@intelligems/sst 2.49.6-ig.8 → 2.49.6-ig.9

package/iot.js

@@ -22,6 +22,59 @@ import { useBus } from "./bus.js";
 import { useProject } from "./project.js";
 import { useBootstrap } from "./bootstrap.js";
 import { PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
+/**
+ * Re-sign the next reconnect with credentials that are still alive.
+ *
+ * The device is built with resolved credential *values*, because
+ * `aws-iot-device-sdk` takes strings rather than a provider. It keeps them in
+ * closure variables and re-signs the WebSocket URL from those on every
+ * reconnect, and nothing ever writes to them again except this call. So once
+ * the session expires, every retry presents a dead `sessionToken`, AWS IoT
+ * rejects the upgrade, and the socket closes again — forever.
+ *
+ * Measured on one machine: the connection dropped routinely five times in the
+ * first fifteen minutes and recovered each time; an hour later the credentials
+ * expired, and the next drop began **93 consecutive failed reconnects over five
+ * hours**, none of which emitted an `error` event. Nothing in the CLI said
+ * anything, and every request through the Live Lambda bridge 504'd.
+ *
+ * Every other AWS call in the process is unaffected, because `useAWSClient`
+ * passes the *provider* and the SDK calls it per request. This is the one path
+ * that holds values, so it is the one path that needs telling.
+ *
+ * **Why `close` and not `reconnect`.** The signing is synchronous and this
+ * refresh is not, so the two race. `emit("reconnect")` runs its handlers and
+ * returns — it does not await them — and `_setupStream()` signs on the next
+ * line, from whatever the variables hold at that instant. A refresh started
+ * there always loses. `close` fires one backoff interval earlier (the SDK
+ * manages its own, from `baseReconnectTimeMs` of 1s up to 128s, ignoring the
+ * `reconnectPeriod` passed in), which is ample for the resolve to land before
+ * the next attempt signs.
+ *
+ * So this wins the race by margin, not by construction. Two things bound it:
+ * `close` fires on **every** failed reconnect, not once per outage, so the
+ * values can never be more than one backoff interval stale; and the retry loop
+ * is unconditional. Making it airtight would mean keeping the stored
+ * credentials warm so the synchronous path can never read a stale one — a
+ * timer, which is machinery duplicating what the memoized provider already
+ * does. Measured recovery is five seconds, so that is not worth it yet.
+ *
+ * The provider only reaches the network within five minutes of expiry, so this
+ * is an in-memory read on most drops and one real refresh per session.
+ */
+async function refreshWebSocketCredentials(device, label) {
+    try {
+        const fresh = await useAWSCredentials();
+        // The typings mark `expiration` as required, but the implementation only
+        // assigns the three credential strings and never reads it — so this passes
+        // what the provider gave rather than inventing a date to satisfy a
+        // parameter nothing uses.
+        device.updateWebSocketCredentials(fresh.accessKeyId, fresh.secretAccessKey, fresh.sessionToken, fresh.expiration);
+    }
+    catch (err) {
+        Logger.debug(`${label} credential refresh failed`, err);
+    }
+}
 export const useIOT = lazy(async () => {
     const bus = useBus();
     const endpoint = await useIOTEndpoint();
@@ -116,6 +169,7 @@ export const useIOT = lazy(async () => {
     });
     device.on("close", () => {
         Logger.debug("IoT closed");
+        void refreshWebSocketCredentials(device, "IoT");
     });
     device.on("reconnect", () => {
         Logger.debug("IoT reconnecting...");
@@ -241,6 +295,7 @@ export const useIOTControl = lazy(async () => {
     });
     device.on("close", () => {
         Logger.debug("IoT control closed");
+        void refreshWebSocketCredentials(device, "IoT control");
     });
     device.on("reconnect", () => {
         Logger.debug("IoT control reconnecting...");

package/package.json

@@ -1,7 +1,7 @@
 {
   "sideEffects": false,
   "name": "@intelligems/sst",
-  "version": "2.49.6-ig.8",
+  "version": "2.49.6-ig.9",
   "bin": {
     "sst": "cli/sst.js"
   },

package/package.json.bak

@@ -0,0 +1,156 @@
+{
+  "publishConfig": {
+    "directory": "dist",
+    "access": "public"
+  },
+  "sideEffects": false,
+  "name": "@intelligems/sst",
+  "version": "2.49.6-ig.9",
+  "bin": {
+    "sst": "cli/sst.js"
+  },
+  "description": "A CLI to help deploy SST apps.",
+  "type": "module",
+  "license": "MIT",
+  "scripts": {
+    "prepare": "",
+    "build": "node build.mjs && tsc",
+    "test": "vitest run",
+    "dev": "source .env && tsc-watch --onSuccess \"rsync -av dist/* ${TO} --checksum\""
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/sst/v2.git",
+    "directory": "packages/cli"
+  },
+  "exports": {
+    "./constructs/deprecated": "./constructs/deprecated/index.js",
+    "./constructs/future": "./constructs/future/index.js",
+    "./constructs": "./constructs/index.js",
+    "./context": "./context/index.js",
+    "./node/future/*": "./node/future/*/index.js",
+    "./node/*": "./node/*/index.js",
+    ".": "./index.js",
+    "./*": "./*"
+  },
+  "homepage": "https://sst.dev",
+  "dependencies": {
+    "@aws-cdk/aws-lambda-python-alpha": "2.201.0-alpha.0",
+    "@aws-cdk/cloud-assembly-schema": "44.5.0",
+    "@aws-cdk/cloudformation-diff": "2.182.0",
+    "@aws-cdk/cx-api": "2.201.0",
+    "@aws-cdk/toolkit-lib": "1.1.1",
+    "@aws-crypto/sha256-js": "^5.2.0",
+    "@aws-sdk/client-cloudformation": "3.699.0",
+    "@aws-sdk/client-ecs": "3.699.0",
+    "@aws-sdk/client-eventbridge": "3.699.0",
+    "@aws-sdk/client-iam": "3.699.0",
+    "@aws-sdk/client-iot": "3.699.0",
+    "@aws-sdk/client-iot-data-plane": "3.699.0",
+    "@aws-sdk/client-lambda": "3.699.0",
+    "@aws-sdk/client-rds-data": "3.699.0",
+    "@aws-sdk/client-s3": "3.699.0",
+    "@aws-sdk/client-ssm": "3.699.0",
+    "@aws-sdk/client-sts": "3.699.0",
+    "@aws-sdk/config-resolver": "3.374.0",
+    "@aws-sdk/credential-providers": "3.699.0",
+    "@aws-sdk/middleware-retry": "3.374.0",
+    "@aws-sdk/middleware-signing": "3.451.0",
+    "@aws-sdk/signature-v4-crt": "3.451.0",
+    "@aws-sdk/smithy-client": "3.374.0",
+    "@babel/core": "^7.0.0-0",
+    "@babel/generator": "^7.20.5",
+    "@babel/plugin-syntax-typescript": "^7.21.4",
+    "@smithy/signature-v4": "2.0.16",
+    "@trpc/server": "9.18.0",
+    "adm-zip": "0.5.14",
+    "aws-cdk-lib": "2.201.0",
+    "aws-iot-device-sdk": "^2.2.13",
+    "aws-sdk": "^2.1501.0",
+    "builtin-modules": "3.2.0",
+    "cdk-assets": "3.3.1",
+    "chalk": "^5.2.0",
+    "chokidar": "^3.5.3",
+    "ci-info": "^3.7.0",
+    "colorette": "^2.0.19",
+    "conf": "^10.2.0",
+    "constructs": "10.3.0",
+    "cross-spawn": "^7.0.3",
+    "dendriform-immer-patch-optimiser": "^2.1.0",
+    "dotenv": "^16.0.3",
+    "esbuild": "0.18.13",
+    "express": "^4.18.2",
+    "fast-jwt": "^5.0.5",
+    "get-port": "^6.1.2",
+    "glob": "^10.0.0",
+    "graphql": "*",
+    "graphql-yoga": "^3.9.0",
+    "immer": "9",
+    "ink": "^4.0.0",
+    "ink-spinner": "^5.0.0",
+    "kysely": "^0.25.0",
+    "kysely-codegen": "^0.10.1",
+    "kysely-data-api": "^0.2.1",
+    "minimatch": "^6.1.6",
+    "openid-client": "^5.1.8",
+    "ora": "^6.1.2",
+    "react": "^18.0.0",
+    "remeda": "^1.3.0",
+    "tree-kill": "^1.2.2",
+    "undici": "^5.12.0",
+    "uuid": "^9.0.0",
+    "ws": "^8.11.0",
+    "yargs": "^17.6.2",
+    "zod": "^3.21.4"
+  },
+  "devDependencies": {
+    "dotenv-cli": "^8.0.0",
+    "@aws-sdk/client-api-gateway": "3.699.0",
+    "@aws-sdk/client-cloudfront": "3.699.0",
+    "@aws-sdk/client-codebuild": "3.699.0",
+    "@aws-sdk/client-sqs": "3.699.0",
+    "@aws-sdk/types": "3.451.0",
+    "@graphql-tools/merge": "^8.3.16",
+    "@sls-next/lambda-at-edge": "^3.7.0",
+    "@smithy/types": "4.1.0",
+    "@tsconfig/node16": "^1.0.3",
+    "@tsconfig/node18": "^18.2.2",
+    "@types/adm-zip": "^0.5.0",
+    "@types/async": "^3.2.24",
+    "@types/aws-iot-device-sdk": "^2.2.8",
+    "@types/aws-lambda": "^8.10.128",
+    "@types/babel__core": "^7.1.20",
+    "@types/babel__generator": "^7.6.4",
+    "@types/cross-spawn": "^6.0.2",
+    "@types/express": "^4.17.14",
+    "@types/node": "22.13.14",
+    "@types/react": "^18.0.28",
+    "@types/uuid": "^8.3.4",
+    "@types/ws": "8.5.3",
+    "@types/yargs": "^17.0.13",
+    "archiver": "^5.3.1",
+    "astro-sst": "2.45.1",
+    "async": "^3.2.4",
+    "tsx": "^3.12.1",
+    "typescript": "5.2.2",
+    "vitest": "^0.33.0",
+    "tsc-watch": "^6.2.1"
+  },
+  "peerDependencies": {
+    "@sls-next/lambda-at-edge": "^3.7.0"
+  },
+  "peerDependenciesMeta": {
+    "@sls-next/lambda-at-edge": {
+      "optional": true
+    }
+  },
+  "bugs": {
+    "url": "https://github.com/sst/v2/issues"
+  },
+  "main": "index.js",
+  "directories": {
+    "test": "test"
+  },
+  "keywords": [],
+  "author": ""
+}

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2020 SST
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.