// The Init phase executes everything at module scope:
import { DynamoDBClient } from '@aws-sdk/client-dynamodb'
import { DynamoDBDocumentClient } from '@aws-sdk/lib-dynamodb'
import { SecretsManagerClient, GetSecretValueCommand } from '@aws-sdk/client-secrets-manager'

// ✅ All of these run ONCE in Init, never again for warm invocations
const region = process.env.AWS_REGION!
const dynamoClient = new DynamoDBClient({ region })
export const docClient = DynamoDBDocumentClient.from(dynamoClient)

// Secret fetch in global scope — runs once, cached in the MicroVM lifetime
const sm = new SecretsManagerClient({ region })
const secretResponse = await sm.send(
  new GetSecretValueCommand({ SecretId: process.env.DB_SECRET_ARN! })
)
export const dbPassword = JSON.parse(secretResponse.SecretString!).password

// Handler registration — runs after Init completes
export const handler = async (event: AWSLambda.APIGatewayProxyEvent) => {
  // Warm invocations start here — Init phase is already complete
  // docClient and dbPassword are already initialized and available
}

export const handler = async (
  event: AWSLambda.SQSEvent,
  context: AWSLambda.Context
): Promise<AWSLambda.SQSBatchResponse> => {
  // context.awsRequestId — unique per invocation, use as correlation ID
  // context.getRemainingTimeInMillis() — milliseconds until timeout fires
  const remainingMs = context.getRemainingTimeInMillis()

  const failures: AWSLambda.SQSBatchItemFailure[] = []

  for (const record of event.Records) {
    if (context.getRemainingTimeInMillis() < 500) {
      // Less than 500ms remaining — report remaining records as failures
      // SQS will redeliver them; better than a forced timeout
      failures.push({ itemIdentifier: record.messageId })
      continue
    }
    try {
      await processRecord(record)
    } catch (err) {
      failures.push({ itemIdentifier: record.messageId })
    }
  }

  return { batchItemFailures: failures }
}

// Register a SIGTERM handler for graceful cleanup
process.on('SIGTERM', async () => {
  console.log('SIGTERM received — flushing pending telemetry')
  // Close database connection pools
  // Flush buffered metrics / log spans
  // Complete any in-flight writes
  await flushTelemetry()
  process.exit(0)
})

Cold invocation:    [Init: 180ms] → [Invoke: 45ms] → [Freeze]
Warm invocation 1:  [Thaw] → [Invoke: 12ms] → [Freeze]
Warm invocation 2:  [Thaw] → [Invoke: 11ms] → [Freeze]
Warm invocation 3:  [Thaw] → [Invoke: 13ms] → [Freeze]

// ✅ Exploit context reuse: connection pool initialized once
import { Pool } from 'pg'

// Pool is created on Init, reused across all warm invocations
// Without this pattern: new Pool() on every invocation = 40-80ms overhead each time
const pool = new Pool({
  host: process.env.DB_HOST,
  database: process.env.DB_NAME,
  password: dbPassword, // from global scope secret fetch
  max: 1,              // ⚠️ Keep max=1 for Lambda — RDS Proxy handles pooling above
  idleTimeoutMillis: 10_000
})

export const handler = async (event: AWSLambda.APIGatewayProxyEvent) => {
  const client = await pool.connect()
  try {
    const result = await client.query('SELECT id, name FROM users WHERE id = $1', [
      event.pathParameters!.userId
    ])
    return { statusCode: 200, body: JSON.stringify(result.rows[0]) }
  } finally {
    client.release() // Return to pool — NOT pool.end()
  }
}

interface CacheEntry<T> {
  value: T
  expiresAt: number
}

// Module-level cache — survives freeze/thaw cycles
const cache = new Map<string, CacheEntry<unknown>>()

async function getCached<T>(
  key: string,
  ttlMs: number,
  fetch: () => Promise<T>
): Promise<T> {
  const entry = cache.get(key) as CacheEntry<T> | undefined
  if (entry && Date.now() < entry.expiresAt) {
    return entry.value // Cache hit — no external call
  }
  const value = await fetch()
  cache.set(key, { value, expiresAt: Date.now() + ttlMs })
  return value
}

export const handler = async (event: AWSLambda.APIGatewayProxyEvent) => {
  // Fetches config from Parameter Store at most once per 5 minutes per container
  // At 1,000 concurrent invocations: reduces SSM API calls by 99.9%
  const config = await getCached(
    'feature-flags',
    5 * 60 * 1000, // 5 minute TTL
    () => ssm.send(new GetParameterCommand({ Name: '/app/feature-flags', WithDecryption: true }))
      .then(r => JSON.parse(r.Parameter!.Value!))
  )
  // use config...
}

import { createWriteStream, existsSync, readFileSync } from 'fs'
import { pipeline } from 'stream/promises'
import { Readable } from 'stream'

const MODEL_PATH = '/tmp/model-weights.bin'

async function ensureModelLoaded(): Promise<Buffer> {
  if (existsSync(MODEL_PATH)) {
    // ✅ Warm invocation: model already downloaded in a previous invocation
    return readFileSync(MODEL_PATH)
  }
  // Cold path: download from S3, cache to /tmp
  const response = await s3.send(
    new GetObjectCommand({ Bucket: 'my-models', Key: 'model-weights.bin' })
  )
  await pipeline(response.Body as Readable, createWriteStream(MODEL_PATH))
  return readFileSync(MODEL_PATH)
}

Total cold start duration = Runtime bootstrap + Dependency loading + Static initializer execution

// ❌ Entire AWS SDK v2 — 4.4MB unzipped, loads hundreds of service clients on require()
const AWS = require('aws-sdk')
const dynamo = new AWS.DynamoDB.DocumentClient()

// ✅ AWS SDK v3 modular — import only what you use
import { DynamoDBClient } from '@aws-sdk/client-dynamodb'
import { DynamoDBDocumentClient, GetCommand } from '@aws-sdk/lib-dynamodb'
// @aws-sdk/client-dynamodb alone: ~180KB vs 4.4MB for the full v2 SDK

# esbuild bundles + tree-shakes + minifies to a single file
npx esbuild src/handler.ts \
  --bundle \
  --minify \
  --platform=node \
  --target=node20 \
  --external:@aws-sdk/* \   # AWS SDK v3 is available in the Lambda runtime — don't bundle it
  --outfile=dist/handler.js

# Before bundling: 45MB node_modules
# After bundling (excluding AWS SDK): 240KB — 187× reduction

// CDK: Provisioned Concurrency configuration
import { Function, Runtime, Code } from 'aws-cdk-lib/aws-lambda'
import { Alias } from 'aws-cdk-lib/aws-lambda'

const fn = new Function(this, 'OrderProcessor', {
  runtime: Runtime.NODEJS_20_X,
  handler: 'handler.handler',
  code: Code.fromAsset('dist'),
  memorySize: 1024,
})

const alias = new Alias(this, 'Live', {
  aliasName: 'live',
  version: fn.currentVersion,
  provisionedConcurrentExecutions: 10 // 10 warm instances always available
})

At 512MB:   512/1024 × 0.8s = 0.4 GB-seconds per invocation
At 1024MB:  1024/1024 × 0.4s = 0.4 GB-seconds per invocation  ← same cost, 2× faster!
At 1024MB:  1024/1024 × 0.35s = 0.35 GB-seconds               ← sometimes cheaper

# Deploy Power Tuning via SAR
aws serverlessrepo create-cloud-formation-change-set \
  --application-id arn:aws:serverlessrepo:us-east-1:451282441545:applications/aws-lambda-power-tuning \
  --stack-name power-tuning \
  --capabilities CAPABILITY_IAM \
  --parameter-overrides '[{"Name":"lambdaResource","Value":"*"}]'

# Python: SnapStart with snapshot-restore runtime hooks (Python 3.12+)
# Use pre-installed snapshot_restore library to manage snapshot/restore lifecycle
import boto3
from snapshot_restore import register_before_snapshot, register_after_restore

# Initialized at snapshot time (MicroVM Init phase)
dynamodb = boto3.client('dynamodb')

@register_before_snapshot
def before_checkpoint():
    """
    Runs before the MicroVM snapshot is taken.
    Close any connections or sockets that should NOT be serialized into the snapshot.
    """
    global dynamodb
    # Close connection pool before checkpointing
    dynamodb.close()

@register_after_restore
def after_restore():
    """
    Runs after the MicroVM is restored from snapshot (must complete within 2 seconds).
    Re-establish connections and refresh any unique state (entropy, tokens).
    """
    global dynamodb
    dynamodb = boto3.client('dynamodb')

def handler(event, context):
    response = dynamodb.get_item(
        TableName="Orders",
        Key={"orderId": {"S": event["pathParameters"]["id"]}}
    )
    return {
        "statusCode": 200,
        "body": str(response.get("Item", {}))
    }