headroom-cms 0.1.1

package/dist/image.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image.d.ts","sourceRoot":"","sources":["../src/image.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,WAAW,SAAS;IACxB,aAAa,EAAE,gBAAgB,CAAC,eAAe,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE;QACJ,qEAAqE;QACrE,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS;;;EAwCxD;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/image.js

@@ -0,0 +1,48 @@
+/**
+ * Image Infrastructure
+ *
+ * Sharp-based image transformation Lambda with HMAC-signed URLs.
+ * Supports dev mode (Node.js source) and package mode (pre-bundled handler).
+ */
+import path from "path";
+export function createImage(name, args) {
+    const imageSigningSecret = new sst.Secret(`${name}ImageSigningSecret`);
+    let imageLambda;
+    if (args.dev) {
+        imageLambda = new sst.aws.Function(`${name}ImageLambda`, {
+            handler: args.dev.handler,
+            runtime: "nodejs22.x",
+            architecture: "arm64",
+            timeout: "30 seconds",
+            memory: "1536 MB",
+            url: {
+                authorization: "iam",
+            },
+            environment: {
+                CONTENT_BUCKET: args.contentBucket.name,
+                IMAGE_SIGNING_SECRET: imageSigningSecret.value,
+            },
+            link: [args.contentBucket, imageSigningSecret],
+        });
+    }
+    else {
+        imageLambda = new sst.aws.Function(`${name}ImageLambda`, {
+            bundle: path.join(args.pkgRoot, "lambda/image-lambda"),
+            handler: "index.handler",
+            runtime: "nodejs22.x",
+            architecture: "arm64",
+            timeout: "30 seconds",
+            memory: "1536 MB",
+            url: {
+                authorization: "iam",
+            },
+            environment: {
+                CONTENT_BUCKET: args.contentBucket.name,
+                IMAGE_SIGNING_SECRET: imageSigningSecret.value,
+            },
+            link: [args.contentBucket, imageSigningSecret],
+        });
+    }
+    return { imageSigningSecret, imageLambda };
+}
+//# sourceMappingURL=image.js.map

package/dist/image.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image.js","sourceRoot":"","sources":["../src/image.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AAYxB,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,IAAe;IACvD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IAEvE,IAAI,WAA6B,CAAC;IAClC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,aAAa,EAAE;YACvD,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO;YACzB,OAAO,EAAE,YAAY;YACrB,YAAY,EAAE,OAAO;YACrB,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,SAAS;YACjB,GAAG,EAAE;gBACH,aAAa,EAAE,KAAK;aACrB;YACD,WAAW,EAAE;gBACX,cAAc,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI;gBACvC,oBAAoB,EAAE,kBAAkB,CAAC,KAAK;aAC/C;YACD,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,aAAa,EAAE;YACvD,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC;YACtD,OAAO,EAAE,eAAe;YACxB,OAAO,EAAE,YAAY;YACrB,YAAY,EAAE,OAAO;YACrB,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,SAAS;YACjB,GAAG,EAAE;gBACH,aAAa,EAAE,KAAK;aACrB;YACD,WAAW,EAAE;gBACX,cAAc,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI;gBACvC,oBAAoB,EAAE,kBAAkB,CAAC,KAAK;aAC/C;YACD,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC;AAC7C,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Headroom CMS — SST Component
+ *
+ * A single HeadroomCMS class that provisions the full CMS infrastructure:
+ * DynamoDB tables, S3, Cognito, Lambda functions, CloudFront, and Admin UI.
+ */
+export type { StorageResources } from "./storage.js";
+export type { AuthResources } from "./auth.js";
+export type { WebhookResources } from "./webhooks.js";
+export type { ImageResources } from "./image.js";
+export type { ApiResources } from "./api.js";
+export type { CdnResources } from "./cdn.js";
+export type { AdminSiteResources } from "./admin-site.js";
+export interface HeadroomCMSArgs {
+    /**
+     * Email address for sending admin invitations and password resets.
+     * Must be verified in SES (Headroom creates the SES identity automatically,
+     * but you must click the verification link sent to this address).
+     */
+    senderEmail: string;
+    /**
+     * Custom domain for the CDN (API endpoint).
+     * If not provided, uses the default CloudFront domain.
+     */
+    domain?: {
+        name: string;
+        /** ACM certificate ARN (must be in us-east-1 for CloudFront) */
+        certificateArn: string;
+    };
+    /**
+     * Custom domain for the admin UI.
+     * If not provided, uses the default CloudFront domain.
+     */
+    adminDomain?: {
+        name: string;
+        /** ACM certificate ARN (must be in us-east-1 for CloudFront) */
+        certificateArn: string;
+    };
+    /**
+     * CloudFront price class.
+     * @default "PriceClass_100" (US, Canada, Europe)
+     */
+    priceClass?: "PriceClass_100" | "PriceClass_200" | "PriceClass_All";
+    /**
+     * API cache TTL in seconds.
+     * @default 3600 (1 hour)
+     */
+    apiCacheTtl?: number;
+    /**
+     * Cognito password policy overrides.
+     */
+    passwordPolicy?: {
+        minimumLength?: number;
+        requireLowercase?: boolean;
+        requireUppercase?: boolean;
+        requireNumbers?: boolean;
+        requireSymbols?: boolean;
+    };
+    /**
+     * Development overrides. Used when developing Headroom itself.
+     * When set, Lambda functions are compiled from source (requires Go + Node.js).
+     */
+    dev?: {
+        /** Go source path for API Lambda, e.g. "packages/api" */
+        apiHandler: string;
+        /** Go source path for webhook worker, e.g. "packages/webhook-worker" */
+        webhookWorkerHandler: string;
+        /** SST handler for custom message function, e.g. "packages/functions/custom-message.handler" */
+        customMessageHandler: string;
+        /** SST handler for image Lambda, e.g. "packages/image-lambda/index.handler" */
+        imageLambdaHandler: string;
+        /** Path to admin UI source, e.g. "packages/admin" */
+        adminPath: string;
+    };
+}
+export declare class HeadroomCMS {
+    readonly apiUrl: $util.Output<string>;
+    readonly cdnUrl: $util.Output<string>;
+    readonly adminUrl: $util.Output<string>;
+    readonly userPoolId: $util.Output<string>;
+    readonly userPoolClientId: $util.Output<string>;
+    readonly outputs: Record<string, $util.Output<string>>;
+    constructor(name: string, args: HeadroomCMSArgs);
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAuCH,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,gEAAgE;QAChE,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,gEAAgE;QAChE,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;OAGG;IACH,UAAU,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;IAEpE;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,cAAc,CAAC,EAAE;QACf,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC;IAEF;;;OAGG;IACH,GAAG,CAAC,EAAE;QACJ,yDAAyD;QACzD,UAAU,EAAE,MAAM,CAAC;QACnB,wEAAwE;QACxE,oBAAoB,EAAE,MAAM,CAAC;QAC7B,gGAAgG;QAChG,oBAAoB,EAAE,MAAM,CAAC;QAC7B,+EAA+E;QAC/E,kBAAkB,EAAE,MAAM,CAAC;QAC3B,qDAAqD;QACrD,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,qBAAa,WAAW;IACtB,SAAgB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,SAAgB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,SAAgB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/C,SAAgB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjD,SAAgB,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEvD,SAAgB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBAElD,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe;CAqFhD"}

package/dist/index.js

@@ -0,0 +1,124 @@
+/**
+ * Headroom CMS — SST Component
+ *
+ * A single HeadroomCMS class that provisions the full CMS infrastructure:
+ * DynamoDB tables, S3, Cognito, Lambda functions, CloudFront, and Admin UI.
+ */
+import fs from "fs";
+import path from "path";
+import { createStorage } from "./storage.js";
+import { createAuth } from "./auth.js";
+import { createWebhooks } from "./webhooks.js";
+import { createImage } from "./image.js";
+import { createApi } from "./api.js";
+import { createCdn } from "./cdn.js";
+import { createAdminSite } from "./admin-site.js";
+/**
+ * Resolve the headroom-cms package root directory.
+ *
+ * We can't rely on import.meta.url because SST's esbuild bundler inlines
+ * all config code into a single .mjs file under .sst/platform/, which makes
+ * import.meta.url point to the bundled output instead of the original source.
+ *
+ * Instead, walk up from process.cwd() looking for node_modules/headroom-cms.
+ */
+function resolvePkgRoot() {
+    let dir = process.cwd();
+    while (true) {
+        const candidate = path.join(dir, "node_modules", "headroom-cms");
+        if (fs.existsSync(candidate)) {
+            return fs.realpathSync(candidate);
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    throw new Error("Could not find headroom-cms package in node_modules. " +
+        "Ensure it is installed as a dependency.");
+}
+export class HeadroomCMS {
+    apiUrl;
+    cdnUrl;
+    adminUrl;
+    userPoolId;
+    userPoolClientId;
+    outputs;
+    constructor(name, args) {
+        // Only need pkgRoot for package mode (pre-built artifacts)
+        const pkgRoot = args.dev ? "" : resolvePkgRoot();
+        // 1. Storage (DynamoDB tables, S3 bucket, KVS)
+        const storage = createStorage(name);
+        // 2. Auth (Cognito, SES, custom message Lambda)
+        const auth = createAuth(name, {
+            senderEmail: args.senderEmail,
+            passwordPolicy: args.passwordPolicy,
+            pkgRoot,
+            dev: args.dev
+                ? { handler: args.dev.customMessageHandler }
+                : undefined,
+        });
+        // 3. Webhooks (DynamoDB tables, SQS queues, worker Lambda)
+        const webhooks = createWebhooks(name, {
+            sites: storage.sites,
+            pkgRoot,
+            dev: args.dev
+                ? { handler: args.dev.webhookWorkerHandler }
+                : undefined,
+        });
+        // 4. Image Lambda (Sharp transform with HMAC-signed URLs)
+        const image = createImage(name, {
+            contentBucket: storage.contentBucket,
+            pkgRoot,
+            dev: args.dev
+                ? { handler: args.dev.imageLambdaHandler }
+                : undefined,
+        });
+        // 5. API Lambda (Go handler with access to all resources)
+        const api = createApi(name, {
+            storage,
+            auth,
+            webhooks,
+            image,
+            pkgRoot,
+            dev: args.dev
+                ? { handler: args.dev.apiHandler }
+                : undefined,
+        });
+        // 6. CDN (CloudFront distribution + edge functions)
+        const cdn = createCdn(name, {
+            api,
+            image,
+            contentBucket: storage.contentBucket,
+            kvs: storage.kvs,
+            priceClass: args.priceClass,
+            apiCacheTtl: args.apiCacheTtl,
+            domain: args.domain,
+        });
+        // 7. Admin UI (static site)
+        const admin = createAdminSite(name, {
+            api,
+            cdn,
+            auth,
+            pkgRoot,
+            dev: args.dev
+                ? { adminPath: args.dev.adminPath }
+                : undefined,
+            domain: args.adminDomain,
+        });
+        // Expose outputs
+        this.apiUrl = api.api.url;
+        this.cdnUrl = cdn.url;
+        this.adminUrl = admin.url;
+        this.userPoolId = auth.userPool.id;
+        this.userPoolClientId = auth.userPoolClient.id;
+        this.outputs = {
+            api: api.api.url,
+            cdn: cdn.url,
+            admin: admin.url,
+            userPoolId: auth.userPool.id,
+            userPoolClientId: auth.userPoolClient.id,
+        };
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;;;;;;GAQG;AACH,SAAS,cAAc;IACrB,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACxB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;QACjE,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CACb,uDAAuD;QACvD,yCAAyC,CAC1C,CAAC;AACJ,CAAC;AAgFD,MAAM,OAAO,WAAW;IACN,MAAM,CAAuB;IAC7B,MAAM,CAAuB;IAC7B,QAAQ,CAAuB;IAC/B,UAAU,CAAuB;IACjC,gBAAgB,CAAuB;IAEvC,OAAO,CAAuC;IAE9D,YAAY,IAAY,EAAE,IAAqB;QAC7C,2DAA2D;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QAEjD,+CAA+C;QAC/C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAEpC,gDAAgD;QAChD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE;YAC5B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE;gBAC5C,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE;YACpC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE;gBAC5C,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,0DAA0D;QAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE;YAC9B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE;gBAC1C,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,0DAA0D;QAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE;YAC1B,OAAO;YACP,IAAI;YACJ,QAAQ;YACR,KAAK;YACL,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE;gBAClC,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,oDAAoD;QACpD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE;YAC1B,GAAG;YACH,KAAK;YACL,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,4BAA4B;QAC5B,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE;YAClC,GAAG;YACH,GAAG;YACH,IAAI;YACJ,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE;gBACnC,CAAC,CAAC,SAAS;YACb,MAAM,EAAE,IAAI,CAAC,WAAW;SACzB,CAAC,CAAC;QAEH,iBAAiB;QACjB,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QAE/C,IAAI,CAAC,OAAO,GAAG;YACb,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG;YAChB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,KAAK,CAAC,GAAG;YAChB,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAC5B,gBAAgB,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE;SACzC,CAAC;IACJ,CAAC;CACF"}

package/dist/storage.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Storage Infrastructure
+ *
+ * 9 DynamoDB tables + S3 bucket + CloudFront KeyValueStore.
+ * All resources are prefixed with the component name.
+ */
+export declare function createStorage(name: string): {
+    sites: sst.aws.Dynamo;
+    content: sst.aws.Dynamo;
+    draftContent: sst.aws.Dynamo;
+    blocks: sst.aws.Dynamo;
+    media: sst.aws.Dynamo;
+    collections: sst.aws.Dynamo;
+    blockTypes: sst.aws.Dynamo;
+    adminAudit: sst.aws.Dynamo;
+    relationships: sst.aws.Dynamo;
+    contentBucket: sst.aws.Bucket;
+    kvs: aws.cloudfront.KeyValueStore;
+};
+export type StorageResources = ReturnType<typeof createStorage>;
+//# sourceMappingURL=storage.d.ts.map

package/dist/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM;;;;;;;;;;;;EAgIzC;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC"}

package/dist/storage.js

@@ -0,0 +1,125 @@
+/**
+ * Storage Infrastructure
+ *
+ * 9 DynamoDB tables + S3 bucket + CloudFront KeyValueStore.
+ * All resources are prefixed with the component name.
+ */
+export function createStorage(name) {
+    const sites = new sst.aws.Dynamo(`${name}Sites`, {
+        fields: {
+            pk: "string",
+            sk: "string",
+        },
+        primaryIndex: { hashKey: "pk", rangeKey: "sk" },
+    });
+    const content = new sst.aws.Dynamo(`${name}Content`, {
+        fields: {
+            pk: "string",
+            sk: "string",
+            gsiPk: "string",
+            gsiSk: "string",
+            lastDraftAtSk: "string",
+            collectionGsiPk: "string",
+            titleSk: "string",
+        },
+        primaryIndex: { hashKey: "pk", rangeKey: "sk" },
+        globalIndexes: {
+            byPublishedDate: { hashKey: "gsiPk", rangeKey: "gsiSk" },
+            byLastDraftAt: { hashKey: "pk", rangeKey: "lastDraftAtSk" },
+            byCollectionTitle: { hashKey: "collectionGsiPk", rangeKey: "titleSk" },
+        },
+    });
+    const draftContent = new sst.aws.Dynamo(`${name}DraftContent`, {
+        fields: {
+            pk: "string",
+            sk: "string",
+        },
+        primaryIndex: { hashKey: "pk", rangeKey: "sk" },
+    });
+    const blocks = new sst.aws.Dynamo(`${name}Blocks`, {
+        fields: {
+            pk: "string",
+        },
+        primaryIndex: { hashKey: "pk" },
+    });
+    const media = new sst.aws.Dynamo(`${name}Media`, {
+        fields: {
+            pk: "string",
+            sk: "string",
+            uploadedAt: "number",
+            folderGsiPk: "string",
+        },
+        primaryIndex: { hashKey: "pk", rangeKey: "sk" },
+        globalIndexes: {
+            byDate: { hashKey: "pk", rangeKey: "uploadedAt" },
+            byFolder: { hashKey: "folderGsiPk", rangeKey: "uploadedAt" },
+        },
+    });
+    const collections = new sst.aws.Dynamo(`${name}Collections`, {
+        fields: {
+            pk: "string",
+            sk: "string",
+        },
+        primaryIndex: { hashKey: "pk", rangeKey: "sk" },
+    });
+    const blockTypes = new sst.aws.Dynamo(`${name}BlockTypes`, {
+        fields: {
+            pk: "string",
+            sk: "string",
+        },
+        primaryIndex: { hashKey: "pk", rangeKey: "sk" },
+    });
+    const adminAudit = new sst.aws.Dynamo(`${name}AdminAudit`, {
+        fields: {
+            pk: "string",
+            sk: "string",
+        },
+        primaryIndex: { hashKey: "pk", rangeKey: "sk" },
+    });
+    const relationships = new sst.aws.Dynamo(`${name}Relationships`, {
+        fields: {
+            pk: "string",
+            sk: "string",
+            targetPk: "string",
+            targetSk: "string",
+        },
+        primaryIndex: { hashKey: "pk", rangeKey: "sk" },
+        globalIndexes: {
+            byTarget: { hashKey: "targetPk", rangeKey: "targetSk" },
+        },
+    });
+    const contentBucket = new sst.aws.Bucket(`${name}ContentBucket`, {
+        versioning: true,
+        access: "cloudfront",
+        transform: {
+            bucket: (args) => {
+                args.lifecycleRules = [
+                    {
+                        id: "cleanup-pending-uploads",
+                        enabled: true,
+                        expirations: [{ days: 1 }],
+                        tags: { status: "pending" },
+                    },
+                ];
+            },
+        },
+    });
+    const kvs = new aws.cloudfront.KeyValueStore(`${name}KVS`, {
+        name: $interpolate `${$app.name}-${$app.stage}-kvs`,
+        comment: "Headroom CMS edge data: API keys and site versions",
+    });
+    return {
+        sites,
+        content,
+        draftContent,
+        blocks,
+        media,
+        collections,
+        blockTypes,
+        adminAudit,
+        relationships,
+        contentBucket,
+        kvs,
+    };
+}
+//# sourceMappingURL=storage.js.map

package/dist/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE;QAC/C,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE;QACnD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,QAAQ;YACf,aAAa,EAAE,QAAQ;YACvB,eAAe,EAAE,QAAQ;YACzB,OAAO,EAAE,QAAQ;SAClB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,eAAe,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE;YACxD,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE;YAC3D,iBAAiB,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE;SACvE;KACF,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,cAAc,EAAE;QAC7D,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,QAAQ,EAAE;QACjD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;KAChC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE;QAC/C,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;YACZ,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,QAAQ;SACtB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE;YACjD,QAAQ,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE;SAC7D;KACF,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,aAAa,EAAE;QAC3D,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,YAAY,EAAE;QACzD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,YAAY,EAAE;QACzD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE;QAC/D,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;YACZ,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,QAAQ;SACnB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,QAAQ,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE;SACxD;KACF,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE;QAC/D,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,YAAY;QACpB,SAAS,EAAE;YACT,MAAM,EAAE,CAAC,IAAS,EAAE,EAAE;gBACpB,IAAI,CAAC,cAAc,GAAG;oBACpB;wBACE,EAAE,EAAE,yBAAyB;wBAC7B,OAAO,EAAE,IAAI;wBACb,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;wBAC1B,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;qBAC5B;iBACF,CAAC;YACJ,CAAC;SACF;KACF,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,IAAI,KAAK,EAAE;QACzD,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,MAAM;QAClD,OAAO,EAAE,oDAAoD;KAC9D,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;QACL,OAAO;QACP,YAAY;QACZ,MAAM;QACN,KAAK;QACL,WAAW;QACX,UAAU;QACV,UAAU;QACV,aAAa;QACb,aAAa;QACb,GAAG;KACJ,CAAC;AACJ,CAAC"}

package/dist/webhooks.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Webhook Infrastructure
+ *
+ * 2 DynamoDB tables + 2 SQS queues + webhook worker Lambda.
+ * Supports dev mode (Go source) and package mode (pre-compiled binary).
+ */
+import type { StorageResources } from "./storage.js";
+export interface WebhookArgs {
+    sites: StorageResources["sites"];
+    pkgRoot: string;
+    dev?: {
+        /** Go source path, e.g. "packages/webhook-worker" */
+        handler: string;
+    };
+}
+export declare function createWebhooks(name: string, args: WebhookArgs): {
+    webhooks: sst.aws.Dynamo;
+    webhookDeliveries: sst.aws.Dynamo;
+    webhookDeliveryQueue: sst.aws.Queue;
+    webhookDeliveryDLQ: sst.aws.Queue;
+};
+export type WebhookResources = ReturnType<typeof createWebhooks>;
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE;QACJ,qDAAqD;QACrD,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW;;;;;EA4F7D;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/webhooks.js

@@ -0,0 +1,91 @@
+/**
+ * Webhook Infrastructure
+ *
+ * 2 DynamoDB tables + 2 SQS queues + webhook worker Lambda.
+ * Supports dev mode (Go source) and package mode (pre-compiled binary).
+ */
+import path from "path";
+export function createWebhooks(name, args) {
+    const webhooks = new sst.aws.Dynamo(`${name}Webhooks`, {
+        fields: {
+            pk: "string",
+            sk: "string",
+        },
+        primaryIndex: { hashKey: "pk", rangeKey: "sk" },
+    });
+    const webhookDeliveries = new sst.aws.Dynamo(`${name}WebhookDeliveries`, {
+        fields: {
+            pk: "string",
+            sk: "string",
+        },
+        primaryIndex: { hashKey: "pk", rangeKey: "sk" },
+        ttl: "ttl",
+    });
+    const webhookDeliveryDLQ = new sst.aws.Queue(`${name}WebhookDeliveryDLQ`, {
+        transform: {
+            queue: (queueArgs) => {
+                queueArgs.messageRetentionSeconds = 14 * 24 * 60 * 60; // 14 days
+            },
+        },
+    });
+    const webhookDeliveryQueue = new sst.aws.Queue(`${name}WebhookDeliveryQueue`, {
+        dlq: {
+            queue: webhookDeliveryDLQ.arn,
+            retry: 5,
+        },
+        transform: {
+            queue: (queueArgs) => {
+                queueArgs.visibilityTimeoutSeconds = 60;
+                queueArgs.messageRetentionSeconds = 4 * 24 * 60 * 60; // 4 days
+            },
+        },
+    });
+    // Webhook worker Lambda: processes SQS messages and delivers webhooks.
+    // Note: We use a manual Function + EventSourceMapping instead of
+    // queue.subscribe() to avoid a duplicate LambdaEncryptionKey issue
+    // caused by SST's dynamic import creating a separate Function class instance.
+    const workerConfig = args.dev
+        ? {
+            handler: args.dev.handler,
+            runtime: "go",
+        }
+        : {
+            bundle: path.join(args.pkgRoot, "lambda/webhook-worker"),
+            handler: "bootstrap",
+            runtime: "provided.al2023",
+            architecture: "arm64",
+        };
+    const webhookWorker = new sst.aws.Function(`${name}WebhookWorker`, {
+        ...workerConfig,
+        memory: "256 MB",
+        timeout: "30 seconds",
+        environment: {
+            WEBHOOK_DELIVERIES_TABLE: webhookDeliveries.name,
+            WEBHOOKS_TABLE: webhooks.name,
+            SITES_TABLE: args.sites.name,
+        },
+        link: [webhookDeliveries, webhooks, args.sites],
+        permissions: [
+            {
+                actions: [
+                    "sqs:ReceiveMessage",
+                    "sqs:DeleteMessage",
+                    "sqs:GetQueueAttributes",
+                ],
+                resources: [webhookDeliveryQueue.arn],
+            },
+        ],
+    });
+    new aws.lambda.EventSourceMapping(`${name}WebhookWorkerEventSource`, {
+        eventSourceArn: webhookDeliveryQueue.arn,
+        functionName: webhookWorker.name,
+        batchSize: 1,
+    });
+    return {
+        webhooks,
+        webhookDeliveries,
+        webhookDeliveryQueue,
+        webhookDeliveryDLQ,
+    };
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AAYxB,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAiB;IAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,UAAU,EAAE;QACrD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,mBAAmB,EAAE;QACvE,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,GAAG,EAAE,KAAK;KACX,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,oBAAoB,EAAE;QACxE,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,SAAc,EAAE,EAAE;gBACxB,SAAS,CAAC,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;YACnE,CAAC;SACF;KACF,CAAC,CAAC;IAEH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAC5C,GAAG,IAAI,sBAAsB,EAC7B;QACE,GAAG,EAAE;YACH,KAAK,EAAE,kBAAkB,CAAC,GAAG;YAC7B,KAAK,EAAE,CAAC;SACT;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,SAAc,EAAE,EAAE;gBACxB,SAAS,CAAC,wBAAwB,GAAG,EAAE,CAAC;gBACxC,SAAS,CAAC,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS;YACjE,CAAC;SACF;KACF,CACF,CAAC;IAEF,uEAAuE;IACvE,iEAAiE;IACjE,mEAAmE;IACnE,8EAA8E;IAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG;QAC3B,CAAC,CAAC;YACE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO;YACzB,OAAO,EAAE,IAAa;SACvB;QACH,CAAC,CAAC;YACE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB,CAAC;YACxD,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,iBAA0B;YACnC,YAAY,EAAE,OAAgB;SAC/B,CAAC;IAEN,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,eAAe,EAAE;QACjE,GAAG,YAAY;QACf,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,YAAY;QACrB,WAAW,EAAE;YACX,wBAAwB,EAAE,iBAAiB,CAAC,IAAI;YAChD,cAAc,EAAE,QAAQ,CAAC,IAAI;YAC7B,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;SAC7B;QACD,IAAI,EAAE,CAAC,iBAAiB,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC;QAC/C,WAAW,EAAE;YACX;gBACE,OAAO,EAAE;oBACP,oBAAoB;oBACpB,mBAAmB;oBACnB,wBAAwB;iBACzB;gBACD,SAAS,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC;aACtC;SACF;KACF,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,GAAG,IAAI,0BAA0B,EAAE;QACnE,cAAc,EAAE,oBAAoB,CAAC,GAAG;QACxC,YAAY,EAAE,aAAa,CAAC,IAAI;QAChC,SAAS,EAAE,CAAC;KACb,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,iBAAiB;QACjB,oBAAoB;QACpB,kBAAkB;KACnB,CAAC;AACJ,CAAC"}