@ts-cloud/core 0.5.0 → 0.5.1

package/dist/index.js

@@ -45517,6 +45517,7 @@ function composeServerlessAppTemplate(opts) {
     TSCLOUD_LAMBDA_MODE: mode,
     TSCLOUD_ENV: environment,
     ...app.octane ? { TSCLOUD_OCTANE: "1" } : {},
+    ...app.scheduler === "sub-minute" ? { TSCLOUD_SCHEDULER: "sub-minute" } : {},
     ...cacheEnabled ? { TSCLOUD_CACHE_TABLE: `${slug}-${environment}-cache` } : {},
     ...hasQueue ? { TSCLOUD_QUEUE: queueNames[0] } : {},
     ...app.env ?? {}
@@ -45536,7 +45537,7 @@ function composeServerlessAppTemplate(opts) {
       ]
     }
   } : {};
-  function addFunction(logicalId, name, handler8, mode, memory, timeout, reservedConcurrency) {
+  function addFunction(logicalId, name, handler8, mode, memory, timeout, reservedConcurrency, tmp = tmpStorage) {
     resources[`${logicalId}LogGroup`] = {
       Type: "AWS::Logs::LogGroup",
       Properties: { LogGroupName: `/aws/lambda/${name}`, RetentionInDays: 14 }
@@ -45561,17 +45562,17 @@ function composeServerlessAppTemplate(opts) {
         Timeout: timeout,
         Role: Fn2.getAtt("AppRole", "Arn"),
         Environment: { Variables: baseEnv(mode) },
-        EphemeralStorage: { Size: tmpStorage },
+        EphemeralStorage: { Size: tmp },
         ...codeProps,
         ...reservedConcurrency !== undefined ? { ReservedConcurrentExecutions: reservedConcurrency } : {},
         ...vpcConfig
       }
     };
   }
-  addFunction("HttpFunction", functionNames.http, handlers.http, "http", app.memory ?? 1024, app.timeout ?? 28, app.concurrency);
-  addFunction("CliFunction", functionNames.cli, handlers.cli, "cli", app.cliMemory ?? 1024, app.cliTimeout ?? 900);
+  addFunction("HttpFunction", functionNames.http, handlers.http, "http", app.memory ?? 1024, app.timeout ?? 28, app.concurrency, tmpStorage);
+  addFunction("CliFunction", functionNames.cli, handlers.cli, "cli", app.cliMemory ?? 1024, app.cliTimeout ?? 900, undefined, app.cliTmpStorage ?? tmpStorage);
   if (hasQueue)
-    addFunction("QueueFunction", functionNames.queue, handlers.queue, "queue", app.queueMemory ?? 1024, app.queueTimeout ?? 120);
+    addFunction("QueueFunction", functionNames.queue, handlers.queue, "queue", app.queueMemory ?? 1024, app.queueTimeout ?? 120, undefined, app.queueTmpStorage ?? tmpStorage);
   resources.HttpApi = {
     Type: "AWS::ApiGatewayV2::Api",
     Properties: {
@@ -45618,6 +45619,59 @@ function composeServerlessAppTemplate(opts) {
     Value: Fn2.getAtt("HttpApi", "ApiEndpoint")
   };
   outputs.HttpApiId = { Description: "HTTP API id", Value: Fn2.ref("HttpApi") };
+  const domains = (Array.isArray(app.domain) ? app.domain : app.domain ? [app.domain] : []).filter(Boolean);
+  if (domains.length) {
+    if (!app.certificateArn && !app.hostedZoneId) {
+      throw new Error("serverless app: a custom `domain` needs either `certificateArn` (pre-issued, regional) or `hostedZoneId` (to auto-issue + validate an ACM cert).");
+    }
+    let certRef = app.certificateArn;
+    if (!certRef) {
+      resources.HttpCertificate = {
+        Type: "AWS::CertificateManager::Certificate",
+        Properties: {
+          DomainName: domains[0],
+          ...domains.length > 1 ? { SubjectAlternativeNames: domains.slice(1) } : {},
+          ValidationMethod: "DNS",
+          DomainValidationOptions: domains.map((d) => ({ DomainName: d, HostedZoneId: app.hostedZoneId }))
+        }
+      };
+      certRef = Fn2.ref("HttpCertificate");
+    }
+    domains.forEach((d, i) => {
+      const dn = `HttpDomain${i}`;
+      resources[dn] = {
+        Type: "AWS::ApiGatewayV2::DomainName",
+        Properties: {
+          DomainName: d,
+          DomainNameConfigurations: [{ CertificateArn: certRef, EndpointType: "REGIONAL" }]
+        }
+      };
+      resources[`HttpApiMapping${i}`] = {
+        Type: "AWS::ApiGatewayV2::ApiMapping",
+        DependsOn: ["HttpStage"],
+        Properties: { ApiId: Fn2.ref("HttpApi"), DomainName: Fn2.ref(dn), Stage: "$default" }
+      };
+      if (app.hostedZoneId) {
+        resources[`HttpDomainRecord${i}`] = {
+          Type: "AWS::Route53::RecordSet",
+          Properties: {
+            HostedZoneId: app.hostedZoneId,
+            Name: d,
+            Type: "A",
+            AliasTarget: {
+              DNSName: Fn2.getAtt(dn, "RegionalDomainName"),
+              HostedZoneId: Fn2.getAtt(dn, "RegionalHostedZoneId")
+            }
+          }
+        };
+      }
+      outputs[`CustomDomain${i}`] = { Description: `Custom domain ${d}`, Value: d };
+      outputs[`CustomDomainTarget${i}`] = {
+        Description: `Point ${d} (CNAME/alias) at this APIGW regional domain`,
+        Value: Fn2.getAtt(dn, "RegionalDomainName")
+      };
+    });
+  }
   if (hasQueue) {
     resources.AppQueueDlq = {
       Type: "AWS::SQS::Queue",

package/dist/types.d.ts

@@ -949,6 +949,23 @@ export interface SiteConfig {
      * process.env.UI_PASSWORD }`. The htpasswd file is generated on the box.
      */
     auth?: SiteAuthConfig;
+    /**
+     * Package-registry credentials written into the release before
+     * `composer install` / `npm install` so private packages resolve (Forge's
+     * Composer/npm credentials feature).
+     */
+    credentials?: SiteCredentialsConfig;
+}
+/** Private package-registry credentials for a site's build. */
+export interface SiteCredentialsConfig {
+    /**
+     * Composer `auth.json` contents — an object (serialized to JSON) or a
+     * ready-made JSON string. Written to the release root before `composer
+     * install` (e.g. `{ 'github-oauth': { 'github.com': '<token>' } }`).
+     */
+    composerAuth?: Record<string, unknown> | string;
+    /** `.npmrc` contents written to the release root before `npm install`. */
+    npmrc?: string;
 }
 /** HTTP Basic auth for a site's nginx vhost. See {@link SiteConfig.auth}. */
 export interface SiteAuthConfig {
@@ -1006,6 +1023,32 @@ export interface SiteSslConfig {
     certPath?: string;
     /** Path to the private key (PEM) when `provider: 'custom'`. */
     keyPath?: string;
+    /**
+     * Issue a **wildcard** certificate (`*.<domain>` + `<domain>`). Requires
+     * DNS-01 validation, so {@link dns} must be set. The nginx plugin can't do
+     * wildcards (that needs HTTP-01 per host).
+     */
+    wildcard?: boolean;
+    /**
+     * Use DNS-01 validation via a certbot DNS plugin instead of the nginx
+     * (HTTP-01) challenge. Needed for wildcard certs and for issuing before the
+     * domain resolves to the box. The plugin + credentials are wired on the box.
+     */
+    dns?: SslDnsConfig;
+}
+/** certbot DNS-01 plugin configuration for DNS-validated / wildcard certs. */
+export interface SslDnsConfig {
+    /** DNS provider whose certbot plugin handles the `_acme-challenge` records. */
+    provider: 'cloudflare' | 'route53' | 'digitalocean' | 'google';
+    /**
+     * Provider credentials written to a root-only INI certbot reads
+     * (`--dns-<provider>-credentials`). For route53, AWS env/instance-role creds
+     * are used instead, so this may be omitted. Keys are provider-specific, e.g.
+     * `{ dns_cloudflare_api_token: '…' }`.
+     */
+    credentials?: Record<string, string>;
+    /** Seconds to wait for DNS propagation before certbot asks the CA to verify. */
+    propagationSeconds?: number;
 }
 /**
  * A Laravel queue worker (or Horizon supervisor) run as a systemd service.
@@ -1123,6 +1166,34 @@ export interface DatabaseConfig {
     host?: string;
     /** Port (defaults: mysql/mariadb 3306, postgres 5432). */
     port?: number;
+    /**
+     * Additional database users to create beyond the app {@link username}
+     * (the Forge Database Users feature). Each can be granted full or read-only
+     * access to one or more databases. Created at provision time on the on-box
+     * engine.
+     */
+    users?: DatabaseUserConfig[];
+}
+/**
+ * An extra database user provisioned on the on-box engine (per-user grants).
+ * Beyond the application user, you can create reporting/read-only accounts or
+ * service-specific logins with their own access scope.
+ */
+export interface DatabaseUserConfig {
+    /** User name to create. */
+    username: string;
+    /** Password for the user. */
+    password: string;
+    /**
+     * Databases this user may access. Defaults to the app database
+     * ({@link DatabaseConfig.name}) when omitted.
+     */
+    databases?: string[];
+    /**
+     * Access level granted on {@link databases}. `all` (default) is full
+     * read/write; `readonly` grants SELECT only (plus connect on Postgres).
+     */
+    access?: 'all' | 'readonly';
 }
 export interface CacheConfig {
     type?: 'redis' | 'memcached';
@@ -1530,8 +1601,12 @@ export interface ServerlessAppConfig {
     rdsProxy?: boolean | {
         name?: string;
     };
-    /** Ephemeral `/tmp` size in MB (512–10240). @default 512 */
+    /** Ephemeral storage in MB (512 to 10240) for the HTTP function. @default 512 */
     tmpStorage?: number;
+    /** Ephemeral storage in MB for the CLI function. @default tmpStorage */
+    cliTmpStorage?: number;
+    /** Ephemeral storage in MB for the queue function. @default tmpStorage */
+    queueTmpStorage?: number;
     /** Database attachment. */
     database?: {
         connection?: 'rds-proxy' | 'aurora-serverless' | 'rds';
@@ -1548,10 +1623,17 @@ export interface ServerlessAppConfig {
     };
     /** Managed WAF in front of the HTTP API / CloudFront. */
     firewall?: WafConfig;
-    /** Custom domain for the app (overrides {@link EnvironmentConfig.domain}). */
+    /** Custom domain(s) for the app's HTTP API (overrides {@link EnvironmentConfig.domain}). */
     domain?: string | string[];
-    /** Pre-issued ACM certificate ARN for the custom domain. */
+    /** Pre-issued ACM certificate ARN for the custom domain (regional, same region). */
     certificateArn?: string;
+    /**
+     * Route53 hosted zone ID for the custom domain. When set (and no
+     * `certificateArn`), ts-cloud issues + DNS-validates an ACM cert and creates
+     * the alias record automatically. Without it, supply `certificateArn` and
+     * point your DNS at the API's regional domain (emitted as a stack output).
+     */
+    hostedZoneId?: string;
     /** Local directory whose contents are uploaded to S3/CloudFront as versioned assets. */
     assets?: string;
     /** PHP version for the runtime layer. @default '8.3' */
@@ -3191,7 +3273,7 @@ export interface RealtimeHooksConfig {
  * })
  *
  * // Private channel
- * Echo.private(`user.${userId}`).listen('notification', (e) => {
+ * Echo.private('user.' + userId).listen('notification', (e) => {
  *   console.log('Private notification:', e)
  * })
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ts-cloud/core",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "type": "module",
   "description": "Core CloudFormation generation library for ts-cloud",
   "author": "Chris Breuer <chris@stacksjs.com>",
@@ -31,7 +31,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.5.0"
+    "@ts-cloud/aws-types": "0.5.1"
   },
   "devDependencies": {
     "typescript": "^5.9.3"