@hot-updater/aws 1.2.0-rc.7 → 1.2.0-rc.8

package/dist/index.cjs

@@ -315,10 +315,30 @@ async apply() {
 	};
 };
 //#endregion
+//#region src/lazyCredentials.ts
+/**
+* `credentials` as the AWS SDK takes them: access keys with a lazy field
+* become a provider, which the SDK calls once, on its first request.
+*/
+const toSdkCredentials = (credentials) => {
+	if (credentials === void 0 || typeof credentials === "function") return credentials;
+	const { accessKeyId, secretAccessKey, sessionToken, ...rest } = credentials;
+	if (typeof accessKeyId !== "function" && typeof secretAccessKey !== "function" && typeof sessionToken !== "function") return credentials;
+	return async () => ({
+		...rest,
+		accessKeyId: await (0, _hot_updater_plugin_core.resolveLazy)(accessKeyId),
+		secretAccessKey: await (0, _hot_updater_plugin_core.resolveLazy)(secretAccessKey),
+		...sessionToken === void 0 ? {} : { sessionToken: await (0, _hot_updater_plugin_core.resolveLazy)(sessionToken) }
+	});
+};
+//#endregion
 //#region src/dynamoDB.ts
 /** The DynamoDB client ignores the CloudFront and batching settings. */
-const adapterOf = ({ tableName, ...clientConfig }) => {
-	const client = new _aws_sdk_client_dynamodb.DynamoDBClient(clientConfig);
+const adapterOf = ({ tableName, credentials, ...clientConfig }) => {
+	const client = new _aws_sdk_client_dynamodb.DynamoDBClient({
+		...clientConfig,
+		credentials: toSdkCredentials(credentials)
+	});
 	const store = createDynamoDBStore({
 		client,
 		tableName
@@ -353,7 +373,10 @@ const marked = (target) => ({ [DATABASE_TARGET]: target });
 */
 const dynamoDB = (config) => {
 	const { client, adapter } = adapterOf(config);
-	const cloudFront = createUpdateRouteInvalidation(config);
+	const cloudFront = createUpdateRouteInvalidation({
+		...config,
+		credentials: toSdkCredentials(config.credentials)
+	});
 	return {
 		...(0, _hot_updater_plugin_core.createEngineDatabase)({
 			name: "dynamoDB",
@@ -500,8 +523,11 @@ const cloudFrontDownloadUrl = (config) => {
 const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
 const isObjectNotFoundError = (error) => error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchKey");
 function s3Storage(config) {
-	const { bucketName, basePath, getDownloadUrl, ...s3Config } = config;
-	const client = new _aws_sdk_client_s3.S3Client(applyS3RuntimeAwsConfig(s3Config));
+	const { bucketName, basePath, getDownloadUrl, credentials, ...s3Config } = config;
+	const client = new _aws_sdk_client_s3.S3Client(applyS3RuntimeAwsConfig({
+		...s3Config,
+		credentials: toSdkCredentials(credentials)
+	}));
 	const normalizedBasePath = basePath?.replace(/^\/+|\/+$/g, "") ?? "";
 	const getStorageKey = (0, _hot_updater_plugin_core.createStorageKeyBuilder)(normalizedBasePath);
 	const getListPrefix = (prefix = "") => {

package/dist/index.d.cts

@@ -1,8 +1,24 @@
 import { DynamoDBClientConfig } from "@aws-sdk/client-dynamodb";
-import { EngineDatabase, PluginTables, SecretsAdapter, StorageAdapter, StorageAdapterWith } from "@hot-updater/plugin-core";
+import { EngineDatabase, Lazy, PluginTables, SecretsAdapter, StorageAdapter, StorageAdapterWith } from "@hot-updater/plugin-core";
 import { S3ClientConfig } from "@aws-sdk/client-s3";
+//#region src/lazyCredentials.d.ts
+type SdkCredentials = S3ClientConfig["credentials"];
+/**
+ * Access keys whose fields may each be a function that returns them, such
+ * as `secret("<name>")` in `hot-updater.config.ts`, called on first use.
+ */
+interface LazyAwsCredentials {
+  readonly accessKeyId: Lazy<string>;
+  readonly secretAccessKey: Lazy<string>;
+  readonly sessionToken?: Lazy<string>;
+}
+/** The credentials the AWS SDK takes, or access keys with lazy fields. */
+type AwsCredentialsOption = SdkCredentials | LazyAwsCredentials;
+//#endregion
 //#region src/dynamoDB.d.ts
-interface DynamoDBConfig extends DynamoDBClientConfig {
+interface DynamoDBConfig extends Omit<DynamoDBClientConfig, "credentials"> {
+  /** The SDK's credentials, or access keys whose fields are lazy. */
+  readonly credentials?: AwsCredentialsOption;
   readonly apiBasePath?: string;
   readonly cloudfrontDistributionId?: string;
   readonly shouldWaitForInvalidation?: boolean;
@@ -59,7 +75,9 @@ declare const cloudFrontDownloadUrl: (config: CloudFrontDownloadUrlOptions) => (
 }>;
 //#endregion
 //#region src/s3Storage.d.ts
-interface S3StorageConfig extends S3ClientConfig {
+interface S3StorageConfig extends Omit<S3ClientConfig, "credentials"> {
+  /** The SDK's credentials, or access keys whose fields are lazy. */
+  credentials?: AwsCredentialsOption;
   bucketName: string;
   /** Base path where bundles will be stored in the bucket. */
   basePath?: string;
@@ -85,7 +103,7 @@ interface SecretsManagerOptions {
   /** The AWS region the secrets are in, such as `"us-east-1"`. */
   readonly region: string;
   /**
-   * Put before every name to make its secret's name, so `secret:asc-api-key`
+   * Put before every name to make its secret's name, so `secret("asc-api-key")`
    * reads the secret `hot-updater/asc-api-key` and one IAM resource,
    * `secret:hot-updater/*`, covers them all. Letters, digits, and
    * `/_+=.@-`.

package/dist/index.d.mts

@@ -1,8 +1,24 @@
 import { DynamoDBClientConfig } from "@aws-sdk/client-dynamodb";
-import { EngineDatabase, PluginTables, SecretsAdapter, StorageAdapter, StorageAdapterWith } from "@hot-updater/plugin-core";
+import { EngineDatabase, Lazy, PluginTables, SecretsAdapter, StorageAdapter, StorageAdapterWith } from "@hot-updater/plugin-core";
 import { S3ClientConfig } from "@aws-sdk/client-s3";
+//#region src/lazyCredentials.d.ts
+type SdkCredentials = S3ClientConfig["credentials"];
+/**
+ * Access keys whose fields may each be a function that returns them, such
+ * as `secret("<name>")` in `hot-updater.config.ts`, called on first use.
+ */
+interface LazyAwsCredentials {
+  readonly accessKeyId: Lazy<string>;
+  readonly secretAccessKey: Lazy<string>;
+  readonly sessionToken?: Lazy<string>;
+}
+/** The credentials the AWS SDK takes, or access keys with lazy fields. */
+type AwsCredentialsOption = SdkCredentials | LazyAwsCredentials;
+//#endregion
 //#region src/dynamoDB.d.ts
-interface DynamoDBConfig extends DynamoDBClientConfig {
+interface DynamoDBConfig extends Omit<DynamoDBClientConfig, "credentials"> {
+  /** The SDK's credentials, or access keys whose fields are lazy. */
+  readonly credentials?: AwsCredentialsOption;
   readonly apiBasePath?: string;
   readonly cloudfrontDistributionId?: string;
   readonly shouldWaitForInvalidation?: boolean;
@@ -59,7 +75,9 @@ declare const cloudFrontDownloadUrl: (config: CloudFrontDownloadUrlOptions) => (
 }>;
 //#endregion
 //#region src/s3Storage.d.ts
-interface S3StorageConfig extends S3ClientConfig {
+interface S3StorageConfig extends Omit<S3ClientConfig, "credentials"> {
+  /** The SDK's credentials, or access keys whose fields are lazy. */
+  credentials?: AwsCredentialsOption;
   bucketName: string;
   /** Base path where bundles will be stored in the bucket. */
   basePath?: string;
@@ -85,7 +103,7 @@ interface SecretsManagerOptions {
   /** The AWS region the secrets are in, such as `"us-east-1"`. */
   readonly region: string;
   /**
-   * Put before every name to make its secret's name, so `secret:asc-api-key`
+   * Put before every name to make its secret's name, so `secret("asc-api-key")`
    * reads the secret `hot-updater/asc-api-key` and one IAM resource,
    * `secret:hot-updater/*`, covers them all. Letters, digits, and
    * `/_+=.@-`.

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { CreateTableCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DynamoDBClient, UpdateTimeToLiveCommand, waitUntilTableExists } from "@aws-sdk/client-dynamodb";
-import { BUNDLE_STORAGE_PREFIX, CONTENT_ADDRESSED_ASSET_PREFIX, createEngineDatabase, createKvAdapter, createStorageAdapter, createStorageKeyBuilder, createStorageUri, migrateCoreSchema, parseStorageUri } from "@hot-updater/plugin-core";
+import { BUNDLE_STORAGE_PREFIX, CONTENT_ADDRESSED_ASSET_PREFIX, createEngineDatabase, createKvAdapter, createStorageAdapter, createStorageKeyBuilder, createStorageUri, migrateCoreSchema, parseStorageUri, resolveLazy } from "@hot-updater/plugin-core";
 import { CloudFrontClient, CreateInvalidationCommand, GetInvalidationCommand } from "@aws-sdk/client-cloudfront";
 import { BatchGetCommand, BatchWriteCommand, DynamoDBDocumentClient, QueryCommand, TransactWriteCommand } from "@aws-sdk/lib-dynamodb";
 import { SSM } from "@aws-sdk/client-ssm";
@@ -314,10 +314,30 @@ async apply() {
 	};
 };
 //#endregion
+//#region src/lazyCredentials.ts
+/**
+* `credentials` as the AWS SDK takes them: access keys with a lazy field
+* become a provider, which the SDK calls once, on its first request.
+*/
+const toSdkCredentials = (credentials) => {
+	if (credentials === void 0 || typeof credentials === "function") return credentials;
+	const { accessKeyId, secretAccessKey, sessionToken, ...rest } = credentials;
+	if (typeof accessKeyId !== "function" && typeof secretAccessKey !== "function" && typeof sessionToken !== "function") return credentials;
+	return async () => ({
+		...rest,
+		accessKeyId: await resolveLazy(accessKeyId),
+		secretAccessKey: await resolveLazy(secretAccessKey),
+		...sessionToken === void 0 ? {} : { sessionToken: await resolveLazy(sessionToken) }
+	});
+};
+//#endregion
 //#region src/dynamoDB.ts
 /** The DynamoDB client ignores the CloudFront and batching settings. */
-const adapterOf = ({ tableName, ...clientConfig }) => {
-	const client = new DynamoDBClient(clientConfig);
+const adapterOf = ({ tableName, credentials, ...clientConfig }) => {
+	const client = new DynamoDBClient({
+		...clientConfig,
+		credentials: toSdkCredentials(credentials)
+	});
 	const store = createDynamoDBStore({
 		client,
 		tableName
@@ -352,7 +372,10 @@ const marked = (target) => ({ [DATABASE_TARGET]: target });
 */
 const dynamoDB = (config) => {
 	const { client, adapter } = adapterOf(config);
-	const cloudFront = createUpdateRouteInvalidation(config);
+	const cloudFront = createUpdateRouteInvalidation({
+		...config,
+		credentials: toSdkCredentials(config.credentials)
+	});
 	return {
 		...createEngineDatabase({
 			name: "dynamoDB",
@@ -499,8 +522,11 @@ const cloudFrontDownloadUrl = (config) => {
 const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
 const isObjectNotFoundError = (error) => error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchKey");
 function s3Storage(config) {
-	const { bucketName, basePath, getDownloadUrl, ...s3Config } = config;
-	const client = new S3Client(applyS3RuntimeAwsConfig(s3Config));
+	const { bucketName, basePath, getDownloadUrl, credentials, ...s3Config } = config;
+	const client = new S3Client(applyS3RuntimeAwsConfig({
+		...s3Config,
+		credentials: toSdkCredentials(credentials)
+	}));
 	const normalizedBasePath = basePath?.replace(/^\/+|\/+$/g, "") ?? "";
 	const getStorageKey = createStorageKeyBuilder(normalizedBasePath);
 	const getListPrefix = (prefix = "") => {

package/dist/init/index.cjs

@@ -6579,10 +6579,30 @@ async apply() {
 	};
 };
 //#endregion
+//#region src/lazyCredentials.ts
+/**
+* `credentials` as the AWS SDK takes them: access keys with a lazy field
+* become a provider, which the SDK calls once, on its first request.
+*/
+const toSdkCredentials = (credentials) => {
+	if (credentials === void 0 || typeof credentials === "function") return credentials;
+	const { accessKeyId, secretAccessKey, sessionToken, ...rest } = credentials;
+	if (typeof accessKeyId !== "function" && typeof secretAccessKey !== "function" && typeof sessionToken !== "function") return credentials;
+	return async () => ({
+		...rest,
+		accessKeyId: await (0, _hot_updater_plugin_core.resolveLazy)(accessKeyId),
+		secretAccessKey: await (0, _hot_updater_plugin_core.resolveLazy)(secretAccessKey),
+		...sessionToken === void 0 ? {} : { sessionToken: await (0, _hot_updater_plugin_core.resolveLazy)(sessionToken) }
+	});
+};
+//#endregion
 //#region src/dynamoDB.ts
 /** The DynamoDB client ignores the CloudFront and batching settings. */
-const adapterOf = ({ tableName, ...clientConfig }) => {
-	const client = new _aws_sdk_client_dynamodb.DynamoDBClient(clientConfig);
+const adapterOf = ({ tableName, credentials, ...clientConfig }) => {
+	const client = new _aws_sdk_client_dynamodb.DynamoDBClient({
+		...clientConfig,
+		credentials: toSdkCredentials(credentials)
+	});
 	const store = createDynamoDBStore({
 		client,
 		tableName
@@ -6617,7 +6637,10 @@ const marked = (target) => ({ [DATABASE_TARGET]: target });
 */
 const dynamoDB = (config) => {
 	const { client, adapter } = adapterOf(config);
-	const cloudFront = createUpdateRouteInvalidation(config);
+	const cloudFront = createUpdateRouteInvalidation({
+		...config,
+		credentials: toSdkCredentials(config.credentials)
+	});
 	return {
 		...(0, _hot_updater_plugin_core.createEngineDatabase)({
 			name: "dynamoDB",
@@ -8419,10 +8442,11 @@ var SSMKeyPairManager = class {
 //#region iac/templates.ts
 /**
 * The config init writes. With the `resources` init set up, it names them,
-* and an account's access keys are read with `secretEnv`, from the
+* and an account's access keys are read with `secret()`, from the
 * environment and `.env.hotupdater`, then the config's `secrets` adapter.
-* Without them, as the agent scaffold writes it, it reads every value from
-* the environment. A profile or SSO sign-in is each person's own.
+* Without them, as the agent scaffold writes it before the agent creates the
+* resources, it reads their names from the environment, where the agent
+* records them. A profile or SSO sign-in is each person's own.
 */
 const getConfigScaffold = (build, authMode, resources) => {
 	const value = (envKey, resolved) => resolved === void 0 ? `process.env.${envKey}!` : JSON.stringify(resolved);
@@ -8478,31 +8502,19 @@ const awsOptions = {
 };`.trim()
 			}];
 			break;
-		case "account":
-			helperStatements = [{
-				name: "awsOptions",
-				strategy: "merge-object",
-				replaceIncompatibleProperties: ["credentials"],
-				code: resources === void 0 ? `
+		case "account": helperStatements = [{
+			name: "awsOptions",
+			strategy: "merge-object",
+			replaceIncompatibleProperties: ["credentials"],
+			code: `
 const awsOptions = {
   region: ${region},
   credentials: {
-    accessKeyId: process.env.HOT_UPDATER_S3_ACCESS_KEY_ID!,
-    secretAccessKey: process.env.HOT_UPDATER_S3_SECRET_ACCESS_KEY!,
-  },
-};`.trim() : `
-const awsOptions = {
-  region: ${region},
-  credentials: async () => {
-    const env = await deploySecrets();
-    return {
-      accessKeyId: env.HOT_UPDATER_S3_ACCESS_KEY_ID,
-      secretAccessKey: env.HOT_UPDATER_S3_SECRET_ACCESS_KEY,
-    };
+    accessKeyId: secret("HOT_UPDATER_S3_ACCESS_KEY_ID"),
+    secretAccessKey: secret("HOT_UPDATER_S3_SECRET_ACCESS_KEY"),
   },
 };`.trim()
-			}];
-			if (resources !== void 0) helperStatements.unshift((0, _hot_updater_cli_tools.secretEnvHelper)("deploySecrets", ["HOT_UPDATER_S3_ACCESS_KEY_ID", "HOT_UPDATER_S3_SECRET_ACCESS_KEY"]));
+		}];
 	}
 	const builder = new _hot_updater_cli_tools.ConfigBuilder().setBuildType(build).setStorage(storageConfig).setDatabase(databaseConfig).setPlugins({
 		imports: [{
@@ -8528,9 +8540,9 @@ const awsOptions = {
 				named: [authMode.profile ? "fromIni" : "fromNodeProviderChain"]
 			});
 			break;
-		case "account": if (resources !== void 0) builder.addImport({
+		case "account": builder.addImport({
 			pkg: "hot-updater",
-			named: ["secretEnv"]
+			named: ["secret"]
 		});
 	}
 	return (0, _hot_updater_cli_tools.createHotUpdaterConfigScaffoldFromBuilder)(builder, { helperStatements });

package/dist/init/index.mjs

@@ -1,5 +1,5 @@
 import { createRequire } from "node:module";
-import { ConfigBuilder, InitError, MissingInitInputsError, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitProviderInputs, colors, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, createZip, ensureInstallPackages, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, printAppSetup, provisionClientCredential, readHotUpdaterInitEnv, resolveInitProviderInput, secretEnvHelper, transformEnv, writeHotUpdaterFiles } from "@hot-updater/cli-tools";
+import { ConfigBuilder, InitError, MissingInitInputsError, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitProviderInputs, colors, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, createZip, ensureInstallPackages, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, printAppSetup, provisionClientCredential, readHotUpdaterInitEnv, resolveInitProviderInput, transformEnv, writeHotUpdaterFiles } from "@hot-updater/cli-tools";
 import { apiKeys, insights, remoteConfig } from "@hot-updater/server/plugins";
 import { fileURLToPath } from "node:url";
 import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process";
@@ -18,7 +18,7 @@ import { finished } from "node:stream/promises";
 import { Duplex, PassThrough, Readable, Transform, Writable, getDefaultHighWaterMark } from "node:stream";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { CreateTableCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DynamoDB, DynamoDBClient, UpdateTimeToLiveCommand, waitUntilTableExists } from "@aws-sdk/client-dynamodb";
-import { SETTINGS_TABLE, aggregateBatchingTables, createEngineDatabase, createKvAdapter, encodeKvKey, migrateCoreSchema, toolingTargetOf } from "@hot-updater/plugin-core";
+import { SETTINGS_TABLE, aggregateBatchingTables, createEngineDatabase, createKvAdapter, encodeKvKey, migrateCoreSchema, resolveLazy, toolingTargetOf } from "@hot-updater/plugin-core";
 import { CloudFront, CloudFrontClient, CreateInvalidationCommand, GetInvalidationCommand } from "@aws-sdk/client-cloudfront";
 import { BatchGetCommand, BatchWriteCommand, DynamoDBDocumentClient, QueryCommand, TransactWriteCommand } from "@aws-sdk/lib-dynamodb";
 import { fromIni, fromNodeProviderChain, fromSSO } from "@aws-sdk/credential-providers";
@@ -6574,10 +6574,30 @@ async apply() {
 	};
 };
 //#endregion
+//#region src/lazyCredentials.ts
+/**
+* `credentials` as the AWS SDK takes them: access keys with a lazy field
+* become a provider, which the SDK calls once, on its first request.
+*/
+const toSdkCredentials = (credentials) => {
+	if (credentials === void 0 || typeof credentials === "function") return credentials;
+	const { accessKeyId, secretAccessKey, sessionToken, ...rest } = credentials;
+	if (typeof accessKeyId !== "function" && typeof secretAccessKey !== "function" && typeof sessionToken !== "function") return credentials;
+	return async () => ({
+		...rest,
+		accessKeyId: await resolveLazy(accessKeyId),
+		secretAccessKey: await resolveLazy(secretAccessKey),
+		...sessionToken === void 0 ? {} : { sessionToken: await resolveLazy(sessionToken) }
+	});
+};
+//#endregion
 //#region src/dynamoDB.ts
 /** The DynamoDB client ignores the CloudFront and batching settings. */
-const adapterOf = ({ tableName, ...clientConfig }) => {
-	const client = new DynamoDBClient(clientConfig);
+const adapterOf = ({ tableName, credentials, ...clientConfig }) => {
+	const client = new DynamoDBClient({
+		...clientConfig,
+		credentials: toSdkCredentials(credentials)
+	});
 	const store = createDynamoDBStore({
 		client,
 		tableName
@@ -6612,7 +6632,10 @@ const marked = (target) => ({ [DATABASE_TARGET]: target });
 */
 const dynamoDB = (config) => {
 	const { client, adapter } = adapterOf(config);
-	const cloudFront = createUpdateRouteInvalidation(config);
+	const cloudFront = createUpdateRouteInvalidation({
+		...config,
+		credentials: toSdkCredentials(config.credentials)
+	});
 	return {
 		...createEngineDatabase({
 			name: "dynamoDB",
@@ -8414,10 +8437,11 @@ var SSMKeyPairManager = class {
 //#region iac/templates.ts
 /**
 * The config init writes. With the `resources` init set up, it names them,
-* and an account's access keys are read with `secretEnv`, from the
+* and an account's access keys are read with `secret()`, from the
 * environment and `.env.hotupdater`, then the config's `secrets` adapter.
-* Without them, as the agent scaffold writes it, it reads every value from
-* the environment. A profile or SSO sign-in is each person's own.
+* Without them, as the agent scaffold writes it before the agent creates the
+* resources, it reads their names from the environment, where the agent
+* records them. A profile or SSO sign-in is each person's own.
 */
 const getConfigScaffold = (build, authMode, resources) => {
 	const value = (envKey, resolved) => resolved === void 0 ? `process.env.${envKey}!` : JSON.stringify(resolved);
@@ -8473,31 +8497,19 @@ const awsOptions = {
 };`.trim()
 			}];
 			break;
-		case "account":
-			helperStatements = [{
-				name: "awsOptions",
-				strategy: "merge-object",
-				replaceIncompatibleProperties: ["credentials"],
-				code: resources === void 0 ? `
+		case "account": helperStatements = [{
+			name: "awsOptions",
+			strategy: "merge-object",
+			replaceIncompatibleProperties: ["credentials"],
+			code: `
 const awsOptions = {
   region: ${region},
   credentials: {
-    accessKeyId: process.env.HOT_UPDATER_S3_ACCESS_KEY_ID!,
-    secretAccessKey: process.env.HOT_UPDATER_S3_SECRET_ACCESS_KEY!,
-  },
-};`.trim() : `
-const awsOptions = {
-  region: ${region},
-  credentials: async () => {
-    const env = await deploySecrets();
-    return {
-      accessKeyId: env.HOT_UPDATER_S3_ACCESS_KEY_ID,
-      secretAccessKey: env.HOT_UPDATER_S3_SECRET_ACCESS_KEY,
-    };
+    accessKeyId: secret("HOT_UPDATER_S3_ACCESS_KEY_ID"),
+    secretAccessKey: secret("HOT_UPDATER_S3_SECRET_ACCESS_KEY"),
   },
 };`.trim()
-			}];
-			if (resources !== void 0) helperStatements.unshift(secretEnvHelper("deploySecrets", ["HOT_UPDATER_S3_ACCESS_KEY_ID", "HOT_UPDATER_S3_SECRET_ACCESS_KEY"]));
+		}];
 	}
 	const builder = new ConfigBuilder().setBuildType(build).setStorage(storageConfig).setDatabase(databaseConfig).setPlugins({
 		imports: [{
@@ -8523,9 +8535,9 @@ const awsOptions = {
 				named: [authMode.profile ? "fromIni" : "fromNodeProviderChain"]
 			});
 			break;
-		case "account": if (resources !== void 0) builder.addImport({
+		case "account": builder.addImport({
 			pkg: "hot-updater",
-			named: ["secretEnv"]
+			named: ["secret"]
 		});
 	}
 	return createHotUpdaterConfigScaffoldFromBuilder(builder, { helperStatements });

package/dist/lambda/index.cjs

@@ -1437,6 +1437,10 @@ const semverSatisfies = (targetAppVersion, currentVersion) => {
 	return satisfies(currentCoerce, targetAppVersion);
 };
 //#endregion
+//#region ../plugin-core/dist/types/index.mjs
+/** The value of a `Lazy`, calling its function. */
+const resolveLazy = async (value) => typeof value === "function" ? await value() : value;
+//#endregion
 //#region ../plugin-core/dist/serverPlugin/definePlugin.mjs
 /** Declares a plugin; Hot Updater's own plugins and third-party ones use the same contract. */
 const definePlugin = (plugin) => plugin;
@@ -4707,7 +4711,7 @@ const createKvAdapter = ({ store, tablePrefix = "" }) => {
 };
 //#endregion
 //#region ../../packages/server/dist/version.mjs
-const HOT_UPDATER_SERVER_VERSION = "1.2.0-rc.7";
+const HOT_UPDATER_SERVER_VERSION = "1.2.0-rc.8";
 //#endregion
 //#region ../../packages/server/dist/handlerVersionRoutes.mjs
 /**
@@ -14295,10 +14299,30 @@ async apply() {
 	};
 };
 //#endregion
+//#region src/lazyCredentials.ts
+/**
+* `credentials` as the AWS SDK takes them: access keys with a lazy field
+* become a provider, which the SDK calls once, on its first request.
+*/
+const toSdkCredentials = (credentials) => {
+	if (credentials === void 0 || typeof credentials === "function") return credentials;
+	const { accessKeyId, secretAccessKey, sessionToken, ...rest } = credentials;
+	if (typeof accessKeyId !== "function" && typeof secretAccessKey !== "function" && typeof sessionToken !== "function") return credentials;
+	return async () => ({
+		...rest,
+		accessKeyId: await resolveLazy(accessKeyId),
+		secretAccessKey: await resolveLazy(secretAccessKey),
+		...sessionToken === void 0 ? {} : { sessionToken: await resolveLazy(sessionToken) }
+	});
+};
+//#endregion
 //#region src/dynamoDB.ts
 /** The DynamoDB client ignores the CloudFront and batching settings. */
-const adapterOf = ({ tableName, ...clientConfig }) => {
-	const client = new _aws_sdk_client_dynamodb.DynamoDBClient(clientConfig);
+const adapterOf = ({ tableName, credentials, ...clientConfig }) => {
+	const client = new _aws_sdk_client_dynamodb.DynamoDBClient({
+		...clientConfig,
+		credentials: toSdkCredentials(credentials)
+	});
 	const store = createDynamoDBStore({
 		client,
 		tableName
@@ -14323,7 +14347,10 @@ const marked = (target) => ({ [DATABASE_TARGET]: target });
 */
 const dynamoDB = (config) => {
 	const { client, adapter } = adapterOf(config);
-	const cloudFront = createUpdateRouteInvalidation(config);
+	const cloudFront = createUpdateRouteInvalidation({
+		...config,
+		credentials: toSdkCredentials(config.credentials)
+	});
 	return {
 		...createEngineDatabase({
 			name: "dynamoDB",
@@ -14345,8 +14372,11 @@ const dynamoDB = (config) => {
 const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
 const isObjectNotFoundError = (error) => error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchKey");
 function s3Storage(config) {
-	const { bucketName, basePath, getDownloadUrl, ...s3Config } = config;
-	const client = new _aws_sdk_client_s3.S3Client(applyS3RuntimeAwsConfig(s3Config));
+	const { bucketName, basePath, getDownloadUrl, credentials, ...s3Config } = config;
+	const client = new _aws_sdk_client_s3.S3Client(applyS3RuntimeAwsConfig({
+		...s3Config,
+		credentials: toSdkCredentials(credentials)
+	}));
 	const normalizedBasePath = basePath?.replace(/^\/+|\/+$/g, "") ?? "";
 	const getStorageKey = createStorageKeyBuilder(normalizedBasePath);
 	const getListPrefix = (prefix = "") => {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hot-updater/aws",
   "type": "module",
-  "version": "1.2.0-rc.7",
+  "version": "1.2.0-rc.8",
   "description": "React Native OTA solution for self-hosted",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -45,9 +45,9 @@
     "es-toolkit": "^1.32.0",
     "execa": "9.5.2",
     "mime": "^4.0.4",
-    "@hot-updater/protocol": "1.2.0-rc.7",
-    "@hot-updater/mock": "1.2.0-rc.7",
-    "@hot-updater/test-utils": "1.2.0-rc.7"
+    "@hot-updater/protocol": "1.2.0-rc.8",
+    "@hot-updater/test-utils": "1.2.0-rc.8",
+    "@hot-updater/mock": "1.2.0-rc.8"
   },
   "dependencies": {
     "@aws-sdk/client-cloudfront": "3.1066.0",
@@ -64,9 +64,9 @@
     "@aws-sdk/lib-dynamodb": "3.1066.0",
     "@aws-sdk/s3-request-presigner": "3.1066.0",
     "hono": "4.12.34",
-    "@hot-updater/cli-tools": "1.2.0-rc.7",
-    "@hot-updater/plugin-core": "1.2.0-rc.7",
-    "@hot-updater/server": "1.2.0-rc.7"
+    "@hot-updater/cli-tools": "1.2.0-rc.8",
+    "@hot-updater/plugin-core": "1.2.0-rc.8",
+    "@hot-updater/server": "1.2.0-rc.8"
   },
   "scripts": {
     "build": "tsdown",