@hot-updater/cloudflare 1.2.0-rc.7 → 1.2.0-rc.9

package/dist/index.cjs

@@ -24,9 +24,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
 let cloudflare = require("cloudflare");
 cloudflare = __toESM(cloudflare, 1);
-let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
-let _aws_sdk_lib_storage = require("@aws-sdk/lib-storage");
-let _aws_sdk_s3_request_presigner = require("@aws-sdk/s3-request-presigner");
+let _hot_updater_storage_s3 = require("@hot-updater/storage-s3");
 //#region src/d1Executor.ts
 var D1ExecutionError = class extends Error {
 	name = "D1ExecutionError";
@@ -157,94 +155,17 @@ const d1Database = (config) => ({
 });
 //#endregion
 //#region src/r2S3Storage.ts
-/** Devices download right after the update check that returns the URL. */
-const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
-const isObjectNotFoundError = (error) => {
-	if (error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchKey")) return true;
-	return typeof error === "object" && error !== null && "$metadata" in error && error.$metadata?.httpStatusCode === 404;
-};
 const createR2S3Storage = (config) => {
-	const { accountId, basePath, bucketName, endpoint, forcePathStyle, region, ...s3Config } = config;
-	const client = new _aws_sdk_client_s3.S3Client({
+	const { accountId, endpoint, forcePathStyle, region, ...s3Config } = config;
+	return (0, _hot_updater_storage_s3.createS3Storage)({
+		name: "r2Storage",
+		protocol: "r2"
+	}, {
 		...s3Config,
 		endpoint: endpoint ?? `https://${accountId}.r2.cloudflarestorage.com`,
 		forcePathStyle: forcePathStyle ?? true,
 		region: region ?? "auto"
 	});
-	const getStorageKey = (0, _hot_updater_plugin_core.createStorageKeyBuilder)(basePath);
-	const parseAndValidate = (storageUri) => {
-		const parsed = (0, _hot_updater_plugin_core.parseStorageUri)(storageUri, "r2");
-		if (parsed.bucket !== bucketName) throw new Error(`Bucket name mismatch: expected "${bucketName}", but found "${parsed.bucket}".`);
-		return parsed;
-	};
-	return (0, _hot_updater_plugin_core.createStorageAdapter)({
-		name: "r2Storage",
-		protocol: "r2",
-		async put({ key, body, contentLength, contentType }) {
-			const storageKey = getStorageKey(key);
-			await new _aws_sdk_lib_storage.Upload({
-				client,
-				params: {
-					Body: body,
-					Bucket: bucketName,
-					CacheControl: "max-age=31536000",
-					ContentLength: contentLength,
-					ContentType: contentType,
-					Key: storageKey
-				}
-			}).done();
-			return { storageUri: (0, _hot_updater_plugin_core.createStorageUri)({
-				protocol: "r2",
-				bucket: bucketName,
-				key: storageKey
-			}) };
-		},
-		async get({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			try {
-				const response = await client.send(new _aws_sdk_client_s3.GetObjectCommand({
-					Bucket: bucketName,
-					Key: key
-				}));
-				if (!response.Body) return { response: null };
-				const headers = new Headers();
-				if (response.ContentType) headers.set("content-type", response.ContentType);
-				if (response.ContentLength !== void 0) headers.set("content-length", String(response.ContentLength));
-				return { response: new Response(response.Body.transformToWebStream(), { headers }) };
-			} catch (error) {
-				if (isObjectNotFoundError(error)) return { response: null };
-				throw error;
-			}
-		},
-		async getDownloadUrl({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			return { url: await (0, _aws_sdk_s3_request_presigner.getSignedUrl)(client, new _aws_sdk_client_s3.GetObjectCommand({
-				Bucket: bucketName,
-				Key: key
-			}), { expiresIn: PRESIGNED_URL_EXPIRES_IN_SECONDS }) };
-		},
-		async exists({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			try {
-				await client.send(new _aws_sdk_client_s3.HeadObjectCommand({
-					Bucket: bucketName,
-					Key: key
-				}));
-				return { exists: true };
-			} catch (error) {
-				if (isObjectNotFoundError(error)) return { exists: false };
-				throw error;
-			}
-		},
-		async delete({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			await client.send(new _aws_sdk_client_s3.DeleteObjectCommand({
-				Bucket: bucketName,
-				Key: key
-			}));
-			return { deleted: true };
-		}
-	});
 };
 //#endregion
 //#region src/r2Storage.ts

package/dist/index.d.cts

@@ -1,15 +1,15 @@
-import { StorageAdapterWith, ToolingDatabase } from "@hot-updater/plugin-core";
-import { S3ClientConfig } from "@aws-sdk/client-s3";
+import { Lazy, StorageAdapterWith, ToolingDatabase } from "@hot-updater/plugin-core";
+import { S3ClientConfig, S3CredentialsOption, S3StorageOperations } from "@hot-updater/storage-s3";
 //#region src/d1Rest.d.ts
 interface D1RestConfig {
   readonly databaseId: string;
   readonly accountId: string;
   /**
    * An API token with D1 edit permission, or a function that returns it,
-   * such as one that reads it with `secretEnv`: called on the first query,
-   * so a config loads without the token.
+   * such as `secret("<name>")` in `hot-updater.config.ts`: called on the
+   * first query, so a config loads without the token.
    */
-  readonly cloudflareApiToken: string | (() => string | Promise<string>);
+  readonly cloudflareApiToken: Lazy<string>;
 }
 //#endregion
 //#region src/d1Executor.d.ts
@@ -31,16 +31,17 @@ type D1DatabaseConfig = D1RestConfig;
 declare const d1Database: (config: D1DatabaseConfig) => ToolingDatabase;
 //#endregion
 //#region src/r2S3Storage.d.ts
-interface R2S3StorageConfig extends S3ClientConfig {
+interface R2S3StorageConfig extends Omit<S3ClientConfig, "credentials"> {
   accountId: string;
   bucketName: string;
-  credentials: NonNullable<S3ClientConfig["credentials"]>;
+  /** The SDK's credentials, or an R2 access key whose fields are lazy. */
+  credentials: NonNullable<S3CredentialsOption>;
   /** Base path where bundles will be stored in the bucket. */
   basePath?: string;
 }
 //#endregion
 //#region src/r2Storage.d.ts
 type R2StorageConfig = R2S3StorageConfig;
-declare const r2Storage: (config: R2S3StorageConfig) => StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
+declare const r2Storage: (config: R2S3StorageConfig) => StorageAdapterWith<S3StorageOperations>;
 //#endregion
 export { D1DatabaseConfig, D1ExecutionError, type R2S3StorageConfig, R2StorageConfig, d1Database, r2Storage };

package/dist/index.d.mts

@@ -1,15 +1,15 @@
-import { StorageAdapterWith, ToolingDatabase } from "@hot-updater/plugin-core";
-import { S3ClientConfig } from "@aws-sdk/client-s3";
+import { Lazy, StorageAdapterWith, ToolingDatabase } from "@hot-updater/plugin-core";
+import { S3ClientConfig, S3CredentialsOption, S3StorageOperations } from "@hot-updater/storage-s3";
 //#region src/d1Rest.d.ts
 interface D1RestConfig {
   readonly databaseId: string;
   readonly accountId: string;
   /**
    * An API token with D1 edit permission, or a function that returns it,
-   * such as one that reads it with `secretEnv`: called on the first query,
-   * so a config loads without the token.
+   * such as `secret("<name>")` in `hot-updater.config.ts`: called on the
+   * first query, so a config loads without the token.
    */
-  readonly cloudflareApiToken: string | (() => string | Promise<string>);
+  readonly cloudflareApiToken: Lazy<string>;
 }
 //#endregion
 //#region src/d1Executor.d.ts
@@ -31,16 +31,17 @@ type D1DatabaseConfig = D1RestConfig;
 declare const d1Database: (config: D1DatabaseConfig) => ToolingDatabase;
 //#endregion
 //#region src/r2S3Storage.d.ts
-interface R2S3StorageConfig extends S3ClientConfig {
+interface R2S3StorageConfig extends Omit<S3ClientConfig, "credentials"> {
   accountId: string;
   bucketName: string;
-  credentials: NonNullable<S3ClientConfig["credentials"]>;
+  /** The SDK's credentials, or an R2 access key whose fields are lazy. */
+  credentials: NonNullable<S3CredentialsOption>;
   /** Base path where bundles will be stored in the bucket. */
   basePath?: string;
 }
 //#endregion
 //#region src/r2Storage.d.ts
 type R2StorageConfig = R2S3StorageConfig;
-declare const r2Storage: (config: R2S3StorageConfig) => StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
+declare const r2Storage: (config: R2S3StorageConfig) => StorageAdapterWith<S3StorageOperations>;
 //#endregion
 export { D1DatabaseConfig, D1ExecutionError, type R2S3StorageConfig, R2StorageConfig, d1Database, r2Storage };

package/dist/index.mjs

@@ -1,8 +1,6 @@
-import { WRITE_GUARD_TABLE, coreSettings, coreTarget, createEngineDatabase, createSqlAdapter, createStorageAdapter, createStorageKeyBuilder, createStorageUri, createTableStatements, generateEngineSql, parseStorageUri } from "@hot-updater/plugin-core";
+import { WRITE_GUARD_TABLE, coreSettings, coreTarget, createEngineDatabase, createSqlAdapter, createTableStatements, generateEngineSql } from "@hot-updater/plugin-core";
 import Cloudflare from "cloudflare";
-import { DeleteObjectCommand, GetObjectCommand, HeadObjectCommand, S3Client } from "@aws-sdk/client-s3";
-import { Upload } from "@aws-sdk/lib-storage";
-import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import { createS3Storage } from "@hot-updater/storage-s3";
 //#region src/d1Executor.ts
 var D1ExecutionError = class extends Error {
 	name = "D1ExecutionError";
@@ -133,94 +131,17 @@ const d1Database = (config) => ({
 });
 //#endregion
 //#region src/r2S3Storage.ts
-/** Devices download right after the update check that returns the URL. */
-const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
-const isObjectNotFoundError = (error) => {
-	if (error instanceof Error && (error.name === "NotFound" || error.name === "NoSuchKey")) return true;
-	return typeof error === "object" && error !== null && "$metadata" in error && error.$metadata?.httpStatusCode === 404;
-};
 const createR2S3Storage = (config) => {
-	const { accountId, basePath, bucketName, endpoint, forcePathStyle, region, ...s3Config } = config;
-	const client = new S3Client({
+	const { accountId, endpoint, forcePathStyle, region, ...s3Config } = config;
+	return createS3Storage({
+		name: "r2Storage",
+		protocol: "r2"
+	}, {
 		...s3Config,
 		endpoint: endpoint ?? `https://${accountId}.r2.cloudflarestorage.com`,
 		forcePathStyle: forcePathStyle ?? true,
 		region: region ?? "auto"
 	});
-	const getStorageKey = createStorageKeyBuilder(basePath);
-	const parseAndValidate = (storageUri) => {
-		const parsed = parseStorageUri(storageUri, "r2");
-		if (parsed.bucket !== bucketName) throw new Error(`Bucket name mismatch: expected "${bucketName}", but found "${parsed.bucket}".`);
-		return parsed;
-	};
-	return createStorageAdapter({
-		name: "r2Storage",
-		protocol: "r2",
-		async put({ key, body, contentLength, contentType }) {
-			const storageKey = getStorageKey(key);
-			await new Upload({
-				client,
-				params: {
-					Body: body,
-					Bucket: bucketName,
-					CacheControl: "max-age=31536000",
-					ContentLength: contentLength,
-					ContentType: contentType,
-					Key: storageKey
-				}
-			}).done();
-			return { storageUri: createStorageUri({
-				protocol: "r2",
-				bucket: bucketName,
-				key: storageKey
-			}) };
-		},
-		async get({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			try {
-				const response = await client.send(new GetObjectCommand({
-					Bucket: bucketName,
-					Key: key
-				}));
-				if (!response.Body) return { response: null };
-				const headers = new Headers();
-				if (response.ContentType) headers.set("content-type", response.ContentType);
-				if (response.ContentLength !== void 0) headers.set("content-length", String(response.ContentLength));
-				return { response: new Response(response.Body.transformToWebStream(), { headers }) };
-			} catch (error) {
-				if (isObjectNotFoundError(error)) return { response: null };
-				throw error;
-			}
-		},
-		async getDownloadUrl({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			return { url: await getSignedUrl(client, new GetObjectCommand({
-				Bucket: bucketName,
-				Key: key
-			}), { expiresIn: PRESIGNED_URL_EXPIRES_IN_SECONDS }) };
-		},
-		async exists({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			try {
-				await client.send(new HeadObjectCommand({
-					Bucket: bucketName,
-					Key: key
-				}));
-				return { exists: true };
-			} catch (error) {
-				if (isObjectNotFoundError(error)) return { exists: false };
-				throw error;
-			}
-		},
-		async delete({ storageUri }) {
-			const { key } = parseAndValidate(storageUri);
-			await client.send(new DeleteObjectCommand({
-				Bucket: bucketName,
-				Key: key
-			}));
-			return { deleted: true };
-		}
-	});
 };
 //#endregion
 //#region src/r2Storage.ts

package/dist/init/index.cjs

@@ -11420,10 +11420,11 @@ const inputCloudflareInitSecrets = async ({ accountId, bucketName, apiToken, acc
 //#region iac/configTemplate.ts
 /**
 * The config init writes. With the `resources` init set up, it names them,
-* and reads the API token and R2 keys with `secretEnv`, from the
+* and reads the API token and R2 keys with `secret()`, from the
 * environment and `.env.hotupdater`, then the config's `secrets` adapter.
-* Without them, as the agent scaffold writes it, it reads every value from
-* the environment.
+* Without them, as the agent scaffold writes it before the agent creates the
+* resources, it reads their IDs from the environment, where the agent
+* records them, and the credentials with `secret()` alike.
 */
 const getConfigScaffold = (build, resources) => {
 	const builder = new _hot_updater_cli_tools.ConfigBuilder().setBuildType(build).setPlugins({
@@ -11446,8 +11447,8 @@ const getConfigScaffold = (build, resources) => {
     bucketName: process.env.HOT_UPDATER_CLOUDFLARE_R2_BUCKET_NAME!,
     accountId: process.env.HOT_UPDATER_CLOUDFLARE_ACCOUNT_ID!,
     credentials: {
-      accessKeyId: process.env.HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID!,
-      secretAccessKey: process.env.HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY!,
+      accessKeyId: secret("HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID"),
+      secretAccessKey: secret("HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY"),
     },
   })`
 	}).setDatabase({
@@ -11458,8 +11459,11 @@ const getConfigScaffold = (build, resources) => {
 		configString: `d1Database({
     databaseId: process.env.HOT_UPDATER_CLOUDFLARE_D1_DATABASE_ID!,
     accountId: process.env.HOT_UPDATER_CLOUDFLARE_ACCOUNT_ID!,
-    cloudflareApiToken: process.env.HOT_UPDATER_CLOUDFLARE_API_TOKEN!,
+    cloudflareApiToken: secret("HOT_UPDATER_CLOUDFLARE_API_TOKEN"),
   })`
+	}).addImport({
+		pkg: "hot-updater",
+		named: ["secret"]
 	}));
 	const accountId = JSON.stringify(resources.accountId);
 	const storageConfig = {
@@ -11470,12 +11474,9 @@ const getConfigScaffold = (build, resources) => {
 		configString: `r2Storage({
     bucketName: ${JSON.stringify(resources.bucketName)},
     accountId: ${accountId},
-    credentials: async () => {
-      const env = await storageSecrets();
-      return {
-        accessKeyId: env.HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID,
-        secretAccessKey: env.HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY,
-      };
+    credentials: {
+      accessKeyId: secret("HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID"),
+      secretAccessKey: secret("HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY"),
     },
   })`
 	};
@@ -11487,15 +11488,13 @@ const getConfigScaffold = (build, resources) => {
 		configString: `d1Database({
     databaseId: ${JSON.stringify(resources.d1DatabaseId)},
     accountId: ${accountId},
-    cloudflareApiToken: async () =>
-      (await databaseSecrets()).HOT_UPDATER_CLOUDFLARE_API_TOKEN,
+    cloudflareApiToken: secret("HOT_UPDATER_CLOUDFLARE_API_TOKEN"),
   })`
 	};
-	const helperStatements = [(0, _hot_updater_cli_tools.secretEnvHelper)("storageSecrets", ["HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID", "HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY"]), (0, _hot_updater_cli_tools.secretEnvHelper)("databaseSecrets", ["HOT_UPDATER_CLOUDFLARE_API_TOKEN"])];
 	return (0, _hot_updater_cli_tools.createHotUpdaterConfigScaffoldFromBuilder)(builder.setStorage(storageConfig).setDatabase(databaseConfig).addImport({
 		pkg: "hot-updater",
-		named: ["secretEnv"]
-	}).setIntermediateCode(helperStatements.map(({ code }) => code).join("\n\n")), { helperStatements });
+		named: ["secret"]
+	}));
 };
 //#endregion
 //#region iac/managedWorker.ts

package/dist/init/index.mjs

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
 import path from "path";
-import { ConfigBuilder, InitError, LegacyInfrastructureError, assembleServer, assertInfrastructureGenerationAtUrl, assertInitInputs, assertInitProviderInputs, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, printAppSetup, provisionClientCredential, readHotUpdaterInitEnv, resolveInitProviderInput, secretEnvHelper, writeHotUpdaterFiles } from "@hot-updater/cli-tools";
+import { ConfigBuilder, InitError, LegacyInfrastructureError, assembleServer, assertInfrastructureGenerationAtUrl, assertInitInputs, assertInitProviderInputs, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, printAppSetup, provisionClientCredential, readHotUpdaterInitEnv, resolveInitProviderInput, writeHotUpdaterFiles } from "@hot-updater/cli-tools";
 import { apiKeys, insights, remoteConfig } from "@hot-updater/server/plugins";
 import Cloudflare$1, { Cloudflare } from "cloudflare";
 import { WRITE_GUARD_TABLE, coreSettings, coreTarget, createEngineDatabase, createSqlAdapter, createTableStatements, generateEngineSql } from "@hot-updater/plugin-core";
@@ -11413,10 +11413,11 @@ const inputCloudflareInitSecrets = async ({ accountId, bucketName, apiToken, acc
 //#region iac/configTemplate.ts
 /**
 * The config init writes. With the `resources` init set up, it names them,
-* and reads the API token and R2 keys with `secretEnv`, from the
+* and reads the API token and R2 keys with `secret()`, from the
 * environment and `.env.hotupdater`, then the config's `secrets` adapter.
-* Without them, as the agent scaffold writes it, it reads every value from
-* the environment.
+* Without them, as the agent scaffold writes it before the agent creates the
+* resources, it reads their IDs from the environment, where the agent
+* records them, and the credentials with `secret()` alike.
 */
 const getConfigScaffold = (build, resources) => {
 	const builder = new ConfigBuilder().setBuildType(build).setPlugins({
@@ -11439,8 +11440,8 @@ const getConfigScaffold = (build, resources) => {
     bucketName: process.env.HOT_UPDATER_CLOUDFLARE_R2_BUCKET_NAME!,
     accountId: process.env.HOT_UPDATER_CLOUDFLARE_ACCOUNT_ID!,
     credentials: {
-      accessKeyId: process.env.HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID!,
-      secretAccessKey: process.env.HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY!,
+      accessKeyId: secret("HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID"),
+      secretAccessKey: secret("HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY"),
     },
   })`
 	}).setDatabase({
@@ -11451,8 +11452,11 @@ const getConfigScaffold = (build, resources) => {
 		configString: `d1Database({
     databaseId: process.env.HOT_UPDATER_CLOUDFLARE_D1_DATABASE_ID!,
     accountId: process.env.HOT_UPDATER_CLOUDFLARE_ACCOUNT_ID!,
-    cloudflareApiToken: process.env.HOT_UPDATER_CLOUDFLARE_API_TOKEN!,
+    cloudflareApiToken: secret("HOT_UPDATER_CLOUDFLARE_API_TOKEN"),
   })`
+	}).addImport({
+		pkg: "hot-updater",
+		named: ["secret"]
 	}));
 	const accountId = JSON.stringify(resources.accountId);
 	const storageConfig = {
@@ -11463,12 +11467,9 @@ const getConfigScaffold = (build, resources) => {
 		configString: `r2Storage({
     bucketName: ${JSON.stringify(resources.bucketName)},
     accountId: ${accountId},
-    credentials: async () => {
-      const env = await storageSecrets();
-      return {
-        accessKeyId: env.HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID,
-        secretAccessKey: env.HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY,
-      };
+    credentials: {
+      accessKeyId: secret("HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID"),
+      secretAccessKey: secret("HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY"),
     },
   })`
 	};
@@ -11480,15 +11481,13 @@ const getConfigScaffold = (build, resources) => {
 		configString: `d1Database({
     databaseId: ${JSON.stringify(resources.d1DatabaseId)},
     accountId: ${accountId},
-    cloudflareApiToken: async () =>
-      (await databaseSecrets()).HOT_UPDATER_CLOUDFLARE_API_TOKEN,
+    cloudflareApiToken: secret("HOT_UPDATER_CLOUDFLARE_API_TOKEN"),
   })`
 	};
-	const helperStatements = [secretEnvHelper("storageSecrets", ["HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID", "HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY"]), secretEnvHelper("databaseSecrets", ["HOT_UPDATER_CLOUDFLARE_API_TOKEN"])];
 	return createHotUpdaterConfigScaffoldFromBuilder(builder.setStorage(storageConfig).setDatabase(databaseConfig).addImport({
 		pkg: "hot-updater",
-		named: ["secretEnv"]
-	}).setIntermediateCode(helperStatements.map(({ code }) => code).join("\n\n")), { helperStatements });
+		named: ["secret"]
+	}));
 };
 //#endregion
 //#region iac/managedWorker.ts

package/dist/worker/index.cjs

@@ -121,8 +121,11 @@ const presignR2GetUrl = async ({ accountId, bucketName, credentials, expiresInSe
 //#region src/r2WorkerStorage.ts
 /** Devices download right after the update check that returns the URL. */
 const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
+/** Keys the binding deletes in one call. */
+const DELETE_BATCH_SIZE = 1e3;
 function r2WorkerStorage(config) {
 	const getStorageKey = (0, _hot_updater_plugin_core.createStorageKeyBuilder)(config.basePath);
+	const basePrefix = getStorageKey() ? `${getStorageKey()}/` : "";
 	const parseAndValidate = (storageUri) => {
 		const parsed = (0, _hot_updater_plugin_core.parseStorageUri)(storageUri, "r2");
 		if (parsed.bucket !== config.bucketName) throw new Error(`Bucket name mismatch: expected "${config.bucketName}", but found "${parsed.bucket}".`);
@@ -178,6 +181,42 @@ function r2WorkerStorage(config) {
 			const { key } = parseAndValidate(storageUri);
 			await config.bucket.delete(key);
 			return { deleted: true };
+		},
+		async listObjects(prefix) {
+			const folder = getStorageKey(prefix ?? "");
+			const objects = [];
+			let cursor;
+			do {
+				const listed = await config.bucket.list({
+					prefix: folder ? `${folder}/` : "",
+					...cursor === void 0 ? {} : { cursor }
+				});
+				for (const object of listed.objects) {
+					if (!object.key.startsWith(basePrefix)) continue;
+					let storageUri;
+					try {
+						storageUri = (0, _hot_updater_plugin_core.createStorageUri)({
+							protocol: "r2",
+							bucket: config.bucketName,
+							key: object.key
+						});
+					} catch {
+						continue;
+					}
+					objects.push({
+						key: object.key.slice(basePrefix.length),
+						lastModifiedAt: object.uploaded,
+						size: object.size,
+						storageUri
+					});
+				}
+				cursor = listed.truncated ? listed.cursor : void 0;
+			} while (cursor !== void 0);
+			return objects;
+		},
+		async deleteObjects(relativeKeys) {
+			const keys = relativeKeys.map((key) => getStorageKey(key));
+			for (let offset = 0; offset < keys.length; offset += DELETE_BATCH_SIZE) await config.bucket.delete(keys.slice(offset, offset + DELETE_BATCH_SIZE));
 		}
 	});
 }

package/dist/worker/index.d.cts

@@ -48,6 +48,7 @@ type CloudflareWorkerStorageConfig = {
   readonly accountId?: undefined;
   readonly credentials?: undefined;
 });
+type R2WorkerOperations = "put" | "get" | "exists" | "delete" | "listObjects" | "deleteObjects";
 /**
  * Storage on the Worker's R2 binding. With R2's S3-compatible credentials,
  * its download URLs are presigned and devices download from the bucket;
@@ -56,7 +57,7 @@ type CloudflareWorkerStorageConfig = {
  */
 declare function r2WorkerStorage(config: CloudflareWorkerStorageConfig & {
   readonly credentials: R2Credentials;
-}): StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
-declare function r2WorkerStorage(config: CloudflareWorkerStorageConfig): StorageAdapterWith<"put" | "get" | "exists" | "delete">;
+}): StorageAdapterWith<R2WorkerOperations | "getDownloadUrl">;
+declare function r2WorkerStorage(config: CloudflareWorkerStorageConfig): StorageAdapterWith<R2WorkerOperations>;
 //#endregion
 export { type CloudflareWorkerStorageConfig, type D1Like, d1Database, r2WorkerStorage as r2Storage };

package/dist/worker/index.d.mts

@@ -48,6 +48,7 @@ type CloudflareWorkerStorageConfig = {
   readonly accountId?: undefined;
   readonly credentials?: undefined;
 });
+type R2WorkerOperations = "put" | "get" | "exists" | "delete" | "listObjects" | "deleteObjects";
 /**
  * Storage on the Worker's R2 binding. With R2's S3-compatible credentials,
  * its download URLs are presigned and devices download from the bucket;
@@ -56,7 +57,7 @@ type CloudflareWorkerStorageConfig = {
  */
 declare function r2WorkerStorage(config: CloudflareWorkerStorageConfig & {
   readonly credentials: R2Credentials;
-}): StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
-declare function r2WorkerStorage(config: CloudflareWorkerStorageConfig): StorageAdapterWith<"put" | "get" | "exists" | "delete">;
+}): StorageAdapterWith<R2WorkerOperations | "getDownloadUrl">;
+declare function r2WorkerStorage(config: CloudflareWorkerStorageConfig): StorageAdapterWith<R2WorkerOperations>;
 //#endregion
 export { type CloudflareWorkerStorageConfig, type D1Like, d1Database, r2WorkerStorage as r2Storage };

package/dist/worker/index.mjs

@@ -120,8 +120,11 @@ const presignR2GetUrl = async ({ accountId, bucketName, credentials, expiresInSe
 //#region src/r2WorkerStorage.ts
 /** Devices download right after the update check that returns the URL. */
 const PRESIGNED_URL_EXPIRES_IN_SECONDS = 3600;
+/** Keys the binding deletes in one call. */
+const DELETE_BATCH_SIZE = 1e3;
 function r2WorkerStorage(config) {
 	const getStorageKey = createStorageKeyBuilder(config.basePath);
+	const basePrefix = getStorageKey() ? `${getStorageKey()}/` : "";
 	const parseAndValidate = (storageUri) => {
 		const parsed = parseStorageUri(storageUri, "r2");
 		if (parsed.bucket !== config.bucketName) throw new Error(`Bucket name mismatch: expected "${config.bucketName}", but found "${parsed.bucket}".`);
@@ -177,6 +180,42 @@ function r2WorkerStorage(config) {
 			const { key } = parseAndValidate(storageUri);
 			await config.bucket.delete(key);
 			return { deleted: true };
+		},
+		async listObjects(prefix) {
+			const folder = getStorageKey(prefix ?? "");
+			const objects = [];
+			let cursor;
+			do {
+				const listed = await config.bucket.list({
+					prefix: folder ? `${folder}/` : "",
+					...cursor === void 0 ? {} : { cursor }
+				});
+				for (const object of listed.objects) {
+					if (!object.key.startsWith(basePrefix)) continue;
+					let storageUri;
+					try {
+						storageUri = createStorageUri({
+							protocol: "r2",
+							bucket: config.bucketName,
+							key: object.key
+						});
+					} catch {
+						continue;
+					}
+					objects.push({
+						key: object.key.slice(basePrefix.length),
+						lastModifiedAt: object.uploaded,
+						size: object.size,
+						storageUri
+					});
+				}
+				cursor = listed.truncated ? listed.cursor : void 0;
+			} while (cursor !== void 0);
+			return objects;
+		},
+		async deleteObjects(relativeKeys) {
+			const keys = relativeKeys.map((key) => getStorageKey(key));
+			for (let offset = 0; offset < keys.length; offset += DELETE_BATCH_SIZE) await config.bucket.delete(keys.slice(offset, offset + DELETE_BATCH_SIZE));
 		}
 	});
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hot-updater/cloudflare",
   "type": "module",
-  "version": "1.2.0-rc.7",
+  "version": "1.2.0-rc.9",
   "description": "React Native OTA solution for self-hosted",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -49,18 +49,19 @@
     "package.json"
   ],
   "dependencies": {
-    "@aws-sdk/client-s3": "3.1066.0",
-    "@aws-sdk/lib-storage": "3.1008.0",
-    "@aws-sdk/s3-request-presigner": "3.1066.0",
     "cloudflare": "4.2.0",
     "hono": "4.12.34",
     "uuidv7": "^1.0.2",
-    "@hot-updater/cli-tools": "1.2.0-rc.7",
-    "@hot-updater/protocol": "1.2.0-rc.7",
-    "@hot-updater/plugin-core": "1.2.0-rc.7",
-    "@hot-updater/server": "1.2.0-rc.7"
+    "@hot-updater/cli-tools": "1.2.0-rc.9",
+    "@hot-updater/protocol": "1.2.0-rc.9",
+    "@hot-updater/plugin-core": "1.2.0-rc.9",
+    "@hot-updater/server": "1.2.0-rc.9",
+    "@hot-updater/storage-s3": "1.2.0-rc.9"
   },
   "devDependencies": {
+    "@aws-sdk/client-s3": "3.1066.0",
+    "@aws-sdk/lib-storage": "3.1066.0",
+    "@aws-sdk/s3-request-presigner": "3.1066.0",
     "@cloudflare/vitest-pool-workers": "0.13.0",
     "@cloudflare/workers-types": "^4.20260312.1",
     "@types/node": "^20",
@@ -74,7 +75,7 @@
     "vitest": "4.1.4",
     "wrangler": "^4.69.0",
     "xdg-app-paths": "^8.3.0",
-    "@hot-updater/test-utils": "1.2.0-rc.7"
+    "@hot-updater/test-utils": "1.2.0-rc.9"
   },
   "scripts": {
     "build": "tsdown && pnpm build:worker",