
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
povery-cli
Advanced tools
Povery is a framework for developing AWS Lambda functions with TypeScript. This CLI tool facilitates local development, testing, and deployment of serverless applications.
Povery CLI enables developers to:
Unlike other serverless frameworks, Povery CLI focuses exclusively on Lambda function management without infrastructure provisioning. This adheres to the principle of separation of concerns between application logic and infrastructure management.
The local development server functionality is built on top of the Serverless Framework, leveraging its offline capabilities to simulate AWS Lambda and API Gateway locally. This integration provides a high-fidelity local development experience that closely mirrors the AWS production environment while maintaining a streamlined developer workflow.
The CLI requires a specific project structure:
/<project_root>
lambda/
API_Something/
index.ts
EVENT_Something/
index.ts
event.json
povery.json
lambda/
directoryindex.ts
as its entry pointAPI_
(e.g., API_UserService
)EVENT_
(e.g., EVENT_DataProcessor
)npm i -D povery-cli
Add to your package.json
:
{
"scripts": {
"povery": "povery-cli"
}
}
Usage:
npm run povery
When passing options:
npm run povery function deploy API_UserService -- --stage dev
npm i -g povery-cli
povery-cli --help
povery-cli start [options]
Options:
-t, --timeout <seconds>
: Set the Lambda timeout in seconds (default: 30)Configure routes in povery.json
:
{
"lambdas": {
"API_UserService": [
{
"method": "ANY",
"path": "/{proxy+}"
}
]
}
}
Start the local server:
povery-cli start
You can customize the Lambda timeout for local development:
povery-cli start --timeout 60
This sets the Lambda timeout to 60 seconds (default is 30 seconds) which is useful for debugging or when working with long-running operations.
By default, Lambda functions have a 30-second timeout when running locally. If you're experiencing timeout issues during debugging or when working with long-running operations, you can increase this limit using the --timeout
parameter.
Execute a Lambda function with the event.json
file in its directory:
povery-cli function invoke EVENT_DataProcessor
When sharing code between Lambda functions, use TypeScript path aliases instead of relative imports:
// Incorrect - will break transpilation
import { Something } from '../../common/something.ts';
// Correct
import { Something } from '@common/something.ts';
Configure tsconfig.json
with appropriate path mappings:
{
"compilerOptions": {
"baseUrl": "./",
"paths": {
"@common/*": "common/*",
"povery": "node_modules/povery"
}
}
}
The explicit povery
path mapping prevents esbuild transpilation issues.
The povery.json
file supports the following configuration options:
deployStrategy
""
(empty string): Deploys Lambda functions without prefix or alias (e.g., API_UserService
)STAGE_PREFIX
: Deploys with stage name as prefix (e.g., dev_API_UserService
)STAGE_ALIAS
: Deploys with stage name as alias (e.g., API_UserService:dev
)installScript
Specifies a custom script to run instead of the default npm install
during Lambda build.
esbuild
Provides configuration options for esbuild:
{
"esbuild": {
"external": ["pg"]
}
}
This is particularly useful for:
Interactive mode:
povery-cli function
Direct deployment:
povery-cli function deploy <lambda_name>
Deploy all Lambda functions (ideal for CI/CD pipelines):
povery-cli deploy
Povery CLI follows a structured process when building Lambda functions:
Clean Build Directory:
.dist
directory for the specified Lambda function.dist
directory for the build outputInstall Dependencies:
.tmp
) if it doesn't existpackage.json
to the temporary foldernpm install --omit=dev
(or a custom install script specified in povery.json
)node_modules
to the Lambda's .dist/node_modules
TypeScript Compilation:
tsconfig.json
tsconfig.json
with appropriate settingstsc --noEmit
./lambda/<functionName>/index.ts
./lambda/<functionName>/.dist/index.js
povery.json
Package Creation:
index.js
)index.js.map
)./lambda/<functionName>/.dist/<functionName>.zip
Deployment (if requested):
deployStrategy
in povery.json
This process can be initiated in several ways:
# Interactive mode
povery-cli function
# Direct build (package only)
povery-cli function build <functionName>
# Direct deployment (build and publish)
povery-cli function deploy <functionName>
# With environment option
povery-cli function deploy <functionName> --environment prod
# Force dependency reinstallation
povery-cli function deploy <functionName> --nocache
By default, Povery CLI:
Enable source maps for debugging by adding this environment variable to your Lambda:
NODE_OPTIONS=--enable-source-maps
Note: This may impact performance and is not recommended for production environments. Consider using error tracking services like Sentry with uploaded source maps instead.
Povery CLI provides several commands for managing the deployment lifecycle of your Lambda functions:
The function
command is the primary interface for working with individual Lambda functions:
povery-cli function [operation] [functionName] [options]
Available operations:
info
: Retrieve information about a deployed Lambda functionbuild
: Build the Lambda package without deployingdeploy
: Build and deploy the Lambda functionpromote
: Promote a Lambda function to a different stageinvoke
: Run the Lambda function locally with an eventclean
: Remove build artifactsOptions:
-p, --payload <payload>
: Specify a payload for function invocation-e, --eventFilename <string>
: Specify an event file for invocation-z, --environment <string>
: Target environment (default: 'dev')-nc, --nocache
: Disable cache and force npm install--auth
: Load claims file for authorization testingIf no operation or function name is provided, an interactive wizard will guide you through the process.
To deploy all Lambda functions at once:
povery-cli deploy [options]
Options:
-y, --yes
: Automatically confirm all prompts-nc, --nocache
: Disable cache and force npm install-z, --environment <string>
: Target environment (default: 'dev')To increment the version of all Lambda functions:
povery-cli version
This command:
$LATEST
Lambda functiondev
alias to point to $LATEST
To upload a Lambda Layer:
povery-cli layers [functionName]
If no function name is provided, an interactive wizard will guide you through the process.
To promote Lambda functions between stages:
povery-cli promote [stage]
Available promotion paths:
dev -> test
: Promotes from development to testingtest -> prod
: Promotes from testing to productionThe promotion process:
dev -> test
: Creates a new version and sets the test
alias to that versionTo deploy API Gateway configurations:
povery-cli api
This command allows you to select a stage (dev, staging, prod) and deploys the API Gateway configuration for all Lambda functions.
Create a .envrc
file in your project root to define environment variables. All exported variables will be available during local Lambda execution.
Add the following to your .gitignore
file:
.serverless.*
Contributions are welcome. Please feel free to submit issues and pull requests.
MIT
FAQs
Povery - The CLI
The npm package povery-cli receives a total of 46 weekly downloads. As such, povery-cli popularity was classified as not popular.
We found that povery-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.