canopycms-cdk 0.0.67-int.90 → 0.0.67

package/dist/constructs/lambda-execution-role.d.ts

@@ -13,48 +13,32 @@ export interface LambdaExecutionPolicyOptions {
 }
 /**
  * Re-attach what CDK drops when a `lambda.Function` is handed a pre-built
- * execution role. Call this for every caller-supplied role, alongside passing
- * that role to the function.
+ * execution role. Call this for EVERY caller-supplied role.
  *
- * The contract this maintains is deliberately the strong one: **passing a role
- * yields the same effective permissions as letting the construct create one.**
- * The weaker alternative - attach only what each function demonstrably still
- * needs - is a judgment call that goes stale silently. Concretely, neither
- * Lambda in this package strictly needs `AWSLambdaBasicExecutionRole` today:
- * both log to a custom-named group (`/canopycms/<stackName>/...`), that
- * policy's `logs:CreateLogStream`/`logs:PutLogEvents` are scoped to
- * `arn:aws:logs:*:*:log-group:/aws/lambda/*:*` and so grant nothing for such a
- * group, and an explicit `logGroup.grantWrite()` is what actually enables
- * their logging. Attaching it regardless costs one managed-policy ARN and
- * means the first change to either function's logging cannot quietly leave
+ * The contract is the strong one: **passing a role yields the same effective
+ * permissions as letting the construct create one.** Attaching only what each
+ * function demonstrably still needs goes stale silently - neither Lambda here
+ * strictly needs `AWSLambdaBasicExecutionRole` today, since both log to a
+ * custom-named group its `/aws/lambda/*`-scoped statements do not cover and an
+ * explicit `logGroup.grantWrite()` is what enables their logging. Attaching it
+ * anyway costs one ARN and keeps a later logging change from quietly leaving
  * passed-role deployments behind.
  *
- * WHY THE PARAMETER IS THE CONCRETE `iam.Role` AND NOT `iam.IRole`, which is
- * the type a CDK prop would normally take: `addManagedPolicy` does nothing
- * useful on an imported role, in two distinct ways, neither of which surfaces
- * an error.
+ * THE PARAMETER IS THE CONCRETE `iam.Role`, NOT `iam.IRole`, because
+ * `addManagedPolicy` does nothing useful on an imported role, in two ways that
+ * both emit nothing and neither of which errors: `ImmutableRole` (what
+ * `Role.fromRoleArn` returns cross-account, or for any `mutable: false` import)
+ * defines it as an empty method body, and `ImportedRole` (same-account, still
+ * mutable) attaches only if the policy exposes `attachToRole`, which
+ * `ManagedPolicy.fromAwsManagedPolicyName` does not, so it takes the warning
+ * branch. Both confirmed on a synthesized template: no `AWS::IAM::Role` and no
+ * `AWS::IAM::Policy` appears either way. Typed `IRole`, this function would
+ * silently no-op for every imported role and ship exactly the cannot-start
+ * Lambda it exists to prevent, and no runtime guard is available -
+ * `ImmutableRole.addToPrincipalPolicy` reports `statementAdded: true` while
+ * emitting nothing. Narrowing moves the failure to COMPILE time.
  *
- * - `ImmutableRole.addManagedPolicy(_policy) {}` - an empty method body. This
- *   is what `Role.fromRoleArn` returns for a CROSS-ACCOUNT role, or for any
- *   role imported with `mutable: false`.
- * - `ImportedRole.addManagedPolicy` (the same-account, still-mutable case)
- *   attaches the policy only if it exposes `attachToRole`, which
- *   `ManagedPolicy.fromAwsManagedPolicyName` does not - so it takes the
- *   warning branch and emits nothing.
- *
- * Both confirmed on a synthesized template: no `AWS::IAM::Role` and no
- * `AWS::IAM::Policy` resource appears in either case. So typed `IRole`, this
- * function would silently no-op for every imported role and ship exactly the
- * cannot-start Lambda it exists to prevent. There is no runtime guard
- * available either - `ImmutableRole.addToPrincipalPolicy` returns
- * `statementAdded: true` while emitting nothing, so the one signal CDK offers
- * lies. Narrowing the type moves the failure to COMPILE time instead, which is
- * the earliest it can be caught; `attachTo(distribution:
- * cloudfront.Distribution)` in asset-support.ts narrows to a concrete class for
- * the same kind of reason.
- *
- * Residual, documented rather than guarded because of its rarity: a role
- * produced under `Role.customizeRoles` carries a precreated `ImportedRole` that
- * `addManagedPolicy` delegates to, landing on the warning branch above.
+ * Residual, documented rather than guarded: a role from `Role.customizeRoles`
+ * carries a precreated `ImportedRole` and lands on that same warning branch.
  */
 export declare function attachLambdaExecutionPolicies(role: iam.Role, options: LambdaExecutionPolicyOptions): void;

package/dist/constructs/lambda-execution-role.js

@@ -3,9 +3,8 @@ import { aws_iam as iam } from 'aws-cdk-lib';
  * The two AWS managed policies CDK's `lambda.Function` attaches to an
  * execution role IT creates, and silently DISCARDS when one is passed in.
  *
- * Verbatim from `aws-cdk-lib/aws-lambda/lib/function.js` (checked against
- * 2.265.0 here, and independently against 2.267.0 by the adopter who filed
- * this):
+ * Verbatim from `aws-cdk-lib/aws-lambda/lib/function.js` (2.265.0, and the same
+ * in 2.267.0):
  *
  * ```js
  * managedPolicies.push(ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole'))
@@ -13,74 +12,52 @@ import { aws_iam as iam } from 'aws-cdk-lib';
  * this.role = props.role || new iam.Role(this, 'ServiceRole', { assumedBy: ..., managedPolicies })
  * ```
  *
- * The array is built unconditionally and then reaches ONLY the `||` fallback.
- * Pass a role and both entries are dropped with nothing logged. Confirmed on a
- * synthesized template, not inferred: a VPC-attached function given a bare role
- * emits an `AWS::IAM::Role` whose `ManagedPolicyArns` is absent entirely.
- *
- * For the VPC-attached CMS Lambda that is not a degradation, it is fatal and
- * invisible: without `AWSLambdaVPCAccessExecutionRole` the function cannot
- * create ENIs, so it cannot start at all - while synthesizing and deploying
- * perfectly clean and failing only at invoke, a long way from the cause. Which
- * is why every `role` prop in this package routes through here.
+ * The array is built unconditionally and then reaches ONLY the `||` fallback, so
+ * passing a role drops both entries with nothing logged - confirmed on a
+ * synthesized template, where a VPC-attached function given a bare role emits an
+ * `AWS::IAM::Role` with no `ManagedPolicyArns` at all. For the VPC-attached CMS
+ * Lambda that is fatal and invisible: without `AWSLambdaVPCAccessExecutionRole`
+ * the function cannot create ENIs and so cannot start, having synthesized and
+ * deployed perfectly clean and failing only at invoke. Every `role` prop in this
+ * package routes through here.
  *
  * NOT affected by passing a role, so deliberately not re-applied below (all
- * three verified in the same CDK source):
- *
- * - EFS access-point statements - `config.policies.forEach(p => this.role?.addToPrincipalPolicy(p))`.
- * - `initialPolicy` - `this.role.addToPrincipalPolicy(statement)` per statement.
- * - Every `grant*` call, because `this.grantPrincipal = this.role`. That covers
- *   `cmsLogGroup`/`transformLogGroup`'s `grantWrite` and all asset-bucket
- *   grants, which land on the passed role exactly as they would on a created
- *   one.
+ * three verified in the same CDK source): EFS access-point statements and
+ * `initialPolicy`, which go through `addToPrincipalPolicy`, and every `grant*`
+ * call, because `this.grantPrincipal = this.role` - which covers
+ * `cmsLogGroup`/`transformLogGroup`'s `grantWrite` and all asset-bucket grants.
  */
 const BASIC_EXECUTION_POLICY = 'service-role/AWSLambdaBasicExecutionRole';
 const VPC_ACCESS_POLICY = 'service-role/AWSLambdaVPCAccessExecutionRole';
 /**
  * Re-attach what CDK drops when a `lambda.Function` is handed a pre-built
- * execution role. Call this for every caller-supplied role, alongside passing
- * that role to the function.
+ * execution role. Call this for EVERY caller-supplied role.
  *
- * The contract this maintains is deliberately the strong one: **passing a role
- * yields the same effective permissions as letting the construct create one.**
- * The weaker alternative - attach only what each function demonstrably still
- * needs - is a judgment call that goes stale silently. Concretely, neither
- * Lambda in this package strictly needs `AWSLambdaBasicExecutionRole` today:
- * both log to a custom-named group (`/canopycms/<stackName>/...`), that
- * policy's `logs:CreateLogStream`/`logs:PutLogEvents` are scoped to
- * `arn:aws:logs:*:*:log-group:/aws/lambda/*:*` and so grant nothing for such a
- * group, and an explicit `logGroup.grantWrite()` is what actually enables
- * their logging. Attaching it regardless costs one managed-policy ARN and
- * means the first change to either function's logging cannot quietly leave
+ * The contract is the strong one: **passing a role yields the same effective
+ * permissions as letting the construct create one.** Attaching only what each
+ * function demonstrably still needs goes stale silently - neither Lambda here
+ * strictly needs `AWSLambdaBasicExecutionRole` today, since both log to a
+ * custom-named group its `/aws/lambda/*`-scoped statements do not cover and an
+ * explicit `logGroup.grantWrite()` is what enables their logging. Attaching it
+ * anyway costs one ARN and keeps a later logging change from quietly leaving
  * passed-role deployments behind.
  *
- * WHY THE PARAMETER IS THE CONCRETE `iam.Role` AND NOT `iam.IRole`, which is
- * the type a CDK prop would normally take: `addManagedPolicy` does nothing
- * useful on an imported role, in two distinct ways, neither of which surfaces
- * an error.
- *
- * - `ImmutableRole.addManagedPolicy(_policy) {}` - an empty method body. This
- *   is what `Role.fromRoleArn` returns for a CROSS-ACCOUNT role, or for any
- *   role imported with `mutable: false`.
- * - `ImportedRole.addManagedPolicy` (the same-account, still-mutable case)
- *   attaches the policy only if it exposes `attachToRole`, which
- *   `ManagedPolicy.fromAwsManagedPolicyName` does not - so it takes the
- *   warning branch and emits nothing.
- *
- * Both confirmed on a synthesized template: no `AWS::IAM::Role` and no
- * `AWS::IAM::Policy` resource appears in either case. So typed `IRole`, this
- * function would silently no-op for every imported role and ship exactly the
- * cannot-start Lambda it exists to prevent. There is no runtime guard
- * available either - `ImmutableRole.addToPrincipalPolicy` returns
- * `statementAdded: true` while emitting nothing, so the one signal CDK offers
- * lies. Narrowing the type moves the failure to COMPILE time instead, which is
- * the earliest it can be caught; `attachTo(distribution:
- * cloudfront.Distribution)` in asset-support.ts narrows to a concrete class for
- * the same kind of reason.
+ * THE PARAMETER IS THE CONCRETE `iam.Role`, NOT `iam.IRole`, because
+ * `addManagedPolicy` does nothing useful on an imported role, in two ways that
+ * both emit nothing and neither of which errors: `ImmutableRole` (what
+ * `Role.fromRoleArn` returns cross-account, or for any `mutable: false` import)
+ * defines it as an empty method body, and `ImportedRole` (same-account, still
+ * mutable) attaches only if the policy exposes `attachToRole`, which
+ * `ManagedPolicy.fromAwsManagedPolicyName` does not, so it takes the warning
+ * branch. Both confirmed on a synthesized template: no `AWS::IAM::Role` and no
+ * `AWS::IAM::Policy` appears either way. Typed `IRole`, this function would
+ * silently no-op for every imported role and ship exactly the cannot-start
+ * Lambda it exists to prevent, and no runtime guard is available -
+ * `ImmutableRole.addToPrincipalPolicy` reports `statementAdded: true` while
+ * emitting nothing. Narrowing moves the failure to COMPILE time.
  *
- * Residual, documented rather than guarded because of its rarity: a role
- * produced under `Role.customizeRoles` carries a precreated `ImportedRole` that
- * `addManagedPolicy` delegates to, landing on the warning branch above.
+ * Residual, documented rather than guarded: a role from `Role.customizeRoles`
+ * carries a precreated `ImportedRole` and lands on that same warning branch.
  */
 export function attachLambdaExecutionPolicies(role, options) {
     role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName(BASIC_EXECUTION_POLICY));

package/dist/index.js

@@ -1,6 +1,4 @@
-// Worker daemon
 export { CmsWorker } from './worker.js';
-// CDK Constructs
 export { CanopyCmsService } from './constructs/cms-service.js';
 export { CanopyCmsDistribution } from './constructs/cms-distribution.js';
 export { AssetSupport, assetUploadBehavior } from './constructs/asset-support.js';

package/dist/worker.d.ts

@@ -1,7 +1,5 @@
 /**
- * Re-export CmsWorker from the core canopycms package.
  * The worker is cloud-agnostic and auth-agnostic — it lives in canopycms core.
- * This file re-exports it for convenience from the CDK package.
  */
 export { CmsWorker } from 'canopycms/worker/cms-worker';
 export type { CmsWorkerConfig, AuthCacheRefresher } from 'canopycms/worker/cms-worker';

package/dist/worker.js

@@ -1,6 +1,4 @@
 /**
- * Re-export CmsWorker from the core canopycms package.
  * The worker is cloud-agnostic and auth-agnostic — it lives in canopycms core.
- * This file re-exports it for convenience from the CDK package.
  */
 export { CmsWorker } from 'canopycms/worker/cms-worker';

package/lambda/asset-transform/dist/handler.js

@@ -4522,18 +4522,18 @@ var init_config = __esm({
       onAccountClick: external_exports.function().returns(external_exports.void()).optional(),
       onLogoutClick: external_exports.function().returns(external_exports.void()).optional(),
       // Optional: custom account component (e.g., Clerk's UserButton)
-      AccountComponent: external_exports.custom().optional()
+      AccountComponent: external_exports.custom().optional(),
+      // Optional: provider sign-in UI for signed-out users (see EditorSignInProps)
+      SignInComponent: external_exports.custom().optional()
     });
     CanopyConfigSchema = external_exports.object({
       media: mediaSchema.optional(),
-      // No outer .optional() here: defaultBranchAccessSchema/defaultPathAccessSchema already
-      // have .default('deny'), so the field is optional on input but always resolves to
-      // 'allow'/'deny' (never undefined) on output. An outer .optional() would short-circuit
-      // before the inner default runs, defeating the fail-closed default (SCH-M1).
-      // defaultPathAccessSchema's union keeps the same rule: the .default('deny') sits on the
-      // OUTER union, not inside defaultPathAccessLevelsSchema, so an omitted top-level field
-      // still resolves to 'deny' and an omitted level inside the object form stays undefined
-      // (resolved to 'deny' at read time by resolveDefaultPathAccess).
+      // No outer .optional(): both schemas already .default('deny'), so the field is optional on
+      // input but always resolves to 'allow'/'deny' (never undefined) on output — an outer
+      // .optional() would short-circuit before the inner default runs, defeating the fail-closed
+      // default (SCH-M1). defaultPathAccessSchema's .default('deny') sits on the OUTER union, not
+      // inside defaultPathAccessLevelsSchema, so an omitted level in the object form stays
+      // undefined (resolved to 'deny' at read time by resolveDefaultPathAccess).
       defaultBranchAccess: defaultBranchAccessSchema,
       defaultPathAccess: defaultPathAccessSchema,
       // .optional() deliberately defeats defaultBaseBranchSchema's .default('main'):
@@ -4557,16 +4557,11 @@ var init_config = __esm({
       allowNetworkRemoteInProd: external_exports.boolean().optional(),
       settingsBranch: external_exports.string().optional(),
       autoCreateSettingsPR: external_exports.boolean().optional(),
-      // Deliberately `deploymentNameSchema.optional()`, NOT `deploymentNameSchema` alone.
-      // deploymentNameSchema.default('prod') would make `parse(undefined)` resolve to
-      // the literal 'prod' instead of staying `undefined` — collapsing the
-      // env > config > modeDefault precedence chain that resolveDeploymentName
-      // (operating-mode/deployment-name.ts) implements: config would then always
-      // "win" over modeDefault (masking dev's real default of 'local'), and the env
-      // var would just be racing config's baked-in 'prod' instead of a true absence.
-      // `.optional()` here is what keeps an omitted deploymentName reaching
-      // resolveDeploymentName as `undefined`, so it can fall through to modeDefault.
-      // Do not "fix" this by removing `.optional()`.
+      // `.optional()`, NOT bare `deploymentNameSchema`: its own `.default('prod')` would make
+      // `parse(undefined)` resolve to 'prod' instead of staying `undefined`, collapsing the
+      // env > config > modeDefault precedence chain `resolveDeploymentName`
+      // (operating-mode/deployment-name.ts) implements — config would always "win" over
+      // modeDefault, masking dev's real default of 'local'. Do not remove `.optional()`.
       deploymentName: deploymentNameSchema.optional(),
       contentRoot: contentRootSchema.default("content"),
       sourceRoot: sourceRootSchema.optional(),
@@ -24061,15 +24056,11 @@ var DebugLogger = class {
     return LOG_LEVELS[level] >= LOG_LEVELS[minLevel];
   }
   /**
-   * The ISO-8601 timestamp leads the line BARE - not wrapped in brackets as it
-   * once was. `CANOPYCMS_DEBUG=true` can be set on the EC2 worker, whose stdout
-   * appends to /var/log/canopy-worker/worker.log; the CloudWatch agent's
-   * `multi_line_start_pattern` matches the timestamp at the START of a line
-   * (see worker/log.ts's INVARIANT and cms-service.ts's agent config), so a
-   * leading `[` meant every debug line was silently folded into the previous
-   * event instead of starting its own. The bracketed `[prefix:category]` and
-   * `[level]` fields still follow, so the human-readable shape is unchanged
-   * apart from those two characters.
+   * The ISO-8601 timestamp leads the line BARE, never bracketed. `CANOPYCMS_DEBUG=true` can
+   * be set on the EC2 worker, whose stdout appends to /var/log/canopy-worker/worker.log, and
+   * the CloudWatch agent's `multi_line_start_pattern` matches a timestamp at the START of a
+   * line (see worker/log.ts's INVARIANT and cms-service.ts's agent config): any leading
+   * character folds the line into the previous event instead of starting its own.
    */
   formatMessage(level, category, message) {
     const timestamp = (/* @__PURE__ */ new Date()).toISOString();
@@ -24102,15 +24093,9 @@ var DebugLogger = class {
       throw new Error(errorMsg);
     }
   }
-  /**
-   * Start timing an operation
-   */
   time(label) {
     this.timers.set(label, Date.now());
   }
-  /**
-   * End timing an operation and log the duration
-   */
   timeEnd(category, label) {
     const start = this.timers.get(label);
     if (start === void 0) {
@@ -24122,9 +24107,6 @@ var DebugLogger = class {
     this.debug(category, `${label} completed`, { durationMs: duration });
     return duration;
   }
-  /**
-   * Wrap an async function with automatic timing
-   */
   async timed(category, label, fn) {
     this.time(label);
     try {
@@ -30130,10 +30112,10 @@ var permissionPathSchema = external_exports.string().min(1).transform((val, ctx)
   return result.path;
 });
 var PermissionsFileSchema = external_exports.object({
-  // Managed by writeOccJsonFile (see authorization/settings-file-store.ts) —
-  // the single OCC counter for this file. Optional so a hand-written file
-  // with no version field parses as version 0. A legacy `contentVersion`
-  // field (if present) is silently stripped by this non-strict zod parse.
+  // Managed by writeOccJsonFile (see authorization/settings-file-store.ts):
+  // the single OCC counter for this file. Optional so a hand-written file with
+  // no version field parses as version 0; a stray `contentVersion` key is
+  // silently stripped by this non-strict zod parse.
   version: external_exports.number().int().nonnegative().optional(),
   writeId: external_exports.string().optional(),
   updatedAt: external_exports.string().datetime(),
@@ -30157,10 +30139,10 @@ init_error();
 // ../canopycms/src/authorization/groups/schema.ts
 init_zod();
 var GroupsFileSchema = external_exports.object({
-  // Managed by writeOccJsonFile (see authorization/settings-file-store.ts) —
-  // the single OCC counter for this file. Optional so a hand-written file
-  // with no version field parses as version 0. A legacy `contentVersion`
-  // field (if present) is silently stripped by this non-strict zod parse.
+  // Managed by writeOccJsonFile (see authorization/settings-file-store.ts):
+  // the single OCC counter for this file. Optional so a hand-written file with
+  // no version field parses as version 0; a stray `contentVersion` key is
+  // silently stripped by this non-strict zod parse.
   version: external_exports.number().int().nonnegative().optional(),
   writeId: external_exports.string().optional(),
   updatedAt: external_exports.string().datetime(),
@@ -30193,10 +30175,10 @@ var ThrottledOctokit = import_rest.Octokit.plugin(import_plugin_throttling.throt
 // ../canopycms/src/services.ts
 init_operating_mode();
 
-// ../canopycms/src/worker/task-queue.ts
+// ../canopycms/src/task-queue/cms-task-queue.ts
 var debugLogger = createDebugLogger({ prefix: "TaskQueue" });
 
-// ../canopycms/src/worker/task-queue-config.ts
+// ../canopycms/src/task-queue/task-queue-config.ts
 init_config3();
 
 // ../canopycms/src/url-path-resolver.ts
@@ -30433,7 +30415,7 @@ var ASSET_PREFIXES = {
 function createKeyBuilders(prefixes = ASSET_PREFIXES) {
   return {
     originalKey: (hash32, ext2) => `${prefixes.originals}/${hash32}.${ext2}`,
-    /** Prefix used to look up an original by hash32 alone (extension unknown ahead of time). */
+    /** Prefix for looking up an original by hash32 alone (extension unknown ahead of time). */
     originalPrefix: (hash32) => `${prefixes.originals}/${hash32}.`,
     stagingKey: (uuid) => `${prefixes.staging}/${uuid}`,
     metaKey: (hash32) => `${prefixes.meta}/${hash32}.json`,
@@ -30441,7 +30423,9 @@ function createKeyBuilders(prefixes = ASSET_PREFIXES) {
     publicKey: (hash32, slug, ext2) => `${prefixes.public}/${hash32}/${slug}.${ext2}`
   };
 }
-var { originalKey, originalPrefix, stagingKey, metaKey, metaPrefix, publicKey } = createKeyBuilders();
+var keyBuilders = createKeyBuilders();
+var { originalKey, stagingKey, metaKey, publicKey } = keyBuilders;
+var { originalPrefix, metaPrefix } = keyBuilders;
 
 // ../canopycms/src/assets/store-local.ts
 var DEFAULT_MAX_UPLOAD_BYTES = 50 * 1024 * 1024;

package/lambda/asset-transform/dist/node_modules/.package-lock.json

@@ -22,9 +22,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-arm64": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.3.3.tgz",
-      "integrity": "sha512-0DaL0A6Xu6sQSQFwe4iVCrKWU2cCTItnRsYsCdxAMm9NF6twAA9BKnoqy4hqz4+azQ0JHuA26qiUKsf1XJ/v5A==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.3.4.tgz",
+      "integrity": "sha512-Y3dgX/6lE2QhQb+Gxy0WZxfg9MEm/JBjamZpS2IklP7xIQoKN4hzAm7KcMVGtaVDt3neE9OKBC7vAfonA/Lr1A==",
       "cpu": [
         "arm64"
       ],
@@ -38,9 +38,9 @@
       }
     },
     "node_modules/@img/sharp-linux-arm64": {
-      "version": "0.35.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.35.4.tgz",
-      "integrity": "sha512-De4jpEnAU8Hd5oT0j1G3uL4ZvTuipVMn7YC6vPaJhy6/7EwEae0SVAoBrUMYQbkLGDm85taVWwuPc1a44LTzCQ==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.35.5.tgz",
+      "integrity": "sha512-LYVx5JTsOM2CBzmxreh+nl64/3H6Xb09iSLknqH47z2T2DFFxDeFLP5y4dJwe6H7uGQlHPyEEtIqyo3DYsRwdQ==",
       "cpu": [
         "arm64"
       ],
@@ -56,13 +56,13 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-arm64": "1.3.3"
+        "@img/sharp-libvips-linux-arm64": "1.3.4"
       }
     },
     "node_modules/@img/sharp-wasm32": {
-      "version": "0.35.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.35.4.tgz",
-      "integrity": "sha512-zQnl4Kwp7Q6NHsENtU2T/00Zi+w3AQNwz3+UaTyVBy2FpXrzXzGjndpK61onhZjRtRpQXxCTeqw19bVyXOh7jA==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.35.5.tgz",
+      "integrity": "sha512-Ptsga1su4tQx+LLF1ECS9U6nz5kmrXKo6XVbtR48Ke3ZRxxgaWBu7IDtEe1quo8hiupwm6WFqxVlXaSf7IINGQ==",
       "license": "Apache-2.0 AND LGPL-3.0-or-later AND MIT",
       "optional": true,
       "dependencies": {
@@ -97,9 +97,9 @@
       }
     },
     "node_modules/sharp": {
-      "version": "0.35.4",
-      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.35.4.tgz",
-      "integrity": "sha512-n++8XWcj+jCOr2IOl7h8LbKnGBDY4aPbmprMONBNFdn0ImXqpGVv5zliDs0V9HbmbCQLpbuo2ej9rAoOQTvMDA==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.35.5.tgz",
+      "integrity": "sha512-Ywn4OnzGukp7CDMrp08RQ50YKmuwG47brZgIVPTvBaaAfQlRlygrRqSrxdCiL9M+LlzLBiJ68IR1QqvzHyjC7g==",
       "license": "Apache-2.0",
       "dependencies": {
         "@img/colour": "^1.1.0",
@@ -113,31 +113,31 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-darwin-arm64": "0.35.4",
-        "@img/sharp-darwin-x64": "0.35.4",
-        "@img/sharp-freebsd-wasm32": "0.35.4",
-        "@img/sharp-libvips-darwin-arm64": "1.3.3",
-        "@img/sharp-libvips-darwin-x64": "1.3.3",
-        "@img/sharp-libvips-linux-arm": "1.3.3",
-        "@img/sharp-libvips-linux-arm64": "1.3.3",
-        "@img/sharp-libvips-linux-ppc64": "1.3.3",
-        "@img/sharp-libvips-linux-riscv64": "1.3.3",
-        "@img/sharp-libvips-linux-s390x": "1.3.3",
-        "@img/sharp-libvips-linux-x64": "1.3.3",
-        "@img/sharp-libvips-linuxmusl-arm64": "1.3.3",
-        "@img/sharp-libvips-linuxmusl-x64": "1.3.3",
-        "@img/sharp-linux-arm": "0.35.4",
-        "@img/sharp-linux-arm64": "0.35.4",
-        "@img/sharp-linux-ppc64": "0.35.4",
-        "@img/sharp-linux-riscv64": "0.35.4",
-        "@img/sharp-linux-s390x": "0.35.4",
-        "@img/sharp-linux-x64": "0.35.4",
-        "@img/sharp-linuxmusl-arm64": "0.35.4",
-        "@img/sharp-linuxmusl-x64": "0.35.4",
-        "@img/sharp-webcontainers-wasm32": "0.35.4",
-        "@img/sharp-win32-arm64": "0.35.4",
-        "@img/sharp-win32-ia32": "0.35.4",
-        "@img/sharp-win32-x64": "0.35.4"
+        "@img/sharp-darwin-arm64": "0.35.5",
+        "@img/sharp-darwin-x64": "0.35.5",
+        "@img/sharp-freebsd-wasm32": "0.35.5",
+        "@img/sharp-libvips-darwin-arm64": "1.3.4",
+        "@img/sharp-libvips-darwin-x64": "1.3.4",
+        "@img/sharp-libvips-linux-arm": "1.3.4",
+        "@img/sharp-libvips-linux-arm64": "1.3.4",
+        "@img/sharp-libvips-linux-ppc64": "1.3.4",
+        "@img/sharp-libvips-linux-riscv64": "1.3.4",
+        "@img/sharp-libvips-linux-s390x": "1.3.4",
+        "@img/sharp-libvips-linux-x64": "1.3.4",
+        "@img/sharp-libvips-linuxmusl-arm64": "1.3.4",
+        "@img/sharp-libvips-linuxmusl-x64": "1.3.4",
+        "@img/sharp-linux-arm": "0.35.5",
+        "@img/sharp-linux-arm64": "0.35.5",
+        "@img/sharp-linux-ppc64": "0.35.5",
+        "@img/sharp-linux-riscv64": "0.35.5",
+        "@img/sharp-linux-s390x": "0.35.5",
+        "@img/sharp-linux-x64": "0.35.5",
+        "@img/sharp-linuxmusl-arm64": "0.35.5",
+        "@img/sharp-linuxmusl-x64": "0.35.5",
+        "@img/sharp-webcontainers-wasm32": "0.35.5",
+        "@img/sharp-win32-arm64": "0.35.5",
+        "@img/sharp-win32-ia32": "0.35.5",
+        "@img/sharp-win32-x64": "0.35.5"
       },
       "peerDependenciesMeta": {
         "@types/node": {

package/lambda/asset-transform/dist/node_modules/@img/sharp-libvips-linux-arm64/README.md

@@ -10,7 +10,7 @@ used under the terms of the following licenses:
 | Library       | Used under the terms of                                                                                   |
 |---------------|-----------------------------------------------------------------------------------------------------------|
 | aom           | BSD 2-Clause + [Alliance for Open Media Patent License 1.0](https://aomedia.org/license/patent-license/)  |
-| cairo         | Mozilla Public License 2.0                                                                                |
+| cairo         | Mozilla Public License 1.1                                                                                |
 | cgif          | MIT License                                                                                               |
 | expat         | MIT License                                                                                               |
 | fontconfig    | [fontconfig License](https://gitlab.freedesktop.org/fontconfig/fontconfig/blob/main/COPYING) (BSD-like)   |

package/lambda/asset-transform/dist/node_modules/@img/sharp-libvips-linux-arm64/lib/glib-2.0/include/glibconfig.h

@@ -112,8 +112,8 @@ typedef unsigned long guintptr;
 #define G_GUINTPTR_FORMAT       "lu"
 
 #define GLIB_MAJOR_VERSION 2
-#define GLIB_MINOR_VERSION 89
-#define GLIB_MICRO_VERSION 4
+#define GLIB_MINOR_VERSION 90
+#define GLIB_MICRO_VERSION 0
 
 #define G_OS_UNIX
 

package/lambda/asset-transform/dist/node_modules/@img/sharp-libvips-linux-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@img/sharp-libvips-linux-arm64",
-  "version": "1.3.3",
+  "version": "1.3.4",
   "description": "Prebuilt libvips and dependencies for use with sharp on Linux (glibc) 64-bit ARM",
   "author": "Lovell Fuller <npm@lovell.info>",
   "homepage": "https://sharp.pixelplumbing.com",
@@ -26,7 +26,7 @@
     "./lib": "./lib/index.js",
     "./package": "./package.json",
     "./versions": "./versions.json",
-    "./binary": "./lib/libvips-cpp.so.8.18.6"
+    "./binary": "./lib/libvips-cpp.so.8.18.7"
   },
   "config": {
     "glibc": ">=2.28"

package/lambda/asset-transform/dist/node_modules/@img/sharp-libvips-linux-arm64/versions.json

@@ -1,17 +1,17 @@
 {
-  "aom": "3.15.0",
+  "aom": "3.15.1",
   "archive": "3.8.9",
-  "cairo": "1.18.4",
-  "cgif": "0.5.3",
+  "cairo": "1.18.6",
+  "cgif": "0.5.4",
   "exif": "0.6.26",
-  "expat": "2.8.3",
+  "expat": "2.8.5",
   "ffi": "3.8.0",
   "fontconfig": "2.18.3",
   "freetype": "2.14.3",
-  "fribidi": "1.0.16",
-  "glib": "2.89.4",
-  "harfbuzz": "14.3.1",
-  "heif": "1.23.2",
+  "fribidi": "1.0.17",
+  "glib": "2.90.0",
+  "harfbuzz": "14.5.0",
+  "heif": "1.23.5",
   "highway": "1.4.0",
   "imagequant": "2.4.1",
   "lcms": "2.19.1",
@@ -20,11 +20,11 @@
   "pixman": "0.46.4",
   "png": "1.6.58",
   "proxy-libintl": "0.5",
-  "rsvg": "2.62.91",
+  "rsvg": "2.63.2",
   "tiff": "4.7.2",
   "uhdr": "2.0.2",
-  "vips": "8.18.6",
+  "vips": "8.18.7",
   "webp": "1.6.0",
-  "xml2": "2.15.3",
+  "xml2": "2.15.4",
   "zlib-ng": "2.3.3"
 }

package/lambda/asset-transform/dist/node_modules/@img/sharp-linux-arm64/index.cjs

@@ -1,2 +1,2 @@
 try { require.resolve('@img/sharp-libvips-linux-arm64/binary'); } catch {}
-module.exports = require('./lib/sharp-linux-arm64-0.35.4.node');
+module.exports = require('./lib/sharp-linux-arm64-0.35.5.node');

package/lambda/asset-transform/dist/node_modules/@img/sharp-linux-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@img/sharp-linux-arm64",
-  "version": "0.35.4",
+  "version": "0.35.5",
   "description": "Prebuilt sharp for use with Linux (glibc) 64-bit ARM",
   "author": "Lovell Fuller <npm@lovell.info>",
   "homepage": "https://sharp.pixelplumbing.com",
@@ -15,7 +15,7 @@
   },
   "preferUnplugged": true,
   "optionalDependencies": {
-    "@img/sharp-libvips-linux-arm64": "1.3.3"
+    "@img/sharp-libvips-linux-arm64": "1.3.4"
   },
   "files": [
     "index.cjs",

package/lambda/asset-transform/dist/node_modules/@img/sharp-wasm32/index.cjs

@@ -1 +1 @@
-module.exports = require('./lib/sharp-wasm32-0.35.4.node');
+module.exports = require('./lib/sharp-wasm32-0.35.5.node');