@hot-updater/aws 1.1.3 → 1.2.0-rc.0

package/dist/index.cjs

@@ -7,6 +7,7 @@ let _aws_sdk_client_ssm = require("@aws-sdk/client-ssm");
 let _aws_sdk_cloudfront_signer = require("@aws-sdk/cloudfront-signer");
 let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
 let _aws_sdk_lib_storage = require("@aws-sdk/lib-storage");
+let node_crypto = require("node:crypto");
 //#region src/cloudFrontInvalidation.ts
 const DEFAULT_POLL_INTERVAL_MS = 2e3;
 const DEFAULT_TIMEOUT_MS = 3e5;
@@ -338,6 +339,14 @@ const migrateDynamoDB = (config, plugins = []) => {
 	return (0, _hot_updater_plugin_core.migrateCoreSchema)(adapter, "dynamoDB", plugins).finally(() => client.destroy());
 };
 /**
+* The resource this database reaches, without credentials, under the key
+* `hot-updater doctor` reads to tell the database `hot-updater init` saved
+* from another (a convention CLAUDE.md documents).
+*/
+const DATABASE_TARGET = Symbol.for("@hot-updater/database-target");
+/** `target` under {@link DATABASE_TARGET}, to spread into the database. */
+const marked = (target) => ({ [DATABASE_TARGET]: target });
+/**
 * Hot Updater's database on one DynamoDB table, through the storage engine.
 * With a distribution, it gives core the CloudFront invalidation core runs
 * after a write that changes what the update-check routes answer.
@@ -352,6 +361,7 @@ const dynamoDB = (config) => {
 			onCachedRoutesChange: cloudFront?.invalidate,
 			aggregateBatching: config.aggregateBatching ?? {}
 		}),
+		...marked(`dynamodb/${config.tableName}`),
 		async dispose() {
 			await adapter.dispose?.();
 			client.destroy();
@@ -636,7 +646,178 @@ function s3Storage(config) {
 	});
 }
 //#endregion
+//#region src/secretsManager.ts
+const NAME = "secretsManager";
+const REGION_PATTERN = /^[a-z]{2}(?:-[a-z]+)+-\d+$/u;
+/** The characters AWS takes in a secret's name. */
+const SECRET_ID_PATTERN = /^[A-Za-z0-9/_+=.@-]+$/u;
+const MAX_SECRET_ID_LENGTH = 512;
+/** AWS's limit on a `SecretString`, in bytes. */
+const MAX_SECRET_BYTES = 65536;
+const REQUEST_TIMEOUT_MS = 3e4;
+/** Errors of credentials AWS no longer takes: signing in again fixes them. */
+const EXPIRED_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set([
+	"ExpiredToken",
+	"ExpiredTokenException",
+	"IncompleteSignature",
+	"InvalidClientTokenId",
+	"InvalidSignatureException",
+	"MissingAuthenticationToken",
+	"UnrecognizedClientException"
+]);
+/** Errors of the SDK finding no credentials, or an expired SSO session. */
+const NO_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set(["CredentialsProviderError", "TokenProviderError"]);
+const SIGN_IN_HINT = "In CI, set them with aws-actions/configure-aws-credentials; on your machine, run aws sso login --profile <profile> and set AWS_PROFILE=<profile>";
+const errorName = (error) => error instanceof Error ? error.name : "";
+const errorMessage = (error) => (error instanceof Error ? error.message : String(error)).replace(/\.+$/u, "");
+const resolveEndpoint = (endpoint) => {
+	let url;
+	try {
+		url = new URL(endpoint.trim());
+	} catch {
+		throw new Error(`${NAME} endpoint must be a valid URL.`);
+	}
+	const loopback = (/* @__PURE__ */ new Set([
+		"localhost",
+		"127.0.0.1",
+		"[::1]"
+	])).has(url.hostname);
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.search || url.hash) throw new Error(`${NAME} endpoint must use HTTPS, or HTTP on a loopback address, without credentials, a query, or a fragment.`);
+	return url.toString();
+};
+/** Masks a value in the CLI's output, which loads `@hot-updater/cli-tools`. */
+const mask = async (values) => {
+	const { registerSecretValue } = await import("@hot-updater/cli-tools");
+	for (const value of values) if (value) registerSecretValue(value);
+};
+const checkCredentials = async (credentials) => {
+	if (!credentials?.accessKeyId || !credentials.secretAccessKey) throw new Error(`${NAME} credentials need an accessKeyId and a secretAccessKey.`);
+	await mask([credentials.secretAccessKey, credentials.sessionToken]);
+	return credentials;
+};
+/**
+* Secrets from AWS Secrets Manager: each name is the secret
+* `<prefix><name>`, its `SecretString`, or its `SecretBinary` as base64.
+* `set` puts a new version of the secret, and creates the secret when it
+* does not exist; AWS keeps the versions labeled `AWSCURRENT` and
+* `AWSPREVIOUS`, and removes the older ones itself. The AWS SDK loads on
+* the first read or write, so a config that only uses `s3Storage` never
+* loads it.
+*
+* @example
+* secrets: secretsManager({ region: "us-east-1" })
+*/
+const secretsManager = ({ credentials, endpoint, prefix = "hot-updater/", region }) => {
+	const checkSettings = () => {
+		if (typeof region !== "string" || !REGION_PATTERN.test(region)) throw new Error(`${NAME} needs an AWS region, such as "us-east-1", and ${JSON.stringify(region)} is not one.`);
+		if (prefix !== "" && !SECRET_ID_PATTERN.test(prefix)) throw new Error(`${NAME}'s prefix takes letters, digits, and /_+=.@- only.`);
+	};
+	const secretId = (name) => {
+		checkSettings();
+		const id = `${prefix}${name}`;
+		if (!SECRET_ID_PATTERN.test(name) || id.length > MAX_SECRET_ID_LENGTH) throw new Error(`${NAME} cannot name a secret ${JSON.stringify(id)}: AWS takes up to ${MAX_SECRET_ID_LENGTH} letters, digits, and /_+=.@- characters.`);
+		return id;
+	};
+	const resolveCredentials = () => {
+		if (credentials !== void 0) return async () => checkCredentials(typeof credentials === "function" ? await credentials() : credentials);
+		const accessKeyId = process.env["AWS_ACCESS_KEY_ID"];
+		const secretAccessKey = process.env["AWS_SECRET_ACCESS_KEY"];
+		if (Boolean(accessKeyId) !== Boolean(secretAccessKey)) throw new Error(`${NAME} found ${accessKeyId ? "AWS_ACCESS_KEY_ID" : "AWS_SECRET_ACCESS_KEY"} without ${accessKeyId ? "AWS_SECRET_ACCESS_KEY" : "AWS_ACCESS_KEY_ID"} in the environment: set both, or neither to use a profile.`);
+	};
+	let opened;
+	const open = () => {
+		checkSettings();
+		const signWith = resolveCredentials();
+		opened ??= import("@aws-sdk/client-secrets-manager").then((sdk) => ({
+			sdk,
+			client: new sdk.SecretsManagerClient({
+				region,
+				...signWith ? { credentials: signWith } : {},
+				...endpoint === void 0 ? {} : { endpoint: resolveEndpoint(endpoint) },
+				requestHandler: { requestTimeout: REQUEST_TIMEOUT_MS }
+			})
+		})).catch((error) => {
+			opened = void 0;
+			throw error;
+		});
+		return opened;
+	};
+	const describeFailure = (verb, id, error, permissions) => {
+		const name = errorName(error);
+		const status = error?.$metadata?.httpStatusCode;
+		const detail = `${name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}`;
+		if (NO_CREDENTIAL_ERRORS.has(name)) return new Error(`${NAME} found no usable AWS credentials to ${verb} ${JSON.stringify(id)} (${errorMessage(error)}). ${SIGN_IN_HINT}.`, { cause: error });
+		if (EXPIRED_CREDENTIAL_ERRORS.has(name)) return new Error(`AWS Secrets Manager refused the credentials to ${verb} ${JSON.stringify(id)}, ${detail}. They are expired or invalid: sign in again. ${SIGN_IN_HINT}.`, { cause: error });
+		if (name === "AccessDeniedException") return new Error(`AWS Secrets Manager refused to ${verb} ${JSON.stringify(id)}, ${detail}. The AWS identity needs ${permissions} on it, and on a secret encrypted with a customer managed KMS key, kms:Decrypt to read and kms:GenerateDataKey to store.`, { cause: error });
+		if (/marked for deletion|scheduled for deletion/iu.test(errorMessage(error))) return new Error(`AWS Secrets Manager cannot ${verb} ${JSON.stringify(id)}: it is scheduled for deletion. Restore it with aws secretsmanager restore-secret --secret-id ${id}, or wait until it is deleted.`, { cause: error });
+		return new Error(`AWS Secrets Manager failed to ${verb} ${JSON.stringify(id)}, ${detail}.`, { cause: error });
+	};
+	const read = async ({ sdk, client }, id) => {
+		let output;
+		try {
+			output = await client.send(new sdk.GetSecretValueCommand({ SecretId: id }));
+		} catch (error) {
+			if (error instanceof sdk.ResourceNotFoundException) return void 0;
+			throw describeFailure("read", id, error, "secretsmanager:GetSecretValue");
+		}
+		const value = output.SecretString ?? (output.SecretBinary === void 0 ? void 0 : Buffer.from(output.SecretBinary).toString("base64"));
+		await mask([value]);
+		return value;
+	};
+	return {
+		name: NAME,
+		get: async (names) => {
+			const unique = [...new Set(names)];
+			const ids = unique.map(secretId);
+			const result = Object.create(null);
+			if (unique.length === 0) return result;
+			const client = await open();
+			const values = await Promise.all(ids.map((id) => read(client, id)));
+			unique.forEach((name, index) => {
+				result[name] = values[index];
+			});
+			return result;
+		},
+		set: async (name, value) => {
+			const id = secretId(name);
+			if (typeof value !== "string" || value === "") throw new Error(`${NAME} cannot store an empty ${id}.`);
+			if (Buffer.byteLength(value, "utf8") > MAX_SECRET_BYTES) throw new Error(`${NAME} cannot store ${id}: AWS takes up to ${MAX_SECRET_BYTES} bytes per secret.`);
+			await mask([value]);
+			const { sdk, client } = await open();
+			const token = (0, node_crypto.randomUUID)();
+			const put = () => client.send(new sdk.PutSecretValueCommand({
+				ClientRequestToken: token,
+				SecretId: id,
+				SecretString: value
+			}));
+			try {
+				await put();
+				return;
+			} catch (error) {
+				if (!(error instanceof sdk.ResourceNotFoundException)) throw describeFailure("write", id, error, "secretsmanager:PutSecretValue");
+			}
+			try {
+				await client.send(new sdk.CreateSecretCommand({
+					ClientRequestToken: token,
+					Description: "Stored by Hot Updater.",
+					Name: id,
+					SecretString: value
+				}));
+			} catch (error) {
+				if (!(error instanceof sdk.ResourceExistsException)) throw describeFailure("create", id, error, "secretsmanager:CreateSecret");
+				try {
+					await put();
+				} catch (retryError) {
+					throw describeFailure("write", id, retryError, "secretsmanager:PutSecretValue");
+				}
+			}
+		},
+		describe: (name) => `the secret ${JSON.stringify(`${prefix}${name}`)} in AWS Secrets Manager (${region})`
+	};
+};
+//#endregion
 exports.cloudFrontDownloadUrl = cloudFrontDownloadUrl;
 exports.dynamoDB = dynamoDB;
 exports.migrateDynamoDB = migrateDynamoDB;
 exports.s3Storage = s3Storage;
+exports.secretsManager = secretsManager;

package/dist/index.d.cts

@@ -1,5 +1,5 @@
 import { DynamoDBClientConfig } from "@aws-sdk/client-dynamodb";
-import { EngineDatabase, PluginTables, StorageAdapter, StorageAdapterWith } from "@hot-updater/plugin-core";
+import { EngineDatabase, PluginTables, SecretsAdapter, StorageAdapter, StorageAdapterWith } from "@hot-updater/plugin-core";
 import { S3ClientConfig } from "@aws-sdk/client-s3";
 //#region src/dynamoDB.d.ts
 interface DynamoDBConfig extends DynamoDBClientConfig {
@@ -73,4 +73,51 @@ interface S3StorageConfig extends S3ClientConfig {
 type S3StorageOperations = "put" | "get" | "getDownloadUrl" | "exists" | "delete" | "listObjects" | "deleteObjects";
 declare function s3Storage(config: S3StorageConfig): StorageAdapterWith<S3StorageOperations>;
 //#endregion
-export { CloudFrontDownloadUrlOptions, type DynamoDBConfig, S3StorageConfig, cloudFrontDownloadUrl, dynamoDB, migrateDynamoDB, s3Storage };
+//#region src/secretsManager.d.ts
+/** AWS credentials, as the AWS SDK takes them. */
+interface SecretsManagerCredentials {
+  readonly accessKeyId: string;
+  readonly secretAccessKey: string;
+  readonly sessionToken?: string;
+  readonly expiration?: Date;
+}
+interface SecretsManagerOptions {
+  /** The AWS region the secrets are in, such as `"us-east-1"`. */
+  readonly region: string;
+  /**
+   * Put before every name to make its secret's name, so `secret:asc-api-key`
+   * reads the secret `hot-updater/asc-api-key` and one IAM resource,
+   * `secret:hot-updater/*`, covers them all. Letters, digits, and
+   * `/_+=.@-`.
+   *
+   * @default "hot-updater/"
+   */
+  readonly prefix?: string;
+  /**
+   * The credentials to sign with, or a function that returns them. Without
+   * them, the AWS SDK's default chain: the environment, as
+   * `aws-actions/configure-aws-credentials` sets it in CI, then a profile,
+   * AWS SSO, or an instance role.
+   */
+  readonly credentials?: SecretsManagerCredentials | (() => Promise<SecretsManagerCredentials>);
+  /**
+   * An HTTPS endpoint to call instead of the region's, such as a VPC
+   * endpoint, or an HTTP loopback one, such as LocalStack's.
+   */
+  readonly endpoint?: string;
+}
+/**
+ * Secrets from AWS Secrets Manager: each name is the secret
+ * `<prefix><name>`, its `SecretString`, or its `SecretBinary` as base64.
+ * `set` puts a new version of the secret, and creates the secret when it
+ * does not exist; AWS keeps the versions labeled `AWSCURRENT` and
+ * `AWSPREVIOUS`, and removes the older ones itself. The AWS SDK loads on
+ * the first read or write, so a config that only uses `s3Storage` never
+ * loads it.
+ *
+ * @example
+ * secrets: secretsManager({ region: "us-east-1" })
+ */
+declare const secretsManager: ({ credentials, endpoint, prefix, region }: SecretsManagerOptions) => SecretsAdapter;
+//#endregion
+export { CloudFrontDownloadUrlOptions, type DynamoDBConfig, S3StorageConfig, SecretsManagerCredentials, SecretsManagerOptions, cloudFrontDownloadUrl, dynamoDB, migrateDynamoDB, s3Storage, secretsManager };

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 import { DynamoDBClientConfig } from "@aws-sdk/client-dynamodb";
-import { EngineDatabase, PluginTables, StorageAdapter, StorageAdapterWith } from "@hot-updater/plugin-core";
+import { EngineDatabase, PluginTables, SecretsAdapter, StorageAdapter, StorageAdapterWith } from "@hot-updater/plugin-core";
 import { S3ClientConfig } from "@aws-sdk/client-s3";
 //#region src/dynamoDB.d.ts
 interface DynamoDBConfig extends DynamoDBClientConfig {
@@ -73,4 +73,51 @@ interface S3StorageConfig extends S3ClientConfig {
 type S3StorageOperations = "put" | "get" | "getDownloadUrl" | "exists" | "delete" | "listObjects" | "deleteObjects";
 declare function s3Storage(config: S3StorageConfig): StorageAdapterWith<S3StorageOperations>;
 //#endregion
-export { CloudFrontDownloadUrlOptions, type DynamoDBConfig, S3StorageConfig, cloudFrontDownloadUrl, dynamoDB, migrateDynamoDB, s3Storage };
+//#region src/secretsManager.d.ts
+/** AWS credentials, as the AWS SDK takes them. */
+interface SecretsManagerCredentials {
+  readonly accessKeyId: string;
+  readonly secretAccessKey: string;
+  readonly sessionToken?: string;
+  readonly expiration?: Date;
+}
+interface SecretsManagerOptions {
+  /** The AWS region the secrets are in, such as `"us-east-1"`. */
+  readonly region: string;
+  /**
+   * Put before every name to make its secret's name, so `secret:asc-api-key`
+   * reads the secret `hot-updater/asc-api-key` and one IAM resource,
+   * `secret:hot-updater/*`, covers them all. Letters, digits, and
+   * `/_+=.@-`.
+   *
+   * @default "hot-updater/"
+   */
+  readonly prefix?: string;
+  /**
+   * The credentials to sign with, or a function that returns them. Without
+   * them, the AWS SDK's default chain: the environment, as
+   * `aws-actions/configure-aws-credentials` sets it in CI, then a profile,
+   * AWS SSO, or an instance role.
+   */
+  readonly credentials?: SecretsManagerCredentials | (() => Promise<SecretsManagerCredentials>);
+  /**
+   * An HTTPS endpoint to call instead of the region's, such as a VPC
+   * endpoint, or an HTTP loopback one, such as LocalStack's.
+   */
+  readonly endpoint?: string;
+}
+/**
+ * Secrets from AWS Secrets Manager: each name is the secret
+ * `<prefix><name>`, its `SecretString`, or its `SecretBinary` as base64.
+ * `set` puts a new version of the secret, and creates the secret when it
+ * does not exist; AWS keeps the versions labeled `AWSCURRENT` and
+ * `AWSPREVIOUS`, and removes the older ones itself. The AWS SDK loads on
+ * the first read or write, so a config that only uses `s3Storage` never
+ * loads it.
+ *
+ * @example
+ * secrets: secretsManager({ region: "us-east-1" })
+ */
+declare const secretsManager: ({ credentials, endpoint, prefix, region }: SecretsManagerOptions) => SecretsAdapter;
+//#endregion
+export { CloudFrontDownloadUrlOptions, type DynamoDBConfig, S3StorageConfig, SecretsManagerCredentials, SecretsManagerOptions, cloudFrontDownloadUrl, dynamoDB, migrateDynamoDB, s3Storage, secretsManager };

package/dist/index.mjs

@@ -6,6 +6,7 @@ import { SSM } from "@aws-sdk/client-ssm";
 import { getSignedUrl } from "@aws-sdk/cloudfront-signer";
 import { DeleteObjectCommand, DeleteObjectsCommand, GetObjectCommand, HeadObjectCommand, ListObjectsV2Command, S3Client } from "@aws-sdk/client-s3";
 import { Upload } from "@aws-sdk/lib-storage";
+import { randomUUID } from "node:crypto";
 //#region src/cloudFrontInvalidation.ts
 const DEFAULT_POLL_INTERVAL_MS = 2e3;
 const DEFAULT_TIMEOUT_MS = 3e5;
@@ -337,6 +338,14 @@ const migrateDynamoDB = (config, plugins = []) => {
 	return migrateCoreSchema(adapter, "dynamoDB", plugins).finally(() => client.destroy());
 };
 /**
+* The resource this database reaches, without credentials, under the key
+* `hot-updater doctor` reads to tell the database `hot-updater init` saved
+* from another (a convention CLAUDE.md documents).
+*/
+const DATABASE_TARGET = Symbol.for("@hot-updater/database-target");
+/** `target` under {@link DATABASE_TARGET}, to spread into the database. */
+const marked = (target) => ({ [DATABASE_TARGET]: target });
+/**
 * Hot Updater's database on one DynamoDB table, through the storage engine.
 * With a distribution, it gives core the CloudFront invalidation core runs
 * after a write that changes what the update-check routes answer.
@@ -351,6 +360,7 @@ const dynamoDB = (config) => {
 			onCachedRoutesChange: cloudFront?.invalidate,
 			aggregateBatching: config.aggregateBatching ?? {}
 		}),
+		...marked(`dynamodb/${config.tableName}`),
 		async dispose() {
 			await adapter.dispose?.();
 			client.destroy();
@@ -635,4 +645,174 @@ function s3Storage(config) {
 	});
 }
 //#endregion
-export { cloudFrontDownloadUrl, dynamoDB, migrateDynamoDB, s3Storage };
+//#region src/secretsManager.ts
+const NAME = "secretsManager";
+const REGION_PATTERN = /^[a-z]{2}(?:-[a-z]+)+-\d+$/u;
+/** The characters AWS takes in a secret's name. */
+const SECRET_ID_PATTERN = /^[A-Za-z0-9/_+=.@-]+$/u;
+const MAX_SECRET_ID_LENGTH = 512;
+/** AWS's limit on a `SecretString`, in bytes. */
+const MAX_SECRET_BYTES = 65536;
+const REQUEST_TIMEOUT_MS = 3e4;
+/** Errors of credentials AWS no longer takes: signing in again fixes them. */
+const EXPIRED_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set([
+	"ExpiredToken",
+	"ExpiredTokenException",
+	"IncompleteSignature",
+	"InvalidClientTokenId",
+	"InvalidSignatureException",
+	"MissingAuthenticationToken",
+	"UnrecognizedClientException"
+]);
+/** Errors of the SDK finding no credentials, or an expired SSO session. */
+const NO_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set(["CredentialsProviderError", "TokenProviderError"]);
+const SIGN_IN_HINT = "In CI, set them with aws-actions/configure-aws-credentials; on your machine, run aws sso login --profile <profile> and set AWS_PROFILE=<profile>";
+const errorName = (error) => error instanceof Error ? error.name : "";
+const errorMessage = (error) => (error instanceof Error ? error.message : String(error)).replace(/\.+$/u, "");
+const resolveEndpoint = (endpoint) => {
+	let url;
+	try {
+		url = new URL(endpoint.trim());
+	} catch {
+		throw new Error(`${NAME} endpoint must be a valid URL.`);
+	}
+	const loopback = (/* @__PURE__ */ new Set([
+		"localhost",
+		"127.0.0.1",
+		"[::1]"
+	])).has(url.hostname);
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.search || url.hash) throw new Error(`${NAME} endpoint must use HTTPS, or HTTP on a loopback address, without credentials, a query, or a fragment.`);
+	return url.toString();
+};
+/** Masks a value in the CLI's output, which loads `@hot-updater/cli-tools`. */
+const mask = async (values) => {
+	const { registerSecretValue } = await import("@hot-updater/cli-tools");
+	for (const value of values) if (value) registerSecretValue(value);
+};
+const checkCredentials = async (credentials) => {
+	if (!credentials?.accessKeyId || !credentials.secretAccessKey) throw new Error(`${NAME} credentials need an accessKeyId and a secretAccessKey.`);
+	await mask([credentials.secretAccessKey, credentials.sessionToken]);
+	return credentials;
+};
+/**
+* Secrets from AWS Secrets Manager: each name is the secret
+* `<prefix><name>`, its `SecretString`, or its `SecretBinary` as base64.
+* `set` puts a new version of the secret, and creates the secret when it
+* does not exist; AWS keeps the versions labeled `AWSCURRENT` and
+* `AWSPREVIOUS`, and removes the older ones itself. The AWS SDK loads on
+* the first read or write, so a config that only uses `s3Storage` never
+* loads it.
+*
+* @example
+* secrets: secretsManager({ region: "us-east-1" })
+*/
+const secretsManager = ({ credentials, endpoint, prefix = "hot-updater/", region }) => {
+	const checkSettings = () => {
+		if (typeof region !== "string" || !REGION_PATTERN.test(region)) throw new Error(`${NAME} needs an AWS region, such as "us-east-1", and ${JSON.stringify(region)} is not one.`);
+		if (prefix !== "" && !SECRET_ID_PATTERN.test(prefix)) throw new Error(`${NAME}'s prefix takes letters, digits, and /_+=.@- only.`);
+	};
+	const secretId = (name) => {
+		checkSettings();
+		const id = `${prefix}${name}`;
+		if (!SECRET_ID_PATTERN.test(name) || id.length > MAX_SECRET_ID_LENGTH) throw new Error(`${NAME} cannot name a secret ${JSON.stringify(id)}: AWS takes up to ${MAX_SECRET_ID_LENGTH} letters, digits, and /_+=.@- characters.`);
+		return id;
+	};
+	const resolveCredentials = () => {
+		if (credentials !== void 0) return async () => checkCredentials(typeof credentials === "function" ? await credentials() : credentials);
+		const accessKeyId = process.env["AWS_ACCESS_KEY_ID"];
+		const secretAccessKey = process.env["AWS_SECRET_ACCESS_KEY"];
+		if (Boolean(accessKeyId) !== Boolean(secretAccessKey)) throw new Error(`${NAME} found ${accessKeyId ? "AWS_ACCESS_KEY_ID" : "AWS_SECRET_ACCESS_KEY"} without ${accessKeyId ? "AWS_SECRET_ACCESS_KEY" : "AWS_ACCESS_KEY_ID"} in the environment: set both, or neither to use a profile.`);
+	};
+	let opened;
+	const open = () => {
+		checkSettings();
+		const signWith = resolveCredentials();
+		opened ??= import("@aws-sdk/client-secrets-manager").then((sdk) => ({
+			sdk,
+			client: new sdk.SecretsManagerClient({
+				region,
+				...signWith ? { credentials: signWith } : {},
+				...endpoint === void 0 ? {} : { endpoint: resolveEndpoint(endpoint) },
+				requestHandler: { requestTimeout: REQUEST_TIMEOUT_MS }
+			})
+		})).catch((error) => {
+			opened = void 0;
+			throw error;
+		});
+		return opened;
+	};
+	const describeFailure = (verb, id, error, permissions) => {
+		const name = errorName(error);
+		const status = error?.$metadata?.httpStatusCode;
+		const detail = `${name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}`;
+		if (NO_CREDENTIAL_ERRORS.has(name)) return new Error(`${NAME} found no usable AWS credentials to ${verb} ${JSON.stringify(id)} (${errorMessage(error)}). ${SIGN_IN_HINT}.`, { cause: error });
+		if (EXPIRED_CREDENTIAL_ERRORS.has(name)) return new Error(`AWS Secrets Manager refused the credentials to ${verb} ${JSON.stringify(id)}, ${detail}. They are expired or invalid: sign in again. ${SIGN_IN_HINT}.`, { cause: error });
+		if (name === "AccessDeniedException") return new Error(`AWS Secrets Manager refused to ${verb} ${JSON.stringify(id)}, ${detail}. The AWS identity needs ${permissions} on it, and on a secret encrypted with a customer managed KMS key, kms:Decrypt to read and kms:GenerateDataKey to store.`, { cause: error });
+		if (/marked for deletion|scheduled for deletion/iu.test(errorMessage(error))) return new Error(`AWS Secrets Manager cannot ${verb} ${JSON.stringify(id)}: it is scheduled for deletion. Restore it with aws secretsmanager restore-secret --secret-id ${id}, or wait until it is deleted.`, { cause: error });
+		return new Error(`AWS Secrets Manager failed to ${verb} ${JSON.stringify(id)}, ${detail}.`, { cause: error });
+	};
+	const read = async ({ sdk, client }, id) => {
+		let output;
+		try {
+			output = await client.send(new sdk.GetSecretValueCommand({ SecretId: id }));
+		} catch (error) {
+			if (error instanceof sdk.ResourceNotFoundException) return void 0;
+			throw describeFailure("read", id, error, "secretsmanager:GetSecretValue");
+		}
+		const value = output.SecretString ?? (output.SecretBinary === void 0 ? void 0 : Buffer.from(output.SecretBinary).toString("base64"));
+		await mask([value]);
+		return value;
+	};
+	return {
+		name: NAME,
+		get: async (names) => {
+			const unique = [...new Set(names)];
+			const ids = unique.map(secretId);
+			const result = Object.create(null);
+			if (unique.length === 0) return result;
+			const client = await open();
+			const values = await Promise.all(ids.map((id) => read(client, id)));
+			unique.forEach((name, index) => {
+				result[name] = values[index];
+			});
+			return result;
+		},
+		set: async (name, value) => {
+			const id = secretId(name);
+			if (typeof value !== "string" || value === "") throw new Error(`${NAME} cannot store an empty ${id}.`);
+			if (Buffer.byteLength(value, "utf8") > MAX_SECRET_BYTES) throw new Error(`${NAME} cannot store ${id}: AWS takes up to ${MAX_SECRET_BYTES} bytes per secret.`);
+			await mask([value]);
+			const { sdk, client } = await open();
+			const token = randomUUID();
+			const put = () => client.send(new sdk.PutSecretValueCommand({
+				ClientRequestToken: token,
+				SecretId: id,
+				SecretString: value
+			}));
+			try {
+				await put();
+				return;
+			} catch (error) {
+				if (!(error instanceof sdk.ResourceNotFoundException)) throw describeFailure("write", id, error, "secretsmanager:PutSecretValue");
+			}
+			try {
+				await client.send(new sdk.CreateSecretCommand({
+					ClientRequestToken: token,
+					Description: "Stored by Hot Updater.",
+					Name: id,
+					SecretString: value
+				}));
+			} catch (error) {
+				if (!(error instanceof sdk.ResourceExistsException)) throw describeFailure("create", id, error, "secretsmanager:CreateSecret");
+				try {
+					await put();
+				} catch (retryError) {
+					throw describeFailure("write", id, retryError, "secretsmanager:PutSecretValue");
+				}
+			}
+		},
+		describe: (name) => `the secret ${JSON.stringify(`${prefix}${name}`)} in AWS Secrets Manager (${region})`
+	};
+};
+//#endregion
+export { cloudFrontDownloadUrl, dynamoDB, migrateDynamoDB, s3Storage, secretsManager };

package/dist/init/index.cjs

@@ -6603,6 +6603,14 @@ const migrateDynamoDB = (config, plugins = []) => {
 	return (0, _hot_updater_plugin_core.migrateCoreSchema)(adapter, "dynamoDB", plugins).finally(() => client.destroy());
 };
 /**
+* The resource this database reaches, without credentials, under the key
+* `hot-updater doctor` reads to tell the database `hot-updater init` saved
+* from another (a convention CLAUDE.md documents).
+*/
+const DATABASE_TARGET = Symbol.for("@hot-updater/database-target");
+/** `target` under {@link DATABASE_TARGET}, to spread into the database. */
+const marked = (target) => ({ [DATABASE_TARGET]: target });
+/**
 * Hot Updater's database on one DynamoDB table, through the storage engine.
 * With a distribution, it gives core the CloudFront invalidation core runs
 * after a write that changes what the update-check routes answer.
@@ -6617,6 +6625,7 @@ const dynamoDB = (config) => {
 			onCachedRoutesChange: cloudFront?.invalidate,
 			aggregateBatching: config.aggregateBatching ?? {}
 		}),
+		...marked(`dynamodb/${config.tableName}`),
 		async dispose() {
 			await adapter.dispose?.();
 			client.destroy();
@@ -7961,7 +7970,9 @@ var DynamoDBManager = class {
 /**
 * The partitions the managed server's items use: each table's rows of core
 * and its plugins, and its index items after `#`, the log and lease tables
-* of batched aggregates and the settings rows included.
+* of batched aggregates and the settings rows included. A table a later
+* release adds reaches an existing deployment's policy when init runs again,
+* which writes the table's settings rows and puts this policy.
 */
 const dynamoDBLeadingKeys = () => [
 	...(0, _hot_updater_plugin_core.toolingTargetOf)([

package/dist/init/index.mjs

@@ -6598,6 +6598,14 @@ const migrateDynamoDB = (config, plugins = []) => {
 	return migrateCoreSchema(adapter, "dynamoDB", plugins).finally(() => client.destroy());
 };
 /**
+* The resource this database reaches, without credentials, under the key
+* `hot-updater doctor` reads to tell the database `hot-updater init` saved
+* from another (a convention CLAUDE.md documents).
+*/
+const DATABASE_TARGET = Symbol.for("@hot-updater/database-target");
+/** `target` under {@link DATABASE_TARGET}, to spread into the database. */
+const marked = (target) => ({ [DATABASE_TARGET]: target });
+/**
 * Hot Updater's database on one DynamoDB table, through the storage engine.
 * With a distribution, it gives core the CloudFront invalidation core runs
 * after a write that changes what the update-check routes answer.
@@ -6612,6 +6620,7 @@ const dynamoDB = (config) => {
 			onCachedRoutesChange: cloudFront?.invalidate,
 			aggregateBatching: config.aggregateBatching ?? {}
 		}),
+		...marked(`dynamodb/${config.tableName}`),
 		async dispose() {
 			await adapter.dispose?.();
 			client.destroy();
@@ -7956,7 +7965,9 @@ var DynamoDBManager = class {
 /**
 * The partitions the managed server's items use: each table's rows of core
 * and its plugins, and its index items after `#`, the log and lease tables
-* of batched aggregates and the settings rows included.
+* of batched aggregates and the settings rows included. A table a later
+* release adds reaches an existing deployment's policy when init runs again,
+* which writes the table's settings rows and puts this policy.
 */
 const dynamoDBLeadingKeys = () => [
 	...toolingTargetOf([