@hot-updater/aws 1.2.0-rc.7 → 1.2.0-rc.9

package/dist/index.cjs

@@ -5,8 +5,7 @@ let _aws_sdk_client_cloudfront = require("@aws-sdk/client-cloudfront");
 let _aws_sdk_lib_dynamodb = require("@aws-sdk/lib-dynamodb");
 let _aws_sdk_client_ssm = require("@aws-sdk/client-ssm");
 let _aws_sdk_cloudfront_signer = require("@aws-sdk/cloudfront-signer");
-let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
-let _aws_sdk_lib_storage = require("@aws-sdk/lib-storage");
+let _hot_updater_storage_s3 = require("@hot-updater/storage-s3");
 let node_crypto = require("node:crypto");
 //#region src/cloudFrontInvalidation.ts
 const DEFAULT_POLL_INTERVAL_MS = 2e3;
@@ -315,10 +314,30 @@ async apply() {
 	};
 };
 //#endregion
+//#region src/lazyCredentials.ts
+/**
+* `credentials` as the AWS SDK takes them: access keys with a lazy field
+* become a provider, which the SDK calls once, on its first request.
+*/
+const toSdkCredentials = (credentials) => {
+	if (credentials === void 0 || typeof credentials === "function") return credentials;
+	const { accessKeyId, secretAccessKey, sessionToken, ...rest } = credentials;
+	if (typeof accessKeyId !== "function" && typeof secretAccessKey !== "function" && typeof sessionToken !== "function") return credentials;
+	return async () => ({
+		...rest,
+		accessKeyId: await (0, _hot_updater_plugin_core.resolveLazy)(accessKeyId),
+		secretAccessKey: await (0, _hot_updater_plugin_core.resolveLazy)(secretAccessKey),
+		...sessionToken === void 0 ? {} : { sessionToken: await (0, _hot_updater_plugin_core.resolveLazy)(sessionToken) }
+	});
+};
+//#endregion
 //#region src/dynamoDB.ts
 /** The DynamoDB client ignores the CloudFront and batching settings. */
-const adapterOf = ({ tableName, ...clientConfig }) => {
-	const client = new _aws_sdk_client_dynamodb.DynamoDBClient(clientConfig);
+const adapterOf = ({ tableName, credentials, ...clientConfig }) => {
+	const client = new _aws_sdk_client_dynamodb.DynamoDBClient({
+		...clientConfig,
+		credentials: toSdkCredentials(credentials)
+	});
 	const store = createDynamoDBStore({
 		client,
 		tableName
@@ -353,7 +372,10 @@ const marked = (target) => ({ [DATABASE_TARGET]: target });
 */
 const dynamoDB = (config) => {
 	const { client, adapter } = adapterOf(config);
-	const cloudFront = createUpdateRouteInvalidation(config);
+	const cloudFront = createUpdateRouteInvalidation({
+		...config,
+		credentials: toSdkCredentials(config.credentials)
+	});
 	return {
 		...(0, _hot_updater_plugin_core.createEngineDatabase)({
 			name: "dynamoDB",
@@ -496,153 +518,17 @@ const cloudFrontDownloadUrl = (config) => {
 };
 //#endregion
 //#region src/s3Storage.ts
-/** Devices download right after the update check that returns the URL. */
-const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
-const isObjectNotFoundError = (error) => error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchKey");
 function s3Storage(config) {
-	const { bucketName, basePath, getDownloadUrl, ...s3Config } = config;
-	const client = new _aws_sdk_client_s3.S3Client(applyS3RuntimeAwsConfig(s3Config));
-	const normalizedBasePath = basePath?.replace(/^\/+|\/+$/g, "") ?? "";
-	const getStorageKey = (0, _hot_updater_plugin_core.createStorageKeyBuilder)(normalizedBasePath);
-	const getListPrefix = (prefix = "") => {
-		const normalizedPrefix = prefix.replace(/^\/+|\/+$/g, "");
-		const value = [normalizedBasePath, normalizedPrefix].filter(Boolean).join("/");
-		return value ? `${value}/` : "";
-	};
-	/**
-	* The URI `put` returns for the key, or null for a key no `put` writes,
-	* such as a folder marker that ends in "/".
-	*/
-	const getListedStorageUri = (key) => {
-		try {
-			return (0, _hot_updater_plugin_core.createStorageUri)({
-				bucket: bucketName,
-				key,
-				protocol: "s3"
-			});
-		} catch {
-			return null;
-		}
-	};
-	const getRelativeKey = (key) => {
-		if (!normalizedBasePath) return key;
-		const basePrefix = `${normalizedBasePath}/`;
-		return key.startsWith(basePrefix) ? key.slice(basePrefix.length) : key;
-	};
-	const parseAndValidate = (storageUri) => {
-		const parsed = (0, _hot_updater_plugin_core.parseStorageUri)(storageUri, "s3");
-		if (parsed.bucket !== bucketName) throw new Error(`Bucket name mismatch: expected "${bucketName}", but found "${parsed.bucket}".`);
-		return parsed;
-	};
-	return (0, _hot_updater_plugin_core.createStorageAdapter)({
+	const { bucketName, basePath, getDownloadUrl, credentials, ...s3Config } = config;
+	return (0, _hot_updater_storage_s3.createS3Storage)({
 		name: "s3Storage",
-		protocol: "s3",
-		async listObjects(prefix) {
-			const objects = [];
-			let continuationToken;
-			do {
-				const response = await client.send(new _aws_sdk_client_s3.ListObjectsV2Command({
-					Bucket: bucketName,
-					ContinuationToken: continuationToken,
-					Prefix: getListPrefix(prefix)
-				}));
-				for (const object of response.Contents ?? []) {
-					if (!object.Key) continue;
-					const storageUri = getListedStorageUri(object.Key);
-					if (storageUri === null) continue;
-					objects.push({
-						key: getRelativeKey(object.Key),
-						lastModifiedAt: object.LastModified,
-						size: object.Size ?? 0,
-						storageUri
-					});
-				}
-				continuationToken = response.NextContinuationToken;
-			} while (continuationToken);
-			return objects;
-		},
-		async deleteObjects(relativeKeys) {
-			const keys = relativeKeys.map((key) => getStorageKey(key));
-			for (let offset = 0; offset < keys.length; offset += 1e3) {
-				const batch = keys.slice(offset, offset + 1e3);
-				if (batch.length === 0) continue;
-				const response = await client.send(new _aws_sdk_client_s3.DeleteObjectsCommand({
-					Bucket: bucketName,
-					Delete: {
-						Objects: batch.map((Key) => ({ Key })),
-						Quiet: true
-					}
-				}));
-				if (response.Errors && response.Errors.length > 0) throw new Error(`Failed to delete ${response.Errors.length} S3 object(s).`);
-			}
-		},
-		async put({ key, body, contentLength, contentType }) {
-			const storageKey = getStorageKey(key);
-			const response = await new _aws_sdk_lib_storage.Upload({
-				client,
-				params: {
-					Body: body,
-					Bucket: bucketName,
-					CacheControl: "max-age=31536000",
-					...contentLength === void 0 ? {} : { ContentLength: contentLength },
-					ContentType: contentType,
-					Key: storageKey
-				}
-			}).done();
-			if (!response.Bucket || !response.Key) throw new Error("Upload failed");
-			return { storageUri: (0, _hot_updater_plugin_core.createStorageUri)({
-				bucket: bucketName,
-				key: storageKey,
-				protocol: "s3"
-			}) };
-		},
-		async get({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			try {
-				const response = await client.send(new _aws_sdk_client_s3.GetObjectCommand({
-					Bucket: bucketName,
-					Key: key
-				}));
-				if (!response.Body) return { response: null };
-				const headers = new Headers();
-				if (response.ContentType) headers.set("content-type", response.ContentType);
-				if (response.ContentLength !== void 0) headers.set("content-length", String(response.ContentLength));
-				return { response: new Response(response.Body.transformToWebStream(), { headers }) };
-			} catch (error) {
-				if (isObjectNotFoundError(error)) return { response: null };
-				throw error;
-			}
-		},
-		async getDownloadUrl({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			if (getDownloadUrl) return getDownloadUrl({ storageUri });
-			const { getSignedUrl } = await import("@aws-sdk/s3-request-presigner");
-			return { url: await getSignedUrl(client, new _aws_sdk_client_s3.GetObjectCommand({
-				Bucket: bucketName,
-				Key: key
-			}), { expiresIn: PRESIGNED_URL_EXPIRES_IN_SECONDS }) };
-		},
-		async exists({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			try {
-				await client.send(new _aws_sdk_client_s3.HeadObjectCommand({
-					Bucket: bucketName,
-					Key: key
-				}));
-				return { exists: true };
-			} catch (error) {
-				if (isObjectNotFoundError(error)) return { exists: false };
-				throw error;
-			}
-		},
-		async delete({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			await client.send(new _aws_sdk_client_s3.DeleteObjectCommand({
-				Bucket: bucketName,
-				Key: key
-			}));
-			return { deleted: true };
-		}
+		protocol: "s3"
+	}, {
+		...applyS3RuntimeAwsConfig(s3Config),
+		credentials,
+		bucketName,
+		basePath,
+		getDownloadUrl
 	});
 }
 //#endregion
@@ -667,7 +553,22 @@ const EXPIRED_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set([
 ]);
 /** Errors of the SDK finding no credentials, or an expired SSO session. */
 const NO_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set(["CredentialsProviderError", "TokenProviderError"]);
-const SIGN_IN_HINT = "In CI, set them with aws-actions/configure-aws-credentials; on your machine, run aws sso login --profile <profile> and set AWS_PROFILE=<profile>";
+const SIGN_IN_HINT = ["In CI, set them with aws-actions/configure-aws-credentials.", "On your machine: aws sso login --profile <profile>, then set AWS_PROFILE."];
+/** The widest line a message has: the CLI prints no wider. */
+const LINE_WIDTH = 76;
+/** `text`, such as AWS's own message, in lines that fit, broken at spaces. */
+const wrap = (text) => {
+	const lines = [];
+	let line = "";
+	for (const word of text.split(/\s+/u).filter(Boolean)) if (line && line.length + 1 + word.length > LINE_WIDTH) {
+		lines.push(line);
+		line = word;
+	} else line = line ? `${line} ${word}` : word;
+	if (line) lines.push(line);
+	return lines;
+};
+/** An error of one line each, for a terminal. */
+const failure = (lines, cause) => new Error(lines.join("\n"), cause === void 0 ? void 0 : { cause });
 const errorName = (error) => error instanceof Error ? error.name : "";
 const errorMessage = (error) => (error instanceof Error ? error.message : String(error)).replace(/\.+$/u, "");
 const resolveEndpoint = (endpoint) => {
@@ -682,7 +583,11 @@ const resolveEndpoint = (endpoint) => {
 		"127.0.0.1",
 		"[::1]"
 	])).has(url.hostname);
-	if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.search || url.hash) throw new Error(`${NAME} endpoint must use HTTPS, or HTTP on a loopback address, without credentials, a query, or a fragment.`);
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.search || url.hash) throw failure([
+		`${NAME} can't use its endpoint.`,
+		"Use HTTPS, or HTTP on a loopback address.",
+		"Leave out credentials, a query, and a fragment."
+	]);
 	return url.toString();
 };
 /** Masks a value in the CLI's output, which loads `@hot-updater/cli-tools`. */
@@ -709,20 +614,20 @@ const checkCredentials = async (credentials) => {
 */
 const secretsManager = ({ credentials, endpoint, prefix = "hot-updater/", region }) => {
 	const checkSettings = () => {
-		if (typeof region !== "string" || !REGION_PATTERN.test(region)) throw new Error(`${NAME} needs an AWS region, such as "us-east-1", and ${JSON.stringify(region)} is not one.`);
+		if (typeof region !== "string" || !REGION_PATTERN.test(region)) throw failure([`${NAME} can't use the region ${JSON.stringify(region)}.`, "Set an AWS region, such as \"us-east-1\"."]);
 		if (prefix !== "" && !SECRET_ID_PATTERN.test(prefix)) throw new Error(`${NAME}'s prefix takes letters, digits, and /_+=.@- only.`);
 	};
 	const secretId = (name) => {
 		checkSettings();
 		const id = `${prefix}${name}`;
-		if (!SECRET_ID_PATTERN.test(name) || id.length > MAX_SECRET_ID_LENGTH) throw new Error(`${NAME} cannot name a secret ${JSON.stringify(id)}: AWS takes up to ${MAX_SECRET_ID_LENGTH} letters, digits, and /_+=.@- characters.`);
+		if (!SECRET_ID_PATTERN.test(name) || id.length > MAX_SECRET_ID_LENGTH) throw failure([`${NAME} can't name a secret ${JSON.stringify(id)}.`, `AWS takes up to ${MAX_SECRET_ID_LENGTH} letters, digits, and /_+=.@- characters.`]);
 		return id;
 	};
 	const resolveCredentials = () => {
 		if (credentials !== void 0) return async () => checkCredentials(typeof credentials === "function" ? await credentials() : credentials);
 		const accessKeyId = process.env["AWS_ACCESS_KEY_ID"];
 		const secretAccessKey = process.env["AWS_SECRET_ACCESS_KEY"];
-		if (Boolean(accessKeyId) !== Boolean(secretAccessKey)) throw new Error(`${NAME} found ${accessKeyId ? "AWS_ACCESS_KEY_ID" : "AWS_SECRET_ACCESS_KEY"} without ${accessKeyId ? "AWS_SECRET_ACCESS_KEY" : "AWS_ACCESS_KEY_ID"} in the environment: set both, or neither to use a profile.`);
+		if (Boolean(accessKeyId) !== Boolean(secretAccessKey)) throw failure([`${NAME} found ${accessKeyId ? "AWS_ACCESS_KEY_ID" : "AWS_SECRET_ACCESS_KEY"} without ${accessKeyId ? "AWS_SECRET_ACCESS_KEY" : "AWS_ACCESS_KEY_ID"}.`, "Set both, or neither to use a profile."]);
 	};
 	let opened;
 	const open = () => {
@@ -745,12 +650,40 @@ const secretsManager = ({ credentials, endpoint, prefix = "hot-updater/", region
 	const describeFailure = (verb, id, error, permissions) => {
 		const name = errorName(error);
 		const status = error?.$metadata?.httpStatusCode;
-		const detail = `${name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}`;
-		if (NO_CREDENTIAL_ERRORS.has(name)) return new Error(`${NAME} found no usable AWS credentials to ${verb} ${JSON.stringify(id)} (${errorMessage(error)}). ${SIGN_IN_HINT}.`, { cause: error });
-		if (EXPIRED_CREDENTIAL_ERRORS.has(name)) return new Error(`AWS Secrets Manager refused the credentials to ${verb} ${JSON.stringify(id)}, ${detail}. They are expired or invalid: sign in again. ${SIGN_IN_HINT}.`, { cause: error });
-		if (name === "AccessDeniedException") return new Error(`AWS Secrets Manager refused to ${verb} ${JSON.stringify(id)}, ${detail}. The AWS identity needs ${permissions} on it, and on a secret encrypted with a customer managed KMS key, kms:Decrypt to read and kms:GenerateDataKey to store.`, { cause: error });
-		if (/marked for deletion|scheduled for deletion/iu.test(errorMessage(error))) return new Error(`AWS Secrets Manager cannot ${verb} ${JSON.stringify(id)}: it is scheduled for deletion. Restore it with aws secretsmanager restore-secret --secret-id ${id}, or wait until it is deleted.`, { cause: error });
-		return new Error(`AWS Secrets Manager failed to ${verb} ${JSON.stringify(id)}, ${detail}.`, { cause: error });
+		const detail = wrap(`${name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}.`);
+		const secret = `Secret: ${id}`;
+		if (NO_CREDENTIAL_ERRORS.has(name)) return failure([
+			`${NAME} found no AWS credentials to ${verb} a secret.`,
+			secret,
+			...wrap(`${errorMessage(error)}.`),
+			...SIGN_IN_HINT
+		], error);
+		if (EXPIRED_CREDENTIAL_ERRORS.has(name)) return failure([
+			`AWS Secrets Manager refused the sign-in to ${verb} a secret.`,
+			secret,
+			...detail,
+			"They are expired or invalid: sign in again.",
+			...SIGN_IN_HINT
+		], error);
+		if (name === "AccessDeniedException") return failure([
+			`AWS Secrets Manager refused to ${verb} a secret.`,
+			secret,
+			...detail,
+			`The AWS identity needs ${permissions} on it.`,
+			`With a customer managed KMS key, it needs ${verb === "read" ? "kms:Decrypt" : "kms:GenerateDataKey"} too.`
+		], error);
+		if (/marked for deletion|scheduled for deletion/iu.test(errorMessage(error))) return failure([
+			`AWS Secrets Manager can't ${verb} a secret.`,
+			secret,
+			"It is scheduled for deletion. Restore it, or wait until it is gone:",
+			"aws secretsmanager restore-secret \\",
+			`  --secret-id ${id}`
+		], error);
+		return failure([
+			`AWS Secrets Manager failed to ${verb} a secret.`,
+			secret,
+			...detail
+		], error);
 	};
 	const read = async ({ sdk, client }, id) => {
 		let output;
@@ -780,8 +713,8 @@ const secretsManager = ({ credentials, endpoint, prefix = "hot-updater/", region
 		},
 		set: async (name, value) => {
 			const id = secretId(name);
-			if (typeof value !== "string" || value === "") throw new Error(`${NAME} cannot store an empty ${id}.`);
-			if (Buffer.byteLength(value, "utf8") > MAX_SECRET_BYTES) throw new Error(`${NAME} cannot store ${id}: AWS takes up to ${MAX_SECRET_BYTES} bytes per secret.`);
+			if (typeof value !== "string" || value === "") throw new Error(`${NAME} can't store an empty ${id}.`);
+			if (Buffer.byteLength(value, "utf8") > MAX_SECRET_BYTES) throw failure([`${NAME} can't store ${id}.`, `AWS takes up to ${MAX_SECRET_BYTES} bytes per secret.`]);
 			await mask([value]);
 			const { sdk, client } = await open();
 			const token = (0, node_crypto.randomUUID)();

package/dist/index.d.cts

@@ -1,8 +1,25 @@
 import { DynamoDBClientConfig } from "@aws-sdk/client-dynamodb";
-import { EngineDatabase, PluginTables, SecretsAdapter, StorageAdapter, StorageAdapterWith } from "@hot-updater/plugin-core";
+import { EngineDatabase, Lazy, PluginTables, SecretsAdapter, StorageAdapter, StorageAdapterWith } from "@hot-updater/plugin-core";
 import { S3ClientConfig } from "@aws-sdk/client-s3";
+import { S3StorageOperations } from "@hot-updater/storage-s3";
+//#region src/lazyCredentials.d.ts
+type SdkCredentials = S3ClientConfig["credentials"];
+/**
+ * Access keys whose fields may each be a function that returns them, such
+ * as `secret("<name>")` in `hot-updater.config.ts`, called on first use.
+ */
+interface LazyAwsCredentials {
+  readonly accessKeyId: Lazy<string>;
+  readonly secretAccessKey: Lazy<string>;
+  readonly sessionToken?: Lazy<string>;
+}
+/** The credentials the AWS SDK takes, or access keys with lazy fields. */
+type AwsCredentialsOption = SdkCredentials | LazyAwsCredentials;
+//#endregion
 //#region src/dynamoDB.d.ts
-interface DynamoDBConfig extends DynamoDBClientConfig {
+interface DynamoDBConfig extends Omit<DynamoDBClientConfig, "credentials"> {
+  /** The SDK's credentials, or access keys whose fields are lazy. */
+  readonly credentials?: AwsCredentialsOption;
   readonly apiBasePath?: string;
   readonly cloudfrontDistributionId?: string;
   readonly shouldWaitForInvalidation?: boolean;
@@ -59,7 +76,9 @@ declare const cloudFrontDownloadUrl: (config: CloudFrontDownloadUrlOptions) => (
 }>;
 //#endregion
 //#region src/s3Storage.d.ts
-interface S3StorageConfig extends S3ClientConfig {
+interface S3StorageConfig extends Omit<S3ClientConfig, "credentials"> {
+  /** The SDK's credentials, or access keys whose fields are lazy. */
+  credentials?: AwsCredentialsOption;
   bucketName: string;
   /** Base path where bundles will be stored in the bucket. */
   basePath?: string;
@@ -70,7 +89,6 @@ interface S3StorageConfig extends S3ClientConfig {
    */
   getDownloadUrl?: StorageAdapter["getDownloadUrl"];
 }
-type S3StorageOperations = "put" | "get" | "getDownloadUrl" | "exists" | "delete" | "listObjects" | "deleteObjects";
 declare function s3Storage(config: S3StorageConfig): StorageAdapterWith<S3StorageOperations>;
 //#endregion
 //#region src/secretsManager.d.ts
@@ -85,7 +103,7 @@ interface SecretsManagerOptions {
   /** The AWS region the secrets are in, such as `"us-east-1"`. */
   readonly region: string;
   /**
-   * Put before every name to make its secret's name, so `secret:asc-api-key`
+   * Put before every name to make its secret's name, so `secret("asc-api-key")`
    * reads the secret `hot-updater/asc-api-key` and one IAM resource,
    * `secret:hot-updater/*`, covers them all. Letters, digits, and
    * `/_+=.@-`.

package/dist/index.d.mts

@@ -1,8 +1,25 @@
 import { DynamoDBClientConfig } from "@aws-sdk/client-dynamodb";
-import { EngineDatabase, PluginTables, SecretsAdapter, StorageAdapter, StorageAdapterWith } from "@hot-updater/plugin-core";
+import { EngineDatabase, Lazy, PluginTables, SecretsAdapter, StorageAdapter, StorageAdapterWith } from "@hot-updater/plugin-core";
+import { S3StorageOperations } from "@hot-updater/storage-s3";
 import { S3ClientConfig } from "@aws-sdk/client-s3";
+//#region src/lazyCredentials.d.ts
+type SdkCredentials = S3ClientConfig["credentials"];
+/**
+ * Access keys whose fields may each be a function that returns them, such
+ * as `secret("<name>")` in `hot-updater.config.ts`, called on first use.
+ */
+interface LazyAwsCredentials {
+  readonly accessKeyId: Lazy<string>;
+  readonly secretAccessKey: Lazy<string>;
+  readonly sessionToken?: Lazy<string>;
+}
+/** The credentials the AWS SDK takes, or access keys with lazy fields. */
+type AwsCredentialsOption = SdkCredentials | LazyAwsCredentials;
+//#endregion
 //#region src/dynamoDB.d.ts
-interface DynamoDBConfig extends DynamoDBClientConfig {
+interface DynamoDBConfig extends Omit<DynamoDBClientConfig, "credentials"> {
+  /** The SDK's credentials, or access keys whose fields are lazy. */
+  readonly credentials?: AwsCredentialsOption;
   readonly apiBasePath?: string;
   readonly cloudfrontDistributionId?: string;
   readonly shouldWaitForInvalidation?: boolean;
@@ -59,7 +76,9 @@ declare const cloudFrontDownloadUrl: (config: CloudFrontDownloadUrlOptions) => (
 }>;
 //#endregion
 //#region src/s3Storage.d.ts
-interface S3StorageConfig extends S3ClientConfig {
+interface S3StorageConfig extends Omit<S3ClientConfig, "credentials"> {
+  /** The SDK's credentials, or access keys whose fields are lazy. */
+  credentials?: AwsCredentialsOption;
   bucketName: string;
   /** Base path where bundles will be stored in the bucket. */
   basePath?: string;
@@ -70,7 +89,6 @@ interface S3StorageConfig extends S3ClientConfig {
    */
   getDownloadUrl?: StorageAdapter["getDownloadUrl"];
 }
-type S3StorageOperations = "put" | "get" | "getDownloadUrl" | "exists" | "delete" | "listObjects" | "deleteObjects";
 declare function s3Storage(config: S3StorageConfig): StorageAdapterWith<S3StorageOperations>;
 //#endregion
 //#region src/secretsManager.d.ts
@@ -85,7 +103,7 @@ interface SecretsManagerOptions {
   /** The AWS region the secrets are in, such as `"us-east-1"`. */
   readonly region: string;
   /**
-   * Put before every name to make its secret's name, so `secret:asc-api-key`
+   * Put before every name to make its secret's name, so `secret("asc-api-key")`
    * reads the secret `hot-updater/asc-api-key` and one IAM resource,
    * `secret:hot-updater/*`, covers them all. Letters, digits, and
    * `/_+=.@-`.