canopycms 0.0.61-int.75 → 0.0.61

package/dist/cli/init.js

@@ -267,6 +267,16 @@ var init_config = __esm({
       allowNetworkRemoteInProd: z4.boolean().optional(),
       settingsBranch: z4.string().optional(),
       autoCreateSettingsPR: z4.boolean().optional(),
+      // Deliberately `deploymentNameSchema.optional()`, NOT `deploymentNameSchema` alone.
+      // deploymentNameSchema.default('prod') would make `parse(undefined)` resolve to
+      // the literal 'prod' instead of staying `undefined` — collapsing the
+      // env > config > modeDefault precedence chain that resolveDeploymentName
+      // (operating-mode/deployment-name.ts) implements: config would then always
+      // "win" over modeDefault (masking dev's real default of 'local'), and the env
+      // var would just be racing config's baked-in 'prod' instead of a true absence.
+      // `.optional()` here is what keeps an omitted deploymentName reaching
+      // resolveDeploymentName as `undefined`, so it can fall through to modeDefault.
+      // Do not "fix" this by removing `.optional()`.
       deploymentName: deploymentNameSchema.optional(),
       contentRoot: contentRootSchema.default("content"),
       sourceRoot: sourceRootSchema.optional(),
@@ -356,14 +366,59 @@ var init_config2 = __esm({
   }
 });
 
+// dist/utils/error.js
+function getErrorMessage(err) {
+  if (err instanceof Error) {
+    return err.message;
+  }
+  if (typeof err === "string") {
+    return err;
+  }
+  return String(err);
+}
+function isNodeError(err) {
+  return err instanceof Error && "code" in err;
+}
+function isNotFoundError(err) {
+  return isNodeError(err) && err.code === "ENOENT";
+}
+var init_error = __esm({
+  "dist/utils/error.js"() {
+    "use strict";
+  }
+});
+
+// dist/utils/fs.js
+import fs from "node:fs/promises";
+async function filePathExists(filePath) {
+  try {
+    await fs.stat(filePath);
+    return true;
+  } catch (err) {
+    if (isNotFoundError(err))
+      return false;
+    throw err;
+  }
+}
+var init_fs = __esm({
+  "dist/utils/fs.js"() {
+    "use strict";
+    init_error();
+  }
+});
+
 // dist/cli/templates.js
 var templates_exports = {};
 __export(templates_exports, {
+  SCAFFOLD_STACK_NAME: () => SCAFFOLD_STACK_NAME,
   aiConfig: () => aiConfig,
   aiRoute: () => aiRoute,
   apiRoute: () => apiRoute,
   canopyCmsConfig: () => canopyCmsConfig,
   canopyContext: () => canopyContext,
+  cdkApp: () => cdkApp,
+  cdkJson: () => cdkJson,
+  cmsStack: () => cmsStack,
   dockerfileCms: () => dockerfileCms,
   dockerignore: () => dockerignore,
   editPage: () => editPage,
@@ -427,21 +482,205 @@ async function nextConfig(options) {
   const templateName = options.staticBuild ? "next.config-static.ts.template" : "next.config.ts.template";
   return readTemplate(templateName);
 }
-async function dockerfileCms() {
-  return readTemplate("Dockerfile.cms.template");
+async function dockerfileCms(options) {
+  const template = await readTemplate("Dockerfile.cms.template");
+  return template.replace("{{DOCKER_COPY}}", options.copy).replace("{{DOCKER_INSTALL}}", options.install).replace("{{DOCKER_BUILD}}", options.build);
 }
 async function dockerignore() {
   return readTemplate("dockerignore.template");
 }
-async function githubWorkflowCms() {
-  return readTemplate("deploy-cms.yml.template");
+async function githubWorkflowCms(options) {
+  const template = await readTemplate("deploy-cms.yml.template");
+  return template.replace("{{DEFAULT_BRANCH}}", options.defaultBranch).replace("{{LOCKFILE}}", options.lockfile).replace("{{CI_INSTALL}}", options.ciInstall).replaceAll("{{ADD_DEV}}", options.addDev).replace("{{STACK_NAME}}", SCAFFOLD_STACK_NAME);
+}
+async function cdkJson() {
+  return readTemplate("cdk.json.template");
 }
-var __dirname, TEMPLATES_DIR;
+async function cdkApp(options) {
+  const template = await readTemplate("cdk-app.ts.template");
+  return template.replace("{{STACK_NAME}}", SCAFFOLD_STACK_NAME).replace("{{GITHUB_OWNER}}", options.githubOwner).replace("{{GITHUB_REPO}}", options.githubRepo);
+}
+async function cmsStack() {
+  return readTemplate("cms-stack.ts.template");
+}
+var __dirname, TEMPLATES_DIR, SCAFFOLD_STACK_NAME;
 var init_templates = __esm({
   "dist/cli/templates.js"() {
     "use strict";
     __dirname = path2.dirname(fileURLToPath(import.meta.url));
     TEMPLATES_DIR = path2.join(__dirname, "template-files");
+    SCAFFOLD_STACK_NAME = "CanopyCms";
+  }
+});
+
+// dist/cli/project-detect.js
+var project_detect_exports = {};
+__export(project_detect_exports, {
+  CDK_DEPENDENCIES: () => CDK_DEPENDENCIES,
+  commandsFor: () => commandsFor,
+  detectDefaultBranch: () => detectDefaultBranch,
+  detectGitHubRepo: () => detectGitHubRepo,
+  detectPackageManager: () => detectPackageManager,
+  missingCdkDependencies: () => missingCdkDependencies,
+  readPackageJson: () => readPackageJson
+});
+import fs3 from "node:fs/promises";
+import path3 from "node:path";
+import { simpleGit } from "simple-git";
+function commandsFor(manager) {
+  return COMMANDS[manager];
+}
+async function detectPackageManager(projectDir) {
+  for (const dir of await workspaceSearchPath(projectDir)) {
+    const declared = await readDeclaredPackageManager(dir);
+    if (declared)
+      return declared;
+    if (await filePathExists(path3.join(dir, "pnpm-lock.yaml")))
+      return "pnpm";
+    if (await filePathExists(path3.join(dir, "yarn.lock"))) {
+      return await isYarnBerryLockfile(dir) ? "yarn-berry" : "yarn";
+    }
+  }
+  return "npm";
+}
+async function workspaceSearchPath(projectDir) {
+  const start = path3.resolve(projectDir);
+  const dirs = [start];
+  if (!await filePathExists(path3.join(start, "package.json")))
+    return dirs;
+  let dir = start;
+  for (let depth = 0; depth < MAX_WORKSPACE_DEPTH; depth++) {
+    if (await filePathExists(path3.join(dir, ".git")))
+      break;
+    const parent = path3.dirname(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
+    dirs.push(dir);
+  }
+  return dirs;
+}
+async function readDeclaredPackageManager(projectDir) {
+  const pkg = await readPackageJson(projectDir);
+  const declared = pkg?.["packageManager"];
+  if (typeof declared !== "string")
+    return null;
+  if (declared.startsWith("pnpm@"))
+    return "pnpm";
+  if (declared.startsWith("npm@"))
+    return "npm";
+  if (declared.startsWith("yarn@")) {
+    const major = Number.parseInt(declared.slice("yarn@".length), 10);
+    if (Number.isFinite(major) && major >= 2)
+      return "yarn-berry";
+    if (Number.isFinite(major))
+      return "yarn";
+    return await isYarnBerryLockfile(projectDir) ? "yarn-berry" : "yarn";
+  }
+  return null;
+}
+async function isYarnBerryLockfile(projectDir) {
+  try {
+    const content = await fs3.readFile(path3.join(projectDir, "yarn.lock"), "utf-8");
+    return content.includes("__metadata:");
+  } catch {
+    return false;
+  }
+}
+async function detectDefaultBranch(projectDir) {
+  const head = await gitRaw(projectDir, ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"]);
+  if (!head)
+    return "main";
+  const slash = head.indexOf("/");
+  const branch = slash === -1 ? head : head.slice(slash + 1);
+  return branch || "main";
+}
+async function detectGitHubRepo(projectDir) {
+  const url = await gitRaw(projectDir, ["remote", "get-url", "origin"]);
+  if (!url)
+    return null;
+  const match = /github\.com[:/]+([^/]+)\/(.+?)(?:\.git)?\/?$/.exec(url);
+  if (!match)
+    return null;
+  return { owner: match[1], repo: match[2] };
+}
+async function gitRaw(projectDir, args) {
+  try {
+    const output = await simpleGit({ baseDir: projectDir }).raw(args);
+    const trimmed = output.trim();
+    return trimmed.length > 0 ? trimmed : null;
+  } catch {
+    return null;
+  }
+}
+async function readPackageJson(projectDir) {
+  try {
+    const raw = await fs3.readFile(path3.join(projectDir, "package.json"), "utf-8");
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function missingCdkDependencies(projectDir) {
+  const pkg = await readPackageJson(projectDir);
+  const declared = /* @__PURE__ */ new Set();
+  for (const field of ["dependencies", "devDependencies", "peerDependencies"]) {
+    const section = pkg?.[field];
+    if (typeof section === "object" && section !== null) {
+      for (const name of Object.keys(section))
+        declared.add(name);
+    }
+  }
+  return CDK_DEPENDENCIES.filter((name) => !declared.has(name));
+}
+var COMMANDS, MAX_WORKSPACE_DEPTH, CDK_DEPENDENCIES;
+var init_project_detect = __esm({
+  "dist/cli/project-detect.js"() {
+    "use strict";
+    init_fs();
+    COMMANDS = {
+      npm: {
+        lockfile: "package-lock.json",
+        ciInstall: "npm ci",
+        dockerCopy: "COPY package*.json ./",
+        dockerInstall: "RUN npm ci",
+        build: "npm run build",
+        addDev: "npm install --save-dev"
+      },
+      pnpm: {
+        lockfile: "pnpm-lock.yaml",
+        ciInstall: "corepack enable && pnpm install --frozen-lockfile",
+        dockerCopy: "COPY package.json pnpm-lock.yaml ./",
+        dockerInstall: "RUN corepack enable && pnpm install --frozen-lockfile",
+        build: "pnpm run build",
+        addDev: "pnpm add -D"
+      },
+      yarn: {
+        lockfile: "yarn.lock",
+        ciInstall: "corepack enable && yarn install --frozen-lockfile",
+        dockerCopy: "COPY package.json yarn.lock ./",
+        dockerInstall: "RUN corepack enable && yarn install --frozen-lockfile",
+        build: "yarn build",
+        addDev: "yarn add -D"
+      },
+      "yarn-berry": {
+        lockfile: "yarn.lock",
+        ciInstall: "corepack enable && yarn install --immutable",
+        dockerCopy: "COPY package.json yarn.lock .yarnrc.yml ./",
+        dockerInstall: "RUN corepack enable && yarn install --immutable",
+        build: "yarn build",
+        addDev: "yarn add -D"
+      }
+    };
+    MAX_WORKSPACE_DEPTH = 8;
+    CDK_DEPENDENCIES = [
+      "canopycms-cdk",
+      "aws-cdk-lib",
+      "constructs",
+      "tsx",
+      "aws-cdk"
+    ];
   }
 });
 
@@ -450,15 +689,15 @@ var task_queue_config_exports = {};
 __export(task_queue_config_exports, {
   getTaskQueueDir: () => getTaskQueueDir
 });
-import path3 from "node:path";
+import path4 from "node:path";
 function getTaskQueueDir(config) {
   switch (config.mode) {
     case "prod": {
       const workspace = process.env.CANOPYCMS_WORKSPACE_ROOT ?? DEFAULT_PROD_WORKSPACE;
-      return path3.join(path3.resolve(workspace), ".tasks");
+      return path4.join(path4.resolve(workspace), ".tasks");
     }
     case "dev": {
-      return path3.join(process.cwd(), ".canopy-dev", ".tasks");
+      return path4.join(process.cwd(), ".canopy-dev", ".tasks");
     }
   }
 }
@@ -495,10 +734,21 @@ var init_debug = __esm({
         const minLevel = this.options.minLevel ?? "DEBUG";
         return LOG_LEVELS[level] >= LOG_LEVELS[minLevel];
       }
+      /**
+       * The ISO-8601 timestamp leads the line BARE - not wrapped in brackets as it
+       * once was. `CANOPYCMS_DEBUG=true` can be set on the EC2 worker, whose stdout
+       * appends to /var/log/canopy-worker/worker.log; the CloudWatch agent's
+       * `multi_line_start_pattern` matches the timestamp at the START of a line
+       * (see worker/log.ts's INVARIANT and cms-service.ts's agent config), so a
+       * leading `[` meant every debug line was silently folded into the previous
+       * event instead of starting its own. The bracketed `[prefix:category]` and
+       * `[level]` fields still follow, so the human-readable shape is unchanged
+       * apart from those two characters.
+       */
       formatMessage(level, category, message) {
         const timestamp = (/* @__PURE__ */ new Date()).toISOString();
         const prefix = this.options.prefix ?? "CanopyCMS";
-        return `[${timestamp}] [${prefix}:${category}] [${level}] ${message}`;
+        return `${timestamp} [${prefix}:${category}] [${level}] ${message}`;
       }
       debug(category, message, data) {
         if (this.shouldLog("DEBUG")) {
@@ -567,17 +817,17 @@ var init_debug = __esm({
 });
 
 // dist/utils/atomic-write.js
-import fs3 from "node:fs/promises";
-import path4 from "node:path";
+import fs4 from "node:fs/promises";
+import path5 from "node:path";
 async function atomicWriteFile(filePath, content) {
-  const dir = path4.dirname(filePath);
-  await fs3.mkdir(dir, { recursive: true });
+  const dir = path5.dirname(filePath);
+  await fs4.mkdir(dir, { recursive: true });
   const tempPath = `${filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-  await fs3.writeFile(tempPath, content, typeof content === "string" ? "utf-8" : void 0);
+  await fs4.writeFile(tempPath, content, typeof content === "string" ? "utf-8" : void 0);
   try {
-    await fs3.rename(tempPath, filePath);
+    await fs4.rename(tempPath, filePath);
   } catch (err) {
-    await fs3.unlink(tempPath).catch(() => {
+    await fs4.unlink(tempPath).catch(() => {
     });
     throw err;
   }
@@ -589,15 +839,15 @@ var init_atomic_write = __esm({
 });
 
 // dist/task-queue/task-queue.js
-import fs4 from "node:fs/promises";
-import path5 from "node:path";
+import fs5 from "node:fs/promises";
+import path6 from "node:path";
 import crypto from "node:crypto";
 function isNotFoundError2(err) {
   return err instanceof Error && "code" in err && err.code === "ENOENT";
 }
 async function enqueueTask(taskDir, task, logger = nullLogger) {
   const id = crypto.randomUUID();
-  const pendingDir = path5.join(taskDir, "pending");
+  const pendingDir = path6.join(taskDir, "pending");
   const queuedTask = {
     id,
     action: task.action,
@@ -607,17 +857,17 @@ async function enqueueTask(taskDir, task, logger = nullLogger) {
     retryCount: 0,
     maxRetries: task.maxRetries ?? DEFAULT_MAX_RETRIES
   };
-  const filePath = path5.join(pendingDir, `${id}.json`);
+  const filePath = path6.join(pendingDir, `${id}.json`);
   await atomicWriteFile(filePath, JSON.stringify(queuedTask, null, 2));
   logger.debug("Enqueued task", { id, action: task.action });
   return id;
 }
 async function dequeueTask(taskDir, logger = nullLogger) {
-  const pendingDir = path5.join(taskDir, "pending");
-  const processingDir = path5.join(taskDir, "processing");
+  const pendingDir = path6.join(taskDir, "pending");
+  const processingDir = path6.join(taskDir, "processing");
   let files;
   try {
-    files = await fs4.readdir(pendingDir);
+    files = await fs5.readdir(pendingDir);
   } catch {
     return null;
   }
@@ -628,7 +878,7 @@ async function dequeueTask(taskDir, logger = nullLogger) {
   const tasks = [];
   for (const fileName of jsonFiles) {
     try {
-      const content = await fs4.readFile(path5.join(pendingDir, fileName), "utf-8");
+      const content = await fs5.readFile(path6.join(pendingDir, fileName), "utf-8");
       const task = parseTaskJson(content);
       if (!task) {
         await moveToCorrupt(taskDir, pendingDir, fileName, "Invalid JSON", logger);
@@ -649,17 +899,17 @@ async function dequeueTask(taskDir, logger = nullLogger) {
   tasks.sort((a, b) => a.task.createdAt.localeCompare(b.task.createdAt) || a.task.id.localeCompare(b.task.id));
   for (const { fileName, task } of tasks) {
     if (await taskExistsIn(taskDir, task.id, ["completed", "failed"])) {
-      await fs4.unlink(path5.join(pendingDir, fileName)).catch(() => {
+      await fs5.unlink(path6.join(pendingDir, fileName)).catch(() => {
       });
       logger.debug("Skipped already-finished task", { id: task.id });
       continue;
     }
-    const sourcePath = path5.join(pendingDir, fileName);
-    const destPath = path5.join(processingDir, fileName);
+    const sourcePath = path6.join(pendingDir, fileName);
+    const destPath = path6.join(processingDir, fileName);
     try {
       task.status = "processing";
       await atomicWriteFile(destPath, JSON.stringify(task, null, 2));
-      await fs4.unlink(sourcePath);
+      await fs5.unlink(sourcePath);
       logger.debug("Dequeued task", { id: task.id, action: task.action });
       return task;
     } catch (err) {
@@ -671,16 +921,16 @@ async function dequeueTask(taskDir, logger = nullLogger) {
   return null;
 }
 async function completeTask(taskDir, taskId, result, logger = nullLogger) {
-  const processingPath = path5.join(taskDir, "processing", `${taskId}.json`);
-  const completedDir = path5.join(taskDir, "completed");
-  const completedPath = path5.join(completedDir, `${taskId}.json`);
+  const processingPath = path6.join(taskDir, "processing", `${taskId}.json`);
+  const completedDir = path6.join(taskDir, "completed");
+  const completedPath = path6.join(completedDir, `${taskId}.json`);
   let task;
   try {
-    const content = await fs4.readFile(processingPath, "utf-8");
+    const content = await fs5.readFile(processingPath, "utf-8");
     const parsed = parseTaskJson(content);
     if (!parsed) {
       logger.debug("Corrupt task file in processing, removing", { id: taskId });
-      await fs4.unlink(processingPath).catch(() => {
+      await fs5.unlink(processingPath).catch(() => {
       });
       return;
     }
@@ -694,21 +944,21 @@ async function completeTask(taskDir, taskId, result, logger = nullLogger) {
   task.completedAt = (/* @__PURE__ */ new Date()).toISOString();
   task.result = result;
   await atomicWriteFile(completedPath, JSON.stringify(task, null, 2));
-  await fs4.unlink(processingPath).catch(() => {
+  await fs5.unlink(processingPath).catch(() => {
   });
   logger.debug("Completed task", { id: taskId });
 }
 async function failTask(taskDir, taskId, error, logger = nullLogger) {
-  const processingPath = path5.join(taskDir, "processing", `${taskId}.json`);
-  const failedDir = path5.join(taskDir, "failed");
-  const failedPath = path5.join(failedDir, `${taskId}.json`);
+  const processingPath = path6.join(taskDir, "processing", `${taskId}.json`);
+  const failedDir = path6.join(taskDir, "failed");
+  const failedPath = path6.join(failedDir, `${taskId}.json`);
   let task;
   try {
-    const content = await fs4.readFile(processingPath, "utf-8");
+    const content = await fs5.readFile(processingPath, "utf-8");
     const parsed = parseTaskJson(content);
     if (!parsed) {
       logger.debug("Corrupt task file in processing, removing", { id: taskId });
-      await fs4.unlink(processingPath).catch(() => {
+      await fs5.unlink(processingPath).catch(() => {
       });
       return;
     }
@@ -722,21 +972,21 @@ async function failTask(taskDir, taskId, error, logger = nullLogger) {
   task.completedAt = (/* @__PURE__ */ new Date()).toISOString();
   task.error = error;
   await atomicWriteFile(failedPath, JSON.stringify(task, null, 2));
-  await fs4.unlink(processingPath).catch(() => {
+  await fs5.unlink(processingPath).catch(() => {
   });
   logger.debug("Failed task", { id: taskId, error });
 }
 async function retryTask(taskDir, taskId, error, logger = nullLogger) {
-  const processingPath = path5.join(taskDir, "processing", `${taskId}.json`);
-  const pendingDir = path5.join(taskDir, "pending");
-  const pendingPath = path5.join(pendingDir, `${taskId}.json`);
+  const processingPath = path6.join(taskDir, "processing", `${taskId}.json`);
+  const pendingDir = path6.join(taskDir, "pending");
+  const pendingPath = path6.join(pendingDir, `${taskId}.json`);
   let task;
   try {
-    const content = await fs4.readFile(processingPath, "utf-8");
+    const content = await fs5.readFile(processingPath, "utf-8");
     const parsed = parseTaskJson(content);
     if (!parsed) {
       logger.debug("Corrupt task file in processing, removing", { id: taskId });
-      await fs4.unlink(processingPath).catch(() => {
+      await fs5.unlink(processingPath).catch(() => {
       });
       return;
     }
@@ -753,15 +1003,15 @@ async function retryTask(taskDir, taskId, error, logger = nullLogger) {
   task.retryAfter = new Date(Date.now() + backoffMs).toISOString();
   task.error = error;
   await atomicWriteFile(pendingPath, JSON.stringify(task, null, 2));
-  await fs4.unlink(processingPath).catch(() => {
+  await fs5.unlink(processingPath).catch(() => {
   });
   logger.debug("Retrying task", { id: taskId, retryCount, backoffMs });
 }
 async function requeueFailedTask(taskDir, taskId, logger = nullLogger) {
-  const failedPath = path5.join(taskDir, "failed", `${taskId}.json`);
+  const failedPath = path6.join(taskDir, "failed", `${taskId}.json`);
   let content;
   try {
-    content = await fs4.readFile(failedPath, "utf-8");
+    content = await fs5.readFile(failedPath, "utf-8");
   } catch (err) {
     if (isNotFoundError2(err))
       return { error: "not-found" };
@@ -780,37 +1030,37 @@ async function requeueFailedTask(taskDir, taskId, logger = nullLogger) {
     retryCount: 0,
     maxRetries: original.maxRetries
   };
-  const pendingPath = path5.join(taskDir, "pending", `${newTaskId}.json`);
+  const pendingPath = path6.join(taskDir, "pending", `${newTaskId}.json`);
   await atomicWriteFile(pendingPath, JSON.stringify(newTask, null, 2));
-  await fs4.unlink(failedPath).catch(() => {
+  await fs5.unlink(failedPath).catch(() => {
   });
   logger.debug("Requeued failed task", { originalId: taskId, newTaskId });
   return { newTaskId };
 }
 async function recoverOrphanedTasks(taskDir, maxAgeMs = 5 * 6e4, logger = nullLogger) {
-  const processingDir = path5.join(taskDir, "processing");
-  const pendingDir = path5.join(taskDir, "pending");
+  const processingDir = path6.join(taskDir, "processing");
+  const pendingDir = path6.join(taskDir, "pending");
   let files;
   try {
-    files = await fs4.readdir(processingDir);
+    files = await fs5.readdir(processingDir);
   } catch {
     return 0;
   }
   const now = Date.now();
   let recovered = 0;
   for (const fileName of files.filter((f) => f.endsWith(".json"))) {
-    const filePath = path5.join(processingDir, fileName);
+    const filePath = path6.join(processingDir, fileName);
     try {
-      const stat = await fs4.stat(filePath);
+      const stat = await fs5.stat(filePath);
       if (now - stat.mtimeMs >= maxAgeMs) {
-        const content = await fs4.readFile(filePath, "utf-8");
+        const content = await fs5.readFile(filePath, "utf-8");
         const task = parseTaskJson(content);
         if (!task) {
           await moveToCorrupt(taskDir, processingDir, fileName, "Invalid JSON during recovery", logger);
           continue;
         }
         if (await taskExistsIn(taskDir, task.id, ["completed", "failed"])) {
-          await fs4.unlink(filePath).catch(() => {
+          await fs5.unlink(filePath).catch(() => {
           });
           logger.debug("Cleaned up orphaned task (already finished)", {
             id: task.id
@@ -818,8 +1068,8 @@ async function recoverOrphanedTasks(taskDir, maxAgeMs = 5 * 6e4, logger = nullLo
           continue;
         }
         task.status = "pending";
-        await atomicWriteFile(path5.join(pendingDir, fileName), JSON.stringify(task, null, 2));
-        await fs4.unlink(filePath);
+        await atomicWriteFile(path6.join(pendingDir, fileName), JSON.stringify(task, null, 2));
+        await fs5.unlink(filePath);
         logger.debug("Recovered orphaned task", {
           id: task.id,
           action: task.action
@@ -838,19 +1088,19 @@ async function cleanupOldTasks(taskDir, maxAgeMs = 30 * 24 * 60 * 6e4, logger =
   const now = Date.now();
   let cleaned = 0;
   for (const subdir of ["completed", "failed"]) {
-    const dir = path5.join(taskDir, subdir);
+    const dir = path6.join(taskDir, subdir);
     let files;
     try {
-      files = await fs4.readdir(dir);
+      files = await fs5.readdir(dir);
     } catch {
       continue;
     }
     for (const fileName of files.filter((f) => f.endsWith(".json"))) {
       try {
-        const filePath = path5.join(dir, fileName);
-        const stat = await fs4.stat(filePath);
+        const filePath = path6.join(dir, fileName);
+        const stat = await fs5.stat(filePath);
         if (now - stat.mtimeMs >= maxAgeMs) {
-          await fs4.unlink(filePath);
+          await fs5.unlink(filePath);
           cleaned++;
         }
       } catch {
@@ -864,9 +1114,9 @@ async function cleanupOldTasks(taskDir, maxAgeMs = 30 * 24 * 60 * 6e4, logger =
 }
 async function getTask(taskDir, taskId) {
   for (const subdir of ["completed", "failed", "processing", "pending"]) {
-    const filePath = path5.join(taskDir, subdir, `${taskId}.json`);
+    const filePath = path6.join(taskDir, subdir, `${taskId}.json`);
     try {
-      const content = await fs4.readFile(filePath, "utf-8");
+      const content = await fs5.readFile(filePath, "utf-8");
       return parseTaskJson(content);
     } catch {
       continue;
@@ -875,10 +1125,10 @@ async function getTask(taskDir, taskId) {
   return null;
 }
 async function listTasks(taskDir, status, limit = 100) {
-  const dir = path5.join(taskDir, status);
+  const dir = path6.join(taskDir, status);
   let files;
   try {
-    files = await fs4.readdir(dir);
+    files = await fs5.readdir(dir);
   } catch {
     return [];
   }
@@ -887,7 +1137,7 @@ async function listTasks(taskDir, status, limit = 100) {
     if (tasks.length >= limit)
       break;
     try {
-      const content = await fs4.readFile(path5.join(dir, fileName), "utf-8");
+      const content = await fs5.readFile(path6.join(dir, fileName), "utf-8");
       const task = parseTaskJson(content);
       if (task)
         tasks.push(task);
@@ -907,9 +1157,9 @@ async function getQueueStats(taskDir) {
     corrupt: 0
   };
   for (const status of ["pending", "processing", "completed", "failed", "corrupt"]) {
-    const dir = path5.join(taskDir, status);
+    const dir = path6.join(taskDir, status);
     try {
-      const files = await fs4.readdir(dir);
+      const files = await fs5.readdir(dir);
       stats[status] = files.filter((f) => f.endsWith(".json")).length;
     } catch {
     }
@@ -917,10 +1167,10 @@ async function getQueueStats(taskDir) {
   return stats;
 }
 async function listCorruptTaskFiles(taskDir, limit = 50, logger = nullLogger) {
-  const corruptDir = path5.join(taskDir, "corrupt");
+  const corruptDir = path6.join(taskDir, "corrupt");
   let files;
   try {
-    files = await fs4.readdir(corruptDir);
+    files = await fs5.readdir(corruptDir);
   } catch (err) {
     if (isNotFoundError2(err))
       return [];
@@ -928,9 +1178,9 @@ async function listCorruptTaskFiles(taskDir, limit = 50, logger = nullLogger) {
   }
   const entries = [];
   for (const fileName of files.filter((f) => f.endsWith(".json"))) {
-    const filePath = path5.join(corruptDir, fileName);
+    const filePath = path6.join(corruptDir, fileName);
     try {
-      const stat = await fs4.stat(filePath);
+      const stat = await fs5.stat(filePath);
       entries.push({
         fileName,
         size: stat.size,
@@ -947,7 +1197,7 @@ async function listCorruptTaskFiles(taskDir, limit = 50, logger = nullLogger) {
   return entries.slice(0, limit);
 }
 async function readSnippet(filePath, maxBytes) {
-  const handle = await fs4.open(filePath, "r");
+  const handle = await fs5.open(filePath, "r");
   try {
     const buffer = Buffer.alloc(maxBytes);
     const { bytesRead } = await handle.read(buffer, 0, maxBytes, 0);
@@ -970,7 +1220,7 @@ function parseTaskJson(content) {
 async function taskExistsIn(taskDir, taskId, subdirs) {
   for (const subdir of subdirs) {
     try {
-      await fs4.stat(path5.join(taskDir, subdir, `${taskId}.json`));
+      await fs5.stat(path6.join(taskDir, subdir, `${taskId}.json`));
       return true;
     } catch {
     }
@@ -978,13 +1228,13 @@ async function taskExistsIn(taskDir, taskId, subdirs) {
   return false;
 }
 async function moveToCorrupt(taskDir, sourceDir, fileName, reason, logger) {
-  const corruptDir = path5.join(taskDir, "corrupt");
+  const corruptDir = path6.join(taskDir, "corrupt");
   try {
-    await fs4.mkdir(corruptDir, { recursive: true });
-    await fs4.rename(path5.join(sourceDir, fileName), path5.join(corruptDir, fileName));
+    await fs5.mkdir(corruptDir, { recursive: true });
+    await fs5.rename(path6.join(sourceDir, fileName), path6.join(corruptDir, fileName));
     logger.debug("Moved corrupt task file", { fileName, reason });
   } catch {
-    await fs4.unlink(path5.join(sourceDir, fileName)).catch(() => {
+    await fs5.unlink(path6.join(sourceDir, fileName)).catch(() => {
     });
   }
 }
@@ -1041,8 +1291,8 @@ var init_task_queue3 = __esm({
 });
 
 // dist/cli/init.js
-import fs5 from "node:fs/promises";
-import path6 from "node:path";
+import fs6 from "node:fs/promises";
+import path7 from "node:path";
 import * as p from "@clack/prompts";
 import { createJiti } from "jiti";
 
@@ -1112,6 +1362,33 @@ var DevClientSafeStrategy = class {
 
 // dist/operating-mode/client-unsafe-strategy.js
 import path from "node:path";
+
+// dist/utils/logger.js
+var active = console;
+function canopyLogWarn(...args) {
+  active.warn(...args);
+}
+
+// dist/operating-mode/deployment-name.js
+var warned = false;
+var VALID_DEPLOYMENT_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var isValidDeploymentName = (name) => VALID_DEPLOYMENT_NAME.test(name) && !name.includes("..") && !name.endsWith(".") && !name.endsWith(".lock");
+function resolveDeploymentName(config, modeDefault) {
+  const envValue = process.env.CANOPYCMS_DEPLOYMENT_NAME?.trim();
+  const configValue = config.deploymentName;
+  if (envValue && configValue && envValue !== configValue && !warned) {
+    canopyLogWarn(`CanopyCMS: CANOPYCMS_DEPLOYMENT_NAME ("${envValue}") differs from config.deploymentName ("${configValue}") \u2014 using the env var (infra-stamped env wins over shared-repo config by design; see resolveDeploymentName's doc comment). Update config.deploymentName to match if this mismatch was unintentional.`);
+    warned = true;
+  }
+  const resolved = envValue || configValue || modeDefault;
+  if (!isValidDeploymentName(resolved)) {
+    const source = envValue ? "CANOPYCMS_DEPLOYMENT_NAME" : configValue ? "config.deploymentName" : "the mode default";
+    throw new Error(`CanopyCMS: invalid deploymentName ${JSON.stringify(resolved)} (from ${source}). It is interpolated into the settings branch name (canopycms-settings-<deploymentName>), so it must start with a letter or digit, contain only letters, digits, '.', '_' or '-', and must not contain '..' or end with '.' or '.lock'.`);
+  }
+  return resolved;
+}
+
+// dist/operating-mode/client-unsafe-strategy.js
 init_config2();
 var ProdStrategy = class extends ProdClientSafeStrategy {
   // All client-safe methods inherited automatically from ProdClientSafeStrategy:
@@ -1122,8 +1399,8 @@ var ProdStrategy = class extends ProdClientSafeStrategy {
   getWorkspaceRoot(_sourceRoot) {
     return path.resolve(process.env.CANOPYCMS_WORKSPACE_ROOT ?? DEFAULT_PROD_WORKSPACE);
   }
-  getContentRoot(sourceRoot) {
-    return path.resolve(sourceRoot ?? process.cwd(), "content");
+  getContentRoot(contentRoot, sourceRoot) {
+    return path.resolve(sourceRoot ?? process.cwd(), contentRoot);
   }
   getContentBranchesRoot(sourceRoot) {
     return path.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
@@ -1154,8 +1431,7 @@ var ProdStrategy = class extends ProdClientSafeStrategy {
   getSettingsBranchName(config) {
     if (config.settingsBranch)
       return config.settingsBranch;
-    const deploymentName = config.deploymentName ?? "prod";
-    return `canopycms-settings-${deploymentName}`;
+    return `canopycms-settings-${resolveDeploymentName(config, "prod")}`;
   }
   getSettingsRoot(sourceRoot) {
     return path.join(this.getWorkspaceRoot(sourceRoot), "settings");
@@ -1177,8 +1453,8 @@ var DevStrategy = class extends DevClientSafeStrategy {
   getWorkspaceRoot(sourceRoot) {
     return path.resolve(sourceRoot ?? process.cwd(), ".canopy-dev");
   }
-  getContentRoot(sourceRoot) {
-    return path.resolve(sourceRoot ?? process.cwd(), "content");
+  getContentRoot(contentRoot, sourceRoot) {
+    return path.resolve(sourceRoot ?? process.cwd(), contentRoot);
   }
   getContentBranchesRoot(sourceRoot) {
     return path.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
@@ -1208,8 +1484,7 @@ var DevStrategy = class extends DevClientSafeStrategy {
   getSettingsBranchName(config) {
     if (config.settingsBranch)
       return config.settingsBranch;
-    const deploymentName = config.deploymentName ?? "local";
-    return `canopycms-settings-${deploymentName}`;
+    return `canopycms-settings-${resolveDeploymentName(config, "local")}`;
   }
   getSettingsRoot(sourceRoot) {
     return path.join(this.getWorkspaceRoot(sourceRoot), "settings");
@@ -1252,41 +1527,11 @@ function assertAuthPluginAllowedForMode(plugin, mode) {
   }
 }
 
-// dist/utils/fs.js
-import fs from "node:fs/promises";
-
-// dist/utils/error.js
-function getErrorMessage(err) {
-  if (err instanceof Error) {
-    return err.message;
-  }
-  if (typeof err === "string") {
-    return err;
-  }
-  return String(err);
-}
-function isNodeError(err) {
-  return err instanceof Error && "code" in err;
-}
-function isNotFoundError(err) {
-  return isNodeError(err) && err.code === "ENOENT";
-}
-
-// dist/utils/fs.js
-async function filePathExists(filePath) {
-  try {
-    await fs.stat(filePath);
-    return true;
-  } catch (err) {
-    if (isNotFoundError(err))
-      return false;
-    throw err;
-  }
-}
-
 // dist/cli/init.js
+init_fs();
+init_error();
 async function writeFile(filePath, content, options) {
-  const relativePath = path6.relative(process.cwd(), filePath);
+  const relativePath = path7.relative(process.cwd(), filePath);
   if (await filePathExists(filePath)) {
     if (options.force) {
     } else if (options.nonInteractive) {
@@ -1303,8 +1548,8 @@ async function writeFile(filePath, content, options) {
       }
     }
   }
-  await fs5.mkdir(path6.dirname(filePath), { recursive: true });
-  await fs5.writeFile(filePath, content, "utf-8");
+  await fs6.mkdir(path7.dirname(filePath), { recursive: true });
+  await fs6.writeFile(filePath, content, "utf-8");
   p.log.success(`created: ${relativePath}`);
   return true;
 }
@@ -1356,24 +1601,24 @@ async function init(options) {
   }
   const serverPageExt = staticBuild ? "page.server.tsx" : "page.tsx";
   const serverRouteExt = staticBuild ? "route.server.ts" : "route.ts";
-  await writeFile(path6.join(projectDir, "canopycms.config.ts"), await canopyCmsConfig2({ mode, staticBuild }), writeOpts);
-  await writeFile(path6.join(projectDir, appDir, "lib/canopy.ts"), await canopyContext2({ configImport: configImportPath(appDir, 1), authProvider }), writeOpts);
-  await writeFile(path6.join(projectDir, appDir, "schemas.ts"), await schemasTemplate2(), writeOpts);
-  await writeFile(path6.join(projectDir, appDir, `api/canopycms/[...canopycms]/${serverRouteExt}`), await apiRoute2({
+  await writeFile(path7.join(projectDir, "canopycms.config.ts"), await canopyCmsConfig2({ mode, staticBuild }), writeOpts);
+  await writeFile(path7.join(projectDir, appDir, "lib/canopy.ts"), await canopyContext2({ configImport: configImportPath(appDir, 1), authProvider }), writeOpts);
+  await writeFile(path7.join(projectDir, appDir, "schemas.ts"), await schemasTemplate2(), writeOpts);
+  await writeFile(path7.join(projectDir, appDir, `api/canopycms/[...canopycms]/${serverRouteExt}`), await apiRoute2({
     canopyImport: "../".repeat(3) + "lib/canopy"
   }), writeOpts);
-  await writeFile(path6.join(projectDir, appDir, `edit/${serverPageExt}`), await editPage2({ configImport: configImportPath(appDir, 1), authProvider }), writeOpts);
+  await writeFile(path7.join(projectDir, appDir, `edit/${serverPageExt}`), await editPage2({ configImport: configImportPath(appDir, 1), authProvider }), writeOpts);
   if (ai) {
-    await writeFile(path6.join(projectDir, appDir, "ai/config.ts"), await aiConfig2(), writeOpts);
-    await writeFile(path6.join(projectDir, appDir, `ai/[...path]/${serverRouteExt}`), await aiRoute2({ configImport: configImportPath(appDir, 2) }), writeOpts);
+    await writeFile(path7.join(projectDir, appDir, "ai/config.ts"), await aiConfig2(), writeOpts);
+    await writeFile(path7.join(projectDir, appDir, `ai/[...path]/${serverRouteExt}`), await aiRoute2({ configImport: configImportPath(appDir, 2) }), writeOpts);
   }
-  await writeFile(path6.join(projectDir, "next.config.ts"), await nextConfig2({ staticBuild }), writeOpts);
-  await writeFile(path6.join(projectDir, "middleware.ts"), await middleware2({ authProvider }), writeOpts);
-  const gitignorePath = path6.join(projectDir, ".gitignore");
+  await writeFile(path7.join(projectDir, "next.config.ts"), await nextConfig2({ staticBuild }), writeOpts);
+  await writeFile(path7.join(projectDir, "middleware.ts"), await middleware2({ authProvider }), writeOpts);
+  const gitignorePath = path7.join(projectDir, ".gitignore");
   if (await filePathExists(gitignorePath)) {
-    const content = await fs5.readFile(gitignorePath, "utf-8");
+    const content = await fs6.readFile(gitignorePath, "utf-8");
     if (!content.includes(".canopy-dev")) {
-      await fs5.appendFile(gitignorePath, "\n# CanopyCMS\n.canopy-dev/\n");
+      await fs6.appendFile(gitignorePath, "\n# CanopyCMS\n.canopy-dev/\n");
       p.log.success("updated: .gitignore");
     }
   }
@@ -1398,34 +1643,78 @@ async function init(options) {
 async function initDeployAws(options) {
   const { projectDir, force, nonInteractive } = options;
   const writeOpts = { force, nonInteractive };
-  const { dockerfileCms: dockerfileCms2, dockerignore: dockerignore2, githubWorkflowCms: githubWorkflowCms2 } = await Promise.resolve().then(() => (init_templates(), templates_exports));
+  const { dockerfileCms: dockerfileCms2, dockerignore: dockerignore2, githubWorkflowCms: githubWorkflowCms2, cdkJson: cdkJson2, cdkApp: cdkApp2, cmsStack: cmsStack2 } = await Promise.resolve().then(() => (init_templates(), templates_exports));
+  const { detectPackageManager: detectPackageManager2, detectDefaultBranch: detectDefaultBranch2, detectGitHubRepo: detectGitHubRepo2, commandsFor: commandsFor2, missingCdkDependencies: missingCdkDependencies2, CDK_DEPENDENCIES: CDK_DEPENDENCIES2 } = await Promise.resolve().then(() => (init_project_detect(), project_detect_exports));
   p.intro("CanopyCMS init-deploy aws");
-  await writeFile(path6.join(projectDir, "Dockerfile.cms"), await dockerfileCms2(), writeOpts);
-  const dockerignoreWritten = await writeFile(path6.join(projectDir, ".dockerignore"), await dockerignore2(), writeOpts);
+  const packageManager = await detectPackageManager2(projectDir);
+  const pm = commandsFor2(packageManager);
+  const defaultBranch = await detectDefaultBranch2(projectDir);
+  const repo = await detectGitHubRepo2(projectDir);
+  await writeFile(path7.join(projectDir, "Dockerfile.cms"), await dockerfileCms2({ copy: pm.dockerCopy, install: pm.dockerInstall, build: pm.build }), writeOpts);
+  const dockerignoreWritten = await writeFile(path7.join(projectDir, ".dockerignore"), await dockerignore2(), writeOpts);
   if (!dockerignoreWritten) {
-    p.log.warn("Existing .dockerignore kept \u2014 verify it excludes .env* (secrets would otherwise enter the build context) and does NOT exclude vendor/ (needed for `npm ci` with file: deps).");
+    p.log.warn("Existing .dockerignore kept \u2014 verify it excludes .env* (secrets would otherwise enter the build context) and does NOT exclude vendor/ (needed by the Dockerfile.cms install step with file: deps).");
+  }
+  await writeFile(path7.join(projectDir, ".github/workflows/deploy-cms.yml"), await githubWorkflowCms2({
+    defaultBranch,
+    lockfile: pm.lockfile,
+    ciInstall: pm.ciInstall,
+    addDev: pm.addDev
+  }), writeOpts);
+  const cdkJsonPath = path7.join(projectDir, "cdk.json");
+  const existingCdkJson = await filePathExists(cdkJsonPath) ? await fs6.readFile(cdkJsonPath, "utf-8") : null;
+  const cdkJsonWritten = await writeFile(cdkJsonPath, await cdkJson2(), writeOpts);
+  await writeFile(path7.join(projectDir, "infrastructure/bin/app.ts"), await cdkApp2({
+    githubOwner: repo?.owner ?? "your-org",
+    githubRepo: repo?.repo ?? "your-docs-site"
+  }), writeOpts);
+  await writeFile(path7.join(projectDir, "infrastructure/lib/cms-stack.ts"), await cmsStack2(), writeOpts);
+  if (!cdkJsonWritten && existingCdkJson && !existingCdkJson.includes("infrastructure/bin/app.ts")) {
+    p.log.warn("Existing cdk.json kept, and it does not point at infrastructure/bin/app.ts \u2014 the scaffolded CDK app will not be deployed. Either wire CmsStack into your own app entry point, or re-run with --force to replace cdk.json.");
   }
-  await writeFile(path6.join(projectDir, ".github/workflows/deploy-cms.yml"), await githubWorkflowCms2(), writeOpts);
-  const nextConfigPath = path6.join(projectDir, "next.config.ts");
-  const nextConfigMjsPath = path6.join(projectDir, "next.config.mjs");
+  const nextConfigPath = path7.join(projectDir, "next.config.ts");
+  const nextConfigMjsPath = path7.join(projectDir, "next.config.mjs");
   const configPath = await filePathExists(nextConfigPath) ? nextConfigPath : await filePathExists(nextConfigMjsPath) ? nextConfigMjsPath : null;
   if (configPath) {
-    const content = await fs5.readFile(configPath, "utf-8");
+    const content = await fs6.readFile(configPath, "utf-8");
     if (!content.includes("CANOPY_BUILD")) {
       p.note([
-        `Add dual build support to ${path6.basename(configPath)}:`,
+        `Add dual build support to ${path7.basename(configPath)}:`,
         "",
         "  output: process.env.CANOPY_BUILD === 'cms' ? 'standalone' : 'export',"
       ].join("\n"), "Manual step");
     }
   }
-  p.note("CDK constructs are available via the canopycms-cdk package.\nSee the deployment plan for CDK stack setup.", "AWS deployment");
+  if (packageManager === "yarn" || packageManager === "yarn-berry") {
+    p.log.warn(`Yarn detected (${packageManager === "yarn-berry" ? "Berry" : "classic"}). The generated install lines are a best effort and are not exercised by CanopyCMS tests \u2014 review them in Dockerfile.cms and .github/workflows/deploy-cms.yml.` + (packageManager === "yarn-berry" ? " Berry additionally requires nodeLinker: node-modules; PnP is incompatible with Next.js standalone output, which the CMS image's runner stage copies." : ""));
+  }
+  const missing = await missingCdkDependencies2(projectDir);
+  if (missing.length > 0) {
+    p.log.warn(`Not installed: ${missing.join(", ")}. cdk.json runs \`node --import tsx infrastructure/bin/app.ts\`, so the deploy fails without them:
+   ${pm.addDev} ${CDK_DEPENDENCIES2.join(" ")}`);
+  }
+  p.note([
+    "1. Install the CDK dependencies (if you have not already):",
+    `   ${pm.addDev} ${CDK_DEPENDENCIES2.join(" ")}`,
+    "",
+    "2. Fill in infrastructure/lib/cms-stack.ts and infrastructure/bin/app.ts",
+    `   (worker repo currently set to ${repo ? `${repo.owner}/${repo.repo}` : "your-org/your-docs-site"})`,
+    "",
+    "3. Bootstrap CDK in the target account/region: cdk bootstrap",
+    "",
+    "4. Set the repository secrets and variables listed at the top of",
+    "   .github/workflows/deploy-cms.yml \u2014 the deploy fails at synth without them.",
+    "",
+    `Deploys trigger on pushes to '${defaultBranch}'; edit the workflow to change that.`,
+    "",
+    "Full walkthrough: docs/deploying-to-aws.md"
+  ].join("\n"), "AWS deployment");
   p.outro("Done!");
 }
 async function detectMode(projectDir) {
-  const cfgPath = path6.join(projectDir, "canopycms.config.ts");
+  const cfgPath = path7.join(projectDir, "canopycms.config.ts");
   try {
-    await fs5.stat(cfgPath);
+    await fs6.stat(cfgPath);
   } catch (err) {
     if (isNotFoundError(err))
       return "dev";
@@ -1456,7 +1745,7 @@ async function workerRunOnce(options) {
     assertAuthPluginAllowedForMode(options.authPlugin, mode);
   }
   const taskDir = getTaskQueueDir2({ mode });
-  const cachePath = process.env.CANOPY_AUTH_CACHE_PATH ?? path6.join(operatingStrategy(mode).getWorkspaceRoot(options.projectDir), ".cache");
+  const cachePath = process.env.CANOPY_AUTH_CACHE_PATH ?? path7.join(operatingStrategy(mode).getWorkspaceRoot(options.projectDir), ".cache");
   let refreshAuthCache;
   const authMode = process.env.CANOPY_AUTH_MODE || "dev";
   if (options.authPlugin?.createCacheRefresher) {