canopycms-cdk 0.0.58 → 0.0.60

package/dist/constructs/asset-support.d.ts

@@ -61,18 +61,24 @@ export interface AssetSupportProps {
  * ```ts
  * const behaviors = assetSupport.assetBehaviors()
  *
- * // Building a new distribution:
+ * // Building a new distribution. CloudFront matches path patterns in the
+ * // order they're listed and stops at the first match, so the more
+ * // specific '/assets/t/*' MUST come before '/assets/*' - otherwise the
+ * // broader S3-only pattern swallows transform requests first and they
+ * // 403 with no Lambda fallback.
  * new cloudfront.Distribution(this, 'Dist', {
  *   defaultBehavior: ...,
  *   additionalBehaviors: {
- *     '/assets/*': behaviors.assets,
  *     '/assets/t/*': behaviors.assetsTransform,
+ *     '/assets/*': behaviors.assets,
  *   },
  * })
  *
- * // Adding to an existing distribution:
- * distribution.addBehavior('/assets/*', behaviors.assets.origin, behaviors.assets)
+ * // Adding to an existing distribution: the same first-match-wins ordering
+ * // applies to the resulting CacheBehaviors list, so call addBehavior for
+ * // '/assets/t/*' before '/assets/*' here too.
  * distribution.addBehavior('/assets/t/*', behaviors.assetsTransform.origin, behaviors.assetsTransform)
+ * distribution.addBehavior('/assets/*', behaviors.assets.origin, behaviors.assets)
  * ```
  */
 export interface AssetCloudFrontBehaviors {

package/dist/constructs/asset-support.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"asset-support.d.ts","sourceRoot":"","sources":["../../src/constructs/asset-support.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EAEL,aAAa,EACb,cAAc,IAAI,UAAU,EAE5B,OAAO,IAAI,GAAG,EACd,UAAU,IAAI,MAAM,EACpB,MAAM,IAAI,EAAE,EACb,MAAM,aAAa,CAAA;AAwDpB,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAA;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,CAAA;IAEhC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAEhC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAE5B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAA;IAEtC;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,eAAe,CAAA;IAE3C;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC,eAAe,CAAA;CACrD;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,YAAa,SAAQ,SAAS;IACzC,0EAA0E;IAC1E,SAAgB,MAAM,EAAE,EAAE,CAAC,OAAO,CAAA;IAElC,qCAAqC;IACrC,SAAgB,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAA;IAElD,iGAAiG;IACjG,SAAgB,oBAAoB,EAAE,MAAM,CAAC,WAAW,CAAA;IAExD,mFAAmF;IACnF,SAAgB,cAAc,EAAE,MAAM,CAAA;IAEtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;gBAExC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB;IA6ElE,OAAO,CAAC,cAAc;IA+CtB,uIAAuI;IAChI,cAAc,IAAI,wBAAwB;IAIjD;;;;;;;;;OASG;IACI,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,GAAG,IAAI;CAexD"}
+{"version":3,"file":"asset-support.d.ts","sourceRoot":"","sources":["../../src/constructs/asset-support.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EAEL,aAAa,EACb,cAAc,IAAI,UAAU,EAE5B,OAAO,IAAI,GAAG,EACd,UAAU,IAAI,MAAM,EACpB,MAAM,IAAI,EAAE,EACb,MAAM,aAAa,CAAA;AAwDpB,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAA;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,CAAA;IAEhC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAEhC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAE5B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAA;IAEtC;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,eAAe,CAAA;IAE3C;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC,eAAe,CAAA;CACrD;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,YAAa,SAAQ,SAAS;IACzC,0EAA0E;IAC1E,SAAgB,MAAM,EAAE,EAAE,CAAC,OAAO,CAAA;IAElC,qCAAqC;IACrC,SAAgB,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAA;IAElD,iGAAiG;IACjG,SAAgB,oBAAoB,EAAE,MAAM,CAAC,WAAW,CAAA;IAExD,mFAAmF;IACnF,SAAgB,cAAc,EAAE,MAAM,CAAA;IAEtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;gBAExC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB;IAgFlE,OAAO,CAAC,cAAc;IA+CtB,uIAAuI;IAChI,cAAc,IAAI,wBAAwB;IAIjD;;;;;;;;;OASG;IACI,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,GAAG,IAAI;CAexD"}

package/dist/constructs/asset-support.js

@@ -109,7 +109,10 @@ export class AssetSupport extends Construct {
             // this construct's class doc comment).
             code: lambda.Code.fromAsset(path.join(__dirname, '..', '..', 'lambda', 'asset-transform', 'dist')),
             handler: 'handler.handler',
-            runtime: lambda.Runtime.NODEJS_20_X,
+            // nodejs20.x was deprecated 2026-04-30; CDK's CloudFormation validation
+            // now fails synth on it. The esbuild bundle targets node20 and runs
+            // unchanged on the node22 runtime.
+            runtime: lambda.Runtime.NODEJS_22_X,
             architecture: lambda.Architecture.ARM_64,
             memorySize: TRANSFORM_LAMBDA_MEMORY_MB,
             timeout: TRANSFORM_LAMBDA_TIMEOUT,

package/dist/constructs/asset-support.js.map

@@ -1 +1 @@
-{"version":3,"file":"asset-support.js","sourceRoot":"","sources":["../../src/constructs/asset-support.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EACL,QAAQ,EACR,aAAa,EACb,cAAc,IAAI,UAAU,EAC5B,sBAAsB,IAAI,OAAO,EAEjC,UAAU,IAAI,MAAM,EACpB,MAAM,IAAI,EAAE,GACb,MAAM,aAAa,CAAA;AAEpB,wEAAwE;AACxE,yEAAyE;AACzE,8EAA8E;AAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAE9D;;;;;;;;;;;;GAYG;AACH,MAAM,QAAQ,GAAG;IACf,SAAS,EAAE,iBAAiB;IAC5B,OAAO,EAAE,eAAe;IACxB,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,UAAU;CACb,CAAA;AAEV,mFAAmF;AACnF,MAAM,oBAAoB,GAAG,IAAI,CAAA;AAEjC,sFAAsF;AACtF,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEjD,MAAM,0BAA0B,GAAG,IAAI,CAAA;AACvC,MAAM,wBAAwB,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAErD;;;;;;;;;;;;;;GAcG;AACH,MAAM,uBAAuB,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AACnD,MAAM,2BAA2B,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACpD,MAAM,uBAAuB,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAuGlD;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,YAAa,SAAQ,SAAS;IAezC,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAwB;QAChE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAEhB,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,wBAAwB,CAAA;QAEtE,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;QAC5B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE;gBAC1C,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS;gBACjD,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,UAAU;gBAC1C,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK;gBACnC,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM;gBAC1D,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,KAAK;gBACnD,kEAAkE;gBAClE,6DAA6D;gBAC7D,0DAA0D;gBAC1D,cAAc,EAAE;oBACd;wBACE,EAAE,EAAE,sBAAsB;wBAC1B,OAAO,EAAE,IAAI;wBACb,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,GAAG;wBAC9B,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;qBAC7B;iBACF;gBACD,IAAI,EAAE;oBACJ;wBACE,EAAE,EAAE,yBAAyB;wBAC7B,cAAc,EAAE,KAAK,CAAC,aAAa;wBACnC,cAAc,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC;wBAC7E,cAAc,EAAE,CAAC,GAAG,CAAC;wBACrB,MAAM,EAAE,oBAAoB;qBAC7B;iBACF;aACF,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,iBAAiB,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,EAAE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,oEAAoE;YACpE,oEAAoE;YACpE,uCAAuC;YACvC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CACzB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,CAAC,CACtE;YACD,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;YACnC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM;YACxC,UAAU,EAAE,0BAA0B;YACtC,OAAO,EAAE,wBAAwB;YACjC,WAAW,EAAE;gBACX,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACrC;SACF,CAAC,CAAA;QAEF,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;QACxE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QACnE,+DAA+D;QAC/D,+DAA+D;QAC/D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;QAEpE,wEAAwE;QACxE,sEAAsE;QACtE,oEAAoE;QACpE,gDAAgD;QAChD,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC;YAChE,QAAQ,EAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO;SAC7C,CAAC,CAAA;QAEF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,cAAc,EAAE,CAAA;IACxC,CAAC;IAEO,cAAc;QACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5E,MAAM,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,uBAAuB,CAC7E,IAAI,CAAC,oBAAoB,CAC1B,CAAA;QAED,MAAM,MAAM,GAA+B;YACzC,MAAM,EAAE,QAAQ;YAChB,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,CAAC,iBAAiB;YACvE,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,iBAAiB;YACrD,QAAQ,EAAE,IAAI;SACf,CAAA;QAED,yEAAyE;QACzE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,gCAAgC;QAChC,MAAM,oBAAoB,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,4BAA4B,EAAE;YAC1F,MAAM,EAAE,uBAAuB;YAC/B,UAAU,EAAE,2BAA2B;YACvC,MAAM,EAAE,uBAAuB;YAC/B,wBAAwB,EAAE,IAAI;YAC9B,0BAA0B,EAAE,IAAI;YAChC,mBAAmB,EAAE,UAAU,CAAC,wBAAwB,CAAC,IAAI,EAAE;YAC/D,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACrD,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE;SACtD,CAAC,CAAA;QAEF,MAAM,eAAe,GAA+B;YAClD,MAAM,EAAE,IAAI,OAAO,CAAC,WAAW,CAAC;gBAC9B,aAAa,EAAE,QAAQ;gBACvB,cAAc,EAAE,qBAAqB;gBACrC,+DAA+D;gBAC/D,+DAA+D;gBAC/D,4DAA4D;gBAC5D,gEAAgE;gBAChE,gEAAgE;gBAChE,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;aAChC,CAAC;YACF,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,CAAC,iBAAiB;YACvE,WAAW,EAAE,oBAAoB;SAClC,CAAA;QAED,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IACpC,CAAC;IAED,uIAAuI;IAChI,cAAc;QACnB,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED;;;;;;;;;OASG;IACI,iBAAiB,CAAC,OAAuB;QAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;QAEtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;QACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;QACzD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;QAEtD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;QACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;QAErD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;QACzD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;IACxD,CAAC;CACF"}
+{"version":3,"file":"asset-support.js","sourceRoot":"","sources":["../../src/constructs/asset-support.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EACL,QAAQ,EACR,aAAa,EACb,cAAc,IAAI,UAAU,EAC5B,sBAAsB,IAAI,OAAO,EAEjC,UAAU,IAAI,MAAM,EACpB,MAAM,IAAI,EAAE,GACb,MAAM,aAAa,CAAA;AAEpB,wEAAwE;AACxE,yEAAyE;AACzE,8EAA8E;AAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAE9D;;;;;;;;;;;;GAYG;AACH,MAAM,QAAQ,GAAG;IACf,SAAS,EAAE,iBAAiB;IAC5B,OAAO,EAAE,eAAe;IACxB,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,UAAU;CACb,CAAA;AAEV,mFAAmF;AACnF,MAAM,oBAAoB,GAAG,IAAI,CAAA;AAEjC,sFAAsF;AACtF,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEjD,MAAM,0BAA0B,GAAG,IAAI,CAAA;AACvC,MAAM,wBAAwB,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAErD;;;;;;;;;;;;;;GAcG;AACH,MAAM,uBAAuB,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AACnD,MAAM,2BAA2B,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACpD,MAAM,uBAAuB,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AA6GlD;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,YAAa,SAAQ,SAAS;IAezC,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAwB;QAChE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAEhB,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,wBAAwB,CAAA;QAEtE,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;QAC5B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE;gBAC1C,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS;gBACjD,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,UAAU;gBAC1C,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK;gBACnC,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM;gBAC1D,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,KAAK;gBACnD,kEAAkE;gBAClE,6DAA6D;gBAC7D,0DAA0D;gBAC1D,cAAc,EAAE;oBACd;wBACE,EAAE,EAAE,sBAAsB;wBAC1B,OAAO,EAAE,IAAI;wBACb,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,GAAG;wBAC9B,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;qBAC7B;iBACF;gBACD,IAAI,EAAE;oBACJ;wBACE,EAAE,EAAE,yBAAyB;wBAC7B,cAAc,EAAE,KAAK,CAAC,aAAa;wBACnC,cAAc,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC;wBAC7E,cAAc,EAAE,CAAC,GAAG,CAAC;wBACrB,MAAM,EAAE,oBAAoB;qBAC7B;iBACF;aACF,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,iBAAiB,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,EAAE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,oEAAoE;YACpE,oEAAoE;YACpE,uCAAuC;YACvC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CACzB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,CAAC,CACtE;YACD,OAAO,EAAE,iBAAiB;YAC1B,wEAAwE;YACxE,oEAAoE;YACpE,mCAAmC;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;YACnC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM;YACxC,UAAU,EAAE,0BAA0B;YACtC,OAAO,EAAE,wBAAwB;YACjC,WAAW,EAAE;gBACX,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACrC;SACF,CAAC,CAAA;QAEF,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;QACxE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QACnE,+DAA+D;QAC/D,+DAA+D;QAC/D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;QAEpE,wEAAwE;QACxE,sEAAsE;QACtE,oEAAoE;QACpE,gDAAgD;QAChD,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC;YAChE,QAAQ,EAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO;SAC7C,CAAC,CAAA;QAEF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,cAAc,EAAE,CAAA;IACxC,CAAC;IAEO,cAAc;QACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5E,MAAM,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,uBAAuB,CAC7E,IAAI,CAAC,oBAAoB,CAC1B,CAAA;QAED,MAAM,MAAM,GAA+B;YACzC,MAAM,EAAE,QAAQ;YAChB,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,CAAC,iBAAiB;YACvE,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,iBAAiB;YACrD,QAAQ,EAAE,IAAI;SACf,CAAA;QAED,yEAAyE;QACzE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,gCAAgC;QAChC,MAAM,oBAAoB,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,4BAA4B,EAAE;YAC1F,MAAM,EAAE,uBAAuB;YAC/B,UAAU,EAAE,2BAA2B;YACvC,MAAM,EAAE,uBAAuB;YAC/B,wBAAwB,EAAE,IAAI;YAC9B,0BAA0B,EAAE,IAAI;YAChC,mBAAmB,EAAE,UAAU,CAAC,wBAAwB,CAAC,IAAI,EAAE;YAC/D,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACrD,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE;SACtD,CAAC,CAAA;QAEF,MAAM,eAAe,GAA+B;YAClD,MAAM,EAAE,IAAI,OAAO,CAAC,WAAW,CAAC;gBAC9B,aAAa,EAAE,QAAQ;gBACvB,cAAc,EAAE,qBAAqB;gBACrC,+DAA+D;gBAC/D,+DAA+D;gBAC/D,4DAA4D;gBAC5D,gEAAgE;gBAChE,gEAAgE;gBAChE,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;aAChC,CAAC;YACF,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,CAAC,iBAAiB;YACvE,WAAW,EAAE,oBAAoB;SAClC,CAAA;QAED,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IACpC,CAAC;IAED,uIAAuI;IAChI,cAAc;QACnB,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED;;;;;;;;;OASG;IACI,iBAAiB,CAAC,OAAuB;QAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;QAEtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;QACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;QACzD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;QAEtD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;QACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;QAErD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;QACzD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;IACxD,CAAC;CACF"}

package/dist/constructs/cms-distribution.d.ts

@@ -24,6 +24,8 @@ export interface CanopyCmsDistributionProps {
  * - CloudFront distribution with Function URL origin
  * - Route53 A/AAAA alias records
  * - Cache policies: no-cache for /api/* and /edit*, cache /_next/static/*
+ * - Viewer-request CloudFront Function setting x-forwarded-host (redirect-URL
+ *   derivation behind the Host-stripping OAC origin)
  */
 export declare class CanopyCmsDistribution extends Construct {
     /** The CloudFront distribution */

package/dist/constructs/cms-distribution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cms-distribution.d.ts","sourceRoot":"","sources":["../../src/constructs/cms-distribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EAEL,cAAc,IAAI,UAAU,EAE5B,sBAAsB,IAAI,GAAG,EAC7B,WAAW,IAAI,OAAO,EAEtB,UAAU,IAAI,MAAM,EACrB,MAAM,aAAa,CAAA;AAEpB,MAAM,WAAW,0BAA0B;IACzC,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAC,WAAW,CAAA;IAE/B,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAA;IAElB,uDAAuD;IACvD,gBAAgB,EAAE,MAAM,CAAA;IAExB,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,CAAC,WAAW,CAAA;IAEhC,4EAA4E;IAC5E,WAAW,CAAC,EAAE,GAAG,CAAC,YAAY,CAAA;CAC/B;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,qBAAsB,SAAQ,SAAS;IAClD,kCAAkC;IAClC,SAAgB,YAAY,EAAE,UAAU,CAAC,YAAY,CAAA;gBAEzC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B;CA4F5E"}
+{"version":3,"file":"cms-distribution.d.ts","sourceRoot":"","sources":["../../src/constructs/cms-distribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EAEL,cAAc,IAAI,UAAU,EAE5B,sBAAsB,IAAI,GAAG,EAC7B,WAAW,IAAI,OAAO,EAEtB,UAAU,IAAI,MAAM,EACrB,MAAM,aAAa,CAAA;AAEpB,MAAM,WAAW,0BAA0B;IACzC,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAC,WAAW,CAAA;IAE/B,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAA;IAElB,uDAAuD;IACvD,gBAAgB,EAAE,MAAM,CAAA;IAExB,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,CAAC,WAAW,CAAA;IAEhC,4EAA4E;IAC5E,WAAW,CAAC,EAAE,GAAG,CAAC,YAAY,CAAA;CAC/B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,qBAAsB,SAAQ,SAAS;IAClD,kCAAkC;IAClC,SAAgB,YAAY,EAAE,UAAU,CAAC,YAAY,CAAA;gBAEzC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B;CAyH5E"}

package/dist/constructs/cms-distribution.js

@@ -12,6 +12,8 @@ import { Duration, aws_cloudfront as cloudfront, aws_cloudfront_origins as origi
  * - CloudFront distribution with Function URL origin
  * - Route53 A/AAAA alias records
  * - Cache policies: no-cache for /api/* and /edit*, cache /_next/static/*
+ * - Viewer-request CloudFront Function setting x-forwarded-host (redirect-URL
+ *   derivation behind the Host-stripping OAC origin)
  */
 export class CanopyCmsDistribution extends Construct {
     constructor(scope, id, props) {
@@ -40,19 +42,19 @@ export class CanopyCmsDistribution extends Construct {
         // the Function URL are rejected (DEP-H2). withOriginAccessControl creates
         // the OAC and grants CloudFront lambda:InvokeFunctionUrl automatically.
         const origin = origins.FunctionUrlOrigin.withOriginAccessControl(props.functionUrl);
-        // Cache policy for API/editor routes: no caching, forward all headers
-        const noCachePolicy = new cloudfront.CachePolicy(this, 'NoCachePolicy', {
-            cachePolicyName: `${id}-no-cache`,
-            defaultTtl: Duration.seconds(0),
-            maxTtl: Duration.seconds(0),
-            minTtl: Duration.seconds(0),
-            headerBehavior: cloudfront.CacheHeaderBehavior.allowList('Authorization', 'Cookie', 'Host'),
-            queryStringBehavior: cloudfront.CacheQueryStringBehavior.all(),
-            cookieBehavior: cloudfront.CacheCookieBehavior.all(),
-        });
+        // Cache policy for API/editor routes: AWS's managed CACHING_DISABLED
+        // policy. Deploy-proven (deploy-test epic, 2026-07-23): CloudFront
+        // rejects ANY non-none cache-key setting on a caching-disabled policy -
+        // Authorization in a header allowlist (aws/aws-cdk#16977) but also
+        // cookieBehavior/queryStringBehavior `all()` ("The parameter
+        // CookieBehavior is invalid for policy with caching disabled"). With
+        // TTL 0 the cache key is meaningless anyway; the origin still receives
+        // the full viewer request (headers/cookies/query string, minus Host -
+        // forwarding Host would break the OAC-signed Function URL) via the
+        // ALL_VIEWER_EXCEPT_HOST_HEADER origin request policy on the behavior.
+        const noCachePolicy = cloudfront.CachePolicy.CACHING_DISABLED;
         // Cache policy for static assets
         const staticCachePolicy = new cloudfront.CachePolicy(this, 'StaticCachePolicy', {
-            cachePolicyName: `${id}-static`,
             defaultTtl: Duration.days(365),
             maxTtl: Duration.days(365),
             minTtl: Duration.days(365),
@@ -60,6 +62,26 @@ export class CanopyCmsDistribution extends Construct {
             queryStringBehavior: cloudfront.CacheQueryStringBehavior.none(),
             cookieBehavior: cloudfront.CacheCookieBehavior.none(),
         });
+        // CloudFront gives the origin the Function URL's own Host (forwarding the
+        // viewer Host would break the OAC SigV4 signature), and Lambda Web Adapter
+        // forwards no `x-forwarded-*` headers of its own - so without this
+        // function, Clerk/Next derive sign-in redirect URLs from the IAM-authed
+        // Function URL host instead of the public domain, and the redirect 403s
+        // (direct Function URL hits are rejected). Deploy-proven (deploy-test
+        // epic, 2026-07-23): x-forwarded-proto is on CloudFront Functions'
+        // DISALLOWED header list - setting it fails every request with 502
+        // FunctionValidationError. Only x-forwarded-host is set; proto is
+        // unambiguous anyway (viewer-facing CloudFront is HTTPS-only via
+        // REDIRECT_TO_HTTPS).
+        const forwardedHostFunction = new cloudfront.Function(this, 'ForwardedHostFunction', {
+            code: cloudfront.FunctionCode.fromInline([
+                'function handler(event) {',
+                '  var request = event.request;',
+                "  request.headers['x-forwarded-host'] = { value: request.headers.host.value };",
+                '  return request;',
+                '}',
+            ].join('\n')),
+        });
         this.distribution = new cloudfront.Distribution(this, 'Distribution', {
             domainNames: [props.domainName],
             certificate,
@@ -69,6 +91,12 @@ export class CanopyCmsDistribution extends Construct {
                 viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
                 allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
                 originRequestPolicy: cloudfront.OriginRequestPolicy.ALL_VIEWER_EXCEPT_HOST_HEADER,
+                functionAssociations: [
+                    {
+                        function: forwardedHostFunction,
+                        eventType: cloudfront.FunctionEventType.VIEWER_REQUEST,
+                    },
+                ],
             },
             additionalBehaviors: {
                 '/_next/static/*': {

package/dist/constructs/cms-distribution.js.map

@@ -1 +1 @@
-{"version":3,"file":"cms-distribution.js","sourceRoot":"","sources":["../../src/constructs/cms-distribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EACL,QAAQ,EACR,cAAc,IAAI,UAAU,EAC5B,sBAAsB,IAAI,OAAO,EACjC,sBAAsB,IAAI,GAAG,EAC7B,WAAW,IAAI,OAAO,EACtB,mBAAmB,IAAI,OAAO,GAE/B,MAAM,aAAa,CAAA;AAmBpB;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,qBAAsB,SAAQ,SAAS;IAIlD,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAiC;QACzE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAEhB,2EAA2E;QAC3E,2BAA2B;QAC3B,2EAA2E;QAE3E,MAAM,UAAU,GACd,KAAK,CAAC,UAAU;YAChB,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE;gBAC1C,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;QAEJ,2EAA2E;QAC3E,kBAAkB;QAClB,2EAA2E;QAE3E,MAAM,WAAW,GACf,KAAK,CAAC,WAAW;YACjB,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC;aAC1D,CAAC,CAAA;QAEJ,2EAA2E;QAC3E,0BAA0B;QAC1B,2EAA2E;QAE3E,wEAAwE;QACxE,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QAEnF,sEAAsE;QACtE,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,eAAe,EAAE;YACtE,eAAe,EAAE,GAAG,EAAE,WAAW;YACjC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/B,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3B,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3B,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,eAAe,EAAE,QAAQ,EAAE,MAAM,CAAC;YAC3F,mBAAmB,EAAE,UAAU,CAAC,wBAAwB,CAAC,GAAG,EAAE;YAC9D,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,GAAG,EAAE;SACrD,CAAC,CAAA;QAEF,iCAAiC;QACjC,MAAM,iBAAiB,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,mBAAmB,EAAE;YAC9E,eAAe,EAAE,GAAG,EAAE,SAAS;YAC/B,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAC1B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAC1B,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACrD,mBAAmB,EAAE,UAAU,CAAC,wBAAwB,CAAC,IAAI,EAAE;YAC/D,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE;SACtD,CAAC,CAAA;QAEF,IAAI,CAAC,YAAY,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE;YACpE,WAAW,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;YAC/B,WAAW;YACX,eAAe,EAAE;gBACf,MAAM;gBACN,WAAW,EAAE,aAAa;gBAC1B,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,CAAC,iBAAiB;gBACvE,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,SAAS;gBACnD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB,CAAC,6BAA6B;aAClF;YACD,mBAAmB,EAAE;gBACnB,iBAAiB,EAAE;oBACjB,MAAM;oBACN,WAAW,EAAE,iBAAiB;oBAC9B,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,CAAC,iBAAiB;iBACxE;aACF;SACF,CAAC,CAAA;QAEF,2EAA2E;QAC3E,cAAc;QACd,2EAA2E;QAE3E,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE;YACnC,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;SACxF,CAAC,CAAA;QAEF,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE;YACzC,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;SACxF,CAAC,CAAA;IACJ,CAAC;CACF"}
+{"version":3,"file":"cms-distribution.js","sourceRoot":"","sources":["../../src/constructs/cms-distribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EACL,QAAQ,EACR,cAAc,IAAI,UAAU,EAC5B,sBAAsB,IAAI,OAAO,EACjC,sBAAsB,IAAI,GAAG,EAC7B,WAAW,IAAI,OAAO,EACtB,mBAAmB,IAAI,OAAO,GAE/B,MAAM,aAAa,CAAA;AAmBpB;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,qBAAsB,SAAQ,SAAS;IAIlD,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAiC;QACzE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAEhB,2EAA2E;QAC3E,2BAA2B;QAC3B,2EAA2E;QAE3E,MAAM,UAAU,GACd,KAAK,CAAC,UAAU;YAChB,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE;gBAC1C,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;QAEJ,2EAA2E;QAC3E,kBAAkB;QAClB,2EAA2E;QAE3E,MAAM,WAAW,GACf,KAAK,CAAC,WAAW;YACjB,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC;aAC1D,CAAC,CAAA;QAEJ,2EAA2E;QAC3E,0BAA0B;QAC1B,2EAA2E;QAE3E,wEAAwE;QACxE,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QAEnF,qEAAqE;QACrE,mEAAmE;QACnE,wEAAwE;QACxE,mEAAmE;QACnE,6DAA6D;QAC7D,qEAAqE;QACrE,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,uEAAuE;QACvE,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC,gBAAgB,CAAA;QAE7D,iCAAiC;QACjC,MAAM,iBAAiB,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,mBAAmB,EAAE;YAC9E,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAC1B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAC1B,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACrD,mBAAmB,EAAE,UAAU,CAAC,wBAAwB,CAAC,IAAI,EAAE;YAC/D,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE;SACtD,CAAC,CAAA;QAEF,0EAA0E;QAC1E,2EAA2E;QAC3E,mEAAmE;QACnE,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,iEAAiE;QACjE,sBAAsB;QACtB,MAAM,qBAAqB,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,EAAE;YACnF,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,UAAU,CACtC;gBACE,2BAA2B;gBAC3B,gCAAgC;gBAChC,gFAAgF;gBAChF,mBAAmB;gBACnB,GAAG;aACJ,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;SACF,CAAC,CAAA;QAEF,IAAI,CAAC,YAAY,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE;YACpE,WAAW,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;YAC/B,WAAW;YACX,eAAe,EAAE;gBACf,MAAM;gBACN,WAAW,EAAE,aAAa;gBAC1B,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,CAAC,iBAAiB;gBACvE,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,SAAS;gBACnD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB,CAAC,6BAA6B;gBACjF,oBAAoB,EAAE;oBACpB;wBACE,QAAQ,EAAE,qBAAqB;wBAC/B,SAAS,EAAE,UAAU,CAAC,iBAAiB,CAAC,cAAc;qBACvD;iBACF;aACF;YACD,mBAAmB,EAAE;gBACnB,iBAAiB,EAAE;oBACjB,MAAM;oBACN,WAAW,EAAE,iBAAiB;oBAC9B,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,CAAC,iBAAiB;iBACxE;aACF;SACF,CAAC,CAAA;QAEF,2EAA2E;QAC3E,cAAc;QACd,2EAA2E;QAE3E,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE;YACnC,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;SACxF,CAAC,CAAA;QAEF,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE;YACzC,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;SACxF,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/constructs/cms-service.d.ts

@@ -1,5 +1,5 @@
 import { Construct } from 'constructs';
-import { Duration, RemovalPolicy, aws_ec2 as ec2, aws_efs as efs, aws_lambda as lambda, aws_autoscaling as autoscaling } from 'aws-cdk-lib';
+import { Duration, RemovalPolicy, aws_ec2 as ec2, aws_efs as efs, aws_lambda as lambda, aws_autoscaling as autoscaling, aws_logs as logs } from 'aws-cdk-lib';
 import type { IBucket } from 'aws-cdk-lib/aws-s3';
 export interface CanopyCmsServiceProps {
     /** Docker image for the CMS Lambda function */
@@ -12,6 +12,14 @@ export interface CanopyCmsServiceProps {
     timeout?: Duration;
     /** Lambda reserved concurrency cap (default: 10) */
     reservedConcurrency?: number;
+    /**
+     * Lambda architecture (default: `Architecture.X86_64`, Lambda's own
+     * default). MUST match the platform the Docker image was built for - e.g.
+     * an image built for `Platform.LINUX_ARM64` requires
+     * `Architecture.ARM_64` here, or the function fails at invoke time with
+     * an exec format error.
+     */
+    architecture?: lambda.Architecture;
     /** EC2 spot max price (default: on-demand rate for t4g.nano) */
     spotMaxPrice?: string;
     /** Secrets Manager ARNs the worker needs to read (GitHub token, Clerk key) */
@@ -39,6 +47,18 @@ export interface CanopyCmsServiceProps {
      * construct directly, so `canopycms-cdk`'s two constructs stay decoupled.
      */
     assetBucket?: IBucket;
+    /**
+     * Retention for the EC2 worker's CloudWatch log group (default: three
+     * months). Worker-only: the Lambdas keep their auto-created log groups.
+     */
+    workerLogRetention?: logs.RetentionDays;
+    /**
+     * Name for the worker's CloudWatch log group (default:
+     * `/canopycms/<stackName>/worker`). Override to follow an org naming
+     * convention, or when instantiating this construct twice in one stack (the
+     * default name would collide).
+     */
+    workerLogGroupName?: string;
 }
 /**
  * Core CDK construct for CanopyCMS deployment.
@@ -49,8 +69,11 @@ export interface CanopyCmsServiceProps {
  * - Lambda function (Docker image, EFS mount, private subnet, no internet)
  * - Lambda Function URL (for CloudFront origin)
  * - EC2 Worker (t4g.nano spot in ASG, public subnet, EFS mount, systemd)
+ * - Dedicated CloudWatch log group for the worker's stdout/stderr, shipped
+ *   via the amazon-cloudwatch-agent (journald is not agent-readable)
  * - Security groups (least-privilege)
- * - IAM roles (Lambda: EFS only; EC2: EFS + Secrets Manager)
+ * - IAM roles (Lambda: EFS only; EC2: EFS + Secrets Manager + CloudWatch
+ *   Logs write, scoped to its own log group)
  */
 export declare class CanopyCmsService extends Construct {
     /** Lambda Function URL — use as CloudFront origin */
@@ -63,6 +86,8 @@ export declare class CanopyCmsService extends Construct {
     readonly lambdaFunction: lambda.Function;
     /** The EC2 worker Auto Scaling Group */
     readonly workerAsg: autoscaling.AutoScalingGroup;
+    /** The EC2 worker's CloudWatch log group (worker stdout/stderr) */
+    readonly workerLogGroup: logs.LogGroup;
     constructor(scope: Construct, id: string, props: CanopyCmsServiceProps);
 }
 //# sourceMappingURL=cms-service.d.ts.map

package/dist/constructs/cms-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cms-service.d.ts","sourceRoot":"","sources":["../../src/constructs/cms-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EACL,QAAQ,EACR,aAAa,EACb,OAAO,IAAI,GAAG,EACd,OAAO,IAAI,GAAG,EAEd,UAAU,IAAI,MAAM,EACpB,eAAe,IAAI,WAAW,EAE/B,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAWjD,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAC,eAAe,CAAA;IAEtC,4DAA4D;IAC5D,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAA;IAEd,0CAA0C;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,QAAQ,CAAA;IAElB,oDAAoD;IACpD,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAE5B,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IAEtB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEpC,2CAA2C;IAC3C,gBAAgB,CAAC,EAAE,aAAa,CAAA;IAEhC,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAA;IAEnB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAElB,mDAAmD;IACnD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B,mDAAmD;IACnD,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAEhC,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAiB,SAAQ,SAAS;IAC7C,qDAAqD;IACrD,SAAgB,WAAW,EAAE,MAAM,CAAC,WAAW,CAAA;IAE/C,yBAAyB;IACzB,SAAgB,UAAU,EAAE,GAAG,CAAC,UAAU,CAAA;IAE1C,cAAc;IACd,SAAgB,GAAG,EAAE,GAAG,CAAC,IAAI,CAAA;IAE7B,0BAA0B;IAC1B,SAAgB,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAA;IAE/C,wCAAwC;IACxC,SAAgB,SAAS,EAAE,WAAW,CAAC,gBAAgB,CAAA;gBAE3C,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB;CAkTvE"}
+{"version":3,"file":"cms-service.d.ts","sourceRoot":"","sources":["../../src/constructs/cms-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EACL,QAAQ,EACR,aAAa,EAEb,OAAO,IAAI,GAAG,EACd,OAAO,IAAI,GAAG,EAEd,UAAU,IAAI,MAAM,EACpB,eAAe,IAAI,WAAW,EAE9B,QAAQ,IAAI,IAAI,EACjB,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAWjD,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAC,eAAe,CAAA;IAEtC,4DAA4D;IAC5D,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAA;IAEd,0CAA0C;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,QAAQ,CAAA;IAElB,oDAAoD;IACpD,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAE5B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,YAAY,CAAA;IAElC,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IAEtB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEpC,2CAA2C;IAC3C,gBAAgB,CAAC,EAAE,aAAa,CAAA;IAEhC,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAA;IAEnB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAElB,mDAAmD;IACnD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B,mDAAmD;IACnD,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAEhC,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,IAAI,CAAC,aAAa,CAAA;IAEvC;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gBAAiB,SAAQ,SAAS;IAC7C,qDAAqD;IACrD,SAAgB,WAAW,EAAE,MAAM,CAAC,WAAW,CAAA;IAE/C,yBAAyB;IACzB,SAAgB,UAAU,EAAE,GAAG,CAAC,UAAU,CAAA;IAE1C,cAAc;IACd,SAAgB,GAAG,EAAE,GAAG,CAAC,IAAI,CAAA;IAE7B,0BAA0B;IAC1B,SAAgB,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAA;IAE/C,wCAAwC;IACxC,SAAgB,SAAS,EAAE,WAAW,CAAC,gBAAgB,CAAA;IAEvD,mEAAmE;IACnE,SAAgB,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAA;gBAEjC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB;CAgbvE"}

package/dist/constructs/cms-service.js

@@ -1,7 +1,7 @@
 import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { Construct } from 'constructs';
-import { Duration, RemovalPolicy, aws_ec2 as ec2, aws_efs as efs, aws_iam as iam, aws_lambda as lambda, aws_autoscaling as autoscaling, aws_s3_assets as s3assets, } from 'aws-cdk-lib';
+import { Duration, RemovalPolicy, Stack, aws_ec2 as ec2, aws_efs as efs, aws_iam as iam, aws_lambda as lambda, aws_autoscaling as autoscaling, aws_s3_assets as s3assets, aws_logs as logs, } from 'aws-cdk-lib';
 // This package (`canopycms-cdk`) is `"type": "module"`, so its compiled
 // output is real ESM - `__dirname` is not a global there. Found while
 // fixing this construct's B1 deploy blocker below: the worker asset path a
@@ -19,8 +19,11 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
  * - Lambda function (Docker image, EFS mount, private subnet, no internet)
  * - Lambda Function URL (for CloudFront origin)
  * - EC2 Worker (t4g.nano spot in ASG, public subnet, EFS mount, systemd)
+ * - Dedicated CloudWatch log group for the worker's stdout/stderr, shipped
+ *   via the amazon-cloudwatch-agent (journald is not agent-readable)
  * - Security groups (least-privilege)
- * - IAM roles (Lambda: EFS only; EC2: EFS + Secrets Manager)
+ * - IAM roles (Lambda: EFS only; EC2: EFS + Secrets Manager + CloudWatch
+ *   Logs write, scoped to its own log group)
  */
 export class CanopyCmsService extends Construct {
     constructor(scope, id, props) {
@@ -119,13 +122,26 @@ export class CanopyCmsService extends Construct {
             memorySize: props.memorySize ?? 2048,
             timeout: props.timeout ?? Duration.seconds(60),
             reservedConcurrentExecutions: props.reservedConcurrency ?? 10,
+            architecture: props.architecture,
             vpc: this.vpc,
             vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
             securityGroups: [lambdaSg],
             filesystem: lambda.FileSystem.fromEfsAccessPoint(accessPoint, '/mnt/efs'),
             environment: {
-                CANOPYCMS_WORKSPACE_ROOT: '/mnt/efs/workspace',
-                CANOPY_AUTH_CACHE_PATH: '/mnt/efs/workspace/.cache',
+                // INVARIANT (B1): the Lambda mounts EFS through the WorkspaceAP access
+                // point above, which is already rooted at EFS:/workspace - so /mnt/efs
+                // here IS EFS:/workspace. The EC2 worker instead mounts the filesystem
+                // ROOT at /mnt/efs (see UserData below) and reaches the same directory
+                // via /mnt/efs/workspace. Both paths must resolve to EFS:/workspace,
+                // or the Lambda and worker silently operate on different directories.
+                CANOPYCMS_WORKSPACE_ROOT: '/mnt/efs',
+                CANOPY_AUTH_CACHE_PATH: '/mnt/efs/.cache',
+                // B7 note: git >= 2.35.2 refuses repos owned by another uid (the
+                // access point forces uid 1000; Lambda containers run as a different
+                // user). Env-based GIT_CONFIG_* CANNOT fix this - simple-git
+                // hard-blocks env config (deploy-proven 2026-07-24). The fix lives in
+                // the image: Dockerfile.cms.template runs
+                // `git config --system safe.directory '*'`.
                 ...props.environment,
             },
         });
@@ -193,6 +209,20 @@ export class CanopyCmsService extends Construct {
         }
         // Worker needs EFS access (handled via security group, but mount needs ec2:DescribeAvailabilityZones)
         workerRole.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonElasticFileSystemClientReadWriteAccess'));
+        // Observation channel for a NAT-less deploy (SSM Session Manager / send-command);
+        // worker SG already allows 443 egress.
+        workerRole.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore'));
+        // Dedicated CloudWatch log group for the worker's stdout/stderr (shipped by
+        // the CloudWatch agent in user-data below - the agent cannot read journald,
+        // so the systemd unit is switched to file output further down).
+        this.workerLogGroup = new logs.LogGroup(this, 'WorkerLogs', {
+            logGroupName: props.workerLogGroupName ?? `/canopycms/${Stack.of(this).stackName}/worker`,
+            retention: props.workerLogRetention ?? logs.RetentionDays.THREE_MONTHS,
+            removalPolicy: RemovalPolicy.DESTROY,
+        });
+        // CreateLogStream + PutLogEvents scoped to this group only (least privilege;
+        // the group is pre-created by CFN so the agent never needs CreateLogGroup).
+        this.workerLogGroup.grantWrite(workerRole);
         // Worker S3 Asset — upload bundled worker code to CDK assets bucket
         // The worker is bundled with esbuild into a single JS file (npm run build:worker)
         const workerAsset = new s3assets.Asset(this, 'WorkerCode', {
@@ -205,6 +235,10 @@ export class CanopyCmsService extends Construct {
             `CANOPYCMS_GITHUB_OWNER=${props.githubOwner}`,
             `CANOPYCMS_GITHUB_REPO=${props.githubRepo}`,
             `CANOPYCMS_BASE_BRANCH=${props.baseBranch ?? 'main'}`,
+            // B8: the AWS SDK JS v3 cannot resolve a region from IMDS on its own -
+            // without this the worker's bare `SecretsManagerClient({})` crash-loops
+            // with "Region is missing".
+            `AWS_REGION=${Stack.of(this).region}`,
         ];
         if (props.githubTokenSecretArn) {
             envLines.push(`CANOPYCMS_GITHUB_TOKEN_SECRET_ARN=${props.githubTokenSecretArn}`);
@@ -215,25 +249,42 @@ export class CanopyCmsService extends Construct {
         const envFileContent = envLines.join('\n');
         // UserData script
         const userData = ec2.UserData.forLinux();
-        userData.addCommands('#!/bin/bash', 'set -euo pipefail', '', '# Install dependencies', 'yum install -y git', 'curl -fsSL https://rpm.nodesource.com/setup_20.x | bash -', 'yum install -y nodejs', '', '# Mount EFS', 'yum install -y amazon-efs-utils', 'mkdir -p /mnt/efs', `mount -t efs ${this.fileSystem.fileSystemId}:/ /mnt/efs`, '', '# Download worker from CDK S3 Asset', `aws s3 cp s3://${workerAsset.s3BucketName}/${workerAsset.s3ObjectKey} /tmp/canopy-worker.zip`, 'mkdir -p /opt/canopy-worker', 'cd /opt/canopy-worker', 'unzip -o /tmp/canopy-worker.zip', '', '# Write environment file for systemd service', `cat > /opt/canopy-worker/.env << 'ENVEOF'`, envFileContent, 'ENVEOF', '', '# Create systemd service', `cat > /etc/systemd/system/canopy-worker.service << 'SVCEOF'`, '[Unit]', 'Description=CanopyCMS Worker Daemon', 'After=network.target', '', '[Service]', 'Type=simple', 'User=ec2-user', 'WorkingDirectory=/opt/canopy-worker', 'ExecStart=/usr/bin/node index.js', 'Restart=always', 'RestartSec=5', 'TimeoutStartSec=300', 'StandardOutput=journal', 'StandardError=journal', 'EnvironmentFile=/opt/canopy-worker/.env', '', '[Install]', 'WantedBy=multi-user.target', 'SVCEOF', '', '# Set ownership for ec2-user', 'chown -R ec2-user:ec2-user /opt/canopy-worker', '# Non-recursive: EFS access point enforces UID 1000 for Lambda.', '# Only set ownership on mount point and workspace dir to avoid', '# slow recursive chown on large filesystems during ASG replacements.', 'chown ec2-user:ec2-user /mnt/efs', 'mkdir -p /mnt/efs/workspace', 'chown ec2-user:ec2-user /mnt/efs/workspace', '', '# Start worker', 'systemctl daemon-reload', 'systemctl enable canopy-worker', 'systemctl start canopy-worker');
-        // Auto Scaling Group
-        this.workerAsg = new autoscaling.AutoScalingGroup(this, 'WorkerAsg', {
-            vpc: this.vpc,
-            vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
+        userData.addCommands('#!/bin/bash', 'set -euo pipefail', '', '# Install dependencies (unzip is not guaranteed in the AL2023 AMI)', 'yum install -y git unzip', 'curl -fsSL https://rpm.nodesource.com/setup_20.x | bash -', 'yum install -y nodejs', '', '# Mount EFS', 'yum install -y amazon-efs-utils', 'mkdir -p /mnt/efs', `mount -t efs ${this.fileSystem.fileSystemId}:/ /mnt/efs`, '# Persist the mount across instance reboots: user-data runs once per', '# instance, so without an fstab entry a plain reboot leaves /mnt/efs an', '# empty local dir and the worker would clone a divergent remote.git', '# onto the instance disk, invisible to the Lambda.', `echo '${this.fileSystem.fileSystemId}:/ /mnt/efs efs _netdev 0 0' >> /etc/fstab`, '', '# Download worker from CDK S3 Asset', `aws s3 cp s3://${workerAsset.s3BucketName}/${workerAsset.s3ObjectKey} /tmp/canopy-worker.zip`, 'mkdir -p /opt/canopy-worker', 'cd /opt/canopy-worker', 'unzip -o /tmp/canopy-worker.zip', '# The worker bundle is ESM (esbuild --format=esm). Node 20 treats .js as', '# CommonJS without this marker and crash-loops on the import statement', '# (Node >=22.7 auto-detects and masks the bug locally).', `echo '{"type":"module"}' > /opt/canopy-worker/package.json`, '', '# Write environment file for systemd service', `cat > /opt/canopy-worker/.env << 'ENVEOF'`, envFileContent, 'ENVEOF', '', '# Create systemd service', `cat > /etc/systemd/system/canopy-worker.service << 'SVCEOF'`, '[Unit]', 'Description=CanopyCMS Worker Daemon', 'After=network.target', '# Never run against an unmounted /mnt/efs (see the fstab note above).', 'RequiresMountsFor=/mnt/efs', '', '[Service]', 'Type=simple', 'User=ec2-user', 'WorkingDirectory=/opt/canopy-worker', 'ExecStart=/usr/bin/node index.js', 'Restart=always', 'RestartSec=5', 'TimeoutStartSec=300', '# File output, not journal: the CloudWatch agent cannot read journald,', '# so it tails this file instead (see the agent config below).', '# CAUTION: /var/log/canopy-worker must exist BEFORE first start. systemd', '# opens append: targets before it creates LogsDirectory= dirs', '# (systemd#27591), so without the pre-created dir the exec fails with', '# 209/STDOUT and Restart=always crash-loops forever. User-data runs', '# mkdir before systemctl start; LogsDirectory= is kept for ownership.', 'LogsDirectory=canopy-worker', 'StandardOutput=append:/var/log/canopy-worker/worker.log', 'StandardError=append:/var/log/canopy-worker/worker.log', 'EnvironmentFile=/opt/canopy-worker/.env', '', '[Install]', 'WantedBy=multi-user.target', 'SVCEOF', '', '# Set ownership for ec2-user', 'chown -R ec2-user:ec2-user /opt/canopy-worker', '# Non-recursive: EFS access point enforces UID 1000 for Lambda.', '# Only set ownership on mount point and workspace dir to avoid', '# slow recursive chown on large filesystems during ASG replacements.', 'chown ec2-user:ec2-user /mnt/efs', 'mkdir -p /mnt/efs/workspace', 'chown ec2-user:ec2-user /mnt/efs/workspace', '', '# Pre-create the worker log dir (crash-loop guard, MUST precede the', '# first systemctl start): systemd opens StandardOutput=append: files', '# BEFORE it creates LogsDirectory= dirs (systemd#27591), so on a fresh', '# instance the unit would fail exec with 209/STDOUT and crash-loop', '# forever without this. The unit keeps LogsDirectory= for ownership', '# management on subsequent starts.', 'mkdir -p /var/log/canopy-worker', 'chown ec2-user:ec2-user /var/log/canopy-worker', '', '# Start worker', 'systemctl daemon-reload', 'systemctl enable canopy-worker', 'systemctl start canopy-worker', '', '# ---- CloudWatch log shipping ----', '# Placed AFTER worker start: with set -euo pipefail, a yum/agent failure', '# here must not prevent the worker from running (shipping is best-effort).', 'yum install -y amazon-cloudwatch-agent logrotate', '', '# Bound on-disk growth; copytruncate keeps the fd the CW agent tails valid', '# (tiny copy->truncate loss window is acceptable for diagnostic logs).', `cat > /etc/logrotate.d/canopy-worker << 'ROTEOF'`, '/var/log/canopy-worker/worker.log {', '    size 10M', '    rotate 5', '    compress', '    copytruncate', '    missingok', '    notifempty', '}', 'ROTEOF', '# The config above only fires when logrotate actually runs; AL2023', '# presets may leave logrotate.timer disabled, and without it the size', '# cap never triggers and worker.log grows until the nano disk fills.', '# --now is idempotent if the timer is already enabled/running.', 'systemctl enable --now logrotate.timer', '', '# No retention_in_days here: CDK owns retention on the pre-created group.', `cat > /opt/aws/amazon-cloudwatch-agent/etc/canopy-worker-logs.json << 'CWEOF'`, '{', '  "logs": {', '    "logs_collected": {', '      "files": {', '        "collect_list": [', '          {', '            "file_path": "/var/log/canopy-worker/worker.log",', `            "log_group_name": "${this.workerLogGroup.logGroupName}",`, '            "log_stream_name": "{instance_id}"', '          }', '        ]', '      }', '    }', '  }', '}', 'CWEOF', '# fetch-config -s starts AND systemctl-enables the agent (reboot-persistent).', '/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c file:/opt/aws/amazon-cloudwatch-agent/etc/canopy-worker-logs.json');
+        // Launch template (not the deprecated AutoScalingGroup instanceType/
+        // machineImage/... shorthand): that shorthand synthesizes an
+        // AWS::AutoScaling::LaunchConfiguration, which AWS accounts created after
+        // ~mid-2023 cannot create at all — `cdk deploy` would hard-fail for any
+        // fresh adopter account. An explicit LaunchTemplate synthesizes
+        // AWS::EC2::LaunchTemplate instead, which every account can use.
+        const launchTemplate = new ec2.LaunchTemplate(this, 'WorkerLaunchTemplate', {
             instanceType: ec2.InstanceType.of(ec2.InstanceClass.T4G, ec2.InstanceSize.NANO),
             machineImage: ec2.MachineImage.latestAmazonLinux2023({
                 cpuType: ec2.AmazonLinuxCpuType.ARM_64,
             }),
             role: workerRole,
             securityGroup: workerSg,
+            userData,
+            spotOptions: {
+                requestType: ec2.SpotRequestType.ONE_TIME, // required for ASG-managed spot
+                maxPrice: parseFloat(props.spotMaxPrice ?? '0.0042'), // On-demand rate for t4g.nano
+            },
+        });
+        // Auto Scaling Group
+        this.workerAsg = new autoscaling.AutoScalingGroup(this, 'WorkerAsg', {
+            vpc: this.vpc,
+            vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
+            launchTemplate,
             minCapacity: 1,
             maxCapacity: 1,
-            userData,
-            spotPrice: props.spotMaxPrice ?? '0.0042', // On-demand rate for t4g.nano
             healthCheck: autoscaling.HealthCheck.ec2({
                 grace: Duration.minutes(5),
             }),
         });
+        // Boot ordering: the ASG can launch before EFS mount targets are
+        // available; user-data runs with `set -euo pipefail`, so an early
+        // `mount -t efs` failure kills the whole bootstrap and the
+        // EC2-health-checked ASG never notices.
+        this.workerAsg.node.addDependency(this.fileSystem.mountTargetsAvailable);
     }
 }
 //# sourceMappingURL=cms-service.js.map

package/dist/constructs/cms-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"cms-service.js","sourceRoot":"","sources":["../../src/constructs/cms-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EACL,QAAQ,EACR,aAAa,EACb,OAAO,IAAI,GAAG,EACd,OAAO,IAAI,GAAG,EACd,OAAO,IAAI,GAAG,EACd,UAAU,IAAI,MAAM,EACpB,eAAe,IAAI,WAAW,EAC9B,aAAa,IAAI,QAAQ,GAC1B,MAAM,aAAa,CAAA;AAGpB,wEAAwE;AACxE,sEAAsE;AACtE,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,yEAAyE;AACzE,iEAAiE;AACjE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAwD9D;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gBAAiB,SAAQ,SAAS;IAgB7C,YAAY,KAAgB,EAAE,EAAU,EAAE,KAA4B;QACpE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAEhB,2EAA2E;QAC3E,gDAAgD;QAChD,2EAA2E;QAE3E,IAAI,CAAC,GAAG;YACN,KAAK,CAAC,GAAG;gBACT,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;oBACvB,MAAM,EAAE,CAAC;oBACT,WAAW,EAAE,CAAC,EAAE,yCAAyC;oBACzD,mBAAmB,EAAE;wBACnB;4BACE,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM;4BACjC,QAAQ,EAAE,EAAE;yBACb;wBACD;4BACE,IAAI,EAAE,SAAS;4BACf,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,gBAAgB;4BAC3C,QAAQ,EAAE,EAAE;yBACb;qBACF;iBACF,CAAC,CAAA;QAEJ,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,0EAA0E;QAC1E,yEAAyE;QACzE,+BAA+B;QAC/B,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,EAAE;YACxC,OAAO,EAAE,GAAG,CAAC,4BAA4B,CAAC,EAAE;SAC7C,CAAC,CAAA;QAEF,2EAA2E;QAC3E,4DAA4D;QAC5D,2EAA2E;QAE3E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE;YACjD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,eAAe;YAC5B,gBAAgB,EAAE,KAAK;SACxB,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE;YACvD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,SAAS,EAAE,IAAI;YACf,eAAe,EAAE,GAAG,CAAC,eAAe,CAAC,eAAe;YACpD,aAAa,EAAE,KAAK,CAAC,gBAAgB,IAAI,aAAa,CAAC,MAAM;YAC7D,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,gBAAgB,EAAE;YAC3D,aAAa,EAAE,KAAK;SACrB,CAAC,CAAA;QAEF,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,aAAa,EAAE;YAChE,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE;gBACT,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,KAAK;aACnB;YACD,SAAS,EAAE;gBACT,GAAG,EAAE,MAAM;gBACX,GAAG,EAAE,MAAM;aACZ;SACF,CAAC,CAAA;QAEF,2EAA2E;QAC3E,2DAA2D;QAC3D,2EAA2E;QAE3E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE;YACvD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,kBAAkB;YAC/B,gBAAgB,EAAE,KAAK,EAAE,qBAAqB;SAC/C,CAAC,CAAA;QAEF,0DAA0D;QAC1D,2EAA2E;QAC3E,wEAAwE;QACxE,qEAAqE;QACrE,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC,CAAA;QACvE,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAA;QAE/D,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,+DAA+D;QAC/D,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,sEAAsE;QACtE,iEAAiE;QACjE,iEAAiE;QACjE,uEAAuE;QACvE,kDAAkD;QAClD,QAAQ,CAAC,aAAa,CACpB,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAClB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EACjB,oCAAoC,CACrC,CAAA;QAED,IAAI,CAAC,cAAc,GAAG,IAAI,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,aAAa,EAAE;YACxE,IAAI,EAAE,KAAK,CAAC,cAAc;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9C,4BAA4B,EAAE,KAAK,CAAC,mBAAmB,IAAI,EAAE;YAC7D,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,gBAAgB,EAAE;YAC3D,cAAc,EAAE,CAAC,QAAQ,CAAC;YAC1B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,WAAW,EAAE,UAAU,CAAC;YACzE,WAAW,EAAE;gBACX,wBAAwB,EAAE,oBAAoB;gBAC9C,sBAAsB,EAAE,2BAA2B;gBACnD,GAAG,KAAK,CAAC,WAAW;aACrB;SACF,CAAC,CAAA;QAEF,sCAAsC;QACtC,yEAAyE;QACzE,6DAA6D;QAC7D,4EAA4E;QAC5E,qEAAqE;QACrE,0EAA0E;QAC1E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC;YACpD,QAAQ,EAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO;SAC7C,CAAC,CAAA;QAEF,yEAAyE;QACzE,8EAA8E;QAC9E,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,sBAAsB;QACtB,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG;gBACf,OAAO,EAAE,eAAe;gBACxB,SAAS,EAAE,iBAAiB;gBAC5B,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,QAAQ;aACjB,CAAA;YACD,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;YACxE,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;YACzE,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;YAC3E,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;YACtE,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;YACxE,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;YAC1E,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;YACrE,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;YACvE,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;YAC3E,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QAC1E,CAAC;QAED,2EAA2E;QAC3E,iEAAiE;QACjE,2EAA2E;QAE3E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE;YACvD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,sBAAsB;YACnC,gBAAgB,EAAE,KAAK;SACxB,CAAC,CAAA;QAEF,yDAAyD;QACzD,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC,CAAA;QACvE,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAA;QAE/D,iCAAiC;QACjC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,CAAA;QAE/E,wDAAwD;QACxD,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;QACvE,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;QAEvE,kBAAkB;QAClB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE;YAClD,SAAS,EAAE,IAAI,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;YACxD,WAAW,EAAE,2BAA2B;SACzC,CAAC,CAAA;QAEF,+BAA+B;QAC/B,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,UAAU,CAAC,WAAW,CACpB,IAAI,GAAG,CAAC,eAAe,CAAC;gBACtB,OAAO,EAAE,CAAC,+BAA+B,CAAC;gBAC1C,SAAS,EAAE,KAAK,CAAC,WAAW;aAC7B,CAAC,CACH,CAAA;QACH,CAAC;QAED,sGAAsG;QACtG,UAAU,CAAC,gBAAgB,CACzB,GAAG,CAAC,aAAa,CAAC,wBAAwB,CAAC,8CAA8C,CAAC,CAC3F,CAAA;QAED,oEAAoE;QACpE,kFAAkF;QAClF,MAAM,WAAW,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE;YACzD,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC;SAChD,CAAC,CAAA;QACF,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QAEjC,gDAAgD;QAChD,MAAM,QAAQ,GAAG;YACf,6CAA6C;YAC7C,0BAA0B,KAAK,CAAC,WAAW,EAAE;YAC7C,yBAAyB,KAAK,CAAC,UAAU,EAAE;YAC3C,yBAAyB,KAAK,CAAC,UAAU,IAAI,MAAM,EAAE;SACtD,CAAA;QACD,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,qCAAqC,KAAK,CAAC,oBAAoB,EAAE,CAAC,CAAA;QAClF,CAAC;QACD,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,uBAAuB,EAAE,CAAC,CAAA;QAC/E,CAAC;QACD,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAE1C,kBAAkB;QAClB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAA;QACxC,QAAQ,CAAC,WAAW,CAClB,aAAa,EACb,mBAAmB,EACnB,EAAE,EACF,wBAAwB,EACxB,oBAAoB,EACpB,2DAA2D,EAC3D,uBAAuB,EACvB,EAAE,EACF,aAAa,EACb,iCAAiC,EACjC,mBAAmB,EACnB,gBAAgB,IAAI,CAAC,UAAU,CAAC,YAAY,aAAa,EACzD,EAAE,EACF,qCAAqC,EACrC,kBAAkB,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,WAAW,yBAAyB,EAC9F,6BAA6B,EAC7B,uBAAuB,EACvB,iCAAiC,EACjC,EAAE,EACF,8CAA8C,EAC9C,2CAA2C,EAC3C,cAAc,EACd,QAAQ,EACR,EAAE,EACF,0BAA0B,EAC1B,6DAA6D,EAC7D,QAAQ,EACR,qCAAqC,EACrC,sBAAsB,EACtB,EAAE,EACF,WAAW,EACX,aAAa,EACb,eAAe,EACf,qCAAqC,EACrC,kCAAkC,EAClC,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,yCAAyC,EACzC,EAAE,EACF,WAAW,EACX,4BAA4B,EAC5B,QAAQ,EACR,EAAE,EACF,8BAA8B,EAC9B,+CAA+C,EAC/C,iEAAiE,EACjE,gEAAgE,EAChE,sEAAsE,EACtE,kCAAkC,EAClC,6BAA6B,EAC7B,4CAA4C,EAC5C,EAAE,EACF,gBAAgB,EAChB,yBAAyB,EACzB,gCAAgC,EAChC,+BAA+B,CAChC,CAAA;QAED,qBAAqB;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,WAAW,CAAC,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE;YACnE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE;YACjD,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC;YAC/E,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,qBAAqB,CAAC;gBACnD,OAAO,EAAE,GAAG,CAAC,kBAAkB,CAAC,MAAM;aACvC,CAAC;YACF,IAAI,EAAE,UAAU;YAChB,aAAa,EAAE,QAAQ;YACvB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,CAAC;YACd,QAAQ;YACR,SAAS,EAAE,KAAK,CAAC,YAAY,IAAI,QAAQ,EAAE,8BAA8B;YACzE,WAAW,EAAE,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC;gBACvC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;aAC3B,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;CACF"}
+{"version":3,"file":"cms-service.js","sourceRoot":"","sources":["../../src/constructs/cms-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EACL,QAAQ,EACR,aAAa,EACb,KAAK,EACL,OAAO,IAAI,GAAG,EACd,OAAO,IAAI,GAAG,EACd,OAAO,IAAI,GAAG,EACd,UAAU,IAAI,MAAM,EACpB,eAAe,IAAI,WAAW,EAC9B,aAAa,IAAI,QAAQ,EACzB,QAAQ,IAAI,IAAI,GACjB,MAAM,aAAa,CAAA;AAGpB,wEAAwE;AACxE,sEAAsE;AACtE,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,yEAAyE;AACzE,iEAAiE;AACjE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AA+E9D;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,gBAAiB,SAAQ,SAAS;IAmB7C,YAAY,KAAgB,EAAE,EAAU,EAAE,KAA4B;QACpE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAEhB,2EAA2E;QAC3E,gDAAgD;QAChD,2EAA2E;QAE3E,IAAI,CAAC,GAAG;YACN,KAAK,CAAC,GAAG;gBACT,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;oBACvB,MAAM,EAAE,CAAC;oBACT,WAAW,EAAE,CAAC,EAAE,yCAAyC;oBACzD,mBAAmB,EAAE;wBACnB;4BACE,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM;4BACjC,QAAQ,EAAE,EAAE;yBACb;wBACD;4BACE,IAAI,EAAE,SAAS;4BACf,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,gBAAgB;4BAC3C,QAAQ,EAAE,EAAE;yBACb;qBACF;iBACF,CAAC,CAAA;QAEJ,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,0EAA0E;QAC1E,yEAAyE;QACzE,+BAA+B;QAC/B,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,EAAE;YACxC,OAAO,EAAE,GAAG,CAAC,4BAA4B,CAAC,EAAE;SAC7C,CAAC,CAAA;QAEF,2EAA2E;QAC3E,4DAA4D;QAC5D,2EAA2E;QAE3E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE;YACjD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,eAAe;YAC5B,gBAAgB,EAAE,KAAK;SACxB,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE;YACvD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,SAAS,EAAE,IAAI;YACf,eAAe,EAAE,GAAG,CAAC,eAAe,CAAC,eAAe;YACpD,aAAa,EAAE,KAAK,CAAC,gBAAgB,IAAI,aAAa,CAAC,MAAM;YAC7D,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,gBAAgB,EAAE;YAC3D,aAAa,EAAE,KAAK;SACrB,CAAC,CAAA;QAEF,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,aAAa,EAAE;YAChE,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE;gBACT,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,KAAK;aACnB;YACD,SAAS,EAAE;gBACT,GAAG,EAAE,MAAM;gBACX,GAAG,EAAE,MAAM;aACZ;SACF,CAAC,CAAA;QAEF,2EAA2E;QAC3E,2DAA2D;QAC3D,2EAA2E;QAE3E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE;YACvD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,kBAAkB;YAC/B,gBAAgB,EAAE,KAAK,EAAE,qBAAqB;SAC/C,CAAC,CAAA;QAEF,0DAA0D;QAC1D,2EAA2E;QAC3E,wEAAwE;QACxE,qEAAqE;QACrE,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC,CAAA;QACvE,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAA;QAE/D,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,+DAA+D;QAC/D,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,sEAAsE;QACtE,iEAAiE;QACjE,iEAAiE;QACjE,uEAAuE;QACvE,kDAAkD;QAClD,QAAQ,CAAC,aAAa,CACpB,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAClB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EACjB,oCAAoC,CACrC,CAAA;QAED,IAAI,CAAC,cAAc,GAAG,IAAI,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,aAAa,EAAE;YACxE,IAAI,EAAE,KAAK,CAAC,cAAc;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9C,4BAA4B,EAAE,KAAK,CAAC,mBAAmB,IAAI,EAAE;YAC7D,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,gBAAgB,EAAE;YAC3D,cAAc,EAAE,CAAC,QAAQ,CAAC;YAC1B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,WAAW,EAAE,UAAU,CAAC;YACzE,WAAW,EAAE;gBACX,uEAAuE;gBACvE,uEAAuE;gBACvE,uEAAuE;gBACvE,uEAAuE;gBACvE,qEAAqE;gBACrE,sEAAsE;gBACtE,wBAAwB,EAAE,UAAU;gBACpC,sBAAsB,EAAE,iBAAiB;gBACzC,iEAAiE;gBACjE,qEAAqE;gBACrE,6DAA6D;gBAC7D,sEAAsE;gBACtE,0CAA0C;gBAC1C,4CAA4C;gBAC5C,GAAG,KAAK,CAAC,WAAW;aACrB;SACF,CAAC,CAAA;QAEF,sCAAsC;QACtC,yEAAyE;QACzE,6DAA6D;QAC7D,4EAA4E;QAC5E,qEAAqE;QACrE,0EAA0E;QAC1E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC;YACpD,QAAQ,EAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO;SAC7C,CAAC,CAAA;QAEF,yEAAyE;QACzE,8EAA8E;QAC9E,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,sBAAsB;QACtB,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG;gBACf,OAAO,EAAE,eAAe;gBACxB,SAAS,EAAE,iBAAiB;gBAC5B,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,QAAQ;aACjB,CAAA;YACD,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;YACxE,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;YACzE,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;YAC3E,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;YACtE,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;YACxE,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;YAC1E,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;YACrE,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;YACvE,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;YAC3E,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QAC1E,CAAC;QAED,2EAA2E;QAC3E,iEAAiE;QACjE,2EAA2E;QAE3E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE;YACvD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,sBAAsB;YACnC,gBAAgB,EAAE,KAAK;SACxB,CAAC,CAAA;QAEF,yDAAyD;QACzD,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC,CAAA;QACvE,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAA;QAE/D,iCAAiC;QACjC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,CAAA;QAE/E,wDAAwD;QACxD,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;QACvE,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;QAEvE,kBAAkB;QAClB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE;YAClD,SAAS,EAAE,IAAI,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;YACxD,WAAW,EAAE,2BAA2B;SACzC,CAAC,CAAA;QAEF,+BAA+B;QAC/B,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,UAAU,CAAC,WAAW,CACpB,IAAI,GAAG,CAAC,eAAe,CAAC;gBACtB,OAAO,EAAE,CAAC,+BAA+B,CAAC;gBAC1C,SAAS,EAAE,KAAK,CAAC,WAAW;aAC7B,CAAC,CACH,CAAA;QACH,CAAC;QAED,sGAAsG;QACtG,UAAU,CAAC,gBAAgB,CACzB,GAAG,CAAC,aAAa,CAAC,wBAAwB,CAAC,8CAA8C,CAAC,CAC3F,CAAA;QAED,kFAAkF;QAClF,uCAAuC;QACvC,UAAU,CAAC,gBAAgB,CACzB,GAAG,CAAC,aAAa,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,CAC3E,CAAA;QAED,4EAA4E;QAC5E,4EAA4E;QAC5E,gEAAgE;QAChE,IAAI,CAAC,cAAc,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE;YAC1D,YAAY,EAAE,KAAK,CAAC,kBAAkB,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,SAAS;YACzF,SAAS,EAAE,KAAK,CAAC,kBAAkB,IAAI,IAAI,CAAC,aAAa,CAAC,YAAY;YACtE,aAAa,EAAE,aAAa,CAAC,OAAO;SACrC,CAAC,CAAA;QACF,6EAA6E;QAC7E,4EAA4E;QAC5E,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;QAE1C,oEAAoE;QACpE,kFAAkF;QAClF,MAAM,WAAW,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE;YACzD,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC;SAChD,CAAC,CAAA;QACF,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QAEjC,gDAAgD;QAChD,MAAM,QAAQ,GAAG;YACf,6CAA6C;YAC7C,0BAA0B,KAAK,CAAC,WAAW,EAAE;YAC7C,yBAAyB,KAAK,CAAC,UAAU,EAAE;YAC3C,yBAAyB,KAAK,CAAC,UAAU,IAAI,MAAM,EAAE;YACrD,uEAAuE;YACvE,wEAAwE;YACxE,4BAA4B;YAC5B,cAAc,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;SACtC,CAAA;QACD,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,qCAAqC,KAAK,CAAC,oBAAoB,EAAE,CAAC,CAAA;QAClF,CAAC;QACD,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,uBAAuB,EAAE,CAAC,CAAA;QAC/E,CAAC;QACD,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAE1C,kBAAkB;QAClB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAA;QACxC,QAAQ,CAAC,WAAW,CAClB,aAAa,EACb,mBAAmB,EACnB,EAAE,EACF,oEAAoE,EACpE,0BAA0B,EAC1B,2DAA2D,EAC3D,uBAAuB,EACvB,EAAE,EACF,aAAa,EACb,iCAAiC,EACjC,mBAAmB,EACnB,gBAAgB,IAAI,CAAC,UAAU,CAAC,YAAY,aAAa,EACzD,sEAAsE,EACtE,yEAAyE,EACzE,qEAAqE,EACrE,oDAAoD,EACpD,SAAS,IAAI,CAAC,UAAU,CAAC,YAAY,4CAA4C,EACjF,EAAE,EACF,qCAAqC,EACrC,kBAAkB,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,WAAW,yBAAyB,EAC9F,6BAA6B,EAC7B,uBAAuB,EACvB,iCAAiC,EACjC,0EAA0E,EAC1E,wEAAwE,EACxE,yDAAyD,EACzD,4DAA4D,EAC5D,EAAE,EACF,8CAA8C,EAC9C,2CAA2C,EAC3C,cAAc,EACd,QAAQ,EACR,EAAE,EACF,0BAA0B,EAC1B,6DAA6D,EAC7D,QAAQ,EACR,qCAAqC,EACrC,sBAAsB,EACtB,uEAAuE,EACvE,4BAA4B,EAC5B,EAAE,EACF,WAAW,EACX,aAAa,EACb,eAAe,EACf,qCAAqC,EACrC,kCAAkC,EAClC,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,wEAAwE,EACxE,+DAA+D,EAC/D,0EAA0E,EAC1E,+DAA+D,EAC/D,uEAAuE,EACvE,qEAAqE,EACrE,uEAAuE,EACvE,6BAA6B,EAC7B,yDAAyD,EACzD,wDAAwD,EACxD,yCAAyC,EACzC,EAAE,EACF,WAAW,EACX,4BAA4B,EAC5B,QAAQ,EACR,EAAE,EACF,8BAA8B,EAC9B,+CAA+C,EAC/C,iEAAiE,EACjE,gEAAgE,EAChE,sEAAsE,EACtE,kCAAkC,EAClC,6BAA6B,EAC7B,4CAA4C,EAC5C,EAAE,EACF,qEAAqE,EACrE,sEAAsE,EACtE,wEAAwE,EACxE,oEAAoE,EACpE,qEAAqE,EACrE,oCAAoC,EACpC,iCAAiC,EACjC,gDAAgD,EAChD,EAAE,EACF,gBAAgB,EAChB,yBAAyB,EACzB,gCAAgC,EAChC,+BAA+B,EAC/B,EAAE,EACF,qCAAqC,EACrC,0EAA0E,EAC1E,4EAA4E,EAC5E,kDAAkD,EAClD,EAAE,EACF,4EAA4E,EAC5E,wEAAwE,EACxE,kDAAkD,EAClD,qCAAqC,EACrC,cAAc,EACd,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,GAAG,EACH,QAAQ,EACR,oEAAoE,EACpE,uEAAuE,EACvE,sEAAsE,EACtE,gEAAgE,EAChE,wCAAwC,EACxC,EAAE,EACF,2EAA2E,EAC3E,+EAA+E,EAC/E,GAAG,EACH,aAAa,EACb,yBAAyB,EACzB,kBAAkB,EAClB,2BAA2B,EAC3B,aAAa,EACb,+DAA+D,EAC/D,kCAAkC,IAAI,CAAC,cAAc,CAAC,YAAY,IAAI,EACtE,gDAAgD,EAChD,aAAa,EACb,WAAW,EACX,SAAS,EACT,OAAO,EACP,KAAK,EACL,GAAG,EACH,OAAO,EACP,+EAA+E,EAC/E,iKAAiK,CAClK,CAAA;QAED,qEAAqE;QACrE,6DAA6D;QAC7D,0EAA0E;QAC1E,wEAAwE;QACxE,gEAAgE;QAChE,iEAAiE;QACjE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,sBAAsB,EAAE;YAC1E,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC;YAC/E,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,qBAAqB,CAAC;gBACnD,OAAO,EAAE,GAAG,CAAC,kBAAkB,CAAC,MAAM;aACvC,CAAC;YACF,IAAI,EAAE,UAAU;YAChB,aAAa,EAAE,QAAQ;YACvB,QAAQ;YACR,WAAW,EAAE;gBACX,WAAW,EAAE,GAAG,CAAC,eAAe,CAAC,QAAQ,EAAE,gCAAgC;gBAC3E,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,YAAY,IAAI,QAAQ,CAAC,EAAE,8BAA8B;aACrF;SACF,CAAC,CAAA;QAEF,qBAAqB;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,WAAW,CAAC,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE;YACnE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE;YACjD,cAAc;YACd,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC;gBACvC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;aAC3B,CAAC;SACH,CAAC,CAAA;QAEF,iEAAiE;QACjE,kEAAkE;QAClE,2DAA2D;QAC3D,wCAAwC;QACxC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAA;IAC1E,CAAC;CACF"}