@awsless/cli 0.0.46-next.0 → 0.0.46-next.2

package/dist/bin.js

@@ -528,6 +528,8 @@ import {
   CreateAliasCommand as CreateAliasCommand2,
   CreateFunctionUrlConfigCommand,
   GetFunctionUrlConfigCommand,
+  RemovePermissionCommand,
+  UpdateFunctionUrlConfigCommand,
   LambdaClient as LambdaClient2,
   PutFunctionEventInvokeConfigCommand
 } from "@aws-sdk/client-lambda";
@@ -559,7 +561,8 @@ var createLambdaProvider = ({ credentials, region }) => {
     deploymentId: z2.string(),
     functionName: z2.string(),
     functionVersion: z2.string(),
-    onFailureArn: z2.string()
+    onFailureArn: z2.string(),
+    sourceAccount: z2.string().optional()
   });
   const bundleDeploymentStateSchema = bundleDeploymentInputSchema.extend({
     deploymentAlias: z2.string(),
@@ -596,14 +599,15 @@ var createLambdaProvider = ({ credentials, region }) => {
       })
     );
   };
-  const createPublicUrl = async (functionName, alias) => {
+  const createDeploymentUrl = async (functionName, alias, sourceAccount) => {
+    const authType = sourceAccount ? "AWS_IAM" : "NONE";
     let url;
     try {
       const result = await lambda.send(
         new CreateFunctionUrlConfigCommand({
           FunctionName: functionName,
           Qualifier: alias,
-          AuthType: "NONE"
+          AuthType: authType
         })
       );
       url = result.FunctionUrl;
@@ -612,21 +616,39 @@ var createLambdaProvider = ({ credentials, region }) => {
         throw error;
       }
       const result = await lambda.send(
-        new GetFunctionUrlConfigCommand({
+        new UpdateFunctionUrlConfigCommand({
           FunctionName: functionName,
-          Qualifier: alias
+          Qualifier: alias,
+          AuthType: authType
         })
       );
       url = result.FunctionUrl;
     }
-    const permissions = [
+    const permissions = sourceAccount ? [
+      {
+        StatementId: "cloudfront-url",
+        Principal: "cloudfront.amazonaws.com",
+        SourceAccount: sourceAccount,
+        Action: "lambda:InvokeFunctionUrl",
+        FunctionUrlAuthType: "AWS_IAM"
+      },
+      {
+        StatementId: "cloudfront-invoke",
+        Principal: "cloudfront.amazonaws.com",
+        SourceAccount: sourceAccount,
+        Action: "lambda:InvokeFunction",
+        InvokedViaFunctionUrl: true
+      }
+    ] : [
       {
         StatementId: "public-url",
+        Principal: "*",
         Action: "lambda:InvokeFunctionUrl",
         FunctionUrlAuthType: "NONE"
       },
       {
         StatementId: "public-invoke",
+        Principal: "*",
         Action: "lambda:InvokeFunction",
         InvokedViaFunctionUrl: true
       }
@@ -637,7 +659,6 @@ var createLambdaProvider = ({ credentials, region }) => {
           new AddPermissionCommand({
             FunctionName: functionName,
             Qualifier: alias,
-            Principal: "*",
             ...permission
           })
         );
@@ -647,6 +668,23 @@ var createLambdaProvider = ({ credentials, region }) => {
         }
       }
     }
+    if (sourceAccount) {
+      for (const statementId of ["public-url", "public-invoke"]) {
+        try {
+          await lambda.send(
+            new RemovePermissionCommand({
+              FunctionName: functionName,
+              Qualifier: alias,
+              StatementId: statementId
+            })
+          );
+        } catch (error) {
+          if (!isError(error, "ResourceNotFoundException")) {
+            throw error;
+          }
+        }
+      }
+    }
     return url;
   };
   const createBundleDeployment = async (state2) => {
@@ -658,7 +696,7 @@ var createLambdaProvider = ({ credentials, region }) => {
       name: deploymentAlias
     });
     await configureVersion(state2);
-    const url = await createPublicUrl(state2.functionName, deploymentAlias);
+    const url = await createDeploymentUrl(state2.functionName, deploymentAlias, state2.sourceAccount);
     return {
       ...state2,
       deploymentAlias,
@@ -769,7 +807,20 @@ var createLambdaProvider = ({ credentials, region }) => {
           deploymentAliases.push(deploymentAlias);
         }
         await configureVersion(proposed);
-        const url = await createPublicUrl(proposed.functionName, deploymentAlias);
+        const url = await createDeploymentUrl(proposed.functionName, deploymentAlias, proposed.sourceAccount);
+        if (proposed.sourceAccount && prior.sourceAccount !== proposed.sourceAccount) {
+          await Promise.all(
+            deploymentAliases.filter((name) => name !== deploymentAlias).map(
+              (name) => createDeploymentUrl(proposed.functionName, name, proposed.sourceAccount).catch(
+                (error) => {
+                  if (!isError(error, "ResourceNotFoundException")) {
+                    throw error;
+                  }
+                }
+              )
+            )
+          );
+        }
         return {
           ...proposed,
           deploymentAlias,
@@ -1276,20 +1327,16 @@ var readDeployedFunctionVersion = (state2) => {
 };
 var formatDeploymentSummary = (props) => {
   let previewUrl;
-  let lambdaUrl;
   for (const [urn, node] of readStateNodes(props.state)) {
     if (node.type === "aws_cloudfront_distribution" && urn.endsWith(":{preview}")) {
       previewUrl = `https://${node.output.domainName}`;
     }
-    if (node.type === "bundle-deployment") {
-      lambdaUrl = node.output.url;
-    }
   }
   return Object.keys(props.appConfig.defaults.router ?? {}).map((routerId, index) => {
     return [
       `${routerId}: deployment #${props.id}`,
       index === 0 ? previewUrl : void 0,
-      index === 0 ? lambdaUrl : void 0
+      index === 0 && previewUrl ? `${previewUrl}/?awsless-deployment=${props.id}` : void 0
     ].filter(Boolean).join("\n");
   });
 };
@@ -1418,6 +1465,9 @@ var activateDeployment = async (props) => {
   });
   return id;
 };
+var promoteAppDeployment = (props) => {
+  return activateDeployment({ ...props, rejectStale: true });
+};
 var rollbackAppDeployment = (props) => {
   return withAppReleaseLock(props.appConfig, () => activateDeployment(props));
 };
@@ -2153,6 +2203,7 @@ var RouterDefaultSchema = z20.record(
   z20.object({
     domain: ResourceIdSchema.describe("The domain id to link your Router.").optional(),
     subDomain: z20.string().optional(),
+    redirectWww: z20.boolean().default(false).describe("Redirect all www subdomain requests to your root domain."),
     waf: WafSettingsSchema.optional(),
     geoRestrictions: z20.array(z20.string().length(2).toUpperCase()).default([]).describe("Specifies a blacklist of countries that should be blocked."),
     errors: z20.object({
@@ -2241,6 +2292,21 @@ var RouterDefaultSchema = z20.record(
     }).optional().describe(
       "Specifies the cookies, headers, and query values that CloudFront includes in the cache key."
     )
+  }).superRefine((props, ctx) => {
+    if (props.redirectWww && !props.domain) {
+      ctx.addIssue({
+        code: z20.ZodIssueCode.custom,
+        path: ["redirectWww"],
+        message: "The redirectWww option requires a domain to be set."
+      });
+    }
+    if (props.redirectWww && props.subDomain) {
+      ctx.addIssue({
+        code: z20.ZodIssueCode.custom,
+        path: ["redirectWww"],
+        message: `The redirectWww option can't be combined with a subDomain, because the domain certificate only covers single level subdomains.`
+      });
+    }
   })
 ).optional().describe(`Define the global Router. Backed by AWS CloudFront.`);
 
@@ -3824,7 +3890,6 @@ var bundleTypeScriptWithRolldown = async ({
   format: format3 = "esm",
   minify = true,
   file,
-  nativeDir,
   external,
   importAsString: importAsStringList
 }) => {
@@ -3835,7 +3900,25 @@ var bundleTypeScriptWithRolldown = async ({
       return importee.startsWith("@aws-sdk") || importee.startsWith("aws-sdk") || external?.includes(importee);
     },
     treeshake: {
-      moduleSideEffects: (id, isExternal) => isExternal ? external?.includes(id) === true : id.startsWith(`${directories.root}/`)
+      // The @awsless packages are pure clients, but their entry points
+      // also export test helpers that pull in local server
+      // implementations like dynamo-db-local, which crash the ESM
+      // runtime with CJS globals like __dirname. Treating the scope as
+      // side-effect free prunes those unused chains from production
+      // bundles, while every other dependency keeps its import side
+      // effects, like the fs patching of graceful-fs.
+      moduleSideEffects: (id, isExternal) => {
+        if (isExternal) {
+          return external?.includes(id) === true;
+        }
+        if (id.includes("/node_modules/@awsless/")) {
+          return false;
+        }
+        if (id.includes("/node_modules/")) {
+          return true;
+        }
+        return id.startsWith(`${directories.root}/`);
+      }
     },
     onwarn: (error) => {
       debugError(error.message);
@@ -3882,6 +3965,7 @@ var bundleTypeScriptWithRolldown = async ({
     chunkFileNames: `[name].${ext}`,
     minify
   });
+  assertNoTestOnlyModules(result.output);
   const hash = createHash4("sha1");
   const files = [];
   for (const item of result.output) {
@@ -3903,6 +3987,22 @@ var bundleTypeScriptWithRolldown = async ({
     files
   };
 };
+var TEST_ONLY_MODULES = ["dynamo-db-local", "@awsless/dynamodb-server", "redis-memory-server"];
+var assertNoTestOnlyModules = (output) => {
+  for (const item of output) {
+    if (item.type !== "chunk") {
+      continue;
+    }
+    for (const id of item.moduleIds ?? []) {
+      const found = TEST_ONLY_MODULES.find((name) => id.includes(`/node_modules/${name}/`));
+      if (found) {
+        throw new Error(
+          `The test-only package "${found}" was bundled into a production build through "${id}". Remove the import from the handler, or keep the package tree-shakeable.`
+        );
+      }
+    }
+  }
+};
 
 // src/feature/bundle/util.ts
 var ROUTE_HEADER = "x-awsless-route";
@@ -4188,7 +4288,8 @@ var bundleFeature = defineFeature({
         deploymentId: ctx.deploymentId ?? "local-0",
         functionName: lambda.functionName,
         functionVersion: lambda.version,
-        onFailureArn: onFailure
+        onFailureArn: onFailure,
+        sourceAccount: ctx.accountId
       },
       {
         // Make sure the permissions are in place before any event source is wired up.
@@ -4329,6 +4430,7 @@ var cacheFeature = defineFeature({
         {
           name,
           engine: "valkey",
+          networkType: "dual_stack",
           dailySnapshotTime: "02:00",
           majorEngineVersion: "8",
           snapshotRetentionLimit: props.snapshotRetentionLimit,
@@ -4354,7 +4456,9 @@ var cacheFeature = defineFeature({
         },
         {
           retainOnDelete: ctx.appConfig.removal === "retain",
-          import: ctx.import ? name : void 0
+          import: ctx.import ? name : void 0,
+          // The network type can only be set at creation time.
+          replaceOnChanges: ["networkType"]
         }
       );
       const masterHost = cache.endpoint.pipe((v) => v.at(0).address);
@@ -5893,12 +5997,15 @@ var pubsubFeature = defineFeature({
         {
           name: cacheName,
           engine: "valkey",
+          networkType: "dual_stack",
           majorEngineVersion: "8",
           securityGroupIds: [cacheSecurityGroup.id],
           subnetIds: ctx.shared.get("vpc", "private-subnets")
         },
         {
-          import: ctx.import ? cacheName : void 0
+          import: ctx.import ? cacheName : void 0,
+          // The network type can only be set at creation time.
+          replaceOnChanges: ["networkType"]
         }
       );
       const redisHost = cache.endpoint.pipe((v) => v.at(0).address);
@@ -6484,7 +6591,7 @@ var searchFeature = defineFeature({
         {
           domainName: name,
           engineVersion: `OpenSearch_${props.version}`,
-          ipAddressType: "ipv4",
+          ipAddressType: "dualstack",
           clusterConfig: {
             instanceType: `${props.type}.search`,
             instanceCount: props.count
@@ -6539,7 +6646,7 @@ var searchFeature = defineFeature({
           import: ctx.import ? name : void 0
         }
       );
-      ctx.addEnv(`SEARCH_${constantCase8(ctx.stack.name)}_${constantCase8(id)}_DOMAIN`, openSearch.endpoint);
+      ctx.addEnv(`SEARCH_${constantCase8(ctx.stack.name)}_${constantCase8(id)}_DOMAIN`, openSearch.endpointV2);
       ctx.addStackPermission({
         actions: ["es:ESHttp*"],
         resources: [
@@ -9083,6 +9190,7 @@ var getViewerRequestFunctionCode = (props) => {
   return CODE(
     [
       props.blockDirectAccess ? BLOCK_DIRECT_ACCESS_TO_CLOUDFRONT : "",
+      props.redirectWww ? REDIRECT_WWW : "",
       props.passwordAuth ?? props.basicAuth ? AUTH_WRAPPER(
         [
           //
@@ -9091,7 +9199,7 @@ var getViewerRequestFunctionCode = (props) => {
         ].join("\n")
       ) : ""
     ],
-    ACTIVE_PREFIX(props.router)
+    props.preview ? PREVIEW_PREFIX(props.router) : ACTIVE_PREFIX(props.router)
   );
 };
 var BLOCK_DIRECT_ACCESS_TO_CLOUDFRONT = `
@@ -9101,6 +9209,38 @@ if (headers.host && headers.host.value.includes('cloudfront.net')) {
 		statusDescription: 'Forbidden'
 	};
 }`;
+var REDIRECT_WWW = `
+if (headers.host && headers.host.value.startsWith('www.')) {
+	let location = 'https://' + headers.host.value.slice(4) + request.uri;
+	const query = [];
+
+	for(const key in request.querystring) {
+		const item = request.querystring[key];
+
+		if(item.multiValue) {
+			for(const i in item.multiValue) {
+				query.push(key + '=' + item.multiValue[i].value);
+			}
+		} else if(item.value === '') {
+			query.push(key);
+		} else {
+			query.push(key + '=' + item.value);
+		}
+	}
+
+	if(query.length > 0) {
+		location += '?' + query.join('&');
+	}
+
+	return {
+		statusCode: 301,
+		statusDescription: 'Moved Permanently',
+		headers: {
+			'location': { value: location },
+			'strict-transport-security': { value: 'max-age=31536000; includeSubdomains; preload' }
+		}
+	};
+}`;
 var BASIC_AUTH_CHECK = (username, password) => `
 authMethods.push('Basic realm="Protected"');
 
@@ -9119,6 +9259,58 @@ if(!isAuthorized) {
 	}
 }
 `;
+var PREVIEW_PREFIX = (router) => `
+const router = ${JSON.stringify(router)};
+let deployment;
+
+if (request.querystring['awsless-deployment'] && request.querystring['awsless-deployment'].value) {
+	deployment = request.querystring['awsless-deployment'].value;
+} else if (request.cookies && request.cookies['awsless-deployment'] && request.cookies['awsless-deployment'].value) {
+	deployment = request.cookies['awsless-deployment'].value;
+}
+
+let prefix;
+
+try {
+	const pointer = deployment ? '$deploy:' + deployment : '$active';
+	prefix = (await cf.kvs().get(pointer)).split(':')[0] + ':' + router + ':';
+} catch (e) {
+	return deployment
+		? { statusCode: 404, statusDescription: 'Unknown Deployment' }
+		: { statusCode: 503, statusDescription: 'Service Unavailable' };
+}
+
+if (request.querystring['awsless-deployment']) {
+	delete request.querystring['awsless-deployment'];
+
+	const query = [];
+
+	for (const key in request.querystring) {
+		const entry = request.querystring[key];
+
+		if (entry.multiValue) {
+			for (const item of entry.multiValue) {
+				query.push(key + '=' + item.value);
+			}
+		} else {
+			query.push(key + '=' + entry.value);
+		}
+	}
+
+	return {
+		statusCode: 302,
+		statusDescription: 'Found',
+		headers: {
+			location: { value: request.uri + (query.length ? '?' + query.join('&') : '') }
+		},
+		cookies: {
+			'awsless-deployment': {
+				value: deployment,
+				attributes: 'Path=/; Secure; SameSite=Lax'
+			}
+		}
+	};
+}`;
 var ACTIVE_PREFIX = (router) => `
 const router = ${JSON.stringify(router)};
 let prefix;
@@ -9416,6 +9608,7 @@ var routerFeature = defineFeature({
         code: getViewerRequestFunctionCode({
           router: id,
           blockDirectAccess: !!props.domain,
+          redirectWww: !!props.domain && props.redirectWww,
           basicAuth: props.basicAuth,
           passwordAuth: props.passwordAuth
         }),
@@ -9734,6 +9927,7 @@ var routerFeature = defineFeature({
           runtime: "cloudfront-js-2.0",
           code: getViewerRequestFunctionCode({
             router: id,
+            preview: true,
             basicAuth: props.basicAuth,
             passwordAuth: props.passwordAuth
           }),
@@ -9746,6 +9940,7 @@ var routerFeature = defineFeature({
           },
           comment: `${name} preview`,
           enabled: true,
+          isIpv6Enabled: true,
           waitForDeployment: true,
           origin: [
             {
@@ -9841,22 +10036,6 @@ var routerFeature = defineFeature({
               dependsOn: Array.from(routeDependencies)
             }
           );
-          if (!(props.basicAuth ?? props.passwordAuth)) {
-            bundle.addEnv(
-              "AWSLESS_PREVIEW",
-              $resolve(
-                [routes],
-                (routes2) => JSON.stringify({
-                  router: id,
-                  routes: Object.fromEntries(
-                    Object.entries(routes2).filter(
-                      ([key, route]) => key.startsWith(`${id}:`) && route.type !== "url"
-                    )
-                  )
-                })
-              )
-            );
-          }
         });
       }
       ctx.shared.add("router", "id", id, distribution.id);
@@ -9864,29 +10043,50 @@ var routerFeature = defineFeature({
       distributionIds.push(distribution.id);
       if (props.domain) {
         const domainName = formatFullDomainName(ctx.appConfig, props.domain, props.subDomain);
+        const wwwDomainName = props.redirectWww ? `www.${domainName}` : void 0;
         const certificateArn = ctx.shared.entry("domain", `global-certificate-arn`, props.domain);
         const zoneId = ctx.shared.entry("domain", "zone-id", props.domain);
         const connectionGroup = new aws30.cloudfront.ConnectionGroup(group, "connection-group", {
-          name
+          name,
+          ipv6Enabled: true
         });
         new aws30.cloudfront.DistributionTenant(group, `tenant`, {
           name,
           enabled: true,
           distributionId: distribution.id,
           connectionGroupId: connectionGroup.id,
-          domain: [{ domain: domainName }],
+          domain: [
+            //
+            { domain: domainName },
+            ...wwwDomainName ? [{ domain: wwwDomainName }] : []
+          ],
           customizations: [{ certificate: [{ arn: certificateArn }] }]
         });
-        new aws30.route53.Record(group, `record`, {
-          zoneId,
-          type: "A",
-          name: domainName,
-          alias: {
-            name: connectionGroup.routingEndpoint,
-            zoneId: "Z2FDTNDATAQYW2",
-            evaluateTargetHealth: false
-          }
-        });
+        for (const [recordId, recordName] of [
+          ["record", domainName],
+          ...wwwDomainName ? [["www-record", wwwDomainName]] : []
+        ]) {
+          new aws30.route53.Record(group, recordId, {
+            zoneId,
+            type: "A",
+            name: recordName,
+            alias: {
+              name: connectionGroup.routingEndpoint,
+              zoneId: "Z2FDTNDATAQYW2",
+              evaluateTargetHealth: false
+            }
+          });
+          new aws30.route53.Record(group, `${recordId}-ipv6`, {
+            zoneId,
+            type: "AAAA",
+            name: recordName,
+            alias: {
+              name: connectionGroup.routingEndpoint,
+              zoneId: "Z2FDTNDATAQYW2",
+              evaluateTargetHealth: false
+            }
+          });
+        }
         ctx.bind(`ROUTER_${constantCase15(id)}_ENDPOINT`, domainName);
       }
     }
@@ -11391,6 +11591,10 @@ var deploy = (program2) => {
               appConfig,
               id: deployment.id
             });
+            await promoteAppDeployment({
+              appConfig,
+              id: deployment.id
+            });
             return deployments3;
           } finally {
             await release();

package/dist/build-json-schema.js

@@ -560,6 +560,7 @@ var RouterDefaultSchema = z16.record(
   z16.object({
     domain: ResourceIdSchema.describe("The domain id to link your Router.").optional(),
     subDomain: z16.string().optional(),
+    redirectWww: z16.boolean().default(false).describe("Redirect all www subdomain requests to your root domain."),
     waf: WafSettingsSchema.optional(),
     geoRestrictions: z16.array(z16.string().length(2).toUpperCase()).default([]).describe("Specifies a blacklist of countries that should be blocked."),
     errors: z16.object({
@@ -648,6 +649,21 @@ var RouterDefaultSchema = z16.record(
     }).optional().describe(
       "Specifies the cookies, headers, and query values that CloudFront includes in the cache key."
     )
+  }).superRefine((props, ctx) => {
+    if (props.redirectWww && !props.domain) {
+      ctx.addIssue({
+        code: z16.ZodIssueCode.custom,
+        path: ["redirectWww"],
+        message: "The redirectWww option requires a domain to be set."
+      });
+    }
+    if (props.redirectWww && props.subDomain) {
+      ctx.addIssue({
+        code: z16.ZodIssueCode.custom,
+        path: ["redirectWww"],
+        message: `The redirectWww option can't be combined with a subDomain, because the domain certificate only covers single level subdomains.`
+      });
+    }
   })
 ).optional().describe(`Define the global Router. Backed by AWS CloudFront.`);