@hot-updater/cloudflare 1.2.0-rc.7 → 1.2.0-rc.8

package/dist/index.cjs

@@ -156,6 +156,23 @@ const d1Database = (config) => ({
 	})
 });
 //#endregion
+//#region src/lazyCredentials.ts
+/**
+* `credentials` as the AWS SDK takes them: access keys with a lazy field
+* become a provider, which the SDK calls once, on its first request.
+*/
+const toSdkCredentials = (credentials) => {
+	if (credentials === void 0 || typeof credentials === "function") return credentials;
+	const { accessKeyId, secretAccessKey, sessionToken, ...rest } = credentials;
+	if (typeof accessKeyId !== "function" && typeof secretAccessKey !== "function" && typeof sessionToken !== "function") return credentials;
+	return async () => ({
+		...rest,
+		accessKeyId: await (0, _hot_updater_plugin_core.resolveLazy)(accessKeyId),
+		secretAccessKey: await (0, _hot_updater_plugin_core.resolveLazy)(secretAccessKey),
+		...sessionToken === void 0 ? {} : { sessionToken: await (0, _hot_updater_plugin_core.resolveLazy)(sessionToken) }
+	});
+};
+//#endregion
 //#region src/r2S3Storage.ts
 /** Devices download right after the update check that returns the URL. */
 const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
@@ -164,9 +181,10 @@ const isObjectNotFoundError = (error) => {
 	return typeof error === "object" && error !== null && "$metadata" in error && error.$metadata?.httpStatusCode === 404;
 };
 const createR2S3Storage = (config) => {
-	const { accountId, basePath, bucketName, endpoint, forcePathStyle, region, ...s3Config } = config;
+	const { accountId, basePath, bucketName, endpoint, forcePathStyle, region, credentials, ...s3Config } = config;
 	const client = new _aws_sdk_client_s3.S3Client({
 		...s3Config,
+		credentials: toSdkCredentials(credentials),
 		endpoint: endpoint ?? `https://${accountId}.r2.cloudflarestorage.com`,
 		forcePathStyle: forcePathStyle ?? true,
 		region: region ?? "auto"

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { StorageAdapterWith, ToolingDatabase } from "@hot-updater/plugin-core";
+import { Lazy, StorageAdapterWith, ToolingDatabase } from "@hot-updater/plugin-core";
 import { S3ClientConfig } from "@aws-sdk/client-s3";
 //#region src/d1Rest.d.ts
 interface D1RestConfig {
@@ -6,10 +6,10 @@ interface D1RestConfig {
   readonly accountId: string;
   /**
    * An API token with D1 edit permission, or a function that returns it,
-   * such as one that reads it with `secretEnv`: called on the first query,
-   * so a config loads without the token.
+   * such as `secret("<name>")` in `hot-updater.config.ts`: called on the
+   * first query, so a config loads without the token.
    */
-  readonly cloudflareApiToken: string | (() => string | Promise<string>);
+  readonly cloudflareApiToken: Lazy<string>;
 }
 //#endregion
 //#region src/d1Executor.d.ts
@@ -30,11 +30,26 @@ type D1DatabaseConfig = D1RestConfig;
  */
 declare const d1Database: (config: D1DatabaseConfig) => ToolingDatabase;
 //#endregion
+//#region src/lazyCredentials.d.ts
+type SdkCredentials = S3ClientConfig["credentials"];
+/**
+ * Access keys whose fields may each be a function that returns them, such
+ * as `secret("<name>")` in `hot-updater.config.ts`, called on first use.
+ */
+interface LazyAwsCredentials {
+  readonly accessKeyId: Lazy<string>;
+  readonly secretAccessKey: Lazy<string>;
+  readonly sessionToken?: Lazy<string>;
+}
+/** The credentials the AWS SDK takes, or access keys with lazy fields. */
+type AwsCredentialsOption = SdkCredentials | LazyAwsCredentials;
+//#endregion
 //#region src/r2S3Storage.d.ts
-interface R2S3StorageConfig extends S3ClientConfig {
+interface R2S3StorageConfig extends Omit<S3ClientConfig, "credentials"> {
   accountId: string;
   bucketName: string;
-  credentials: NonNullable<S3ClientConfig["credentials"]>;
+  /** The SDK's credentials, or an R2 access key whose fields are lazy. */
+  credentials: NonNullable<AwsCredentialsOption>;
   /** Base path where bundles will be stored in the bucket. */
   basePath?: string;
 }

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { StorageAdapterWith, ToolingDatabase } from "@hot-updater/plugin-core";
+import { Lazy, StorageAdapterWith, ToolingDatabase } from "@hot-updater/plugin-core";
 import { S3ClientConfig } from "@aws-sdk/client-s3";
 //#region src/d1Rest.d.ts
 interface D1RestConfig {
@@ -6,10 +6,10 @@ interface D1RestConfig {
   readonly accountId: string;
   /**
    * An API token with D1 edit permission, or a function that returns it,
-   * such as one that reads it with `secretEnv`: called on the first query,
-   * so a config loads without the token.
+   * such as `secret("<name>")` in `hot-updater.config.ts`: called on the
+   * first query, so a config loads without the token.
    */
-  readonly cloudflareApiToken: string | (() => string | Promise<string>);
+  readonly cloudflareApiToken: Lazy<string>;
 }
 //#endregion
 //#region src/d1Executor.d.ts
@@ -30,11 +30,26 @@ type D1DatabaseConfig = D1RestConfig;
  */
 declare const d1Database: (config: D1DatabaseConfig) => ToolingDatabase;
 //#endregion
+//#region src/lazyCredentials.d.ts
+type SdkCredentials = S3ClientConfig["credentials"];
+/**
+ * Access keys whose fields may each be a function that returns them, such
+ * as `secret("<name>")` in `hot-updater.config.ts`, called on first use.
+ */
+interface LazyAwsCredentials {
+  readonly accessKeyId: Lazy<string>;
+  readonly secretAccessKey: Lazy<string>;
+  readonly sessionToken?: Lazy<string>;
+}
+/** The credentials the AWS SDK takes, or access keys with lazy fields. */
+type AwsCredentialsOption = SdkCredentials | LazyAwsCredentials;
+//#endregion
 //#region src/r2S3Storage.d.ts
-interface R2S3StorageConfig extends S3ClientConfig {
+interface R2S3StorageConfig extends Omit<S3ClientConfig, "credentials"> {
   accountId: string;
   bucketName: string;
-  credentials: NonNullable<S3ClientConfig["credentials"]>;
+  /** The SDK's credentials, or an R2 access key whose fields are lazy. */
+  credentials: NonNullable<AwsCredentialsOption>;
   /** Base path where bundles will be stored in the bucket. */
   basePath?: string;
 }

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { WRITE_GUARD_TABLE, coreSettings, coreTarget, createEngineDatabase, createSqlAdapter, createStorageAdapter, createStorageKeyBuilder, createStorageUri, createTableStatements, generateEngineSql, parseStorageUri } from "@hot-updater/plugin-core";
+import { WRITE_GUARD_TABLE, coreSettings, coreTarget, createEngineDatabase, createSqlAdapter, createStorageAdapter, createStorageKeyBuilder, createStorageUri, createTableStatements, generateEngineSql, parseStorageUri, resolveLazy } from "@hot-updater/plugin-core";
 import Cloudflare from "cloudflare";
 import { DeleteObjectCommand, GetObjectCommand, HeadObjectCommand, S3Client } from "@aws-sdk/client-s3";
 import { Upload } from "@aws-sdk/lib-storage";
@@ -132,6 +132,23 @@ const d1Database = (config) => ({
 	})
 });
 //#endregion
+//#region src/lazyCredentials.ts
+/**
+* `credentials` as the AWS SDK takes them: access keys with a lazy field
+* become a provider, which the SDK calls once, on its first request.
+*/
+const toSdkCredentials = (credentials) => {
+	if (credentials === void 0 || typeof credentials === "function") return credentials;
+	const { accessKeyId, secretAccessKey, sessionToken, ...rest } = credentials;
+	if (typeof accessKeyId !== "function" && typeof secretAccessKey !== "function" && typeof sessionToken !== "function") return credentials;
+	return async () => ({
+		...rest,
+		accessKeyId: await resolveLazy(accessKeyId),
+		secretAccessKey: await resolveLazy(secretAccessKey),
+		...sessionToken === void 0 ? {} : { sessionToken: await resolveLazy(sessionToken) }
+	});
+};
+//#endregion
 //#region src/r2S3Storage.ts
 /** Devices download right after the update check that returns the URL. */
 const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
@@ -140,9 +157,10 @@ const isObjectNotFoundError = (error) => {
 	return typeof error === "object" && error !== null && "$metadata" in error && error.$metadata?.httpStatusCode === 404;
 };
 const createR2S3Storage = (config) => {
-	const { accountId, basePath, bucketName, endpoint, forcePathStyle, region, ...s3Config } = config;
+	const { accountId, basePath, bucketName, endpoint, forcePathStyle, region, credentials, ...s3Config } = config;
 	const client = new S3Client({
 		...s3Config,
+		credentials: toSdkCredentials(credentials),
 		endpoint: endpoint ?? `https://${accountId}.r2.cloudflarestorage.com`,
 		forcePathStyle: forcePathStyle ?? true,
 		region: region ?? "auto"

package/dist/init/index.cjs

@@ -11420,10 +11420,11 @@ const inputCloudflareInitSecrets = async ({ accountId, bucketName, apiToken, acc
 //#region iac/configTemplate.ts
 /**
 * The config init writes. With the `resources` init set up, it names them,
-* and reads the API token and R2 keys with `secretEnv`, from the
+* and reads the API token and R2 keys with `secret()`, from the
 * environment and `.env.hotupdater`, then the config's `secrets` adapter.
-* Without them, as the agent scaffold writes it, it reads every value from
-* the environment.
+* Without them, as the agent scaffold writes it before the agent creates the
+* resources, it reads their IDs from the environment, where the agent
+* records them, and the credentials with `secret()` alike.
 */
 const getConfigScaffold = (build, resources) => {
 	const builder = new _hot_updater_cli_tools.ConfigBuilder().setBuildType(build).setPlugins({
@@ -11446,8 +11447,8 @@ const getConfigScaffold = (build, resources) => {
     bucketName: process.env.HOT_UPDATER_CLOUDFLARE_R2_BUCKET_NAME!,
     accountId: process.env.HOT_UPDATER_CLOUDFLARE_ACCOUNT_ID!,
     credentials: {
-      accessKeyId: process.env.HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID!,
-      secretAccessKey: process.env.HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY!,
+      accessKeyId: secret("HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID"),
+      secretAccessKey: secret("HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY"),
     },
   })`
 	}).setDatabase({
@@ -11458,8 +11459,11 @@ const getConfigScaffold = (build, resources) => {
 		configString: `d1Database({
     databaseId: process.env.HOT_UPDATER_CLOUDFLARE_D1_DATABASE_ID!,
     accountId: process.env.HOT_UPDATER_CLOUDFLARE_ACCOUNT_ID!,
-    cloudflareApiToken: process.env.HOT_UPDATER_CLOUDFLARE_API_TOKEN!,
+    cloudflareApiToken: secret("HOT_UPDATER_CLOUDFLARE_API_TOKEN"),
   })`
+	}).addImport({
+		pkg: "hot-updater",
+		named: ["secret"]
 	}));
 	const accountId = JSON.stringify(resources.accountId);
 	const storageConfig = {
@@ -11470,12 +11474,9 @@ const getConfigScaffold = (build, resources) => {
 		configString: `r2Storage({
     bucketName: ${JSON.stringify(resources.bucketName)},
     accountId: ${accountId},
-    credentials: async () => {
-      const env = await storageSecrets();
-      return {
-        accessKeyId: env.HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID,
-        secretAccessKey: env.HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY,
-      };
+    credentials: {
+      accessKeyId: secret("HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID"),
+      secretAccessKey: secret("HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY"),
     },
   })`
 	};
@@ -11487,15 +11488,13 @@ const getConfigScaffold = (build, resources) => {
 		configString: `d1Database({
     databaseId: ${JSON.stringify(resources.d1DatabaseId)},
     accountId: ${accountId},
-    cloudflareApiToken: async () =>
-      (await databaseSecrets()).HOT_UPDATER_CLOUDFLARE_API_TOKEN,
+    cloudflareApiToken: secret("HOT_UPDATER_CLOUDFLARE_API_TOKEN"),
   })`
 	};
-	const helperStatements = [(0, _hot_updater_cli_tools.secretEnvHelper)("storageSecrets", ["HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID", "HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY"]), (0, _hot_updater_cli_tools.secretEnvHelper)("databaseSecrets", ["HOT_UPDATER_CLOUDFLARE_API_TOKEN"])];
 	return (0, _hot_updater_cli_tools.createHotUpdaterConfigScaffoldFromBuilder)(builder.setStorage(storageConfig).setDatabase(databaseConfig).addImport({
 		pkg: "hot-updater",
-		named: ["secretEnv"]
-	}).setIntermediateCode(helperStatements.map(({ code }) => code).join("\n\n")), { helperStatements });
+		named: ["secret"]
+	}));
 };
 //#endregion
 //#region iac/managedWorker.ts

package/dist/init/index.mjs

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
 import path from "path";
-import { ConfigBuilder, InitError, LegacyInfrastructureError, assembleServer, assertInfrastructureGenerationAtUrl, assertInitInputs, assertInitProviderInputs, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, printAppSetup, provisionClientCredential, readHotUpdaterInitEnv, resolveInitProviderInput, secretEnvHelper, writeHotUpdaterFiles } from "@hot-updater/cli-tools";
+import { ConfigBuilder, InitError, LegacyInfrastructureError, assembleServer, assertInfrastructureGenerationAtUrl, assertInitInputs, assertInitProviderInputs, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, printAppSetup, provisionClientCredential, readHotUpdaterInitEnv, resolveInitProviderInput, writeHotUpdaterFiles } from "@hot-updater/cli-tools";
 import { apiKeys, insights, remoteConfig } from "@hot-updater/server/plugins";
 import Cloudflare$1, { Cloudflare } from "cloudflare";
 import { WRITE_GUARD_TABLE, coreSettings, coreTarget, createEngineDatabase, createSqlAdapter, createTableStatements, generateEngineSql } from "@hot-updater/plugin-core";
@@ -11413,10 +11413,11 @@ const inputCloudflareInitSecrets = async ({ accountId, bucketName, apiToken, acc
 //#region iac/configTemplate.ts
 /**
 * The config init writes. With the `resources` init set up, it names them,
-* and reads the API token and R2 keys with `secretEnv`, from the
+* and reads the API token and R2 keys with `secret()`, from the
 * environment and `.env.hotupdater`, then the config's `secrets` adapter.
-* Without them, as the agent scaffold writes it, it reads every value from
-* the environment.
+* Without them, as the agent scaffold writes it before the agent creates the
+* resources, it reads their IDs from the environment, where the agent
+* records them, and the credentials with `secret()` alike.
 */
 const getConfigScaffold = (build, resources) => {
 	const builder = new ConfigBuilder().setBuildType(build).setPlugins({
@@ -11439,8 +11440,8 @@ const getConfigScaffold = (build, resources) => {
     bucketName: process.env.HOT_UPDATER_CLOUDFLARE_R2_BUCKET_NAME!,
     accountId: process.env.HOT_UPDATER_CLOUDFLARE_ACCOUNT_ID!,
     credentials: {
-      accessKeyId: process.env.HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID!,
-      secretAccessKey: process.env.HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY!,
+      accessKeyId: secret("HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID"),
+      secretAccessKey: secret("HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY"),
     },
   })`
 	}).setDatabase({
@@ -11451,8 +11452,11 @@ const getConfigScaffold = (build, resources) => {
 		configString: `d1Database({
     databaseId: process.env.HOT_UPDATER_CLOUDFLARE_D1_DATABASE_ID!,
     accountId: process.env.HOT_UPDATER_CLOUDFLARE_ACCOUNT_ID!,
-    cloudflareApiToken: process.env.HOT_UPDATER_CLOUDFLARE_API_TOKEN!,
+    cloudflareApiToken: secret("HOT_UPDATER_CLOUDFLARE_API_TOKEN"),
   })`
+	}).addImport({
+		pkg: "hot-updater",
+		named: ["secret"]
 	}));
 	const accountId = JSON.stringify(resources.accountId);
 	const storageConfig = {
@@ -11463,12 +11467,9 @@ const getConfigScaffold = (build, resources) => {
 		configString: `r2Storage({
     bucketName: ${JSON.stringify(resources.bucketName)},
     accountId: ${accountId},
-    credentials: async () => {
-      const env = await storageSecrets();
-      return {
-        accessKeyId: env.HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID,
-        secretAccessKey: env.HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY,
-      };
+    credentials: {
+      accessKeyId: secret("HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID"),
+      secretAccessKey: secret("HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY"),
     },
   })`
 	};
@@ -11480,15 +11481,13 @@ const getConfigScaffold = (build, resources) => {
 		configString: `d1Database({
     databaseId: ${JSON.stringify(resources.d1DatabaseId)},
     accountId: ${accountId},
-    cloudflareApiToken: async () =>
-      (await databaseSecrets()).HOT_UPDATER_CLOUDFLARE_API_TOKEN,
+    cloudflareApiToken: secret("HOT_UPDATER_CLOUDFLARE_API_TOKEN"),
   })`
 	};
-	const helperStatements = [secretEnvHelper("storageSecrets", ["HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID", "HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY"]), secretEnvHelper("databaseSecrets", ["HOT_UPDATER_CLOUDFLARE_API_TOKEN"])];
 	return createHotUpdaterConfigScaffoldFromBuilder(builder.setStorage(storageConfig).setDatabase(databaseConfig).addImport({
 		pkg: "hot-updater",
-		named: ["secretEnv"]
-	}).setIntermediateCode(helperStatements.map(({ code }) => code).join("\n\n")), { helperStatements });
+		named: ["secret"]
+	}));
 };
 //#endregion
 //#region iac/managedWorker.ts

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hot-updater/cloudflare",
   "type": "module",
-  "version": "1.2.0-rc.7",
+  "version": "1.2.0-rc.8",
   "description": "React Native OTA solution for self-hosted",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -55,10 +55,10 @@
     "cloudflare": "4.2.0",
     "hono": "4.12.34",
     "uuidv7": "^1.0.2",
-    "@hot-updater/cli-tools": "1.2.0-rc.7",
-    "@hot-updater/protocol": "1.2.0-rc.7",
-    "@hot-updater/plugin-core": "1.2.0-rc.7",
-    "@hot-updater/server": "1.2.0-rc.7"
+    "@hot-updater/cli-tools": "1.2.0-rc.8",
+    "@hot-updater/protocol": "1.2.0-rc.8",
+    "@hot-updater/server": "1.2.0-rc.8",
+    "@hot-updater/plugin-core": "1.2.0-rc.8"
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "0.13.0",
@@ -74,7 +74,7 @@
     "vitest": "4.1.4",
     "wrangler": "^4.69.0",
     "xdg-app-paths": "^8.3.0",
-    "@hot-updater/test-utils": "1.2.0-rc.7"
+    "@hot-updater/test-utils": "1.2.0-rc.8"
   },
   "scripts": {
     "build": "tsdown && pnpm build:worker",

package/src/d1Rest.ts

@@ -1,4 +1,4 @@
-import type { SqlResult, SqlStatement } from "@hot-updater/plugin-core";
+import type { Lazy, SqlResult, SqlStatement } from "@hot-updater/plugin-core";
 import Cloudflare from "cloudflare";
 
 import { D1ExecutionError, type D1ResultLike, toSqlResult } from "./d1Executor";
@@ -8,10 +8,10 @@ export interface D1RestConfig {
   readonly accountId: string;
   /**
    * An API token with D1 edit permission, or a function that returns it,
-   * such as one that reads it with `secretEnv`: called on the first query,
-   * so a config loads without the token.
+   * such as `secret("<name>")` in `hot-updater.config.ts`: called on the
+   * first query, so a config loads without the token.
    */
-  readonly cloudflareApiToken: string | (() => string | Promise<string>);
+  readonly cloudflareApiToken: Lazy<string>;
 }
 
 /** The REST API binds text: each value goes as JSON and is read back with `json_extract`. */

package/src/lazyCredentials.ts

@@ -0,0 +1,45 @@
+import type { S3ClientConfig } from "@aws-sdk/client-s3";
+import { type Lazy, resolveLazy } from "@hot-updater/plugin-core";
+
+type SdkCredentials = S3ClientConfig["credentials"];
+
+/**
+ * Access keys whose fields may each be a function that returns them, such
+ * as `secret("<name>")` in `hot-updater.config.ts`, called on first use.
+ */
+export interface LazyAwsCredentials {
+  readonly accessKeyId: Lazy<string>;
+  readonly secretAccessKey: Lazy<string>;
+  readonly sessionToken?: Lazy<string>;
+}
+
+/** The credentials the AWS SDK takes, or access keys with lazy fields. */
+export type AwsCredentialsOption = SdkCredentials | LazyAwsCredentials;
+
+/**
+ * `credentials` as the AWS SDK takes them: access keys with a lazy field
+ * become a provider, which the SDK calls once, on its first request.
+ */
+export const toSdkCredentials = (
+  credentials: AwsCredentialsOption | undefined,
+): SdkCredentials => {
+  if (credentials === undefined || typeof credentials === "function") {
+    return credentials;
+  }
+  const { accessKeyId, secretAccessKey, sessionToken, ...rest } = credentials;
+  if (
+    typeof accessKeyId !== "function" &&
+    typeof secretAccessKey !== "function" &&
+    typeof sessionToken !== "function"
+  ) {
+    return credentials as SdkCredentials;
+  }
+  return async () => ({
+    ...rest,
+    accessKeyId: await resolveLazy(accessKeyId),
+    secretAccessKey: await resolveLazy(secretAccessKey),
+    ...(sessionToken === undefined
+      ? {}
+      : { sessionToken: await resolveLazy(sessionToken) }),
+  });
+};

package/src/r2S3Storage.ts

@@ -15,10 +15,13 @@ import {
   type StorageAdapterWith,
 } from "@hot-updater/plugin-core";
 
-export interface R2S3StorageConfig extends S3ClientConfig {
+import { type AwsCredentialsOption, toSdkCredentials } from "./lazyCredentials";
+
+export interface R2S3StorageConfig extends Omit<S3ClientConfig, "credentials"> {
   accountId: string;
   bucketName: string;
-  credentials: NonNullable<S3ClientConfig["credentials"]>;
+  /** The SDK's credentials, or an R2 access key whose fields are lazy. */
+  credentials: NonNullable<AwsCredentialsOption>;
   /** Base path where bundles will be stored in the bucket. */
   basePath?: string;
 }
@@ -54,10 +57,12 @@ export const createR2S3Storage = (
     endpoint,
     forcePathStyle,
     region,
+    credentials,
     ...s3Config
   } = config;
   const client = new S3Client({
     ...s3Config,
+    credentials: toSdkCredentials(credentials),
     endpoint: endpoint ?? `https://${accountId}.r2.cloudflarestorage.com`,
     forcePathStyle: forcePathStyle ?? true,
     region: region ?? "auto",

package/worker/dist/README.md

@@ -1 +1 @@
-This folder contains the built output assets for the worker "hot-updater" generated at 2026-10-29T02:19:11.482Z.
+This folder contains the built output assets for the worker "hot-updater" generated at 2026-10-29T09:59:26.122Z.

package/worker/dist/index.js

@@ -4632,7 +4632,7 @@ var createSqlAdapter = /* @__PURE__ */ __name(({ executor, tablePrefix = "", max
 }, "createSqlAdapter");
 
 // ../../packages/server/dist/package.mjs
-var version = "1.2.0-rc.7";
+var version = "1.2.0-rc.8";
 
 // ../../packages/server/dist/version.mjs
 var HOT_UPDATER_SERVER_VERSION = version;