@ashishpandeyone/cdk-lambda-web-function 0.1.0 → 0.1.2

package/.jsii

@@ -9745,7 +9745,7 @@
   },
   "name": "@ashishpandeyone/cdk-lambda-web-function",
   "readme": {
-    "markdown": "# CDK constructs for AWS Lambda Web Functions\n\n<!--BEGIN STABILITY BANNER-->\n\n---\n\n![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)\n\n> The APIs of higher level constructs in this module are experimental and under active development.\n> They are subject to non-backward compatible changes or removal in any future version. These are\n> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be\n> announced in the release notes. This means that while you may use them, you may need to update\n> your source code when upgrading to a newer version of this package.\n\n---\n\n<!--END STABILITY BANNER-->\n\n[AWS Lambda Web Functions](https://aws.amazon.com/lambda/) run an ordinary Node.js HTTP server (Express, Fastify, Hono, `node:http`) on Lambda and give it an HTTPS endpoint, optionally served from several regions. `WebFunction` deploys one, following the conventions of `aws-cdk-lib/aws-lambda` where the two services overlap.\n\n```ts fixture=bare\nimport * as lambda from 'aws-cdk-lib/aws-lambda';\nimport { WebFunction, WebFunctionAuthType, WebFunctionEndpointType } from '@ashishpandeyone/cdk-lambda-web-function';\n\nconst fn = new WebFunction(this, 'Api', {\n  runtime: lambda.Runtime.NODEJS_24_X,\n  code: lambda.Code.fromAsset('dist'),\n  authType: WebFunctionAuthType.AWS_IAM,\n  endpoint: {\n    endpointType: WebFunctionEndpointType.MULTI_REGION,\n    regions: ['us-east-1', 'eu-west-1'],\n  },\n});\n\nnew CfnOutput(this, 'Url', { value: fn.endpoint.url }); // https://<id>.lambda-web.global.on.aws\n```\n\nThe stack's region is the function's **home region**. Multi-region endpoints need a stack with an explicit `env.region`.\n\n## Writing the server\n\n1. Listen on the host and port in **`AWS_LAMBDA_HTTP_ENDPOINT`** (`0.0.0.0:3000` today). `PORT` is not set.\n2. Start listening within **about 9 seconds**, or initialisation fails with `Application.TimeoutListenError`.\n3. Put the entry file at the root of your bundle as **`index.js`**, or set `entrypoint`.\n4. The runtime has **no AWS SDK**: bundle the clients you import.\n5. Code runs on **arm64**.\n\n```js\nconst express = require('express');\n\nconst app = express();\napp.get('/', (req, res) => res.json({ hello: 'world', region: process.env.AWS_REGION }));\n\nconst [host, port] = process.env.AWS_LAMBDA_HTTP_ENDPOINT.split(':');\napp.listen(Number(port), host);\n```\n\nRequests carry `lambda-web-request-id` and `lambda-web-endpoint-name` headers.\n\n## Regions and endpoints\n\nEach `WebFunction` has one endpoint, `fn.endpoint`:\n\n| `endpointType` | URL | Routing |\n|---|---|---|\n| `HOME_REGION` (default) | `https://<id>.<cell>.lambda-web.<home>.on.aws` | home region only |\n| `MULTI_REGION` | one global `https://<id>.lambda-web.global.on.aws` | nearest region |\n| `PER_REGION` | one URL per region, from `fn.endpoint.regionalUrl(region)` | the region in the hostname |\n\n```ts\nconst perRegion = new WebFunction(this, 'Api', {\n  runtime: lambda.Runtime.NODEJS_24_X,\n  code: lambda.Code.fromAsset('dist'),\n  authType: WebFunctionAuthType.AWS_IAM,\n  endpoint: {\n    endpointType: WebFunctionEndpointType.PER_REGION,\n    regions: ['us-east-1', 'eu-west-1'],\n  },\n});\n\nnew CfnOutput(this, 'UsEast1Url', { value: perRegion.endpoint.regionalUrl('us-east-1') });\n// perRegion.endpoint.regions is ['<home region>', 'eu-west-1', 'us-east-1']\n```\n\n- `MULTI_REGION` and `PER_REGION` need at least one region besides the home region; `HOME_REGION` takes none.\n- A MultiRegion endpoint takes about a minute to create.\n\n### Changing regions or the endpoint type\n\nAn endpoint's type and regions can't change in place: a change creates a **new endpoint with a new URL**, and the old one is deleted once the new one is live. Two endpoints of one function can't share a name, so:\n\n| `endpointName` | Physical name | Changing `regions` or `endpointType` |\n|---|---|---|\n| omitted (recommended) | `default-<hash of type and regions>` | works: new endpoint, new URL |\n| set, e.g. `'live'` | `live` | also change the name in the same deployment, or it fails with *The endpoint live already exists* (the stack rolls back and the old endpoint keeps serving) |\n\nThe construct warns at synth time when `endpointName` is set.\n\n## Authentication and invoking\n\n| `authType` | Meaning |\n|---|---|\n| `AWS_IAM` | Callers sign requests (SigV4 or SigV4a, signing name `lambda`) and need `lambda:InvokeWebFunctionEndpoint` |\n| `NONE` | **Public**: Lambda does no authentication; your application does (JWT, sessions). The `Authorization` header reaches your application untouched. The construct warns at synth time |\n\n```ts\nfn.grants.invoke(consumerRole); // or fn.grantInvoke(consumerRole), as on lambda.Function\n```\n\nThe grant is on the endpoint's home-region ARN, which IAM evaluates in every region the endpoint serves from, including the global URL.\n\n| Endpoint | How to sign |\n|---|---|\n| `HOME_REGION` | SigV4 for the home region |\n| `PER_REGION` | SigV4 for the hostname's region, or SigV4a |\n| `MULTI_REGION` | **SigV4a with region set `*`**: you can't know which region will serve the request |\n\n```js\nimport { SignatureV4a } from '@smithy/signature-v4a';\nimport { Sha256 } from '@aws-crypto/sha256-js';\nimport { fromNodeProviderChain } from '@aws-sdk/credential-providers';\n\nconst signer = new SignatureV4a({ service: 'lambda', region: '*', sha256: Sha256, credentials: fromNodeProviderChain() });\nconst signed = await signer.sign(\n  { method: 'GET', protocol: 'https:', hostname: host, path: '/', headers: { host } },\n  { signingRegion: '*' },\n);\nconst response = await fetch(`https://${host}/`, { headers: signed.headers });\n```\n\n## Configuration\n\n```ts\nconst api = new WebFunction(this, 'Api', {\n  runtime: lambda.Runtime.NODEJS_24_X,\n  code: lambda.Code.fromAsset('build'),\n  authType: WebFunctionAuthType.AWS_IAM,\n  entrypoint: 'server.js',               // default index.js\n  webFunctionName: 'orders-api',         // default: generated from the construct path\n  description: 'Orders HTTP API',\n  environment: { TABLE_NAME: table.tableName },\n  timeout: Duration.seconds(60),         // per request: 3 seconds to 15 minutes, default 30 seconds\n  maxConcurrencyPerEnvironment: 32,      // requests per environment at once: 1-128, default 64\n});\n\napi.addEnvironment('FEATURE_FLAG', 'on');\ntable.grantReadWriteData(api);           // the default role trusts lambda.amazonaws.com\n```\n\n- Requests handled by one environment share module-level state, so keep handlers concurrency-safe.\n- Environment variable names starting with `AWS_` are reserved.\n- **Renaming the function replaces it and changes its URL.** A generated name depends on the construct path, so moving the construct renames it too.\n\n### Code\n\n`code` takes any `lambda.Code` that produces a zip in S3: `fromAsset`, `fromBucket`/`fromBucketV2`, `fromCustomCommand`, `fromDockerBuild`. Inline code and container images fail at synth time.\n\nLambda Web Functions download code as the `lambda.amazonaws.com` service principal, from a **versioned** bucket, and the CDK bootstrap bucket allows neither. So each stack gets a small code bucket, and the code is copied into it on deploy.\n\n### Updates\n\nAny change to code or configuration creates a new **revision**. The endpoint switches to it once it's ready, and the old revision is deleted after the deployment succeeds; a failed deployment rolls back to it. If nothing changed, nothing is deployed.\n\n## Logs in every region\n\nWeb Functions log in two tiers:\n\n```text\n every serving region               home region\n ┌──────────────────┐              ┌──────────────────────────────────────────┐\n │ <group>.local    │── copied ───►│ <group>   every region's logs            │\n │ (that region's   │  (seconds)   │ streams …[rev]<instance>-<acct>-<region> │\n │  environments)   │              │ <group>.local  (home-region traffic)     │\n └──────────────────┘              └──────────────────────────────────────────┘\n```\n\n**Query `fn.logGroup`**, the home-region group that receives every region's logs. The service would create missing groups without retention and never delete them, so the construct creates and owns all of them: both home-region groups, and `<group>.local` in every other region of the endpoint.\n\n```ts\nnew WebFunction(this, 'Api', {\n  runtime: lambda.Runtime.NODEJS_24_X,\n  code: lambda.Code.fromAsset('dist'),\n  authType: WebFunctionAuthType.AWS_IAM,\n  logRetention: logs.RetentionDays.THREE_MONTHS,    // default ONE_MONTH, every group in every region\n  logRemovalPolicy: RemovalPolicy.DESTROY,           // default RETAIN\n  applicationLogLevelV2: lambda.ApplicationLogLevel.WARN,\n  systemLogLevelV2: lambda.SystemLogLevel.INFO,      // DEBUG, INFO or WARN\n});\n```\n\n- The default group is `/aws/lambda/web/<function name>`. Log lines are JSON; application lines carry `requestId`, `endpointName` and `region`.\n- Every event is stored twice (`.local` plus the home-region copy), so expect about double log ingestion, plus cross-region transfer.\n- With `DESTROY`, deletion waits about a minute after the function is gone, because environments flush their last lines late.\n- Subscribe only to `fn.logGroup`: subscribing to the `.local` groups as well delivers every event twice.\n\n## Limitations\n\n- One endpoint per function; no traffic splitting between revisions.\n- Not yet supported: importing existing functions, VPC access (network connectors), resource-policy permissions, KMS encryption, metrics helpers, tracing, and a CloudFront origin.\n- `cdk deploy --hotswap` and `cdk watch` don't support Web Functions.\n- Quotas per account and region: 50 revisions and 10 endpoints per function, 200 Arm vCPUs, 10,000 requests per second.\n- The stack's custom resource provider Lambda keeps its own log group after the stack is deleted, as with other CDK custom resources.\n\n## Development\n\nTooling is pinned in `mise.toml` (Node 24, AWS CDK CLI). Personal settings, such as the AWS profile for the live end-to-end tests, go in a git-ignored `mise.local.toml`.\n\n```bash\nmise install\nnpx projen build      # compile, unit tests, lint, API docs\nnpx projen e2e        # deploy, verify and destroy real stacks in three regions (needs AWS credentials)\n```\n"
+    "markdown": "# CDK constructs for AWS Lambda Web Functions\n\n<!--BEGIN STABILITY BANNER-->\n\n---\n\n![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)\n\n> The APIs of higher level constructs in this module are experimental and under active development.\n> They are subject to non-backward compatible changes or removal in any future version. These are\n> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be\n> announced in the release notes. This means that while you may use them, you may need to update\n> your source code when upgrading to a newer version of this package.\n\n---\n\n<!--END STABILITY BANNER-->\n\n[AWS Lambda Web Functions](https://aws.amazon.com/lambda/) run an ordinary Node.js HTTP server (Express, Fastify, Hono, `node:http`) on Lambda and give it an HTTPS endpoint, optionally served from several regions. `WebFunction` deploys one, following the conventions of `aws-cdk-lib/aws-lambda` where the two services overlap.\n\n```ts fixture=bare\nimport * as lambda from 'aws-cdk-lib/aws-lambda';\nimport { WebFunction, WebFunctionAuthType, WebFunctionEndpointType } from '@ashishpandeyone/cdk-lambda-web-function';\n\nconst fn = new WebFunction(this, 'Api', {\n  runtime: lambda.Runtime.NODEJS_24_X,\n  code: lambda.Code.fromAsset('dist'),\n  authType: WebFunctionAuthType.AWS_IAM,\n  endpoint: {\n    endpointType: WebFunctionEndpointType.MULTI_REGION,\n    regions: ['us-east-1', 'eu-west-1'],\n  },\n});\n\nnew CfnOutput(this, 'Url', { value: fn.endpoint.url }); // https://<id>.lambda-web.global.on.aws\n```\n\nThe stack's region is the function's **home region**. Multi-region endpoints need a stack with an explicit `env.region`.\n\n## Writing the server\n\n1. Listen on the host and port in **`AWS_LAMBDA_HTTP_ENDPOINT`** (`0.0.0.0:3000` today). `PORT` is not set.\n2. Start listening within **about 9 seconds**, or initialisation fails with `Application.TimeoutListenError`.\n3. Put the entry file at the root of your bundle as **`index.js`**, or set `entrypoint`.\n4. The runtime has **no AWS SDK**: bundle the clients you import.\n5. Code runs on **arm64**.\n\n```js\nconst express = require('express');\n\nconst app = express();\napp.get('/', (req, res) => res.json({ hello: 'world', region: process.env.AWS_REGION }));\n\nconst [host, port] = process.env.AWS_LAMBDA_HTTP_ENDPOINT.split(':');\napp.listen(Number(port), host);\n```\n\nRequests carry `lambda-web-request-id` and `lambda-web-endpoint-name` headers.\n\n## Regions and endpoints\n\nEach `WebFunction` has a default endpoint, `fn.endpoint`, configured with the `endpoint` property. [Add more](#more-endpoints) with `fn.addEndpoint()`.\n\n| `endpointType` | URL | Routing |\n|---|---|---|\n| `HOME_REGION` (default) | `https://<id>.<cell>.lambda-web.<home>.on.aws` | home region only |\n| `MULTI_REGION` | one global `https://<id>.lambda-web.global.on.aws` | nearest region |\n| `PER_REGION` | one URL per region, from `fn.endpoint.regionalUrl(region)` | the region in the hostname |\n\n```ts\nconst perRegion = new WebFunction(this, 'Api', {\n  runtime: lambda.Runtime.NODEJS_24_X,\n  code: lambda.Code.fromAsset('dist'),\n  authType: WebFunctionAuthType.AWS_IAM,\n  endpoint: {\n    endpointType: WebFunctionEndpointType.PER_REGION,\n    regions: ['us-east-1', 'eu-west-1'],\n  },\n});\n\nnew CfnOutput(this, 'UsEast1Url', { value: perRegion.endpoint.regionalUrl('us-east-1') });\n// perRegion.endpoint.regions is ['<home region>', 'eu-west-1', 'us-east-1']\n```\n\n- `MULTI_REGION` and `PER_REGION` need at least one region besides the home region; `HOME_REGION` takes none.\n- A MultiRegion endpoint takes about a minute to create.\n- Lambda routes a `MULTI_REGION` endpoint by latency, not by health: it doesn't fail over when a region has problems.\n\n### More endpoints\n\nA function can have up to 10 endpoints, each with its own URL, authentication, regions and limits. For example, a public endpoint next to an IAM-only global one:\n\n```ts\nconst api = new WebFunction(this, 'Api', {\n  runtime: lambda.Runtime.NODEJS_24_X,\n  code: lambda.Code.fromAsset('dist'),\n  authType: WebFunctionAuthType.NONE,              // the default endpoint is public\n  endpoint: { rateLimit: 1000 },                   // requests per second\n});\n\nconst internal = api.addEndpoint('Internal', {\n  authType: WebFunctionAuthType.AWS_IAM,\n  endpointType: WebFunctionEndpointType.MULTI_REGION,\n  regions: ['us-east-1', 'eu-west-1'],\n  description: 'Service-to-service traffic',\n  maxEnvironments: 50,\n});\ninternal.grantInvoke(consumerRole);\nnew CfnOutput(this, 'InternalUrl', { value: internal.url });\n```\n\n- `rateLimit` takes 0 (blocks all traffic), 100–1,000 in steps of 100, or 2,000–10,000 in steps of 1,000; excess requests get HTTP 429. `maxEnvironments` takes 2–10,000.\n- **Both limits apply separately in each region** an endpoint serves from: a 3-region endpoint with `rateLimit: 1000` accepts up to 1,000 requests per second in each region.\n- Endpoints can serve the same regions. The construct owns one `.local` log group per region, whichever endpoints serve it.\n\n### Changing regions or the endpoint type\n\nAn endpoint's type and regions can't change in place: a change creates a **new endpoint with a new URL**, and the old one is deleted once the new one is live. Two endpoints of one function can't share a name, so:\n\n| `endpointName` | Physical name | Changing `regions` or `endpointType` |\n|---|---|---|\n| omitted (recommended) | `default-<hash>` for `fn.endpoint`, `<id>-<hash>` for added endpoints; the hash covers the type and regions | works: new endpoint, new URL |\n| set, e.g. `'live'` | `live` | also change the name in the same deployment, or it fails with *The endpoint live already exists* (the stack rolls back and the old endpoint keeps serving) |\n\nThe construct warns at synth time when `endpointName` is set.\n\n## Authentication and invoking\n\n| `authType` | Meaning |\n|---|---|\n| `AWS_IAM` | Callers sign requests (SigV4 or SigV4a, signing name `lambda`) and need `lambda:InvokeWebFunctionEndpoint` |\n| `NONE` | **Public**: Lambda does no authentication; your application does (JWT, sessions). The `Authorization` header reaches your application untouched. The construct warns at synth time |\n\n```ts\nfn.grants.invoke(consumerRole); // or fn.grantInvoke(consumerRole), as on lambda.Function\n```\n\nThe grant is on the endpoint's home-region ARN, which IAM evaluates in every region the endpoint serves from, including the global URL. `fn.grants` covers the default endpoint only; grant other endpoints with their own `grantInvoke()` or `grants.invoke()`.\n\n| Endpoint | How to sign |\n|---|---|\n| `HOME_REGION` | SigV4 for the home region |\n| `PER_REGION` | SigV4 for the hostname's region, or SigV4a |\n| `MULTI_REGION` | **SigV4a with region set `*`**: you can't know which region will serve the request |\n\n```js\nimport { SignatureV4a } from '@smithy/signature-v4a';\nimport { Sha256 } from '@aws-crypto/sha256-js';\nimport { fromNodeProviderChain } from '@aws-sdk/credential-providers';\n\nconst signer = new SignatureV4a({ service: 'lambda', region: '*', sha256: Sha256, credentials: fromNodeProviderChain() });\nconst signed = await signer.sign(\n  { method: 'GET', protocol: 'https:', hostname: host, path: '/', headers: { host } },\n  { signingRegion: '*' },\n);\nconst response = await fetch(`https://${host}/`, { headers: signed.headers });\n```\n\n## Configuration\n\n```ts\nconst api = new WebFunction(this, 'Api', {\n  runtime: lambda.Runtime.NODEJS_24_X,\n  code: lambda.Code.fromAsset('build'),\n  authType: WebFunctionAuthType.AWS_IAM,\n  entrypoint: 'server.js',               // default index.js\n  webFunctionName: 'orders-api',         // default: generated from the construct path\n  description: 'Orders HTTP API',\n  environment: { TABLE_NAME: table.tableName },\n  timeout: Duration.seconds(60),         // per request: 3 seconds to 15 minutes, default 30 seconds\n  maxConcurrencyPerEnvironment: 32,      // requests per environment at once: 1-128, default 64\n});\n\napi.addEnvironment('FEATURE_FLAG', 'on');\ntable.grantReadWriteData(api);           // the default role trusts lambda.amazonaws.com\n```\n\n- Requests handled by one environment share module-level state, so keep handlers concurrency-safe.\n- Environment variable names starting with `AWS_` are reserved.\n- **Renaming the function replaces it and changes its URL.** A generated name depends on the construct path, so moving the construct renames it too.\n\n### Bundling TypeScript with `NodejsWebFunction`\n\n`NodejsWebFunction` is a `WebFunction` that bundles your server from a TypeScript or JavaScript entry file with esbuild, like `NodejsFunction` does for Lambda functions:\n\n```ts\nnew NodejsWebFunction(this, 'Api', {\n  entry: 'src/server.ts',\n  authType: WebFunctionAuthType.AWS_IAM,\n  bundling: {\n    minify: true,                                       // default true\n    sourceMap: true,                                    // default true\n    format: lambdaNodejs.OutputFormat.ESM,              // default ESM (index.mjs); CJS gives index.js\n    externalModules: [],                                // default: bundle everything you import\n  },\n});\n```\n\n- **Defaults:** `runtime` is `NODEJS_24_X`, and the esbuild target follows the runtime (`node24`). The project root is the directory of the nearest lock file above `entry` (override it with `depsLockFilePath` or `projectRoot`).\n- **It also sets what a `lambda.Code` can't:** the entry point that matches the bundle, and `NODE_OPTIONS=--enable-source-maps` when source maps are on, appended to any `NODE_OPTIONS` you set, so stack traces point at your `.ts` files (e.g. `/var/task/src/server.ts:22:12`). Source map paths are relative to the project root, so no build-machine paths are deployed.\n- **ESM bundles include a `require` shim**, so CommonJS dependencies that load Node.js built-ins (Express, for example) work.\n- **The AWS SDK is bundled like any other dependency**, since the runtime has none. Only the clients you import are included.\n- **Bundling runs locally** when esbuild is installed in your project, and otherwise in Docker (an arm64 AWS SAM build image; set `forceDockerBundling` to always use Docker).\n- **Not yet supported:** installing native modules next to the bundle (`nodeModules`) and command hooks. For native dependencies, use `WebFunction` with `Code.fromAsset(..., { bundling: { image, command } })`.\n\n### Code\n\n`code` takes any `lambda.Code` that produces a zip in S3: `fromAsset`, `fromBucket`/`fromBucketV2`, `fromCustomCommand`, `fromDockerBuild`. Inline code and container images fail at synth time.\n\nLambda Web Functions download code as the `lambda.amazonaws.com` service principal, from a **versioned** bucket, and the CDK bootstrap bucket allows neither. So each stack gets a small code bucket, and the code is copied into it on deploy.\n\n## Revisions\n\nAny change to code or configuration creates a new **revision** (`fn.currentRevision`), and endpoints switch to it once it's ready. A failed deployment rolls back to the previous revision. If nothing changed, nothing is deployed.\n\nEarlier revisions are kept, so you can roll back or route traffic to them. After each deployment, the construct deletes the oldest beyond `revisionRetention` (default 20, up to 50). It never deletes a revision an endpoint routes to, or one the previous deployment used, which a rollback returns to.\n\n```ts\nnew WebFunction(this, 'Api', {\n  runtime: lambda.Runtime.NODEJS_24_X,\n  code: lambda.Code.fromAsset('dist'),\n  authType: WebFunctionAuthType.AWS_IAM,\n  revisionRetention: 5,\n});\n```\n\n### Routing to earlier revisions\n\nReference an earlier revision by its ID (for example from a `CfnOutput` of `fn.currentRevision.revisionId`, or `aws lambda-web list-web-function-revisions`). Then pin an endpoint to it, or split traffic between two revisions:\n\n```ts\nconst previous = WebFunctionRevision.fromRevisionAttributes(this, 'Previous', {\n  webFunction: fn,\n  revisionId: 'rev-a1b2c',\n});\n\n// Keep the default endpoint on the previous revision, and send 10% to the new one:\nfn.endpoint.routeTraffic(previous, [{ revision: fn.currentRevision, weight: 0.1 }]);\n\n// Or a second endpoint that stays on the previous revision while fn.endpoint moves on:\nfn.addEndpoint('Stable', { authType: WebFunctionAuthType.AWS_IAM, revision: previous });\n```\n\n- An endpoint routes to at most two revisions. The additional revision's `weight` is a whole percentage, from 0.01 to 0.99.\n- To promote, remove `routeTraffic` (or `revision`) and deploy: the endpoint serves the current revision again.\n- Lambda Web Function metrics have no revision dimension. To compare a split's revisions, log a version you control (for example an environment variable) from your application.\n\n### Canary and linear deployments\n\nBy default an endpoint moves all its traffic to a new revision at once. With `deployment`, it moves in steps instead, watching CloudWatch alarms: if one goes into ALARM, the endpoint goes back to the revision it served before and the deployment fails, so CloudFormation rolls the stack back.\n\n```ts\n// errorRate: a cloudwatch.IAlarm, for example on the share of 5xx responses\nconst api = new WebFunction(this, 'Api', {\n  runtime: lambda.Runtime.NODEJS_24_X,\n  code: lambda.Code.fromAsset('dist'),\n  authType: WebFunctionAuthType.AWS_IAM,\n  endpoint: {\n    // 10% of the traffic for 10 minutes, then all of it.\n    deployment: WebFunctionDeployment.canary({ percent: 10, bake: Duration.minutes(10), alarms: [errorRate] }),\n  },\n});\n\n// 25% more every 5 minutes. Each endpoint has its own deployment.\napi.addEndpoint('Public', {\n  authType: WebFunctionAuthType.NONE,\n  deployment: WebFunctionDeployment.linear({ percent: 25, interval: Duration.minutes(5), alarms: [errorRate] }),\n});\n```\n\n| | Steps | Limits |\n|---|---|---|\n| `allAtOnce()` (default) | 100% | |\n| `canary({ percent, bake })` | `percent`, then 100% after `bake` | `percent` 1–99, `bake` 1–45 minutes |\n| `linear({ percent, interval })` | `percent` more every `interval` | `percent` 5–50, `interval` from 1 minute, at most 45 minutes in all |\n\nHow it works:\n\n- Each deployment that creates a revision (code or configuration) moves the traffic from the revision the endpoint serves at that moment, which is also what it goes back to. If someone switched the endpoint outside CloudFormation, the deployment starts from there.\n- Each step waits until every region of a `MULTI_REGION` or `PER_REGION` endpoint has applied it (usually about 15 seconds), and if a region fails to update, the endpoint goes back as for an alarm. The bake or interval counts from the start of the step.\n- Alarms are checked before the first step (an alarm already in ALARM stops the deployment before any traffic moves), throughout every step, and once the new revision has all the traffic. They can be in any region, and composite alarms work. `INSUFFICIENT_DATA` doesn't stop a deployment.\n- A rollback of the stack, for any reason, moves the traffic back at once, without waiting or checking alarms.\n- A stack's first deployment, and a new endpoint (including one renamed by a region change), serve the revision at once: there's nothing to move from.\n- A deployment can take up to an hour: CloudFormation waits for it before it updates the endpoint. Deployments of different endpoints run in parallel.\n- A canary or linear endpoint always moves to the current revision, so it can't also use `revision`, `additionalRevisions` or `routeTraffic()`. Use `allAtOnce()` to deploy a fix immediately, for example while an alarm is in ALARM.\n\nLambda Web Function metrics have no revision dimension, so an alarm sees the whole endpoint: at 10%, a new revision's errors are a tenth of the endpoint's. Alarm on a rate, with a threshold low enough to notice that, or publish metrics from your application that carry its version. A bake should be longer than an alarm needs to fire (its period times its evaluation periods).\n\nThe deployment runs in a few resources per stack, created on first use: two Lambda functions, a Step Functions state machine that calls them every 15 seconds, and a log group.\n\n## Logs in every region\n\nWeb Functions log in two tiers:\n\n```text\n every serving region               home region\n ┌──────────────────┐              ┌──────────────────────────────────────────┐\n │ <group>.local    │── copied ───►│ <group>   every region's logs            │\n │ (that region's   │  (seconds)   │ streams …[rev]<instance>-<acct>-<region> │\n │  environments)   │              │ <group>.local  (home-region traffic)     │\n └──────────────────┘              └──────────────────────────────────────────┘\n```\n\n**Query `fn.logGroup`**, the home-region group that receives every region's logs. The service would create missing groups without retention and never delete them, so the construct creates and owns all of them: both home-region groups, and `<group>.local` in every other region of the endpoint.\n\n```ts\nnew WebFunction(this, 'Api', {\n  runtime: lambda.Runtime.NODEJS_24_X,\n  code: lambda.Code.fromAsset('dist'),\n  authType: WebFunctionAuthType.AWS_IAM,\n  logRetention: logs.RetentionDays.THREE_MONTHS,    // default ONE_MONTH, every group in every region\n  logRemovalPolicy: RemovalPolicy.DESTROY,           // default RETAIN\n  applicationLogLevelV2: lambda.ApplicationLogLevel.WARN,\n  systemLogLevelV2: lambda.SystemLogLevel.INFO,      // DEBUG, INFO or WARN\n});\n```\n\n- The default group is `/aws/lambda/web/<function name>`. Log lines are JSON; application lines carry `requestId`, `endpointName` and `region`.\n- Every event is stored twice (`.local` plus the home-region copy), so expect about double log ingestion, plus cross-region transfer.\n- With `DESTROY`, deletion waits about a minute after the function is gone, because environments flush their last lines late.\n- Subscribe only to `fn.logGroup`: subscribing to the `.local` groups as well delivers every event twice.\n\n## Limitations\n\n- Not yet supported: importing existing functions, VPC access (network connectors), resource-policy permissions, KMS encryption, metrics helpers, tracing, and a CloudFront origin.\n- `cdk deploy --hotswap` and `cdk watch` don't support Web Functions.\n- Quotas: 10 endpoints and about 50 revisions per function (Lambda cleans up older revisions automatically), and 10,000 requests per second per endpoint. Per account and region: 100,000 requests per second and 2,000 Arm64 vCPUs (each execution environment uses 2). The account quotas are adjustable, and new accounts start lower. See [Lambda quotas](https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-limits.html).\n- The stack's custom resource provider Lambda keeps its own log group after the stack is deleted, as with other CDK custom resources.\n\n## Development\n\nTooling is pinned in `mise.toml` (Node 24, AWS CDK CLI). Personal settings, such as the AWS profile for the live end-to-end tests, go in a git-ignored `mise.local.toml`.\n\n```bash\nmise install\nnpx projen build      # compile, unit tests, lint, API docs\nnpx projen e2e        # deploy, verify and destroy real stacks in three regions (needs AWS credentials)\n```\n"
   },
   "repository": {
     "type": "git",
@@ -9758,39 +9758,613 @@
     }
   },
   "types": {
+    "@ashishpandeyone/cdk-lambda-web-function.AddWebFunctionEndpointOptions": {
+      "assembly": "@ashishpandeyone/cdk-lambda-web-function",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "Options for `WebFunction.addEndpoint`."
+      },
+      "fqn": "@ashishpandeyone/cdk-lambda-web-function.AddWebFunctionEndpointOptions",
+      "interfaces": [
+        "@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpointOptions"
+      ],
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/web-function-endpoint.ts",
+        "line": 105
+      },
+      "name": "AddWebFunctionEndpointOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "How callers of this endpoint are authenticated."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-endpoint.ts",
+            "line": 109
+          },
+          "name": "authType",
+          "type": {
+            "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionAuthType"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- all traffic goes to `revision`",
+            "remarks": "`revision` gets the rest.\nAn endpoint routes to at most two revisions.",
+            "stability": "experimental",
+            "summary": "A second revision and its share of the endpoint's traffic;"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-endpoint.ts",
+            "line": 125
+          },
+          "name": "additionalRevisions",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionRevisionWeight"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- the function's current revision (`currentRevision`)",
+            "stability": "experimental",
+            "summary": "The revision the endpoint serves, e.g. an earlier one from `WebFunctionRevision.fromRevisionAttributes` to keep this endpoint on it while others move on. Same as calling `routeTraffic`."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-endpoint.ts",
+            "line": 117
+          },
+          "name": "revision",
+          "optional": true,
+          "type": {
+            "fqn": "@ashishpandeyone/cdk-lambda-web-function.IWebFunctionRevision"
+          }
+        }
+      ],
+      "symbolId": "src/web-function-endpoint:AddWebFunctionEndpointOptions"
+    },
     "@ashishpandeyone/cdk-lambda-web-function.IWebFunction": {
       "assembly": "@ashishpandeyone/cdk-lambda-web-function",
       "docs": {
         "stability": "experimental",
-        "summary": "A Lambda Web Function."
+        "summary": "A Lambda Web Function."
+      },
+      "fqn": "@ashishpandeyone/cdk-lambda-web-function.IWebFunction",
+      "interfaces": [
+        "aws-cdk-lib.IResource",
+        "aws-cdk-lib.interfaces.aws_lambda.IWebFunctionRef"
+      ],
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/web-function.ts",
+        "line": 153
+      },
+      "name": "IWebFunction",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "custom": {
+              "attribute": "true"
+            },
+            "stability": "experimental",
+            "summary": "The function's ARN."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function.ts",
+            "line": 166
+          },
+          "name": "webFunctionArn",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "custom": {
+              "attribute": "true"
+            },
+            "stability": "experimental",
+            "summary": "The function's name."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function.ts",
+            "line": 159
+          },
+          "name": "webFunctionName",
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/web-function:IWebFunction"
+    },
+    "@ashishpandeyone/cdk-lambda-web-function.IWebFunctionRevision": {
+      "assembly": "@ashishpandeyone/cdk-lambda-web-function",
+      "docs": {
+        "stability": "experimental",
+        "summary": "A revision of a Web Function: an immutable snapshot of its code and configuration."
+      },
+      "fqn": "@ashishpandeyone/cdk-lambda-web-function.IWebFunctionRevision",
+      "interfaces": [
+        "constructs.IConstruct"
+      ],
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/web-function-revision.ts",
+        "line": 7
+      },
+      "name": "IWebFunctionRevision",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "The revision's ARN."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-revision.ts",
+            "line": 12
+          },
+          "name": "revisionArn",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "The revision's ID, e.g. `rev-a1b2c`."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-revision.ts",
+            "line": 9
+          },
+          "name": "revisionId",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "The function the revision belongs to."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-revision.ts",
+            "line": 15
+          },
+          "name": "webFunction",
+          "type": {
+            "fqn": "aws-cdk-lib.interfaces.aws_lambda.IWebFunctionRef"
+          }
+        }
+      ],
+      "symbolId": "src/web-function-revision:IWebFunctionRevision"
+    },
+    "@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction": {
+      "assembly": "@ashishpandeyone/cdk-lambda-web-function",
+      "base": "@ashishpandeyone/cdk-lambda-web-function.WebFunction",
+      "docs": {
+        "remarks": "Besides bundling, it sets what a `lambda.Code` alone can't: the entry point that matches the\nbundle, and `NODE_OPTIONS=--enable-source-maps` when source maps are on.",
+        "stability": "experimental",
+        "summary": "A `WebFunction` whose code is bundled from a TypeScript or JavaScript entry file with esbuild, like `NodejsFunction` for Lambda functions."
+      },
+      "fqn": "@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        },
+        "locationInModule": {
+          "filename": "src/nodejs-web-function.ts",
+          "line": 167
+        },
+        "parameters": [
+          {
+            "name": "scope",
+            "type": {
+              "fqn": "constructs.Construct"
+            }
+          },
+          {
+            "name": "id",
+            "type": {
+              "primitive": "string"
+            }
+          },
+          {
+            "name": "props",
+            "type": {
+              "fqn": "@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunctionProps"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/nodejs-web-function.ts",
+        "line": 166
+      },
+      "name": "NodejsWebFunction",
+      "symbolId": "src/nodejs-web-function:NodejsWebFunction"
+    },
+    "@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunctionBundlingOptions": {
+      "assembly": "@ashishpandeyone/cdk-lambda-web-function",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "How `NodejsWebFunction` bundles the server with esbuild."
+      },
+      "fqn": "@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunctionBundlingOptions",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/nodejs-web-function.ts",
+        "line": 12
+      },
+      "name": "NodejsWebFunctionBundlingOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- none",
+            "stability": "experimental",
+            "summary": "Text to prepend to the bundle."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/nodejs-web-function.ts",
+            "line": 69
+          },
+          "name": "banner",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- none",
+            "stability": "experimental",
+            "summary": "Replace global identifiers with constant expressions (esbuild `--define`)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/nodejs-web-function.ts",
+            "line": 55
+          },
+          "name": "define",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "map"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- the arm64 AWS SAM build image for the runtime, e.g. `public.ecr.aws/sam/build-nodejs24.x:latest-arm64`",
+            "stability": "experimental",
+            "summary": "Docker image for bundling when esbuild isn't installed locally."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/nodejs-web-function.ts",
+            "line": 118
+          },
+          "name": "dockerImage",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.DockerImage"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- none",
+            "stability": "experimental",
+            "summary": "Environment variables while bundling (not at runtime)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/nodejs-web-function.ts",
+            "line": 104
+          },
+          "name": "environment",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "map"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- none",
+            "stability": "experimental",
+            "summary": "Extra esbuild arguments, e.g. `{ '--log-limit': '0', '--tree-shaking': true }`."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/nodejs-web-function.ts",
+            "line": 97
+          },
+          "name": "esbuildArgs",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "union": {
+                  "types": [
+                    {
+                      "primitive": "string"
+                    },
+                    {
+                      "primitive": "boolean"
+                    }
+                  ]
+                }
+              },
+              "kind": "map"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- none",
+            "remarks": "The runtime has no AWS SDK, so `@aws-sdk/*` is bundled like\nany other dependency; only exclude modules you provide another way.",
+            "stability": "experimental",
+            "summary": "Modules to leave out of the bundle."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/nodejs-web-function.ts",
+            "line": 48
+          },
+          "name": "externalModules",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- none",
+            "stability": "experimental",
+            "summary": "Text to append to the bundle."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/nodejs-web-function.ts",
+            "line": 76
+          },
+          "name": "footer",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "false",
+            "stability": "experimental",
+            "summary": "Always bundle in Docker, even if esbuild is installed locally."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/nodejs-web-function.ts",
+            "line": 111
+          },
+          "name": "forceDockerBundling",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "OutputFormat.ESM",
+            "remarks": "ESM is written to `index.mjs` (with a `require` shim, so CommonJS dependencies\nsuch as Express work); CommonJS to `index.js`.",
+            "stability": "experimental",
+            "summary": "Output format."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/nodejs-web-function.ts",
+            "line": 33
+          },
+          "name": "format",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_lambda_nodejs.OutputFormat"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "false",
+            "stability": "experimental",
+            "summary": "Keep function and class names (`--keep-names`)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/nodejs-web-function.ts",
+            "line": 90
+          },
+          "name": "keepNames",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- esbuild's defaults",
+            "stability": "experimental",
+            "summary": "esbuild loaders by file extension, e.g. `{ '.png': 'dataurl' }`."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/nodejs-web-function.ts",
+            "line": 62
+          },
+          "name": "loader",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "map"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "true",
+            "stability": "experimental",
+            "summary": "Minify the bundle."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/nodejs-web-function.ts",
+            "line": 18
+          },
+          "name": "minify",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "true",
+            "stability": "experimental",
+            "summary": "Generate a source map, and set `NODE_OPTIONS=--enable-source-maps` so stack traces point at your sources."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/nodejs-web-function.ts",
+            "line": 25
+          },
+          "name": "sourceMap",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- the runtime's Node.js version, e.g. `node24`",
+            "stability": "experimental",
+            "summary": "esbuild target."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/nodejs-web-function.ts",
+            "line": 40
+          },
+          "name": "target",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- esbuild's lookup from the entry file",
+            "stability": "experimental",
+            "summary": "Path of the tsconfig.json to use, relative to the project root or absolute (inside the project root)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/nodejs-web-function.ts",
+            "line": 83
+          },
+          "name": "tsconfig",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/nodejs-web-function:NodejsWebFunctionBundlingOptions"
+    },
+    "@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunctionProps": {
+      "assembly": "@ashishpandeyone/cdk-lambda-web-function",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "Properties for a `NodejsWebFunction`."
       },
-      "fqn": "@ashishpandeyone/cdk-lambda-web-function.IWebFunction",
+      "fqn": "@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunctionProps",
       "interfaces": [
-        "aws-cdk-lib.IResource",
-        "aws-cdk-lib.interfaces.aws_lambda.IWebFunctionRef"
+        "@ashishpandeyone/cdk-lambda-web-function.WebFunctionOptions"
       ],
       "kind": "interface",
       "locationInModule": {
-        "filename": "src/web-function.ts",
-        "line": 128
+        "filename": "src/nodejs-web-function.ts",
+        "line": 124
       },
-      "name": "IWebFunction",
+      "name": "NodejsWebFunctionProps",
       "properties": [
         {
           "abstract": true,
           "docs": {
-            "custom": {
-              "attribute": "true"
-            },
+            "remarks": "It's bundled with its dependencies.",
             "stability": "experimental",
-            "summary": "The function's ARN."
+            "summary": "The file that starts your server (TypeScript or JavaScript)."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/web-function.ts",
-            "line": 141
+            "filename": "src/nodejs-web-function.ts",
+            "line": 128
           },
-          "name": "webFunctionArn",
+          "name": "entry",
           "type": {
             "primitive": "string"
           }
@@ -9798,24 +10372,78 @@
         {
           "abstract": true,
           "docs": {
-            "custom": {
-              "attribute": "true"
-            },
+            "default": "- minified ESM with a source map, targeting the runtime's Node.js version",
             "stability": "experimental",
-            "summary": "The function's name."
+            "summary": "How the server is bundled."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/web-function.ts",
-            "line": 134
+            "filename": "src/nodejs-web-function.ts",
+            "line": 156
           },
-          "name": "webFunctionName",
+          "name": "bundling",
+          "optional": true,
+          "type": {
+            "fqn": "@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunctionBundlingOptions"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- the nearest `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml` or `bun.lock(b)` above the entry",
+            "stability": "experimental",
+            "summary": "The lock file that marks the project root (where esbuild resolves `node_modules`)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/nodejs-web-function.ts",
+            "line": 142
+          },
+          "name": "depsLockFilePath",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- the directory of the lock file",
+            "remarks": "Must contain the entry file.",
+            "stability": "experimental",
+            "summary": "The project root."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/nodejs-web-function.ts",
+            "line": 149
+          },
+          "name": "projectRoot",
+          "optional": true,
           "type": {
             "primitive": "string"
           }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "lambda.Runtime.NODEJS_24_X",
+            "stability": "experimental",
+            "summary": "The Node.js runtime."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/nodejs-web-function.ts",
+            "line": 135
+          },
+          "name": "runtime",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_lambda.Runtime"
+          }
         }
       ],
-      "symbolId": "src/web-function:IWebFunction"
+      "symbolId": "src/nodejs-web-function:NodejsWebFunctionProps"
     },
     "@ashishpandeyone/cdk-lambda-web-function.WebFunction": {
       "assembly": "@ashishpandeyone/cdk-lambda-web-function",
@@ -9824,7 +10452,7 @@
         "custom": {
           "resource": "AWS::Lambda::WebFunction"
         },
-        "remarks": "Creates the function, its current revision (code and configuration; any change replaces it),\nan HTTPS endpoint, an execution role, and owns the function's log groups in every region.\n\nImporting existing functions (`fromXxx` methods) is planned after 0.1.",
+        "remarks": "Creates the function, its current revision (code and configuration; any change creates a new one,\nand the newest `revisionRetention` are kept), a default HTTPS endpoint, an execution role, and owns\nthe function's log groups in every region its endpoints serve from.\n\nImporting existing functions (`fromXxx` methods) is planned after 0.1.",
         "stability": "experimental",
         "summary": "A Node.js HTTP server running as an AWS Lambda Web Function, served from one or more regions."
       },
@@ -9835,7 +10463,7 @@
         },
         "locationInModule": {
           "filename": "src/web-function.ts",
-          "line": 186
+          "line": 221
         },
         "parameters": [
           {
@@ -9865,9 +10493,42 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/web-function.ts",
-        "line": 154
+        "line": 180
       },
       "methods": [
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Adds an endpoint (up to 10 per function), e.g. a public one next to an IAM-only one, or one pinned to an earlier revision. Each endpoint has its own URL, authentication, regions and limits."
+          },
+          "locationInModule": {
+            "filename": "src/web-function.ts",
+            "line": 323
+          },
+          "name": "addEndpoint",
+          "parameters": [
+            {
+              "docs": {
+                "summary": "the endpoint's construct ID, also used in its generated name (`<id>-<hash>`)."
+              },
+              "name": "id",
+              "type": {
+                "primitive": "string"
+              }
+            },
+            {
+              "name": "options",
+              "type": {
+                "fqn": "@ashishpandeyone/cdk-lambda-web-function.AddWebFunctionEndpointOptions"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint"
+            }
+          }
+        },
         {
           "docs": {
             "remarks": "Names starting with `AWS_` are reserved.",
@@ -9876,7 +10537,7 @@
           },
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 278
+            "line": 331
           },
           "name": "addEnvironment",
           "parameters": [
@@ -9906,7 +10567,7 @@
           },
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 289
+            "line": 342
           },
           "name": "addToRolePolicy",
           "parameters": [
@@ -9926,7 +10587,7 @@
           },
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 297
+            "line": 350
           },
           "name": "grantInvoke",
           "parameters": [
@@ -9949,12 +10610,28 @@
         {
           "docs": {
             "stability": "experimental",
-            "summary": "The function's endpoint."
+            "summary": "The revision built from the current code and configuration."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function.ts",
+            "line": 188
+          },
+          "name": "currentRevision",
+          "type": {
+            "fqn": "@ashishpandeyone/cdk-lambda-web-function.IWebFunctionRevision"
+          }
+        },
+        {
+          "docs": {
+            "remarks": "Add more with `addEndpoint`.",
+            "stability": "experimental",
+            "summary": "The default endpoint."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 162
+            "line": 191
           },
           "name": "endpoint",
           "type": {
@@ -9969,7 +10646,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 171
+            "line": 200
           },
           "name": "grantPrincipal",
           "overrides": "aws-cdk-lib.aws_iam.IGrantable",
@@ -9980,12 +10657,12 @@
         {
           "docs": {
             "stability": "experimental",
-            "summary": "Grants on the function (e.g. `grants.invoke(principal)`)."
+            "summary": "Grants on the default endpoint (e.g. `grants.invoke(principal)`). Other endpoints have their own `grants`."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 165
+            "line": 194
           },
           "name": "grants",
           "type": {
@@ -10001,7 +10678,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 177
+            "line": 206
           },
           "name": "logGroup",
           "type": {
@@ -10010,13 +10687,14 @@
         },
         {
           "docs": {
+            "remarks": "Same as `currentRevision.revisionId`.",
             "stability": "experimental",
             "summary": "The ID of the current revision."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 159
+            "line": 185
           },
           "name": "revisionId",
           "type": {
@@ -10031,7 +10709,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 168
+            "line": 197
           },
           "name": "role",
           "type": {
@@ -10046,7 +10724,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 156
+            "line": 182
           },
           "name": "webFunctionArn",
           "overrides": "@ashishpandeyone/cdk-lambda-web-function.IWebFunction",
@@ -10062,80 +10740,264 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 155
+            "line": 181
           },
           "name": "webFunctionName",
           "overrides": "@ashishpandeyone/cdk-lambda-web-function.IWebFunction",
           "type": {
-            "primitive": "string"
+            "primitive": "string"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "A reference to this function, for APIs that accept `lambda.IWebFunctionRef`."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function.ts",
+            "line": 217
+          },
+          "name": "webFunctionRef",
+          "overrides": "aws-cdk-lib.interfaces.aws_lambda.IWebFunctionRef",
+          "type": {
+            "fqn": "aws-cdk-lib.interfaces.aws_lambda.WebFunctionReference"
+          }
+        }
+      ],
+      "symbolId": "src/web-function:WebFunction"
+    },
+    "@ashishpandeyone/cdk-lambda-web-function.WebFunctionAuthType": {
+      "assembly": "@ashishpandeyone/cdk-lambda-web-function",
+      "docs": {
+        "stability": "experimental",
+        "summary": "How callers of a Web Function endpoint are authenticated."
+      },
+      "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionAuthType",
+      "kind": "enum",
+      "locationInModule": {
+        "filename": "src/enums.ts",
+        "line": 4
+      },
+      "members": [
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Requests must be signed with SigV4 or SigV4a (signing name `lambda`) by a principal allowed `lambda:InvokeWebFunctionEndpoint` on the endpoint."
+          },
+          "name": "AWS_IAM"
+        },
+        {
+          "docs": {
+            "remarks": "The `Authorization` header reaches your application untouched.",
+            "stability": "experimental",
+            "summary": "No authentication by Lambda: the endpoint is public and your application authenticates requests itself."
+          },
+          "name": "NONE"
+        }
+      ],
+      "name": "WebFunctionAuthType",
+      "symbolId": "src/enums:WebFunctionAuthType"
+    },
+    "@ashishpandeyone/cdk-lambda-web-function.WebFunctionCanaryDeploymentOptions": {
+      "assembly": "@ashishpandeyone/cdk-lambda-web-function",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "Options for a canary deployment."
+      },
+      "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionCanaryDeploymentOptions",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/web-function-deployment.ts",
+        "line": 12
+      },
+      "name": "WebFunctionCanaryDeploymentOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "Make it longer than the time your alarms need to fire (period × evaluation periods).",
+            "stability": "experimental",
+            "summary": "How long the new revision serves `percent` before it gets all traffic (1-45 minutes)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-deployment.ts",
+            "line": 22
+          },
+          "name": "bake",
+          "type": {
+            "fqn": "aws-cdk-lib.Duration"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "The share of traffic, in whole percent (1-99), that the new revision gets first."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-deployment.ts",
+            "line": 16
+          },
+          "name": "percent",
+          "type": {
+            "primitive": "number"
           }
         },
         {
+          "abstract": true,
           "docs": {
+            "default": "- no alarms: traffic moves on a timer",
+            "remarks": "They're checked before traffic moves, during the bake, and once the new revision has all traffic.\nUse alarms in any region (by ARN), including composite alarms.",
             "stability": "experimental",
-            "summary": "A reference to this function, for APIs that accept `lambda.IWebFunctionRef`."
+            "summary": "Alarms that stop the deployment: if one is in ALARM, the endpoint goes back to the previous revision and the deployment fails, so CloudFormation rolls the stack back."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/web-function.ts",
-            "line": 182
+            "filename": "src/web-function-deployment.ts",
+            "line": 33
           },
-          "name": "webFunctionRef",
-          "overrides": "aws-cdk-lib.interfaces.aws_lambda.IWebFunctionRef",
+          "name": "alarms",
+          "optional": true,
           "type": {
-            "fqn": "aws-cdk-lib.interfaces.aws_lambda.WebFunctionReference"
+            "collection": {
+              "elementtype": {
+                "fqn": "aws-cdk-lib.aws_cloudwatch.IAlarm"
+              },
+              "kind": "array"
+            }
           }
         }
       ],
-      "symbolId": "src/web-function:WebFunction"
+      "symbolId": "src/web-function-deployment:WebFunctionCanaryDeploymentOptions"
     },
-    "@ashishpandeyone/cdk-lambda-web-function.WebFunctionAuthType": {
+    "@ashishpandeyone/cdk-lambda-web-function.WebFunctionDeployment": {
       "assembly": "@ashishpandeyone/cdk-lambda-web-function",
       "docs": {
         "stability": "experimental",
-        "summary": "How callers of a Web Function endpoint are authenticated."
+        "summary": "How an endpoint moves its traffic to a new revision."
       },
-      "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionAuthType",
-      "kind": "enum",
+      "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionDeployment",
+      "kind": "class",
       "locationInModule": {
-        "filename": "src/enums.ts",
-        "line": 4
+        "filename": "src/web-function-deployment.ts",
+        "line": 65
       },
-      "members": [
+      "methods": [
         {
           "docs": {
             "stability": "experimental",
-            "summary": "Requests must be signed with SigV4 or SigV4a (signing name `lambda`) by a principal allowed `lambda:InvokeWebFunctionEndpoint` on the endpoint."
+            "summary": "All traffic moves to the new revision at once, as soon as it's ready (the default)."
           },
-          "name": "AWS_IAM"
+          "locationInModule": {
+            "filename": "src/web-function-deployment.ts",
+            "line": 69
+          },
+          "name": "allAtOnce",
+          "returns": {
+            "type": {
+              "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionDeployment"
+            }
+          },
+          "static": true
         },
         {
           "docs": {
-            "remarks": "The `Authorization` header reaches your application untouched.",
             "stability": "experimental",
-            "summary": "No authentication by Lambda: the endpoint is public and your application authenticates requests itself."
+            "summary": "The new revision first gets `percent` of the traffic for `bake`, then all of it."
           },
-          "name": "NONE"
+          "locationInModule": {
+            "filename": "src/web-function-deployment.ts",
+            "line": 76
+          },
+          "name": "canary",
+          "parameters": [
+            {
+              "name": "options",
+              "type": {
+                "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionCanaryDeploymentOptions"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionDeployment"
+            }
+          },
+          "static": true
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "The new revision gets `percent` more of the traffic every `interval` until it has all of it."
+          },
+          "locationInModule": {
+            "filename": "src/web-function-deployment.ts",
+            "line": 85
+          },
+          "name": "linear",
+          "parameters": [
+            {
+              "name": "options",
+              "type": {
+                "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionLinearDeploymentOptions"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionDeployment"
+            }
+          },
+          "static": true
         }
       ],
-      "name": "WebFunctionAuthType",
-      "symbolId": "src/enums:WebFunctionAuthType"
+      "name": "WebFunctionDeployment",
+      "symbolId": "src/web-function-deployment:WebFunctionDeployment"
     },
     "@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint": {
       "assembly": "@ashishpandeyone/cdk-lambda-web-function",
       "base": "constructs.Construct",
       "docs": {
-        "remarks": "Only `WebFunction` creates endpoints in this version (one per function), so the constructor is private.",
+        "remarks": "Endpoints are created only through `WebFunction`, which owns their log groups in every region, so the constructor is private.",
         "stability": "experimental",
-        "summary": "The HTTPS endpoint of a Web Function. Created by `WebFunction`; access it as `fn.endpoint`."
+        "summary": "An HTTPS endpoint of a Web Function: `fn.endpoint` (the default one) or the result of `fn.addEndpoint()`."
       },
       "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint",
       "kind": "class",
       "locationInModule": {
         "filename": "src/web-function-endpoint.ts",
-        "line": 65
+        "line": 150
       },
       "methods": [
+        {
+          "docs": {
+            "remarks": "Shortcut for `grants.invoke(grantee)`.\n[disable-awslint:no-grants]",
+            "stability": "experimental",
+            "summary": "Allows `grantee` to call this endpoint."
+          },
+          "locationInModule": {
+            "filename": "src/web-function-endpoint.ts",
+            "line": 328
+          },
+          "name": "grantInvoke",
+          "parameters": [
+            {
+              "name": "grantee",
+              "type": {
+                "fqn": "aws-cdk-lib.aws_iam.IGrantable"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "aws-cdk-lib.aws_iam.Grant"
+            }
+          }
+        },
         {
           "docs": {
             "remarks": "Only for `PER_REGION` endpoints.",
@@ -10144,7 +11006,7 @@
           },
           "locationInModule": {
             "filename": "src/web-function-endpoint.ts",
-            "line": 146
+            "line": 275
           },
           "name": "regionalUrl",
           "parameters": [
@@ -10163,10 +11025,57 @@
               "primitive": "string"
             }
           }
+        },
+        {
+          "docs": {
+            "remarks": "`revision` gets the rest).\n\nUse it to keep an endpoint on an earlier revision (`WebFunctionRevision.fromRevisionAttributes`),\nor to send part of the traffic to the current revision:\n`fn.endpoint.routeTraffic(previous, [{ revision: fn.currentRevision, weight: 0.1 }])`.\nCan be called once per endpoint, and not on one created with `revision` or `additionalRevisions`.",
+            "stability": "experimental",
+            "summary": "Routes the endpoint to `revision` instead of the function's current revision, optionally sharing traffic with one more revision (`additionalRevisions`, which gets its weight;"
+          },
+          "locationInModule": {
+            "filename": "src/web-function-endpoint.ts",
+            "line": 303
+          },
+          "name": "routeTraffic",
+          "parameters": [
+            {
+              "name": "revision",
+              "type": {
+                "fqn": "@ashishpandeyone/cdk-lambda-web-function.IWebFunctionRevision"
+              }
+            },
+            {
+              "name": "additionalRevisions",
+              "optional": true,
+              "type": {
+                "collection": {
+                  "elementtype": {
+                    "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionRevisionWeight"
+                  },
+                  "kind": "array"
+                }
+              }
+            }
+          ]
         }
       ],
       "name": "WebFunctionEndpoint",
       "properties": [
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "How callers of the endpoint are authenticated."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-endpoint.ts",
+            "line": 170
+          },
+          "name": "authType",
+          "type": {
+            "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionAuthType"
+          }
+        },
         {
           "docs": {
             "stability": "experimental",
@@ -10175,7 +11084,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function-endpoint.ts",
-            "line": 90
+            "line": 178
           },
           "name": "domainName",
           "type": {
@@ -10190,7 +11099,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function-endpoint.ts",
-            "line": 79
+            "line": 164
           },
           "name": "endpointArn",
           "type": {
@@ -10205,7 +11114,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function-endpoint.ts",
-            "line": 76
+            "line": 161
           },
           "name": "endpointName",
           "type": {
@@ -10220,13 +11129,28 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function-endpoint.ts",
-            "line": 82
+            "line": 167
           },
           "name": "endpointType",
           "type": {
             "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpointType"
           }
         },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Grants on this endpoint (e.g. `grants.invoke(principal)`)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-endpoint.ts",
+            "line": 186
+          },
+          "name": "grants",
+          "type": {
+            "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionGrants"
+          }
+        },
         {
           "docs": {
             "stability": "experimental",
@@ -10235,7 +11159,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function-endpoint.ts",
-            "line": 85
+            "line": 173
           },
           "name": "regions",
           "type": {
@@ -10255,7 +11179,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function-endpoint.ts",
-            "line": 95
+            "line": 183
           },
           "name": "url",
           "type": {
@@ -10276,22 +11200,59 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/web-function-endpoint.ts",
-        "line": 12
+        "line": 32
       },
       "name": "WebFunctionEndpointOptions",
       "properties": [
         {
           "abstract": true,
           "docs": {
-            "default": "- `default-<hash of type and regions>`",
-            "remarks": "When omitted, the name is `default-<hash>`, with the hash covering the endpoint type and regions,\nso changing either deploys a new endpoint cleanly. When set, changing the endpoint type or\nregions also requires a new name: two endpoints of one function can't share a name, and\nCloudFormation creates the replacement before deleting the old one.",
+            "default": "WebFunctionDeployment.allAtOnce()",
+            "remarks": "A deployment in steps can't be combined with `revision`, `additionalRevisions` or `routeTraffic()`.",
             "stability": "experimental",
-            "summary": "The endpoint's name, shown in logs (`endpointName`) and in the `lambda-web-endpoint-name` header."
+            "summary": "How the endpoint moves its traffic to a new revision: all at once, or in steps (`WebFunctionDeployment.canary()` or `linear()`) that watch CloudWatch alarms and move the traffic back when one goes into ALARM."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function-endpoint.ts",
-            "line": 40
+            "line": 99
+          },
+          "name": "deployment",
+          "optional": true,
+          "type": {
+            "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionDeployment"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- no description",
+            "stability": "experimental",
+            "summary": "A description of the endpoint."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-endpoint.ts",
+            "line": 68
+          },
+          "name": "description",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- `default-<hash>` for the function's default endpoint, `<id>-<hash>` for endpoints added with `addEndpoint`",
+            "remarks": "When omitted, the name ends in a hash of the endpoint type and regions, so changing either deploys\na new endpoint cleanly. When set, changing the endpoint type or regions also requires a new name:\ntwo endpoints of one function can't share a name, and CloudFormation creates the replacement\nbefore deleting the old one.",
+            "stability": "experimental",
+            "summary": "The endpoint's name, shown in logs (`endpointName`) and in the `lambda-web-endpoint-name` header. Names are unique per function."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-endpoint.ts",
+            "line": 61
           },
           "name": "endpointName",
           "optional": true,
@@ -10309,7 +11270,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function-endpoint.ts",
-            "line": 18
+            "line": 38
           },
           "name": "endpointType",
           "optional": true,
@@ -10317,6 +11278,44 @@
             "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpointType"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- scales within the account's vCPU quota",
+            "remarks": "Enforced separately in each region the endpoint serves from.",
+            "stability": "experimental",
+            "summary": "The most execution environments the endpoint may use (2–10,000). Each one uses 2 vCPUs of the account's quota."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-endpoint.ts",
+            "line": 88
+          },
+          "name": "maxEnvironments",
+          "optional": true,
+          "type": {
+            "primitive": "number"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- no limit beyond the service quota of 10,000 requests per second per endpoint (per region)",
+            "remarks": "excess requests get HTTP 429.\nAllowed: 0 (blocks all traffic), 100–1,000 in steps of 100, or 2,000–10,000 in steps of 1,000.\n\nEnforced separately in each region the endpoint serves from, so a multi-region endpoint\ncan accept this many requests per second in every region.",
+            "stability": "experimental",
+            "summary": "The most requests per second the endpoint accepts;"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-endpoint.ts",
+            "line": 79
+          },
+          "name": "rateLimit",
+          "optional": true,
+          "type": {
+            "primitive": "number"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -10328,7 +11327,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function-endpoint.ts",
-            "line": 28
+            "line": 48
           },
           "name": "regions",
           "optional": true,
@@ -10385,9 +11384,9 @@
     "@ashishpandeyone/cdk-lambda-web-function.WebFunctionGrants": {
       "assembly": "@ashishpandeyone/cdk-lambda-web-function",
       "docs": {
-        "remarks": "Access it as `fn.grants`.",
+        "remarks": "Access them as `fn.grants` (the default endpoint) or `endpoint.grants`.",
         "stability": "experimental",
-        "summary": "Grants on a Web Function."
+        "summary": "Grants on a Web Function endpoint."
       },
       "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionGrants",
       "kind": "class",
@@ -10400,7 +11399,7 @@
           "docs": {
             "remarks": "The grant is on the endpoint's home-region ARN, which IAM evaluates for every region the\nendpoint serves from, including a MULTI_REGION global URL.",
             "stability": "experimental",
-            "summary": "Allows `grantee` to call the function's endpoint (`lambda:InvokeWebFunctionEndpoint`)."
+            "summary": "Allows `grantee` to call the endpoint (`lambda:InvokeWebFunctionEndpoint`)."
           },
           "locationInModule": {
             "filename": "src/web-function-grants.ts",
@@ -10425,68 +11424,109 @@
       "name": "WebFunctionGrants",
       "symbolId": "src/web-function-grants:WebFunctionGrants"
     },
-    "@ashishpandeyone/cdk-lambda-web-function.WebFunctionProps": {
+    "@ashishpandeyone/cdk-lambda-web-function.WebFunctionLinearDeploymentOptions": {
       "assembly": "@ashishpandeyone/cdk-lambda-web-function",
       "datatype": true,
       "docs": {
         "stability": "experimental",
-        "summary": "Properties for a `WebFunction`."
+        "summary": "Options for a linear deployment."
       },
-      "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionProps",
+      "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionLinearDeploymentOptions",
       "kind": "interface",
       "locationInModule": {
-        "filename": "src/web-function.ts",
-        "line": 16
+        "filename": "src/web-function-deployment.ts",
+        "line": 39
       },
-      "name": "WebFunctionProps",
+      "name": "WebFunctionLinearDeploymentOptions",
       "properties": [
         {
           "abstract": true,
           "docs": {
             "stability": "experimental",
-            "summary": "How callers of the endpoint are authenticated."
+            "summary": "How long each step serves before the next one (at least 1 minute, and at most 45 minutes in total)."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/web-function.ts",
-            "line": 33
+            "filename": "src/web-function-deployment.ts",
+            "line": 48
           },
-          "name": "authType",
+          "name": "interval",
           "type": {
-            "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionAuthType"
+            "fqn": "aws-cdk-lib.Duration"
           }
         },
         {
           "abstract": true,
           "docs": {
-            "remarks": "The code is copied into the stack's code bucket, which Lambda Web Functions can read.",
             "stability": "experimental",
-            "summary": "The code: a zip in S3 (`Code.fromAsset`, `Code.fromBucket`, `Code.fromCustomCommand`, `Code.fromDockerBuild`). Inline code and container images aren't supported."
+            "summary": "The share of traffic, in whole percent (5-50), that moves to the new revision at each step."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/web-function.ts",
-            "line": 28
+            "filename": "src/web-function-deployment.ts",
+            "line": 43
           },
-          "name": "code",
+          "name": "percent",
           "type": {
-            "fqn": "aws-cdk-lib.aws_lambda.Code"
+            "primitive": "number"
           }
         },
         {
           "abstract": true,
           "docs": {
+            "default": "- no alarms: traffic moves on a timer",
+            "remarks": "They're checked before traffic moves, during every step, and once the new revision has all traffic.\nUse alarms in any region (by ARN), including composite alarms.",
             "stability": "experimental",
-            "summary": "The Node.js runtime, e.g. `lambda.Runtime.NODEJS_24_X`."
+            "summary": "Alarms that stop the deployment: if one is in ALARM, the endpoint goes back to the previous revision and the deployment fails, so CloudFormation rolls the stack back."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-deployment.ts",
+            "line": 59
+          },
+          "name": "alarms",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "fqn": "aws-cdk-lib.aws_cloudwatch.IAlarm"
+              },
+              "kind": "array"
+            }
+          }
+        }
+      ],
+      "symbolId": "src/web-function-deployment:WebFunctionLinearDeploymentOptions"
+    },
+    "@ashishpandeyone/cdk-lambda-web-function.WebFunctionOptions": {
+      "assembly": "@ashishpandeyone/cdk-lambda-web-function",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "Options shared by `WebFunction` and `NodejsWebFunction`: everything except how the code is supplied."
+      },
+      "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionOptions",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/web-function.ts",
+        "line": 21
+      },
+      "name": "WebFunctionOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "How callers of the endpoint are authenticated."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 20
+            "line": 25
           },
-          "name": "runtime",
+          "name": "authType",
           "type": {
-            "fqn": "aws-cdk-lib.aws_lambda.Runtime"
+            "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionAuthType"
           }
         },
         {
@@ -10499,7 +11539,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 115
+            "line": 114
           },
           "name": "applicationLogLevelV2",
           "optional": true,
@@ -10517,7 +11557,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 61
+            "line": 60
           },
           "name": "description",
           "optional": true,
@@ -10528,14 +11568,14 @@
         {
           "abstract": true,
           "docs": {
-            "default": "- a HOME_REGION endpoint",
+            "default": "- a HOME_REGION endpoint serving the current revision",
             "stability": "experimental",
-            "summary": "The endpoint: where it serves from, and its name."
+            "summary": "The default endpoint (`fn.endpoint`): where it serves from, its name and limits. It serves the current revision; route it elsewhere with `fn.endpoint.routeTraffic()`. Add more endpoints with `addEndpoint`."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 40
+            "line": 34
           },
           "name": "endpoint",
           "optional": true,
@@ -10543,24 +11583,6 @@
             "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpointOptions"
           }
         },
-        {
-          "abstract": true,
-          "docs": {
-            "default": "'index.js'",
-            "stability": "experimental",
-            "summary": "The file that starts your server, relative to the root of the code."
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/web-function.ts",
-            "line": 47
-          },
-          "name": "entrypoint",
-          "optional": true,
-          "type": {
-            "primitive": "string"
-          }
-        },
         {
           "abstract": true,
           "docs": {
@@ -10572,7 +11594,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 78
+            "line": 77
           },
           "name": "environment",
           "optional": true,
@@ -10596,7 +11618,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 108
+            "line": 107
           },
           "name": "logRemovalPolicy",
           "optional": true,
@@ -10614,7 +11636,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 100
+            "line": 99
           },
           "name": "logRetention",
           "optional": true,
@@ -10633,7 +11655,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 93
+            "line": 92
           },
           "name": "maxConcurrencyPerEnvironment",
           "optional": true,
@@ -10641,6 +11663,25 @@
             "primitive": "number"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "20",
+            "remarks": "Each deployment that changes the code or\nconfiguration creates a revision; older ones stay available to roll back to or route traffic to,\nand the oldest beyond this count are deleted after each deployment.\n\nRevisions that an endpoint routes to are never deleted, and neither are those the previous\ndeployment used (a rollback returns to them).",
+            "stability": "experimental",
+            "summary": "How many of the newest revisions to keep (1-50)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function.ts",
+            "line": 46
+          },
+          "name": "revisionRetention",
+          "optional": true,
+          "type": {
+            "primitive": "number"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -10652,7 +11693,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 71
+            "line": 70
           },
           "name": "role",
           "optional": true,
@@ -10670,7 +11711,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 122
+            "line": 121
           },
           "name": "systemLogLevelV2",
           "optional": true,
@@ -10688,7 +11729,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 85
+            "line": 84
           },
           "name": "timeout",
           "optional": true,
@@ -10707,7 +11748,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/web-function.ts",
-            "line": 54
+            "line": 53
           },
           "name": "webFunctionName",
           "optional": true,
@@ -10716,9 +11757,290 @@
           }
         }
       ],
+      "symbolId": "src/web-function:WebFunctionOptions"
+    },
+    "@ashishpandeyone/cdk-lambda-web-function.WebFunctionProps": {
+      "assembly": "@ashishpandeyone/cdk-lambda-web-function",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "Properties for a `WebFunction`."
+      },
+      "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionProps",
+      "interfaces": [
+        "@ashishpandeyone/cdk-lambda-web-function.WebFunctionOptions"
+      ],
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/web-function.ts",
+        "line": 127
+      },
+      "name": "WebFunctionProps",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "The code is copied into the stack's code bucket, which Lambda Web Functions can read.",
+            "stability": "experimental",
+            "summary": "The code: a zip in S3 (`Code.fromAsset`, `Code.fromBucket`, `Code.fromCustomCommand`, `Code.fromDockerBuild`). Inline code and container images aren't supported."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function.ts",
+            "line": 139
+          },
+          "name": "code",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_lambda.Code"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "The Node.js runtime, e.g. `lambda.Runtime.NODEJS_24_X`."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function.ts",
+            "line": 131
+          },
+          "name": "runtime",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_lambda.Runtime"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "'index.js'",
+            "stability": "experimental",
+            "summary": "The file that starts your server, relative to the root of the code."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function.ts",
+            "line": 146
+          },
+          "name": "entrypoint",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
       "symbolId": "src/web-function:WebFunctionProps"
+    },
+    "@ashishpandeyone/cdk-lambda-web-function.WebFunctionRevision": {
+      "assembly": "@ashishpandeyone/cdk-lambda-web-function",
+      "base": "constructs.Construct",
+      "docs": {
+        "remarks": "`WebFunction` creates its current revision (`fn.currentRevision`) from its code and configuration.\nUse `fromRevisionAttributes` to route an endpoint to an earlier one, which must still exist:\nonly revisions within `revisionRetention`, or that an endpoint routes to, are kept.",
+        "stability": "experimental",
+        "summary": "A revision of a Web Function."
+      },
+      "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionRevision",
+      "interfaces": [
+        "@ashishpandeyone/cdk-lambda-web-function.IWebFunctionRevision"
+      ],
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/web-function-revision.ts",
+        "line": 36
+      },
+      "methods": [
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "References an existing revision of `webFunction`, e.g. to pin an endpoint to it or split traffic with it."
+          },
+          "locationInModule": {
+            "filename": "src/web-function-revision.ts",
+            "line": 40
+          },
+          "name": "fromRevisionAttributes",
+          "parameters": [
+            {
+              "name": "scope",
+              "type": {
+                "fqn": "constructs.Construct"
+              }
+            },
+            {
+              "name": "id",
+              "type": {
+                "primitive": "string"
+              }
+            },
+            {
+              "name": "attrs",
+              "type": {
+                "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionRevisionAttributes"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "@ashishpandeyone/cdk-lambda-web-function.IWebFunctionRevision"
+            }
+          },
+          "static": true
+        }
+      ],
+      "name": "WebFunctionRevision",
+      "properties": [
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "The revision's ARN."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-revision.ts",
+            "line": 57
+          },
+          "name": "revisionArn",
+          "overrides": "@ashishpandeyone/cdk-lambda-web-function.IWebFunctionRevision",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "The revision's ID, e.g. `rev-a1b2c`."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-revision.ts",
+            "line": 56
+          },
+          "name": "revisionId",
+          "overrides": "@ashishpandeyone/cdk-lambda-web-function.IWebFunctionRevision",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "The function the revision belongs to."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-revision.ts",
+            "line": 55
+          },
+          "name": "webFunction",
+          "overrides": "@ashishpandeyone/cdk-lambda-web-function.IWebFunctionRevision",
+          "type": {
+            "fqn": "aws-cdk-lib.interfaces.aws_lambda.IWebFunctionRef"
+          }
+        }
+      ],
+      "symbolId": "src/web-function-revision:WebFunctionRevision"
+    },
+    "@ashishpandeyone/cdk-lambda-web-function.WebFunctionRevisionAttributes": {
+      "assembly": "@ashishpandeyone/cdk-lambda-web-function",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "Attributes of an existing revision."
+      },
+      "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionRevisionAttributes",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/web-function-revision.ts",
+        "line": 21
+      },
+      "name": "WebFunctionRevisionAttributes",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "The revision's ID, e.g. `rev-a1b2c` (the `revisionId` of an earlier deployment)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-revision.ts",
+            "line": 26
+          },
+          "name": "revisionId",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "The function the revision belongs to."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-revision.ts",
+            "line": 23
+          },
+          "name": "webFunction",
+          "type": {
+            "fqn": "aws-cdk-lib.interfaces.aws_lambda.IWebFunctionRef"
+          }
+        }
+      ],
+      "symbolId": "src/web-function-revision:WebFunctionRevisionAttributes"
+    },
+    "@ashishpandeyone/cdk-lambda-web-function.WebFunctionRevisionWeight": {
+      "assembly": "@ashishpandeyone/cdk-lambda-web-function",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "A revision and the share of an endpoint's traffic it receives."
+      },
+      "fqn": "@ashishpandeyone/cdk-lambda-web-function.WebFunctionRevisionWeight",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/web-function-endpoint.ts",
+        "line": 18
+      },
+      "name": "WebFunctionRevisionWeight",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "The revision."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-endpoint.ts",
+            "line": 20
+          },
+          "name": "revision",
+          "type": {
+            "fqn": "@ashishpandeyone/cdk-lambda-web-function.IWebFunctionRevision"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "The revision's share of the endpoint's traffic, as a fraction (like `lambda.Alias` `additionalVersions`). Must be a whole percentage from 0.01 to 0.99."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/web-function-endpoint.ts",
+            "line": 26
+          },
+          "name": "weight",
+          "type": {
+            "primitive": "number"
+          }
+        }
+      ],
+      "symbolId": "src/web-function-endpoint:WebFunctionRevisionWeight"
     }
   },
-  "version": "0.1.0",
-  "fingerprint": "u0Hmq0zAMAyCc6Dk05vjUCG6qd3zEXZ0NaQJhOSdkfA="
+  "version": "0.1.2",
+  "fingerprint": "klXX+MmGau/7IlYuQHB50VIISLQsvsWWTDfCXLEc9FQ="
 }