@ts-cloud/core 0.5.1 → 0.5.2

package/dist/index.js

@@ -45522,11 +45522,16 @@ function composeServerlessAppTemplate(opts) {
     ...hasQueue ? { TSCLOUD_QUEUE: queueNames[0] } : {},
     ...app.env ?? {}
   });
+  const efsEnabled = Boolean(app.efs);
+  const efsOpts = typeof app.efs === "object" ? app.efs : {};
+  const efsMountPath = efsOpts.mountPath ?? "/mnt/local";
+  const efsProvision = efsEnabled && !efsOpts.accessPointArn;
+  const efsAccessPoint = efsOpts.accessPointArn ?? (efsProvision ? Fn2.getAtt("EfsAccessPoint", "Arn") : undefined);
   const subnets = app.vpc?.subnets ?? [];
   const hasVpc = subnets.length > 0;
-  const needsDataVpc = app.cache?.driver === "elasticache" || app.database?.connection === "aurora-serverless" || Boolean(app.rdsProxy);
+  const needsDataVpc = app.cache?.driver === "elasticache" || app.database?.connection === "aurora-serverless" || Boolean(app.rdsProxy) || efsEnabled;
   if (needsDataVpc && !hasVpc) {
-    throw new Error("serverless app: elasticache / aurora-serverless / rdsProxy require app.vpc.subnets (private subnets) to be set.");
+    throw new Error("serverless app: elasticache / aurora-serverless / rdsProxy / efs require app.vpc.subnets (private subnets) to be set.");
   }
   const vpcConfig = hasVpc ? {
     VpcConfig: {
@@ -45537,6 +45542,15 @@ function composeServerlessAppTemplate(opts) {
       ]
     }
   } : {};
+  const efsDependsOn = efsProvision ? subnets.map((_, i) => `EfsMountTarget${i}`) : [];
+  const efsConfig = efsEnabled ? { FileSystemConfigs: [{ Arn: efsAccessPoint, LocalMountPath: efsMountPath }] } : {};
+  if (efsEnabled) {
+    inlinePolicies[0].PolicyDocument.Statement.push({
+      Effect: "Allow",
+      Action: ["elasticfilesystem:ClientMount", "elasticfilesystem:ClientWrite", "elasticfilesystem:ClientRootAccess", "elasticfilesystem:DescribeMountTargets"],
+      Resource: "*"
+    });
+  }
   function addFunction(logicalId, name, handler8, mode, memory, timeout, reservedConcurrency, tmp = tmpStorage) {
     resources[`${logicalId}LogGroup`] = {
       Type: "AWS::Logs::LogGroup",
@@ -45554,7 +45568,7 @@ function composeServerlessAppTemplate(opts) {
     };
     resources[logicalId] = {
       Type: "AWS::Lambda::Function",
-      DependsOn: [`${logicalId}LogGroup`],
+      DependsOn: [`${logicalId}LogGroup`, ...efsDependsOn],
       Properties: {
         FunctionName: name,
         Architectures: [architecture],
@@ -45565,7 +45579,8 @@ function composeServerlessAppTemplate(opts) {
         EphemeralStorage: { Size: tmp },
         ...codeProps,
         ...reservedConcurrency !== undefined ? { ReservedConcurrentExecutions: reservedConcurrency } : {},
-        ...vpcConfig
+        ...vpcConfig,
+        ...efsConfig
       }
     };
   }
@@ -45814,10 +45829,37 @@ function composeServerlessAppTemplate(opts) {
             DomainName: Fn2.getAtt("AssetsBucket", "RegionalDomainName"),
             OriginAccessControlId: Fn2.ref("AssetsOAC"),
             S3OriginConfig: { OriginAccessIdentity: "" }
-          }]
+          }],
+          ...app.assetDomain ? {
+            Aliases: [app.assetDomain],
+            ViewerCertificate: {
+              AcmCertificateArn: app.assetCertificateArn,
+              SslSupportMethod: "sni-only",
+              MinimumProtocolVersion: "TLSv1.2_2021"
+            }
+          } : {}
         }
       }
     };
+    if (app.assetDomain) {
+      if (!app.assetCertificateArn)
+        throw new Error("serverless app: `assetDomain` requires `assetCertificateArn` (a us-east-1 ACM cert — CloudFront only accepts certs from us-east-1).");
+      if (app.hostedZoneId) {
+        resources.AssetsDomainRecord = {
+          Type: "AWS::Route53::RecordSet",
+          Properties: {
+            HostedZoneId: app.hostedZoneId,
+            Name: app.assetDomain,
+            Type: "A",
+            AliasTarget: {
+              DNSName: Fn2.getAtt("AssetsDistribution", "DomainName"),
+              HostedZoneId: "Z2FDTNDATAQYW2"
+            }
+          }
+        };
+      }
+      outputs.AssetDomain = { Description: "Custom asset CDN host", Value: app.assetDomain };
+    }
     resources.AssetsBucketPolicy = {
       Type: "AWS::S3::BucketPolicy",
       Properties: {
@@ -45896,6 +45938,37 @@ function composeServerlessAppTemplate(opts) {
       }
     };
   }
+  if (efsProvision) {
+    resources.EfsFileSystem = {
+      Type: "AWS::EFS::FileSystem",
+      Properties: {
+        Encrypted: true,
+        FileSystemTags: [{ Key: "Name", Value: `${slug}-${environment}-efs` }]
+      }
+    };
+    subnets.forEach((subnetId, i) => {
+      resources[`EfsMountTarget${i}`] = {
+        Type: "AWS::EFS::MountTarget",
+        Properties: {
+          FileSystemId: Fn2.ref("EfsFileSystem"),
+          SubnetId: subnetId,
+          SecurityGroups: [Fn2.getAtt("DataSecurityGroup", "GroupId")]
+        }
+      };
+    });
+    resources.EfsAccessPoint = {
+      Type: "AWS::EFS::AccessPoint",
+      Properties: {
+        FileSystemId: Fn2.ref("EfsFileSystem"),
+        PosixUser: { Uid: 1001, Gid: 1001 },
+        RootDirectory: {
+          Path: "/lambda",
+          CreationInfo: { OwnerUid: 1001, OwnerGid: 1001, Permissions: "0755" }
+        }
+      }
+    };
+    outputs.EfsFileSystemId = { Description: "EFS file system id", Value: Fn2.ref("EfsFileSystem") };
+  }
   if (app.cache?.driver === "elasticache") {
     resources.CacheSubnetGroup = {
       Type: "AWS::ElastiCache::SubnetGroup",

package/dist/types.d.ts

@@ -918,9 +918,10 @@ export interface SiteConfig {
     queues?: QueueWorkerConfig[];
     /**
      * Run the Laravel scheduler for this site
-     * (`* * * * * php artisan schedule:run`).
+     * (`* * * * * php artisan schedule:run`). `true` enables it with defaults;
+     * pass a {@link SchedulerConfig} to attach heartbeat monitoring.
      */
-    scheduler?: boolean;
+    scheduler?: boolean | SchedulerConfig;
     /** Arbitrary long-running processes to keep alive (systemd-managed). */
     daemons?: DaemonConfig[];
     /** TLS configuration for this site's nginx vhost. */
@@ -955,6 +956,29 @@ export interface SiteConfig {
      * Composer/npm credentials feature).
      */
     credentials?: SiteCredentialsConfig;
+    /**
+     * Custom nginx for this site's vhost (Forge's "Edit Nginx Configuration").
+     * Directives are injected into the generated `server { … }` block, so the
+     * managed root/locations/SSL still apply.
+     */
+    nginx?: SiteNginxConfig;
+}
+/** Per-site nginx customization injected into the generated server block. */
+export interface SiteNginxConfig {
+    /**
+     * Name of a reusable template defined in
+     * {@link ComputeConfig.nginxTemplates}. Its directive lines are injected into
+     * this site's server block.
+     */
+    template?: string;
+    /**
+     * Raw nginx directive lines added to this site's server block (after the
+     * managed directives), e.g. `['gzip on;', 'location /metrics { deny all; }']`.
+     * Applied on top of {@link template} when both are set.
+     */
+    serverSnippet?: string[];
+    /** `client_max_body_size` for this vhost (e.g. `'256M'`) for large uploads. */
+    clientMaxBodySize?: string;
 }
 /** Private package-registry credentials for a site's build. */
 export interface SiteCredentialsConfig {
@@ -1050,6 +1074,22 @@ export interface SslDnsConfig {
     /** Seconds to wait for DNS propagation before certbot asks the CA to verify. */
     propagationSeconds?: number;
 }
+/**
+ * Laravel scheduler options for a site (Forge's scheduler + heartbeat
+ * monitoring). The scheduler runs `php artisan schedule:run` every minute.
+ */
+export interface SchedulerConfig {
+    /**
+     * Heartbeat monitor URL pinged after each successful `schedule:run`
+     * (healthchecks.io, Oh Dear, Better Uptime, …). If the scheduler stops, the
+     * monitor stops receiving pings and alerts you.
+     */
+    heartbeatUrl?: string;
+    /**
+     * HTTP method for the heartbeat ping. @default 'GET'
+     */
+    heartbeatMethod?: 'GET' | 'POST' | 'HEAD';
+}
 /**
  * A Laravel queue worker (or Horizon supervisor) run as a systemd service.
  * Mirrors Forge's queue configuration. See {@link SiteConfig.queues}.
@@ -1621,6 +1661,18 @@ export interface ServerlessAppConfig {
     storage?: {
         bucket?: string;
     };
+    /**
+     * Mount a shared Elastic File System on the functions (Vapor's `/mnt/local`).
+     * Requires a VPC. `true` provisions an EFS file system + access point;
+     * otherwise attach an existing access point by ARN. The mount path defaults
+     * to `/mnt/local`.
+     */
+    efs?: boolean | {
+        /** Existing EFS Access Point ARN to attach (skips provisioning). */
+        accessPointArn?: string;
+        /** Mount path inside the functions. @default '/mnt/local' */
+        mountPath?: string;
+    };
     /** Managed WAF in front of the HTTP API / CloudFront. */
     firewall?: WafConfig;
     /** Custom domain(s) for the app's HTTP API (overrides {@link EnvironmentConfig.domain}). */
@@ -1636,6 +1688,19 @@ export interface ServerlessAppConfig {
     hostedZoneId?: string;
     /** Local directory whose contents are uploaded to S3/CloudFront as versioned assets. */
     assets?: string;
+    /**
+     * Serve assets from a custom CDN host instead of the default CloudFront domain
+     * (Vapor `asset-domain`). Requires a us-east-1 ACM cert via assetCertificateArn.
+     */
+    assetDomain?: string;
+    /** us-east-1 ACM certificate ARN for {@link assetDomain} (CloudFront requirement). */
+    assetCertificateArn?: string;
+    /** Include dotfiles when uploading assets (Vapor `dot-files-as-assets`). @default false */
+    dotFilesAsAssets?: boolean;
+    /** Serve assets from the app/root domain too (Vapor `serve_assets`). Injected as env. */
+    serveAssets?: boolean;
+    /** Redirect robots.txt to the asset CDN (Vapor `redirect_robots_txt`). Injected as env. @default true */
+    redirectRobotsTxt?: boolean;
     /** PHP version for the runtime layer. @default '8.3' */
     phpVersion?: PhpVersion;
     /** CPU architecture. @default 'x86_64' */
@@ -2141,6 +2206,13 @@ export interface ComputeConfig {
      * @default 'nginx'
      */
     webServer?: 'nginx' | 'rpx';
+    /**
+     * Reusable nginx config templates, keyed by name. A site references one via
+     * `site.nginx.template`, and its directive lines are injected into that
+     * site's server block — define a hardening/caching/proxy snippet once and
+     * share it across sites (Forge's nginx templates).
+     */
+    nginxTemplates?: Record<string, string[]>;
     /**
      * On-box managed services to install (Forge's single-server model): the
      * database engine, cache, and search. Each may be `true` for defaults or an
@@ -2228,6 +2300,19 @@ export interface ComputePhpConfig {
      * e.g. `['imagick', 'swoole']`.
      */
     extensions?: string[];
+    /**
+     * Apply the production OPcache + php.ini tuning (Forge's "Optimize for
+     * Production"): OPcache on with timestamp validation off, larger file/string
+     * buffers, and a bigger realpath cache. Deploys restart php-fpm, so disabled
+     * timestamp validation is safe. @default true
+     */
+    optimizeForProduction?: boolean;
+    /**
+     * Extra `php.ini` directives merged on top of the production tuning (and
+     * applied even when {@link optimizeForProduction} is false), e.g.
+     * `{ memory_limit: '512M', upload_max_filesize: '128M' }`.
+     */
+    ini?: Record<string, string>;
 }
 /**
  * On-box managed services (database / cache / search) for a compute box.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ts-cloud/core",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "type": "module",
   "description": "Core CloudFormation generation library for ts-cloud",
   "author": "Chris Breuer <chris@stacksjs.com>",
@@ -31,7 +31,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.5.1"
+    "@ts-cloud/aws-types": "0.5.2"
   },
   "devDependencies": {
     "typescript": "^5.9.3"