@hot-updater/aws 1.2.0-rc.1 → 1.2.0-rc.10

package/dist/index.mjs

@@ -1,11 +1,10 @@
 import { CreateTableCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DynamoDBClient, UpdateTimeToLiveCommand, waitUntilTableExists } from "@aws-sdk/client-dynamodb";
-import { BUNDLE_STORAGE_PREFIX, CONTENT_ADDRESSED_ASSET_PREFIX, createEngineDatabase, createKvAdapter, createStorageAdapter, createStorageKeyBuilder, createStorageUri, migrateCoreSchema, parseStorageUri } from "@hot-updater/plugin-core";
+import { BUNDLE_STORAGE_PREFIX, CONTENT_ADDRESSED_ASSET_PREFIX, createEngineDatabase, createKvAdapter, migrateCoreSchema, resolveLazy } from "@hot-updater/plugin-core";
 import { CloudFrontClient, CreateInvalidationCommand, GetInvalidationCommand } from "@aws-sdk/client-cloudfront";
 import { BatchGetCommand, BatchWriteCommand, DynamoDBDocumentClient, QueryCommand, TransactWriteCommand } from "@aws-sdk/lib-dynamodb";
 import { SSM } from "@aws-sdk/client-ssm";
 import { getSignedUrl } from "@aws-sdk/cloudfront-signer";
-import { DeleteObjectCommand, DeleteObjectsCommand, GetObjectCommand, HeadObjectCommand, ListObjectsV2Command, S3Client } from "@aws-sdk/client-s3";
-import { Upload } from "@aws-sdk/lib-storage";
+import { createS3Storage } from "@hot-updater/storage-s3";
 import { randomUUID } from "node:crypto";
 //#region src/cloudFrontInvalidation.ts
 const DEFAULT_POLL_INTERVAL_MS = 2e3;
@@ -314,10 +313,30 @@ async apply() {
 	};
 };
 //#endregion
+//#region src/lazyCredentials.ts
+/**
+* `credentials` as the AWS SDK takes them: access keys with a lazy field
+* become a provider, which the SDK calls once, on its first request.
+*/
+const toSdkCredentials = (credentials) => {
+	if (credentials === void 0 || typeof credentials === "function") return credentials;
+	const { accessKeyId, secretAccessKey, sessionToken, ...rest } = credentials;
+	if (typeof accessKeyId !== "function" && typeof secretAccessKey !== "function" && typeof sessionToken !== "function") return credentials;
+	return async () => ({
+		...rest,
+		accessKeyId: await resolveLazy(accessKeyId),
+		secretAccessKey: await resolveLazy(secretAccessKey),
+		...sessionToken === void 0 ? {} : { sessionToken: await resolveLazy(sessionToken) }
+	});
+};
+//#endregion
 //#region src/dynamoDB.ts
 /** The DynamoDB client ignores the CloudFront and batching settings. */
-const adapterOf = ({ tableName, ...clientConfig }) => {
-	const client = new DynamoDBClient(clientConfig);
+const adapterOf = ({ tableName, credentials, ...clientConfig }) => {
+	const client = new DynamoDBClient({
+		...clientConfig,
+		credentials: toSdkCredentials(credentials)
+	});
 	const store = createDynamoDBStore({
 		client,
 		tableName
@@ -352,7 +371,10 @@ const marked = (target) => ({ [DATABASE_TARGET]: target });
 */
 const dynamoDB = (config) => {
 	const { client, adapter } = adapterOf(config);
-	const cloudFront = createUpdateRouteInvalidation(config);
+	const cloudFront = createUpdateRouteInvalidation({
+		...config,
+		credentials: toSdkCredentials(config.credentials)
+	});
 	return {
 		...createEngineDatabase({
 			name: "dynamoDB",
@@ -495,153 +517,17 @@ const cloudFrontDownloadUrl = (config) => {
 };
 //#endregion
 //#region src/s3Storage.ts
-/** Devices download right after the update check that returns the URL. */
-const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
-const isObjectNotFoundError = (error) => error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchKey");
 function s3Storage(config) {
-	const { bucketName, basePath, getDownloadUrl, ...s3Config } = config;
-	const client = new S3Client(applyS3RuntimeAwsConfig(s3Config));
-	const normalizedBasePath = basePath?.replace(/^\/+|\/+$/g, "") ?? "";
-	const getStorageKey = createStorageKeyBuilder(normalizedBasePath);
-	const getListPrefix = (prefix = "") => {
-		const normalizedPrefix = prefix.replace(/^\/+|\/+$/g, "");
-		const value = [normalizedBasePath, normalizedPrefix].filter(Boolean).join("/");
-		return value ? `${value}/` : "";
-	};
-	/**
-	* The URI `put` returns for the key, or null for a key no `put` writes,
-	* such as a folder marker that ends in "/".
-	*/
-	const getListedStorageUri = (key) => {
-		try {
-			return createStorageUri({
-				bucket: bucketName,
-				key,
-				protocol: "s3"
-			});
-		} catch {
-			return null;
-		}
-	};
-	const getRelativeKey = (key) => {
-		if (!normalizedBasePath) return key;
-		const basePrefix = `${normalizedBasePath}/`;
-		return key.startsWith(basePrefix) ? key.slice(basePrefix.length) : key;
-	};
-	const parseAndValidate = (storageUri) => {
-		const parsed = parseStorageUri(storageUri, "s3");
-		if (parsed.bucket !== bucketName) throw new Error(`Bucket name mismatch: expected "${bucketName}", but found "${parsed.bucket}".`);
-		return parsed;
-	};
-	return createStorageAdapter({
+	const { bucketName, basePath, getDownloadUrl, credentials, ...s3Config } = config;
+	return createS3Storage({
 		name: "s3Storage",
-		protocol: "s3",
-		async listObjects(prefix) {
-			const objects = [];
-			let continuationToken;
-			do {
-				const response = await client.send(new ListObjectsV2Command({
-					Bucket: bucketName,
-					ContinuationToken: continuationToken,
-					Prefix: getListPrefix(prefix)
-				}));
-				for (const object of response.Contents ?? []) {
-					if (!object.Key) continue;
-					const storageUri = getListedStorageUri(object.Key);
-					if (storageUri === null) continue;
-					objects.push({
-						key: getRelativeKey(object.Key),
-						lastModifiedAt: object.LastModified,
-						size: object.Size ?? 0,
-						storageUri
-					});
-				}
-				continuationToken = response.NextContinuationToken;
-			} while (continuationToken);
-			return objects;
-		},
-		async deleteObjects(relativeKeys) {
-			const keys = relativeKeys.map((key) => getStorageKey(key));
-			for (let offset = 0; offset < keys.length; offset += 1e3) {
-				const batch = keys.slice(offset, offset + 1e3);
-				if (batch.length === 0) continue;
-				const response = await client.send(new DeleteObjectsCommand({
-					Bucket: bucketName,
-					Delete: {
-						Objects: batch.map((Key) => ({ Key })),
-						Quiet: true
-					}
-				}));
-				if (response.Errors && response.Errors.length > 0) throw new Error(`Failed to delete ${response.Errors.length} S3 object(s).`);
-			}
-		},
-		async put({ key, body, contentLength, contentType }) {
-			const storageKey = getStorageKey(key);
-			const response = await new Upload({
-				client,
-				params: {
-					Body: body,
-					Bucket: bucketName,
-					CacheControl: "max-age=31536000",
-					...contentLength === void 0 ? {} : { ContentLength: contentLength },
-					ContentType: contentType,
-					Key: storageKey
-				}
-			}).done();
-			if (!response.Bucket || !response.Key) throw new Error("Upload failed");
-			return { storageUri: createStorageUri({
-				bucket: bucketName,
-				key: storageKey,
-				protocol: "s3"
-			}) };
-		},
-		async get({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			try {
-				const response = await client.send(new GetObjectCommand({
-					Bucket: bucketName,
-					Key: key
-				}));
-				if (!response.Body) return { response: null };
-				const headers = new Headers();
-				if (response.ContentType) headers.set("content-type", response.ContentType);
-				if (response.ContentLength !== void 0) headers.set("content-length", String(response.ContentLength));
-				return { response: new Response(response.Body.transformToWebStream(), { headers }) };
-			} catch (error) {
-				if (isObjectNotFoundError(error)) return { response: null };
-				throw error;
-			}
-		},
-		async getDownloadUrl({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			if (getDownloadUrl) return getDownloadUrl({ storageUri });
-			const { getSignedUrl } = await import("@aws-sdk/s3-request-presigner");
-			return { url: await getSignedUrl(client, new GetObjectCommand({
-				Bucket: bucketName,
-				Key: key
-			}), { expiresIn: PRESIGNED_URL_EXPIRES_IN_SECONDS }) };
-		},
-		async exists({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			try {
-				await client.send(new HeadObjectCommand({
-					Bucket: bucketName,
-					Key: key
-				}));
-				return { exists: true };
-			} catch (error) {
-				if (isObjectNotFoundError(error)) return { exists: false };
-				throw error;
-			}
-		},
-		async delete({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			await client.send(new DeleteObjectCommand({
-				Bucket: bucketName,
-				Key: key
-			}));
-			return { deleted: true };
-		}
+		protocol: "s3"
+	}, {
+		...applyS3RuntimeAwsConfig(s3Config),
+		credentials,
+		bucketName,
+		basePath,
+		getDownloadUrl
 	});
 }
 //#endregion
@@ -666,7 +552,22 @@ const EXPIRED_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set([
 ]);
 /** Errors of the SDK finding no credentials, or an expired SSO session. */
 const NO_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set(["CredentialsProviderError", "TokenProviderError"]);
-const SIGN_IN_HINT = "In CI, set them with aws-actions/configure-aws-credentials; on your machine, run aws sso login --profile <profile> and set AWS_PROFILE=<profile>";
+const SIGN_IN_HINT = ["In CI, set them with aws-actions/configure-aws-credentials.", "On your machine: aws sso login --profile <profile>, then set AWS_PROFILE."];
+/** The widest line a message has: the CLI prints no wider. */
+const LINE_WIDTH = 76;
+/** `text`, such as AWS's own message, in lines that fit, broken at spaces. */
+const wrap = (text) => {
+	const lines = [];
+	let line = "";
+	for (const word of text.split(/\s+/u).filter(Boolean)) if (line && line.length + 1 + word.length > LINE_WIDTH) {
+		lines.push(line);
+		line = word;
+	} else line = line ? `${line} ${word}` : word;
+	if (line) lines.push(line);
+	return lines;
+};
+/** An error of one line each, for a terminal. */
+const failure = (lines, cause) => new Error(lines.join("\n"), cause === void 0 ? void 0 : { cause });
 const errorName = (error) => error instanceof Error ? error.name : "";
 const errorMessage = (error) => (error instanceof Error ? error.message : String(error)).replace(/\.+$/u, "");
 const resolveEndpoint = (endpoint) => {
@@ -681,7 +582,11 @@ const resolveEndpoint = (endpoint) => {
 		"127.0.0.1",
 		"[::1]"
 	])).has(url.hostname);
-	if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.search || url.hash) throw new Error(`${NAME} endpoint must use HTTPS, or HTTP on a loopback address, without credentials, a query, or a fragment.`);
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.search || url.hash) throw failure([
+		`${NAME} can't use its endpoint.`,
+		"Use HTTPS, or HTTP on a loopback address.",
+		"Leave out credentials, a query, and a fragment."
+	]);
 	return url.toString();
 };
 /** Masks a value in the CLI's output, which loads `@hot-updater/cli-tools`. */
@@ -708,20 +613,20 @@ const checkCredentials = async (credentials) => {
 */
 const secretsManager = ({ credentials, endpoint, prefix = "hot-updater/", region }) => {
 	const checkSettings = () => {
-		if (typeof region !== "string" || !REGION_PATTERN.test(region)) throw new Error(`${NAME} needs an AWS region, such as "us-east-1", and ${JSON.stringify(region)} is not one.`);
+		if (typeof region !== "string" || !REGION_PATTERN.test(region)) throw failure([`${NAME} can't use the region ${JSON.stringify(region)}.`, "Set an AWS region, such as \"us-east-1\"."]);
 		if (prefix !== "" && !SECRET_ID_PATTERN.test(prefix)) throw new Error(`${NAME}'s prefix takes letters, digits, and /_+=.@- only.`);
 	};
 	const secretId = (name) => {
 		checkSettings();
 		const id = `${prefix}${name}`;
-		if (!SECRET_ID_PATTERN.test(name) || id.length > MAX_SECRET_ID_LENGTH) throw new Error(`${NAME} cannot name a secret ${JSON.stringify(id)}: AWS takes up to ${MAX_SECRET_ID_LENGTH} letters, digits, and /_+=.@- characters.`);
+		if (!SECRET_ID_PATTERN.test(name) || id.length > MAX_SECRET_ID_LENGTH) throw failure([`${NAME} can't name a secret ${JSON.stringify(id)}.`, `AWS takes up to ${MAX_SECRET_ID_LENGTH} letters, digits, and /_+=.@- characters.`]);
 		return id;
 	};
 	const resolveCredentials = () => {
 		if (credentials !== void 0) return async () => checkCredentials(typeof credentials === "function" ? await credentials() : credentials);
 		const accessKeyId = process.env["AWS_ACCESS_KEY_ID"];
 		const secretAccessKey = process.env["AWS_SECRET_ACCESS_KEY"];
-		if (Boolean(accessKeyId) !== Boolean(secretAccessKey)) throw new Error(`${NAME} found ${accessKeyId ? "AWS_ACCESS_KEY_ID" : "AWS_SECRET_ACCESS_KEY"} without ${accessKeyId ? "AWS_SECRET_ACCESS_KEY" : "AWS_ACCESS_KEY_ID"} in the environment: set both, or neither to use a profile.`);
+		if (Boolean(accessKeyId) !== Boolean(secretAccessKey)) throw failure([`${NAME} found ${accessKeyId ? "AWS_ACCESS_KEY_ID" : "AWS_SECRET_ACCESS_KEY"} without ${accessKeyId ? "AWS_SECRET_ACCESS_KEY" : "AWS_ACCESS_KEY_ID"}.`, "Set both, or neither to use a profile."]);
 	};
 	let opened;
 	const open = () => {
@@ -744,12 +649,40 @@ const secretsManager = ({ credentials, endpoint, prefix = "hot-updater/", region
 	const describeFailure = (verb, id, error, permissions) => {
 		const name = errorName(error);
 		const status = error?.$metadata?.httpStatusCode;
-		const detail = `${name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}`;
-		if (NO_CREDENTIAL_ERRORS.has(name)) return new Error(`${NAME} found no usable AWS credentials to ${verb} ${JSON.stringify(id)} (${errorMessage(error)}). ${SIGN_IN_HINT}.`, { cause: error });
-		if (EXPIRED_CREDENTIAL_ERRORS.has(name)) return new Error(`AWS Secrets Manager refused the credentials to ${verb} ${JSON.stringify(id)}, ${detail}. They are expired or invalid: sign in again. ${SIGN_IN_HINT}.`, { cause: error });
-		if (name === "AccessDeniedException") return new Error(`AWS Secrets Manager refused to ${verb} ${JSON.stringify(id)}, ${detail}. The AWS identity needs ${permissions} on it, and on a secret encrypted with a customer managed KMS key, kms:Decrypt to read and kms:GenerateDataKey to store.`, { cause: error });
-		if (/marked for deletion|scheduled for deletion/iu.test(errorMessage(error))) return new Error(`AWS Secrets Manager cannot ${verb} ${JSON.stringify(id)}: it is scheduled for deletion. Restore it with aws secretsmanager restore-secret --secret-id ${id}, or wait until it is deleted.`, { cause: error });
-		return new Error(`AWS Secrets Manager failed to ${verb} ${JSON.stringify(id)}, ${detail}.`, { cause: error });
+		const detail = wrap(`${name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}.`);
+		const secret = `Secret: ${id}`;
+		if (NO_CREDENTIAL_ERRORS.has(name)) return failure([
+			`${NAME} found no AWS credentials to ${verb} a secret.`,
+			secret,
+			...wrap(`${errorMessage(error)}.`),
+			...SIGN_IN_HINT
+		], error);
+		if (EXPIRED_CREDENTIAL_ERRORS.has(name)) return failure([
+			`AWS Secrets Manager refused the sign-in to ${verb} a secret.`,
+			secret,
+			...detail,
+			"They are expired or invalid: sign in again.",
+			...SIGN_IN_HINT
+		], error);
+		if (name === "AccessDeniedException") return failure([
+			`AWS Secrets Manager refused to ${verb} a secret.`,
+			secret,
+			...detail,
+			`The AWS identity needs ${permissions} on it.`,
+			`With a customer managed KMS key, it needs ${verb === "read" ? "kms:Decrypt" : "kms:GenerateDataKey"} too.`
+		], error);
+		if (/marked for deletion|scheduled for deletion/iu.test(errorMessage(error))) return failure([
+			`AWS Secrets Manager can't ${verb} a secret.`,
+			secret,
+			"It is scheduled for deletion. Restore it, or wait until it is gone:",
+			"aws secretsmanager restore-secret \\",
+			`  --secret-id ${id}`
+		], error);
+		return failure([
+			`AWS Secrets Manager failed to ${verb} a secret.`,
+			secret,
+			...detail
+		], error);
 	};
 	const read = async ({ sdk, client }, id) => {
 		let output;
@@ -779,8 +712,8 @@ const secretsManager = ({ credentials, endpoint, prefix = "hot-updater/", region
 		},
 		set: async (name, value) => {
 			const id = secretId(name);
-			if (typeof value !== "string" || value === "") throw new Error(`${NAME} cannot store an empty ${id}.`);
-			if (Buffer.byteLength(value, "utf8") > MAX_SECRET_BYTES) throw new Error(`${NAME} cannot store ${id}: AWS takes up to ${MAX_SECRET_BYTES} bytes per secret.`);
+			if (typeof value !== "string" || value === "") throw new Error(`${NAME} can't store an empty ${id}.`);
+			if (Buffer.byteLength(value, "utf8") > MAX_SECRET_BYTES) throw failure([`${NAME} can't store ${id}.`, `AWS takes up to ${MAX_SECRET_BYTES} bytes per secret.`]);
 			await mask([value]);
 			const { sdk, client } = await open();
 			const token = randomUUID();

package/dist/init/index.cjs

@@ -6579,10 +6579,30 @@ async apply() {
 	};
 };
 //#endregion
+//#region src/lazyCredentials.ts
+/**
+* `credentials` as the AWS SDK takes them: access keys with a lazy field
+* become a provider, which the SDK calls once, on its first request.
+*/
+const toSdkCredentials = (credentials) => {
+	if (credentials === void 0 || typeof credentials === "function") return credentials;
+	const { accessKeyId, secretAccessKey, sessionToken, ...rest } = credentials;
+	if (typeof accessKeyId !== "function" && typeof secretAccessKey !== "function" && typeof sessionToken !== "function") return credentials;
+	return async () => ({
+		...rest,
+		accessKeyId: await (0, _hot_updater_plugin_core.resolveLazy)(accessKeyId),
+		secretAccessKey: await (0, _hot_updater_plugin_core.resolveLazy)(secretAccessKey),
+		...sessionToken === void 0 ? {} : { sessionToken: await (0, _hot_updater_plugin_core.resolveLazy)(sessionToken) }
+	});
+};
+//#endregion
 //#region src/dynamoDB.ts
 /** The DynamoDB client ignores the CloudFront and batching settings. */
-const adapterOf = ({ tableName, ...clientConfig }) => {
-	const client = new _aws_sdk_client_dynamodb.DynamoDBClient(clientConfig);
+const adapterOf = ({ tableName, credentials, ...clientConfig }) => {
+	const client = new _aws_sdk_client_dynamodb.DynamoDBClient({
+		...clientConfig,
+		credentials: toSdkCredentials(credentials)
+	});
 	const store = createDynamoDBStore({
 		client,
 		tableName
@@ -6617,7 +6637,10 @@ const marked = (target) => ({ [DATABASE_TARGET]: target });
 */
 const dynamoDB = (config) => {
 	const { client, adapter } = adapterOf(config);
-	const cloudFront = createUpdateRouteInvalidation(config);
+	const cloudFront = createUpdateRouteInvalidation({
+		...config,
+		credentials: toSdkCredentials(config.credentials)
+	});
 	return {
 		...(0, _hot_updater_plugin_core.createEngineDatabase)({
 			name: "dynamoDB",
@@ -6774,7 +6797,8 @@ const initProvider = {
 			help: "Existing CloudFront distribution ID",
 			optional: true
 		}
-	}
+	},
+	secrets: ["HOT_UPDATER_S3_ACCESS_KEY_ID", "HOT_UPDATER_S3_SECRET_ACCESS_KEY"]
 };
 //#endregion
 //#region iac/regionLocationMap.ts
@@ -8416,7 +8440,17 @@ var SSMKeyPairManager = class {
 };
 //#endregion
 //#region iac/templates.ts
-const getConfigScaffold = (build, authMode) => {
+/**
+* The config init writes. With the `resources` init set up, it names them,
+* and an account's access keys are read with `secret()`, from the
+* environment and `.env.hotupdater`, then the config's `secrets` adapter.
+* Without them, as the agent scaffold writes it before the agent creates the
+* resources, it reads their names from the environment, where the agent
+* records them. A profile or SSO sign-in is each person's own.
+*/
+const getConfigScaffold = (build, authMode, resources) => {
+	const value = (envKey, resolved) => resolved === void 0 ? `process.env.${envKey}!` : JSON.stringify(resolved);
+	const region = value("HOT_UPDATER_S3_REGION", resources?.region);
 	const storageConfig = {
 		imports: [{
 			pkg: "@hot-updater/aws",
@@ -8424,7 +8458,7 @@ const getConfigScaffold = (build, authMode) => {
 		}],
 		configString: `s3Storage({
     ...awsOptions,
-    bucketName: process.env.HOT_UPDATER_S3_BUCKET_NAME!,
+    bucketName: ${value("HOT_UPDATER_S3_BUCKET_NAME", resources?.bucketName)},
   })`
 	};
 	const databaseConfig = {
@@ -8434,8 +8468,8 @@ const getConfigScaffold = (build, authMode) => {
 		}],
 		configString: `dynamoDB({
     ...awsOptions,
-    tableName: process.env.HOT_UPDATER_DYNAMODB_TABLE_NAME!,
-    cloudfrontDistributionId: process.env.HOT_UPDATER_CLOUDFRONT_DISTRIBUTION_ID!,
+    tableName: ${value("HOT_UPDATER_DYNAMODB_TABLE_NAME", resources?.tableName)},
+    cloudfrontDistributionId: ${value("HOT_UPDATER_CLOUDFRONT_DISTRIBUTION_ID", resources?.cloudfrontDistributionId)},
   })`
 	};
 	let helperStatements;
@@ -8447,7 +8481,7 @@ const getConfigScaffold = (build, authMode) => {
 				replaceIncompatibleProperties: ["credentials"],
 				code: `
 const awsOptions = {
-  region: process.env.HOT_UPDATER_S3_REGION!,
+  region: ${region},
   credentials: fromSSO({ profile: process.env.HOT_UPDATER_AWS_PROFILE! }),
 };`.trim()
 			}];
@@ -8459,11 +8493,11 @@ const awsOptions = {
 				replaceIncompatibleProperties: ["credentials"],
 				code: authMode.profile ? `
 const awsOptions = {
-  region: process.env.HOT_UPDATER_S3_REGION!,
+  region: ${region},
   credentials: fromIni({ profile: process.env.HOT_UPDATER_AWS_PROFILE! }),
 };`.trim() : `
 const awsOptions = {
-  region: process.env.HOT_UPDATER_S3_REGION!,
+  region: ${region},
   credentials: fromNodeProviderChain(),
 };`.trim()
 			}];
@@ -8474,10 +8508,10 @@ const awsOptions = {
 			replaceIncompatibleProperties: ["credentials"],
 			code: `
 const awsOptions = {
-  region: process.env.HOT_UPDATER_S3_REGION!,
+  region: ${region},
   credentials: {
-    accessKeyId: process.env.HOT_UPDATER_S3_ACCESS_KEY_ID!,
-    secretAccessKey: process.env.HOT_UPDATER_S3_SECRET_ACCESS_KEY!,
+    accessKeyId: secret("HOT_UPDATER_S3_ACCESS_KEY_ID"),
+    secretAccessKey: secret("HOT_UPDATER_S3_SECRET_ACCESS_KEY"),
   },
 };`.trim()
 		}];
@@ -8500,9 +8534,15 @@ const awsOptions = {
 				named: ["fromSSO"]
 			});
 			break;
-		case "local": builder.addImport({
-			pkg: "@aws-sdk/credential-providers",
-			named: [authMode.profile ? "fromIni" : "fromNodeProviderChain"]
+		case "local":
+			builder.addImport({
+				pkg: "@aws-sdk/credential-providers",
+				named: [authMode.profile ? "fromIni" : "fromNodeProviderChain"]
+			});
+			break;
+		case "account": builder.addImport({
+			pkg: "hot-updater",
+			named: ["secret"]
 		});
 	}
 	return (0, _hot_updater_cli_tools.createHotUpdaterConfigScaffoldFromBuilder)(builder, { helperStatements });
@@ -8528,9 +8568,9 @@ const prepareDynamoDBDeployment = async (input) => {
 		(0, _hot_updater_server_plugins.remoteConfig)()
 	]);
 };
-const runInit = async ({ build, envFile }) => {
+const runInit = async ({ build, envFile, secretsEnv }) => {
 	const nonInteractive = envFile !== void 0;
-	const initEnvSources = await (0, _hot_updater_cli_tools.readHotUpdaterInitEnv)(process.cwd(), envFile);
+	const initEnvSources = await (0, _hot_updater_cli_tools.readHotUpdaterInitEnv)(process.cwd(), envFile, secretsEnv);
 	const { managedEnv } = initEnvSources;
 	const providerEnv = (0, _hot_updater_cli_tools.getHotUpdaterInitInputEnv)(initEnvSources, nonInteractive);
 	const savedInputs = resolveAwsInitInputs(providerEnv);
@@ -8739,7 +8779,12 @@ const runInit = async ({ build, envFile }) => {
 	if (mode === "sso") await (0, _hot_updater_cli_tools.ensureInstallPackages)({ devDependencies: ["@aws-sdk/credential-provider-sso"] });
 	else if (mode === "local-session" || mode === "shared-profile") await (0, _hot_updater_cli_tools.ensureInstallPackages)({ devDependencies: ["@aws-sdk/credential-providers"] });
 	_hot_updater_cli_tools.p.log.success("Generated '.env.hotupdater' file with AWS settings.");
-	await (0, _hot_updater_cli_tools.writeHotUpdaterFiles)(getConfigScaffold(build, configAuthMode), {
+	await (0, _hot_updater_cli_tools.writeHotUpdaterFiles)(getConfigScaffold(build, configAuthMode, {
+		region: bucketRegion,
+		bucketName,
+		tableName: resolvedDynamoDBTableName,
+		cloudfrontDistributionId: distributionId
+	}), {
 		cwd: process.cwd(),
 		settings: "AWS"
 	});

package/dist/init/index.d.cts

@@ -206,6 +206,7 @@ declare const initProvider: {
       readonly optional: true;
     };
   };
+  readonly secrets: readonly ["HOT_UPDATER_S3_ACCESS_KEY_ID", "HOT_UPDATER_S3_SECRET_ACCESS_KEY"];
 };
 //#endregion
 //#region iac/index.d.ts
@@ -218,6 +219,6 @@ declare const prepareDynamoDBDeployment: (input: {
   readonly region: string;
   readonly tableName: string;
 }) => Promise<void>;
-declare const runInit: ({ build, envFile }: RunInitOptions) => Promise<void>;
+declare const runInit: ({ build, envFile, secretsEnv }: RunInitOptions) => Promise<void>;
 //#endregion
 export { LAMBDA_EDGE_TRUST_POLICY, buildDynamoDBBackupInput, buildDynamoDBCreateTableInput, buildDynamoDBPolicy, buildDynamoDBSchemaSettingsInput, buildDynamoDBTimeToLiveInput, buildS3Policy, buildSsmPolicy, initProvider, prepareDynamoDBDeployment, runInit };

package/dist/init/index.d.mts

@@ -206,6 +206,7 @@ declare const initProvider: {
       readonly optional: true;
     };
   };
+  readonly secrets: readonly ["HOT_UPDATER_S3_ACCESS_KEY_ID", "HOT_UPDATER_S3_SECRET_ACCESS_KEY"];
 };
 //#endregion
 //#region iac/index.d.ts
@@ -218,6 +219,6 @@ declare const prepareDynamoDBDeployment: (input: {
   readonly region: string;
   readonly tableName: string;
 }) => Promise<void>;
-declare const runInit: ({ build, envFile }: RunInitOptions) => Promise<void>;
+declare const runInit: ({ build, envFile, secretsEnv }: RunInitOptions) => Promise<void>;
 //#endregion
 export { LAMBDA_EDGE_TRUST_POLICY, buildDynamoDBBackupInput, buildDynamoDBCreateTableInput, buildDynamoDBPolicy, buildDynamoDBSchemaSettingsInput, buildDynamoDBTimeToLiveInput, buildS3Policy, buildSsmPolicy, initProvider, prepareDynamoDBDeployment, runInit };