@sst-community/sst 4.19.0 → 5.0.0-alpha.1

package/platform/src/components/aws/svelte-kit.ts

@@ -0,0 +1,563 @@
+import fs from "fs";
+import path from "path";
+import { ComponentResourceOptions, Output } from "@pulumi/pulumi";
+import { Plan, SsrSite, SsrSiteArgs } from "./ssr-site.js";
+
+export interface SvelteKitArgs extends SsrSiteArgs {
+  /**
+   * Configure how this component works in `sst dev`.
+   *
+   * :::note
+   * In `sst dev` your SvelteKit app is run in dev mode; it's not deployed.
+   * :::
+   *
+   * Instead of deploying your SvelteKit app, this starts it in dev mode. It's run
+   * as a separate process in the `sst dev` multiplexer. Read more about
+   * [`sst dev`](/docs/reference/cli/#dev).
+   *
+   * To disable dev mode, pass in `false`.
+   */
+  dev?: SsrSiteArgs["dev"];
+  /**
+   * Permissions and the resources that the [server function](#nodes-server) in your SvelteKit app needs to access. These permissions are used to create the function's IAM role.
+   *
+   * :::tip
+   * If you `link` the function to a resource, the permissions to access it are
+   * automatically added.
+   * :::
+   *
+   * @example
+   * Allow reading and writing to an S3 bucket called `my-bucket`.
+   * ```js
+   * {
+   *   permissions: [
+   *     {
+   *       actions: ["s3:GetObject", "s3:PutObject"],
+   *       resources: ["arn:aws:s3:::my-bucket/*"]
+   *     },
+   *   ]
+   * }
+   * ```
+   *
+   * Perform all actions on an S3 bucket called `my-bucket`.
+   *
+   * ```js
+   * {
+   *   permissions: [
+   *     {
+   *       actions: ["s3:*"],
+   *       resources: ["arn:aws:s3:::my-bucket/*"]
+   *     },
+   *   ]
+   * }
+   * ```
+   *
+   * Grant permissions to access all resources.
+   *
+   * ```js
+   * {
+   *   permissions: [
+   *     {
+   *       actions: ["*"],
+   *       resources: ["*"]
+   *     },
+   *   ]
+   * }
+   * ```
+   */
+  permissions?: SsrSiteArgs["permissions"];
+  /**
+   * Path to the directory where your SvelteKit app is located.  This path is relative to your `sst.config.ts`.
+   *
+   * By default it assumes your SvelteKit app is in the root of your SST app.
+   * @default `"."`
+   *
+   * @example
+   *
+   * If your SvelteKit app is in a package in your monorepo.
+   *
+   * ```js
+   * {
+   *   path: "packages/web"
+   * }
+   * ```
+   */
+  path?: SsrSiteArgs["path"];
+  /**
+   * [Link resources](/docs/linking/) to your SvelteKit app. This will:
+   *
+   * 1. Grant the permissions needed to access the resources.
+   * 2. Allow you to access it in your site using the [SDK](/docs/reference/sdk/).
+   *
+   * @example
+   *
+   * Takes a list of resources to link to the function.
+   *
+   * ```js
+   * {
+   *   link: [bucket, stripeKey]
+   * }
+   * ```
+   */
+  link?: SsrSiteArgs["link"];
+  /**
+   * Configure how the CloudFront cache invalidations are handled. This is run after your SvelteKit app has been deployed.
+   * :::tip
+   * You get 1000 free invalidations per month. After that you pay $0.005 per invalidation path. [Read more here](https://aws.amazon.com/cloudfront/pricing/).
+   * :::
+   * @default `{paths: "all", wait: false}`
+   * @example
+   * Wait for all paths to be invalidated.
+   * ```js
+   * {
+   *   invalidation: {
+   *     paths: "all",
+   *     wait: true
+   *   }
+   * }
+   * ```
+   */
+  invalidation?: SsrSiteArgs["invalidation"];
+  /**
+   * Set [environment variables](https://vitejs.dev/guide/env-and-mode.html#env-files) in your SvelteKit app. These are made available:
+   *
+   * 1. In `vite build`, they are loaded into `process.env`.
+   * 2. Locally while running through `sst dev`.
+   *
+   * :::tip
+   * You can also `link` resources to your SvelteKit app and access them in a type-safe way with the [SDK](/docs/reference/sdk/). We recommend linking since it's more secure.
+   * :::
+   *
+   * @example
+   * ```js
+   * {
+   *   environment: {
+   *     API_URL: api.url,
+   *     STRIPE_PUBLISHABLE_KEY: "pk_test_123"
+   *   }
+   * }
+   * ```
+   */
+  environment?: SsrSiteArgs["environment"];
+  /**
+   * Set a custom domain for your SvelteKit app.
+   *
+   * Automatically manages domains hosted on AWS Route 53, Cloudflare, and Vercel. For other
+   * providers, you'll need to pass in a `cert` that validates domain ownership and add the
+   * DNS records.
+   *
+   * :::tip
+   * Built-in support for AWS Route 53, Cloudflare, and Vercel. And manual setup for other
+   * providers.
+   * :::
+   *
+   * @example
+   *
+   * By default this assumes the domain is hosted on Route 53.
+   *
+   * ```js
+   * {
+   *   domain: "example.com"
+   * }
+   * ```
+   *
+   * For domains hosted on Cloudflare.
+   *
+   * ```js
+   * {
+   *   domain: {
+   *     name: "example.com",
+   *     dns: sst.cloudflare.dns()
+   *   }
+   * }
+   * ```
+   *
+   * Specify a `www.` version of the custom domain.
+   *
+   * ```js
+   * {
+   *   domain: {
+   *     name: "domain.com",
+   *     redirects: ["www.domain.com"]
+   *   }
+   * }
+   * ```
+   */
+  domain?: SsrSiteArgs["domain"];
+  /**
+   * Serve your SvelteKit app through a `Router` instead of a standalone CloudFront
+   * distribution.
+   *
+   * By default, this component creates a new CloudFront distribution. But you might
+   * want to serve it through the distribution of your `Router` as a:
+   *
+   * - A path like `/docs`
+   * - A subdomain like `docs.example.com`
+   * - Or a combined pattern like `dev.example.com/docs`
+   *
+   * @example
+   *
+   * To serve your SvelteKit app **from a path**, you'll need to configure the root domain
+   * in your `Router` component.
+   *
+   * ```ts title="sst.config.ts" {2}
+   * const router = new sst.aws.Router("Router", {
+   *   domain: "example.com"
+   * });
+   * ```
+   *
+   * Now set the `router` and the `path`.
+   *
+   * ```ts {3,4}
+   * {
+   *   router: {
+   *     instance: router,
+   *     path: "/docs"
+   *   }
+   * }
+   * ```
+   *
+   * You also need to set the [`base`](https://svelte.dev/docs/kit/configuration#paths)
+   * to `/docs` in your SvelteKit config without a trailing slash. In SvelteKit 3, pass
+   * `paths` to the `sveltekit()` plugin in `vite.config.ts`. In SvelteKit 2, use
+   * `kit.paths` in `svelte.config.js`.
+   *
+   * :::caution
+   * If routing to a path, you need to set that as the base path in your
+   * SvelteKit app as well.
+   * :::
+   *
+   * ```js title="vite.config.ts" {9}
+   * import adapter from "svelte-kit-sst";
+   * import { sveltekit } from "@sveltejs/kit/vite";
+   * import { defineConfig } from "vite";
+   *
+   * export default defineConfig({
+   *   plugins: [
+   *     sveltekit({
+   *       adapter: adapter(),
+   *       paths: { base: "/docs" }
+   *     })
+   *   ]
+   * });
+   * ```
+   *
+   * In SvelteKit 2, it goes in `svelte.config.js`.
+   *
+   * ```js title="svelte.config.js" {4}
+   * export default {
+   *   kit: {
+   *     paths: {
+   *       base: "/docs"
+   *     }
+   *   }
+   * };
+   * ```
+   *
+   * To serve your SvelteKit app **from a subdomain**, you'll need to configure the
+   * domain in your `Router` component to match both the root and the subdomain.
+   *
+   * ```ts title="sst.config.ts" {3,4}
+   * const router = new sst.aws.Router("Router", {
+   *   domain: {
+   *     name: "example.com",
+   *     aliases: ["*.example.com"]
+   *   }
+   * });
+   * ```
+   *
+   * Now set the `domain` in the `router` prop.
+   *
+   * ```ts {4}
+   * {
+   *   router: {
+   *     instance: router,
+   *     domain: "docs.example.com"
+   *   }
+   * }
+   * ```
+   *
+   * Finally, to serve your SvelteKit app **from a combined pattern** like
+   * `dev.example.com/docs`, you'll need to configure the domain in your `Router` to
+   * match the subdomain.
+   *
+   * ```ts title="sst.config.ts" {3,4}
+   * const router = new sst.aws.Router("Router", {
+   *   domain: {
+   *     name: "example.com",
+   *     aliases: ["*.example.com"]
+   *   }
+   * });
+   * ```
+   *
+   * And set the `domain` and the `path`.
+   *
+   * ```ts {4,5}
+   * {
+   *   router: {
+   *     instance: router,
+   *     domain: "dev.example.com",
+   *     path: "/docs"
+   *   }
+   * }
+   * ```
+   *
+   * Also, make sure to set the base path in your SvelteKit config, like above.
+   */
+  router?: SsrSiteArgs["router"];
+  /**
+   * The command used internally to build your SvelteKit app.
+   *
+   * @default `"npm run build"`
+   *
+   * @example
+   *
+   * If you want to use a different build command.
+   * ```js
+   * {
+   *   buildCommand: "yarn build"
+   * }
+   * ```
+   */
+  buildCommand?: SsrSiteArgs["buildCommand"];
+  /**
+   * Configure the SvelteKit app to use an existing CloudFront cache policy.
+   *
+   * :::note
+   * CloudFront has a limit of 20 cache policies per account, though you can request a limit
+   * increase.
+   * :::
+   *
+   * By default, a new cache policy is created for it. This allows you to reuse an existing
+   * policy instead of creating a new one.
+   *
+   * @default A new cache policy is created
+   * @example
+   * ```js
+   * {
+   *   cachePolicy: "658327ea-f89d-4fab-a63d-7e88639e58f6"
+   * }
+   * ```
+   */
+  cachePolicy?: SsrSiteArgs["cachePolicy"];
+}
+
+/**
+ * The `SvelteKit` component lets you deploy a [SvelteKit](https://svelte.dev/docs/kit) app to AWS.
+ *
+ * In a route, `getClientAddress()` returns the visitor's IP address when requests come through
+ * CloudFront, read from the `CloudFront-Viewer-Address` header. The server function's URL is
+ * public unless `protection` is set to `"oac"` or `"oac-with-edge-signing"`, and anyone who
+ * has it can send their own header. If you use the address for rate limiting or to allow or
+ * block clients, set `protection` on this component, or on the `Router` if the site is served
+ * through one.
+ *
+ * If another CDN sits in front of CloudFront, the address is that CDN's. Read the header it
+ * sets instead.
+ *
+ * @example
+ *
+ * #### Minimal example
+ *
+ * Deploy a SvelteKit app that's in the project root.
+ *
+ * ```js title="sst.config.ts"
+ * new sst.aws.SvelteKit("MyWeb");
+ * ```
+ *
+ * #### Change the path
+ *
+ * Deploys the SvelteKit app in the `my-svelte-app/` directory.
+ *
+ * ```js {2} title="sst.config.ts"
+ * new sst.aws.SvelteKit("MyWeb", {
+ *   path: "my-svelte-app/"
+ * });
+ * ```
+ *
+ * #### Add a custom domain
+ *
+ * Set a custom domain for your SvelteKit app.
+ *
+ * ```js {2} title="sst.config.ts"
+ * new sst.aws.SvelteKit("MyWeb", {
+ *   domain: "my-app.com"
+ * });
+ * ```
+ *
+ * #### Redirect www to apex domain
+ *
+ * Redirect `www.my-app.com` to `my-app.com`.
+ *
+ * ```js {4} title="sst.config.ts"
+ * new sst.aws.SvelteKit("MyWeb", {
+ *   domain: {
+ *     name: "my-app.com",
+ *     redirects: ["www.my-app.com"]
+ *   }
+ * });
+ * ```
+ *
+ * #### Link resources
+ *
+ * [Link resources](/docs/linking/) to your SvelteKit app. This will grant permissions
+ * to the resources and allow you to access it in your app.
+ *
+ * ```ts {4} title="sst.config.ts"
+ * const bucket = new sst.aws.Bucket("MyBucket");
+ *
+ * new sst.aws.SvelteKit("MyWeb", {
+ *   link: [bucket]
+ * });
+ * ```
+ *
+ * You can use the [SDK](/docs/reference/sdk/) to access the linked resources
+ * in your SvelteKit app.
+ *
+ * ```ts title="src/routes/+page.server.ts"
+ * import { Resource } from "sst";
+ *
+ * console.log(Resource.MyBucket.name);
+ * ```
+ *
+ * #### Stream responses
+ *
+ * Turn on `streaming` in the adapter to stream responses from the server. The page's
+ * HTML is sent right away, and the promises a `load` function returns without
+ * awaiting are sent as they resolve.
+ *
+ * ```js title="vite.config.ts" {3}
+ * sveltekit({
+ *   adapter: adapter({ streaming: true })
+ * })
+ * ```
+ *
+ * In SvelteKit 2, it goes in `svelte.config.js`.
+ *
+ * ```js title="svelte.config.js" {3}
+ * export default {
+ *   kit: {
+ *     adapter: adapter({ streaming: true })
+ *   }
+ * };
+ * ```
+ *
+ * The function URL is then set up for [response streaming](https://docs.aws.amazon.com/lambda/latest/dg/configuration-response-streaming.html).
+ * This needs version 3.1.0 or later of the `svelte-kit-sst` adapter. Earlier versions don't have the option.
+ */
+export class SvelteKit extends SsrSite {
+  constructor(
+    name: string,
+    args: SvelteKitArgs = {},
+    opts: ComponentResourceOptions = {},
+  ) {
+    super(__pulumiType, name, args, opts);
+  }
+
+  protected normalizeBuildCommand() {}
+
+  protected buildPlan(outputPath: Output<string>): Output<Plan> {
+    return outputPath.apply((outputPath) => {
+      const serverOutputPath = path.join(
+        outputPath,
+        ".svelte-kit",
+        "svelte-kit-sst",
+        "server",
+      );
+      let basepath: string | undefined;
+      try {
+        const manifest = fs
+          .readFileSync(path.join(serverOutputPath, "manifest.js"))
+          .toString();
+        // SvelteKit 3 renamed these manifest fields from camelCase to snake_case
+        const appDir = manifest.match(/app(?:Dir|_dir): "(.+?)"/)?.[1];
+        const appPath = manifest.match(/app(?:Path|_path): "(.+?)"/)?.[1];
+        if (appDir && appPath && appPath.endsWith(appDir)) {
+          basepath = appPath.substring(0, appPath.length - appDir.length);
+        }
+      } catch (e) {}
+
+      // Written by svelte-kit-sst 3.1.0 and later
+      let streaming = false;
+      try {
+        streaming =
+          JSON.parse(
+            fs
+              .readFileSync(
+                path.join(
+                  outputPath,
+                  ".svelte-kit",
+                  "svelte-kit-sst",
+                  "adapter.json",
+                ),
+              )
+              .toString(),
+          ).streaming === true;
+      } catch (e) {}
+
+      return {
+        base: basepath,
+        server: {
+          handler: path.join(
+            serverOutputPath,
+            "lambda-handler",
+            streaming ? "stream.handler" : "index.handler",
+          ),
+          streaming,
+          nodejs: {
+            esbuild: {
+              minify: process.env.SST_DEBUG ? false : true,
+              sourcemap: process.env.SST_DEBUG ? ("inline" as const) : false,
+              define: {
+                "process.env.SST_DEBUG": process.env.SST_DEBUG
+                  ? "true"
+                  : "false",
+              },
+            },
+          },
+          copyFiles: [
+            {
+              from: path.join(
+                outputPath,
+                ".svelte-kit",
+                "svelte-kit-sst",
+                "prerendered",
+              ),
+              to: "prerendered",
+            },
+          ],
+        },
+        assets: [
+          {
+            from: path.join(".svelte-kit", "svelte-kit-sst", "client"),
+            to: "",
+            cached: true,
+            versionedSubDir: "_app",
+            deepRoute: "_app",
+          },
+          {
+            from: path.join(".svelte-kit", "svelte-kit-sst", "prerendered"),
+            to: "",
+            cached: false,
+            listFiles: true,
+          },
+        ],
+        hasStaticRoutes: true,
+      };
+    });
+  }
+
+  /**
+   * The URL of the SvelteKit app.
+   *
+   * If the `domain` is set, this is the URL with the custom domain.
+   * Otherwise, it's the auto-generated CloudFront URL.
+   */
+  public get url() {
+    return super.url;
+  }
+}
+
+const __pulumiType = "sst:aws:SvelteKit";
+// @ts-expect-error
+SvelteKit.__pulumiType = __pulumiType;

package/platform/src/components/aws/takeover/alb.ts

@@ -0,0 +1,9 @@
+import { takeover } from "../../takeover";
+import { Alb } from "../v5/alb";
+
+takeover(Alb, {
+  moved: {
+    // The 4.x `Alb` calls the certificate the SSL
+    certificate: "ssl",
+  },
+});

package/platform/src/components/aws/takeover/apigatewayv2.ts

@@ -0,0 +1,43 @@
+import { takeover } from "../../takeover";
+import { outputId } from "../../component";
+import { hashStringToPrettyString, logicalName } from "../../naming";
+import { ApiGatewayV2 } from "../v5/apigatewayv2";
+import { childOf } from "./helpers";
+
+// The 4.x `ApiGatewayV2` keeps each route in a component of its own, next to
+// the API. There are three kinds, one for each thing a route can send requests
+// to. It's named after the route's `name`, or after a hash of the route. The V5
+// one keeps a route's resources inside the API, under the route's name or the
+// route itself.
+const LAMBDA = "sst:aws:ApiGatewayV2LambdaRoute";
+const ROUTES = [LAMBDA, "sst:aws:ApiGatewayV2UrlRoute", "sst:aws:ApiGatewayV2PrivateRoute"];
+const ROUTE = /^(\$default$|(ANY|DELETE|GET|HEAD|OPTIONS|PATCH|POST|PUT) \/)/;
+const route = (api: string, id = "") => {
+  const suffix = ROUTE.test(id) ? hashStringToPrettyString(outputId + id, 6) : id;
+  return `${api}Route${logicalName(suffix)}`;
+};
+
+// An authorizer was kept the same way, named after the authorizer.
+const AUTHORIZER = "sst:aws:ApiGatewayV2Authorizer";
+const authorizer = (api: string, id = "") =>
+  `${api}Authorizer${logicalName(id)}`;
+
+takeover(ApiGatewayV2, {
+  moved: {
+    logGroup: "accessLog",
+    certificate: "ssl",
+    handler: (_, { name, id }) => childOf(LAMBDA, route(name, id), "Handler"),
+    permission: (_, { name, id }) =>
+      childOf(LAMBDA, route(name, id), "Permissions"),
+    integration: (_, { name, id }) =>
+      ROUTES.map((type) => childOf(type, route(name, id), "Integration")),
+    route: (_, { name, id }) =>
+      ROUTES.map((type) => childOf(type, route(name, id), "Route")),
+    authorizer: (_, { name, id }) =>
+      childOf(AUTHORIZER, authorizer(name, id), "Authorizer"),
+    authorizerFunction: (_, { name, id }) =>
+      childOf(AUTHORIZER, authorizer(name, id), "Handler"),
+    authorizerPermission: (_, { name, id }) =>
+      childOf(AUTHORIZER, authorizer(name, id), "Permission"),
+  },
+});

package/platform/src/components/aws/takeover/app-sync.ts

@@ -0,0 +1,45 @@
+import { takeover } from "../../takeover";
+import { logicalName } from "../../naming";
+import { AppSync } from "../v5/app-sync";
+import { childOf } from "./helpers";
+
+// The 4.x `AppSync` keeps each data source, AppSync function and resolver in a
+// component of its own, next to the API. The V5 one keeps their resources
+// inside the API, under the data source's or function's name, or the resolver's
+// operation.
+const DATA_SOURCE = "sst:aws:AppSyncDataSource";
+const dataSource = (api: string, id = "") =>
+  `${api}DataSource${logicalName(id)}`;
+
+const FUNCTION = "sst:aws:AppSyncFunction";
+const fn = (api: string, id = "") => `${api}Function${logicalName(id)}`;
+
+// A resolver's component was named after the operation's type and field:
+// `QueryUser` for "Query user".
+const RESOLVER = "sst:aws:AppSyncResolver";
+const resolver = (api: string, id = "") =>
+  `${api}Resolver${id.split(" ").map(logicalName).join("")}`;
+
+// Two things the 4.x `AppSync` created with no parent at all, beside the API
+// rather than inside anything: the function of a Lambda data source given as a
+// handler, and the association between a custom domain and the API.
+takeover(AppSync, {
+  moved: {
+    certificate: "ssl",
+    domainAssociation: (_, { name }) => ({
+      name: `${name}DomainAssociation`,
+      parent: false,
+    }),
+    dataSourceFunction: (_, { name, id }) => ({
+      name: `${dataSource(name, id)}Function`,
+      parent: false,
+    }),
+    dataSource: (_, { name, id }) =>
+      childOf(DATA_SOURCE, dataSource(name, id), "DataSource"),
+    serviceRole: (_, { name, id }) =>
+      childOf(DATA_SOURCE, dataSource(name, id), "ServiceRole"),
+    function: (_, { name, id }) => childOf(FUNCTION, fn(name, id), "Function"),
+    resolver: (_, { name, id }) =>
+      childOf(RESOLVER, resolver(name, id), "Resolver"),
+  },
+});

package/platform/src/components/aws/takeover/aurora.ts

@@ -0,0 +1,19 @@
+import { takeover } from "../../takeover";
+import { Aurora } from "../v5/aurora";
+
+takeover(Aurora, {
+  moved: {
+    // The 4.x `Aurora` calls the secret with the master user's credentials the
+    // "proxy" secret, though it's created without a proxy too
+    secret: "proxySecret",
+    secretVersion: "proxySecretVersion",
+    // The instances' parameter group was the only one named plainly
+    instanceParameterGroup: "parameterGroup",
+    // The secret of an additional user was named after the username as it
+    // was written
+    proxySecret: (_, { name, id }) => ({ name: `${name}ProxySecret${id}` }),
+    proxySecretVersion: (_, { name, id }) => ({
+      name: `${name}ProxySecretVersion${id}`,
+    }),
+  },
+});