@ts-cloud/core 0.7.47 → 0.7.49

package/dist/index.js

@@ -10836,6 +10836,136 @@ class SMS {
     return { resources, outputs };
   }
 }
+// src/modules/sftp.ts
+function logicalPart(value) {
+  const clean = value.replace(/[^a-zA-Z0-9]/g, " ").trim();
+  const part = clean.split(/\s+/).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join("");
+  return part || "User";
+}
+function normalizeHomeDirectory(value, username) {
+  const path = (value || username).replace(/^\/+|\/+$/g, "");
+  if (!path || path.split("/").includes(".."))
+    throw new Error(`sftp: invalid homeDirectory for user ${username}`);
+  return path;
+}
+
+class Sftp {
+  static create(options) {
+    if (!options.bucket.trim())
+      throw new Error("sftp: bucket is required");
+    const endpointType = options.endpointType ?? "PUBLIC";
+    if (endpointType === "VPC" && (!options.endpointDetails?.vpcId || !options.endpointDetails.subnetIds.length))
+      throw new Error("sftp: VPC endpoints require endpointDetails.vpcId and at least one subnet");
+    const prefix = `${logicalPart(options.slug)}${logicalPart(options.environment)}Sftp`;
+    const serverLogicalId = `${prefix}Server`;
+    const resources = {};
+    let loggingRoleArn;
+    if (options.logging !== false) {
+      const loggingRoleLogicalId = `${prefix}LoggingRole`;
+      resources[loggingRoleLogicalId] = {
+        Type: "AWS::IAM::Role",
+        Properties: {
+          AssumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [{ Effect: "Allow", Principal: { Service: "transfer.amazonaws.com" }, Action: "sts:AssumeRole" }]
+          },
+          Policies: [{
+            PolicyName: "TransferLogging",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [{
+                Effect: "Allow",
+                Action: ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents"],
+                Resource: "arn:aws:logs:*:*:log-group:/aws/transfer/*"
+              }]
+            }
+          }]
+        }
+      };
+      loggingRoleArn = { "Fn::GetAtt": [loggingRoleLogicalId, "Arn"] };
+    }
+    resources[serverLogicalId] = {
+      Type: "AWS::Transfer::Server",
+      Properties: {
+        Domain: "S3",
+        EndpointType: endpointType,
+        IdentityProviderType: "SERVICE_MANAGED",
+        Protocols: ["SFTP"],
+        ...endpointType === "VPC" ? {
+          EndpointDetails: {
+            VpcId: options.endpointDetails.vpcId,
+            SubnetIds: options.endpointDetails.subnetIds,
+            ...options.endpointDetails.securityGroupIds?.length ? { SecurityGroupIds: options.endpointDetails.securityGroupIds } : {},
+            ...options.endpointDetails.addressAllocationIds?.length ? { AddressAllocationIds: options.endpointDetails.addressAllocationIds } : {}
+          }
+        } : {},
+        ...options.securityPolicyName ? { SecurityPolicyName: options.securityPolicyName } : {},
+        ...loggingRoleArn ? { LoggingRole: loggingRoleArn } : {},
+        Tags: [
+          { Key: "Project", Value: options.slug },
+          { Key: "Environment", Value: options.environment },
+          { Key: "ManagedBy", Value: "ts-cloud" }
+        ]
+      }
+    };
+    for (const [username, user] of Object.entries(options.users)) {
+      if (!/^[a-zA-Z0-9_.@-]{3,100}$/.test(username))
+        throw new Error(`sftp: invalid username ${username}`);
+      if (!user.sshPublicKeys.length)
+        throw new Error(`sftp: user ${username} requires at least one SSH public key`);
+      const userPart = logicalPart(username);
+      const home = normalizeHomeDirectory(user.homeDirectory, username);
+      const userLogicalId = `${prefix}${userPart}User`;
+      let roleArn = user.roleArn;
+      if (!roleArn) {
+        const roleLogicalId = `${prefix}${userPart}Role`;
+        const bucketArn = `arn:aws:s3:::${options.bucket}`;
+        resources[roleLogicalId] = {
+          Type: "AWS::IAM::Role",
+          Properties: {
+            AssumeRolePolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [{ Effect: "Allow", Principal: { Service: "transfer.amazonaws.com" }, Action: "sts:AssumeRole" }]
+            },
+            Policies: [{
+              PolicyName: "SftpHomeDirectory",
+              PolicyDocument: {
+                Version: "2012-10-17",
+                Statement: [
+                  {
+                    Effect: "Allow",
+                    Action: ["s3:ListBucket", "s3:GetBucketLocation"],
+                    Resource: bucketArn,
+                    Condition: { StringLike: { "s3:prefix": [home, `${home}/*`] } }
+                  },
+                  {
+                    Effect: "Allow",
+                    Action: ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectVersion"],
+                    Resource: `${bucketArn}/${home}/*`
+                  }
+                ]
+              }
+            }]
+          }
+        };
+        roleArn = { "Fn::GetAtt": [roleLogicalId, "Arn"] };
+      }
+      resources[userLogicalId] = {
+        Type: "AWS::Transfer::User",
+        DependsOn: [serverLogicalId],
+        Properties: {
+          ServerId: { Ref: serverLogicalId },
+          UserName: username,
+          Role: roleArn,
+          HomeDirectoryType: "PATH",
+          HomeDirectory: `/${options.bucket}/${home}`,
+          SshPublicKeys: user.sshPublicKeys
+        }
+      };
+    }
+    return { resources, serverLogicalId };
+  }
+}
 // src/modules/ai.ts
 class AI {
   static createBedrockRole(servicePrincipal, options) {
@@ -25298,6 +25428,9 @@ var cloud_config_schema_default = {
         cdn: {
           $ref: "#/definitions/cdn"
         },
+        sftp: {
+          $ref: "#/definitions/sftp"
+        },
         functions: {
           type: "object",
           description: "Lambda functions configuration",
@@ -25348,6 +25481,14 @@ var cloud_config_schema_default = {
             timeout: { type: "number", description: "HTTP request timeout in seconds" },
             gatewayVersion: { type: "number", enum: [1, 2], description: "API Gateway version (2 = HTTP API, 1 = REST)" },
             warm: { type: "number", description: "Keep-warm / provisioned concurrency count" },
+            lambdaInsights: {
+              type: "object",
+              description: "CloudWatch Lambda Insights extension configuration for zip deployments",
+              required: ["layerArn"],
+              properties: {
+                layerArn: { type: "string", description: "Region- and architecture-specific Lambda Insights extension layer ARN" }
+              }
+            },
             queues: { description: "Queue names (true = single default queue, false = disabled)" },
             scheduler: { type: "string", enum: ["off", "on", "sub-minute"], description: "Task scheduler mode" },
             build: { type: "array", items: { type: "string" }, description: "Commands run locally before packaging" },
@@ -25621,6 +25762,15 @@ var cloud_config_schema_default = {
           type: "boolean",
           default: true
         },
+        originShield: {
+          type: "boolean",
+          description: "Enable CloudFront Origin Shield",
+          default: false
+        },
+        originShieldRegion: {
+          type: "string",
+          description: "AWS region used by CloudFront Origin Shield"
+        },
         compress: {
           type: "boolean",
           description: "Enable automatic compression",
@@ -25661,6 +25811,38 @@ var cloud_config_schema_default = {
         }
       }
     },
+    sftp: {
+      type: "object",
+      required: ["bucket", "users"],
+      properties: {
+        bucket: { type: "string", description: "S3 bucket backing the SFTP server" },
+        endpointType: { type: "string", enum: ["PUBLIC", "VPC"], default: "PUBLIC" },
+        endpointDetails: {
+          type: "object",
+          required: ["vpcId", "subnetIds"],
+          properties: {
+            vpcId: { type: "string" },
+            subnetIds: { type: "array", items: { type: "string" }, minItems: 1 },
+            securityGroupIds: { type: "array", items: { type: "string" } },
+            addressAllocationIds: { type: "array", items: { type: "string" } }
+          }
+        },
+        securityPolicyName: { type: "string" },
+        logging: { type: "boolean", default: true },
+        users: {
+          type: "object",
+          additionalProperties: {
+            type: "object",
+            required: ["sshPublicKeys"],
+            properties: {
+              sshPublicKeys: { type: "array", items: { type: "string" }, minItems: 1 },
+              homeDirectory: { type: "string" },
+              roleArn: { type: "string" }
+            }
+          }
+        }
+      }
+    },
     function: {
       type: "object",
       required: ["name", "runtime"],
@@ -45568,6 +45750,9 @@ function composeServerlessAppTemplate(opts) {
   const hasQueue = queueNames.length > 0;
   const logRetention = app.logRetention ?? 14;
   const imageMode = app.packaging === "image";
+  if (imageMode && app.lambdaInsights) {
+    throw new Error("serverless app: `lambdaInsights` layer attachment is only supported for zip packaging. Container images must install the Lambda Insights extension in the image.");
+  }
   const schedulerEnabled = (app.scheduler ?? "on") !== "off";
   const cacheEnabled = (app.cache?.driver ?? "dynamodb") === "dynamodb";
   const assetsEnabled = Boolean(app.assets);
@@ -45629,6 +45814,8 @@ function composeServerlessAppTemplate(opts) {
   const managedPolicies = ["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"];
   if (app.vpc?.subnets?.length)
     managedPolicies.push("arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole");
+  if (app.lambdaInsights)
+    managedPolicies.push("arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy");
   resources.AppRole = {
     Type: "AWS::IAM::Role",
     Properties: {
@@ -45684,6 +45871,7 @@ function composeServerlessAppTemplate(opts) {
       Type: "AWS::Logs::LogGroup",
       Properties: { LogGroupName: `/aws/lambda/${name}`, RetentionInDays: logRetention }
     };
+    const layers = [...opts.runtimeLayers ?? [], ...app.lambdaInsights ? [app.lambdaInsights.layerArn] : []];
     const codeProps = imageMode ? {
       PackageType: "Image",
       Code: { ImageUri: Fn2.ref("ImageUri") },
@@ -45692,7 +45880,7 @@ function composeServerlessAppTemplate(opts) {
       Runtime: runtime,
       Handler: handler8,
       Code: { S3Bucket: Fn2.ref("ArtifactBucket"), S3Key: Fn2.ref("ArtifactKey") },
-      ...opts.runtimeLayers?.length ? { Layers: opts.runtimeLayers } : {}
+      ...layers.length ? { Layers: [...new Set(layers)] } : {}
     };
     resources[logicalId] = {
       Type: "AWS::Lambda::Function",
@@ -47494,6 +47682,7 @@ export {
   Spinner,
   exports_send as SmsHandlers,
   exports_advanced3 as SmsAdvanced,
+  Sftp,
   ServiceMeshManager,
   SenderReputationManager,
   SecurityScanningManager,

package/dist/modules/index.d.ts

@@ -14,6 +14,7 @@ export * from './email';
 export * from './phone';
 export * from './queue';
 export * from './sms';
+export * from './sftp';
 export * from './ai';
 export * from './database';
 export * from './cache';

package/dist/modules/sftp.d.ts

@@ -0,0 +1,12 @@
+import type { EnvironmentType, SftpConfig } from '../types';
+export interface SftpResources {
+    resources: Record<string, any>;
+    serverLogicalId: string;
+}
+/** Build an AWS Transfer Family SFTP server with service-managed users. */
+export declare class Sftp {
+    static create(options: SftpConfig & {
+        slug: string;
+        environment: EnvironmentType;
+    }): SftpResources;
+}

package/dist/modules/sftp.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types.d.ts

@@ -354,6 +354,8 @@ export interface InfrastructureConfig {
     appDatabase?: DatabaseConfig;
     cache?: CacheConfig;
     cdn?: Record<string, CdnItemConfig & ResourceConditions> | CdnItemConfig;
+    /** AWS Transfer Family SFTP server backed by S3. */
+    sftp?: SftpConfig;
     /**
      * Elastic File System (EFS) configuration
      * For shared file storage across multiple instances
@@ -1378,6 +1380,23 @@ export interface CdnConfig {
     customDomain?: string;
     certificateArn?: string;
 }
+export interface SftpConfig {
+    bucket: string;
+    users: Record<string, {
+        sshPublicKeys: string[];
+        homeDirectory?: string;
+        roleArn?: string;
+    }>;
+    endpointType?: 'PUBLIC' | 'VPC';
+    endpointDetails?: {
+        vpcId: string;
+        subnetIds: string[];
+        securityGroupIds?: string[];
+        addressAllocationIds?: string[];
+    };
+    securityPolicyName?: string;
+    logging?: boolean;
+}
 export interface DnsConfig {
     domain?: string;
     hostedZoneId?: string;
@@ -1717,6 +1736,17 @@ export interface ServerlessAppConfig {
     provisionedConcurrency?: number;
     /** CloudWatch log retention (days) for all function log groups. @default 14 */
     logRetention?: number;
+    /**
+     * Enable CloudWatch Lambda Insights for every function in the app.
+     *
+     * AWS publishes architecture- and region-specific extension layers, so the
+     * layer ARN stays explicit instead of ts-cloud pinning a version that can go
+     * stale. Zip deployments attach the layer and the required AWS managed role
+     * policy. Container-image deployments must bake the extension into the image.
+     */
+    lambdaInsights?: {
+        layerArn: string;
+    };
     /** CLI function memory in MB. @default 1024 */
     cliMemory?: number;
     /** CLI command timeout in seconds (allow room for migrations). @default 900 */
@@ -2684,6 +2714,10 @@ export interface CdnFrontConfig {
     secret?: string;
     /** Header name carrying {@link secret}. @default 'X-Origin-Verify' */
     secretHeader?: string;
+    /** Enable CloudFront Origin Shield for the gateway origin. @default false */
+    originShield?: boolean;
+    /** AWS region used by Origin Shield. Required when {@link originShield} is enabled. */
+    originShieldRegion?: string;
 }
 export interface DatabaseItemConfig {
     engine?: 'dynamodb' | 'postgres' | 'mysql';
@@ -2757,6 +2791,10 @@ export interface CdnItemConfig {
      * Enable CDN
      */
     enabled?: boolean;
+    /** Enable CloudFront Origin Shield for this origin. @default false */
+    originShield?: boolean;
+    /** AWS region used by Origin Shield. Defaults to the deployment region. */
+    originShieldRegion?: string;
     /**
      * Cache policy configuration
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ts-cloud/core",
-  "version": "0.7.47",
+  "version": "0.7.49",
   "type": "module",
   "description": "Core CloudFormation generation library for ts-cloud",
   "author": "Chris Breuer <chris@stacksjs.com>",
@@ -31,7 +31,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.7.47"
+    "@ts-cloud/aws-types": "0.7.49"
   },
   "devDependencies": {
     "typescript": "^7.0.2"