canopycms-cdk 0.0.57 → 0.0.59

package/dist/constructs/asset-support.d.ts

@@ -0,0 +1,143 @@
+import { Construct } from 'constructs';
+import { RemovalPolicy, aws_cloudfront as cloudfront, aws_iam as iam, aws_lambda as lambda, aws_s3 as s3 } from 'aws-cdk-lib';
+export interface AssetSupportProps {
+    /**
+     * Use an existing bucket (BYO mode - e.g. a site's existing content
+     * bucket) instead of creating one. The caller owns that bucket's
+     * lifecycle rules and CORS configuration in this mode: `IBucket` (an
+     * imported bucket reference) has no CDK-level `addLifecycleRule`/
+     * `addCorsRule` - only a bucket this construct creates itself does. See
+     * `.claude/future-tasks/docs-site-assets-wiring.md` for the BYO-mode
+     * wiring this is designed for.
+     *
+     * @default - a new private bucket is created (standalone mode)
+     */
+    readonly bucket?: s3.IBucket;
+    /**
+     * Origins allowed to presigned-POST/PUT/GET upload directly to the bucket
+     * (the editor's own origin(s) - e.g. `http://localhost:3000` in dev, or
+     * the deployed editor's domain). Only applied in standalone mode (see
+     * `bucket`).
+     */
+    readonly editorOrigins: string[];
+    /**
+     * Advisory upload-size cap in bytes. Not enforced by this construct -
+     * the actual cap comes from the presigned POST's `content-length-range`
+     * condition, set by `S3AssetStoreOptions.maxUploadBytes` at runtime
+     * (packages/canopycms/src/assets/store-s3.ts). Exposed here only so the
+     * consuming stack can wire the SAME number into the CMS Lambda's
+     * environment (e.g. as `MEDIA_MAX_UPLOAD_BYTES`) and keep infra and app
+     * config from silently drifting apart.
+     *
+     * @default 52428800 (50 MiB)
+     */
+    readonly maxUploadBytes?: number;
+    /**
+     * Enable S3 versioning on the created bucket. Standalone mode only.
+     *
+     * @default false
+     */
+    readonly versioned?: boolean;
+    /**
+     * Removal policy for the created bucket. Standalone mode only.
+     *
+     * @default RemovalPolicy.RETAIN
+     */
+    readonly removalPolicy?: RemovalPolicy;
+    /**
+     * Auto-delete objects when the created bucket is destroyed. Only takes
+     * effect alongside `removalPolicy: RemovalPolicy.DESTROY` - useful for
+     * ephemeral canary/test stacks. Standalone mode only.
+     *
+     * @default false
+     */
+    readonly autoDeleteObjects?: boolean;
+}
+/**
+ * The two CloudFront behavior configs the asset system needs, keyed by the
+ * path pattern they belong under. Each value is a full `BehaviorOptions`
+ * (origin included), so a consumer can use it either way:
+ *
+ * ```ts
+ * const behaviors = assetSupport.assetBehaviors()
+ *
+ * // Building a new distribution. CloudFront matches path patterns in the
+ * // order they're listed and stops at the first match, so the more
+ * // specific '/assets/t/*' MUST come before '/assets/*' - otherwise the
+ * // broader S3-only pattern swallows transform requests first and they
+ * // 403 with no Lambda fallback.
+ * new cloudfront.Distribution(this, 'Dist', {
+ *   defaultBehavior: ...,
+ *   additionalBehaviors: {
+ *     '/assets/t/*': behaviors.assetsTransform,
+ *     '/assets/*': behaviors.assets,
+ *   },
+ * })
+ *
+ * // Adding to an existing distribution: the same first-match-wins ordering
+ * // applies to the resulting CacheBehaviors list, so call addBehavior for
+ * // '/assets/t/*' before '/assets/*' here too.
+ * distribution.addBehavior('/assets/t/*', behaviors.assetsTransform.origin, behaviors.assetsTransform)
+ * distribution.addBehavior('/assets/*', behaviors.assets.origin, behaviors.assets)
+ * ```
+ */
+export interface AssetCloudFrontBehaviors {
+    /**
+     * `/assets/*` - static objects only (sanitized SVG/PDF the finalize
+     * pipeline wrote, plus already-computed transform outputs under
+     * `assets/t/...`, which also live under this prefix). S3 origin only -
+     * nothing here is ever computed on demand.
+     */
+    readonly assets: cloudfront.BehaviorOptions;
+    /**
+     * `/assets/t/*` - transform outputs specifically. Origin group: the same
+     * S3 origin as `assets` primary, falling over to the transform Lambda's
+     * Function URL on 403 OR 404 (a signed OAC origin reports a miss as 403;
+     * configuring both is defense-in-depth). See the SPIKE RESULT in
+     * `.claude/future-tasks/assets-media-system.md` - this design is
+     * confirmed working with CloudFront caching the failover response.
+     */
+    readonly assetsTransform: cloudfront.BehaviorOptions;
+}
+/**
+ * Per-site CDK construct for the asset/media delivery system (see
+ * `.claude/future-tasks/assets-media-system.md` for the full design record).
+ * Wires:
+ *
+ * - The bucket's asset-prefix lifecycle rule + CORS (standalone mode only).
+ * - The transform Lambda (`../../lambda/asset-transform/handler.ts`, built
+ *   via `pnpm run build:lambda` - see that script's doc comment for the
+ *   no-Docker sharp bundling approach) and its OAC-locked Function URL.
+ * - `assetBehaviors()`, the two CloudFront behavior configs a consuming
+ *   distribution attaches (see `AssetCloudFrontBehaviors`'s doc comment for
+ *   both attachment shapes).
+ * - `grantUploadAccess()`, the exact prefix-scoped grants the CMS/editor
+ *   principal needs to run `S3AssetStore` (packages/canopycms/src/assets/store-s3.ts).
+ */
+export declare class AssetSupport extends Construct {
+    /** The bucket in use (either created here, or the BYO `props.bucket`). */
+    readonly bucket: s3.IBucket;
+    /** The transform Lambda function. */
+    readonly transformFunction: lambda.Function;
+    /** The transform Lambda's Function URL - use as a CloudFront origin (see `assetBehaviors()`). */
+    readonly transformFunctionUrl: lambda.FunctionUrl;
+    /** Effective advisory upload-size cap (see `AssetSupportProps.maxUploadBytes`). */
+    readonly maxUploadBytes: number;
+    private readonly behaviors;
+    constructor(scope: Construct, id: string, props: AssetSupportProps);
+    private buildBehaviors;
+    /** The two CloudFront behavior configs this system needs - see `AssetCloudFrontBehaviors`'s doc comment for both attachment shapes. */
+    assetBehaviors(): AssetCloudFrontBehaviors;
+    /**
+     * Grant the CMS/editor principal (the CMS Lambda's role, typically) the
+     * exact permissions `S3AssetStore` (packages/canopycms/src/assets/store-s3.ts)
+     * calls for:
+     *
+     * - put on `asset-staging/` (presigned POST + proxied `writeStaging`)
+     * - get on `asset-staging/` + `asset-originals/` + `asset-meta/` + `assets/`
+     * - put on `asset-originals/` + `asset-meta/` + `assets/`
+     * - delete on `asset-staging/` + `asset-meta/`
+     */
+    grantUploadAccess(grantee: iam.IGrantable): void;
+}
+//# sourceMappingURL=asset-support.d.ts.map

package/dist/constructs/asset-support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-support.d.ts","sourceRoot":"","sources":["../../src/constructs/asset-support.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EAEL,aAAa,EACb,cAAc,IAAI,UAAU,EAE5B,OAAO,IAAI,GAAG,EACd,UAAU,IAAI,MAAM,EACpB,MAAM,IAAI,EAAE,EACb,MAAM,aAAa,CAAA;AAwDpB,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAA;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,CAAA;IAEhC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAEhC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAE5B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAA;IAEtC;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,eAAe,CAAA;IAE3C;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC,eAAe,CAAA;CACrD;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,YAAa,SAAQ,SAAS;IACzC,0EAA0E;IAC1E,SAAgB,MAAM,EAAE,EAAE,CAAC,OAAO,CAAA;IAElC,qCAAqC;IACrC,SAAgB,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAA;IAElD,iGAAiG;IACjG,SAAgB,oBAAoB,EAAE,MAAM,CAAC,WAAW,CAAA;IAExD,mFAAmF;IACnF,SAAgB,cAAc,EAAE,MAAM,CAAA;IAEtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;gBAExC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB;IAgFlE,OAAO,CAAC,cAAc;IA+CtB,uIAAuI;IAChI,cAAc,IAAI,wBAAwB;IAIjD;;;;;;;;;OASG;IACI,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,GAAG,IAAI;CAexD"}

package/dist/constructs/asset-support.js

@@ -0,0 +1,208 @@
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Construct } from 'constructs';
+import { Duration, RemovalPolicy, aws_cloudfront as cloudfront, aws_cloudfront_origins as origins, aws_lambda as lambda, aws_s3 as s3, } from 'aws-cdk-lib';
+// This package (`canopycms-cdk`) is `"type": "module"`, so its compiled
+// output is real ESM - `__dirname` is not a global there. Derive it from
+// `import.meta.url` instead (mirrors ../../lambda/asset-transform/build.mjs).
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+/**
+ * The four S3 key prefixes the asset system uses, mirrored from
+ * `packages/canopycms/src/assets/asset-prefixes.ts` (the source of truth).
+ * Duplicated as plain string literals - not imported from `canopycms` -
+ * because this construct must synth cleanly for ANY consumer's CDK app
+ * (e.g. a site's own `infrastructure/` package), which has no reason to
+ * have `canopycms` itself resolvable from wherever its CDK code runs. The
+ * transform Lambda (../../lambda/asset-transform/handler.ts), by contrast,
+ * is bundled at build time from WITHIN this package (where `canopycms` is a
+ * real workspace devDependency), so it imports the canonical constants
+ * directly from `canopycms/server` instead of duplicating them - see that
+ * file's doc comment.
+ */
+const PREFIXES = {
+    originals: 'asset-originals',
+    staging: 'asset-staging',
+    meta: 'asset-meta',
+    public: 'assets',
+    transform: 'assets/t',
+};
+/** S3 CORS preflight cache duration for presigned-POST uploads from the editor. */
+const CORS_MAX_AGE_SECONDS = 3000;
+/** Matches packages/canopycms/src/assets/store-s3.ts's `DEFAULT_MAX_UPLOAD_BYTES`. */
+const DEFAULT_MAX_UPLOAD_BYTES = 50 * 1024 * 1024;
+const TRANSFORM_LAMBDA_MEMORY_MB = 1536;
+const TRANSFORM_LAMBDA_TIMEOUT = Duration.seconds(30);
+/**
+ * `/assets/t/*`-specific cache TTLs. The managed `CachePolicy.CACHING_OPTIMIZED`
+ * (used for the plain `/assets/*` static behavior) has a 1-second MIN TTL,
+ * which is exactly the bug this policy exists to avoid: the transform
+ * Lambda's oversized-output path (handler.ts) returns a `Cache-Control:
+ * no-store` 302 redirect specifically so CloudFront never caches it - but a
+ * managed policy with ANY nonzero min TTL still caches that response for at
+ * least that long regardless of the origin's own `no-store`, so the redirect
+ * (to the now-written canonical S3 key) gets cached and re-served, and
+ * CloudFront's next hit for that same canonical key 404s/403s off S3 (or
+ * hasn't propagated yet), falling back to the Lambda again - a self-sustaining
+ * redirect loop. `minTtl: 0` lets an origin's own `Cache-Control` (including
+ * `no-store`) be honored immediately; `maxTtl`/`defaultTtl` stay generous so
+ * the normal case (an immutable 200 with a real `max-age`) still caches well.
+ */
+const TRANSFORM_CACHE_MIN_TTL = Duration.seconds(0);
+const TRANSFORM_CACHE_DEFAULT_TTL = Duration.days(1);
+const TRANSFORM_CACHE_MAX_TTL = Duration.days(365);
+/**
+ * Per-site CDK construct for the asset/media delivery system (see
+ * `.claude/future-tasks/assets-media-system.md` for the full design record).
+ * Wires:
+ *
+ * - The bucket's asset-prefix lifecycle rule + CORS (standalone mode only).
+ * - The transform Lambda (`../../lambda/asset-transform/handler.ts`, built
+ *   via `pnpm run build:lambda` - see that script's doc comment for the
+ *   no-Docker sharp bundling approach) and its OAC-locked Function URL.
+ * - `assetBehaviors()`, the two CloudFront behavior configs a consuming
+ *   distribution attaches (see `AssetCloudFrontBehaviors`'s doc comment for
+ *   both attachment shapes).
+ * - `grantUploadAccess()`, the exact prefix-scoped grants the CMS/editor
+ *   principal needs to run `S3AssetStore` (packages/canopycms/src/assets/store-s3.ts).
+ */
+export class AssetSupport extends Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.maxUploadBytes = props.maxUploadBytes ?? DEFAULT_MAX_UPLOAD_BYTES;
+        if (props.bucket) {
+            this.bucket = props.bucket;
+        }
+        else {
+            this.bucket = new s3.Bucket(this, 'Bucket', {
+                blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+                encryption: s3.BucketEncryption.S3_MANAGED,
+                versioned: props.versioned ?? false,
+                removalPolicy: props.removalPolicy ?? RemovalPolicy.RETAIN,
+                autoDeleteObjects: props.autoDeleteObjects ?? false,
+                // Only `asset-staging/` expires - originals/meta/public/transform
+                // outputs are all kept forever by design (content-addressed,
+                // immutable - see the design record's "Storage" section).
+                lifecycleRules: [
+                    {
+                        id: 'expire-asset-staging',
+                        enabled: true,
+                        prefix: `${PREFIXES.staging}/`,
+                        expiration: Duration.days(1),
+                    },
+                ],
+                cors: [
+                    {
+                        id: 'editor-presigned-upload',
+                        allowedOrigins: props.editorOrigins,
+                        allowedMethods: [s3.HttpMethods.POST, s3.HttpMethods.PUT, s3.HttpMethods.GET],
+                        allowedHeaders: ['*'],
+                        maxAge: CORS_MAX_AGE_SECONDS,
+                    },
+                ],
+            });
+        }
+        this.transformFunction = new lambda.Function(this, 'TransformFunction', {
+            // Built by `pnpm run build:lambda` (lambda/asset-transform/build.mjs) -
+            // esbuild bundle + a real linux/arm64 `npm install sharp` alongside it,
+            // no Docker. `cdk synth`/`deploy` need that script run first; it is
+            // NOT run automatically here (kept explicit rather than magic - see
+            // this construct's class doc comment).
+            code: lambda.Code.fromAsset(path.join(__dirname, '..', '..', 'lambda', 'asset-transform', 'dist')),
+            handler: 'handler.handler',
+            // nodejs20.x was deprecated 2026-04-30; CDK's CloudFormation validation
+            // now fails synth on it. The esbuild bundle targets node20 and runs
+            // unchanged on the node22 runtime.
+            runtime: lambda.Runtime.NODEJS_22_X,
+            architecture: lambda.Architecture.ARM_64,
+            memorySize: TRANSFORM_LAMBDA_MEMORY_MB,
+            timeout: TRANSFORM_LAMBDA_TIMEOUT,
+            environment: {
+                ASSET_BUCKET: this.bucket.bucketName,
+            },
+        });
+        // Read access to originals (what it transforms) - deviation from the PR
+        // spec's literal "read asset-originals/, write assets/" grant list: the
+        // handler must also read `asset-meta/{hash32}.json` to look up kind/ext
+        // before it can transform anything, so meta read access is granted too.
+        this.bucket.grantRead(this.transformFunction, `${PREFIXES.originals}/*`);
+        this.bucket.grantRead(this.transformFunction, `${PREFIXES.meta}/*`);
+        // Write access to `assets/*` covers both the public prefix and
+        // `assets/t/*` (transform outputs nest under it) in one grant.
+        this.bucket.grantPut(this.transformFunction, `${PREFIXES.public}/*`);
+        // AWS_IAM (not NONE): only reachable through CloudFront's Origin Access
+        // Control, matching CanopyCmsService/CanopyCmsDistribution's existing
+        // Function URL pattern (see cms-service.ts / cms-distribution.ts) -
+        // direct hits to the Function URL are rejected.
+        this.transformFunctionUrl = this.transformFunction.addFunctionUrl({
+            authType: lambda.FunctionUrlAuthType.AWS_IAM,
+        });
+        this.behaviors = this.buildBehaviors();
+    }
+    buildBehaviors() {
+        const s3Origin = origins.S3BucketOrigin.withOriginAccessControl(this.bucket);
+        const transformLambdaOrigin = origins.FunctionUrlOrigin.withOriginAccessControl(this.transformFunctionUrl);
+        const assets = {
+            origin: s3Origin,
+            viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+            cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
+            compress: true,
+        };
+        // Custom (not managed CACHING_OPTIMIZED) - see TRANSFORM_CACHE_MIN_TTL's
+        // doc comment for why this behavior specifically needs minTtl: 0.
+        // Directives live entirely in the path (no query string), and the
+        // response never varies by cookie/request header, so nothing is
+        // forwarded into the cache key.
+        const transformCachePolicy = new cloudfront.CachePolicy(this, 'AssetsTransformCachePolicy', {
+            minTtl: TRANSFORM_CACHE_MIN_TTL,
+            defaultTtl: TRANSFORM_CACHE_DEFAULT_TTL,
+            maxTtl: TRANSFORM_CACHE_MAX_TTL,
+            enableAcceptEncodingGzip: true,
+            enableAcceptEncodingBrotli: true,
+            queryStringBehavior: cloudfront.CacheQueryStringBehavior.none(),
+            headerBehavior: cloudfront.CacheHeaderBehavior.none(),
+            cookieBehavior: cloudfront.CacheCookieBehavior.none(),
+        });
+        const assetsTransform = {
+            origin: new origins.OriginGroup({
+                primaryOrigin: s3Origin,
+                fallbackOrigin: transformLambdaOrigin,
+                // A signed OAC origin reports a miss as 403 (not 404, since it
+                // never reveals object existence) - CloudFront's own S3 origin
+                // handling can still surface 404 in some paths, so both are
+                // configured. Confirmed working end-to-end by the sandbox spike
+                // (.claude/future-tasks/assets-media-system.md's SPIKE RESULT).
+                fallbackStatusCodes: [403, 404],
+            }),
+            viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+            cachePolicy: transformCachePolicy,
+        };
+        return { assets, assetsTransform };
+    }
+    /** The two CloudFront behavior configs this system needs - see `AssetCloudFrontBehaviors`'s doc comment for both attachment shapes. */
+    assetBehaviors() {
+        return this.behaviors;
+    }
+    /**
+     * Grant the CMS/editor principal (the CMS Lambda's role, typically) the
+     * exact permissions `S3AssetStore` (packages/canopycms/src/assets/store-s3.ts)
+     * calls for:
+     *
+     * - put on `asset-staging/` (presigned POST + proxied `writeStaging`)
+     * - get on `asset-staging/` + `asset-originals/` + `asset-meta/` + `assets/`
+     * - put on `asset-originals/` + `asset-meta/` + `assets/`
+     * - delete on `asset-staging/` + `asset-meta/`
+     */
+    grantUploadAccess(grantee) {
+        this.bucket.grantPut(grantee, `${PREFIXES.staging}/*`);
+        this.bucket.grantRead(grantee, `${PREFIXES.staging}/*`);
+        this.bucket.grantRead(grantee, `${PREFIXES.originals}/*`);
+        this.bucket.grantRead(grantee, `${PREFIXES.meta}/*`);
+        this.bucket.grantRead(grantee, `${PREFIXES.public}/*`);
+        this.bucket.grantPut(grantee, `${PREFIXES.originals}/*`);
+        this.bucket.grantPut(grantee, `${PREFIXES.meta}/*`);
+        this.bucket.grantPut(grantee, `${PREFIXES.public}/*`);
+        this.bucket.grantDelete(grantee, `${PREFIXES.staging}/*`);
+        this.bucket.grantDelete(grantee, `${PREFIXES.meta}/*`);
+    }
+}
+//# sourceMappingURL=asset-support.js.map

package/dist/constructs/asset-support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-support.js","sourceRoot":"","sources":["../../src/constructs/asset-support.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EACL,QAAQ,EACR,aAAa,EACb,cAAc,IAAI,UAAU,EAC5B,sBAAsB,IAAI,OAAO,EAEjC,UAAU,IAAI,MAAM,EACpB,MAAM,IAAI,EAAE,GACb,MAAM,aAAa,CAAA;AAEpB,wEAAwE;AACxE,yEAAyE;AACzE,8EAA8E;AAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAE9D;;;;;;;;;;;;GAYG;AACH,MAAM,QAAQ,GAAG;IACf,SAAS,EAAE,iBAAiB;IAC5B,OAAO,EAAE,eAAe;IACxB,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,UAAU;CACb,CAAA;AAEV,mFAAmF;AACnF,MAAM,oBAAoB,GAAG,IAAI,CAAA;AAEjC,sFAAsF;AACtF,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEjD,MAAM,0BAA0B,GAAG,IAAI,CAAA;AACvC,MAAM,wBAAwB,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAErD;;;;;;;;;;;;;;GAcG;AACH,MAAM,uBAAuB,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AACnD,MAAM,2BAA2B,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACpD,MAAM,uBAAuB,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AA6GlD;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,YAAa,SAAQ,SAAS;IAezC,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAwB;QAChE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAEhB,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,wBAAwB,CAAA;QAEtE,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;QAC5B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE;gBAC1C,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS;gBACjD,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,UAAU;gBAC1C,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK;gBACnC,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM;gBAC1D,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,KAAK;gBACnD,kEAAkE;gBAClE,6DAA6D;gBAC7D,0DAA0D;gBAC1D,cAAc,EAAE;oBACd;wBACE,EAAE,EAAE,sBAAsB;wBAC1B,OAAO,EAAE,IAAI;wBACb,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,GAAG;wBAC9B,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;qBAC7B;iBACF;gBACD,IAAI,EAAE;oBACJ;wBACE,EAAE,EAAE,yBAAyB;wBAC7B,cAAc,EAAE,KAAK,CAAC,aAAa;wBACnC,cAAc,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC;wBAC7E,cAAc,EAAE,CAAC,GAAG,CAAC;wBACrB,MAAM,EAAE,oBAAoB;qBAC7B;iBACF;aACF,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,iBAAiB,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,EAAE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,oEAAoE;YACpE,oEAAoE;YACpE,uCAAuC;YACvC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CACzB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,CAAC,CACtE;YACD,OAAO,EAAE,iBAAiB;YAC1B,wEAAwE;YACxE,oEAAoE;YACpE,mCAAmC;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;YACnC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM;YACxC,UAAU,EAAE,0BAA0B;YACtC,OAAO,EAAE,wBAAwB;YACjC,WAAW,EAAE;gBACX,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACrC;SACF,CAAC,CAAA;QAEF,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;QACxE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QACnE,+DAA+D;QAC/D,+DAA+D;QAC/D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;QAEpE,wEAAwE;QACxE,sEAAsE;QACtE,oEAAoE;QACpE,gDAAgD;QAChD,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC;YAChE,QAAQ,EAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO;SAC7C,CAAC,CAAA;QAEF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,cAAc,EAAE,CAAA;IACxC,CAAC;IAEO,cAAc;QACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5E,MAAM,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,uBAAuB,CAC7E,IAAI,CAAC,oBAAoB,CAC1B,CAAA;QAED,MAAM,MAAM,GAA+B;YACzC,MAAM,EAAE,QAAQ;YAChB,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,CAAC,iBAAiB;YACvE,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,iBAAiB;YACrD,QAAQ,EAAE,IAAI;SACf,CAAA;QAED,yEAAyE;QACzE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,gCAAgC;QAChC,MAAM,oBAAoB,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,4BAA4B,EAAE;YAC1F,MAAM,EAAE,uBAAuB;YAC/B,UAAU,EAAE,2BAA2B;YACvC,MAAM,EAAE,uBAAuB;YAC/B,wBAAwB,EAAE,IAAI;YAC9B,0BAA0B,EAAE,IAAI;YAChC,mBAAmB,EAAE,UAAU,CAAC,wBAAwB,CAAC,IAAI,EAAE;YAC/D,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACrD,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE;SACtD,CAAC,CAAA;QAEF,MAAM,eAAe,GAA+B;YAClD,MAAM,EAAE,IAAI,OAAO,CAAC,WAAW,CAAC;gBAC9B,aAAa,EAAE,QAAQ;gBACvB,cAAc,EAAE,qBAAqB;gBACrC,+DAA+D;gBAC/D,+DAA+D;gBAC/D,4DAA4D;gBAC5D,gEAAgE;gBAChE,gEAAgE;gBAChE,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;aAChC,CAAC;YACF,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,CAAC,iBAAiB;YACvE,WAAW,EAAE,oBAAoB;SAClC,CAAA;QAED,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IACpC,CAAC;IAED,uIAAuI;IAChI,cAAc;QACnB,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED;;;;;;;;;OASG;IACI,iBAAiB,CAAC,OAAuB;QAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;QAEtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;QACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;QACzD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;QAEtD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;QACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;QAErD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;QACzD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;IACxD,CAAC;CACF"}

package/dist/constructs/cms-distribution.d.ts

@@ -24,6 +24,8 @@ export interface CanopyCmsDistributionProps {
  * - CloudFront distribution with Function URL origin
  * - Route53 A/AAAA alias records
  * - Cache policies: no-cache for /api/* and /edit*, cache /_next/static/*
+ * - Viewer-request CloudFront Function setting x-forwarded-host (redirect-URL
+ *   derivation behind the Host-stripping OAC origin)
  */
 export declare class CanopyCmsDistribution extends Construct {
     /** The CloudFront distribution */

package/dist/constructs/cms-distribution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cms-distribution.d.ts","sourceRoot":"","sources":["../../src/constructs/cms-distribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EAEL,cAAc,IAAI,UAAU,EAE5B,sBAAsB,IAAI,GAAG,EAC7B,WAAW,IAAI,OAAO,EAEtB,UAAU,IAAI,MAAM,EACrB,MAAM,aAAa,CAAA;AAEpB,MAAM,WAAW,0BAA0B;IACzC,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAC,WAAW,CAAA;IAE/B,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAA;IAElB,uDAAuD;IACvD,gBAAgB,EAAE,MAAM,CAAA;IAExB,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,CAAC,WAAW,CAAA;IAEhC,4EAA4E;IAC5E,WAAW,CAAC,EAAE,GAAG,CAAC,YAAY,CAAA;CAC/B;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,qBAAsB,SAAQ,SAAS;IAClD,kCAAkC;IAClC,SAAgB,YAAY,EAAE,UAAU,CAAC,YAAY,CAAA;gBAEzC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B;CA4F5E"}
+{"version":3,"file":"cms-distribution.d.ts","sourceRoot":"","sources":["../../src/constructs/cms-distribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EAEL,cAAc,IAAI,UAAU,EAE5B,sBAAsB,IAAI,GAAG,EAC7B,WAAW,IAAI,OAAO,EAEtB,UAAU,IAAI,MAAM,EACrB,MAAM,aAAa,CAAA;AAEpB,MAAM,WAAW,0BAA0B;IACzC,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAC,WAAW,CAAA;IAE/B,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAA;IAElB,uDAAuD;IACvD,gBAAgB,EAAE,MAAM,CAAA;IAExB,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,CAAC,WAAW,CAAA;IAEhC,4EAA4E;IAC5E,WAAW,CAAC,EAAE,GAAG,CAAC,YAAY,CAAA;CAC/B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,qBAAsB,SAAQ,SAAS;IAClD,kCAAkC;IAClC,SAAgB,YAAY,EAAE,UAAU,CAAC,YAAY,CAAA;gBAEzC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B;CAyH5E"}

package/dist/constructs/cms-distribution.js

@@ -12,6 +12,8 @@ import { Duration, aws_cloudfront as cloudfront, aws_cloudfront_origins as origi
  * - CloudFront distribution with Function URL origin
  * - Route53 A/AAAA alias records
  * - Cache policies: no-cache for /api/* and /edit*, cache /_next/static/*
+ * - Viewer-request CloudFront Function setting x-forwarded-host (redirect-URL
+ *   derivation behind the Host-stripping OAC origin)
  */
 export class CanopyCmsDistribution extends Construct {
     constructor(scope, id, props) {
@@ -40,19 +42,19 @@ export class CanopyCmsDistribution extends Construct {
         // the Function URL are rejected (DEP-H2). withOriginAccessControl creates
         // the OAC and grants CloudFront lambda:InvokeFunctionUrl automatically.
         const origin = origins.FunctionUrlOrigin.withOriginAccessControl(props.functionUrl);
-        // Cache policy for API/editor routes: no caching, forward all headers
-        const noCachePolicy = new cloudfront.CachePolicy(this, 'NoCachePolicy', {
-            cachePolicyName: `${id}-no-cache`,
-            defaultTtl: Duration.seconds(0),
-            maxTtl: Duration.seconds(0),
-            minTtl: Duration.seconds(0),
-            headerBehavior: cloudfront.CacheHeaderBehavior.allowList('Authorization', 'Cookie', 'Host'),
-            queryStringBehavior: cloudfront.CacheQueryStringBehavior.all(),
-            cookieBehavior: cloudfront.CacheCookieBehavior.all(),
-        });
+        // Cache policy for API/editor routes: AWS's managed CACHING_DISABLED
+        // policy. Deploy-proven (deploy-test epic, 2026-07-23): CloudFront
+        // rejects ANY non-none cache-key setting on a caching-disabled policy -
+        // Authorization in a header allowlist (aws/aws-cdk#16977) but also
+        // cookieBehavior/queryStringBehavior `all()` ("The parameter
+        // CookieBehavior is invalid for policy with caching disabled"). With
+        // TTL 0 the cache key is meaningless anyway; the origin still receives
+        // the full viewer request (headers/cookies/query string, minus Host -
+        // forwarding Host would break the OAC-signed Function URL) via the
+        // ALL_VIEWER_EXCEPT_HOST_HEADER origin request policy on the behavior.
+        const noCachePolicy = cloudfront.CachePolicy.CACHING_DISABLED;
         // Cache policy for static assets
         const staticCachePolicy = new cloudfront.CachePolicy(this, 'StaticCachePolicy', {
-            cachePolicyName: `${id}-static`,
             defaultTtl: Duration.days(365),
             maxTtl: Duration.days(365),
             minTtl: Duration.days(365),
@@ -60,6 +62,26 @@ export class CanopyCmsDistribution extends Construct {
             queryStringBehavior: cloudfront.CacheQueryStringBehavior.none(),
             cookieBehavior: cloudfront.CacheCookieBehavior.none(),
         });
+        // CloudFront gives the origin the Function URL's own Host (forwarding the
+        // viewer Host would break the OAC SigV4 signature), and Lambda Web Adapter
+        // forwards no `x-forwarded-*` headers of its own - so without this
+        // function, Clerk/Next derive sign-in redirect URLs from the IAM-authed
+        // Function URL host instead of the public domain, and the redirect 403s
+        // (direct Function URL hits are rejected). Deploy-proven (deploy-test
+        // epic, 2026-07-23): x-forwarded-proto is on CloudFront Functions'
+        // DISALLOWED header list - setting it fails every request with 502
+        // FunctionValidationError. Only x-forwarded-host is set; proto is
+        // unambiguous anyway (viewer-facing CloudFront is HTTPS-only via
+        // REDIRECT_TO_HTTPS).
+        const forwardedHostFunction = new cloudfront.Function(this, 'ForwardedHostFunction', {
+            code: cloudfront.FunctionCode.fromInline([
+                'function handler(event) {',
+                '  var request = event.request;',
+                "  request.headers['x-forwarded-host'] = { value: request.headers.host.value };",
+                '  return request;',
+                '}',
+            ].join('\n')),
+        });
         this.distribution = new cloudfront.Distribution(this, 'Distribution', {
             domainNames: [props.domainName],
             certificate,
@@ -69,6 +91,12 @@ export class CanopyCmsDistribution extends Construct {
                 viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
                 allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
                 originRequestPolicy: cloudfront.OriginRequestPolicy.ALL_VIEWER_EXCEPT_HOST_HEADER,
+                functionAssociations: [
+                    {
+                        function: forwardedHostFunction,
+                        eventType: cloudfront.FunctionEventType.VIEWER_REQUEST,
+                    },
+                ],
             },
             additionalBehaviors: {
                 '/_next/static/*': {

package/dist/constructs/cms-distribution.js.map

@@ -1 +1 @@
-{"version":3,"file":"cms-distribution.js","sourceRoot":"","sources":["../../src/constructs/cms-distribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EACL,QAAQ,EACR,cAAc,IAAI,UAAU,EAC5B,sBAAsB,IAAI,OAAO,EACjC,sBAAsB,IAAI,GAAG,EAC7B,WAAW,IAAI,OAAO,EACtB,mBAAmB,IAAI,OAAO,GAE/B,MAAM,aAAa,CAAA;AAmBpB;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,qBAAsB,SAAQ,SAAS;IAIlD,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAiC;QACzE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAEhB,2EAA2E;QAC3E,2BAA2B;QAC3B,2EAA2E;QAE3E,MAAM,UAAU,GACd,KAAK,CAAC,UAAU;YAChB,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE;gBAC1C,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;QAEJ,2EAA2E;QAC3E,kBAAkB;QAClB,2EAA2E;QAE3E,MAAM,WAAW,GACf,KAAK,CAAC,WAAW;YACjB,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC;aAC1D,CAAC,CAAA;QAEJ,2EAA2E;QAC3E,0BAA0B;QAC1B,2EAA2E;QAE3E,wEAAwE;QACxE,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QAEnF,sEAAsE;QACtE,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,eAAe,EAAE;YACtE,eAAe,EAAE,GAAG,EAAE,WAAW;YACjC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/B,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3B,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3B,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,eAAe,EAAE,QAAQ,EAAE,MAAM,CAAC;YAC3F,mBAAmB,EAAE,UAAU,CAAC,wBAAwB,CAAC,GAAG,EAAE;YAC9D,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,GAAG,EAAE;SACrD,CAAC,CAAA;QAEF,iCAAiC;QACjC,MAAM,iBAAiB,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,mBAAmB,EAAE;YAC9E,eAAe,EAAE,GAAG,EAAE,SAAS;YAC/B,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAC1B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAC1B,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACrD,mBAAmB,EAAE,UAAU,CAAC,wBAAwB,CAAC,IAAI,EAAE;YAC/D,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE;SACtD,CAAC,CAAA;QAEF,IAAI,CAAC,YAAY,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE;YACpE,WAAW,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;YAC/B,WAAW;YACX,eAAe,EAAE;gBACf,MAAM;gBACN,WAAW,EAAE,aAAa;gBAC1B,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,CAAC,iBAAiB;gBACvE,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,SAAS;gBACnD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB,CAAC,6BAA6B;aAClF;YACD,mBAAmB,EAAE;gBACnB,iBAAiB,EAAE;oBACjB,MAAM;oBACN,WAAW,EAAE,iBAAiB;oBAC9B,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,CAAC,iBAAiB;iBACxE;aACF;SACF,CAAC,CAAA;QAEF,2EAA2E;QAC3E,cAAc;QACd,2EAA2E;QAE3E,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE;YACnC,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;SACxF,CAAC,CAAA;QAEF,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE;YACzC,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;SACxF,CAAC,CAAA;IACJ,CAAC;CACF"}
+{"version":3,"file":"cms-distribution.js","sourceRoot":"","sources":["../../src/constructs/cms-distribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EACL,QAAQ,EACR,cAAc,IAAI,UAAU,EAC5B,sBAAsB,IAAI,OAAO,EACjC,sBAAsB,IAAI,GAAG,EAC7B,WAAW,IAAI,OAAO,EACtB,mBAAmB,IAAI,OAAO,GAE/B,MAAM,aAAa,CAAA;AAmBpB;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,qBAAsB,SAAQ,SAAS;IAIlD,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAiC;QACzE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAEhB,2EAA2E;QAC3E,2BAA2B;QAC3B,2EAA2E;QAE3E,MAAM,UAAU,GACd,KAAK,CAAC,UAAU;YAChB,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE;gBAC1C,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;QAEJ,2EAA2E;QAC3E,kBAAkB;QAClB,2EAA2E;QAE3E,MAAM,WAAW,GACf,KAAK,CAAC,WAAW;YACjB,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC;aAC1D,CAAC,CAAA;QAEJ,2EAA2E;QAC3E,0BAA0B;QAC1B,2EAA2E;QAE3E,wEAAwE;QACxE,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QAEnF,qEAAqE;QACrE,mEAAmE;QACnE,wEAAwE;QACxE,mEAAmE;QACnE,6DAA6D;QAC7D,qEAAqE;QACrE,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,uEAAuE;QACvE,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC,gBAAgB,CAAA;QAE7D,iCAAiC;QACjC,MAAM,iBAAiB,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,mBAAmB,EAAE;YAC9E,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAC1B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAC1B,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACrD,mBAAmB,EAAE,UAAU,CAAC,wBAAwB,CAAC,IAAI,EAAE;YAC/D,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE;SACtD,CAAC,CAAA;QAEF,0EAA0E;QAC1E,2EAA2E;QAC3E,mEAAmE;QACnE,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,iEAAiE;QACjE,sBAAsB;QACtB,MAAM,qBAAqB,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,EAAE;YACnF,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,UAAU,CACtC;gBACE,2BAA2B;gBAC3B,gCAAgC;gBAChC,gFAAgF;gBAChF,mBAAmB;gBACnB,GAAG;aACJ,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;SACF,CAAC,CAAA;QAEF,IAAI,CAAC,YAAY,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE;YACpE,WAAW,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;YAC/B,WAAW;YACX,eAAe,EAAE;gBACf,MAAM;gBACN,WAAW,EAAE,aAAa;gBAC1B,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,CAAC,iBAAiB;gBACvE,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,SAAS;gBACnD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB,CAAC,6BAA6B;gBACjF,oBAAoB,EAAE;oBACpB;wBACE,QAAQ,EAAE,qBAAqB;wBAC/B,SAAS,EAAE,UAAU,CAAC,iBAAiB,CAAC,cAAc;qBACvD;iBACF;aACF;YACD,mBAAmB,EAAE;gBACnB,iBAAiB,EAAE;oBACjB,MAAM;oBACN,WAAW,EAAE,iBAAiB;oBAC9B,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,CAAC,iBAAiB;iBACxE;aACF;SACF,CAAC,CAAA;QAEF,2EAA2E;QAC3E,cAAc;QACd,2EAA2E;QAE3E,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE;YACnC,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;SACxF,CAAC,CAAA;QAEF,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE;YACzC,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;SACxF,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/constructs/cms-service.d.ts

@@ -1,5 +1,6 @@
 import { Construct } from 'constructs';
-import { Duration, RemovalPolicy, aws_ec2 as ec2, aws_efs as efs, aws_lambda as lambda, aws_autoscaling as autoscaling } from 'aws-cdk-lib';
+import { Duration, RemovalPolicy, aws_ec2 as ec2, aws_efs as efs, aws_lambda as lambda, aws_autoscaling as autoscaling, aws_logs as logs } from 'aws-cdk-lib';
+import type { IBucket } from 'aws-cdk-lib/aws-s3';
 export interface CanopyCmsServiceProps {
     /** Docker image for the CMS Lambda function */
     cmsDockerImage: lambda.DockerImageCode;
@@ -11,6 +12,14 @@ export interface CanopyCmsServiceProps {
     timeout?: Duration;
     /** Lambda reserved concurrency cap (default: 10) */
     reservedConcurrency?: number;
+    /**
+     * Lambda architecture (default: `Architecture.X86_64`, Lambda's own
+     * default). MUST match the platform the Docker image was built for - e.g.
+     * an image built for `Platform.LINUX_ARM64` requires
+     * `Architecture.ARM_64` here, or the function fails at invoke time with
+     * an exec format error.
+     */
+    architecture?: lambda.Architecture;
     /** EC2 spot max price (default: on-demand rate for t4g.nano) */
     spotMaxPrice?: string;
     /** Secrets Manager ARNs the worker needs to read (GitHub token, Clerk key) */
@@ -29,6 +38,27 @@ export interface CanopyCmsServiceProps {
     clerkSecretKeySecretArn?: string;
     /** Base branch name (default: 'main') */
     baseBranch?: string;
+    /**
+     * The asset bucket (from `AssetSupport`, or any bucket following its
+     * prefix layout) the CMS Lambda's role should be granted access to. When
+     * provided, grants the exact prefix-scoped put/get/delete permissions
+     * `S3AssetStore` calls for (packages/canopycms/src/assets/store-s3.ts) -
+     * mirrors `AssetSupport.grantUploadAccess()` rather than depending on that
+     * construct directly, so `canopycms-cdk`'s two constructs stay decoupled.
+     */
+    assetBucket?: IBucket;
+    /**
+     * Retention for the EC2 worker's CloudWatch log group (default: three
+     * months). Worker-only: the Lambdas keep their auto-created log groups.
+     */
+    workerLogRetention?: logs.RetentionDays;
+    /**
+     * Name for the worker's CloudWatch log group (default:
+     * `/canopycms/<stackName>/worker`). Override to follow an org naming
+     * convention, or when instantiating this construct twice in one stack (the
+     * default name would collide).
+     */
+    workerLogGroupName?: string;
 }
 /**
  * Core CDK construct for CanopyCMS deployment.
@@ -39,8 +69,11 @@ export interface CanopyCmsServiceProps {
  * - Lambda function (Docker image, EFS mount, private subnet, no internet)
  * - Lambda Function URL (for CloudFront origin)
  * - EC2 Worker (t4g.nano spot in ASG, public subnet, EFS mount, systemd)
+ * - Dedicated CloudWatch log group for the worker's stdout/stderr, shipped
+ *   via the amazon-cloudwatch-agent (journald is not agent-readable)
  * - Security groups (least-privilege)
- * - IAM roles (Lambda: EFS only; EC2: EFS + Secrets Manager)
+ * - IAM roles (Lambda: EFS only; EC2: EFS + Secrets Manager + CloudWatch
+ *   Logs write, scoped to its own log group)
  */
 export declare class CanopyCmsService extends Construct {
     /** Lambda Function URL — use as CloudFront origin */
@@ -53,6 +86,8 @@ export declare class CanopyCmsService extends Construct {
     readonly lambdaFunction: lambda.Function;
     /** The EC2 worker Auto Scaling Group */
     readonly workerAsg: autoscaling.AutoScalingGroup;
+    /** The EC2 worker's CloudWatch log group (worker stdout/stderr) */
+    readonly workerLogGroup: logs.LogGroup;
     constructor(scope: Construct, id: string, props: CanopyCmsServiceProps);
 }
 //# sourceMappingURL=cms-service.d.ts.map

package/dist/constructs/cms-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cms-service.d.ts","sourceRoot":"","sources":["../../src/constructs/cms-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EACL,QAAQ,EACR,aAAa,EACb,OAAO,IAAI,GAAG,EACd,OAAO,IAAI,GAAG,EAEd,UAAU,IAAI,MAAM,EACpB,eAAe,IAAI,WAAW,EAE/B,MAAM,aAAa,CAAA;AAEpB,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAC,eAAe,CAAA;IAEtC,4DAA4D;IAC5D,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAA;IAEd,0CAA0C;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,QAAQ,CAAA;IAElB,oDAAoD;IACpD,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAE5B,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IAEtB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEpC,2CAA2C;IAC3C,gBAAgB,CAAC,EAAE,aAAa,CAAA;IAEhC,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAA;IAEnB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAElB,mDAAmD;IACnD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B,mDAAmD;IACnD,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAEhC,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAiB,SAAQ,SAAS;IAC7C,qDAAqD;IACrD,SAAgB,WAAW,EAAE,MAAM,CAAC,WAAW,CAAA;IAE/C,yBAAyB;IACzB,SAAgB,UAAU,EAAE,GAAG,CAAC,UAAU,CAAA;IAE1C,cAAc;IACd,SAAgB,GAAG,EAAE,GAAG,CAAC,IAAI,CAAA;IAE7B,0BAA0B;IAC1B,SAAgB,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAA;IAE/C,wCAAwC;IACxC,SAAgB,SAAS,EAAE,WAAW,CAAC,gBAAgB,CAAA;gBAE3C,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB;CAwPvE"}
+{"version":3,"file":"cms-service.d.ts","sourceRoot":"","sources":["../../src/constructs/cms-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EACL,QAAQ,EACR,aAAa,EAEb,OAAO,IAAI,GAAG,EACd,OAAO,IAAI,GAAG,EAEd,UAAU,IAAI,MAAM,EACpB,eAAe,IAAI,WAAW,EAE9B,QAAQ,IAAI,IAAI,EACjB,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAWjD,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAC,eAAe,CAAA;IAEtC,4DAA4D;IAC5D,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAA;IAEd,0CAA0C;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,QAAQ,CAAA;IAElB,oDAAoD;IACpD,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAE5B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,YAAY,CAAA;IAElC,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IAEtB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEpC,2CAA2C;IAC3C,gBAAgB,CAAC,EAAE,aAAa,CAAA;IAEhC,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAA;IAEnB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAElB,mDAAmD;IACnD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B,mDAAmD;IACnD,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAEhC,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,IAAI,CAAC,aAAa,CAAA;IAEvC;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gBAAiB,SAAQ,SAAS;IAC7C,qDAAqD;IACrD,SAAgB,WAAW,EAAE,MAAM,CAAC,WAAW,CAAA;IAE/C,yBAAyB;IACzB,SAAgB,UAAU,EAAE,GAAG,CAAC,UAAU,CAAA;IAE1C,cAAc;IACd,SAAgB,GAAG,EAAE,GAAG,CAAC,IAAI,CAAA;IAE7B,0BAA0B;IAC1B,SAAgB,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAA;IAE/C,wCAAwC;IACxC,SAAgB,SAAS,EAAE,WAAW,CAAC,gBAAgB,CAAA;IAEvD,mEAAmE;IACnE,SAAgB,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAA;gBAEjC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB;CAgbvE"}