);
+			return rows.sort((left, right) => right.created_at_ms - left.created_at_ms || left.id.localeCompare(right.id));
+		},
+		async revoke({ id, revokedAtMs }) {
+			const current = await loadApiKey(store, id);
+			if (current === null) return null;
+			const row = {
+				...current.row,
+				revoked_at_ms: revokedAtMs
+			};
+			await store.client.send(new PutCommand({
+				TableName: store.tableName,
+				Item: boundedDynamoDBMetadataItem(apiKeyItem(row, current.version + 1)),
+				ConditionExpression: "#version = :currentVersion",
+				ExpressionAttributeNames: { "#version": "version" },
+				ExpressionAttributeValues: { ":currentVersion": current.version }
+			}));
+			return row;
+		}
+	};
+};
+const DYNAMODB_UPDATE_INDEX_NAME = "hot-updater-update-index";
+const dynamoDB = (config) => {
+	const { apiBasePath = "/release-catalogs", cloudfrontDistributionId, shouldWaitForInvalidation = false, tableName, ...clientConfig } = config;
+	const client = DynamoDBDocumentClient.from(new DynamoDBClient(clientConfig), { marshallOptions: { removeUndefinedValues: true } });
+	const cloudFront = cloudfrontDistributionId ? new CloudFrontClient({
+		credentials: clientConfig.credentials,
+		region: clientConfig.region
+	}) : null;
+	const store = {
+		client,
+		tableName
+	};
+	const crud = createDynamoDBCrud(store, DYNAMODB_UPDATE_INDEX_NAME);
+	const invalidateUpdateRoutes = async () => {
+		if (!cloudFront || !cloudfrontDistributionId) return;
+		try {
+			await invalidateCloudFront(cloudFront, cloudfrontDistributionId, [`${apiBasePath.replace(/\/+$/, "")}/*`], { shouldWait: shouldWaitForInvalidation });
+		} catch (error) {
+			console.warn("[hot-updater/aws] CloudFront invalidation failed; continuing without cache invalidation.", {
+				distributionId: cloudfrontDistributionId,
+				error: error instanceof Error ? error.message : "Unknown error"
+			});
+		}
+	};
+	const adapter = createDatabasePluginAdapter("dynamoDB", {
+		...crud,
+		commit: createDynamoDBCommit(store),
+		dispose: async () => {
+			client.destroy();
+			cloudFront?.destroy();
+		}
+	});
+	return createDatabasePlugin({
+		name: "dynamoDB",
+		models: {
+			...adapter.models,
+			bundlePatches: createDynamoDBBundlePatchTable(store, DYNAMODB_UPDATE_INDEX_NAME),
+			analytics: createDynamoDBAnalyticsTable(store),
+			apiKeys: createDynamoDBApiKeyTable(store)
+		},
+		async commit(input) {
+			const result = await adapter.commit(input);
+			if (result.committed && input.changes.some(({ model }) => model === "bundles" || model === "bundlePatches")) await invalidateUpdateRoutes();
+			return result;
+		},
+		dispose: adapter.dispose
+	});
+};
+//#endregion
+//#region iac/init/index.ts
+const AWS_AUTH_MODES = [
+	"local-session",
+	"shared-profile",
+	"sso",
+	"account"
+];
+const isAwsAuthMode = (value) => value !== void 0 && AWS_AUTH_MODES.some((mode) => mode === value);
+const AWS_REGION_VALUES = [
+	"af-south-1",
+	"ap-east-1",
+	"ap-east-2",
+	"ap-northeast-1",
+	"ap-northeast-2",
+	"ap-northeast-3",
+	"ap-south-1",
+	"ap-south-2",
+	"ap-southeast-1",
+	"ap-southeast-2",
+	"ap-southeast-3",
+	"ap-southeast-4",
+	"ap-southeast-5",
+	"ap-southeast-6",
+	"ap-southeast-7",
+	"ca-central-1",
+	"ca-west-1",
+	"cn-north-1",
+	"cn-northwest-1",
+	"eu-central-1",
+	"eu-central-2",
+	"eu-north-1",
+	"eu-south-1",
+	"eu-south-2",
+	"eu-west-1",
+	"eu-west-2",
+	"eu-west-3",
+	"il-central-1",
+	"me-central-1",
+	"me-south-1",
+	"mx-central-1",
+	"sa-east-1",
+	"us-east-1",
+	"us-east-2",
+	"us-gov-east-1",
+	"us-gov-west-1",
+	"us-west-1",
+	"us-west-2"
+];
+const isAwsRegionValue = (value) => value !== void 0 && AWS_REGION_VALUES.some((region) => region === value);
+const initProvider = {
+	label: "AWS + Lambda@Edge",
+	inputs: {
+		dynamodbTableName: {
+			envKey: "HOT_UPDATER_DYNAMODB_TABLE_NAME",
+			help: "DynamoDB metadata table name",
+			prompt: {
+				defaultValue: "hot-updater-v1",
+				message: "Enter the DynamoDB table name",
+				placeholder: "hot-updater-v1",
+				type: "text"
+			}
+		},
+		authMode: {
+			envKey: "HOT_UPDATER_AWS_AUTH_MODE",
+			help: "AWS authentication mode: local-session, shared-profile, sso, or account",
+			prompt: {
+				message: "Select the mode to login to AWS",
+				type: "select"
+			},
+			validate: isAwsAuthMode
+		},
+		profile: {
+			envKey: "HOT_UPDATER_AWS_PROFILE",
+			help: "AWS profile name",
+			requiredWhen: (inputs) => inputs.authMode === "shared-profile" || inputs.authMode === "sso",
+			requirementHint: "required for shared-profile and sso auth",
+			prompt: {
+				defaultValue: "default",
+				message: "Enter the AWS profile name",
+				placeholder: "default",
+				type: "text"
+			}
+		},
+		accessKeyId: {
+			envKey: "HOT_UPDATER_S3_ACCESS_KEY_ID",
+			help: "AWS access key ID",
+			persistence: "with-consent",
+			requiredWhen: (inputs) => inputs.authMode === "account",
+			requirementHint: "required for account auth",
+			prompt: {
+				message: "Enter your AWS Access Key ID",
+				placeholder: "AKIA...",
+				type: "text"
+			}
+		},
+		secretAccessKey: {
+			envKey: "HOT_UPDATER_S3_SECRET_ACCESS_KEY",
+			help: "AWS secret access key",
+			persistence: "with-consent",
+			requiredWhen: (inputs) => inputs.authMode === "account",
+			requirementHint: "required for account auth",
+			prompt: {
+				message: "Enter your AWS Secret Access Key",
+				type: "password"
+			}
+		},
+		bucketName: {
+			envKey: "HOT_UPDATER_S3_BUCKET_NAME",
+			help: "S3 bucket name",
+			prompt: {
+				defaultValue: "hot-updater-storage",
+				message: "Enter the name of the new S3 Bucket",
+				placeholder: "hot-updater-storage",
+				type: "text"
+			}
+		},
+		bucketRegion: {
+			envKey: "HOT_UPDATER_S3_REGION",
+			help: "S3 bucket region",
+			prompt: {
+				message: "Enter AWS region for the S3 bucket",
+				type: "select"
+			},
+			validate: isAwsRegionValue
+		},
+		lambdaName: {
+			envKey: "HOT_UPDATER_AWS_LAMBDA_NAME",
+			help: "Lambda@Edge function name",
+			prompt: {
+				defaultValue: "hot-updater-v1-edge",
+				message: "Enter the name of the Lambda@Edge function",
+				placeholder: "hot-updater-v1-edge",
+				type: "text"
+			}
+		},
+		distributionId: {
+			envKey: "HOT_UPDATER_CLOUDFRONT_DISTRIBUTION_ID",
+			help: "Existing CloudFront distribution ID",
+			optional: true
+		}
+	}
+};
+//#endregion
+//#region iac/regionLocationMap.ts
+const regionLocationMap = {
+	"af-south-1": "Cape Town, South Africa",
+	"ap-east-1": "Hong Kong",
+	"ap-east-2": "Taipei, Taiwan",
+	"ap-northeast-1": "Tokyo, Japan",
+	"ap-northeast-2": "Seoul, South Korea",
+	"ap-northeast-3": "Osaka, Japan",
+	"ap-south-1": "Mumbai, India",
+	"ap-south-2": "Hyderabad, India",
+	"ap-southeast-1": "Singapore",
+	"ap-southeast-2": "Sydney, Australia",
+	"ap-southeast-3": "Jakarta, Indonesia",
+	"ap-southeast-4": "Melbourne, Australia",
+	"ap-southeast-5": "Auckland, New Zealand",
+	"ap-southeast-6": "New Zealand",
+	"ap-southeast-7": "Thailand",
+	"ca-central-1": "Montreal, Canada",
+	"ca-west-1": "Calgary, Canada",
+	"cn-north-1": "Beijing, China",
+	"cn-northwest-1": "Ningxia, China",
+	"eu-central-1": "Frankfurt, Germany",
+	"eu-north-1": "Stockholm, Sweden",
+	"eu-south-1": "Milan, Italy",
+	"eu-south-2": "Spain",
+	"eu-west-1": "Ireland",
+	"eu-west-2": "London, UK",
+	"eu-west-3": "Paris, France",
+	"il-central-1": "Tel Aviv, Israel",
+	"me-central-1": "UAE",
+	"me-south-1": "Bahrain",
+	"mx-central-1": "Mexico",
+	"sa-east-1": "São Paulo, Brazil",
+	"us-east-1": "Virginia, USA",
+	"us-east-2": "Ohio, USA",
+	"us-gov-east-1": "US Gov East (Virginia, USA)",
+	"us-gov-west-1": "US Gov West (Oregon, USA)",
+	"us-west-1": "California, USA",
+	"us-west-2": "Oregon, USA",
+	"eu-central-2": "Zurich, Switzerland"
+};
+//#endregion
+//#region iac/awsInitInputs.ts
+const resolveAwsInitInputs = (existingEnv) => {
+	const { inputs } = initProvider;
+	const savedAuthMode = resolveInitProviderInput(existingEnv, inputs.authMode);
+	return {
 		accessKeyId: resolveInitProviderInput(existingEnv, inputs.accessKeyId),
 		authMode: isAwsAuthMode(savedAuthMode) ? savedAuthMode : void 0,
 		bucketName: resolveInitProviderInput(existingEnv, inputs.bucketName),
 		bucketRegion: resolveInitProviderInput(existingEnv, inputs.bucketRegion),
 		distributionId: resolveInitProviderInput(existingEnv, inputs.distributionId),
+		dynamodbTableName: resolveInitProviderInput(existingEnv, inputs.dynamodbTableName),
 		lambdaName: resolveInitProviderInput(existingEnv, inputs.lambdaName),
-		migrationApproved: resolveInitProviderInput(existingEnv, inputs.migrationApproved),
 		profile: resolveInitProviderInput(existingEnv, inputs.profile),
 		secretAccessKey: resolveInitProviderInput(existingEnv, inputs.secretAccessKey)
 	};
@@ -6583,6 +8362,109 @@ const resolveAwsAuth = async (existingEnv, nonInteractive = false) => {
 	}
 };
 //#endregion
+//#region iac/awsInfrastructureNames.ts
+const getAwsV1SsmParameterName = (lambdaName) => `/hot-updater/v1/${lambdaName}/keypair`;
+//#endregion
+//#region iac/awsInfrastructureState.ts
+const AWS_DISTRIBUTION_VERSION_PATHS = ["/version", "/api/check-update/version"];
+const readAwsDistributionGeneration = (payload) => {
+	if (typeof payload !== "object" || payload === null) return "unknown";
+	if ("infrastructureGeneration" in payload) return payload.infrastructureGeneration === 1 ? "v1" : "unknown";
+	return "version" in payload && typeof payload.version === "string" ? "v0" : "unknown";
+};
+const resolveAwsDistributionGeneration = async ({ domainName, fetchImpl = fetch }) => {
+	const generations = await Promise.all(AWS_DISTRIBUTION_VERSION_PATHS.map(async (path) => {
+		try {
+			const response = await fetchImpl(`https://${domainName}${path}`);
+			if (!response.ok) return "unknown";
+			return readAwsDistributionGeneration(await response.json().catch(() => void 0));
+		} catch {
+			return "unknown";
+		}
+	}));
+	if (generations.includes("v1")) return "v1";
+	if (generations.includes("v0")) return "v0";
+	return "unknown";
+};
+const assertAwsInfrastructureGeneration = async (input) => {
+	const versionUrl = `https://${input.domainName}/version`;
+	await assertInfrastructureGenerationAtUrl({
+		fetchImpl: input.fetchImpl,
+		provider: "AWS",
+		resource: versionUrl,
+		versionUrl
+	});
+};
+const createVersionEvent = () => ({ Records: [{ cf: {
+	config: {
+		distributionDomainName: "hot-updater-init.invalid",
+		distributionId: "hot-updater-init",
+		eventType: "origin-request",
+		requestId: "hot-updater-init"
+	},
+	request: {
+		clientIp: "127.0.0.1",
+		headers: { host: [{
+			key: "host",
+			value: "hot-updater-init.invalid"
+		}] },
+		method: "GET",
+		querystring: "",
+		uri: "/version"
+	}
+} }] });
+const readLambdaResponsePayload = (payload) => {
+	if (!payload) return void 0;
+	const response = JSON.parse(new TextDecoder().decode(payload));
+	if (typeof response !== "object" || response === null) return void 0;
+	const status = Reflect.get(response, "status");
+	if (status !== 200 && status !== "200") {
+		if (status === 404 || status === "404") return void 0;
+		throw new InitError(`Could not verify the AWS Lambda infrastructure generation: HTTP ${String(status)}`);
+	}
+	const body = Reflect.get(response, "body");
+	if (typeof body === "string") return JSON.parse(body);
+	if (typeof body !== "object" || body === null) return void 0;
+	const data = Reflect.get(body, "data");
+	const encoding = Reflect.get(body, "encoding");
+	if (typeof data !== "string") return void 0;
+	return JSON.parse(encoding === "base64" ? Buffer.from(data, "base64").toString("utf8") : data);
+};
+const assertAwsLambdaCanInitialize = async ({ credentials, lambdaClient = new Lambda({
+	credentials,
+	region: "us-east-1"
+}), lambdaName }) => {
+	try {
+		await lambdaClient.getFunctionConfiguration({ FunctionName: lambdaName });
+	} catch (error) {
+		if (error instanceof Error && error.name === "ResourceNotFoundException") return;
+		throw new InitError(`Could not check whether AWS Lambda ${lambdaName} already exists: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const resource = `Lambda function ${lambdaName}`;
+	let result;
+	try {
+		result = await lambdaClient.invoke({
+			FunctionName: lambdaName,
+			Payload: Buffer.from(JSON.stringify(createVersionEvent()))
+		});
+	} catch (error) {
+		throw new InitError(`Could not verify the AWS infrastructure generation at ${resource}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (result.FunctionError) throw new InitError(`Could not verify the AWS infrastructure generation at ${resource}: ${result.FunctionError}`);
+	let payload;
+	try {
+		payload = readLambdaResponsePayload(result.Payload);
+	} catch (error) {
+		if (error instanceof InitError) throw error;
+		payload = void 0;
+	}
+	assertInfrastructureGenerationPayload({
+		payload,
+		provider: "AWS",
+		resource
+	});
+};
+//#endregion
 //#region ../../node_modules/.pnpm/es-toolkit@1.47.0/node_modules/es-toolkit/dist/_internal/globalThis.mjs
 const globalThis_ = typeof globalThis === "object" && globalThis || typeof window === "object" && window || typeof self === "object" && self || typeof global === "object" && global || (function() {
 	return this;
@@ -6628,185 +8510,34 @@ var AbortError = class extends DOMException$1 {
 * const { signal } = controller;
 *
 * setTimeout(() => controller.abort(), 50); // Will cancel the delay after 50ms
-* try {
-*   await delay(100, { signal });
-*  } catch (error) {
-*   console.error(error); // Will log 'AbortError'
-*  }
-* }
-*/
-function delay(ms, { signal } = {}) {
-	return new Promise((resolve, reject) => {
-		const abortError = () => {
-			reject(new AbortError());
-		};
-		const abortHandler = () => {
-			clearTimeout(timeoutId);
-			abortError();
-		};
-		if (signal?.aborted) return abortError();
-		const timeoutId = setTimeout(() => {
-			signal?.removeEventListener("abort", abortHandler);
-			resolve();
-		}, ms);
-		signal?.addEventListener("abort", abortHandler, { once: true });
-	});
-}
-//#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.47.0/node_modules/es-toolkit/dist/predicate/isPlainObject.mjs
-/**
-* Checks if a given value is a plain object.
-*
-* @param {object} value - The value to check.
-* @returns {value is Record<PropertyKey, any>} - True if the value is a plain object, otherwise false.
-*
-* @example
-* ```typescript
-* // ✅👇 True
-*
-* isPlainObject({ });                       // ✅
-* isPlainObject({ key: 'value' });          // ✅
-* isPlainObject({ key: new Date() });       // ✅
-* isPlainObject(new Object());              // ✅
-* isPlainObject(Object.create(null));       // ✅
-* isPlainObject({ nested: { key: true} });  // ✅
-* isPlainObject(new Proxy({}, {}));         // ✅
-* isPlainObject({ [Symbol('tag')]: 'A' });  // ✅
-*
-* // ✅👇 (cross-realms, node context, workers, ...)
-* const runInNewContext = await import('node:vm').then(
-*     (mod) => mod.runInNewContext
-* );
-* isPlainObject(runInNewContext('({})'));   // ✅
-*
-* // ❌👇 False
-*
-* class Test { };
-* isPlainObject(new Test())           // ❌
-* isPlainObject(10);                  // ❌
-* isPlainObject(null);                // ❌
-* isPlainObject('hello');             // ❌
-* isPlainObject([]);                  // ❌
-* isPlainObject(new Date());          // ❌
-* isPlainObject(new Uint8Array([1])); // ❌
-* isPlainObject(Buffer.from('ABC'));  // ❌
-* isPlainObject(Promise.resolve({})); // ❌
-* isPlainObject(Object.create({}));   // ❌
-* isPlainObject(new (class Cls {}));  // ❌
-* isPlainObject(globalThis);          // ❌,
-* ```
-*/
-function isPlainObject(value) {
-	if (!value || typeof value !== "object") return false;
-	const proto = Object.getPrototypeOf(value);
-	if (!(proto === null || proto === Object.prototype || Object.getPrototypeOf(proto) === null)) return false;
-	return Object.prototype.toString.call(value) === "[object Object]";
-}
-//#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.47.0/node_modules/es-toolkit/dist/_internal/isUnsafeProperty.mjs
-/**
-* Checks if a property key is unsafe to modify directly.
-*
-* This function is used in functions like `merge` to prevent prototype pollution attacks
-* by identifying property keys that could modify the object's prototype chain or constructor.
-*
-* @param key - The property key to check
-* @returns `true` if the property is unsafe to modify directly, `false` otherwise
-* @internal
-*/
-function isUnsafeProperty(key) {
-	return key === "__proto__";
-}
-//#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.47.0/node_modules/es-toolkit/dist/object/merge.mjs
-/**
-* Merges the properties of the source object into the target object.
-*
-* This function performs a deep merge, meaning nested objects and arrays are merged recursively.
-* If a property in the source object is an array or an object and the corresponding property in the target object is also an array or object, they will be merged.
-* If a property in the source object is undefined, it will not overwrite a defined property in the target object.
-*
-* Note that this function mutates the target object.
-*
-* @param {T} target - The target object into which the source object properties will be merged. This object is modified in place.
-* @param {S} source - The source object whose properties will be merged into the target object.
-* @returns {T & S} The updated target object with properties from the source object merged in.
-*
-* @template T - Type of the target object.
-* @template S - Type of the source object.
-*
-* @example
-* const target = { a: 1, b: { x: 1, y: 2 } };
-* const source = { b: { y: 3, z: 4 }, c: 5 };
-*
-* const result = merge(target, source);
-* console.log(result);
-* // Output: { a: 1, b: { x: 1, y: 3, z: 4 }, c: 5 }
-*
-* @example
-* const target = { a: [1, 2], b: { x: 1 } };
-* const source = { a: [3], b: { y: 2 } };
-*
-* const result = merge(target, source);
-* console.log(result);
-* // Output: { a: [3, 2], b: { x: 1, y: 2 } }
-*
-* @example
-* const target = { a: null };
-* const source = { a: [1, 2, 3] };
-*
-* const result = merge(target, source);
-* console.log(result);
-* // Output: { a: [1, 2, 3] }
-*/
-function merge(target, source) {
-	const sourceKeys = Object.keys(source);
-	for (let i = 0; i < sourceKeys.length; i++) {
-		const key = sourceKeys[i];
-		if (isUnsafeProperty(key)) continue;
-		const sourceValue = source[key];
-		const targetValue = target[key];
-		if (isMergeableValue(sourceValue) && isMergeableValue(targetValue)) target[key] = merge(targetValue, sourceValue);
-		else if (Array.isArray(sourceValue)) target[key] = merge([], sourceValue);
-		else if (isPlainObject(sourceValue)) target[key] = merge({}, sourceValue);
-		else if (targetValue === void 0 || sourceValue !== void 0) target[key] = sourceValue;
-	}
-	return target;
-}
-function isMergeableValue(value) {
-	return isPlainObject(value) || Array.isArray(value);
-}
-//#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.47.0/node_modules/es-toolkit/dist/object/omit.mjs
-/**
-* Creates a new object with specified keys omitted.
-*
-* This function takes an object and an array of keys, and returns a new object that
-* excludes the properties corresponding to the specified keys.
-*
-* @template T - The type of object.
-* @template K - The type of keys in object.
-* @param {T} obj - The object to omit keys from.
-* @param {K[]} keys - An array of keys to be omitted from the object.
-* @returns {Omit<T, K>} A new object with the specified keys omitted.
-*
-* @example
-* const obj = { a: 1, b: 2, c: 3 };
-* const result = omit(obj, ['b', 'c']);
-* // result will be { a: 1 }
+* try {
+*   await delay(100, { signal });
+*  } catch (error) {
+*   console.error(error); // Will log 'AbortError'
+*  }
+* }
 */
-function omit(obj, keys) {
-	const result = { ...obj };
-	for (let i = 0; i < keys.length; i++) {
-		const key = keys[i];
-		delete result[key];
-	}
-	return result;
+function delay(ms, { signal } = {}) {
+	return new Promise((resolve, reject) => {
+		const abortError = () => {
+			reject(new AbortError());
+		};
+		const abortHandler = () => {
+			clearTimeout(timeoutId);
+			abortError();
+		};
+		if (signal?.aborted) return abortError();
+		const timeoutId = setTimeout(() => {
+			signal?.removeEventListener("abort", abortHandler);
+			resolve();
+		}, ms);
+		signal?.addEventListener("abort", abortHandler, { once: true });
+	});
 }
 //#endregion
 //#region iac/cloudfrontDistributionConfig.ts
 const HOT_UPDATER_SHARED_CACHE_POLICY_CONFIG = {
-	Name: "HotUpdaterOriginCacheControl",
+	Name: "HotUpdaterOriginCacheControlV2",
 	Comment: "Honor origin Cache-Control without forwarding viewer Host/cookies/query strings",
 	DefaultTTL: 0,
 	MaxTTL: 31536e3,
@@ -6814,11 +8545,50 @@ const HOT_UPDATER_SHARED_CACHE_POLICY_CONFIG = {
 	ParametersInCacheKeyAndForwardedToOrigin: {
 		EnableAcceptEncodingBrotli: true,
 		EnableAcceptEncodingGzip: true,
-		HeadersConfig: { HeaderBehavior: "none" },
+		HeadersConfig: {
+			HeaderBehavior: "whitelist",
+			Headers: {
+				Quantity: 1,
+				Items: ["x-api-key"]
+			}
+		},
+		CookiesConfig: { CookieBehavior: "none" },
+		QueryStringsConfig: { QueryStringBehavior: "none" }
+	}
+};
+const HOT_UPDATER_RELEASE_CATALOG_CACHE_POLICY_CONFIG = {
+	Name: "HotUpdaterReleaseCatalogV1",
+	Comment: "Cache Release catalogs by canonical path, API key, and encoding",
+	DefaultTTL: 0,
+	MaxTTL: 5,
+	MinTTL: 0,
+	ParametersInCacheKeyAndForwardedToOrigin: {
+		EnableAcceptEncodingBrotli: true,
+		EnableAcceptEncodingGzip: true,
+		HeadersConfig: {
+			HeaderBehavior: "whitelist",
+			Headers: {
+				Quantity: 1,
+				Items: ["x-api-key"]
+			}
+		},
 		CookiesConfig: { CookieBehavior: "none" },
 		QueryStringsConfig: { QueryStringBehavior: "none" }
 	}
 };
+const HOT_UPDATER_ORIGIN_REQUEST_POLICY_CONFIG = {
+	Name: "HotUpdaterManagedApiOriginRequestV2",
+	Comment: "Forward managed API bodies, query strings, and the API key",
+	HeadersConfig: {
+		HeaderBehavior: "whitelist",
+		Headers: {
+			Quantity: 2,
+			Items: ["content-type", "x-api-key"]
+		}
+	},
+	CookiesConfig: { CookieBehavior: "none" },
+	QueryStringsConfig: { QueryStringBehavior: "all" }
+};
 const READ_ONLY_METHODS = {
 	Quantity: 2,
 	Items: ["HEAD", "GET"],
@@ -6827,6 +8597,19 @@ const READ_ONLY_METHODS = {
 		Items: ["HEAD", "GET"]
 	}
 };
+const API_METHODS = {
+	Quantity: 7,
+	Items: [
+		"HEAD",
+		"DELETE",
+		"POST",
+		"GET",
+		"OPTIONS",
+		"PUT",
+		"PATCH"
+	],
+	CachedMethods: READ_ONLY_METHODS.CachedMethods
+};
 const EMPTY_FUNCTION_ASSOCIATIONS = { Quantity: 0 };
 const EMPTY_LAMBDA_FUNCTION_ASSOCIATIONS = { Quantity: 0 };
 const HOT_UPDATER_BEHAVIOR_BASE = {
@@ -6837,9 +8620,14 @@ const HOT_UPDATER_BEHAVIOR_BASE = {
 	FieldLevelEncryptionId: "",
 	AllowedMethods: READ_ONLY_METHODS
 };
-const HOT_UPDATER_CACHE_BEHAVIOR_PATH = "/api/check-update/*";
+const HOT_UPDATER_CACHE_BEHAVIOR_PATHS = [
+	"/events",
+	"/artifacts/*",
+	"/version"
+];
+const HOT_UPDATER_RELEASE_CATALOG_BEHAVIOR_PATHS = ["/release-catalogs/*"];
 const omitLegacyCacheFields = (value) => {
-	const { ForwardedValues: _forwardedValues, MinTTL: _minTTL, DefaultTTL: _defaultTTL, MaxTTL: _maxTTL, OriginRequestPolicyId: _originRequestPolicyId, ...rest } = value;
+	const { ForwardedValues: _forwardedValues, MinTTL: _minTTL, DefaultTTL: _defaultTTL, MaxTTL: _maxTTL, ...rest } = value;
 	return rest;
 };
 const sanitizeDefaultBehavior = (behavior) => ({
@@ -6864,6 +8652,7 @@ const buildOriginRequestLambdaAssociations = (functionArn) => ({
 	Quantity: 1,
 	Items: [{
 		EventType: "origin-request",
+		IncludeBody: true,
 		LambdaFunctionARN: functionArn
 	}]
 });
@@ -6890,13 +8679,16 @@ const buildDefaultCacheBehavior = (options) => ({
 });
 const buildCacheBehavior = (options) => ({
 	...buildSharedBehavior(options.bucketName),
-	PathPattern: HOT_UPDATER_CACHE_BEHAVIOR_PATH,
+	AllowedMethods: API_METHODS,
+	PathPattern: options.pathPattern,
 	CachePolicyId: options.sharedCachePolicyId,
+	OriginRequestPolicyId: options.originRequestPolicyId,
 	LambdaFunctionAssociations: buildOriginRequestLambdaAssociations(options.functionArn)
 });
 const mergeOriginWithExisting = (existingOrigin, overrideOrigin) => ({
 	...existingOrigin,
 	...overrideOrigin,
+	Id: existingOrigin?.Id ?? overrideOrigin.Id,
 	CustomHeaders: existingOrigin?.CustomHeaders ?? { Quantity: 0 }
 });
 const mergeBehaviorWithExisting = (existingBehavior, overrideBehavior) => ({
@@ -6905,6 +8697,33 @@ const mergeBehaviorWithExisting = (existingBehavior, overrideBehavior) => ({
 	LambdaFunctionAssociations: overrideBehavior.LambdaFunctionAssociations ?? existingBehavior?.LambdaFunctionAssociations ?? EMPTY_LAMBDA_FUNCTION_ASSOCIATIONS,
 	FunctionAssociations: overrideBehavior.FunctionAssociations ?? existingBehavior?.FunctionAssociations ?? EMPTY_FUNCTION_ASSOCIATIONS
 });
+const mergeOrigins = (existing, overrides) => [...existing.map((existingOrigin) => {
+	const override = overrides.find((candidate) => candidate.Id === existingOrigin.Id || candidate.DomainName === existingOrigin.DomainName);
+	return override ? mergeOriginWithExisting(existingOrigin, override) : existingOrigin;
+}), ...overrides.filter((override) => !existing.some((candidate) => candidate.Id === override.Id || candidate.DomainName === override.DomainName))];
+const mergeCacheBehaviors = (existing, overrides) => {
+	const additions = overrides.filter((override) => !existing.some((candidate) => candidate.PathPattern === override.PathPattern));
+	const mergedExisting = existing.map((existingBehavior) => {
+		const override = overrides.find((candidate) => candidate.PathPattern === existingBehavior.PathPattern);
+		return override ? mergeBehaviorWithExisting(existingBehavior, override) : existingBehavior;
+	});
+	return additions.reduce((behaviors, addition) => {
+		const additionPrefix = (addition.PathPattern ?? "").split(/[?*]/, 1)[0] ?? "";
+		const broaderBehaviorIndex = behaviors.findIndex((behavior) => {
+			const behaviorPattern = behavior.PathPattern ?? "";
+			const wildcardIndex = behaviorPattern.indexOf("*");
+			if (wildcardIndex !== behaviorPattern.length - 1 || behaviorPattern.includes("?")) return false;
+			const behaviorPrefix = behaviorPattern.slice(0, wildcardIndex);
+			return behaviorPrefix.length < additionPrefix.length && additionPrefix.startsWith(behaviorPrefix);
+		});
+		if (broaderBehaviorIndex === -1) return [...behaviors, addition];
+		return [
+			...behaviors.slice(0, broaderBehaviorIndex),
+			addition,
+			...behaviors.slice(broaderBehaviorIndex)
+		];
+	}, mergedExisting);
+};
 const buildDistributionConfigOverrides = (options) => ({
 	Origins: {
 		Quantity: 1,
@@ -6920,29 +8739,45 @@ const buildDistributionConfigOverrides = (options) => ({
 		sharedCachePolicyId: options.sharedCachePolicyId
 	}),
 	CacheBehaviors: {
-		Quantity: 1,
-		Items: [buildCacheBehavior({
+		Quantity: HOT_UPDATER_RELEASE_CATALOG_BEHAVIOR_PATHS.length + HOT_UPDATER_CACHE_BEHAVIOR_PATHS.length,
+		Items: [...HOT_UPDATER_RELEASE_CATALOG_BEHAVIOR_PATHS.map((pathPattern) => buildCacheBehavior({
+			bucketName: options.bucketName,
+			functionArn: options.functionArn,
+			originRequestPolicyId: options.originRequestPolicyId,
+			pathPattern,
+			sharedCachePolicyId: options.releaseCatalogCachePolicyId
+		})), ...HOT_UPDATER_CACHE_BEHAVIOR_PATHS.map((pathPattern) => buildCacheBehavior({
 			bucketName: options.bucketName,
 			functionArn: options.functionArn,
+			originRequestPolicyId: options.originRequestPolicyId,
+			pathPattern,
 			sharedCachePolicyId: options.sharedCachePolicyId
-		})]
+		}))]
 	}
 });
 const applyDistributionConfigOverrides = (distributionConfig, overrides) => {
+	const managedOrigin = overrides.Origins.Items?.[0];
+	const targetOriginId = (managedOrigin ? distributionConfig.Origins?.Items?.find((origin) => origin.Id === managedOrigin.Id || origin.DomainName === managedOrigin.DomainName) : void 0)?.Id ?? managedOrigin?.Id;
+	const defaultCacheBehavior = targetOriginId ? {
+		...overrides.DefaultCacheBehavior,
+		TargetOriginId: targetOriginId
+	} : overrides.DefaultCacheBehavior;
+	const cacheBehaviorOverrides = (overrides.CacheBehaviors.Items ?? []).map((behavior) => targetOriginId ? {
+		...behavior,
+		TargetOriginId: targetOriginId
+	} : behavior);
+	const origins = mergeOrigins(distributionConfig.Origins?.Items ?? [], overrides.Origins.Items ?? []);
+	const cacheBehaviors = mergeCacheBehaviors(distributionConfig.CacheBehaviors?.Items ?? [], cacheBehaviorOverrides);
 	return sanitizeDistributionConfig({
 		...distributionConfig,
 		Origins: {
-			Quantity: overrides.Origins.Quantity,
-			Items: (overrides.Origins.Items ?? []).map((overrideOrigin) => {
-				return mergeOriginWithExisting((distributionConfig.Origins?.Items ?? []).find((origin) => origin.Id === overrideOrigin.Id || origin.DomainName === overrideOrigin.DomainName), overrideOrigin);
-			})
+			Quantity: origins.length,
+			Items: origins
 		},
-		DefaultCacheBehavior: mergeBehaviorWithExisting(distributionConfig.DefaultCacheBehavior, overrides.DefaultCacheBehavior),
+		DefaultCacheBehavior: mergeBehaviorWithExisting(distributionConfig.DefaultCacheBehavior, defaultCacheBehavior),
 		CacheBehaviors: {
-			Quantity: overrides.CacheBehaviors.Quantity,
-			Items: (overrides.CacheBehaviors.Items ?? []).map((overrideBehavior) => {
-				return mergeBehaviorWithExisting((distributionConfig.CacheBehaviors?.Items ?? []).find((behavior) => behavior.PathPattern === overrideBehavior.PathPattern), overrideBehavior);
-			})
+			Quantity: cacheBehaviors.length,
+			Items: cacheBehaviors
 		}
 	});
 };
@@ -6993,7 +8828,7 @@ var CloudFrontManager = class {
 		this.region = region;
 		this.credentials = credentials;
 	}
-	async getOrCreateSharedCachePolicy(cloudfrontClient) {
+	async getOrCreateCachePolicy(cloudfrontClient, config) {
 		const existingPolicyId = (await findInPaginatedCloudFrontList({
 			listPage: async (marker) => {
 				const listPoliciesResponse = await cloudfrontClient.listCachePolicies({
@@ -7005,13 +8840,41 @@ var CloudFrontManager = class {
 					nextMarker: listPoliciesResponse.CachePolicyList?.NextMarker
 				};
 			},
-			matches: (policy) => policy.CachePolicy?.CachePolicyConfig?.Name === HOT_UPDATER_SHARED_CACHE_POLICY_CONFIG.Name
+			matches: (policy) => policy.CachePolicy?.CachePolicyConfig?.Name === config.Name
 		}))?.CachePolicy?.Id;
-		if (existingPolicyId) return existingPolicyId;
-		const cachePolicyId = (await cloudfrontClient.createCachePolicy({ CachePolicyConfig: HOT_UPDATER_SHARED_CACHE_POLICY_CONFIG })).CachePolicy?.Id;
+		if (existingPolicyId) {
+			const currentPolicy = await cloudfrontClient.getCachePolicy({ Id: existingPolicyId });
+			if (!currentPolicy.ETag) throw new Error("Failed to read shared cache policy ETag");
+			await cloudfrontClient.updateCachePolicy({
+				CachePolicyConfig: config,
+				Id: existingPolicyId,
+				IfMatch: currentPolicy.ETag
+			});
+			return existingPolicyId;
+		}
+		const cachePolicyId = (await cloudfrontClient.createCachePolicy({ CachePolicyConfig: config })).CachePolicy?.Id;
 		if (!cachePolicyId) throw new Error("Failed to create shared cache policy");
 		return cachePolicyId;
 	}
+	async getOrCreateOriginRequestPolicy(cloudfrontClient) {
+		const existingPolicyId = (await findInPaginatedCloudFrontList({
+			listPage: async (marker) => {
+				const response = await cloudfrontClient.listOriginRequestPolicies({
+					Type: "custom",
+					...marker ? { Marker: marker } : {}
+				});
+				return {
+					items: response.OriginRequestPolicyList?.Items ?? [],
+					nextMarker: response.OriginRequestPolicyList?.NextMarker
+				};
+			},
+			matches: (policy) => policy.OriginRequestPolicy?.OriginRequestPolicyConfig?.Name === HOT_UPDATER_ORIGIN_REQUEST_POLICY_CONFIG.Name
+		}))?.OriginRequestPolicy?.Id;
+		if (existingPolicyId) return existingPolicyId;
+		const policyId = (await cloudfrontClient.createOriginRequestPolicy({ OriginRequestPolicyConfig: HOT_UPDATER_ORIGIN_REQUEST_POLICY_CONFIG })).OriginRequestPolicy?.Id;
+		if (!policyId) throw new Error("Failed to create origin request policy");
+		return policyId;
+	}
 	async getOrCreateKeyGroup(publicKey) {
 		const publicKeyHash = crypto.createHash("sha256").update(publicKey).digest("hex").slice(0, 16);
 		const cloudfrontClient = new CloudFront({
@@ -7079,11 +8942,17 @@ var CloudFrontManager = class {
 		}
 		if (!oacId) throw new Error("Failed to get Origin Access Control ID");
 		const bucketDomain = `${options.bucketName}.s3.${this.region}.amazonaws.com`;
+		let releaseCatalogCachePolicyId;
 		let sharedCachePolicyId;
+		let originRequestPolicyId;
 		try {
-			sharedCachePolicyId = await this.getOrCreateSharedCachePolicy(cloudfrontClient);
+			[sharedCachePolicyId, releaseCatalogCachePolicyId, originRequestPolicyId] = await Promise.all([
+				this.getOrCreateCachePolicy(cloudfrontClient, HOT_UPDATER_SHARED_CACHE_POLICY_CONFIG),
+				this.getOrCreateCachePolicy(cloudfrontClient, HOT_UPDATER_RELEASE_CATALOG_CACHE_POLICY_CONFIG),
+				this.getOrCreateOriginRequestPolicy(cloudfrontClient)
+			]);
 		} catch (error) {
-			throw new Error(`Failed to get or create shared cache policy: ${error instanceof Error ? error.message : String(error)}`);
+			throw new Error(`Failed to get or create CloudFront request policies: ${error instanceof Error ? error.message : String(error)}`);
 		}
 		const newOverrides = buildDistributionConfigOverrides({
 			bucketName: options.bucketName,
@@ -7091,6 +8960,8 @@ var CloudFrontManager = class {
 			functionArn: options.functionArn,
 			keyGroupId: options.keyGroupId,
 			oacId,
+			originRequestPolicyId,
+			releaseCatalogCachePolicyId,
 			sharedCachePolicyId
 		});
 		if (selectedDistribution) {
@@ -7111,8 +8982,8 @@ var CloudFrontManager = class {
 					InvalidationBatch: {
 						CallerReference: (/* @__PURE__ */ new Date()).toISOString(),
 						Paths: {
-							Quantity: 1,
-							Items: ["/*"]
+							Quantity: HOT_UPDATER_CACHE_BEHAVIOR_PATHS.length + HOT_UPDATER_RELEASE_CATALOG_BEHAVIOR_PATHS.length,
+							Items: [...HOT_UPDATER_CACHE_BEHAVIOR_PATHS, ...HOT_UPDATER_RELEASE_CATALOG_BEHAVIOR_PATHS]
 						}
 					}
 				});
@@ -7132,6 +9003,8 @@ var CloudFrontManager = class {
 			functionArn: options.functionArn,
 			keyGroupId: options.keyGroupId,
 			oacId,
+			originRequestPolicyId,
+			releaseCatalogCachePolicyId,
 			sharedCachePolicyId
 		});
 		try {
@@ -7187,33 +9060,165 @@ var CloudFrontManager = class {
 		});
 		const savedDistribution = matchingDistributions.find((distribution) => distribution.Id === distributionId);
 		const savedDistributionExists = distributions.some((distribution) => distribution.Id === distributionId);
-		if (nonInteractive && savedDistribution) return savedDistribution;
-		if (distributionId && !savedDistribution) {
-			if (matchingDistributions.length === 0 && !savedDistributionExists) {
+		if (nonInteractive) {
+			if (savedDistribution) return savedDistribution;
+			if (!distributionId) return null;
+			if (!savedDistributionExists) {
 				p.log.warn("Saved CloudFront distribution was not found. A new distribution will be created.");
 				return null;
 			}
-			if (nonInteractive) throw new MissingInitInputsError(["HOT_UPDATER_CLOUDFRONT_DISTRIBUTION_ID"]);
-			p.log.warn("Saved CloudFront distribution was not found. Select a distribution again.");
-		}
-		if (matchingDistributions.length === 0) return null;
-		if (nonInteractive) {
-			if (!distributionId && matchingDistributions.length === 1) return matchingDistributions[0] ?? null;
 			throw new MissingInitInputsError(["HOT_UPDATER_CLOUDFRONT_DISTRIBUTION_ID"]);
 		}
+		if (distributionId && !savedDistribution) p.log.warn(savedDistributionExists ? "Saved CloudFront distribution does not use the selected S3 bucket. Select a distribution again." : "Saved CloudFront distribution was not found. A new distribution will be created unless another distribution is selected.");
+		if (matchingDistributions.length === 0) return null;
+		const legacyDistributionIds = /* @__PURE__ */ new Set();
+		await Promise.all(matchingDistributions.map(async (distribution) => {
+			if (await resolveAwsDistributionGeneration({ domainName: distribution.DomainName }) === "v0") legacyDistributionIds.add(distribution.Id);
+		}));
+		const createNewDistribution = "__create-new-cloudfront-distribution__";
+		const reusableSavedDistributionId = savedDistribution && !legacyDistributionIds.has(savedDistribution.Id) ? savedDistribution.Id : void 0;
 		const selectedDistributionId = await p.select({
-			initialValue: savedDistribution?.Id ?? matchingDistributions[0]?.Id,
+			initialValue: reusableSavedDistributionId ?? createNewDistribution,
 			message: "Select a CloudFront distribution:",
-			options: matchingDistributions.map((distribution) => ({
-				value: distribution.Id,
-				label: `${distribution.Id} (${distribution.DomainName})`
-			}))
+			options: [{
+				value: createNewDistribution,
+				label: "Create New CloudFront Distribution"
+			}, ...matchingDistributions.map((distribution) => {
+				const isLegacy = legacyDistributionIds.has(distribution.Id);
+				return {
+					value: distribution.Id,
+					label: `${distribution.Id} (${distribution.DomainName})${isLegacy ? " (v0, deprecated)" : ""}`,
+					disabled: isLegacy
+				};
+			})]
 		});
 		if (p.isCancel(selectedDistributionId)) process.exit(0);
+		if (selectedDistributionId === createNewDistribution) return null;
 		return matchingDistributions.find((distribution) => distribution.Id === selectedDistributionId) ?? null;
 	}
 };
 //#endregion
+//#region iac/dynamodb.ts
+const DYNAMODB_DESCRIBE_TABLE_ACTION = "dynamodb:DescribeTable";
+var DynamoDBTableSchemaError = class extends Error {
+	name = "DynamoDBTableSchemaError";
+	constructor(tableName) {
+		super(`DynamoDB table "${tableName}" does not match the Hot Updater key and index schema`);
+		this.tableName = tableName;
+	}
+};
+var DynamoDBPermissionError = class extends InitError {
+	name = "DynamoDBPermissionError";
+	requiredAction = DYNAMODB_DESCRIBE_TABLE_ACTION;
+	constructor(tableName, region, cause) {
+		super([
+			`AWS credentials cannot access DynamoDB table "${tableName}" in ${region}.`,
+			`Required permission: ${DYNAMODB_DESCRIBE_TABLE_ACTION}`,
+			`AWS error: ${cause.message}`,
+			"Ask your AWS administrator to grant this permission, or attach the AmazonDynamoDBFullAccess_v2 managed policy, to the identity used for init.",
+			"For AWS IAM Identity Center, update the assigned permission set and refresh the SSO session.",
+			"Then rerun `hot-updater init`."
+		].join("\n"), { cause });
+		this.tableName = tableName;
+		this.region = region;
+	}
+};
+const primaryKeySchema = [{
+	AttributeName: "pk",
+	KeyType: "HASH"
+}, {
+	AttributeName: "sk",
+	KeyType: "RANGE"
+}];
+const updateIndexKeySchema = [{
+	AttributeName: "gsi1pk",
+	KeyType: "HASH"
+}, {
+	AttributeName: "gsi1sk",
+	KeyType: "RANGE"
+}];
+const keyAttributes = [
+	"pk",
+	"sk",
+	"gsi1pk",
+	"gsi1sk"
+];
+const onDemandThroughput = {
+	MaxReadRequestUnits: 4e3,
+	MaxWriteRequestUnits: 100
+};
+const hasKeySchema = (actual, expected) => actual?.length === expected.length && expected.every(({ AttributeName, KeyType }) => actual.some((key) => key.AttributeName === AttributeName && key.KeyType === KeyType));
+const hasExpectedSchema = (table) => {
+	const updateIndex = table?.GlobalSecondaryIndexes?.find(({ IndexName }) => IndexName === DYNAMODB_UPDATE_INDEX_NAME);
+	return keyAttributes.every((attributeName) => table?.AttributeDefinitions?.some(({ AttributeName, AttributeType }) => AttributeName === attributeName && AttributeType === "S")) && table?.BillingModeSummary?.BillingMode === "PAY_PER_REQUEST" && table.OnDemandThroughput?.MaxReadRequestUnits === onDemandThroughput.MaxReadRequestUnits && table.OnDemandThroughput?.MaxWriteRequestUnits === onDemandThroughput.MaxWriteRequestUnits && hasKeySchema(table?.KeySchema, primaryKeySchema) && hasKeySchema(updateIndex?.KeySchema, updateIndexKeySchema) && updateIndex?.OnDemandThroughput?.MaxReadRequestUnits === onDemandThroughput.MaxReadRequestUnits && updateIndex?.OnDemandThroughput?.MaxWriteRequestUnits === onDemandThroughput.MaxWriteRequestUnits && updateIndex?.Projection?.ProjectionType === "ALL";
+};
+const isResourceNotFound = (error) => typeof error === "object" && error !== null && Reflect.get(error, "name") === "ResourceNotFoundException";
+var DynamoDBManager = class {
+	client;
+	constructor(region, credentials) {
+		this.region = region;
+		this.client = new DynamoDB({
+			credentials,
+			region
+		});
+	}
+	async ensureTable(tableName) {
+		try {
+			const { Table } = await this.client.describeTable({ TableName: tableName });
+			if (!hasExpectedSchema(Table)) throw new DynamoDBTableSchemaError(tableName);
+			await this.ensureLifecycle(tableName);
+			return;
+		} catch (error) {
+			if (error instanceof Error && error.name === "AccessDeniedException" && error.message.includes(DYNAMODB_DESCRIBE_TABLE_ACTION)) throw new DynamoDBPermissionError(tableName, this.region, error);
+			if (!isResourceNotFound(error)) throw error;
+		}
+		await this.client.createTable({
+			AttributeDefinitions: [
+				{
+					AttributeName: "pk",
+					AttributeType: "S"
+				},
+				{
+					AttributeName: "sk",
+					AttributeType: "S"
+				},
+				{
+					AttributeName: "gsi1pk",
+					AttributeType: "S"
+				},
+				{
+					AttributeName: "gsi1sk",
+					AttributeType: "S"
+				}
+			],
+			BillingMode: "PAY_PER_REQUEST",
+			DeletionProtectionEnabled: true,
+			GlobalSecondaryIndexes: [{
+				IndexName: DYNAMODB_UPDATE_INDEX_NAME,
+				KeySchema: [...updateIndexKeySchema],
+				Projection: { ProjectionType: "ALL" },
+				OnDemandThroughput: onDemandThroughput
+			}],
+			KeySchema: [...primaryKeySchema],
+			OnDemandThroughput: onDemandThroughput,
+			TableName: tableName
+		});
+		await waitUntilTableExists({
+			client: this.client,
+			maxWaitTime: 120
+		}, { TableName: tableName });
+		await this.ensureLifecycle(tableName);
+	}
+	async ensureLifecycle(tableName) {
+		const { ContinuousBackupsDescription } = await this.client.describeContinuousBackups({ TableName: tableName });
+		if (ContinuousBackupsDescription?.PointInTimeRecoveryDescription?.PointInTimeRecoveryStatus === "ENABLED") return;
+		await this.client.updateContinuousBackups({
+			PointInTimeRecoverySpecification: { PointInTimeRecoveryEnabled: true },
+			TableName: tableName
+		});
+	}
+};
+//#endregion
 //#region iac/iam.ts
 var IAMManager = class {
 	region;
@@ -7225,12 +9230,82 @@ var IAMManager = class {
 	async ensureManagedPolicies(iamClient, roleName) {
 		const attachedPolicies = await iamClient.listAttachedRolePolicies({ RoleName: roleName });
 		const attachedPolicyArns = new Set((attachedPolicies.AttachedPolicies ?? []).map((policy) => policy.PolicyArn));
-		for (const policyArn of ["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"]) if (!attachedPolicyArns.has(policyArn)) await iamClient.attachRolePolicy({
+		for (const policyArn of ["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]) if (!attachedPolicyArns.has(policyArn)) await iamClient.attachRolePolicy({
 			RoleName: roleName,
 			PolicyArn: policyArn
 		});
 	}
-	async createOrSelectRole() {
+	async ensureDynamoDBPolicy(iamClient, roleName, accountId, tableName) {
+		const tableArn = `arn:aws:dynamodb:${this.region}:${accountId}:table/${tableName}`;
+		await iamClient.putRolePolicy({
+			PolicyDocument: JSON.stringify({
+				Version: "2012-10-17",
+				Statement: [{
+					Action: ["dynamodb:Query"],
+					Effect: "Allow",
+					Resource: [`${tableArn}/index/${DYNAMODB_UPDATE_INDEX_NAME}`]
+				}, {
+					Action: [
+						"dynamodb:BatchGetItem",
+						"dynamodb:DeleteItem",
+						"dynamodb:GetItem",
+						"dynamodb:PutItem",
+						"dynamodb:Query",
+						"dynamodb:TransactWriteItems",
+						"dynamodb:UpdateItem"
+					],
+					Condition: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": [
+						"_hot-updater",
+						"bundles",
+						"bundle_patches",
+						DYNAMODB_CHANNEL_PARTITION,
+						DYNAMODB_CHANNEL_NAME_PARTITION,
+						DYNAMODB_ANALYTICS_PARTITION,
+						DYNAMODB_API_KEY_PARTITION,
+						DYNAMODB_API_KEY_HASH_PARTITION
+					] } },
+					Effect: "Allow",
+					Resource: [tableArn]
+				}]
+			}),
+			PolicyName: "HotUpdaterDynamoDBReadAccess",
+			RoleName: roleName
+		});
+	}
+	async ensureS3Policy(iamClient, roleName, bucketName) {
+		await iamClient.putRolePolicy({
+			PolicyDocument: JSON.stringify({
+				Version: "2012-10-17",
+				Statement: [{
+					Action: ["s3:ListBucket"],
+					Effect: "Allow",
+					Resource: [`arn:aws:s3:::${bucketName}`]
+				}, {
+					Action: ["s3:GetObject"],
+					Effect: "Allow",
+					Resource: [`arn:aws:s3:::${bucketName}/*`]
+				}]
+			}),
+			PolicyName: "HotUpdaterS3ReadAccess",
+			RoleName: roleName
+		});
+	}
+	async ensureSsmPolicy(iamClient, roleName, accountId, parameterName) {
+		const parameterPath = parameterName.replace(/^\/+/, "");
+		await iamClient.putRolePolicy({
+			PolicyDocument: JSON.stringify({
+				Version: "2012-10-17",
+				Statement: [{
+					Effect: "Allow",
+					Action: ["ssm:GetParameter"],
+					Resource: `arn:aws:ssm:${this.region}:${accountId}:parameter/${parameterPath}`
+				}]
+			}),
+			PolicyName: "HotUpdaterSSMAccess",
+			RoleName: roleName
+		});
+	}
+	async createOrSelectRole(options) {
 		const iamClient = new IAM({
 			region: this.region,
 			credentials: this.credentials
@@ -7248,50 +9323,35 @@ var IAMManager = class {
 				Action: "sts:AssumeRole"
 			}]
 		});
-		const roleName = "hot-updater-edge-role";
-		const ssmPolicyDocument = JSON.stringify({
-			Version: "2012-10-17",
-			Statement: [{
-				Effect: "Allow",
-				Action: ["ssm:GetParameter"],
-				Resource: `arn:aws:ssm:*:${accountId}:parameter/hot-updater/*`
-			}]
-		});
+		const roleName = `hot-updater-edge-${createHash("sha256").update(options.lambdaName).digest("hex").slice(0, 16)}`;
 		try {
 			const { Role: existingRole } = await iamClient.getRole({ RoleName: roleName });
 			if (existingRole?.Arn) {
 				await this.ensureManagedPolicies(iamClient, roleName);
-				try {
-					await iamClient.putRolePolicy({
-						RoleName: roleName,
-						PolicyName: "HotUpdaterSSMAccess",
-						PolicyDocument: ssmPolicyDocument
-					});
-					p.log.info("Updated SSM access policy for existing IAM role");
-				} catch {
-					p.log.warn("Failed to update SSM policy, continuing anyway");
-				}
+				await this.ensureS3Policy(iamClient, roleName, options.bucketName);
+				await this.ensureSsmPolicy(iamClient, roleName, accountId, options.ssmParameterName);
+				await this.ensureDynamoDBPolicy(iamClient, roleName, accountId, options.dynamodbTableName);
 				p.log.info(`Using existing IAM role: ${roleName} (${existingRole.Arn})`);
 				return existingRole.Arn;
 			}
-		} catch {
+		} catch (error) {
+			if (!(error instanceof Error && error.name === "NoSuchEntityException")) throw error;
 			try {
 				const createRoleResp = await iamClient.createRole({
 					RoleName: roleName,
 					AssumeRolePolicyDocument: assumeRolePolicyDocument,
-					Description: "Role for Lambda@Edge to access S3 and SSM"
+					Description: `Role for Hot Updater Lambda@Edge ${options.lambdaName}`
 				});
 				if (!createRoleResp.Role?.Arn) throw new Error("Failed to create IAM role: No ARN returned");
 				const lambdaRoleArn = createRoleResp.Role.Arn;
 				p.log.info(`Created IAM role: ${roleName} (${lambdaRoleArn})`);
 				await this.ensureManagedPolicies(iamClient, roleName);
 				p.log.info(`Attached managed policies to ${roleName}`);
-				await iamClient.putRolePolicy({
-					RoleName: roleName,
-					PolicyName: "HotUpdaterSSMAccess",
-					PolicyDocument: ssmPolicyDocument
-				});
-				p.log.info(`Added SSM access inline policy to ${roleName}`);
+				await this.ensureS3Policy(iamClient, roleName, options.bucketName);
+				await this.ensureSsmPolicy(iamClient, roleName, accountId, options.ssmParameterName);
+				p.log.info(`Added resource-scoped policies to ${roleName}`);
+				await this.ensureDynamoDBPolicy(iamClient, roleName, accountId, options.dynamodbTableName);
+				p.log.info(`Added DynamoDB read policy to ${roleName}`);
 				return lambdaRoleArn;
 			} catch (createError) {
 				if (createError instanceof Error) p.log.error(`Error setting up IAM role: ${createError.message}`);
@@ -7302,40 +9362,48 @@ var IAMManager = class {
 	}
 };
 //#endregion
-//#region iac/lambdaAsset.ts
-/**
-* Resolves the directory holding the bundled Lambda@Edge runtime.
-* Kept in its own module so it can be mocked in tests without requiring a
-* built `dist/`.
-*/
-const resolveLambdaDir = () => path$1.dirname(__require.resolve("@hot-updater/aws/lambda"));
-//#endregion
 //#region iac/lambdaEdge.ts
-const LAMBDA_EDGE_MEMORY_SIZE = 256;
-const LAMBDA_EDGE_TIMEOUT = 10;
-const waitForFunctionUpdate = async (lambdaClient, lambdaName) => {
-	while (true) {
-		try {
-			const status = await lambdaClient.getFunctionConfiguration({ FunctionName: lambdaName });
-			if (status.LastUpdateStatus === "Successful") return;
-			if (status.LastUpdateStatus === "Failed") throw new Error(`Lambda update failed: ${status.LastUpdateStatusReason}`);
-		} catch (err) {
-			if (!(err instanceof Error && err.name === "ResourceConflictException")) throw err;
-		}
-		await new Promise((resolve) => setTimeout(resolve, 2e3));
+const LAMBDA_MEMORY_SIZE = 256;
+const LAMBDA_TIMEOUT_SECONDS = 10;
+const LAMBDA_ROLE_PROPAGATION_MAX_ATTEMPTS = 10;
+const LAMBDA_ROLE_PROPAGATION_RETRY_DELAY_MS = 2e3;
+const isLambdaRolePropagationError = (error) => error instanceof Error && error.name === "InvalidParameterValueException" && /role defined for the function cannot be assumed by Lambda/i.test(error.message);
+const createFunctionWithRolePropagationRetry = async (createFunction, message) => {
+	for (let attempt = 1; attempt <= LAMBDA_ROLE_PROPAGATION_MAX_ATTEMPTS; attempt++) try {
+		return await createFunction();
+	} catch (error) {
+		if (!isLambdaRolePropagationError(error) || attempt === LAMBDA_ROLE_PROPAGATION_MAX_ATTEMPTS) throw error;
+		message("Waiting for IAM role to become assumable by Lambda...");
+		await new Promise((resolve) => setTimeout(resolve, LAMBDA_ROLE_PROPAGATION_RETRY_DELAY_MS));
 	}
+	throw new Error("Failed to create Lambda function");
 };
 var LambdaEdgeDeployer = class {
 	credentials;
 	constructor(credentials) {
 		this.credentials = credentials;
 	}
+	async waitForUpdate(lambdaClient, lambdaName) {
+		while (true) {
+			try {
+				const status = await lambdaClient.getFunctionConfiguration({ FunctionName: lambdaName });
+				if (status.LastUpdateStatus === "Successful") return;
+				if (status.LastUpdateStatus === "Failed") throw new Error(`Lambda update failed: ${status.LastUpdateStatusReason}`);
+			} catch (error) {
+				if (!(error instanceof Error) || error.name !== "ResourceConflictException") throw error;
+			}
+			await new Promise((resolve) => setTimeout(resolve, 2e3));
+		}
+	}
 	async deploy(lambdaRoleArn, lambdaName, config) {
 		const cwd = getCwd();
-		const { tmpDir, removeTmpDir } = await copyDirToTmp(resolveLambdaDir());
+		const lambdaPath = __require.resolve("@hot-updater/aws/lambda");
+		const { tmpDir, removeTmpDir } = await copyDirToTmp(path$1.dirname(lambdaPath));
 		const indexPath = path$1.join(tmpDir, "index.cjs");
 		const code = transformEnv(indexPath, {
 			CLOUDFRONT_KEY_PAIR_ID: config.publicKeyId,
+			DYNAMODB_REGION: config.dynamodbRegion,
+			DYNAMODB_TABLE_NAME: config.dynamodbTableName,
 			SSM_PARAMETER_NAME: config.ssmParameterName,
 			SSM_REGION: config.ssmRegion,
 			S3_BUCKET_NAME: config.bucketName
@@ -7369,17 +9437,18 @@ var LambdaEdgeDeployer = class {
 				title: "Creating or Updating Lambda function",
 				task: async (message) => {
 					try {
-						const createResp = await lambdaClient.createFunction({
+						const zipFile = await fs.readFile(zipFilePath);
+						const createResp = await createFunctionWithRolePropagationRetry(() => lambdaClient.createFunction({
 							FunctionName: lambdaName,
 							Runtime: "nodejs22.x",
 							Role: lambdaRoleArn,
 							Handler: "index.handler",
-							Code: { ZipFile: await fs.readFile(zipFilePath) },
+							Code: { ZipFile: zipFile },
 							Description: "Hot Updater Lambda@Edge function",
+							MemorySize: LAMBDA_MEMORY_SIZE,
 							Publish: true,
-							MemorySize: LAMBDA_EDGE_MEMORY_SIZE,
-							Timeout: LAMBDA_EDGE_TIMEOUT
-						});
+							Timeout: LAMBDA_TIMEOUT_SECONDS
+						}), message);
 						functionArn.arn = createResp.FunctionArn || null;
 						functionArn.version = createResp.Version || "1";
 						return `Created Lambda "${lambdaName}" function`;
@@ -7392,17 +9461,17 @@ var LambdaEdgeDeployer = class {
 								Publish: false
 							});
 							message("Waiting for Lambda function update to complete...");
-							await waitForFunctionUpdate(lambdaClient, lambdaName);
+							await this.waitForUpdate(lambdaClient, lambdaName);
 							await lambdaClient.updateFunctionConfiguration({
 								FunctionName: lambdaName,
-								MemorySize: LAMBDA_EDGE_MEMORY_SIZE,
-								Timeout: LAMBDA_EDGE_TIMEOUT
+								MemorySize: LAMBDA_MEMORY_SIZE,
+								Role: lambdaRoleArn,
+								Timeout: LAMBDA_TIMEOUT_SECONDS
 							});
-							message("Waiting for Lambda configuration update to complete...");
-							await waitForFunctionUpdate(lambdaClient, lambdaName);
-							const publishResp = await lambdaClient.publishVersion({ FunctionName: lambdaName });
-							functionArn.arn = publishResp.FunctionArn || null;
-							functionArn.version = publishResp.Version || "1";
+							await this.waitForUpdate(lambdaClient, lambdaName);
+							const published = await lambdaClient.publishVersion({ FunctionName: lambdaName });
+							functionArn.arn = published.FunctionArn || null;
+							functionArn.version = published.Version || null;
 						} else {
 							if (error instanceof Error) p.log.error(`Failed to create or update Lambda function: ${error.message}`);
 							throw error;
@@ -7437,287 +9506,6 @@ var LambdaEdgeDeployer = class {
 	}
 };
 //#endregion
-//#region iac/migrations/migrator.ts
-/**
-* S3Migration
-* Base class that each migration script extends.
-* Provides common S3-related methods (getKeys, readJson, updateFile, moveFile, backup, rollback, etc.)
-*/
-var S3Migration = class {
-	name;
-	s3;
-	bucketName;
-	dryRun = false;
-	backupMapping = /* @__PURE__ */ new Map();
-	async doUpdateFile(key, content, { cacheControl } = {}) {
-		const normalizedKey = key.startsWith("/") ? key.substring(1) : key;
-		await new Upload({
-			client: this.s3,
-			params: {
-				Bucket: this.bucketName,
-				Key: normalizedKey,
-				Body: content,
-				CacheControl: cacheControl
-			}
-		}).done();
-	}
-	async getKeys(prefix) {
-		const keys = [];
-		let continuationToken;
-		do {
-			const command = new ListObjectsV2Command({
-				Bucket: this.bucketName,
-				Prefix: prefix.startsWith("/") ? prefix.substring(1) : prefix,
-				ContinuationToken: continuationToken
-			});
-			const data = await this.s3.send(command);
-			if (data.Contents) {
-				for (const item of data.Contents) if (item.Key) keys.push(item.Key);
-			}
-			continuationToken = data?.NextContinuationToken;
-		} while (continuationToken);
-		return keys;
-	}
-	async readFile(key) {
-		try {
-			const command = new GetObjectCommand({
-				Bucket: this.bucketName,
-				Key: key.startsWith("/") ? key.substring(1) : key
-			});
-			const response = await this.s3.send(command);
-			if (response.Body) return await response.Body.transformToString();
-			return null;
-		} catch (error) {
-			console.error(colors.red(`Error reading file ${key}:`), error);
-			return null;
-		}
-	}
-	async readJson(key) {
-		const content = await this.readFile(key);
-		if (content) try {
-			return JSON.parse(content);
-		} catch (e) {
-			console.error(colors.red(`Error parsing JSON from ${key}:`), e);
-		}
-		return null;
-	}
-	async backupFile(key) {
-		if (this.dryRun) return;
-		const content = await this.readFile(key);
-		if (content !== null) {
-			const backupKey = `backup/${this.name}/${key}`;
-			await this.doUpdateFile(backupKey, content);
-			this.backupMapping.set(key, backupKey);
-		}
-	}
-	async updateFile(key, content, { cacheControl } = {}) {
-		const normalizedKey = key.startsWith("/") ? key.substring(1) : key;
-		if (this.dryRun) {
-			console.log(colors.yellow(`[DRY RUN] Updated ${colors.bold(normalizedKey)}`));
-			return;
-		}
-		if (await this.readFile(key) !== null) await this.backupFile(key);
-		await this.doUpdateFile(normalizedKey, content, { cacheControl });
-		console.log(colors.green(`Updated ${colors.bold(normalizedKey)}`));
-	}
-	async moveFile(from, to) {
-		if (this.dryRun) {
-			console.log(colors.yellow(`[DRY RUN] ${colors.bold(from)} -> ${colors.bold(to)}`));
-			return;
-		}
-		await this.backupFile(from);
-		try {
-			const copyCommand = new CopyObjectCommand({
-				Bucket: this.bucketName,
-				CopySource: `${this.bucketName}/${from}`,
-				Key: to
-			});
-			await this.s3.send(copyCommand);
-		} catch (error) {
-			console.error(colors.red(`Error copying file from ${from} to ${to}:`), error);
-			throw error;
-		}
-		try {
-			const deleteCommand = new DeleteObjectCommand({
-				Bucket: this.bucketName,
-				Key: from
-			});
-			await this.s3.send(deleteCommand);
-		} catch (error) {
-			if (error?.message?.includes("NoSuchKey")) console.warn(colors.yellow(`Key ${from} not found during deletion, ignoring.`));
-			else {
-				console.error(colors.red(`Error deleting file ${from}:`), error);
-				throw error;
-			}
-		}
-		console.log(colors.green(`${colors.bold(from)} -> ${colors.bold(to)}`));
-	}
-	async deleteBackupFile(backupKey) {
-		if (this.dryRun) return;
-		try {
-			const deleteCommand = new DeleteObjectCommand({
-				Bucket: this.bucketName,
-				Key: backupKey
-			});
-			await this.s3.send(deleteCommand);
-		} catch (error) {
-			console.error(colors.red(`Error deleting backup file ${backupKey}:`), error);
-		}
-	}
-	async cleanupBackups() {
-		if (this.backupMapping.size === 0) return;
-		for (const backupKey of this.backupMapping.values()) await this.deleteBackupFile(backupKey);
-		this.backupMapping.clear();
-	}
-	async rollback() {
-		console.log(colors.magenta(`Starting rollback for migration ${this.name}...`));
-		for (const [originalKey, backupKey] of this.backupMapping.entries()) {
-			const backupContent = await this.readFile(backupKey);
-			if (backupContent !== null) {
-				console.log(colors.blue(`Restoring backup for ${originalKey} from ${backupKey}`));
-				await this.doUpdateFile(originalKey, backupContent);
-			} else console.error(colors.red(`Failed to read backup for ${originalKey} at ${backupKey}`));
-		}
-		console.log(colors.green(`Rollback completed for migration ${this.name}.`));
-	}
-};
-/**
-* S3Migrator
-* Manages migration records and sequentially executes the provided migration scripts.
-*/
-var S3Migrator = class {
-	s3;
-	bucketName;
-	migrationRecordKey = "migrate.json";
-	migrationRecords = [];
-	migrations;
-	constructor(options) {
-		this.bucketName = options.bucketName;
-		this.s3 = options.s3;
-		this.migrations = options.migrations;
-	}
-	async loadMigrationRecords() {
-		try {
-			const command = new GetObjectCommand({
-				Bucket: this.bucketName,
-				Key: this.migrationRecordKey
-			});
-			const response = await this.s3.send(command);
-			if (response.Body) {
-				const bodyContents = await response.Body.transformToString();
-				try {
-					this.migrationRecords = JSON.parse(bodyContents);
-				} catch (jsonError) {
-					console.error(colors.red("Failed to parse migration records JSON:"), jsonError);
-					this.migrationRecords = [];
-				}
-			}
-		} catch (error) {
-			if (error.Code === "NoSuchKey" || error.name === "NoSuchKey" || error.message === "NoSuchKey" || error.$metadata?.httpStatusCode === 404) this.migrationRecords = [];
-			else throw error;
-		}
-	}
-	async saveMigrationRecords(dryRun) {
-		if (dryRun) return;
-		const body = JSON.stringify(this.migrationRecords, null, 2);
-		await new Upload({
-			client: this.s3,
-			params: {
-				Bucket: this.bucketName,
-				Key: this.migrationRecordKey,
-				Body: body
-			}
-		}).done();
-	}
-	/**
-	* Returns a JSON object containing applied and pending migrations.
-	*/
-	async list() {
-		await this.loadMigrationRecords();
-		return {
-			applied: this.migrationRecords.map((record) => ({
-				name: record.name,
-				appliedAt: record.appliedAt
-			})),
-			pending: this.migrations.filter((migration) => !this.migrationRecords.some((record) => record.name === migration.name)).map((migration) => ({ name: migration.name }))
-		};
-	}
-	async migrate({ dryRun }) {
-		await this.loadMigrationRecords();
-		for (const migration of this.migrations) {
-			if (this.migrationRecords.some((record) => record.name === migration.name)) continue;
-			console.log(colors.magenta(`Applying migration ${migration.name}...`));
-			migration.s3 = this.s3;
-			migration.bucketName = this.bucketName;
-			migration.dryRun = dryRun;
-			try {
-				await migration.migrate();
-				if (!dryRun) {
-					this.migrationRecords.push({
-						name: migration.name,
-						appliedAt: (/* @__PURE__ */ new Date()).toISOString()
-					});
-					console.log(colors.green(`${colors.bold(migration.name)} applied successfully.`));
-					await migration.cleanupBackups();
-				} else console.log(colors.yellow(`[DRY RUN] ${colors.bold(migration.name)} applied successfully`));
-			} catch (error) {
-				console.error(colors.red(`Migration ${migration.name} failed. Initiating rollback...`), error);
-				await migration.rollback();
-				throw error;
-			}
-		}
-		await this.saveMigrationRecords(dryRun);
-		if (!dryRun) console.log(colors.blue("All migrations applied."));
-	}
-};
-//#endregion
-//#region iac/migrations/Migration0001HotUpdater0_13_0.ts
-/**
-* Migration0001HotUpdater0_13_0
-* 1. Moves all files starting with ios/ or android/ to under production/ directory.
-* 2. Reads update.json files in the production/ path, removes the fileUrl property from each item, merges { channel: "production" }, and updates them.
-*/
-var Migration0001HotUpdater0_13_0 = class extends S3Migration {
-	name = "hot-updater_0.13.0";
-	async migrate() {
-		const keysToMove = (await this.getKeys("")).filter((key) => !key.startsWith("production/") && /^(ios|android)\//.test(key));
-		for (const key of keysToMove) {
-			const newKey = `production/${key}`;
-			await this.moveFile(key, newKey);
-		}
-		const updateKeys = (await this.getKeys("production/")).filter((key) => key.endsWith("update.json"));
-		for (const key of updateKeys) {
-			const data = await this.readJson(key);
-			if (data && Array.isArray(data)) {
-				const updatedData = data.map((item) => merge(omit(item, ["fileUrl"]), { channel: "production" }));
-				await this.updateFile(key, JSON.stringify(updatedData));
-			}
-		}
-	}
-};
-//#endregion
-//#region iac/migrations/Migration0001HotUpdater0_18_0.ts
-/**
-* Migration0001HotUpdater0_18_0
-* Adds storageUri to all update.json files.
-*/
-var Migration0001HotUpdater0_18_0 = class extends S3Migration {
-	name = "hot-updater_0.18.0";
-	async migrate() {
-		const updateKeys = (await this.getKeys("")).filter((key) => key.endsWith("update.json"));
-		for (const key of updateKeys) {
-			const data = await this.readJson(key);
-			if (data && Array.isArray(data)) {
-				const updatedData = data.map((item) => merge(item, {
-					storageUri: `s3://${this.bucketName}/${item.id}/bundle.zip`,
-					metadata: {}
-				}));
-				await this.updateFile(key, JSON.stringify(updatedData));
-			}
-		}
-	}
-};
-//#endregion
 //#region iac/s3.ts
 function normalizeBucketRegion(region) {
 	if (region == null) return "us-east-1";
@@ -7753,49 +9541,44 @@ var S3Manager = class {
 		});
 		p.log.info(`Created S3 bucket: ${bucketName}`);
 	}
-	async runMigrations({ approved, bucketName, nonInteractive, region, migrations }) {
-		const migrator = new S3Migrator({
-			s3: new S3({
-				region,
-				credentials: this.credentials
-			}),
-			bucketName,
-			migrations
-		});
-		const { pending } = await migrator.list();
-		await migrator.migrate({ dryRun: true });
-		if (pending.length === 0) return false;
-		p.log.step("Pending migrations:");
-		for (const migration of pending) p.log.step(`- ${migration.name}`);
-		if (!nonInteractive || !approved) {
-			if (nonInteractive) throw new MissingInitInputsError(["HOT_UPDATER_AWS_MIGRATION_APPROVED"]);
-			const confirm = await p.confirm({
-				initialValue: approved,
-				message: "Do you want to continue?"
-			});
-			if (p.isCancel(confirm) || !confirm) {
-				p.log.info("Migration cancelled.");
-				process.exit(1);
-			}
-		}
-		await migrator.migrate({ dryRun: false });
-		return true;
-	}
 	async updateBucketPolicy({ bucketName, region, distributionId, accountId }) {
 		const s3Client = new S3({
 			region,
 			credentials: this.credentials
 		});
+		let existingPolicy = {};
+		try {
+			const { Policy } = await s3Client.getBucketPolicy({ Bucket: bucketName });
+			if (Policy) {
+				const parsed = JSON.parse(Policy);
+				if (typeof parsed !== "object" || parsed === null) throw new Error("Existing S3 bucket policy is not a JSON object");
+				existingPolicy = Object.fromEntries(Object.entries(parsed));
+			}
+		} catch (error) {
+			if (typeof error !== "object" || error === null || Reflect.get(error, "name") !== "NoSuchBucketPolicy") throw error;
+		}
+		const policyStatements = Array.isArray(existingPolicy.Statement) ? existingPolicy.Statement : typeof existingPolicy.Statement === "object" && existingPolicy.Statement !== null ? [existingPolicy.Statement] : [];
+		const sourceArn = `arn:aws:cloudfront::${accountId}:distribution/${distributionId}`;
+		const statementId = `AllowHotUpdaterCloudFrontRead${distributionId.replace(/[^A-Za-z0-9]/g, "")}`;
+		const existingStatements = policyStatements.filter((statement) => {
+			if (typeof statement !== "object" || statement === null) return true;
+			const sid = Reflect.get(statement, "Sid");
+			if (sid === statementId) return false;
+			if (sid !== "AllowCloudFrontServicePrincipal" && sid !== "AllowHotUpdaterCloudFrontRead") return true;
+			const condition = Reflect.get(statement, "Condition");
+			const stringEquals = typeof condition === "object" && condition !== null ? Reflect.get(condition, "StringEquals") : void 0;
+			return !(typeof stringEquals === "object" && stringEquals !== null && Reflect.get(stringEquals, "AWS:SourceArn") === sourceArn);
+		});
 		const bucketPolicy = {
-			Version: "2008-10-17",
-			Id: "PolicyForCloudFrontPrivateContent",
-			Statement: [{
-				Sid: "AllowCloudFrontServicePrincipal",
+			...existingPolicy,
+			Version: typeof existingPolicy.Version === "string" ? existingPolicy.Version : "2012-10-17",
+			Statement: [...existingStatements, {
+				Sid: statementId,
 				Effect: "Allow",
 				Principal: { Service: "cloudfront.amazonaws.com" },
 				Action: "s3:GetObject",
 				Resource: `arn:aws:s3:::${bucketName}/*`,
-				Condition: { StringEquals: { "AWS:SourceArn": `arn:aws:cloudfront::${accountId}:distribution/${distributionId}` } }
+				Condition: { StringEquals: { "AWS:SourceArn": sourceArn } }
 			}]
 		};
 		await s3Client.putBucketPolicy({
@@ -7877,15 +9660,19 @@ const getConfigScaffold = (build, authMode) => {
 			pkg: "@hot-updater/aws",
 			named: ["s3Storage"]
 		}],
-		configString: "s3Storage(commonOptions)"
+		configString: `s3Storage({
+    ...awsOptions,
+    bucketName: process.env.HOT_UPDATER_S3_BUCKET_NAME!,
+  })`
 	};
 	const databaseConfig = {
 		imports: [{
 			pkg: "@hot-updater/aws",
-			named: ["s3Database"]
+			named: ["dynamoDB"]
 		}],
-		configString: `s3Database({
-    ...commonOptions,
+		configString: `dynamoDB({
+    ...awsOptions,
+    tableName: process.env.HOT_UPDATER_DYNAMODB_TABLE_NAME!,
     cloudfrontDistributionId: process.env.HOT_UPDATER_CLOUDFRONT_DISTRIBUTION_ID!,
   })`
 	};
@@ -7893,11 +9680,11 @@ const getConfigScaffold = (build, authMode) => {
 	switch (authMode.mode) {
 		case "sso":
 			helperStatements = [{
-				name: "commonOptions",
+				name: "awsOptions",
 				strategy: "merge-object",
+				replaceIncompatibleProperties: ["credentials"],
 				code: `
-const commonOptions = {
-  bucketName: process.env.HOT_UPDATER_S3_BUCKET_NAME!,
+const awsOptions = {
   region: process.env.HOT_UPDATER_S3_REGION!,
   credentials: fromSSO({ profile: process.env.HOT_UPDATER_AWS_PROFILE! }),
 };`.trim()
@@ -7905,16 +9692,15 @@ const commonOptions = {
 			break;
 		case "local":
 			helperStatements = [{
-				name: "commonOptions",
+				name: "awsOptions",
 				strategy: "merge-object",
+				replaceIncompatibleProperties: ["credentials"],
 				code: authMode.profile ? `
-const commonOptions = {
-  bucketName: process.env.HOT_UPDATER_S3_BUCKET_NAME!,
+const awsOptions = {
   region: process.env.HOT_UPDATER_S3_REGION!,
   credentials: fromIni({ profile: process.env.HOT_UPDATER_AWS_PROFILE! }),
 };`.trim() : `
-const commonOptions = {
-  bucketName: process.env.HOT_UPDATER_S3_BUCKET_NAME!,
+const awsOptions = {
   region: process.env.HOT_UPDATER_S3_REGION!,
   credentials: fromNodeProviderChain(),
 };`.trim()
@@ -7922,11 +9708,11 @@ const commonOptions = {
 			break;
 		case "account":
 			helperStatements = [{
-				name: "commonOptions",
+				name: "awsOptions",
 				strategy: "merge-object",
+				replaceIncompatibleProperties: ["credentials"],
 				code: `
-const commonOptions = {
-  bucketName: process.env.HOT_UPDATER_S3_BUCKET_NAME!,
+const awsOptions = {
   region: process.env.HOT_UPDATER_S3_REGION!,
   credentials: {
     accessKeyId: process.env.HOT_UPDATER_S3_ACCESS_KEY_ID!,
@@ -7958,13 +9744,19 @@ const SOURCE_TEMPLATE = `// Add this to your App.tsx
 import { HotUpdater } from "@hot-updater/react-native";
 
 function App() {
-  return null; // Replace with your app root
+  return null; // Replace with your app root.
 }
 
-export default HotUpdater.wrap({
-  baseURL: "%%source%%",
-  updateStrategy: "appVersion", // or "fingerprint"
-})(App);`;
+HotUpdater.init({
+  baseURL: %%source%%,
+  requestHeaders: {
+    "x-api-key": %%apiKey%%,
+  },
+});
+
+// Call HotUpdater.checkForUpdate({ updateStrategy: "appVersion" })
+// when your app is ready to check.
+export default App;`;
 //#endregion
 //#region iac/index.ts
 const checkIfAwsCliInstalled = async () => {
@@ -7978,6 +9770,16 @@ const checkIfAwsCliInstalled = async () => {
 const isAwsRegion = (value) => {
 	return value !== void 0 && Object.hasOwn(regionLocationMap, value);
 };
+const prepareDynamoDBDeployment = async (input) => {
+	return new DynamoDBManager(input.region, input.credentials).ensureTable(input.tableName);
+};
+const prepareDynamoDBApiKey = async (input) => {
+	return (await provisionApiKey({
+		apiKeys: input.apiKeys,
+		existingApiKey: input.existingApiKey,
+		name: "AWS init"
+	})).apiKey;
+};
 const runInit = async ({ build, envFile }) => {
 	const nonInteractive = envFile !== void 0;
 	const initEnvSources = await readHotUpdaterInitEnv(process.cwd(), envFile);
@@ -7995,6 +9797,7 @@ const runInit = async ({ build, envFile }) => {
 	p.log.message(`${colors.blue("CloudFrontFullAccess")}: Create and update CloudFront distributions`);
 	p.log.message(`${colors.blue("IAMFullAccess")}: Get or create IAM roles for Lambda@Edge`);
 	p.log.message(`${colors.blue("AmazonSSMFullAccess")}: Access to SSM Parameters for storing CloudFront key pairs`);
+	p.log.message(`${colors.blue("AmazonDynamoDBFullAccess_v2")}: Create and configure the metadata table`);
 	const { awsProfile, configAuthMode, credentials, mode } = await resolveAwsAuth(providerEnv, nonInteractive);
 	const resolvedAuthInputs = {
 		...savedInputs,
@@ -8021,9 +9824,9 @@ const runInit = async ({ build, envFile }) => {
 	const savedBucketRegion = savedInputs.bucketRegion;
 	const existingBucket = availableBuckets.find((bucket) => bucket.name === savedBucketName);
 	const createSavedBucket = nonInteractive && savedBucketName !== void 0 && isAwsRegion(savedBucketRegion) && !existingBucket;
-	if (createSavedBucket && savedInputs.migrationApproved !== "true") throw new MissingInitInputsError(["HOT_UPDATER_AWS_MIGRATION_APPROVED"]);
 	if (savedBucketName && !existingBucket && !createSavedBucket) p.log.warn("Saved S3 bucket was not found. Select a bucket again.");
 	const savedLambdaName = savedInputs.lambdaName;
+	const savedDynamoDBTableName = savedInputs.dynamodbTableName;
 	const resourceInputs = await p.group({
 		bucketSelection: () => {
 			if (nonInteractive && existingBucket) return Promise.resolve(existingBucket.name);
@@ -8053,13 +9856,18 @@ const runInit = async ({ build, envFile }) => {
 				value: region
 			}))
 		}) : Promise.resolve(availableBuckets.find((bucket) => bucket.name === results.bucketSelection)?.region),
+		dynamodbTableName: () => nonInteractive && savedDynamoDBTableName ? Promise.resolve(savedDynamoDBTableName) : p.text({
+			...getInitProviderTextPromptValues(initProvider.inputs.dynamodbTableName.prompt, savedDynamoDBTableName),
+			message: initProvider.inputs.dynamodbTableName.prompt.message,
+			validate: (value) => value ? void 0 : "DynamoDB table name is required"
+		}),
 		lambdaName: () => nonInteractive && savedLambdaName ? Promise.resolve(savedLambdaName) : p.text({
 			...getInitProviderTextPromptValues(initProvider.inputs.lambdaName.prompt, savedLambdaName),
 			message: initProvider.inputs.lambdaName.prompt.message,
 			validate: (value) => value ? void 0 : "Lambda function name is required"
 		})
 	}, { onCancel: () => process.exit(1) });
-	const { bucketName, bucketRegion, lambdaName } = resourceInputs;
+	const { bucketName, bucketRegion, dynamodbTableName, lambdaName } = resourceInputs;
 	if (!bucketName || !lambdaName) {
 		p.log.error("AWS resource names are required.");
 		process.exit(1);
@@ -8068,19 +9876,29 @@ const runInit = async ({ build, envFile }) => {
 		p.log.error("AWS bucket region is required.");
 		process.exit(1);
 	}
+	const resolvedDynamoDBTableName = typeof dynamodbTableName === "string" ? dynamodbTableName : void 0;
+	if (!resolvedDynamoDBTableName) {
+		p.log.error("AWS DynamoDB table name is required.");
+		process.exit(1);
+	}
+	await assertAwsLambdaCanInitialize({
+		credentials,
+		lambdaName
+	});
 	const cloudFrontManager = new CloudFrontManager(bucketRegion, credentials);
 	const selectedDistribution = await cloudFrontManager.selectDistribution({
 		bucketName,
 		distributionId: savedInputs.distributionId,
 		nonInteractive
 	});
+	if (selectedDistribution?.DomainName) await assertAwsInfrastructureGeneration({ domainName: selectedDistribution.DomainName });
 	const resolvedInputs = {
 		...resolvedAuthInputs,
 		bucketName,
 		bucketRegion,
 		distributionId: selectedDistribution?.Id,
-		lambdaName,
-		migrationApproved: savedInputs.migrationApproved
+		dynamodbTableName: resolvedDynamoDBTableName,
+		lambdaName
 	};
 	const initEnv = getInitProviderEnvVars({
 		includeConsentInputs: await confirmInitInputPersistence({
@@ -8097,30 +9915,51 @@ const runInit = async ({ build, envFile }) => {
 	await makeEnv({
 		...initEnv,
 		...initEnv[accessKeyEnvKey] ? { [accessKeyEnvKey]: {
-			comment: "The current key may have excessive permissions. Update it with an S3FullAccess and CloudFrontFullAccess key.",
+			comment: "The current key may have excessive permissions. Replace it with least-privilege S3, DynamoDB, and CloudFront permissions.",
 			value: initEnv[accessKeyEnvKey]
 		} } : {},
 		...initEnv[secretAccessKeyEnvKey] ? { [secretAccessKeyEnvKey]: {
-			comment: "The current key may have excessive permissions. Update it with an S3FullAccess and CloudFrontFullAccess key.",
+			comment: "The current key may have excessive permissions. Replace it with least-privilege S3, DynamoDB, and CloudFront permissions.",
 			value: initEnv[secretAccessKeyEnvKey]
 		} } : {}
 	});
 	if (resourceInputs.bucketSelection === createKey) await s3Manager.createBucket(bucketName, bucketRegion);
 	p.log.info(`Selected S3 Bucket: ${bucketName} (${bucketRegion})`);
-	if (await s3Manager.runMigrations({
-		approved: savedInputs.migrationApproved === "true",
-		bucketName,
-		nonInteractive,
+	await prepareDynamoDBDeployment({
+		credentials,
+		region: bucketRegion,
+		tableName: resolvedDynamoDBTableName
+	});
+	const databasePlugin = dynamoDB({
+		credentials,
 		region: bucketRegion,
-		migrations: [new Migration0001HotUpdater0_13_0(), new Migration0001HotUpdater0_18_0()]
-	}) && savedInputs.migrationApproved !== "true") await makeEnv({ [initProvider.inputs.migrationApproved.envKey]: "true" });
-	const lambdaRoleArn = await new IAMManager(bucketRegion, credentials).createOrSelectRole();
-	const keyPair = await new SSMKeyPairManager(bucketRegion, credentials).getOrCreateKeyPair(`/hot-updater/${bucketName}/keypair`);
+		tableName: resolvedDynamoDBTableName
+	});
+	let apiKey;
+	try {
+		apiKey = await prepareDynamoDBApiKey({
+			apiKeys: databasePlugin.models.apiKeys,
+			existingApiKey: providerEnv.HOT_UPDATER_API_KEY
+		});
+		await makeEnv({ HOT_UPDATER_API_KEY: apiKey });
+	} finally {
+		await databasePlugin.dispose?.();
+	}
+	p.log.info(`Using DynamoDB table: ${resolvedDynamoDBTableName} (${bucketRegion})`);
+	const iamManager = new IAMManager(bucketRegion, credentials);
+	const ssmParameterName = getAwsV1SsmParameterName(lambdaName);
+	const lambdaRoleArn = await iamManager.createOrSelectRole({
+		bucketName,
+		dynamodbTableName: resolvedDynamoDBTableName,
+		lambdaName,
+		ssmParameterName
+	});
+	const keyPair = await new SSMKeyPairManager(bucketRegion, credentials).getOrCreateKeyPair(ssmParameterName);
 	const { publicKeyId, keyGroupId } = await cloudFrontManager.getOrCreateKeyGroup(keyPair.publicKey);
-	const lambdaEdgeDeployer = new LambdaEdgeDeployer(credentials);
-	const ssmParameterName = `/hot-updater/${bucketName}/keypair`;
-	const { functionArn } = await lambdaEdgeDeployer.deploy(lambdaRoleArn, lambdaName, {
+	const { functionArn } = await new LambdaEdgeDeployer(credentials).deploy(lambdaRoleArn, lambdaName, {
 		bucketName,
+		dynamodbRegion: bucketRegion,
+		dynamodbTableName: resolvedDynamoDBTableName,
 		publicKeyId,
 		ssmParameterName,
 		ssmRegion: bucketRegion
@@ -8146,10 +9985,15 @@ const runInit = async ({ build, envFile }) => {
 	if (configWriteResult.status === "created") p.log.success("Generated 'hot-updater.config.ts' file with AWS settings.");
 	else if (configWriteResult.status === "merged") p.log.success("Updated 'hot-updater.config.ts' file with AWS settings.");
 	else p.log.warn(`Kept existing 'hot-updater.config.ts' unchanged: ${configWriteResult.reason}`);
-	const sourceUrl = `https://${distributionDomain}/api/check-update`;
-	p.note(transformTemplate(SOURCE_TEMPLATE, { source: sourceUrl }));
+	const sourceUrl = `https://${distributionDomain}`;
+	p.note(transformTemplate(SOURCE_TEMPLATE, {
+		apiKey: JSON.stringify(apiKey),
+		source: JSON.stringify(sourceUrl)
+	}));
+	p.note(formatApiKeyNote(apiKey), "API Key");
+	p.log.message("Store this API key separately in a secure place.");
 	p.log.message(`Next step: ${link("https://hot-updater.dev/docs/managed/aws#step-4-changeenv-file-optional")}`);
 	p.log.success("Done! 🎉");
 };
 //#endregion
-export { runInit };
+export { prepareDynamoDBApiKey, prepareDynamoDBDeployment, runInit };