@hot-updater/aws 1.2.0-rc.8 → 1.2.0-rc.9

package/dist/index.cjs

@@ -5,8 +5,7 @@ let _aws_sdk_client_cloudfront = require("@aws-sdk/client-cloudfront");
 let _aws_sdk_lib_dynamodb = require("@aws-sdk/lib-dynamodb");
 let _aws_sdk_client_ssm = require("@aws-sdk/client-ssm");
 let _aws_sdk_cloudfront_signer = require("@aws-sdk/cloudfront-signer");
-let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
-let _aws_sdk_lib_storage = require("@aws-sdk/lib-storage");
+let _hot_updater_storage_s3 = require("@hot-updater/storage-s3");
 let node_crypto = require("node:crypto");
 //#region src/cloudFrontInvalidation.ts
 const DEFAULT_POLL_INTERVAL_MS = 2e3;
@@ -519,156 +518,17 @@ const cloudFrontDownloadUrl = (config) => {
 };
 //#endregion
 //#region src/s3Storage.ts
-/** Devices download right after the update check that returns the URL. */
-const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
-const isObjectNotFoundError = (error) => error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchKey");
 function s3Storage(config) {
 	const { bucketName, basePath, getDownloadUrl, credentials, ...s3Config } = config;
-	const client = new _aws_sdk_client_s3.S3Client(applyS3RuntimeAwsConfig({
-		...s3Config,
-		credentials: toSdkCredentials(credentials)
-	}));
-	const normalizedBasePath = basePath?.replace(/^\/+|\/+$/g, "") ?? "";
-	const getStorageKey = (0, _hot_updater_plugin_core.createStorageKeyBuilder)(normalizedBasePath);
-	const getListPrefix = (prefix = "") => {
-		const normalizedPrefix = prefix.replace(/^\/+|\/+$/g, "");
-		const value = [normalizedBasePath, normalizedPrefix].filter(Boolean).join("/");
-		return value ? `${value}/` : "";
-	};
-	/**
-	* The URI `put` returns for the key, or null for a key no `put` writes,
-	* such as a folder marker that ends in "/".
-	*/
-	const getListedStorageUri = (key) => {
-		try {
-			return (0, _hot_updater_plugin_core.createStorageUri)({
-				bucket: bucketName,
-				key,
-				protocol: "s3"
-			});
-		} catch {
-			return null;
-		}
-	};
-	const getRelativeKey = (key) => {
-		if (!normalizedBasePath) return key;
-		const basePrefix = `${normalizedBasePath}/`;
-		return key.startsWith(basePrefix) ? key.slice(basePrefix.length) : key;
-	};
-	const parseAndValidate = (storageUri) => {
-		const parsed = (0, _hot_updater_plugin_core.parseStorageUri)(storageUri, "s3");
-		if (parsed.bucket !== bucketName) throw new Error(`Bucket name mismatch: expected "${bucketName}", but found "${parsed.bucket}".`);
-		return parsed;
-	};
-	return (0, _hot_updater_plugin_core.createStorageAdapter)({
+	return (0, _hot_updater_storage_s3.createS3Storage)({
 		name: "s3Storage",
-		protocol: "s3",
-		async listObjects(prefix) {
-			const objects = [];
-			let continuationToken;
-			do {
-				const response = await client.send(new _aws_sdk_client_s3.ListObjectsV2Command({
-					Bucket: bucketName,
-					ContinuationToken: continuationToken,
-					Prefix: getListPrefix(prefix)
-				}));
-				for (const object of response.Contents ?? []) {
-					if (!object.Key) continue;
-					const storageUri = getListedStorageUri(object.Key);
-					if (storageUri === null) continue;
-					objects.push({
-						key: getRelativeKey(object.Key),
-						lastModifiedAt: object.LastModified,
-						size: object.Size ?? 0,
-						storageUri
-					});
-				}
-				continuationToken = response.NextContinuationToken;
-			} while (continuationToken);
-			return objects;
-		},
-		async deleteObjects(relativeKeys) {
-			const keys = relativeKeys.map((key) => getStorageKey(key));
-			for (let offset = 0; offset < keys.length; offset += 1e3) {
-				const batch = keys.slice(offset, offset + 1e3);
-				if (batch.length === 0) continue;
-				const response = await client.send(new _aws_sdk_client_s3.DeleteObjectsCommand({
-					Bucket: bucketName,
-					Delete: {
-						Objects: batch.map((Key) => ({ Key })),
-						Quiet: true
-					}
-				}));
-				if (response.Errors && response.Errors.length > 0) throw new Error(`Failed to delete ${response.Errors.length} S3 object(s).`);
-			}
-		},
-		async put({ key, body, contentLength, contentType }) {
-			const storageKey = getStorageKey(key);
-			const response = await new _aws_sdk_lib_storage.Upload({
-				client,
-				params: {
-					Body: body,
-					Bucket: bucketName,
-					CacheControl: "max-age=31536000",
-					...contentLength === void 0 ? {} : { ContentLength: contentLength },
-					ContentType: contentType,
-					Key: storageKey
-				}
-			}).done();
-			if (!response.Bucket || !response.Key) throw new Error("Upload failed");
-			return { storageUri: (0, _hot_updater_plugin_core.createStorageUri)({
-				bucket: bucketName,
-				key: storageKey,
-				protocol: "s3"
-			}) };
-		},
-		async get({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			try {
-				const response = await client.send(new _aws_sdk_client_s3.GetObjectCommand({
-					Bucket: bucketName,
-					Key: key
-				}));
-				if (!response.Body) return { response: null };
-				const headers = new Headers();
-				if (response.ContentType) headers.set("content-type", response.ContentType);
-				if (response.ContentLength !== void 0) headers.set("content-length", String(response.ContentLength));
-				return { response: new Response(response.Body.transformToWebStream(), { headers }) };
-			} catch (error) {
-				if (isObjectNotFoundError(error)) return { response: null };
-				throw error;
-			}
-		},
-		async getDownloadUrl({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			if (getDownloadUrl) return getDownloadUrl({ storageUri });
-			const { getSignedUrl } = await import("@aws-sdk/s3-request-presigner");
-			return { url: await getSignedUrl(client, new _aws_sdk_client_s3.GetObjectCommand({
-				Bucket: bucketName,
-				Key: key
-			}), { expiresIn: PRESIGNED_URL_EXPIRES_IN_SECONDS }) };
-		},
-		async exists({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			try {
-				await client.send(new _aws_sdk_client_s3.HeadObjectCommand({
-					Bucket: bucketName,
-					Key: key
-				}));
-				return { exists: true };
-			} catch (error) {
-				if (isObjectNotFoundError(error)) return { exists: false };
-				throw error;
-			}
-		},
-		async delete({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			await client.send(new _aws_sdk_client_s3.DeleteObjectCommand({
-				Bucket: bucketName,
-				Key: key
-			}));
-			return { deleted: true };
-		}
+		protocol: "s3"
+	}, {
+		...applyS3RuntimeAwsConfig(s3Config),
+		credentials,
+		bucketName,
+		basePath,
+		getDownloadUrl
 	});
 }
 //#endregion
@@ -693,7 +553,22 @@ const EXPIRED_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set([
 ]);
 /** Errors of the SDK finding no credentials, or an expired SSO session. */
 const NO_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set(["CredentialsProviderError", "TokenProviderError"]);
-const SIGN_IN_HINT = "In CI, set them with aws-actions/configure-aws-credentials; on your machine, run aws sso login --profile <profile> and set AWS_PROFILE=<profile>";
+const SIGN_IN_HINT = ["In CI, set them with aws-actions/configure-aws-credentials.", "On your machine: aws sso login --profile <profile>, then set AWS_PROFILE."];
+/** The widest line a message has: the CLI prints no wider. */
+const LINE_WIDTH = 76;
+/** `text`, such as AWS's own message, in lines that fit, broken at spaces. */
+const wrap = (text) => {
+	const lines = [];
+	let line = "";
+	for (const word of text.split(/\s+/u).filter(Boolean)) if (line && line.length + 1 + word.length > LINE_WIDTH) {
+		lines.push(line);
+		line = word;
+	} else line = line ? `${line} ${word}` : word;
+	if (line) lines.push(line);
+	return lines;
+};
+/** An error of one line each, for a terminal. */
+const failure = (lines, cause) => new Error(lines.join("\n"), cause === void 0 ? void 0 : { cause });
 const errorName = (error) => error instanceof Error ? error.name : "";
 const errorMessage = (error) => (error instanceof Error ? error.message : String(error)).replace(/\.+$/u, "");
 const resolveEndpoint = (endpoint) => {
@@ -708,7 +583,11 @@ const resolveEndpoint = (endpoint) => {
 		"127.0.0.1",
 		"[::1]"
 	])).has(url.hostname);
-	if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.search || url.hash) throw new Error(`${NAME} endpoint must use HTTPS, or HTTP on a loopback address, without credentials, a query, or a fragment.`);
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.search || url.hash) throw failure([
+		`${NAME} can't use its endpoint.`,
+		"Use HTTPS, or HTTP on a loopback address.",
+		"Leave out credentials, a query, and a fragment."
+	]);
 	return url.toString();
 };
 /** Masks a value in the CLI's output, which loads `@hot-updater/cli-tools`. */
@@ -735,20 +614,20 @@ const checkCredentials = async (credentials) => {
 */
 const secretsManager = ({ credentials, endpoint, prefix = "hot-updater/", region }) => {
 	const checkSettings = () => {
-		if (typeof region !== "string" || !REGION_PATTERN.test(region)) throw new Error(`${NAME} needs an AWS region, such as "us-east-1", and ${JSON.stringify(region)} is not one.`);
+		if (typeof region !== "string" || !REGION_PATTERN.test(region)) throw failure([`${NAME} can't use the region ${JSON.stringify(region)}.`, "Set an AWS region, such as \"us-east-1\"."]);
 		if (prefix !== "" && !SECRET_ID_PATTERN.test(prefix)) throw new Error(`${NAME}'s prefix takes letters, digits, and /_+=.@- only.`);
 	};
 	const secretId = (name) => {
 		checkSettings();
 		const id = `${prefix}${name}`;
-		if (!SECRET_ID_PATTERN.test(name) || id.length > MAX_SECRET_ID_LENGTH) throw new Error(`${NAME} cannot name a secret ${JSON.stringify(id)}: AWS takes up to ${MAX_SECRET_ID_LENGTH} letters, digits, and /_+=.@- characters.`);
+		if (!SECRET_ID_PATTERN.test(name) || id.length > MAX_SECRET_ID_LENGTH) throw failure([`${NAME} can't name a secret ${JSON.stringify(id)}.`, `AWS takes up to ${MAX_SECRET_ID_LENGTH} letters, digits, and /_+=.@- characters.`]);
 		return id;
 	};
 	const resolveCredentials = () => {
 		if (credentials !== void 0) return async () => checkCredentials(typeof credentials === "function" ? await credentials() : credentials);
 		const accessKeyId = process.env["AWS_ACCESS_KEY_ID"];
 		const secretAccessKey = process.env["AWS_SECRET_ACCESS_KEY"];
-		if (Boolean(accessKeyId) !== Boolean(secretAccessKey)) throw new Error(`${NAME} found ${accessKeyId ? "AWS_ACCESS_KEY_ID" : "AWS_SECRET_ACCESS_KEY"} without ${accessKeyId ? "AWS_SECRET_ACCESS_KEY" : "AWS_ACCESS_KEY_ID"} in the environment: set both, or neither to use a profile.`);
+		if (Boolean(accessKeyId) !== Boolean(secretAccessKey)) throw failure([`${NAME} found ${accessKeyId ? "AWS_ACCESS_KEY_ID" : "AWS_SECRET_ACCESS_KEY"} without ${accessKeyId ? "AWS_SECRET_ACCESS_KEY" : "AWS_ACCESS_KEY_ID"}.`, "Set both, or neither to use a profile."]);
 	};
 	let opened;
 	const open = () => {
@@ -771,12 +650,40 @@ const secretsManager = ({ credentials, endpoint, prefix = "hot-updater/", region
 	const describeFailure = (verb, id, error, permissions) => {
 		const name = errorName(error);
 		const status = error?.$metadata?.httpStatusCode;
-		const detail = `${name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}`;
-		if (NO_CREDENTIAL_ERRORS.has(name)) return new Error(`${NAME} found no usable AWS credentials to ${verb} ${JSON.stringify(id)} (${errorMessage(error)}). ${SIGN_IN_HINT}.`, { cause: error });
-		if (EXPIRED_CREDENTIAL_ERRORS.has(name)) return new Error(`AWS Secrets Manager refused the credentials to ${verb} ${JSON.stringify(id)}, ${detail}. They are expired or invalid: sign in again. ${SIGN_IN_HINT}.`, { cause: error });
-		if (name === "AccessDeniedException") return new Error(`AWS Secrets Manager refused to ${verb} ${JSON.stringify(id)}, ${detail}. The AWS identity needs ${permissions} on it, and on a secret encrypted with a customer managed KMS key, kms:Decrypt to read and kms:GenerateDataKey to store.`, { cause: error });
-		if (/marked for deletion|scheduled for deletion/iu.test(errorMessage(error))) return new Error(`AWS Secrets Manager cannot ${verb} ${JSON.stringify(id)}: it is scheduled for deletion. Restore it with aws secretsmanager restore-secret --secret-id ${id}, or wait until it is deleted.`, { cause: error });
-		return new Error(`AWS Secrets Manager failed to ${verb} ${JSON.stringify(id)}, ${detail}.`, { cause: error });
+		const detail = wrap(`${name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}.`);
+		const secret = `Secret: ${id}`;
+		if (NO_CREDENTIAL_ERRORS.has(name)) return failure([
+			`${NAME} found no AWS credentials to ${verb} a secret.`,
+			secret,
+			...wrap(`${errorMessage(error)}.`),
+			...SIGN_IN_HINT
+		], error);
+		if (EXPIRED_CREDENTIAL_ERRORS.has(name)) return failure([
+			`AWS Secrets Manager refused the sign-in to ${verb} a secret.`,
+			secret,
+			...detail,
+			"They are expired or invalid: sign in again.",
+			...SIGN_IN_HINT
+		], error);
+		if (name === "AccessDeniedException") return failure([
+			`AWS Secrets Manager refused to ${verb} a secret.`,
+			secret,
+			...detail,
+			`The AWS identity needs ${permissions} on it.`,
+			`With a customer managed KMS key, it needs ${verb === "read" ? "kms:Decrypt" : "kms:GenerateDataKey"} too.`
+		], error);
+		if (/marked for deletion|scheduled for deletion/iu.test(errorMessage(error))) return failure([
+			`AWS Secrets Manager can't ${verb} a secret.`,
+			secret,
+			"It is scheduled for deletion. Restore it, or wait until it is gone:",
+			"aws secretsmanager restore-secret \\",
+			`  --secret-id ${id}`
+		], error);
+		return failure([
+			`AWS Secrets Manager failed to ${verb} a secret.`,
+			secret,
+			...detail
+		], error);
 	};
 	const read = async ({ sdk, client }, id) => {
 		let output;
@@ -806,8 +713,8 @@ const secretsManager = ({ credentials, endpoint, prefix = "hot-updater/", region
 		},
 		set: async (name, value) => {
 			const id = secretId(name);
-			if (typeof value !== "string" || value === "") throw new Error(`${NAME} cannot store an empty ${id}.`);
-			if (Buffer.byteLength(value, "utf8") > MAX_SECRET_BYTES) throw new Error(`${NAME} cannot store ${id}: AWS takes up to ${MAX_SECRET_BYTES} bytes per secret.`);
+			if (typeof value !== "string" || value === "") throw new Error(`${NAME} can't store an empty ${id}.`);
+			if (Buffer.byteLength(value, "utf8") > MAX_SECRET_BYTES) throw failure([`${NAME} can't store ${id}.`, `AWS takes up to ${MAX_SECRET_BYTES} bytes per secret.`]);
 			await mask([value]);
 			const { sdk, client } = await open();
 			const token = (0, node_crypto.randomUUID)();

package/dist/index.d.cts

@@ -1,6 +1,7 @@
 import { DynamoDBClientConfig } from "@aws-sdk/client-dynamodb";
 import { EngineDatabase, Lazy, PluginTables, SecretsAdapter, StorageAdapter, StorageAdapterWith } from "@hot-updater/plugin-core";
 import { S3ClientConfig } from "@aws-sdk/client-s3";
+import { S3StorageOperations } from "@hot-updater/storage-s3";
 //#region src/lazyCredentials.d.ts
 type SdkCredentials = S3ClientConfig["credentials"];
 /**
@@ -88,7 +89,6 @@ interface S3StorageConfig extends Omit<S3ClientConfig, "credentials"> {
    */
   getDownloadUrl?: StorageAdapter["getDownloadUrl"];
 }
-type S3StorageOperations = "put" | "get" | "getDownloadUrl" | "exists" | "delete" | "listObjects" | "deleteObjects";
 declare function s3Storage(config: S3StorageConfig): StorageAdapterWith<S3StorageOperations>;
 //#endregion
 //#region src/secretsManager.d.ts

package/dist/index.d.mts

@@ -1,5 +1,6 @@
 import { DynamoDBClientConfig } from "@aws-sdk/client-dynamodb";
 import { EngineDatabase, Lazy, PluginTables, SecretsAdapter, StorageAdapter, StorageAdapterWith } from "@hot-updater/plugin-core";
+import { S3StorageOperations } from "@hot-updater/storage-s3";
 import { S3ClientConfig } from "@aws-sdk/client-s3";
 //#region src/lazyCredentials.d.ts
 type SdkCredentials = S3ClientConfig["credentials"];
@@ -88,7 +89,6 @@ interface S3StorageConfig extends Omit<S3ClientConfig, "credentials"> {
    */
   getDownloadUrl?: StorageAdapter["getDownloadUrl"];
 }
-type S3StorageOperations = "put" | "get" | "getDownloadUrl" | "exists" | "delete" | "listObjects" | "deleteObjects";
 declare function s3Storage(config: S3StorageConfig): StorageAdapterWith<S3StorageOperations>;
 //#endregion
 //#region src/secretsManager.d.ts

package/dist/index.mjs

@@ -1,11 +1,10 @@
 import { CreateTableCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DynamoDBClient, UpdateTimeToLiveCommand, waitUntilTableExists } from "@aws-sdk/client-dynamodb";
-import { BUNDLE_STORAGE_PREFIX, CONTENT_ADDRESSED_ASSET_PREFIX, createEngineDatabase, createKvAdapter, createStorageAdapter, createStorageKeyBuilder, createStorageUri, migrateCoreSchema, parseStorageUri, resolveLazy } from "@hot-updater/plugin-core";
+import { BUNDLE_STORAGE_PREFIX, CONTENT_ADDRESSED_ASSET_PREFIX, createEngineDatabase, createKvAdapter, migrateCoreSchema, resolveLazy } from "@hot-updater/plugin-core";
 import { CloudFrontClient, CreateInvalidationCommand, GetInvalidationCommand } from "@aws-sdk/client-cloudfront";
 import { BatchGetCommand, BatchWriteCommand, DynamoDBDocumentClient, QueryCommand, TransactWriteCommand } from "@aws-sdk/lib-dynamodb";
 import { SSM } from "@aws-sdk/client-ssm";
 import { getSignedUrl } from "@aws-sdk/cloudfront-signer";
-import { DeleteObjectCommand, DeleteObjectsCommand, GetObjectCommand, HeadObjectCommand, ListObjectsV2Command, S3Client } from "@aws-sdk/client-s3";
-import { Upload } from "@aws-sdk/lib-storage";
+import { createS3Storage } from "@hot-updater/storage-s3";
 import { randomUUID } from "node:crypto";
 //#region src/cloudFrontInvalidation.ts
 const DEFAULT_POLL_INTERVAL_MS = 2e3;
@@ -518,156 +517,17 @@ const cloudFrontDownloadUrl = (config) => {
 };
 //#endregion
 //#region src/s3Storage.ts
-/** Devices download right after the update check that returns the URL. */
-const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
-const isObjectNotFoundError = (error) => error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchKey");
 function s3Storage(config) {
 	const { bucketName, basePath, getDownloadUrl, credentials, ...s3Config } = config;
-	const client = new S3Client(applyS3RuntimeAwsConfig({
-		...s3Config,
-		credentials: toSdkCredentials(credentials)
-	}));
-	const normalizedBasePath = basePath?.replace(/^\/+|\/+$/g, "") ?? "";
-	const getStorageKey = createStorageKeyBuilder(normalizedBasePath);
-	const getListPrefix = (prefix = "") => {
-		const normalizedPrefix = prefix.replace(/^\/+|\/+$/g, "");
-		const value = [normalizedBasePath, normalizedPrefix].filter(Boolean).join("/");
-		return value ? `${value}/` : "";
-	};
-	/**
-	* The URI `put` returns for the key, or null for a key no `put` writes,
-	* such as a folder marker that ends in "/".
-	*/
-	const getListedStorageUri = (key) => {
-		try {
-			return createStorageUri({
-				bucket: bucketName,
-				key,
-				protocol: "s3"
-			});
-		} catch {
-			return null;
-		}
-	};
-	const getRelativeKey = (key) => {
-		if (!normalizedBasePath) return key;
-		const basePrefix = `${normalizedBasePath}/`;
-		return key.startsWith(basePrefix) ? key.slice(basePrefix.length) : key;
-	};
-	const parseAndValidate = (storageUri) => {
-		const parsed = parseStorageUri(storageUri, "s3");
-		if (parsed.bucket !== bucketName) throw new Error(`Bucket name mismatch: expected "${bucketName}", but found "${parsed.bucket}".`);
-		return parsed;
-	};
-	return createStorageAdapter({
+	return createS3Storage({
 		name: "s3Storage",
-		protocol: "s3",
-		async listObjects(prefix) {
-			const objects = [];
-			let continuationToken;
-			do {
-				const response = await client.send(new ListObjectsV2Command({
-					Bucket: bucketName,
-					ContinuationToken: continuationToken,
-					Prefix: getListPrefix(prefix)
-				}));
-				for (const object of response.Contents ?? []) {
-					if (!object.Key) continue;
-					const storageUri = getListedStorageUri(object.Key);
-					if (storageUri === null) continue;
-					objects.push({
-						key: getRelativeKey(object.Key),
-						lastModifiedAt: object.LastModified,
-						size: object.Size ?? 0,
-						storageUri
-					});
-				}
-				continuationToken = response.NextContinuationToken;
-			} while (continuationToken);
-			return objects;
-		},
-		async deleteObjects(relativeKeys) {
-			const keys = relativeKeys.map((key) => getStorageKey(key));
-			for (let offset = 0; offset < keys.length; offset += 1e3) {
-				const batch = keys.slice(offset, offset + 1e3);
-				if (batch.length === 0) continue;
-				const response = await client.send(new DeleteObjectsCommand({
-					Bucket: bucketName,
-					Delete: {
-						Objects: batch.map((Key) => ({ Key })),
-						Quiet: true
-					}
-				}));
-				if (response.Errors && response.Errors.length > 0) throw new Error(`Failed to delete ${response.Errors.length} S3 object(s).`);
-			}
-		},
-		async put({ key, body, contentLength, contentType }) {
-			const storageKey = getStorageKey(key);
-			const response = await new Upload({
-				client,
-				params: {
-					Body: body,
-					Bucket: bucketName,
-					CacheControl: "max-age=31536000",
-					...contentLength === void 0 ? {} : { ContentLength: contentLength },
-					ContentType: contentType,
-					Key: storageKey
-				}
-			}).done();
-			if (!response.Bucket || !response.Key) throw new Error("Upload failed");
-			return { storageUri: createStorageUri({
-				bucket: bucketName,
-				key: storageKey,
-				protocol: "s3"
-			}) };
-		},
-		async get({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			try {
-				const response = await client.send(new GetObjectCommand({
-					Bucket: bucketName,
-					Key: key
-				}));
-				if (!response.Body) return { response: null };
-				const headers = new Headers();
-				if (response.ContentType) headers.set("content-type", response.ContentType);
-				if (response.ContentLength !== void 0) headers.set("content-length", String(response.ContentLength));
-				return { response: new Response(response.Body.transformToWebStream(), { headers }) };
-			} catch (error) {
-				if (isObjectNotFoundError(error)) return { response: null };
-				throw error;
-			}
-		},
-		async getDownloadUrl({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			if (getDownloadUrl) return getDownloadUrl({ storageUri });
-			const { getSignedUrl } = await import("@aws-sdk/s3-request-presigner");
-			return { url: await getSignedUrl(client, new GetObjectCommand({
-				Bucket: bucketName,
-				Key: key
-			}), { expiresIn: PRESIGNED_URL_EXPIRES_IN_SECONDS }) };
-		},
-		async exists({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			try {
-				await client.send(new HeadObjectCommand({
-					Bucket: bucketName,
-					Key: key
-				}));
-				return { exists: true };
-			} catch (error) {
-				if (isObjectNotFoundError(error)) return { exists: false };
-				throw error;
-			}
-		},
-		async delete({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			await client.send(new DeleteObjectCommand({
-				Bucket: bucketName,
-				Key: key
-			}));
-			return { deleted: true };
-		}
+		protocol: "s3"
+	}, {
+		...applyS3RuntimeAwsConfig(s3Config),
+		credentials,
+		bucketName,
+		basePath,
+		getDownloadUrl
 	});
 }
 //#endregion
@@ -692,7 +552,22 @@ const EXPIRED_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set([
 ]);
 /** Errors of the SDK finding no credentials, or an expired SSO session. */
 const NO_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set(["CredentialsProviderError", "TokenProviderError"]);
-const SIGN_IN_HINT = "In CI, set them with aws-actions/configure-aws-credentials; on your machine, run aws sso login --profile <profile> and set AWS_PROFILE=<profile>";
+const SIGN_IN_HINT = ["In CI, set them with aws-actions/configure-aws-credentials.", "On your machine: aws sso login --profile <profile>, then set AWS_PROFILE."];
+/** The widest line a message has: the CLI prints no wider. */
+const LINE_WIDTH = 76;
+/** `text`, such as AWS's own message, in lines that fit, broken at spaces. */
+const wrap = (text) => {
+	const lines = [];
+	let line = "";
+	for (const word of text.split(/\s+/u).filter(Boolean)) if (line && line.length + 1 + word.length > LINE_WIDTH) {
+		lines.push(line);
+		line = word;
+	} else line = line ? `${line} ${word}` : word;
+	if (line) lines.push(line);
+	return lines;
+};
+/** An error of one line each, for a terminal. */
+const failure = (lines, cause) => new Error(lines.join("\n"), cause === void 0 ? void 0 : { cause });
 const errorName = (error) => error instanceof Error ? error.name : "";
 const errorMessage = (error) => (error instanceof Error ? error.message : String(error)).replace(/\.+$/u, "");
 const resolveEndpoint = (endpoint) => {
@@ -707,7 +582,11 @@ const resolveEndpoint = (endpoint) => {
 		"127.0.0.1",
 		"[::1]"
 	])).has(url.hostname);
-	if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.search || url.hash) throw new Error(`${NAME} endpoint must use HTTPS, or HTTP on a loopback address, without credentials, a query, or a fragment.`);
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.search || url.hash) throw failure([
+		`${NAME} can't use its endpoint.`,
+		"Use HTTPS, or HTTP on a loopback address.",
+		"Leave out credentials, a query, and a fragment."
+	]);
 	return url.toString();
 };
 /** Masks a value in the CLI's output, which loads `@hot-updater/cli-tools`. */
@@ -734,20 +613,20 @@ const checkCredentials = async (credentials) => {
 */
 const secretsManager = ({ credentials, endpoint, prefix = "hot-updater/", region }) => {
 	const checkSettings = () => {
-		if (typeof region !== "string" || !REGION_PATTERN.test(region)) throw new Error(`${NAME} needs an AWS region, such as "us-east-1", and ${JSON.stringify(region)} is not one.`);
+		if (typeof region !== "string" || !REGION_PATTERN.test(region)) throw failure([`${NAME} can't use the region ${JSON.stringify(region)}.`, "Set an AWS region, such as \"us-east-1\"."]);
 		if (prefix !== "" && !SECRET_ID_PATTERN.test(prefix)) throw new Error(`${NAME}'s prefix takes letters, digits, and /_+=.@- only.`);
 	};
 	const secretId = (name) => {
 		checkSettings();
 		const id = `${prefix}${name}`;
-		if (!SECRET_ID_PATTERN.test(name) || id.length > MAX_SECRET_ID_LENGTH) throw new Error(`${NAME} cannot name a secret ${JSON.stringify(id)}: AWS takes up to ${MAX_SECRET_ID_LENGTH} letters, digits, and /_+=.@- characters.`);
+		if (!SECRET_ID_PATTERN.test(name) || id.length > MAX_SECRET_ID_LENGTH) throw failure([`${NAME} can't name a secret ${JSON.stringify(id)}.`, `AWS takes up to ${MAX_SECRET_ID_LENGTH} letters, digits, and /_+=.@- characters.`]);
 		return id;
 	};
 	const resolveCredentials = () => {
 		if (credentials !== void 0) return async () => checkCredentials(typeof credentials === "function" ? await credentials() : credentials);
 		const accessKeyId = process.env["AWS_ACCESS_KEY_ID"];
 		const secretAccessKey = process.env["AWS_SECRET_ACCESS_KEY"];
-		if (Boolean(accessKeyId) !== Boolean(secretAccessKey)) throw new Error(`${NAME} found ${accessKeyId ? "AWS_ACCESS_KEY_ID" : "AWS_SECRET_ACCESS_KEY"} without ${accessKeyId ? "AWS_SECRET_ACCESS_KEY" : "AWS_ACCESS_KEY_ID"} in the environment: set both, or neither to use a profile.`);
+		if (Boolean(accessKeyId) !== Boolean(secretAccessKey)) throw failure([`${NAME} found ${accessKeyId ? "AWS_ACCESS_KEY_ID" : "AWS_SECRET_ACCESS_KEY"} without ${accessKeyId ? "AWS_SECRET_ACCESS_KEY" : "AWS_ACCESS_KEY_ID"}.`, "Set both, or neither to use a profile."]);
 	};
 	let opened;
 	const open = () => {
@@ -770,12 +649,40 @@ const secretsManager = ({ credentials, endpoint, prefix = "hot-updater/", region
 	const describeFailure = (verb, id, error, permissions) => {
 		const name = errorName(error);
 		const status = error?.$metadata?.httpStatusCode;
-		const detail = `${name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}`;
-		if (NO_CREDENTIAL_ERRORS.has(name)) return new Error(`${NAME} found no usable AWS credentials to ${verb} ${JSON.stringify(id)} (${errorMessage(error)}). ${SIGN_IN_HINT}.`, { cause: error });
-		if (EXPIRED_CREDENTIAL_ERRORS.has(name)) return new Error(`AWS Secrets Manager refused the credentials to ${verb} ${JSON.stringify(id)}, ${detail}. They are expired or invalid: sign in again. ${SIGN_IN_HINT}.`, { cause: error });
-		if (name === "AccessDeniedException") return new Error(`AWS Secrets Manager refused to ${verb} ${JSON.stringify(id)}, ${detail}. The AWS identity needs ${permissions} on it, and on a secret encrypted with a customer managed KMS key, kms:Decrypt to read and kms:GenerateDataKey to store.`, { cause: error });
-		if (/marked for deletion|scheduled for deletion/iu.test(errorMessage(error))) return new Error(`AWS Secrets Manager cannot ${verb} ${JSON.stringify(id)}: it is scheduled for deletion. Restore it with aws secretsmanager restore-secret --secret-id ${id}, or wait until it is deleted.`, { cause: error });
-		return new Error(`AWS Secrets Manager failed to ${verb} ${JSON.stringify(id)}, ${detail}.`, { cause: error });
+		const detail = wrap(`${name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}.`);
+		const secret = `Secret: ${id}`;
+		if (NO_CREDENTIAL_ERRORS.has(name)) return failure([
+			`${NAME} found no AWS credentials to ${verb} a secret.`,
+			secret,
+			...wrap(`${errorMessage(error)}.`),
+			...SIGN_IN_HINT
+		], error);
+		if (EXPIRED_CREDENTIAL_ERRORS.has(name)) return failure([
+			`AWS Secrets Manager refused the sign-in to ${verb} a secret.`,
+			secret,
+			...detail,
+			"They are expired or invalid: sign in again.",
+			...SIGN_IN_HINT
+		], error);
+		if (name === "AccessDeniedException") return failure([
+			`AWS Secrets Manager refused to ${verb} a secret.`,
+			secret,
+			...detail,
+			`The AWS identity needs ${permissions} on it.`,
+			`With a customer managed KMS key, it needs ${verb === "read" ? "kms:Decrypt" : "kms:GenerateDataKey"} too.`
+		], error);
+		if (/marked for deletion|scheduled for deletion/iu.test(errorMessage(error))) return failure([
+			`AWS Secrets Manager can't ${verb} a secret.`,
+			secret,
+			"It is scheduled for deletion. Restore it, or wait until it is gone:",
+			"aws secretsmanager restore-secret \\",
+			`  --secret-id ${id}`
+		], error);
+		return failure([
+			`AWS Secrets Manager failed to ${verb} a secret.`,
+			secret,
+			...detail
+		], error);
 	};
 	const read = async ({ sdk, client }, id) => {
 		let output;
@@ -805,8 +712,8 @@ const secretsManager = ({ credentials, endpoint, prefix = "hot-updater/", region
 		},
 		set: async (name, value) => {
 			const id = secretId(name);
-			if (typeof value !== "string" || value === "") throw new Error(`${NAME} cannot store an empty ${id}.`);
-			if (Buffer.byteLength(value, "utf8") > MAX_SECRET_BYTES) throw new Error(`${NAME} cannot store ${id}: AWS takes up to ${MAX_SECRET_BYTES} bytes per secret.`);
+			if (typeof value !== "string" || value === "") throw new Error(`${NAME} can't store an empty ${id}.`);
+			if (Buffer.byteLength(value, "utf8") > MAX_SECRET_BYTES) throw failure([`${NAME} can't store ${id}.`, `AWS takes up to ${MAX_SECRET_BYTES} bytes per secret.`]);
 			await mask([value]);
 			const { sdk, client } = await open();
 			const token = randomUUID();

package/dist/lambda/index.cjs

@@ -30,6 +30,7 @@ let _aws_sdk_client_cloudfront = require("@aws-sdk/client-cloudfront");
 let _aws_sdk_lib_dynamodb = require("@aws-sdk/lib-dynamodb");
 let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
 let _aws_sdk_lib_storage = require("@aws-sdk/lib-storage");
+let _aws_sdk_s3_request_presigner = require("@aws-sdk/s3-request-presigner");
 const SHA256_FILE_HASH_RE = /^[0-9a-f]{64}$/;
 const isContentAddressedAssetFileHash = (value) => {
 	return typeof value === "string" && SHA256_FILE_HASH_RE.test(value);
@@ -4711,7 +4712,7 @@ const createKvAdapter = ({ store, tablePrefix = "" }) => {
 };
 //#endregion
 //#region ../../packages/server/dist/version.mjs
-const HOT_UPDATER_SERVER_VERSION = "1.2.0-rc.8";
+const HOT_UPDATER_SERVER_VERSION = "1.2.0-rc.9";
 //#endregion
 //#region ../../packages/server/dist/handlerVersionRoutes.mjs
 /**
@@ -14304,7 +14305,7 @@ async apply() {
 * `credentials` as the AWS SDK takes them: access keys with a lazy field
 * become a provider, which the SDK calls once, on its first request.
 */
-const toSdkCredentials = (credentials) => {
+const toSdkCredentials$1 = (credentials) => {
 	if (credentials === void 0 || typeof credentials === "function") return credentials;
 	const { accessKeyId, secretAccessKey, sessionToken, ...rest } = credentials;
 	if (typeof accessKeyId !== "function" && typeof secretAccessKey !== "function" && typeof sessionToken !== "function") return credentials;
@@ -14321,7 +14322,7 @@ const toSdkCredentials = (credentials) => {
 const adapterOf = ({ tableName, credentials, ...clientConfig }) => {
 	const client = new _aws_sdk_client_dynamodb.DynamoDBClient({
 		...clientConfig,
-		credentials: toSdkCredentials(credentials)
+		credentials: toSdkCredentials$1(credentials)
 	});
 	const store = createDynamoDBStore({
 		client,
@@ -14349,7 +14350,7 @@ const dynamoDB = (config) => {
 	const { client, adapter } = adapterOf(config);
 	const cloudFront = createUpdateRouteInvalidation({
 		...config,
-		credentials: toSdkCredentials(config.credentials)
+		credentials: toSdkCredentials$1(config.credentials)
 	});
 	return {
 		...createEngineDatabase({
@@ -14367,21 +14368,49 @@ const dynamoDB = (config) => {
 	};
 };
 //#endregion
-//#region src/s3Storage.ts
+//#region ../storage-s3/dist/index.mjs
+/**
+* `credentials` as the AWS SDK takes them: access keys with a lazy field
+* become a provider, which the SDK calls once, on its first request.
+*/
+const toSdkCredentials = (credentials) => {
+	if (credentials === void 0 || typeof credentials === "function") return credentials;
+	const { accessKeyId, secretAccessKey, sessionToken, ...rest } = credentials;
+	if (typeof accessKeyId !== "function" && typeof secretAccessKey !== "function" && typeof sessionToken !== "function") return credentials;
+	return async () => ({
+		...rest,
+		accessKeyId: await resolveLazy(accessKeyId),
+		secretAccessKey: await resolveLazy(secretAccessKey),
+		...sessionToken === void 0 ? {} : { sessionToken: await resolveLazy(sessionToken) }
+	});
+};
 /** Devices download right after the update check that returns the URL. */
-const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
-const isObjectNotFoundError = (error) => error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchKey");
-function s3Storage(config) {
-	const { bucketName, basePath, getDownloadUrl, credentials, ...s3Config } = config;
-	const client = new _aws_sdk_client_s3.S3Client(applyS3RuntimeAwsConfig({
-		...s3Config,
+const DEFAULT_SIGNED_LIFETIME_SECONDS = 3600;
+/** SigV4's limit on a presigned URL. */
+const MAX_SIGNED_LIFETIME_SECONDS = 604800;
+/** DeleteObjects takes at most 1000 keys a request. */
+const DELETE_BATCH_SIZE = 1e3;
+const isObjectNotFoundError = (error) => {
+	if (error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchKey")) return true;
+	return typeof error === "object" && error !== null && "$metadata" in error && error.$metadata?.httpStatusCode === 404;
+};
+const trimSlashes = (value) => value.replace(/^\/+|\/+$/g, "");
+/**
+* A storage adapter over a bucket's S3 API, which AWS S3, Cloudflare R2, and
+* Neon Object Storage all serve. Each provider package passes its own name,
+* URI protocol, and client defaults.
+*/
+const createS3Storage = ({ name, protocol }, config) => {
+	const { bucketName, basePath, getDownloadUrl, signedUrlExpiresIn = DEFAULT_SIGNED_LIFETIME_SECONDS, credentials, ...clientConfig } = config;
+	if (!Number.isFinite(signedUrlExpiresIn) || signedUrlExpiresIn <= 0 || signedUrlExpiresIn > MAX_SIGNED_LIFETIME_SECONDS) throw new Error(`${name} signedUrlExpiresIn must be between 1 and ${MAX_SIGNED_LIFETIME_SECONDS} seconds (seven days).`);
+	const client = new _aws_sdk_client_s3.S3Client({
+		...clientConfig,
 		credentials: toSdkCredentials(credentials)
-	}));
-	const normalizedBasePath = basePath?.replace(/^\/+|\/+$/g, "") ?? "";
+	});
+	const normalizedBasePath = trimSlashes(basePath ?? "");
 	const getStorageKey = createStorageKeyBuilder(normalizedBasePath);
 	const getListPrefix = (prefix = "") => {
-		const normalizedPrefix = prefix.replace(/^\/+|\/+$/g, "");
-		const value = [normalizedBasePath, normalizedPrefix].filter(Boolean).join("/");
+		const value = [normalizedBasePath, trimSlashes(prefix)].filter(Boolean).join("/");
 		return value ? `${value}/` : "";
 	};
 	/**
@@ -14393,7 +14422,7 @@ function s3Storage(config) {
 			return createStorageUri({
 				bucket: bucketName,
 				key,
-				protocol: "s3"
+				protocol
 			});
 		} catch {
 			return null;
@@ -14405,55 +14434,16 @@ function s3Storage(config) {
 		return key.startsWith(basePrefix) ? key.slice(basePrefix.length) : key;
 	};
 	const parseAndValidate = (storageUri) => {
-		const parsed = parseStorageUri(storageUri, "s3");
+		const parsed = parseStorageUri(storageUri, protocol);
 		if (parsed.bucket !== bucketName) throw new Error(`Bucket name mismatch: expected "${bucketName}", but found "${parsed.bucket}".`);
 		return parsed;
 	};
 	return createStorageAdapter({
-		name: "s3Storage",
-		protocol: "s3",
-		async listObjects(prefix) {
-			const objects = [];
-			let continuationToken;
-			do {
-				const response = await client.send(new _aws_sdk_client_s3.ListObjectsV2Command({
-					Bucket: bucketName,
-					ContinuationToken: continuationToken,
-					Prefix: getListPrefix(prefix)
-				}));
-				for (const object of response.Contents ?? []) {
-					if (!object.Key) continue;
-					const storageUri = getListedStorageUri(object.Key);
-					if (storageUri === null) continue;
-					objects.push({
-						key: getRelativeKey(object.Key),
-						lastModifiedAt: object.LastModified,
-						size: object.Size ?? 0,
-						storageUri
-					});
-				}
-				continuationToken = response.NextContinuationToken;
-			} while (continuationToken);
-			return objects;
-		},
-		async deleteObjects(relativeKeys) {
-			const keys = relativeKeys.map((key) => getStorageKey(key));
-			for (let offset = 0; offset < keys.length; offset += 1e3) {
-				const batch = keys.slice(offset, offset + 1e3);
-				if (batch.length === 0) continue;
-				const response = await client.send(new _aws_sdk_client_s3.DeleteObjectsCommand({
-					Bucket: bucketName,
-					Delete: {
-						Objects: batch.map((Key) => ({ Key })),
-						Quiet: true
-					}
-				}));
-				if (response.Errors && response.Errors.length > 0) throw new Error(`Failed to delete ${response.Errors.length} S3 object(s).`);
-			}
-		},
+		name,
+		protocol,
 		async put({ key, body, contentLength, contentType }) {
 			const storageKey = getStorageKey(key);
-			const response = await new _aws_sdk_lib_storage.Upload({
+			await new _aws_sdk_lib_storage.Upload({
 				client,
 				params: {
 					Body: body,
@@ -14464,11 +14454,10 @@ function s3Storage(config) {
 					Key: storageKey
 				}
 			}).done();
-			if (!response.Bucket || !response.Key) throw new Error("Upload failed");
 			return { storageUri: createStorageUri({
 				bucket: bucketName,
 				key: storageKey,
-				protocol: "s3"
+				protocol
 			}) };
 		},
 		async get({ storageUri }) {
@@ -14491,11 +14480,10 @@ function s3Storage(config) {
 		async getDownloadUrl({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
 			if (getDownloadUrl) return getDownloadUrl({ storageUri });
-			const { getSignedUrl } = await import("@aws-sdk/s3-request-presigner");
-			return { url: await getSignedUrl(client, new _aws_sdk_client_s3.GetObjectCommand({
+			return { url: await (0, _aws_sdk_s3_request_presigner.getSignedUrl)(client, new _aws_sdk_client_s3.GetObjectCommand({
 				Bucket: bucketName,
 				Key: key
-			}), { expiresIn: PRESIGNED_URL_EXPIRES_IN_SECONDS }) };
+			}), { expiresIn: signedUrlExpiresIn }) };
 		},
 		async exists({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
@@ -14517,8 +14505,61 @@ function s3Storage(config) {
 				Key: key
 			}));
 			return { deleted: true };
+		},
+		async listObjects(prefix) {
+			const objects = [];
+			let continuationToken;
+			do {
+				const response = await client.send(new _aws_sdk_client_s3.ListObjectsV2Command({
+					Bucket: bucketName,
+					ContinuationToken: continuationToken,
+					Prefix: getListPrefix(prefix)
+				}));
+				for (const object of response.Contents ?? []) {
+					if (!object.Key) continue;
+					const storageUri = getListedStorageUri(object.Key);
+					if (storageUri === null) continue;
+					objects.push({
+						key: getRelativeKey(object.Key),
+						lastModifiedAt: object.LastModified,
+						size: object.Size ?? 0,
+						storageUri
+					});
+				}
+				continuationToken = response.NextContinuationToken;
+			} while (continuationToken);
+			return objects;
+		},
+		async deleteObjects(relativeKeys) {
+			const keys = relativeKeys.map((key) => getStorageKey(key));
+			for (let offset = 0; offset < keys.length; offset += DELETE_BATCH_SIZE) {
+				const batch = keys.slice(offset, offset + DELETE_BATCH_SIZE);
+				const response = await client.send(new _aws_sdk_client_s3.DeleteObjectsCommand({
+					Bucket: bucketName,
+					Delete: {
+						Objects: batch.map((Key) => ({ Key })),
+						Quiet: true
+					}
+				}));
+				if (response.Errors && response.Errors.length > 0) throw new Error(`Failed to delete ${response.Errors.length} S3 object(s) from bucket "${bucketName}".`);
+			}
 		}
 	});
+};
+//#endregion
+//#region src/s3Storage.ts
+function s3Storage(config) {
+	const { bucketName, basePath, getDownloadUrl, credentials, ...s3Config } = config;
+	return createS3Storage({
+		name: "s3Storage",
+		protocol: "s3"
+	}, {
+		...applyS3RuntimeAwsConfig(s3Config),
+		credentials,
+		bucketName,
+		basePath,
+		getDownloadUrl
+	});
 }
 //#endregion
 //#region lambda/index.ts

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hot-updater/aws",
   "type": "module",
-  "version": "1.2.0-rc.8",
+  "version": "1.2.0-rc.9",
   "description": "React Native OTA solution for self-hosted",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -45,9 +45,9 @@
     "es-toolkit": "^1.32.0",
     "execa": "9.5.2",
     "mime": "^4.0.4",
-    "@hot-updater/protocol": "1.2.0-rc.8",
-    "@hot-updater/test-utils": "1.2.0-rc.8",
-    "@hot-updater/mock": "1.2.0-rc.8"
+    "@hot-updater/protocol": "1.2.0-rc.9",
+    "@hot-updater/mock": "1.2.0-rc.9",
+    "@hot-updater/test-utils": "1.2.0-rc.9"
   },
   "dependencies": {
     "@aws-sdk/client-cloudfront": "3.1066.0",
@@ -64,9 +64,10 @@
     "@aws-sdk/lib-dynamodb": "3.1066.0",
     "@aws-sdk/s3-request-presigner": "3.1066.0",
     "hono": "4.12.34",
-    "@hot-updater/cli-tools": "1.2.0-rc.8",
-    "@hot-updater/plugin-core": "1.2.0-rc.8",
-    "@hot-updater/server": "1.2.0-rc.8"
+    "@hot-updater/cli-tools": "1.2.0-rc.9",
+    "@hot-updater/plugin-core": "1.2.0-rc.9",
+    "@hot-updater/server": "1.2.0-rc.9",
+    "@hot-updater/storage-s3": "1.2.0-rc.9"
   },
   "scripts": {
     "build": "tsdown",