@effortless-aws/cli 0.2.0 → 0.2.2

package/dist/cli/index.js

@@ -1943,56 +1943,36 @@ var ensureFunctionUrl = (functionName) => Effect13.gen(function* () {
     )
   );
   if (existing) {
-    yield* Effect13.logDebug(`Function URL already exists: ${existing.FunctionUrl}`);
+    yield* lambda_exports.make("update_function_url_config", {
+      FunctionName: functionName,
+      AuthType: "NONE"
+    });
     return { functionUrl: existing.FunctionUrl };
   }
   yield* Effect13.logDebug(`Creating Function URL for: ${functionName}`);
   const result = yield* lambda_exports.make("create_function_url_config", {
     FunctionName: functionName,
-    AuthType: "AWS_IAM",
+    AuthType: "NONE",
     InvokeMode: "BUFFERED"
   });
   return { functionUrl: result.FunctionUrl };
 });
-var addCloudFrontPermission = (functionName, distributionArn) => Effect13.gen(function* () {
+var addFunctionUrlPublicAccess = (functionName) => Effect13.gen(function* () {
   const statements = [
-    {
-      statementId: "cloudfront-oac",
-      action: "lambda:InvokeFunctionUrl",
-      authType: "AWS_IAM"
-    },
-    {
-      statementId: "cloudfront-oac-invoke",
-      action: "lambda:InvokeFunction",
-      authType: void 0
-    }
+    { statementId: "function-url-public", action: "lambda:InvokeFunctionUrl", urlAuthType: "NONE" },
+    { statementId: "function-url-invoke", action: "lambda:InvokeFunction", urlAuthType: void 0 }
   ];
   for (const stmt of statements) {
     yield* lambda_exports.make("add_permission", {
       FunctionName: functionName,
       StatementId: stmt.statementId,
       Action: stmt.action,
-      Principal: "cloudfront.amazonaws.com",
-      SourceArn: distributionArn,
-      ...stmt.authType ? { FunctionUrlAuthType: stmt.authType } : {}
+      Principal: "*",
+      ...stmt.urlAuthType ? { FunctionUrlAuthType: stmt.urlAuthType } : {}
     }).pipe(
       Effect13.catchIf(
         (e) => e._tag === "LambdaError" && e.is("ResourceConflictException"),
-        () => Effect13.gen(function* () {
-          yield* Effect13.logDebug(`Permission ${stmt.statementId} exists for ${functionName}, replacing...`);
-          yield* lambda_exports.make("remove_permission", {
-            FunctionName: functionName,
-            StatementId: stmt.statementId
-          });
-          yield* lambda_exports.make("add_permission", {
-            FunctionName: functionName,
-            StatementId: stmt.statementId,
-            Action: stmt.action,
-            Principal: "cloudfront.amazonaws.com",
-            SourceArn: distributionArn,
-            ...stmt.authType ? { FunctionUrlAuthType: stmt.authType } : {}
-          });
-        })
+        () => Effect13.logDebug(`Permission ${stmt.statementId} already exists for ${functionName}`)
       )
     );
   }
@@ -2660,6 +2640,14 @@ var DEV_ONLY_PREFIXES = [
   "@vitest/",
   "@jest/"
 ];
+var extractExportPaths = (value) => {
+  if (typeof value === "string") return [value];
+  if (typeof value === "object" && value !== null) {
+    return Object.values(value).flatMap(extractExportPaths);
+  }
+  return [];
+};
+var isRawTypeScript = (p) => /\.(?:ts|tsx|mts|cts)$/.test(p) && !p.endsWith(".d.ts") && !p.endsWith(".d.mts") && !p.endsWith(".d.cts");
 var checkDependencyWarnings = (projectDir) => Effect18.gen(function* () {
   const pkgPath = path.join(projectDir, "package.json");
   const content = yield* Effect18.tryPromise({
@@ -2684,6 +2672,26 @@ var checkDependencyWarnings = (projectDir) => Effect18.gen(function* () {
       `"dependencies" is empty but "devDependencies" has ${devDeps.length} package(s). Runtime packages must be in "dependencies" to be included in the Lambda layer.`
     );
   }
+  for (const dep of deps) {
+    const depPath = getPackageRealPath(projectDir, dep);
+    if (!depPath) continue;
+    const depPkgPath = path.join(depPath, "package.json");
+    if (!fsSync.existsSync(depPkgPath)) continue;
+    try {
+      const depPkg = JSON.parse(fsSync.readFileSync(depPkgPath, "utf-8"));
+      const entryPoints = [];
+      if (typeof depPkg.main === "string") entryPoints.push(depPkg.main);
+      if (typeof depPkg.module === "string") entryPoints.push(depPkg.module);
+      entryPoints.push(...extractExportPaths(depPkg.exports));
+      const tsEntries = [...new Set(entryPoints.filter(isRawTypeScript))];
+      if (tsEntries.length > 0) {
+        warnings.push(
+          `Package "${dep}" has TypeScript entry points (${tsEntries.join(", ")}) that will fail at runtime in node_modules (ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING). Move it to "devDependencies" so esbuild can bundle and transpile it.`
+        );
+      }
+    } catch {
+    }
+  }
   return warnings;
 });
 var getPackageRealPath = (projectDir, pkgName) => {
@@ -3258,6 +3266,16 @@ var CACHING_OPTIMIZED_POLICY_ID = "658327ea-f89d-4fab-a63d-7e88639e58f6";
 var CACHING_DISABLED_POLICY_ID = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad";
 var ALL_VIEWER_EXCEPT_HOST_HEADER_POLICY_ID = "b689b0a8-53d0-40ab-baf2-68738e2966ac";
 var SECURITY_HEADERS_POLICY_ID = "67f7725c-6f97-4210-82d7-5512b31e9d03";
+var expandRoutePatterns = (patterns) => {
+  const expanded = /* @__PURE__ */ new Set();
+  for (const p of patterns) {
+    expanded.add(p);
+    if (p.endsWith("/*")) {
+      expanded.add(p.slice(0, -2));
+    }
+  }
+  return [...expanded];
+};
 var ensureOAC = (input) => Effect21.gen(function* () {
   const { name, originType = "s3" } = input;
   const result = yield* cloudfront_exports.make("list_origin_access_controls", {});
@@ -3368,7 +3386,8 @@ var ensureDistribution = (input) => Effect21.gen(function* () {
   const comment = makeDistComment(project, stage, handlerName);
   const s3OriginId = `S3-${bucketName}`;
   const s3OriginDomain = `${bucketName}.s3.${bucketRegion}.amazonaws.com`;
-  const hasApiRoutes = apiOriginDomain && routePatterns && routePatterns.length > 0;
+  const expandedRoutePatterns = routePatterns ? expandRoutePatterns(routePatterns) : void 0;
+  const hasApiRoutes = apiOriginDomain && expandedRoutePatterns && expandedRoutePatterns.length > 0;
   const apiOriginId = hasApiRoutes ? `API-${project}-${stage}` : void 0;
   const originsItems = [
     {
@@ -3399,8 +3418,8 @@ var ensureDistribution = (input) => Effect21.gen(function* () {
   const API_METHODS = ["GET", "HEAD", "OPTIONS", "PUT", "POST", "PATCH", "DELETE"];
   const CACHED_METHODS = ["GET", "HEAD"];
   const cacheBehaviors = hasApiRoutes ? {
-    Quantity: routePatterns.length,
-    Items: routePatterns.map((pattern) => ({
+    Quantity: expandedRoutePatterns.length,
+    Items: expandedRoutePatterns.map((pattern) => ({
       PathPattern: pattern,
       TargetOriginId: apiOriginId,
       ViewerProtocolPolicy: "redirect-to-https",
@@ -3468,7 +3487,7 @@ var ensureDistribution = (input) => Effect21.gen(function* () {
     const currentLambdaEdgeArn = currentConfig.DefaultCacheBehavior?.LambdaFunctionAssociations?.Items?.[0]?.LambdaFunctionARN;
     const originsMatch = (currentConfig.Origins?.Quantity ?? 0) === originsItems.length;
     const currentBehaviorPatterns = (currentConfig.CacheBehaviors?.Items ?? []).map((b) => b.PathPattern).sort();
-    const desiredBehaviorPatterns = (routePatterns ?? []).slice().sort();
+    const desiredBehaviorPatterns = (expandedRoutePatterns ?? []).slice().sort();
     const behaviorsMatch = currentBehaviorPatterns.length === desiredBehaviorPatterns.length && desiredBehaviorPatterns.every((p, i) => currentBehaviorPatterns[i] === p);
     const apiOriginMatch = !hasApiRoutes || currentConfig.Origins?.Items?.some((o) => o.DomainName === apiOriginDomain);
     const needsUpdate = currentOrigin?.DomainName !== s3OriginDomain || currentOrigin?.OriginAccessControlId !== oacId || currentConfig.DefaultRootObject !== index || currentConfig.DefaultCacheBehavior?.CachePolicyId !== CACHING_OPTIMIZED_POLICY_ID || currentConfig.DefaultCacheBehavior?.ResponseHeadersPolicyId !== SECURITY_HEADERS_POLICY_ID || (currentConfig.CustomErrorResponses?.Quantity ?? 0) !== customErrorResponses.Quantity || (currentConfig.DefaultCacheBehavior?.FunctionAssociations?.Quantity ?? 0) !== functionAssociations.Quantity || currentConfig.DefaultCacheBehavior?.FunctionAssociations?.Items?.[0]?.FunctionARN !== (urlRewriteFunctionArn ?? void 0) || (currentConfig.DefaultCacheBehavior?.LambdaFunctionAssociations?.Quantity ?? 0) !== lambdaFunctionAssociations.Quantity || currentLambdaEdgeArn !== (lambdaEdgeArn ?? void 0) || !aliasesMatch || !certMatch || !originsMatch || !behaviorsMatch || !apiOriginMatch;
@@ -3588,7 +3607,7 @@ var ensureDistribution = (input) => Effect21.gen(function* () {
   };
 });
 var ensureSsrDistribution = (input) => Effect21.gen(function* () {
-  const { project, stage, handlerName, bucketName, bucketRegion, s3OacId, lambdaOriginDomain, lambdaOacId, assetPatterns, tags, aliases, acmCertificateArn, apiOriginDomain, routePatterns } = input;
+  const { project, stage, handlerName, bucketName, bucketRegion, s3OacId, lambdaOriginDomain, assetPatterns, tags, aliases, acmCertificateArn, apiOriginDomain, routePatterns } = input;
   const comment = makeDistComment(project, stage, handlerName);
   const lambdaOriginId = `Lambda-${project}-${stage}-${handlerName}`;
   const s3OriginId = `S3-${bucketName}`;
@@ -3601,14 +3620,14 @@ var ensureSsrDistribution = (input) => Effect21.gen(function* () {
   } : void 0;
   const ALL_METHODS = ["GET", "HEAD", "OPTIONS", "PUT", "POST", "PATCH", "DELETE"];
   const CACHED_METHODS = ["GET", "HEAD"];
-  const hasApiRoutes = apiOriginDomain && routePatterns && routePatterns.length > 0;
+  const expandedRoutePatterns = routePatterns ? expandRoutePatterns(routePatterns) : void 0;
+  const hasApiRoutes = apiOriginDomain && expandedRoutePatterns && expandedRoutePatterns.length > 0;
   const apiOriginId = hasApiRoutes ? `API-${project}-${stage}` : void 0;
   const originsItems = [
     {
       Id: lambdaOriginId,
       DomainName: lambdaOriginDomain,
       OriginPath: "",
-      OriginAccessControlId: lambdaOacId,
       CustomOriginConfig: {
         HTTPPort: 80,
         HTTPSPort: 443,
@@ -3661,7 +3680,7 @@ var ensureSsrDistribution = (input) => Effect21.gen(function* () {
     LambdaFunctionAssociations: { Quantity: 0, Items: [] },
     FieldLevelEncryptionId: ""
   };
-  const apiRouteBehaviors = hasApiRoutes ? routePatterns.map((pattern) => ({
+  const apiRouteBehaviors = hasApiRoutes ? expandedRoutePatterns.map((pattern) => ({
     PathPattern: pattern,
     TargetOriginId: apiOriginId,
     ViewerProtocolPolicy: "redirect-to-https",
@@ -4969,8 +4988,6 @@ var deployApp = (input) => Effect29.gen(function* () {
   });
   const s3OacName = `${project}-${stage}-oac`;
   const { oacId: s3OacId } = yield* ensureOAC({ name: s3OacName, originType: "s3" });
-  const lambdaOacName = `${project}-${stage}-lambda-oac`;
-  const { oacId: lambdaOacId } = yield* ensureOAC({ name: lambdaOacName, originType: "lambda" });
   const assetsDir = path5.resolve(projectDir, config.assets);
   const assetPatterns = detectAssetPatterns(assetsDir);
   yield* Effect29.logDebug(`Detected ${assetPatterns.length} asset pattern(s): ${assetPatterns.join(", ")}`);
@@ -4990,14 +5007,13 @@ var deployApp = (input) => Effect29.gen(function* () {
     bucketRegion: region,
     s3OacId,
     lambdaOriginDomain,
-    lambdaOacId,
     assetPatterns,
     tags: makeTags(tagCtx, "cloudfront-distribution"),
     aliases,
     acmCertificateArn,
     ...input.apiOriginDomain && routePatterns.length > 0 ? { apiOriginDomain: input.apiOriginDomain, routePatterns } : {}
   });
-  yield* addCloudFrontPermission(lambdaName, distributionArn);
+  yield* addFunctionUrlPublicAccess(lambdaName);
   yield* putBucketPolicyForOAC(bucketName, distributionArn);
   yield* syncFiles({ bucketName, sourceDir: assetsDir });
   yield* invalidateDistribution(distributionId);
@@ -5540,6 +5556,31 @@ var buildBucketNameMap = (bucketHandlers, project, stage) => {
   }
   return map;
 };
+var validateDeps = (discovered, tableNameMap, bucketNameMap, mailerDomainMap) => {
+  const errors = [];
+  const allGroups = [
+    ...discovered.httpHandlers,
+    ...discovered.apiHandlers,
+    ...discovered.tableHandlers,
+    ...discovered.fifoQueueHandlers,
+    ...discovered.bucketHandlers,
+    ...discovered.staticSiteHandlers,
+    ...discovered.appHandlers,
+    ...discovered.mailerHandlers
+  ];
+  for (const { exports } of allGroups) {
+    for (const fn13 of exports) {
+      for (const key of fn13.depsKeys) {
+        if (!tableNameMap.has(key) && !bucketNameMap.has(key) && !mailerDomainMap.has(key)) {
+          errors.push(
+            `Handler "${fn13.exportName}" depends on "${key}", but no matching table, bucket, or mailer handler was found. Make sure it is exported.`
+          );
+        }
+      }
+    }
+  }
+  return errors;
+};
 var resolveDeps = (depsKeys, tableNameMap, bucketNameMap, mailerDomainMap) => {
   if (depsKeys.length === 0) return void 0;
   const depsEnv = {};
@@ -5890,6 +5931,14 @@ var deployProject = (input) => Effect35.gen(function* () {
   const tableNameMap = buildTableNameMap(tableHandlers, input.project, stage);
   const bucketNameMap = buildBucketNameMap(bucketHandlers, input.project, stage);
   const mailerDomainMap = buildMailerDomainMap(mailerHandlers);
+  const depsErrors = validateDeps(discovered, tableNameMap, bucketNameMap, mailerDomainMap);
+  if (depsErrors.length > 0) {
+    yield* Console2.log("");
+    for (const err of depsErrors) {
+      yield* Console2.log(`  ${c.red("\u2717")} ${err}`);
+    }
+    return yield* Effect35.fail(new Error("Unresolved deps \u2014 aborting deploy"));
+  }
   const { layerArn, layerVersion, layerStatus, external } = yield* prepareLayer({
     project: input.project,
     stage,
@@ -6525,6 +6574,15 @@ API: ${c.cyan(apiUrl)}`);
       if (counts.orphaned > 0) parts.push(c.red(`${counts.orphaned} orphaned`));
       yield* Console4.log(`
 Total: ${parts.join(", ")}`);
+      const depWarnings = yield* checkDependencyWarnings(projectDir).pipe(
+        Effect39.catchAll(() => Effect39.succeed([]))
+      );
+      if (depWarnings.length > 0) {
+        yield* Console4.log("");
+        for (const w of depWarnings) {
+          yield* Console4.log(c.yellow(`  \u26A0 ${w}`));
+        }
+      }
     }).pipe(
       Effect39.provide(clientsLayer),
       Logger2.withMinimumLogLevel(logLevel)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@effortless-aws/cli",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "license": "MIT",
   "type": "module",
   "description": "CLI and deploy tooling for effortless-aws",