@stacksjs/ts-cloud 0.5.3 → 0.5.5

package/dist/index.js

@@ -26262,7 +26262,7 @@ function composeServerlessAppTemplate(opts) {
           ...app.assetDomain ? {
             Aliases: [app.assetDomain],
             ViewerCertificate: {
-              AcmCertificateArn: app.assetCertificateArn,
+              AcmCertificateArn: app.assetCertificateArn ?? Fn2.ref("AssetsCertificate"),
               SslSupportMethod: "sni-only",
               MinimumProtocolVersion: "TLSv1.2_2021"
             }
@@ -26271,8 +26271,20 @@ function composeServerlessAppTemplate(opts) {
       }
     };
     if (app.assetDomain) {
-      if (!app.assetCertificateArn)
-        throw new Error("serverless app: `assetDomain` requires `assetCertificateArn` (a us-east-1 ACM cert — CloudFront only accepts certs from us-east-1).");
+      if (!app.assetCertificateArn) {
+        if (!app.hostedZoneId)
+          throw new Error("serverless app: `assetDomain` requires either `assetCertificateArn` (a us-east-1 ACM cert) or `hostedZoneId` (to auto-issue + validate one). CloudFront only accepts certs from us-east-1.");
+        if (region !== "us-east-1")
+          throw new Error(`serverless app: auto-issuing an asset-domain cert needs a us-east-1 app (CloudFront certs must be us-east-1); this app is in ${region}. Supply a pre-issued us-east-1 \`assetCertificateArn\` instead.`);
+        resources.AssetsCertificate = {
+          Type: "AWS::CertificateManager::Certificate",
+          Properties: {
+            DomainName: app.assetDomain,
+            ValidationMethod: "DNS",
+            DomainValidationOptions: [{ DomainName: app.assetDomain, HostedZoneId: app.hostedZoneId }]
+          }
+        };
+      }
       if (app.hostedZoneId) {
         resources.AssetsDomainRecord = {
           Type: "AWS::Route53::RecordSet",
@@ -26359,9 +26371,12 @@ function composeServerlessAppTemplate(opts) {
     };
   }
   if (hasVpc && needsDataVpc) {
+    if (!app.vpc?.id)
+      throw new Error("serverless app: data services (elasticache / aurora-serverless / rdsProxy / efs) need app.vpc.id (the VPC id) so the managed security group is created in the right VPC.");
     resources.DataSecurityGroup = {
       Type: "AWS::EC2::SecurityGroup",
       Properties: {
+        VpcId: app.vpc.id,
         GroupDescription: `${slug}-${environment} serverless data access`,
         SecurityGroupIngress: [{ IpProtocol: "-1", CidrIp: "10.0.0.0/8" }]
       }
@@ -26442,6 +26457,7 @@ function composeServerlessAppTemplate(opts) {
         Engine: "aurora-mysql",
         EngineMode: "provisioned",
         DBClusterIdentifier: `${slug}-${environment}-db`,
+        DatabaseName: "app",
         MasterUsername: Fn2.sub("{{resolve:secretsmanager:${DbSecret}:SecretString:username}}"),
         MasterUserPassword: Fn2.sub("{{resolve:secretsmanager:${DbSecret}:SecretString:password}}"),
         ServerlessV2ScalingConfiguration: { MinCapacity: 0.5, MaxCapacity: 4 },
@@ -26488,6 +26504,15 @@ function composeServerlessAppTemplate(opts) {
         RequireTLS: false
       }
     };
+    resources.DbProxyTargetGroup = {
+      Type: "AWS::RDS::DBProxyTargetGroup",
+      DependsOn: ["DbInstance"],
+      Properties: {
+        DBProxyName: Fn2.ref("DbProxy"),
+        TargetGroupName: "default",
+        DBClusterIdentifiers: [Fn2.ref("DbCluster")]
+      }
+    };
     outputs.DbProxyEndpoint = { Description: "RDS Proxy endpoint", Value: Fn2.getAtt("DbProxy", "Endpoint") };
   }
   outputs.HttpFunctionName = { Description: "HTTP function name", Value: Fn2.ref("HttpFunction") };
@@ -57435,7 +57460,7 @@ var exports_serverless_image = {};
 __export(exports_serverless_image, {
   buildAndPushServerlessImage: () => buildAndPushServerlessImage
 });
-import { execFileSync as execFileSync3, execSync as execSync3 } from "node:child_process";
+import { execFileSync as execFileSync3 } from "node:child_process";
 import { mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
 import { dirname as dirname7, join as join15 } from "node:path";
@@ -57497,12 +57522,17 @@ async function buildAndPushServerlessImage(opts) {
       throw new Error(`could not resolve ECR repository URI for ${repository}`);
     const imageUri = `${repoUri}:${tag}`;
     step2("docker build");
-    execFileSync3("docker", ["build", "--platform", platform, "-t", imageUri, stage], { stdio: "inherit" });
-    step2("ecr login");
-    const loginCmd = await ecr2.getDockerLoginCommand();
-    execSync3(loginCmd, { stdio: "inherit" });
-    step2("docker push");
-    execFileSync3("docker", ["push", imageUri], { stdio: "inherit" });
+    execFileSync3("docker", ["build", "--platform", platform, "--provenance=false", "--sbom=false", "-t", imageUri, stage], { stdio: "inherit" });
+    step2("ecr auth + push");
+    const auth = await ecr2.getAuthorizationToken();
+    const data = auth.authorizationData?.[0];
+    if (!data?.authorizationToken || !data.proxyEndpoint)
+      throw new Error("failed to get an ECR authorization token");
+    const registry = data.proxyEndpoint.replace(/^https?:\/\//, "");
+    const dockerConfig = join15(stage, ".docker");
+    mkdirSync7(dockerConfig, { recursive: true });
+    writeFileSync10(join15(dockerConfig, "config.json"), JSON.stringify({ auths: { [registry]: { auth: data.authorizationToken } } }));
+    execFileSync3("docker", ["push", imageUri], { stdio: "inherit", env: { ...process.env, DOCKER_CONFIG: dockerConfig } });
     info(`Image: ${imageUri}`);
     return { imageUri, tag, handlers };
   } finally {
@@ -83385,6 +83415,19 @@ async function deployServerlessApp(config6, environment, opts = {}) {
   }
   step("Resolving secrets");
   const secrets = await resolveSecrets(app, region);
+  if (app.database?.connection === "aurora-serverless") {
+    try {
+      const sm = new SecretsManagerClient(region);
+      const v = await sm.getSecretValue({ SecretId: `${slug}/${environment}/db` });
+      const creds = JSON.parse(v.SecretString ?? "{}");
+      if (creds.username)
+        secrets.DB_USERNAME = creds.username;
+      if (creds.password)
+        secrets.DB_PASSWORD = creds.password;
+    } catch (err) {
+      warn(`Could not resolve Aurora DB credentials: ${err.message}`);
+    }
+  }
   if (!await s32.bucketExists(artifactBucket)) {
     await s32.createBucket(artifactBucket);
   }
@@ -83584,7 +83627,7 @@ function planServices(services) {
   const packages = [];
   const names = [];
   if (enabled(services.mysql)) {
-    packages.push("mysql.com");
+    packages.push(typeof services.mysql === "object" && services.mysql.version ? `mysql.com@${services.mysql.version}` : "mysql.com@8.0.43");
     names.push("mysql");
   } else if (enabled(services.mariadb)) {
     packages.push(PANTRY_PACKAGES.mariadb);
@@ -84785,7 +84828,7 @@ await init_dist2();
 import { existsSync as existsSync18, readFileSync as readFileSync15 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
 import { join as join18 } from "node:path";
-import { execSync as execSync5 } from "node:child_process";
+import { execSync as execSync3 } from "node:child_process";
 
 // src/drivers/hetzner/client.ts
 var DEFAULT_API_URL = "https://api.hetzner.cloud/v1";
@@ -85721,7 +85764,7 @@ class HetznerDriver {
     let lastErr;
     while (Date.now() - start < sshTimeoutMs) {
       try {
-        execSync5(`ssh ${this.sshBaseArgs(host, ["-o", "ConnectTimeout=5"]).map((a) => `"${a.replace(/"/g, "\\\"")}"`).join(" ")} true`, {
+        execSync3(`ssh ${this.sshBaseArgs(host, ["-o", "ConnectTimeout=5"]).map((a) => `"${a.replace(/"/g, "\\\"")}"`).join(" ")} true`, {
           stdio: "pipe",
           maxBuffer: SSH_MAX_BUFFER
         });
@@ -85781,7 +85824,7 @@ ${out}`);
     ];
   }
   scpToHost(host, localPath, remotePath) {
-    execSync5([
+    execSync3([
       "scp",
       "-i",
       this.sshPrivateKeyPath,
@@ -85794,7 +85837,7 @@ ${out}`);
   }
   sshExec(host, script) {
     const escaped = script.replace(/'/g, `'\\''`);
-    return execSync5(`ssh ${this.sshBaseArgs(host).map((a) => `"${a.replace(/"/g, "\\\"")}"`).join(" ")} '${escaped}'`, {
+    return execSync3(`ssh ${this.sshBaseArgs(host).map((a) => `"${a.replace(/"/g, "\\\"")}"`).join(" ")} '${escaped}'`, {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"],
       maxBuffer: SSH_MAX_BUFFER

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stacksjs/ts-cloud",
   "type": "module",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "description": "A lightweight, performant infrastructure-as-code library and CLI for deploying both server-based (EC2) and serverless applications.",
   "author": "Chris Breuer <chris@stacksjs.com>",
   "license": "MIT",
@@ -89,8 +89,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.5.3",
-    "@ts-cloud/core": "0.5.3",
+    "@ts-cloud/aws-types": "0.5.5",
+    "@ts-cloud/core": "0.5.5",
     "@stacksjs/ts-xml": "^0.1.0"
   },
   "devDependencies": {