@awsless/cli 0.0.46-next.34 → 0.0.46-next.36

package/dist/bin.js

@@ -82626,7 +82626,7 @@ var require_readdirp = __commonJS((exports, module) => {
   var sysPath = __require("path");
   var { promisify: promisify4 } = __require("util");
   var picomatch = require_picomatch3();
-  var readdir5 = promisify4(fs3.readdir);
+  var readdir6 = promisify4(fs3.readdir);
   var stat5 = promisify4(fs3.stat);
   var lstat4 = promisify4(fs3.lstat);
   var realpath2 = promisify4(fs3.realpath);
@@ -82759,7 +82759,7 @@ var require_readdirp = __commonJS((exports, module) => {
     async _exploreDir(path2, depth) {
       let files;
       try {
-        files = await readdir5(path2, this._rdOptions);
+        files = await readdir6(path2, this._rdOptions);
       } catch (error3) {
         this._onError(error3);
       }
@@ -149550,7 +149550,7 @@ var createLambdaProvider = ({ credentials: credentials3, region }) => {
     deploymentId: exports_external.string(),
     functionName: exports_external.string(),
     functionVersion: exports_external.string(),
-    onFailureArn: exports_external.string(),
+    onFailureArn: exports_external.string().optional(),
     sourceAccount: exports_external.string().optional()
   });
   const bundleDeploymentStateSchema = bundleDeploymentInputSchema.extend({
@@ -149579,11 +149579,11 @@ var createLambdaProvider = ({ credentials: credentials3, region }) => {
       FunctionName: state2.functionName,
       Qualifier: state2.functionVersion,
       MaximumRetryAttempts: 2,
-      DestinationConfig: {
+      DestinationConfig: state2.onFailureArn ? {
         OnFailure: {
           Destination: state2.onFailureArn
         }
-      }
+      } : undefined
     }));
   };
   const createDeploymentUrl = async (functionName, alias, sourceAccount) => {
@@ -161499,10 +161499,28 @@ var CodeSchema = exports_external.union([
   })).pipe(FileCodeSchema),
   FileCodeSchema
 ]).describe("Specify the code of your function.");
-var FnSchema = exports_external.object({
+var BundledFnSchema = exports_external.object({
   code: CodeSchema,
   handler: HandlerSchema.optional()
 }).strict();
+var BundledFunctionSchema = exports_external.union([
+  LocalFileSchema.transform((code) => ({
+    code
+  })).pipe(BundledFnSchema),
+  BundledFnSchema
+]);
+var FnSchema = BundledFnSchema.extend({
+  timeout: TimeoutSchema.optional(),
+  memorySize: MemorySizeSchema.optional(),
+  architecture: ArchitectureSchema.optional(),
+  vpc: VPCSchema.optional(),
+  log: LogSchema.transform((log) => ({
+    retention: log.retention,
+    format: "format" in log ? log.format : undefined,
+    level: "level" in log ? log.level : undefined,
+    system: "system" in log ? log.system : undefined
+  })).optional()
+});
 var FunctionSchema = exports_external.union([
   LocalFileSchema.transform((code) => ({
     code
@@ -161540,14 +161558,14 @@ var FunctionDefaultSchema = exports_external.object({
   external: exports_external.string().array().optional().describe(`A list of external packages that won't be included in the bundle.`),
   log: LogSchema.default(true).transform((log) => ({
     retention: log.retention ?? days(7),
-    level: "level" in log ? log.level : "error",
+    level: "level" in log ? log.level : "trace",
     system: "system" in log ? log.system : "warn",
     format: "format" in log ? log.format : "json"
   })),
   timeout: TimeoutSchema.default("15 minutes"),
   memorySize: MemorySizeSchema.default("1024 MB"),
   architecture: ArchitectureSchema.default("arm64"),
-  vpc: VPCSchema.default(false),
+  vpc: VPCSchema.default(true),
   ephemeralStorageSize: EphemeralStorageSizeSchema.default("512 MB"),
   reserved: ReservedConcurrentExecutionsSchema.optional(),
   layers: LayersSchema.optional(),
@@ -161574,32 +161592,36 @@ var LayerSchema = exports_external.record(exports_external.string(), exports_ext
   Schema
 ])).optional().describe("Define the lambda layers in your stack.");
 
-// src/feature/task/schema.ts
-var TaskSchema = exports_external.union([
-  FunctionSchema.transform((consumer) => ({
+// src/feature/on-error-log/schema.ts
+var ConsumerSchema = FunctionSchema.transform((consumer) => ({
+  ...consumer,
+  vpc: consumer.vpc ?? false
+}));
+var OnErrorLogDefaultSchema = exports_external.union([
+  ConsumerSchema.transform((consumer) => ({
     consumer
   })),
   exports_external.object({
-    consumer: FunctionSchema
+    consumer: ConsumerSchema
   })
-]);
-var TasksSchema = exports_external.record(ResourceIdSchema, TaskSchema).optional().describe("Define the tasks in your stack.");
-
-// src/feature/on-error-log/schema.ts
-var OnErrorLogDefaultSchema = TaskSchema.optional().describe("Define a subscription on all Lambda functions logs.");
+]).optional().describe("Define a subscription on all Lambda functions logs.");
 
 // src/feature/on-failure/schema.ts
 var NotifySchema = exports_external.union([
   EmailSchema.transform((v7) => [v7]),
   EmailSchema.array()
 ]).describe("Receive an email notification when consuming failure entries goes wrong.");
+var ConsumerSchema2 = FunctionSchema.transform((consumer) => ({
+  ...consumer,
+  vpc: consumer.vpc ?? false
+}));
 var OnFailureDefaultSchema = exports_external.union([
-  FunctionSchema.transform((consumer) => ({
+  ConsumerSchema2.transform((consumer) => ({
     consumer,
     notify: []
   })),
   exports_external.object({
-    consumer: FunctionSchema,
+    consumer: ConsumerSchema2,
     notify: NotifySchema.optional()
   })
 ]).optional().describe([
@@ -161813,7 +161835,7 @@ var ErrorResponseSchema = exports_external.union([
   })
 ]).optional();
 var RouteSchema = exports_external.string().regex(/^\//, "Route must start with a slash (/)").regex(/^\/([^/*.]+)?$/, 'Router paths mount a single segment without dots, like "/api".');
-var RoutesSchema = exports_external.record(ResourceIdSchema.describe("The router id to add your routes to."), exports_external.record(exports_external.string().regex(/^\//, "Route must start with a slash (/)"), FunctionSchema).superRefine((routes, ctx) => {
+var RoutesSchema = exports_external.record(ResourceIdSchema.describe("The router id to add your routes to."), exports_external.record(exports_external.string().regex(/^\//, "Route must start with a slash (/)"), BundledFunctionSchema).superRefine((routes, ctx) => {
   for (const pattern of Object.keys(routes)) {
     try {
       compileRoutePattern(pattern);
@@ -161921,7 +161943,7 @@ var RouterDefaultSchema = exports_external.record(ResourceIdSchema, exports_exte
 
 // src/feature/pubsub/schema.ts
 var PubSubDefaultSchema = exports_external.record(ResourceIdSchema, exports_external.object({
-  auth: FunctionSchema.describe("The authorizer that validates the client auth token and returns the allowed topics."),
+  auth: BundledFunctionSchema.describe("The authorizer that validates the client auth token and returns the allowed topics."),
   router: ResourceIdSchema.describe("The router id to route pubsub traffic through."),
   path: RouteSchema.default("/ws").describe("The base path on the router that exposes the pubsub endpoint."),
   log: LogSchema2.default(true).transform((log) => ({
@@ -161929,10 +161951,10 @@ var PubSubDefaultSchema = exports_external.record(ResourceIdSchema, exports_exte
   }))
 })).optional().describe("Define the pubsub API for your app. Backed by a websocket server on AWS Fargate.");
 var PubSubSchema = exports_external.record(ResourceIdSchema, exports_external.object({
-  connected: FunctionSchema.optional().describe("Subscribe to the event when a client connects."),
-  disconnected: FunctionSchema.optional().describe("Subscribe to the event when a client disconnects."),
-  subscribed: FunctionSchema.optional().describe("Subscribe to the event when a client subscribes to topics."),
-  unsubscribed: FunctionSchema.optional().describe("Subscribe to the event when a client unsubscribes from topics.")
+  connected: BundledFunctionSchema.optional().describe("Subscribe to the event when a client connects."),
+  disconnected: BundledFunctionSchema.optional().describe("Subscribe to the event when a client disconnects."),
+  subscribed: BundledFunctionSchema.optional().describe("Subscribe to the event when a client subscribes to topics."),
+  unsubscribed: BundledFunctionSchema.optional().describe("Subscribe to the event when a client unsubscribes from topics.")
 })).optional().describe("Define the pubsub event listeners in your stack.");
 var pubsubEventTypes = ["connected", "disconnected", "subscribed", "unsubscribed"];
 
@@ -161949,7 +161971,7 @@ var QueueDefaultSchema = exports_external.object({
   batchSize: BatchSizeSchema.default(10)
 }).default({});
 var QueueSchema = exports_external.object({
-  consumer: FunctionSchema.optional().describe("The consuming lambda function properties."),
+  consumer: BundledFunctionSchema.optional().describe("The consuming lambda function properties."),
   retentionPeriod: RetentionPeriodSchema.optional(),
   receiveMessageWaitTime: ReceiveMessageWaitTimeSchema.optional(),
   maxMessageSize: MaxMessageSizeSchema.optional(),
@@ -161978,21 +162000,21 @@ var RestSchema = exports_external.record(ResourceIdSchema, exports_external.reco
   "The possible http methods are POST, GET,PUT, DELETE, HEAD, OPTIONS, ANY.",
   "Example: GET /posts/{id}"
 ].join(`
-`)), FunctionSchema)).optional().describe("Define routes in your stack for your global REST API.");
+`)), BundledFunctionSchema)).optional().describe("Define routes in your stack for your global REST API.");
 
 // src/feature/rpc/schema.ts
 var RpcDefaultSchema = exports_external.record(ResourceIdSchema, exports_external.object({
   router: ResourceIdSchema.describe("The router id to link your RPC API with."),
   path: RouteSchema.describe("The path inside the router to link your RPC API to."),
-  auth: FunctionSchema.optional().describe("The authentication handler for your RPC API.")
+  auth: BundledFunctionSchema.optional().describe("The authentication handler for your RPC API.")
 })).describe(`Define the global RPC API's.`).optional();
 var RpcSchema = exports_external.record(ResourceIdSchema, exports_external.record(exports_external.string(), exports_external.union([
-  FunctionSchema.transform((f11) => ({
+  BundledFunctionSchema.transform((f11) => ({
     function: f11,
     lock: false
   })),
   exports_external.object({
-    function: FunctionSchema.describe("The RPC function to execute."),
+    function: BundledFunctionSchema.describe("The RPC function to execute."),
     lock: exports_external.boolean().describe([
       "Specify if the function should be locked on the `lockKey` returned from the auth function.",
       "An example would be returning the user ID as `lockKey`."
@@ -162110,6 +162132,17 @@ var JobDefaultSchema = exports_external.object({
   }))
 }).default({});
 
+// src/feature/task/schema.ts
+var TaskSchema = exports_external.union([
+  BundledFunctionSchema.transform((consumer) => ({
+    consumer
+  })),
+  exports_external.object({
+    consumer: BundledFunctionSchema
+  })
+]);
+var TasksSchema = exports_external.record(ResourceIdSchema, TaskSchema).optional().describe("Define the tasks in your stack.");
+
 // src/feature/topic/schema.ts
 var TopicNameSchema = exports_external.string().min(3).max(256).regex(/^[a-z0-9\-]+$/i, "Invalid topic name").transform((value) => kebabCase(value)).describe("Define event topic name.");
 var TopicsDefaultSchema = exports_external.array(TopicNameSchema).refine((topics) => {
@@ -162255,7 +162288,7 @@ var ScheduleExpressionSchema = RateExpressionSchema.or(CronExpressionSchema);
 // src/feature/cron/schema/index.ts
 var CronsSchema = exports_external.record(ResourceIdSchema, exports_external.object({
   enabled: exports_external.boolean().default(true).describe("If the cron is enabled."),
-  consumer: FunctionSchema.describe("The consuming lambda function properties."),
+  consumer: BundledFunctionSchema.describe("The consuming lambda function properties."),
   schedule: ScheduleExpressionSchema.describe(`The scheduling expression.
 
 example: "0 20 * * ? *"
@@ -162431,7 +162464,7 @@ var StoresSchema = exports_external.union([
 
 // src/feature/icon/schema.ts
 var staticOriginSchema = LocalDirectorySchema.describe("Specifies the path to a local image directory that will be uploaded in S3.");
-var functionOriginSchema = FunctionSchema.describe("Specifies the file that will be called when an image isn't found in the (cache) bucket.");
+var functionOriginSchema = BundledFunctionSchema.describe("Specifies the file that will be called when an image isn't found in the (cache) bucket.");
 var IconsSchema = exports_external.record(ResourceIdSchema, exports_external.object({
   router: ResourceIdSchema.describe("The router id to link your icon proxy."),
   path: RouteSchema.describe("The path inside the router to link your icon proxy to."),
@@ -162459,7 +162492,7 @@ var transformationOptionsSchema = exports_external.object({
   quality: exports_external.number().int().min(1).max(100).optional()
 });
 var staticOriginSchema2 = LocalDirectorySchema.describe("Specifies the path to a local image directory that will be uploaded in S3.");
-var functionOriginSchema2 = FunctionSchema.describe("Specifies the file that will be called when an image isn't found in the (cache) bucket.");
+var functionOriginSchema2 = BundledFunctionSchema.describe("Specifies the file that will be called when an image isn't found in the (cache) bucket.");
 var ImagesSchema = exports_external.record(ResourceIdSchema, exports_external.object({
   router: ResourceIdSchema.describe("The router id to link your image proxy."),
   path: RouteSchema.describe("The path inside the router to link your image proxy to."),
@@ -162529,7 +162562,7 @@ var AlarmSchema = exports_external.object({
   where: WhereSchema,
   period: DurationSchema,
   minDataPoints: exports_external.number().int().default(1),
-  trigger: exports_external.union([EmailSchema.transform((v7) => [v7]), EmailSchema.array(), FunctionSchema])
+  trigger: exports_external.union([EmailSchema.transform((v7) => [v7]), EmailSchema.array(), BundledFunctionSchema])
 });
 var MetricsSchema = exports_external.record(ResourceIdSchema, exports_external.object({
   type: exports_external.enum(["number", "size", "duration"]),
@@ -162584,7 +162617,7 @@ var TablesSchema = exports_external.record(ResourceIdSchema, exports_external.ob
       "You can specify a number from 1 to 10."
     ].join(`
 `)),
-    consumer: FunctionSchema.describe("The consuming lambda function for the stream")
+    consumer: BundledFunctionSchema.describe("The consuming lambda function for the stream")
   }).optional().describe("The settings for the DynamoDB table stream, which capture changes to items stored in the table."),
   indexes: exports_external.record(exports_external.string(), exports_external.object({
     hash: exports_external.union([KeySchema.transform((v7) => [v7]), KeySchema.array()]).describe("Specifies the name of the partition / hash key that makes up the primary key for the global secondary index."),
@@ -163786,8 +163819,21 @@ var shortId = (ns) => {
   return createHash10("md5").update(ns).digest("hex").substring(0, 10);
 };
 
+// src/feature/on-error-log/util.ts
+var filterPattern = `{${[
+  `$.level = "WARN"`,
+  `$.level = "ERROR"`,
+  `$.level = "FATAL"`,
+  `($.type = "platform.report" && $.record.status = "timeout")`,
+  `($.type = "platform.report" && $.record.status = "error")`,
+  `($.type = "platform.report" && $.record.status = "failure")`
+].join(" || ")}}`;
+
 // src/feature/on-failure/util.ts
 var getGlobalOnFailure = (ctx) => {
+  if (!ctx.shared.has("on-failure", "bucket-arn")) {
+    return;
+  }
   return ctx.shared.get("on-failure", "bucket-arn");
 };
 
@@ -164245,14 +164291,6 @@ var bundleTypeScriptWithRolldown = async (props) => {
       }
       const routeKey = decodeURIComponent(encodedRouteKey);
       return `${routeKey.replaceAll(":", "--")}.${extension}`;
-    },
-    codeSplitting: {
-      groups: [
-        {
-          name: "shared",
-          minShareCount: 2
-        }
-      ]
     }
   });
   const hash2 = createHash11("sha1");
@@ -164537,12 +164575,7 @@ var bundleFeature = defineFeature({
       },
       s3Bucket: code.bucket,
       s3ObjectVersion: code.versionId,
-      s3Key: code.key.pipe((name2) => {
-        if (name2.startsWith("/")) {
-          return name2.substring(1);
-        }
-        return name2;
-      }),
+      s3Key: code.key,
       sourceCodeHash: sourceHash,
       environment: {
         variables: {
@@ -164588,27 +164621,29 @@ var bundleFeature = defineFeature({
     }, {
       dependsOn: [policy]
     });
-    new aws3.lambda.FunctionEventInvokeConfig(group4, "async", {
-      functionName: lambda.functionName,
-      qualifier: alias.name,
-      maximumRetryAttempts: 2,
-      destinationConfig: {
-        onFailure: {
-          destination: onFailure
+    if (onFailure) {
+      new aws3.lambda.FunctionEventInvokeConfig(group4, "async", {
+        functionName: lambda.functionName,
+        qualifier: alias.name,
+        maximumRetryAttempts: 2,
+        destinationConfig: {
+          onFailure: {
+            destination: onFailure
+          }
         }
-      }
-    }, {
-      dependsOn: [policy]
-    });
-    addPermission({
-      actions: ["s3:PutObject", "s3:ListBucket"],
-      resources: [onFailure, $interpolate`${onFailure}/*`],
-      conditions: {
-        StringEquals: {
-          "s3:ResourceAccount": ctx.accountId
+      }, {
+        dependsOn: [policy]
+      });
+      addPermission({
+        actions: ["s3:PutObject", "s3:ListBucket"],
+        resources: [onFailure, $interpolate`${onFailure}/*`],
+        conditions: {
+          StringEquals: {
+            "s3:ResourceAccount": ctx.accountId
+          }
         }
-      }
-    });
+      });
+    }
     let logGroup;
     if (defaults2.log.retention.value > 0n) {
       logGroup = new aws3.cloudwatch.LogGroup(group4, "log", {
@@ -164619,6 +164654,17 @@ var bundleFeature = defineFeature({
         actions: ["logs:PutLogEvents", "logs:CreateLogStream"],
         resources: [logGroup.arn.pipe((arn) => `${arn}:*`)]
       });
+      if (ctx.shared.has("on-error-log", "subscriber-arn")) {
+        new aws3.cloudwatch.LogSubscriptionFilter(group4, "on-error-log", {
+          name: "error-log-subscription",
+          destinationArn: ctx.shared.get("on-error-log", "subscriber-arn"),
+          logGroupName: logGroup.name,
+          filterPattern
+        }, {
+          replaceOnChanges: ["destinationArn"],
+          dependsOn: [ctx.shared.get("on-error-log", "permission")]
+        });
+      }
     }
     for (const [name2, value] of Object.entries(defaults2.environment ?? {})) {
       addEnv(name2, value);
@@ -172732,9 +172778,12 @@ var configFeature = defineFeature({
         `arn:aws:ssm:${ctx.appConfig.region}:${ctx.accountId}:parameter${configParameterPrefix(ctx.app.name)}/*`
       ]
     });
-    for (const name of ctx.appConfig.configs ?? []) {
+    const names = ctx.appConfig.configs ?? [];
+    for (const name of names) {
       ctx.registerConfig(name);
-      ctx.addEnv(`CONFIG_${constantCase(name)}`, name);
+    }
+    if (names.length > 0) {
+      ctx.addEnv("CONFIGS", names.join(","));
     }
   }
 });
@@ -173054,20 +173103,9 @@ import { days as days8, seconds as seconds4, toDays as toDays6, toSeconds as toS
 import { generateFileHash as generateFileHash2 } from "@awsless/ts-file-cache";
 var import_deepmerge = __toESM(require_cjs2(), 1);
 import { createHash as createHash16 } from "crypto";
+import { readdir as readdir4, readFile as readFile16, rm as rm7, writeFile as writeFile10 } from "fs/promises";
 import { dirname as dirname8, join as join23 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
-
-// src/feature/on-error-log/util.ts
-var filterPattern = `{${[
-  `$.level = "WARN"`,
-  `$.level = "ERROR"`,
-  `$.level = "FATAL"`,
-  `($.type = "platform.report" && $.record.status = "timeout")`,
-  `($.type = "platform.report" && $.record.status = "error")`,
-  `($.type = "platform.report" && $.record.status = "failure")`
-].join(" || ")}}`;
-
-// src/feature/function/util.ts
 var standaloneFields = [
   "runtime",
   "description",
@@ -173085,6 +173123,88 @@ var standaloneFields = [
 var isStandaloneFunction = (props) => {
   return standaloneFields.some((field) => typeof props[field] !== "undefined");
 };
+var registerFunctionBuild = (ctx, name, props) => {
+  const exportName = parseExportName(props.handler ?? ctx.appConfig.defaults.function.handler);
+  ctx.registerBuild("function", name, async (build2, { workspace }) => {
+    const fingerprint = createHash16("sha1").update(await generateFileHash2(workspace, props.code.file)).update(props.wrapper ? await readFile16(props.wrapper) : "").update(JSON.stringify([
+      exportName,
+      props.code.minify,
+      props.code.external,
+      props.code.importAsString,
+      props.code.moduleSideEffects,
+      props.external
+    ])).digest("hex");
+    return build2(fingerprint, async (write) => {
+      const handlerImport = `const { ${exportName === "default" ? "default: handler" : `${exportName}: handler`} } = await import(${JSON.stringify(props.code.file)})`;
+      const entry = `import env from './awsless-env.mjs'
+
+for (const name in env) {
+	process.env[name] ??= env[name]
+}
+
+${props.wrapper ? `const { createHandler } = await import(${JSON.stringify(props.wrapper)})
+${handlerImport}
+
+export default createHandler(handler)` : `${handlerImport}
+
+export default handler`}
+`;
+      const temp = await createTempFolder(name);
+      const entryFile = join23(temp.path, "entry.ts");
+      await writeFile10(entryFile, entry);
+      const result = await bundleTypeScriptWithRolldown({
+        file: entryFile,
+        minify: props.code.minify,
+        external: [
+          "./awsless-env.mjs",
+          ...props.code.external ?? [],
+          ...props.external ?? []
+        ],
+        moduleSideEffects: props.code.moduleSideEffects,
+        importAsString: props.code.importAsString
+      });
+      await temp.delete();
+      await rm7(getBuildPath("function", name, "files"), { recursive: true, force: true });
+      await Promise.all([
+        write("HASH", result.hash),
+        ...result.files.map((file2) => write(`files/${file2.name}`, file2.code)),
+        ...result.files.map((file2) => file2.map && write(`files/${file2.name}.map`, file2.map))
+      ]);
+      return {
+        size: formatByteSize(result.files.reduce((total, file2) => total + file2.code.byteLength, 0))
+      };
+    });
+  });
+  const env5 = {};
+  const envDeps = new Set;
+  const addEnv = (name2, value) => {
+    env5[name2] = value;
+    for (const dep of findInputDeps(value)) {
+      envDeps.add(dep);
+    }
+  };
+  const zipFile = getBuildPath("function", name, "bundle.zip");
+  const sourceHash = new Output(envDeps, async (resolve3) => {
+    const buildHash = await readFile16(getBuildPath("function", name, "HASH"), "utf8");
+    const vars = await resolveInputs(env5);
+    const sorted = Object.fromEntries(Object.entries(vars).sort(([a15], [b17]) => a15.localeCompare(b17)));
+    const envFile = `export default ${JSON.stringify(sorted, undefined, "\t")}
+`;
+    const dir = getBuildPath("function", name, "files");
+    const files = await readdir4(dir);
+    const archive = await zipFiles([
+      ...files.filter((file2) => !file2.endsWith(".map")).map((file2) => ({ name: file2, path: join23(dir, file2) })),
+      { name: "awsless-env.mjs", code: Buffer.from(envFile, "utf8") }
+    ]);
+    await writeFile10(zipFile, archive);
+    resolve3(createHash16("sha1").update(buildHash).update(envFile).digest("hex"));
+  });
+  return {
+    zipFile,
+    sourceHash,
+    addEnv
+  };
+};
 var createLambdaFunction = (ctx, id, local) => {
   const group4 = new Group(ctx.stack, "function", id);
   const props = import_deepmerge.default(ctx.appConfig.defaults.function, local);
@@ -173103,43 +173223,16 @@ var createLambdaFunction = (ctx, id, local) => {
     resourceName: id
   });
   const roleName = shortId(`${ctx.app.name}:${ctx.stack.name}:function:${id}:${ctx.appId}`);
-  const fileCode = local.code;
-  ctx.registerBuild("function", name, async (build2, { workspace }) => {
-    const fingerprint = createHash16("sha1").update(await generateFileHash2(workspace, fileCode.file)).update(JSON.stringify([
-      fileCode.minify,
-      fileCode.external,
-      fileCode.importAsString,
-      fileCode.moduleSideEffects
-    ])).digest("hex");
-    return build2(fingerprint, async (write) => {
-      const bundle = await bundleTypeScriptWithRolldown({
-        file: fileCode.file,
-        minify: fileCode.minify,
-        external: [
-          ...fileCode.external ?? [],
-          ...(props.layers ?? []).flatMap((layerId) => ctx.shared.entry("layer", "packages", layerId))
-        ],
-        moduleSideEffects: fileCode.moduleSideEffects,
-        importAsString: fileCode.importAsString
-      });
-      const archive = await zipFiles(bundle.files);
-      await Promise.all([
-        write("HASH", bundle.hash),
-        write("bundle.zip", archive),
-        ...bundle.files.map((file2) => write(`files/${file2.name}`, file2.code)),
-        ...bundle.files.map((file2) => file2.map && write(`files/${file2.name}.map`, file2.map))
-      ]);
-      return {
-        size: formatByteSize(archive.byteLength)
-      };
-    });
+  const build2 = registerFunctionBuild(ctx, name, {
+    code: local.code,
+    handler: props.handler,
+    external: (props.layers ?? []).flatMap((layerId) => ctx.shared.entry("layer", "packages", layerId))
   });
-  const sourceHash = $file(getBuildPath("function", name, "HASH"));
   const code = new aws3.s3.BucketObject(group4, "code", {
     bucket: ctx.shared.get("asset", "bucket").name,
     key: `lambda/${name}.zip`,
-    source: relativePath(getBuildPath("function", name, "bundle.zip")),
-    sourceHash
+    source: relativePath(build2.zipFile),
+    sourceHash: build2.sourceHash
   }, {
     replaceOnChanges: ["bucket", "key"]
   });
@@ -173168,11 +173261,11 @@ var createLambdaFunction = (ctx, id, local) => {
     }
   };
   const sandboxed = typeof local.sandbox !== "undefined" && local.sandbox !== false;
-  addPermission(...(sandboxed ? local.permissions : props.permissions) ?? []);
-  if (!sandboxed) {
-    ctx.onPermission((statement) => {
-      addPermission(statement);
-    });
+  if (sandboxed) {
+    addPermission(...local.permissions ?? []);
+  } else {
+    addPermission(...props.permissions ?? []);
+    ctx.onPermission(addPermission);
   }
   const policy = new aws3.iam.RolePolicy(group4, "policy", {
     role: role.name,
@@ -173224,7 +173317,7 @@ var createLambdaFunction = (ctx, id, local) => {
     description: props.description ?? name,
     role: role.arn,
     runtime: props.runtime,
-    handler: props.handler,
+    handler: "index.default",
     timeout: toSeconds4(props.timeout),
     memorySize: toMebibytes(props.memorySize),
     architectures: [props.architecture],
@@ -173240,13 +173333,8 @@ var createLambdaFunction = (ctx, id, local) => {
     },
     s3Bucket: code.bucket,
     s3ObjectVersion: code.versionId,
-    s3Key: code.key.pipe((name2) => {
-      if (name2.startsWith("/")) {
-        return name2.substring(1);
-      }
-      return name2;
-    }),
-    sourceCodeHash: sourceHash,
+    s3Key: code.key,
+    sourceCodeHash: build2.sourceHash,
     environment: {
       variables
     },
@@ -173264,7 +173352,30 @@ var createLambdaFunction = (ctx, id, local) => {
   }, {
     dependsOn
   });
-  ctx.addFunction(lambda);
+  ctx.restartOnConfigChange(lambda);
+  const onFailure = getGlobalOnFailure(ctx);
+  if (onFailure) {
+    new aws3.lambda.FunctionEventInvokeConfig(group4, "async", {
+      functionName: lambda.functionName,
+      maximumRetryAttempts: 2,
+      destinationConfig: {
+        onFailure: {
+          destination: onFailure
+        }
+      }
+    }, {
+      dependsOn: [policy]
+    });
+    addPermission({
+      actions: ["s3:PutObject", "s3:ListBucket"],
+      resources: [onFailure, $interpolate`${onFailure}/*`],
+      conditions: {
+        StringEquals: {
+          "s3:ResourceAccount": ctx.accountId
+        }
+      }
+    });
+  }
   variables.APP = ctx.appConfig.name;
   variables.APP_ID = ctx.appId;
   variables.AWS_ACCOUNT_ID = ctx.accountId;
@@ -173283,12 +173394,8 @@ var createLambdaFunction = (ctx, id, local) => {
     variables[key] = value;
   }
   if (!sandboxed) {
-    ctx.onEnv((name2, value) => {
-      variables[name2] = value;
-    });
-    ctx.onBind((name2, value) => {
-      variables[name2] = value;
-    });
+    ctx.onEnv(build2.addEnv);
+    ctx.onBind(build2.addEnv);
   }
   if (typeof local.sandbox === "object") {
     const routes = [
@@ -173304,16 +173411,17 @@ var createLambdaFunction = (ctx, id, local) => {
     if (routes.length > 0) {
       const bundle = ctx.shared.get("bundle", "main");
       const distDir = dirname8(fileURLToPath4(import.meta.url));
-      const proxy = createPrebuildLambdaFunction(group4, ctx, "function", `${id}-proxy`, {
-        bundleFile: join23(distDir, "/prebuild/sandbox-proxy/bundle.zip"),
-        bundleHash: join23(distDir, "/prebuild/sandbox-proxy/HASH"),
+      const proxy = createLambdaFunctionFromZip(group4, ctx, "function", `${id}-proxy`, {
+        zipFile: join23(distDir, "/prebuild/sandbox-proxy/bundle.zip"),
+        sourceHash: $file(join23(distDir, "/prebuild/sandbox-proxy/HASH")),
         runtime: "nodejs24.x",
         handler: "index.default",
+        memorySize: mebibytes(512),
         timeout: ctx.appConfig.defaults.function.timeout,
         log: {
           format: "json",
           level: "warn",
-          system: "warn",
+          system: "info",
           retention: days8(3)
         }
       });
@@ -173330,9 +173438,7 @@ var createLambdaFunction = (ctx, id, local) => {
     }
     const configs = local.sandbox.configs ?? [];
     if (configs.length > 0) {
-      for (const configName of configs) {
-        variables[`CONFIG_${constantCase(configName)}`] = configName;
-      }
+      variables.CONFIGS = configs.join(",");
       addPermission({
         actions: [
           "ssm:GetParameter",
@@ -173362,6 +173468,7 @@ var createLambdaFunction = (ctx, id, local) => {
         logGroupName: logGroup.name,
         filterPattern
       }, {
+        replaceOnChanges: ["destinationArn"],
         dependsOn: [ctx.shared.get("on-error-log", "permission")]
       });
     }
@@ -173380,7 +173487,7 @@ var createLambdaFunction = (ctx, id, local) => {
     }
   };
 };
-var createPrebuildLambdaFunction = (parentGroup, ctx, ns, id, props) => {
+var createLambdaFunctionFromZip = (parentGroup, ctx, ns, id, props) => {
   let name;
   let roleName;
   const group4 = new Group(parentGroup, "function", id);
@@ -173411,12 +173518,11 @@ var createPrebuildLambdaFunction = (parentGroup, ctx, ns, id, props) => {
       postfix: ctx.appId
     });
   }
-  const sourceHash = $file(props.bundleHash);
   const code = new aws3.s3.BucketObject(group4, "code", {
     bucket: ctx.shared.get("asset", "bucket").name,
     key: `lambda/${name}.zip`,
-    source: relativePath(props.bundleFile),
-    sourceHash
+    source: relativePath(props.zipFile),
+    sourceHash: props.sourceHash
   }, {
     replaceOnChanges: ["bucket", "key"]
   });
@@ -173505,13 +173611,8 @@ var createPrebuildLambdaFunction = (parentGroup, ctx, ns, id, props) => {
     },
     s3Bucket: code.bucket,
     s3ObjectVersion: code.versionId,
-    s3Key: code.key.pipe((name2) => {
-      if (name2.startsWith("/")) {
-        return name2.substring(1);
-      }
-      return name2;
-    }),
-    sourceCodeHash: sourceHash,
+    s3Key: code.key,
+    sourceCodeHash: props.sourceHash,
     environment: {
       variables
     },
@@ -173529,11 +173630,35 @@ var createPrebuildLambdaFunction = (parentGroup, ctx, ns, id, props) => {
   }, {
     dependsOn
   });
+  const onFailure = getGlobalOnFailure(ctx);
+  if (onFailure) {
+    new aws3.lambda.FunctionEventInvokeConfig(group4, "async", {
+      functionName: lambda.functionName,
+      maximumRetryAttempts: 2,
+      destinationConfig: {
+        onFailure: {
+          destination: onFailure
+        }
+      }
+    }, {
+      dependsOn: [policy]
+    });
+    addPermission({
+      actions: ["s3:PutObject", "s3:ListBucket"],
+      resources: [onFailure, $interpolate`${onFailure}/*`],
+      conditions: {
+        StringEquals: {
+          "s3:ResourceAccount": ctx.accountId
+        }
+      }
+    });
+  }
   variables.APP = ctx.appConfig.name;
   variables.APP_ID = ctx.appId;
   variables.AWS_ACCOUNT_ID = ctx.accountId;
   variables.REGION = ctx.appConfig.region;
   variables.STAGE = ctx.appConfig.stage ?? "default";
+  variables.STANDALONE = "true";
   if ("stackConfig" in ctx) {
     variables.STACK = ctx.stackConfig.name;
   }
@@ -173557,6 +173682,7 @@ var createPrebuildLambdaFunction = (parentGroup, ctx, ns, id, props) => {
         logGroupName: logGroup.name,
         filterPattern
       }, {
+        replaceOnChanges: ["destinationArn"],
         dependsOn: [ctx.shared.get("on-error-log", "permission")]
       });
     }
@@ -173674,7 +173800,7 @@ var functionFeature = defineFeature({
 });
 
 // src/feature/on-error-log/index.ts
-import { formatRouteEnvName as formatRouteEnvName2 } from "awsless";
+import { days as days9 } from "@awsless/duration";
 import { dirname as dirname9, join as join24 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 var onErrorLogFeature = defineFeature({
@@ -173685,73 +173811,61 @@ var onErrorLogFeature = defineFeature({
       return;
     }
     const group4 = new Group(ctx.base, "on-error-log", "main");
-    const bundle = ctx.shared.get("bundle", "main");
     const consumer = props.consumer;
-    const handlerRoute = formatRouteKey("base", "on-error-log", "handler");
-    const consumerRoute = formatRouteKey("base", "on-error-log", "consumer");
-    bundle.addHandler({
-      routeKey: handlerRoute,
-      file: join24(dirname9(fileURLToPath5(import.meta.url)), "/handlers/on-error-log.js"),
-      exportName: "default"
-    });
-    bundle.addEnv(formatRouteEnvName2(handlerRoute, "CONSUMER"), consumerRoute);
-    const requestTable = new aws3.dynamodb.Table(group4, "requests", {
-      name: formatGlobalResourceName({
-        appName: ctx.app.name,
-        resourceType: "on-error-log",
-        resourceName: "requests"
-      }),
-      hashKey: "id",
-      billingMode: "PAY_PER_REQUEST",
-      ttl: {
-        enabled: true,
-        attributeName: "ttl"
-      },
-      attribute: [
-        {
-          name: "id",
-          type: "S"
-        }
-      ]
+    const name = formatGlobalResourceName({
+      appName: ctx.app.name,
+      resourceType: "on-error-log",
+      resourceName: "handler"
+    });
+    const build2 = registerFunctionBuild(ctx, name, {
+      code: consumer.code,
+      handler: consumer.handler,
+      wrapper: join24(dirname9(fileURLToPath5(import.meta.url)), "/handlers/on-error-log.js")
     });
-    bundle.addEnv(formatRouteEnvName2(handlerRoute, "TABLE"), requestTable.name);
-    bundle.addPermission({
-      effect: "allow",
-      actions: ["dynamodb:PutItem", "dynamodb:GetItem"],
-      resources: [requestTable.arn]
+    const handler = createLambdaFunctionFromZip(group4, ctx, "on-error-log", "handler", {
+      zipFile: build2.zipFile,
+      sourceHash: build2.sourceHash,
+      runtime: "nodejs24.x",
+      handler: "index.default",
+      memorySize: consumer.memorySize ?? ctx.appConfig.defaults.function.memorySize,
+      timeout: consumer.timeout ?? ctx.appConfig.defaults.function.timeout,
+      architecture: consumer.architecture ?? ctx.appConfig.defaults.function.architecture,
+      vpc: consumer.vpc,
+      log: {
+        format: consumer.log?.format ?? "json",
+        level: consumer.log?.level ?? "warn",
+        system: consumer.log?.system ?? "warn",
+        retention: consumer.log?.retention ?? days9(3)
+      }
     });
-    registerBundleFunction(ctx, consumerRoute, consumer);
+    ctx.onEnv(build2.addEnv);
+    ctx.onBind(build2.addEnv);
+    ctx.onPermission((statement) => handler.addPermission(statement));
+    ctx.restartOnConfigChange(handler.lambda);
     const permission = new aws3.lambda.Permission(group4, "permission", {
       action: "lambda:InvokeFunction",
       principal: "logs.amazonaws.com",
-      functionName: bundle.lambda.functionName,
-      qualifier: bundle.alias.name,
+      functionName: handler.lambda.functionName,
       sourceArn: `arn:aws:logs:${ctx.appConfig.region}:${ctx.accountId}:log-group:/aws/*/${ctx.app.name}--*`
     }, {
-      replaceOnChanges: ["functionName", "qualifier"]
+      replaceOnChanges: ["functionName"]
     });
-    if (bundle.logGroup) {
-      new aws3.cloudwatch.LogSubscriptionFilter(group4, "bundle", {
-        name: "error-log-subscription",
-        destinationArn: bundle.alias.arn,
-        logGroupName: bundle.logGroup.name,
-        filterPattern
-      }, {
-        dependsOn: [permission]
-      });
-    }
-    ctx.shared.set("on-error-log", "subscriber-arn", bundle.alias.arn);
+    ctx.shared.set("on-error-log", "subscriber-arn", handler.lambda.arn);
     ctx.shared.set("on-error-log", "permission", permission);
   }
 });
 
 // src/feature/on-failure/index.ts
-import { days as days9, toSeconds as toSeconds5 } from "@awsless/duration";
+import { days as days10, toSeconds as toSeconds5 } from "@awsless/duration";
 import { dirname as dirname10, join as join25 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 var onFailureFeature = defineFeature({
   name: "on-failure",
   onBefore(ctx) {
+    const props = ctx.appConfig.defaults.onFailure;
+    if (!props) {
+      return;
+    }
     const group4 = new Group(ctx.base, "on-failure", "main");
     const deadletter = new aws3.sqs.Queue(group4, "deadletter", {
       name: formatGlobalResourceName({
@@ -173759,16 +173873,16 @@ var onFailureFeature = defineFeature({
         resourceType: "on-failure",
         resourceName: "deadletter"
       }),
-      messageRetentionSeconds: toSeconds5(days9(14))
+      messageRetentionSeconds: toSeconds5(days10(14))
     });
-    const bundleTimeout = toSeconds5(ctx.appConfig.defaults.function.timeout);
+    const handlerTimeout = toSeconds5(props.consumer.timeout ?? ctx.appConfig.defaults.function.timeout);
     const queue2 = new aws3.sqs.Queue(group4, "on-failure", {
       name: formatGlobalResourceName({
         appName: ctx.app.name,
         resourceType: "on-failure",
         resourceName: "failure"
       }),
-      visibilityTimeoutSeconds: bundleTimeout * 6,
+      visibilityTimeoutSeconds: handlerTimeout * 2,
       redrivePolicy: deadletter.arn.pipe((deadLetterTargetArn) => {
         return JSON.stringify({
           deadLetterTargetArn,
@@ -173793,13 +173907,12 @@ var onFailureFeature = defineFeature({
         }
       ]
     });
-    ctx.shared.set("on-failure", "bucket-arn", bucket.arn);
     ctx.shared.set("on-failure", "resources", {
       group: group4,
       bucket,
       queue: queue2
     });
-    const notify = ctx.appConfig.defaults.onFailure?.notify;
+    const notify = props.notify;
     if (notify) {
       const topic = new aws3.sns.Topic(group4, "deadletter-topic", {
         name: formatGlobalResourceName({
@@ -173893,28 +174006,39 @@ var onFailureFeature = defineFeature({
     if (!props) {
       return;
     }
-    const bundle = ctx.shared.get("bundle", "main");
     const { group: group4, bucket, queue: queue2 } = ctx.shared.get("on-failure", "resources");
-    registerBundleFunction(ctx, formatRouteKey("base", "on-failure", "consumer"), props.consumer);
-    const distDir = dirname10(fileURLToPath6(import.meta.url));
-    const handler = createPrebuildLambdaFunction(group4, ctx, "on-failure", "handler", {
-      bundleFile: join25(distDir, "/prebuild/on-failure/bundle.zip"),
-      bundleHash: join25(distDir, "/prebuild/on-failure/HASH"),
+    const name = formatGlobalResourceName({
+      appName: ctx.app.name,
+      resourceType: "on-failure",
+      resourceName: "handler"
+    });
+    const consumer = props.consumer;
+    const build2 = registerFunctionBuild(ctx, name, {
+      code: consumer.code,
+      handler: consumer.handler,
+      wrapper: join25(dirname10(fileURLToPath6(import.meta.url)), "/handlers/on-failure.js")
+    });
+    const handler = createLambdaFunctionFromZip(group4, ctx, "on-failure", "handler", {
+      zipFile: build2.zipFile,
+      sourceHash: build2.sourceHash,
       runtime: "nodejs24.x",
       handler: "index.default",
-      memorySize: mebibytes(256),
-      timeout: ctx.appConfig.defaults.function.timeout,
+      memorySize: consumer.memorySize ?? ctx.appConfig.defaults.function.memorySize,
+      timeout: consumer.timeout ?? ctx.appConfig.defaults.function.timeout,
+      architecture: consumer.architecture ?? ctx.appConfig.defaults.function.architecture,
+      vpc: consumer.vpc,
       log: {
-        format: "json",
-        level: "warn",
-        system: "warn",
-        retention: days9(3)
+        format: consumer.log?.format ?? "json",
+        level: consumer.log?.level ?? "warn",
+        system: consumer.log?.system ?? "warn",
+        retention: consumer.log?.retention ?? days10(3)
       }
     });
+    ctx.onEnv(build2.addEnv);
+    ctx.onBind(build2.addEnv);
+    ctx.onPermission((statement) => handler.addPermission(statement));
+    ctx.restartOnConfigChange(handler.lambda);
     handler.addPermission({
-      actions: ["lambda:InvokeFunction"],
-      resources: [bundle.alias.arn]
-    }, {
       actions: ["s3:GetObject", "s3:DeleteObject"],
       resources: [$interpolate`${bucket.arn}/*`]
     }, {
@@ -173968,6 +174092,7 @@ var onFailureFeature = defineFeature({
         }
       ]
     }, { dependsOn: [queuePolicy] });
+    ctx.shared.set("on-failure", "bucket-arn", bucket.arn);
   }
 });
 
@@ -173975,19 +174100,19 @@ var onFailureFeature = defineFeature({
 import { createHmac as createHmac5 } from "crypto";
 import { fileURLToPath as fileURLToPath8 } from "url";
 import { dirname as dirname12, join as join28 } from "path";
-import { formatRouteEnvName as formatRouteEnvName3 } from "awsless";
+import { formatRouteEnvName as formatRouteEnvName2 } from "awsless";
 
 // src/feature/pubsub/util.ts
 import { toDays as toDays7 } from "@awsless/duration";
 import { stringify as stringify2 } from "@awsless/json";
 import { createHash as createHash18 } from "crypto";
-import { readFile as readFile17 } from "fs/promises";
+import { readFile as readFile18 } from "fs/promises";
 import { fileURLToPath as fileURLToPath7 } from "url";
 import { dirname as dirname11, join as join27 } from "path";
 
 // src/feature/instance/build/executable.ts
 import { createHash as createHash17 } from "crypto";
-import { readFile as readFile16 } from "fs/promises";
+import { readFile as readFile17 } from "fs/promises";
 import { join as join26 } from "path";
 var buildExecutable = async (input, outputPath, architecture) => {
   const filePath = join26(outputPath, "program");
@@ -174027,7 +174152,7 @@ var buildExecutable = async (input, outputPath, architecture) => {
 ${result.logs?.map((log) => log.message).join(`
 `)}`);
   }
-  const file2 = await readFile16(filePath);
+  const file2 = await readFile17(filePath);
   return {
     hash: createHash17("sha1").update(file2).update("x86_64").digest("hex"),
     file: file2
@@ -174053,7 +174178,7 @@ var createPubSubService = (parentGroup, ctx, id, props, inputs) => {
   const image = "public.ecr.aws/aws-cli/aws-cli:arm64";
   const bundleFile = join27(__dirname2, "handlers/pubsub-server.js");
   ctx.registerBuild("pubsub", name, async (build2) => {
-    const hash2 = createHash18("sha1").update(await readFile17(bundleFile)).digest("hex");
+    const hash2 = createHash18("sha1").update(await readFile18(bundleFile)).digest("hex");
     const fingerprint = `${hash2}-${ARCHITECTURE}`;
     return build2(fingerprint, async (write) => {
       const temp = await createTempFolder(`pubsub--${name}`);
@@ -174585,9 +174710,9 @@ var pubsubFeature = defineFeature({
         file: join28(__dirname3, "/handlers/pubsub-publisher.js"),
         exportName: "default"
       });
-      bundle.addEnv(formatRouteEnvName3(publisherRouteKey, "REDIS_HOST"), redisHost);
-      bundle.addEnv(formatRouteEnvName3(publisherRouteKey, "REDIS_PORT"), redisPort.pipe((port) => port.toString()));
-      bundle.addEnv(formatRouteEnvName3(publisherRouteKey, "CHANNEL"), channel);
+      bundle.addEnv(formatRouteEnvName2(publisherRouteKey, "REDIS_HOST"), redisHost);
+      bundle.addEnv(formatRouteEnvName2(publisherRouteKey, "REDIS_PORT"), redisPort.pipe((port) => port.toString()));
+      bundle.addEnv(formatRouteEnvName2(publisherRouteKey, "CHANNEL"), channel);
       const routerProps = ctx.appConfig.defaults.router?.[props.router];
       if (!routerProps?.domain) {
         throw new FileError("app.json", `The pubsub "${id}" requires the "${props.router}" router to have a domain configured.`);
@@ -174842,7 +174967,7 @@ var restFeature = defineFeature({
 });
 
 // src/feature/rpc/index.ts
-import { formatRouteEnvName as formatRouteEnvName4 } from "awsless";
+import { formatRouteEnvName as formatRouteEnvName3 } from "awsless";
 import { dirname as dirname13, join as join29, relative as relative5 } from "path";
 import { fileURLToPath as fileURLToPath9 } from "url";
 import { toSeconds as toSeconds7 } from "@awsless/duration";
@@ -174899,7 +175024,7 @@ var rpcFeature = defineFeature({
         file: join29(dirname13(fileURLToPath9(import.meta.url)), "/handlers/rpc.js"),
         exportName: "default"
       });
-      bundle.addEnv(formatRouteEnvName4(serverRouteKey, "TIMEOUT"), toSeconds7(ctx.appConfig.defaults.function.timeout).toString());
+      bundle.addEnv(formatRouteEnvName3(serverRouteKey, "TIMEOUT"), toSeconds7(ctx.appConfig.defaults.function.timeout).toString());
       const lockTable = new aws3.dynamodb.Table(group4, "lock", {
         name: formatGlobalResourceName({
           appName: ctx.app.name,
@@ -174919,7 +175044,7 @@ var rpcFeature = defineFeature({
           }
         ]
       });
-      bundle.addEnv(formatRouteEnvName4(serverRouteKey, "LOCK_TABLE"), lockTable.name);
+      bundle.addEnv(formatRouteEnvName3(serverRouteKey, "LOCK_TABLE"), lockTable.name);
       bundle.addPermission({
         effect: "allow",
         actions: ["dynamodb:UpdateItem", "dynamodb:DeleteItem"],
@@ -174928,7 +175053,7 @@ var rpcFeature = defineFeature({
       if (props.auth) {
         const authRouteKey = formatRouteKey("base", "rpc", `${id}-auth`);
         registerBundleFunction(ctx, authRouteKey, props.auth);
-        bundle.addEnv(formatRouteEnvName4(serverRouteKey, "AUTH"), authRouteKey);
+        bundle.addEnv(formatRouteEnvName3(serverRouteKey, "AUTH"), authRouteKey);
       }
       const addRoutes = ctx.shared.entry("router", "addRoutes", props.router);
       addRoutes({
@@ -174953,7 +175078,7 @@ var rpcFeature = defineFeature({
         const entryId = kebabCase(`${id}-${shortId(name)}`);
         const routeKey = formatRouteKey(ctx.stack.name, "rpc", entryId);
         registerBundleFunction(ctx, routeKey, props.function);
-        bundle.addEnv(formatRouteEnvName4(serverRouteKey, `QUERY:${name}`), JSON.stringify({ function: routeKey, lock: props.lock }));
+        bundle.addEnv(formatRouteEnvName3(serverRouteKey, `QUERY:${name}`), JSON.stringify({ function: routeKey, lock: props.lock }));
       }
     }
   }
@@ -175049,7 +175174,7 @@ import { createHash as createHash19 } from "crypto";
 import { dirname as dirname15, join as join32 } from "path";
 
 // src/util/cache.ts
-import { lstat as lstat3, readdir as readdir4 } from "fs/promises";
+import { lstat as lstat3, readdir as readdir5 } from "fs/promises";
 import { join as join30 } from "path";
 var generateCacheKey = async (directories2) => {
   const files = await listAllFiles(directories2);
@@ -175073,7 +175198,7 @@ var listAllFiles = async (list2) => {
   for (const entry of list2) {
     const stat5 = await lstat3(entry);
     if (stat5.isDirectory()) {
-      const dirents = await readdir4(entry, {
+      const dirents = await readdir5(entry, {
         recursive: true,
         withFileTypes: true
       });
@@ -175155,11 +175280,9 @@ var siteFeature = defineFeature({
               AWS_SECRET_ACCESS_KEY: credentials4.secretAccessKey,
               AWS_SESSION_TOKEN: credentials4.sessionToken
             };
-            for (const name2 of props.build?.configs ?? []) {
-              env5[`CONFIG_${constantCase(name2)}`] = name2;
-            }
-            for (const name2 of ctx.stackConfig.configs ?? []) {
-              env5[`CONFIG_${constantCase(name2)}`] = name2;
+            const configs = props.build?.configs ?? [];
+            if (configs.length > 0) {
+              env5.CONFIGS = configs.join(",");
             }
             const instance = Bun.spawn(buildProps.command.split(" "), {
               cwd,
@@ -175565,11 +175688,11 @@ var tableFeature = defineFeature({
           parallelizationFactor: props.stream.concurrencyPerShard,
           functionResponseTypes: ["ReportBatchItemFailures"],
           startingPosition: "LATEST",
-          destinationConfig: {
+          destinationConfig: onFailure ? {
             onFailure: {
               destinationArn: onFailure
             }
-          }
+          } : undefined
         }, {
           dependsOn: [bundle.policy]
         });
@@ -176081,9 +176204,9 @@ var layerFeature = defineFeature({
 
 // src/feature/image/index.ts
 import { toDays as toDays9 } from "@awsless/duration";
-import { formatRouteEnvName as formatRouteEnvName5 } from "awsless";
+import { formatRouteEnvName as formatRouteEnvName4 } from "awsless";
 import { createHash as createHash20 } from "crypto";
-import { readFile as readFile18 } from "fs/promises";
+import { readFile as readFile19 } from "fs/promises";
 import { dirname as dirname16, join as join34 } from "path";
 import { fileURLToPath as fileURLToPath10 } from "url";
 var imageFeature = defineFeature({
@@ -176106,7 +176229,7 @@ var imageFeature = defineFeature({
       resourceName: "sharp"
     });
     ctx.registerBuild("image", layerId, async (build2) => {
-      const file2 = await readFile18(path2);
+      const file2 = await readFile19(path2);
       const fingerprint = createHash20("sha1").update(file2).digest("hex");
       return build2(fingerprint, async (write) => {
         await Promise.all([
@@ -176195,17 +176318,17 @@ var imageFeature = defineFeature({
           }
         }
       });
-      bundle.addEnv(formatRouteEnvName5(serverRouteKey, "IMAGE_CONFIG"), JSON.stringify({
+      bundle.addEnv(formatRouteEnvName4(serverRouteKey, "IMAGE_CONFIG"), JSON.stringify({
         presets: props.presets,
         extensions: props.extensions
       }));
-      bundle.addEnv(formatRouteEnvName5(serverRouteKey, "IMAGE_BUCKET"), bucket.name);
-      bundle.addEnv(formatRouteEnvName5(serverRouteKey, "IMAGE_FOLDER"), folder);
+      bundle.addEnv(formatRouteEnvName4(serverRouteKey, "IMAGE_BUCKET"), bucket.name);
+      bundle.addEnv(formatRouteEnvName4(serverRouteKey, "IMAGE_FOLDER"), folder);
       if (originRouteKey) {
-        bundle.addEnv(formatRouteEnvName5(serverRouteKey, "IMAGE_ORIGIN"), originRouteKey);
+        bundle.addEnv(formatRouteEnvName4(serverRouteKey, "IMAGE_ORIGIN"), originRouteKey);
       }
       if (props.origin.static) {
-        bundle.addEnv(formatRouteEnvName5(serverRouteKey, "IMAGE_ORIGIN_S3"), "true");
+        bundle.addEnv(formatRouteEnvName4(serverRouteKey, "IMAGE_ORIGIN_S3"), "true");
       }
       ctx.onReady(() => {
         if (props.origin.static) {
@@ -176233,7 +176356,7 @@ var imageFeature = defineFeature({
 
 // src/feature/icon/index.ts
 import { toDays as toDays10 } from "@awsless/duration";
-import { formatRouteEnvName as formatRouteEnvName6 } from "awsless";
+import { formatRouteEnvName as formatRouteEnvName5 } from "awsless";
 import { dirname as dirname17, join as join35 } from "path";
 import { fileURLToPath as fileURLToPath11 } from "url";
 var iconFeature = defineFeature({
@@ -176281,17 +176404,17 @@ var iconFeature = defineFeature({
           }
         }
       });
-      bundle.addEnv(formatRouteEnvName6(serverRouteKey, "ICON_CONFIG"), JSON.stringify({
+      bundle.addEnv(formatRouteEnvName5(serverRouteKey, "ICON_CONFIG"), JSON.stringify({
         preserveIds: props.preserveIds,
         symbols: props.symbols
       }));
-      bundle.addEnv(formatRouteEnvName6(serverRouteKey, "ICON_BUCKET"), bucket.name);
-      bundle.addEnv(formatRouteEnvName6(serverRouteKey, "ICON_FOLDER"), folder);
+      bundle.addEnv(formatRouteEnvName5(serverRouteKey, "ICON_BUCKET"), bucket.name);
+      bundle.addEnv(formatRouteEnvName5(serverRouteKey, "ICON_FOLDER"), folder);
       if (originRouteKey) {
-        bundle.addEnv(formatRouteEnvName6(serverRouteKey, "ICON_ORIGIN"), originRouteKey);
+        bundle.addEnv(formatRouteEnvName5(serverRouteKey, "ICON_ORIGIN"), originRouteKey);
       }
       if (props.origin.static) {
-        bundle.addEnv(formatRouteEnvName6(serverRouteKey, "ICON_ORIGIN_S3"), "true");
+        bundle.addEnv(formatRouteEnvName5(serverRouteKey, "ICON_ORIGIN_S3"), "true");
       }
       ctx.onReady(() => {
         if (props.origin.static) {
@@ -176333,13 +176456,13 @@ var import_deepmerge4 = __toESM(require_cjs2(), 1);
 
 // src/feature/job/build/executable.ts
 import { createHash as createHash21 } from "crypto";
-import { readFile as readFile19, writeFile as writeFile10 } from "fs/promises";
+import { readFile as readFile20, writeFile as writeFile11 } from "fs/promises";
 import { join as join36, resolve as resolve3 } from "path";
 var buildJobExecutable = async (input, outputPath, architecture) => {
   const filePath = join36(outputPath, "program");
   const wrapperPath = join36(outputPath, "wrapper.ts");
   const handlerPath = resolve3(input);
-  await writeFile10(wrapperPath, `import { parse } from '@awsless/json'
+  await writeFile11(wrapperPath, `import { parse } from '@awsless/json'
 import { getObject } from '@awsless/s3'
 import handler from '${handlerPath}'
 
@@ -176388,7 +176511,7 @@ await handler(payload)
 ${result.logs?.map((log) => log.message).join(`
 `)}`);
   }
-  const file2 = await readFile19(filePath);
+  const file2 = await readFile20(filePath);
   return {
     hash: createHash21("sha1").update(file2).update(target2).digest("hex"),
     file: file2
@@ -176841,7 +176964,7 @@ var jobFeature = defineFeature({
 });
 
 // src/feature/instance/index.ts
-import { days as days10, seconds as seconds6, toSeconds as toSeconds11 } from "@awsless/duration";
+import { days as days11, seconds as seconds6, toSeconds as toSeconds11 } from "@awsless/duration";
 
 // src/feature/instance/util.ts
 import { toDays as toDays12, toSeconds as toSeconds10 } from "@awsless/duration";
@@ -177225,7 +177348,7 @@ var instanceFeature = defineFeature({
       const queue2 = new aws3.sqs.Queue(group4, "queue", {
         name: task2.name,
         visibilityTimeoutSeconds: toSeconds11(seconds6(30)),
-        messageRetentionSeconds: toSeconds11(days10(4)),
+        messageRetentionSeconds: toSeconds11(days11(4)),
         maxMessageSize: toBytes(kibibytes(256)),
         receiveWaitTimeSeconds: toSeconds11(seconds6(20))
       });
@@ -177383,7 +177506,7 @@ var metricFeature = defineFeature({
 });
 
 // src/feature/router/index.ts
-import { days as days11, seconds as seconds8, toSeconds as toSeconds14, years } from "@awsless/duration";
+import { days as days12, seconds as seconds8, toSeconds as toSeconds14, years } from "@awsless/duration";
 
 // src/feature/router/router-code.ts
 import { minutes as minutes8, seconds as seconds7, toSeconds as toSeconds13 } from "@awsless/duration";
@@ -177939,8 +178062,8 @@ var routerFeature = defineFeature({
       const cache7 = new aws3.cloudfront.CachePolicy(group4, "cache", {
         name,
         minTtl: toSeconds14(seconds8(0)),
-        maxTtl: toSeconds14(days11(365)),
-        defaultTtl: toSeconds14(days11(0)),
+        maxTtl: toSeconds14(days12(365)),
+        defaultTtl: toSeconds14(days12(0)),
         parametersInCacheKeyAndForwardedToOrigin: {
           enableAcceptEncodingBrotli: true,
           enableAcceptEncodingGzip: true,
@@ -178417,11 +178540,11 @@ var features = [
   routerFeature,
   commandFeature,
   layerFeature,
+  onFailureFeature,
+  onErrorLogFeature,
+  bundleFeature,
   authFeature,
   functionFeature,
-  bundleFeature,
-  onErrorLogFeature,
-  onFailureFeature,
   instanceFeature,
   jobFeature,
   configFeature,
@@ -179226,6 +179349,12 @@ var createApp = (props) => {
       registerDomainZone(zone) {
         domainZones.push(zone);
       },
+      restartOnConfigChange(lambda) {
+        for (const configName of props.appConfig.configs ?? []) {
+          functionsByConfig[configName] ??= [];
+          functionsByConfig[configName].push(lambda);
+        }
+      },
       bind(name, value) {
         binds.push({ name, value });
       },
@@ -179272,7 +179401,7 @@ var createApp = (props) => {
         addWarning(props2) {
           warnings.push(props2);
         },
-        addFunction(lambda) {
+        restartOnConfigChange(lambda) {
           for (const configName of props.appConfig.configs ?? []) {
             functionsByConfig[configName] ??= [];
             functionsByConfig[configName].push(lambda);
@@ -179787,7 +179916,7 @@ import { DynamoDBClient as DynamoDBClient4 } from "@awsless/dynamodb";
 
 // src/cli/ui/complex/run-tests.ts
 var import_wildstring3 = __toESM(require_wildstring(), 1);
-import { mkdir as mkdir6, readFile as readFile20, writeFile as writeFile11 } from "fs/promises";
+import { mkdir as mkdir6, readFile as readFile21, writeFile as writeFile12 } from "fs/promises";
 import { join as join39 } from "path";
 import { parse as parse8, stringify as stringify5 } from "@awsless/json";
 import { generateFolderHash, loadWorkspace as loadWorkspace2 } from "@awsless/ts-file-cache";
@@ -179974,7 +180103,7 @@ var runTest = async (stack, dir, filters, workspace, opts) => {
   if (!process.env.NO_CACHE) {
     const exists2 = await fileExist(file2);
     if (exists2) {
-      const raw = await readFile20(file2, { encoding: "utf8" });
+      const raw = await readFile21(file2, { encoding: "utf8" });
       const data = parse8(raw);
       if (data.fingerprint === fingerprint) {
         logs_exports.step(formatResult({
@@ -180014,7 +180143,7 @@ var runTest = async (stack, dir, filters, workspace, opts) => {
     logTestLogs(result);
   }
   logTestErrors(result);
-  await writeFile11(file2, stringify5({
+  await writeFile12(file2, stringify5({
     ...result,
     fingerprint
   }));
@@ -185710,8 +185839,8 @@ var bind = (program3) => {
       }
       const configList = opts.config ?? [];
       const configs = {};
-      for (const name of configList) {
-        configs[`CONFIG_${constantCase(name)}`] = name;
+      if (configList.length > 0) {
+        configs.CONFIGS = configList.join(",");
       }
       if (configList.length ?? 0 > 0) {
         logs_exports.note("Bind Config", configList.map((v7) => color2.label(constantCase(v7))).join(`
@@ -185793,7 +185922,7 @@ var {
   isIBMi
 } = require_constants7();
 var stat5 = promisify4(fs3.stat);
-var readdir5 = promisify4(fs3.readdir);
+var readdir6 = promisify4(fs3.readdir);
 var arrify = (value = []) => Array.isArray(value) ? value : [value];
 var flatten = (list3, result = []) => {
   list3.forEach((item) => {
@@ -185865,7 +185994,7 @@ class DirEntry {
       return;
     const dir = this.path;
     try {
-      await readdir5(dir);
+      await readdir6(dir);
     } catch (err) {
       if (this._removeWatcher) {
         this._removeWatcher(sysPath.dirname(dir), sysPath.basename(dir));
@@ -186451,7 +186580,7 @@ var watchConfig = async (options, resolve4, reject) => {
 };
 
 // src/type-gen/generate.ts
-import { mkdir as mkdir7, writeFile as writeFile12 } from "fs/promises";
+import { mkdir as mkdir7, writeFile as writeFile13 } from "fs/promises";
 import { dirname as dirname19, join as join40, relative as relative8 } from "path";
 var generateTypes = async (props) => {
   const files = [];
@@ -186466,7 +186595,7 @@ var generateTypes = async (props) => {
             files.push(relative8(directories.root, path2));
           }
           await mkdir7(dirname19(path2), { recursive: true });
-          await writeFile12(path2, code);
+          await writeFile13(path2, code);
         }
       }
     });
@@ -186474,7 +186603,7 @@ var generateTypes = async (props) => {
   if (files.length) {
     const code = files.map((file2) => `/// <reference path='${file2}' />`).join(`
 `);
-    await writeFile12(join40(directories.root, `awsless.d.ts`), code);
+    await writeFile13(join40(directories.root, `awsless.d.ts`), code);
   }
 };