headroom-cms 0.1.10 → 0.2.0

package/dist/webhooks.d.ts

@@ -1,8 +1,9 @@
 /**
  * Webhook Infrastructure
  *
- * 2 DynamoDB tables + 2 SQS queues + webhook worker Lambda.
- * Supports dev mode (Go source) and package mode (pre-compiled binary).
+ * 2 DynamoDB tables + webhook worker Lambda (async-invoked by the API) + DLQ
+ * (Lambda async on-failure destination). The API directly invokes the worker
+ * via lambda:InvokeFunction; there is no SQS queue between them.
  */
 import type { StorageResources } from "./storage.js";
 export interface WebhookArgs {
@@ -16,7 +17,7 @@ export interface WebhookArgs {
 export declare function createWebhooks(name: string, args: WebhookArgs): {
     webhooks: sst.aws.Dynamo;
     webhookDeliveries: sst.aws.Dynamo;
-    webhookDeliveryQueue: sst.aws.Queue;
+    webhookWorker: sst.aws.Function;
     webhookDeliveryDLQ: sst.aws.Queue;
 };
 export type WebhookResources = ReturnType<typeof createWebhooks>;

package/dist/webhooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE;QACJ,qDAAqD;QACrD,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW;;;;;EA4F7D;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC"}
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE;QACJ,qDAAqD;QACrD,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW;;;;;EA0E7D;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/webhooks.js

@@ -1,8 +1,9 @@
 /**
  * Webhook Infrastructure
  *
- * 2 DynamoDB tables + 2 SQS queues + webhook worker Lambda.
- * Supports dev mode (Go source) and package mode (pre-compiled binary).
+ * 2 DynamoDB tables + webhook worker Lambda (async-invoked by the API) + DLQ
+ * (Lambda async on-failure destination). The API directly invokes the worker
+ * via lambda:InvokeFunction; there is no SQS queue between them.
  */
 import path from "path";
 export function createWebhooks(name, args) {
@@ -21,6 +22,9 @@ export function createWebhooks(name, args) {
         primaryIndex: { hashKey: "pk", rangeKey: "sk" },
         ttl: "ttl",
     });
+    // DLQ retained as Lambda async OnFailure destination. Lambda writes a
+    // failure envelope (not the original payload verbatim) when retries are
+    // exhausted. No consumer polls this queue — it's a sink only.
     const webhookDeliveryDLQ = new sst.aws.Queue(`${name}WebhookDeliveryDLQ`, {
         transform: {
             queue: (queueArgs) => {
@@ -28,22 +32,6 @@ export function createWebhooks(name, args) {
             },
         },
     });
-    const webhookDeliveryQueue = new sst.aws.Queue(`${name}WebhookDeliveryQueue`, {
-        dlq: {
-            queue: webhookDeliveryDLQ.arn,
-            retry: 5,
-        },
-        transform: {
-            queue: (queueArgs) => {
-                queueArgs.visibilityTimeoutSeconds = 60;
-                queueArgs.messageRetentionSeconds = 4 * 24 * 60 * 60; // 4 days
-            },
-        },
-    });
-    // Webhook worker Lambda: processes SQS messages and delivers webhooks.
-    // Note: We use a manual Function + EventSourceMapping instead of
-    // queue.subscribe() to avoid a duplicate LambdaEncryptionKey issue
-    // caused by SST's dynamic import creating a separate Function class instance.
     const workerConfig = args.dev
         ? {
             handler: args.dev.handler,
@@ -61,30 +49,29 @@ export function createWebhooks(name, args) {
         timeout: "30 seconds",
         environment: {
             WEBHOOK_DELIVERIES_TABLE: webhookDeliveries.name,
-            WEBHOOKS_TABLE: webhooks.name,
-            SITES_TABLE: args.sites.name,
         },
-        link: [webhookDeliveries, webhooks, args.sites],
-        permissions: [
-            {
-                actions: [
-                    "sqs:ReceiveMessage",
-                    "sqs:DeleteMessage",
-                    "sqs:GetQueueAttributes",
-                ],
-                resources: [webhookDeliveryQueue.arn],
-            },
-        ],
+        // webhookDeliveryDLQ is linked so SST auto-grants sqs:SendMessage on the
+        // worker's execution role. Lambda async OnFailure delivery uses the
+        // function's own role to write the failure envelope to the DLQ — without
+        // this grant, AWS accepts the FunctionEventInvokeConfig at deploy time but
+        // silently drops failure envelopes at runtime.
+        link: [webhookDeliveries, webhookDeliveryDLQ],
     });
-    new aws.lambda.EventSourceMapping(`${name}WebhookWorkerEventSource`, {
-        eventSourceArn: webhookDeliveryQueue.arn,
+    // Lambda async retry + DLQ on terminal failure. MaximumRetryAttempts is
+    // 0–2 (industry standard for webhook delivery — Stripe/GitHub publish
+    // similar caps). Total attempts = initial + 2 retries = 3.
+    new aws.lambda.FunctionEventInvokeConfig(`${name}WebhookWorkerAsyncConfig`, {
         functionName: webhookWorker.name,
-        batchSize: 1,
+        maximumRetryAttempts: 2,
+        maximumEventAgeInSeconds: 6 * 60 * 60, // 6 hours
+        destinationConfig: {
+            onFailure: { destination: webhookDeliveryDLQ.arn },
+        },
     });
     return {
         webhooks,
         webhookDeliveries,
-        webhookDeliveryQueue,
+        webhookWorker,
         webhookDeliveryDLQ,
     };
 }

package/dist/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AAYxB,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAiB;IAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,UAAU,EAAE;QACrD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,mBAAmB,EAAE;QACvE,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,GAAG,EAAE,KAAK;KACX,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,oBAAoB,EAAE;QACxE,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,SAAc,EAAE,EAAE;gBACxB,SAAS,CAAC,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;YACnE,CAAC;SACF;KACF,CAAC,CAAC;IAEH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAC5C,GAAG,IAAI,sBAAsB,EAC7B;QACE,GAAG,EAAE;YACH,KAAK,EAAE,kBAAkB,CAAC,GAAG;YAC7B,KAAK,EAAE,CAAC;SACT;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,SAAc,EAAE,EAAE;gBACxB,SAAS,CAAC,wBAAwB,GAAG,EAAE,CAAC;gBACxC,SAAS,CAAC,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS;YACjE,CAAC;SACF;KACF,CACF,CAAC;IAEF,uEAAuE;IACvE,iEAAiE;IACjE,mEAAmE;IACnE,8EAA8E;IAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG;QAC3B,CAAC,CAAC;YACE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO;YACzB,OAAO,EAAE,IAAa;SACvB;QACH,CAAC,CAAC;YACE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB,CAAC;YACxD,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,iBAA0B;YACnC,YAAY,EAAE,OAAgB;SAC/B,CAAC;IAEN,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,eAAe,EAAE;QACjE,GAAG,YAAY;QACf,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,YAAY;QACrB,WAAW,EAAE;YACX,wBAAwB,EAAE,iBAAiB,CAAC,IAAI;YAChD,cAAc,EAAE,QAAQ,CAAC,IAAI;YAC7B,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;SAC7B;QACD,IAAI,EAAE,CAAC,iBAAiB,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC;QAC/C,WAAW,EAAE;YACX;gBACE,OAAO,EAAE;oBACP,oBAAoB;oBACpB,mBAAmB;oBACnB,wBAAwB;iBACzB;gBACD,SAAS,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC;aACtC;SACF;KACF,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,GAAG,IAAI,0BAA0B,EAAE;QACnE,cAAc,EAAE,oBAAoB,CAAC,GAAG;QACxC,YAAY,EAAE,aAAa,CAAC,IAAI;QAChC,SAAS,EAAE,CAAC;KACb,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,iBAAiB;QACjB,oBAAoB;QACpB,kBAAkB;KACnB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AAYxB,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAiB;IAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,UAAU,EAAE;QACrD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,mBAAmB,EAAE;QACvE,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,GAAG,EAAE,KAAK;KACX,CAAC,CAAC;IAEH,sEAAsE;IACtE,wEAAwE;IACxE,8DAA8D;IAC9D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,oBAAoB,EAAE;QACxE,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,SAAc,EAAE,EAAE;gBACxB,SAAS,CAAC,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;YACnE,CAAC;SACF;KACF,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG;QAC3B,CAAC,CAAC;YACE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO;YACzB,OAAO,EAAE,IAAa;SACvB;QACH,CAAC,CAAC;YACE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB,CAAC;YACxD,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,iBAA0B;YACnC,YAAY,EAAE,OAAgB;SAC/B,CAAC;IAEN,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,eAAe,EAAE;QACjE,GAAG,YAAY;QACf,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,YAAY;QACrB,WAAW,EAAE;YACX,wBAAwB,EAAE,iBAAiB,CAAC,IAAI;SACjD;QACD,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,2EAA2E;QAC3E,+CAA+C;QAC/C,IAAI,EAAE,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;KAC9C,CAAC,CAAC;IAEH,wEAAwE;IACxE,sEAAsE;IACtE,2DAA2D;IAC3D,IAAI,GAAG,CAAC,MAAM,CAAC,yBAAyB,CAAC,GAAG,IAAI,0BAA0B,EAAE;QAC1E,YAAY,EAAE,aAAa,CAAC,IAAI;QAChC,oBAAoB,EAAE,CAAC;QACvB,wBAAwB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU;QACjD,iBAAiB,EAAE;YACjB,SAAS,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC,GAAG,EAAE;SACnD;KACF,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,iBAAiB;QACjB,aAAa;QACb,kBAAkB;KACnB,CAAC;AACJ,CAAC"}

package/lambda/image-lambda/index.mjs

@@ -4,7 +4,17 @@ import { S3Client, GetObjectCommand, PutObjectCommand } from "@aws-sdk/client-s3
 import { createHmac, timingSafeEqual } from "crypto";
 var s3 = new S3Client({});
 var BUCKET = process.env.CONTENT_BUCKET;
-var SIGNING_SECRET = process.env.IMAGE_SIGNING_SECRET;
+var MASTER_SECRET = process.env.IMAGE_SIGNING_MASTER_SECRET;
+var MASTER_SECRET_OLD = process.env.IMAGE_SIGNING_MASTER_SECRET_OLD;
+var _timingSafeEqualCallCount = { count: 0 };
+function _timingSafeEqual(a, b) {
+  _timingSafeEqualCallCount.count++;
+  return timingSafeEqual(a, b);
+}
+function deriveSiteSecret(master, siteHost) {
+  if (!master) return null;
+  return createHmac("sha256", master).update(siteHost).digest("hex").substring(0, 32);
+}
 var MAX_WIDTH = 2048;
 var MAX_HEIGHT = 2048;
 var MAX_PIXELS = 4e6;
@@ -31,6 +41,11 @@ async function handler(event) {
   if (!match) {
     return { statusCode: 400, body: "Invalid image path" };
   }
+  const [, site, mediaId, ext] = match;
+  const sitePrimary = deriveSiteSecret(MASTER_SECRET, site);
+  if (!sitePrimary) {
+    return { statusCode: 503, body: "Image transforms not configured" };
+  }
   const params = new URLSearchParams(rawQuery);
   const sig = params.get("sig");
   if (!sig) {
@@ -44,11 +59,18 @@ async function handler(event) {
   if (!hasTransform) {
     return { statusCode: 400, body: "No transform requested. Use /media/ path for originals." };
   }
-  const expectedSig = computeSignature(rawPath, params);
-  if (!timingSafeEqual(Buffer.from(sig), Buffer.from(expectedSig))) {
+  const siteOld = deriveSiteSecret(MASTER_SECRET_OLD, site);
+  const sigBuf = Buffer.from(sig);
+  const expectedPrimary = computeSignature(rawPath, params, sitePrimary);
+  const primaryMatch = _timingSafeEqual(sigBuf, Buffer.from(expectedPrimary));
+  let oldMatch = false;
+  if (siteOld) {
+    const expectedOld = computeSignature(rawPath, params, siteOld);
+    oldMatch = _timingSafeEqual(sigBuf, Buffer.from(expectedOld));
+  }
+  if (!primaryMatch && !oldMatch) {
     return { statusCode: 403, body: "Invalid signature" };
   }
-  const [, site, mediaId, ext] = match;
   const s3Key = `sites/${site}/media/${mediaId}/original${ext}`;
   const w = clamp(parseInt(params.get("w")) || null, 1, MAX_WIDTH);
   const h = clamp(parseInt(params.get("h")) || null, 1, MAX_HEIGHT);
@@ -139,11 +161,11 @@ async function handler(event) {
     return { statusCode: 500, body: "Image processing failed" };
   }
 }
-function computeSignature(path, params) {
+function computeSignature(path, params, key) {
   const sorted = new URLSearchParams([...params.entries()].sort());
   const qs = sorted.toString();
   const canonical = qs ? `${path}?${qs}` : path;
-  return createHmac("sha256", SIGNING_SECRET).update(canonical).digest("hex").substring(0, 32);
+  return createHmac("sha256", key).update(canonical).digest("hex").substring(0, 32);
 }
 function clamp(val, min, max) {
   if (val == null) return null;
@@ -180,8 +202,10 @@ export {
   MAX_WIDTH,
   PATH_REGEX,
   SHARP_MIME_TYPES,
+  _timingSafeEqualCallCount,
   clamp,
   computeSignature,
+  deriveSiteSecret,
   extToFormat,
   formatToMime,
   handler

package/lambda/image-lambda/node_modules/.package-lock.json

@@ -97,9 +97,9 @@
       "license": "MIT"
     },
     "node_modules/semver": {
-      "version": "7.7.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
-      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
+      "version": "7.8.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.1.tgz",
+      "integrity": "sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"

package/lambda/image-lambda/node_modules/semver/README.md

@@ -56,6 +56,7 @@ const semverCompareLoose = require('semver/functions/compare-loose')
 const semverCompareBuild = require('semver/functions/compare-build')
 const semverSort = require('semver/functions/sort')
 const semverRsort = require('semver/functions/rsort')
+const semverTruncate = require('semver/functions/truncate')
 
 // low-level comparators between versions
 const semverGt = require('semver/functions/gt')
@@ -399,12 +400,19 @@ nr         ::= '0' | ['1'-'9'] ( ['0'-'9'] ) *
 tilde      ::= '~' partial
 caret      ::= '^' partial
 qualifier  ::= ( '-' pre )? ( '+' build )?
-pre        ::= parts
-build      ::= parts
-parts      ::= part ( '.' part ) *
-part       ::= nr | [-0-9A-Za-z]+
+pre        ::= prepart ( '.' prepart ) *
+prepart    ::= nr | alphanumid
+build      ::= buildid ( '.' buildid ) *
+alphanumid ::= ( ['0'-'9'] ) * [-A-Za-z] [-0-9A-Za-z] *
+buildid    ::= [-0-9A-Za-z]+
 ```
 
+Note: Prerelease identifiers (`pre`) use `nr` for numeric parts, which
+disallows leading zeros (e.g., `1.2.3-00` is invalid). Build metadata
+identifiers (`build`) allow any alphanumeric string including leading
+zeros (e.g., `1.2.3+00` is valid). This matches the
+[SemVer 2.0.0 specification](https://semver.org/#spec-item-9).
+
 ## Functions
 
 All methods and classes take a final `options` object argument.  All
@@ -449,6 +457,12 @@ strings that they parse.
   or comparators intersect.
 * `parse(v)`: Attempt to parse a string as a semantic version, returning either
   a `SemVer` object or `null`.
+* `truncate(v, releaseType)`: Return the version with components _lower_
+  than `releaseType` dropped off, e.g.:
+  * `major` removes build & prerelease info and sets minor & patch to 0.
+  * `minor` removes build & prerelease info, and sets patch to 0
+  * `patch` removes build & prerelease info
+  * All prerelease types remove build info only
 
 ### Comparison
 
@@ -650,6 +664,7 @@ The following modules are available:
 * `require('semver/functions/rsort')`
 * `require('semver/functions/satisfies')`
 * `require('semver/functions/sort')`
+* `require('semver/functions/truncate')`
 * `require('semver/functions/valid')`
 * `require('semver/ranges/gtr')`
 * `require('semver/ranges/intersects')`

package/lambda/image-lambda/node_modules/semver/bin/semver.js

@@ -46,6 +46,7 @@ const main = () => {
       a = a.slice(0, indexOfEqualSign)
       argv.unshift(value)
     }
+
     switch (a) {
       case '-rv': case '-rev': case '--rev': case '--reverse':
         reverse = true
@@ -60,15 +61,10 @@ const main = () => {
         versions.push(argv.shift())
         break
       case '-i': case '--inc': case '--increment':
-        switch (argv[0]) {
-          case 'major': case 'minor': case 'patch': case 'prerelease':
-          case 'premajor': case 'preminor': case 'prepatch':
-          case 'release':
-            inc = argv.shift()
-            break
-          default:
-            inc = 'patch'
-            break
+        if (semver.RELEASE_TYPES.includes(argv[0]) || (argv[0] === 'release')) {
+          inc = { value: argv.shift(), maybeErrantValue: null, option: a }
+        } else {
+          inc = { value: 'patch', maybeErrantValue: argv[0], option: a }
         }
         break
       case '--preid':
@@ -102,6 +98,14 @@ const main = () => {
 
   options = parseOptions({ loose, includePrerelease, rtl })
 
+  if (
+    inc &&
+    versions.includes(inc.maybeErrantValue) &&
+    !semver.valid(inc.maybeErrantValue, options)
+  ) {
+    console.warn(`Invalid value for ${inc.option}; defaulting to 'patch'. This may become a failure in future major versions.`)
+  }
+
   versions = versions.map((v) => {
     return coerce ? (semver.coerce(v, options) || { version: v }).version : v
   }).filter((v) => {
@@ -125,7 +129,7 @@ const main = () => {
   versions
     .sort((a, b) => semver[reverse ? 'rcompare' : 'compare'](a, b, options))
     .map(v => semver.clean(v, options))
-    .map(v => inc ? semver.inc(v, inc, options, identifier, identifierBase) : v)
+    .map(v => inc ? semver.inc(v, inc.value, options, identifier, identifierBase) : v)
     .forEach(v => console.log(v))
 }
 

package/lambda/image-lambda/node_modules/semver/classes/range.js

@@ -98,6 +98,9 @@ class Range {
   }
 
   parseRange (range) {
+    // strip build metadata so it can't bleed into the version
+    range = range.replace(BUILDSTRIPRE, '')
+
     // memoize range parsing for performance.
     // this is a very hot path, and fully deterministic.
     const memoOpts =
@@ -223,6 +226,7 @@ const debug = require('../internal/debug')
 const SemVer = require('./semver')
 const {
   safeRe: re,
+  src,
   t,
   comparatorTrimReplace,
   tildeTrimReplace,
@@ -230,6 +234,9 @@ const {
 } = require('../internal/re')
 const { FLAG_INCLUDE_PRERELEASE, FLAG_LOOSE } = require('../internal/constants')
 
+// unbounded global build-metadata stripper used by parseRange
+const BUILDSTRIPRE = new RegExp(src[t.BUILD], 'g')
+
 const isNullSet = c => c.value === '<0.0.0-0'
 const isAny = c => c.value === ''
 

package/lambda/image-lambda/node_modules/semver/functions/truncate.js

@@ -0,0 +1,48 @@
+'use strict'
+
+const parse = require('./parse')
+const constants = require('../internal/constants')
+const SemVer = require('../classes/semver')
+
+const truncate = (version, truncation, options) => {
+  if (!constants.RELEASE_TYPES.includes(truncation)) {
+    return null
+  }
+
+  const clonedVersion = cloneInputVersion(version, options)
+  return clonedVersion && doTruncation(clonedVersion, truncation)
+}
+
+const cloneInputVersion = (version, options) => {
+  const versionStringToParse = (
+    version instanceof SemVer ? version.version : version
+  )
+
+  return parse(versionStringToParse, options)
+}
+
+const doTruncation = (version, truncation) => {
+  if (isPrerelease(truncation)) {
+    return version.version
+  }
+
+  version.prerelease = []
+
+  switch (truncation) {
+    case 'major':
+      version.minor = 0
+      version.patch = 0
+      break
+    case 'minor':
+      version.patch = 0
+      break
+  }
+
+  return version.format()
+}
+
+const isPrerelease = (type) => {
+  return type.startsWith('pre')
+}
+
+module.exports = truncate

package/lambda/image-lambda/node_modules/semver/index.js

@@ -28,6 +28,7 @@ const gte = require('./functions/gte')
 const lte = require('./functions/lte')
 const cmp = require('./functions/cmp')
 const coerce = require('./functions/coerce')
+const truncate = require('./functions/truncate')
 const Comparator = require('./classes/comparator')
 const Range = require('./classes/range')
 const satisfies = require('./functions/satisfies')
@@ -66,6 +67,7 @@ module.exports = {
   lte,
   cmp,
   coerce,
+  truncate,
   Comparator,
   Range,
   satisfies,

package/lambda/image-lambda/node_modules/semver/internal/re.js

@@ -136,7 +136,7 @@ createToken('LOOSE', `^${src[t.LOOSEPLAIN]}$`)
 createToken('GTLT', '((?:<|>)?=?)')
 
 // Something like "2.*" or "1.2.x".
-// Note that "x.x" is a valid xRange identifer, meaning "any version"
+// Note that "x.x" is a valid xRange identifier, meaning "any version"
 // Only the first item is strictly required.
 createToken('XRANGEIDENTIFIERLOOSE', `${src[t.NUMERICIDENTIFIERLOOSE]}|x|X|\\*`)
 createToken('XRANGEIDENTIFIER', `${src[t.NUMERICIDENTIFIER]}|x|X|\\*`)

package/lambda/image-lambda/node_modules/semver/package.json

@@ -1,6 +1,6 @@
 {
   "name": "semver",
-  "version": "7.7.4",
+  "version": "7.8.1",
   "description": "The semantic version parser used by npm.",
   "main": "index.js",
   "scripts": {
@@ -15,7 +15,7 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^6.0.0",
-    "@npmcli/template-oss": "4.29.0",
+    "@npmcli/template-oss": "5.0.0",
     "benchmark": "^2.1.4",
     "tap": "^16.0.0"
   },
@@ -52,7 +52,7 @@
   "author": "GitHub Inc.",
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.29.0",
+    "version": "5.0.0",
     "engines": ">=10",
     "distPaths": [
       "classes/",

package/lambda/image-lambda/node_modules/semver/range.bnf

@@ -10,7 +10,8 @@ nr         ::= '0' | [1-9] ( [0-9] ) *
 tilde      ::= '~' partial
 caret      ::= '^' partial
 qualifier  ::= ( '-' pre )? ( '+' build )?
-pre        ::= parts
-build      ::= parts
-parts      ::= part ( '.' part ) *
-part       ::= nr | [-0-9A-Za-z]+
+pre        ::= prepart ( '.' prepart ) *
+prepart    ::= nr | alphanumid
+build      ::= buildid ( '.' buildid ) *
+alphanumid ::= ( [0-9] ) * [A-Za-z-] [-0-9A-Za-z] *
+buildid    ::= [-0-9A-Za-z]+

package/lambda/image-lambda/node_modules/semver/ranges/subset.js

@@ -174,7 +174,7 @@ const simpleSubset = (sub, dom, options) => {
         if (higher === c && higher !== gt) {
           return false
         }
-      } else if (gt.operator === '>=' && !satisfies(gt.semver, String(c), options)) {
+      } else if (gt.operator === '>=' && !c.test(gt.semver)) {
         return false
       }
     }
@@ -192,7 +192,7 @@ const simpleSubset = (sub, dom, options) => {
         if (lower === c && lower !== lt) {
           return false
         }
-      } else if (lt.operator === '<=' && !satisfies(lt.semver, String(c), options)) {
+      } else if (lt.operator === '<=' && !c.test(lt.semver)) {
         return false
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "headroom-cms",
-  "version": "0.1.10",
+  "version": "0.2.0",
   "description": "Headroom CMS — Serverless headless CMS for AWS, deployed with SST",
   "type": "module",
   "main": "dist/index.js",

package/src/admin-site.ts

@@ -9,13 +9,15 @@
 import fs from "fs";
 import path from "path";
 import type { ApiResources } from "./api.js";
-import type { CdnResources } from "./cdn.js";
+import type { ApiCdnResources } from "./cdn-api.js";
+import type { MediaCdnResources } from "./cdn-media.js";
 import type { AuthResources } from "./auth.js";
 import type { CollaborationResources } from "./collaboration.js";
 
 export interface AdminSiteArgs {
   api: ApiResources;
-  cdn: CdnResources;
+  apiCdn: ApiCdnResources;
+  mediaCdn: MediaCdnResources;
   auth: AuthResources;
   collab: CollaborationResources;
   pkgRoot: string;
@@ -40,7 +42,7 @@ export interface AdminSiteArgs {
 }
 
 export function createAdminSite(name: string, args: AdminSiteArgs) {
-  const { api, cdn, auth, collab } = args;
+  const { api, mediaCdn, auth, collab } = args;
   // Default ON for backward compat — only emit "false" when explicitly
   // disabled so existing stages without the flag set don't change behaviour.
   const collabEnabledStr = args.collabEnabled === false ? "false" : "true";
@@ -53,7 +55,18 @@ export function createAdminSite(name: string, args: AdminSiteArgs) {
     : undefined;
 
   if (args.dev) {
-    // Dev mode: standard StaticSite with Vite build
+    // Dev mode: standard StaticSite with Vite build.
+    //
+    // VITE_ADMIN_URL is set from the configured custom domain when present
+    // (we know it before the StaticSite is constructed). Without a custom
+    // domain the admin URL is only known *after* the StaticSite resolves —
+    // which would be circular at the `environment` map. In that case we
+    // leave VITE_ADMIN_URL empty; the discovery doc emits adminUrl: "" and
+    // the CLI tolerates the empty value. See:
+    //   steering/CLI_BOOSTRAP_DESIGN.md §1.2 (env-injection circularity)
+    const viteAdminUrl = args.domain
+      ? `https://${args.domain.name}`
+      : "";
     const site = new sst.aws.StaticSite(`${name}Admin`, {
       path: args.dev.adminPath,
       dev: {
@@ -65,12 +78,13 @@ export function createAdminSite(name: string, args: AdminSiteArgs) {
       },
       environment: {
         VITE_API_URL: api.api.url,
-        VITE_CDN_URL: cdn.url,
+        VITE_MEDIA_URL: mediaCdn.url,
         VITE_USER_POOL_ID: auth.userPool.id,
         VITE_USER_POOL_CLIENT_ID: auth.userPoolClient.id,
         VITE_AWS_REGION: aws.getRegionOutput().name,
         VITE_COLLAB_WS_URL: collab.wsUrl,
         VITE_COLLAB_ENABLED: collabEnabledStr,
+        VITE_ADMIN_URL: viteAdminUrl,
       },
       domain: domainConfig,
     });
@@ -88,27 +102,45 @@ export function createAdminSite(name: string, args: AdminSiteArgs) {
   fs.mkdirSync(workDir, { recursive: true });
   fs.cpSync(adminSrc, workDir, { recursive: true });
 
+  // Compute the admin URL for placeholder substitution. When a custom domain
+  // is configured, use it directly; otherwise fall back to the CloudFront-
+  // distribution URL the StaticSite resolves to. Using `$interpolate` keeps
+  // the value as an SST Output until deploy time, where it's safely inlined
+  // into the node script via the existing $-interpolated template.
+  const adminUrlForSubstitution = args.domain
+    ? `https://${args.domain.name}`
+    : "";
   const site = new sst.aws.StaticSite(`${name}Admin`, {
     path: workDir,
     build: {
-      // Replace placeholder env vars in the pre-built JS/HTML files
+      // Replace placeholder env vars in the pre-built JS/HTML/discovery files.
+      //
+      // The walk filter intentionally only matches the exact path
+      // `.well-known/headroom.json` (not any *.json) so we don't touch
+      // manifest.webmanifest, asset manifests, or other runtime JSON files.
       command: $interpolate`node -e "
         const fs = require('fs');
         const path = require('path');
         const replacements = {
           '__HEADROOM_API_URL__': '${api.api.url}',
-          '__HEADROOM_CDN_URL__': '${cdn.url}',
+          '__HEADROOM_MEDIA_URL__': '${mediaCdn.url}',
           '__HEADROOM_USER_POOL_ID__': '${auth.userPool.id}',
           '__HEADROOM_USER_POOL_CLIENT_ID__': '${auth.userPoolClient.id}',
           '__HEADROOM_AWS_REGION__': '${aws.getRegionOutput().name}',
           '__HEADROOM_COLLAB_WS_URL__': '${collab.wsUrl}',
           '__HEADROOM_COLLAB_ENABLED__': '${collabEnabledStr}',
+          '__HEADROOM_ADMIN_URL__': '${adminUrlForSubstitution}',
         };
+        const discoveryFile = path.join('.well-known', 'headroom.json');
         function walk(d) {
           for (const f of fs.readdirSync(d)) {
             const full = path.join(d, f);
             if (fs.statSync(full).isDirectory()) walk(full);
-            else if (f.endsWith('.js') || f.endsWith('.html')) {
+            else {
+              const isSubstitutable = f.endsWith('.js')
+                || f.endsWith('.html')
+                || full.endsWith(discoveryFile);
+              if (!isSubstitutable) continue;
               let content = fs.readFileSync(full, 'utf8');
               for (const [k, v] of Object.entries(replacements)) {
                 content = content.replaceAll(k, v);
@@ -118,6 +150,19 @@ export function createAdminSite(name: string, args: AdminSiteArgs) {
           }
         }
         walk('.');
+        // Regression guard: the discovery doc must have all placeholders
+        // substituted by now. A surviving __HEADROOM_*__ would indicate a
+        // mismatch between the Vite-emitted file and the replacements map.
+        try {
+          const body = fs.readFileSync(discoveryFile, 'utf8');
+          if (/__HEADROOM_[A-Z_]+__/.test(body)) {
+            console.error('headroom: unsubstituted placeholders survive in ' + discoveryFile);
+            console.error(body);
+            process.exit(1);
+          }
+        } catch (e) {
+          if (e && e.code !== 'ENOENT') throw e;
+        }
       "`,
       output: ".",
     },