@awsless/cli 0.0.46-next.1 → 0.0.46-next.10

package/dist/bin.js

@@ -173,7 +173,7 @@ import { DynamoDBClient as DynamoDBClient2, migrate } from "@awsless/dynamodb";
 // src/util/deployment.ts
 import { CloudFrontClient as CloudFrontClient2 } from "@aws-sdk/client-cloudfront";
 import { CloudFrontKeyValueStoreClient as CloudFrontKeyValueStoreClient2 } from "@aws-sdk/client-cloudfront-keyvaluestore";
-import { GetFunctionCommand, LambdaClient as LambdaClient3 } from "@aws-sdk/client-lambda";
+import { DeleteFunctionCommand, GetFunctionCommand, LambdaClient as LambdaClient3 } from "@aws-sdk/client-lambda";
 import {
   define,
   deleteItem,
@@ -187,7 +187,7 @@ import {
   string,
   updateItem
 } from "@awsless/dynamodb";
-import { execSync } from "child_process";
+import { isAfter, subHours } from "date-fns";
 import { userInfo as userInfo2 } from "os";
 
 // src/formation/cloudfront-kvs.ts
@@ -290,17 +290,16 @@ var getRouteStoreArn = async (cloudfront, name) => {
     return;
   }
 };
-var stageRoutes = async (kvs, state2, prior) => {
+var stageRoutes = async (kvs, state2) => {
   const routes = sortRoutes(state2.routes);
   const table2 = getRouteTableId(routes);
-  const priorTable = prior ? getRouteTableId(sortRoutes(prior.routes)) : void 0;
   const deployment = {
     id: state2.deploymentId,
     table: table2,
     functionVersion: state2.functionVersion
   };
   const mutations = [
-    ...priorTable === table2 ? [] : getTableMutations(table2, routes),
+    ...getTableMutations(table2, routes),
     {
       type: "put",
       key: `${DEPLOY_KEY_PREFIX}${deployment.id}`,
@@ -324,9 +323,7 @@ var createCloudFrontKvsProvider = ({ credentials, region }) => {
         return stageRoutes(kvs, routeDeploymentInputSchema.parse(props.state));
       },
       async updateResource(props) {
-        const state2 = routeDeploymentInputSchema.parse(props.proposedState);
-        const prior = routeDeploymentInputSchema.parse(props.priorState);
-        return stageRoutes(kvs, state2, prior.storeArn === state2.storeArn ? prior : void 0);
+        return stageRoutes(kvs, routeDeploymentInputSchema.parse(props.proposedState));
       }
     }
   });
@@ -359,6 +356,42 @@ var pruneStoreDeployments = async (kvs, storeArn, deploymentIds) => {
   });
 };
 
+// src/util/git.ts
+import { execFileSync, execSync } from "child_process";
+var git = (command) => {
+  try {
+    return execSync(`git ${command}`, { stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" }).trim();
+  } catch {
+    return;
+  }
+};
+var checkedOutBranch = () => {
+  return git("rev-parse --abbrev-ref HEAD");
+};
+var currentBranch = () => {
+  const branch = checkedOutBranch();
+  if (branch && branch !== "HEAD") {
+    return branch;
+  }
+  return process.env.GITHUB_HEAD_REF || process.env.GITHUB_REF_NAME || process.env.CI_COMMIT_REF_NAME || process.env.BRANCH_NAME || branch;
+};
+var currentCommit = () => {
+  return git("rev-parse HEAD");
+};
+var currentCommitMessage = () => {
+  return git("log -1 --pretty=%s");
+};
+var isCommitMerged = (commit, branch) => {
+  try {
+    execFileSync("git", ["merge-base", "--is-ancestor", commit, branch], {
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    return true;
+  } catch {
+    return false;
+  }
+};
+
 // src/util/lambda.ts
 import {
   CreateAliasCommand,
@@ -366,6 +399,7 @@ import {
   DeleteFunctionUrlConfigCommand,
   GetAliasCommand,
   LambdaClient,
+  ListAliasesCommand,
   UpdateAliasCommand,
   UpdateFunctionCodeCommand
 } from "@aws-sdk/client-lambda";
@@ -386,6 +420,22 @@ var getLambdaAlias = async (lambda, functionName, name) => {
     return;
   }
 };
+var listLambdaAliases = async (lambda, functionName, functionVersion) => {
+  const aliases = [];
+  let marker;
+  do {
+    const result = await lambda.send(
+      new ListAliasesCommand({
+        FunctionName: functionName,
+        FunctionVersion: functionVersion,
+        Marker: marker
+      })
+    );
+    aliases.push(...result.Aliases ?? []);
+    marker = result.NextMarker;
+  } while (marker);
+  return aliases;
+};
 var upsertLambdaAlias = async (lambda, props) => {
   const input = {
     FunctionName: props.functionName,
@@ -528,6 +578,8 @@ import {
   CreateAliasCommand as CreateAliasCommand2,
   CreateFunctionUrlConfigCommand,
   GetFunctionUrlConfigCommand,
+  RemovePermissionCommand,
+  UpdateFunctionUrlConfigCommand,
   LambdaClient as LambdaClient2,
   PutFunctionEventInvokeConfigCommand
 } from "@aws-sdk/client-lambda";
@@ -559,7 +611,8 @@ var createLambdaProvider = ({ credentials, region }) => {
     deploymentId: z2.string(),
     functionName: z2.string(),
     functionVersion: z2.string(),
-    onFailureArn: z2.string()
+    onFailureArn: z2.string(),
+    sourceAccount: z2.string().optional()
   });
   const bundleDeploymentStateSchema = bundleDeploymentInputSchema.extend({
     deploymentAlias: z2.string(),
@@ -596,14 +649,15 @@ var createLambdaProvider = ({ credentials, region }) => {
       })
     );
   };
-  const createPublicUrl = async (functionName, alias) => {
+  const createDeploymentUrl = async (functionName, alias, sourceAccount) => {
+    const authType = sourceAccount ? "AWS_IAM" : "NONE";
     let url;
     try {
       const result = await lambda.send(
         new CreateFunctionUrlConfigCommand({
           FunctionName: functionName,
           Qualifier: alias,
-          AuthType: "NONE"
+          AuthType: authType
         })
       );
       url = result.FunctionUrl;
@@ -612,21 +666,39 @@ var createLambdaProvider = ({ credentials, region }) => {
         throw error;
       }
       const result = await lambda.send(
-        new GetFunctionUrlConfigCommand({
+        new UpdateFunctionUrlConfigCommand({
           FunctionName: functionName,
-          Qualifier: alias
+          Qualifier: alias,
+          AuthType: authType
         })
       );
       url = result.FunctionUrl;
     }
-    const permissions = [
+    const permissions = sourceAccount ? [
+      {
+        StatementId: "cloudfront-url",
+        Principal: "cloudfront.amazonaws.com",
+        SourceAccount: sourceAccount,
+        Action: "lambda:InvokeFunctionUrl",
+        FunctionUrlAuthType: "AWS_IAM"
+      },
+      {
+        StatementId: "cloudfront-invoke",
+        Principal: "cloudfront.amazonaws.com",
+        SourceAccount: sourceAccount,
+        Action: "lambda:InvokeFunction",
+        InvokedViaFunctionUrl: true
+      }
+    ] : [
       {
         StatementId: "public-url",
+        Principal: "*",
         Action: "lambda:InvokeFunctionUrl",
         FunctionUrlAuthType: "NONE"
       },
       {
         StatementId: "public-invoke",
+        Principal: "*",
         Action: "lambda:InvokeFunction",
         InvokedViaFunctionUrl: true
       }
@@ -637,7 +709,6 @@ var createLambdaProvider = ({ credentials, region }) => {
           new AddPermissionCommand({
             FunctionName: functionName,
             Qualifier: alias,
-            Principal: "*",
             ...permission
           })
         );
@@ -647,6 +718,23 @@ var createLambdaProvider = ({ credentials, region }) => {
         }
       }
     }
+    if (sourceAccount) {
+      for (const statementId of ["public-url", "public-invoke"]) {
+        try {
+          await lambda.send(
+            new RemovePermissionCommand({
+              FunctionName: functionName,
+              Qualifier: alias,
+              StatementId: statementId
+            })
+          );
+        } catch (error) {
+          if (!isError(error, "ResourceNotFoundException")) {
+            throw error;
+          }
+        }
+      }
+    }
     return url;
   };
   const createBundleDeployment = async (state2) => {
@@ -658,7 +746,7 @@ var createLambdaProvider = ({ credentials, region }) => {
       name: deploymentAlias
     });
     await configureVersion(state2);
-    const url = await createPublicUrl(state2.functionName, deploymentAlias);
+    const url = await createDeploymentUrl(state2.functionName, deploymentAlias, state2.sourceAccount);
     return {
       ...state2,
       deploymentAlias,
@@ -769,7 +857,21 @@ var createLambdaProvider = ({ credentials, region }) => {
           deploymentAliases.push(deploymentAlias);
         }
         await configureVersion(proposed);
-        const url = await createPublicUrl(proposed.functionName, deploymentAlias);
+        const url = await createDeploymentUrl(proposed.functionName, deploymentAlias, proposed.sourceAccount);
+        if (proposed.sourceAccount && prior.sourceAccount !== proposed.sourceAccount) {
+          for (const name of deploymentAliases) {
+            if (name === deploymentAlias) {
+              continue;
+            }
+            try {
+              await createDeploymentUrl(proposed.functionName, name, proposed.sourceAccount);
+            } catch (error) {
+              if (!isError(error, "ResourceNotFoundException")) {
+                throw error;
+              }
+            }
+          }
+        }
         return {
           ...proposed,
           deploymentAlias,
@@ -1134,7 +1236,7 @@ var pullRemoteState = async (app, stateBackend) => {
       await rm(file);
     }
   } else {
-    await writeFile(file, JSON.stringify(state2, void 0, 2));
+    await writeFile(file, JSON.stringify(state2, void 0, 2), { mode: 384 });
   }
 };
 var pushRemoteState = async (app, stateBackend) => {
@@ -1148,16 +1250,6 @@ var pushRemoteState = async (app, stateBackend) => {
 var slugifyBranch = (branch) => {
   return (branch ?? "").replace(/[^a-zA-Z0-9_-]+/g, "-").replace(/^-+|-+$/g, "") || "local";
 };
-var git = (command) => {
-  try {
-    return execSync(`git ${command}`, { stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" }).trim();
-  } catch {
-    return;
-  }
-};
-var isCommitMerged = (commit, branch) => {
-  return git(`merge-base --is-ancestor ${JSON.stringify(commit)} ${JSON.stringify(branch)}`) !== void 0;
-};
 var table = define("awsless-deployments", {
   hash: "appId",
   sort: "id",
@@ -1177,10 +1269,13 @@ var table = define("awsless-deployments", {
 var deploymentsTable = table;
 var latestBranchDeployment = async (client, appId, branch) => {
   const items = await listDeployments(client, appId, branch);
-  return items.reduce((latest, item) => (latest?.seq ?? 0) >= item.seq ? latest : item, void 0);
+  return items.reduce(
+    (latest, item) => (latest?.seq ?? 0) >= item.seq ? latest : item,
+    void 0
+  );
 };
 var claimDeployment = async (props) => {
-  const branch = slugifyBranch(git("rev-parse --abbrev-ref HEAD"));
+  const branch = slugifyBranch(currentBranch());
   while (true) {
     const latest = await latestBranchDeployment(props.client, props.appId, branch);
     const seq = (latest?.seq ?? 0) + 1;
@@ -1191,8 +1286,8 @@ var claimDeployment = async (props) => {
       seq,
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
       user: userInfo2().username,
-      commit: git("rev-parse HEAD"),
-      message: git("log -1 --pretty=%s")
+      commit: currentCommit(),
+      message: currentCommitMessage()
     };
     try {
       await putItem(table, deployment, {
@@ -1209,7 +1304,7 @@ var claimDeployment = async (props) => {
   }
 };
 var currentDeployment = async (client, appId) => {
-  return latestBranchDeployment(client, appId, slugifyBranch(git("rev-parse --abbrev-ref HEAD")));
+  return latestBranchDeployment(client, appId, slugifyBranch(currentBranch()));
 };
 var getDeployment = async (client, appId, id) => {
   return getItem(table, { appId, id }, { client });
@@ -1259,6 +1354,63 @@ var markPromoted = async (client, appId, id) => {
 var removeDeployment = async (client, appId, id) => {
   await deleteItem(table, { appId, id }, { client });
 };
+var BUSY_WINDOW_HOURS = 24;
+var isDeploymentBusy = (item, now = /* @__PURE__ */ new Date()) => {
+  return !item.functionVersion && isAfter(new Date(item.createdAt), subHours(now, BUSY_WINDOW_HOURS));
+};
+var selectPrunableDeployments = (items, liveId, options) => {
+  const rollbackTarget = items.filter((item) => item.promotedAt && item.id !== liveId).sort((a, b) => b.promotedAt.localeCompare(a.promotedAt))[0];
+  const keep = Math.max(1, Number(options.keep) || 10);
+  const mainSlug = slugifyBranch(options.main);
+  const keptMain = new Set(
+    items.filter((item) => item.branch === mainSlug && item.functionVersion).map((item) => item.seq).sort((a, b) => b - a).slice(0, keep)
+  );
+  return items.filter((item) => {
+    if (item.id === liveId || item.id === rollbackTarget?.id || isDeploymentBusy(item)) {
+      return false;
+    }
+    if (options.branch) {
+      return item.branch === slugifyBranch(options.branch);
+    }
+    if (!item.functionVersion) {
+      return true;
+    }
+    if (item.branch === mainSlug) {
+      return !keptMain.has(item.seq);
+    }
+    return item.commit ? isCommitMerged(item.commit, options.main) : false;
+  });
+};
+var pruneFunctionVersion = async (lambda, functionName, version) => {
+  for (const alias of await listLambdaAliases(lambda, functionName, version)) {
+    if (alias.Name && alias.Name !== LIVE_LAMBDA_ALIAS) {
+      await deleteLambdaAlias(lambda, functionName, alias.Name);
+    }
+  }
+  try {
+    await lambda.send(
+      new DeleteFunctionCommand({
+        FunctionName: functionName,
+        Qualifier: version
+      })
+    );
+  } catch (error) {
+    if (!isError(error, "ResourceNotFoundException")) {
+      throw error;
+    }
+  }
+};
+var selectPrunableVersions = async (props) => {
+  const surviving = props.items.filter((item) => !props.prunable.includes(item));
+  const kept = new Set(surviving.map((item) => item.functionVersion));
+  const live = await getLambdaAlias(props.lambda, props.functionName, LIVE_LAMBDA_ALIAS);
+  if (live?.FunctionVersion) {
+    kept.add(live.FunctionVersion);
+  }
+  return new Set(
+    props.prunable.map((item) => item.functionVersion).filter((version) => Boolean(version && !kept.has(version)))
+  );
+};
 var readLiveDeploymentId = async (lambda, functionName) => {
   return (await getLambdaAlias(lambda, functionName, LIVE_LAMBDA_ALIAS))?.Description || void 0;
 };
@@ -1275,21 +1427,21 @@ var readDeployedFunctionVersion = (state2) => {
   return;
 };
 var formatDeploymentSummary = (props) => {
-  let previewUrl;
-  let lambdaUrl;
+  const previewUrls = /* @__PURE__ */ new Map();
   for (const [urn, node] of readStateNodes(props.state)) {
     if (node.type === "aws_cloudfront_distribution" && urn.endsWith(":{preview}")) {
-      previewUrl = `https://${node.output.domainName}`;
-    }
-    if (node.type === "bundle-deployment") {
-      lambdaUrl = node.output.url;
+      const router = urn.match(/router:\{([^}]+)\}/)?.[1];
+      if (router) {
+        previewUrls.set(router, `https://${node.output.domainName}`);
+      }
     }
   }
-  return Object.keys(props.appConfig.defaults.router ?? {}).map((routerId, index) => {
+  return Object.keys(props.appConfig.defaults.router ?? {}).map((routerId) => {
+    const previewUrl = previewUrls.get(routerId);
     return [
       `${routerId}: deployment #${props.id}`,
-      index === 0 ? previewUrl : void 0,
-      index === 0 ? lambdaUrl : void 0
+      previewUrl,
+      previewUrl ? `${previewUrl}/?awsless-deployment=${props.id}` : void 0
     ].filter(Boolean).join("\n");
   });
 };
@@ -1371,7 +1523,10 @@ var promoteDeployment = async (props) => {
     ];
     const failures = (await Promise.allSettled(rollback2)).filter((result) => result.status === "rejected").map((result) => result.reason);
     if (failures.length > 0) {
-      throw new AggregateError([error, ...failures], `Deployment promotion failed and couldn't be fully reverted.`);
+      throw new AggregateError(
+        [error, ...failures],
+        `Deployment promotion failed and couldn't be fully reverted.`
+      );
     }
     throw error;
   }
@@ -1833,7 +1988,7 @@ var CodeSchema = z14.union([
 var FnSchema = z14.object({
   code: CodeSchema,
   handler: HandlerSchema.optional()
-});
+}).strict();
 var FunctionSchema = z14.union([
   LocalFileSchema.transform((code) => ({
     code
@@ -2079,6 +2234,66 @@ var InstanceDefaultSchema = z19.object({
 // src/feature/router/schema.ts
 import { days as days3, minutes as minutes2, parse as parse3 } from "@awsless/duration";
 import { z as z20 } from "zod";
+
+// src/feature/router/pattern.ts
+var PARAM_TOKEN = /\{([a-zA-Z_][a-zA-Z0-9_]*)\}|\*/g;
+var escapeRegex = (value) => {
+  return value.replace(/[|\\{}()[\]^$+*?.\-]/g, "\\$&");
+};
+var compileRoutePattern = (pattern) => {
+  if (!pattern.startsWith("/")) {
+    throw new ExpectedError(`Route pattern "${pattern}" must start with a slash (/)`);
+  }
+  if (pattern === "/*") {
+    return { key: pattern };
+  }
+  const params = [];
+  let regex = "";
+  let stars = 0;
+  let last = 0;
+  let token;
+  PARAM_TOKEN.lastIndex = 0;
+  while (token = PARAM_TOKEN.exec(pattern)) {
+    regex += escapeRegex(pattern.slice(last, token.index));
+    const param = token[1];
+    if (param) {
+      if (params.includes(param)) {
+        throw new ExpectedError(`Duplicate param "${param}" in route pattern "${pattern}"`);
+      }
+      params.push(param);
+      regex += "([^/]+)";
+    } else {
+      stars++;
+      regex += ".*";
+    }
+    last = PARAM_TOKEN.lastIndex;
+  }
+  if (params.length === 0 && stars === 0) {
+    return { key: pattern };
+  }
+  regex += escapeRegex(pattern.slice(last));
+  const root2 = pattern.split("/")[1] ?? "";
+  if (root2 === "" || root2.includes("*") || root2.includes("{")) {
+    throw new ExpectedError(
+      `The first path segment of route pattern "${pattern}" must be static when the pattern contains params or wildcards.`
+    );
+  }
+  if (root2.includes(".")) {
+    throw new ExpectedError(
+      `The first path segment of route pattern "${pattern}" can't contain a dot when the pattern contains params or wildcards.`
+    );
+  }
+  if (params.length === 0 && pattern === `/${root2}/*`) {
+    return { key: pattern };
+  }
+  return {
+    key: `/${root2}/*`,
+    match: `^${regex}$`,
+    params: params.length > 0 ? params : void 0
+  };
+};
+
+// src/feature/router/schema.ts
 var ErrorResponsePathSchema = z20.string().describe(
   [
     "The path to the custom error page that you want to return to the viewer when your origin returns the HTTP status code specified.",
@@ -2107,7 +2322,29 @@ var ErrorResponseSchema = z20.union([
     minTTL: MinTTLSchema.optional()
   })
 ]).optional();
-var RouteSchema = z20.string().regex(/^\//, "Route must start with a slash (/)");
+var RouteSchema = z20.string().regex(/^\//, "Route must start with a slash (/)").regex(/^\/([^/*.]+)?$/, 'Router paths mount a single segment without dots, like "/api".');
+var RoutesSchema = z20.record(
+  ResourceIdSchema.describe("The router id to add your routes to."),
+  z20.record(z20.string().regex(/^\//, "Route must start with a slash (/)"), FunctionSchema).superRefine((routes, ctx) => {
+    for (const pattern of Object.keys(routes)) {
+      try {
+        compileRoutePattern(pattern);
+      } catch (error) {
+        ctx.addIssue({
+          code: z20.ZodIssueCode.custom,
+          path: [pattern],
+          message: error instanceof Error ? error.message : `Invalid route pattern: ${pattern}`
+        });
+      }
+    }
+  }).describe(
+    [
+      "Define the routes and the lambda function that should handle them.",
+      'Routes can be an exact path like "/sitemap.xml", a wildcard like "/sitemap/*", or contain params like "/sitemap/{locale}/{page}.xml".',
+      'Param values are passed to the function as "x-param-[NAME]" request headers.'
+    ].join("\n")
+  )
+).optional().describe("Add routes to your global Router that link a path pattern to a lambda function.");
 var VisibilitySchema = z20.boolean().default(false).describe("Whether to enable CloudWatch metrics for the WAF rule.");
 var WafSettingsSchema = z20.object({
   rateLimiter: z20.object({
@@ -2606,8 +2843,8 @@ var AppSchema = z29.object({
     layers: LayerSchema,
     router: RouterDefaultSchema
     // dataRetention: z.boolean().describe('Configure how your resources are handled on delete.').default(false),
-  }).default({}).describe("Default properties")
-});
+  }).strict().default({}).describe("Default properties")
+}).strict();
 
 // src/config/stack.ts
 import { z as z45 } from "zod";
@@ -2663,7 +2900,7 @@ var CommandsSchema = z31.record(ResourceIdSchema, CommandSchema).optional().desc
 
 // src/feature/config/schema.ts
 import { z as z32 } from "zod";
-var ConfigNameSchema = z32.string().regex(/[a-z0-9\-]/g, "Invalid config name");
+var ConfigNameSchema = z32.string().regex(/^[a-z0-9-]+$/, "Invalid config name");
 var ConfigsSchema = z32.array(ConfigNameSchema).optional().describe("Define the config values for your stack.");
 
 // src/feature/cron/schema/index.ts
@@ -3216,14 +3453,13 @@ var TestsSchema = z44.union([
 ]).describe("Define the location of your tests for your stack.").optional();
 
 // src/config/stack.ts
-var DependsSchema = ResourceIdSchema.array().optional().describe("Define the stacks that this stack is depended on.");
 var NameSchema = ResourceIdSchema.refine((name) => !["base", "hostedzones"].includes(name), {
   message: `Stack name can't be a reserved name.`
 }).describe("Stack name.");
 var StackSchema = z45.object({
   $schema: z45.string().optional(),
   name: NameSchema,
-  depends: DependsSchema,
+  routes: RoutesSchema,
   commands: CommandsSchema,
   // auth: AuthSchema,
   // http: HttpSchema,
@@ -3249,7 +3485,7 @@ var StackSchema = z45.object({
   images: ImagesSchema,
   icons: IconsSchema,
   metrics: MetricsSchema
-});
+}).strict();
 
 // src/config/load/read.ts
 import { readFile as readFile3 } from "fs/promises";
@@ -3708,7 +3944,7 @@ import { readdir as readdir2, readFile as readFile7, writeFile as writeFile4 } f
 import { join as join10 } from "path";
 
 // src/build/index.ts
-import { mkdir as mkdir2, readFile as readFile4, writeFile as writeFile2 } from "fs/promises";
+import { mkdir as mkdir2, readFile as readFile4, rm as rm2, writeFile as writeFile2 } from "fs/promises";
 import { dirname as dirname4, join as join7 } from "path";
 
 // src/util/timer.ts
@@ -3750,6 +3986,7 @@ var build = (type, name, builder, props) => {
         cached: true
       };
     }
+    await rm2(cacheFile, { force: true });
     const time = createTimer();
     const meta = await callback(async (file, data2) => {
       const path = getBuildPath(type, name, file);
@@ -3802,7 +4039,7 @@ var zipFiles = (files) => {
 import { generateFileHash } from "@awsless/ts-file-cache";
 import { kebabCase as kebabCase5 } from "change-case";
 import { createHash as createHash5 } from "crypto";
-import { readFile as readFile6, rm as rm3, writeFile as writeFile3 } from "fs/promises";
+import { readFile as readFile6, rm as rm4, writeFile as writeFile3 } from "fs/promises";
 import { dirname as dirname5, join as join9 } from "path";
 import { fileURLToPath } from "url";
 
@@ -3814,13 +4051,13 @@ var formatByteSize = (size) => {
 };
 
 // src/util/temp.ts
-import { mkdir as mkdir3, readdir, rm as rm2 } from "fs/promises";
+import { mkdir as mkdir3, readdir, rm as rm3 } from "fs/promises";
 import { join as join8 } from "path";
 var createTempFolder = async (name) => {
   const path = join8(directories.temp, name);
   await mkdir3(join8(directories.temp, name), { recursive: true });
   process.on("SIGTERM", async () => {
-    await rm2(path, { recursive: true });
+    await rm3(path, { recursive: true });
   });
   return {
     path,
@@ -3828,7 +4065,7 @@ var createTempFolder = async (name) => {
       return readdir(path, { recursive: true });
     },
     async delete() {
-      await rm2(path, { recursive: true });
+      await rm3(path, { recursive: true });
     }
   };
 };
@@ -3843,7 +4080,6 @@ var bundleTypeScriptWithRolldown = async ({
   format: format3 = "esm",
   minify = true,
   file,
-  nativeDir,
   external,
   importAsString: importAsStringList
 }) => {
@@ -3854,9 +4090,15 @@ var bundleTypeScriptWithRolldown = async ({
       return importee.startsWith("@aws-sdk") || importee.startsWith("aws-sdk") || external?.includes(importee);
     },
     treeshake: {
-      moduleSideEffects: (id, isExternal) => isExternal ? external?.includes(id) === true : id.startsWith(`${directories.root}/`)
+      // Dependencies are treated as side-effect free, so unused imports
+      // like the local test servers never reach the production bundle.
+      // The bundle guard below fails the build if one slips through.
+      moduleSideEffects: (id, isExternal) => isExternal ? external?.includes(id) === true : id.startsWith(`${directories.root}/`) && !id.includes("/node_modules/")
     },
     onwarn: (error) => {
+      if (error.code === "UNRESOLVED_IMPORT") {
+        throw new ExpectedError(error.message);
+      }
       debugError(error.message);
     },
     plugins: [
@@ -3901,6 +4143,7 @@ var bundleTypeScriptWithRolldown = async ({
     chunkFileNames: `[name].${ext}`,
     minify
   });
+  assertNoTestOnlyModules(result.output);
   const hash = createHash4("sha1");
   const files = [];
   for (const item of result.output) {
@@ -3922,6 +4165,25 @@ var bundleTypeScriptWithRolldown = async ({
     files
   };
 };
+var TEST_ONLY_MODULES = ["dynamo-db-local", "@awsless/dynamodb-server", "redis-memory-server", "aws-sdk-vitest-mock"];
+var findPackage = (id, names) => {
+  return names.find((name) => id.includes(`/${name.replace(/^@[^/]+\//, "")}/`));
+};
+var assertNoTestOnlyModules = (output) => {
+  for (const item of output) {
+    if (item.type !== "chunk") {
+      continue;
+    }
+    for (const id of item.moduleIds ?? []) {
+      const found = findPackage(id, TEST_ONLY_MODULES);
+      if (found) {
+        throw new Error(
+          `The test-only package "${found}" was bundled into a production build through "${id}". Remove the import from the handler, or keep the package tree-shakeable.`
+        );
+      }
+    }
+  }
+};
 
 // src/feature/bundle/util.ts
 var ROUTE_HEADER = "x-awsless-route";
@@ -3944,7 +4206,7 @@ var registerBundleFunction = (ctx, routeKey, props) => {
 };
 var buildBundle = (props) => {
   return async (build3, { workspace }) => {
-    const runtime = props.runtime ?? join9(dirname5(fileURLToPath(import.meta.url)), "/handlers/bundle.mjs");
+    const runtime = props.runtime ?? join9(dirname5(fileURLToPath(import.meta.url)), "/handlers/bundle.js");
     const handlers = [...props.handlers].sort((a, b) => a.routeKey.localeCompare(b.routeKey));
     const entries = handlers.map(({ routeKey, file, exportName }) => {
       const virtualFile = JSON.stringify(`${file}?awsless-route=${encodeURIComponent(routeKey)}`);
@@ -3993,7 +4255,7 @@ ${entries.join("\n")}
         importAsString: importAsString2.length > 0 ? importAsString2 : void 0
       });
       await temp.delete();
-      await rm3(getBuildPath("bundle", props.name, "files"), { recursive: true, force: true });
+      await rm4(getBuildPath("bundle", props.name, "files"), { recursive: true, force: true });
       await Promise.all([
         write("HASH", bundle.hash),
         ...bundle.files.map((file) => write(`files/${file.name}`, file.code)),
@@ -4038,6 +4300,11 @@ var bundleFeature = defineFeature({
     const addLayer = (layer) => {
       layers.push(layer);
     };
+    const layerIds = Object.keys(ctx.appConfig.defaults.layers ?? {});
+    const layerPackages = layerIds.flatMap((id) => ctx.shared.entry("layer", "packages", id));
+    for (const id of layerIds) {
+      addLayer(ctx.shared.entry("layer", "arn", id));
+    }
     const name = getBundleFunctionName(ctx.app.name);
     const shortName = formatGlobalResourceName({
       appName: ctx.app.name,
@@ -4051,7 +4318,7 @@ var bundleFeature = defineFeature({
         name,
         handlers,
         minify: defaults.minify,
-        external: defaults.external
+        external: [...defaults.external ?? [], ...layerPackages]
       })
     );
     const sourceHash = new Output3(envDeps, async (resolve2) => {
@@ -4207,7 +4474,8 @@ var bundleFeature = defineFeature({
         deploymentId: ctx.deploymentId ?? "local-0",
         functionName: lambda.functionName,
         functionVersion: lambda.version,
-        onFailureArn: onFailure
+        onFailureArn: onFailure,
+        sourceAccount: ctx.accountId
       },
       {
         // Make sure the permissions are in place before any event source is wired up.
@@ -4293,11 +4561,6 @@ var bundleFeature = defineFeature({
       addLayer,
       addPermission
     });
-  },
-  onStack(ctx) {
-    const bundle = ctx.shared.get("bundle", "main");
-    ctx.onEnv(bundle.addEnv);
-    ctx.onPermission(bundle.addPermission);
   }
 });
 
@@ -4509,7 +4772,7 @@ var SsmStore = class {
     debug("Value:", color.info(value));
     await this.client.send(
       new PutParameterCommand({
-        Type: ParameterType.STRING,
+        Type: ParameterType.SECURE_STRING,
         Name: this.getName(name),
         Value: value,
         Overwrite: true
@@ -4608,7 +4871,7 @@ var configFeature = defineFeature({
       ctx.addEnv(`CONFIG_${constantCase4(name)}`, name);
     }
     if (configs.length) {
-      ctx.addStackPermission({
+      ctx.addGlobalPermission({
         actions: [
           "ssm:GetParameter",
           "ssm:GetParameters",
@@ -4945,10 +5208,12 @@ var domainFeature = defineFeature({
       }
     }
     ctx.addGlobalPermission({
-      actions: ["ses:*"],
+      actions: ["ses:SendEmail", "ses:SendRawEmail"],
       resources: [
-        // `arn:aws:ses:${ctx.appConfig.region}:${ctx.accountId}:identity/*`,
-        "*"
+        `arn:aws:ses:${ctx.appConfig.region}:${ctx.accountId}:identity/*`,
+        // Sending through the app configuration set is authorized against
+        // its own ARN, not just the identity.
+        `arn:aws:ses:${ctx.appConfig.region}:${ctx.accountId}:configuration-set/${ctx.app.name}`
       ]
     });
   }
@@ -5038,7 +5303,9 @@ var functionFeature = defineFeature({
         // 'lambda:ListFunctions',
         // 'lambda:GetFunction',
       ],
-      resources: [`arn:aws:lambda:*:*:function:${ctx.appConfig.name}--*`]
+      resources: [
+        `arn:aws:lambda:${ctx.appConfig.region}:${ctx.accountId}:function:${ctx.appConfig.name}--*`
+      ]
     });
   },
   onStack(ctx) {
@@ -5080,7 +5347,7 @@ var onErrorLogFeature = defineFeature({
     const consumerRoute = formatRouteKey(ctx.app.name, "on-error-log", "consumer");
     bundle.addHandler({
       routeKey: handlerRoute,
-      file: join11(dirname6(fileURLToPath2(import.meta.url)), "/handlers/on-error-log.mjs"),
+      file: join11(dirname6(fileURLToPath2(import.meta.url)), "/handlers/on-error-log.js"),
       exportName: "default"
     });
     bundle.addEnv(formatRouteEnvName(handlerRoute, "CONSUMER"), consumerRoute);
@@ -5305,7 +5572,7 @@ var onFailureFeature = defineFeature({
     const consumer = props.consumer;
     bundle.addHandler({
       routeKey: normalizerRoute,
-      file: join12(dirname7(fileURLToPath3(import.meta.url)), "/handlers/on-failure.mjs"),
+      file: join12(dirname7(fileURLToPath3(import.meta.url)), "/handlers/on-failure.js"),
       exportName: "default"
     });
     registerBundleFunction(ctx, consumerRoute, consumer);
@@ -5460,7 +5727,7 @@ var createPubSubService = (parentGroup, ctx, id, props, inputs) => {
   });
   const shortName = shortId(`${ctx.app.name}:pubsub:${id}:${ctx.appId}`);
   const image2 = "public.ecr.aws/aws-cli/aws-cli:arm64";
-  const bundleFile = join14(__dirname, "handlers/pubsub-server.mjs");
+  const bundleFile = join14(__dirname, "handlers/pubsub-server.js");
   ctx.registerBuild("pubsub", name, async (build3) => {
     const hash = createHash8("sha1").update(await readFile9(bundleFile)).digest("hex");
     const fingerprint = `${hash}-${ARCHITECTURE}`;
@@ -5561,7 +5828,8 @@ var createPubSubService = (parentGroup, ctx, id, props, inputs) => {
           Statement: list3.map((statement) => ({
             Effect: pascalCase2(statement.effect ?? "allow"),
             Action: statement.actions,
-            Resource: statement.resources
+            Resource: statement.resources,
+            Condition: statement.conditions
           }))
         })
       );
@@ -6052,7 +6320,7 @@ var pubsubFeature = defineFeature({
       const publisherRouteKey = formatRouteKey(ctx.app.name, "pubsub", `${id}-publisher`);
       bundle.addHandler({
         routeKey: publisherRouteKey,
-        file: join15(__dirname2, "/handlers/pubsub-publisher.mjs"),
+        file: join15(__dirname2, "/handlers/pubsub-publisher.js"),
         exportName: "default"
       });
       bundle.addEnv(formatRouteEnvName3(publisherRouteKey, "REDIS_HOST"), redisHost);
@@ -6205,7 +6473,7 @@ var queueFeature = defineFeature({
         });
       }
       ctx.addEnv(`QUEUE_${constantCase6(ctx.stack.name)}_${constantCase6(id)}_URL`, queue2.url);
-      ctx.addStackPermission({
+      ctx.addGlobalPermission({
         actions: [
           "sqs:SendMessage",
           "sqs:ReceiveMessage",
@@ -6401,7 +6669,7 @@ var rpcFeature = defineFeature({
       const serverRouteKey = formatRouteKey(ctx.app.name, "rpc", id);
       bundle.addHandler({
         routeKey: serverRouteKey,
-        file: join16(dirname10(fileURLToPath6(import.meta.url)), "/handlers/rpc.mjs"),
+        file: join16(dirname10(fileURLToPath6(import.meta.url)), "/handlers/rpc.js"),
         exportName: "default"
       });
       bundle.addEnv(
@@ -6565,7 +6833,7 @@ var searchFeature = defineFeature({
         }
       );
       ctx.addEnv(`SEARCH_${constantCase8(ctx.stack.name)}_${constantCase8(id)}_DOMAIN`, openSearch.endpointV2);
-      ctx.addStackPermission({
+      ctx.addGlobalPermission({
         actions: ["es:ESHttp*"],
         resources: [
           //
@@ -6922,14 +7190,18 @@ var siteFeature = defineFeature({
               env,
               stdout: "pipe",
               stderr: "pipe"
-              // stdout: 'ignore',
-              // stderr: ''
-              // stdout: 'inherit',
-              // stderr: 'inherit',
             });
-            await instance.exited;
-            if (instance.exitCode !== null && instance.exitCode > 0) {
-              throw new Error("Site build failed");
+            const [output, errors] = await Promise.all([
+              new Response(instance.stdout).text(),
+              new Response(instance.stderr).text(),
+              instance.exited
+            ]);
+            if (instance.exitCode !== 0) {
+              const reason = instance.signalCode ? ` (${instance.signalCode})` : "";
+              throw new ExpectedError(
+                `Site build failed${reason}:
+${(errors.trim() || output.trim()).slice(-2e3)}`
+              );
             }
             await write("HASH", fingerprint);
             return {
@@ -7770,7 +8042,7 @@ var imageFeature = defineFeature({
       const serverRouteKey = formatRouteKey(ctx.stack.name, "image", id);
       bundle.addHandler({
         routeKey: serverRouteKey,
-        file: join20(dirname12(fileURLToPath7(import.meta.url)), "/handlers/image.mjs"),
+        file: join20(dirname12(fileURLToPath7(import.meta.url)), "/handlers/image.js"),
         exportName: "default",
         external: ["sharp"]
       });
@@ -7869,7 +8141,7 @@ var iconFeature = defineFeature({
       const serverRouteKey = formatRouteKey(ctx.stack.name, "icon", id);
       bundle.addHandler({
         routeKey: serverRouteKey,
-        file: join21(dirname13(fileURLToPath8(import.meta.url)), "/handlers/icon.mjs"),
+        file: join21(dirname13(fileURLToPath8(import.meta.url)), "/handlers/icon.js"),
         exportName: "default"
       });
       addRoutes({
@@ -8128,7 +8400,8 @@ var createFargateJob = (parentGroup, ctx, ns, id, local) => {
           Statement: list3.map((statement) => ({
             Effect: pascalCase3(statement.effect ?? "allow"),
             Action: statement.actions,
-            Resource: statement.resources
+            Resource: statement.resources,
+            Condition: statement.conditions
           }))
         })
       );
@@ -8480,13 +8753,13 @@ var jobFeature = defineFeature({
       const group = new Group25(ctx.stack, "job", id);
       createFargateJob(group, ctx, "job", id, props);
     }
-    ctx.addStackPermission({
+    ctx.addGlobalPermission({
       actions: ["ecs:RunTask"],
       resources: [
         `arn:aws:ecs:${ctx.appConfig.region}:*:task-definition/${ctx.app.name}--${ctx.stackConfig.name}--*`
       ]
     });
-    ctx.addStackPermission({
+    ctx.addGlobalPermission({
       actions: ["iam:PassRole"],
       resources: ["*"],
       conditions: {
@@ -8626,7 +8899,8 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
           Statement: list3.map((statement) => ({
             Effect: pascalCase4(statement.effect ?? "allow"),
             Action: statement.actions,
-            Resource: statement.resources
+            Resource: statement.resources,
+            Condition: statement.conditions
           }))
         })
       );
@@ -9022,7 +9296,7 @@ var metricFeature = defineFeature({
   onStack(ctx) {
     const bundle = ctx.shared.get("bundle", "main");
     const namespace = `awsless/${kebabCase11(ctx.app.name)}/${kebabCase11(ctx.stack.name)}`;
-    ctx.addStackPermission({
+    ctx.addGlobalPermission({
       actions: ["cloudwatch:PutMetricData"],
       resources: ["*"],
       conditions: {
@@ -9098,12 +9372,15 @@ var metricFeature = defineFeature({
 });
 
 // src/feature/router/index.ts
-import { days as days10, seconds as seconds6, toSeconds as toSeconds12, years } from "@awsless/duration";
+import { days as days10, seconds as seconds7, toSeconds as toSeconds13, years } from "@awsless/duration";
 import { Group as Group29 } from "@terraforge/core";
 import { aws as aws30 } from "@terraforge/aws";
-import { camelCase as camelCase9, constantCase as constantCase15 } from "change-case";
+import { camelCase as camelCase9, constantCase as constantCase15, kebabCase as kebabCase12 } from "change-case";
 
 // src/feature/router/router-code.ts
+import { minutes as minutes8, seconds as seconds6, toSeconds as toSeconds12 } from "@awsless/duration";
+var ORIGIN_READ_TIMEOUT = toSeconds12(minutes8(2));
+var ORIGIN_CONNECTION_TIMEOUT = toSeconds12(seconds6(10));
 var getViewerRequestFunctionCode = (props) => {
   return CODE(
     [
@@ -9117,7 +9394,7 @@ var getViewerRequestFunctionCode = (props) => {
         ].join("\n")
       ) : ""
     ],
-    ACTIVE_PREFIX(props.router)
+    props.preview ? PREVIEW_PREFIX(props.router) : ACTIVE_PREFIX(props.router)
   );
 };
 var BLOCK_DIRECT_ACCESS_TO_CLOUDFRONT = `
@@ -9172,11 +9449,64 @@ var PASSWORD_AUTH_CHECK = (password) => `
 authMethods.push('Password realm="Protected"');
 
 if(!isAuthorized) {
-	if(authHeader && authHeader.startsWith('Password ') && authHeader.slice(9) === '${password}') {
+	if(authHeader && authHeader.startsWith('Password ') && authHeader.slice(9) === ${JSON.stringify(password)}) {
 		isAuthorized = true;
 	}
 }
 `;
+var PREVIEW_PREFIX = (router) => `
+const router = ${JSON.stringify(router)};
+let deployment;
+
+if (request.querystring['awsless-deployment'] && request.querystring['awsless-deployment'].value) {
+	deployment = request.querystring['awsless-deployment'].value;
+} else if (request.cookies && request.cookies['awsless-deployment'] && request.cookies['awsless-deployment'].value) {
+	deployment = request.cookies['awsless-deployment'].value;
+}
+
+let prefix;
+
+try {
+	const pointer = deployment ? '$deploy:' + deployment : '$active';
+	prefix = (await cf.kvs().get(pointer)).split(':')[0] + ':' + router + ':';
+} catch (e) {
+	return deployment
+		? { statusCode: 404, statusDescription: 'Unknown Deployment' }
+		: { statusCode: 503, statusDescription: 'Service Unavailable' };
+}
+
+if (deployment && request.querystring['awsless-deployment']) {
+	delete request.querystring['awsless-deployment'];
+
+	const query = [];
+
+	for (const key in request.querystring) {
+		const entry = request.querystring[key];
+
+		if (entry.multiValue) {
+			// The CloudFront js runtime doesn't support for...of.
+			for (const i in entry.multiValue) {
+				query.push(key + '=' + entry.multiValue[i].value);
+			}
+		} else {
+			query.push(key + '=' + entry.value);
+		}
+	}
+
+	return {
+		statusCode: 302,
+		statusDescription: 'Found',
+		headers: {
+			location: { value: request.uri + (query.length ? '?' + query.join('&') : '') }
+		},
+		cookies: {
+			'awsless-deployment': {
+				value: deployment,
+				attributes: 'Path=/; Secure; SameSite=Lax'
+			}
+		}
+	};
+}`;
 var ACTIVE_PREFIX = (router) => `
 const router = ${JSON.stringify(router)};
 let prefix;
@@ -9244,20 +9574,77 @@ function isValidRoute(route, method) {
 	return true;
 }
 
+function matchRoute(value, path, method) {
+	const list = Array.isArray(value) ? value : [value];
+
+	for(const i in list) {
+		const route = list[i];
+
+		if(!isValidRoute(route, method)) {
+			continue;
+		}
+
+		if(route.match) {
+			const found = path.match(new RegExp(route.match));
+
+			if(!found) {
+				continue;
+			}
+
+			const params = {};
+
+			if(route.params) {
+				for(const p in route.params) {
+					params[route.params[p]] = found[Number(p) + 1];
+				}
+			}
+
+			return { route: route, params: params };
+		}
+
+		return { route: route };
+	}
+}
+
 async function findRoute(path, method, prefix) {
+	// only route selection is normalized, the forwarded uri stays untouched
+	if (path.length > 1 && path.slice(-1) === '/') {
+		path = path.slice(0, -1);
+	}
+
 	const store = cf.kvs();
 	const keys = getPossibleRouteKeys(path);
 
 	for(const i in keys) {
 		const key = keys[i];
+		let value;
 
 		try {
-			const route = await store.get(prefix + key, { format: 'json' });
+			value = await store.get(prefix + key, { format: 'json' });
+		} catch (e) {
+			continue;
+		}
 
-			if(isValidRoute(route, method)) {
-				return route;
+		// Route lists that are too big for a single key value pair
+		// are sharded over multiple entries behind a route index.
+		if(value && value.list) {
+			for(let n = 0; n < value.list; n++) {
+				try {
+					const route = await store.get(prefix + key + '#' + n, { format: 'json' });
+					const result = matchRoute(route, path, method);
+
+					if(result) {
+						return result;
+					}
+				} catch (e) {}
 			}
-		} catch (e) {}
+		} else {
+			const result = matchRoute(value, path, method);
+
+			if(result) {
+				return result;
+			}
+		}
 	}
 }
 
@@ -9326,13 +9713,12 @@ function setS3Origin(route) {
 function setLambdaOrigin(route) {
 	const config = getRequestOriginConfig(route);
 
-	// CloudFront caps the origin response timeout at 60s without a quota increase.
 	if(typeof config.timeouts.readTimeout !== 'number') {
-		config.timeouts.readTimeout = 120;
+		config.timeouts.readTimeout = ${ORIGIN_READ_TIMEOUT};
 	}
 
 	if(typeof config.timeouts.connectionTimeout !== 'number') {
-		config.timeouts.connectionTimeout = 10;
+		config.timeouts.connectionTimeout = ${ORIGIN_CONNECTION_TIMEOUT};
 	}
 
 	cf.updateRequestOrigin(Object.assign(config, {
@@ -9381,15 +9767,36 @@ async function handler(event) {
 
 	${prefixCode}
 
-	const route = await findRoute(path, request.method, prefix);
+	const result = await findRoute(path, request.method, prefix);
 
-	if(!route) {
+	if(!result) {
 		return {
 			statusCode: 404,
 			statusDescription: 'Not Found'
 		};
 	}
 
+	const route = result.route;
+
+	// A client provided param header can never reach the origin.
+	const spoofed = [];
+
+	for(const name in headers) {
+		if(name.indexOf('x-param-') === 0) {
+			spoofed.push(name);
+		}
+	}
+
+	for(const i in spoofed) {
+		delete headers[spoofed[i]];
+	}
+
+	if(result.params) {
+		for(const name in result.params) {
+			headers['x-param-' + name.toLowerCase()] = { value: encodeURIComponent(result.params[name]) };
+		}
+	}
+
 	if(route.requestHeaders) {
 		for(const name in route.requestHeaders) {
 			headers[name] = { value: route.requestHeaders[name] };
@@ -9408,6 +9815,8 @@ async function handler(event) {
 
 	if(route.forwardHost && headers.host && headers.host.value) {
 		headers['x-forwarded-host'] = { value: headers.host.value };
+	} else {
+		delete headers['x-forwarded-host'];
 	}
 
 	headers['x-origin'] = { value: route.domainName };
@@ -9440,6 +9849,31 @@ async function handler(event) {
 `;
 
 // src/feature/router/index.ts
+var MAX_VALUE_SIZE = 1e3;
+var ORIGIN_PLACEHOLDER = "x".repeat(64);
+var assertRouteValueSize = (key, route) => {
+  const withOrigin = (entry) => {
+    return entry.type === "lambda" ? { ...entry, domainName: ORIGIN_PLACEHOLDER } : entry;
+  };
+  for (const entry of Array.isArray(route) ? route : [route]) {
+    if (Buffer.byteLength(JSON.stringify(withOrigin(entry)), "utf8") > MAX_VALUE_SIZE) {
+      throw new ExpectedError(`The route value of the "${key}" route key is too large.`);
+    }
+  }
+};
+var createRouteStoreEntries = (key, route) => {
+  const value = JSON.stringify(route);
+  if (!Array.isArray(route) || Buffer.byteLength(value, "utf8") <= MAX_VALUE_SIZE) {
+    return [{ key, value }];
+  }
+  return [
+    { key, value: JSON.stringify({ list: route.length }) },
+    ...route.map((entry, index) => ({
+      key: `${key}#${index}`,
+      value: JSON.stringify(entry)
+    }))
+  ];
+};
 var routerFeature = defineFeature({
   name: "router",
   onApp(ctx) {
@@ -9450,7 +9884,6 @@ var routerFeature = defineFeature({
     const distributionIds = [];
     let hasLambdaRoutes = false;
     let routeStore;
-    let previewDistribution;
     for (const [id, props] of routers) {
       const group = new Group29(ctx.base, "router", id);
       const name = formatGlobalResourceName({
@@ -9486,20 +9919,21 @@ var routerFeature = defineFeature({
           if (Object.hasOwn(routes, `${id}:${key}`)) {
             throw new ExpectedError(`Duplicate route key: ${key} in the "${id}" router`);
           }
+          assertRouteValueSize(`${id}:${key}`, route);
           routes[`${id}:${key}`] = route;
         }
         for (const dependency of options?.dependsOn ?? []) {
           routeDependencies.add(dependency);
         }
-        if (Object.values(newRoutes).some((route) => route.type === "lambda")) {
+        if (Object.values(newRoutes).flat().some((route) => route.type === "lambda")) {
           hasLambdaRoutes = true;
         }
       });
       const cache = new aws30.cloudfront.CachePolicy(group, "cache", {
         name,
-        minTtl: toSeconds12(seconds6(0)),
-        maxTtl: toSeconds12(days10(365)),
-        defaultTtl: toSeconds12(days10(0)),
+        minTtl: toSeconds13(seconds7(0)),
+        maxTtl: toSeconds13(days10(365)),
+        defaultTtl: toSeconds13(days10(0)),
         parametersInCacheKeyAndForwardedToOrigin: {
           enableAcceptEncodingBrotli: true,
           enableAcceptEncodingGzip: true,
@@ -9552,7 +9986,7 @@ var routerFeature = defineFeature({
         name,
         corsConfig: {
           originOverride: props.cors?.override ?? true,
-          accessControlMaxAgeSec: toSeconds12(props.cors?.maxAge ?? years(1)),
+          accessControlMaxAgeSec: toSeconds13(props.cors?.maxAge ?? years(1)),
           accessControlAllowHeaders: { items: props.cors?.headers ?? ["*"] },
           accessControlAllowMethods: { items: props.cors?.methods ?? ["ALL"] },
           accessControlAllowOrigins: { items: props.cors?.origins ?? ["*"] },
@@ -9577,7 +10011,7 @@ var routerFeature = defineFeature({
           strictTransportSecurity: {
             override: true,
             preload: true,
-            accessControlMaxAgeSec: toSeconds12(years(1)),
+            accessControlMaxAgeSec: toSeconds13(years(1)),
             includeSubdomains: true
           },
           xssProtection: {
@@ -9597,7 +10031,7 @@ var routerFeature = defineFeature({
             rateBasedStatement: {
               limit: wafSettingsConfig.rateLimiter.limit,
               aggregateKeyType: "IP",
-              evaluationWindowSec: toSeconds12(wafSettingsConfig.rateLimiter.window)
+              evaluationWindowSec: toSeconds13(wafSettingsConfig.rateLimiter.window)
             }
           },
           action: {
@@ -9687,12 +10121,12 @@ var routerFeature = defineFeature({
           rule: wafRules,
           captchaConfig: {
             immunityTimeProperty: {
-              immunityTime: toSeconds12(wafSettingsConfig.captchaImmunityTime)
+              immunityTime: toSeconds13(wafSettingsConfig.captchaImmunityTime)
             }
           },
           challengeConfig: {
             immunityTimeProperty: {
-              immunityTime: toSeconds12(wafSettingsConfig.challengeImmunityTime)
+              immunityTime: toSeconds13(wafSettingsConfig.challengeImmunityTime)
             }
           },
           visibilityConfig: {
@@ -9748,7 +10182,7 @@ var routerFeature = defineFeature({
           }
           return {
             errorCode: Number(errorCode),
-            errorCachingMinTtl: item.minTTL ? toSeconds12(item.minTTL) : void 0,
+            errorCachingMinTtl: item.minTTL ? toSeconds13(item.minTTL) : void 0,
             responseCode: item.statusCode?.toString() ?? errorCode,
             responsePagePath: item.path
           };
@@ -9787,19 +10221,20 @@ var routerFeature = defineFeature({
         ],
         webAclId: waf?.arn
       });
-      if (id === defaultRouter) {
+      {
         const previewFunction = new aws30.cloudfront.Function(group, "preview-function", {
           name: `${name.slice(0, 55)}--preview`,
           runtime: "cloudfront-js-2.0",
           code: getViewerRequestFunctionCode({
             router: id,
+            preview: true,
             basicAuth: props.basicAuth,
             passwordAuth: props.passwordAuth
           }),
           publish: true,
           keyValueStoreAssociations: [routeStore.arn]
         });
-        previewDistribution = new aws30.cloudfront.Distribution(group, "preview", {
+        const previewDistribution = new aws30.cloudfront.Distribution(group, "preview", {
           tags: {
             name: `${name}-preview`
           },
@@ -9830,7 +10265,7 @@ var routerFeature = defineFeature({
             }
             return {
               errorCode: Number(errorCode),
-              errorCachingMinTtl: item.minTTL ? toSeconds12(item.minTTL) : void 0,
+              errorCachingMinTtl: item.minTTL ? toSeconds13(item.minTTL) : void 0,
               responseCode: item.statusCode ?? Number(errorCode),
               responsePagePath: item.path
             };
@@ -9863,6 +10298,9 @@ var routerFeature = defineFeature({
           webAclId: waf?.arn
         });
         distributionIds.push(previewDistribution.id);
+        ctx.shared.add("router", "preview-id", id, previewDistribution.id);
+      }
+      if (id === defaultRouter) {
         ctx.onReadyLast(() => {
           const bundle = ctx.shared.get("bundle", "main");
           let lambdaUrlHost;
@@ -9889,38 +10327,24 @@ var routerFeature = defineFeature({
               storeArn: routeStore.arn,
               functionVersion: bundle.lambda.version,
               routes: $resolve([routes, lambdaUrlHost], (routes2, lambdaUrlHost2) => {
-                return Object.entries(routes2).map(([key, route]) => ({
-                  key,
-                  value: JSON.stringify(
-                    route.type === "lambda" ? { ...route, domainName: lambdaUrlHost2 } : route
+                const withOrigin = (route) => {
+                  return route.type === "lambda" ? { ...route, domainName: lambdaUrlHost2 } : route;
+                };
+                return Object.entries(routes2).flatMap(
+                  ([key, route]) => createRouteStoreEntries(
+                    key,
+                    Array.isArray(route) ? route.map(withOrigin) : withOrigin(route)
                   )
-                }));
+                );
               })
             },
             {
               dependsOn: Array.from(routeDependencies)
             }
           );
-          if (!(props.basicAuth ?? props.passwordAuth)) {
-            bundle.addEnv(
-              "AWSLESS_PREVIEW",
-              $resolve(
-                [routes],
-                (routes2) => JSON.stringify({
-                  router: id,
-                  routes: Object.fromEntries(
-                    Object.entries(routes2).filter(
-                      ([key, route]) => key.startsWith(`${id}:`) && route.type !== "url"
-                    )
-                  )
-                })
-              )
-            );
-          }
         });
       }
       ctx.shared.add("router", "id", id, distribution.id);
-      ctx.shared.add("router", "preview-id", id, previewDistribution.id);
       distributionIds.push(distribution.id);
       if (props.domain) {
         const domainName = formatFullDomainName(ctx.appConfig, props.domain, props.subDomain);
@@ -9971,6 +10395,41 @@ var routerFeature = defineFeature({
         ctx.bind(`ROUTER_${constantCase15(id)}_ENDPOINT`, domainName);
       }
     }
+  },
+  onStack(ctx) {
+    for (const [id, patterns] of Object.entries(ctx.stackConfig.routes ?? {})) {
+      if (!ctx.appConfig.defaults.router?.[id]) {
+        throw new FileError(ctx.stackConfig.file, `Router "${id}" is not defined on the app level.`);
+      }
+      const addRoutes = ctx.shared.entry("router", "addRoutes", id);
+      const grouped = {};
+      for (const [pattern, props] of Object.entries(patterns)) {
+        const compiled = compileRoutePattern(pattern);
+        const slug = kebabCase12(pattern).slice(0, 20);
+        const routeKey = formatRouteKey(ctx.stack.name, "route", `${slug || "root"}-${shortId(pattern)}`);
+        registerBundleFunction(ctx, routeKey, props);
+        grouped[compiled.key] ??= [];
+        grouped[compiled.key].push({
+          type: "lambda",
+          forwardHost: true,
+          urlEncodedQueryString: true,
+          match: compiled.match,
+          params: compiled.params,
+          requestHeaders: {
+            [ROUTE_HEADER]: routeKey
+          }
+        });
+      }
+      const merged = {};
+      for (const [key, list3] of Object.entries(grouped)) {
+        if (list3.length === 1) {
+          merged[key] = list3[0];
+        } else {
+          merged[key] = [...list3.filter((route) => route.match), ...list3.filter((route) => !route.match)];
+        }
+      }
+      addRoutes(merged);
+    }
   }
 });
 
@@ -10264,6 +10723,12 @@ var logo = () => {
 var layout = async (command, cb) => {
   console.log();
   log9.intro(`${logo()} ${color.line(command)}`);
+  let completed = false;
+  process.on("exit", (code) => {
+    if (code === 0 && !completed) {
+      process.exitCode = 130;
+    }
+  });
   try {
     const options = program.optsWithGlobals();
     const appConfig = await loadAppConfig(options);
@@ -10278,9 +10743,11 @@ var layout = async (command, cb) => {
       appConfig,
       stackConfigs
     });
+    completed = true;
     log9.outro(result ?? void 0);
     process.exit(0);
   } catch (error) {
+    completed = true;
     playErrorSound();
     logError(error);
     log9.outro();
@@ -10348,14 +10815,6 @@ var SharedData = class {
 };
 
 // src/app.ts
-var assertDepsExists = (stack, stacks) => {
-  for (const dep of stack.depends ?? []) {
-    const found = stacks.find((i) => i.name === dep);
-    if (!found) {
-      throw new FileError(stack.file, `Stack "${stack.name}" depends on a stack "${dep}" that doesn't exist.`);
-    }
-  }
-};
 var createApp = (props) => {
   const app = new App2(props.appConfig.name);
   const zones = new Stack(app, "zones");
@@ -10379,17 +10838,10 @@ var createApp = (props) => {
   const bindListeners = [];
   const globalEnv = [];
   const globalEnvListeners = [];
-  const allLocalEnv = {};
-  const allLocalEnvListeners = {};
   const globalPermissions = [];
   const globalPermissionCallbacks = [];
   const appPermissions = [];
   const appPermissionCallbacks = [];
-  const allStackPermissions = {};
-  const allStackPermissionCallbacks = {};
-  for (const stackConfig of props.stackConfigs) {
-    assertDepsExists(stackConfig, props.stackConfigs);
-  }
   for (const feature of features) {
     feature.onBefore?.({
       ...props,
@@ -10462,14 +10914,6 @@ var createApp = (props) => {
   }
   for (const stackConfig of props.stackConfigs) {
     const stack = new Stack(app, stackConfig.name);
-    const localEnvListeners = [];
-    const localEnv = [];
-    const stackPermissions = [];
-    const stackPermissionCallbacks = [];
-    allStackPermissions[stack.name] = stackPermissions;
-    allStackPermissionCallbacks[stack.name] = stackPermissionCallbacks;
-    allLocalEnvListeners[stack.name] = localEnvListeners;
-    allLocalEnv[stack.name] = localEnv;
     for (const feature of features) {
       feature.onStack?.({
         ...props,
@@ -10483,7 +10927,6 @@ var createApp = (props) => {
         shared,
         onPermission(callback) {
           globalPermissionCallbacks.push(callback);
-          stackPermissionCallbacks.push(callback);
         },
         addGlobalPermission(permission) {
           globalPermissions.push(permission);
@@ -10491,9 +10934,6 @@ var createApp = (props) => {
         addAppPermission(permission) {
           appPermissions.push(permission);
         },
-        addStackPermission(permission) {
-          stackPermissions.push(permission);
-        },
         addWarning(props2) {
           warnings.push(props2);
         },
@@ -10557,10 +10997,10 @@ var createApp = (props) => {
           bindListeners.push(cb);
         },
         addEnv(name, value) {
-          localEnv.push({ name, value });
+          globalEnv.push({ name, value });
         },
         onEnv(cb) {
-          localEnvListeners.push(cb);
+          globalEnvListeners.push(cb);
         },
         onReady(cb) {
           readyListeners.push(cb);
@@ -10570,16 +11010,6 @@ var createApp = (props) => {
         }
       });
     }
-    for (const callback of stackPermissionCallbacks) {
-      for (const permission of stackPermissions) {
-        callback(permission);
-      }
-    }
-    for (const listener of localEnvListeners) {
-      for (const env of localEnv) {
-        listener(env.name, env.value);
-      }
-    }
   }
   for (const callback of appPermissionCallbacks) {
     for (const permission of appPermissions) {
@@ -10601,24 +11031,6 @@ var createApp = (props) => {
       listener(name, value);
     }
   }
-  for (const stackConfig of props.stackConfigs) {
-    const envListeners = allLocalEnvListeners[stackConfig.name];
-    const permissionCallbacks = allStackPermissionCallbacks[stackConfig.name];
-    for (const dependency of stackConfig.depends ?? []) {
-      const permissions = allStackPermissions[dependency];
-      const env = allLocalEnv[dependency];
-      for (const permission of permissions) {
-        for (const callback of permissionCallbacks) {
-          callback(permission);
-        }
-      }
-      for (const entry of env) {
-        for (const listener of envListeners) {
-          listener(entry.name, entry.value);
-        }
-      }
-    }
-  }
   const ready = () => {
     for (const listener of readyListeners) {
       listener();
@@ -10664,6 +11076,7 @@ var buildAssets = async (builders, stackFilters, showResult = false) => {
   if (filteredBuilders.length === 0) {
     return;
   }
+  filteredBuilders.sort((a, b) => Number(a.type === "bundle") - Number(b.type === "bundle"));
   const results = [];
   await log10.task({
     initialMessage: `Building assets...`,
@@ -11483,9 +11896,10 @@ var deploy = (program2) => {
         }
       });
       playSuccessSound();
-      const details = deployments2.length > 0 ? `
-${deployments2.join("\n")}` : "";
-      return `Deployment #${deployment.id} is live.${details}`;
+      for (const summary of deployments2) {
+        log20.message(summary);
+      }
+      return `Deployment #${deployment.id} is live.`;
     });
   });
 };
@@ -11976,7 +12390,7 @@ var bind = (program2) => {
         stderr: "inherit"
       });
       await instance.exited;
-      process.exit(0);
+      process.exit(instance.exitCode ?? 1);
     });
   });
 };
@@ -12096,7 +12510,7 @@ var resources = (program2) => {
           return `${color.dim("{")}${color.warning(v)}${color.dim("}")}`;
         }).replaceAll(":", color.dim(":"));
       };
-      const formatStatus = (status) => {
+      const formatStatus2 = (status) => {
         if (status === "created") {
           return color.success(status);
         }
@@ -12121,7 +12535,7 @@ var resources = (program2) => {
             stack.resources.map((r) => {
               return [
                 //
-                formatStatus(r.status),
+                formatStatus2(r.status),
                 color.dim(icon.arrow.right),
                 formatResource(stack.urn, r.urn)
               ].join(" ");
@@ -12365,9 +12779,12 @@ var test = (program2) => {
       if (tests.length === 0) {
         return "No tests found.";
       }
-      await runTests(tests, stacks, options?.filters, {
+      const passed = await runTests(tests, stacks, options?.filters, {
         showLogs: true
       });
+      if (!passed) {
+        throw new Cancelled();
+      }
       return "All tests finished.";
     });
   });
@@ -12592,14 +13009,14 @@ var parseJsonLog = (message) => {
     json = JSON.parse(message);
   } catch (error) {
   }
-  if ("level" in json && typeof json.level === "string" && "timestamp" in json && typeof json.timestamp === "string" && "message" in json) {
+  if (typeof json === "object" && json !== null && "level" in json && typeof json.level === "string" && "timestamp" in json && typeof json.timestamp === "string" && "message" in json) {
     return {
       level: json.level,
       message: typeof json.message === "string" ? json.message : JSON.stringify(json.message, void 0, 2),
       date: new Date(json.timestamp)
     };
   }
-  if ("type" in json && typeof json.type === "string" && json.type.startsWith("platform") && "time" in json && typeof json.time === "string" && "record" in json) {
+  if (typeof json === "object" && json !== null && "type" in json && typeof json.type === "string" && json.type.startsWith("platform") && "time" in json && typeof json.time === "string" && "record" in json) {
     return {
       level: "SYSTEM",
       message: JSON.stringify(json.record, void 0, 2),
@@ -13047,7 +13464,7 @@ var activity = (program2) => {
 // src/cli/command/deployment.ts
 import { CloudFrontClient as CloudFrontClient6 } from "@aws-sdk/client-cloudfront";
 import { CloudFrontKeyValueStoreClient as CloudFrontKeyValueStoreClient3 } from "@aws-sdk/client-cloudfront-keyvaluestore";
-import { DeleteFunctionCommand, LambdaClient as LambdaClient7 } from "@aws-sdk/client-lambda";
+import { LambdaClient as LambdaClient7 } from "@aws-sdk/client-lambda";
 import { log as log35, prompt as prompt19 } from "@awsless/clui";
 import { DynamoDBClient as DynamoDBClient6 } from "@awsless/dynamodb";
 var createClients = async (appConfig) => {
@@ -13064,11 +13481,17 @@ var createClients = async (appConfig) => {
   };
 };
 var formatAge = (iso) => {
-  const minutes8 = Math.floor((Date.now() - Date.parse(iso)) / 6e4);
-  if (minutes8 < 1) return "just now";
-  if (minutes8 < 60) return `${minutes8}m ago`;
-  if (minutes8 < 60 * 24) return `${Math.floor(minutes8 / 60)}h ago`;
-  return `${Math.floor(minutes8 / (60 * 24))}d ago`;
+  const minutes9 = Math.floor((Date.now() - Date.parse(iso)) / 6e4);
+  if (minutes9 < 1) return "just now";
+  if (minutes9 < 60) return `${minutes9}m ago`;
+  if (minutes9 < 60 * 24) return `${Math.floor(minutes9 / 60)}h ago`;
+  return `${Math.floor(minutes9 / (60 * 24))}d ago`;
+};
+var formatStatus = (item, liveId) => {
+  if (item.id === liveId) return color.success("live    ");
+  if (item.promotedAt) return "promoted";
+  if (item.functionVersion) return color.info("staged  ");
+  return color.dim("pending ");
 };
 var deployments = (program2) => {
   program2.command("deployments").description("List the deployment history of your app").action(async () => {
@@ -13083,17 +13506,16 @@ var deployments = (program2) => {
       }
       const idWidth = Math.max(...items.map((item) => item.id.length));
       log35.message(
-        items.map((item) => {
-          const status = item.id === liveId ? color.success("live    ") : item.promotedAt ? "promoted" : item.functionVersion ? color.info("staged  ") : color.dim("pending ");
-          return [
+        items.map(
+          (item) => [
             color.label(item.id.padEnd(idWidth)),
-            status,
+            formatStatus(item, liveId),
             formatAge(item.createdAt).padEnd(8),
             color.dim(item.commit?.slice(0, 7) ?? "-------"),
             (item.message ?? "").slice(0, 50).padEnd(50),
             color.dim(item.user ?? "")
-          ].join("  ");
-        }).join("\n")
+          ].join("  ")
+        ).join("\n")
       );
       return `Found ${items.length} deployments.`;
     });
@@ -13107,28 +13529,7 @@ var prune = (program2) => {
         listDeployments(dynamo, appId),
         readLiveDeploymentId(lambda, functionName)
       ]);
-      const rollbackTarget = items.filter((item) => item.promotedAt && item.id !== liveId).sort((a, b) => b.promotedAt.localeCompare(a.promotedAt))[0];
-      const keep = Math.max(1, Number(options.keep) || 10);
-      const mainSlug = slugifyBranch(options.main);
-      const keptMain = new Set(
-        items.filter((item) => item.branch === mainSlug && item.functionVersion).map((item) => item.seq).sort((a, b) => b - a).slice(0, keep)
-      );
-      const dayAgo = new Date(Date.now() - 24 * 60 * 60 * 1e3).toISOString();
-      const prunable = items.filter((item) => {
-        if (item.id === liveId || item.id === rollbackTarget?.id) {
-          return false;
-        }
-        if (options.branch) {
-          return item.branch === slugifyBranch(options.branch);
-        }
-        if (!item.functionVersion) {
-          return item.createdAt < dayAgo;
-        }
-        if (item.branch === mainSlug) {
-          return !keptMain.has(item.seq);
-        }
-        return item.commit ? isCommitMerged(item.commit, options.main) : false;
-      });
+      const prunable = selectPrunableDeployments(items, liveId, options);
       if (prunable.length === 0) {
         return `Nothing to prune.`;
       }
@@ -13145,31 +13546,25 @@ var prune = (program2) => {
         initialMessage: "Pruning the deployments",
         successMessage: "Done pruning the deployments.",
         task: () => withAppReleaseLock(appConfig, async () => {
-          for (const item of prunable) {
+          const [freshItems, freshLiveId] = await Promise.all([
+            listDeployments(dynamo, appId),
+            readLiveDeploymentId(lambda, functionName)
+          ]);
+          const confirmed = new Set(prunable.map((item) => item.id));
+          const prune2 = selectPrunableDeployments(freshItems, freshLiveId, options).filter(
+            (item) => confirmed.has(item.id)
+          );
+          for (const item of prune2) {
             await deleteLambdaAlias(lambda, functionName, getDeploymentLambdaAliasName(item.id));
           }
-          const surviving = items.filter((item) => !prunable.includes(item));
-          const keepVersions = new Set(surviving.map((item) => item.functionVersion));
-          const live = await getLambdaAlias(lambda, functionName, LIVE_LAMBDA_ALIAS);
-          if (live?.FunctionVersion) {
-            keepVersions.add(live.FunctionVersion);
-          }
-          const versions = new Set(
-            prunable.map((item) => item.functionVersion).filter((version) => version && !keepVersions.has(version))
-          );
+          const versions = await selectPrunableVersions({
+            lambda,
+            functionName,
+            items: freshItems,
+            prunable: prune2
+          });
           for (const version of versions) {
-            try {
-              await lambda.send(
-                new DeleteFunctionCommand({
-                  FunctionName: functionName,
-                  Qualifier: version
-                })
-              );
-            } catch (error) {
-              if (!isError(error, "ResourceNotFoundException") && !isError(error, "ResourceConflictException")) {
-                throw error;
-              }
-            }
+            await pruneFunctionVersion(lambda, functionName, version);
           }
           const storeArn = await getRouteStoreArn(
             cloudfront,
@@ -13183,10 +13578,10 @@ var prune = (program2) => {
             await pruneStoreDeployments(
               kvs,
               storeArn,
-              prunable.map((item) => item.id)
+              prune2.map((item) => item.id)
             );
           }
-          for (const item of prunable) {
+          for (const item of prune2) {
             await removeDeployment(dynamo, appId, item.id);
           }
         })
@@ -13255,8 +13650,8 @@ program.option("--stage <string>", "The stage to use");
 program.option("-c --no-cache", "Always build & test without the cache");
 program.option("-s --skip-prompt", "Skip prompts");
 program.option("-v --verbose", "Print verbose logs");
-program.exitOverride(() => {
-  process.exit(0);
+program.exitOverride((error) => {
+  process.exit(error.exitCode);
 });
 program.on("option:verbose", () => {
   process.env.VERBOSE = program.opts().verbose ? "1" : void 0;
@@ -13270,4 +13665,13 @@ program.on("option:no-cache", () => {
 commands10.forEach((fn) => fn(program));
 
 // src/bin.ts
+var interrupt = (signal, code) => () => {
+  process.stdout.write("\x1B[?25h");
+  if (signal === "SIGINT" && process.listenerCount(signal) > 1) {
+    return;
+  }
+  process.exit(code);
+};
+process.on("SIGINT", interrupt("SIGINT", 130));
+process.on("SIGTERM", interrupt("SIGTERM", 143));
 program.parse(process.argv);