@hot-updater/aws 1.2.0-rc.4 → 1.2.0-rc.5

package/dist/init/index.cjs

@@ -6774,7 +6774,8 @@ const initProvider = {
 			help: "Existing CloudFront distribution ID",
 			optional: true
 		}
-	}
+	},
+	secrets: ["HOT_UPDATER_S3_ACCESS_KEY_ID", "HOT_UPDATER_S3_SECRET_ACCESS_KEY"]
 };
 //#endregion
 //#region iac/regionLocationMap.ts
@@ -8416,7 +8417,16 @@ var SSMKeyPairManager = class {
 };
 //#endregion
 //#region iac/templates.ts
-const getConfigScaffold = (build, authMode) => {
+/**
+* The config init writes. With the `resources` init set up, it names them,
+* and an account's access keys are read with `secretEnv`, from the
+* environment and `.env.hotupdater`, then the config's `secrets` adapter.
+* Without them, as the agent scaffold writes it, it reads every value from
+* the environment. A profile or SSO sign-in is each person's own.
+*/
+const getConfigScaffold = (build, authMode, resources) => {
+	const value = (envKey, resolved) => resolved === void 0 ? `process.env.${envKey}!` : JSON.stringify(resolved);
+	const region = value("HOT_UPDATER_S3_REGION", resources?.region);
 	const storageConfig = {
 		imports: [{
 			pkg: "@hot-updater/aws",
@@ -8424,7 +8434,7 @@ const getConfigScaffold = (build, authMode) => {
 		}],
 		configString: `s3Storage({
     ...awsOptions,
-    bucketName: process.env.HOT_UPDATER_S3_BUCKET_NAME!,
+    bucketName: ${value("HOT_UPDATER_S3_BUCKET_NAME", resources?.bucketName)},
   })`
 	};
 	const databaseConfig = {
@@ -8434,8 +8444,8 @@ const getConfigScaffold = (build, authMode) => {
 		}],
 		configString: `dynamoDB({
     ...awsOptions,
-    tableName: process.env.HOT_UPDATER_DYNAMODB_TABLE_NAME!,
-    cloudfrontDistributionId: process.env.HOT_UPDATER_CLOUDFRONT_DISTRIBUTION_ID!,
+    tableName: ${value("HOT_UPDATER_DYNAMODB_TABLE_NAME", resources?.tableName)},
+    cloudfrontDistributionId: ${value("HOT_UPDATER_CLOUDFRONT_DISTRIBUTION_ID", resources?.cloudfrontDistributionId)},
   })`
 	};
 	let helperStatements;
@@ -8447,7 +8457,7 @@ const getConfigScaffold = (build, authMode) => {
 				replaceIncompatibleProperties: ["credentials"],
 				code: `
 const awsOptions = {
-  region: process.env.HOT_UPDATER_S3_REGION!,
+  region: ${region},
   credentials: fromSSO({ profile: process.env.HOT_UPDATER_AWS_PROFILE! }),
 };`.trim()
 			}];
@@ -8459,28 +8469,40 @@ const awsOptions = {
 				replaceIncompatibleProperties: ["credentials"],
 				code: authMode.profile ? `
 const awsOptions = {
-  region: process.env.HOT_UPDATER_S3_REGION!,
+  region: ${region},
   credentials: fromIni({ profile: process.env.HOT_UPDATER_AWS_PROFILE! }),
 };`.trim() : `
 const awsOptions = {
-  region: process.env.HOT_UPDATER_S3_REGION!,
+  region: ${region},
   credentials: fromNodeProviderChain(),
 };`.trim()
 			}];
 			break;
-		case "account": helperStatements = [{
-			name: "awsOptions",
-			strategy: "merge-object",
-			replaceIncompatibleProperties: ["credentials"],
-			code: `
+		case "account":
+			helperStatements = [{
+				name: "awsOptions",
+				strategy: "merge-object",
+				replaceIncompatibleProperties: ["credentials"],
+				code: resources === void 0 ? `
 const awsOptions = {
-  region: process.env.HOT_UPDATER_S3_REGION!,
+  region: ${region},
   credentials: {
     accessKeyId: process.env.HOT_UPDATER_S3_ACCESS_KEY_ID!,
     secretAccessKey: process.env.HOT_UPDATER_S3_SECRET_ACCESS_KEY!,
   },
+};`.trim() : `
+const awsOptions = {
+  region: ${region},
+  credentials: async () => {
+    const env = await deploySecrets();
+    return {
+      accessKeyId: env.HOT_UPDATER_S3_ACCESS_KEY_ID,
+      secretAccessKey: env.HOT_UPDATER_S3_SECRET_ACCESS_KEY,
+    };
+  },
 };`.trim()
-		}];
+			}];
+			if (resources !== void 0) helperStatements.unshift((0, _hot_updater_cli_tools.secretEnvHelper)("deploySecrets", ["HOT_UPDATER_S3_ACCESS_KEY_ID", "HOT_UPDATER_S3_SECRET_ACCESS_KEY"]));
 	}
 	const builder = new _hot_updater_cli_tools.ConfigBuilder().setBuildType(build).setStorage(storageConfig).setDatabase(databaseConfig).setPlugins({
 		imports: [{
@@ -8500,9 +8522,15 @@ const awsOptions = {
 				named: ["fromSSO"]
 			});
 			break;
-		case "local": builder.addImport({
-			pkg: "@aws-sdk/credential-providers",
-			named: [authMode.profile ? "fromIni" : "fromNodeProviderChain"]
+		case "local":
+			builder.addImport({
+				pkg: "@aws-sdk/credential-providers",
+				named: [authMode.profile ? "fromIni" : "fromNodeProviderChain"]
+			});
+			break;
+		case "account": if (resources !== void 0) builder.addImport({
+			pkg: "hot-updater",
+			named: ["secretEnv"]
 		});
 	}
 	return (0, _hot_updater_cli_tools.createHotUpdaterConfigScaffoldFromBuilder)(builder, { helperStatements });
@@ -8528,9 +8556,9 @@ const prepareDynamoDBDeployment = async (input) => {
 		(0, _hot_updater_server_plugins.remoteConfig)()
 	]);
 };
-const runInit = async ({ build, envFile }) => {
+const runInit = async ({ build, envFile, secretsEnv }) => {
 	const nonInteractive = envFile !== void 0;
-	const initEnvSources = await (0, _hot_updater_cli_tools.readHotUpdaterInitEnv)(process.cwd(), envFile);
+	const initEnvSources = await (0, _hot_updater_cli_tools.readHotUpdaterInitEnv)(process.cwd(), envFile, secretsEnv);
 	const { managedEnv } = initEnvSources;
 	const providerEnv = (0, _hot_updater_cli_tools.getHotUpdaterInitInputEnv)(initEnvSources, nonInteractive);
 	const savedInputs = resolveAwsInitInputs(providerEnv);
@@ -8739,7 +8767,12 @@ const runInit = async ({ build, envFile }) => {
 	if (mode === "sso") await (0, _hot_updater_cli_tools.ensureInstallPackages)({ devDependencies: ["@aws-sdk/credential-provider-sso"] });
 	else if (mode === "local-session" || mode === "shared-profile") await (0, _hot_updater_cli_tools.ensureInstallPackages)({ devDependencies: ["@aws-sdk/credential-providers"] });
 	_hot_updater_cli_tools.p.log.success("Generated '.env.hotupdater' file with AWS settings.");
-	await (0, _hot_updater_cli_tools.writeHotUpdaterFiles)(getConfigScaffold(build, configAuthMode), {
+	await (0, _hot_updater_cli_tools.writeHotUpdaterFiles)(getConfigScaffold(build, configAuthMode, {
+		region: bucketRegion,
+		bucketName,
+		tableName: resolvedDynamoDBTableName,
+		cloudfrontDistributionId: distributionId
+	}), {
 		cwd: process.cwd(),
 		settings: "AWS"
 	});

package/dist/init/index.d.cts

@@ -206,6 +206,7 @@ declare const initProvider: {
       readonly optional: true;
     };
   };
+  readonly secrets: readonly ["HOT_UPDATER_S3_ACCESS_KEY_ID", "HOT_UPDATER_S3_SECRET_ACCESS_KEY"];
 };
 //#endregion
 //#region iac/index.d.ts
@@ -218,6 +219,6 @@ declare const prepareDynamoDBDeployment: (input: {
   readonly region: string;
   readonly tableName: string;
 }) => Promise<void>;
-declare const runInit: ({ build, envFile }: RunInitOptions) => Promise<void>;
+declare const runInit: ({ build, envFile, secretsEnv }: RunInitOptions) => Promise<void>;
 //#endregion
 export { LAMBDA_EDGE_TRUST_POLICY, buildDynamoDBBackupInput, buildDynamoDBCreateTableInput, buildDynamoDBPolicy, buildDynamoDBSchemaSettingsInput, buildDynamoDBTimeToLiveInput, buildS3Policy, buildSsmPolicy, initProvider, prepareDynamoDBDeployment, runInit };

package/dist/init/index.d.mts

@@ -206,6 +206,7 @@ declare const initProvider: {
       readonly optional: true;
     };
   };
+  readonly secrets: readonly ["HOT_UPDATER_S3_ACCESS_KEY_ID", "HOT_UPDATER_S3_SECRET_ACCESS_KEY"];
 };
 //#endregion
 //#region iac/index.d.ts
@@ -218,6 +219,6 @@ declare const prepareDynamoDBDeployment: (input: {
   readonly region: string;
   readonly tableName: string;
 }) => Promise<void>;
-declare const runInit: ({ build, envFile }: RunInitOptions) => Promise<void>;
+declare const runInit: ({ build, envFile, secretsEnv }: RunInitOptions) => Promise<void>;
 //#endregion
 export { LAMBDA_EDGE_TRUST_POLICY, buildDynamoDBBackupInput, buildDynamoDBCreateTableInput, buildDynamoDBPolicy, buildDynamoDBSchemaSettingsInput, buildDynamoDBTimeToLiveInput, buildS3Policy, buildSsmPolicy, initProvider, prepareDynamoDBDeployment, runInit };

package/dist/init/index.mjs

@@ -1,5 +1,5 @@
 import { createRequire } from "node:module";
-import { ConfigBuilder, InitError, MissingInitInputsError, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitProviderInputs, colors, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, createZip, ensureInstallPackages, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, printAppSetup, provisionClientCredential, readHotUpdaterInitEnv, resolveInitProviderInput, transformEnv, writeHotUpdaterFiles } from "@hot-updater/cli-tools";
+import { ConfigBuilder, InitError, MissingInitInputsError, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitProviderInputs, colors, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, createZip, ensureInstallPackages, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, printAppSetup, provisionClientCredential, readHotUpdaterInitEnv, resolveInitProviderInput, secretEnvHelper, transformEnv, writeHotUpdaterFiles } from "@hot-updater/cli-tools";
 import { apiKeys, insights, remoteConfig } from "@hot-updater/server/plugins";
 import { fileURLToPath } from "node:url";
 import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process";
@@ -6769,7 +6769,8 @@ const initProvider = {
 			help: "Existing CloudFront distribution ID",
 			optional: true
 		}
-	}
+	},
+	secrets: ["HOT_UPDATER_S3_ACCESS_KEY_ID", "HOT_UPDATER_S3_SECRET_ACCESS_KEY"]
 };
 //#endregion
 //#region iac/regionLocationMap.ts
@@ -8411,7 +8412,16 @@ var SSMKeyPairManager = class {
 };
 //#endregion
 //#region iac/templates.ts
-const getConfigScaffold = (build, authMode) => {
+/**
+* The config init writes. With the `resources` init set up, it names them,
+* and an account's access keys are read with `secretEnv`, from the
+* environment and `.env.hotupdater`, then the config's `secrets` adapter.
+* Without them, as the agent scaffold writes it, it reads every value from
+* the environment. A profile or SSO sign-in is each person's own.
+*/
+const getConfigScaffold = (build, authMode, resources) => {
+	const value = (envKey, resolved) => resolved === void 0 ? `process.env.${envKey}!` : JSON.stringify(resolved);
+	const region = value("HOT_UPDATER_S3_REGION", resources?.region);
 	const storageConfig = {
 		imports: [{
 			pkg: "@hot-updater/aws",
@@ -8419,7 +8429,7 @@ const getConfigScaffold = (build, authMode) => {
 		}],
 		configString: `s3Storage({
     ...awsOptions,
-    bucketName: process.env.HOT_UPDATER_S3_BUCKET_NAME!,
+    bucketName: ${value("HOT_UPDATER_S3_BUCKET_NAME", resources?.bucketName)},
   })`
 	};
 	const databaseConfig = {
@@ -8429,8 +8439,8 @@ const getConfigScaffold = (build, authMode) => {
 		}],
 		configString: `dynamoDB({
     ...awsOptions,
-    tableName: process.env.HOT_UPDATER_DYNAMODB_TABLE_NAME!,
-    cloudfrontDistributionId: process.env.HOT_UPDATER_CLOUDFRONT_DISTRIBUTION_ID!,
+    tableName: ${value("HOT_UPDATER_DYNAMODB_TABLE_NAME", resources?.tableName)},
+    cloudfrontDistributionId: ${value("HOT_UPDATER_CLOUDFRONT_DISTRIBUTION_ID", resources?.cloudfrontDistributionId)},
   })`
 	};
 	let helperStatements;
@@ -8442,7 +8452,7 @@ const getConfigScaffold = (build, authMode) => {
 				replaceIncompatibleProperties: ["credentials"],
 				code: `
 const awsOptions = {
-  region: process.env.HOT_UPDATER_S3_REGION!,
+  region: ${region},
   credentials: fromSSO({ profile: process.env.HOT_UPDATER_AWS_PROFILE! }),
 };`.trim()
 			}];
@@ -8454,28 +8464,40 @@ const awsOptions = {
 				replaceIncompatibleProperties: ["credentials"],
 				code: authMode.profile ? `
 const awsOptions = {
-  region: process.env.HOT_UPDATER_S3_REGION!,
+  region: ${region},
   credentials: fromIni({ profile: process.env.HOT_UPDATER_AWS_PROFILE! }),
 };`.trim() : `
 const awsOptions = {
-  region: process.env.HOT_UPDATER_S3_REGION!,
+  region: ${region},
   credentials: fromNodeProviderChain(),
 };`.trim()
 			}];
 			break;
-		case "account": helperStatements = [{
-			name: "awsOptions",
-			strategy: "merge-object",
-			replaceIncompatibleProperties: ["credentials"],
-			code: `
+		case "account":
+			helperStatements = [{
+				name: "awsOptions",
+				strategy: "merge-object",
+				replaceIncompatibleProperties: ["credentials"],
+				code: resources === void 0 ? `
 const awsOptions = {
-  region: process.env.HOT_UPDATER_S3_REGION!,
+  region: ${region},
   credentials: {
     accessKeyId: process.env.HOT_UPDATER_S3_ACCESS_KEY_ID!,
     secretAccessKey: process.env.HOT_UPDATER_S3_SECRET_ACCESS_KEY!,
   },
+};`.trim() : `
+const awsOptions = {
+  region: ${region},
+  credentials: async () => {
+    const env = await deploySecrets();
+    return {
+      accessKeyId: env.HOT_UPDATER_S3_ACCESS_KEY_ID,
+      secretAccessKey: env.HOT_UPDATER_S3_SECRET_ACCESS_KEY,
+    };
+  },
 };`.trim()
-		}];
+			}];
+			if (resources !== void 0) helperStatements.unshift(secretEnvHelper("deploySecrets", ["HOT_UPDATER_S3_ACCESS_KEY_ID", "HOT_UPDATER_S3_SECRET_ACCESS_KEY"]));
 	}
 	const builder = new ConfigBuilder().setBuildType(build).setStorage(storageConfig).setDatabase(databaseConfig).setPlugins({
 		imports: [{
@@ -8495,9 +8517,15 @@ const awsOptions = {
 				named: ["fromSSO"]
 			});
 			break;
-		case "local": builder.addImport({
-			pkg: "@aws-sdk/credential-providers",
-			named: [authMode.profile ? "fromIni" : "fromNodeProviderChain"]
+		case "local":
+			builder.addImport({
+				pkg: "@aws-sdk/credential-providers",
+				named: [authMode.profile ? "fromIni" : "fromNodeProviderChain"]
+			});
+			break;
+		case "account": if (resources !== void 0) builder.addImport({
+			pkg: "hot-updater",
+			named: ["secretEnv"]
 		});
 	}
 	return createHotUpdaterConfigScaffoldFromBuilder(builder, { helperStatements });
@@ -8523,9 +8551,9 @@ const prepareDynamoDBDeployment = async (input) => {
 		remoteConfig()
 	]);
 };
-const runInit = async ({ build, envFile }) => {
+const runInit = async ({ build, envFile, secretsEnv }) => {
 	const nonInteractive = envFile !== void 0;
-	const initEnvSources = await readHotUpdaterInitEnv(process.cwd(), envFile);
+	const initEnvSources = await readHotUpdaterInitEnv(process.cwd(), envFile, secretsEnv);
 	const { managedEnv } = initEnvSources;
 	const providerEnv = getHotUpdaterInitInputEnv(initEnvSources, nonInteractive);
 	const savedInputs = resolveAwsInitInputs(providerEnv);
@@ -8734,7 +8762,12 @@ const runInit = async ({ build, envFile }) => {
 	if (mode === "sso") await ensureInstallPackages({ devDependencies: ["@aws-sdk/credential-provider-sso"] });
 	else if (mode === "local-session" || mode === "shared-profile") await ensureInstallPackages({ devDependencies: ["@aws-sdk/credential-providers"] });
 	p.log.success("Generated '.env.hotupdater' file with AWS settings.");
-	await writeHotUpdaterFiles(getConfigScaffold(build, configAuthMode), {
+	await writeHotUpdaterFiles(getConfigScaffold(build, configAuthMode, {
+		region: bucketRegion,
+		bucketName,
+		tableName: resolvedDynamoDBTableName,
+		cloudfrontDistributionId: distributionId
+	}), {
 		cwd: process.cwd(),
 		settings: "AWS"
 	});

package/dist/lambda/index.cjs

@@ -4707,7 +4707,7 @@ const createKvAdapter = ({ store, tablePrefix = "" }) => {
 };
 //#endregion
 //#region ../../packages/server/dist/version.mjs
-const HOT_UPDATER_SERVER_VERSION = "1.2.0-rc.4";
+const HOT_UPDATER_SERVER_VERSION = "1.2.0-rc.5";
 //#endregion
 //#region ../../packages/server/dist/handlerVersionRoutes.mjs
 /**

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hot-updater/aws",
   "type": "module",
-  "version": "1.2.0-rc.4",
+  "version": "1.2.0-rc.5",
   "description": "React Native OTA solution for self-hosted",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -45,9 +45,9 @@
     "es-toolkit": "^1.32.0",
     "execa": "9.5.2",
     "mime": "^4.0.4",
-    "@hot-updater/protocol": "1.2.0-rc.4",
-    "@hot-updater/mock": "1.2.0-rc.4",
-    "@hot-updater/test-utils": "1.2.0-rc.4"
+    "@hot-updater/protocol": "1.2.0-rc.5",
+    "@hot-updater/mock": "1.2.0-rc.5",
+    "@hot-updater/test-utils": "1.2.0-rc.5"
   },
   "dependencies": {
     "@aws-sdk/client-cloudfront": "3.1066.0",
@@ -64,9 +64,9 @@
     "@aws-sdk/lib-dynamodb": "3.1066.0",
     "@aws-sdk/s3-request-presigner": "3.1066.0",
     "hono": "4.12.34",
-    "@hot-updater/cli-tools": "1.2.0-rc.4",
-    "@hot-updater/plugin-core": "1.2.0-rc.4",
-    "@hot-updater/server": "1.2.0-rc.4"
+    "@hot-updater/cli-tools": "1.2.0-rc.5",
+    "@hot-updater/server": "1.2.0-rc.5",
+    "@hot-updater/plugin-core": "1.2.0-rc.5"
   },
   "scripts": {
     "build": "tsdown",