@ts-cloud/core 0.5.3 → 0.5.5

package/dist/index.js

@@ -45833,7 +45833,7 @@ function composeServerlessAppTemplate(opts) {
           ...app.assetDomain ? {
             Aliases: [app.assetDomain],
             ViewerCertificate: {
-              AcmCertificateArn: app.assetCertificateArn,
+              AcmCertificateArn: app.assetCertificateArn ?? Fn2.ref("AssetsCertificate"),
               SslSupportMethod: "sni-only",
               MinimumProtocolVersion: "TLSv1.2_2021"
             }
@@ -45842,8 +45842,20 @@ function composeServerlessAppTemplate(opts) {
       }
     };
     if (app.assetDomain) {
-      if (!app.assetCertificateArn)
-        throw new Error("serverless app: `assetDomain` requires `assetCertificateArn` (a us-east-1 ACM cert — CloudFront only accepts certs from us-east-1).");
+      if (!app.assetCertificateArn) {
+        if (!app.hostedZoneId)
+          throw new Error("serverless app: `assetDomain` requires either `assetCertificateArn` (a us-east-1 ACM cert) or `hostedZoneId` (to auto-issue + validate one). CloudFront only accepts certs from us-east-1.");
+        if (region !== "us-east-1")
+          throw new Error(`serverless app: auto-issuing an asset-domain cert needs a us-east-1 app (CloudFront certs must be us-east-1); this app is in ${region}. Supply a pre-issued us-east-1 \`assetCertificateArn\` instead.`);
+        resources.AssetsCertificate = {
+          Type: "AWS::CertificateManager::Certificate",
+          Properties: {
+            DomainName: app.assetDomain,
+            ValidationMethod: "DNS",
+            DomainValidationOptions: [{ DomainName: app.assetDomain, HostedZoneId: app.hostedZoneId }]
+          }
+        };
+      }
       if (app.hostedZoneId) {
         resources.AssetsDomainRecord = {
           Type: "AWS::Route53::RecordSet",
@@ -45930,9 +45942,12 @@ function composeServerlessAppTemplate(opts) {
     };
   }
   if (hasVpc && needsDataVpc) {
+    if (!app.vpc?.id)
+      throw new Error("serverless app: data services (elasticache / aurora-serverless / rdsProxy / efs) need app.vpc.id (the VPC id) so the managed security group is created in the right VPC.");
     resources.DataSecurityGroup = {
       Type: "AWS::EC2::SecurityGroup",
       Properties: {
+        VpcId: app.vpc.id,
         GroupDescription: `${slug}-${environment} serverless data access`,
         SecurityGroupIngress: [{ IpProtocol: "-1", CidrIp: "10.0.0.0/8" }]
       }
@@ -46013,6 +46028,7 @@ function composeServerlessAppTemplate(opts) {
         Engine: "aurora-mysql",
         EngineMode: "provisioned",
         DBClusterIdentifier: `${slug}-${environment}-db`,
+        DatabaseName: "app",
         MasterUsername: Fn2.sub("{{resolve:secretsmanager:${DbSecret}:SecretString:username}}"),
         MasterUserPassword: Fn2.sub("{{resolve:secretsmanager:${DbSecret}:SecretString:password}}"),
         ServerlessV2ScalingConfiguration: { MinCapacity: 0.5, MaxCapacity: 4 },
@@ -46059,6 +46075,15 @@ function composeServerlessAppTemplate(opts) {
         RequireTLS: false
       }
     };
+    resources.DbProxyTargetGroup = {
+      Type: "AWS::RDS::DBProxyTargetGroup",
+      DependsOn: ["DbInstance"],
+      Properties: {
+        DBProxyName: Fn2.ref("DbProxy"),
+        TargetGroupName: "default",
+        DBClusterIdentifiers: [Fn2.ref("DbCluster")]
+      }
+    };
     outputs.DbProxyEndpoint = { Description: "RDS Proxy endpoint", Value: Fn2.getAtt("DbProxy", "Endpoint") };
   }
   outputs.HttpFunctionName = { Description: "HTTP function name", Value: Fn2.ref("HttpFunction") };

package/dist/types.d.ts

@@ -1632,8 +1632,10 @@ export interface ServerlessAppConfig {
      * @default 'zip'
      */
     packaging?: 'zip' | 'image';
-    /** Attach the functions to a VPC (required for ElastiCache / private RDS). */
+    /** Attach the functions to a VPC (required for ElastiCache / private RDS / EFS). */
     vpc?: {
+        /** VPC id — required when ts-cloud provisions a managed security group for data services. */
+        id?: string;
         subnets?: string[];
         securityGroups?: string[];
     };
@@ -1690,10 +1692,16 @@ export interface ServerlessAppConfig {
     assets?: string;
     /**
      * Serve assets from a custom CDN host instead of the default CloudFront domain
-     * (Vapor `asset-domain`). Requires a us-east-1 ACM cert via assetCertificateArn.
+     * (Vapor `asset-domain`). CloudFront needs a us-east-1 ACM cert: supply one via
+     * {@link assetCertificateArn}, or give {@link hostedZoneId} and (for a us-east-1
+     * app) ts-cloud auto-issues + DNS-validates one.
      */
     assetDomain?: string;
-    /** us-east-1 ACM certificate ARN for {@link assetDomain} (CloudFront requirement). */
+    /**
+     * us-east-1 ACM certificate ARN for {@link assetDomain} (CloudFront requirement).
+     * Optional when {@link hostedZoneId} is set and the app is in us-east-1 — the
+     * cert is then auto-issued and DNS-validated.
+     */
     assetCertificateArn?: string;
     /** Include dotfiles when uploading assets (Vapor `dot-files-as-assets`). @default false */
     dotFilesAsAssets?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ts-cloud/core",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "type": "module",
   "description": "Core CloudFormation generation library for ts-cloud",
   "author": "Chris Breuer <chris@stacksjs.com>",
@@ -31,7 +31,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.5.3"
+    "@ts-cloud/aws-types": "0.5.5"
   },
   "devDependencies": {
     "typescript": "^5.9.3"