@hot-updater/aws 1.0.0-rc.16 → 1.0.0-rc.18

package/dist/iac/index.cjs

@@ -6341,17 +6341,27 @@ const DYNAMODB_LIMITS = {
 		sk: 1024
 	}
 };
-/** BatchGetItem takes 100 keys a call. */
+/** BatchGetItem takes 100 keys a call, and BatchWriteItem 25 requests. */
 const GET_BATCH = 100;
+const WRITE_BATCH = 25;
+/**
+* The table's TTL attribute: epoch seconds on every item of a row that
+* expires, which DynamoDB deletes for free. No column is named like it.
+*/
+const DYNAMODB_TTL_ATTRIBUTE = "_ttl";
 /** A column named like a key attribute is stored with a leading dot, which no column name has. */
 const attribute = (column) => column === "pk" || column === "sk" ? `.${column}` : column;
 const renamed = (record, rename) => Object.fromEntries(Object.entries(record).map(([name, value]) => [rename(name), value]));
-const toItem = (key, row) => ({
-	...renamed(row, attribute),
+const ttl = (expiresAt) => expiresAt === void 0 ? {} : { _ttl: Math.ceil(expiresAt / 1e3) };
+const toItem = (key, row, expiresAt) => ({
+	...renamed({
+		...row,
+		...ttl(expiresAt)
+	}, attribute),
 	pk: key.pk,
 	sk: key.sk
 });
-const toRow = ({ pk: _pk, sk: _sk, ...item }) => renamed(item, (name) => name.replace(/^\./, ""));
+const toRow = ({ pk: _pk, sk: _sk, _ttl, ...item }) => renamed(item, (name) => name.replace(/^\./, ""));
 const idOf = ({ pk, sk }) => JSON.stringify([pk, sk]);
 const nameOf = (error) => error.name;
 const sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
@@ -6383,14 +6393,17 @@ const toTransactItem = (tableName, op) => {
 		sk: op.key.sk
 	};
 	switch (op.type) {
-		case "put": return { Put: item({ Item: toItem(op.key, op.value) }) };
+		case "put": return { Put: item({ Item: toItem(op.key, op.value, op.expiresAt) }) };
 		case "delete": return { Delete: item({ Key }) };
 		case "check": return { ConditionCheck: item({
 			Key,
 			ConditionExpression: guard
 		}) };
 		case "add": {
-			const init = op.init ?? {};
+			const init = {
+				...op.init,
+				...ttl(op.expiresAt)
+			};
 			return { Update: item({
 				Key,
 				UpdateExpression: `SET ${Object.keys({
@@ -6441,19 +6454,36 @@ const createDynamoDBStore = ({ client, tableName, nativePageSize }) => {
 				}));
 				for (let round = 0; pending.length > 0; round += 1) {
 					if (round > 0) await sleep(2 ** round * 10);
-					const result = await documents.send(new _aws_sdk_lib_dynamodb.BatchGetCommand({ RequestItems: { [tableName]: {
+					const RequestItems = { [tableName]: {
 						Keys: pending,
 						ConsistentRead: true
-					} } })).catch(missingTable);
+					} };
+					const result = await documents.send(new _aws_sdk_lib_dynamodb.BatchGetCommand({ RequestItems })).catch(missingTable);
 					for (const item of result.Responses?.[tableName] ?? []) found.set(idOf(item), toRow(item));
 					pending = result.UnprocessedKeys?.[tableName]?.Keys ?? [];
 				}
 			}
 			return keys.map((key) => found.get(idOf(key)) ?? null);
 		},
+		/** Plain BatchWriteItem deletes: 1 write unit per KB each, not a transaction's 2. */
+		async deleteConsumed(keys) {
+			for (let at = 0; at < keys.length; at += WRITE_BATCH) {
+				let pending = keys.slice(at, at + WRITE_BATCH).map(({ pk, sk }) => ({ DeleteRequest: { Key: {
+					pk,
+					sk
+				} } }));
+				for (let round = 0; pending.length > 0; round += 1) {
+					if (round > 0) await sleep(2 ** round * 10);
+					const RequestItems = { [tableName]: pending };
+					const { UnprocessedItems } = await documents.send(new _aws_sdk_lib_dynamodb.BatchWriteCommand({ RequestItems })).catch(missingTable);
+					pending = UnprocessedItems?.[tableName] ?? [];
+				}
+			}
+		},
 		async query({ pk, gte, lt, lte, order, limit, after }) {
 			let condition = "pk = :pk";
-			if (gte !== void 0 && lt !== void 0) condition += " AND sk BETWEEN :gte AND :lte";
+			const between = gte !== void 0 && lt !== void 0;
+			if (between) condition += " AND sk BETWEEN :gte AND :lte";
 			else if (gte !== void 0) condition += " AND sk >= :gte";
 			else if (lt !== void 0) condition += " AND sk < :lt";
 			const result = await documents.send(new _aws_sdk_lib_dynamodb.QueryCommand({
@@ -6462,7 +6492,7 @@ const createDynamoDBStore = ({ client, tableName, nativePageSize }) => {
 				ExpressionAttributeValues: {
 					":pk": pk,
 					":gte": gte,
-					...gte !== void 0 && lt !== void 0 ? { ":lte": lte ?? lt } : { ":lt": lt }
+					...between ? { ":lte": lte ?? lt } : { ":lt": lt }
 				},
 				ScanIndexForward: order === "asc",
 				ConsistentRead: true,
@@ -6502,65 +6532,77 @@ const createDynamoDBStore = ({ client, tableName, nativePageSize }) => {
 			}
 		},
 		migrations: { 
-		/** Creates the table for local and test runs; `hot-updater init` creates it in AWS. */
+		/**
+		* Creates the table for local and test runs, and turns on its TTL,
+		* which every table the store runs on needs; `hot-updater init`
+		* creates it in AWS.
+		*/
 async apply() {
 			try {
 				await client.send(new _aws_sdk_client_dynamodb.DescribeTableCommand({ TableName: tableName }));
-				return;
 			} catch (error) {
 				if (nameOf(error) !== "ResourceNotFoundException") throw error;
+				await client.send(new _aws_sdk_client_dynamodb.CreateTableCommand({
+					TableName: tableName,
+					AttributeDefinitions: [{
+						AttributeName: "pk",
+						AttributeType: "S"
+					}, {
+						AttributeName: "sk",
+						AttributeType: "S"
+					}],
+					KeySchema: [{
+						AttributeName: "pk",
+						KeyType: "HASH"
+					}, {
+						AttributeName: "sk",
+						KeyType: "RANGE"
+					}],
+					BillingMode: "PAY_PER_REQUEST"
+				}));
+				await (0, _aws_sdk_client_dynamodb.waitUntilTableExists)({
+					client,
+					maxWaitTime: 120,
+					minDelay: 1,
+					maxDelay: 1
+				}, { TableName: tableName });
 			}
-			await client.send(new _aws_sdk_client_dynamodb.CreateTableCommand({
+			const { TimeToLiveDescription: ttl } = await client.send(new _aws_sdk_client_dynamodb.DescribeTimeToLiveCommand({ TableName: tableName }));
+			if (ttl?.TimeToLiveStatus?.startsWith("ENABL")) return;
+			const input = {
 				TableName: tableName,
-				AttributeDefinitions: [{
-					AttributeName: "pk",
-					AttributeType: "S"
-				}, {
-					AttributeName: "sk",
-					AttributeType: "S"
-				}],
-				KeySchema: [{
-					AttributeName: "pk",
-					KeyType: "HASH"
-				}, {
-					AttributeName: "sk",
-					KeyType: "RANGE"
-				}],
-				BillingMode: "PAY_PER_REQUEST"
-			}));
-			await (0, _aws_sdk_client_dynamodb.waitUntilTableExists)({
-				client,
-				maxWaitTime: 120,
-				minDelay: 1,
-				maxDelay: 1
-			}, { TableName: tableName });
+				TimeToLiveSpecification: {
+					AttributeName: DYNAMODB_TTL_ATTRIBUTE,
+					Enabled: true
+				}
+			};
+			await client.send(new _aws_sdk_client_dynamodb.UpdateTimeToLiveCommand(input));
 		} }
 	};
 };
 //#endregion
 //#region src/dynamoDB.ts
-/** The DynamoDB client ignores the CloudFront settings in its config. */
+/** The DynamoDB client ignores the CloudFront and batching settings. */
 const adapterOf = ({ tableName, ...clientConfig }) => {
 	const client = new _aws_sdk_client_dynamodb.DynamoDBClient(clientConfig);
+	const store = createDynamoDBStore({
+		client,
+		tableName
+	});
 	return {
 		client,
-		adapter: (0, _hot_updater_server_database.createKvAdapter)({ store: createDynamoDBStore({
-			client,
-			tableName
-		}) })
+		adapter: (0, _hot_updater_server_database.createKvAdapter)({ store })
 	};
 };
 /**
-* Creates the table when it is missing and writes the schema settings the
-* database checks before its first read. `hot-updater init` runs it in AWS.
+* Creates the table when it is missing and writes the schema settings of
+* core and `plugins`, the plugins the server runs, which the database checks
+* before its first read. `hot-updater init` runs it in AWS with the managed
+* server's plugins.
 */
-const migrateDynamoDB = async (config) => {
+const migrateDynamoDB = (config, plugins = []) => {
 	const { client, adapter } = adapterOf(config);
-	try {
-		await (0, _hot_updater_server_database.migrateBuiltInSchema)(adapter, "dynamoDB");
-	} finally {
-		client.destroy();
-	}
+	return (0, _hot_updater_server_database.migrateCoreSchema)(adapter, "dynamoDB", plugins).finally(() => client.destroy());
 };
 /**
 * Hot Updater's database on one DynamoDB table, through the storage engine.
@@ -6574,7 +6616,8 @@ const dynamoDB = (config) => {
 		...(0, _hot_updater_server_database.createEngineDatabase)({
 			name: "dynamoDB",
 			adapter,
-			onCachedRoutesChange: cloudFront?.invalidate
+			onCachedRoutesChange: cloudFront?.invalidate,
+			aggregateBatching: config.aggregateBatching ?? {}
 		}),
 		async dispose() {
 			await adapter.dispose?.();
@@ -7139,7 +7182,18 @@ function delay(ms, { signal } = {}) {
 }
 //#endregion
 //#region iac/cloudfrontDistributionConfig.ts
-const HOT_UPDATER_SHARED_CACHE_POLICY_CONFIG = {
+/**
+* The request headers a cache key holds: those the server's client-route
+* policy reads, so responses to different credentials never share an entry.
+*/
+const headersConfig = (clientHeaders) => clientHeaders.length === 0 ? { HeaderBehavior: "none" } : {
+	HeaderBehavior: "whitelist",
+	Headers: {
+		Quantity: clientHeaders.length,
+		Items: [...clientHeaders]
+	}
+};
+const buildSharedCachePolicyConfig = (clientHeaders) => ({
 	Name: "HotUpdaterOriginCacheControlV2",
 	Comment: "Honor origin Cache-Control without forwarding viewer Host/cookies/query strings",
 	DefaultTTL: 0,
@@ -7148,50 +7202,38 @@ const HOT_UPDATER_SHARED_CACHE_POLICY_CONFIG = {
 	ParametersInCacheKeyAndForwardedToOrigin: {
 		EnableAcceptEncodingBrotli: true,
 		EnableAcceptEncodingGzip: true,
-		HeadersConfig: {
-			HeaderBehavior: "whitelist",
-			Headers: {
-				Quantity: 1,
-				Items: ["x-api-key"]
-			}
-		},
+		HeadersConfig: headersConfig(clientHeaders),
 		CookiesConfig: { CookieBehavior: "none" },
 		QueryStringsConfig: { QueryStringBehavior: "none" }
 	}
-};
-const HOT_UPDATER_RELEASE_CATALOG_CACHE_POLICY_CONFIG = {
+});
+const buildReleaseCatalogCachePolicyConfig = (clientHeaders) => ({
 	Name: "HotUpdaterReleaseCatalogV1",
-	Comment: "Cache Release catalogs by canonical path, API key, and encoding",
+	Comment: "Cache Release catalogs by canonical path, client credential, and encoding",
 	DefaultTTL: 0,
 	MaxTTL: 5,
 	MinTTL: 0,
 	ParametersInCacheKeyAndForwardedToOrigin: {
 		EnableAcceptEncodingBrotli: true,
 		EnableAcceptEncodingGzip: true,
-		HeadersConfig: {
-			HeaderBehavior: "whitelist",
-			Headers: {
-				Quantity: 1,
-				Items: ["x-api-key"]
-			}
-		},
+		HeadersConfig: headersConfig(clientHeaders),
 		CookiesConfig: { CookieBehavior: "none" },
 		QueryStringsConfig: { QueryStringBehavior: "none" }
 	}
-};
-const HOT_UPDATER_ORIGIN_REQUEST_POLICY_CONFIG = {
+});
+const buildOriginRequestPolicyConfig = (clientHeaders) => ({
 	Name: "HotUpdaterManagedApiOriginRequestV2",
-	Comment: "Forward managed API bodies, query strings, and the API key",
+	Comment: "Forward managed API bodies, query strings, and the client credential",
 	HeadersConfig: {
 		HeaderBehavior: "whitelist",
 		Headers: {
-			Quantity: 2,
-			Items: ["content-type", "x-api-key"]
+			Quantity: clientHeaders.length + 1,
+			Items: ["content-type", ...clientHeaders]
 		}
 	},
 	CookiesConfig: { CookieBehavior: "none" },
 	QueryStringsConfig: { QueryStringBehavior: "all" }
-};
+});
 const READ_ONLY_METHODS = {
 	Quantity: 2,
 	Items: ["HEAD", "GET"],
@@ -7459,7 +7501,7 @@ var CloudFrontManager = class {
 		if (!cachePolicyId) throw new Error("Failed to create shared cache policy");
 		return cachePolicyId;
 	}
-	async getOrCreateOriginRequestPolicy(cloudfrontClient) {
+	async getOrCreateOriginRequestPolicy(cloudfrontClient, config) {
 		const existingPolicyId = (await findInPaginatedCloudFrontList({
 			listPage: async (marker) => {
 				const response = await cloudfrontClient.listOriginRequestPolicies({
@@ -7471,10 +7513,10 @@ var CloudFrontManager = class {
 					nextMarker: response.OriginRequestPolicyList?.NextMarker
 				};
 			},
-			matches: (policy) => policy.OriginRequestPolicy?.OriginRequestPolicyConfig?.Name === HOT_UPDATER_ORIGIN_REQUEST_POLICY_CONFIG.Name
+			matches: (policy) => policy.OriginRequestPolicy?.OriginRequestPolicyConfig?.Name === config.Name
 		}))?.OriginRequestPolicy?.Id;
 		if (existingPolicyId) return existingPolicyId;
-		const policyId = (await cloudfrontClient.createOriginRequestPolicy({ OriginRequestPolicyConfig: HOT_UPDATER_ORIGIN_REQUEST_POLICY_CONFIG })).OriginRequestPolicy?.Id;
+		const policyId = (await cloudfrontClient.createOriginRequestPolicy({ OriginRequestPolicyConfig: config })).OriginRequestPolicy?.Id;
 		if (!policyId) throw new Error("Failed to create origin request policy");
 		return policyId;
 	}
@@ -7550,9 +7592,9 @@ var CloudFrontManager = class {
 		let originRequestPolicyId;
 		try {
 			[sharedCachePolicyId, releaseCatalogCachePolicyId, originRequestPolicyId] = await Promise.all([
-				this.getOrCreateCachePolicy(cloudfrontClient, HOT_UPDATER_SHARED_CACHE_POLICY_CONFIG),
-				this.getOrCreateCachePolicy(cloudfrontClient, HOT_UPDATER_RELEASE_CATALOG_CACHE_POLICY_CONFIG),
-				this.getOrCreateOriginRequestPolicy(cloudfrontClient)
+				this.getOrCreateCachePolicy(cloudfrontClient, buildSharedCachePolicyConfig(options.clientHeaders)),
+				this.getOrCreateCachePolicy(cloudfrontClient, buildReleaseCatalogCachePolicyConfig(options.clientHeaders)),
+				this.getOrCreateOriginRequestPolicy(cloudfrontClient, buildOriginRequestPolicyConfig(options.clientHeaders))
 			]);
 		} catch (error) {
 			throw new Error(`Failed to get or create CloudFront request policies: ${error instanceof Error ? error.message : String(error)}`);
@@ -7711,6 +7753,17 @@ var DynamoDBTableSchemaError = class extends Error {
 		this.tableName = tableName;
 	}
 };
+/** TTL is on for another attribute; a table has one, and the store writes `_ttl`. */
+var DynamoDBTimeToLiveError = class extends Error {
+	tableName;
+	attributeName;
+	name = "DynamoDBTimeToLiveError";
+	constructor(tableName, attributeName) {
+		super(`DynamoDB table "${tableName}" has TTL on "${attributeName}", but Hot Updater expires rows by "${DYNAMODB_TTL_ATTRIBUTE}". Turn TTL off on the table (aws dynamodb update-time-to-live --table-name ${tableName} --time-to-live-specification Enabled=false,AttributeName=${attributeName}), then rerun init.`);
+		this.tableName = tableName;
+		this.attributeName = attributeName;
+	}
+};
 var DynamoDBPermissionError = class extends _hot_updater_cli_tools.InitError {
 	tableName;
 	region;
@@ -7761,10 +7814,11 @@ const buildDynamoDBCreateTableInput = (tableName) => ({
 	TableName: tableName
 });
 /**
-* The schema settings items the plugin checks before its first read, as one
-* BatchWriteItem request: what `migrateDynamoDB` writes to a new table.
+* The schema settings items of core and the managed server's plugins, which
+* the database checks before its first read, as one BatchWriteItem request:
+* what `migrateDynamoDB` writes to a new table for those plugins.
 */
-const buildDynamoDBSchemaSettingsInput = (tableName) => ({ RequestItems: { [tableName]: Object.entries(_hot_updater_server_database.builtInSettings).map(([key, value]) => ({ PutRequest: { Item: {
+const buildDynamoDBSchemaSettingsInput = (tableName) => ({ RequestItems: { [tableName]: Object.entries((0, _hot_updater_server_database.toolingTargetOf)(plugins).settings).map(([key, value]) => ({ PutRequest: { Item: {
 	pk: { S: _hot_updater_server_database.SETTINGS_TABLE.name },
 	sk: { S: (0, _hot_updater_server_database.encodeKvKey)([key]) },
 	key: { S: key },
@@ -7775,6 +7829,17 @@ const buildDynamoDBBackupInput = (tableName) => ({
 	PointInTimeRecoverySpecification: { PointInTimeRecoveryEnabled: true },
 	TableName: tableName
 });
+/**
+* Turns on the table's TTL, which deletes expired items for free: the store
+* writes `_ttl`, in epoch seconds, on every item of a row with retention.
+*/
+const buildDynamoDBTimeToLiveInput = (tableName) => ({
+	TableName: tableName,
+	TimeToLiveSpecification: {
+		AttributeName: DYNAMODB_TTL_ATTRIBUTE,
+		Enabled: true
+	}
+});
 var DynamoDBManager = class {
 	region;
 	client;
@@ -7802,16 +7867,31 @@ var DynamoDBManager = class {
 		}, { TableName: tableName });
 		await this.ensureLifecycle(tableName);
 	}
+	/** Point-in-time recovery and TTL, each turned on only when it is off. */
 	async ensureLifecycle(tableName) {
 		const { ContinuousBackupsDescription } = await this.client.describeContinuousBackups({ TableName: tableName });
-		if (ContinuousBackupsDescription?.PointInTimeRecoveryDescription?.PointInTimeRecoveryStatus === "ENABLED") return;
-		await this.client.updateContinuousBackups(buildDynamoDBBackupInput(tableName));
+		if (ContinuousBackupsDescription?.PointInTimeRecoveryDescription?.PointInTimeRecoveryStatus !== "ENABLED") await this.client.updateContinuousBackups(buildDynamoDBBackupInput(tableName));
+		const { TimeToLiveDescription: ttl } = await this.client.describeTimeToLive({ TableName: tableName });
+		const status = ttl?.TimeToLiveStatus;
+		if (status === "ENABLED" || status === "ENABLING") {
+			if (ttl?.AttributeName !== "_ttl") throw new DynamoDBTimeToLiveError(tableName, ttl?.AttributeName);
+			return;
+		}
+		await this.client.updateTimeToLive(buildDynamoDBTimeToLiveInput(tableName));
 	}
 };
 //#endregion
 //#region iac/iam.ts
-/** The partitions the plugin's items use: each table's rows, and its index items after `#`. */
-const dynamoDBLeadingKeys = () => [..._hot_updater_server_database.builtInSchema.tables, _hot_updater_server_database.SETTINGS_TABLE].flatMap(({ name }) => [name, `${name}#*`]);
+/**
+* The partitions the managed server's items use: each table's rows of core
+* and its plugins, and its index items after `#`, the log and lease tables
+* of batched aggregates included.
+*/
+const dynamoDBLeadingKeys = () => [
+	...(0, _hot_updater_server_database.toolingTargetOf)(plugins).schema.tables,
+	...(0, _hot_updater_server_database.resolveSchema)([_hot_updater_server_database.aggregateBatchingModule]).tables,
+	_hot_updater_server_database.SETTINGS_TABLE
+].flatMap(({ name }) => [name, `${name}#*`]);
 const buildDynamoDBPolicy = (region, accountId, tableName) => {
 	const tableArn = `arn:aws:dynamodb:${region}:${accountId}:table/${tableName}`;
 	return {
@@ -7819,6 +7899,7 @@ const buildDynamoDBPolicy = (region, accountId, tableName) => {
 		Statement: [{
 			Action: [
 				"dynamodb:BatchGetItem",
+				"dynamodb:BatchWriteItem",
 				"dynamodb:ConditionCheckItem",
 				"dynamodb:DeleteItem",
 				"dynamodb:GetItem",
@@ -8325,23 +8406,6 @@ const awsOptions = {
 	}
 	return (0, _hot_updater_cli_tools.createHotUpdaterConfigScaffoldFromBuilder)(builder, { helperStatements });
 };
-const SOURCE_TEMPLATE = `// Add this to your App.tsx
-import { HotUpdater } from "@hot-updater/react-native";
-
-function App() {
-  return null; // Replace with your app root.
-}
-
-HotUpdater.init({
-  baseURL: %%source%%,
-  requestHeaders: {
-    "x-api-key": %%apiKey%%,
-  },
-});
-
-// Call HotUpdater.checkForUpdate({ updateStrategy: "appVersion" })
-// when your app is ready to check.
-export default App;`;
 //#endregion
 //#region iac/index.ts
 const checkIfAwsCliInstalled = async () => {
@@ -8357,14 +8421,7 @@ const isAwsRegion = (value) => {
 };
 const prepareDynamoDBDeployment = async (input) => {
 	await new DynamoDBManager(input.region, input.credentials).ensureTable(input.tableName);
-	await migrateDynamoDB(input);
-};
-/** The app's client key, through the managed server's apiKeys() plugin, on the table it reads. */
-const prepareDynamoDBApiKey = async (input) => {
-	return (await (0, _hot_updater_server_db.createDatabasePluginApis)(input.database, plugins).apiKeys.provision({
-		existingApiKey: input.existingApiKey,
-		name: "AWS init"
-	})).apiKey;
+	await migrateDynamoDB(input, plugins);
 };
 const runInit = async ({ build, envFile }) => {
 	const nonInteractive = envFile !== void 0;
@@ -8522,13 +8579,13 @@ const runInit = async ({ build, envFile }) => {
 		region: bucketRegion,
 		tableName: resolvedDynamoDBTableName
 	});
-	let apiKey;
+	let credential;
 	try {
-		apiKey = await prepareDynamoDBApiKey({
-			database: databasePlugin,
-			existingApiKey: providerEnv.HOT_UPDATER_API_KEY
+		credential = await (0, _hot_updater_server_db.provisionClientCredential)(databasePlugin, plugins, {
+			env: providerEnv,
+			name: "AWS init"
 		});
-		await (0, _hot_updater_cli_tools.makeEnv)({ HOT_UPDATER_API_KEY: apiKey });
+		if (credential !== void 0) await (0, _hot_updater_cli_tools.makeEnv)({ [credential.env]: credential.value });
 	} finally {
 		await databasePlugin.dispose?.();
 	}
@@ -8554,6 +8611,7 @@ const runInit = async ({ build, envFile }) => {
 	const { distributionDomain, distributionId } = await cloudFrontManager.createOrUpdateDistribution({
 		keyGroupId,
 		bucketName,
+		clientHeaders: (0, _hot_updater_server_db.clientAuthOf)(plugins)?.varyHeaders ?? [],
 		distribution: selectedDistribution,
 		functionArn
 	});
@@ -8573,13 +8631,11 @@ const runInit = async ({ build, envFile }) => {
 	else if (configWriteResult.status === "merged") _hot_updater_cli_tools.p.log.success("Updated 'hot-updater.config.ts' file with AWS settings.");
 	else _hot_updater_cli_tools.p.log.warn(`Kept existing 'hot-updater.config.ts' unchanged: ${configWriteResult.reason}`);
 	await (0, _hot_updater_cli_tools.generateHotUpdaterPlugins)("@hot-updater/aws");
-	const sourceUrl = `https://${distributionDomain}`;
-	_hot_updater_cli_tools.p.note((0, _hot_updater_cli_tools.transformTemplate)(SOURCE_TEMPLATE, {
-		apiKey: JSON.stringify(apiKey),
-		source: JSON.stringify(sourceUrl)
-	}));
-	_hot_updater_cli_tools.p.note((0, _hot_updater_cli_tools.formatApiKeyNote)(apiKey), "API Key");
-	_hot_updater_cli_tools.p.log.message("Store this API key separately in a secure place.");
+	(0, _hot_updater_cli_tools.printAppSetup)({
+		baseURL: `https://${distributionDomain}`,
+		...credential === void 0 ? {} : { credential },
+		clientPlugins: (0, _hot_updater_server_db.clientPluginsOf)(plugins)
+	});
 	_hot_updater_cli_tools.p.log.message(`Next step: ${(0, _hot_updater_cli_tools.link)("https://hot-updater.dev/docs/managed/aws#step-4-changeenv-file-optional")}`);
 	_hot_updater_cli_tools.p.log.success("Done! 🎉");
 };
@@ -8589,8 +8645,8 @@ exports.buildDynamoDBBackupInput = buildDynamoDBBackupInput;
 exports.buildDynamoDBCreateTableInput = buildDynamoDBCreateTableInput;
 exports.buildDynamoDBPolicy = buildDynamoDBPolicy;
 exports.buildDynamoDBSchemaSettingsInput = buildDynamoDBSchemaSettingsInput;
+exports.buildDynamoDBTimeToLiveInput = buildDynamoDBTimeToLiveInput;
 exports.buildS3Policy = buildS3Policy;
 exports.buildSsmPolicy = buildSsmPolicy;
-exports.prepareDynamoDBApiKey = prepareDynamoDBApiKey;
 exports.prepareDynamoDBDeployment = prepareDynamoDBDeployment;
 exports.runInit = runInit;

package/dist/iac/index.d.cts

@@ -21,8 +21,9 @@ declare const buildDynamoDBCreateTableInput: (tableName: string) => {
   TableName: string;
 };
 /**
- * The schema settings items the plugin checks before its first read, as one
- * BatchWriteItem request: what `migrateDynamoDB` writes to a new table.
+ * The schema settings items of core and the managed server's plugins, which
+ * the database checks before its first read, as one BatchWriteItem request:
+ * what `migrateDynamoDB` writes to a new table for those plugins.
  */
 declare const buildDynamoDBSchemaSettingsInput: (tableName: string) => {
   RequestItems: {
@@ -55,6 +56,17 @@ declare const buildDynamoDBBackupInput: (tableName: string) => {
   };
   TableName: string;
 };
+/**
+ * Turns on the table's TTL, which deletes expired items for free: the store
+ * writes `_ttl`, in epoch seconds, on every item of a row with retention.
+ */
+declare const buildDynamoDBTimeToLiveInput: (tableName: string) => {
+  TableName: string;
+  TimeToLiveSpecification: {
+    AttributeName: string;
+    Enabled: true;
+  };
+};
 //#endregion
 //#region iac/iam.d.ts
 declare const buildDynamoDBPolicy: (region: string, accountId: string, tableName: string) => {
@@ -107,11 +119,6 @@ declare const prepareDynamoDBDeployment: (input: {
   readonly region: string;
   readonly tableName: string;
 }) => Promise<void>;
-/** The app's client key, through the managed server's apiKeys() plugin, on the table it reads. */
-declare const prepareDynamoDBApiKey: (input: {
-  readonly database: unknown;
-  readonly existingApiKey?: string;
-}) => Promise<string>;
 declare const runInit: ({ build, envFile }: RunInitOptions) => Promise<void>;
 //#endregion
-export { LAMBDA_EDGE_TRUST_POLICY, buildDynamoDBBackupInput, buildDynamoDBCreateTableInput, buildDynamoDBPolicy, buildDynamoDBSchemaSettingsInput, buildS3Policy, buildSsmPolicy, prepareDynamoDBApiKey, prepareDynamoDBDeployment, runInit };
+export { LAMBDA_EDGE_TRUST_POLICY, buildDynamoDBBackupInput, buildDynamoDBCreateTableInput, buildDynamoDBPolicy, buildDynamoDBSchemaSettingsInput, buildDynamoDBTimeToLiveInput, buildS3Policy, buildSsmPolicy, prepareDynamoDBDeployment, runInit };

package/dist/iac/index.d.mts

@@ -21,8 +21,9 @@ declare const buildDynamoDBCreateTableInput: (tableName: string) => {
   TableName: string;
 };
 /**
- * The schema settings items the plugin checks before its first read, as one
- * BatchWriteItem request: what `migrateDynamoDB` writes to a new table.
+ * The schema settings items of core and the managed server's plugins, which
+ * the database checks before its first read, as one BatchWriteItem request:
+ * what `migrateDynamoDB` writes to a new table for those plugins.
  */
 declare const buildDynamoDBSchemaSettingsInput: (tableName: string) => {
   RequestItems: {
@@ -55,6 +56,17 @@ declare const buildDynamoDBBackupInput: (tableName: string) => {
   };
   TableName: string;
 };
+/**
+ * Turns on the table's TTL, which deletes expired items for free: the store
+ * writes `_ttl`, in epoch seconds, on every item of a row with retention.
+ */
+declare const buildDynamoDBTimeToLiveInput: (tableName: string) => {
+  TableName: string;
+  TimeToLiveSpecification: {
+    AttributeName: string;
+    Enabled: true;
+  };
+};
 //#endregion
 //#region iac/iam.d.ts
 declare const buildDynamoDBPolicy: (region: string, accountId: string, tableName: string) => {
@@ -107,11 +119,6 @@ declare const prepareDynamoDBDeployment: (input: {
   readonly region: string;
   readonly tableName: string;
 }) => Promise<void>;
-/** The app's client key, through the managed server's apiKeys() plugin, on the table it reads. */
-declare const prepareDynamoDBApiKey: (input: {
-  readonly database: unknown;
-  readonly existingApiKey?: string;
-}) => Promise<string>;
 declare const runInit: ({ build, envFile }: RunInitOptions) => Promise<void>;
 //#endregion
-export { LAMBDA_EDGE_TRUST_POLICY, buildDynamoDBBackupInput, buildDynamoDBCreateTableInput, buildDynamoDBPolicy, buildDynamoDBSchemaSettingsInput, buildS3Policy, buildSsmPolicy, prepareDynamoDBApiKey, prepareDynamoDBDeployment, runInit };
+export { LAMBDA_EDGE_TRUST_POLICY, buildDynamoDBBackupInput, buildDynamoDBCreateTableInput, buildDynamoDBPolicy, buildDynamoDBSchemaSettingsInput, buildDynamoDBTimeToLiveInput, buildS3Policy, buildSsmPolicy, prepareDynamoDBDeployment, runInit };