@awsless/cli 0.0.46-next.1 → 0.0.46-next.3

package/dist/bin.js

@@ -173,7 +173,7 @@ import { DynamoDBClient as DynamoDBClient2, migrate } from "@awsless/dynamodb";
 // src/util/deployment.ts
 import { CloudFrontClient as CloudFrontClient2 } from "@aws-sdk/client-cloudfront";
 import { CloudFrontKeyValueStoreClient as CloudFrontKeyValueStoreClient2 } from "@aws-sdk/client-cloudfront-keyvaluestore";
-import { GetFunctionCommand, LambdaClient as LambdaClient3 } from "@aws-sdk/client-lambda";
+import { DeleteFunctionCommand, GetFunctionCommand, LambdaClient as LambdaClient3 } from "@aws-sdk/client-lambda";
 import {
   define,
   deleteItem,
@@ -366,6 +366,7 @@ import {
   DeleteFunctionUrlConfigCommand,
   GetAliasCommand,
   LambdaClient,
+  ListAliasesCommand,
   UpdateAliasCommand,
   UpdateFunctionCodeCommand
 } from "@aws-sdk/client-lambda";
@@ -386,6 +387,22 @@ var getLambdaAlias = async (lambda, functionName, name) => {
     return;
   }
 };
+var listLambdaAliases = async (lambda, functionName, functionVersion) => {
+  const aliases = [];
+  let marker;
+  do {
+    const result = await lambda.send(
+      new ListAliasesCommand({
+        FunctionName: functionName,
+        FunctionVersion: functionVersion,
+        Marker: marker
+      })
+    );
+    aliases.push(...result.Aliases ?? []);
+    marker = result.NextMarker;
+  } while (marker);
+  return aliases;
+};
 var upsertLambdaAlias = async (lambda, props) => {
   const input = {
     FunctionName: props.functionName,
@@ -528,6 +545,8 @@ import {
   CreateAliasCommand as CreateAliasCommand2,
   CreateFunctionUrlConfigCommand,
   GetFunctionUrlConfigCommand,
+  RemovePermissionCommand,
+  UpdateFunctionUrlConfigCommand,
   LambdaClient as LambdaClient2,
   PutFunctionEventInvokeConfigCommand
 } from "@aws-sdk/client-lambda";
@@ -559,7 +578,8 @@ var createLambdaProvider = ({ credentials, region }) => {
     deploymentId: z2.string(),
     functionName: z2.string(),
     functionVersion: z2.string(),
-    onFailureArn: z2.string()
+    onFailureArn: z2.string(),
+    sourceAccount: z2.string().optional()
   });
   const bundleDeploymentStateSchema = bundleDeploymentInputSchema.extend({
     deploymentAlias: z2.string(),
@@ -596,14 +616,15 @@ var createLambdaProvider = ({ credentials, region }) => {
       })
     );
   };
-  const createPublicUrl = async (functionName, alias) => {
+  const createDeploymentUrl = async (functionName, alias, sourceAccount) => {
+    const authType = sourceAccount ? "AWS_IAM" : "NONE";
     let url;
     try {
       const result = await lambda.send(
         new CreateFunctionUrlConfigCommand({
           FunctionName: functionName,
           Qualifier: alias,
-          AuthType: "NONE"
+          AuthType: authType
         })
       );
       url = result.FunctionUrl;
@@ -612,21 +633,39 @@ var createLambdaProvider = ({ credentials, region }) => {
         throw error;
       }
       const result = await lambda.send(
-        new GetFunctionUrlConfigCommand({
+        new UpdateFunctionUrlConfigCommand({
           FunctionName: functionName,
-          Qualifier: alias
+          Qualifier: alias,
+          AuthType: authType
         })
       );
       url = result.FunctionUrl;
     }
-    const permissions = [
+    const permissions = sourceAccount ? [
+      {
+        StatementId: "cloudfront-url",
+        Principal: "cloudfront.amazonaws.com",
+        SourceAccount: sourceAccount,
+        Action: "lambda:InvokeFunctionUrl",
+        FunctionUrlAuthType: "AWS_IAM"
+      },
+      {
+        StatementId: "cloudfront-invoke",
+        Principal: "cloudfront.amazonaws.com",
+        SourceAccount: sourceAccount,
+        Action: "lambda:InvokeFunction",
+        InvokedViaFunctionUrl: true
+      }
+    ] : [
       {
         StatementId: "public-url",
+        Principal: "*",
         Action: "lambda:InvokeFunctionUrl",
         FunctionUrlAuthType: "NONE"
       },
       {
         StatementId: "public-invoke",
+        Principal: "*",
         Action: "lambda:InvokeFunction",
         InvokedViaFunctionUrl: true
       }
@@ -637,7 +676,6 @@ var createLambdaProvider = ({ credentials, region }) => {
           new AddPermissionCommand({
             FunctionName: functionName,
             Qualifier: alias,
-            Principal: "*",
             ...permission
           })
         );
@@ -647,6 +685,23 @@ var createLambdaProvider = ({ credentials, region }) => {
         }
       }
     }
+    if (sourceAccount) {
+      for (const statementId of ["public-url", "public-invoke"]) {
+        try {
+          await lambda.send(
+            new RemovePermissionCommand({
+              FunctionName: functionName,
+              Qualifier: alias,
+              StatementId: statementId
+            })
+          );
+        } catch (error) {
+          if (!isError(error, "ResourceNotFoundException")) {
+            throw error;
+          }
+        }
+      }
+    }
     return url;
   };
   const createBundleDeployment = async (state2) => {
@@ -658,7 +713,7 @@ var createLambdaProvider = ({ credentials, region }) => {
       name: deploymentAlias
     });
     await configureVersion(state2);
-    const url = await createPublicUrl(state2.functionName, deploymentAlias);
+    const url = await createDeploymentUrl(state2.functionName, deploymentAlias, state2.sourceAccount);
     return {
       ...state2,
       deploymentAlias,
@@ -769,7 +824,21 @@ var createLambdaProvider = ({ credentials, region }) => {
           deploymentAliases.push(deploymentAlias);
         }
         await configureVersion(proposed);
-        const url = await createPublicUrl(proposed.functionName, deploymentAlias);
+        const url = await createDeploymentUrl(proposed.functionName, deploymentAlias, proposed.sourceAccount);
+        if (proposed.sourceAccount && prior.sourceAccount !== proposed.sourceAccount) {
+          for (const name of deploymentAliases) {
+            if (name === deploymentAlias) {
+              continue;
+            }
+            try {
+              await createDeploymentUrl(proposed.functionName, name, proposed.sourceAccount);
+            } catch (error) {
+              if (!isError(error, "ResourceNotFoundException")) {
+                throw error;
+              }
+            }
+          }
+        }
         return {
           ...proposed,
           deploymentAlias,
@@ -1259,6 +1328,60 @@ var markPromoted = async (client, appId, id) => {
 var removeDeployment = async (client, appId, id) => {
   await deleteItem(table, { appId, id }, { client });
 };
+var selectPrunableDeployments = (items, liveId, options) => {
+  const rollbackTarget = items.filter((item) => item.promotedAt && item.id !== liveId).sort((a, b) => b.promotedAt.localeCompare(a.promotedAt))[0];
+  const keep = Math.max(1, Number(options.keep) || 10);
+  const mainSlug = slugifyBranch(options.main);
+  const keptMain = new Set(
+    items.filter((item) => item.branch === mainSlug && item.functionVersion).map((item) => item.seq).sort((a, b) => b - a).slice(0, keep)
+  );
+  const dayAgo = new Date(Date.now() - 24 * 60 * 60 * 1e3).toISOString();
+  return items.filter((item) => {
+    if (item.id === liveId || item.id === rollbackTarget?.id) {
+      return false;
+    }
+    if (options.branch) {
+      return item.branch === slugifyBranch(options.branch);
+    }
+    if (!item.functionVersion) {
+      return item.createdAt < dayAgo;
+    }
+    if (item.branch === mainSlug) {
+      return !keptMain.has(item.seq);
+    }
+    return item.commit ? isCommitMerged(item.commit, options.main) : false;
+  });
+};
+var pruneFunctionVersion = async (lambda, functionName, version) => {
+  for (const alias of await listLambdaAliases(lambda, functionName, version)) {
+    if (alias.Name && alias.Name !== LIVE_LAMBDA_ALIAS) {
+      await deleteLambdaAlias(lambda, functionName, alias.Name);
+    }
+  }
+  try {
+    await lambda.send(
+      new DeleteFunctionCommand({
+        FunctionName: functionName,
+        Qualifier: version
+      })
+    );
+  } catch (error) {
+    if (!isError(error, "ResourceNotFoundException")) {
+      throw error;
+    }
+  }
+};
+var selectPrunableVersions = async (props) => {
+  const surviving = props.items.filter((item) => !props.prunable.includes(item));
+  const kept = new Set(surviving.map((item) => item.functionVersion));
+  const live = await getLambdaAlias(props.lambda, props.functionName, LIVE_LAMBDA_ALIAS);
+  if (live?.FunctionVersion) {
+    kept.add(live.FunctionVersion);
+  }
+  return new Set(
+    props.prunable.map((item) => item.functionVersion).filter((version) => Boolean(version && !kept.has(version)))
+  );
+};
 var readLiveDeploymentId = async (lambda, functionName) => {
   return (await getLambdaAlias(lambda, functionName, LIVE_LAMBDA_ALIAS))?.Description || void 0;
 };
@@ -1275,21 +1398,21 @@ var readDeployedFunctionVersion = (state2) => {
   return;
 };
 var formatDeploymentSummary = (props) => {
-  let previewUrl;
-  let lambdaUrl;
+  const previewUrls = /* @__PURE__ */ new Map();
   for (const [urn, node] of readStateNodes(props.state)) {
     if (node.type === "aws_cloudfront_distribution" && urn.endsWith(":{preview}")) {
-      previewUrl = `https://${node.output.domainName}`;
-    }
-    if (node.type === "bundle-deployment") {
-      lambdaUrl = node.output.url;
+      const router = urn.match(/router:\{([^}]+)\}/)?.[1];
+      if (router) {
+        previewUrls.set(router, `https://${node.output.domainName}`);
+      }
     }
   }
-  return Object.keys(props.appConfig.defaults.router ?? {}).map((routerId, index) => {
+  return Object.keys(props.appConfig.defaults.router ?? {}).map((routerId) => {
+    const previewUrl = previewUrls.get(routerId);
     return [
       `${routerId}: deployment #${props.id}`,
-      index === 0 ? previewUrl : void 0,
-      index === 0 ? lambdaUrl : void 0
+      previewUrl,
+      previewUrl ? `${previewUrl}/?awsless-deployment=${props.id}` : void 0
     ].filter(Boolean).join("\n");
   });
 };
@@ -3843,7 +3966,6 @@ var bundleTypeScriptWithRolldown = async ({
   format: format3 = "esm",
   minify = true,
   file,
-  nativeDir,
   external,
   importAsString: importAsStringList
 }) => {
@@ -3854,7 +3976,10 @@ var bundleTypeScriptWithRolldown = async ({
       return importee.startsWith("@aws-sdk") || importee.startsWith("aws-sdk") || external?.includes(importee);
     },
     treeshake: {
-      moduleSideEffects: (id, isExternal) => isExternal ? external?.includes(id) === true : id.startsWith(`${directories.root}/`)
+      // Dependencies are treated as side-effect free, so unused imports
+      // like the local test servers never reach the production bundle.
+      // The bundle guard below fails the build if one slips through.
+      moduleSideEffects: (id, isExternal) => isExternal ? external?.includes(id) === true : id.startsWith(`${directories.root}/`) && !id.includes("/node_modules/")
     },
     onwarn: (error) => {
       debugError(error.message);
@@ -3901,6 +4026,7 @@ var bundleTypeScriptWithRolldown = async ({
     chunkFileNames: `[name].${ext}`,
     minify
   });
+  assertNoTestOnlyModules(result.output);
   const hash = createHash4("sha1");
   const files = [];
   for (const item of result.output) {
@@ -3922,6 +4048,22 @@ var bundleTypeScriptWithRolldown = async ({
     files
   };
 };
+var TEST_ONLY_MODULES = ["dynamo-db-local", "@awsless/dynamodb-server", "redis-memory-server"];
+var assertNoTestOnlyModules = (output) => {
+  for (const item of output) {
+    if (item.type !== "chunk") {
+      continue;
+    }
+    for (const id of item.moduleIds ?? []) {
+      const found = TEST_ONLY_MODULES.find((name) => id.includes(`/node_modules/${name}/`));
+      if (found) {
+        throw new Error(
+          `The test-only package "${found}" was bundled into a production build through "${id}". Remove the import from the handler, or keep the package tree-shakeable.`
+        );
+      }
+    }
+  }
+};
 
 // src/feature/bundle/util.ts
 var ROUTE_HEADER = "x-awsless-route";
@@ -4038,6 +4180,11 @@ var bundleFeature = defineFeature({
     const addLayer = (layer) => {
       layers.push(layer);
     };
+    const layerIds = Object.keys(ctx.appConfig.defaults.layers ?? {});
+    const layerPackages = layerIds.flatMap((id) => ctx.shared.entry("layer", "packages", id));
+    for (const id of layerIds) {
+      addLayer(ctx.shared.entry("layer", "arn", id));
+    }
     const name = getBundleFunctionName(ctx.app.name);
     const shortName = formatGlobalResourceName({
       appName: ctx.app.name,
@@ -4051,7 +4198,7 @@ var bundleFeature = defineFeature({
         name,
         handlers,
         minify: defaults.minify,
-        external: defaults.external
+        external: [...defaults.external ?? [], ...layerPackages]
       })
     );
     const sourceHash = new Output3(envDeps, async (resolve2) => {
@@ -4207,7 +4354,8 @@ var bundleFeature = defineFeature({
         deploymentId: ctx.deploymentId ?? "local-0",
         functionName: lambda.functionName,
         functionVersion: lambda.version,
-        onFailureArn: onFailure
+        onFailureArn: onFailure,
+        sourceAccount: ctx.accountId
       },
       {
         // Make sure the permissions are in place before any event source is wired up.
@@ -6922,14 +7070,15 @@ var siteFeature = defineFeature({
               env,
               stdout: "pipe",
               stderr: "pipe"
-              // stdout: 'ignore',
-              // stderr: ''
-              // stdout: 'inherit',
-              // stderr: 'inherit',
             });
-            await instance.exited;
+            const [output, errors] = await Promise.all([
+              new Response(instance.stdout).text(),
+              new Response(instance.stderr).text(),
+              instance.exited
+            ]);
             if (instance.exitCode !== null && instance.exitCode > 0) {
-              throw new Error("Site build failed");
+              throw new ExpectedError(`Site build failed:
+${(errors.trim() || output.trim()).slice(-2e3)}`);
             }
             await write("HASH", fingerprint);
             return {
@@ -9117,7 +9266,7 @@ var getViewerRequestFunctionCode = (props) => {
         ].join("\n")
       ) : ""
     ],
-    ACTIVE_PREFIX(props.router)
+    props.preview ? PREVIEW_PREFIX(props.router) : ACTIVE_PREFIX(props.router)
   );
 };
 var BLOCK_DIRECT_ACCESS_TO_CLOUDFRONT = `
@@ -9172,11 +9321,64 @@ var PASSWORD_AUTH_CHECK = (password) => `
 authMethods.push('Password realm="Protected"');
 
 if(!isAuthorized) {
-	if(authHeader && authHeader.startsWith('Password ') && authHeader.slice(9) === '${password}') {
+	if(authHeader && authHeader.startsWith('Password ') && authHeader.slice(9) === ${JSON.stringify(password)}) {
 		isAuthorized = true;
 	}
 }
 `;
+var PREVIEW_PREFIX = (router) => `
+const router = ${JSON.stringify(router)};
+let deployment;
+
+if (request.querystring['awsless-deployment'] && request.querystring['awsless-deployment'].value) {
+	deployment = request.querystring['awsless-deployment'].value;
+} else if (request.cookies && request.cookies['awsless-deployment'] && request.cookies['awsless-deployment'].value) {
+	deployment = request.cookies['awsless-deployment'].value;
+}
+
+let prefix;
+
+try {
+	const pointer = deployment ? '$deploy:' + deployment : '$active';
+	prefix = (await cf.kvs().get(pointer)).split(':')[0] + ':' + router + ':';
+} catch (e) {
+	return deployment
+		? { statusCode: 404, statusDescription: 'Unknown Deployment' }
+		: { statusCode: 503, statusDescription: 'Service Unavailable' };
+}
+
+if (deployment && request.querystring['awsless-deployment']) {
+	delete request.querystring['awsless-deployment'];
+
+	const query = [];
+
+	for (const key in request.querystring) {
+		const entry = request.querystring[key];
+
+		if (entry.multiValue) {
+			// The CloudFront js runtime doesn't support for...of.
+			for (const i in entry.multiValue) {
+				query.push(key + '=' + entry.multiValue[i].value);
+			}
+		} else {
+			query.push(key + '=' + entry.value);
+		}
+	}
+
+	return {
+		statusCode: 302,
+		statusDescription: 'Found',
+		headers: {
+			location: { value: request.uri + (query.length ? '?' + query.join('&') : '') }
+		},
+		cookies: {
+			'awsless-deployment': {
+				value: deployment,
+				attributes: 'Path=/; Secure; SameSite=Lax'
+			}
+		}
+	};
+}`;
 var ACTIVE_PREFIX = (router) => `
 const router = ${JSON.stringify(router)};
 let prefix;
@@ -9450,7 +9652,6 @@ var routerFeature = defineFeature({
     const distributionIds = [];
     let hasLambdaRoutes = false;
     let routeStore;
-    let previewDistribution;
     for (const [id, props] of routers) {
       const group = new Group29(ctx.base, "router", id);
       const name = formatGlobalResourceName({
@@ -9787,19 +9988,20 @@ var routerFeature = defineFeature({
         ],
         webAclId: waf?.arn
       });
-      if (id === defaultRouter) {
+      {
         const previewFunction = new aws30.cloudfront.Function(group, "preview-function", {
           name: `${name.slice(0, 55)}--preview`,
           runtime: "cloudfront-js-2.0",
           code: getViewerRequestFunctionCode({
             router: id,
+            preview: true,
             basicAuth: props.basicAuth,
             passwordAuth: props.passwordAuth
           }),
           publish: true,
           keyValueStoreAssociations: [routeStore.arn]
         });
-        previewDistribution = new aws30.cloudfront.Distribution(group, "preview", {
+        const previewDistribution = new aws30.cloudfront.Distribution(group, "preview", {
           tags: {
             name: `${name}-preview`
           },
@@ -9863,6 +10065,9 @@ var routerFeature = defineFeature({
           webAclId: waf?.arn
         });
         distributionIds.push(previewDistribution.id);
+        ctx.shared.add("router", "preview-id", id, previewDistribution.id);
+      }
+      if (id === defaultRouter) {
         ctx.onReadyLast(() => {
           const bundle = ctx.shared.get("bundle", "main");
           let lambdaUrlHost;
@@ -9901,26 +10106,9 @@ var routerFeature = defineFeature({
               dependsOn: Array.from(routeDependencies)
             }
           );
-          if (!(props.basicAuth ?? props.passwordAuth)) {
-            bundle.addEnv(
-              "AWSLESS_PREVIEW",
-              $resolve(
-                [routes],
-                (routes2) => JSON.stringify({
-                  router: id,
-                  routes: Object.fromEntries(
-                    Object.entries(routes2).filter(
-                      ([key, route]) => key.startsWith(`${id}:`) && route.type !== "url"
-                    )
-                  )
-                })
-              )
-            );
-          }
         });
       }
       ctx.shared.add("router", "id", id, distribution.id);
-      ctx.shared.add("router", "preview-id", id, previewDistribution.id);
       distributionIds.push(distribution.id);
       if (props.domain) {
         const domainName = formatFullDomainName(ctx.appConfig, props.domain, props.subDomain);
@@ -11483,9 +11671,10 @@ var deploy = (program2) => {
         }
       });
       playSuccessSound();
-      const details = deployments2.length > 0 ? `
-${deployments2.join("\n")}` : "";
-      return `Deployment #${deployment.id} is live.${details}`;
+      for (const summary of deployments2) {
+        log20.message(summary);
+      }
+      return `Deployment #${deployment.id} is live.`;
     });
   });
 };
@@ -11976,7 +12165,7 @@ var bind = (program2) => {
         stderr: "inherit"
       });
       await instance.exited;
-      process.exit(0);
+      process.exit(instance.exitCode ?? 1);
     });
   });
 };
@@ -12096,7 +12285,7 @@ var resources = (program2) => {
           return `${color.dim("{")}${color.warning(v)}${color.dim("}")}`;
         }).replaceAll(":", color.dim(":"));
       };
-      const formatStatus = (status) => {
+      const formatStatus2 = (status) => {
         if (status === "created") {
           return color.success(status);
         }
@@ -12121,7 +12310,7 @@ var resources = (program2) => {
             stack.resources.map((r) => {
               return [
                 //
-                formatStatus(r.status),
+                formatStatus2(r.status),
                 color.dim(icon.arrow.right),
                 formatResource(stack.urn, r.urn)
               ].join(" ");
@@ -13047,7 +13236,7 @@ var activity = (program2) => {
 // src/cli/command/deployment.ts
 import { CloudFrontClient as CloudFrontClient6 } from "@aws-sdk/client-cloudfront";
 import { CloudFrontKeyValueStoreClient as CloudFrontKeyValueStoreClient3 } from "@aws-sdk/client-cloudfront-keyvaluestore";
-import { DeleteFunctionCommand, LambdaClient as LambdaClient7 } from "@aws-sdk/client-lambda";
+import { LambdaClient as LambdaClient7 } from "@aws-sdk/client-lambda";
 import { log as log35, prompt as prompt19 } from "@awsless/clui";
 import { DynamoDBClient as DynamoDBClient6 } from "@awsless/dynamodb";
 var createClients = async (appConfig) => {
@@ -13070,6 +13259,12 @@ var formatAge = (iso) => {
   if (minutes8 < 60 * 24) return `${Math.floor(minutes8 / 60)}h ago`;
   return `${Math.floor(minutes8 / (60 * 24))}d ago`;
 };
+var formatStatus = (item, liveId) => {
+  if (item.id === liveId) return color.success("live    ");
+  if (item.promotedAt) return "promoted";
+  if (item.functionVersion) return color.info("staged  ");
+  return color.dim("pending ");
+};
 var deployments = (program2) => {
   program2.command("deployments").description("List the deployment history of your app").action(async () => {
     await layout("deployments", async ({ appConfig }) => {
@@ -13083,17 +13278,16 @@ var deployments = (program2) => {
       }
       const idWidth = Math.max(...items.map((item) => item.id.length));
       log35.message(
-        items.map((item) => {
-          const status = item.id === liveId ? color.success("live    ") : item.promotedAt ? "promoted" : item.functionVersion ? color.info("staged  ") : color.dim("pending ");
-          return [
+        items.map(
+          (item) => [
             color.label(item.id.padEnd(idWidth)),
-            status,
+            formatStatus(item, liveId),
             formatAge(item.createdAt).padEnd(8),
             color.dim(item.commit?.slice(0, 7) ?? "-------"),
             (item.message ?? "").slice(0, 50).padEnd(50),
             color.dim(item.user ?? "")
-          ].join("  ");
-        }).join("\n")
+          ].join("  ")
+        ).join("\n")
       );
       return `Found ${items.length} deployments.`;
     });
@@ -13107,28 +13301,7 @@ var prune = (program2) => {
         listDeployments(dynamo, appId),
         readLiveDeploymentId(lambda, functionName)
       ]);
-      const rollbackTarget = items.filter((item) => item.promotedAt && item.id !== liveId).sort((a, b) => b.promotedAt.localeCompare(a.promotedAt))[0];
-      const keep = Math.max(1, Number(options.keep) || 10);
-      const mainSlug = slugifyBranch(options.main);
-      const keptMain = new Set(
-        items.filter((item) => item.branch === mainSlug && item.functionVersion).map((item) => item.seq).sort((a, b) => b - a).slice(0, keep)
-      );
-      const dayAgo = new Date(Date.now() - 24 * 60 * 60 * 1e3).toISOString();
-      const prunable = items.filter((item) => {
-        if (item.id === liveId || item.id === rollbackTarget?.id) {
-          return false;
-        }
-        if (options.branch) {
-          return item.branch === slugifyBranch(options.branch);
-        }
-        if (!item.functionVersion) {
-          return item.createdAt < dayAgo;
-        }
-        if (item.branch === mainSlug) {
-          return !keptMain.has(item.seq);
-        }
-        return item.commit ? isCommitMerged(item.commit, options.main) : false;
-      });
+      const prunable = selectPrunableDeployments(items, liveId, options);
       if (prunable.length === 0) {
         return `Nothing to prune.`;
       }
@@ -13148,28 +13321,9 @@ var prune = (program2) => {
           for (const item of prunable) {
             await deleteLambdaAlias(lambda, functionName, getDeploymentLambdaAliasName(item.id));
           }
-          const surviving = items.filter((item) => !prunable.includes(item));
-          const keepVersions = new Set(surviving.map((item) => item.functionVersion));
-          const live = await getLambdaAlias(lambda, functionName, LIVE_LAMBDA_ALIAS);
-          if (live?.FunctionVersion) {
-            keepVersions.add(live.FunctionVersion);
-          }
-          const versions = new Set(
-            prunable.map((item) => item.functionVersion).filter((version) => version && !keepVersions.has(version))
-          );
+          const versions = await selectPrunableVersions({ lambda, functionName, items, prunable });
           for (const version of versions) {
-            try {
-              await lambda.send(
-                new DeleteFunctionCommand({
-                  FunctionName: functionName,
-                  Qualifier: version
-                })
-              );
-            } catch (error) {
-              if (!isError(error, "ResourceNotFoundException") && !isError(error, "ResourceConflictException")) {
-                throw error;
-              }
-            }
+            await pruneFunctionVersion(lambda, functionName, version);
           }
           const storeArn = await getRouteStoreArn(
             cloudfront,
@@ -13255,8 +13409,8 @@ program.option("--stage <string>", "The stage to use");
 program.option("-c --no-cache", "Always build & test without the cache");
 program.option("-s --skip-prompt", "Skip prompts");
 program.option("-v --verbose", "Print verbose logs");
-program.exitOverride(() => {
-  process.exit(0);
+program.exitOverride((error) => {
+  process.exit(error.exitCode);
 });
 program.on("option:verbose", () => {
   process.env.VERBOSE = program.opts().verbose ? "1" : void 0;

package/dist/handlers/bundle.mjs

@@ -3,128 +3,6 @@ import { patch, unpatch } from "@awsless/json";
 import { ExpectedError, invoke, isErrorResponse } from "@awsless/lambda";
 import { formatRoutePayload, getCurrentRoute, withRoute } from "awsless";
 
-// src/feature/bundle/server/preview.ts
-import { GetObjectCommand, NoSuchKey } from "@aws-sdk/client-s3";
-import { s3Client } from "@awsless/s3";
-var getPossibleRouteKeys = (path) => {
-  if (path === "" || path === "/") {
-    return ["/", "/*"];
-  }
-  const parts = path.split("/");
-  const root = path.startsWith("/") ? parts[1] : parts[0];
-  const file = parts[parts.length - 1].includes(".");
-  if (root.includes(".")) {
-    return [path, "/*.", "/*"];
-  }
-  if (file) {
-    return [path, "/" + root + "/*.", "/" + root + "/*", "/*.", "/*"];
-  }
-  return [path, "/" + root + "/*", "/*"];
-};
-var findRoute = (props, path, method) => {
-  for (const key of getPossibleRouteKeys(path)) {
-    const route = props.routes[`${props.router}:${key}`];
-    if (!route) {
-      continue;
-    }
-    if (route.type === "s3" && method !== "GET" && method !== "HEAD") {
-      continue;
-    }
-    return route;
-  }
-  return;
-};
-var rewritePath = (route, path) => {
-  if (!route.rewrite) {
-    return path;
-  }
-  if (route.rewrite.regex) {
-    return path.replace(new RegExp(route.rewrite.regex), route.rewrite.to);
-  }
-  return route.rewrite.to;
-};
-var serveObject = async (route, path, method) => {
-  const bucket = route.domainName.split(".s3")[0];
-  const key = rewritePath(route, path).replace(/^\//, "");
-  let result;
-  try {
-    result = await s3Client().send(new GetObjectCommand({
-      Bucket: bucket,
-      Key: key
-    }));
-  } catch (error) {
-    if (error instanceof NoSuchKey) {
-      return {
-        statusCode: 404
-      };
-    }
-    throw error;
-  }
-  const headers = {};
-  if (result.ContentType) {
-    headers["content-type"] = result.ContentType;
-  }
-  if (result.CacheControl) {
-    headers["cache-control"] = result.CacheControl;
-  }
-  if (result.ETag) {
-    headers["etag"] = result.ETag;
-  }
-  if (method === "HEAD") {
-    return { statusCode: 200, headers };
-  }
-  return {
-    statusCode: 200,
-    headers,
-    body: await result.Body.transformToString("base64"),
-    isBase64Encoded: true
-  };
-};
-var createPreviewHandler = (props) => {
-  return async (event) => {
-    const method = event.requestContext.http.method;
-    const headers = event.headers ?? {};
-    let path = event.rawPath;
-    try {
-      path = decodeURIComponent(path);
-    } catch {}
-    if (method === "OPTIONS") {
-      return {
-        statusCode: 204,
-        headers: {
-          "access-control-allow-origin": "*",
-          "access-control-allow-methods": "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS",
-          "access-control-allow-headers": "*",
-          "access-control-max-age": "86400"
-        }
-      };
-    }
-    const route = findRoute(props, path, method);
-    if (!route) {
-      return {
-        statusCode: 404
-      };
-    }
-    if (route.type === "s3") {
-      return serveObject(route, path, method);
-    }
-    for (const [name, value] of Object.entries(route.requestHeaders ?? {})) {
-      headers[name] = value;
-    }
-    if (headers.authorization) {
-      headers["x-awsless-authorization"] = headers.authorization;
-    } else {
-      delete headers["x-awsless-authorization"];
-    }
-    if (route.forwardHost && headers.host) {
-      headers["x-forwarded-host"] = headers.host;
-    }
-    event.headers = headers;
-    event.rawPath = rewritePath(route, path);
-    return props.dispatch(event);
-  };
-};
-
 // src/feature/bundle/server/resource/util.ts
 var asyncRoute = (key, payload) => {
   process.env.THROW_EXPECTED_ERRORS = "1";
@@ -434,7 +312,6 @@ var topicHandler = (event, routes) => {
 // src/feature/bundle/server/handle.ts
 var createBundle = (handlers) => {
   const routes = Object.keys(handlers);
-  let previewConfig;
   const matchers = [
     functionHandler,
     cronHandler,
@@ -473,7 +350,8 @@ var createBundle = (handlers) => {
       process.env.AWSLESS_ROUTE = match2.key;
       return withRoute(match2.key, invokeRoute, async () => {
         const handle = await load();
-        return handle(match2.payload ?? {}, context);
+        const routedContext = { ...context, route: match2.key };
+        return handle(match2.payload ?? {}, routedContext);
       });
     };
     const invokeRoute = async (key, payload) => {
@@ -502,20 +380,6 @@ var createBundle = (handlers) => {
       }
       return response;
     };
-    const raw = event;
-    if (process.env.AWSLESS_PREVIEW && raw?.requestContext?.http && !event?.headers?.["x-awsless-route"]) {
-      previewConfig ??= JSON.parse(process.env.AWSLESS_PREVIEW);
-      return createPreviewHandler({
-        ...previewConfig,
-        dispatch: async (event2) => {
-          const match2 = matchRoute(event2);
-          if (Array.isArray(match2)) {
-            throw new Error("Unknown bundle route");
-          }
-          return handleRoute(match2);
-        }
-      })(event);
-    }
     const match = matchRoute(event);
     if (Array.isArray(match)) {
       const name = `${process.env.AWS_LAMBDA_FUNCTION_NAME}:${process.env.AWS_LAMBDA_FUNCTION_VERSION}`;

package/dist/handlers/on-failure.mjs

@@ -1,8 +1,81 @@
 // src/feature/on-failure/server/handle.ts
-import { parse, patch } from "@awsless/json";
+import { parse as parse2, patch } from "@awsless/json";
 import { invoke } from "@awsless/lambda";
 import { deleteObject, getObject } from "@awsless/s3";
 import { formatRoutePayload, getRouteEnv } from "awsless";
+
+// src/feature/on-failure/server/util.ts
+import { parse } from "@awsless/json";
+var isDynamoDBFailureEvent = (event) => {
+  return "DDBStreamBatchInfo" in event;
+};
+var logicalResourceName = (physical) => {
+  const segments = physical.replace(/\.fifo$/, "").split("--");
+  if (segments.length === 4) {
+    return `${segments[1]}:${segments[2]}:${segments[3]}`;
+  }
+  if (segments.length === 3) {
+    return `${segments[1]}:${segments[2]}`;
+  }
+  return physical;
+};
+var getFailureSource = (payload) => {
+  const record = getDeliveryRecord(payload);
+  if (!record) {
+    return;
+  }
+  if (isTopicRecord(record)) {
+    return {
+      resource: record.Sns.TopicArn ? logicalResourceName(lastArnSegment(record.Sns.TopicArn)) : "topic",
+      event: parseEvent(record.Sns.Message)
+    };
+  }
+  if (isStreamRecord(record)) {
+    const table = record.eventSourceARN.split("/")[1];
+    return {
+      resource: table ? logicalResourceName(table) : "table-stream"
+    };
+  }
+  if (isQueueRecord(record)) {
+    return {
+      resource: logicalResourceName(lastArnSegment(record.eventSourceARN)),
+      event: parseEvent(record.body)
+    };
+  }
+  return;
+};
+var getDeliveryRecord = (payload) => {
+  if (!payload || typeof payload !== "object") {
+    return;
+  }
+  const records = payload.Records;
+  const record = Array.isArray(records) ? records[0] : undefined;
+  return record && typeof record === "object" ? record : undefined;
+};
+var isTopicRecord = (record) => {
+  return "Sns" in record && typeof record.Sns === "object" && record.Sns !== null;
+};
+var isStreamRecord = (record) => {
+  return "eventSource" in record && record.eventSource === "aws:dynamodb" && "eventSourceARN" in record;
+};
+var isQueueRecord = (record) => {
+  return "eventSource" in record && record.eventSource === "aws:sqs" && "eventSourceARN" in record;
+};
+var lastArnSegment = (arn) => {
+  return arn.split(":").at(-1);
+};
+var parseEvent = (value) => {
+  if (typeof value !== "string") {
+    return value;
+  }
+  try {
+    return parse(value);
+  } catch {
+    return value;
+  }
+};
+
+// src/feature/on-failure/server/handle.ts
 var handle_default = async (event, context) => {
   if (!Array.isArray(event.Records)) {
     throw new TypeError(`Unknown Event Type: ${JSON.stringify(event)}`);
@@ -28,13 +101,16 @@ var sqsRecord = async (record, context) => {
     await Promise.all(s3Records.map((record2) => s3Record(record2, context)));
     return;
   }
+  const queueName = record.messageAttributes.queueName?.stringValue;
+  const body = parsePayload(record.body);
   const payload = {
     type: "queue",
     id: record.messageId,
     date: new Date(Number(record.attributes.SentTimestamp)),
-    payload: parsePayload(record.body),
+    payload: body,
+    source: queueName ? { resource: logicalResourceName(queueName), event: body } : undefined,
     queue: {
-      name: record.messageAttributes.queueName?.stringValue,
+      name: queueName,
       url: record.messageAttributes.queueUrl?.stringValue
     }
   };
@@ -70,9 +146,6 @@ var s3Record = async (record, context) => {
     key
   });
 };
-var isDynamoDBFailureEvent = (event) => {
-  return "DDBStreamBatchInfo" in event;
-};
 var formatUnknownFailureEvent = (event) => {
   if (isDynamoDBFailureEvent(event)) {
     return formatDynamoDBStreamFailureEvent(event);
@@ -90,6 +163,7 @@ var formatAsyncLambdaFailureEvent = (event) => {
       name: typeof route === "string" ? route : event.requestContext.functionArn.split(":")[6]
     },
     payload: typeof route === "string" ? payload.event ?? {} : payload,
+    source: typeof route === "string" ? { resource: route, event: payload.event ?? {} } : getFailureSource(payload),
     error: {
       type: event.responsePayload.errorType,
       message: event.responsePayload.errorMessage,
@@ -98,6 +172,9 @@ var formatAsyncLambdaFailureEvent = (event) => {
   };
 };
 var formatDynamoDBStreamFailureEvent = (event) => {
+  const payload = parsePayload(event.payload);
+  const streamArn = event.DDBStreamBatchInfo?.streamArn;
+  const table = streamArn?.split("/")[1];
   return {
     type: "dynamodb-stream",
     date: new Date(event.timestamp),
@@ -105,12 +182,13 @@ var formatDynamoDBStreamFailureEvent = (event) => {
     function: {
       name: event.requestContext.functionArn.split(":")[6]
     },
-    payload: parsePayload(event.payload)
+    payload,
+    source: table ? { resource: logicalResourceName(table) } : getFailureSource(payload)
   };
 };
 var parsePayload = (payload) => {
   try {
-    return parse(payload);
+    return parse2(payload);
   } catch {
     return payload;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awsless/cli",
-  "version": "0.0.46-next.1",
+  "version": "0.0.46-next.3",
   "license": "MIT",
   "type": "module",
   "sideEffects": false,
@@ -83,23 +83,23 @@
     "zod": "^3.24.2",
     "zod-to-json-schema": "^3.24.3",
     "@awsless/big-float": "^0.1.7",
-    "@awsless/clui": "^0.0.8",
     "@awsless/cloudwatch": "^0.0.1",
     "@awsless/duration": "^0.0.4",
+    "@awsless/clui": "^0.0.9",
     "@awsless/dynamodb": "^0.3.21",
     "@awsless/iot": "^0.0.5",
     "@awsless/json": "^0.0.11",
-    "@awsless/lambda": "^0.0.44",
     "@awsless/s3": "^0.0.21",
     "@awsless/redis": "^0.1.13",
     "@awsless/size": "^0.0.2",
-    "@awsless/sns": "^0.0.10",
+    "@awsless/scheduler": "^0.0.4",
+    "@awsless/lambda": "^0.0.45",
     "@awsless/sqs": "^0.0.24",
-    "@awsless/ts-file-cache": "^0.0.16",
-    "@awsless/weak-cache": "^0.0.1",
+    "@awsless/sns": "^0.0.10",
     "@awsless/validate": "^0.1.7",
     "awsless": "^0.0.15-next.0",
-    "@awsless/scheduler": "^0.0.4"
+    "@awsless/weak-cache": "^0.0.1",
+    "@awsless/ts-file-cache": "^0.0.16"
   },
   "devDependencies": {
     "@hono/node-server": "1.19.9",