@learncard/learn-cloud-service 2.5.35 → 2.5.37

package/esbuildPlugins.cjs

@@ -41,6 +41,7 @@ module.exports = [
     forceCjsSodiumWrapperPlugin,
     copyDidkitWasmPlugin,
     sentryEsbuildPlugin({
+        telemetry: process.env.SENTRY_BUILD_TELEMETRY !== 'false',
         authToken: process.env.SENTRY_AUTH_TOKEN,
         org: process.env.SENTRY_ORG,
         project: process.env.SENTRY_PROJECT,

package/lambda.ts

@@ -1,163 +1,32 @@
-import serverlessHttp from 'serverless-http';
-import type { Context, APIGatewayProxyResultV2, APIGatewayProxyEventV2 } from 'aws-lambda';
-import { awsLambdaRequestHandler } from '@trpc/server/adapters/aws-lambda';
-import * as Sentry from '@sentry/serverless';
-import Fastify, { type FastifyInstance } from 'fastify';
+import { bootstrapLambda } from '@learncard/service-config';
 
-import app from './src/openapi';
-import { appRouter, createContext } from './src/app';
-import { createOpenApiAwsLambdaHandler } from './src/helpers/shim';
-import {
-    handleTrpcError,
-    sentryBeforeSend,
-    getTracesSampleRate,
-} from './src/helpers/sentry.helpers';
-import { environment } from './src/config/environment';
-import { toServerlessApplication } from './src/helpers/serverlessApplication';
-import {
-    assertShareContentEnvironmentConfiguration,
-    createShareContentRuntimeFromEnvironment,
-    registerShareContentRoutes,
-} from './src/share-content';
+import { base, stages } from './src/config/stageConfig';
 
-Sentry.AWSLambda.init({
-    dsn: environment.SENTRY_DSN,
-    environment: environment.SENTRY_ENV,
-    enabled: Boolean(environment.SENTRY_DSN),
-    tracesSampleRate: getTracesSampleRate(),
-    beforeSend: sentryBeforeSend,
-    integrations: [
-        new Sentry.Integrations.Console(),
-        new Sentry.Integrations.Http({ tracing: true }),
-        new Sentry.Integrations.ContextLines(),
-        new Sentry.Integrations.Mongo(),
-    ],
-});
-
-// Fail the cold start on an enabled-but-invalid LC-2187 share-content
-// configuration; a disabled configuration is a no-op.
-assertShareContentEnvironmentConfiguration();
-
-let shareContentProxyPromise: Promise<ReturnType<typeof serverlessHttp> | null> | null = null;
-
-/**
- * Lazy per-container boot for the LC-2187 service routes. Resolving the runtime
- * awaits repository index initialization and opens Redis only when enabled, so a
- * disabled deployment installs nothing and returns 404 for every internal path.
- */
-const getShareContentProxy = async (): Promise<ReturnType<typeof serverlessHttp> | null> => {
-    if (!shareContentProxyPromise) {
-        shareContentProxyPromise = (async () => {
-            const runtime = await createShareContentRuntimeFromEnvironment();
-
-            if (!runtime.enabled) return null;
-
-            const shareContentApp: FastifyInstance = Fastify({ maxParamLength: 5000 });
-            await registerShareContentRoutes(shareContentApp, runtime);
-            await shareContentApp.ready();
-
-            return serverlessHttp(toServerlessApplication(shareContentApp.server));
-        })();
-    }
-
-    return shareContentProxyPromise;
-};
-
-export const shareContentHandler = async (
-    event: APIGatewayProxyEventV2,
-    context: Context
-): Promise<APIGatewayProxyResultV2> => {
-    let proxy: ReturnType<typeof serverlessHttp> | null;
-
-    try {
-        proxy = await getShareContentProxy();
-    } catch {
-        // Never return a raw boot error. Allow a later invocation to retry.
-        shareContentProxyPromise = null;
-
-        return {
-            statusCode: 503,
-            headers: { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' },
-            body: JSON.stringify({ ok: false, error: 'UNAVAILABLE' }),
-        };
-    }
-
-    if (!proxy) {
-        return { statusCode: 404, headers: { 'Cache-Control': 'no-store' }, body: '' };
-    }
-
-    return proxy(event, context);
-};
-
-export const swaggerUiHandler = serverlessHttp(toServerlessApplication(app), {
-    basePath: '/docs',
-});
-
-export const _openApiHandler = createOpenApiAwsLambdaHandler({
-    router: appRouter,
-    responseMeta: () => {
-        return {
-            headers: {
-                'Access-Control-Allow-Origin': '*',
-                'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
-                'Access-Control-Allow-Headers': 'Authorization, Content-Type',
-            },
-        };
-    },
-    createContext,
-    onError: handleTrpcError,
-});
+type LambdaApp = typeof import('./lambdaApp');
 
-export const _trpcHandler = awsLambdaRequestHandler({
-    allowMethodOverride: true,
-    router: appRouter,
-    createContext,
-    onError: handleTrpcError,
-    responseMeta: () => {
-        return {
-            headers: {
-                'Access-Control-Allow-Origin': '*',
-                'Access-Control-Allow-Methods': '*',
-                'Access-Control-Allow-Headers': 'authorization',
-            },
-        };
-    },
+const getApplication = bootstrapLambda<LambdaApp>({
+    base,
+    stages,
+    stage: process.env.AWS_LAMBDA_FUNCTION_NAME
+        ? process.env.LAMBDA_STAGE
+        : process.env.CONFIG_STAGE,
+    importApp: () => import('./lambdaApp'),
 });
 
-export const openApiHandler = Sentry.AWSLambda.wrapHandler(
-    async (event: APIGatewayProxyEventV2, context: Context): Promise<APIGatewayProxyResultV2> => {
-        if (event.requestContext.http.method === 'OPTIONS') {
-            return {
-                statusCode: 200,
-                headers: {
-                    'Access-Control-Allow-Origin': '*',
-                    'Access-Control-Allow-Headers': '*',
-                    'Access-Control-Allow-Methods': '*',
-                },
-            };
-        }
+export const trpcHandler = async (...args: Parameters<LambdaApp['trpcHandler']>) =>
+    (await getApplication()).trpcHandler(...args);
 
-        context.callbackWaitsForEmptyEventLoop = false;
+export const openApiHandler = async (...args: Parameters<LambdaApp['openApiHandler']>) =>
+    (await getApplication()).openApiHandler(...args);
 
-        return _openApiHandler(event, context);
-    }
-);
+export const _trpcHandler = async (...args: Parameters<LambdaApp['_trpcHandler']>) =>
+    (await getApplication())._trpcHandler(...args);
 
-export const trpcHandler = Sentry.AWSLambda.wrapHandler(
-    async (event: APIGatewayProxyEventV2, context: Context): Promise<APIGatewayProxyResultV2> => {
-        if (event.requestContext.http.method === 'OPTIONS') {
-            return {
-                statusCode: 200,
-                headers: {
-                    'Access-Control-Allow-Origin': '*',
-                    'Access-Control-Allow-Headers': '*',
-                    'Access-Control-Allow-Methods': '*',
-                },
-            };
-        }
+export const _openApiHandler = async (...args: Parameters<LambdaApp['_openApiHandler']>) =>
+    (await getApplication())._openApiHandler(...args);
 
-        context.callbackWaitsForEmptyEventLoop = false;
+export const shareContentHandler = async (...args: Parameters<LambdaApp['shareContentHandler']>) =>
+    (await getApplication()).shareContentHandler(...args);
 
-        return _trpcHandler(event, context);
-    }
-);
+export const swaggerUiHandler = async (...args: Parameters<LambdaApp['swaggerUiHandler']>) =>
+    (await getApplication()).swaggerUiHandler(...args);

package/lambdaApp.ts

@@ -0,0 +1,163 @@
+import serverlessHttp from 'serverless-http';
+import type { Context, APIGatewayProxyResultV2, APIGatewayProxyEventV2 } from 'aws-lambda';
+import { awsLambdaRequestHandler } from '@trpc/server/adapters/aws-lambda';
+import * as Sentry from '@sentry/serverless';
+import Fastify, { type FastifyInstance } from 'fastify';
+
+import app from './src/openapi';
+import { appRouter, createContext } from './src/app';
+import { createOpenApiAwsLambdaHandler } from './src/helpers/shim';
+import {
+    handleTrpcError,
+    sentryBeforeSend,
+    getTracesSampleRate,
+} from './src/helpers/sentry.helpers';
+import { environment } from './src/config/environment';
+import { toServerlessApplication } from './src/helpers/serverlessApplication';
+import {
+    assertShareContentEnvironmentConfiguration,
+    createShareContentRuntimeFromEnvironment,
+    registerShareContentRoutes,
+} from './src/share-content';
+
+Sentry.AWSLambda.init({
+    dsn: environment.SENTRY_DSN,
+    environment: environment.SENTRY_ENV,
+    enabled: Boolean(environment.SENTRY_DSN),
+    tracesSampleRate: getTracesSampleRate(),
+    beforeSend: sentryBeforeSend,
+    integrations: [
+        new Sentry.Integrations.Console(),
+        new Sentry.Integrations.Http({ tracing: true }),
+        new Sentry.Integrations.ContextLines(),
+        new Sentry.Integrations.Mongo(),
+    ],
+});
+
+// Fail the cold start on an enabled-but-invalid LC-2187 share-content
+// configuration; a disabled configuration is a no-op.
+assertShareContentEnvironmentConfiguration();
+
+let shareContentProxyPromise: Promise<ReturnType<typeof serverlessHttp> | null> | null = null;
+
+/**
+ * Lazy per-container boot for the LC-2187 service routes. Resolving the runtime
+ * awaits repository index initialization and opens Redis only when enabled, so a
+ * disabled deployment installs nothing and returns 404 for every internal path.
+ */
+const getShareContentProxy = async (): Promise<ReturnType<typeof serverlessHttp> | null> => {
+    if (!shareContentProxyPromise) {
+        shareContentProxyPromise = (async () => {
+            const runtime = await createShareContentRuntimeFromEnvironment();
+
+            if (!runtime.enabled) return null;
+
+            const shareContentApp: FastifyInstance = Fastify({ maxParamLength: 5000 });
+            await registerShareContentRoutes(shareContentApp, runtime);
+            await shareContentApp.ready();
+
+            return serverlessHttp(toServerlessApplication(shareContentApp.server));
+        })();
+    }
+
+    return shareContentProxyPromise;
+};
+
+export const shareContentHandler = async (
+    event: APIGatewayProxyEventV2,
+    context: Context
+): Promise<APIGatewayProxyResultV2> => {
+    let proxy: ReturnType<typeof serverlessHttp> | null;
+
+    try {
+        proxy = await getShareContentProxy();
+    } catch {
+        // Never return a raw boot error. Allow a later invocation to retry.
+        shareContentProxyPromise = null;
+
+        return {
+            statusCode: 503,
+            headers: { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' },
+            body: JSON.stringify({ ok: false, error: 'UNAVAILABLE' }),
+        };
+    }
+
+    if (!proxy) {
+        return { statusCode: 404, headers: { 'Cache-Control': 'no-store' }, body: '' };
+    }
+
+    return proxy(event, context);
+};
+
+export const swaggerUiHandler = serverlessHttp(toServerlessApplication(app), {
+    basePath: '/docs',
+});
+
+export const _openApiHandler = createOpenApiAwsLambdaHandler({
+    router: appRouter,
+    responseMeta: () => {
+        return {
+            headers: {
+                'Access-Control-Allow-Origin': '*',
+                'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
+                'Access-Control-Allow-Headers': 'Authorization, Content-Type',
+            },
+        };
+    },
+    createContext,
+    onError: handleTrpcError,
+});
+
+export const _trpcHandler = awsLambdaRequestHandler({
+    allowMethodOverride: true,
+    router: appRouter,
+    createContext,
+    onError: handleTrpcError,
+    responseMeta: () => {
+        return {
+            headers: {
+                'Access-Control-Allow-Origin': '*',
+                'Access-Control-Allow-Methods': '*',
+                'Access-Control-Allow-Headers': 'authorization',
+            },
+        };
+    },
+});
+
+export const openApiHandler = Sentry.AWSLambda.wrapHandler(
+    async (event: APIGatewayProxyEventV2, context: Context): Promise<APIGatewayProxyResultV2> => {
+        if (event.requestContext.http.method === 'OPTIONS') {
+            return {
+                statusCode: 200,
+                headers: {
+                    'Access-Control-Allow-Origin': '*',
+                    'Access-Control-Allow-Headers': '*',
+                    'Access-Control-Allow-Methods': '*',
+                },
+            };
+        }
+
+        context.callbackWaitsForEmptyEventLoop = false;
+
+        return _openApiHandler(event, context);
+    }
+);
+
+export const trpcHandler = Sentry.AWSLambda.wrapHandler(
+    async (event: APIGatewayProxyEventV2, context: Context): Promise<APIGatewayProxyResultV2> => {
+        if (event.requestContext.http.method === 'OPTIONS') {
+            return {
+                statusCode: 200,
+                headers: {
+                    'Access-Control-Allow-Origin': '*',
+                    'Access-Control-Allow-Headers': '*',
+                    'Access-Control-Allow-Methods': '*',
+                },
+            };
+        }
+
+        context.callbackWaitsForEmptyEventLoop = false;
+
+        return _trpcHandler(event, context);
+    }
+);

package/oidcLambda.test.ts

@@ -0,0 +1,41 @@
+import type { APIGatewayProxyEventV2, Context } from 'aws-lambda';
+import { beforeEach, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({ bootstrap: vi.fn(), getApp: vi.fn(), handler: vi.fn() }));
+
+vi.mock('@learncard/service-config', () => ({ bootstrapLambda: mocks.bootstrap }));
+vi.mock('./src/config/stageConfig', () => ({ base: {}, stages: { dev: {}, production: {} } }));
+vi.mock('./oidcLambdaApp', () => ({ oidcHandler: mocks.handler }));
+
+beforeEach(() => {
+    vi.resetModules();
+    vi.clearAllMocks();
+    mocks.bootstrap.mockReturnValue(mocks.getApp);
+    mocks.getApp.mockResolvedValue({ oidcHandler: mocks.handler });
+    mocks.handler.mockResolvedValue({ statusCode: 200 });
+});
+
+it('bootstraps the oidc app with checked-in stage config and the deploy stage', async () => {
+    vi.stubEnv('AWS_LAMBDA_FUNCTION_NAME', 'learn-cloud-service-dev-oidc');
+    vi.stubEnv('LAMBDA_STAGE', 'dev');
+    await import('./oidcLambda');
+    expect(mocks.bootstrap).toHaveBeenCalledTimes(1);
+    expect(mocks.bootstrap).toHaveBeenCalledWith({
+        base: {},
+        stages: { dev: {}, production: {} },
+        stage: 'dev',
+        importApp: expect.any(Function),
+    });
+    vi.unstubAllEnvs();
+});
+
+it('resolves the app once per cold start and forwards every argument', async () => {
+    const { oidcHandler } = await import('./oidcLambda');
+    const event = {} as APIGatewayProxyEventV2;
+    const context = {} as Context;
+    const callback = vi.fn();
+    await oidcHandler(event, context, callback);
+    await oidcHandler(event, context, callback);
+    expect(mocks.getApp).toHaveBeenCalledTimes(2);
+    expect(mocks.handler).toHaveBeenLastCalledWith(event, context, callback);
+});

package/oidcLambda.ts

@@ -1,23 +1,17 @@
-import serverlessHttp from 'serverless-http';
-import * as Sentry from '@sentry/serverless';
+import { bootstrapLambda } from '@learncard/service-config';
 
-import oidcApp from './src/oidc';
-import { environment } from './src/config/environment';
-import { toServerlessApplication } from './src/helpers/serverlessApplication';
+import { base, stages } from './src/config/stageConfig';
 
-Sentry.AWSLambda.init({
-    dsn: environment.SENTRY_DSN,
-    environment: environment.SENTRY_ENV,
-    enabled: Boolean(environment.SENTRY_DSN),
-    tracesSampleRate: 1.0,
-    integrations: [
-        new Sentry.Integrations.Console(),
-        new Sentry.Integrations.Http(),
-        new Sentry.Integrations.ContextLines(),
-        new Sentry.Integrations.Mongo(),
-    ],
+type OidcApp = typeof import('./oidcLambdaApp');
+
+const getApplication = bootstrapLambda<OidcApp>({
+    base,
+    stages,
+    stage: process.env.AWS_LAMBDA_FUNCTION_NAME
+        ? process.env.LAMBDA_STAGE
+        : process.env.CONFIG_STAGE,
+    importApp: () => import('./oidcLambdaApp'),
 });
 
-export const oidcHandler = Sentry.AWSLambda.wrapHandler(
-    serverlessHttp(toServerlessApplication(oidcApp))
-);
+export const oidcHandler = async (...args: Parameters<OidcApp['oidcHandler']>) =>
+    (await getApplication()).oidcHandler(...args);

package/oidcLambdaApp.ts

@@ -0,0 +1,23 @@
+import serverlessHttp from 'serverless-http';
+import * as Sentry from '@sentry/serverless';
+
+import oidcApp from './src/oidc';
+import { environment } from './src/config/environment';
+import { toServerlessApplication } from './src/helpers/serverlessApplication';
+
+Sentry.AWSLambda.init({
+    dsn: environment.SENTRY_DSN,
+    environment: environment.SENTRY_ENV,
+    enabled: Boolean(environment.SENTRY_DSN),
+    tracesSampleRate: 1.0,
+    integrations: [
+        new Sentry.Integrations.Console(),
+        new Sentry.Integrations.Http(),
+        new Sentry.Integrations.ContextLines(),
+        new Sentry.Integrations.Mongo(),
+    ],
+});
+
+export const oidcHandler = Sentry.AWSLambda.wrapHandler(
+    serverlessHttp(toServerlessApplication(oidcApp))
+);

package/package.json

@@ -1,11 +1,11 @@
 {
     "name": "@learncard/learn-cloud-service",
-    "version": "2.5.35",
+    "version": "2.5.37",
     "description": "",
     "engines": {
         "node": ">=24.12 <25"
     },
-    "packageManager": "bun@1.3.14",
+    "packageManager": "bun@1.4.2",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",
     "scripts": {
@@ -61,27 +61,27 @@
         "serverless-offline": "^12.0.4",
         "serverless-prune-plugin": "^2.1.0",
         "shx": "^0.3.4",
-        "swagger-ui-dist": "^5.18.2",
         "testcontainers": "^9.1.1"
     },
     "dependencies": {
         "@fastify/cors": "^11.2.0",
         "@fastify/rate-limit": "^10.2.0",
         "@fastify/static": "^10.1.1",
-        "@learncard/core": "9.4.37",
-        "@learncard/crypto-plugin": "1.1.37",
-        "@learncard/did-web-plugin": "1.1.37",
-        "@learncard/didkey-plugin": "1.1.37",
-        "@learncard/didkit-plugin": "^1.10.2",
-        "@learncard/didkit-plugin-node": "0.3.2",
-        "@learncard/encryption-plugin": "1.1.37",
-        "@learncard/expiration-plugin": "1.2.37",
-        "@learncard/helpers": "1.6.1",
-        "@learncard/learn-card-plugin": "1.2.37",
-        "@learncard/types": "5.22.0",
-        "@learncard/vc-plugin": "1.6.3",
-        "@learncard/vc-templates-plugin": "1.1.37",
+        "@learncard/core": "9.4.38",
+        "@learncard/crypto-plugin": "1.1.38",
+        "@learncard/did-web-plugin": "1.1.38",
+        "@learncard/didkey-plugin": "1.1.38",
+        "@learncard/didkit-plugin": "^1.10.3",
+        "@learncard/didkit-plugin-node": "0.3.3",
+        "@learncard/encryption-plugin": "1.1.38",
+        "@learncard/expiration-plugin": "1.2.38",
+        "@learncard/helpers": "1.6.2",
+        "@learncard/learn-card-plugin": "1.2.38",
+        "@learncard/types": "5.23.0",
+        "@learncard/vc-plugin": "1.6.4",
+        "@learncard/vc-templates-plugin": "1.1.38",
         "@sentry/serverless": "7.61.0",
+        "@traversable/zod": "^0.0.57",
         "@trpc/server": "11.8.0",
         "@types/lodash": "^4.14.191",
         "@xapi/xapi": "^3.0.0",
@@ -103,6 +103,7 @@
         "neo4j-driver": "^4.3.0",
         "neogma": "^1.11.1",
         "simple-redis-mutex": "^1.3.1",
+        "swagger-ui-dist": "^5.18.2",
         "trpc-to-openapi": "^3.1.0",
         "tsc-alias": "^1.8.10",
         "zod-openapi": "^5.0.1",

package/project.json

@@ -35,7 +35,14 @@
         },
         "build": {
             "executor": "nx:run-script",
-            "inputs": ["source"],
+            "inputs": [
+                "source",
+                "{projectRoot}/bundle.mjs",
+                "{projectRoot}/esbuildPlugins.cjs",
+                "{projectRoot}/package.json",
+                "{projectRoot}/tsconfig*.json",
+                "{workspaceRoot}/packages/service-config/src/**/*"
+            ],
             "options": {
                 "script": "build"
             }

package/serverless-local.yml

@@ -40,9 +40,11 @@ provider:
     timeout: 20
     stage: ${opt:stage, "dev"}
     region: ${opt:region, "us-east-1"}
+    # serverless-offline sets AWS_LAMBDA_FUNCTION_NAME; stage config stays opt-in locally.
     environment:
         PORT: ${env:PORT, 3000}
-        LAMBDA_STAGE: ${opt:stage, "dev"}
+        LAMBDA_STAGE: ${env:CONFIG_STAGE, ''}
+        CONFIG_STAGE: ${env:CONFIG_STAGE, ''}
         LEARN_CLOUD_SEED: ${env:LEARN_CLOUD_SEED}
         LEARN_CLOUD_MONGO_URI: ${env:LEARN_CLOUD_MONGO_URI}
         LEARN_CLOUD_MONGO_DB_NAME: ${env:LEARN_CLOUD_MONGO_DB_NAME}

package/serverless.function-env.cjs

@@ -0,0 +1,31 @@
+const { functionEnvironment } = require('@learncard/service-config/function-env.cjs');
+
+const PROVIDER_SECRETS = [
+    'LEARN_CLOUD_SEED',
+    'LEARN_CLOUD_MONGO_URI',
+    'LEARN_CLOUD_MONGO_DB_NAME',
+    'RSA_PRIVATE_KEY',
+    'RSA_PUBLIC_KEY',
+    'JWT_SIGNING_KEY',
+    'XAPI_ENDPOINT',
+    'XAPI_USERNAME',
+    'XAPI_PASSWORD',
+    'SENTRY_DSN',
+];
+
+// Serverless v3 supplies CLI options to file functions and preserves CF intrinsics.
+// Every function shares the one generated execution role, so the bundle pointer and the
+// credential fallbacks sit together on the provider. Bundle mode emits only infra plus the
+// pointer; fallback mode retains the per-value GitHub secrets. XAPI_ENDPOINT is a
+// user-classified bundle secret (fallback env only), not infra, so it rides the fallback
+// list and is dropped once a bundle is configured. Non-secret per-stage values are applied
+// from checked-in stage config at cold start, never forwarded here.
+exports.provider = ({ options = {}, env = process.env } = {}) => ({
+    LAMBDA_STAGE: options.stage || 'dev',
+    // Non-secret product selector for the shared stage files (config.<tenant>.<stage>.json).
+    CONFIG_TENANT: env.CONFIG_TENANT || 'learncard',
+    PORT: String(options.httpPort || '3000'),
+    REDIS_HOST: { 'Fn::GetAtt': ['ElasticCacheCluster', 'RedisEndpoint.Address'] },
+    REDIS_PORT: { 'Fn::GetAtt': ['ElasticCacheCluster', 'RedisEndpoint.Port'] },
+    ...functionEnvironment({ always: ['RUNTIME_SECRETS_ID'], fallback: PROVIDER_SECRETS, env }),
+});

package/serverless.yml

@@ -24,6 +24,8 @@ custom:
         packager: pnpm
         plugins: esbuildPlugins.cjs
         bundle: true
+        # Deployment builds run once; avoid leaking rebuild contexts when plugins fail.
+        skipRebuild: true
         # minify: true
         external: ['@learncard/didkit-plugin/dist/didkit_wasm_bg.wasm', '*.node']
         # didkit-plugin-node ships via the didkitNative Lambda Layer. `exclude` both
@@ -118,35 +120,19 @@ provider:
     timeout: 29
     stage: ${opt:stage, "dev"}
     region: ${opt:region, "us-east-1"}
-    environment:
-        PORT: ${env:PORT, 3000}
-        LAMBDA_STAGE: ${opt:stage, "dev"}
-        LEARN_CLOUD_SEED: ${env:LEARN_CLOUD_SEED}
-        LEARN_CLOUD_MONGO_URI: ${env:LEARN_CLOUD_MONGO_URI}
-        LEARN_CLOUD_MONGO_DB_NAME: ${env:LEARN_CLOUD_MONGO_DB_NAME}
-        XAPI_ENDPOINT: ${env:XAPI_ENDPOINT, "false"}
-        XAPI_USERNAME: ${env:XAPI_USERNAME, "false"}
-        XAPI_PASSWORD: ${env:XAPI_PASSWORD, "false"}
-        RSA_PRIVATE_KEY: ${env:RSA_PRIVATE_KEY, "false"}
-        RSA_PUBLIC_KEY: ${env:RSA_PUBLIC_KEY, "false"}
-        SERVER_URL: ${env:SERVER_URL, "https://cloud.learncard.com"}
-        JWT_SIGNING_KEY: ${env:JWT_SIGNING_KEY, ""}
-        SENTRY_DSN: ${env:SENTRY_DSN}
-        SENTRY_ENV: ${env:SENTRY_ENV}
-        SENTRY_AUTH_TOKEN: ${env:SENTRY_AUTH_TOKEN}
-        SENTRY_ORG: ${env:SENTRY_ORG}
-        SENTRY_PROJECT: ${env:SENTRY_PROJECT}
-        REDIS_HOST:
-            'Fn::GetAtt': [ElasticCacheCluster, RedisEndpoint.Address]
-        REDIS_PORT:
-            'Fn::GetAtt': [ElasticCacheCluster, RedisEndpoint.Port]
-        # LC-2187 service-only share-content routes. Require an explicit
-        # audience, service DID/key-method allowlists and
-        # per-service namespace bindings. No secret material is passed here.
-        SHARE_CONTENT_AUDIENCE: ${env:SHARE_CONTENT_AUDIENCE, ''}
-        SHARE_CONTENT_SERVICE_DIDS: ${env:SHARE_CONTENT_SERVICE_DIDS, ''}
-        SHARE_CONTENT_VERIFICATION_METHODS: ${env:SHARE_CONTENT_VERIFICATION_METHODS, ''}
-        SHARE_CONTENT_NAMESPACE_BINDINGS: ${env:SHARE_CONTENT_NAMESPACE_BINDINGS, ''}
+    # Infra values and the CF intrinsics live in the helper alongside the bundle pointer.
+    # Bundle mode emits only infra + RUNTIME_SECRETS_ID; fallback mode retains the GitHub
+    # secrets. Non-secret per-stage values (SENTRY_ENV, SERVER_URL, SHARE_CONTENT_*) are
+    # applied from checked-in stage config at cold start, not passed here.
+    environment: ${file(./serverless.function-env.cjs):provider}
+    # Only this generated role runs every function; grant it read of the runtime bundle.
+    iam:
+        role:
+            statements:
+                - Effect: Allow
+                  Action: secretsmanager:GetSecretValue
+                  Resource:
+                      Fn::Sub: arn:${AWS::Partition}:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:learn-cloud-service/${sls:stage}/runtime-secrets-*
     tracing:
         apiGateway: true
         lambda: true

package/src/config/applyDockerStageConfig.ts

@@ -0,0 +1,6 @@
+import { applyLearnCloudStageConfig } from './stageConfig';
+
+// Side-effect import: runs before @environment is evaluated so Docker/local processes
+// pick up checked-in per-stage config. Keyed on CONFIG_STAGE (Lambda uses LAMBDA_STAGE);
+// explicit non-empty env values from the developer's .env still win.
+applyLearnCloudStageConfig(process.env.CONFIG_STAGE);