@ts-cloud/core 0.7.55 → 0.7.57

package/dist/modules/ai.d.ts

@@ -1,4 +1,4 @@
-import type { IAMRole, IAMManagedPolicy } from '@ts-cloud/aws-types';
+import type { IAMManagedPolicy, IAMRole } from '@ts-cloud/aws-types';
 import type { EnvironmentType } from '../types';
 export interface BedrockRoleOptions {
     slug: string;

package/dist/modules/auth.d.ts

@@ -1,4 +1,4 @@
-import type { CognitoUserPool, CognitoUserPoolClient, CognitoUserPoolDomain, CognitoIdentityPool, CognitoIdentityPoolRoleAttachment, IAMRole } from '@ts-cloud/aws-types';
+import type { CognitoIdentityPool, CognitoIdentityPoolRoleAttachment, CognitoUserPool, CognitoUserPoolClient, CognitoUserPoolDomain, IAMRole } from '@ts-cloud/aws-types';
 import type { EnvironmentType } from '../types';
 export interface UserPoolOptions {
     slug: string;

package/dist/modules/cdn.d.ts

@@ -1,4 +1,4 @@
-import type { CloudFrontDistribution, CloudFrontOriginAccessControl, LambdaFunction, IAMRole } from '@ts-cloud/aws-types';
+import type { CloudFrontDistribution, CloudFrontOriginAccessControl, IAMRole, LambdaFunction } from '@ts-cloud/aws-types';
 import type { EnvironmentType } from '../types';
 export interface DistributionOptions {
     slug: string;

package/dist/modules/deployment.d.ts

@@ -1,4 +1,4 @@
-import type { CodeDeployApplication, CodeDeployDeploymentGroup, CodeDeployDeploymentConfig } from '@ts-cloud/aws-types';
+import type { CodeDeployApplication, CodeDeployDeploymentConfig, CodeDeployDeploymentGroup } from '@ts-cloud/aws-types';
 import type { EnvironmentType } from '../types';
 /**
  * Asset file with hash information

package/dist/modules/monitoring.d.ts

@@ -1,4 +1,4 @@
-import type { CloudWatchAlarm, CloudWatchDashboard, CloudWatchLogGroup, CloudWatchLogStream, CloudWatchMetricFilter, CloudWatchCompositeAlarm } from '@ts-cloud/aws-types';
+import type { CloudWatchAlarm, CloudWatchCompositeAlarm, CloudWatchDashboard, CloudWatchLogGroup, CloudWatchLogStream, CloudWatchMetricFilter } from '@ts-cloud/aws-types';
 import type { EnvironmentType } from '../types';
 export interface AlarmOptions {
     slug: string;

package/dist/modules/phone.d.ts

@@ -1,8 +1,3 @@
-/**
- * Phone/Voice Module for CloudFormation
- *
- * Provides CloudFormation resources for Amazon Connect phone infrastructure
- */
 export interface PhoneConfig {
     slug: string;
     environment: string;

package/dist/modules/secrets.d.ts

@@ -2,7 +2,7 @@
  * Secrets Manager Module
  * Clean API for AWS Secrets Manager
  */
-import type { SecretsManagerSecret, SecretsManagerSecretTargetAttachment, SecretsManagerRotationSchedule } from '@ts-cloud/aws-types';
+import type { SecretsManagerRotationSchedule, SecretsManagerSecret, SecretsManagerSecretTargetAttachment } from '@ts-cloud/aws-types';
 export interface SecretOptions {
     slug: string;
     environment: string;

package/dist/modules/sms.d.ts

@@ -3,9 +3,9 @@
  *
  * Provides CloudFormation resources for AWS Pinpoint SMS infrastructure
  */
-import { handler as sendHandler } from '../sms/handlers/send';
-import { handler as receiveHandler } from '../sms/handlers/receive';
 import { handler as deliveryStatusHandler } from '../sms/handlers/delivery-status';
+import { handler as receiveHandler } from '../sms/handlers/receive';
+import { handler as sendHandler } from '../sms/handlers/send';
 export interface SmsConfig {
     slug: string;
     environment: string;

package/dist/modules/storage.d.ts

@@ -1,5 +1,4 @@
-import type { BackupPlan, BackupSelection, BackupVault, S3Bucket, S3BucketPolicy } from '@ts-cloud/aws-types';
-import type { IAMRole } from '@ts-cloud/aws-types';
+import type { BackupPlan, BackupSelection, BackupVault, IAMRole, S3Bucket, S3BucketPolicy } from '@ts-cloud/aws-types';
 import type { EnvironmentType } from '../types';
 export interface BucketOptions {
     name?: string;

package/dist/modules/workflow.d.ts

@@ -1,4 +1,4 @@
-import type { StepFunctionsStateMachine, IAMRole } from '@ts-cloud/aws-types';
+import type { IAMRole, StepFunctionsStateMachine } from '@ts-cloud/aws-types';
 import type { EnvironmentType } from '../types';
 export interface StateMachineOptions {
     slug: string;

package/dist/presets/fullstack-app.d.ts

@@ -1,4 +1,21 @@
 import type { CloudConfig } from '../types';
+/**
+ * Backend-only companion stack for an already deployed S3/CloudFront frontend.
+ * The caller attaches AppLoadBalancerDnsName to the existing distribution only
+ * after this stack is healthy.
+ */
+export declare function createExistingStaticFullStackPreset(options: {
+    name: string;
+    slug: string;
+    domain: string;
+    imageUri: string;
+    certificateArn?: string;
+    originVerifySecret?: string;
+    desiredCount?: number;
+    database?: boolean;
+    cache?: boolean;
+    queue?: boolean;
+}): Partial<CloudConfig>;
 /**
  * Full Stack App Preset
  * Perfect for: Complete web applications with frontend and API

package/dist/presets/fullstack-app.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/presets/index.d.ts

@@ -2,7 +2,7 @@ export { createStaticSitePreset } from './static-site';
 export { createNodeJsServerPreset } from './nodejs-server';
 export { createNodeJsServerlessPreset } from './nodejs-serverless';
 export { createServerlessNodePreset } from './serverless-node';
-export { createFullStackAppPreset } from './fullstack-app';
+export { createExistingStaticFullStackPreset, createFullStackAppPreset } from './fullstack-app';
 export { createApiBackendPreset } from './api-backend';
 export { createWordPressPreset } from './wordpress';
 export { createJamstackPreset } from './jamstack';

package/dist/preview/index.d.ts

@@ -2,9 +2,9 @@
  * Preview Environments
  * Ephemeral environments for PR/branch previews
  */
-export { PreviewEnvironmentManager, previewManager, } from './manager';
-export type { PreviewEnvironment, PreviewEnvironmentOptions, PreviewCleanupOptions, } from './manager';
-export { generatePreviewWorkflow, generateCleanupWorkflow, generateCostReportWorkflow, } from './github';
+export { PreviewEnvironmentManager, previewManager } from './manager';
+export type { PreviewEnvironment, PreviewEnvironmentOptions, PreviewCleanupOptions } from './manager';
+export { generatePreviewWorkflow, generateCleanupWorkflow, generateCostReportWorkflow } from './github';
 export type { GitHubWorkflowOptions } from './github';
-export { PreviewNotificationService, previewNotifications, } from './notifications';
+export { PreviewNotificationService, previewNotifications } from './notifications';
 export type { NotificationChannel, SlackConfig, DiscordConfig, EmailConfig, WebhookConfig, NotificationEvent, } from './notifications';

package/dist/runtime/adapter.ts

@@ -107,7 +107,8 @@ export function resolveApp(mod: unknown): ServerlessApp {
 
 // ── Body / content helpers ──────────────────────────────────────────────────
 
-const TEXT_CONTENT = /^(?:text\/|application\/(?:json|xml|javascript|graphql|x-www-form-urlencoded|.*\+json|.*\+xml)|image\/svg)/i
+const TEXT_CONTENT =
+  /^(?:text\/|application\/(?:json|xml|javascript|graphql|x-www-form-urlencoded|.*\+json|.*\+xml)|image\/svg)/i
 
 function isTextContentType(contentType: string | null): boolean {
   // No declared type → treat as text (the common case for `new Response(str)`).
@@ -130,7 +131,7 @@ export interface HttpAdapterOptions {
   }
 }
 
-function readMaintenance(opts?: HttpAdapterOptions): { enabled: boolean, bypassSecret?: string } {
+function readMaintenance(opts?: HttpAdapterOptions): { enabled: boolean; bypassSecret?: string } {
   if (opts?.maintenance) return opts.maintenance
   const env = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process?.env ?? {}
   return {
@@ -168,9 +169,10 @@ export async function responseToResult(response: Response): Promise<ApiGatewayPr
   const cookies: string[] = []
 
   // `getSetCookie` is available in the Lambda runtime's undici Headers.
-  const setCookies = typeof (response.headers as { getSetCookie?: () => string[] }).getSetCookie === 'function'
-    ? (response.headers as { getSetCookie: () => string[] }).getSetCookie()
-    : []
+  const setCookies =
+    typeof (response.headers as { getSetCookie?: () => string[] }).getSetCookie === 'function'
+      ? (response.headers as { getSetCookie: () => string[] }).getSetCookie()
+      : []
   for (const c of setCookies) cookies.push(c)
 
   response.headers.forEach((value, key) => {
@@ -203,13 +205,19 @@ export function createHttpHandler(handler: FetchHandler | undefined, opts?: Http
     }
 
     if (!handler) {
-      return { statusCode: 501, headers: { 'content-type': 'text/plain' }, body: 'No HTTP handler configured', isBase64Encoded: false }
+      return {
+        statusCode: 501,
+        headers: { 'content-type': 'text/plain' },
+        body: 'No HTTP handler configured',
+        isBase64Encoded: false,
+      }
     }
 
     const maintenance = readMaintenance(opts)
     if (maintenance.enabled) {
-      const bypass = event.headers?.['x-maintenance-bypass']
-        ?? (event.cookies?.find(c => c.startsWith('tscloud_bypass='))?.split('=')[1])
+      const bypass =
+        event.headers?.['x-maintenance-bypass'] ??
+        event.cookies?.find((c) => c.startsWith('tscloud_bypass='))?.split('=')[1]
       if (!maintenance.bypassSecret || bypass !== maintenance.bypassSecret) {
         return {
           statusCode: 503,
@@ -231,8 +239,7 @@ export function createHttpHandler(handler: FetchHandler | undefined, opts?: Http
 function parseRecordBody(body: string): unknown {
   try {
     return JSON.parse(body)
-  }
-  catch {
+  } catch {
     return body
   }
 }
@@ -253,8 +260,7 @@ export function createQueueHandler(handler: JobHandler | undefined): LambdaQueue
     for (const record of event.Records ?? []) {
       try {
         await handler(parseRecordBody(record.body), record)
-      }
-      catch {
+      } catch {
         batchItemFailures.push({ itemIdentifier: record.messageId })
       }
     }
@@ -279,7 +285,10 @@ export function createCliHandler(handler: CommandHandler | undefined): LambdaCli
 }
 
 /** Convenience: build all three Lambda handlers from a resolved app. */
-export function createHandlers(app: ServerlessApp, opts?: HttpAdapterOptions): {
+export function createHandlers(
+  app: ServerlessApp,
+  opts?: HttpAdapterOptions,
+): {
   http: LambdaHttpHandler
   queue: LambdaQueueHandler
   cli: LambdaCliHandler

package/dist/serverless/app-image.d.ts

@@ -1,15 +1,3 @@
-/**
- * Generates the application container-image Dockerfile for serverless apps that
- * exceed the 250 MB zip/layer limit (`packaging: 'image'`). Lambda runs the
- * image directly (up to 10 GB).
- *
- * - Node/Bun: FROM the AWS Lambda Node base image; the bundled handler is copied
- *   to the task root and the function's `ImageConfig.Command` selects the export.
- * - PHP: a self-contained multi-stage build — stage 1 compiles + relocates PHP
- *   (the same recipe as the runtime layer), stage 2 is the `provided.al2023`
- *   base with /opt (runtime) + /var/task (app) baked in; the bootstrap selects
- *   the mode from `TSCLOUD_LAMBDA_MODE`.
- */
 export interface AppImageDockerfileOptions {
     kind: 'node' | 'bun' | 'php';
     /** Node runtime tag (e.g. '20') — used for the Lambda Node base image. */

package/dist/serverless/composer.d.ts

@@ -10,8 +10,8 @@
  * stack updates never revert the deployed code. Alias-based blue/green is a v2
  * refinement.
  */
-import type { CloudConfig, EnvironmentType, ServerlessAppConfig } from '../types';
 import type { CloudFormationTemplate } from '../cloudformation/types';
+import type { CloudConfig, EnvironmentType, ServerlessAppConfig } from '../types';
 export interface ComposeOptions {
     config: Pick<CloudConfig, 'project'>;
     environment: EnvironmentType;

package/dist/serverless/runtimes/index.d.ts

@@ -1,12 +1,3 @@
-/**
- * Unified custom-runtime (`provided.al2023`) layer builders for Node and Bun.
- *
- * Both ship the same shape as the PHP runtime layer — a binary + a `bootstrap`
- * entrypoint + the shared {@link runtime.mjs} Runtime API loop — so newer Node
- * versions (e.g. 24, beyond AWS's managed runtimes) and Bun run on Lambda the
- * same way Laravel/PHP does. Unlike the PHP layer these need no Docker: the
- * official binary is downloaded and zipped directly.
- */
 export type RuntimeArch = 'x86_64' | 'arm64';
 /** The shared Runtime API loop source (bundled into every node/bun layer). */
 export declare function sharedRuntimeLoop(): string;

package/dist/serverless/zip.d.ts

@@ -1,12 +1,3 @@
-/**
- * Minimal, dependency-free ZIP writer for Lambda deployment artifacts.
- *
- * Lambda deployment packages must be ZIP archives. This generalizes the
- * single-file writer in `ts-cloud/src/aws/lambda.ts` to multiple files so the
- * same code path serves a bundled Node/Bun handler (one file) and a full
- * PHP/Laravel application tree (many files). Uses Node's `zlib` only — no
- * third-party zip dependency, in keeping with the zero-dependency ethos.
- */
 export interface ZipEntry {
     /** POSIX path inside the archive (forward slashes). */
     name: string;

package/dist/serverless-php/layer-build.d.ts

@@ -1,16 +1,4 @@
-/**
- * Builds the ts-cloud PHP runtime layer ZIP.
- *
- * Runs the generated Dockerfile to produce a /opt tree (PHP + php-fpm +
- * extensions for AL2023), extracts it, injects the runtime assets
- * (bootstrap/runtime loops/fpm config), and packages everything as a Lambda
- * layer ZIP. Publishing the ZIP as a layer version is done by the CLI using the
- * ts-cloud Lambda client; this module only produces the artifact.
- *
- * Requires Docker. Intended to run in CI to publish a versioned, ts-cloud-owned
- * layer that user deploys reference (no per-deploy compilation).
- */
-import { type PhpDockerfileOptions } from './dockerfile';
+import type { PhpDockerfileOptions } from './dockerfile';
 export interface BuildPhpLayerOptions extends PhpDockerfileOptions {
     /** Target architecture. @default 'x86_64' */
     architecture?: 'x86_64' | 'arm64';

package/dist/serverless-php/package-php.d.ts

@@ -7,8 +7,8 @@
  * Build hooks (composer install + artisan caches) run before packaging because
  * the Lambda filesystem is read-only at runtime.
  */
+import type { ZipEntry } from '../serverless/zip';
 import type { ServerlessAppConfig } from '../types';
-import { type ZipEntry } from '../serverless/zip';
 /** Paths excluded from the PHP deployment artifact by default. */
 export declare const PHP_DEFAULT_EXCLUDES: string[];
 export interface PackagePhpOptions {

package/dist/serverless-php/runtime-assets.d.ts

@@ -1,10 +1,3 @@
-/**
- * Accessors for the in-repo PHP runtime asset sources (bootstrap, runtime loops,
- * FastCGI client) and the Laravel-on-Lambda environment defaults.
- *
- * The layer builder bundles these files plus the generated php-fpm.conf into the
- * ts-cloud PHP runtime layer (mounted at /opt on Lambda).
- */
 export interface RuntimeAsset {
     /** Path inside the layer, relative to /opt. */
     path: string;

package/dist/types.d.ts

@@ -238,6 +238,7 @@ export interface ApiGatewayConfig {
     customDomain?: {
         domain?: string;
         certificateArn?: string;
+        dnsProvider?: 'route53' | 'external';
     };
     authorizer?: {
         type?: string;
@@ -2253,6 +2254,11 @@ export interface ComputeConfig {
                 domain?: string;
                 certificateArn?: string;
             };
+            originVerifyHeader?: {
+                name?: string;
+                value?: string;
+            };
+            deletionProtection?: boolean;
         };
     };
     /**
@@ -2638,6 +2644,21 @@ export interface ComputeProxyConfig {
     onDemandTls?: boolean;
     /** Contact email for the ACME account when {@link onDemandTls} is enabled. */
     onDemandTlsEmail?: string;
+    /**
+     * Issue on-demand certs from Let's Encrypt's **staging** directory instead of
+     * production. Untrusted by browsers, but effectively un-rate-limited — useful
+     * when bringing up many new hostnames at once and only checking wiring.
+     *
+     * Always emitted into the rpx fragment, including the `false` default, rather
+     * than left undefined: `obtainCertificate` selects the production directory
+     * only on an explicit `false`, so an absent flag silently yields staging
+     * certs that chain to an untrusted root while issuance reports success.
+     * Stating the intent here keeps the deploy correct regardless of the
+     * defaulting behaviour of whatever rpx version the box has installed.
+     *
+     * @default false
+     */
+    onDemandTlsStaging?: boolean;
     /**
      * Webroot the gateway serves ACME http-01 challenge tokens from on `:80` (and
      * that the deploy-time issuance + renewal cron write tokens into). Only used

package/dist/utils/cache.d.ts

@@ -1,7 +1,3 @@
-/**
- * Caching utilities for performance optimization
- * Caches CloudFormation templates, credentials, and other data
- */
 export interface CacheOptions {
     ttl?: number;
     maxSize?: number;

package/dist/utils/hash.d.ts

@@ -1,7 +1,3 @@
-/**
- * File hashing utilities for deployment optimization
- * Fast hashing for detecting changed files
- */
 export interface FileHash {
     path: string;
     hash: string;

package/dist/validators/quotas.d.ts

@@ -1,7 +1,3 @@
-/**
- * AWS Service Quota Checking
- * Check if deployment will exceed service limits
- */
 export interface ServiceQuota {
     service: string;
     quotaName: string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ts-cloud/core",
-  "version": "0.7.55",
   "type": "module",
+  "version": "0.7.57",
   "description": "Core CloudFormation generation library for ts-cloud",
   "author": "Chris Breuer <chris@stacksjs.com>",
   "license": "MIT",
@@ -31,7 +31,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.7.55"
+    "@ts-cloud/aws-types": "0.7.57"
   },
   "devDependencies": {
     "typescript": "^7.0.2"