@awsless/cli 0.0.46-local.44 → 0.0.46-local.46

package/dist/bin.js

@@ -152670,10 +152670,290 @@ class TypeObject {
   }
 }
 
+// src/feature/auth/dev.ts
+import {
+  AdminAddUserToGroupCommand,
+  AdminCreateUserCommand,
+  AdminGetUserCommand,
+  AdminListGroupsForUserCommand,
+  AdminRemoveUserFromGroupCommand,
+  AdminSetUserPasswordCommand,
+  CognitoIdentityProviderClient,
+  ListUserPoolClientsCommand,
+  ListUserPoolsCommand,
+  ListUsersCommand,
+  UserNotFoundException,
+  UsernameExistsException
+} from "@aws-sdk/client-cognito-identity-provider";
+var authOnDev = async (ctx) => {
+  const ids = Object.keys(ctx.appConfig.auth ?? {});
+  if (ids.length === 0) {
+    return;
+  }
+  const pools = await ctx.keep("auth:pull", [...ids].sort().join(","), async () => {
+    const values = {};
+    try {
+      ctx.log(`Resolving ${ids.length} auth userpool${ids.length === 1 ? "" : "s"} from Cognito...`);
+      const credentials2 = await getCredentials(ctx.appConfig.profile);
+      const client = new CognitoIdentityProviderClient({
+        region: ctx.appConfig.region,
+        credentials: credentials2
+      });
+      let timer;
+      const timeout = new Promise((_3, reject) => {
+        timer = setTimeout(() => reject(new Error("the lookup timed out after 15s")), 15000);
+      });
+      const resolve2 = async () => {
+        const poolIdsByName = {};
+        let token;
+        do {
+          const result = await client.send(new ListUserPoolsCommand({
+            MaxResults: 60,
+            NextToken: token
+          }));
+          for (const pool of result.UserPools ?? []) {
+            if (pool.Name && pool.Id) {
+              poolIdsByName[pool.Name] = pool.Id;
+            }
+          }
+          token = result.NextToken;
+        } while (token);
+        for (const id of ids) {
+          const name = formatGlobalResourceName({
+            appName: ctx.appConfig.name,
+            resourceType: "auth",
+            resourceName: id
+          });
+          const userPoolId = poolIdsByName[name];
+          if (!userPoolId) {
+            ctx.log(`The auth userpool "${id}" isn't deployed yet - its login won't work locally.`);
+            continue;
+          }
+          const clients = await client.send(new ListUserPoolClientsCommand({
+            UserPoolId: userPoolId,
+            MaxResults: 60
+          }));
+          const appClient = clients.UserPoolClients?.find((client2) => client2.ClientName === name) ?? clients.UserPoolClients?.[0];
+          if (!appClient?.ClientId) {
+            ctx.log(`The auth userpool "${id}" has no client - its login won't work locally.`);
+            continue;
+          }
+          values[id] = {
+            userPoolId,
+            clientId: appClient.ClientId
+          };
+        }
+      };
+      await Promise.race([resolve2(), timeout]).finally(() => clearTimeout(timer));
+    } catch (error3) {
+      debug("Auth userpool lookup failed", error3);
+      ctx.log(`Couldn't resolve the auth userpools from Cognito (${error3 instanceof Error ? error3.message : String(error3)}) - logins won't work locally.`);
+    }
+    return { value: values, stop: () => {} };
+  });
+  for (const [id, pool] of Object.entries(pools)) {
+    ctx.addEnv(`AUTH_${constantCase(id)}_USER_POOL_ID`, pool.userPoolId);
+    ctx.addEnv(`AUTH_${constantCase(id)}_CLIENT_ID`, pool.clientId);
+  }
+  for (const id of ids) {
+    ctx.registerResource({
+      kind: "auth",
+      id,
+      detail: pools[id]?.userPoolId ?? "not deployed"
+    });
+  }
+};
+var createAuthAdmin = (props) => {
+  let client;
+  const getClient = async () => {
+    client ??= new CognitoIdentityProviderClient({
+      region: props.appConfig.region,
+      credentials: await getCredentials(props.appConfig.profile)
+    });
+    return client;
+  };
+  const getPool = (id) => {
+    const authProps = props.appConfig.auth?.[id];
+    const resolved = props.resolvedPools()?.[id];
+    if (!authProps) {
+      throw new Error(`The auth userpool "${id}" doesn't exist.`);
+    }
+    if (!resolved) {
+      throw new Error(`The auth userpool "${id}" isn't deployed yet.`);
+    }
+    return { ...authProps, userPoolId: resolved.userPoolId };
+  };
+  const validatePassword = (pool, value) => {
+    if (!value) {
+      return "A password is required";
+    }
+    if (value.length < pool.password.minLength) {
+      return `The password min length is ${pool.password.minLength}`;
+    }
+    if (pool.password.lowercase && value.toUpperCase() === value) {
+      return `The password should include lowercase characters`;
+    }
+    if (pool.password.uppercase && value.toLowerCase() === value) {
+      return `The password should include uppercase characters`;
+    }
+    if (pool.password.numbers && !/\d/.test(value)) {
+      return `The password should include numbers`;
+    }
+    if (pool.password.symbols && !/[ `!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?~]/.test(value)) {
+      return `The password should include symbols`;
+    }
+    return;
+  };
+  const validateGroups = (pool, groups) => {
+    for (const group4 of groups) {
+      if (!pool.groups.includes(group4)) {
+        throw new Error(`The group "${group4}" doesn't exist.`);
+      }
+    }
+  };
+  const listUserGroups = async (userPoolId, username) => {
+    const client2 = await getClient();
+    const groups = [];
+    let token;
+    do {
+      const result = await client2.send(new AdminListGroupsForUserCommand({
+        UserPoolId: userPoolId,
+        Username: username,
+        NextToken: token
+      }));
+      groups.push(...result.Groups?.map((group4) => group4.GroupName) ?? []);
+      token = result.NextToken;
+    } while (token);
+    return groups;
+  };
+  return {
+    describePool(id) {
+      const pool = getPool(id);
+      return {
+        groups: pool.groups,
+        password: pool.password
+      };
+    },
+    async listUsers(id) {
+      const pool = getPool(id);
+      const client2 = await getClient();
+      const users = [];
+      let token;
+      do {
+        const result = await client2.send(new ListUsersCommand({
+          UserPoolId: pool.userPoolId,
+          PaginationToken: token
+        }));
+        for (const user of result.Users ?? []) {
+          users.push({
+            username: user.Username,
+            email: user.Attributes?.find((a3) => a3.Name === "email")?.Value,
+            status: user.UserStatus,
+            enabled: user.Enabled ?? true,
+            createdAt: user.UserCreateDate?.toISOString(),
+            groups: []
+          });
+        }
+        token = result.PaginationToken;
+      } while (token && users.length < 500);
+      await Promise.all(users.map(async (user) => {
+        user.groups = await listUserGroups(pool.userPoolId, user.username);
+      }));
+      return users.sort((a3, b5) => a3.username.localeCompare(b5.username));
+    },
+    async createUser(id, input) {
+      const pool = getPool(id);
+      if (!input.username) {
+        throw new Error("A username is required");
+      }
+      const issue = validatePassword(pool, input.password);
+      if (issue) {
+        throw new Error(issue);
+      }
+      validateGroups(pool, input.groups);
+      const client2 = await getClient();
+      try {
+        await client2.send(new AdminCreateUserCommand({
+          UserPoolId: pool.userPoolId,
+          Username: input.username,
+          TemporaryPassword: input.password
+        }));
+      } catch (error3) {
+        if (error3 instanceof UsernameExistsException) {
+          throw new Error("The user already exists");
+        }
+        throw error3;
+      }
+      await client2.send(new AdminSetUserPasswordCommand({
+        UserPoolId: pool.userPoolId,
+        Username: input.username,
+        Password: input.password,
+        Permanent: true
+      }));
+      for (const group4 of input.groups) {
+        await client2.send(new AdminAddUserToGroupCommand({
+          UserPoolId: pool.userPoolId,
+          Username: input.username,
+          GroupName: group4
+        }));
+      }
+    },
+    async updateUser(id, input) {
+      const pool = getPool(id);
+      validateGroups(pool, input.groups);
+      if (input.password) {
+        const issue = validatePassword(pool, input.password);
+        if (issue) {
+          throw new Error(issue);
+        }
+      }
+      const client2 = await getClient();
+      let oldGroups;
+      try {
+        await client2.send(new AdminGetUserCommand({
+          UserPoolId: pool.userPoolId,
+          Username: input.username
+        }));
+        oldGroups = await listUserGroups(pool.userPoolId, input.username);
+      } catch (error3) {
+        if (error3 instanceof UserNotFoundException) {
+          throw new Error("The user does not exist");
+        }
+        throw error3;
+      }
+      if (input.password) {
+        await client2.send(new AdminSetUserPasswordCommand({
+          UserPoolId: pool.userPoolId,
+          Username: input.username,
+          Password: input.password,
+          Permanent: true
+        }));
+      }
+      const removed = oldGroups.filter((group4) => !input.groups.includes(group4));
+      const added = input.groups.filter((group4) => !oldGroups.includes(group4));
+      for (const group4 of removed) {
+        await client2.send(new AdminRemoveUserFromGroupCommand({
+          UserPoolId: pool.userPoolId,
+          Username: input.username,
+          GroupName: group4
+        }));
+      }
+      for (const group4 of added) {
+        await client2.send(new AdminAddUserToGroupCommand({
+          UserPoolId: pool.userPoolId,
+          Username: input.username,
+          GroupName: group4
+        }));
+      }
+    }
+  };
+};
+
 // src/feature/auth/index.ts
 import { toDays as toDays4, toHours } from "@awsless/duration";
 var authFeature = defineFeature({
   name: "auth",
+  onDev: authOnDev,
   async onTypeGen(ctx) {
     const gen = new TypeFile("awsless");
     const resources = new TypeObject(1);
@@ -154743,6 +155023,9 @@ var decodeAwsChunked = (body) => {
   }
   return Buffer.concat(chunks);
 };
+var stripAnsi2 = (line) => {
+  return line.replaceAll(/\x1b\[[0-9;?]*[a-zA-Z]/g, "");
+};
 
 // src/dev/servers/ssm.ts
 var createSsmServer = (props) => {
@@ -157981,7 +158264,20 @@ var startDevRouter = async (props) => {
       }
       const body = Buffer.from(await request.arrayBuffer());
       const sourceIp = server2.requestIP(request)?.address ?? "127.0.0.1";
-      const result = await props.dispatch(formatWebEvent(request, route, body, url, sourceIp));
+      let result;
+      try {
+        result = await props.dispatch(formatWebEvent(request, route, body, url, sourceIp));
+      } catch (error3) {
+        props.onError?.(error3, route.routeKey);
+        const detail = error3 instanceof Error ? error3.stack ?? error3.message : String(error3);
+        return new Response(`500: Internal Error
+
+${route.routeKey}
+${detail}`, {
+          status: 500,
+          headers: { "content-type": "text/plain" }
+        });
+      }
       return toResponse(result);
     },
     websocket: {
@@ -158766,7 +159062,7 @@ var planStaticRoutes = (files, sitePath) => {
 };
 
 // src/feature/site/dev.ts
-var stripAnsi2 = (line) => {
+var stripAnsi3 = (line) => {
   return line.replaceAll(/\x1b\[[0-9;?]*[a-zA-Z]/g, "");
 };
 var binPath = (from) => {
@@ -158819,7 +159115,7 @@ var siteOnDev = async (ctx) => {
               const capture = (chunk3) => {
                 for (const raw of chunk3.toString().split(`
 `)) {
-                  const line = stripAnsi2(raw);
+                  const line = stripAnsi3(raw);
                   if (line.trim() === "") {
                     continue;
                   }
@@ -162623,7 +162919,7 @@ var routerFeature = defineFeature({
       for (const [id, patterns] of Object.entries(stackConfig.routes ?? {})) {
         for (const pattern of Object.keys(patterns)) {
           const slug = kebabCase(pattern).slice(0, 20);
-          const routeKey = formatRouteKey(stackConfig.name, "route", `${slug || "root"}-${shortId(`${id}:${pattern}`)}`);
+          const routeKey = formatRouteKey(stackConfig.name, "route", `${slug || "root"}-${shortId(pattern)}`);
           ctx.addRoute({
             routerId: id,
             pattern,
@@ -164582,11 +164878,11 @@ var deploy = (program3) => {
 
 // src/cli/command/auth/user/create.ts
 import {
-  AdminAddUserToGroupCommand,
-  AdminCreateUserCommand,
-  AdminSetUserPasswordCommand,
-  CognitoIdentityProviderClient,
-  UsernameExistsException
+  AdminAddUserToGroupCommand as AdminAddUserToGroupCommand2,
+  AdminCreateUserCommand as AdminCreateUserCommand2,
+  AdminSetUserPasswordCommand as AdminSetUserPasswordCommand2,
+  CognitoIdentityProviderClient as CognitoIdentityProviderClient2,
+  UsernameExistsException as UsernameExistsException2
 } from "@aws-sdk/client-cognito-identity-provider";
 var create = (program3) => {
   program3.command("create").description("Create an user in your userpool").option("--pool <name>", "The auth userpool name").option("--username <username>", "The username for the new user").option("--password <password>", "The password for the new user").option("--groups <groups...>", "The groups to add the new user to").action(async (options) => {
@@ -164724,7 +165020,7 @@ var create = (program3) => {
           }))
         });
       }
-      const client = new CognitoIdentityProviderClient({
+      const client = new CognitoIdentityProviderClient2({
         region,
         credentials: credentials2
       });
@@ -164734,18 +165030,18 @@ var create = (program3) => {
         errorMessage: "Failed creating user.",
         async task() {
           try {
-            await client.send(new AdminCreateUserCommand({
+            await client.send(new AdminCreateUserCommand2({
               UserPoolId: userPoolId,
               Username: username,
               TemporaryPassword: password2
             }));
           } catch (error3) {
-            if (error3 instanceof UsernameExistsException) {
+            if (error3 instanceof UsernameExistsException2) {
               throw new ExpectedError("User already exists");
             }
             throw error3;
           }
-          await client.send(new AdminSetUserPasswordCommand({
+          await client.send(new AdminSetUserPasswordCommand2({
             UserPoolId: userPoolId,
             Username: username,
             Password: password2,
@@ -164753,7 +165049,7 @@ var create = (program3) => {
           }));
           if (groups.length > 0) {
             for (const group4 of groups) {
-              await client.send(new AdminAddUserToGroupCommand({
+              await client.send(new AdminAddUserToGroupCommand2({
                 UserPoolId: userPoolId,
                 Username: username,
                 GroupName: group4
@@ -164768,13 +165064,13 @@ var create = (program3) => {
 
 // src/cli/command/auth/user/update.ts
 import {
-  AdminAddUserToGroupCommand as AdminAddUserToGroupCommand2,
-  AdminGetUserCommand,
-  AdminListGroupsForUserCommand,
-  AdminRemoveUserFromGroupCommand,
-  AdminSetUserPasswordCommand as AdminSetUserPasswordCommand2,
-  CognitoIdentityProviderClient as CognitoIdentityProviderClient2,
-  UserNotFoundException
+  AdminAddUserToGroupCommand as AdminAddUserToGroupCommand3,
+  AdminGetUserCommand as AdminGetUserCommand2,
+  AdminListGroupsForUserCommand as AdminListGroupsForUserCommand2,
+  AdminRemoveUserFromGroupCommand as AdminRemoveUserFromGroupCommand2,
+  AdminSetUserPasswordCommand as AdminSetUserPasswordCommand3,
+  CognitoIdentityProviderClient as CognitoIdentityProviderClient3,
+  UserNotFoundException as UserNotFoundException2
 } from "@aws-sdk/client-cognito-identity-provider";
 var update = (program3) => {
   program3.command("update").description("Update an user in your userpool").option("--pool <name>", "The auth userpool name").option("--username <username>", "The username of the user").option("--password <password>", "The new password for the user").option("--groups <groups...>", "The groups the user should be in, replacing the current groups").action(async (options) => {
@@ -164861,7 +165157,7 @@ var update = (program3) => {
           }
         });
       }
-      const client = new CognitoIdentityProviderClient2({
+      const client = new CognitoIdentityProviderClient3({
         region,
         credentials: credentials2
       });
@@ -164871,12 +165167,12 @@ var update = (program3) => {
         errorMessage: `Failed fetching user info.`,
         async task() {
           try {
-            await client.send(new AdminGetUserCommand({
+            await client.send(new AdminGetUserCommand2({
               UserPoolId: userPoolId,
               Username: username
             }));
           } catch (error3) {
-            if (error3 instanceof UserNotFoundException) {
+            if (error3 instanceof UserNotFoundException2) {
               throw new ExpectedError("User does not exist");
             }
             throw error3;
@@ -164884,7 +165180,7 @@ var update = (program3) => {
           const groups = [];
           let token;
           do {
-            const result = await client.send(new AdminListGroupsForUserCommand({
+            const result = await client.send(new AdminListGroupsForUserCommand2({
               UserPoolId: userPoolId,
               Username: username,
               NextToken: token
@@ -164958,7 +165254,7 @@ var update = (program3) => {
         errorMessage: "Failed updating user.",
         async task() {
           if (password2) {
-            await client.send(new AdminSetUserPasswordCommand2({
+            await client.send(new AdminSetUserPasswordCommand3({
               UserPoolId: userPoolId,
               Username: username,
               Password: password2,
@@ -164970,14 +165266,14 @@ var update = (program3) => {
           const removedGroups = oldGroupSet.difference(newGroupSet);
           const addedGroups = newGroupSet.difference(oldGroupSet);
           for (const group4 of removedGroups) {
-            await client.send(new AdminRemoveUserFromGroupCommand({
+            await client.send(new AdminRemoveUserFromGroupCommand2({
               UserPoolId: userPoolId,
               Username: username,
               GroupName: group4
             }));
           }
           for (const group4 of addedGroups) {
-            await client.send(new AdminAddUserToGroupCommand2({
+            await client.send(new AdminAddUserToGroupCommand3({
               UserPoolId: userPoolId,
               Username: username,
               GroupName: group4
@@ -164992,8 +165288,8 @@ var update = (program3) => {
 // src/cli/command/auth/user/delete.ts
 import {
   AdminDeleteUserCommand,
-  CognitoIdentityProviderClient as CognitoIdentityProviderClient3,
-  UserNotFoundException as UserNotFoundException2
+  CognitoIdentityProviderClient as CognitoIdentityProviderClient4,
+  UserNotFoundException as UserNotFoundException3
 } from "@aws-sdk/client-cognito-identity-provider";
 var del10 = (program3) => {
   program3.command("delete").description("Delete an user from your userpool").option("--pool <name>", "The auth userpool name").option("--username <username>", "The username of the user to delete").action(async (options) => {
@@ -165069,7 +165365,7 @@ var del10 = (program3) => {
           throw new Cancelled;
         }
       }
-      const client = new CognitoIdentityProviderClient3({
+      const client = new CognitoIdentityProviderClient4({
         region,
         credentials: credentials2
       });
@@ -165084,7 +165380,7 @@ var del10 = (program3) => {
               Username: username
             }));
           } catch (error3) {
-            if (error3 instanceof UserNotFoundException2) {
+            if (error3 instanceof UserNotFoundException3) {
               throw new ExpectedError(`User doesn't exist`);
             }
             throw error3;
@@ -166419,8 +166715,18 @@ var createBundleWorker = (props) => {
         AWSLESS_DEV_WORKER_PORT: String(port)
       }
     });
-    child.stdout?.on("data", (chunk3) => process.stdout.write(chunk3));
-    child.stderr?.on("data", (chunk3) => process.stderr.write(chunk3));
+    const capture = (stream2) => (chunk3) => {
+      process[stream2].write(chunk3);
+      for (const raw of chunk3.toString().split(`
+`)) {
+        const line = stripAnsi2(raw);
+        if (line.trim() !== "") {
+          props.onOutput?.(line, stream2);
+        }
+      }
+    };
+    child.stdout?.on("data", capture("stdout"));
+    child.stderr?.on("data", capture("stderr"));
     child.on("exit", (code) => {
       if (code !== null && code !== 0) {
         debug(`Bundle worker exited with code ${code}`);
@@ -166527,6 +166833,7 @@ var dashboardHtml = `<!doctype html>
 	.logs .line { display: flex; gap: 8px; padding: 1px 0; }
 	.logs .time { color: var(--muted); flex-shrink: 0; }
 	.logs .text { white-space: pre-wrap; word-break: break-word; }
+	.logs .line.error .text { color: var(--bad); }
 	.config-form { display: flex; flex-direction: column; gap: 8px; max-width: 520px; }
 	.config-form .field { display: grid; grid-template-columns: 180px 1fr; gap: 12px; align-items: center; }
 	.config-form .name { color: var(--muted); overflow-wrap: anywhere; }
@@ -166539,6 +166846,8 @@ var dashboardHtml = `<!doctype html>
 		font: inherit;
 	}
 	.config-form input::placeholder { color: var(--muted); }
+	.groups { display: flex; flex-wrap: wrap; gap: 4px 16px; }
+	.groups .group { display: flex; align-items: center; gap: 4px; cursor: pointer; }
 	nav {
 		border-right: 1px solid var(--border);
 		overflow-y: auto;
@@ -166756,7 +167065,9 @@ const GROUPS = [
 	['search', 'Searches'],
 	['store', 'Stores'],
 	['config', 'Config'],
+	['auth', 'Auth'],
 	['email', 'Emails'],
+	['worker', 'Worker'],
 	['route', 'Routes'],
 ]
 
@@ -167042,7 +167353,7 @@ const attachLogFeed = (main, channel) => {
 		const data = JSON.parse(message.data)
 
 		feed.querySelector('.empty')?.remove()
-		feed.append($('div', { className: 'line' }, [
+		feed.append($('div', { className: 'line' + (data.error ? ' error' : '') }, [
 			$('span', { className: 'time' }, new Date(data.date).toLocaleTimeString()),
 			$('span', { className: 'text' }, data.line),
 		]))
@@ -167372,6 +167683,138 @@ const configPanel = async (main) => {
 	main.append(form, $('div', { className: 'actions' }, [save, status]))
 }
 
+// The users of a real deployed auth pool, with the same create &
+// group-update operations as the auth user cli commands.
+const authPanel = async (main, r) => {
+	const holder = $('div', {}, $('p', { className: 'empty' }, 'Loading users...'))
+	main.append(holder)
+
+	const groupBoxes = (groups, selected) => {
+		const boxes = new Map()
+		const row = $('div', { className: 'groups' })
+
+		for (const group of groups) {
+			const box = $('input', { type: 'checkbox', checked: selected.includes(group) })
+			boxes.set(group, box)
+			row.append($('label', { className: 'group' }, [box, ' ' + group]))
+		}
+
+		return { row, selected: () => [...boxes].filter(([, box]) => box.checked).map(([group]) => group) }
+	}
+
+	try {
+		const data = await api('/api/auth?pool=' + encodeURIComponent(r.id))
+		holder.innerHTML = ''
+
+		// --------------------------------------------------------------
+		// The user list, each row expanding into its group/password form.
+
+		if (data.users.length === 0) {
+			holder.append($('p', { className: 'empty' }, 'The pool has no users.'))
+		} else {
+			const editRow = $('tr', { style: 'display: none' })
+			const table = $('table', {}, [
+				$('tr', {}, ['username', 'email', 'status', 'groups', 'created'].map(c => $('th', {}, c))),
+			])
+
+			for (const user of data.users) {
+				const row = $('tr', {}, [
+					$('td', {}, user.username),
+					$('td', {}, user.email ?? ''),
+					$('td', {}, user.enabled ? (user.status ?? '') : 'DISABLED'),
+					$('td', {}, user.groups.join(', ')),
+					$('td', {}, user.createdAt ? new Date(user.createdAt).toLocaleString() : ''),
+				])
+
+				row.style.cursor = 'pointer'
+				row.onclick = () => {
+					const groups = groupBoxes(data.groups, user.groups)
+					const password = $('input', { type: 'password', placeholder: 'unchanged', spellcheck: false })
+					const status = $('span', { className: 'status' })
+					const save = $('button', { className: 'primary', textContent: 'Save' })
+
+					save.onclick = async () => {
+						save.disabled = true
+						try {
+							await api('/api/auth/update', {
+								method: 'POST',
+								body: JSON.stringify({
+									pool: r.id,
+									username: user.username,
+									password: password.value,
+									groups: groups.selected(),
+								}),
+							})
+							main.innerHTML = ''
+							renderResource(main)
+							return
+						} catch (error) {
+							status.textContent = String(error.message ?? error)
+						}
+						save.disabled = false
+					}
+
+					editRow.innerHTML = ''
+					editRow.style.display = ''
+					editRow.append($('td', { colSpan: 5 }, $('div', { className: 'config-form' }, [
+						$('label', { className: 'field' }, [$('span', { className: 'name' }, 'groups'), groups.row]),
+						$('label', { className: 'field' }, [$('span', { className: 'name' }, 'new password'), password]),
+						$('div', { className: 'actions' }, [save, status]),
+					])))
+					row.after(editRow)
+				}
+
+				table.append(row)
+			}
+
+			holder.append(table)
+		}
+
+		// --------------------------------------------------------------
+		// Create a new user.
+
+		const username = $('input', { placeholder: 'username', spellcheck: false })
+		const password = $('input', { type: 'password', placeholder: 'password', spellcheck: false })
+		const groups = groupBoxes(data.groups, [])
+		const status = $('span', { className: 'status' })
+		const create = $('button', { className: 'primary', textContent: 'Create user' })
+
+		create.onclick = async () => {
+			create.disabled = true
+			try {
+				await api('/api/auth/create', {
+					method: 'POST',
+					body: JSON.stringify({
+						pool: r.id,
+						username: username.value,
+						password: password.value,
+						groups: groups.selected(),
+					}),
+				})
+				main.innerHTML = ''
+				renderResource(main)
+				return
+			} catch (error) {
+				status.textContent = String(error.message ?? error)
+			}
+			create.disabled = false
+		}
+
+		holder.append(
+			$('h3', {}, 'Create user'),
+			$('div', { className: 'config-form' }, [
+				$('label', { className: 'field' }, [$('span', { className: 'name' }, 'username'), username]),
+				$('label', { className: 'field' }, [$('span', { className: 'name' }, 'password'), password]),
+				$('label', { className: 'field' }, [$('span', { className: 'name' }, 'groups'), groups.row]),
+				$('div', { className: 'actions' }, [create, status]),
+			]),
+		)
+	} catch (error) {
+		holder.innerHTML = ''
+		holder.append($('pre', { className: 'result error' }, String(error.message ?? error)))
+	}
+}
+
 const renderResource = main => {
 	const r = view.resource
 	const back = $('button', { className: 'back' }, '\u2190 ' + groupTitle(r.kind))
@@ -167395,6 +167838,7 @@ const renderResource = main => {
 	if (r.kind === 'cache') return cachePanel(main, r)
 	if (r.kind === 'store') return storePanel(main, r)
 	if (r.kind === 'config') return configPanel(main)
+	if (r.kind === 'auth') return authPanel(main, r)
 	if (r.kind === 'route' || r.kind === 'site') {
 		const url = r.url ?? r.detail
 		main.append($('p', {}, $('a', { href: url, target: '_blank', style: 'color: var(--accent)' }, url)))
@@ -167776,6 +168220,36 @@ var createDashboardServer = (props) => {
     if (url.pathname === "/api/emails") {
       return { status: 200, body: JSON.stringify({ emails: props.getEmails?.() ?? [] }) };
     }
+    if (url.pathname.startsWith("/api/auth") && props.auth) {
+      const auth2 = props.auth;
+      try {
+        if (url.pathname === "/api/auth" && req.method === "GET") {
+          const pool = url.searchParams.get("pool") ?? "";
+          return {
+            status: 200,
+            body: JSON.stringify({
+              ...auth2.describePool(pool),
+              users: await auth2.listUsers(pool)
+            })
+          };
+        }
+        if (url.pathname === "/api/auth/create" && req.method === "POST") {
+          const { pool, username, password: password2, groups } = JSON.parse((await readBody3(req)).toString() || "{}");
+          await auth2.createUser(pool, { username, password: password2, groups: groups ?? [] });
+          return { status: 200, body: JSON.stringify({ ok: true }) };
+        }
+        if (url.pathname === "/api/auth/update" && req.method === "POST") {
+          const { pool, username, password: password2, groups } = JSON.parse((await readBody3(req)).toString() || "{}");
+          await auth2.updateUser(pool, { username, password: password2 || undefined, groups: groups ?? [] });
+          return { status: 200, body: JSON.stringify({ ok: true }) };
+        }
+      } catch (error3) {
+        return {
+          status: 400,
+          body: JSON.stringify({ error: error3 instanceof Error ? error3.message : String(error3) })
+        };
+      }
+    }
     if (url.pathname === "/api/config") {
       if (req.method === "PUT") {
         const values2 = JSON.parse((await readBody3(req)).toString() || "{}");
@@ -168160,7 +168634,21 @@ var startDev = async (props) => {
     workspace = await loadWorkspace3(directories.root);
     await buildAll();
   });
-  const worker = createBundleWorker({ buildDir, env: env4, functionName: bundleName });
+  const emitWorkerLine = (line, error3 = false) => {
+    dev.events.emit("worker", { date: Date.now(), line, error: error3 });
+  };
+  const worker = createBundleWorker({
+    buildDir,
+    env: env4,
+    functionName: bundleName,
+    onOutput: (line, stream2) => emitWorkerLine(line, stream2 === "stderr")
+  });
+  dev.resources.push({
+    kind: "worker",
+    id: "bundle",
+    channel: "worker",
+    detail: "The output & errors of the local bundle worker"
+  });
   let dirty = false;
   let fresh;
   let restartNeeded = false;
@@ -168236,7 +168724,13 @@ var startDev = async (props) => {
     routers.push(await startDevRouter({
       routes: dev.routes.filter((route) => route.routerId === id),
       port,
-      dispatch
+      dispatch,
+      onError(error3, routeKey) {
+        const detail = error3 instanceof Error ? error3.stack ?? error3.message : String(error3);
+        process.stderr.write(`Route ${routeKey} failed: ${detail}
+`);
+        emitWorkerLine(`Route ${routeKey} failed: ${detail}`, true);
+      }
     }));
   }
   const dashboardPort = props.port;
@@ -168255,6 +168749,10 @@ var startDev = async (props) => {
     configFile: join54(directories.output, "local", "config.json"),
     getEmails: () => props.pool.peek("shim:ses-email")?.server.list() ?? [],
     configPulled: Object.keys(props.pool.peek("config:pull") ?? {}),
+    auth: createAuthAdmin({
+      appConfig,
+      resolvedPools: () => props.pool.peek("auth:pull")
+    }),
     events: dev.events
   });
   dashboard.connect(dispatch);

package/dist/handlers/bundle.js

@@ -452,7 +452,9 @@ var createBundle = (handlers) => {
         }
         throw new Error("Unknown bundle route: " + match2.key);
       }
-      console.trace(`Bundle route: ${match2.key}`);
+      if (process.env.AWSLESS_ENV !== "local") {
+        console.trace(`Bundle route: ${match2.key}`);
+      }
       process.env.AWSLESS_ROUTE = match2.key;
       return withBundleRouteContext(match2.key, internalInvoke, async () => {
         const handle = await load();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awsless/cli",
-  "version": "0.0.46-local.44",
+  "version": "0.0.46-local.46",
   "license": "MIT",
   "type": "module",
   "sideEffects": false,
@@ -38,19 +38,19 @@
     "@opensearch-project/opensearch": "^2.13.0",
     "rolldown": "1.2.1",
     "vitest": "4.1.10",
-    "@awsless/ts-file-cache": "^0.0.16",
-    "@awsless/dynamodb-server": "^0.1.8"
+    "@awsless/dynamodb-server": "^0.1.8",
+    "@awsless/ts-file-cache": "^0.0.16"
   },
   "peerDependencies": {
     "@awsless/big-float": "^0.1.7",
-    "@awsless/duration": "^0.0.4",
-    "@awsless/lambda": "^0.0.47",
     "@awsless/dynamodb": "^0.3.22",
+    "@awsless/duration": "^0.0.4",
     "@awsless/s3": "^0.0.22",
-    "@awsless/json": "^0.0.11",
+    "@awsless/lambda": "^0.0.47",
     "@awsless/weak-cache": "^0.0.1",
-    "awsless": "^0.0.15-local.11",
-    "@awsless/validate": "^0.1.7"
+    "@awsless/json": "^0.0.11",
+    "@awsless/validate": "^0.1.7",
+    "awsless": "^0.0.15-local.11"
   },
   "devDependencies": {
     "@aws-sdk/client-cloudformation": "^3.369.0",
@@ -120,25 +120,25 @@
     "zip-a-folder": "^3.1.6",
     "zod": "^3.24.2",
     "zod-to-json-schema": "^3.24.3",
-    "@awsless/cloudwatch": "^0.0.1",
     "@awsless/clui": "^0.0.9",
     "@awsless/big-float": "^0.1.7",
-    "@awsless/iot": "^0.0.5",
     "@awsless/duration": "^0.0.4",
+    "@awsless/lambda": "^0.0.47",
     "@awsless/dynamodb": "^0.3.22",
-    "@awsless/json": "^0.0.11",
     "@awsless/open-search": "^0.0.26",
+    "@awsless/iot": "^0.0.5",
+    "@awsless/cloudwatch": "^0.0.1",
+    "@awsless/json": "^0.0.11",
     "@awsless/redis": "^0.1.13",
     "@awsless/s3": "^0.0.22",
+    "@awsless/sqs": "^0.0.24",
     "@awsless/size": "^0.0.2",
+    "@awsless/scheduler": "^0.0.5",
     "@awsless/sns": "^0.0.11",
-    "@awsless/ssm": "^0.0.8",
-    "@awsless/lambda": "^0.0.47",
     "@awsless/validate": "^0.1.7",
+    "awsless": "^0.0.15-local.11",
     "@awsless/weak-cache": "^0.0.1",
-    "@awsless/sqs": "^0.0.24",
-    "@awsless/scheduler": "^0.0.5",
-    "awsless": "^0.0.15-local.11"
+    "@awsless/ssm": "^0.0.8"
   },
   "scripts": {
     "test": "bun cli/build-handlers.ts && pnpm vitest",