@awsless/cli 0.0.46-next.1 → 0.0.46-next.2

package/dist/bin.js

@@ -528,6 +528,8 @@ import {
   CreateAliasCommand as CreateAliasCommand2,
   CreateFunctionUrlConfigCommand,
   GetFunctionUrlConfigCommand,
+  RemovePermissionCommand,
+  UpdateFunctionUrlConfigCommand,
   LambdaClient as LambdaClient2,
   PutFunctionEventInvokeConfigCommand
 } from "@aws-sdk/client-lambda";
@@ -559,7 +561,8 @@ var createLambdaProvider = ({ credentials, region }) => {
     deploymentId: z2.string(),
     functionName: z2.string(),
     functionVersion: z2.string(),
-    onFailureArn: z2.string()
+    onFailureArn: z2.string(),
+    sourceAccount: z2.string().optional()
   });
   const bundleDeploymentStateSchema = bundleDeploymentInputSchema.extend({
     deploymentAlias: z2.string(),
@@ -596,14 +599,15 @@ var createLambdaProvider = ({ credentials, region }) => {
       })
     );
   };
-  const createPublicUrl = async (functionName, alias) => {
+  const createDeploymentUrl = async (functionName, alias, sourceAccount) => {
+    const authType = sourceAccount ? "AWS_IAM" : "NONE";
     let url;
     try {
       const result = await lambda.send(
         new CreateFunctionUrlConfigCommand({
           FunctionName: functionName,
           Qualifier: alias,
-          AuthType: "NONE"
+          AuthType: authType
         })
       );
       url = result.FunctionUrl;
@@ -612,21 +616,39 @@ var createLambdaProvider = ({ credentials, region }) => {
         throw error;
       }
       const result = await lambda.send(
-        new GetFunctionUrlConfigCommand({
+        new UpdateFunctionUrlConfigCommand({
           FunctionName: functionName,
-          Qualifier: alias
+          Qualifier: alias,
+          AuthType: authType
         })
       );
       url = result.FunctionUrl;
     }
-    const permissions = [
+    const permissions = sourceAccount ? [
+      {
+        StatementId: "cloudfront-url",
+        Principal: "cloudfront.amazonaws.com",
+        SourceAccount: sourceAccount,
+        Action: "lambda:InvokeFunctionUrl",
+        FunctionUrlAuthType: "AWS_IAM"
+      },
+      {
+        StatementId: "cloudfront-invoke",
+        Principal: "cloudfront.amazonaws.com",
+        SourceAccount: sourceAccount,
+        Action: "lambda:InvokeFunction",
+        InvokedViaFunctionUrl: true
+      }
+    ] : [
       {
         StatementId: "public-url",
+        Principal: "*",
         Action: "lambda:InvokeFunctionUrl",
         FunctionUrlAuthType: "NONE"
       },
       {
         StatementId: "public-invoke",
+        Principal: "*",
         Action: "lambda:InvokeFunction",
         InvokedViaFunctionUrl: true
       }
@@ -637,7 +659,6 @@ var createLambdaProvider = ({ credentials, region }) => {
           new AddPermissionCommand({
             FunctionName: functionName,
             Qualifier: alias,
-            Principal: "*",
             ...permission
           })
         );
@@ -647,6 +668,23 @@ var createLambdaProvider = ({ credentials, region }) => {
         }
       }
     }
+    if (sourceAccount) {
+      for (const statementId of ["public-url", "public-invoke"]) {
+        try {
+          await lambda.send(
+            new RemovePermissionCommand({
+              FunctionName: functionName,
+              Qualifier: alias,
+              StatementId: statementId
+            })
+          );
+        } catch (error) {
+          if (!isError(error, "ResourceNotFoundException")) {
+            throw error;
+          }
+        }
+      }
+    }
     return url;
   };
   const createBundleDeployment = async (state2) => {
@@ -658,7 +696,7 @@ var createLambdaProvider = ({ credentials, region }) => {
       name: deploymentAlias
     });
     await configureVersion(state2);
-    const url = await createPublicUrl(state2.functionName, deploymentAlias);
+    const url = await createDeploymentUrl(state2.functionName, deploymentAlias, state2.sourceAccount);
     return {
       ...state2,
       deploymentAlias,
@@ -769,7 +807,20 @@ var createLambdaProvider = ({ credentials, region }) => {
           deploymentAliases.push(deploymentAlias);
         }
         await configureVersion(proposed);
-        const url = await createPublicUrl(proposed.functionName, deploymentAlias);
+        const url = await createDeploymentUrl(proposed.functionName, deploymentAlias, proposed.sourceAccount);
+        if (proposed.sourceAccount && prior.sourceAccount !== proposed.sourceAccount) {
+          await Promise.all(
+            deploymentAliases.filter((name) => name !== deploymentAlias).map(
+              (name) => createDeploymentUrl(proposed.functionName, name, proposed.sourceAccount).catch(
+                (error) => {
+                  if (!isError(error, "ResourceNotFoundException")) {
+                    throw error;
+                  }
+                }
+              )
+            )
+          );
+        }
         return {
           ...proposed,
           deploymentAlias,
@@ -1276,20 +1327,16 @@ var readDeployedFunctionVersion = (state2) => {
 };
 var formatDeploymentSummary = (props) => {
   let previewUrl;
-  let lambdaUrl;
   for (const [urn, node] of readStateNodes(props.state)) {
     if (node.type === "aws_cloudfront_distribution" && urn.endsWith(":{preview}")) {
       previewUrl = `https://${node.output.domainName}`;
     }
-    if (node.type === "bundle-deployment") {
-      lambdaUrl = node.output.url;
-    }
   }
   return Object.keys(props.appConfig.defaults.router ?? {}).map((routerId, index) => {
     return [
       `${routerId}: deployment #${props.id}`,
       index === 0 ? previewUrl : void 0,
-      index === 0 ? lambdaUrl : void 0
+      index === 0 && previewUrl ? `${previewUrl}/?awsless-deployment=${props.id}` : void 0
     ].filter(Boolean).join("\n");
   });
 };
@@ -3843,7 +3890,6 @@ var bundleTypeScriptWithRolldown = async ({
   format: format3 = "esm",
   minify = true,
   file,
-  nativeDir,
   external,
   importAsString: importAsStringList
 }) => {
@@ -3854,7 +3900,25 @@ var bundleTypeScriptWithRolldown = async ({
       return importee.startsWith("@aws-sdk") || importee.startsWith("aws-sdk") || external?.includes(importee);
     },
     treeshake: {
-      moduleSideEffects: (id, isExternal) => isExternal ? external?.includes(id) === true : id.startsWith(`${directories.root}/`)
+      // The @awsless packages are pure clients, but their entry points
+      // also export test helpers that pull in local server
+      // implementations like dynamo-db-local, which crash the ESM
+      // runtime with CJS globals like __dirname. Treating the scope as
+      // side-effect free prunes those unused chains from production
+      // bundles, while every other dependency keeps its import side
+      // effects, like the fs patching of graceful-fs.
+      moduleSideEffects: (id, isExternal) => {
+        if (isExternal) {
+          return external?.includes(id) === true;
+        }
+        if (id.includes("/node_modules/@awsless/")) {
+          return false;
+        }
+        if (id.includes("/node_modules/")) {
+          return true;
+        }
+        return id.startsWith(`${directories.root}/`);
+      }
     },
     onwarn: (error) => {
       debugError(error.message);
@@ -3901,6 +3965,7 @@ var bundleTypeScriptWithRolldown = async ({
     chunkFileNames: `[name].${ext}`,
     minify
   });
+  assertNoTestOnlyModules(result.output);
   const hash = createHash4("sha1");
   const files = [];
   for (const item of result.output) {
@@ -3922,6 +3987,22 @@ var bundleTypeScriptWithRolldown = async ({
     files
   };
 };
+var TEST_ONLY_MODULES = ["dynamo-db-local", "@awsless/dynamodb-server", "redis-memory-server"];
+var assertNoTestOnlyModules = (output) => {
+  for (const item of output) {
+    if (item.type !== "chunk") {
+      continue;
+    }
+    for (const id of item.moduleIds ?? []) {
+      const found = TEST_ONLY_MODULES.find((name) => id.includes(`/node_modules/${name}/`));
+      if (found) {
+        throw new Error(
+          `The test-only package "${found}" was bundled into a production build through "${id}". Remove the import from the handler, or keep the package tree-shakeable.`
+        );
+      }
+    }
+  }
+};
 
 // src/feature/bundle/util.ts
 var ROUTE_HEADER = "x-awsless-route";
@@ -4207,7 +4288,8 @@ var bundleFeature = defineFeature({
         deploymentId: ctx.deploymentId ?? "local-0",
         functionName: lambda.functionName,
         functionVersion: lambda.version,
-        onFailureArn: onFailure
+        onFailureArn: onFailure,
+        sourceAccount: ctx.accountId
       },
       {
         // Make sure the permissions are in place before any event source is wired up.
@@ -9117,7 +9199,7 @@ var getViewerRequestFunctionCode = (props) => {
         ].join("\n")
       ) : ""
     ],
-    ACTIVE_PREFIX(props.router)
+    props.preview ? PREVIEW_PREFIX(props.router) : ACTIVE_PREFIX(props.router)
   );
 };
 var BLOCK_DIRECT_ACCESS_TO_CLOUDFRONT = `
@@ -9177,6 +9259,58 @@ if(!isAuthorized) {
 	}
 }
 `;
+var PREVIEW_PREFIX = (router) => `
+const router = ${JSON.stringify(router)};
+let deployment;
+
+if (request.querystring['awsless-deployment'] && request.querystring['awsless-deployment'].value) {
+	deployment = request.querystring['awsless-deployment'].value;
+} else if (request.cookies && request.cookies['awsless-deployment'] && request.cookies['awsless-deployment'].value) {
+	deployment = request.cookies['awsless-deployment'].value;
+}
+
+let prefix;
+
+try {
+	const pointer = deployment ? '$deploy:' + deployment : '$active';
+	prefix = (await cf.kvs().get(pointer)).split(':')[0] + ':' + router + ':';
+} catch (e) {
+	return deployment
+		? { statusCode: 404, statusDescription: 'Unknown Deployment' }
+		: { statusCode: 503, statusDescription: 'Service Unavailable' };
+}
+
+if (request.querystring['awsless-deployment']) {
+	delete request.querystring['awsless-deployment'];
+
+	const query = [];
+
+	for (const key in request.querystring) {
+		const entry = request.querystring[key];
+
+		if (entry.multiValue) {
+			for (const item of entry.multiValue) {
+				query.push(key + '=' + item.value);
+			}
+		} else {
+			query.push(key + '=' + entry.value);
+		}
+	}
+
+	return {
+		statusCode: 302,
+		statusDescription: 'Found',
+		headers: {
+			location: { value: request.uri + (query.length ? '?' + query.join('&') : '') }
+		},
+		cookies: {
+			'awsless-deployment': {
+				value: deployment,
+				attributes: 'Path=/; Secure; SameSite=Lax'
+			}
+		}
+	};
+}`;
 var ACTIVE_PREFIX = (router) => `
 const router = ${JSON.stringify(router)};
 let prefix;
@@ -9793,6 +9927,7 @@ var routerFeature = defineFeature({
           runtime: "cloudfront-js-2.0",
           code: getViewerRequestFunctionCode({
             router: id,
+            preview: true,
             basicAuth: props.basicAuth,
             passwordAuth: props.passwordAuth
           }),
@@ -9901,22 +10036,6 @@ var routerFeature = defineFeature({
               dependsOn: Array.from(routeDependencies)
             }
           );
-          if (!(props.basicAuth ?? props.passwordAuth)) {
-            bundle.addEnv(
-              "AWSLESS_PREVIEW",
-              $resolve(
-                [routes],
-                (routes2) => JSON.stringify({
-                  router: id,
-                  routes: Object.fromEntries(
-                    Object.entries(routes2).filter(
-                      ([key, route]) => key.startsWith(`${id}:`) && route.type !== "url"
-                    )
-                  )
-                })
-              )
-            );
-          }
         });
       }
       ctx.shared.add("router", "id", id, distribution.id);

package/dist/handlers/bundle.mjs

@@ -3,128 +3,6 @@ import { patch, unpatch } from "@awsless/json";
 import { ExpectedError, invoke, isErrorResponse } from "@awsless/lambda";
 import { formatRoutePayload, getCurrentRoute, withRoute } from "awsless";
 
-// src/feature/bundle/server/preview.ts
-import { GetObjectCommand, NoSuchKey } from "@aws-sdk/client-s3";
-import { s3Client } from "@awsless/s3";
-var getPossibleRouteKeys = (path) => {
-  if (path === "" || path === "/") {
-    return ["/", "/*"];
-  }
-  const parts = path.split("/");
-  const root = path.startsWith("/") ? parts[1] : parts[0];
-  const file = parts[parts.length - 1].includes(".");
-  if (root.includes(".")) {
-    return [path, "/*.", "/*"];
-  }
-  if (file) {
-    return [path, "/" + root + "/*.", "/" + root + "/*", "/*.", "/*"];
-  }
-  return [path, "/" + root + "/*", "/*"];
-};
-var findRoute = (props, path, method) => {
-  for (const key of getPossibleRouteKeys(path)) {
-    const route = props.routes[`${props.router}:${key}`];
-    if (!route) {
-      continue;
-    }
-    if (route.type === "s3" && method !== "GET" && method !== "HEAD") {
-      continue;
-    }
-    return route;
-  }
-  return;
-};
-var rewritePath = (route, path) => {
-  if (!route.rewrite) {
-    return path;
-  }
-  if (route.rewrite.regex) {
-    return path.replace(new RegExp(route.rewrite.regex), route.rewrite.to);
-  }
-  return route.rewrite.to;
-};
-var serveObject = async (route, path, method) => {
-  const bucket = route.domainName.split(".s3")[0];
-  const key = rewritePath(route, path).replace(/^\//, "");
-  let result;
-  try {
-    result = await s3Client().send(new GetObjectCommand({
-      Bucket: bucket,
-      Key: key
-    }));
-  } catch (error) {
-    if (error instanceof NoSuchKey) {
-      return {
-        statusCode: 404
-      };
-    }
-    throw error;
-  }
-  const headers = {};
-  if (result.ContentType) {
-    headers["content-type"] = result.ContentType;
-  }
-  if (result.CacheControl) {
-    headers["cache-control"] = result.CacheControl;
-  }
-  if (result.ETag) {
-    headers["etag"] = result.ETag;
-  }
-  if (method === "HEAD") {
-    return { statusCode: 200, headers };
-  }
-  return {
-    statusCode: 200,
-    headers,
-    body: await result.Body.transformToString("base64"),
-    isBase64Encoded: true
-  };
-};
-var createPreviewHandler = (props) => {
-  return async (event) => {
-    const method = event.requestContext.http.method;
-    const headers = event.headers ?? {};
-    let path = event.rawPath;
-    try {
-      path = decodeURIComponent(path);
-    } catch {}
-    if (method === "OPTIONS") {
-      return {
-        statusCode: 204,
-        headers: {
-          "access-control-allow-origin": "*",
-          "access-control-allow-methods": "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS",
-          "access-control-allow-headers": "*",
-          "access-control-max-age": "86400"
-        }
-      };
-    }
-    const route = findRoute(props, path, method);
-    if (!route) {
-      return {
-        statusCode: 404
-      };
-    }
-    if (route.type === "s3") {
-      return serveObject(route, path, method);
-    }
-    for (const [name, value] of Object.entries(route.requestHeaders ?? {})) {
-      headers[name] = value;
-    }
-    if (headers.authorization) {
-      headers["x-awsless-authorization"] = headers.authorization;
-    } else {
-      delete headers["x-awsless-authorization"];
-    }
-    if (route.forwardHost && headers.host) {
-      headers["x-forwarded-host"] = headers.host;
-    }
-    event.headers = headers;
-    event.rawPath = rewritePath(route, path);
-    return props.dispatch(event);
-  };
-};
-
 // src/feature/bundle/server/resource/util.ts
 var asyncRoute = (key, payload) => {
   process.env.THROW_EXPECTED_ERRORS = "1";
@@ -434,7 +312,6 @@ var topicHandler = (event, routes) => {
 // src/feature/bundle/server/handle.ts
 var createBundle = (handlers) => {
   const routes = Object.keys(handlers);
-  let previewConfig;
   const matchers = [
     functionHandler,
     cronHandler,
@@ -473,7 +350,8 @@ var createBundle = (handlers) => {
       process.env.AWSLESS_ROUTE = match2.key;
       return withRoute(match2.key, invokeRoute, async () => {
         const handle = await load();
-        return handle(match2.payload ?? {}, context);
+        const routedContext = { ...context, route: match2.key };
+        return handle(match2.payload ?? {}, routedContext);
       });
     };
     const invokeRoute = async (key, payload) => {
@@ -502,20 +380,6 @@ var createBundle = (handlers) => {
       }
       return response;
     };
-    const raw = event;
-    if (process.env.AWSLESS_PREVIEW && raw?.requestContext?.http && !event?.headers?.["x-awsless-route"]) {
-      previewConfig ??= JSON.parse(process.env.AWSLESS_PREVIEW);
-      return createPreviewHandler({
-        ...previewConfig,
-        dispatch: async (event2) => {
-          const match2 = matchRoute(event2);
-          if (Array.isArray(match2)) {
-            throw new Error("Unknown bundle route");
-          }
-          return handleRoute(match2);
-        }
-      })(event);
-    }
     const match = matchRoute(event);
     if (Array.isArray(match)) {
       const name = `${process.env.AWS_LAMBDA_FUNCTION_NAME}:${process.env.AWS_LAMBDA_FUNCTION_VERSION}`;

package/dist/handlers/on-failure.mjs

@@ -1,8 +1,81 @@
 // src/feature/on-failure/server/handle.ts
-import { parse, patch } from "@awsless/json";
+import { parse as parse2, patch } from "@awsless/json";
 import { invoke } from "@awsless/lambda";
 import { deleteObject, getObject } from "@awsless/s3";
 import { formatRoutePayload, getRouteEnv } from "awsless";
+
+// src/feature/on-failure/server/util.ts
+import { parse } from "@awsless/json";
+var isDynamoDBFailureEvent = (event) => {
+  return "DDBStreamBatchInfo" in event;
+};
+var logicalResourceName = (physical) => {
+  const segments = physical.replace(/\.fifo$/, "").split("--");
+  if (segments.length === 4) {
+    return `${segments[1]}:${segments[2]}:${segments[3]}`;
+  }
+  if (segments.length === 3) {
+    return `${segments[1]}:${segments[2]}`;
+  }
+  return physical;
+};
+var getFailureSource = (payload) => {
+  const record = getDeliveryRecord(payload);
+  if (!record) {
+    return;
+  }
+  if (isTopicRecord(record)) {
+    return {
+      resource: record.Sns.TopicArn ? logicalResourceName(lastArnSegment(record.Sns.TopicArn)) : "topic",
+      event: parseEvent(record.Sns.Message)
+    };
+  }
+  if (isStreamRecord(record)) {
+    const table = record.eventSourceARN.split("/")[1];
+    return {
+      resource: table ? logicalResourceName(table) : "table-stream"
+    };
+  }
+  if (isQueueRecord(record)) {
+    return {
+      resource: logicalResourceName(lastArnSegment(record.eventSourceARN)),
+      event: parseEvent(record.body)
+    };
+  }
+  return;
+};
+var getDeliveryRecord = (payload) => {
+  if (!payload || typeof payload !== "object") {
+    return;
+  }
+  const records = payload.Records;
+  const record = Array.isArray(records) ? records[0] : undefined;
+  return record && typeof record === "object" ? record : undefined;
+};
+var isTopicRecord = (record) => {
+  return "Sns" in record && typeof record.Sns === "object" && record.Sns !== null;
+};
+var isStreamRecord = (record) => {
+  return "eventSource" in record && record.eventSource === "aws:dynamodb" && "eventSourceARN" in record;
+};
+var isQueueRecord = (record) => {
+  return "eventSource" in record && record.eventSource === "aws:sqs" && "eventSourceARN" in record;
+};
+var lastArnSegment = (arn) => {
+  return arn.split(":").at(-1);
+};
+var parseEvent = (value) => {
+  if (typeof value !== "string") {
+    return value;
+  }
+  try {
+    return parse(value);
+  } catch {
+    return value;
+  }
+};
+
+// src/feature/on-failure/server/handle.ts
 var handle_default = async (event, context) => {
   if (!Array.isArray(event.Records)) {
     throw new TypeError(`Unknown Event Type: ${JSON.stringify(event)}`);
@@ -28,13 +101,16 @@ var sqsRecord = async (record, context) => {
     await Promise.all(s3Records.map((record2) => s3Record(record2, context)));
     return;
   }
+  const queueName = record.messageAttributes.queueName?.stringValue;
+  const body = parsePayload(record.body);
   const payload = {
     type: "queue",
     id: record.messageId,
     date: new Date(Number(record.attributes.SentTimestamp)),
-    payload: parsePayload(record.body),
+    payload: body,
+    source: queueName ? { resource: logicalResourceName(queueName), event: body } : undefined,
     queue: {
-      name: record.messageAttributes.queueName?.stringValue,
+      name: queueName,
       url: record.messageAttributes.queueUrl?.stringValue
     }
   };
@@ -70,9 +146,6 @@ var s3Record = async (record, context) => {
     key
   });
 };
-var isDynamoDBFailureEvent = (event) => {
-  return "DDBStreamBatchInfo" in event;
-};
 var formatUnknownFailureEvent = (event) => {
   if (isDynamoDBFailureEvent(event)) {
     return formatDynamoDBStreamFailureEvent(event);
@@ -90,6 +163,7 @@ var formatAsyncLambdaFailureEvent = (event) => {
       name: typeof route === "string" ? route : event.requestContext.functionArn.split(":")[6]
     },
     payload: typeof route === "string" ? payload.event ?? {} : payload,
+    source: typeof route === "string" ? { resource: route, event: payload.event ?? {} } : getFailureSource(payload),
     error: {
       type: event.responsePayload.errorType,
       message: event.responsePayload.errorMessage,
@@ -98,6 +172,9 @@ var formatAsyncLambdaFailureEvent = (event) => {
   };
 };
 var formatDynamoDBStreamFailureEvent = (event) => {
+  const payload = parsePayload(event.payload);
+  const streamArn = event.DDBStreamBatchInfo?.streamArn;
+  const table = streamArn?.split("/")[1];
   return {
     type: "dynamodb-stream",
     date: new Date(event.timestamp),
@@ -105,12 +182,13 @@ var formatDynamoDBStreamFailureEvent = (event) => {
     function: {
       name: event.requestContext.functionArn.split(":")[6]
     },
-    payload: parsePayload(event.payload)
+    payload,
+    source: table ? { resource: logicalResourceName(table) } : getFailureSource(payload)
   };
 };
 var parsePayload = (payload) => {
   try {
-    return parse(payload);
+    return parse2(payload);
   } catch {
     return payload;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awsless/cli",
-  "version": "0.0.46-next.1",
+  "version": "0.0.46-next.2",
   "license": "MIT",
   "type": "module",
   "sideEffects": false,
@@ -83,23 +83,23 @@
     "zod": "^3.24.2",
     "zod-to-json-schema": "^3.24.3",
     "@awsless/big-float": "^0.1.7",
-    "@awsless/clui": "^0.0.8",
     "@awsless/cloudwatch": "^0.0.1",
     "@awsless/duration": "^0.0.4",
+    "@awsless/clui": "^0.0.8",
     "@awsless/dynamodb": "^0.3.21",
     "@awsless/iot": "^0.0.5",
     "@awsless/json": "^0.0.11",
-    "@awsless/lambda": "^0.0.44",
     "@awsless/s3": "^0.0.21",
+    "@awsless/lambda": "^0.0.45",
     "@awsless/redis": "^0.1.13",
-    "@awsless/size": "^0.0.2",
+    "@awsless/scheduler": "^0.0.4",
     "@awsless/sns": "^0.0.10",
     "@awsless/sqs": "^0.0.24",
     "@awsless/ts-file-cache": "^0.0.16",
-    "@awsless/weak-cache": "^0.0.1",
     "@awsless/validate": "^0.1.7",
+    "@awsless/weak-cache": "^0.0.1",
     "awsless": "^0.0.15-next.0",
-    "@awsless/scheduler": "^0.0.4"
+    "@awsless/size": "^0.0.2"
   },
   "devDependencies": {
     "@hono/node-server": "1.19.9",