canopycms-cdk 0.0.61-int.75 → 0.0.62

package/dist/constructs/asset-support.d.ts

@@ -1,5 +1,5 @@
 import { Construct } from 'constructs';
-import { RemovalPolicy, aws_cloudfront as cloudfront, aws_iam as iam, aws_lambda as lambda, aws_s3 as s3 } from 'aws-cdk-lib';
+import { RemovalPolicy, aws_cloudfront as cloudfront, aws_iam as iam, aws_lambda as lambda, aws_logs as logs, aws_s3 as s3 } from 'aws-cdk-lib';
 export interface AssetSupportProps {
     /**
      * Use an existing bucket (BYO mode - e.g. a site's existing content
@@ -52,6 +52,40 @@ export interface AssetSupportProps {
      * @default false
      */
     readonly autoDeleteObjects?: boolean;
+    /**
+     * Require the transform Lambda's code asset to carry proof that it was
+     * built with its native sharp binary (the `.deployable` marker written by
+     * `build:lambda`). Leave this ON for anything that can reach a real
+     * deploy.
+     *
+     * Set to `false` ONLY in this package's own tests, which deliberately
+     * synth against the cheap `--skip-native` fixture bundle that
+     * `build:test-fixtures` produces - the suite never executes the handler,
+     * so the binary is irrelevant to what it asserts, and requiring a real
+     * build would put a live `npm install sharp` back in front of every test
+     * run (which is what kept these tests out of CI in the first place).
+     *
+     * Adopters never need this: the published package's asset is built by
+     * `prepack`'s full `build:lambda`, so the marker is always present.
+     *
+     * @default true
+     */
+    readonly requireDeployableBundle?: boolean;
+    /**
+     * Retention for the transform Lambda's CloudWatch log group (default:
+     * three months / 90 days).
+     */
+    readonly transformLogRetention?: logs.RetentionDays;
+    /**
+     * Name for the transform Lambda's CloudWatch log group (default:
+     * `/canopycms/<stackName>/transform`). Deliberately NOT
+     * `/aws/lambda/<function-name>` - see `transformLogGroup`'s comment in the
+     * constructor for why a CDK-managed group must avoid that exact name once
+     * the function has ever been deployed without one. Override to follow an
+     * org naming convention, or when instantiating this construct twice in one
+     * stack (the default name would collide).
+     */
+    readonly transformLogGroupName?: string;
 }
 /**
  * The two CloudFront behavior configs the asset system needs, keyed by the
@@ -107,7 +141,10 @@ export interface AssetCloudFrontBehaviors {
  * - The bucket's asset-prefix lifecycle rule + CORS (standalone mode only).
  * - The transform Lambda (`../../lambda/asset-transform/handler.ts`, built
  *   via `pnpm run build:lambda` - see that script's doc comment for the
- *   no-Docker sharp bundling approach) and its OAC-locked Function URL.
+ *   no-Docker sharp bundling approach), its dedicated CloudWatch log group
+ *   (custom name/retention/removal policy instead of the
+ *   CloudFormation-implicit `/aws/lambda/<function-name>` group), and its
+ *   OAC-locked Function URL.
  * - `assetBehaviors()`, the two CloudFront behavior configs a consuming
  *   distribution attaches (see `AssetCloudFrontBehaviors`'s doc comment for
  *   both attachment shapes).
@@ -119,6 +156,8 @@ export declare class AssetSupport extends Construct {
     readonly bucket: s3.IBucket;
     /** The transform Lambda function. */
     readonly transformFunction: lambda.Function;
+    /** The transform Lambda's CloudWatch log group (Lambda stdout/stderr). */
+    readonly transformLogGroup: logs.LogGroup;
     /** The transform Lambda's Function URL - use as a CloudFront origin (see `assetBehaviors()`). */
     readonly transformFunctionUrl: lambda.FunctionUrl;
     /** Effective advisory upload-size cap (see `AssetSupportProps.maxUploadBytes`). */

package/dist/constructs/asset-support.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"asset-support.d.ts","sourceRoot":"","sources":["../../src/constructs/asset-support.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EAEL,aAAa,EACb,cAAc,IAAI,UAAU,EAE5B,OAAO,IAAI,GAAG,EACd,UAAU,IAAI,MAAM,EACpB,MAAM,IAAI,EAAE,EACb,MAAM,aAAa,CAAA;AAwDpB,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAA;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,CAAA;IAEhC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAEhC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAE5B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAA;IAEtC;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,eAAe,CAAA;IAE3C;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC,eAAe,CAAA;CACrD;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,YAAa,SAAQ,SAAS;IACzC,0EAA0E;IAC1E,SAAgB,MAAM,EAAE,EAAE,CAAC,OAAO,CAAA;IAElC,qCAAqC;IACrC,SAAgB,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAA;IAElD,iGAAiG;IACjG,SAAgB,oBAAoB,EAAE,MAAM,CAAC,WAAW,CAAA;IAExD,mFAAmF;IACnF,SAAgB,cAAc,EAAE,MAAM,CAAA;IAEtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;gBAExC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB;IAgFlE,OAAO,CAAC,cAAc;IA+CtB,uIAAuI;IAChI,cAAc,IAAI,wBAAwB;IAIjD;;;;;;;;;OASG;IACI,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,GAAG,IAAI;CAexD"}
+{"version":3,"file":"asset-support.d.ts","sourceRoot":"","sources":["../../src/constructs/asset-support.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EAEL,aAAa,EAEb,cAAc,IAAI,UAAU,EAE5B,OAAO,IAAI,GAAG,EACd,UAAU,IAAI,MAAM,EACpB,QAAQ,IAAI,IAAI,EAChB,MAAM,IAAI,EAAE,EACb,MAAM,aAAa,CAAA;AAiFpB,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAA;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,CAAA;IAEhC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAEhC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAE5B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAA;IAEtC;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAEpC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAA;IAE1C;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,aAAa,CAAA;IAEnD;;;;;;;;OAQG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,eAAe,CAAA;IAE3C;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC,eAAe,CAAA;CACrD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,YAAa,SAAQ,SAAS;IACzC,0EAA0E;IAC1E,SAAgB,MAAM,EAAE,EAAE,CAAC,OAAO,CAAA;IAElC,qCAAqC;IACrC,SAAgB,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAA;IAElD,0EAA0E;IAC1E,SAAgB,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAA;IAEhD,iGAAiG;IACjG,SAAgB,oBAAoB,EAAE,MAAM,CAAC,WAAW,CAAA;IAExD,mFAAmF;IACnF,SAAgB,cAAc,EAAE,MAAM,CAAA;IAEtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;gBAExC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB;IA2IlE,OAAO,CAAC,cAAc;IA+CtB,uIAAuI;IAChI,cAAc,IAAI,wBAAwB;IAIjD;;;;;;;;;OASG;IACI,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,GAAG,IAAI;CAexD"}

package/dist/constructs/asset-support.js

@@ -1,11 +1,35 @@
+import { existsSync } from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { Construct } from 'constructs';
-import { Duration, RemovalPolicy, aws_cloudfront as cloudfront, aws_cloudfront_origins as origins, aws_lambda as lambda, aws_s3 as s3, } from 'aws-cdk-lib';
+import { Duration, RemovalPolicy, Stack, aws_cloudfront as cloudfront, aws_cloudfront_origins as origins, aws_lambda as lambda, aws_logs as logs, aws_s3 as s3, } from 'aws-cdk-lib';
 // This package (`canopycms-cdk`) is `"type": "module"`, so its compiled
 // output is real ESM - `__dirname` is not a global there. Derive it from
 // `import.meta.url` instead (mirrors ../../lambda/asset-transform/build.mjs).
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
+/**
+ * The transform Lambda's built code asset. Computed ONCE and shared by the
+ * deployability guard and `Code.fromAsset()` below - if the check and the
+ * bundle ever read two independently-computed paths, the guard can silently
+ * start statting a directory that is never the one being deployed, and
+ * nothing about either call site would look wrong.
+ *
+ * The `'..', '..'` walk is correct from both `<pkg>/src/constructs/` (local
+ * source) and `<pkg>/dist/constructs/` (published package) only because those
+ * sit at the same depth - see the `__dirname` note above.
+ */
+const transformAssetDir = path.join(__dirname, '..', '..', 'lambda', 'asset-transform', 'dist');
+/**
+ * Written by `build:lambda` as the last act of a successful FULL build, once
+ * the linux/arm64 sharp binary is verified present. See that script's header
+ * for why the marker is positive rather than negative: a partial build (a
+ * thrown `npm install sharp`, a failed platform check) leaves a sharp-less
+ * `dist/` on disk WITHOUT reaching the `--skip-native` branch, so a
+ * "is it marked bad?" test would wave exactly that bundle through to a
+ * deploy. Requiring proof-of-good instead fails closed on every unexpected
+ * path, including the producer's and consumer's paths drifting apart.
+ */
+const DEPLOYABLE_MARKER = '.deployable';
 /**
  * The four S3 key prefixes the asset system uses, mirrored from
  * `packages/canopycms/src/assets/asset-prefixes.ts` (the source of truth).
@@ -58,7 +82,10 @@ const TRANSFORM_CACHE_MAX_TTL = Duration.days(365);
  * - The bucket's asset-prefix lifecycle rule + CORS (standalone mode only).
  * - The transform Lambda (`../../lambda/asset-transform/handler.ts`, built
  *   via `pnpm run build:lambda` - see that script's doc comment for the
- *   no-Docker sharp bundling approach) and its OAC-locked Function URL.
+ *   no-Docker sharp bundling approach), its dedicated CloudWatch log group
+ *   (custom name/retention/removal policy instead of the
+ *   CloudFormation-implicit `/aws/lambda/<function-name>` group), and its
+ *   OAC-locked Function URL.
  * - `assetBehaviors()`, the two CloudFront behavior configs a consuming
  *   distribution attaches (see `AssetCloudFrontBehaviors`'s doc comment for
  *   both attachment shapes).
@@ -68,6 +95,25 @@ const TRANSFORM_CACHE_MAX_TTL = Duration.days(365);
 export class AssetSupport extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
+        // Fail closed before anything else: refuse to build a stack around a
+        // transform Lambda whose code asset was never verified to contain the
+        // linux/arm64 sharp binary. Without this, `pnpm test` (whose
+        // canopycms-cdk suite rebuilds that directory as a --skip-native
+        // fixture) or any partially-failed build leaves a sharp-less bundle on
+        // disk, and a later in-repo `cdk deploy` ships it - producing a Lambda
+        // that throws at cold start on the first image request, a long way from
+        // the cause. Guarding in the construct rather than at one deploy
+        // entrypoint means future entrypoints inherit the protection instead of
+        // having to remember it.
+        if ((props.requireDeployableBundle ?? true) &&
+            !existsSync(path.join(transformAssetDir, DEPLOYABLE_MARKER))) {
+            throw new Error(`The transform Lambda code asset at ${transformAssetDir} carries no ${DEPLOYABLE_MARKER} ` +
+                'marker, so it was not built with its native sharp binary and must not be deployed. ' +
+                'This is usually a --skip-native fixture bundle left behind by `pnpm test`, or a ' +
+                '`build:lambda` run that failed partway through its sharp install.\n' +
+                'Build it for real:\n' +
+                '  pnpm --filter canopycms-cdk run build:lambda');
+        }
         this.maxUploadBytes = props.maxUploadBytes ?? DEFAULT_MAX_UPLOAD_BYTES;
         if (props.bucket) {
             this.bucket = props.bucket;
@@ -101,13 +147,30 @@ export class AssetSupport extends Construct {
                 ],
             });
         }
+        // Dedicated CloudWatch log group for the transform Lambda's stdout/
+        // stderr. Custom name (NOT the CloudFormation-implicit
+        // `/aws/lambda/<function name>`), for two reasons: (1) CDK does not
+        // manage that implicit group at all - infinite retention, and
+        // `cdk destroy` leaves it behind; (2) Lambda auto-creates
+        // `/aws/lambda/<function name>` on first invoke, OUTSIDE CloudFormation -
+        // once that has happened (e.g. this construct was already deployed
+        // before this log group existed), a CDK `LogGroup` construct using that
+        // exact name would fail its `CreateLogGroup` call with "already exists"
+        // and block every future `cdk deploy`. Mirrors `CanopyCmsService`'s
+        // `workerLogGroup`/`cmsLogGroup` (cms-service.ts), which established this
+        // convention.
+        this.transformLogGroup = new logs.LogGroup(this, 'TransformFunctionLogs', {
+            logGroupName: props.transformLogGroupName ?? `/canopycms/${Stack.of(this).stackName}/transform`,
+            retention: props.transformLogRetention ?? logs.RetentionDays.THREE_MONTHS,
+            removalPolicy: RemovalPolicy.DESTROY,
+        });
         this.transformFunction = new lambda.Function(this, 'TransformFunction', {
             // Built by `pnpm run build:lambda` (lambda/asset-transform/build.mjs) -
             // esbuild bundle + a real linux/arm64 `npm install sharp` alongside it,
             // no Docker. `cdk synth`/`deploy` need that script run first; it is
             // NOT run automatically here (kept explicit rather than magic - see
             // this construct's class doc comment).
-            code: lambda.Code.fromAsset(path.join(__dirname, '..', '..', 'lambda', 'asset-transform', 'dist')),
+            code: lambda.Code.fromAsset(transformAssetDir),
             handler: 'handler.handler',
             // nodejs20.x was deprecated 2026-04-30; CDK's CloudFormation validation
             // now fails synth on it. The esbuild bundle targets node20 and runs
@@ -116,10 +179,27 @@ export class AssetSupport extends Construct {
             architecture: lambda.Architecture.ARM_64,
             memorySize: TRANSFORM_LAMBDA_MEMORY_MB,
             timeout: TRANSFORM_LAMBDA_TIMEOUT,
+            // Pass the pre-created group via `logGroup`, NOT `logRetention` (CDK
+            // throws LogRetentionLogGroupConflict/ConflictingLogPolicyOptions if
+            // both are set on the same function) - the removal policy lives on the
+            // LogGroup construct above instead.
+            logGroup: this.transformLogGroup,
             environment: {
                 ASSET_BUCKET: this.bucket.bucketName,
             },
         });
+        // Explicit, scoped grant - NOT a reliance on the auto-created execution
+        // role's AWSLambdaBasicExecutionRole managed policy (attached by CDK's
+        // lambda.Function regardless of `logGroup`, and never adjusted for it -
+        // passing `logGroup` only points the function's LoggingConfig at this
+        // group, it grants no IAM permissions). That managed policy's
+        // logs:CreateLogStream/logs:PutLogEvents statement is scoped to
+        // `arn:aws:logs:*:*:log-group:/aws/lambda/*:*` only (its
+        // logs:CreateLogGroup statement is the sole one that's unrestricted) -
+        // it grants nothing for a custom-named group like this one. Without this
+        // grantWrite, log delivery to this group would fail permission checks
+        // with no error surfaced anywhere - logs would simply vanish.
+        this.transformLogGroup.grantWrite(this.transformFunction);
         // Read access to originals (what it transforms) - deviation from the PR
         // spec's literal "read asset-originals/, write assets/" grant list: the
         // handler must also read `asset-meta/{hash32}.json` to look up kind/ext

package/dist/constructs/asset-support.js.map

@@ -1 +1 @@
-{"version":3,"file":"asset-support.js","sourceRoot":"","sources":["../../src/constructs/asset-support.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EACL,QAAQ,EACR,aAAa,EACb,cAAc,IAAI,UAAU,EAC5B,sBAAsB,IAAI,OAAO,EAEjC,UAAU,IAAI,MAAM,EACpB,MAAM,IAAI,EAAE,GACb,MAAM,aAAa,CAAA;AAEpB,wEAAwE;AACxE,yEAAyE;AACzE,8EAA8E;AAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAE9D;;;;;;;;;;;;GAYG;AACH,MAAM,QAAQ,GAAG;IACf,SAAS,EAAE,iBAAiB;IAC5B,OAAO,EAAE,eAAe;IACxB,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,UAAU;CACb,CAAA;AAEV,mFAAmF;AACnF,MAAM,oBAAoB,GAAG,IAAI,CAAA;AAEjC,sFAAsF;AACtF,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEjD,MAAM,0BAA0B,GAAG,IAAI,CAAA;AACvC,MAAM,wBAAwB,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAErD;;;;;;;;;;;;;;GAcG;AACH,MAAM,uBAAuB,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AACnD,MAAM,2BAA2B,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACpD,MAAM,uBAAuB,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AA6GlD;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,YAAa,SAAQ,SAAS;IAezC,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAwB;QAChE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAEhB,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,wBAAwB,CAAA;QAEtE,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;QAC5B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE;gBAC1C,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS;gBACjD,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,UAAU;gBAC1C,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK;gBACnC,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM;gBAC1D,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,KAAK;gBACnD,kEAAkE;gBAClE,6DAA6D;gBAC7D,0DAA0D;gBAC1D,cAAc,EAAE;oBACd;wBACE,EAAE,EAAE,sBAAsB;wBAC1B,OAAO,EAAE,IAAI;wBACb,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,GAAG;wBAC9B,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;qBAC7B;iBACF;gBACD,IAAI,EAAE;oBACJ;wBACE,EAAE,EAAE,yBAAyB;wBAC7B,cAAc,EAAE,KAAK,CAAC,aAAa;wBACnC,cAAc,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC;wBAC7E,cAAc,EAAE,CAAC,GAAG,CAAC;wBACrB,MAAM,EAAE,oBAAoB;qBAC7B;iBACF;aACF,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,iBAAiB,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,EAAE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,oEAAoE;YACpE,oEAAoE;YACpE,uCAAuC;YACvC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CACzB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,CAAC,CACtE;YACD,OAAO,EAAE,iBAAiB;YAC1B,wEAAwE;YACxE,oEAAoE;YACpE,mCAAmC;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;YACnC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM;YACxC,UAAU,EAAE,0BAA0B;YACtC,OAAO,EAAE,wBAAwB;YACjC,WAAW,EAAE;gBACX,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACrC;SACF,CAAC,CAAA;QAEF,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;QACxE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QACnE,+DAA+D;QAC/D,+DAA+D;QAC/D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;QAEpE,wEAAwE;QACxE,sEAAsE;QACtE,oEAAoE;QACpE,gDAAgD;QAChD,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC;YAChE,QAAQ,EAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO;SAC7C,CAAC,CAAA;QAEF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,cAAc,EAAE,CAAA;IACxC,CAAC;IAEO,cAAc;QACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5E,MAAM,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,uBAAuB,CAC7E,IAAI,CAAC,oBAAoB,CAC1B,CAAA;QAED,MAAM,MAAM,GAA+B;YACzC,MAAM,EAAE,QAAQ;YAChB,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,CAAC,iBAAiB;YACvE,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,iBAAiB;YACrD,QAAQ,EAAE,IAAI;SACf,CAAA;QAED,yEAAyE;QACzE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,gCAAgC;QAChC,MAAM,oBAAoB,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,4BAA4B,EAAE;YAC1F,MAAM,EAAE,uBAAuB;YAC/B,UAAU,EAAE,2BAA2B;YACvC,MAAM,EAAE,uBAAuB;YAC/B,wBAAwB,EAAE,IAAI;YAC9B,0BAA0B,EAAE,IAAI;YAChC,mBAAmB,EAAE,UAAU,CAAC,wBAAwB,CAAC,IAAI,EAAE;YAC/D,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACrD,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE;SACtD,CAAC,CAAA;QAEF,MAAM,eAAe,GAA+B;YAClD,MAAM,EAAE,IAAI,OAAO,CAAC,WAAW,CAAC;gBAC9B,aAAa,EAAE,QAAQ;gBACvB,cAAc,EAAE,qBAAqB;gBACrC,+DAA+D;gBAC/D,+DAA+D;gBAC/D,4DAA4D;gBAC5D,gEAAgE;gBAChE,gEAAgE;gBAChE,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;aAChC,CAAC;YACF,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,CAAC,iBAAiB;YACvE,WAAW,EAAE,oBAAoB;SAClC,CAAA;QAED,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IACpC,CAAC;IAED,uIAAuI;IAChI,cAAc;QACnB,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED;;;;;;;;;OASG;IACI,iBAAiB,CAAC,OAAuB;QAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;QAEtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;QACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;QACzD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;QAEtD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;QACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;QAErD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;QACzD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;IACxD,CAAC;CACF"}
+{"version":3,"file":"asset-support.js","sourceRoot":"","sources":["../../src/constructs/asset-support.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EACL,QAAQ,EACR,aAAa,EACb,KAAK,EACL,cAAc,IAAI,UAAU,EAC5B,sBAAsB,IAAI,OAAO,EAEjC,UAAU,IAAI,MAAM,EACpB,QAAQ,IAAI,IAAI,EAChB,MAAM,IAAI,EAAE,GACb,MAAM,aAAa,CAAA;AAEpB,wEAAwE;AACxE,yEAAyE;AACzE,8EAA8E;AAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAA;AAE/F;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG,aAAa,CAAA;AAEvC;;;;;;;;;;;;GAYG;AACH,MAAM,QAAQ,GAAG;IACf,SAAS,EAAE,iBAAiB;IAC5B,OAAO,EAAE,eAAe;IACxB,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,UAAU;CACb,CAAA;AAEV,mFAAmF;AACnF,MAAM,oBAAoB,GAAG,IAAI,CAAA;AAEjC,sFAAsF;AACtF,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEjD,MAAM,0BAA0B,GAAG,IAAI,CAAA;AACvC,MAAM,wBAAwB,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAErD;;;;;;;;;;;;;;GAcG;AACH,MAAM,uBAAuB,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AACnD,MAAM,2BAA2B,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACpD,MAAM,uBAAuB,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAkJlD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,YAAa,SAAQ,SAAS;IAkBzC,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAwB;QAChE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAEhB,qEAAqE;QACrE,sEAAsE;QACtE,6DAA6D;QAC7D,iEAAiE;QACjE,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,iEAAiE;QACjE,wEAAwE;QACxE,yBAAyB;QACzB,IACE,CAAC,KAAK,CAAC,uBAAuB,IAAI,IAAI,CAAC;YACvC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,EAC5D,CAAC;YACD,MAAM,IAAI,KAAK,CACb,sCAAsC,iBAAiB,eAAe,iBAAiB,GAAG;gBACxF,qFAAqF;gBACrF,kFAAkF;gBAClF,qEAAqE;gBACrE,sBAAsB;gBACtB,gDAAgD,CACnD,CAAA;QACH,CAAC;QAED,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,wBAAwB,CAAA;QAEtE,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;QAC5B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE;gBAC1C,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS;gBACjD,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,UAAU;gBAC1C,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK;gBACnC,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM;gBAC1D,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,KAAK;gBACnD,kEAAkE;gBAClE,6DAA6D;gBAC7D,0DAA0D;gBAC1D,cAAc,EAAE;oBACd;wBACE,EAAE,EAAE,sBAAsB;wBAC1B,OAAO,EAAE,IAAI;wBACb,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,GAAG;wBAC9B,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;qBAC7B;iBACF;gBACD,IAAI,EAAE;oBACJ;wBACE,EAAE,EAAE,yBAAyB;wBAC7B,cAAc,EAAE,KAAK,CAAC,aAAa;wBACnC,cAAc,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC;wBAC7E,cAAc,EAAE,CAAC,GAAG,CAAC;wBACrB,MAAM,EAAE,oBAAoB;qBAC7B;iBACF;aACF,CAAC,CAAA;QACJ,CAAC;QAED,oEAAoE;QACpE,uDAAuD;QACvD,oEAAoE;QACpE,8DAA8D;QAC9D,0DAA0D;QAC1D,0EAA0E;QAC1E,mEAAmE;QACnE,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,0EAA0E;QAC1E,cAAc;QACd,IAAI,CAAC,iBAAiB,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,EAAE;YACxE,YAAY,EACV,KAAK,CAAC,qBAAqB,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,YAAY;YACnF,SAAS,EAAE,KAAK,CAAC,qBAAqB,IAAI,IAAI,CAAC,aAAa,CAAC,YAAY;YACzE,aAAa,EAAE,aAAa,CAAC,OAAO;SACrC,CAAC,CAAA;QAEF,IAAI,CAAC,iBAAiB,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,EAAE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,oEAAoE;YACpE,oEAAoE;YACpE,uCAAuC;YACvC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;YAC9C,OAAO,EAAE,iBAAiB;YAC1B,wEAAwE;YACxE,oEAAoE;YACpE,mCAAmC;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;YACnC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM;YACxC,UAAU,EAAE,0BAA0B;YACtC,OAAO,EAAE,wBAAwB;YACjC,qEAAqE;YACrE,qEAAqE;YACrE,uEAAuE;YACvE,oCAAoC;YACpC,QAAQ,EAAE,IAAI,CAAC,iBAAiB;YAChC,WAAW,EAAE;gBACX,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACrC;SACF,CAAC,CAAA;QAEF,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,8DAA8D;QAC9D,gEAAgE;QAChE,yDAAyD;QACzD,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,8DAA8D;QAC9D,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAEzD,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;QACxE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QACnE,+DAA+D;QAC/D,+DAA+D;QAC/D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;QAEpE,wEAAwE;QACxE,sEAAsE;QACtE,oEAAoE;QACpE,gDAAgD;QAChD,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC;YAChE,QAAQ,EAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO;SAC7C,CAAC,CAAA;QAEF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,cAAc,EAAE,CAAA;IACxC,CAAC;IAEO,cAAc;QACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5E,MAAM,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,uBAAuB,CAC7E,IAAI,CAAC,oBAAoB,CAC1B,CAAA;QAED,MAAM,MAAM,GAA+B;YACzC,MAAM,EAAE,QAAQ;YAChB,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,CAAC,iBAAiB;YACvE,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,iBAAiB;YACrD,QAAQ,EAAE,IAAI;SACf,CAAA;QAED,yEAAyE;QACzE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,gCAAgC;QAChC,MAAM,oBAAoB,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,4BAA4B,EAAE;YAC1F,MAAM,EAAE,uBAAuB;YAC/B,UAAU,EAAE,2BAA2B;YACvC,MAAM,EAAE,uBAAuB;YAC/B,wBAAwB,EAAE,IAAI;YAC9B,0BAA0B,EAAE,IAAI;YAChC,mBAAmB,EAAE,UAAU,CAAC,wBAAwB,CAAC,IAAI,EAAE;YAC/D,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACrD,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE;SACtD,CAAC,CAAA;QAEF,MAAM,eAAe,GAA+B;YAClD,MAAM,EAAE,IAAI,OAAO,CAAC,WAAW,CAAC;gBAC9B,aAAa,EAAE,QAAQ;gBACvB,cAAc,EAAE,qBAAqB;gBACrC,+DAA+D;gBAC/D,+DAA+D;gBAC/D,4DAA4D;gBAC5D,gEAAgE;gBAChE,gEAAgE;gBAChE,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;aAChC,CAAC;YACF,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,CAAC,iBAAiB;YACvE,WAAW,EAAE,oBAAoB;SAClC,CAAA;QAED,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IACpC,CAAC;IAED,uIAAuI;IAChI,cAAc;QACnB,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED;;;;;;;;;OASG;IACI,iBAAiB,CAAC,OAAuB;QAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;QAEtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;QACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;QACzD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;QAEtD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;QACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;QAErD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;QACzD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;IACxD,CAAC;CACF"}

package/dist/constructs/cms-service.d.ts

@@ -24,7 +24,15 @@ export interface CanopyCmsServiceProps {
     spotMaxPrice?: string;
     /** Secrets Manager ARNs the worker needs to read (GitHub token, Clerk key) */
     secretsArns?: string[];
-    /** Environment variables for the Lambda function */
+    /**
+     * Environment variables for the Lambda function.
+     *
+     * Two keys are not free-form here, because the construct configures the
+     * worker from the same values and the two halves must agree:
+     * `CANOPYCMS_DEPLOYMENT_NAME` is folded into `deploymentName` (validated,
+     * and mirrored into the worker's `.env`), and `CANOPY_MODE` accepts only
+     * `'prod'`. Everything else is passed through untouched.
+     */
     environment?: Record<string, string>;
     /** EFS removal policy (default: RETAIN) */
     efsRemovalPolicy?: RemovalPolicy;
@@ -38,6 +46,30 @@ export interface CanopyCmsServiceProps {
     clerkSecretKeySecretArn?: string;
     /** Base branch name (default: 'main') */
     baseBranch?: string;
+    /**
+     * Deployment name (default: 'prod'). Namespaces the settings branch
+     * (`canopycms-settings-{deploymentName}`) so this stack's CMS Lambda/worker
+     * don't fight another CanopyCMS deployment over the same orphan settings
+     * branch. Stamped into the Lambda's `CANOPYCMS_DEPLOYMENT_NAME` environment
+     * variable and the worker's `.env`; both resolve it through
+     * `resolveDeploymentName` (packages/canopycms/src/operating-mode/deployment-name.ts),
+     * which lets this env value win over any `deploymentName` baked into the
+     * shared repo's `canopycms.config.ts` — the point of this prop.
+     *
+     * `environment.CANOPYCMS_DEPLOYMENT_NAME` still overrides this prop, but it
+     * is now folded in at synth: the winner is validated by the same rule and
+     * written to BOTH halves, so the Lambda and the worker can never resolve
+     * different settings branches.
+     *
+     * Two `CanopyCmsService` stacks pointed at the SAME GitHub repo MUST set
+     * distinct values here, or both resolve to `canopycms-settings-prod` and
+     * fight over the same branch (permissions/groups changes reviewed on one PR
+     * clobber the other). Changing this value later, on a stack that already
+     * has a populated settings workspace, is refused at boot (see
+     * settings-workspace.ts's rename guard) rather than silently reset — plan
+     * the value up front for any stack that shares a repo.
+     */
+    deploymentName?: string;
     /**
      * The asset bucket (from `AssetSupport`, or any bucket following its
      * prefix layout) the CMS Lambda's role should be granted access to. When
@@ -49,7 +81,7 @@ export interface CanopyCmsServiceProps {
     assetBucket?: IBucket;
     /**
      * Retention for the EC2 worker's CloudWatch log group (default: three
-     * months). Worker-only: the Lambdas keep their auto-created log groups.
+     * months).
      */
     workerLogRetention?: logs.RetentionDays;
     /**
@@ -59,6 +91,23 @@ export interface CanopyCmsServiceProps {
      * default name would collide).
      */
     workerLogGroupName?: string;
+    /**
+     * Retention for the CMS Lambda's CloudWatch log group (default: three
+     * months / 90 days).
+     */
+    cmsLogRetention?: logs.RetentionDays;
+    /**
+     * Name for the CMS Lambda's CloudWatch log group (default:
+     * `/canopycms/<stackName>/cms`). Deliberately NOT
+     * `/aws/lambda/<function-name>` - see the constructor's `cmsLogGroup`
+     * comment for why a CDK-managed group must avoid that exact name once the
+     * function has ever been deployed without one (CloudFormation's
+     * `CreateLogGroup` call fails "already exists" against a group Lambda
+     * itself auto-created outside CloudFormation). Override to follow an org
+     * naming convention, or when instantiating this construct twice in one
+     * stack (the default name would collide).
+     */
+    cmsLogGroupName?: string;
 }
 /**
  * Core CDK construct for CanopyCMS deployment.
@@ -68,12 +117,21 @@ export interface CanopyCmsServiceProps {
  * - EFS filesystem with access point at /workspace
  * - Lambda function (Docker image, EFS mount, private subnet, no internet)
  * - Lambda Function URL (for CloudFront origin)
- * - EC2 Worker (t4g.nano spot in ASG, public subnet, EFS mount, systemd)
- * - Dedicated CloudWatch log group for the worker's stdout/stderr, shipped
- *   via the amazon-cloudwatch-agent (journald is not agent-readable)
+ * - EC2 Worker (t4g.nano spot in ASG, public subnet, EFS mount, systemd) -
+ *   rolled on every deploy via the ASG's UpdatePolicy, so a changed worker
+ *   bundle actually reaches the instance instead of sitting unused in a
+ *   launch template until the next spot interruption (see the UpdatePolicy
+ *   below)
+ * - Dedicated CloudWatch log groups for the CMS Lambda and the worker's
+ *   stdout/stderr (the worker's is shipped via the amazon-cloudwatch-agent -
+ *   journald is not agent-readable), each with a custom name/retention/
+ *   removal policy instead of the CloudFormation-implicit
+ *   `/aws/lambda/<function-name>` group (infinite retention, survives
+ *   `cdk destroy`)
  * - Security groups (least-privilege)
- * - IAM roles (Lambda: EFS only; EC2: EFS + Secrets Manager + CloudWatch
- *   Logs write, scoped to its own log group)
+ * - IAM roles (Lambda: EFS + CloudWatch Logs write scoped to its own log
+ *   group; EC2: EFS + Secrets Manager + CloudWatch Logs write, scoped to its
+ *   own log group)
  */
 export declare class CanopyCmsService extends Construct {
     /** Lambda Function URL — use as CloudFront origin */
@@ -84,6 +142,8 @@ export declare class CanopyCmsService extends Construct {
     readonly vpc: ec2.IVpc;
     /** The Lambda function */
     readonly lambdaFunction: lambda.Function;
+    /** The CMS Lambda's CloudWatch log group (Lambda stdout/stderr) */
+    readonly cmsLogGroup: logs.LogGroup;
     /** The EC2 worker Auto Scaling Group */
     readonly workerAsg: autoscaling.AutoScalingGroup;
     /** The EC2 worker's CloudWatch log group (worker stdout/stderr) */

package/dist/constructs/cms-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cms-service.d.ts","sourceRoot":"","sources":["../../src/constructs/cms-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EACL,QAAQ,EACR,aAAa,EAEb,OAAO,IAAI,GAAG,EACd,OAAO,IAAI,GAAG,EAEd,UAAU,IAAI,MAAM,EACpB,eAAe,IAAI,WAAW,EAE9B,QAAQ,IAAI,IAAI,EACjB,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAWjD,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAC,eAAe,CAAA;IAEtC,4DAA4D;IAC5D,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAA;IAEd,0CAA0C;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,QAAQ,CAAA;IAElB,oDAAoD;IACpD,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAE5B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,YAAY,CAAA;IAElC,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IAEtB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEpC,2CAA2C;IAC3C,gBAAgB,CAAC,EAAE,aAAa,CAAA;IAEhC,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAA;IAEnB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAElB,mDAAmD;IACnD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B,mDAAmD;IACnD,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAEhC,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,IAAI,CAAC,aAAa,CAAA;IAEvC;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gBAAiB,SAAQ,SAAS;IAC7C,qDAAqD;IACrD,SAAgB,WAAW,EAAE,MAAM,CAAC,WAAW,CAAA;IAE/C,yBAAyB;IACzB,SAAgB,UAAU,EAAE,GAAG,CAAC,UAAU,CAAA;IAE1C,cAAc;IACd,SAAgB,GAAG,EAAE,GAAG,CAAC,IAAI,CAAA;IAE7B,0BAA0B;IAC1B,SAAgB,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAA;IAE/C,wCAAwC;IACxC,SAAgB,SAAS,EAAE,WAAW,CAAC,gBAAgB,CAAA;IAEvD,mEAAmE;IACnE,SAAgB,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAA;gBAEjC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB;CAgbvE"}
+{"version":3,"file":"cms-service.d.ts","sourceRoot":"","sources":["../../src/constructs/cms-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EACL,QAAQ,EACR,aAAa,EAEb,OAAO,IAAI,GAAG,EACd,OAAO,IAAI,GAAG,EAEd,UAAU,IAAI,MAAM,EACpB,eAAe,IAAI,WAAW,EAE9B,QAAQ,IAAI,IAAI,EACjB,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AA0EjD,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAC,eAAe,CAAA;IAEtC,4DAA4D;IAC5D,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAA;IAEd,0CAA0C;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,QAAQ,CAAA;IAElB,oDAAoD;IACpD,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAE5B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,YAAY,CAAA;IAElC,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IAEtB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEpC,2CAA2C;IAC3C,gBAAgB,CAAC,EAAE,aAAa,CAAA;IAEhC,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAA;IAEnB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAElB,mDAAmD;IACnD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B,mDAAmD;IACnD,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAEhC,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,IAAI,CAAC,aAAa,CAAA;IAEvC;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAE3B;;;OAGG;IACH,eAAe,CAAC,EAAE,IAAI,CAAC,aAAa,CAAA;IAEpC;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,gBAAiB,SAAQ,SAAS;IAC7C,qDAAqD;IACrD,SAAgB,WAAW,EAAE,MAAM,CAAC,WAAW,CAAA;IAE/C,yBAAyB;IACzB,SAAgB,UAAU,EAAE,GAAG,CAAC,UAAU,CAAA;IAE1C,cAAc;IACd,SAAgB,GAAG,EAAE,GAAG,CAAC,IAAI,CAAA;IAE7B,0BAA0B;IAC1B,SAAgB,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAA;IAE/C,mEAAmE;IACnE,SAAgB,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAA;IAE1C,wCAAwC;IACxC,SAAgB,SAAS,EAAE,WAAW,CAAC,gBAAgB,CAAA;IAEvD,mEAAmE;IACnE,SAAgB,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAA;gBAEjC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB;CAsnBvE"}