@hot-updater/aws 1.2.0-rc.7 → 1.2.0-rc.9

package/dist/index.mjs

@@ -1,11 +1,10 @@
 import { CreateTableCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DynamoDBClient, UpdateTimeToLiveCommand, waitUntilTableExists } from "@aws-sdk/client-dynamodb";
-import { BUNDLE_STORAGE_PREFIX, CONTENT_ADDRESSED_ASSET_PREFIX, createEngineDatabase, createKvAdapter, createStorageAdapter, createStorageKeyBuilder, createStorageUri, migrateCoreSchema, parseStorageUri } from "@hot-updater/plugin-core";
+import { BUNDLE_STORAGE_PREFIX, CONTENT_ADDRESSED_ASSET_PREFIX, createEngineDatabase, createKvAdapter, migrateCoreSchema, resolveLazy } from "@hot-updater/plugin-core";
 import { CloudFrontClient, CreateInvalidationCommand, GetInvalidationCommand } from "@aws-sdk/client-cloudfront";
 import { BatchGetCommand, BatchWriteCommand, DynamoDBDocumentClient, QueryCommand, TransactWriteCommand } from "@aws-sdk/lib-dynamodb";
 import { SSM } from "@aws-sdk/client-ssm";
 import { getSignedUrl } from "@aws-sdk/cloudfront-signer";
-import { DeleteObjectCommand, DeleteObjectsCommand, GetObjectCommand, HeadObjectCommand, ListObjectsV2Command, S3Client } from "@aws-sdk/client-s3";
-import { Upload } from "@aws-sdk/lib-storage";
+import { createS3Storage } from "@hot-updater/storage-s3";
 import { randomUUID } from "node:crypto";
 //#region src/cloudFrontInvalidation.ts
 const DEFAULT_POLL_INTERVAL_MS = 2e3;
@@ -314,10 +313,30 @@ async apply() {
 	};
 };
 //#endregion
+//#region src/lazyCredentials.ts
+/**
+* `credentials` as the AWS SDK takes them: access keys with a lazy field
+* become a provider, which the SDK calls once, on its first request.
+*/
+const toSdkCredentials = (credentials) => {
+	if (credentials === void 0 || typeof credentials === "function") return credentials;
+	const { accessKeyId, secretAccessKey, sessionToken, ...rest } = credentials;
+	if (typeof accessKeyId !== "function" && typeof secretAccessKey !== "function" && typeof sessionToken !== "function") return credentials;
+	return async () => ({
+		...rest,
+		accessKeyId: await resolveLazy(accessKeyId),
+		secretAccessKey: await resolveLazy(secretAccessKey),
+		...sessionToken === void 0 ? {} : { sessionToken: await resolveLazy(sessionToken) }
+	});
+};
+//#endregion
 //#region src/dynamoDB.ts
 /** The DynamoDB client ignores the CloudFront and batching settings. */
-const adapterOf = ({ tableName, ...clientConfig }) => {
-	const client = new DynamoDBClient(clientConfig);
+const adapterOf = ({ tableName, credentials, ...clientConfig }) => {
+	const client = new DynamoDBClient({
+		...clientConfig,
+		credentials: toSdkCredentials(credentials)
+	});
 	const store = createDynamoDBStore({
 		client,
 		tableName
@@ -352,7 +371,10 @@ const marked = (target) => ({ [DATABASE_TARGET]: target });
 */
 const dynamoDB = (config) => {
 	const { client, adapter } = adapterOf(config);
-	const cloudFront = createUpdateRouteInvalidation(config);
+	const cloudFront = createUpdateRouteInvalidation({
+		...config,
+		credentials: toSdkCredentials(config.credentials)
+	});
 	return {
 		...createEngineDatabase({
 			name: "dynamoDB",
@@ -495,153 +517,17 @@ const cloudFrontDownloadUrl = (config) => {
 };
 //#endregion
 //#region src/s3Storage.ts
-/** Devices download right after the update check that returns the URL. */
-const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
-const isObjectNotFoundError = (error) => error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchKey");
 function s3Storage(config) {
-	const { bucketName, basePath, getDownloadUrl, ...s3Config } = config;
-	const client = new S3Client(applyS3RuntimeAwsConfig(s3Config));
-	const normalizedBasePath = basePath?.replace(/^\/+|\/+$/g, "") ?? "";
-	const getStorageKey = createStorageKeyBuilder(normalizedBasePath);
-	const getListPrefix = (prefix = "") => {
-		const normalizedPrefix = prefix.replace(/^\/+|\/+$/g, "");
-		const value = [normalizedBasePath, normalizedPrefix].filter(Boolean).join("/");
-		return value ? `${value}/` : "";
-	};
-	/**
-	* The URI `put` returns for the key, or null for a key no `put` writes,
-	* such as a folder marker that ends in "/".
-	*/
-	const getListedStorageUri = (key) => {
-		try {
-			return createStorageUri({
-				bucket: bucketName,
-				key,
-				protocol: "s3"
-			});
-		} catch {
-			return null;
-		}
-	};
-	const getRelativeKey = (key) => {
-		if (!normalizedBasePath) return key;
-		const basePrefix = `${normalizedBasePath}/`;
-		return key.startsWith(basePrefix) ? key.slice(basePrefix.length) : key;
-	};
-	const parseAndValidate = (storageUri) => {
-		const parsed = parseStorageUri(storageUri, "s3");
-		if (parsed.bucket !== bucketName) throw new Error(`Bucket name mismatch: expected "${bucketName}", but found "${parsed.bucket}".`);
-		return parsed;
-	};
-	return createStorageAdapter({
+	const { bucketName, basePath, getDownloadUrl, credentials, ...s3Config } = config;
+	return createS3Storage({
 		name: "s3Storage",
-		protocol: "s3",
-		async listObjects(prefix) {
-			const objects = [];
-			let continuationToken;
-			do {
-				const response = await client.send(new ListObjectsV2Command({
-					Bucket: bucketName,
-					ContinuationToken: continuationToken,
-					Prefix: getListPrefix(prefix)
-				}));
-				for (const object of response.Contents ?? []) {
-					if (!object.Key) continue;
-					const storageUri = getListedStorageUri(object.Key);
-					if (storageUri === null) continue;
-					objects.push({
-						key: getRelativeKey(object.Key),
-						lastModifiedAt: object.LastModified,
-						size: object.Size ?? 0,
-						storageUri
-					});
-				}
-				continuationToken = response.NextContinuationToken;
-			} while (continuationToken);
-			return objects;
-		},
-		async deleteObjects(relativeKeys) {
-			const keys = relativeKeys.map((key) => getStorageKey(key));
-			for (let offset = 0; offset < keys.length; offset += 1e3) {
-				const batch = keys.slice(offset, offset + 1e3);
-				if (batch.length === 0) continue;
-				const response = await client.send(new DeleteObjectsCommand({
-					Bucket: bucketName,
-					Delete: {
-						Objects: batch.map((Key) => ({ Key })),
-						Quiet: true
-					}
-				}));
-				if (response.Errors && response.Errors.length > 0) throw new Error(`Failed to delete ${response.Errors.length} S3 object(s).`);
-			}
-		},
-		async put({ key, body, contentLength, contentType }) {
-			const storageKey = getStorageKey(key);
-			const response = await new Upload({
-				client,
-				params: {
-					Body: body,
-					Bucket: bucketName,
-					CacheControl: "max-age=31536000",
-					...contentLength === void 0 ? {} : { ContentLength: contentLength },
-					ContentType: contentType,
-					Key: storageKey
-				}
-			}).done();
-			if (!response.Bucket || !response.Key) throw new Error("Upload failed");
-			return { storageUri: createStorageUri({
-				bucket: bucketName,
-				key: storageKey,
-				protocol: "s3"
-			}) };
-		},
-		async get({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			try {
-				const response = await client.send(new GetObjectCommand({
-					Bucket: bucketName,
-					Key: key
-				}));
-				if (!response.Body) return { response: null };
-				const headers = new Headers();
-				if (response.ContentType) headers.set("content-type", response.ContentType);
-				if (response.ContentLength !== void 0) headers.set("content-length", String(response.ContentLength));
-				return { response: new Response(response.Body.transformToWebStream(), { headers }) };
-			} catch (error) {
-				if (isObjectNotFoundError(error)) return { response: null };
-				throw error;
-			}
-		},
-		async getDownloadUrl({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			if (getDownloadUrl) return getDownloadUrl({ storageUri });
-			const { getSignedUrl } = await import("@aws-sdk/s3-request-presigner");
-			return { url: await getSignedUrl(client, new GetObjectCommand({
-				Bucket: bucketName,
-				Key: key
-			}), { expiresIn: PRESIGNED_URL_EXPIRES_IN_SECONDS }) };
-		},
-		async exists({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			try {
-				await client.send(new HeadObjectCommand({
-					Bucket: bucketName,
-					Key: key
-				}));
-				return { exists: true };
-			} catch (error) {
-				if (isObjectNotFoundError(error)) return { exists: false };
-				throw error;
-			}
-		},
-		async delete({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			await client.send(new DeleteObjectCommand({
-				Bucket: bucketName,
-				Key: key
-			}));
-			return { deleted: true };
-		}
+		protocol: "s3"
+	}, {
+		...applyS3RuntimeAwsConfig(s3Config),
+		credentials,
+		bucketName,
+		basePath,
+		getDownloadUrl
 	});
 }
 //#endregion
@@ -666,7 +552,22 @@ const EXPIRED_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set([
 ]);
 /** Errors of the SDK finding no credentials, or an expired SSO session. */
 const NO_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set(["CredentialsProviderError", "TokenProviderError"]);
-const SIGN_IN_HINT = "In CI, set them with aws-actions/configure-aws-credentials; on your machine, run aws sso login --profile <profile> and set AWS_PROFILE=<profile>";
+const SIGN_IN_HINT = ["In CI, set them with aws-actions/configure-aws-credentials.", "On your machine: aws sso login --profile <profile>, then set AWS_PROFILE."];
+/** The widest line a message has: the CLI prints no wider. */
+const LINE_WIDTH = 76;
+/** `text`, such as AWS's own message, in lines that fit, broken at spaces. */
+const wrap = (text) => {
+	const lines = [];
+	let line = "";
+	for (const word of text.split(/\s+/u).filter(Boolean)) if (line && line.length + 1 + word.length > LINE_WIDTH) {
+		lines.push(line);
+		line = word;
+	} else line = line ? `${line} ${word}` : word;
+	if (line) lines.push(line);
+	return lines;
+};
+/** An error of one line each, for a terminal. */
+const failure = (lines, cause) => new Error(lines.join("\n"), cause === void 0 ? void 0 : { cause });
 const errorName = (error) => error instanceof Error ? error.name : "";
 const errorMessage = (error) => (error instanceof Error ? error.message : String(error)).replace(/\.+$/u, "");
 const resolveEndpoint = (endpoint) => {
@@ -681,7 +582,11 @@ const resolveEndpoint = (endpoint) => {
 		"127.0.0.1",
 		"[::1]"
 	])).has(url.hostname);
-	if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.search || url.hash) throw new Error(`${NAME} endpoint must use HTTPS, or HTTP on a loopback address, without credentials, a query, or a fragment.`);
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.search || url.hash) throw failure([
+		`${NAME} can't use its endpoint.`,
+		"Use HTTPS, or HTTP on a loopback address.",
+		"Leave out credentials, a query, and a fragment."
+	]);
 	return url.toString();
 };
 /** Masks a value in the CLI's output, which loads `@hot-updater/cli-tools`. */
@@ -708,20 +613,20 @@ const checkCredentials = async (credentials) => {
 */
 const secretsManager = ({ credentials, endpoint, prefix = "hot-updater/", region }) => {
 	const checkSettings = () => {
-		if (typeof region !== "string" || !REGION_PATTERN.test(region)) throw new Error(`${NAME} needs an AWS region, such as "us-east-1", and ${JSON.stringify(region)} is not one.`);
+		if (typeof region !== "string" || !REGION_PATTERN.test(region)) throw failure([`${NAME} can't use the region ${JSON.stringify(region)}.`, "Set an AWS region, such as \"us-east-1\"."]);
 		if (prefix !== "" && !SECRET_ID_PATTERN.test(prefix)) throw new Error(`${NAME}'s prefix takes letters, digits, and /_+=.@- only.`);
 	};
 	const secretId = (name) => {
 		checkSettings();
 		const id = `${prefix}${name}`;
-		if (!SECRET_ID_PATTERN.test(name) || id.length > MAX_SECRET_ID_LENGTH) throw new Error(`${NAME} cannot name a secret ${JSON.stringify(id)}: AWS takes up to ${MAX_SECRET_ID_LENGTH} letters, digits, and /_+=.@- characters.`);
+		if (!SECRET_ID_PATTERN.test(name) || id.length > MAX_SECRET_ID_LENGTH) throw failure([`${NAME} can't name a secret ${JSON.stringify(id)}.`, `AWS takes up to ${MAX_SECRET_ID_LENGTH} letters, digits, and /_+=.@- characters.`]);
 		return id;
 	};
 	const resolveCredentials = () => {
 		if (credentials !== void 0) return async () => checkCredentials(typeof credentials === "function" ? await credentials() : credentials);
 		const accessKeyId = process.env["AWS_ACCESS_KEY_ID"];
 		const secretAccessKey = process.env["AWS_SECRET_ACCESS_KEY"];
-		if (Boolean(accessKeyId) !== Boolean(secretAccessKey)) throw new Error(`${NAME} found ${accessKeyId ? "AWS_ACCESS_KEY_ID" : "AWS_SECRET_ACCESS_KEY"} without ${accessKeyId ? "AWS_SECRET_ACCESS_KEY" : "AWS_ACCESS_KEY_ID"} in the environment: set both, or neither to use a profile.`);
+		if (Boolean(accessKeyId) !== Boolean(secretAccessKey)) throw failure([`${NAME} found ${accessKeyId ? "AWS_ACCESS_KEY_ID" : "AWS_SECRET_ACCESS_KEY"} without ${accessKeyId ? "AWS_SECRET_ACCESS_KEY" : "AWS_ACCESS_KEY_ID"}.`, "Set both, or neither to use a profile."]);
 	};
 	let opened;
 	const open = () => {
@@ -744,12 +649,40 @@ const secretsManager = ({ credentials, endpoint, prefix = "hot-updater/", region
 	const describeFailure = (verb, id, error, permissions) => {
 		const name = errorName(error);
 		const status = error?.$metadata?.httpStatusCode;
-		const detail = `${name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}`;
-		if (NO_CREDENTIAL_ERRORS.has(name)) return new Error(`${NAME} found no usable AWS credentials to ${verb} ${JSON.stringify(id)} (${errorMessage(error)}). ${SIGN_IN_HINT}.`, { cause: error });
-		if (EXPIRED_CREDENTIAL_ERRORS.has(name)) return new Error(`AWS Secrets Manager refused the credentials to ${verb} ${JSON.stringify(id)}, ${detail}. They are expired or invalid: sign in again. ${SIGN_IN_HINT}.`, { cause: error });
-		if (name === "AccessDeniedException") return new Error(`AWS Secrets Manager refused to ${verb} ${JSON.stringify(id)}, ${detail}. The AWS identity needs ${permissions} on it, and on a secret encrypted with a customer managed KMS key, kms:Decrypt to read and kms:GenerateDataKey to store.`, { cause: error });
-		if (/marked for deletion|scheduled for deletion/iu.test(errorMessage(error))) return new Error(`AWS Secrets Manager cannot ${verb} ${JSON.stringify(id)}: it is scheduled for deletion. Restore it with aws secretsmanager restore-secret --secret-id ${id}, or wait until it is deleted.`, { cause: error });
-		return new Error(`AWS Secrets Manager failed to ${verb} ${JSON.stringify(id)}, ${detail}.`, { cause: error });
+		const detail = wrap(`${name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}.`);
+		const secret = `Secret: ${id}`;
+		if (NO_CREDENTIAL_ERRORS.has(name)) return failure([
+			`${NAME} found no AWS credentials to ${verb} a secret.`,
+			secret,
+			...wrap(`${errorMessage(error)}.`),
+			...SIGN_IN_HINT
+		], error);
+		if (EXPIRED_CREDENTIAL_ERRORS.has(name)) return failure([
+			`AWS Secrets Manager refused the sign-in to ${verb} a secret.`,
+			secret,
+			...detail,
+			"They are expired or invalid: sign in again.",
+			...SIGN_IN_HINT
+		], error);
+		if (name === "AccessDeniedException") return failure([
+			`AWS Secrets Manager refused to ${verb} a secret.`,
+			secret,
+			...detail,
+			`The AWS identity needs ${permissions} on it.`,
+			`With a customer managed KMS key, it needs ${verb === "read" ? "kms:Decrypt" : "kms:GenerateDataKey"} too.`
+		], error);
+		if (/marked for deletion|scheduled for deletion/iu.test(errorMessage(error))) return failure([
+			`AWS Secrets Manager can't ${verb} a secret.`,
+			secret,
+			"It is scheduled for deletion. Restore it, or wait until it is gone:",
+			"aws secretsmanager restore-secret \\",
+			`  --secret-id ${id}`
+		], error);
+		return failure([
+			`AWS Secrets Manager failed to ${verb} a secret.`,
+			secret,
+			...detail
+		], error);
 	};
 	const read = async ({ sdk, client }, id) => {
 		let output;
@@ -779,8 +712,8 @@ const secretsManager = ({ credentials, endpoint, prefix = "hot-updater/", region
 		},
 		set: async (name, value) => {
 			const id = secretId(name);
-			if (typeof value !== "string" || value === "") throw new Error(`${NAME} cannot store an empty ${id}.`);
-			if (Buffer.byteLength(value, "utf8") > MAX_SECRET_BYTES) throw new Error(`${NAME} cannot store ${id}: AWS takes up to ${MAX_SECRET_BYTES} bytes per secret.`);
+			if (typeof value !== "string" || value === "") throw new Error(`${NAME} can't store an empty ${id}.`);
+			if (Buffer.byteLength(value, "utf8") > MAX_SECRET_BYTES) throw failure([`${NAME} can't store ${id}.`, `AWS takes up to ${MAX_SECRET_BYTES} bytes per secret.`]);
 			await mask([value]);
 			const { sdk, client } = await open();
 			const token = randomUUID();

package/dist/init/index.cjs

@@ -6579,10 +6579,30 @@ async apply() {
 	};
 };
 //#endregion
+//#region src/lazyCredentials.ts
+/**
+* `credentials` as the AWS SDK takes them: access keys with a lazy field
+* become a provider, which the SDK calls once, on its first request.
+*/
+const toSdkCredentials = (credentials) => {
+	if (credentials === void 0 || typeof credentials === "function") return credentials;
+	const { accessKeyId, secretAccessKey, sessionToken, ...rest } = credentials;
+	if (typeof accessKeyId !== "function" && typeof secretAccessKey !== "function" && typeof sessionToken !== "function") return credentials;
+	return async () => ({
+		...rest,
+		accessKeyId: await (0, _hot_updater_plugin_core.resolveLazy)(accessKeyId),
+		secretAccessKey: await (0, _hot_updater_plugin_core.resolveLazy)(secretAccessKey),
+		...sessionToken === void 0 ? {} : { sessionToken: await (0, _hot_updater_plugin_core.resolveLazy)(sessionToken) }
+	});
+};
+//#endregion
 //#region src/dynamoDB.ts
 /** The DynamoDB client ignores the CloudFront and batching settings. */
-const adapterOf = ({ tableName, ...clientConfig }) => {
-	const client = new _aws_sdk_client_dynamodb.DynamoDBClient(clientConfig);
+const adapterOf = ({ tableName, credentials, ...clientConfig }) => {
+	const client = new _aws_sdk_client_dynamodb.DynamoDBClient({
+		...clientConfig,
+		credentials: toSdkCredentials(credentials)
+	});
 	const store = createDynamoDBStore({
 		client,
 		tableName
@@ -6617,7 +6637,10 @@ const marked = (target) => ({ [DATABASE_TARGET]: target });
 */
 const dynamoDB = (config) => {
 	const { client, adapter } = adapterOf(config);
-	const cloudFront = createUpdateRouteInvalidation(config);
+	const cloudFront = createUpdateRouteInvalidation({
+		...config,
+		credentials: toSdkCredentials(config.credentials)
+	});
 	return {
 		...(0, _hot_updater_plugin_core.createEngineDatabase)({
 			name: "dynamoDB",
@@ -8419,10 +8442,11 @@ var SSMKeyPairManager = class {
 //#region iac/templates.ts
 /**
 * The config init writes. With the `resources` init set up, it names them,
-* and an account's access keys are read with `secretEnv`, from the
+* and an account's access keys are read with `secret()`, from the
 * environment and `.env.hotupdater`, then the config's `secrets` adapter.
-* Without them, as the agent scaffold writes it, it reads every value from
-* the environment. A profile or SSO sign-in is each person's own.
+* Without them, as the agent scaffold writes it before the agent creates the
+* resources, it reads their names from the environment, where the agent
+* records them. A profile or SSO sign-in is each person's own.
 */
 const getConfigScaffold = (build, authMode, resources) => {
 	const value = (envKey, resolved) => resolved === void 0 ? `process.env.${envKey}!` : JSON.stringify(resolved);
@@ -8478,31 +8502,19 @@ const awsOptions = {
 };`.trim()
 			}];
 			break;
-		case "account":
-			helperStatements = [{
-				name: "awsOptions",
-				strategy: "merge-object",
-				replaceIncompatibleProperties: ["credentials"],
-				code: resources === void 0 ? `
+		case "account": helperStatements = [{
+			name: "awsOptions",
+			strategy: "merge-object",
+			replaceIncompatibleProperties: ["credentials"],
+			code: `
 const awsOptions = {
   region: ${region},
   credentials: {
-    accessKeyId: process.env.HOT_UPDATER_S3_ACCESS_KEY_ID!,
-    secretAccessKey: process.env.HOT_UPDATER_S3_SECRET_ACCESS_KEY!,
-  },
-};`.trim() : `
-const awsOptions = {
-  region: ${region},
-  credentials: async () => {
-    const env = await deploySecrets();
-    return {
-      accessKeyId: env.HOT_UPDATER_S3_ACCESS_KEY_ID,
-      secretAccessKey: env.HOT_UPDATER_S3_SECRET_ACCESS_KEY,
-    };
+    accessKeyId: secret("HOT_UPDATER_S3_ACCESS_KEY_ID"),
+    secretAccessKey: secret("HOT_UPDATER_S3_SECRET_ACCESS_KEY"),
   },
 };`.trim()
-			}];
-			if (resources !== void 0) helperStatements.unshift((0, _hot_updater_cli_tools.secretEnvHelper)("deploySecrets", ["HOT_UPDATER_S3_ACCESS_KEY_ID", "HOT_UPDATER_S3_SECRET_ACCESS_KEY"]));
+		}];
 	}
 	const builder = new _hot_updater_cli_tools.ConfigBuilder().setBuildType(build).setStorage(storageConfig).setDatabase(databaseConfig).setPlugins({
 		imports: [{
@@ -8528,9 +8540,9 @@ const awsOptions = {
 				named: [authMode.profile ? "fromIni" : "fromNodeProviderChain"]
 			});
 			break;
-		case "account": if (resources !== void 0) builder.addImport({
+		case "account": builder.addImport({
 			pkg: "hot-updater",
-			named: ["secretEnv"]
+			named: ["secret"]
 		});
 	}
 	return (0, _hot_updater_cli_tools.createHotUpdaterConfigScaffoldFromBuilder)(builder, { helperStatements });

package/dist/init/index.mjs

@@ -1,5 +1,5 @@
 import { createRequire } from "node:module";
-import { ConfigBuilder, InitError, MissingInitInputsError, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitProviderInputs, colors, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, createZip, ensureInstallPackages, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, printAppSetup, provisionClientCredential, readHotUpdaterInitEnv, resolveInitProviderInput, secretEnvHelper, transformEnv, writeHotUpdaterFiles } from "@hot-updater/cli-tools";
+import { ConfigBuilder, InitError, MissingInitInputsError, assembleServer, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitProviderInputs, colors, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, createZip, ensureInstallPackages, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, printAppSetup, provisionClientCredential, readHotUpdaterInitEnv, resolveInitProviderInput, transformEnv, writeHotUpdaterFiles } from "@hot-updater/cli-tools";
 import { apiKeys, insights, remoteConfig } from "@hot-updater/server/plugins";
 import { fileURLToPath } from "node:url";
 import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process";
@@ -18,7 +18,7 @@ import { finished } from "node:stream/promises";
 import { Duplex, PassThrough, Readable, Transform, Writable, getDefaultHighWaterMark } from "node:stream";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { CreateTableCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DynamoDB, DynamoDBClient, UpdateTimeToLiveCommand, waitUntilTableExists } from "@aws-sdk/client-dynamodb";
-import { SETTINGS_TABLE, aggregateBatchingTables, createEngineDatabase, createKvAdapter, encodeKvKey, migrateCoreSchema, toolingTargetOf } from "@hot-updater/plugin-core";
+import { SETTINGS_TABLE, aggregateBatchingTables, createEngineDatabase, createKvAdapter, encodeKvKey, migrateCoreSchema, resolveLazy, toolingTargetOf } from "@hot-updater/plugin-core";
 import { CloudFront, CloudFrontClient, CreateInvalidationCommand, GetInvalidationCommand } from "@aws-sdk/client-cloudfront";
 import { BatchGetCommand, BatchWriteCommand, DynamoDBDocumentClient, QueryCommand, TransactWriteCommand } from "@aws-sdk/lib-dynamodb";
 import { fromIni, fromNodeProviderChain, fromSSO } from "@aws-sdk/credential-providers";
@@ -6574,10 +6574,30 @@ async apply() {
 	};
 };
 //#endregion
+//#region src/lazyCredentials.ts
+/**
+* `credentials` as the AWS SDK takes them: access keys with a lazy field
+* become a provider, which the SDK calls once, on its first request.
+*/
+const toSdkCredentials = (credentials) => {
+	if (credentials === void 0 || typeof credentials === "function") return credentials;
+	const { accessKeyId, secretAccessKey, sessionToken, ...rest } = credentials;
+	if (typeof accessKeyId !== "function" && typeof secretAccessKey !== "function" && typeof sessionToken !== "function") return credentials;
+	return async () => ({
+		...rest,
+		accessKeyId: await resolveLazy(accessKeyId),
+		secretAccessKey: await resolveLazy(secretAccessKey),
+		...sessionToken === void 0 ? {} : { sessionToken: await resolveLazy(sessionToken) }
+	});
+};
+//#endregion
 //#region src/dynamoDB.ts
 /** The DynamoDB client ignores the CloudFront and batching settings. */
-const adapterOf = ({ tableName, ...clientConfig }) => {
-	const client = new DynamoDBClient(clientConfig);
+const adapterOf = ({ tableName, credentials, ...clientConfig }) => {
+	const client = new DynamoDBClient({
+		...clientConfig,
+		credentials: toSdkCredentials(credentials)
+	});
 	const store = createDynamoDBStore({
 		client,
 		tableName
@@ -6612,7 +6632,10 @@ const marked = (target) => ({ [DATABASE_TARGET]: target });
 */
 const dynamoDB = (config) => {
 	const { client, adapter } = adapterOf(config);
-	const cloudFront = createUpdateRouteInvalidation(config);
+	const cloudFront = createUpdateRouteInvalidation({
+		...config,
+		credentials: toSdkCredentials(config.credentials)
+	});
 	return {
 		...createEngineDatabase({
 			name: "dynamoDB",
@@ -8414,10 +8437,11 @@ var SSMKeyPairManager = class {
 //#region iac/templates.ts
 /**
 * The config init writes. With the `resources` init set up, it names them,
-* and an account's access keys are read with `secretEnv`, from the
+* and an account's access keys are read with `secret()`, from the
 * environment and `.env.hotupdater`, then the config's `secrets` adapter.
-* Without them, as the agent scaffold writes it, it reads every value from
-* the environment. A profile or SSO sign-in is each person's own.
+* Without them, as the agent scaffold writes it before the agent creates the
+* resources, it reads their names from the environment, where the agent
+* records them. A profile or SSO sign-in is each person's own.
 */
 const getConfigScaffold = (build, authMode, resources) => {
 	const value = (envKey, resolved) => resolved === void 0 ? `process.env.${envKey}!` : JSON.stringify(resolved);
@@ -8473,31 +8497,19 @@ const awsOptions = {
 };`.trim()
 			}];
 			break;
-		case "account":
-			helperStatements = [{
-				name: "awsOptions",
-				strategy: "merge-object",
-				replaceIncompatibleProperties: ["credentials"],
-				code: resources === void 0 ? `
+		case "account": helperStatements = [{
+			name: "awsOptions",
+			strategy: "merge-object",
+			replaceIncompatibleProperties: ["credentials"],
+			code: `
 const awsOptions = {
   region: ${region},
   credentials: {
-    accessKeyId: process.env.HOT_UPDATER_S3_ACCESS_KEY_ID!,
-    secretAccessKey: process.env.HOT_UPDATER_S3_SECRET_ACCESS_KEY!,
-  },
-};`.trim() : `
-const awsOptions = {
-  region: ${region},
-  credentials: async () => {
-    const env = await deploySecrets();
-    return {
-      accessKeyId: env.HOT_UPDATER_S3_ACCESS_KEY_ID,
-      secretAccessKey: env.HOT_UPDATER_S3_SECRET_ACCESS_KEY,
-    };
+    accessKeyId: secret("HOT_UPDATER_S3_ACCESS_KEY_ID"),
+    secretAccessKey: secret("HOT_UPDATER_S3_SECRET_ACCESS_KEY"),
   },
 };`.trim()
-			}];
-			if (resources !== void 0) helperStatements.unshift(secretEnvHelper("deploySecrets", ["HOT_UPDATER_S3_ACCESS_KEY_ID", "HOT_UPDATER_S3_SECRET_ACCESS_KEY"]));
+		}];
 	}
 	const builder = new ConfigBuilder().setBuildType(build).setStorage(storageConfig).setDatabase(databaseConfig).setPlugins({
 		imports: [{
@@ -8523,9 +8535,9 @@ const awsOptions = {
 				named: [authMode.profile ? "fromIni" : "fromNodeProviderChain"]
 			});
 			break;
-		case "account": if (resources !== void 0) builder.addImport({
+		case "account": builder.addImport({
 			pkg: "hot-updater",
-			named: ["secretEnv"]
+			named: ["secret"]
 		});
 	}
 	return createHotUpdaterConfigScaffoldFromBuilder(builder, { helperStatements });