cdk-nextjs 0.7.12 → 0.7.14

package/lib/utils/viewer-request-functions.test.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const viewer_request_functions_1 = require("./viewer-request-functions");
+describe("spliceViewerRequest", () => {
+    it.each([
+        ["x-forwarded-host", viewer_request_functions_1.X_FORWARDED_HOST_HANDLER],
+        ["pass-through", viewer_request_functions_1.PASS_THROUGH_HANDLER],
+        ["assetPrefix rewrite", (0, viewer_request_functions_1.assetPrefixRewriteHandler)("base", "/cdn")],
+    ])("drops the marker and indentation from the %s handler", (_, handler) => {
+        const code = (0, viewer_request_functions_1.spliceViewerRequest)(handler, undefined);
+        expect(code).not.toContain(viewer_request_functions_1.VIEWER_REQUEST_HOOK);
+        expect(code).not.toMatch(/^[ \t]/m);
+        expect(code).toMatch(/^async function handler\(event\) \{$/m);
+    });
+    it("puts the user's code first and awaits viewerRequest at the marker", () => {
+        const code = (0, viewer_request_functions_1.spliceViewerRequest)(viewer_request_functions_1.PASS_THROUGH_HANDLER, 'import cf from "cloudfront";\nfunction viewerRequest(event) {}');
+        expect(code.startsWith('import cf from "cloudfront";')).toBe(true);
+        expect(code).toMatch(/async function handler\(event\) \{\nconst viewerResult = await viewerRequest\(event\);/);
+    });
+});
+describe("assetPrefixRewriteHandler", () => {
+    it("swaps the prefix for the basePath", () => {
+        expect((0, viewer_request_functions_1.assetPrefixRewriteHandler)("base", "/cdn")).toContain('request.uri = "/base" + request.uri.slice(4);');
+        expect((0, viewer_request_functions_1.assetPrefixRewriteHandler)("", "/cdn")).toContain('request.uri = "" + request.uri.slice(4);');
+    });
+});
+describe("checkViewerRequestCode", () => {
+    it.each([
+        "function viewerRequest(event) {}",
+        "async function viewerRequest(event) {}",
+        "const viewerRequest = (event) => {};",
+        "var x = 1, viewerRequest = (event) => {};",
+    ])("accepts %s", (code) => {
+        expect(() => (0, viewer_request_functions_1.checkViewerRequestCode)(code)).not.toThrow();
+    });
+    it("refuses code that never defines viewerRequest", () => {
+        expect(() => (0, viewer_request_functions_1.checkViewerRequestCode)("const ok = viewerRequest === 1;")).toThrow(/must define `viewerRequest\(event\)`/);
+    });
+    it("refuses code that uses the name handler", () => {
+        expect(() => (0, viewer_request_functions_1.checkViewerRequestCode)("function viewerRequest(event) {} // handler")).toThrow(/uses the name `handler`/);
+    });
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmlld2VyLXJlcXVlc3QtZnVuY3Rpb25zLnRlc3QuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdXRpbHMvdmlld2VyLXJlcXVlc3QtZnVuY3Rpb25zLnRlc3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFBQSx5RUFPb0M7QUFFcEMsUUFBUSxDQUFDLHFCQUFxQixFQUFFLEdBQUcsRUFBRTtJQUNuQyxFQUFFLENBQUMsSUFBSSxDQUFDO1FBQ04sQ0FBQyxrQkFBa0IsRUFBRSxtREFBd0IsQ0FBQztRQUM5QyxDQUFDLGNBQWMsRUFBRSwrQ0FBb0IsQ0FBQztRQUN0QyxDQUFDLHFCQUFxQixFQUFFLElBQUEsb0RBQXlCLEVBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0tBQ25FLENBQUMsQ0FBQyxzREFBc0QsRUFBRSxDQUFDLENBQUMsRUFBRSxPQUFPLEVBQUUsRUFBRTtRQUN4RSxNQUFNLElBQUksR0FBRyxJQUFBLDhDQUFtQixFQUFDLE9BQU8sRUFBRSxTQUFTLENBQUMsQ0FBQztRQUNyRCxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQyw4Q0FBbUIsQ0FBQyxDQUFDO1FBQ2hELE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3BDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLENBQUMsdUNBQXVDLENBQUMsQ0FBQztJQUNoRSxDQUFDLENBQUMsQ0FBQztJQUVILEVBQUUsQ0FBQyxtRUFBbUUsRUFBRSxHQUFHLEVBQUU7UUFDM0UsTUFBTSxJQUFJLEdBQUcsSUFBQSw4Q0FBbUIsRUFDOUIsK0NBQW9CLEVBQ3BCLGdFQUFnRSxDQUNqRSxDQUFDO1FBQ0YsTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsOEJBQThCLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNuRSxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxDQUNsQix3RkFBd0YsQ0FDekYsQ0FBQztJQUNKLENBQUMsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyxDQUFDLENBQUM7QUFFSCxRQUFRLENBQUMsMkJBQTJCLEVBQUUsR0FBRyxFQUFFO0lBQ3pDLEVBQUUsQ0FBQyxtQ0FBbUMsRUFBRSxHQUFHLEVBQUU7UUFDM0MsTUFBTSxDQUFDLElBQUEsb0RBQXlCLEVBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUN6RCwrQ0FBK0MsQ0FDaEQsQ0FBQztRQUNGLE1BQU0sQ0FBQyxJQUFBLG9EQUF5QixFQUFDLEVBQUUsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FDckQsMENBQTBDLENBQzNDLENBQUM7SUFDSixDQUFDLENBQUMsQ0FBQztBQUNMLENBQUMsQ0FBQyxDQUFDO0FBRUgsUUFBUSxDQUFDLHdCQUF3QixFQUFFLEdBQUcsRUFBRTtJQUN0QyxFQUFFLENBQUMsSUFBSSxDQUFDO1FBQ04sa0NBQWtDO1FBQ2xDLHdDQUF3QztRQUN4QyxzQ0FBc0M7UUFDdEMsMkNBQTJDO0tBQzVDLENBQUMsQ0FBQyxZQUFZLEVBQUUsQ0FBQyxJQUFJLEVBQUUsRUFBRTtRQUN4QixNQUFNLENBQUMsR0FBRyxFQUFFLENBQUMsSUFBQSxpREFBc0IsRUFBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsQ0FBQztJQUMzRCxDQUFDLENBQUMsQ0FBQztJQUVILEVBQUUsQ0FBQywrQ0FBK0MsRUFBRSxHQUFHLEVBQUU7UUFDdkQsTUFBTSxDQUFDLEdBQUcsRUFBRSxDQUNWLElBQUEsaURBQXNCLEVBQUMsaUNBQWlDLENBQUMsQ0FDMUQsQ0FBQyxPQUFPLENBQUMsc0NBQXNDLENBQUMsQ0FBQztJQUNwRCxDQUFDLENBQUMsQ0FBQztJQUVILEVBQUUsQ0FBQyx5Q0FBeUMsRUFBRSxHQUFHLEVBQUU7UUFDakQsTUFBTSxDQUFDLEdBQUcsRUFBRSxDQUNWLElBQUEsaURBQXNCLEVBQUMsNkNBQTZDLENBQUMsQ0FDdEUsQ0FBQyxPQUFPLENBQUMseUJBQXlCLENBQUMsQ0FBQztJQUN2QyxDQUFDLENBQUMsQ0FBQztBQUNMLENBQUMsQ0FBQyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHtcbiAgYXNzZXRQcmVmaXhSZXdyaXRlSGFuZGxlcixcbiAgY2hlY2tWaWV3ZXJSZXF1ZXN0Q29kZSxcbiAgUEFTU19USFJPVUdIX0hBTkRMRVIsXG4gIHNwbGljZVZpZXdlclJlcXVlc3QsXG4gIFZJRVdFUl9SRVFVRVNUX0hPT0ssXG4gIFhfRk9SV0FSREVEX0hPU1RfSEFORExFUixcbn0gZnJvbSBcIi4vdmlld2VyLXJlcXVlc3QtZnVuY3Rpb25zXCI7XG5cbmRlc2NyaWJlKFwic3BsaWNlVmlld2VyUmVxdWVzdFwiLCAoKSA9PiB7XG4gIGl0LmVhY2goW1xuICAgIFtcIngtZm9yd2FyZGVkLWhvc3RcIiwgWF9GT1JXQVJERURfSE9TVF9IQU5ETEVSXSxcbiAgICBbXCJwYXNzLXRocm91Z2hcIiwgUEFTU19USFJPVUdIX0hBTkRMRVJdLFxuICAgIFtcImFzc2V0UHJlZml4IHJld3JpdGVcIiwgYXNzZXRQcmVmaXhSZXdyaXRlSGFuZGxlcihcImJhc2VcIiwgXCIvY2RuXCIpXSxcbiAgXSkoXCJkcm9wcyB0aGUgbWFya2VyIGFuZCBpbmRlbnRhdGlvbiBmcm9tIHRoZSAlcyBoYW5kbGVyXCIsIChfLCBoYW5kbGVyKSA9PiB7XG4gICAgY29uc3QgY29kZSA9IHNwbGljZVZpZXdlclJlcXVlc3QoaGFuZGxlciwgdW5kZWZpbmVkKTtcbiAgICBleHBlY3QoY29kZSkubm90LnRvQ29udGFpbihWSUVXRVJfUkVRVUVTVF9IT09LKTtcbiAgICBleHBlY3QoY29kZSkubm90LnRvTWF0Y2goL15bIFxcdF0vbSk7XG4gICAgZXhwZWN0KGNvZGUpLnRvTWF0Y2goL15hc3luYyBmdW5jdGlvbiBoYW5kbGVyXFwoZXZlbnRcXCkgXFx7JC9tKTtcbiAgfSk7XG5cbiAgaXQoXCJwdXRzIHRoZSB1c2VyJ3MgY29kZSBmaXJzdCBhbmQgYXdhaXRzIHZpZXdlclJlcXVlc3QgYXQgdGhlIG1hcmtlclwiLCAoKSA9PiB7XG4gICAgY29uc3QgY29kZSA9IHNwbGljZVZpZXdlclJlcXVlc3QoXG4gICAgICBQQVNTX1RIUk9VR0hfSEFORExFUixcbiAgICAgICdpbXBvcnQgY2YgZnJvbSBcImNsb3VkZnJvbnRcIjtcXG5mdW5jdGlvbiB2aWV3ZXJSZXF1ZXN0KGV2ZW50KSB7fScsXG4gICAgKTtcbiAgICBleHBlY3QoY29kZS5zdGFydHNXaXRoKCdpbXBvcnQgY2YgZnJvbSBcImNsb3VkZnJvbnRcIjsnKSkudG9CZSh0cnVlKTtcbiAgICBleHBlY3QoY29kZSkudG9NYXRjaChcbiAgICAgIC9hc3luYyBmdW5jdGlvbiBoYW5kbGVyXFwoZXZlbnRcXCkgXFx7XFxuY29uc3Qgdmlld2VyUmVzdWx0ID0gYXdhaXQgdmlld2VyUmVxdWVzdFxcKGV2ZW50XFwpOy8sXG4gICAgKTtcbiAgfSk7XG59KTtcblxuZGVzY3JpYmUoXCJhc3NldFByZWZpeFJld3JpdGVIYW5kbGVyXCIsICgpID0+IHtcbiAgaXQoXCJzd2FwcyB0aGUgcHJlZml4IGZvciB0aGUgYmFzZVBhdGhcIiwgKCkgPT4ge1xuICAgIGV4cGVjdChhc3NldFByZWZpeFJld3JpdGVIYW5kbGVyKFwiYmFzZVwiLCBcIi9jZG5cIikpLnRvQ29udGFpbihcbiAgICAgICdyZXF1ZXN0LnVyaSA9IFwiL2Jhc2VcIiArIHJlcXVlc3QudXJpLnNsaWNlKDQpOycsXG4gICAgKTtcbiAgICBleHBlY3QoYXNzZXRQcmVmaXhSZXdyaXRlSGFuZGxlcihcIlwiLCBcIi9jZG5cIikpLnRvQ29udGFpbihcbiAgICAgICdyZXF1ZXN0LnVyaSA9IFwiXCIgKyByZXF1ZXN0LnVyaS5zbGljZSg0KTsnLFxuICAgICk7XG4gIH0pO1xufSk7XG5cbmRlc2NyaWJlKFwiY2hlY2tWaWV3ZXJSZXF1ZXN0Q29kZVwiLCAoKSA9PiB7XG4gIGl0LmVhY2goW1xuICAgIFwiZnVuY3Rpb24gdmlld2VyUmVxdWVzdChldmVudCkge31cIixcbiAgICBcImFzeW5jIGZ1bmN0aW9uIHZpZXdlclJlcXVlc3QoZXZlbnQpIHt9XCIsXG4gICAgXCJjb25zdCB2aWV3ZXJSZXF1ZXN0ID0gKGV2ZW50KSA9PiB7fTtcIixcbiAgICBcInZhciB4ID0gMSwgdmlld2VyUmVxdWVzdCA9IChldmVudCkgPT4ge307XCIsXG4gIF0pKFwiYWNjZXB0cyAlc1wiLCAoY29kZSkgPT4ge1xuICAgIGV4cGVjdCgoKSA9PiBjaGVja1ZpZXdlclJlcXVlc3RDb2RlKGNvZGUpKS5ub3QudG9UaHJvdygpO1xuICB9KTtcblxuICBpdChcInJlZnVzZXMgY29kZSB0aGF0IG5ldmVyIGRlZmluZXMgdmlld2VyUmVxdWVzdFwiLCAoKSA9PiB7XG4gICAgZXhwZWN0KCgpID0+XG4gICAgICBjaGVja1ZpZXdlclJlcXVlc3RDb2RlKFwiY29uc3Qgb2sgPSB2aWV3ZXJSZXF1ZXN0ID09PSAxO1wiKSxcbiAgICApLnRvVGhyb3coL211c3QgZGVmaW5lIGB2aWV3ZXJSZXF1ZXN0XFwoZXZlbnRcXClgLyk7XG4gIH0pO1xuXG4gIGl0KFwicmVmdXNlcyBjb2RlIHRoYXQgdXNlcyB0aGUgbmFtZSBoYW5kbGVyXCIsICgpID0+IHtcbiAgICBleHBlY3QoKCkgPT5cbiAgICAgIGNoZWNrVmlld2VyUmVxdWVzdENvZGUoXCJmdW5jdGlvbiB2aWV3ZXJSZXF1ZXN0KGV2ZW50KSB7fSAvLyBoYW5kbGVyXCIpLFxuICAgICkudG9UaHJvdygvdXNlcyB0aGUgbmFtZSBgaGFuZGxlcmAvKTtcbiAgfSk7XG59KTtcbiJdfQ==

package/package.json

@@ -20,6 +20,7 @@
     "@aws-sdk/client-s3": "^3.1141.0",
     "@aws-sdk/client-ssm": "^3.1141.0",
     "@aws-sdk/lib-storage": "^3.1141.0",
+    "@iconify-json/logos": "1.2.16",
     "@mrgrain/jsii-struct-builder": "^0.7.64",
     "@next/routing": "16.4.0",
     "@smithy/signature-v4": "^2.3.0",
@@ -84,7 +85,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.7.12",
+  "version": "0.7.14",
   "jest": {
     "coverageProvider": "v8",
     "testPathIgnorePatterns": [
@@ -190,6 +191,8 @@
     "compat": "pnpm dlx projen compat",
     "compile": "pnpm dlx projen compile",
     "default": "pnpm dlx projen default",
+    "diagrams": "pnpm dlx projen diagrams",
+    "diagrams:check": "pnpm dlx projen diagrams:check",
     "docgen": "pnpm dlx projen docgen",
     "eject": "pnpm dlx projen eject",
     "eslint": "pnpm dlx projen eslint",

package/scripts/e2e-harness/README.md

@@ -150,19 +150,21 @@ with a shared stack named `hrns-shard-<n>` (with the type's infix) and each
 running its own slice of that type's file list.
 
 A run of one type starts all its shards at once. A run of `all` (the schedule)
-lists 45 jobs, Global Functions first, then Regional Functions, Regional
-Containers and Global Containers, and runs at most 10 at a time, which is about 11
-hours end to end (about 95 shard-hours: Global Containers' 15 shards take about
-2.5 hours each, the others about 2; the shards of one type end together, so the
-last five Global Containers shards run with half the slots idle). Ten is the peak
-a single-type run of the other three already reaches: no more CloudFront
+lists 45 jobs, Global Functions first, then Regional Containers, Global
+Containers and Regional Functions, and runs at most 10 at a time, which is about
+9.6 hours end to end (about 90 shard-hours: the Containers types' shards take
+about 2.3 hours each, Global Functions' about 1.7 and Regional Functions' about
+1.5). Regional Functions goes last because its shards are the shortest, so they
+fill the slots the others free at the end. Listing Global Containers last, as
+the workflow once did, left its last five shards running with half the slots
+idle, for about 10.2 hours. Ten is the peak a single-type run of the other three already reaches: no more CloudFront
 distributions at once than a Global Functions run, under the CloudFront
 response-headers-policy quota (3 per distribution), no more ECR pulls than a
 Regional Containers run, and no more of the org's concurrent jobs than the
 schedule has always taken. A slot goes to the next job as soon as one frees, so
 types overlap where one ends and the next begins; that is safe, because no two
 entries share a stack name. Results arrive in that order: a Global Functions
-regression shows up first, about 2 hours in.
+regression shows up first, about 2 hours in, and Regional Functions' last.
 
 To check the workflow itself rather than compatibility, dispatch `all` with
 `shard_total: 1` and `test_filters: ../test/harness-smoke-manifest.json`: one
@@ -205,7 +207,7 @@ cancels. It is one group for every type, not one per type: each run's
 account-wide sweep could otherwise delete another type's idle-looking shard stack
 as that run warms into it. GitHub keeps only one _pending_ run per group, so
 dispatch a second type once the first has started, not while one is queued, or
-dispatch `all`. A dispatch on a schedule day waits behind the schedule's ~11
+dispatch `all`. A dispatch on a schedule day waits behind the schedule's ~10
 hours. A pending run that gets cancelled that way, the scheduled one included,
 loses no sweep: every run sweeps, not just the scheduled one.
 

package/scripts/e2e-harness/app.js

@@ -205,8 +205,13 @@ class HarnessStack extends Stack {
  * `use-cache-metadata-route-handler`'s `/[slug]` page, which threw on it (a 500,
  * past the ALB's 200-499 range, so the task under test kept being replaced);
  * `/_next/__cdk-nextjs-harness-health` was taken by `sub-shell-generation`'s
- * `/[lang]/[slug]` as `lang: "_next"`, and the health check's renders left
- * `/es/*` served a runtime root layout instead of the build-time shell.
+ * `/[lang]/[slug]` as `lang: "_next"`. Its fallback shell revalidates 15 minutes
+ * after `next build` (`fallbackRevalidate: 900`, the `'use cache'` root layout's
+ * default lifetime), and the first request past that serves it stale and
+ * regenerates it at runtime, so `/es/*` then reports a runtime root layout -
+ * `next start` does the same. The health check was simply that first request,
+ * well before the test's own; the test still fails if it runs more than 15
+ * minutes after the build (#274).
  */
 const HEALTH_CHECK_PATH = "/_next/static/__cdk-nextjs-harness-health";
 

package/scripts/render-diagrams.mjs

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+/**
+ * Render the README architecture diagrams with real AWS icons.
+ *
+ *   pnpm diagrams          # docs/diagrams/*.mmd -> docs/diagrams/*.svg
+ *   pnpm diagrams:check    # fail if an .svg is missing, orphaned or stale
+ *
+ * Why committed SVGs and not ```mermaid blocks. GitHub's Mermaid renderer can't
+ * register icon packs, so `architecture-beta` there is limited to its generic
+ * built-in icons; and npm and Construct Hub don't render Mermaid at all. An SVG
+ * renders everywhere the README is shown.
+ *
+ * Why the check compares a hash and not the rendered bytes. Chromium lays out
+ * labels with whatever fonts the machine has, so a render on macOS and one on an
+ * Ubuntu runner differ even from the same source. Each SVG instead carries a
+ * SHA-256 of the `.mmd` it was rendered from and the `mmdc` and icon pack
+ * versions, which the check (no Chrome needed) recomputes from what's on disk.
+ *
+ * `mmdc` runs through `npx`, not as a devDependency: it pulls in Puppeteer, whose
+ * Chrome download pnpm blocks as a build script, and every install would pay for
+ * it. The icon pack is an exact-pinned devDependency, which keeps it out of the
+ * automated `upgrade-dev-deps` PRs: bumping either version is a hand edit that
+ * `diagrams:check` then makes you re-render for.
+ */
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import {
+  existsSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+const MERMAID_CLI = "@mermaid-js/mermaid-cli@12.0.0";
+const DIAGRAMS_DIR = resolve("docs", "diagrams");
+const ICON_PACK_DIR = resolve("node_modules", "@iconify-json", "logos");
+const ICON_PACK = join(ICON_PACK_DIR, "icons.json");
+const ICON_PACK_VERSION = JSON.parse(
+  readFileSync(join(ICON_PACK_DIR, "package.json"), "utf8"),
+).version;
+const STAMP = /^<!-- source-sha256: ([0-9a-f]{64}) -->\n/;
+
+const files = readdirSync(DIAGRAMS_DIR);
+const sources = files.filter((f) => f.endsWith(".mmd")).sort();
+
+const stampOf = (source) =>
+  createHash("sha256")
+    .update(`${MERMAID_CLI}\n@iconify-json/logos@${ICON_PACK_VERSION}\n`)
+    .update(readFileSync(join(DIAGRAMS_DIR, source)))
+    .digest("hex");
+
+if (process.argv.includes("--check")) {
+  const stale = sources.filter((source) => {
+    const svg = join(DIAGRAMS_DIR, source.replace(/\.mmd$/, ".svg"));
+    if (!existsSync(svg)) return true;
+    return STAMP.exec(readFileSync(svg, "utf8"))?.[1] !== stampOf(source);
+  });
+  const orphaned = files.filter(
+    (f) => f.endsWith(".svg") && !sources.includes(f.replace(/\.svg$/, ".mmd")),
+  );
+  if (stale.length) {
+    console.error(
+      `Stale diagrams (run \`pnpm diagrams\` and commit the SVGs): ${stale.join(", ")}`,
+    );
+  }
+  if (orphaned.length) {
+    console.error(`SVGs with no .mmd source: ${orphaned.join(", ")}`);
+  }
+  process.exit(stale.length || orphaned.length ? 1 : 0);
+}
+
+// Chrome's sandbox can't start on GitHub's Ubuntu runners or in most containers.
+const work = mkdtempSync(join(tmpdir(), "render-diagrams-"));
+const puppeteerConfig = join(work, "puppeteer.json");
+writeFileSync(puppeteerConfig, JSON.stringify({ args: ["--no-sandbox"] }));
+
+try {
+  for (const source of sources) {
+    const name = basename(source, ".mmd");
+    const input = join(DIAGRAMS_DIR, source);
+    const output = join(DIAGRAMS_DIR, `${name}.svg`);
+    execFileSync(
+      "npx",
+      [
+        "--yes",
+        MERMAID_CLI,
+        "--quiet",
+        "--puppeteerConfigFile",
+        puppeteerConfig,
+        "--iconPacksNamesAndUrls",
+        `logos#${pathToFileURL(ICON_PACK)}`,
+        "--input",
+        input,
+        "--output",
+        output,
+      ],
+      // `npx` is `npx.cmd` on Windows, which only a shell can run.
+      { stdio: "inherit", shell: process.platform === "win32" },
+    );
+    // Iconify names gradient ids with a random prefix; renumber them so an
+    // unchanged source re-renders to the same bytes on the same machine.
+    const ids = new Map();
+    const svg = readFileSync(output, "utf8").replace(
+      /IconifyId[0-9a-f]+/g,
+      (id) => {
+        if (!ids.has(id)) ids.set(id, `${name}-icon-${ids.size}`);
+        return ids.get(id);
+      },
+    );
+    const stamp = `<!-- source-sha256: ${stampOf(source)} -->\n`;
+    writeFileSync(output, `${stamp}${svg}\n`);
+    console.log(`rendered ${output}`);
+  }
+} finally {
+  rmSync(work, { recursive: true, force: true });
+}