@awsless/cli 0.0.46-local.7 → 0.0.46-local.9

package/dist/bin.js

@@ -150257,6 +150257,16 @@ var bootstrapAwsless = async (props) => {
 // src/config/load/load.ts
 import { basename as basename2, dirname as dirname5, join as join13 } from "path";
 
+// src/feature/config/schema.ts
+var ConfigNameSchema = exports_external.string().regex(/^[a-z0-9-]+$/, "Invalid config name");
+var ConfigsSchema = exports_external.array(ConfigNameSchema).optional().describe("Define the config values for your app.");
+var ConfigFileSchema = exports_external.record(ConfigNameSchema, exports_external.union([
+  exports_external.string().describe("A committed default value for the local dev environment."),
+  exports_external.object({
+    secret: exports_external.literal(true).describe("Pulled from ssm into memory on local dev boot, never stored locally.")
+  }).describe("A secret config value.")
+])).describe("The config values of your app.");
+
 // src/config/schema/config-ref.ts
 var ConfigRefSchema = exports_external.string().regex(/^config:[a-z0-9-]+$/, "Invalid config reference");
 var isConfigRef = (value) => {
@@ -150325,10 +150335,6 @@ var AuthDefaultSchema = exports_external.record(ResourceIdSchema, exports_extern
   }).default({}).describe("Specifies the validity duration for every JWT token.")
 })).default({}).describe("Define the authenticatable users in your app.");
 
-// src/feature/config/schema.ts
-var ConfigNameSchema = exports_external.string().regex(/^[a-z0-9-]+$/, "Invalid config name");
-var ConfigsSchema = exports_external.array(ConfigNameSchema).optional().describe("Define the config values for your app.");
-
 // src/feature/domain/schema.ts
 var DomainNameSchema = exports_external.string().regex(/[a-z\-\_\.]/g, "Invalid domain name").describe("Enter a fully qualified domain name, for example, www.example.com. You can optionally include a trailing dot. If you omit the trailing dot, Amazon Route 53 assumes that the domain name that you specify is fully qualified. This means that Route 53 treats www.example.com (without a trailing dot) and www.example.com. (with a trailing dot) as identical.");
 var DNSTypeSchema = exports_external.enum(["A", "AAAA", "CAA", "CNAME", "DS", "MX", "NAPTR", "NS", "PTR", "SOA", "SPF", "SRV", "TXT"]).describe("The DNS record type.");
@@ -152482,8 +152488,32 @@ var loadAppConfig = async (options) => {
   debug("Validate app config file");
   const app = await validateConfig(AppSchema, appConfig.file, appConfig.data);
   app.stage = options.stage;
+  await loadConfigFile(app, root3, options.stage);
   return app;
 };
+var loadConfigFile = async (app, root3, stage) => {
+  const ext2 = ["config.json", "config.jsonc", "config.json5"];
+  const files = await glob(ext2, { cwd: root3 });
+  const file2 = ext2.find((name) => files.includes(name));
+  if (!file2) {
+    return;
+  }
+  debug("Load config file:", color2.info(file2));
+  const config = await readConfigWithStage(join13(root3, file2), stage);
+  const entries2 = await validateConfig(ConfigFileSchema, config.file, config.data);
+  const defaults2 = {};
+  const secrets = [];
+  for (const [name, value] of Object.entries(entries2)) {
+    if (typeof value === "string") {
+      defaults2[name] = value;
+    } else {
+      secrets.push(name);
+    }
+  }
+  app.configs = [...new Set([...app.configs ?? [], ...Object.keys(entries2)])].sort();
+  app.configDefaults = defaults2;
+  app.configSecrets = secrets;
+};
 var loadStackConfigs = async (options) => {
   debug("Load stacks config files");
   const ext2 = "{json,jsonc,json5}";
@@ -154771,6 +154801,9 @@ var createSsmServer = (props) => {
   let closeServer;
   let log;
   const warned2 = new Set;
+  let defaults2 = {};
+  let pulled = {};
+  let secrets = new Set;
   const loadValues = async () => {
     try {
       return JSON.parse(await readFile12(props.file, "utf8"));
@@ -154782,6 +154815,11 @@ var createSsmServer = (props) => {
     connect(logFn) {
       log = logFn;
     },
+    setValues(next) {
+      defaults2 = next.defaults;
+      pulled = next.pulled;
+      secrets = next.secrets;
+    },
     async listen(port = 0) {
       server = createServer2((req, res) => {
         const chunks = [];
@@ -154801,12 +154839,12 @@ var createSsmServer = (props) => {
           const parameters = [];
           for (const name of Names ?? []) {
             const key = name.split("/").at(-1);
-            const value = values[key];
+            const value = values[key] ?? defaults2[key] ?? pulled[key];
             if (typeof value === "string") {
               parameters.push({ Name: name, Type: "SecureString", Value: value });
             } else if (!warned2.has(key)) {
               warned2.add(key);
-              log?.(`The "${key}" config has no local value yet. Set it on the dashboard or in ${props.file}`);
+              log?.(secrets.has(key) ? `The "${key}" config secret has no value - the ssm pull didn't provide one. Set it with "awsless config set ${key}" or override it on the dashboard.` : `The "${key}" config has no local value yet. Set it on the dashboard or add a default in config.jsonc`);
             }
           }
           res.writeHead(200, { "content-type": "application/x-amz-json-1.1" });
@@ -154992,9 +155030,10 @@ var configFeature = defineFeature({
     if (names.size === 0) {
       return;
     }
+    const secrets = new Set(ctx.appConfig.configSecrets ?? []);
     for (const name of names) {
       ctx.addEnv(`CONFIG_${constantCase(name)}`, name);
-      ctx.registerResource({ kind: "config", id: name });
+      ctx.registerResource({ kind: "config", id: name, detail: secrets.has(name) ? "secret" : "" });
     }
     const file2 = join18(directories.output, "local", "config.json");
     const { server, port } = await ctx.keep("shim:ssm", file2, async () => {
@@ -155003,6 +155042,38 @@ var configFeature = defineFeature({
       return { value: { server: server2, port: port2 }, stop: () => server2.stop() };
     });
     ctx.addEnv("AWS_ENDPOINT_URL_SSM", `http://127.0.0.1:${port}`);
+    let pulled = {};
+    if (secrets.size > 0) {
+      pulled = await ctx.keep("config:pull", [...secrets].sort().join(","), async () => {
+        const values = {};
+        try {
+          ctx.log(`Pulling ${secrets.size} config secret${secrets.size === 1 ? "" : "s"} from SSM...`);
+          const credentials2 = await getCredentials(ctx.appConfig.profile);
+          const store = new SsmStore({ credentials: credentials2, appConfig: ctx.appConfig });
+          let timer;
+          const all5 = await Promise.race([
+            store.list(),
+            new Promise((_3, reject) => {
+              timer = setTimeout(() => reject(new Error("the pull timed out after 15s")), 15000);
+            })
+          ]).finally(() => clearTimeout(timer));
+          for (const name of secrets) {
+            if (typeof all5[name] === "string") {
+              values[name] = all5[name];
+            }
+          }
+        } catch (error3) {
+          debug("Config secret pull failed", error3);
+          ctx.log(`Couldn't pull the config secrets from SSM (${error3 instanceof Error ? error3.message : String(error3)}) - secret-backed features will fail when called.`);
+        }
+        return { value: values, stop: () => {} };
+      });
+    }
+    server.setValues({
+      defaults: ctx.appConfig.configDefaults ?? {},
+      pulled,
+      secrets
+    });
     ctx.restartOnChange(file2);
     ctx.registerServer({
       name: "config",
@@ -165788,7 +165859,7 @@ var watchConfig = async (options, resolve5, reject) => {
   await loadAppConfig(options);
   debug("Start watching...");
   const ext2 = "{json,jsonc,json5}";
-  const watcher = $watch([`app.${ext2}`, `**/stack.${ext2}`, `**/*.stack.${ext2}`], {
+  const watcher = $watch([`app.${ext2}`, `config.${ext2}`, `**/stack.${ext2}`, `**/*.stack.${ext2}`], {
     cwd: directories.root,
     ignored: ["**/node_modules/**", "**/dist/**"],
     awaitWriteFinish: true
@@ -167120,12 +167191,25 @@ const configPanel = async (main) => {
 	const names = [...new Set(state.resources.filter(r => r.kind === 'config').map(r => r.id))].sort()
 	const data = await api('/api/config')
 	const values = data.values ?? {}
+	const defaults = data.defaults ?? {}
+	const secrets = new Set(data.secrets ?? [])
 
 	const inputs = new Map()
 	const form = $('div', { className: 'config-form' })
 
 	for (const name of names) {
-		const input = $('input', { value: values[name] ?? '', placeholder: 'not set', spellcheck: false })
+		// An empty input falls through to the committed default or the
+		// pulled ssm secret - the placeholder shows which one carries.
+		const placeholder = secrets.has(name)
+			? 'pulled from ssm'
+			: defaults[name] !== undefined ? 'default: ' + defaults[name] : 'not set'
+
+		const input = $('input', {
+			value: values[name] ?? '',
+			placeholder,
+			spellcheck: false,
+			...(secrets.has(name) ? { type: 'password' } : {}),
+		})
 		inputs.set(name, input)
 		form.append($('label', { className: 'field' }, [$('span', { className: 'name' }, name), input]))
 	}
@@ -167567,7 +167651,14 @@ var createDashboardServer = (props) => {
       try {
         values = JSON.parse(await readFile21(props.configFile, "utf8"));
       } catch (_4) {}
-      return { status: 200, body: JSON.stringify({ values }) };
+      return {
+        status: 200,
+        body: JSON.stringify({
+          values,
+          defaults: props.configMeta?.defaults ?? {},
+          secrets: props.configMeta?.secrets ?? []
+        })
+      };
     }
     return { status: 404, body: JSON.stringify({ error: `Unknown dashboard path: ${url.pathname}` }) };
   };
@@ -167990,6 +168081,10 @@ var startDev = async (props) => {
     env: env4,
     storeRoot: join53(directories.output, "local", "store"),
     configFile: join53(directories.output, "local", "config.json"),
+    configMeta: {
+      defaults: appConfig.configDefaults ?? {},
+      secrets: appConfig.configSecrets ?? []
+    },
     events: dev.events
   });
   dashboard.connect(dispatch);
@@ -168250,7 +168345,7 @@ import { DynamoDBClient as DynamoDBClient6, dynamoDBClient } from "@awsless/dyna
 
 // ../../node_modules/.pnpm/@aws-sdk+client-iot-data-plane@3.1023.0_aws-crt@1.30.0_supports-color@8.1.1_/node_modules/@aws-sdk/client-iot-data-plane/dist-es/IoTDataPlaneClient.js
 var import_core50 = __toESM(require_dist_cjs2(), 1);
-var import_schema67 = __toESM(require_schema(), 1);
+var import_schema68 = __toESM(require_schema(), 1);
 
 // ../../node_modules/.pnpm/@aws-sdk+client-iot-data-plane@3.1023.0_aws-crt@1.30.0_supports-color@8.1.1_/node_modules/@aws-sdk/client-iot-data-plane/dist-es/auth/httpAuthSchemeProvider.js
 var import_httpAuthSchemes4 = __toESM(require_httpAuthSchemes(), 1);
@@ -168456,7 +168551,7 @@ var defaultEndpointResolver3 = (endpointParams, context = {}) => {
 customEndpointFunctions.aws = awsEndpointFunctions;
 
 // ../../node_modules/.pnpm/@aws-sdk+client-iot-data-plane@3.1023.0_aws-crt@1.30.0_supports-color@8.1.1_/node_modules/@aws-sdk/client-iot-data-plane/dist-es/schemas/schemas_0.js
-var import_schema66 = __toESM(require_schema(), 1);
+var import_schema67 = __toESM(require_schema(), 1);
 
 // ../../node_modules/.pnpm/@aws-sdk+client-iot-data-plane@3.1023.0_aws-crt@1.30.0_supports-color@8.1.1_/node_modules/@aws-sdk/client-iot-data-plane/dist-es/models/IoTDataPlaneServiceException.js
 class IoTDataPlaneServiceException extends ServiceException {
@@ -168686,10 +168781,10 @@ var _xamcd = "x-amz-mqtt5-correlation-data";
 var _xampfi = "x-amz-mqtt5-payload-format-indicator";
 var _xamup = "x-amz-mqtt5-user-properties";
 var n03 = "com.amazonaws.iotdataplane";
-var _s_registry3 = import_schema66.TypeRegistry.for(_s3);
+var _s_registry3 = import_schema67.TypeRegistry.for(_s3);
 var IoTDataPlaneServiceException$ = [-3, _s3, "IoTDataPlaneServiceException", 0, [], []];
 _s_registry3.registerError(IoTDataPlaneServiceException$, IoTDataPlaneServiceException);
-var n0_registry3 = import_schema66.TypeRegistry.for(n03);
+var n0_registry3 = import_schema67.TypeRegistry.for(n03);
 var ConflictException$ = [
   -3,
   n03,
@@ -169125,7 +169220,7 @@ class IoTDataPlaneClient extends Client {
     const _config_7 = resolveHttpAuthSchemeConfig3(_config_6);
     const _config_8 = resolveRuntimeExtensions3(_config_7, configuration?.extensions || []);
     this.config = _config_8;
-    this.middlewareStack.use(import_schema67.getSchemaSerdePlugin(this.config));
+    this.middlewareStack.use(import_schema68.getSchemaSerdePlugin(this.config));
     this.middlewareStack.use(getUserAgentPlugin(this.config));
     this.middlewareStack.use(getRetryPlugin(this.config));
     this.middlewareStack.use(getContentLengthPlugin(this.config));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awsless/cli",
-  "version": "0.0.46-local.7",
+  "version": "0.0.46-local.9",
   "license": "MIT",
   "type": "module",
   "sideEffects": false,
@@ -43,14 +43,14 @@
   },
   "peerDependencies": {
     "@awsless/big-float": "^0.1.7",
-    "@awsless/dynamodb": "^0.3.22",
-    "@awsless/lambda": "^0.0.47",
     "@awsless/duration": "^0.0.4",
     "@awsless/json": "^0.0.11",
+    "@awsless/dynamodb": "^0.3.22",
     "@awsless/s3": "^0.0.22",
-    "awsless": "^0.0.15-local.3",
+    "@awsless/lambda": "^0.0.47",
     "@awsless/weak-cache": "^0.0.1",
-    "@awsless/validate": "^0.1.7"
+    "@awsless/validate": "^0.1.7",
+    "awsless": "^0.0.15-local.3"
   },
   "devDependencies": {
     "@aws-sdk/client-cloudformation": "^3.369.0",
@@ -120,25 +120,25 @@
     "zip-a-folder": "^3.1.6",
     "zod": "^3.24.2",
     "zod-to-json-schema": "^3.24.3",
+    "@awsless/big-float": "^0.1.7",
     "@awsless/cloudwatch": "^0.0.1",
     "@awsless/clui": "^0.0.9",
-    "@awsless/big-float": "^0.1.7",
-    "@awsless/dynamodb": "^0.3.22",
     "@awsless/json": "^0.0.11",
     "@awsless/lambda": "^0.0.47",
-    "@awsless/open-search": "^0.0.24",
+    "@awsless/iot": "^0.0.5",
     "@awsless/duration": "^0.0.4",
+    "@awsless/open-search": "^0.0.24",
     "@awsless/redis": "^0.1.13",
-    "@awsless/size": "^0.0.2",
-    "@awsless/iot": "^0.0.5",
-    "@awsless/sqs": "^0.0.24",
-    "@awsless/ssm": "^0.0.8",
-    "@awsless/sns": "^0.0.11",
     "@awsless/s3": "^0.0.22",
+    "@awsless/scheduler": "^0.0.5",
+    "@awsless/sqs": "^0.0.24",
     "@awsless/validate": "^0.1.7",
+    "@awsless/sns": "^0.0.11",
+    "@awsless/ssm": "^0.0.8",
     "@awsless/weak-cache": "^0.0.1",
+    "@awsless/size": "^0.0.2",
     "awsless": "^0.0.15-local.3",
-    "@awsless/scheduler": "^0.0.5"
+    "@awsless/dynamodb": "^0.3.22"
   },
   "scripts": {
     "test": "bun cli/build-handlers.ts && pnpm vitest",