@davidwells/llrt-analyzer 0.1.0 → 0.1.1

package/data/known-quirks.0.8.1-beta.json

@@ -22,6 +22,16 @@
       "fix": "Use a pure-JS constant-time compare (XOR-accumulate over two equal-length buffers, length-check first) instead of timingSafeEqual.",
       "tracking": "https://github.com/honojs/hono/issues/3914"
     },
+    {
+      "id": "buffer-base64url-encoding",
+      "signature": "[\"']base64url[\"']",
+      "files": "firstParty",
+      "severity": "blocker",
+      "api": "Buffer 'base64url' encoding",
+      "note": "LLRT 0.8.x does not support the 'base64url' Buffer encoding — Buffer.from(x,'base64url') and Buffer#toString('base64url') throw 'The \"base64url\" encoding is not supported'. Pervasive in JWS/JWT parsing (e.g. verifying a Netlify x-nf-sign header), PKCE, and opaque-token generation, so a single use can 403 every request. Verified on real Lambda: it broke the mcp-gateway proxy assertion check.",
+      "fix": "LLRT supports standard 'base64'. Encode: toString('base64') then .replace(/\\+/g,'-').replace(/\\//g,'_').replace(/=+$/,''). Decode: restore (-_ -> +/), re-pad to length%4, then Buffer.from(x,'base64'). Wrap in a small base64url helper and swap the call sites.",
+      "tracking": "https://github.com/awslabs/llrt/issues"
+    },
     {
       "id": "response-body-rewrap",
       "signature": "new\\s+Response\\s*\\([^)]{0,80}\\.body\\b",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davidwells/llrt-analyzer",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Per-function analyzer that decides (statically + by actually running under LLRT) whether a Lambda function can switch to AWS LLRT for ~10x faster cold starts, and helps flip it.",
   "main": "src/index.js",
   "bin": {

package/src/cli.js

@@ -36,6 +36,7 @@ function parseArgs(argv) {
     else if (a === '--region') args.flags.region = argv[(i += 1)]
     else if (a === '--profile') args.flags.profile = argv[(i += 1)]
     else if (a === '--layer-name') args.flags.layerName = argv[(i += 1)]
+    else if (a === '--sdk') args.flags.sdk = argv[(i += 1)]
     else if (a === '--ssm') args.flags.ssm = argv[(i += 1)]
     else if (a === '--stage') args.flags.stage = argv[(i += 1)]
     else args._.push(a)
@@ -61,6 +62,8 @@ Analyze options:
 
 publish-layer options:
   --arch <arm64|x64>   Layer architecture (default arm64).
+  --sdk <full-sdk|no-sdk>  SDK bundle variant (default std). Use full-sdk if the
+                       function imports a client outside LLRT's std bundle.
   --region <region>    AWS region (default us-east-1).
   --profile <name>     AWS profile.
   --layer-name <name>  Layer name (default llrt-<arch>).
@@ -178,8 +181,11 @@ async function cmdPublishLayer(flags) {
   const arch = flags.arch === 'x64' ? 'x64' : 'arm64'
   const region = flags.region || 'us-east-1'
   const version = ORG_PINNED_LLRT_VERSION
-  const layerName = flags.layerName || `llrt-${arch}`
-  const asset = `llrt-lambda-${arch}.zip`
+  // SDK variant: 'std' (default), 'full-sdk' (all @aws-sdk clients), 'no-sdk'.
+  // Use full-sdk if the function imports a client outside LLRT's std bundle.
+  const sdkSuffix = flags.sdk === 'full-sdk' ? '-full-sdk' : flags.sdk === 'no-sdk' ? '-no-sdk' : ''
+  const layerName = flags.layerName || `llrt-${arch}${sdkSuffix}`
+  const asset = `llrt-lambda-${arch}${sdkSuffix}.zip`
   const url = `https://github.com/awslabs/llrt/releases/download/v${version}/${asset}`
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'llrt-layer-'))
   const zip = path.join(tmp, asset)