@awsless/cli 0.0.46-next.3 → 0.0.46-next.6

package/dist/bin.js

@@ -187,7 +187,7 @@ import {
   string,
   updateItem
 } from "@awsless/dynamodb";
-import { execSync } from "child_process";
+import { isAfter, subHours } from "date-fns";
 import { userInfo as userInfo2 } from "os";
 
 // src/formation/cloudfront-kvs.ts
@@ -290,17 +290,16 @@ var getRouteStoreArn = async (cloudfront, name) => {
     return;
   }
 };
-var stageRoutes = async (kvs, state2, prior) => {
+var stageRoutes = async (kvs, state2) => {
   const routes = sortRoutes(state2.routes);
   const table2 = getRouteTableId(routes);
-  const priorTable = prior ? getRouteTableId(sortRoutes(prior.routes)) : void 0;
   const deployment = {
     id: state2.deploymentId,
     table: table2,
     functionVersion: state2.functionVersion
   };
   const mutations = [
-    ...priorTable === table2 ? [] : getTableMutations(table2, routes),
+    ...getTableMutations(table2, routes),
     {
       type: "put",
       key: `${DEPLOY_KEY_PREFIX}${deployment.id}`,
@@ -324,9 +323,7 @@ var createCloudFrontKvsProvider = ({ credentials, region }) => {
         return stageRoutes(kvs, routeDeploymentInputSchema.parse(props.state));
       },
       async updateResource(props) {
-        const state2 = routeDeploymentInputSchema.parse(props.proposedState);
-        const prior = routeDeploymentInputSchema.parse(props.priorState);
-        return stageRoutes(kvs, state2, prior.storeArn === state2.storeArn ? prior : void 0);
+        return stageRoutes(kvs, routeDeploymentInputSchema.parse(props.proposedState));
       }
     }
   });
@@ -359,6 +356,42 @@ var pruneStoreDeployments = async (kvs, storeArn, deploymentIds) => {
   });
 };
 
+// src/util/git.ts
+import { execFileSync, execSync } from "child_process";
+var git = (command) => {
+  try {
+    return execSync(`git ${command}`, { stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" }).trim();
+  } catch {
+    return;
+  }
+};
+var checkedOutBranch = () => {
+  return git("rev-parse --abbrev-ref HEAD");
+};
+var currentBranch = () => {
+  const branch = checkedOutBranch();
+  if (branch && branch !== "HEAD") {
+    return branch;
+  }
+  return process.env.GITHUB_HEAD_REF || process.env.GITHUB_REF_NAME || process.env.CI_COMMIT_REF_NAME || process.env.BRANCH_NAME || branch;
+};
+var currentCommit = () => {
+  return git("rev-parse HEAD");
+};
+var currentCommitMessage = () => {
+  return git("log -1 --pretty=%s");
+};
+var isCommitMerged = (commit, branch) => {
+  try {
+    execFileSync("git", ["merge-base", "--is-ancestor", commit, branch], {
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    return true;
+  } catch {
+    return false;
+  }
+};
+
 // src/util/lambda.ts
 import {
   CreateAliasCommand,
@@ -1203,7 +1236,7 @@ var pullRemoteState = async (app, stateBackend) => {
       await rm(file);
     }
   } else {
-    await writeFile(file, JSON.stringify(state2, void 0, 2));
+    await writeFile(file, JSON.stringify(state2, void 0, 2), { mode: 384 });
   }
 };
 var pushRemoteState = async (app, stateBackend) => {
@@ -1217,16 +1250,6 @@ var pushRemoteState = async (app, stateBackend) => {
 var slugifyBranch = (branch) => {
   return (branch ?? "").replace(/[^a-zA-Z0-9_-]+/g, "-").replace(/^-+|-+$/g, "") || "local";
 };
-var git = (command) => {
-  try {
-    return execSync(`git ${command}`, { stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" }).trim();
-  } catch {
-    return;
-  }
-};
-var isCommitMerged = (commit, branch) => {
-  return git(`merge-base --is-ancestor ${JSON.stringify(commit)} ${JSON.stringify(branch)}`) !== void 0;
-};
 var table = define("awsless-deployments", {
   hash: "appId",
   sort: "id",
@@ -1246,10 +1269,13 @@ var table = define("awsless-deployments", {
 var deploymentsTable = table;
 var latestBranchDeployment = async (client, appId, branch) => {
   const items = await listDeployments(client, appId, branch);
-  return items.reduce((latest, item) => (latest?.seq ?? 0) >= item.seq ? latest : item, void 0);
+  return items.reduce(
+    (latest, item) => (latest?.seq ?? 0) >= item.seq ? latest : item,
+    void 0
+  );
 };
 var claimDeployment = async (props) => {
-  const branch = slugifyBranch(git("rev-parse --abbrev-ref HEAD"));
+  const branch = slugifyBranch(currentBranch());
   while (true) {
     const latest = await latestBranchDeployment(props.client, props.appId, branch);
     const seq = (latest?.seq ?? 0) + 1;
@@ -1260,8 +1286,8 @@ var claimDeployment = async (props) => {
       seq,
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
       user: userInfo2().username,
-      commit: git("rev-parse HEAD"),
-      message: git("log -1 --pretty=%s")
+      commit: currentCommit(),
+      message: currentCommitMessage()
     };
     try {
       await putItem(table, deployment, {
@@ -1278,7 +1304,7 @@ var claimDeployment = async (props) => {
   }
 };
 var currentDeployment = async (client, appId) => {
-  return latestBranchDeployment(client, appId, slugifyBranch(git("rev-parse --abbrev-ref HEAD")));
+  return latestBranchDeployment(client, appId, slugifyBranch(currentBranch()));
 };
 var getDeployment = async (client, appId, id) => {
   return getItem(table, { appId, id }, { client });
@@ -1328,6 +1354,10 @@ var markPromoted = async (client, appId, id) => {
 var removeDeployment = async (client, appId, id) => {
   await deleteItem(table, { appId, id }, { client });
 };
+var BUSY_WINDOW_HOURS = 24;
+var isDeploymentBusy = (item, now = /* @__PURE__ */ new Date()) => {
+  return !item.functionVersion && isAfter(new Date(item.createdAt), subHours(now, BUSY_WINDOW_HOURS));
+};
 var selectPrunableDeployments = (items, liveId, options) => {
   const rollbackTarget = items.filter((item) => item.promotedAt && item.id !== liveId).sort((a, b) => b.promotedAt.localeCompare(a.promotedAt))[0];
   const keep = Math.max(1, Number(options.keep) || 10);
@@ -1335,16 +1365,15 @@ var selectPrunableDeployments = (items, liveId, options) => {
   const keptMain = new Set(
     items.filter((item) => item.branch === mainSlug && item.functionVersion).map((item) => item.seq).sort((a, b) => b - a).slice(0, keep)
   );
-  const dayAgo = new Date(Date.now() - 24 * 60 * 60 * 1e3).toISOString();
   return items.filter((item) => {
-    if (item.id === liveId || item.id === rollbackTarget?.id) {
+    if (item.id === liveId || item.id === rollbackTarget?.id || isDeploymentBusy(item)) {
       return false;
     }
     if (options.branch) {
       return item.branch === slugifyBranch(options.branch);
     }
     if (!item.functionVersion) {
-      return item.createdAt < dayAgo;
+      return true;
     }
     if (item.branch === mainSlug) {
       return !keptMain.has(item.seq);
@@ -1494,7 +1523,10 @@ var promoteDeployment = async (props) => {
     ];
     const failures = (await Promise.allSettled(rollback2)).filter((result) => result.status === "rejected").map((result) => result.reason);
     if (failures.length > 0) {
-      throw new AggregateError([error, ...failures], `Deployment promotion failed and couldn't be fully reverted.`);
+      throw new AggregateError(
+        [error, ...failures],
+        `Deployment promotion failed and couldn't be fully reverted.`
+      );
     }
     throw error;
   }
@@ -1956,7 +1988,7 @@ var CodeSchema = z14.union([
 var FnSchema = z14.object({
   code: CodeSchema,
   handler: HandlerSchema.optional()
-});
+}).strict();
 var FunctionSchema = z14.union([
   LocalFileSchema.transform((code) => ({
     code
@@ -2230,7 +2262,7 @@ var ErrorResponseSchema = z20.union([
     minTTL: MinTTLSchema.optional()
   })
 ]).optional();
-var RouteSchema = z20.string().regex(/^\//, "Route must start with a slash (/)");
+var RouteSchema = z20.string().regex(/^\//, "Route must start with a slash (/)").regex(/^\/([^/*.]+)?$/, 'Router paths mount a single segment without dots, like "/api".');
 var VisibilitySchema = z20.boolean().default(false).describe("Whether to enable CloudWatch metrics for the WAF rule.");
 var WafSettingsSchema = z20.object({
   rateLimiter: z20.object({
@@ -2729,8 +2761,8 @@ var AppSchema = z29.object({
     layers: LayerSchema,
     router: RouterDefaultSchema
     // dataRetention: z.boolean().describe('Configure how your resources are handled on delete.').default(false),
-  }).default({}).describe("Default properties")
-});
+  }).strict().default({}).describe("Default properties")
+}).strict();
 
 // src/config/stack.ts
 import { z as z45 } from "zod";
@@ -2786,7 +2818,7 @@ var CommandsSchema = z31.record(ResourceIdSchema, CommandSchema).optional().desc
 
 // src/feature/config/schema.ts
 import { z as z32 } from "zod";
-var ConfigNameSchema = z32.string().regex(/[a-z0-9\-]/g, "Invalid config name");
+var ConfigNameSchema = z32.string().regex(/^[a-z0-9-]+$/, "Invalid config name");
 var ConfigsSchema = z32.array(ConfigNameSchema).optional().describe("Define the config values for your stack.");
 
 // src/feature/cron/schema/index.ts
@@ -3372,7 +3404,7 @@ var StackSchema = z45.object({
   images: ImagesSchema,
   icons: IconsSchema,
   metrics: MetricsSchema
-});
+}).strict();
 
 // src/config/load/read.ts
 import { readFile as readFile3 } from "fs/promises";
@@ -3831,7 +3863,7 @@ import { readdir as readdir2, readFile as readFile7, writeFile as writeFile4 } f
 import { join as join10 } from "path";
 
 // src/build/index.ts
-import { mkdir as mkdir2, readFile as readFile4, writeFile as writeFile2 } from "fs/promises";
+import { mkdir as mkdir2, readFile as readFile4, rm as rm2, writeFile as writeFile2 } from "fs/promises";
 import { dirname as dirname4, join as join7 } from "path";
 
 // src/util/timer.ts
@@ -3873,6 +3905,7 @@ var build = (type, name, builder, props) => {
         cached: true
       };
     }
+    await rm2(cacheFile, { force: true });
     const time = createTimer();
     const meta = await callback(async (file, data2) => {
       const path = getBuildPath(type, name, file);
@@ -3925,7 +3958,7 @@ var zipFiles = (files) => {
 import { generateFileHash } from "@awsless/ts-file-cache";
 import { kebabCase as kebabCase5 } from "change-case";
 import { createHash as createHash5 } from "crypto";
-import { readFile as readFile6, rm as rm3, writeFile as writeFile3 } from "fs/promises";
+import { readFile as readFile6, rm as rm4, writeFile as writeFile3 } from "fs/promises";
 import { dirname as dirname5, join as join9 } from "path";
 import { fileURLToPath } from "url";
 
@@ -3937,13 +3970,13 @@ var formatByteSize = (size) => {
 };
 
 // src/util/temp.ts
-import { mkdir as mkdir3, readdir, rm as rm2 } from "fs/promises";
+import { mkdir as mkdir3, readdir, rm as rm3 } from "fs/promises";
 import { join as join8 } from "path";
 var createTempFolder = async (name) => {
   const path = join8(directories.temp, name);
   await mkdir3(join8(directories.temp, name), { recursive: true });
   process.on("SIGTERM", async () => {
-    await rm2(path, { recursive: true });
+    await rm3(path, { recursive: true });
   });
   return {
     path,
@@ -3951,7 +3984,7 @@ var createTempFolder = async (name) => {
       return readdir(path, { recursive: true });
     },
     async delete() {
-      await rm2(path, { recursive: true });
+      await rm3(path, { recursive: true });
     }
   };
 };
@@ -3982,6 +4015,9 @@ var bundleTypeScriptWithRolldown = async ({
       moduleSideEffects: (id, isExternal) => isExternal ? external?.includes(id) === true : id.startsWith(`${directories.root}/`) && !id.includes("/node_modules/")
     },
     onwarn: (error) => {
+      if (error.code === "UNRESOLVED_IMPORT") {
+        throw new ExpectedError(error.message);
+      }
       debugError(error.message);
     },
     plugins: [
@@ -4048,14 +4084,17 @@ var bundleTypeScriptWithRolldown = async ({
     files
   };
 };
-var TEST_ONLY_MODULES = ["dynamo-db-local", "@awsless/dynamodb-server", "redis-memory-server"];
+var TEST_ONLY_MODULES = ["dynamo-db-local", "@awsless/dynamodb-server", "redis-memory-server", "aws-sdk-vitest-mock"];
+var findPackage = (id, names) => {
+  return names.find((name) => id.includes(`/${name.replace(/^@[^/]+\//, "")}/`));
+};
 var assertNoTestOnlyModules = (output) => {
   for (const item of output) {
     if (item.type !== "chunk") {
       continue;
     }
     for (const id of item.moduleIds ?? []) {
-      const found = TEST_ONLY_MODULES.find((name) => id.includes(`/node_modules/${name}/`));
+      const found = findPackage(id, TEST_ONLY_MODULES);
       if (found) {
         throw new Error(
           `The test-only package "${found}" was bundled into a production build through "${id}". Remove the import from the handler, or keep the package tree-shakeable.`
@@ -4086,7 +4125,7 @@ var registerBundleFunction = (ctx, routeKey, props) => {
 };
 var buildBundle = (props) => {
   return async (build3, { workspace }) => {
-    const runtime = props.runtime ?? join9(dirname5(fileURLToPath(import.meta.url)), "/handlers/bundle.mjs");
+    const runtime = props.runtime ?? join9(dirname5(fileURLToPath(import.meta.url)), "/handlers/bundle.js");
     const handlers = [...props.handlers].sort((a, b) => a.routeKey.localeCompare(b.routeKey));
     const entries = handlers.map(({ routeKey, file, exportName }) => {
       const virtualFile = JSON.stringify(`${file}?awsless-route=${encodeURIComponent(routeKey)}`);
@@ -4135,7 +4174,7 @@ ${entries.join("\n")}
         importAsString: importAsString2.length > 0 ? importAsString2 : void 0
       });
       await temp.delete();
-      await rm3(getBuildPath("bundle", props.name, "files"), { recursive: true, force: true });
+      await rm4(getBuildPath("bundle", props.name, "files"), { recursive: true, force: true });
       await Promise.all([
         write("HASH", bundle.hash),
         ...bundle.files.map((file) => write(`files/${file.name}`, file.code)),
@@ -4657,7 +4696,7 @@ var SsmStore = class {
     debug("Value:", color.info(value));
     await this.client.send(
       new PutParameterCommand({
-        Type: ParameterType.STRING,
+        Type: ParameterType.SECURE_STRING,
         Name: this.getName(name),
         Value: value,
         Overwrite: true
@@ -5093,10 +5132,12 @@ var domainFeature = defineFeature({
       }
     }
     ctx.addGlobalPermission({
-      actions: ["ses:*"],
+      actions: ["ses:SendEmail", "ses:SendRawEmail"],
       resources: [
-        // `arn:aws:ses:${ctx.appConfig.region}:${ctx.accountId}:identity/*`,
-        "*"
+        `arn:aws:ses:${ctx.appConfig.region}:${ctx.accountId}:identity/*`,
+        // Sending through the app configuration set is authorized against
+        // its own ARN, not just the identity.
+        `arn:aws:ses:${ctx.appConfig.region}:${ctx.accountId}:configuration-set/${ctx.app.name}`
       ]
     });
   }
@@ -5186,7 +5227,9 @@ var functionFeature = defineFeature({
         // 'lambda:ListFunctions',
         // 'lambda:GetFunction',
       ],
-      resources: [`arn:aws:lambda:*:*:function:${ctx.appConfig.name}--*`]
+      resources: [
+        `arn:aws:lambda:${ctx.appConfig.region}:${ctx.accountId}:function:${ctx.appConfig.name}--*`
+      ]
     });
   },
   onStack(ctx) {
@@ -5228,7 +5271,7 @@ var onErrorLogFeature = defineFeature({
     const consumerRoute = formatRouteKey(ctx.app.name, "on-error-log", "consumer");
     bundle.addHandler({
       routeKey: handlerRoute,
-      file: join11(dirname6(fileURLToPath2(import.meta.url)), "/handlers/on-error-log.mjs"),
+      file: join11(dirname6(fileURLToPath2(import.meta.url)), "/handlers/on-error-log.js"),
       exportName: "default"
     });
     bundle.addEnv(formatRouteEnvName(handlerRoute, "CONSUMER"), consumerRoute);
@@ -5453,7 +5496,7 @@ var onFailureFeature = defineFeature({
     const consumer = props.consumer;
     bundle.addHandler({
       routeKey: normalizerRoute,
-      file: join12(dirname7(fileURLToPath3(import.meta.url)), "/handlers/on-failure.mjs"),
+      file: join12(dirname7(fileURLToPath3(import.meta.url)), "/handlers/on-failure.js"),
       exportName: "default"
     });
     registerBundleFunction(ctx, consumerRoute, consumer);
@@ -5608,7 +5651,7 @@ var createPubSubService = (parentGroup, ctx, id, props, inputs) => {
   });
   const shortName = shortId(`${ctx.app.name}:pubsub:${id}:${ctx.appId}`);
   const image2 = "public.ecr.aws/aws-cli/aws-cli:arm64";
-  const bundleFile = join14(__dirname, "handlers/pubsub-server.mjs");
+  const bundleFile = join14(__dirname, "handlers/pubsub-server.js");
   ctx.registerBuild("pubsub", name, async (build3) => {
     const hash = createHash8("sha1").update(await readFile9(bundleFile)).digest("hex");
     const fingerprint = `${hash}-${ARCHITECTURE}`;
@@ -5709,7 +5752,8 @@ var createPubSubService = (parentGroup, ctx, id, props, inputs) => {
           Statement: list3.map((statement) => ({
             Effect: pascalCase2(statement.effect ?? "allow"),
             Action: statement.actions,
-            Resource: statement.resources
+            Resource: statement.resources,
+            Condition: statement.conditions
           }))
         })
       );
@@ -6200,7 +6244,7 @@ var pubsubFeature = defineFeature({
       const publisherRouteKey = formatRouteKey(ctx.app.name, "pubsub", `${id}-publisher`);
       bundle.addHandler({
         routeKey: publisherRouteKey,
-        file: join15(__dirname2, "/handlers/pubsub-publisher.mjs"),
+        file: join15(__dirname2, "/handlers/pubsub-publisher.js"),
         exportName: "default"
       });
       bundle.addEnv(formatRouteEnvName3(publisherRouteKey, "REDIS_HOST"), redisHost);
@@ -6549,7 +6593,7 @@ var rpcFeature = defineFeature({
       const serverRouteKey = formatRouteKey(ctx.app.name, "rpc", id);
       bundle.addHandler({
         routeKey: serverRouteKey,
-        file: join16(dirname10(fileURLToPath6(import.meta.url)), "/handlers/rpc.mjs"),
+        file: join16(dirname10(fileURLToPath6(import.meta.url)), "/handlers/rpc.js"),
         exportName: "default"
       });
       bundle.addEnv(
@@ -7076,9 +7120,12 @@ var siteFeature = defineFeature({
               new Response(instance.stderr).text(),
               instance.exited
             ]);
-            if (instance.exitCode !== null && instance.exitCode > 0) {
-              throw new ExpectedError(`Site build failed:
-${(errors.trim() || output.trim()).slice(-2e3)}`);
+            if (instance.exitCode !== 0) {
+              const reason = instance.signalCode ? ` (${instance.signalCode})` : "";
+              throw new ExpectedError(
+                `Site build failed${reason}:
+${(errors.trim() || output.trim()).slice(-2e3)}`
+              );
             }
             await write("HASH", fingerprint);
             return {
@@ -7919,7 +7966,7 @@ var imageFeature = defineFeature({
       const serverRouteKey = formatRouteKey(ctx.stack.name, "image", id);
       bundle.addHandler({
         routeKey: serverRouteKey,
-        file: join20(dirname12(fileURLToPath7(import.meta.url)), "/handlers/image.mjs"),
+        file: join20(dirname12(fileURLToPath7(import.meta.url)), "/handlers/image.js"),
         exportName: "default",
         external: ["sharp"]
       });
@@ -8018,7 +8065,7 @@ var iconFeature = defineFeature({
       const serverRouteKey = formatRouteKey(ctx.stack.name, "icon", id);
       bundle.addHandler({
         routeKey: serverRouteKey,
-        file: join21(dirname13(fileURLToPath8(import.meta.url)), "/handlers/icon.mjs"),
+        file: join21(dirname13(fileURLToPath8(import.meta.url)), "/handlers/icon.js"),
         exportName: "default"
       });
       addRoutes({
@@ -8277,7 +8324,8 @@ var createFargateJob = (parentGroup, ctx, ns, id, local) => {
           Statement: list3.map((statement) => ({
             Effect: pascalCase3(statement.effect ?? "allow"),
             Action: statement.actions,
-            Resource: statement.resources
+            Resource: statement.resources,
+            Condition: statement.conditions
           }))
         })
       );
@@ -8775,7 +8823,8 @@ var createFargateTask = (parentGroup, ctx, ns, id, local) => {
           Statement: list3.map((statement) => ({
             Effect: pascalCase4(statement.effect ?? "allow"),
             Action: statement.actions,
-            Resource: statement.resources
+            Resource: statement.resources,
+            Condition: statement.conditions
           }))
         })
       );
@@ -9247,12 +9296,15 @@ var metricFeature = defineFeature({
 });
 
 // src/feature/router/index.ts
-import { days as days10, seconds as seconds6, toSeconds as toSeconds12, years } from "@awsless/duration";
+import { days as days10, seconds as seconds7, toSeconds as toSeconds13, years } from "@awsless/duration";
 import { Group as Group29 } from "@terraforge/core";
 import { aws as aws30 } from "@terraforge/aws";
 import { camelCase as camelCase9, constantCase as constantCase15 } from "change-case";
 
 // src/feature/router/router-code.ts
+import { minutes as minutes8, seconds as seconds6, toSeconds as toSeconds12 } from "@awsless/duration";
+var ORIGIN_READ_TIMEOUT = toSeconds12(minutes8(2));
+var ORIGIN_CONNECTION_TIMEOUT = toSeconds12(seconds6(10));
 var getViewerRequestFunctionCode = (props) => {
   return CODE(
     [
@@ -9447,6 +9499,11 @@ function isValidRoute(route, method) {
 }
 
 async function findRoute(path, method, prefix) {
+	// only route selection is normalized, the forwarded uri stays untouched
+	if (path.length > 1 && path.slice(-1) === '/') {
+		path = path.slice(0, -1);
+	}
+
 	const store = cf.kvs();
 	const keys = getPossibleRouteKeys(path);
 
@@ -9528,13 +9585,12 @@ function setS3Origin(route) {
 function setLambdaOrigin(route) {
 	const config = getRequestOriginConfig(route);
 
-	// CloudFront caps the origin response timeout at 60s without a quota increase.
 	if(typeof config.timeouts.readTimeout !== 'number') {
-		config.timeouts.readTimeout = 120;
+		config.timeouts.readTimeout = ${ORIGIN_READ_TIMEOUT};
 	}
 
 	if(typeof config.timeouts.connectionTimeout !== 'number') {
-		config.timeouts.connectionTimeout = 10;
+		config.timeouts.connectionTimeout = ${ORIGIN_CONNECTION_TIMEOUT};
 	}
 
 	cf.updateRequestOrigin(Object.assign(config, {
@@ -9610,6 +9666,8 @@ async function handler(event) {
 
 	if(route.forwardHost && headers.host && headers.host.value) {
 		headers['x-forwarded-host'] = { value: headers.host.value };
+	} else {
+		delete headers['x-forwarded-host'];
 	}
 
 	headers['x-origin'] = { value: route.domainName };
@@ -9698,9 +9756,9 @@ var routerFeature = defineFeature({
       });
       const cache = new aws30.cloudfront.CachePolicy(group, "cache", {
         name,
-        minTtl: toSeconds12(seconds6(0)),
-        maxTtl: toSeconds12(days10(365)),
-        defaultTtl: toSeconds12(days10(0)),
+        minTtl: toSeconds13(seconds7(0)),
+        maxTtl: toSeconds13(days10(365)),
+        defaultTtl: toSeconds13(days10(0)),
         parametersInCacheKeyAndForwardedToOrigin: {
           enableAcceptEncodingBrotli: true,
           enableAcceptEncodingGzip: true,
@@ -9753,7 +9811,7 @@ var routerFeature = defineFeature({
         name,
         corsConfig: {
           originOverride: props.cors?.override ?? true,
-          accessControlMaxAgeSec: toSeconds12(props.cors?.maxAge ?? years(1)),
+          accessControlMaxAgeSec: toSeconds13(props.cors?.maxAge ?? years(1)),
           accessControlAllowHeaders: { items: props.cors?.headers ?? ["*"] },
           accessControlAllowMethods: { items: props.cors?.methods ?? ["ALL"] },
           accessControlAllowOrigins: { items: props.cors?.origins ?? ["*"] },
@@ -9778,7 +9836,7 @@ var routerFeature = defineFeature({
           strictTransportSecurity: {
             override: true,
             preload: true,
-            accessControlMaxAgeSec: toSeconds12(years(1)),
+            accessControlMaxAgeSec: toSeconds13(years(1)),
             includeSubdomains: true
           },
           xssProtection: {
@@ -9798,7 +9856,7 @@ var routerFeature = defineFeature({
             rateBasedStatement: {
               limit: wafSettingsConfig.rateLimiter.limit,
               aggregateKeyType: "IP",
-              evaluationWindowSec: toSeconds12(wafSettingsConfig.rateLimiter.window)
+              evaluationWindowSec: toSeconds13(wafSettingsConfig.rateLimiter.window)
             }
           },
           action: {
@@ -9888,12 +9946,12 @@ var routerFeature = defineFeature({
           rule: wafRules,
           captchaConfig: {
             immunityTimeProperty: {
-              immunityTime: toSeconds12(wafSettingsConfig.captchaImmunityTime)
+              immunityTime: toSeconds13(wafSettingsConfig.captchaImmunityTime)
             }
           },
           challengeConfig: {
             immunityTimeProperty: {
-              immunityTime: toSeconds12(wafSettingsConfig.challengeImmunityTime)
+              immunityTime: toSeconds13(wafSettingsConfig.challengeImmunityTime)
             }
           },
           visibilityConfig: {
@@ -9949,7 +10007,7 @@ var routerFeature = defineFeature({
           }
           return {
             errorCode: Number(errorCode),
-            errorCachingMinTtl: item.minTTL ? toSeconds12(item.minTTL) : void 0,
+            errorCachingMinTtl: item.minTTL ? toSeconds13(item.minTTL) : void 0,
             responseCode: item.statusCode?.toString() ?? errorCode,
             responsePagePath: item.path
           };
@@ -10032,7 +10090,7 @@ var routerFeature = defineFeature({
             }
             return {
               errorCode: Number(errorCode),
-              errorCachingMinTtl: item.minTTL ? toSeconds12(item.minTTL) : void 0,
+              errorCachingMinTtl: item.minTTL ? toSeconds13(item.minTTL) : void 0,
               responseCode: item.statusCode ?? Number(errorCode),
               responsePagePath: item.path
             };
@@ -10452,6 +10510,12 @@ var logo = () => {
 var layout = async (command, cb) => {
   console.log();
   log9.intro(`${logo()} ${color.line(command)}`);
+  let completed = false;
+  process.on("exit", (code) => {
+    if (code === 0 && !completed) {
+      process.exitCode = 130;
+    }
+  });
   try {
     const options = program.optsWithGlobals();
     const appConfig = await loadAppConfig(options);
@@ -10466,9 +10530,11 @@ var layout = async (command, cb) => {
       appConfig,
       stackConfigs
     });
+    completed = true;
     log9.outro(result ?? void 0);
     process.exit(0);
   } catch (error) {
+    completed = true;
     playErrorSound();
     logError(error);
     log9.outro();
@@ -10852,6 +10918,7 @@ var buildAssets = async (builders, stackFilters, showResult = false) => {
   if (filteredBuilders.length === 0) {
     return;
   }
+  filteredBuilders.sort((a, b) => Number(a.type === "bundle") - Number(b.type === "bundle"));
   const results = [];
   await log10.task({
     initialMessage: `Building assets...`,
@@ -12554,9 +12621,12 @@ var test = (program2) => {
       if (tests.length === 0) {
         return "No tests found.";
       }
-      await runTests(tests, stacks, options?.filters, {
+      const passed = await runTests(tests, stacks, options?.filters, {
         showLogs: true
       });
+      if (!passed) {
+        throw new Cancelled();
+      }
       return "All tests finished.";
     });
   });
@@ -12781,14 +12851,14 @@ var parseJsonLog = (message) => {
     json = JSON.parse(message);
   } catch (error) {
   }
-  if ("level" in json && typeof json.level === "string" && "timestamp" in json && typeof json.timestamp === "string" && "message" in json) {
+  if (typeof json === "object" && json !== null && "level" in json && typeof json.level === "string" && "timestamp" in json && typeof json.timestamp === "string" && "message" in json) {
     return {
       level: json.level,
       message: typeof json.message === "string" ? json.message : JSON.stringify(json.message, void 0, 2),
       date: new Date(json.timestamp)
     };
   }
-  if ("type" in json && typeof json.type === "string" && json.type.startsWith("platform") && "time" in json && typeof json.time === "string" && "record" in json) {
+  if (typeof json === "object" && json !== null && "type" in json && typeof json.type === "string" && json.type.startsWith("platform") && "time" in json && typeof json.time === "string" && "record" in json) {
     return {
       level: "SYSTEM",
       message: JSON.stringify(json.record, void 0, 2),
@@ -13253,11 +13323,11 @@ var createClients = async (appConfig) => {
   };
 };
 var formatAge = (iso) => {
-  const minutes8 = Math.floor((Date.now() - Date.parse(iso)) / 6e4);
-  if (minutes8 < 1) return "just now";
-  if (minutes8 < 60) return `${minutes8}m ago`;
-  if (minutes8 < 60 * 24) return `${Math.floor(minutes8 / 60)}h ago`;
-  return `${Math.floor(minutes8 / (60 * 24))}d ago`;
+  const minutes9 = Math.floor((Date.now() - Date.parse(iso)) / 6e4);
+  if (minutes9 < 1) return "just now";
+  if (minutes9 < 60) return `${minutes9}m ago`;
+  if (minutes9 < 60 * 24) return `${Math.floor(minutes9 / 60)}h ago`;
+  return `${Math.floor(minutes9 / (60 * 24))}d ago`;
 };
 var formatStatus = (item, liveId) => {
   if (item.id === liveId) return color.success("live    ");
@@ -13318,10 +13388,23 @@ var prune = (program2) => {
         initialMessage: "Pruning the deployments",
         successMessage: "Done pruning the deployments.",
         task: () => withAppReleaseLock(appConfig, async () => {
-          for (const item of prunable) {
+          const [freshItems, freshLiveId] = await Promise.all([
+            listDeployments(dynamo, appId),
+            readLiveDeploymentId(lambda, functionName)
+          ]);
+          const confirmed = new Set(prunable.map((item) => item.id));
+          const prune2 = selectPrunableDeployments(freshItems, freshLiveId, options).filter(
+            (item) => confirmed.has(item.id)
+          );
+          for (const item of prune2) {
             await deleteLambdaAlias(lambda, functionName, getDeploymentLambdaAliasName(item.id));
           }
-          const versions = await selectPrunableVersions({ lambda, functionName, items, prunable });
+          const versions = await selectPrunableVersions({
+            lambda,
+            functionName,
+            items: freshItems,
+            prunable: prune2
+          });
           for (const version of versions) {
             await pruneFunctionVersion(lambda, functionName, version);
           }
@@ -13337,10 +13420,10 @@ var prune = (program2) => {
             await pruneStoreDeployments(
               kvs,
               storeArn,
-              prunable.map((item) => item.id)
+              prune2.map((item) => item.id)
             );
           }
-          for (const item of prunable) {
+          for (const item of prune2) {
             await removeDeployment(dynamo, appId, item.id);
           }
         })
@@ -13424,4 +13507,10 @@ program.on("option:no-cache", () => {
 commands10.forEach((fn) => fn(program));
 
 // src/bin.ts
+var interrupt = (code) => () => {
+  process.stdout.write("\x1B[?25h");
+  process.exit(code);
+};
+process.on("SIGINT", interrupt(130));
+process.on("SIGTERM", interrupt(143));
 program.parse(process.argv);