canopycms-cdk 0.0.61-int.75 → 0.0.62

package/dist/constructs/cms-service.js

@@ -10,6 +10,61 @@ import { Duration, RemovalPolicy, Stack, aws_ec2 as ec2, aws_efs as efs, aws_iam
 // SSR/CJS-interop transform shims `__dirname` automatically. Same fix as
 // ../../lambda/asset-transform/build.mjs and ./asset-support.ts.
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
+/**
+ * Synth-time mirror of `resolveDeploymentName`'s rule in the `canopycms`
+ * package (packages/canopycms/src/operating-mode/deployment-name.ts).
+ * Duplicated rather than imported: `canopycms-cdk` publishes with no runtime
+ * dependency on `canopycms` (it is a devDependency, used only to bundle the
+ * worker), so importing it here would break the published construct.
+ *
+ * Drift between the two copies is caught by a test, not by this comment:
+ * cms-deploy.test.ts drives both this construct and the runtime predicate over
+ * the shared fixture in
+ * packages/canopycms/src/operating-mode/deployment-name-fixtures.ts and
+ * requires them to agree. Add a case there when you change either copy.
+ */
+const isValidDeploymentName = (name) => /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name) &&
+    !name.includes('..') &&
+    !name.endsWith('.') &&
+    !name.endsWith('.lock');
+/**
+ * The heredoc delimiter user-data uses to write the worker's `.env` (see the
+ * `cat > … << 'ENVEOF'` block below).
+ */
+const ENV_HEREDOC_DELIMITER = 'ENVEOF';
+/**
+ * Guard every value interpolated into the worker's `.env` file.
+ *
+ * This is robustness, not a security boundary: the heredoc delimiter is
+ * quoted, so the shell performs no expansion on the body, and these values
+ * come from the adopter's own CDK code rather than from an attacker. What it
+ * catches is a malformed value silently producing a broken instance — a value
+ * carrying a newline injects an arbitrary extra line into the worker's
+ * environment, and a value containing the delimiter ends the heredoc early, so
+ * the rest of the value is executed as user-data shell commands. Both would
+ * deploy clean and fail at boot, or worse, boot with a subtly wrong
+ * environment.
+ *
+ * Applied to every entry in `envEntries` below by construction rather than by
+ * remembering to call it — the previous version validated `deploymentName`
+ * only, while giving a rationale that applied verbatim to the other three
+ * interpolated values.
+ *
+ * Returns the value so it can be used inline.
+ */
+function assertEnvSafe(name, value) {
+    if (/[\r\n]/.test(value)) {
+        throw new Error(`CanopyCmsService: ${name} must not contain a newline (got ${JSON.stringify(value)}). ` +
+            `It is written into the worker's .env file, where a newline injects an arbitrary ` +
+            `extra environment line.`);
+    }
+    if (value.includes(ENV_HEREDOC_DELIMITER)) {
+        throw new Error(`CanopyCmsService: ${name} must not contain ${JSON.stringify(ENV_HEREDOC_DELIMITER)} ` +
+            `(got ${JSON.stringify(value)}). It is written into the worker's .env file with a ` +
+            `<< '${ENV_HEREDOC_DELIMITER}' heredoc, which that value would terminate early.`);
+    }
+    return value;
+}
 /**
  * Core CDK construct for CanopyCMS deployment.
  *
@@ -18,16 +73,86 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
  * - EFS filesystem with access point at /workspace
  * - Lambda function (Docker image, EFS mount, private subnet, no internet)
  * - Lambda Function URL (for CloudFront origin)
- * - EC2 Worker (t4g.nano spot in ASG, public subnet, EFS mount, systemd)
- * - Dedicated CloudWatch log group for the worker's stdout/stderr, shipped
- *   via the amazon-cloudwatch-agent (journald is not agent-readable)
+ * - EC2 Worker (t4g.nano spot in ASG, public subnet, EFS mount, systemd) -
+ *   rolled on every deploy via the ASG's UpdatePolicy, so a changed worker
+ *   bundle actually reaches the instance instead of sitting unused in a
+ *   launch template until the next spot interruption (see the UpdatePolicy
+ *   below)
+ * - Dedicated CloudWatch log groups for the CMS Lambda and the worker's
+ *   stdout/stderr (the worker's is shipped via the amazon-cloudwatch-agent -
+ *   journald is not agent-readable), each with a custom name/retention/
+ *   removal policy instead of the CloudFormation-implicit
+ *   `/aws/lambda/<function-name>` group (infinite retention, survives
+ *   `cdk destroy`)
  * - Security groups (least-privilege)
- * - IAM roles (Lambda: EFS only; EC2: EFS + Secrets Manager + CloudWatch
- *   Logs write, scoped to its own log group)
+ * - IAM roles (Lambda: EFS + CloudWatch Logs write scoped to its own log
+ *   group; EC2: EFS + Secrets Manager + CloudWatch Logs write, scoped to its
+ *   own log group)
  */
 export class CanopyCmsService extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
+        // ------------------------------------------------------------------
+        // Deployment name: ONE effective value, validated once, used by both halves
+        // ------------------------------------------------------------------
+        //
+        // `props.environment` is spread into the Lambda's environment, so an
+        // adopter can set CANOPYCMS_DEPLOYMENT_NAME there directly. That escape
+        // hatch used to bypass both things that make this prop safe: the synth
+        // guard below (an invalid value deployed clean and crash-looped the Lambda
+        // at boot) and the worker, which kept reading `props.deploymentName` and so
+        // resolved a DIFFERENT settings branch than the Lambda — exactly the split
+        // that `pushSettingsBranches`'s [SYNC-M3] warning was added to detect.
+        //
+        // Kept rather than dropped (dropping is a breaking change for anyone
+        // already setting it), but resolved to a single value here: whatever wins
+        // is validated, and the same string is stamped on the Lambda AND written
+        // into the worker's `.env` below. The two halves cannot disagree.
+        const envDeploymentNameOverride = props.environment?.['CANOPYCMS_DEPLOYMENT_NAME'];
+        const deploymentName = envDeploymentNameOverride ?? props.deploymentName ?? 'prod';
+        const deploymentNameSource = envDeploymentNameOverride !== undefined
+            ? 'environment.CANOPYCMS_DEPLOYMENT_NAME'
+            : 'deploymentName';
+        // Fail at synth, not at boot. deploymentName is interpolated BOTH into a
+        // git ref (`canopycms-settings-{deploymentName}`) and into a line of the
+        // worker's `.env`, which user-data writes with a shell heredoc — a value
+        // carrying a newline or quote would corrupt the worker's environment file
+        // before any runtime validation could run. Mirrors the package-side rule
+        // in operating-mode/deployment-name.ts (resolveDeploymentName); the
+        // fixture-driven drift test named above keeps the two in step.
+        if (!isValidDeploymentName(deploymentName)) {
+            throw new Error(`CanopyCmsService: invalid deploymentName ${JSON.stringify(deploymentName)} ` +
+                `(from ${deploymentNameSource}). ` +
+                `It must start with a letter or digit, contain only letters, digits, '.', '_' or '-', ` +
+                `and must not contain '..' or end with '.' or '.lock'.`);
+        }
+        // ------------------------------------------------------------------
+        // Operating mode
+        // ------------------------------------------------------------------
+        //
+        // The adopter's `canopycms.config.ts` is shared by local dev, the image
+        // build and this deployment, and it must say `dev` for the first two (a
+        // prod-mode `next build` would try to open an EFS branch workspace that
+        // cannot exist in an image builder). So the deployed mode is supplied
+        // here, at run time: `resolveOperatingMode`
+        // (packages/canopycms/src/operating-mode/mode-env.ts) reads CANOPY_MODE
+        // and it wins over the config literal. Without it the Lambda runs dev
+        // mode, resolves its workspace to `<cwd>/.canopy-dev`, and fails EROFS on
+        // Lambda's read-only filesystem.
+        //
+        // Only 'prod' is accepted from `props.environment`: this construct deploys
+        // the prod topology (EFS workspace, no internet, read-only container), and
+        // 'dev' there cannot work — better a synth error than an EROFS crash-loop.
+        // The browser half of `mode` cannot come from here at all; it is inlined
+        // at image-build time from the NEXT_PUBLIC_CANOPY_MODE build arg (see
+        // Dockerfile.cms.template and the generated cms-stack.ts).
+        const envModeOverride = props.environment?.['CANOPY_MODE'];
+        if (envModeOverride !== undefined && envModeOverride !== 'prod') {
+            throw new Error(`CanopyCmsService: invalid environment.CANOPY_MODE ${JSON.stringify(envModeOverride)}. ` +
+                `This construct deploys the prod topology, so the only supported value is "prod" ` +
+                `(dev mode resolves its workspace to <cwd>/.canopy-dev, which is read-only on Lambda). ` +
+                `Omit it to get the default.`);
+        }
         // ========================================================================
         // VPC — 2 AZs, public + private subnets, NO NAT
         // ========================================================================
@@ -117,6 +242,22 @@ export class CanopyCmsService extends Construct {
         // region-agnostic way to reference the S3 managed prefix list lands in
         // CDK, or if this VPC ever gains a NAT/IGW route.
         lambdaSg.addEgressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(443), 'HTTPS to S3 (via gateway endpoint)');
+        // Dedicated CloudWatch log group for the CMS Lambda's stdout/stderr.
+        // Custom name (NOT the CloudFormation-implicit `/aws/lambda/<function
+        // name>`), for two reasons: (1) CDK does not manage that implicit group
+        // at all - infinite retention, and `cdk destroy` leaves it behind (the
+        // deploy-test teardown had to sweep it manually); (2) Lambda auto-creates
+        // `/aws/lambda/<function name>` on first invoke, OUTSIDE CloudFormation -
+        // once that has happened (e.g. this stack was already deployed before
+        // this log group existed), a CDK `LogGroup` construct using that exact
+        // name would fail its `CreateLogGroup` call with "already exists" and
+        // block every future `cdk deploy`. Mirrors `workerLogGroup` below, which
+        // predates this and already follows the same convention.
+        this.cmsLogGroup = new logs.LogGroup(this, 'CmsFunctionLogs', {
+            logGroupName: props.cmsLogGroupName ?? `/canopycms/${Stack.of(this).stackName}/cms`,
+            retention: props.cmsLogRetention ?? logs.RetentionDays.THREE_MONTHS,
+            removalPolicy: RemovalPolicy.DESTROY,
+        });
         this.lambdaFunction = new lambda.DockerImageFunction(this, 'CmsFunction', {
             code: props.cmsDockerImage,
             memorySize: props.memorySize ?? 2048,
@@ -127,6 +268,11 @@ export class CanopyCmsService extends Construct {
             vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
             securityGroups: [lambdaSg],
             filesystem: lambda.FileSystem.fromEfsAccessPoint(accessPoint, '/mnt/efs'),
+            // Pass the pre-created group via `logGroup`, NOT `logRetention` (CDK
+            // throws LogRetentionLogGroupConflict/ConflictingLogPolicyOptions if
+            // both are set on the same function) - the removal policy lives on the
+            // LogGroup construct above instead.
+            logGroup: this.cmsLogGroup,
             environment: {
                 // INVARIANT (B1): the Lambda mounts EFS through the WorkspaceAP access
                 // point above, which is already rooted at EFS:/workspace - so /mnt/efs
@@ -143,8 +289,30 @@ export class CanopyCmsService extends Construct {
                 // the image: Dockerfile.cms.template runs
                 // `git config --system safe.directory '*'`.
                 ...props.environment,
+                // AFTER the spread, deliberately. Both values are already the
+                // adopter's own choice (an `environment` override is folded into
+                // `deploymentName` above and validated; CANOPY_MODE is restricted to
+                // 'prod'), so nothing is being taken away here - what the placement
+                // buys is that the Lambda and the worker's `.env` cannot end up
+                // holding different strings, which is the failure mode that made this
+                // an escape hatch worth fixing rather than a harmless one.
+                CANOPYCMS_DEPLOYMENT_NAME: deploymentName,
+                CANOPY_MODE: 'prod',
             },
         });
+        // Explicit, scoped grant - NOT a reliance on the auto-created execution
+        // role's AWSLambdaBasicExecutionRole managed policy (attached by CDK's
+        // lambda.Function/DockerImageFunction regardless of `logGroup`, and
+        // never adjusted for it - passing `logGroup` only points the function's
+        // LoggingConfig at this group, it grants no IAM permissions). That
+        // managed policy's logs:CreateLogStream/logs:PutLogEvents statement is
+        // scoped to `arn:aws:logs:*:*:log-group:/aws/lambda/*:*` only (its
+        // logs:CreateLogGroup statement is the sole one that's unrestricted) -
+        // it grants nothing for a custom-named group like this one. Without this
+        // grantWrite, the function would still create log streams to the void:
+        // CloudWatch Logs delivery failures are never surfaced to the function's
+        // own invocation, so logs would simply vanish with no error anywhere.
+        this.cmsLogGroup.grantWrite(this.lambdaFunction);
         // Function URL for CloudFront origin.
         // AWS_IAM (not NONE): the URL must only be reachable through CloudFront,
         // which signs origin requests via Origin Access Control (see
@@ -229,27 +397,53 @@ export class CanopyCmsService extends Construct {
             path: path.join(__dirname, '../../worker/dist'),
         });
         workerAsset.grantRead(workerRole);
-        // Build worker .env file content from CDK props
-        const envLines = [
-            `CANOPYCMS_WORKSPACE_ROOT=/mnt/efs/workspace`,
-            `CANOPYCMS_GITHUB_OWNER=${props.githubOwner}`,
-            `CANOPYCMS_GITHUB_REPO=${props.githubRepo}`,
-            `CANOPYCMS_BASE_BRANCH=${props.baseBranch ?? 'main'}`,
+        // Build worker .env file content from CDK props.
+        //
+        // Name/value PAIRS rather than pre-formatted lines: every value then flows
+        // through `assertEnvSafe` in the single `map` below, so a value added here
+        // later is guarded whether or not whoever adds it remembers to.
+        const envEntries = [
+            ['CANOPYCMS_WORKSPACE_ROOT', '/mnt/efs/workspace'],
+            ['CANOPYCMS_GITHUB_OWNER', props.githubOwner],
+            ['CANOPYCMS_GITHUB_REPO', props.githubRepo],
+            ['CANOPYCMS_BASE_BRANCH', props.baseBranch ?? 'main'],
+            // The SAME string the Lambda's environment gets above, including an
+            // `environment.CANOPYCMS_DEPLOYMENT_NAME` override - the two halves
+            // resolve one settings branch (`canopycms-settings-<name>`) between them,
+            // and disagreeing here is what [SYNC-M3] warns about at runtime.
+            ['CANOPYCMS_DEPLOYMENT_NAME', deploymentName],
             // B8: the AWS SDK JS v3 cannot resolve a region from IMDS on its own -
             // without this the worker's bare `SecretsManagerClient({})` crash-loops
             // with "Region is missing".
-            `AWS_REGION=${Stack.of(this).region}`,
+            ['AWS_REGION', Stack.of(this).region],
         ];
         if (props.githubTokenSecretArn) {
-            envLines.push(`CANOPYCMS_GITHUB_TOKEN_SECRET_ARN=${props.githubTokenSecretArn}`);
+            envEntries.push(['CANOPYCMS_GITHUB_TOKEN_SECRET_ARN', props.githubTokenSecretArn]);
         }
         if (props.clerkSecretKeySecretArn) {
-            envLines.push(`CLERK_SECRET_KEY_SECRET_ARN=${props.clerkSecretKeySecretArn}`);
+            envEntries.push(['CLERK_SECRET_KEY_SECRET_ARN', props.clerkSecretKeySecretArn]);
         }
-        const envFileContent = envLines.join('\n');
+        const envFileContent = envEntries
+            .map(([name, value]) => `${name}=${assertEnvSafe(name, value)}`)
+            .join('\n');
         // UserData script
         const userData = ec2.UserData.forLinux();
-        userData.addCommands('#!/bin/bash', 'set -euo pipefail', '', '# Install dependencies (unzip is not guaranteed in the AL2023 AMI)', 'yum install -y git unzip', 'curl -fsSL https://rpm.nodesource.com/setup_20.x | bash -', 'yum install -y nodejs', '', '# Mount EFS', 'yum install -y amazon-efs-utils', 'mkdir -p /mnt/efs', `mount -t efs ${this.fileSystem.fileSystemId}:/ /mnt/efs`, '# Persist the mount across instance reboots: user-data runs once per', '# instance, so without an fstab entry a plain reboot leaves /mnt/efs an', '# empty local dir and the worker would clone a divergent remote.git', '# onto the instance disk, invisible to the Lambda.', `echo '${this.fileSystem.fileSystemId}:/ /mnt/efs efs _netdev 0 0' >> /etc/fstab`, '', '# Download worker from CDK S3 Asset', `aws s3 cp s3://${workerAsset.s3BucketName}/${workerAsset.s3ObjectKey} /tmp/canopy-worker.zip`, 'mkdir -p /opt/canopy-worker', 'cd /opt/canopy-worker', 'unzip -o /tmp/canopy-worker.zip', '# The worker bundle is ESM (esbuild --format=esm). Node 20 treats .js as', '# CommonJS without this marker and crash-loops on the import statement', '# (Node >=22.7 auto-detects and masks the bug locally).', `echo '{"type":"module"}' > /opt/canopy-worker/package.json`, '', '# Write environment file for systemd service', `cat > /opt/canopy-worker/.env << 'ENVEOF'`, envFileContent, 'ENVEOF', '', '# Create systemd service', `cat > /etc/systemd/system/canopy-worker.service << 'SVCEOF'`, '[Unit]', 'Description=CanopyCMS Worker Daemon', 'After=network.target', '# Never run against an unmounted /mnt/efs (see the fstab note above).', 'RequiresMountsFor=/mnt/efs', '', '[Service]', 'Type=simple', 'User=ec2-user', 'WorkingDirectory=/opt/canopy-worker', 'ExecStart=/usr/bin/node index.js', 'Restart=always', 'RestartSec=5', 'TimeoutStartSec=300', '# File output, not journal: the CloudWatch agent cannot read journald,', '# so it tails this file instead (see the agent config below).', '# CAUTION: /var/log/canopy-worker must exist BEFORE first start. systemd', '# opens append: targets before it creates LogsDirectory= dirs', '# (systemd#27591), so without the pre-created dir the exec fails with', '# 209/STDOUT and Restart=always crash-loops forever. User-data runs', '# mkdir before systemctl start; LogsDirectory= is kept for ownership.', 'LogsDirectory=canopy-worker', 'StandardOutput=append:/var/log/canopy-worker/worker.log', 'StandardError=append:/var/log/canopy-worker/worker.log', 'EnvironmentFile=/opt/canopy-worker/.env', '', '[Install]', 'WantedBy=multi-user.target', 'SVCEOF', '', '# Set ownership for ec2-user', 'chown -R ec2-user:ec2-user /opt/canopy-worker', '# Non-recursive: EFS access point enforces UID 1000 for Lambda.', '# Only set ownership on mount point and workspace dir to avoid', '# slow recursive chown on large filesystems during ASG replacements.', 'chown ec2-user:ec2-user /mnt/efs', 'mkdir -p /mnt/efs/workspace', 'chown ec2-user:ec2-user /mnt/efs/workspace', '', '# Pre-create the worker log dir (crash-loop guard, MUST precede the', '# first systemctl start): systemd opens StandardOutput=append: files', '# BEFORE it creates LogsDirectory= dirs (systemd#27591), so on a fresh', '# instance the unit would fail exec with 209/STDOUT and crash-loop', '# forever without this. The unit keeps LogsDirectory= for ownership', '# management on subsequent starts.', 'mkdir -p /var/log/canopy-worker', 'chown ec2-user:ec2-user /var/log/canopy-worker', '', '# Start worker', 'systemctl daemon-reload', 'systemctl enable canopy-worker', 'systemctl start canopy-worker', '', '# ---- CloudWatch log shipping ----', '# Placed AFTER worker start: with set -euo pipefail, a yum/agent failure', '# here must not prevent the worker from running (shipping is best-effort).', 'yum install -y amazon-cloudwatch-agent logrotate', '', '# Bound on-disk growth; copytruncate keeps the fd the CW agent tails valid', '# (tiny copy->truncate loss window is acceptable for diagnostic logs).', `cat > /etc/logrotate.d/canopy-worker << 'ROTEOF'`, '/var/log/canopy-worker/worker.log {', '    size 10M', '    rotate 5', '    compress', '    copytruncate', '    missingok', '    notifempty', '}', 'ROTEOF', '# The config above only fires when logrotate actually runs; AL2023', '# presets may leave logrotate.timer disabled, and without it the size', '# cap never triggers and worker.log grows until the nano disk fills.', '# --now is idempotent if the timer is already enabled/running.', 'systemctl enable --now logrotate.timer', '', '# No retention_in_days here: CDK owns retention on the pre-created group.', `cat > /opt/aws/amazon-cloudwatch-agent/etc/canopy-worker-logs.json << 'CWEOF'`, '{', '  "logs": {', '    "logs_collected": {', '      "files": {', '        "collect_list": [', '          {', '            "file_path": "/var/log/canopy-worker/worker.log",', `            "log_group_name": "${this.workerLogGroup.logGroupName}",`, '            "log_stream_name": "{instance_id}"', '          }', '        ]', '      }', '    }', '  }', '}', 'CWEOF', '# fetch-config -s starts AND systemctl-enables the agent (reboot-persistent).', '/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c file:/opt/aws/amazon-cloudwatch-agent/etc/canopy-worker-logs.json');
+        userData.addCommands('#!/bin/bash', 'set -euo pipefail', '', '# Install dependencies (unzip is not guaranteed in the AL2023 AMI)', 'yum install -y git unzip', 'curl -fsSL https://rpm.nodesource.com/setup_20.x | bash -', 'yum install -y nodejs', '', '# Mount EFS', 'yum install -y amazon-efs-utils', 'mkdir -p /mnt/efs', `mount -t efs ${this.fileSystem.fileSystemId}:/ /mnt/efs`, '# Persist the mount across instance reboots: user-data runs once per', '# instance, so without an fstab entry a plain reboot leaves /mnt/efs an', '# empty local dir and the worker would clone a divergent remote.git', '# onto the instance disk, invisible to the Lambda.', `echo '${this.fileSystem.fileSystemId}:/ /mnt/efs efs _netdev 0 0' >> /etc/fstab`, '', '# Download worker from CDK S3 Asset', `aws s3 cp s3://${workerAsset.s3BucketName}/${workerAsset.s3ObjectKey} /tmp/canopy-worker.zip`, 'mkdir -p /opt/canopy-worker', 'cd /opt/canopy-worker', 'unzip -o /tmp/canopy-worker.zip', '# The worker bundle is ESM (esbuild --format=esm). Node 20 treats .js as', '# CommonJS without this marker and crash-loops on the import statement', '# (Node >=22.7 auto-detects and masks the bug locally).', `echo '{"type":"module"}' > /opt/canopy-worker/package.json`, '', '# Write environment file for systemd service', `cat > /opt/canopy-worker/.env << 'ENVEOF'`, envFileContent, 'ENVEOF', '', '# Create systemd service', `cat > /etc/systemd/system/canopy-worker.service << 'SVCEOF'`, '[Unit]', 'Description=CanopyCMS Worker Daemon', 'After=network.target', '# Never run against an unmounted /mnt/efs (see the fstab note above).', 'RequiresMountsFor=/mnt/efs', '', '[Service]', 'Type=simple', 'User=ec2-user', 'WorkingDirectory=/opt/canopy-worker', 'ExecStart=/usr/bin/node index.js', 'Restart=always', 'RestartSec=5', 'TimeoutStartSec=300', '# File output, not journal: the CloudWatch agent cannot read journald,', '# so it tails this file instead (see the agent config below).', '# CAUTION: /var/log/canopy-worker must exist BEFORE first start. systemd', '# opens append: targets before it creates LogsDirectory= dirs', '# (systemd#27591), so without the pre-created dir the exec fails with', '# 209/STDOUT and Restart=always crash-loops forever. User-data runs', '# mkdir before systemctl start; LogsDirectory= is kept for ownership.', 'LogsDirectory=canopy-worker', 'StandardOutput=append:/var/log/canopy-worker/worker.log', 'StandardError=append:/var/log/canopy-worker/worker.log', 'EnvironmentFile=/opt/canopy-worker/.env', '', '[Install]', 'WantedBy=multi-user.target', 'SVCEOF', '', '# Set ownership for ec2-user', 'chown -R ec2-user:ec2-user /opt/canopy-worker', '# Non-recursive: EFS access point enforces UID 1000 for Lambda.', '# Only set ownership on mount point and workspace dir to avoid', '# slow recursive chown on large filesystems during ASG replacements.', 'chown ec2-user:ec2-user /mnt/efs', 'mkdir -p /mnt/efs/workspace', 'chown ec2-user:ec2-user /mnt/efs/workspace', '', '# Pre-create the worker log dir (crash-loop guard, MUST precede the', '# first systemctl start): systemd opens StandardOutput=append: files', '# BEFORE it creates LogsDirectory= dirs (systemd#27591), so on a fresh', '# instance the unit would fail exec with 209/STDOUT and crash-loop', '# forever without this. The unit keeps LogsDirectory= for ownership', '# management on subsequent starts.', 'mkdir -p /var/log/canopy-worker', 'chown ec2-user:ec2-user /var/log/canopy-worker', '', '# Start worker', 'systemctl daemon-reload', 'systemctl enable canopy-worker', 'systemctl start canopy-worker', '', '# ---- CloudWatch log shipping ----', '# Placed AFTER worker start: with set -euo pipefail, a yum/agent failure', '# here must not prevent the worker from running (shipping is best-effort).', 'yum install -y amazon-cloudwatch-agent logrotate', '', '# Bound on-disk growth; copytruncate keeps the fd the CW agent tails valid', '# (tiny copy->truncate loss window is acceptable for diagnostic logs).', `cat > /etc/logrotate.d/canopy-worker << 'ROTEOF'`, '/var/log/canopy-worker/worker.log {', '    size 10M', '    rotate 5', '    compress', '    copytruncate', '    missingok', '    notifempty', '}', 'ROTEOF', '# The config above only fires when logrotate actually runs; AL2023', '# presets may leave logrotate.timer disabled, and without it the size', '# cap never triggers and worker.log grows until the nano disk fills.', '# --now is idempotent if the timer is already enabled/running.', 'systemctl enable --now logrotate.timer', '', '# No retention_in_days here: CDK owns retention on the pre-created group.', `cat > /opt/aws/amazon-cloudwatch-agent/etc/canopy-worker-logs.json << 'CWEOF'`, '{', '  "logs": {', '    "logs_collected": {', '      "files": {', '        "collect_list": [', '          {', '            "file_path": "/var/log/canopy-worker/worker.log",', `            "log_group_name": "${this.workerLogGroup.logGroupName}",`, '            "log_stream_name": "{instance_id}",', 
+        // The worker prefixes every line with an ISO-8601 timestamp
+        // (packages/canopycms/src/worker/log.ts). Parsing it here is what makes
+        // CloudWatch show the time the WORKER emitted a line rather than the
+        // time the agent shipped it - those diverge exactly when it matters
+        // (agent hiccup, buffered burst, post-restart backlog).
+        '            "timestamp_format": "%Y-%m-%dT%H:%M:%S.%f",', 
+        // The prefix ends in `Z`, so the parsed time is UTC. Without this the
+        // agent would interpret it in the instance's local zone.
+        '            "timezone": "UTC",', 
+        // "{timestamp_format}" reuses the pattern above as the multi-line start
+        // marker: a line WITHOUT the timestamp prefix continues the previous
+        // event instead of becoming its own. That is what keeps a stack trace as
+        // one CloudWatch event, and why every writer to this file must go
+        // through the worker log helpers.
+        '            "multi_line_start_pattern": "{timestamp_format}"', '          }', '        ]', '      }', '    }', '  }', '}', 'CWEOF', '# fetch-config -s starts AND systemctl-enables the agent (reboot-persistent).', '/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c file:/opt/aws/amazon-cloudwatch-agent/etc/canopy-worker-logs.json');
         // Launch template (not the deprecated AutoScalingGroup instanceType/
         // machineImage/... shorthand): that shorthand synthesizes an
         // AWS::AutoScaling::LaunchConfiguration, which AWS accounts created after
@@ -279,7 +473,64 @@ export class CanopyCmsService extends Construct {
             healthCheck: autoscaling.HealthCheck.ec2({
                 grace: Duration.minutes(5),
             }),
+            // Without an updatePolicy, CloudFormation's default behavior for an ASG
+            // behind a changed launch template is to update the template resource
+            // and do NOTHING else - the running instance keeps its old user-data
+            // (and therefore the old worker code: the worker bundle is a CDK S3
+            // asset whose hash is interpolated into user-data's `aws s3 cp
+            // s3://...`) until a spot interruption or a manual terminate happens
+            // to replace it. `cdk deploy` would then silently deploy everything
+            // EXCEPT the worker. `rollingUpdate` makes CloudFormation actually
+            // terminate-and-relaunch the instance on every deploy that changes the
+            // launch template, so a worker code change actually reaches it.
+            //
+            // minInstancesInService: 0 is REQUIRED, not just accepted, because
+            // minCapacity/maxCapacity are both 1: there is no way to keep an
+            // instance "in service" out of a max of 1 while its replacement is
+            // being created. The update is therefore terminate-then-relaunch, with
+            // a short worker outage while the replacement boots (yum install
+            // git/unzip/nodejs/efs-utils, mount EFS - realistically 2-4 minutes).
+            // That outage is acceptable: the task queue and branch workspaces live
+            // on EFS, not on the instance, so the new instance picks up exactly
+            // where the old one left off; the Lambda's Save/Publish paths only
+            // enqueue task files onto EFS and never talk to the worker directly,
+            // so they are unaffected by the worker being briefly down. A task that
+            // was actually mid-flight when the old instance was terminated is
+            // handled by orphan recovery now running on every task-queue cycle,
+            // not only at worker boot (see recoverOrphanedTasks's call site in
+            // CmsWorker.processTaskQueue(), packages/canopycms/src/worker/cms-worker.ts).
+            //
+            // Deliberately NOT paired with a `signals`/cfn-signal setup (and
+            // `waitOnResourceSignals` therefore defaults to false here, so this
+            // rolling update does not wait on one): see the comment below.
+            updatePolicy: autoscaling.UpdatePolicy.rollingUpdate({ minInstancesInService: 0 }),
         });
+        // Why this PR does NOT add cfn-signal, despite the rolling update above
+        // now making instance replacement routine instead of rare:
+        //
+        // 1. User-data runs under `set -euo pipefail`, and the CloudWatch-agent
+        //    block is placed at the very end ON PURPOSE (see that block's own
+        //    comment) so an agent failure there cannot kill the boot. A
+        //    cfn-signal placed after it would then never run when that block
+        //    fails, and CloudFormation would wait out its own timeout and
+        //    fail/roll back the ENTIRE deploy - the opposite of the intent
+        //    (agent shipping is best-effort; the worker itself must not be
+        //    blocked by it).
+        // 2. Even placed earlier (right after `systemctl start canopy-worker`),
+        //    a signal there would prove almost nothing: the systemd unit is
+        //    `Type=simple` with `Restart=always`, so `systemctl start` returns 0
+        //    the instant the process execs, regardless of what happens next. A
+        //    worker that immediately crash-loops (bad env, bad bundle) would
+        //    still signal SUCCESS. A real readiness gate would have to poll
+        //    `worker-status.json` or `systemctl is-active` in a loop before
+        //    signaling - a bigger change than this PR should carry.
+        //
+        // recoverOrphanedTasks()'s per-cycle recovery (see above) is the
+        // intentionally simpler fix for the actual problem (a stranded task
+        // surviving an instance replacement) - it works regardless of WHY the
+        // instance was replaced (rolling update, spot interruption, manual
+        // terminate) and does not depend on the new instance ever proving
+        // "ready" in the first place.
         // Boot ordering: the ASG can launch before EFS mount targets are
         // available; user-data runs with `set -euo pipefail`, so an early
         // `mount -t efs` failure kills the whole bootstrap and the

package/dist/constructs/cms-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"cms-service.js","sourceRoot":"","sources":["../../src/constructs/cms-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EACL,QAAQ,EACR,aAAa,EACb,KAAK,EACL,OAAO,IAAI,GAAG,EACd,OAAO,IAAI,GAAG,EACd,OAAO,IAAI,GAAG,EACd,UAAU,IAAI,MAAM,EACpB,eAAe,IAAI,WAAW,EAC9B,aAAa,IAAI,QAAQ,EACzB,QAAQ,IAAI,IAAI,GACjB,MAAM,aAAa,CAAA;AAGpB,wEAAwE;AACxE,sEAAsE;AACtE,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,yEAAyE;AACzE,iEAAiE;AACjE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AA+E9D;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,gBAAiB,SAAQ,SAAS;IAmB7C,YAAY,KAAgB,EAAE,EAAU,EAAE,KAA4B;QACpE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAEhB,2EAA2E;QAC3E,gDAAgD;QAChD,2EAA2E;QAE3E,IAAI,CAAC,GAAG;YACN,KAAK,CAAC,GAAG;gBACT,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;oBACvB,MAAM,EAAE,CAAC;oBACT,WAAW,EAAE,CAAC,EAAE,yCAAyC;oBACzD,mBAAmB,EAAE;wBACnB;4BACE,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM;4BACjC,QAAQ,EAAE,EAAE;yBACb;wBACD;4BACE,IAAI,EAAE,SAAS;4BACf,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,gBAAgB;4BAC3C,QAAQ,EAAE,EAAE;yBACb;qBACF;iBACF,CAAC,CAAA;QAEJ,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,0EAA0E;QAC1E,yEAAyE;QACzE,+BAA+B;QAC/B,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,EAAE;YACxC,OAAO,EAAE,GAAG,CAAC,4BAA4B,CAAC,EAAE;SAC7C,CAAC,CAAA;QAEF,2EAA2E;QAC3E,4DAA4D;QAC5D,2EAA2E;QAE3E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE;YACjD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,eAAe;YAC5B,gBAAgB,EAAE,KAAK;SACxB,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE;YACvD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,SAAS,EAAE,IAAI;YACf,eAAe,EAAE,GAAG,CAAC,eAAe,CAAC,eAAe;YACpD,aAAa,EAAE,KAAK,CAAC,gBAAgB,IAAI,aAAa,CAAC,MAAM;YAC7D,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,gBAAgB,EAAE;YAC3D,aAAa,EAAE,KAAK;SACrB,CAAC,CAAA;QAEF,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,aAAa,EAAE;YAChE,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE;gBACT,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,KAAK;aACnB;YACD,SAAS,EAAE;gBACT,GAAG,EAAE,MAAM;gBACX,GAAG,EAAE,MAAM;aACZ;SACF,CAAC,CAAA;QAEF,2EAA2E;QAC3E,2DAA2D;QAC3D,2EAA2E;QAE3E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE;YACvD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,kBAAkB;YAC/B,gBAAgB,EAAE,KAAK,EAAE,qBAAqB;SAC/C,CAAC,CAAA;QAEF,0DAA0D;QAC1D,2EAA2E;QAC3E,wEAAwE;QACxE,qEAAqE;QACrE,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC,CAAA;QACvE,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAA;QAE/D,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,+DAA+D;QAC/D,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,sEAAsE;QACtE,iEAAiE;QACjE,iEAAiE;QACjE,uEAAuE;QACvE,kDAAkD;QAClD,QAAQ,CAAC,aAAa,CACpB,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAClB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EACjB,oCAAoC,CACrC,CAAA;QAED,IAAI,CAAC,cAAc,GAAG,IAAI,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,aAAa,EAAE;YACxE,IAAI,EAAE,KAAK,CAAC,cAAc;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9C,4BAA4B,EAAE,KAAK,CAAC,mBAAmB,IAAI,EAAE;YAC7D,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,gBAAgB,EAAE;YAC3D,cAAc,EAAE,CAAC,QAAQ,CAAC;YAC1B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,WAAW,EAAE,UAAU,CAAC;YACzE,WAAW,EAAE;gBACX,uEAAuE;gBACvE,uEAAuE;gBACvE,uEAAuE;gBACvE,uEAAuE;gBACvE,qEAAqE;gBACrE,sEAAsE;gBACtE,wBAAwB,EAAE,UAAU;gBACpC,sBAAsB,EAAE,iBAAiB;gBACzC,iEAAiE;gBACjE,qEAAqE;gBACrE,6DAA6D;gBAC7D,sEAAsE;gBACtE,0CAA0C;gBAC1C,4CAA4C;gBAC5C,GAAG,KAAK,CAAC,WAAW;aACrB;SACF,CAAC,CAAA;QAEF,sCAAsC;QACtC,yEAAyE;QACzE,6DAA6D;QAC7D,4EAA4E;QAC5E,qEAAqE;QACrE,0EAA0E;QAC1E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC;YACpD,QAAQ,EAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO;SAC7C,CAAC,CAAA;QAEF,yEAAyE;QACzE,8EAA8E;QAC9E,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,sBAAsB;QACtB,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG;gBACf,OAAO,EAAE,eAAe;gBACxB,SAAS,EAAE,iBAAiB;gBAC5B,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,QAAQ;aACjB,CAAA;YACD,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;YACxE,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;YACzE,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;YAC3E,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;YACtE,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;YACxE,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;YAC1E,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;YACrE,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;YACvE,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;YAC3E,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QAC1E,CAAC;QAED,2EAA2E;QAC3E,iEAAiE;QACjE,2EAA2E;QAE3E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE;YACvD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,sBAAsB;YACnC,gBAAgB,EAAE,KAAK;SACxB,CAAC,CAAA;QAEF,yDAAyD;QACzD,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC,CAAA;QACvE,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAA;QAE/D,iCAAiC;QACjC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,CAAA;QAE/E,wDAAwD;QACxD,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;QACvE,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;QAEvE,kBAAkB;QAClB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE;YAClD,SAAS,EAAE,IAAI,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;YACxD,WAAW,EAAE,2BAA2B;SACzC,CAAC,CAAA;QAEF,+BAA+B;QAC/B,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,UAAU,CAAC,WAAW,CACpB,IAAI,GAAG,CAAC,eAAe,CAAC;gBACtB,OAAO,EAAE,CAAC,+BAA+B,CAAC;gBAC1C,SAAS,EAAE,KAAK,CAAC,WAAW;aAC7B,CAAC,CACH,CAAA;QACH,CAAC;QAED,sGAAsG;QACtG,UAAU,CAAC,gBAAgB,CACzB,GAAG,CAAC,aAAa,CAAC,wBAAwB,CAAC,8CAA8C,CAAC,CAC3F,CAAA;QAED,kFAAkF;QAClF,uCAAuC;QACvC,UAAU,CAAC,gBAAgB,CACzB,GAAG,CAAC,aAAa,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,CAC3E,CAAA;QAED,4EAA4E;QAC5E,4EAA4E;QAC5E,gEAAgE;QAChE,IAAI,CAAC,cAAc,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE;YAC1D,YAAY,EAAE,KAAK,CAAC,kBAAkB,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,SAAS;YACzF,SAAS,EAAE,KAAK,CAAC,kBAAkB,IAAI,IAAI,CAAC,aAAa,CAAC,YAAY;YACtE,aAAa,EAAE,aAAa,CAAC,OAAO;SACrC,CAAC,CAAA;QACF,6EAA6E;QAC7E,4EAA4E;QAC5E,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;QAE1C,oEAAoE;QACpE,kFAAkF;QAClF,MAAM,WAAW,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE;YACzD,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC;SAChD,CAAC,CAAA;QACF,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QAEjC,gDAAgD;QAChD,MAAM,QAAQ,GAAG;YACf,6CAA6C;YAC7C,0BAA0B,KAAK,CAAC,WAAW,EAAE;YAC7C,yBAAyB,KAAK,CAAC,UAAU,EAAE;YAC3C,yBAAyB,KAAK,CAAC,UAAU,IAAI,MAAM,EAAE;YACrD,uEAAuE;YACvE,wEAAwE;YACxE,4BAA4B;YAC5B,cAAc,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;SACtC,CAAA;QACD,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,qCAAqC,KAAK,CAAC,oBAAoB,EAAE,CAAC,CAAA;QAClF,CAAC;QACD,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,uBAAuB,EAAE,CAAC,CAAA;QAC/E,CAAC;QACD,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAE1C,kBAAkB;QAClB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAA;QACxC,QAAQ,CAAC,WAAW,CAClB,aAAa,EACb,mBAAmB,EACnB,EAAE,EACF,oEAAoE,EACpE,0BAA0B,EAC1B,2DAA2D,EAC3D,uBAAuB,EACvB,EAAE,EACF,aAAa,EACb,iCAAiC,EACjC,mBAAmB,EACnB,gBAAgB,IAAI,CAAC,UAAU,CAAC,YAAY,aAAa,EACzD,sEAAsE,EACtE,yEAAyE,EACzE,qEAAqE,EACrE,oDAAoD,EACpD,SAAS,IAAI,CAAC,UAAU,CAAC,YAAY,4CAA4C,EACjF,EAAE,EACF,qCAAqC,EACrC,kBAAkB,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,WAAW,yBAAyB,EAC9F,6BAA6B,EAC7B,uBAAuB,EACvB,iCAAiC,EACjC,0EAA0E,EAC1E,wEAAwE,EACxE,yDAAyD,EACzD,4DAA4D,EAC5D,EAAE,EACF,8CAA8C,EAC9C,2CAA2C,EAC3C,cAAc,EACd,QAAQ,EACR,EAAE,EACF,0BAA0B,EAC1B,6DAA6D,EAC7D,QAAQ,EACR,qCAAqC,EACrC,sBAAsB,EACtB,uEAAuE,EACvE,4BAA4B,EAC5B,EAAE,EACF,WAAW,EACX,aAAa,EACb,eAAe,EACf,qCAAqC,EACrC,kCAAkC,EAClC,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,wEAAwE,EACxE,+DAA+D,EAC/D,0EAA0E,EAC1E,+DAA+D,EAC/D,uEAAuE,EACvE,qEAAqE,EACrE,uEAAuE,EACvE,6BAA6B,EAC7B,yDAAyD,EACzD,wDAAwD,EACxD,yCAAyC,EACzC,EAAE,EACF,WAAW,EACX,4BAA4B,EAC5B,QAAQ,EACR,EAAE,EACF,8BAA8B,EAC9B,+CAA+C,EAC/C,iEAAiE,EACjE,gEAAgE,EAChE,sEAAsE,EACtE,kCAAkC,EAClC,6BAA6B,EAC7B,4CAA4C,EAC5C,EAAE,EACF,qEAAqE,EACrE,sEAAsE,EACtE,wEAAwE,EACxE,oEAAoE,EACpE,qEAAqE,EACrE,oCAAoC,EACpC,iCAAiC,EACjC,gDAAgD,EAChD,EAAE,EACF,gBAAgB,EAChB,yBAAyB,EACzB,gCAAgC,EAChC,+BAA+B,EAC/B,EAAE,EACF,qCAAqC,EACrC,0EAA0E,EAC1E,4EAA4E,EAC5E,kDAAkD,EAClD,EAAE,EACF,4EAA4E,EAC5E,wEAAwE,EACxE,kDAAkD,EAClD,qCAAqC,EACrC,cAAc,EACd,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,GAAG,EACH,QAAQ,EACR,oEAAoE,EACpE,uEAAuE,EACvE,sEAAsE,EACtE,gEAAgE,EAChE,wCAAwC,EACxC,EAAE,EACF,2EAA2E,EAC3E,+EAA+E,EAC/E,GAAG,EACH,aAAa,EACb,yBAAyB,EACzB,kBAAkB,EAClB,2BAA2B,EAC3B,aAAa,EACb,+DAA+D,EAC/D,kCAAkC,IAAI,CAAC,cAAc,CAAC,YAAY,IAAI,EACtE,gDAAgD,EAChD,aAAa,EACb,WAAW,EACX,SAAS,EACT,OAAO,EACP,KAAK,EACL,GAAG,EACH,OAAO,EACP,+EAA+E,EAC/E,iKAAiK,CAClK,CAAA;QAED,qEAAqE;QACrE,6DAA6D;QAC7D,0EAA0E;QAC1E,wEAAwE;QACxE,gEAAgE;QAChE,iEAAiE;QACjE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,sBAAsB,EAAE;YAC1E,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC;YAC/E,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,qBAAqB,CAAC;gBACnD,OAAO,EAAE,GAAG,CAAC,kBAAkB,CAAC,MAAM;aACvC,CAAC;YACF,IAAI,EAAE,UAAU;YAChB,aAAa,EAAE,QAAQ;YACvB,QAAQ;YACR,WAAW,EAAE;gBACX,WAAW,EAAE,GAAG,CAAC,eAAe,CAAC,QAAQ,EAAE,gCAAgC;gBAC3E,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,YAAY,IAAI,QAAQ,CAAC,EAAE,8BAA8B;aACrF;SACF,CAAC,CAAA;QAEF,qBAAqB;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,WAAW,CAAC,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE;YACnE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE;YACjD,cAAc;YACd,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC;gBACvC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;aAC3B,CAAC;SACH,CAAC,CAAA;QAEF,iEAAiE;QACjE,kEAAkE;QAClE,2DAA2D;QAC3D,wCAAwC;QACxC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAA;IAC1E,CAAC;CACF"}
+{"version":3,"file":"cms-service.js","sourceRoot":"","sources":["../../src/constructs/cms-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EACL,QAAQ,EACR,aAAa,EACb,KAAK,EACL,OAAO,IAAI,GAAG,EACd,OAAO,IAAI,GAAG,EACd,OAAO,IAAI,GAAG,EACd,UAAU,IAAI,MAAM,EACpB,eAAe,IAAI,WAAW,EAC9B,aAAa,IAAI,QAAQ,EACzB,QAAQ,IAAI,IAAI,GACjB,MAAM,aAAa,CAAA;AAGpB,wEAAwE;AACxE,sEAAsE;AACtE,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,yEAAyE;AACzE,iEAAiE;AACjE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAE9D;;;;;;;;;;;;GAYG;AACH,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAW,EAAE,CACtD,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC;IACzC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IACpB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;IACnB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AAEzB;;;GAGG;AACH,MAAM,qBAAqB,GAAG,QAAQ,CAAA;AAEtC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,oCAAoC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK;YACrF,kFAAkF;YAClF,yBAAyB,CAC5B,CAAA;IACH,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,qBAAqB,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,GAAG;YACpF,QAAQ,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,sDAAsD;YACnF,OAAO,qBAAqB,oDAAoD,CACnF,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAmID;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,gBAAiB,SAAQ,SAAS;IAsB7C,YAAY,KAAgB,EAAE,EAAU,EAAE,KAA4B;QACpE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAEhB,qEAAqE;QACrE,4EAA4E;QAC5E,qEAAqE;QACrE,EAAE;QACF,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,2EAA2E;QAC3E,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,EAAE;QACF,qEAAqE;QACrE,0EAA0E;QAC1E,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,yBAAyB,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,2BAA2B,CAAC,CAAA;QAClF,MAAM,cAAc,GAAG,yBAAyB,IAAI,KAAK,CAAC,cAAc,IAAI,MAAM,CAAA;QAClF,MAAM,oBAAoB,GACxB,yBAAyB,KAAK,SAAS;YACrC,CAAC,CAAC,uCAAuC;YACzC,CAAC,CAAC,gBAAgB,CAAA;QAEtB,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,oEAAoE;QACpE,+DAA+D;QAC/D,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,4CAA4C,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG;gBAC3E,SAAS,oBAAoB,KAAK;gBAClC,uFAAuF;gBACvF,uDAAuD,CAC1D,CAAA;QACH,CAAC;QAED,qEAAqE;QACrE,iBAAiB;QACjB,qEAAqE;QACrE,EAAE;QACF,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,4CAA4C;QAC5C,wEAAwE;QACxE,sEAAsE;QACtE,0EAA0E;QAC1E,iCAAiC;QACjC,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,aAAa,CAAC,CAAA;QAC1D,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CACb,qDAAqD,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI;gBACtF,kFAAkF;gBAClF,wFAAwF;gBACxF,6BAA6B,CAChC,CAAA;QACH,CAAC;QAED,2EAA2E;QAC3E,gDAAgD;QAChD,2EAA2E;QAE3E,IAAI,CAAC,GAAG;YACN,KAAK,CAAC,GAAG;gBACT,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;oBACvB,MAAM,EAAE,CAAC;oBACT,WAAW,EAAE,CAAC,EAAE,yCAAyC;oBACzD,mBAAmB,EAAE;wBACnB;4BACE,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM;4BACjC,QAAQ,EAAE,EAAE;yBACb;wBACD;4BACE,IAAI,EAAE,SAAS;4BACf,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,gBAAgB;4BAC3C,QAAQ,EAAE,EAAE;yBACb;qBACF;iBACF,CAAC,CAAA;QAEJ,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,0EAA0E;QAC1E,yEAAyE;QACzE,+BAA+B;QAC/B,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,EAAE;YACxC,OAAO,EAAE,GAAG,CAAC,4BAA4B,CAAC,EAAE;SAC7C,CAAC,CAAA;QAEF,2EAA2E;QAC3E,4DAA4D;QAC5D,2EAA2E;QAE3E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE;YACjD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,eAAe;YAC5B,gBAAgB,EAAE,KAAK;SACxB,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE;YACvD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,SAAS,EAAE,IAAI;YACf,eAAe,EAAE,GAAG,CAAC,eAAe,CAAC,eAAe;YACpD,aAAa,EAAE,KAAK,CAAC,gBAAgB,IAAI,aAAa,CAAC,MAAM;YAC7D,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,gBAAgB,EAAE;YAC3D,aAAa,EAAE,KAAK;SACrB,CAAC,CAAA;QAEF,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,aAAa,EAAE;YAChE,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE;gBACT,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,KAAK;aACnB;YACD,SAAS,EAAE;gBACT,GAAG,EAAE,MAAM;gBACX,GAAG,EAAE,MAAM;aACZ;SACF,CAAC,CAAA;QAEF,2EAA2E;QAC3E,2DAA2D;QAC3D,2EAA2E;QAE3E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE;YACvD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,kBAAkB;YAC/B,gBAAgB,EAAE,KAAK,EAAE,qBAAqB;SAC/C,CAAC,CAAA;QAEF,0DAA0D;QAC1D,2EAA2E;QAC3E,wEAAwE;QACxE,qEAAqE;QACrE,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC,CAAA;QACvE,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAA;QAE/D,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,+DAA+D;QAC/D,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,sEAAsE;QACtE,iEAAiE;QACjE,iEAAiE;QACjE,uEAAuE;QACvE,kDAAkD;QAClD,QAAQ,CAAC,aAAa,CACpB,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAClB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EACjB,oCAAoC,CACrC,CAAA;QAED,qEAAqE;QACrE,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,yEAAyE;QACzE,yDAAyD;QACzD,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,EAAE;YAC5D,YAAY,EAAE,KAAK,CAAC,eAAe,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,MAAM;YACnF,SAAS,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,aAAa,CAAC,YAAY;YACnE,aAAa,EAAE,aAAa,CAAC,OAAO;SACrC,CAAC,CAAA;QAEF,IAAI,CAAC,cAAc,GAAG,IAAI,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,aAAa,EAAE;YACxE,IAAI,EAAE,KAAK,CAAC,cAAc;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9C,4BAA4B,EAAE,KAAK,CAAC,mBAAmB,IAAI,EAAE;YAC7D,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,gBAAgB,EAAE;YAC3D,cAAc,EAAE,CAAC,QAAQ,CAAC;YAC1B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,WAAW,EAAE,UAAU,CAAC;YACzE,qEAAqE;YACrE,qEAAqE;YACrE,uEAAuE;YACvE,oCAAoC;YACpC,QAAQ,EAAE,IAAI,CAAC,WAAW;YAC1B,WAAW,EAAE;gBACX,uEAAuE;gBACvE,uEAAuE;gBACvE,uEAAuE;gBACvE,uEAAuE;gBACvE,qEAAqE;gBACrE,sEAAsE;gBACtE,wBAAwB,EAAE,UAAU;gBACpC,sBAAsB,EAAE,iBAAiB;gBACzC,iEAAiE;gBACjE,qEAAqE;gBACrE,6DAA6D;gBAC7D,sEAAsE;gBACtE,0CAA0C;gBAC1C,4CAA4C;gBAC5C,GAAG,KAAK,CAAC,WAAW;gBACpB,8DAA8D;gBAC9D,iEAAiE;gBACjE,qEAAqE;gBACrE,oEAAoE;gBACpE,gEAAgE;gBAChE,sEAAsE;gBACtE,2DAA2D;gBAC3D,yBAAyB,EAAE,cAAc;gBACzC,WAAW,EAAE,MAAM;aACpB;SACF,CAAC,CAAA;QAEF,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,mEAAmE;QACnE,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAEhD,sCAAsC;QACtC,yEAAyE;QACzE,6DAA6D;QAC7D,4EAA4E;QAC5E,qEAAqE;QACrE,0EAA0E;QAC1E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC;YACpD,QAAQ,EAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO;SAC7C,CAAC,CAAA;QAEF,yEAAyE;QACzE,8EAA8E;QAC9E,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,sBAAsB;QACtB,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG;gBACf,OAAO,EAAE,eAAe;gBACxB,SAAS,EAAE,iBAAiB;gBAC5B,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,QAAQ;aACjB,CAAA;YACD,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;YACxE,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;YACzE,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;YAC3E,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;YACtE,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;YACxE,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAA;YAC1E,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;YACrE,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;YACvE,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAA;YAC3E,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QAC1E,CAAC;QAED,2EAA2E;QAC3E,iEAAiE;QACjE,2EAA2E;QAE3E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE;YACvD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,sBAAsB;YACnC,gBAAgB,EAAE,KAAK;SACxB,CAAC,CAAA;QAEF,yDAAyD;QACzD,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC,CAAA;QACvE,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAA;QAE/D,iCAAiC;QACjC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,CAAA;QAE/E,wDAAwD;QACxD,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;QACvE,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;QAEvE,kBAAkB;QAClB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE;YAClD,SAAS,EAAE,IAAI,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;YACxD,WAAW,EAAE,2BAA2B;SACzC,CAAC,CAAA;QAEF,+BAA+B;QAC/B,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,UAAU,CAAC,WAAW,CACpB,IAAI,GAAG,CAAC,eAAe,CAAC;gBACtB,OAAO,EAAE,CAAC,+BAA+B,CAAC;gBAC1C,SAAS,EAAE,KAAK,CAAC,WAAW;aAC7B,CAAC,CACH,CAAA;QACH,CAAC;QAED,sGAAsG;QACtG,UAAU,CAAC,gBAAgB,CACzB,GAAG,CAAC,aAAa,CAAC,wBAAwB,CAAC,8CAA8C,CAAC,CAC3F,CAAA;QAED,kFAAkF;QAClF,uCAAuC;QACvC,UAAU,CAAC,gBAAgB,CACzB,GAAG,CAAC,aAAa,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,CAC3E,CAAA;QAED,4EAA4E;QAC5E,4EAA4E;QAC5E,gEAAgE;QAChE,IAAI,CAAC,cAAc,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE;YAC1D,YAAY,EAAE,KAAK,CAAC,kBAAkB,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,SAAS;YACzF,SAAS,EAAE,KAAK,CAAC,kBAAkB,IAAI,IAAI,CAAC,aAAa,CAAC,YAAY;YACtE,aAAa,EAAE,aAAa,CAAC,OAAO;SACrC,CAAC,CAAA;QACF,6EAA6E;QAC7E,4EAA4E;QAC5E,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;QAE1C,oEAAoE;QACpE,kFAAkF;QAClF,MAAM,WAAW,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE;YACzD,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC;SAChD,CAAC,CAAA;QACF,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QAEjC,iDAAiD;QACjD,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,gEAAgE;QAChE,MAAM,UAAU,GAA4B;YAC1C,CAAC,0BAA0B,EAAE,oBAAoB,CAAC;YAClD,CAAC,wBAAwB,EAAE,KAAK,CAAC,WAAW,CAAC;YAC7C,CAAC,uBAAuB,EAAE,KAAK,CAAC,UAAU,CAAC;YAC3C,CAAC,uBAAuB,EAAE,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC;YACrD,oEAAoE;YACpE,oEAAoE;YACpE,0EAA0E;YAC1E,iEAAiE;YACjE,CAAC,2BAA2B,EAAE,cAAc,CAAC;YAC7C,uEAAuE;YACvE,wEAAwE;YACxE,4BAA4B;YAC5B,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;SACtC,CAAA;QACD,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;YAC/B,UAAU,CAAC,IAAI,CAAC,CAAC,mCAAmC,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAA;QACpF,CAAC;QACD,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,CAAC,6BAA6B,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAA;QACjF,CAAC;QACD,MAAM,cAAc,GAAG,UAAU;aAC9B,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;aAC/D,IAAI,CAAC,IAAI,CAAC,CAAA;QAEb,kBAAkB;QAClB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAA;QACxC,QAAQ,CAAC,WAAW,CAClB,aAAa,EACb,mBAAmB,EACnB,EAAE,EACF,oEAAoE,EACpE,0BAA0B,EAC1B,2DAA2D,EAC3D,uBAAuB,EACvB,EAAE,EACF,aAAa,EACb,iCAAiC,EACjC,mBAAmB,EACnB,gBAAgB,IAAI,CAAC,UAAU,CAAC,YAAY,aAAa,EACzD,sEAAsE,EACtE,yEAAyE,EACzE,qEAAqE,EACrE,oDAAoD,EACpD,SAAS,IAAI,CAAC,UAAU,CAAC,YAAY,4CAA4C,EACjF,EAAE,EACF,qCAAqC,EACrC,kBAAkB,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,WAAW,yBAAyB,EAC9F,6BAA6B,EAC7B,uBAAuB,EACvB,iCAAiC,EACjC,0EAA0E,EAC1E,wEAAwE,EACxE,yDAAyD,EACzD,4DAA4D,EAC5D,EAAE,EACF,8CAA8C,EAC9C,2CAA2C,EAC3C,cAAc,EACd,QAAQ,EACR,EAAE,EACF,0BAA0B,EAC1B,6DAA6D,EAC7D,QAAQ,EACR,qCAAqC,EACrC,sBAAsB,EACtB,uEAAuE,EACvE,4BAA4B,EAC5B,EAAE,EACF,WAAW,EACX,aAAa,EACb,eAAe,EACf,qCAAqC,EACrC,kCAAkC,EAClC,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,wEAAwE,EACxE,+DAA+D,EAC/D,0EAA0E,EAC1E,+DAA+D,EAC/D,uEAAuE,EACvE,qEAAqE,EACrE,uEAAuE,EACvE,6BAA6B,EAC7B,yDAAyD,EACzD,wDAAwD,EACxD,yCAAyC,EACzC,EAAE,EACF,WAAW,EACX,4BAA4B,EAC5B,QAAQ,EACR,EAAE,EACF,8BAA8B,EAC9B,+CAA+C,EAC/C,iEAAiE,EACjE,gEAAgE,EAChE,sEAAsE,EACtE,kCAAkC,EAClC,6BAA6B,EAC7B,4CAA4C,EAC5C,EAAE,EACF,qEAAqE,EACrE,sEAAsE,EACtE,wEAAwE,EACxE,oEAAoE,EACpE,qEAAqE,EACrE,oCAAoC,EACpC,iCAAiC,EACjC,gDAAgD,EAChD,EAAE,EACF,gBAAgB,EAChB,yBAAyB,EACzB,gCAAgC,EAChC,+BAA+B,EAC/B,EAAE,EACF,qCAAqC,EACrC,0EAA0E,EAC1E,4EAA4E,EAC5E,kDAAkD,EAClD,EAAE,EACF,4EAA4E,EAC5E,wEAAwE,EACxE,kDAAkD,EAClD,qCAAqC,EACrC,cAAc,EACd,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,GAAG,EACH,QAAQ,EACR,oEAAoE,EACpE,uEAAuE,EACvE,sEAAsE,EACtE,gEAAgE,EAChE,wCAAwC,EACxC,EAAE,EACF,2EAA2E,EAC3E,+EAA+E,EAC/E,GAAG,EACH,aAAa,EACb,yBAAyB,EACzB,kBAAkB,EAClB,2BAA2B,EAC3B,aAAa,EACb,+DAA+D,EAC/D,kCAAkC,IAAI,CAAC,cAAc,CAAC,YAAY,IAAI,EACtE,iDAAiD;QACjD,4DAA4D;QAC5D,wEAAwE;QACxE,qEAAqE;QACrE,oEAAoE;QACpE,wDAAwD;QACxD,yDAAyD;QACzD,sEAAsE;QACtE,yDAAyD;QACzD,gCAAgC;QAChC,wEAAwE;QACxE,qEAAqE;QACrE,yEAAyE;QACzE,kEAAkE;QAClE,kCAAkC;QAClC,8DAA8D,EAC9D,aAAa,EACb,WAAW,EACX,SAAS,EACT,OAAO,EACP,KAAK,EACL,GAAG,EACH,OAAO,EACP,+EAA+E,EAC/E,iKAAiK,CAClK,CAAA;QAED,qEAAqE;QACrE,6DAA6D;QAC7D,0EAA0E;QAC1E,wEAAwE;QACxE,gEAAgE;QAChE,iEAAiE;QACjE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,sBAAsB,EAAE;YAC1E,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC;YAC/E,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,qBAAqB,CAAC;gBACnD,OAAO,EAAE,GAAG,CAAC,kBAAkB,CAAC,MAAM;aACvC,CAAC;YACF,IAAI,EAAE,UAAU;YAChB,aAAa,EAAE,QAAQ;YACvB,QAAQ;YACR,WAAW,EAAE;gBACX,WAAW,EAAE,GAAG,CAAC,eAAe,CAAC,QAAQ,EAAE,gCAAgC;gBAC3E,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,YAAY,IAAI,QAAQ,CAAC,EAAE,8BAA8B;aACrF;SACF,CAAC,CAAA;QAEF,qBAAqB;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,WAAW,CAAC,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE;YACnE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE;YACjD,cAAc;YACd,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC;gBACvC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;aAC3B,CAAC;YACF,wEAAwE;YACxE,sEAAsE;YACtE,qEAAqE;YACrE,oEAAoE;YACpE,+DAA+D;YAC/D,qEAAqE;YACrE,oEAAoE;YACpE,mEAAmE;YACnE,uEAAuE;YACvE,gEAAgE;YAChE,EAAE;YACF,mEAAmE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,uEAAuE;YACvE,iEAAiE;YACjE,sEAAsE;YACtE,uEAAuE;YACvE,oEAAoE;YACpE,mEAAmE;YACnE,qEAAqE;YACrE,uEAAuE;YACvE,kEAAkE;YAClE,oEAAoE;YACpE,mEAAmE;YACnE,8EAA8E;YAC9E,EAAE;YACF,iEAAiE;YACjE,oEAAoE;YACpE,+DAA+D;YAC/D,YAAY,EAAE,WAAW,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,qBAAqB,EAAE,CAAC,EAAE,CAAC;SACnF,CAAC,CAAA;QAEF,wEAAwE;QACxE,2DAA2D;QAC3D,EAAE;QACF,wEAAwE;QACxE,sEAAsE;QACtE,gEAAgE;QAChE,qEAAqE;QACrE,kEAAkE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,qBAAqB;QACrB,wEAAwE;QACxE,oEAAoE;QACpE,yEAAyE;QACzE,uEAAuE;QACvE,qEAAqE;QACrE,oEAAoE;QACpE,oEAAoE;QACpE,4DAA4D;QAC5D,EAAE;QACF,iEAAiE;QACjE,oEAAoE;QACpE,sEAAsE;QACtE,mEAAmE;QACnE,kEAAkE;QAClE,8BAA8B;QAE9B,iEAAiE;QACjE,kEAAkE;QAClE,2DAA2D;QAC3D,wCAAwC;QACxC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAA;IAC1E,CAAC;CACF"}

package/lambda/asset-transform/dist/.deployable

@@ -0,0 +1,5 @@
+{
+  "sharpRange": "^0.35.3",
+  "platformPkgDir": "/home/runner/work/canopycms/canopycms/packages/canopycms-cdk/lambda/asset-transform/dist/node_modules/@img/sharp-linux-arm64",
+  "builtBy": "build:lambda"
+}