sst 2.21.7 → 2.22.0

package/bootstrap.js

@@ -5,7 +5,7 @@ import { spawn } from "child_process";
 import { DescribeStacksCommand, CloudFormationClient, } from "@aws-sdk/client-cloudformation";
 import { App, DefaultStackSynthesizer, Duration, CfnOutput, Tags, Stack, RemovalPolicy, } from "aws-cdk-lib/core";
 import { Function, Runtime, Code } from "aws-cdk-lib/aws-lambda";
-import { PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { ManagedPolicy, PermissionsBoundary, PolicyStatement, } from "aws-cdk-lib/aws-iam";
 import { Rule } from "aws-cdk-lib/aws-events";
 import { LambdaFunction } from "aws-cdk-lib/aws-events-targets";
 import { BlockPublicAccess, Bucket, BucketEncryption, } from "aws-cdk-lib/aws-s3";
@@ -29,10 +29,12 @@ export const useBootstrap = Context.memo(async () => {
         loadSSTStatus(),
     ]);
     Logger.debug("Loaded bootstrap status");
-    const needToBootstrapCDK = !cdkStatus;
-    const needToBootstrapSST = !sstStatus;
+    const needToBootstrapCDK = cdkStatus.status !== "ready";
+    const needToBootstrapSST = sstStatus.status !== "ready";
     if (needToBootstrapCDK || needToBootstrapSST) {
-        const spinner = createSpinner("Deploying bootstrap stack, this only needs to happen once").start();
+        const spinner = createSpinner(cdkStatus.status === "bootstrap" || sstStatus.status === "bootstrap"
+            ? "Deploying bootstrap stack, this only needs to happen once"
+            : "Updating bootstrap stack").start();
         if (needToBootstrapCDK) {
             await bootstrapCDK();
         }
@@ -40,7 +42,7 @@ export const useBootstrap = Context.memo(async () => {
             await bootstrapSST();
             // fetch bootstrap status
             sstStatus = await loadSSTStatus();
-            if (!sstStatus)
+            if (sstStatus.status !== "ready")
                 throw new VisibleError("Failed to load bootstrap stack status");
         }
         spinner.succeed();
@@ -56,24 +58,25 @@ async function loadCDKStatus() {
         const { Stacks: stacks } = await client.send(new DescribeStacksCommand({ StackName: stackName }));
         // Check CDK bootstrap stack exists
         if (!stacks || stacks.length === 0)
-            return false;
+            return { status: "bootstrap" };
         // Check CDK bootstrap stack deployed successfully
         if (!["CREATE_COMPLETE", "UPDATE_COMPLETE"].includes(stacks[0].StackStatus)) {
-            return false;
+            return { status: "bootstrap" };
         }
         // Check CDK bootstrap stack is up to date
         // note: there is no a programmatical way to get the minimal required version
         //       of CDK bootstrap stack. We are going to hardcode it to 14 for now,
         //       which is the latest version as of CDK v2.62.2
         const output = stacks[0].Outputs?.find((o) => o.OutputKey === "BootstrapVersion");
-        if (!output || parseInt(output.OutputValue) < 14)
-            return false;
-        return true;
+        if (!output || parseInt(output.OutputValue) < 14) {
+            return { status: "update" };
+        }
+        return { status: "ready" };
     }
     catch (e) {
         if (e.name === "ValidationError" &&
             e.message === `Stack with id ${stackName} does not exist`) {
-            return false;
+            return { status: "bootstrap" };
         }
         else {
             throw e;
@@ -94,7 +97,7 @@ async function loadSSTStatus() {
     catch (e) {
         if (e.Code === "ValidationError" &&
             e.message === `Stack with id ${stackName} does not exist`) {
-            return null;
+            return { status: "bootstrap" };
         }
         throw e;
     }
@@ -110,7 +113,7 @@ async function loadSSTStatus() {
         }
     });
     if (!version || !bucket) {
-        return null;
+        return { status: "bootstrap" };
     }
     // Need to update bootstrap stack:
     // 1. If current MAJOR version < latest MAJOR version
@@ -126,9 +129,9 @@ async function loadSSTStatus() {
     if (currentMajor < latestMajor ||
         currentMajor > latestMajor ||
         currentMinor < latestMinor) {
-        return null;
+        return { status: "update" };
     }
-    return { version, bucket };
+    return { status: "ready", version, bucket };
 }
 export async function bootstrapSST() {
     const { region, bootstrap, cdk } = useProject().config;
@@ -215,6 +218,11 @@ export async function bootstrapSST() {
         },
     });
     rule.addTarget(new LambdaFunction(fn));
+    // Create permissions boundary
+    if (cdk?.customPermissionsBoundary) {
+        const boundaryPolicy = ManagedPolicy.fromManagedPolicyName(stack, "PermissionBoundaryPolicy", cdk.customPermissionsBoundary);
+        PermissionsBoundary.of(stack).apply(boundaryPolicy);
+    }
     // Create stack outputs to store bootstrap stack info
     new CfnOutput(stack, OUTPUT_VERSION, { value: LATEST_VERSION });
     new CfnOutput(stack, OUTPUT_BUCKET, { value: bucket.bucketName });

package/cli/local/server.js

@@ -104,11 +104,38 @@ export async function useLocalServer(opts) {
     const wss = new WebSocketServer({ noServer: true });
     const wss2 = new WebSocketServer({ noServer: true });
     const sockets = new Set();
+    let buffer = [
+        {
+            type: "cli.dev",
+            properties: {
+                stage: project.config.stage,
+                app: project.config.name,
+            },
+        },
+    ];
+    function publish(type, properties) {
+        const msg = {
+            type,
+            properties,
+        };
+        buffer.push(msg);
+        const json = JSON.stringify(msg);
+        [...sockets.values()].map((s) => s.send(json));
+    }
     wss2.on("connection", (socket, req) => {
         sockets.add(socket);
+        for (const msg of buffer) {
+            socket.send(JSON.stringify(msg));
+        }
         socket.on("close", () => {
             sockets.delete(socket);
         });
+        socket.on("message", (data) => {
+            const parsed = JSON.parse(data.toString());
+            if (parsed.type === "log.cleared") {
+                buffer = buffer.filter((msg) => msg.properties?.functionID !== parsed.properties?.functionID);
+            }
+        });
     });
     wss.on("connection", (socket, req) => {
         if (req.headers.origin?.endsWith("localhost:3000"))
@@ -179,13 +206,6 @@ export async function useLocalServer(opts) {
             cb(func);
         });
     }
-    function publish(type, properties) {
-        const msg = JSON.stringify({
-            type,
-            properties,
-        });
-        [...sockets.values()].map((s) => s.send(msg));
-    }
     bus.subscribe("function.invoked", async (evt) => {
         publish("function.invoked", evt.properties);
         updateFunction(evt.properties.functionID, (draft) => {

package/constructs/BaseSite.d.ts

@@ -1,6 +1,12 @@
 import { IHostedZone } from "aws-cdk-lib/aws-route53";
 import { ErrorResponse, DistributionProps, BehaviorOptions, IOrigin } from "aws-cdk-lib/aws-cloudfront";
 import { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
+export interface BaseSiteFileOptions {
+    exclude: string | string[];
+    include: string | string[];
+    cacheControl: string;
+    contentType?: string;
+}
 /**
  * The customDomain for this website. SST supports domains that are hosted either on [Route 53](https://aws.amazon.com/route53/) or externally.
  *

package/constructs/Function.d.ts

@@ -13,24 +13,14 @@ import { Size as CDKSize, Duration as CDKDuration } from "aws-cdk-lib/core";
 declare const supportedRuntimes: {
     container: CDKRuntime;
     rust: CDKRuntime;
-    nodejs: CDKRuntime;
-    "nodejs4.3": CDKRuntime;
-    "nodejs6.10": CDKRuntime;
-    "nodejs8.10": CDKRuntime;
-    "nodejs10.x": CDKRuntime;
     "nodejs12.x": CDKRuntime;
     "nodejs14.x": CDKRuntime;
     "nodejs16.x": CDKRuntime;
     "nodejs18.x": CDKRuntime;
-    "python2.7": CDKRuntime;
-    "python3.6": CDKRuntime;
     "python3.7": CDKRuntime;
     "python3.8": CDKRuntime;
     "python3.9": CDKRuntime;
     "python3.10": CDKRuntime;
-    "dotnetcore1.0": CDKRuntime;
-    "dotnetcore2.0": CDKRuntime;
-    "dotnetcore2.1": CDKRuntime;
     "dotnetcore3.1": CDKRuntime;
     dotnet6: CDKRuntime;
     java8: CDKRuntime;
@@ -66,6 +56,10 @@ export interface FunctionProps extends Omit<FunctionOptions, "functionName" | "m
      *```
      */
     copyFiles?: FunctionCopyFilesProps[];
+    /**
+     * Used to configure go function properties
+     */
+    go?: GoProps;
     /**
      * Used to configure nodejs function properties
      */
@@ -458,6 +452,47 @@ export interface PythonProps {
      */
     installCommands?: string[];
 }
+/**
+ * Used to configure Go bundling options
+ */
+export interface GoProps {
+    /**
+     * The ldflags to use when building the Go module.
+     *
+     * @default ["-s", "-w"]
+     * @example
+     * ```js
+     * go: {
+     *   ldFlags: ["-X main.version=1.0.0"],
+     * }
+     * ```
+     */
+    ldFlags?: string[];
+    /**
+     * The build tags to use when building the Go module.
+     *
+     * @default []
+     * @example
+     * ```js
+     * go: {
+     *   buildTags: ["enterprise", "pro"],
+     * }
+     * ```
+     */
+    buildTags?: string[];
+    /**
+     * Whether to enable CGO for the Go build.
+     *
+     * @default false
+     * @example
+     * ```js
+     * go: {
+     *   cgoEnabled: true,
+     * }
+     * ```
+     */
+    cgoEnabled?: boolean;
+}
 /**
  * Used to configure Java package build options
  */

package/constructs/Function.js

@@ -27,24 +27,14 @@ const __dirname = url.fileURLToPath(new URL(".", import.meta.url));
 const supportedRuntimes = {
     container: CDKRuntime.FROM_IMAGE,
     rust: CDKRuntime.PROVIDED_AL2,
-    nodejs: CDKRuntime.NODEJS,
-    "nodejs4.3": CDKRuntime.NODEJS_4_3,
-    "nodejs6.10": CDKRuntime.NODEJS_6_10,
-    "nodejs8.10": CDKRuntime.NODEJS_8_10,
-    "nodejs10.x": CDKRuntime.NODEJS_10_X,
     "nodejs12.x": CDKRuntime.NODEJS_12_X,
     "nodejs14.x": CDKRuntime.NODEJS_14_X,
     "nodejs16.x": CDKRuntime.NODEJS_16_X,
     "nodejs18.x": CDKRuntime.NODEJS_18_X,
-    "python2.7": CDKRuntime.PYTHON_2_7,
-    "python3.6": CDKRuntime.PYTHON_3_6,
     "python3.7": CDKRuntime.PYTHON_3_7,
     "python3.8": CDKRuntime.PYTHON_3_8,
     "python3.9": CDKRuntime.PYTHON_3_9,
     "python3.10": CDKRuntime.PYTHON_3_10,
-    "dotnetcore1.0": CDKRuntime.DOTNET_CORE_1,
-    "dotnetcore2.0": CDKRuntime.DOTNET_CORE_2,
-    "dotnetcore2.1": CDKRuntime.DOTNET_CORE_2_1,
     "dotnetcore3.1": CDKRuntime.DOTNET_CORE_3_1,
     dotnet6: CDKRuntime.DOTNET_6,
     java8: CDKRuntime.JAVA_8,

package/constructs/RemixSite.js

@@ -72,9 +72,11 @@ export class RemixSite extends SsrSite {
         // appropriate Lambda@Edge handler. We will utilise an internal asset
         // template to create this wrapper within the "core server build" output
         // directory.
+        // Ensure build directory exists
+        const buildPath = path.join(this.props.path, "build");
+        fs.mkdirSync(buildPath, { recursive: true });
         // Copy the server lambda handler
-        const handler = path.join(this.props.path, "build", "server.js");
-        fs.copyFileSync(path.resolve(__dirname, `../support/remix-site-function/${wrapperFile}`), handler);
+        fs.copyFileSync(path.resolve(__dirname, `../support/remix-site-function/${wrapperFile}`), path.join(buildPath, "server.js"));
         // Copy the Remix polyfil to the server build directory
         //
         // Note: We need to ensure that the polyfills are injected above other code that
@@ -82,10 +84,10 @@ export class RemixSite extends SsrSite {
         // doesn't appear to guarantee this, we therefore leverage ESBUild's
         // `inject` option to ensure that the polyfills are injected at the top of
         // the bundle.
-        const polyfillDest = path.join(this.props.path, "build/polyfill.js");
+        const polyfillDest = path.join(buildPath, "polyfill.js");
         fs.copyFileSync(path.resolve(__dirname, "../support/remix-site-function/polyfill.js"), polyfillDest);
         return {
-            handler: path.join(this.props.path, "build", "server.handler"),
+            handler: path.join(buildPath, "server.handler"),
             esbuild: { inject: [polyfillDest] },
         };
     }

package/constructs/SsrSite.d.ts

@@ -8,7 +8,7 @@ import { SSTConstruct } from "./Construct.js";
 import { NodeJSProps } from "./Function.js";
 import { SsrFunction } from "./SsrFunction.js";
 import { EdgeFunction } from "./EdgeFunction.js";
-import { BaseSiteDomainProps, BaseSiteReplaceProps, BaseSiteCdkDistributionProps } from "./BaseSite.js";
+import { BaseSiteFileOptions, BaseSiteDomainProps, BaseSiteReplaceProps, BaseSiteCdkDistributionProps } from "./BaseSite.js";
 import { Size } from "./util/size.js";
 import { Duration } from "./util/duration.js";
 import { Permissions } from "./util/permission.js";
@@ -27,6 +27,8 @@ export interface SsrSiteNodeJSProps extends NodeJSProps {
 }
 export interface SsrDomainProps extends BaseSiteDomainProps {
 }
+export interface SsrSiteFileOptions extends BaseSiteFileOptions {
+}
 export interface SsrSiteReplaceProps extends BaseSiteReplaceProps {
 }
 export interface SsrCdkDistributionProps extends BaseSiteCdkDistributionProps {
@@ -192,6 +194,60 @@ export interface SsrSiteProps {
         responseHeadersPolicy?: IResponseHeadersPolicy;
         server?: Pick<FunctionProps, "vpc" | "vpcSubnets" | "securityGroups" | "allowAllOutbound" | "allowPublicSubnet" | "architecture" | "logRetention">;
     };
+    /**
+     * Pass in a list of file options to customize cache control and content type specific files.
+     *
+     * @default Versioned files cached for 1 year at the CDN and brower level. Unversioned files cached for 1 year at the CDN level, but not at the browser level.
+     * ```js
+     * [
+     *   {
+     *     exclude: "*",
+     *     include: "{versioned_directory}/*",
+     *     cacheControl: "public,max-age=31536000,immutable",
+     *   },
+     *   {
+     *     exclude: "*",
+     *     include: "[{non_versioned_file1}, {non_versioned_file2}, ...]",
+     *     cacheControl: "public,max-age=0,s-maxage=31536000,must-revalidate",
+     *   },
+     *   {
+     *     exclude: "*",
+     *     include: "[{non_versioned_dir_1}/*, {non_versioned_dir_2}/*, ...]",
+     *     cacheControl: "public,max-age=0,s-maxage=31536000,must-revalidate",
+     *   },
+     * ]
+     * ```
+     *
+     * @example
+     * ```js
+     * new AstroSite(stack, "Site", {
+     *   fileOptions: [
+     *     {
+     *       exclude: "*",
+     *       include: "{versioned_directory}/*.css",
+     *       cacheControl: "public,max-age=31536000,immutable",
+     *       contentType: "text/css; charset=UTF-8",
+     *     },
+     *     {
+     *       exclude: "*",
+     *       include: "[{versioned_directory}/*.js]",
+     *       cacheControl: "public,max-age=31536000,immutable",
+     *     },
+     *     {
+     *       exclude: "*",
+     *       include: "[{non_versioned_file1}, {non_versioned_file2}, ...]",
+     *       cacheControl: "public,max-age=0,s-maxage=31536000,must-revalidate",
+     *     },
+     *     {
+     *       exclude: "*",
+     *       include: "[{non_versioned_dir_1}/*, {non_versioned_dir_2}/*, ...]",
+     *       cacheControl: "public,max-age=0,s-maxage=31536000,must-revalidate",
+     *     },
+     *   ]
+     * });
+     * ```
+     */
+    fileOptions?: SsrSiteFileOptions[];
 }
 type SsrSiteNormalizedProps = SsrSiteProps & {
     path: Exclude<SsrSiteProps["path"], undefined>;

package/constructs/SsrSite.js

@@ -348,12 +348,14 @@ export class SsrSite extends Construct {
         return assets;
     }
     createS3AssetFileOptions() {
+        if (this.props.fileOptions)
+            return this.props.fileOptions;
         // Build file options
         const fileOptions = [];
         const clientPath = path.join(this.props.path, this.buildConfig.clientBuildOutputDir);
         for (const item of fs.readdirSync(clientPath)) {
             // Versioned files will be cached for 1 year (immutable) both at
-            // CDN and browser level.
+            // the CDN and browser level.
             if (item === this.buildConfig.clientBuildVersionedSubDir) {
                 fileOptions.push({
                     exclude: "*",
@@ -425,15 +427,19 @@ export class SsrSite extends Construct {
                     ObjectKey: asset.s3ObjectKey,
                 })),
                 DestinationBucketName: this.bucket.bucketName,
-                FileOptions: (fileOptions || []).map(({ exclude, include, cacheControl }) => {
+                FileOptions: (fileOptions || []).map(({ exclude, include, cacheControl, contentType }) => {
+                    if (typeof exclude === "string") {
+                        exclude = [exclude];
+                    }
+                    if (typeof include === "string") {
+                        include = [include];
+                    }
                     return [
-                        "--exclude",
-                        exclude,
-                        "--include",
-                        include,
-                        "--cache-control",
-                        cacheControl,
-                    ];
+                        ...exclude.map((per) => ["--exclude", per]),
+                        ...include.map((per) => ["--include", per]),
+                        ["--cache-control", cacheControl],
+                        contentType ? ["--content-type", contentType] : [],
+                    ].flat();
                 }),
                 ReplaceValues: this.getS3ContentReplaceValues(),
             },

package/constructs/StaticSite.d.ts

@@ -3,15 +3,9 @@ import { Bucket, BucketProps, IBucket } from "aws-cdk-lib/aws-s3";
 import { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
 import { IHostedZone } from "aws-cdk-lib/aws-route53";
 import { Distribution, IDistribution } from "aws-cdk-lib/aws-cloudfront";
-import { BaseSiteDomainProps, BaseSiteReplaceProps, BaseSiteCdkDistributionProps } from "./BaseSite.js";
+import { BaseSiteDomainProps, BaseSiteFileOptions, BaseSiteReplaceProps, BaseSiteCdkDistributionProps } from "./BaseSite.js";
 import { SSTConstruct } from "./Construct.js";
 import { FunctionBindingProps } from "./util/functionBinding.js";
-export interface StaticSiteFileOptions {
-    exclude: string | string[];
-    include: string | string[];
-    cacheControl: string;
-    contentType?: string;
-}
 export interface StaticSiteProps {
     /**
      * Path to the directory where the website source is located.
@@ -77,7 +71,7 @@ export interface StaticSiteProps {
     /**
      * Pass in a list of file options to configure cache control for different files. Behind the scenes, the `StaticSite` construct uses a combination of the `s3 cp` and `s3 sync` commands to upload the website content to the S3 bucket. An `s3 cp` command is run for each file option block, and the options are passed in as the command options.
      *
-     * Defaults to no cache control for HTML files, and a 1 year cache control for JS/CSS files.
+     * @default No cache control for HTML files, and a 1 year cache control for JS/CSS files.
      * ```js
      * [
      *   {
@@ -274,6 +268,8 @@ export interface StaticSiteProps {
 }
 export interface StaticSiteDomainProps extends BaseSiteDomainProps {
 }
+export interface StaticSiteFileOptions extends BaseSiteFileOptions {
+}
 export interface StaticSiteReplaceProps extends BaseSiteReplaceProps {
 }
 export interface StaticSiteCdkDistributionProps extends BaseSiteCdkDistributionProps {

package/constructs/util/permission.js

@@ -195,6 +195,9 @@ function permissionsToStatementsAndGrants(permissions) {
             if (secret) {
                 statements.push(buildPolicyStatement(["secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret"], [secret.secretArn]));
             }
+            if (secret?.encryptionKey) {
+                statements.push(buildPolicyStatement(["kms:Decrypt"], [secret.encryptionKey.keyArn]));
+            }
         }
         ////////////////////////////////////
         // Case: grant method

package/package.json

@@ -1,7 +1,7 @@
 {
   "sideEffects": false,
   "name": "sst",
-  "version": "2.21.7",
+  "version": "2.22.0",
   "bin": {
     "sst": "cli/sst.js"
   },

package/runtime/handlers/go.js

@@ -55,11 +55,20 @@ export const useGoHandler = Context.memo(async () => {
             const project = await find(parsed.dir, "go.mod");
             sources.set(input.functionID, project);
             const src = path.relative(project, input.props.handler);
+            const ldFlags = input.props.go?.ldFlags || ["-s", "-w"];
+            const buildTags = input.props.go?.buildTags || [];
             if (input.mode === "start") {
                 try {
                     const target = path.join(input.out, handlerName);
                     const srcPath = os.platform() === "win32" ? src.replaceAll("\\", "\\\\") : src;
-                    const result = await execAsync(`go build -ldflags "-s -w" -o "${target}" ./${srcPath}`, {
+                    const result = await execAsync([
+                        "go",
+                        "build",
+                        ...(ldFlags ? [`-ldflags "${ldFlags.join(" ")}"`] : []),
+                        ...(buildTags ? [`-t ${buildTags.join(" ")}`] : []),
+                        `-o "${target}"`,
+                        `./${srcPath}`,
+                    ].join(" "), {
                         cwd: project,
                         env: {
                             ...process.env,
@@ -77,11 +86,18 @@ export const useGoHandler = Context.memo(async () => {
                 try {
                     const target = path.join(input.out, "bootstrap");
                     const srcPath = os.platform() === "win32" ? src.replaceAll("\\", "\\\\") : src;
-                    await execAsync(`go build -ldflags "-s -w" -o "${target}" ./${srcPath}`, {
+                    await execAsync([
+                        "go",
+                        "build",
+                        ...(ldFlags ? [`-ldflags "${ldFlags.join(" ")}"`] : []),
+                        ...(buildTags ? [`-t ${buildTags.join(" ")}`] : []),
+                        `-o "${target}"`,
+                        `./${srcPath}`,
+                    ].join(" "), {
                         cwd: project,
                         env: {
                             ...process.env,
-                            CGO_ENABLED: "0",
+                            CGO_ENABLED: input.props.go?.cgoEnabled ? "1" : "0",
                             GOARCH: input.props.architecture === "arm_64" ? "arm64" : "amd64",
                             GOOS: "linux",
                         },

package/runtime/handlers/rust.js

@@ -3,7 +3,6 @@ import fs from "fs/promises";
 import { useRuntimeHandlers } from "../handlers.js";
 import { useRuntimeWorkers } from "../workers.js";
 import { Context } from "../../context/context.js";
-import { VisibleError } from "../../error.js";
 import { exec, spawn } from "child_process";
 import { promisify } from "util";
 import { useRuntimeServerConfig } from "../server.js";
@@ -66,7 +65,7 @@ export const useRustHandler = Context.memo(async () => {
             sources.set(input.functionID, project);
             if (input.mode === "start") {
                 try {
-                    await execAsync(`cargo build --bin ${parsed.name}`, {
+                    await execAsync(["cargo", "build", `--bin ${parsed.name}`].join(" "), {
                         cwd: project,
                         env: {
                             ...process.env,
@@ -75,12 +74,22 @@ export const useRustHandler = Context.memo(async () => {
                     await fs.cp(path.join(project, `target/debug`, parsed.name), path.join(input.out, "handler"));
                 }
                 catch (ex) {
-                    throw new VisibleError("Failed to build");
+                    return {
+                        type: "error",
+                        errors: [String(ex)],
+                    };
                 }
             }
             if (input.mode === "deploy") {
                 try {
-                    await execAsync(`cargo lambda build --release --bin ${parsed.name}`, {
+                    await execAsync([
+                        "cargo",
+                        "lambda",
+                        "build",
+                        "--release",
+                        ...(input.props.architecture === "arm_64" ? ["--arm64"] : []),
+                        `--bin ${parsed.name}`,
+                    ].join(" "), {
                         cwd: project,
                         env: {
                             ...process.env,
@@ -89,7 +98,10 @@ export const useRustHandler = Context.memo(async () => {
                     await fs.cp(path.join(project, `target/lambda/`, parsed.name, "bootstrap"), path.join(input.out, "bootstrap"));
                 }
                 catch (ex) {
-                    throw new VisibleError("Failed to build");
+                    return {
+                        type: "error",
+                        errors: [String(ex)],
+                    };
                 }
             }
             return {

package/sst.mjs

@@ -5660,12 +5660,21 @@ var init_go = __esm({
           const project = await find(parsed.dir, "go.mod");
           sources.set(input.functionID, project);
           const src = path11.relative(project, input.props.handler);
+          const ldFlags = input.props.go?.ldFlags || ["-s", "-w"];
+          const buildTags = input.props.go?.buildTags || [];
           if (input.mode === "start") {
             try {
               const target = path11.join(input.out, handlerName);
               const srcPath = os4.platform() === "win32" ? src.replaceAll("\\", "\\\\") : src;
               const result = await execAsync(
-                `go build -ldflags "-s -w" -o "${target}" ./${srcPath}`,
+                [
+                  "go",
+                  "build",
+                  ...ldFlags ? [`-ldflags "${ldFlags.join(" ")}"`] : [],
+                  ...buildTags ? [`-t ${buildTags.join(" ")}`] : [],
+                  `-o "${target}"`,
+                  `./${srcPath}`
+                ].join(" "),
                 {
                   cwd: project,
                   env: {
@@ -5685,12 +5694,19 @@ var init_go = __esm({
               const target = path11.join(input.out, "bootstrap");
               const srcPath = os4.platform() === "win32" ? src.replaceAll("\\", "\\\\") : src;
               await execAsync(
-                `go build -ldflags "-s -w" -o "${target}" ./${srcPath}`,
+                [
+                  "go",
+                  "build",
+                  ...ldFlags ? [`-ldflags "${ldFlags.join(" ")}"`] : [],
+                  ...buildTags ? [`-t ${buildTags.join(" ")}`] : [],
+                  `-o "${target}"`,
+                  `./${srcPath}`
+                ].join(" "),
                 {
                   cwd: project,
                   env: {
                     ...process.env,
-                    CGO_ENABLED: "0",
+                    CGO_ENABLED: input.props.go?.cgoEnabled ? "1" : "0",
                     GOARCH: input.props.architecture === "arm_64" ? "arm64" : "amd64",
                     GOOS: "linux"
                   }
@@ -5993,7 +6009,6 @@ var init_rust = __esm({
     init_handlers2();
     init_workers();
     init_context();
-    init_error();
     init_server();
     init_fs();
     execAsync2 = promisify2(exec4);
@@ -6054,34 +6069,53 @@ var init_rust = __esm({
           sources.set(input.functionID, project);
           if (input.mode === "start") {
             try {
-              await execAsync2(`cargo build --bin ${parsed.name}`, {
-                cwd: project,
-                env: {
-                  ...process.env
+              await execAsync2(
+                ["cargo", "build", `--bin ${parsed.name}`].join(" "),
+                {
+                  cwd: project,
+                  env: {
+                    ...process.env
+                  }
                 }
-              });
+              );
               await fs11.cp(
                 path12.join(project, `target/debug`, parsed.name),
                 path12.join(input.out, "handler")
               );
             } catch (ex) {
-              throw new VisibleError("Failed to build");
+              return {
+                type: "error",
+                errors: [String(ex)]
+              };
             }
           }
           if (input.mode === "deploy") {
             try {
-              await execAsync2(`cargo lambda build --release --bin ${parsed.name}`, {
-                cwd: project,
-                env: {
-                  ...process.env
+              await execAsync2(
+                [
+                  "cargo",
+                  "lambda",
+                  "build",
+                  "--release",
+                  ...input.props.architecture === "arm_64" ? ["--arm64"] : [],
+                  `--bin ${parsed.name}`
+                ].join(" "),
+                {
+                  cwd: project,
+                  env: {
+                    ...process.env
+                  }
                 }
-              });
+              );
               await fs11.cp(
                 path12.join(project, `target/lambda/`, parsed.name, "bootstrap"),
                 path12.join(input.out, "bootstrap")
               );
             } catch (ex) {
-              throw new VisibleError("Failed to build");
+              return {
+                type: "error",
+                errors: [String(ex)]
+              };
             }
           }
           return {
@@ -6661,7 +6695,11 @@ import {
   RemovalPolicy
 } from "aws-cdk-lib/core";
 import { Function, Runtime as Runtime2, Code } from "aws-cdk-lib/aws-lambda";
-import { PolicyStatement } from "aws-cdk-lib/aws-iam";
+import {
+  ManagedPolicy,
+  PermissionsBoundary,
+  PolicyStatement
+} from "aws-cdk-lib/aws-iam";
 import { Rule } from "aws-cdk-lib/aws-events";
 import { LambdaFunction } from "aws-cdk-lib/aws-events-targets";
 import {
@@ -6678,19 +6716,20 @@ async function loadCDKStatus() {
       new DescribeStacksCommand2({ StackName: stackName })
     );
     if (!stacks || stacks.length === 0)
-      return false;
+      return { status: "bootstrap" };
     if (!["CREATE_COMPLETE", "UPDATE_COMPLETE"].includes(stacks[0].StackStatus)) {
-      return false;
+      return { status: "bootstrap" };
     }
     const output = stacks[0].Outputs?.find(
       (o) => o.OutputKey === "BootstrapVersion"
     );
-    if (!output || parseInt(output.OutputValue) < 14)
-      return false;
-    return true;
+    if (!output || parseInt(output.OutputValue) < 14) {
+      return { status: "update" };
+    }
+    return { status: "ready" };
   } catch (e) {
     if (e.name === "ValidationError" && e.message === `Stack with id ${stackName} does not exist`) {
-      return false;
+      return { status: "bootstrap" };
     } else {
       throw e;
     }
@@ -6709,7 +6748,7 @@ async function loadSSTStatus() {
     );
   } catch (e) {
     if (e.Code === "ValidationError" && e.message === `Stack with id ${stackName} does not exist`) {
-      return null;
+      return { status: "bootstrap" };
     }
     throw e;
   }
@@ -6723,7 +6762,7 @@ async function loadSSTStatus() {
     }
   });
   if (!version2 || !bucket) {
-    return null;
+    return { status: "bootstrap" };
   }
   const latestParts = LATEST_VERSION.split(".");
   const latestMajor = parseInt(latestParts[0]);
@@ -6732,9 +6771,9 @@ async function loadSSTStatus() {
   const currentMajor = parseInt(currentParts[0]);
   const currentMinor = parseInt(currentParts[1] || "0");
   if (currentMajor < latestMajor || currentMajor > latestMajor || currentMinor < latestMinor) {
-    return null;
+    return { status: "update" };
   }
-  return { version: version2, bucket };
+  return { status: "ready", version: version2, bucket };
 }
 async function bootstrapSST() {
   const { region, bootstrap: bootstrap2, cdk } = useProject().config;
@@ -6815,6 +6854,14 @@ async function bootstrapSST() {
     }
   });
   rule.addTarget(new LambdaFunction(fn));
+  if (cdk?.customPermissionsBoundary) {
+    const boundaryPolicy = ManagedPolicy.fromManagedPolicyName(
+      stack,
+      "PermissionBoundaryPolicy",
+      cdk.customPermissionsBoundary
+    );
+    PermissionsBoundary.of(stack).apply(boundaryPolicy);
+  }
   new CfnOutput(stack, OUTPUT_VERSION, { value: LATEST_VERSION });
   new CfnOutput(stack, OUTPUT_BUCKET, { value: bucket.bucketName });
   const asm = app.synth();
@@ -6904,11 +6951,11 @@ var init_bootstrap = __esm({
         loadSSTStatus()
       ]);
       Logger.debug("Loaded bootstrap status");
-      const needToBootstrapCDK = !cdkStatus;
-      const needToBootstrapSST = !sstStatus;
+      const needToBootstrapCDK = cdkStatus.status !== "ready";
+      const needToBootstrapSST = sstStatus.status !== "ready";
       if (needToBootstrapCDK || needToBootstrapSST) {
         const spinner = createSpinner(
-          "Deploying bootstrap stack, this only needs to happen once"
+          cdkStatus.status === "bootstrap" || sstStatus.status === "bootstrap" ? "Deploying bootstrap stack, this only needs to happen once" : "Updating bootstrap stack"
         ).start();
         if (needToBootstrapCDK) {
           await bootstrapCDK();
@@ -6916,7 +6963,7 @@ var init_bootstrap = __esm({
         if (needToBootstrapSST) {
           await bootstrapSST();
           sstStatus = await loadSSTStatus();
-          if (!sstStatus)
+          if (sstStatus.status !== "ready")
             throw new VisibleError("Failed to load bootstrap stack status");
         }
         spinner.succeed();
@@ -7085,11 +7132,40 @@ async function useLocalServer(opts) {
   const wss = new WebSocketServer({ noServer: true });
   const wss2 = new WebSocketServer({ noServer: true });
   const sockets = /* @__PURE__ */ new Set();
+  let buffer = [
+    {
+      type: "cli.dev",
+      properties: {
+        stage: project.config.stage,
+        app: project.config.name
+      }
+    }
+  ];
+  function publish(type, properties) {
+    const msg = {
+      type,
+      properties
+    };
+    buffer.push(msg);
+    const json = JSON.stringify(msg);
+    [...sockets.values()].map((s) => s.send(json));
+  }
   wss2.on("connection", (socket, req) => {
     sockets.add(socket);
+    for (const msg of buffer) {
+      socket.send(JSON.stringify(msg));
+    }
     socket.on("close", () => {
       sockets.delete(socket);
     });
+    socket.on("message", (data2) => {
+      const parsed = JSON.parse(data2.toString());
+      if (parsed.type === "log.cleared") {
+        buffer = buffer.filter(
+          (msg) => msg.properties?.functionID !== parsed.properties?.functionID
+        );
+      }
+    });
   });
   wss.on("connection", (socket, req) => {
     if (req.headers.origin?.endsWith("localhost:3000"))
@@ -7160,13 +7236,6 @@ async function useLocalServer(opts) {
       cb(func);
     });
   }
-  function publish(type, properties) {
-    const msg = JSON.stringify({
-      type,
-      properties
-    });
-    [...sockets.values()].map((s) => s.send(msg));
-  }
   bus.subscribe("function.invoked", async (evt) => {
     publish("function.invoked", evt.properties);
     updateFunction(evt.properties.functionID, (draft) => {