headroom-cms 0.1.11 → 0.2.1

package/dist/index.js

@@ -9,6 +9,7 @@ import path from "path";
 import { createStorage } from "./storage.js";
 import { createAuth } from "./auth.js";
 import { createWebhooks } from "./webhooks.js";
+import { createBackup } from "./backup.js";
 import { createImage } from "./image.js";
 import { createApi } from "./api.js";
 import { createApiCdn } from "./cdn-api.js";
@@ -16,6 +17,7 @@ import { createMediaCdn } from "./cdn-media.js";
 import { createScheduler } from "./scheduler.js";
 import { createCollabTable, createCollabHandler } from "./collaboration.js";
 import { createAdminSite } from "./admin-site.js";
+import { createCron } from "./cron.js";
 /**
  * Resolve the headroom-cms package root directory.
  *
@@ -63,7 +65,7 @@ export class HeadroomCMS {
                 ? { handler: args.dev.customMessageHandler }
                 : undefined,
         });
-        // 3. Webhooks (DynamoDB tables, SQS queues, worker Lambda)
+        // 3. Webhooks (DynamoDB tables, DLQ, worker Lambda)
         const webhooks = createWebhooks(name, {
             sites: storage.sites,
             pkgRoot,
@@ -71,6 +73,17 @@ export class HeadroomCMS {
                 ? { handler: args.dev.webhookWorkerHandler }
                 : undefined,
         });
+        // 3b. Backup worker Lambda (export + restore). Needs access to every
+        // site-scoped table plus the content + backup buckets. Created after
+        // webhooks so it can link the webhooks table for backup payloads.
+        const backup = createBackup(name, {
+            storage,
+            webhooks,
+            pkgRoot,
+            dev: args.dev
+                ? { handler: args.dev.backupWorkerHandler }
+                : undefined,
+        });
         // 4. Image Lambda (Sharp transform with HMAC-signed URLs)
         const image = createImage(name, {
             contentBucket: storage.contentBucket,
@@ -87,6 +100,7 @@ export class HeadroomCMS {
             storage,
             auth,
             webhooks,
+            backup,
             image,
             collab: collabTable,
             senderEmail: args.senderEmail,
@@ -119,6 +133,18 @@ export class HeadroomCMS {
                 ? { handler: args.dev.schedulerHandler }
                 : undefined,
         });
+        // 7b. Cron — daily trash sweeper Lambda (with an in-sweeper per-run purge
+        // circuit breaker; no CloudWatch metric/alarm). See `steering/TRASH_CAN.md`
+        // Phase 2b.
+        const cron = createCron(name, {
+            storage,
+            webhooks,
+            pkgRoot,
+            stage: $app.stage,
+            dev: args.dev?.trashSweeperHandler
+                ? { handler: args.dev.trashSweeperHandler }
+                : undefined,
+        });
         // 8a. API CDN (CloudFront distribution + edge auth, /v1/* and /health)
         const apiCdn = createApiCdn(name, {
             api,
@@ -164,6 +190,29 @@ export class HeadroomCMS {
             userPoolId: auth.userPool.id,
             userPoolClientId: auth.userPoolClient.id,
             collabWs: collab.wsUrl,
+            // DynamoDB table names (with Pulumi-generated random suffixes baked
+            // in). Exposed so consumers — notably the Phase 6 E2E test harness —
+            // can discover real table names rather than guess them from the
+            // `<app>-<stage>-<Name>` template (which omits the random suffix).
+            // Per CLAUDE.md, `.sst/outputs.json` IS the supported interface for
+            // post-deploy discovery.
+            sitesTable: storage.sites.name,
+            contentTable: storage.content.name,
+            draftContentTable: storage.draftContent.name,
+            blocksTable: storage.blocks.name,
+            mediaTable: storage.media.name,
+            collectionsTable: storage.collections.name,
+            blockTypesTable: storage.blockTypes.name,
+            adminAuditTable: storage.adminAudit.name,
+            relationshipsTable: storage.relationships.name,
+            siteUsersTable: storage.siteUsers.name,
+            webhooksTable: webhooks.webhooks.name,
+            contentBucket: storage.contentBucket.name,
+            backupBucket: storage.backupBucket.name,
+            // Trash-sweeper Lambda function name (Phase 2b). Surfaced so ops/test
+            // scripts can target the sweeper by deterministic output instead of
+            // `aws lambda list-functions | grep`.
+            trashSweeperFunctionName: cron.trashSweeperCron.nodes.function.name,
         };
     }
 }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;;;;;;GAQG;AACH,SAAS,cAAc;IACrB,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACxB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;QACjE,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CACb,uDAAuD;QACvD,yCAAyC,CAC1C,CAAC;AACJ,CAAC;AA2GD,MAAM,OAAO,WAAW;IACN,MAAM,CAAuB;IAC7B,SAAS,CAAuB;IAChC,WAAW,CAAuB;IAClC,QAAQ,CAAuB;IAC/B,UAAU,CAAuB;IACjC,gBAAgB,CAAuB;IACvC,WAAW,CAAuB;IAElC,OAAO,CAAuC;IAE9D,YAAY,IAAY,EAAE,IAAqB;QAC7C,2DAA2D;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QAEjD,+CAA+C;QAC/C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAEpC,gDAAgD;QAChD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE;YAC5B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE;gBAC5C,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE;YACpC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE;gBAC5C,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,0DAA0D;QAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE;YAC9B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE;gBAC1C,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,mEAAmE;QACnE,qCAAqC;QACrC,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAE5C,0DAA0D;QAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE;YAC1B,OAAO;YACP,IAAI;YACJ,QAAQ;YACR,KAAK;YACL,MAAM,EAAE,WAAW;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE;gBAClC,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,sBAAsB;QACtB,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,EAAE;YAC9C,OAAO;YACP,IAAI;YACJ,GAAG;YACH,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa;gBAC1B,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE;gBACrC,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,aAAa,EAAE,CAAC;QAEpD,2DAA2D;QAC3D,MAAM,kBAAkB,GAAG,eAAe,CAAC,IAAI,EAAE;YAC/C,OAAO;YACP,GAAG;YACH,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,gBAAgB;gBAC7B,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE;gBACxC,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,uEAAuE;QACvE,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE;YAChC,GAAG;YACH,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,oEAAoE;QACpE,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE;YACpC,KAAK;YACL,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,WAAW;SACzB,CAAC,CAAC;QAEH,4BAA4B;QAC5B,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE;YAClC,GAAG;YACH,MAAM;YACN,QAAQ;YACR,IAAI;YACJ,MAAM;YACN,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE;gBACnC,CAAC,CAAC,SAAS;YACb,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;QAEH,iBAAiB;QACjB,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;QAEhC,IAAI,CAAC,OAAO,GAAG;YACb,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG;YAChB,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,QAAQ,EAAE,QAAQ,CAAC,GAAG;YACtB,KAAK,EAAE,KAAK,CAAC,GAAG;YAChB,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAC5B,gBAAgB,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE;YACxC,QAAQ,EAAE,MAAM,CAAC,KAAK;SACvB,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC;;;;;;;;GAQG;AACH,SAAS,cAAc;IACrB,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACxB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;QACjE,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CACb,uDAAuD;QACvD,yCAAyC,CAC1C,CAAC;AACJ,CAAC;AAiHD,MAAM,OAAO,WAAW;IACN,MAAM,CAAuB;IAC7B,SAAS,CAAuB;IAChC,WAAW,CAAuB;IAClC,QAAQ,CAAuB;IAC/B,UAAU,CAAuB;IACjC,gBAAgB,CAAuB;IACvC,WAAW,CAAuB;IAElC,OAAO,CAAuC;IAE9D,YAAY,IAAY,EAAE,IAAqB;QAC7C,2DAA2D;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QAEjD,+CAA+C;QAC/C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAEpC,gDAAgD;QAChD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE;YAC5B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE;gBAC5C,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,oDAAoD;QACpD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE;YACpC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE;gBAC5C,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,qEAAqE;QACrE,qEAAqE;QACrE,kEAAkE;QAClE,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE;YAChC,OAAO;YACP,QAAQ;YACR,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE;gBAC3C,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,0DAA0D;QAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE;YAC9B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE;gBAC1C,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,mEAAmE;QACnE,qCAAqC;QACrC,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAE5C,0DAA0D;QAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE;YAC1B,OAAO;YACP,IAAI;YACJ,QAAQ;YACR,MAAM;YACN,KAAK;YACL,MAAM,EAAE,WAAW;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE;gBAClC,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,sBAAsB;QACtB,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,EAAE;YAC9C,OAAO;YACP,IAAI;YACJ,GAAG;YACH,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa;gBAC1B,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE;gBACrC,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,aAAa,EAAE,CAAC;QAEpD,2DAA2D;QAC3D,MAAM,kBAAkB,GAAG,eAAe,CAAC,IAAI,EAAE;YAC/C,OAAO;YACP,GAAG;YACH,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,gBAAgB;gBAC7B,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE;gBACxC,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,0EAA0E;QAC1E,4EAA4E;QAC5E,YAAY;QACZ,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE;YAC5B,OAAO;YACP,QAAQ;YACR,OAAO;YACP,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,mBAAmB;gBAChC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE;gBAC3C,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,uEAAuE;QACvE,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE;YAChC,GAAG;YACH,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,oEAAoE;QACpE,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE;YACpC,KAAK;YACL,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,WAAW;SACzB,CAAC,CAAC;QAEH,4BAA4B;QAC5B,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE;YAClC,GAAG;YACH,MAAM;YACN,QAAQ;YACR,IAAI;YACJ,MAAM;YACN,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE;gBACnC,CAAC,CAAC,SAAS;YACb,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;QAEH,iBAAiB;QACjB,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;QAEhC,IAAI,CAAC,OAAO,GAAG;YACb,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG;YAChB,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,QAAQ,EAAE,QAAQ,CAAC,GAAG;YACtB,KAAK,EAAE,KAAK,CAAC,GAAG;YAChB,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAC5B,gBAAgB,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE;YACxC,QAAQ,EAAE,MAAM,CAAC,KAAK;YACtB,oEAAoE;YACpE,qEAAqE;YACrE,gEAAgE;YAChE,mEAAmE;YACnE,oEAAoE;YACpE,yBAAyB;YACzB,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC9B,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YAClC,iBAAiB,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI;YAC5C,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;YAChC,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC9B,gBAAgB,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI;YAC1C,eAAe,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI;YACxC,eAAe,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI;YACxC,kBAAkB,EAAE,OAAO,CAAC,aAAa,CAAC,IAAI;YAC9C,cAAc,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI;YACtC,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;YACrC,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,IAAI;YACzC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI;YACvC,sEAAsE;YACtE,oEAAoE;YACpE,sCAAsC;YACtC,wBAAwB,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;SACpE,CAAC;IACJ,CAAC;CACF"}

package/dist/storage.d.ts

@@ -16,6 +16,7 @@ export declare function createStorage(name: string): {
     relationships: sst.aws.Dynamo;
     siteUsers: sst.aws.Dynamo;
     contentBucket: sst.aws.Bucket;
+    backupBucket: sst.aws.Bucket;
     collabStateBucket: sst.aws.Bucket;
     kvs: aws.cloudfront.KeyValueStore;
     internalSecret: sst.Secret;

package/dist/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM;;;;;;;;;;;;;;;EAoLzC;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM;;;;;;;;;;;;;;;;EA0MzC;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC"}

package/dist/storage.js

@@ -36,14 +36,22 @@ export function createStorage(name) {
         fields: {
             pk: "string",
             sk: "string",
+            siteHost: "string",
         },
         primaryIndex: { hashKey: "pk", rangeKey: "sk" },
+        globalIndexes: {
+            bySite: { hashKey: "siteHost", rangeKey: "sk" },
+        },
     });
     const blocks = new sst.aws.Dynamo(`${name}Blocks`, {
         fields: {
             pk: "string",
+            siteHost: "string",
         },
         primaryIndex: { hashKey: "pk" },
+        globalIndexes: {
+            bySite: { hashKey: "siteHost", rangeKey: "pk" },
+        },
     });
     const media = new sst.aws.Dynamo(`${name}Media`, {
         fields: {
@@ -85,10 +93,12 @@ export function createStorage(name) {
             sk: "string",
             targetPk: "string",
             targetSk: "string",
+            siteHost: "string",
         },
         primaryIndex: { hashKey: "pk", rangeKey: "sk" },
         globalIndexes: {
             byTarget: { hashKey: "targetPk", rangeKey: "targetSk" },
+            bySite: { hashKey: "siteHost", rangeKey: "sk" },
         },
     });
     const siteUsers = new sst.aws.Dynamo(`${name}SiteUsers`, {
@@ -96,13 +106,23 @@ export function createStorage(name) {
             pk: "string",
             sk: "string",
             userId: "string",
+            siteHost: "string",
         },
         primaryIndex: { hashKey: "pk", rangeKey: "sk" },
         globalIndexes: {
             byUserId: { hashKey: "userId", rangeKey: "sk" },
+            bySite: { hashKey: "siteHost", rangeKey: "sk" },
         },
         ttl: "expiresAt",
     });
+    // Backup bucket: archives of full site exports written by the backup worker.
+    // Layout: backups/{host}/{timestamp}.tar.gz + backups/{host}/latest.json.
+    // Versioning disabled — archives are immutable by convention (a new timestamp
+    // is a new object). No CloudFront origin — admin endpoints serve presigned
+    // URLs directly off S3.
+    const backupBucket = new sst.aws.Bucket(`${name}BackupBucket`, {
+        versioning: false,
+    });
     const contentBucket = new sst.aws.Bucket(`${name}ContentBucket`, {
         versioning: true,
         access: "cloudfront",
@@ -166,6 +186,7 @@ export function createStorage(name) {
         relationships,
         siteUsers,
         contentBucket,
+        backupBucket,
         collabStateBucket,
         kvs,
         internalSecret,

package/dist/storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"storage.js","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE;QAC/C,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE;QACnD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,QAAQ;YACf,aAAa,EAAE,QAAQ;YACvB,eAAe,EAAE,QAAQ;YACzB,OAAO,EAAE,QAAQ;YACjB,cAAc,EAAE,QAAQ;YACxB,cAAc,EAAE,QAAQ;SACzB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,eAAe,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE;YACxD,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE;YAC3D,iBAAiB,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE;YACtE,eAAe,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,EAAE;SAC3E;KACF,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,cAAc,EAAE;QAC7D,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,QAAQ,EAAE;QACjD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;KAChC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE;QAC/C,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;YACZ,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,QAAQ;SACtB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE;YACjD,QAAQ,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE;SAC7D;KACF,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,aAAa,EAAE;QAC3D,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,YAAY,EAAE;QACzD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,YAAY,EAAE;QACzD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE;QAC/D,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;YACZ,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,QAAQ;SACnB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,QAAQ,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE;SACxD;KACF,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE;QACvD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;YACZ,MAAM,EAAE,QAAQ;SACjB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;SAChD;QACD,GAAG,EAAE,WAAW;KACjB,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE;QAC/D,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,YAAY;QACpB,SAAS,EAAE;YACT,MAAM,EAAE,CAAC,IAAS,EAAE,EAAE;gBACpB,IAAI,CAAC,cAAc,GAAG;oBACpB;wBACE,EAAE,EAAE,yBAAyB;wBAC7B,OAAO,EAAE,IAAI;wBACb,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;wBACvB,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;qBAC5B;iBACF,CAAC;YACJ,CAAC;SACF;KACF,CAAC,CAAC;IAEH,4EAA4E;IAC5E,uEAAuE;IACvE,uEAAuE;IACvE,yEAAyE;IACzE,qEAAqE;IACrE,qDAAqD;IACrD,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,yDAAyD;IACzD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,mBAAmB,EAAE;QACvE,SAAS,EAAE;YACT,MAAM,EAAE,CAAC,IAAS,EAAE,EAAE;gBACpB,IAAI,CAAC,cAAc,GAAG;oBACpB;wBACE,EAAE,EAAE,qBAAqB;wBACzB,OAAO,EAAE,IAAI;wBACb,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;wBACvB,6DAA6D;wBAC7D,gEAAgE;wBAChE,uCAAuC;qBACxC;iBACF,CAAC;YACJ,CAAC;SACF;KACF,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,IAAI,KAAK,EAAE;QACzD,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,MAAM;QAClD,OAAO,EAAE,oDAAoD;KAC9D,CAAC,CAAC;IAEH,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,kFAAkF;IAClF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC;IAE/D,OAAO;QACL,KAAK;QACL,OAAO;QACP,YAAY;QACZ,MAAM;QACN,KAAK;QACL,WAAW;QACX,UAAU;QACV,UAAU;QACV,aAAa;QACb,SAAS;QACT,aAAa;QACb,iBAAiB;QACjB,GAAG;QACH,cAAc;KACf,CAAC;AACJ,CAAC"}
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE;QAC/C,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE;QACnD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,QAAQ;YACf,aAAa,EAAE,QAAQ;YACvB,eAAe,EAAE,QAAQ;YACzB,OAAO,EAAE,QAAQ;YACjB,cAAc,EAAE,QAAQ;YACxB,cAAc,EAAE,QAAQ;SACzB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,eAAe,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE;YACxD,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE;YAC3D,iBAAiB,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE;YACtE,eAAe,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,EAAE;SAC3E;KACF,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,cAAc,EAAE;QAC7D,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;YACZ,QAAQ,EAAE,QAAQ;SACnB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,MAAM,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;SAChD;KACF,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,QAAQ,EAAE;QACjD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,QAAQ,EAAE,QAAQ;SACnB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QAC/B,aAAa,EAAE;YACb,MAAM,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;SAChD;KACF,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE;QAC/C,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;YACZ,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,QAAQ;SACtB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE;YACjD,QAAQ,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE;SAC7D;KACF,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,aAAa,EAAE;QAC3D,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,YAAY,EAAE;QACzD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,YAAY,EAAE;QACzD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE;QAC/D,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;YACZ,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,QAAQ;SACnB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,QAAQ,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE;YACvD,MAAM,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;SAChD;KACF,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE;QACvD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;YACZ,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,QAAQ;SACnB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC/C,MAAM,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;SAChD;QACD,GAAG,EAAE,WAAW;KACjB,CAAC,CAAC;IAEH,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,wBAAwB;IACxB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,cAAc,EAAE;QAC7D,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE;QAC/D,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,YAAY;QACpB,SAAS,EAAE;YACT,MAAM,EAAE,CAAC,IAAS,EAAE,EAAE;gBACpB,IAAI,CAAC,cAAc,GAAG;oBACpB;wBACE,EAAE,EAAE,yBAAyB;wBAC7B,OAAO,EAAE,IAAI;wBACb,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;wBACvB,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;qBAC5B;iBACF,CAAC;YACJ,CAAC;SACF;KACF,CAAC,CAAC;IAEH,4EAA4E;IAC5E,uEAAuE;IACvE,uEAAuE;IACvE,yEAAyE;IACzE,qEAAqE;IACrE,qDAAqD;IACrD,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,yDAAyD;IACzD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,mBAAmB,EAAE;QACvE,SAAS,EAAE;YACT,MAAM,EAAE,CAAC,IAAS,EAAE,EAAE;gBACpB,IAAI,CAAC,cAAc,GAAG;oBACpB;wBACE,EAAE,EAAE,qBAAqB;wBACzB,OAAO,EAAE,IAAI;wBACb,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;wBACvB,6DAA6D;wBAC7D,gEAAgE;wBAChE,uCAAuC;qBACxC;iBACF,CAAC;YACJ,CAAC;SACF;KACF,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,IAAI,KAAK,EAAE;QACzD,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,MAAM;QAClD,OAAO,EAAE,oDAAoD;KAC9D,CAAC,CAAC;IAEH,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,kFAAkF;IAClF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC;IAE/D,OAAO;QACL,KAAK;QACL,OAAO;QACP,YAAY;QACZ,MAAM;QACN,KAAK;QACL,WAAW;QACX,UAAU;QACV,UAAU;QACV,aAAa;QACb,SAAS;QACT,aAAa;QACb,YAAY;QACZ,iBAAiB;QACjB,GAAG;QACH,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/webhooks.d.ts

@@ -1,8 +1,9 @@
 /**
  * Webhook Infrastructure
  *
- * 2 DynamoDB tables + 2 SQS queues + webhook worker Lambda.
- * Supports dev mode (Go source) and package mode (pre-compiled binary).
+ * 2 DynamoDB tables + webhook worker Lambda (async-invoked by the API) + DLQ
+ * (Lambda async on-failure destination). The API directly invokes the worker
+ * via lambda:InvokeFunction; there is no SQS queue between them.
  */
 import type { StorageResources } from "./storage.js";
 export interface WebhookArgs {
@@ -16,7 +17,7 @@ export interface WebhookArgs {
 export declare function createWebhooks(name: string, args: WebhookArgs): {
     webhooks: sst.aws.Dynamo;
     webhookDeliveries: sst.aws.Dynamo;
-    webhookDeliveryQueue: sst.aws.Queue;
+    webhookWorker: sst.aws.Function;
     webhookDeliveryDLQ: sst.aws.Queue;
 };
 export type WebhookResources = ReturnType<typeof createWebhooks>;

package/dist/webhooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE;QACJ,qDAAqD;QACrD,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW;;;;;EA4F7D;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC"}
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE;QACJ,qDAAqD;QACrD,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW;;;;;EA0E7D;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/webhooks.js

@@ -1,8 +1,9 @@
 /**
  * Webhook Infrastructure
  *
- * 2 DynamoDB tables + 2 SQS queues + webhook worker Lambda.
- * Supports dev mode (Go source) and package mode (pre-compiled binary).
+ * 2 DynamoDB tables + webhook worker Lambda (async-invoked by the API) + DLQ
+ * (Lambda async on-failure destination). The API directly invokes the worker
+ * via lambda:InvokeFunction; there is no SQS queue between them.
  */
 import path from "path";
 export function createWebhooks(name, args) {
@@ -21,6 +22,9 @@ export function createWebhooks(name, args) {
         primaryIndex: { hashKey: "pk", rangeKey: "sk" },
         ttl: "ttl",
     });
+    // DLQ retained as Lambda async OnFailure destination. Lambda writes a
+    // failure envelope (not the original payload verbatim) when retries are
+    // exhausted. No consumer polls this queue — it's a sink only.
     const webhookDeliveryDLQ = new sst.aws.Queue(`${name}WebhookDeliveryDLQ`, {
         transform: {
             queue: (queueArgs) => {
@@ -28,22 +32,6 @@ export function createWebhooks(name, args) {
             },
         },
     });
-    const webhookDeliveryQueue = new sst.aws.Queue(`${name}WebhookDeliveryQueue`, {
-        dlq: {
-            queue: webhookDeliveryDLQ.arn,
-            retry: 5,
-        },
-        transform: {
-            queue: (queueArgs) => {
-                queueArgs.visibilityTimeoutSeconds = 60;
-                queueArgs.messageRetentionSeconds = 4 * 24 * 60 * 60; // 4 days
-            },
-        },
-    });
-    // Webhook worker Lambda: processes SQS messages and delivers webhooks.
-    // Note: We use a manual Function + EventSourceMapping instead of
-    // queue.subscribe() to avoid a duplicate LambdaEncryptionKey issue
-    // caused by SST's dynamic import creating a separate Function class instance.
     const workerConfig = args.dev
         ? {
             handler: args.dev.handler,
@@ -61,30 +49,29 @@ export function createWebhooks(name, args) {
         timeout: "30 seconds",
         environment: {
             WEBHOOK_DELIVERIES_TABLE: webhookDeliveries.name,
-            WEBHOOKS_TABLE: webhooks.name,
-            SITES_TABLE: args.sites.name,
         },
-        link: [webhookDeliveries, webhooks, args.sites],
-        permissions: [
-            {
-                actions: [
-                    "sqs:ReceiveMessage",
-                    "sqs:DeleteMessage",
-                    "sqs:GetQueueAttributes",
-                ],
-                resources: [webhookDeliveryQueue.arn],
-            },
-        ],
+        // webhookDeliveryDLQ is linked so SST auto-grants sqs:SendMessage on the
+        // worker's execution role. Lambda async OnFailure delivery uses the
+        // function's own role to write the failure envelope to the DLQ — without
+        // this grant, AWS accepts the FunctionEventInvokeConfig at deploy time but
+        // silently drops failure envelopes at runtime.
+        link: [webhookDeliveries, webhookDeliveryDLQ],
     });
-    new aws.lambda.EventSourceMapping(`${name}WebhookWorkerEventSource`, {
-        eventSourceArn: webhookDeliveryQueue.arn,
+    // Lambda async retry + DLQ on terminal failure. MaximumRetryAttempts is
+    // 0–2 (industry standard for webhook delivery — Stripe/GitHub publish
+    // similar caps). Total attempts = initial + 2 retries = 3.
+    new aws.lambda.FunctionEventInvokeConfig(`${name}WebhookWorkerAsyncConfig`, {
         functionName: webhookWorker.name,
-        batchSize: 1,
+        maximumRetryAttempts: 2,
+        maximumEventAgeInSeconds: 6 * 60 * 60, // 6 hours
+        destinationConfig: {
+            onFailure: { destination: webhookDeliveryDLQ.arn },
+        },
     });
     return {
         webhooks,
         webhookDeliveries,
-        webhookDeliveryQueue,
+        webhookWorker,
         webhookDeliveryDLQ,
     };
 }

package/dist/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AAYxB,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAiB;IAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,UAAU,EAAE;QACrD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,mBAAmB,EAAE;QACvE,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,GAAG,EAAE,KAAK;KACX,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,oBAAoB,EAAE;QACxE,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,SAAc,EAAE,EAAE;gBACxB,SAAS,CAAC,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;YACnE,CAAC;SACF;KACF,CAAC,CAAC;IAEH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAC5C,GAAG,IAAI,sBAAsB,EAC7B;QACE,GAAG,EAAE;YACH,KAAK,EAAE,kBAAkB,CAAC,GAAG;YAC7B,KAAK,EAAE,CAAC;SACT;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,SAAc,EAAE,EAAE;gBACxB,SAAS,CAAC,wBAAwB,GAAG,EAAE,CAAC;gBACxC,SAAS,CAAC,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS;YACjE,CAAC;SACF;KACF,CACF,CAAC;IAEF,uEAAuE;IACvE,iEAAiE;IACjE,mEAAmE;IACnE,8EAA8E;IAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG;QAC3B,CAAC,CAAC;YACE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO;YACzB,OAAO,EAAE,IAAa;SACvB;QACH,CAAC,CAAC;YACE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB,CAAC;YACxD,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,iBAA0B;YACnC,YAAY,EAAE,OAAgB;SAC/B,CAAC;IAEN,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,eAAe,EAAE;QACjE,GAAG,YAAY;QACf,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,YAAY;QACrB,WAAW,EAAE;YACX,wBAAwB,EAAE,iBAAiB,CAAC,IAAI;YAChD,cAAc,EAAE,QAAQ,CAAC,IAAI;YAC7B,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;SAC7B;QACD,IAAI,EAAE,CAAC,iBAAiB,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC;QAC/C,WAAW,EAAE;YACX;gBACE,OAAO,EAAE;oBACP,oBAAoB;oBACpB,mBAAmB;oBACnB,wBAAwB;iBACzB;gBACD,SAAS,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC;aACtC;SACF;KACF,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,GAAG,IAAI,0BAA0B,EAAE;QACnE,cAAc,EAAE,oBAAoB,CAAC,GAAG;QACxC,YAAY,EAAE,aAAa,CAAC,IAAI;QAChC,SAAS,EAAE,CAAC;KACb,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,iBAAiB;QACjB,oBAAoB;QACpB,kBAAkB;KACnB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AAYxB,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAiB;IAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,UAAU,EAAE;QACrD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,mBAAmB,EAAE;QACvE,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,GAAG,EAAE,KAAK;KACX,CAAC,CAAC;IAEH,sEAAsE;IACtE,wEAAwE;IACxE,8DAA8D;IAC9D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,oBAAoB,EAAE;QACxE,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,SAAc,EAAE,EAAE;gBACxB,SAAS,CAAC,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;YACnE,CAAC;SACF;KACF,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG;QAC3B,CAAC,CAAC;YACE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO;YACzB,OAAO,EAAE,IAAa;SACvB;QACH,CAAC,CAAC;YACE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB,CAAC;YACxD,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,iBAA0B;YACnC,YAAY,EAAE,OAAgB;SAC/B,CAAC;IAEN,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,eAAe,EAAE;QACjE,GAAG,YAAY;QACf,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,YAAY;QACrB,WAAW,EAAE;YACX,wBAAwB,EAAE,iBAAiB,CAAC,IAAI;SACjD;QACD,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,2EAA2E;QAC3E,+CAA+C;QAC/C,IAAI,EAAE,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;KAC9C,CAAC,CAAC;IAEH,wEAAwE;IACxE,sEAAsE;IACtE,2DAA2D;IAC3D,IAAI,GAAG,CAAC,MAAM,CAAC,yBAAyB,CAAC,GAAG,IAAI,0BAA0B,EAAE;QAC1E,YAAY,EAAE,aAAa,CAAC,IAAI;QAChC,oBAAoB,EAAE,CAAC;QACvB,wBAAwB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU;QACjD,iBAAiB,EAAE;YACjB,SAAS,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC,GAAG,EAAE;SACnD;KACF,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,iBAAiB;QACjB,aAAa;QACb,kBAAkB;KACnB,CAAC;AACJ,CAAC"}

package/lambda/image-lambda/index.mjs

@@ -4,7 +4,17 @@ import { S3Client, GetObjectCommand, PutObjectCommand } from "@aws-sdk/client-s3
 import { createHmac, timingSafeEqual } from "crypto";
 var s3 = new S3Client({});
 var BUCKET = process.env.CONTENT_BUCKET;
-var SIGNING_SECRET = process.env.IMAGE_SIGNING_SECRET;
+var MASTER_SECRET = process.env.IMAGE_SIGNING_MASTER_SECRET;
+var MASTER_SECRET_OLD = process.env.IMAGE_SIGNING_MASTER_SECRET_OLD;
+var _timingSafeEqualCallCount = { count: 0 };
+function _timingSafeEqual(a, b) {
+  _timingSafeEqualCallCount.count++;
+  return timingSafeEqual(a, b);
+}
+function deriveSiteSecret(master, siteHost) {
+  if (!master) return null;
+  return createHmac("sha256", master).update(siteHost).digest("hex").substring(0, 32);
+}
 var MAX_WIDTH = 2048;
 var MAX_HEIGHT = 2048;
 var MAX_PIXELS = 4e6;
@@ -31,6 +41,11 @@ async function handler(event) {
   if (!match) {
     return { statusCode: 400, body: "Invalid image path" };
   }
+  const [, site, mediaId, ext] = match;
+  const sitePrimary = deriveSiteSecret(MASTER_SECRET, site);
+  if (!sitePrimary) {
+    return { statusCode: 503, body: "Image transforms not configured" };
+  }
   const params = new URLSearchParams(rawQuery);
   const sig = params.get("sig");
   if (!sig) {
@@ -44,11 +59,18 @@ async function handler(event) {
   if (!hasTransform) {
     return { statusCode: 400, body: "No transform requested. Use /media/ path for originals." };
   }
-  const expectedSig = computeSignature(rawPath, params);
-  if (!timingSafeEqual(Buffer.from(sig), Buffer.from(expectedSig))) {
+  const siteOld = deriveSiteSecret(MASTER_SECRET_OLD, site);
+  const sigBuf = Buffer.from(sig);
+  const expectedPrimary = computeSignature(rawPath, params, sitePrimary);
+  const primaryMatch = _timingSafeEqual(sigBuf, Buffer.from(expectedPrimary));
+  let oldMatch = false;
+  if (siteOld) {
+    const expectedOld = computeSignature(rawPath, params, siteOld);
+    oldMatch = _timingSafeEqual(sigBuf, Buffer.from(expectedOld));
+  }
+  if (!primaryMatch && !oldMatch) {
     return { statusCode: 403, body: "Invalid signature" };
   }
-  const [, site, mediaId, ext] = match;
   const s3Key = `sites/${site}/media/${mediaId}/original${ext}`;
   const w = clamp(parseInt(params.get("w")) || null, 1, MAX_WIDTH);
   const h = clamp(parseInt(params.get("h")) || null, 1, MAX_HEIGHT);
@@ -139,11 +161,11 @@ async function handler(event) {
     return { statusCode: 500, body: "Image processing failed" };
   }
 }
-function computeSignature(path, params) {
+function computeSignature(path, params, key) {
   const sorted = new URLSearchParams([...params.entries()].sort());
   const qs = sorted.toString();
   const canonical = qs ? `${path}?${qs}` : path;
-  return createHmac("sha256", SIGNING_SECRET).update(canonical).digest("hex").substring(0, 32);
+  return createHmac("sha256", key).update(canonical).digest("hex").substring(0, 32);
 }
 function clamp(val, min, max) {
   if (val == null) return null;
@@ -180,8 +202,10 @@ export {
   MAX_WIDTH,
   PATH_REGEX,
   SHARP_MIME_TYPES,
+  _timingSafeEqualCallCount,
   clamp,
   computeSignature,
+  deriveSiteSecret,
   extToFormat,
   formatToMime,
   handler

package/lambda/image-lambda/node_modules/.package-lock.json

@@ -97,9 +97,9 @@
       "license": "MIT"
     },
     "node_modules/semver": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
-      "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
+      "version": "7.8.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.1.tgz",
+      "integrity": "sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"

package/lambda/image-lambda/node_modules/semver/classes/range.js

@@ -98,6 +98,9 @@ class Range {
   }
 
   parseRange (range) {
+    // strip build metadata so it can't bleed into the version
+    range = range.replace(BUILDSTRIPRE, '')
+
     // memoize range parsing for performance.
     // this is a very hot path, and fully deterministic.
     const memoOpts =
@@ -223,6 +226,7 @@ const debug = require('../internal/debug')
 const SemVer = require('./semver')
 const {
   safeRe: re,
+  src,
   t,
   comparatorTrimReplace,
   tildeTrimReplace,
@@ -230,6 +234,9 @@ const {
 } = require('../internal/re')
 const { FLAG_INCLUDE_PRERELEASE, FLAG_LOOSE } = require('../internal/constants')
 
+// unbounded global build-metadata stripper used by parseRange
+const BUILDSTRIPRE = new RegExp(src[t.BUILD], 'g')
+
 const isNullSet = c => c.value === '<0.0.0-0'
 const isAny = c => c.value === ''
 

package/lambda/image-lambda/node_modules/semver/package.json

@@ -1,6 +1,6 @@
 {
   "name": "semver",
-  "version": "7.8.0",
+  "version": "7.8.1",
   "description": "The semantic version parser used by npm.",
   "main": "index.js",
   "scripts": {

package/lambda/image-lambda/node_modules/semver/ranges/subset.js

@@ -174,7 +174,7 @@ const simpleSubset = (sub, dom, options) => {
         if (higher === c && higher !== gt) {
           return false
         }
-      } else if (gt.operator === '>=' && !satisfies(gt.semver, String(c), options)) {
+      } else if (gt.operator === '>=' && !c.test(gt.semver)) {
         return false
       }
     }
@@ -192,7 +192,7 @@ const simpleSubset = (sub, dom, options) => {
         if (lower === c && lower !== lt) {
           return false
         }
-      } else if (lt.operator === '<=' && !satisfies(lt.semver, String(c), options)) {
+      } else if (lt.operator === '<=' && !c.test(lt.semver)) {
         return false
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "headroom-cms",
-  "version": "0.1.11",
+  "version": "0.2.1",
   "description": "Headroom CMS — Serverless headless CMS for AWS, deployed with SST",
   "type": "module",
   "main": "dist/index.js",

package/src/admin-site.ts

@@ -55,7 +55,18 @@ export function createAdminSite(name: string, args: AdminSiteArgs) {
     : undefined;
 
   if (args.dev) {
-    // Dev mode: standard StaticSite with Vite build
+    // Dev mode: standard StaticSite with Vite build.
+    //
+    // VITE_ADMIN_URL is set from the configured custom domain when present
+    // (we know it before the StaticSite is constructed). Without a custom
+    // domain the admin URL is only known *after* the StaticSite resolves —
+    // which would be circular at the `environment` map. In that case we
+    // leave VITE_ADMIN_URL empty; the discovery doc emits adminUrl: "" and
+    // the CLI tolerates the empty value. See:
+    //   steering/CLI_BOOSTRAP_DESIGN.md §1.2 (env-injection circularity)
+    const viteAdminUrl = args.domain
+      ? `https://${args.domain.name}`
+      : "";
     const site = new sst.aws.StaticSite(`${name}Admin`, {
       path: args.dev.adminPath,
       dev: {
@@ -73,6 +84,7 @@ export function createAdminSite(name: string, args: AdminSiteArgs) {
         VITE_AWS_REGION: aws.getRegionOutput().name,
         VITE_COLLAB_WS_URL: collab.wsUrl,
         VITE_COLLAB_ENABLED: collabEnabledStr,
+        VITE_ADMIN_URL: viteAdminUrl,
       },
       domain: domainConfig,
     });
@@ -90,10 +102,22 @@ export function createAdminSite(name: string, args: AdminSiteArgs) {
   fs.mkdirSync(workDir, { recursive: true });
   fs.cpSync(adminSrc, workDir, { recursive: true });
 
+  // Compute the admin URL for placeholder substitution. When a custom domain
+  // is configured, use it directly; otherwise fall back to the CloudFront-
+  // distribution URL the StaticSite resolves to. Using `$interpolate` keeps
+  // the value as an SST Output until deploy time, where it's safely inlined
+  // into the node script via the existing $-interpolated template.
+  const adminUrlForSubstitution = args.domain
+    ? `https://${args.domain.name}`
+    : "";
   const site = new sst.aws.StaticSite(`${name}Admin`, {
     path: workDir,
     build: {
-      // Replace placeholder env vars in the pre-built JS/HTML files
+      // Replace placeholder env vars in the pre-built JS/HTML/discovery files.
+      //
+      // The walk filter intentionally only matches the exact path
+      // `.well-known/headroom.json` (not any *.json) so we don't touch
+      // manifest.webmanifest, asset manifests, or other runtime JSON files.
       command: $interpolate`node -e "
         const fs = require('fs');
         const path = require('path');
@@ -105,12 +129,18 @@ export function createAdminSite(name: string, args: AdminSiteArgs) {
           '__HEADROOM_AWS_REGION__': '${aws.getRegionOutput().name}',
           '__HEADROOM_COLLAB_WS_URL__': '${collab.wsUrl}',
           '__HEADROOM_COLLAB_ENABLED__': '${collabEnabledStr}',
+          '__HEADROOM_ADMIN_URL__': '${adminUrlForSubstitution}',
         };
+        const discoveryFile = path.join('.well-known', 'headroom.json');
         function walk(d) {
           for (const f of fs.readdirSync(d)) {
             const full = path.join(d, f);
             if (fs.statSync(full).isDirectory()) walk(full);
-            else if (f.endsWith('.js') || f.endsWith('.html')) {
+            else {
+              const isSubstitutable = f.endsWith('.js')
+                || f.endsWith('.html')
+                || full.endsWith(discoveryFile);
+              if (!isSubstitutable) continue;
               let content = fs.readFileSync(full, 'utf8');
               for (const [k, v] of Object.entries(replacements)) {
                 content = content.replaceAll(k, v);
@@ -120,6 +150,19 @@ export function createAdminSite(name: string, args: AdminSiteArgs) {
           }
         }
         walk('.');
+        // Regression guard: the discovery doc must have all placeholders
+        // substituted by now. A surviving __HEADROOM_*__ would indicate a
+        // mismatch between the Vite-emitted file and the replacements map.
+        try {
+          const body = fs.readFileSync(discoveryFile, 'utf8');
+          if (/__HEADROOM_[A-Z_]+__/.test(body)) {
+            console.error('headroom: unsubstituted placeholders survive in ' + discoveryFile);
+            console.error(body);
+            process.exit(1);
+          }
+        } catch (e) {
+          if (e && e.code !== 'ENOENT') throw e;
+        }
       "`,
       output: ".",
     },