canopycms-cdk 0.0.67 → 0.0.68-int.94

package/dist/constructs/editor-routing.js

@@ -0,0 +1,313 @@
+import { Construct } from 'constructs';
+import { Annotations, Duration, Stack, aws_cloudfront as cloudfront, aws_cloudfront_origins as origins, } from 'aws-cdk-lib';
+import { ASSETS_PATH_PATTERN, ASSETS_TRANSFORM_PATH_PATTERN } from './asset-support.js';
+/** CloudFront's maximum origin read timeout without a service-quota increase. */
+export const MAX_CLOUDFRONT_ORIGIN_READ_TIMEOUT = Duration.seconds(60);
+/**
+ * The routes the editor needs from the CMS Lambda on a distribution it shares
+ * with a site: the editor page and the catch-all API route `canopycms init`
+ * scaffolds. `/edit` and `/edit/*` rather than `/edit*`, which also matches
+ * `/editorial` and `/edit-assets/…` and so takes site pages away from the site.
+ *
+ * Not included, because on a shared distribution they belong to the site:
+ * `/_next/static/*` (the CMS build moves its chunks out of it with Next's
+ * `assetPrefix`; see `editorAssetPrefix`) and `/assets/*`
+ * (`AssetSupport.attachTo` owns it).
+ */
+export const EDITOR_PATH_PATTERNS = ['/edit', '/edit/*', '/api/canopycms/*'];
+/**
+ * One request path per editor pattern that only that pattern serves. A
+ * behavior listed earlier that matches any of these takes the request first.
+ */
+const EDITOR_PROBE_PATHS = {
+    '/edit': ['/edit'],
+    '/edit/*': ['/edit/', '/edit/x'],
+    '/api/canopycms/*': ['/api/canopycms/x'],
+};
+const EDITOR_ROUTES = EDITOR_PATH_PATTERNS.map((pattern) => ({
+    pattern,
+    probes: EDITOR_PROBE_PATHS[pattern],
+}));
+/** Patterns a prefix option must not overlap in either direction. */
+const RESERVED_ROUTES = [
+    ...EDITOR_ROUTES,
+    { pattern: '/_next/*', probes: ['/_next/x'] },
+    { pattern: ASSETS_TRANSFORM_PATH_PATTERN, probes: ['/assets/t/x'] },
+    { pattern: ASSETS_PATH_PATTERN, probes: ['/assets/x'] },
+];
+/** Id of the marker construct `attachEditorBehaviors` adds to the distribution. */
+const EDITOR_ATTACHED_MARKER_ID = 'CanopyEditorBehaviorsAttached';
+/**
+ * Whether a CloudFront path pattern matches a request path: `*` is any run of
+ * characters, `?` exactly one, matching is case-sensitive, and the pattern's
+ * leading `/` is optional.
+ */
+export function cloudFrontPathPatternMatches(pattern, path) {
+    const glob = pattern.startsWith('/') ? pattern : `/${pattern}`;
+    // Greedy wildcard match: on a mismatch, let the most recent `*` absorb one
+    // more character and retry from there.
+    let g = 0;
+    let p = 0;
+    let star = -1;
+    let resume = 0;
+    while (p < path.length) {
+        if (g < glob.length && (glob[g] === '?' || glob[g] === path[p])) {
+            g++;
+            p++;
+        }
+        else if (g < glob.length && glob[g] === '*') {
+            star = g++;
+            resume = p;
+        }
+        else if (star !== -1) {
+            g = star + 1;
+            p = ++resume;
+        }
+        else {
+            return false;
+        }
+    }
+    while (glob[g] === '*')
+        g++;
+    return g === glob.length;
+}
+/**
+ * Throws when the origin read timeout exceeds the 60s CloudFront accepts
+ * without a quota increase, which it would reject at deploy. Neither construct
+ * takes a higher, quota-raised value.
+ */
+export function assertOriginReadTimeout(readTimeout, owner) {
+    if (readTimeout.toSeconds() > MAX_CLOUDFRONT_ORIGIN_READ_TIMEOUT.toSeconds()) {
+        throw new Error(`${owner}: originReadTimeout is ${readTimeout.toSeconds()}s, but CloudFront ` +
+            `allows at most ${MAX_CLOUDFRONT_ORIGIN_READ_TIMEOUT.toSeconds()}s without a service-quota ` +
+            `increase, and these constructs do not take a higher value. Lower the CMS Lambda's ` +
+            `timeout to ${MAX_CLOUDFRONT_ORIGIN_READ_TIMEOUT.toSeconds()}s or less. A shorter origin ` +
+            `timeout than the Lambda's would 504 at the edge on requests that actually succeed.`);
+    }
+}
+/**
+ * The viewer-request function every Lambda behavior needs. CloudFront gives
+ * the origin the Function URL's own Host (forwarding the viewer Host would
+ * break the OAC SigV4 signature), and Lambda Web Adapter adds no
+ * `x-forwarded-*` headers, so without this Clerk/Next derive sign-in redirect
+ * URLs from the IAM-authed Function URL host and the redirect 403s.
+ *
+ * Only `x-forwarded-host`: `x-forwarded-proto` is on CloudFront Functions'
+ * disallowed list and setting it fails every request with a 502. The viewer
+ * side is HTTPS-only, so proto is unambiguous anyway.
+ */
+export function createForwardedHostFunction(scope, id) {
+    return new cloudfront.Function(scope, id, {
+        code: cloudfront.FunctionCode.fromInline([
+            'function handler(event) {',
+            '  var request = event.request;',
+            "  request.headers['x-forwarded-host'] = { value: request.headers.host.value };",
+            '  return request;',
+            '}',
+        ].join('\n')),
+    });
+}
+/**
+ * Response headers for everything the CMS Lambda serves.
+ *
+ * - `frame-ancestors 'self'` (plus `X-Frame-Options: SAMEORIGIN` for browsers
+ *   that ignore it) stops other sites framing the editor. `'self'` keeps the
+ *   editor's own preview iframe working, which frames same-origin site pages.
+ * - Both framing headers have `override: false`, so an origin that sends its
+ *   own CSP keeps it whole; when that CSP has no `frame-ancestors` and the
+ *   origin sends no `X-Frame-Options`, this one applies.
+ * - `X-Robots-Tag: noindex` overrides: nothing the Lambda serves is meant to
+ *   be indexed.
+ * - No `Cross-Origin-Opener-Policy`: it can cut the `window.opener` link a
+ *   popup-based OAuth sign-in reports back through.
+ */
+export function createEditorResponseHeadersPolicy(scope, id) {
+    return new cloudfront.ResponseHeadersPolicy(scope, id, {
+        securityHeadersBehavior: {
+            contentSecurityPolicy: { contentSecurityPolicy: "frame-ancestors 'self'", override: false },
+            frameOptions: { frameOption: cloudfront.HeadersFrameOption.SAMEORIGIN, override: false },
+            contentTypeOptions: { override: true },
+            strictTransportSecurity: {
+                accessControlMaxAge: Duration.days(365),
+                includeSubdomains: false,
+                override: false,
+            },
+        },
+        customHeadersBehavior: {
+            customHeaders: [{ header: 'X-Robots-Tag', value: 'noindex', override: true }],
+        },
+    });
+}
+/**
+ * A year-long cache for content-hashed build output. The cache key carries no
+ * header, cookie or query string, so every viewer shares one copy.
+ */
+export function createStaticCachePolicy(scope, id) {
+    return new cloudfront.CachePolicy(scope, id, {
+        defaultTtl: Duration.days(365),
+        maxTtl: Duration.days(365),
+        minTtl: Duration.days(365),
+        headerBehavior: cloudfront.CacheHeaderBehavior.none(),
+        queryStringBehavior: cloudfront.CacheQueryStringBehavior.none(),
+        cookieBehavior: cloudfront.CacheCookieBehavior.none(),
+    });
+}
+/**
+ * Behavior options for a route the CMS Lambda serves. The managed
+ * CACHING_DISABLED policy as it is: CloudFront rejects any non-none cache-key
+ * setting on a caching-disabled policy, and the origin still gets the whole
+ * viewer request (headers, cookies, query string, minus Host, which would
+ * break the OAC signature) through ALL_VIEWER_EXCEPT_HOST_HEADER.
+ */
+export function lambdaBehaviorOptions(viewerRequestFunction, responseHeadersPolicy) {
+    return {
+        cachePolicy: cloudfront.CachePolicy.CACHING_DISABLED,
+        originRequestPolicy: cloudfront.OriginRequestPolicy.ALL_VIEWER_EXCEPT_HOST_HEADER,
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
+        responseHeadersPolicy,
+        functionAssociations: viewerRequestFunction && [
+            { function: viewerRequestFunction, eventType: cloudfront.FunctionEventType.VIEWER_REQUEST },
+        ],
+    };
+}
+/**
+ * The routes a prefix option adds, after refusing a prefix that is not a
+ * plain path below the root or that overlaps `reserved` in either direction.
+ */
+function prefixRoutes(option, prefix, reserved) {
+    const fail = (reason) => new Error(`CanopyCmsService.attachTo: ${option} '${prefix}' ${reason}.`);
+    if (!prefix.startsWith('/') || prefix === '/') {
+        throw fail("must start with '/' and name a path below the root");
+    }
+    if (prefix.endsWith('/'))
+        throw fail("must not end with a trailing '/'");
+    // CloudFront collapses `//` in request paths, so a pattern holding one never matches.
+    if (prefix.includes('//'))
+        throw fail("must not contain '//'");
+    if (/[*?]/.test(prefix))
+        throw fail('must not contain * or ?, which CloudFront reads as wildcards');
+    if (!/^[A-Za-z0-9_\-.$/~"'@:+&]+$/.test(prefix)) {
+        throw fail(`may hold only the characters CloudFront allows in a path pattern: A-Z a-z 0-9 _-.$/~"'@:+&`);
+    }
+    const routes = option === 'previewPrefix'
+        ? [
+            { pattern: prefix, probes: [prefix] },
+            { pattern: `${prefix}/*`, probes: [`${prefix}/`, `${prefix}/x`] },
+        ]
+        : [{ pattern: `${prefix}/*`, probes: [`${prefix}/x`] }];
+    const overlaps = (a, b) => b.probes.some((path) => cloudFrontPathPatternMatches(a.pattern, path));
+    const clash = reserved.find((route) => routes.some((own) => overlaps(route, own) || overlaps(own, route)));
+    if (clash) {
+        throw fail(`overlaps '${clash.pattern}', so CloudFront would send one route's requests to the ` +
+            `other's behavior. Pick a prefix of its own, such as '/edit-assets' or '/preview'`);
+    }
+    return routes;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** One list from a distribution's L1 config, resolved but still camelCased. */
+function resolvedConfigList(distribution, field) {
+    const cfn = distribution.node.defaultChild;
+    if (!(cfn instanceof cloudfront.CfnDistribution))
+        return [];
+    const config = cfn.distributionConfig;
+    if (!isRecord(config))
+        return [];
+    const list = Stack.of(distribution).resolve(config[field]);
+    return Array.isArray(list) ? list.filter(isRecord) : [];
+}
+/**
+ * Error messages for every behavior that CloudFront would match before one of
+ * the editor's, which leaves that editor route unreachable.
+ */
+function shadowedEditorRoutes(distribution, routes) {
+    const patterns = resolvedConfigList(distribution, 'cacheBehaviors')
+        .map((behavior) => behavior.pathPattern)
+        .filter((pattern) => typeof pattern === 'string');
+    const errors = [];
+    for (const { pattern: editorPattern, probes } of routes) {
+        // The last occurrence, so a duplicate of an editor pattern on either side
+        // of it is reported too.
+        const index = patterns.lastIndexOf(editorPattern);
+        const shadow = patterns
+            .slice(0, index)
+            .find((earlier) => probes.some((path) => cloudFrontPathPatternMatches(earlier, path)));
+        if (index !== -1 && shadow !== undefined) {
+            errors.push(`CanopyCmsService.attachTo: the distribution's '${shadow}' behavior is listed before ` +
+                `the editor's '${editorPattern}' and matches the same requests, so CloudFront never ` +
+                `reaches the editor behavior. Remove hand-wired editor behaviors (such as '/edit*') ` +
+                `and let attachTo add them.`);
+        }
+    }
+    return errors;
+}
+/**
+ * The status codes of custom error responses that replace the origin's
+ * response. A TTL-only entry changes caching, not the response.
+ */
+function rewrittenErrorCodes(distribution) {
+    return resolvedConfigList(distribution, 'customErrorResponses')
+        .filter((entry) => entry.responseCode !== undefined || entry.responsePagePath !== undefined)
+        .map((entry) => entry.errorCode)
+        .filter((code) => typeof code === 'number');
+}
+/**
+ * Attach the editor's behaviors to a distribution. See
+ * `CanopyCmsService.attachTo`, which is the public entry point.
+ */
+export function attachEditorBehaviors(distribution, functionUrl, readTimeout, options = {}) {
+    if (distribution.node.tryFindChild(EDITOR_ATTACHED_MARKER_ID)) {
+        throw new Error('CanopyCmsService: attachTo() was already called for this distribution. Each editor ' +
+            'pattern would be attached twice and CloudFront rejects duplicate path patterns at ' +
+            'deploy time.');
+    }
+    if (options.viewerRequestFunction && options.behaviorOverrides?.functionAssociations) {
+        throw new Error('CanopyCmsService.attachTo: pass viewerRequestFunction or ' +
+            'behaviorOverrides.functionAssociations, not both. The overrides replace the whole ' +
+            'functionAssociations list, so the viewerRequestFunction would be silently dropped.');
+    }
+    assertOriginReadTimeout(readTimeout, 'CanopyCmsService.attachTo');
+    const assetRoutes = options.editorAssetPrefix === undefined
+        ? []
+        : prefixRoutes('editorAssetPrefix', options.editorAssetPrefix, RESERVED_ROUTES);
+    const previewRoutes = options.previewPrefix === undefined
+        ? []
+        : prefixRoutes('previewPrefix', options.previewPrefix, [...RESERVED_ROUTES, ...assetRoutes]);
+    const marker = new Construct(distribution, EDITOR_ATTACHED_MARKER_ID);
+    // Scoped to the distribution so everything lands in its stack, which may
+    // not be the service's.
+    // None at all when the overrides bring their own associations, which would
+    // otherwise leave a deployed function associated with nothing.
+    const viewerRequestFunction = options.viewerRequestFunction ??
+        (options.behaviorOverrides?.functionAssociations
+            ? undefined
+            : createForwardedHostFunction(distribution, 'CanopyEditorForwardedHostFunction'));
+    const responseHeadersPolicy = options.behaviorOverrides?.responseHeadersPolicy ??
+        createEditorResponseHeadersPolicy(distribution, 'CanopyEditorResponseHeadersPolicy');
+    const behavior = lambdaBehaviorOptions(viewerRequestFunction, responseHeadersPolicy);
+    const definedOverrides = Object.fromEntries(Object.entries(options.behaviorOverrides ?? {}).filter(([, value]) => value !== undefined));
+    const origin = origins.FunctionUrlOrigin.withOriginAccessControl(functionUrl, { readTimeout });
+    for (const { pattern } of [...EDITOR_ROUTES, ...previewRoutes]) {
+        distribution.addBehavior(pattern, origin, { ...behavior, ...definedOverrides });
+    }
+    for (const { pattern } of assetRoutes) {
+        distribution.addBehavior(pattern, origin, {
+            cachePolicy: createStaticCachePolicy(distribution, 'CanopyEditorAssetCachePolicy'),
+            viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+            responseHeadersPolicy,
+        });
+    }
+    const routes = [...EDITOR_ROUTES, ...previewRoutes, ...assetRoutes];
+    // Custom error responses are fixed at construction, so they are known now.
+    const rewritten = rewrittenErrorCodes(distribution);
+    if (rewritten.length > 0) {
+        Annotations.of(distribution).addWarningV2('canopycms:editor-custom-error-responses', `This distribution rewrites ${rewritten.join(', ')} responses, and CloudFront custom ` +
+            `error responses are distribution-wide: they also replace the editor API's JSON errors, ` +
+            `so the editor reports "Unexpected response from server" instead of the real error. ` +
+            `See "Custom error responses" in docs/deploying-to-aws.md.`);
+    }
+    // Behaviors can still be added after this call, so shadowing is checked at synth.
+    marker.node.addValidation({ validate: () => shadowedEditorRoutes(distribution, routes) });
+}

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export { CmsWorker } from './worker.js';
 export type { CmsWorkerConfig } from './worker.js';
 export { CanopyCmsService } from './constructs/cms-service.js';
 export type { CanopyCmsServiceProps } from './constructs/cms-service.js';
+export type { CanopyCmsAttachOptions } from './constructs/editor-routing.js';
 export { CanopyCmsDistribution } from './constructs/cms-distribution.js';
 export type { CanopyCmsDistributionProps } from './constructs/cms-distribution.js';
 export { AssetSupport, assetUploadBehavior } from './constructs/asset-support.js';

package/lambda/asset-transform/dist/handler.js

@@ -4304,7 +4304,8 @@ var init_field = __esm({
     });
     objectFieldSchema = fieldBaseSchema.extend({
       type: external_exports.literal("object"),
-      fields: external_exports.array(external_exports.lazy(() => fieldHolder[0])).min(1)
+      fields: external_exports.array(external_exports.lazy(() => fieldHolder[0])).min(1),
+      itemTitleField: external_exports.string().min(1).optional()
     });
     inlineGroupFieldSchema = external_exports.object({
       type: external_exports.literal("group"),
@@ -4418,7 +4419,7 @@ var init_sanitize_href = __esm({
 });
 
 // ../canopycms/src/config/schemas/url.ts
-var uploadTargetUrlSchema, assetMountUrlSchema;
+var uploadTargetUrlSchema, assetMountUrlSchema, previewPrefixSchema;
 var init_url = __esm({
   "../canopycms/src/config/schemas/url.ts"() {
     "use strict";
@@ -4430,6 +4431,9 @@ var init_url = __esm({
     assetMountUrlSchema = external_exports.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value, { allowProtocolRelative: true }), {
       message: 'must be an absolute http(s) URL, a protocol-relative "//host" URL, or a site-relative path beginning with a single "/", with no query or fragment'
     });
+    previewPrefixSchema = external_exports.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value), {
+      message: 'editor.previewPrefix must be an absolute http(s) URL or a site-relative path beginning with a single "/", with no query or fragment'
+    });
   }
 });
 
@@ -4487,6 +4491,7 @@ var init_config = __esm({
     init_zod();
     init_collection();
     init_media();
+    init_url();
     defaultBranchAccessSchema = external_exports.enum(["allow", "deny"]).default("deny");
     defaultPathAccessLevelSchema = external_exports.enum(["allow", "deny"]);
     defaultPathAccessLevelsSchema = external_exports.object({
@@ -4518,6 +4523,7 @@ var init_config = __esm({
       subtitle: external_exports.string().optional(),
       theme: external_exports.unknown().optional(),
       previewBase: external_exports.record(external_exports.string()).optional(),
+      previewPrefix: previewPrefixSchema.optional(),
       // UI handler functions (runtime only, don't serialize)
       onAccountClick: external_exports.function().returns(external_exports.void()).optional(),
       onLogoutClick: external_exports.function().returns(external_exports.void()).optional(),
@@ -4545,6 +4551,9 @@ var init_config = __esm({
       defaultRemoteUrl: defaultRemoteUrlSchema.optional(),
       gitBotAuthorName: gitBotAuthorNameSchema,
       gitBotAuthorEmail: gitBotAuthorEmailSchema,
+      // Unset reads as on for Edited-by and off for Co-authored-by (services.ts submitBranch).
+      gitEditedByTrailers: external_exports.boolean().optional(),
+      gitCoAuthoredByTrailers: external_exports.boolean().optional(),
       githubTokenEnvVar: githubTokenEnvVarSchema.optional(),
       // Required by design (follow-up to SEC-C1): a prod deploy that omits `mode` must fail
       // validation loudly rather than silently running header-trusting dev auth semantics.
@@ -4556,7 +4565,6 @@ var init_config = __esm({
       // Default false/unset — the standard AWS Lambda+worker topology must leave this unset.
       allowNetworkRemoteInProd: external_exports.boolean().optional(),
       settingsBranch: external_exports.string().optional(),
-      autoCreateSettingsPR: external_exports.boolean().optional(),
       // `.optional()`, NOT bare `deploymentNameSchema`: its own `.default('prod')` would make
       // `parse(undefined)` resolve to 'prod' instead of staying `undefined`, collapsing the
       // env > config > modeDefault precedence chain `resolveDeploymentName`
@@ -6858,7 +6866,7 @@ var require_node = __commonJS({
     var tty = require("tty");
     var util2 = require("util");
     exports2.init = init;
-    exports2.log = log10;
+    exports2.log = log11;
     exports2.formatArgs = formatArgs;
     exports2.save = save;
     exports2.load = load;
@@ -6993,7 +7001,7 @@ var require_node = __commonJS({
       }
       return (/* @__PURE__ */ new Date()).toISOString() + " ";
     }
-    function log10(...args) {
+    function log11(...args) {
       return process.stderr.write(util2.formatWithOptions(exports2.inspectOpts, ...args) + "\n");
     }
     function save(namespaces) {
@@ -7047,27 +7055,27 @@ var require_src2 = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     var fs_1 = require("fs");
     var debug_1 = __importDefault(require_src());
-    var log10 = debug_1.default("@kwsites/file-exists");
+    var log11 = debug_1.default("@kwsites/file-exists");
     function check(path3, isFile, isDirectory) {
-      log10(`checking %s`, path3);
+      log11(`checking %s`, path3);
       try {
         const stat = fs_1.statSync(path3);
         if (stat.isFile() && isFile) {
-          log10(`[OK] path represents a file`);
+          log11(`[OK] path represents a file`);
           return true;
         }
         if (stat.isDirectory() && isDirectory) {
-          log10(`[OK] path represents a directory`);
+          log11(`[OK] path represents a directory`);
           return true;
         }
-        log10(`[FAIL] path represents something other than a file or directory`);
+        log11(`[FAIL] path represents something other than a file or directory`);
         return false;
       } catch (e) {
         if (e.code === "ENOENT") {
-          log10(`[FAIL] path is not accessible: %o`, e);
+          log11(`[FAIL] path is not accessible: %o`, e);
           return false;
         }
-        log10(`[FATAL] %o`, e);
+        log11(`[FATAL] %o`, e);
         throw e;
       }
     }
@@ -12661,7 +12669,7 @@ var require_merge2 = __commonJS({
 var require_addPairToJSMap = __commonJS({
   "../../node_modules/.pnpm/yaml@2.8.3/node_modules/yaml/dist/nodes/addPairToJSMap.js"(exports2) {
     "use strict";
-    var log10 = require_log();
+    var log11 = require_log();
     var merge = require_merge2();
     var stringify = require_stringify2();
     var identity = require_identity();
@@ -12710,7 +12718,7 @@ var require_addPairToJSMap = __commonJS({
           let jsonStr = JSON.stringify(strKey);
           if (jsonStr.length > 40)
             jsonStr = jsonStr.substring(0, 36) + '..."';
-          log10.warn(ctx.doc.options.logLevel, `Keys with collection values will be stringified due to JS Object restrictions: ${jsonStr}. Set mapAsMap: true to use object keys.`);
+          log11.warn(ctx.doc.options.logLevel, `Keys with collection values will be stringified due to JS Object restrictions: ${jsonStr}. Set mapAsMap: true to use object keys.`);
           ctx.mapKeyWarned = true;
         }
         return strKey;
@@ -18106,7 +18114,7 @@ var require_public_api = __commonJS({
     var composer = require_composer();
     var Document = require_Document();
     var errors = require_errors();
-    var log10 = require_log();
+    var log11 = require_log();
     var identity = require_identity();
     var lineCounter = require_line_counter();
     var parser4 = require_parser();
@@ -18158,7 +18166,7 @@ var require_public_api = __commonJS({
       const doc = parseDocument2(src, options2);
       if (!doc)
         return null;
-      doc.warnings.forEach((warning) => log10.warn(doc.options.logLevel, warning));
+      doc.warnings.forEach((warning) => log11.warn(doc.options.logLevel, warning));
       if (doc.errors.length > 0) {
         if (doc.options.logLevel !== "silent")
           throw doc.errors[0];
@@ -19195,7 +19203,7 @@ var require_dist_node5 = __commonJS({
     }
     function fetchWrapper(requestOptions) {
       var _a3, _b, _c, _d;
-      const log10 = requestOptions.request && requestOptions.request.log ? requestOptions.request.log : console;
+      const log11 = requestOptions.request && requestOptions.request.log ? requestOptions.request.log : console;
       const parseSuccessResponseBody = ((_a3 = requestOptions.request) == null ? void 0 : _a3.parseSuccessResponseBody) !== false;
       if (isPlainObject(requestOptions.body) || Array.isArray(requestOptions.body)) {
         requestOptions.body = JSON.stringify(requestOptions.body);
@@ -19230,7 +19238,7 @@ var require_dist_node5 = __commonJS({
         if ("deprecation" in headers) {
           const matches = headers.link && headers.link.match(/<([^<>]+)>; rel="deprecation"/);
           const deprecationLink = matches && matches.pop();
-          log10.warn(
+          log11.warn(
             `[@octokit/request] "${requestOptions.method} ${requestOptions.url}" is deprecated. It is scheduled to be removed on ${headers.sunset}${deprecationLink ? `. See ${deprecationLink}` : ""}`
           );
         }
@@ -24030,6 +24038,7 @@ init_validation();
 
 // ../canopycms/src/paths/branch.ts
 init_operating_mode();
+init_error();
 
 // ../canopycms/src/branch-metadata-file.ts
 init_error();
@@ -24093,6 +24102,10 @@ var DebugLogger = class {
       throw new Error(errorMsg);
     }
   }
+  /**
+   * Keyed by label alone, so two overlapping timers with one label overwrite each other;
+   * anything that can run concurrently uses {@link timed}.
+   */
   time(label) {
     this.timers.set(label, Date.now());
   }
@@ -24107,12 +24120,16 @@ var DebugLogger = class {
     this.debug(category, `${label} completed`, { durationMs: duration });
     return duration;
   }
+  /**
+   * Log `<label> completed {durationMs}` once `fn` settles. The start time is local to the
+   * call, so concurrent spans with the same label on one logger never overwrite each other.
+   */
   async timed(category, label, fn) {
-    this.time(label);
+    const start = Date.now();
     try {
       return await fn();
     } finally {
-      this.timeEnd(category, label);
+      this.debug(category, `${label} completed`, { durationMs: Date.now() - start });
     }
   }
 };
@@ -25722,11 +25739,11 @@ function taskCallback(task, response, callback = NOOP) {
   response.then(onSuccess, onError2);
 }
 function addDeprecationNoticeToError(err2) {
-  let log10 = (name) => {
+  let log11 = (name) => {
     console.warn(
       `simple-git deprecation notice: accessing GitResponseError.${name} should be GitResponseError.git.${name}, this will no longer be available in version 3`
     );
-    log10 = NOOP;
+    log11 = NOOP;
   };
   return Object.create(err2, Object.getOwnPropertyNames(err2.git).reduce(descriptorReducer, {}));
   function descriptorReducer(all, name) {
@@ -25737,7 +25754,7 @@ function addDeprecationNoticeToError(err2) {
       enumerable: false,
       configurable: false,
       get() {
-        log10(name);
+        log11(name);
         return err2.git[name];
       }
     };
@@ -28400,6 +28417,11 @@ init_flatten();
 // ../canopycms/src/validation/entry-type-reference-validator.ts
 init_validation2();
 
+// ../canopycms/src/utils/request-timing.ts
+var import_node_async_hooks = require("node:async_hooks");
+var storage = new import_node_async_hooks.AsyncLocalStorage();
+var log4 = createDebugLogger({ prefix: "CanopyCMS" });
+
 // ../canopycms/src/git-manager.ts
 init_error();
 
@@ -28409,10 +28431,10 @@ init_error();
 init_logger();
 
 // ../canopycms/src/git-manager.ts
-var log4 = createDebugLogger({ prefix: "GitManager" });
+var log5 = createDebugLogger({ prefix: "GitManager" });
 
 // ../canopycms/src/branch-workspace.ts
-var log5 = createDebugLogger({ prefix: "BranchWorkspace" });
+var log6 = createDebugLogger({ prefix: "BranchWorkspace" });
 
 // ../canopycms/src/content-store.ts
 var import_gray_matter2 = __toESM(require_gray_matter(), 1);
@@ -28523,7 +28545,7 @@ init_normalize();
 init_error();
 
 // ../canopycms/src/entry-link-resolver.ts
-var log6 = createDebugLogger({ prefix: "EntryLinks" });
+var log7 = createDebugLogger({ prefix: "EntryLinks" });
 var BASE58_CHAR = "[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]";
 var ENTRY_LINK_PATTERN = new RegExp(`entry:(${BASE58_CHAR}{12})(#[^\\s)>"']*)?`, "g");
 
@@ -30162,7 +30184,7 @@ init_operating_mode();
 
 // ../canopycms/src/settings-workspace.ts
 init_error();
-var log7 = createDebugLogger({ prefix: "SettingsWorkspace" });
+var log8 = createDebugLogger({ prefix: "SettingsWorkspace" });
 
 // ../canopycms/src/github-service.ts
 var import_rest = __toESM(require_dist_node12(), 1);
@@ -30170,6 +30192,11 @@ var import_plugin_throttling = __toESM(require_dist_node13(), 1);
 init_operating_mode();
 init_error();
 init_logger();
+
+// ../canopycms/src/submission-attribution.ts
+init_logger();
+
+// ../canopycms/src/github-service.ts
 var ThrottledOctokit = import_rest.Octokit.plugin(import_plugin_throttling.throttling);
 
 // ../canopycms/src/services.ts
@@ -30181,6 +30208,9 @@ var debugLogger = createDebugLogger({ prefix: "TaskQueue" });
 // ../canopycms/src/task-queue/task-queue-config.ts
 init_config3();
 
+// ../canopycms/src/services.ts
+init_error();
+
 // ../canopycms/src/url-path-resolver.ts
 init_normalize();
 
@@ -30189,10 +30219,10 @@ var import_gray_matter3 = __toESM(require_gray_matter(), 1);
 var import_yaml3 = __toESM(require_dist4(), 1);
 init_content_id_index();
 init_error();
-var log8 = createDebugLogger({ prefix: "ContentListing" });
+var log9 = createDebugLogger({ prefix: "ContentListing" });
 
 // ../canopycms/src/context.ts
-var log9 = createDebugLogger({ prefix: "Context" });
+var log10 = createDebugLogger({ prefix: "Context" });
 
 // ../canopycms/src/server.ts
 init_operating_mode();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "canopycms-cdk",
-  "version": "0.0.67",
+  "version": "0.0.68-int.94",
   "description": "AWS CDK constructs and EC2 worker for CanopyCMS deployment",
   "license": "MIT",
   "repository": {
@@ -31,7 +31,7 @@
   "peerDependencies": {
     "aws-cdk-lib": "^2.260.0",
     "constructs": "^10.0.0",
-    "canopycms": "0.0.67"
+    "canopycms": "0.0.68-int.94"
   },
   "peerDependenciesMeta": {
     "aws-cdk-lib": {
@@ -56,8 +56,8 @@
     "tsx": "^4.19.0",
     "typescript": "^5.6.3",
     "vitest": "^4.1.0",
-    "canopycms": "0.0.67",
-    "canopycms-auth-clerk": "0.0.67"
+    "canopycms": "0.0.68-int.94",
+    "canopycms-auth-clerk": "0.0.68-int.94"
   },
   "scripts": {
     "build": "rm -rf dist && tsc && node ../../scripts/add-js-extensions.mjs dist",