sst 2.0.0-rc.63 → 2.0.0-rc.65

package/cli/commands/dev.js

@@ -153,6 +153,7 @@ export const dev = (program) => program.command(["dev", "start"], "Work on your
                 deploy(assembly);
             }
             catch (ex) {
+                isWorking = false;
                 spinner.fail();
                 Colors.line(ex.stack
                     .split("\n")

package/cli/sst.js

@@ -38,8 +38,10 @@ consoleCommand(program);
 diff(program);
 version(program);
 telemetry(program);
-// @ts-expect-error
-process.setSourceMapsEnabled(true);
+if ("setSourceMapsEnabled" in process) {
+    // @ts-expect-error
+    process.setSourceMapsEnabled(true);
+}
 process.removeAllListeners("uncaughtException");
 process.on("uncaughtException", (err) => {
     Logger.debug(err);

package/constructs/ApiGatewayV1Api.d.ts

@@ -9,6 +9,7 @@ import * as apigV1AccessLog from "./util/apiGatewayV1AccessLog.js";
 import { Bucket } from "./Bucket.js";
 import { Duration } from "./util/duration.js";
 import { SSTConstruct } from "./Construct.js";
+import { DnsValidatedCertificate } from "./cdk/dns-validated-certificate.js";
 import { Function as Fn, FunctionProps, FunctionInlineDefinition, FunctionDefinition } from "./Function.js";
 import { Permissions } from "./util/permission.js";
 export interface ApiGatewayV1ApiAccessLogProps extends apigV1AccessLog.AccessLogProps {
@@ -491,7 +492,7 @@ export declare class ApiGatewayV1Api<Authorizers extends Record<string, ApiGatew
         /**
          * The internally created certificate
          */
-        certificate?: acm.Certificate | acm.DnsValidatedCertificate;
+        certificate?: acm.Certificate | DnsValidatedCertificate;
     };
     private _deployment?;
     private _customDomainUrl?;

package/constructs/ApiGatewayV1Api.js

@@ -9,6 +9,7 @@ import * as apigV1AccessLog from "./util/apiGatewayV1AccessLog.js";
 import { Stack } from "./Stack.js";
 import { toCdkDuration } from "./util/duration.js";
 import { getFunctionRef, isCDKConstruct } from "./Construct.js";
+import { DnsValidatedCertificate } from "./cdk/dns-validated-certificate.js";
 import { Function as Fn, } from "./Function.js";
 const allowedMethods = [
     "ANY",
@@ -447,7 +448,7 @@ export class ApiGatewayV1Api extends Construct {
         /////////////////////
         if (!apigDomainName && !certificate) {
             if (endpointType === "edge") {
-                certificate = new acm.DnsValidatedCertificate(this, "CrossRegionCertificate", {
+                certificate = new DnsValidatedCertificate(this, "CrossRegionCertificate", {
                     domainName: domainName,
                     hostedZone: hostedZone,
                     region: "us-east-1",

package/constructs/AppSyncApi.d.ts

@@ -245,7 +245,7 @@ export interface AppSyncApiProps {
      * });
      * ```
      */
-    schema: string | string[];
+    schema?: string | string[];
     /**
      * Specify a custom domain to use in addition to the automatically generated one. SST currently supports domains that are configured using [Route 53](https://aws.amazon.com/route53/)
      *

package/constructs/AppSyncApi.js

@@ -278,7 +278,10 @@ export class AppSyncApi extends Construct {
                 {});
             // build schema
             let mainSchema;
-            if (typeof schema === "string") {
+            if (!schema) {
+                throw new Error(`Missing "schema" in "${id}" AppSyncApi`);
+            }
+            else if (typeof schema === "string") {
                 mainSchema = appsync.SchemaFile.fromAsset(schema);
             }
             else {

package/constructs/BaseSite.d.ts

@@ -1,6 +1,6 @@
-import * as route53 from "aws-cdk-lib/aws-route53";
-import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
-import * as acm from "aws-cdk-lib/aws-certificatemanager";
+import { IHostedZone } from "aws-cdk-lib/aws-route53";
+import { ErrorResponse, DistributionProps, BehaviorOptions, IOrigin } from "aws-cdk-lib/aws-cloudfront";
+import { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
 /**
  * The customDomain for this website. SST supports domains that are hosted either on [Route 53](https://aws.amazon.com/route53/) or externally.
  *
@@ -61,13 +61,13 @@ export interface BaseSiteDomainProps {
         /**
          * Import the underlying Route 53 hosted zone.
          */
-        hostedZone?: route53.IHostedZone;
+        hostedZone?: IHostedZone;
         /**
          * Import the certificate for the domain. By default, SST will create a certificate with the domain name. The certificate will be created in the `us-east-1`(N. Virginia) region as required by AWS CloudFront.
          *
          * Set this option if you have an existing certificate in the `us-east-1` region in AWS Certificate Manager you want to use.
          */
-        certificate?: acm.ICertificate;
+        certificate?: ICertificate;
     };
 }
 export interface BaseSiteEnvironmentOutputsInfo {
@@ -82,11 +82,11 @@ export interface BaseSiteReplaceProps {
     search: string;
     replace: string;
 }
-export declare function buildErrorResponsesForRedirectToIndex(indexPage: string): cloudfront.ErrorResponse[];
-export declare function buildErrorResponsesFor404ErrorPage(errorPage: string): cloudfront.ErrorResponse[];
-export interface BaseSiteCdkDistributionProps extends Omit<cloudfront.DistributionProps, "defaultBehavior"> {
-    defaultBehavior?: Omit<cloudfront.BehaviorOptions, "origin"> & {
-        origin?: cloudfront.IOrigin;
+export declare function buildErrorResponsesForRedirectToIndex(indexPage: string): ErrorResponse[];
+export declare function buildErrorResponsesFor404ErrorPage(errorPage: string): ErrorResponse[];
+export interface BaseSiteCdkDistributionProps extends Omit<DistributionProps, "defaultBehavior"> {
+    defaultBehavior?: Omit<BehaviorOptions, "origin"> & {
+        origin?: IOrigin;
     };
 }
 export declare function getBuildCmdEnvironment(siteEnvironment?: {

package/constructs/BaseSite.js

@@ -1,4 +1,4 @@
-import * as cdk from "aws-cdk-lib";
+import { Token } from "aws-cdk-lib";
 export function buildErrorResponsesForRedirectToIndex(indexPage) {
     return [
         {
@@ -35,7 +35,7 @@ export function getBuildCmdEnvironment(siteEnvironment) {
     //
     const buildCmdEnvironment = {};
     Object.entries(siteEnvironment || {}).forEach(([key, value]) => {
-        buildCmdEnvironment[key] = cdk.Token.isUnresolved(value)
+        buildCmdEnvironment[key] = Token.isUnresolved(value)
             ? `{{ ${key} }}`
             : value;
     });

package/constructs/EventBus.js

@@ -183,7 +183,7 @@ export class EventBus extends Construct {
                 eventBusName: this.cdk.eventBus.eventBusName,
                 rules: Object.entries(this.targetsData).map(([ruleName, rule]) => ({
                     key: ruleName,
-                    targets: Object.values(rule).map(getFunctionRef),
+                    targets: Object.values(rule).map(getFunctionRef).filter(Boolean),
                     targetNames: Object.keys(rule),
                 })),
             },

package/constructs/NextjsSite.js

@@ -89,7 +89,7 @@ export class NextjsSite extends SsrSite {
         const fn = new EdgeFunction(this, "Middleware", {
             bundlePath,
             handler,
-            timeout: 10,
+            timeout: 5,
             memorySize: 128,
             permissions,
             environment,

package/constructs/SsrSite.js

@@ -13,15 +13,15 @@ import { Function, Code, Runtime, FunctionUrlAuthType, } from "aws-cdk-lib/aws-l
 import { HostedZone, ARecord, AaaaRecord, RecordTarget, } from "aws-cdk-lib/aws-route53";
 import { Asset } from "aws-cdk-lib/aws-s3-assets";
 import { Distribution, ViewerProtocolPolicy, AllowedMethods, CachedMethods, LambdaEdgeEventType, CachePolicy, CacheQueryStringBehavior, CacheHeaderBehavior, CacheCookieBehavior, } from "aws-cdk-lib/aws-cloudfront";
-import { DnsValidatedCertificate, } from "aws-cdk-lib/aws-certificatemanager";
 import { AwsCliLayer } from "aws-cdk-lib/lambda-layer-awscli";
 import { S3Origin, HttpOrigin } from "aws-cdk-lib/aws-cloudfront-origins";
 import { CloudFrontTarget } from "aws-cdk-lib/aws-route53-targets";
-import { HttpsRedirect } from "aws-cdk-lib/aws-route53-patterns";
 import { Stack } from "./Stack.js";
 import { Logger } from "../logger.js";
 import { isCDKConstruct } from "./Construct.js";
 import { getBuildCmdEnvironment, } from "./BaseSite.js";
+import { HttpsRedirect } from "./cdk/website-redirect.js";
+import { DnsValidatedCertificate } from "./cdk/dns-validated-certificate.js";
 import { attachPermissionsToRole } from "./util/permission.js";
 import { ENVIRONMENT_PLACEHOLDER, getParameterPath, } from "./util/functionBinding.js";
 import { SiteEnv } from "../site-env.js";

package/constructs/StaticSite.js

@@ -7,17 +7,17 @@ import { Construct } from "constructs";
 import { Token, Duration, CfnOutput, RemovalPolicy, CustomResource, } from "aws-cdk-lib";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import * as s3Assets from "aws-cdk-lib/aws-s3-assets";
-import * as acm from "aws-cdk-lib/aws-certificatemanager";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as route53 from "aws-cdk-lib/aws-route53";
-import * as route53Patterns from "aws-cdk-lib/aws-route53-patterns";
 import * as route53Targets from "aws-cdk-lib/aws-route53-targets";
 import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
 import * as cfOrigins from "aws-cdk-lib/aws-cloudfront-origins";
 import { AwsCliLayer } from "aws-cdk-lib/lambda-layer-awscli";
 import { Stack } from "./Stack.js";
 import { getBuildCmdEnvironment, buildErrorResponsesFor404ErrorPage, buildErrorResponsesForRedirectToIndex, } from "./BaseSite.js";
+import { HttpsRedirect } from "./cdk/website-redirect.js";
+import { DnsValidatedCertificate } from "./cdk/dns-validated-certificate.js";
 import { isCDKConstruct } from "./Construct.js";
 import { ENVIRONMENT_PLACEHOLDER, getParameterPath, } from "./util/functionBinding.js";
 import { gray } from "colorette";
@@ -519,7 +519,7 @@ interface ImportMeta {
         // HostedZone is set for Route 53 domains
         if (this.hostedZone) {
             if (typeof customDomain === "string") {
-                acmCertificate = new acm.DnsValidatedCertificate(this, "Certificate", {
+                acmCertificate = new DnsValidatedCertificate(this, "Certificate", {
                     domainName: customDomain,
                     hostedZone: this.hostedZone,
                     region: "us-east-1",
@@ -529,7 +529,7 @@ interface ImportMeta {
                 acmCertificate = customDomain.cdk.certificate;
             }
             else {
-                acmCertificate = new acm.DnsValidatedCertificate(this, "Certificate", {
+                acmCertificate = new DnsValidatedCertificate(this, "Certificate", {
                     domainName: customDomain.domainName,
                     hostedZone: this.hostedZone,
                     region: "us-east-1",
@@ -568,7 +568,7 @@ interface ImportMeta {
         new route53.AaaaRecord(this, "AliasRecordAAAA", recordProps);
         // Create Alias redirect record
         if (domainAlias) {
-            new route53Patterns.HttpsRedirect(this, "Redirect", {
+            new HttpsRedirect(this, "Redirect", {
                 zone: this.hostedZone,
                 recordNames: [domainAlias],
                 targetDomain: recordName,

package/constructs/cdk/certificate-base.d.ts

@@ -0,0 +1,18 @@
+import { Metric, MetricOptions } from "aws-cdk-lib/aws-cloudwatch";
+import { Resource } from "aws-cdk-lib";
+import { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
+/**
+ * Shared implementation details of ICertificate implementations.
+ *
+ * @internal
+ */
+export declare abstract class CertificateBase extends Resource implements ICertificate {
+    abstract readonly certificateArn: string;
+    /**
+     * If the certificate is provisionned in a different region than the
+     * containing stack, this should be the region in which the certificate lives
+     * so we can correctly create `Metric` instances.
+     */
+    protected readonly region?: string;
+    metricDaysToExpiry(props?: MetricOptions): Metric;
+}

package/constructs/cdk/certificate-base.js

@@ -0,0 +1,26 @@
+import { Metric, Stats } from "aws-cdk-lib/aws-cloudwatch";
+import { Duration, Resource } from "aws-cdk-lib";
+/**
+ * Shared implementation details of ICertificate implementations.
+ *
+ * @internal
+ */
+export class CertificateBase extends Resource {
+    /**
+     * If the certificate is provisionned in a different region than the
+     * containing stack, this should be the region in which the certificate lives
+     * so we can correctly create `Metric` instances.
+     */
+    region;
+    metricDaysToExpiry(props) {
+        return new Metric({
+            period: Duration.days(1),
+            ...props,
+            dimensionsMap: { CertificateArn: this.certificateArn },
+            metricName: "DaysToExpiry",
+            namespace: "AWS/CertificateManager",
+            region: this.region,
+            statistic: Stats.MINIMUM,
+        });
+    }
+}

package/constructs/cdk/dns-validated-certificate.d.ts

@@ -0,0 +1,77 @@
+import { Construct } from "constructs";
+import { ITaggable, TagManager, RemovalPolicy } from "aws-cdk-lib";
+import { CertificateProps, ICertificate } from "aws-cdk-lib/aws-certificatemanager";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as route53 from "aws-cdk-lib/aws-route53";
+import { CertificateBase } from "./certificate-base.js";
+/**
+ * Properties to create a DNS validated certificate managed by AWS Certificate Manager
+ *
+ */
+export interface DnsValidatedCertificateProps extends CertificateProps {
+    /**
+     * Route 53 Hosted Zone used to perform DNS validation of the request.  The zone
+     * must be authoritative for the domain name specified in the Certificate Request.
+     */
+    readonly hostedZone: route53.IHostedZone;
+    /**
+     * AWS region that will host the certificate. This is needed especially
+     * for certificates used for CloudFront distributions, which require the region
+     * to be us-east-1.
+     *
+     * @default the region the stack is deployed in.
+     */
+    readonly region?: string;
+    /**
+     * An endpoint of Route53 service, which is not necessary as AWS SDK could figure
+     * out the right endpoints for most regions, but for some regions such as those in
+     * aws-cn partition, the default endpoint is not working now, hence the right endpoint
+     * need to be specified through this prop.
+     *
+     * Route53 is not been officially launched in China, it is only available for AWS
+     * internal accounts now. To make DnsValidatedCertificate work for internal accounts
+     * now, a special endpoint needs to be provided.
+     *
+     * @default - The AWS SDK will determine the Route53 endpoint to use based on region
+     */
+    readonly route53Endpoint?: string;
+    /**
+     * Role to use for the custom resource that creates the validated certificate
+     *
+     * @default - A new role will be created
+     */
+    readonly customResourceRole?: iam.IRole;
+    /**
+     * When set to true, when the DnsValidatedCertificate is deleted,
+     * the associated Route53 validation records are removed.
+     *
+     * CAUTION: If multiple certificates share the same domains (and same validation records),
+     * this can cause the other certificates to fail renewal and/or not validate.
+     * Not recommended for production use.
+     *
+     * @default false
+     */
+    readonly cleanupRoute53Records?: boolean;
+}
+/**
+ * A certificate managed by AWS Certificate Manager.  Will be automatically
+ * validated using DNS validation against the specified Route 53 hosted zone.
+ *
+ * @resource AWS::CertificateManager::Certificate
+ */
+export declare class DnsValidatedCertificate extends CertificateBase implements ICertificate, ITaggable {
+    readonly certificateArn: string;
+    /**
+     * Resource Tags.
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-certificatemanager-certificate.html#cfn-certificatemanager-certificate-tags
+     */
+    readonly tags: TagManager;
+    protected readonly region?: string;
+    private normalizedZoneName;
+    private hostedZoneId;
+    private domainName;
+    private _removalPolicy?;
+    constructor(scope: Construct, id: string, props: DnsValidatedCertificateProps);
+    applyRemovalPolicy(policy: RemovalPolicy): void;
+    private validateDnsValidatedCertificate;
+}

package/constructs/cdk/dns-validated-certificate.js

@@ -0,0 +1,125 @@
+import url from "url";
+import * as path from "path";
+import { Token, TagManager, TagType, Duration, Stack, CustomResource, Lazy, } from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+import { CertificateBase } from "./certificate-base.js";
+const __dirname = url.fileURLToPath(new URL(".", import.meta.url));
+/**
+ * A certificate managed by AWS Certificate Manager.  Will be automatically
+ * validated using DNS validation against the specified Route 53 hosted zone.
+ *
+ * @resource AWS::CertificateManager::Certificate
+ */
+export class DnsValidatedCertificate extends CertificateBase {
+    certificateArn;
+    /**
+     * Resource Tags.
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-certificatemanager-certificate.html#cfn-certificatemanager-certificate-tags
+     */
+    tags;
+    region;
+    normalizedZoneName;
+    hostedZoneId;
+    domainName;
+    _removalPolicy;
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.region = props.region;
+        this.domainName = props.domainName;
+        // check if domain name is 64 characters or less
+        if (!Token.isUnresolved(props.domainName) && props.domainName.length > 64) {
+            throw new Error("Domain name must be 64 characters or less");
+        }
+        this.normalizedZoneName = props.hostedZone.zoneName;
+        // Remove trailing `.` from zone name
+        if (this.normalizedZoneName.endsWith(".")) {
+            this.normalizedZoneName = this.normalizedZoneName.substring(0, this.normalizedZoneName.length - 1);
+        }
+        // Remove any `/hostedzone/` prefix from the Hosted Zone ID
+        this.hostedZoneId = props.hostedZone.hostedZoneId.replace(/^\/hostedzone\//, "");
+        this.tags = new TagManager(TagType.MAP, "AWS::CertificateManager::Certificate");
+        let certificateTransparencyLoggingPreference;
+        if (props.transparencyLoggingEnabled !== undefined) {
+            certificateTransparencyLoggingPreference =
+                props.transparencyLoggingEnabled ? "ENABLED" : "DISABLED";
+        }
+        const requestorFunction = new lambda.Function(this, "CertificateRequestorFunction", {
+            code: lambda.Code.fromAsset(path.join(__dirname, "../../support/certificate-requestor")),
+            handler: "index.certificateRequestHandler",
+            runtime: lambda.Runtime.NODEJS_14_X,
+            timeout: Duration.minutes(15),
+            role: props.customResourceRole,
+        });
+        requestorFunction.addToRolePolicy(new iam.PolicyStatement({
+            actions: [
+                "acm:RequestCertificate",
+                "acm:DescribeCertificate",
+                "acm:DeleteCertificate",
+                "acm:AddTagsToCertificate",
+            ],
+            resources: ["*"],
+        }));
+        requestorFunction.addToRolePolicy(new iam.PolicyStatement({
+            actions: ["route53:GetChange"],
+            resources: ["*"],
+        }));
+        requestorFunction.addToRolePolicy(new iam.PolicyStatement({
+            actions: ["route53:changeResourceRecordSets"],
+            resources: [
+                `arn:${Stack.of(requestorFunction).partition}:route53:::hostedzone/${this.hostedZoneId}`,
+            ],
+            conditions: {
+                "ForAllValues:StringEquals": {
+                    "route53:ChangeResourceRecordSetsRecordTypes": ["CNAME"],
+                    "route53:ChangeResourceRecordSetsActions": props.cleanupRoute53Records ? ["UPSERT", "DELETE"] : ["UPSERT"],
+                },
+                "ForAllValues:StringLike": {
+                    "route53:ChangeResourceRecordSetsNormalizedRecordNames": [
+                        addWildcard(props.domainName),
+                        ...(props.subjectAlternativeNames ?? []).map((d) => addWildcard(d)),
+                    ],
+                },
+            },
+        }));
+        const certificate = new CustomResource(this, "CertificateRequestorResource", {
+            serviceToken: requestorFunction.functionArn,
+            properties: {
+                DomainName: props.domainName,
+                SubjectAlternativeNames: Lazy.list({ produce: () => props.subjectAlternativeNames }, { omitEmpty: true }),
+                CertificateTransparencyLoggingPreference: certificateTransparencyLoggingPreference,
+                HostedZoneId: this.hostedZoneId,
+                Region: props.region,
+                Route53Endpoint: props.route53Endpoint,
+                RemovalPolicy: Lazy.any({ produce: () => this._removalPolicy }),
+                // Custom resources properties are always converted to strings; might as well be explict here.
+                CleanupRecords: props.cleanupRoute53Records ? "true" : undefined,
+                Tags: Lazy.list({ produce: () => this.tags.renderTags() }),
+            },
+        });
+        this.certificateArn = certificate.getAtt("Arn").toString();
+        this.node.addValidation({
+            validate: () => this.validateDnsValidatedCertificate(),
+        });
+    }
+    applyRemovalPolicy(policy) {
+        this._removalPolicy = policy;
+    }
+    validateDnsValidatedCertificate() {
+        const errors = [];
+        // Ensure the zone name is a parent zone of the certificate domain name
+        if (!Token.isUnresolved(this.normalizedZoneName) &&
+            this.domainName !== this.normalizedZoneName &&
+            !this.domainName.endsWith("." + this.normalizedZoneName)) {
+            errors.push(`DNS zone ${this.normalizedZoneName} is not authoritative for certificate domain name ${this.domainName}`);
+        }
+        return errors;
+    }
+}
+// https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/specifying-rrset-conditions.html
+function addWildcard(domainName) {
+    if (domainName.startsWith("*.")) {
+        return domainName;
+    }
+    return `*.${domainName}`;
+}

package/constructs/cdk/website-redirect.d.ts

@@ -0,0 +1,53 @@
+import { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
+import { IHostedZone } from "aws-cdk-lib/aws-route53";
+import { Construct } from "constructs";
+/**
+ * Properties to configure an HTTPS Redirect
+ */
+export interface HttpsRedirectProps {
+    /**
+     * Hosted zone of the domain which will be used to create alias record(s) from
+     * domain names in the hosted zone to the target domain. The hosted zone must
+     * contain entries for the domain name(s) supplied through `recordNames` that
+     * will redirect to the target domain.
+     *
+     * Domain names in the hosted zone can include a specific domain (example.com)
+     * and its subdomains (acme.example.com, zenith.example.com).
+     *
+     */
+    readonly zone: IHostedZone;
+    /**
+     * The redirect target fully qualified domain name (FQDN). An alias record
+     * will be created that points to your CloudFront distribution. Root domain
+     * or sub-domain can be supplied.
+     */
+    readonly targetDomain: string;
+    /**
+     * The domain names that will redirect to `targetDomain`
+     *
+     * @default - the domain name of the hosted zone
+     */
+    readonly recordNames?: string[];
+    /**
+     * The AWS Certificate Manager (ACM) certificate that will be associated with
+     * the CloudFront distribution that will be created. If provided, the certificate must be
+     * stored in us-east-1 (N. Virginia)
+     *
+     * @default - A new certificate is created in us-east-1 (N. Virginia)
+     */
+    readonly certificate?: ICertificate;
+}
+/**
+ * Allows creating a domainA -> domainB redirect using CloudFront and S3.
+ * You can specify multiple domains to be redirected.
+ */
+export declare class HttpsRedirect extends Construct {
+    constructor(scope: Construct, id: string, props: HttpsRedirectProps);
+    /**
+     * Creates a certificate.
+     *
+     * This is also safe to upgrade since the new certificate will be created and updated
+     * on the CloudFront distribution before the old one is deleted.
+     */
+    private createCertificate;
+}

package/constructs/cdk/website-redirect.js

@@ -0,0 +1,77 @@
+import { CloudFrontWebDistribution, OriginProtocolPolicy, PriceClass, ViewerCertificate, ViewerProtocolPolicy, } from "aws-cdk-lib/aws-cloudfront";
+import { ARecord, AaaaRecord, RecordTarget, } from "aws-cdk-lib/aws-route53";
+import { CloudFrontTarget } from "aws-cdk-lib/aws-route53-targets";
+import { BlockPublicAccess, Bucket, RedirectProtocol, } from "aws-cdk-lib/aws-s3";
+import { ArnFormat, RemovalPolicy, Stack, Token } from "aws-cdk-lib";
+import cdkHelpers from "aws-cdk-lib/core/lib/helpers-internal";
+import { Construct } from "constructs";
+import { DnsValidatedCertificate } from "./dns-validated-certificate.js";
+const { md5hash } = cdkHelpers;
+/**
+ * Allows creating a domainA -> domainB redirect using CloudFront and S3.
+ * You can specify multiple domains to be redirected.
+ */
+export class HttpsRedirect extends Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const domainNames = props.recordNames ?? [props.zone.zoneName];
+        if (props.certificate) {
+            const certificateRegion = Stack.of(this).splitArn(props.certificate.certificateArn, ArnFormat.SLASH_RESOURCE_NAME).region;
+            if (!Token.isUnresolved(certificateRegion) &&
+                certificateRegion !== "us-east-1") {
+                throw new Error(`The certificate must be in the us-east-1 region and the certificate you provided is in ${certificateRegion}.`);
+            }
+        }
+        const redirectCert = props.certificate ?? this.createCertificate(domainNames, props.zone);
+        const redirectBucket = new Bucket(this, "RedirectBucket", {
+            websiteRedirect: {
+                hostName: props.targetDomain,
+                protocol: RedirectProtocol.HTTPS,
+            },
+            removalPolicy: RemovalPolicy.DESTROY,
+            blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
+        });
+        const redirectDist = new CloudFrontWebDistribution(this, "RedirectDistribution", {
+            defaultRootObject: "",
+            originConfigs: [
+                {
+                    behaviors: [{ isDefaultBehavior: true }],
+                    customOriginSource: {
+                        domainName: redirectBucket.bucketWebsiteDomainName,
+                        originProtocolPolicy: OriginProtocolPolicy.HTTP_ONLY,
+                    },
+                },
+            ],
+            viewerCertificate: ViewerCertificate.fromAcmCertificate(redirectCert, {
+                aliases: domainNames,
+            }),
+            comment: `Redirect to ${props.targetDomain} from ${domainNames.join(", ")}`,
+            priceClass: PriceClass.PRICE_CLASS_ALL,
+            viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        });
+        domainNames.forEach((domainName) => {
+            const hash = md5hash(domainName).slice(0, 6);
+            const aliasProps = {
+                recordName: domainName,
+                zone: props.zone,
+                target: RecordTarget.fromAlias(new CloudFrontTarget(redirectDist)),
+            };
+            new ARecord(this, `RedirectAliasRecord${hash}`, aliasProps);
+            new AaaaRecord(this, `RedirectAliasRecordSix${hash}`, aliasProps);
+        });
+    }
+    /**
+     * Creates a certificate.
+     *
+     * This is also safe to upgrade since the new certificate will be created and updated
+     * on the CloudFront distribution before the old one is deleted.
+     */
+    createCertificate(domainNames, zone) {
+        return new DnsValidatedCertificate(this, "RedirectCertificate", {
+            domainName: domainNames[0],
+            subjectAlternativeNames: domainNames,
+            hostedZone: zone,
+            region: "us-east-1",
+        });
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sst",
-  "version": "2.0.0-rc.63",
+  "version": "2.0.0-rc.65",
   "bin": {
     "sst": "cli/sst.js"
   },
@@ -92,6 +92,7 @@
   "devDependencies": {
     "@aws-sdk/client-codebuild": "^3.257.0",
     "@aws-sdk/types": "^3.208.0",
+    "@graphql-tools/merge": "^8.3.16",
     "@sls-next/lambda-at-edge": "^3.7.0",
     "@tsconfig/node16": "^1.0.3",
     "@types/adm-zip": "^0.5.0",
@@ -108,7 +109,7 @@
     "@types/ws": "^8.5.3",
     "@types/yargs": "^17.0.13",
     "tsx": "^3.12.1",
-    "vitest": "^0.15.1"
+    "vitest": "^0.28.3"
   },
   "peerDependencies": {
     "@sls-next/lambda-at-edge": "^3.7.0"

package/pothos.js

@@ -77,6 +77,7 @@ export async function extractSchema(opts) {
                                 if (!types.isMemberExpression(callPath.node.callee) ||
                                     !types.isIdentifier(callPath.node.callee.object) ||
                                     !types.isIdentifier(callPath.node.callee.property) ||
+                                    !schemaBuilder ||
                                     (callPath.node.callee.object.name !==
                                         schemaBuilder.node.id.name &&
                                         callPath.node.callee.property.name !== "implement")) {