@ts-cloud/core 0.5.0 → 0.5.2

package/dist/index.js

@@ -45517,15 +45517,21 @@ function composeServerlessAppTemplate(opts) {
     TSCLOUD_LAMBDA_MODE: mode,
     TSCLOUD_ENV: environment,
     ...app.octane ? { TSCLOUD_OCTANE: "1" } : {},
+    ...app.scheduler === "sub-minute" ? { TSCLOUD_SCHEDULER: "sub-minute" } : {},
     ...cacheEnabled ? { TSCLOUD_CACHE_TABLE: `${slug}-${environment}-cache` } : {},
     ...hasQueue ? { TSCLOUD_QUEUE: queueNames[0] } : {},
     ...app.env ?? {}
   });
+  const efsEnabled = Boolean(app.efs);
+  const efsOpts = typeof app.efs === "object" ? app.efs : {};
+  const efsMountPath = efsOpts.mountPath ?? "/mnt/local";
+  const efsProvision = efsEnabled && !efsOpts.accessPointArn;
+  const efsAccessPoint = efsOpts.accessPointArn ?? (efsProvision ? Fn2.getAtt("EfsAccessPoint", "Arn") : undefined);
   const subnets = app.vpc?.subnets ?? [];
   const hasVpc = subnets.length > 0;
-  const needsDataVpc = app.cache?.driver === "elasticache" || app.database?.connection === "aurora-serverless" || Boolean(app.rdsProxy);
+  const needsDataVpc = app.cache?.driver === "elasticache" || app.database?.connection === "aurora-serverless" || Boolean(app.rdsProxy) || efsEnabled;
   if (needsDataVpc && !hasVpc) {
-    throw new Error("serverless app: elasticache / aurora-serverless / rdsProxy require app.vpc.subnets (private subnets) to be set.");
+    throw new Error("serverless app: elasticache / aurora-serverless / rdsProxy / efs require app.vpc.subnets (private subnets) to be set.");
   }
   const vpcConfig = hasVpc ? {
     VpcConfig: {
@@ -45536,7 +45542,16 @@ function composeServerlessAppTemplate(opts) {
       ]
     }
   } : {};
-  function addFunction(logicalId, name, handler8, mode, memory, timeout, reservedConcurrency) {
+  const efsDependsOn = efsProvision ? subnets.map((_, i) => `EfsMountTarget${i}`) : [];
+  const efsConfig = efsEnabled ? { FileSystemConfigs: [{ Arn: efsAccessPoint, LocalMountPath: efsMountPath }] } : {};
+  if (efsEnabled) {
+    inlinePolicies[0].PolicyDocument.Statement.push({
+      Effect: "Allow",
+      Action: ["elasticfilesystem:ClientMount", "elasticfilesystem:ClientWrite", "elasticfilesystem:ClientRootAccess", "elasticfilesystem:DescribeMountTargets"],
+      Resource: "*"
+    });
+  }
+  function addFunction(logicalId, name, handler8, mode, memory, timeout, reservedConcurrency, tmp = tmpStorage) {
     resources[`${logicalId}LogGroup`] = {
       Type: "AWS::Logs::LogGroup",
       Properties: { LogGroupName: `/aws/lambda/${name}`, RetentionInDays: 14 }
@@ -45553,7 +45568,7 @@ function composeServerlessAppTemplate(opts) {
     };
     resources[logicalId] = {
       Type: "AWS::Lambda::Function",
-      DependsOn: [`${logicalId}LogGroup`],
+      DependsOn: [`${logicalId}LogGroup`, ...efsDependsOn],
       Properties: {
         FunctionName: name,
         Architectures: [architecture],
@@ -45561,17 +45576,18 @@ function composeServerlessAppTemplate(opts) {
         Timeout: timeout,
         Role: Fn2.getAtt("AppRole", "Arn"),
         Environment: { Variables: baseEnv(mode) },
-        EphemeralStorage: { Size: tmpStorage },
+        EphemeralStorage: { Size: tmp },
         ...codeProps,
         ...reservedConcurrency !== undefined ? { ReservedConcurrentExecutions: reservedConcurrency } : {},
-        ...vpcConfig
+        ...vpcConfig,
+        ...efsConfig
       }
     };
   }
-  addFunction("HttpFunction", functionNames.http, handlers.http, "http", app.memory ?? 1024, app.timeout ?? 28, app.concurrency);
-  addFunction("CliFunction", functionNames.cli, handlers.cli, "cli", app.cliMemory ?? 1024, app.cliTimeout ?? 900);
+  addFunction("HttpFunction", functionNames.http, handlers.http, "http", app.memory ?? 1024, app.timeout ?? 28, app.concurrency, tmpStorage);
+  addFunction("CliFunction", functionNames.cli, handlers.cli, "cli", app.cliMemory ?? 1024, app.cliTimeout ?? 900, undefined, app.cliTmpStorage ?? tmpStorage);
   if (hasQueue)
-    addFunction("QueueFunction", functionNames.queue, handlers.queue, "queue", app.queueMemory ?? 1024, app.queueTimeout ?? 120);
+    addFunction("QueueFunction", functionNames.queue, handlers.queue, "queue", app.queueMemory ?? 1024, app.queueTimeout ?? 120, undefined, app.queueTmpStorage ?? tmpStorage);
   resources.HttpApi = {
     Type: "AWS::ApiGatewayV2::Api",
     Properties: {
@@ -45618,6 +45634,59 @@ function composeServerlessAppTemplate(opts) {
     Value: Fn2.getAtt("HttpApi", "ApiEndpoint")
   };
   outputs.HttpApiId = { Description: "HTTP API id", Value: Fn2.ref("HttpApi") };
+  const domains = (Array.isArray(app.domain) ? app.domain : app.domain ? [app.domain] : []).filter(Boolean);
+  if (domains.length) {
+    if (!app.certificateArn && !app.hostedZoneId) {
+      throw new Error("serverless app: a custom `domain` needs either `certificateArn` (pre-issued, regional) or `hostedZoneId` (to auto-issue + validate an ACM cert).");
+    }
+    let certRef = app.certificateArn;
+    if (!certRef) {
+      resources.HttpCertificate = {
+        Type: "AWS::CertificateManager::Certificate",
+        Properties: {
+          DomainName: domains[0],
+          ...domains.length > 1 ? { SubjectAlternativeNames: domains.slice(1) } : {},
+          ValidationMethod: "DNS",
+          DomainValidationOptions: domains.map((d) => ({ DomainName: d, HostedZoneId: app.hostedZoneId }))
+        }
+      };
+      certRef = Fn2.ref("HttpCertificate");
+    }
+    domains.forEach((d, i) => {
+      const dn = `HttpDomain${i}`;
+      resources[dn] = {
+        Type: "AWS::ApiGatewayV2::DomainName",
+        Properties: {
+          DomainName: d,
+          DomainNameConfigurations: [{ CertificateArn: certRef, EndpointType: "REGIONAL" }]
+        }
+      };
+      resources[`HttpApiMapping${i}`] = {
+        Type: "AWS::ApiGatewayV2::ApiMapping",
+        DependsOn: ["HttpStage"],
+        Properties: { ApiId: Fn2.ref("HttpApi"), DomainName: Fn2.ref(dn), Stage: "$default" }
+      };
+      if (app.hostedZoneId) {
+        resources[`HttpDomainRecord${i}`] = {
+          Type: "AWS::Route53::RecordSet",
+          Properties: {
+            HostedZoneId: app.hostedZoneId,
+            Name: d,
+            Type: "A",
+            AliasTarget: {
+              DNSName: Fn2.getAtt(dn, "RegionalDomainName"),
+              HostedZoneId: Fn2.getAtt(dn, "RegionalHostedZoneId")
+            }
+          }
+        };
+      }
+      outputs[`CustomDomain${i}`] = { Description: `Custom domain ${d}`, Value: d };
+      outputs[`CustomDomainTarget${i}`] = {
+        Description: `Point ${d} (CNAME/alias) at this APIGW regional domain`,
+        Value: Fn2.getAtt(dn, "RegionalDomainName")
+      };
+    });
+  }
   if (hasQueue) {
     resources.AppQueueDlq = {
       Type: "AWS::SQS::Queue",
@@ -45760,10 +45829,37 @@ function composeServerlessAppTemplate(opts) {
             DomainName: Fn2.getAtt("AssetsBucket", "RegionalDomainName"),
             OriginAccessControlId: Fn2.ref("AssetsOAC"),
             S3OriginConfig: { OriginAccessIdentity: "" }
-          }]
-        }
+          }],
+          ...app.assetDomain ? {
+            Aliases: [app.assetDomain],
+            ViewerCertificate: {
+              AcmCertificateArn: app.assetCertificateArn,
+              SslSupportMethod: "sni-only",
+              MinimumProtocolVersion: "TLSv1.2_2021"
+            }
+          } : {}
+        }
+      }
+    };
+    if (app.assetDomain) {
+      if (!app.assetCertificateArn)
+        throw new Error("serverless app: `assetDomain` requires `assetCertificateArn` (a us-east-1 ACM cert — CloudFront only accepts certs from us-east-1).");
+      if (app.hostedZoneId) {
+        resources.AssetsDomainRecord = {
+          Type: "AWS::Route53::RecordSet",
+          Properties: {
+            HostedZoneId: app.hostedZoneId,
+            Name: app.assetDomain,
+            Type: "A",
+            AliasTarget: {
+              DNSName: Fn2.getAtt("AssetsDistribution", "DomainName"),
+              HostedZoneId: "Z2FDTNDATAQYW2"
+            }
+          }
+        };
       }
-    };
+      outputs.AssetDomain = { Description: "Custom asset CDN host", Value: app.assetDomain };
+    }
     resources.AssetsBucketPolicy = {
       Type: "AWS::S3::BucketPolicy",
       Properties: {
@@ -45842,6 +45938,37 @@ function composeServerlessAppTemplate(opts) {
       }
     };
   }
+  if (efsProvision) {
+    resources.EfsFileSystem = {
+      Type: "AWS::EFS::FileSystem",
+      Properties: {
+        Encrypted: true,
+        FileSystemTags: [{ Key: "Name", Value: `${slug}-${environment}-efs` }]
+      }
+    };
+    subnets.forEach((subnetId, i) => {
+      resources[`EfsMountTarget${i}`] = {
+        Type: "AWS::EFS::MountTarget",
+        Properties: {
+          FileSystemId: Fn2.ref("EfsFileSystem"),
+          SubnetId: subnetId,
+          SecurityGroups: [Fn2.getAtt("DataSecurityGroup", "GroupId")]
+        }
+      };
+    });
+    resources.EfsAccessPoint = {
+      Type: "AWS::EFS::AccessPoint",
+      Properties: {
+        FileSystemId: Fn2.ref("EfsFileSystem"),
+        PosixUser: { Uid: 1001, Gid: 1001 },
+        RootDirectory: {
+          Path: "/lambda",
+          CreationInfo: { OwnerUid: 1001, OwnerGid: 1001, Permissions: "0755" }
+        }
+      }
+    };
+    outputs.EfsFileSystemId = { Description: "EFS file system id", Value: Fn2.ref("EfsFileSystem") };
+  }
   if (app.cache?.driver === "elasticache") {
     resources.CacheSubnetGroup = {
       Type: "AWS::ElastiCache::SubnetGroup",

package/dist/types.d.ts

@@ -918,9 +918,10 @@ export interface SiteConfig {
     queues?: QueueWorkerConfig[];
     /**
      * Run the Laravel scheduler for this site
-     * (`* * * * * php artisan schedule:run`).
+     * (`* * * * * php artisan schedule:run`). `true` enables it with defaults;
+     * pass a {@link SchedulerConfig} to attach heartbeat monitoring.
      */
-    scheduler?: boolean;
+    scheduler?: boolean | SchedulerConfig;
     /** Arbitrary long-running processes to keep alive (systemd-managed). */
     daemons?: DaemonConfig[];
     /** TLS configuration for this site's nginx vhost. */
@@ -949,6 +950,46 @@ export interface SiteConfig {
      * process.env.UI_PASSWORD }`. The htpasswd file is generated on the box.
      */
     auth?: SiteAuthConfig;
+    /**
+     * Package-registry credentials written into the release before
+     * `composer install` / `npm install` so private packages resolve (Forge's
+     * Composer/npm credentials feature).
+     */
+    credentials?: SiteCredentialsConfig;
+    /**
+     * Custom nginx for this site's vhost (Forge's "Edit Nginx Configuration").
+     * Directives are injected into the generated `server { … }` block, so the
+     * managed root/locations/SSL still apply.
+     */
+    nginx?: SiteNginxConfig;
+}
+/** Per-site nginx customization injected into the generated server block. */
+export interface SiteNginxConfig {
+    /**
+     * Name of a reusable template defined in
+     * {@link ComputeConfig.nginxTemplates}. Its directive lines are injected into
+     * this site's server block.
+     */
+    template?: string;
+    /**
+     * Raw nginx directive lines added to this site's server block (after the
+     * managed directives), e.g. `['gzip on;', 'location /metrics { deny all; }']`.
+     * Applied on top of {@link template} when both are set.
+     */
+    serverSnippet?: string[];
+    /** `client_max_body_size` for this vhost (e.g. `'256M'`) for large uploads. */
+    clientMaxBodySize?: string;
+}
+/** Private package-registry credentials for a site's build. */
+export interface SiteCredentialsConfig {
+    /**
+     * Composer `auth.json` contents — an object (serialized to JSON) or a
+     * ready-made JSON string. Written to the release root before `composer
+     * install` (e.g. `{ 'github-oauth': { 'github.com': '<token>' } }`).
+     */
+    composerAuth?: Record<string, unknown> | string;
+    /** `.npmrc` contents written to the release root before `npm install`. */
+    npmrc?: string;
 }
 /** HTTP Basic auth for a site's nginx vhost. See {@link SiteConfig.auth}. */
 export interface SiteAuthConfig {
@@ -1006,6 +1047,48 @@ export interface SiteSslConfig {
     certPath?: string;
     /** Path to the private key (PEM) when `provider: 'custom'`. */
     keyPath?: string;
+    /**
+     * Issue a **wildcard** certificate (`*.<domain>` + `<domain>`). Requires
+     * DNS-01 validation, so {@link dns} must be set. The nginx plugin can't do
+     * wildcards (that needs HTTP-01 per host).
+     */
+    wildcard?: boolean;
+    /**
+     * Use DNS-01 validation via a certbot DNS plugin instead of the nginx
+     * (HTTP-01) challenge. Needed for wildcard certs and for issuing before the
+     * domain resolves to the box. The plugin + credentials are wired on the box.
+     */
+    dns?: SslDnsConfig;
+}
+/** certbot DNS-01 plugin configuration for DNS-validated / wildcard certs. */
+export interface SslDnsConfig {
+    /** DNS provider whose certbot plugin handles the `_acme-challenge` records. */
+    provider: 'cloudflare' | 'route53' | 'digitalocean' | 'google';
+    /**
+     * Provider credentials written to a root-only INI certbot reads
+     * (`--dns-<provider>-credentials`). For route53, AWS env/instance-role creds
+     * are used instead, so this may be omitted. Keys are provider-specific, e.g.
+     * `{ dns_cloudflare_api_token: '…' }`.
+     */
+    credentials?: Record<string, string>;
+    /** Seconds to wait for DNS propagation before certbot asks the CA to verify. */
+    propagationSeconds?: number;
+}
+/**
+ * Laravel scheduler options for a site (Forge's scheduler + heartbeat
+ * monitoring). The scheduler runs `php artisan schedule:run` every minute.
+ */
+export interface SchedulerConfig {
+    /**
+     * Heartbeat monitor URL pinged after each successful `schedule:run`
+     * (healthchecks.io, Oh Dear, Better Uptime, …). If the scheduler stops, the
+     * monitor stops receiving pings and alerts you.
+     */
+    heartbeatUrl?: string;
+    /**
+     * HTTP method for the heartbeat ping. @default 'GET'
+     */
+    heartbeatMethod?: 'GET' | 'POST' | 'HEAD';
 }
 /**
  * A Laravel queue worker (or Horizon supervisor) run as a systemd service.
@@ -1123,6 +1206,34 @@ export interface DatabaseConfig {
     host?: string;
     /** Port (defaults: mysql/mariadb 3306, postgres 5432). */
     port?: number;
+    /**
+     * Additional database users to create beyond the app {@link username}
+     * (the Forge Database Users feature). Each can be granted full or read-only
+     * access to one or more databases. Created at provision time on the on-box
+     * engine.
+     */
+    users?: DatabaseUserConfig[];
+}
+/**
+ * An extra database user provisioned on the on-box engine (per-user grants).
+ * Beyond the application user, you can create reporting/read-only accounts or
+ * service-specific logins with their own access scope.
+ */
+export interface DatabaseUserConfig {
+    /** User name to create. */
+    username: string;
+    /** Password for the user. */
+    password: string;
+    /**
+     * Databases this user may access. Defaults to the app database
+     * ({@link DatabaseConfig.name}) when omitted.
+     */
+    databases?: string[];
+    /**
+     * Access level granted on {@link databases}. `all` (default) is full
+     * read/write; `readonly` grants SELECT only (plus connect on Postgres).
+     */
+    access?: 'all' | 'readonly';
 }
 export interface CacheConfig {
     type?: 'redis' | 'memcached';
@@ -1530,8 +1641,12 @@ export interface ServerlessAppConfig {
     rdsProxy?: boolean | {
         name?: string;
     };
-    /** Ephemeral `/tmp` size in MB (512–10240). @default 512 */
+    /** Ephemeral storage in MB (512 to 10240) for the HTTP function. @default 512 */
     tmpStorage?: number;
+    /** Ephemeral storage in MB for the CLI function. @default tmpStorage */
+    cliTmpStorage?: number;
+    /** Ephemeral storage in MB for the queue function. @default tmpStorage */
+    queueTmpStorage?: number;
     /** Database attachment. */
     database?: {
         connection?: 'rds-proxy' | 'aurora-serverless' | 'rds';
@@ -1546,14 +1661,46 @@ export interface ServerlessAppConfig {
     storage?: {
         bucket?: string;
     };
+    /**
+     * Mount a shared Elastic File System on the functions (Vapor's `/mnt/local`).
+     * Requires a VPC. `true` provisions an EFS file system + access point;
+     * otherwise attach an existing access point by ARN. The mount path defaults
+     * to `/mnt/local`.
+     */
+    efs?: boolean | {
+        /** Existing EFS Access Point ARN to attach (skips provisioning). */
+        accessPointArn?: string;
+        /** Mount path inside the functions. @default '/mnt/local' */
+        mountPath?: string;
+    };
     /** Managed WAF in front of the HTTP API / CloudFront. */
     firewall?: WafConfig;
-    /** Custom domain for the app (overrides {@link EnvironmentConfig.domain}). */
+    /** Custom domain(s) for the app's HTTP API (overrides {@link EnvironmentConfig.domain}). */
     domain?: string | string[];
-    /** Pre-issued ACM certificate ARN for the custom domain. */
+    /** Pre-issued ACM certificate ARN for the custom domain (regional, same region). */
     certificateArn?: string;
+    /**
+     * Route53 hosted zone ID for the custom domain. When set (and no
+     * `certificateArn`), ts-cloud issues + DNS-validates an ACM cert and creates
+     * the alias record automatically. Without it, supply `certificateArn` and
+     * point your DNS at the API's regional domain (emitted as a stack output).
+     */
+    hostedZoneId?: string;
     /** Local directory whose contents are uploaded to S3/CloudFront as versioned assets. */
     assets?: string;
+    /**
+     * Serve assets from a custom CDN host instead of the default CloudFront domain
+     * (Vapor `asset-domain`). Requires a us-east-1 ACM cert via assetCertificateArn.
+     */
+    assetDomain?: string;
+    /** us-east-1 ACM certificate ARN for {@link assetDomain} (CloudFront requirement). */
+    assetCertificateArn?: string;
+    /** Include dotfiles when uploading assets (Vapor `dot-files-as-assets`). @default false */
+    dotFilesAsAssets?: boolean;
+    /** Serve assets from the app/root domain too (Vapor `serve_assets`). Injected as env. */
+    serveAssets?: boolean;
+    /** Redirect robots.txt to the asset CDN (Vapor `redirect_robots_txt`). Injected as env. @default true */
+    redirectRobotsTxt?: boolean;
     /** PHP version for the runtime layer. @default '8.3' */
     phpVersion?: PhpVersion;
     /** CPU architecture. @default 'x86_64' */
@@ -2059,6 +2206,13 @@ export interface ComputeConfig {
      * @default 'nginx'
      */
     webServer?: 'nginx' | 'rpx';
+    /**
+     * Reusable nginx config templates, keyed by name. A site references one via
+     * `site.nginx.template`, and its directive lines are injected into that
+     * site's server block — define a hardening/caching/proxy snippet once and
+     * share it across sites (Forge's nginx templates).
+     */
+    nginxTemplates?: Record<string, string[]>;
     /**
      * On-box managed services to install (Forge's single-server model): the
      * database engine, cache, and search. Each may be `true` for defaults or an
@@ -2146,6 +2300,19 @@ export interface ComputePhpConfig {
      * e.g. `['imagick', 'swoole']`.
      */
     extensions?: string[];
+    /**
+     * Apply the production OPcache + php.ini tuning (Forge's "Optimize for
+     * Production"): OPcache on with timestamp validation off, larger file/string
+     * buffers, and a bigger realpath cache. Deploys restart php-fpm, so disabled
+     * timestamp validation is safe. @default true
+     */
+    optimizeForProduction?: boolean;
+    /**
+     * Extra `php.ini` directives merged on top of the production tuning (and
+     * applied even when {@link optimizeForProduction} is false), e.g.
+     * `{ memory_limit: '512M', upload_max_filesize: '128M' }`.
+     */
+    ini?: Record<string, string>;
 }
 /**
  * On-box managed services (database / cache / search) for a compute box.
@@ -3191,7 +3358,7 @@ export interface RealtimeHooksConfig {
  * })
  *
  * // Private channel
- * Echo.private(`user.${userId}`).listen('notification', (e) => {
+ * Echo.private('user.' + userId).listen('notification', (e) => {
  *   console.log('Private notification:', e)
  * })
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ts-cloud/core",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "type": "module",
   "description": "Core CloudFormation generation library for ts-cloud",
   "author": "Chris Breuer <chris@stacksjs.com>",
@@ -31,7 +31,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.5.0"
+    "@ts-cloud/aws-types": "0.5.2"
   },
   "devDependencies": {
     "typescript": "^5.9.3"