@stacksjs/ts-cloud 0.5.7 → 0.5.9

package/dist/deploy/serverless-app.d.ts

@@ -43,6 +43,8 @@ export declare function resolveServerlessFunctions(config: CloudConfig, environm
         cli: string;
     };
 };
+/** Resolve secrets from Secrets Manager into a flat env map. */
+export declare function resolveSecrets(app: ServerlessAppConfig, region: string): Promise<Record<string, string>>;
 /**
  * Derive framework env vars (DB/Redis hosts) from the deployed stack outputs so
  * a Laravel app connects to the Aurora/RDS-Proxy/ElastiCache resources the
@@ -72,6 +74,24 @@ export declare function rollbackServerlessApp(config: CloudConfig, environment:
 export declare function setMaintenance(config: CloudConfig, environment: EnvironmentType, enabled: boolean, bypassSecret?: string): Promise<void>;
 /** Invoke the CLI function with an arbitrary command (e.g. `cloud command "migrate"`). */
 export declare function runRemoteCommand(config: CloudConfig, environment: EnvironmentType, command: string): Promise<string>;
+/** One recorded `cloud command` invocation. */
+export interface CommandRecord {
+    id: number;
+    command: string;
+    timestamp: string;
+    status: 'ok' | 'error';
+    output: string;
+}
+/** Run a command on the CLI function AND record it to the history log (best-effort). */
+export declare function runAndRecordCommand(config: CloudConfig, environment: EnvironmentType, command: string): Promise<{
+    id: number;
+    status: 'ok' | 'error';
+    output: string;
+}>;
+/** Return the recorded command history (most-recent last). */
+export declare function listCommandHistory(config: CloudConfig, environment: EnvironmentType): Promise<CommandRecord[]>;
+/** Look up one history record by id (or the most recent when id is omitted). */
+export declare function getCommandRecord(config: CloudConfig, environment: EnvironmentType, id?: number): Promise<CommandRecord | undefined>;
 /**
  * Run a SQL statement against a (private, in-VPC) serverless database via the CLI
  * function — no bastion needed. Requires the `tscloud/serverless` PHP bridge

package/dist/index.js

@@ -26026,6 +26026,28 @@ function composeServerlessAppTemplate(opts) {
   addFunction("CliFunction", functionNames.cli, handlers.cli, "cli", app.cliMemory ?? 1024, app.cliTimeout ?? 900, undefined, app.cliTmpStorage ?? tmpStorage);
   if (hasQueue)
     addFunction("QueueFunction", functionNames.queue, handlers.queue, "queue", app.queueMemory ?? 1024, app.queueTimeout ?? 120, undefined, app.queueTmpStorage ?? tmpStorage);
+  const pc = (app.provisionedConcurrency ?? 0) > 0 ? app.provisionedConcurrency : 0;
+  const fnLogicalIds = ["HttpFunction", "CliFunction", ...hasQueue ? ["QueueFunction"] : []];
+  if (pc) {
+    for (const L of fnLogicalIds) {
+      resources[`${L}Version`] = {
+        Type: "AWS::Lambda::Version",
+        DeletionPolicy: "Retain",
+        Properties: { FunctionName: Fn2.ref(L) }
+      };
+      resources[`${L}Alias`] = {
+        Type: "AWS::Lambda::Alias",
+        Properties: {
+          FunctionName: Fn2.ref(L),
+          Name: "live",
+          FunctionVersion: Fn2.getAtt(`${L}Version`, "Version"),
+          ProvisionedConcurrencyConfig: { ProvisionedConcurrentExecutions: pc }
+        }
+      };
+    }
+  }
+  const invokeArn = (L) => pc ? Fn2.ref(`${L}Alias`) : Fn2.getAtt(L, "Arn");
+  const invokeName = (L) => pc ? Fn2.ref(`${L}Alias`) : Fn2.ref(L);
   resources.HttpApi = {
     Type: "AWS::ApiGatewayV2::Api",
     Properties: {
@@ -26038,7 +26060,7 @@ function composeServerlessAppTemplate(opts) {
     Properties: {
       ApiId: Fn2.ref("HttpApi"),
       IntegrationType: "AWS_PROXY",
-      IntegrationUri: Fn2.getAtt("HttpFunction", "Arn"),
+      IntegrationUri: invokeArn("HttpFunction"),
       PayloadFormatVersion: "2.0"
     }
   };
@@ -26061,7 +26083,7 @@ function composeServerlessAppTemplate(opts) {
   resources.HttpPermission = {
     Type: "AWS::Lambda::Permission",
     Properties: {
-      FunctionName: Fn2.ref("HttpFunction"),
+      FunctionName: invokeName("HttpFunction"),
       Action: "lambda:InvokeFunction",
       Principal: "apigateway.amazonaws.com",
       SourceArn: Fn2.sub("arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${HttpApi}/*/*")
@@ -26152,7 +26174,7 @@ function composeServerlessAppTemplate(opts) {
         Type: "AWS::Lambda::EventSourceMapping",
         Properties: {
           EventSourceArn: Fn2.getAtt(qId, "Arn"),
-          FunctionName: Fn2.ref("QueueFunction"),
+          FunctionName: invokeName("QueueFunction"),
           BatchSize: 1,
           FunctionResponseTypes: ["ReportBatchItemFailures"],
           ...concurrency ? { ScalingConfig: { MaximumConcurrency: Math.max(2, concurrency) } } : {}
@@ -26170,7 +26192,7 @@ function composeServerlessAppTemplate(opts) {
         State: "ENABLED",
         Targets: [{
           Id: "cli",
-          Arn: Fn2.getAtt("CliFunction", "Arn"),
+          Arn: invokeArn("CliFunction"),
           Input: JSON.stringify({ command: "schedule:run" })
         }]
       }
@@ -26178,7 +26200,7 @@ function composeServerlessAppTemplate(opts) {
     resources.SchedulerPermission = {
       Type: "AWS::Lambda::Permission",
       Properties: {
-        FunctionName: Fn2.ref("CliFunction"),
+        FunctionName: invokeName("CliFunction"),
         Action: "lambda:InvokeFunction",
         Principal: "events.amazonaws.com",
         SourceArn: Fn2.getAtt("SchedulerRule", "Arn")
@@ -26187,34 +26209,39 @@ function composeServerlessAppTemplate(opts) {
   }
   if (app.warm && app.warm > 0) {
     const TARGETS_PER_RULE = 5;
-    const ruleCount = Math.ceil(app.warm / TARGETS_PER_RULE);
-    let warmed = 0;
-    for (let r = 0;r < ruleCount; r++) {
-      const targets = Math.min(TARGETS_PER_RULE, app.warm - warmed);
-      resources[`WarmerRule${r}`] = {
-        Type: "AWS::Events::Rule",
+    const fnResource = { http: "HttpFunction", queue: "QueueFunction", cli: "CliFunction" };
+    const warmModes = (app.warmFunctions ?? ["http"]).filter((m) => m !== "queue" || hasQueue);
+    for (const mode of warmModes) {
+      const cap = mode.charAt(0).toUpperCase() + mode.slice(1);
+      const ruleCount = Math.ceil(app.warm / TARGETS_PER_RULE);
+      let warmed = 0;
+      for (let r = 0;r < ruleCount; r++) {
+        const targets = Math.min(TARGETS_PER_RULE, app.warm - warmed);
+        resources[`Warmer${cap}Rule${r}`] = {
+          Type: "AWS::Events::Rule",
+          Properties: {
+            Name: `${slug}-${environment}-warmer-${mode}-${r}`,
+            ScheduleExpression: "rate(5 minutes)",
+            State: "ENABLED",
+            Targets: Array.from({ length: targets }, (_, i) => ({
+              Id: `warm-${mode}-${r}-${i}`,
+              Arn: Fn2.getAtt(fnResource[mode], "Arn"),
+              Input: JSON.stringify({ warmer: true })
+            }))
+          }
+        };
+        warmed += targets;
+      }
+      resources[`Warmer${cap}Permission`] = {
+        Type: "AWS::Lambda::Permission",
         Properties: {
-          Name: `${slug}-${environment}-warmer-${r}`,
-          ScheduleExpression: "rate(5 minutes)",
-          State: "ENABLED",
-          Targets: Array.from({ length: targets }, (_, i) => ({
-            Id: `warm-${r}-${i}`,
-            Arn: Fn2.getAtt("HttpFunction", "Arn"),
-            Input: JSON.stringify({ warmer: true })
-          }))
+          FunctionName: Fn2.ref(fnResource[mode]),
+          Action: "lambda:InvokeFunction",
+          Principal: "events.amazonaws.com",
+          SourceArn: Fn2.sub(`arn:aws:events:\${AWS::Region}:\${AWS::AccountId}:rule/${slug}-${environment}-warmer-${mode}-*`)
         }
       };
-      warmed += targets;
     }
-    resources.WarmerPermission = {
-      Type: "AWS::Lambda::Permission",
-      Properties: {
-        FunctionName: Fn2.ref("HttpFunction"),
-        Action: "lambda:InvokeFunction",
-        Principal: "events.amazonaws.com",
-        SourceArn: Fn2.sub(`arn:aws:events:\${AWS::Region}:\${AWS::AccountId}:rule/${slug}-${environment}-warmer-*`)
-      }
-    };
   }
   if (cacheEnabled) {
     resources.CacheTable = {
@@ -26807,6 +26834,8 @@ function parseRecordBody(body) {
 function createQueueHandler(handler8) {
   return async (event) => {
     const batchItemFailures = [];
+    if (event.warmer)
+      return { batchItemFailures };
     if (!handler8)
       return { batchItemFailures };
     for (const record of event.Records ?? []) {
@@ -26821,6 +26850,8 @@ function createQueueHandler(handler8) {
 }
 function createCliHandler(handler8) {
   return async (event) => {
+    if (event.warmer)
+      return { statusCode: 0, output: "warm" };
     if (!handler8)
       return { statusCode: 501, output: "No CLI handler configured" };
     return handler8(event);
@@ -58022,6 +58053,9 @@ function colorize(text, color) {
 function success(message) {
   console.log(`${colors.green}✓${colors.reset} ${message}`);
 }
+function error(message) {
+  console.error(`${colors.red}✗${colors.reset} ${message}`);
+}
 function warn(message) {
   console.warn(`${colors.yellow}⚠${colors.reset} ${message}`);
 }
@@ -83301,6 +83335,16 @@ async function resolveSecrets(app, region) {
   const sm = new SecretsManagerClient(region);
   const out = {};
   const entries = Array.isArray(app.secrets) ? app.secrets.map((name) => ({ envName: name.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g, "_"), secretId: name })) : Object.entries(app.secrets).map(([envName, secretId]) => ({ envName, secretId }));
+  if (Array.isArray(app.secrets)) {
+    const byName = new Map;
+    for (const { envName, secretId } of entries)
+      byName.set(envName, [...byName.get(envName) ?? [], secretId]);
+    const clashes = [...byName.entries()].filter(([, ids]) => ids.length > 1);
+    if (clashes.length) {
+      const detail = clashes.map(([name, ids]) => `${name} ← ${ids.join(", ")}`).join("; ");
+      throw new Error(`serverless secrets: multiple secrets map to the same env var (${detail}). Use the map form { ENV_NAME: 'secret/id' } to disambiguate.`);
+    }
+  }
   for (const { envName, secretId } of entries) {
     const value = await sm.getSecretValue({ SecretId: secretId });
     const str = value.SecretString ?? "";
@@ -83417,6 +83461,14 @@ async function applyFunction(lambda2, name, env2, code) {
   await withConflictRetry(() => lambda2.updateFunctionCode(codeParams));
   await lambda2.waitForFunctionActive(name, 120);
 }
+async function publishAndFlip(lambda2, name) {
+  const published = await withConflictRetry(() => lambda2.publishVersion({ FunctionName: name }));
+  const version2 = published.Version;
+  if (!version2)
+    throw new Error(`publishVersion returned no version for ${name}`);
+  await withConflictRetry(() => lambda2.updateAlias({ FunctionName: name, Name: "live", FunctionVersion: version2 }));
+  return version2;
+}
 async function deployServerlessApp(config6, environment, opts = {}) {
   const ctx = resolveContext(config6, environment);
   const { app, slug, region, stackName, artifactBucket } = ctx;
@@ -83560,12 +83612,22 @@ async function deployServerlessApp(config6, environment, opts = {}) {
     functionEnv.queue = buildFunctionEnv(app, ctx, environment, "queue", secrets, assetUrl, primaryQueue, infraEnv);
     await applyFunction(lambda2, composed.functionNames.queue, functionEnv.queue, codeSource);
   }
+  const usesProvisionedConcurrency = (app.provisionedConcurrency ?? 0) > 0;
+  const functionVersions = {};
+  if (usesProvisionedConcurrency) {
+    step("Publishing versions + flipping live alias");
+    functionVersions.http = await publishAndFlip(lambda2, composed.functionNames.http);
+    functionVersions.cli = await publishAndFlip(lambda2, composed.functionNames.cli);
+    if (composed.queueNames.length)
+      functionVersions.queue = await publishAndFlip(lambda2, composed.functionNames.queue);
+  }
   await writeRelease(s32, artifactBucket, slug, environment, {
     sha: artifactSha,
     code: codeSource,
     previousSha: prior?.sha,
     previousCode: prior?.code,
     previousFunctionEnv: prior?.functionEnv,
+    ...usesProvisionedConcurrency ? { functionVersions, previousFunctionVersions: prior?.functionVersions } : {},
     functionEnv,
     functionNames: {
       http: composed.functionNames.http,
@@ -83586,6 +83648,8 @@ async function deployServerlessApp(config6, environment, opts = {}) {
         LogType: "Tail"
       });
       if (res.FunctionError) {
+        error("Deploy hook failed — the new build is ALREADY LIVE.");
+        info(`  Roll back with: cloud serverless:rollback --env ${environment}`);
         throw new Error(`Deploy hook failed (${command}): ${res.Payload}`);
       }
     }
@@ -83622,6 +83686,9 @@ async function redeployServerlessApp(config6, environment) {
       continue;
     step(`Re-activating ${mode} (${name})`);
     await applyFunction(lambda2, name, release.functionEnv[mode] ?? {}, release.code);
+    const version2 = release.functionVersions?.[mode];
+    if (version2)
+      await withConflictRetry(() => lambda2.updateAlias({ FunctionName: name, Name: "live", FunctionVersion: version2 }));
   }
   success("Redeploy complete");
 }
@@ -83639,15 +83706,20 @@ async function rollbackServerlessApp(config6, environment) {
     step(`Restoring ${mode} (${name})`);
     const env2 = release.previousFunctionEnv?.[mode] ?? release.functionEnv[mode] ?? {};
     await applyFunction(lambda2, name, env2, release.previousCode);
+    const prevVersion = release.previousFunctionVersions?.[mode];
+    if (prevVersion)
+      await withConflictRetry(() => lambda2.updateAlias({ FunctionName: name, Name: "live", FunctionVersion: prevVersion }));
   }
   await writeRelease(s32, ctx.artifactBucket, ctx.slug, environment, {
     ...release,
     sha: release.previousSha ?? release.sha,
     code: release.previousCode,
     functionEnv: release.previousFunctionEnv ?? release.functionEnv,
+    functionVersions: release.previousFunctionVersions ?? release.functionVersions,
     previousSha: undefined,
     previousCode: undefined,
     previousFunctionEnv: undefined,
+    previousFunctionVersions: undefined,
     timestamp: new Date().toISOString()
   });
   success("Rollback complete");
@@ -83664,6 +83736,10 @@ async function setMaintenance(config6, environment, enabled, bypassSecret) {
   if (!enabled)
     delete env2.MAINTENANCE_BYPASS_SECRET;
   await withConflictRetry(() => lambda2.updateFunctionConfiguration({ FunctionName: httpName, Environment: { Variables: env2 } }));
+  if ((ctx.app.provisionedConcurrency ?? 0) > 0) {
+    await lambda2.waitForFunctionActive(httpName, 120);
+    await publishAndFlip(lambda2, httpName);
+  }
   success(enabled ? "Application is now in maintenance mode (503)" : "Application is live");
 }
 async function runRemoteCommand(config6, environment, command) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stacksjs/ts-cloud",
   "type": "module",
-  "version": "0.5.7",
+  "version": "0.5.9",
   "description": "A lightweight, performant infrastructure-as-code library and CLI for deploying both server-based (EC2) and serverless applications.",
   "author": "Chris Breuer <chris@stacksjs.com>",
   "license": "MIT",
@@ -89,8 +89,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.5.7",
-    "@ts-cloud/core": "0.5.7",
+    "@ts-cloud/aws-types": "0.5.9",
+    "@ts-cloud/core": "0.5.9",
     "@stacksjs/ts-xml": "^0.1.0"
   },
   "devDependencies": {