headroom-cms 0.1.8 → 0.1.10

package/dist/collaboration.js

@@ -0,0 +1,141 @@
+/**
+ * Collaboration Infrastructure
+ *
+ * API Gateway WebSocket API + DynamoDB Collab table + Node.js Lambda handler.
+ * Deployed at all times but dormant for solo editing — no Lambda invocations
+ * and no Collab table writes happen until collaboration is opted into.
+ *
+ * Supports dev mode (Node.js source with live reload) and package mode
+ * (pre-bundled handler).
+ *
+ * Split into two helpers:
+ *   - `createCollabTable` — provisions just the DynamoDB Collab table.
+ *     Must be called BEFORE `createApi`, because the Go API links the
+ *     Collab table for ticket reads/writes.
+ *   - `createCollabHandler` — provisions the WebSocket API + Lambda and
+ *     wires `API_URL` into the Lambda environment so `snapshotToDraft`
+ *     can `fetch` back into the Go API on `$disconnect`. Must be called
+ *     AFTER `createApi`, because it needs `api.api.url`.
+ *
+ * The two halves are merged into a single `CollaborationResources` value
+ * by `index.ts` so downstream consumers (admin-site, etc.) see one shape.
+ */
+import path from "path";
+export function createCollabTable(name, _args = {}) {
+    // DynamoDB table for collaboration sessions + YJS state
+    const collabTable = new sst.aws.Dynamo(`${name}Collab`, {
+        fields: {
+            pk: "string",
+            sk: "string",
+        },
+        primaryIndex: { hashKey: "pk", rangeKey: "sk" },
+        // PascalCase to match the convention used throughout the collab TS
+        // package (RoomManager, YjsPersistence) and the Go ticket writer
+        // (repository/collab.go). DynamoDB attribute names are case-sensitive;
+        // the TTL attribute name must match what writers actually emit.
+        ttl: "ExpiresAt",
+    });
+    return { collabTable };
+}
+export function createCollabHandler(name, args) {
+    const { storage, auth, api, collabTable } = args;
+    // WebSocket API via raw Pulumi (SST v4 doesn't have a WebSocket component)
+    const wsApi = new aws.apigatewayv2.Api(`${name}WsApi`, {
+        protocolType: "WEBSOCKET",
+        routeSelectionExpression: "$request.body.action",
+    });
+    const handlerConfig = args.dev
+        ? {
+            handler: args.dev.handler,
+            runtime: "nodejs22.x",
+        }
+        : {
+            bundle: path.join(args.pkgRoot, "packages/collab"),
+            handler: "index.handler",
+            runtime: "nodejs22.x",
+        };
+    const wsHandler = new sst.aws.Function(`${name}CollabHandler`, {
+        ...handlerConfig,
+        // jsdom is pulled in transitively via @blocknote/server-util (used in
+        // src/yjs/converter.ts to convert YJS state to BlockNote blocks during
+        // the disconnect snapshot). esbuild does not auto-bundle jsdom's
+        // xhr-sync-worker.js because it's spawned dynamically at runtime
+        // (`new Worker(__dirname + "/xhr-sync-worker.js")`), so the worker file
+        // is missing on disk in the deployed Lambda and cold-starts fail with
+        // "Cannot find module './xhr-sync-worker.js'". Adding jsdom to
+        // `nodejs.install` excludes it from the esbuild bundle and instead
+        // installs it (with its full directory tree, including the worker file)
+        // into the function's node_modules/ at deploy time.
+        nodejs: {
+            install: ["jsdom"],
+        },
+        timeout: "30 seconds",
+        memory: "512 MB",
+        environment: {
+            COLLAB_TABLE: collabTable.name,
+            DRAFT_CONTENT_TABLE: storage.draftContent.name,
+            BLOCKS_TABLE: storage.blocks.name,
+            SITES_TABLE: storage.sites.name,
+            USER_POOL_ID: auth.userPool.id,
+            USER_POOL_CLIENT_ID: auth.userPoolClient.id,
+            WS_API_ENDPOINT: $interpolate `https://${wsApi.id}.execute-api.${aws.getRegionOutput().name}.amazonaws.com/${$app.stage}`,
+            // Required by `snapshotToDraft` (packages/collab/src/draft/snapshot.ts)
+            // which fetches `${apiUrl}/v1/admin/sites/{host}/content/{id}/draft`
+            // on `$disconnect` to persist the YJS room state back to DraftContent.
+            // Without this, the URL becomes `undefined/v1/admin/...` and the fetch
+            // throws "Failed to parse URL", crashing the disconnect Lambda.
+            API_URL: api.api.url,
+            // Shared with the Go API. Sent as `X-Headroom-Internal` on the
+            // disconnect snapshot PUT so the Go JWT middleware accepts the
+            // internal service-to-service call. See packages/api/internal/middleware/jwt.go.
+            INTERNAL_SECRET: storage.internalSecret.value,
+            // Phase 7.1 "Large documents": S3 bucket for YJS state that exceeds
+            // DynamoDB's 400KB per-item cap. See `YjsPersistence.saveState`.
+            COLLAB_STATE_BUCKET: storage.collabStateBucket.name,
+        },
+        link: [
+            collabTable,
+            storage.draftContent,
+            storage.blocks,
+            storage.sites,
+            storage.internalSecret,
+            // S3 link grants the Lambda IAM permissions for s3:GetObject /
+            // s3:PutObject on the bucket via SST's resource binding.
+            storage.collabStateBucket,
+        ],
+        permissions: [
+            {
+                actions: ["execute-api:ManageConnections"],
+                resources: [$interpolate `arn:aws:execute-api:*:*:${wsApi.id}/*`],
+            },
+        ],
+    });
+    // Wire up $connect, $default, $disconnect routes
+    const integration = new aws.apigatewayv2.Integration(`${name}WsIntegration`, {
+        apiId: wsApi.id,
+        integrationType: "AWS_PROXY",
+        integrationUri: wsHandler.nodes.function.invokeArn,
+    });
+    for (const routeKey of ["$connect", "$default", "$disconnect"]) {
+        new aws.apigatewayv2.Route(`${name}WsRoute${routeKey}`, {
+            apiId: wsApi.id,
+            routeKey,
+            target: $interpolate `integrations/${integration.id}`,
+        });
+    }
+    new aws.apigatewayv2.Stage(`${name}WsStage`, {
+        apiId: wsApi.id,
+        name: $app.stage,
+        autoDeploy: true,
+    });
+    // Grant API Gateway permission to invoke Lambda
+    new aws.lambda.Permission(`${name}WsPermission`, {
+        action: "lambda:InvokeFunction",
+        function: wsHandler.nodes.function.name,
+        principal: "apigateway.amazonaws.com",
+        sourceArn: $interpolate `${wsApi.executionArn}/*/*`,
+    });
+    const wsUrl = $interpolate `wss://${wsApi.id}.execute-api.${aws.getRegionOutput().name}.amazonaws.com/${$app.stage}`;
+    return { wsApi, wsHandler, wsUrl };
+}
+//# sourceMappingURL=collaboration.js.map

package/dist/collaboration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collaboration.js","sourceRoot":"","sources":["../src/collaboration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AASxB,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,QAAyB,EAAE;IACzE,wDAAwD;IACxD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,QAAQ,EAAE;QACtD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,mEAAmE;QACnE,iEAAiE;QACjE,uEAAuE;QACvE,gEAAgE;QAChE,GAAG,EAAE,WAAW;KACjB,CAAC,CAAC;IAEH,OAAO,EAAE,WAAW,EAAE,CAAC;AACzB,CAAC;AAgBD,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,IAAuB;IACvE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAEjD,2EAA2E;IAC3E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO,EAAE;QACrD,YAAY,EAAE,WAAW;QACzB,wBAAwB,EAAE,sBAAsB;KACjD,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG;QAC5B,CAAC,CAAC;YACE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO;YACzB,OAAO,EAAE,YAAqB;SAC/B;QACH,CAAC,CAAC;YACE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC;YAClD,OAAO,EAAE,eAAe;YACxB,OAAO,EAAE,YAAqB;SAC/B,CAAC;IAEN,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,eAAe,EAAE;QAC7D,GAAG,aAAa;QAChB,sEAAsE;QACtE,uEAAuE;QACvE,iEAAiE;QACjE,iEAAiE;QACjE,wEAAwE;QACxE,sEAAsE;QACtE,+DAA+D;QAC/D,mEAAmE;QACnE,wEAAwE;QACxE,oDAAoD;QACpD,MAAM,EAAE;YACN,OAAO,EAAE,CAAC,OAAO,CAAC;SACnB;QACD,OAAO,EAAE,YAAY;QACrB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE;YACX,YAAY,EAAE,WAAW,CAAC,IAAI;YAC9B,mBAAmB,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI;YAC9C,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;YACjC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC/B,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAC9B,mBAAmB,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE;YAC3C,eAAe,EAAE,YAAY,CAAA,WAAW,KAAK,CAAC,EAAE,gBAAgB,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,kBAAkB,IAAI,CAAC,KAAK,EAAE;YACxH,wEAAwE;YACxE,qEAAqE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,gEAAgE;YAChE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG;YACpB,+DAA+D;YAC/D,+DAA+D;YAC/D,iFAAiF;YACjF,eAAe,EAAE,OAAO,CAAC,cAAc,CAAC,KAAK;YAC7C,oEAAoE;YACpE,iEAAiE;YACjE,mBAAmB,EAAE,OAAO,CAAC,iBAAiB,CAAC,IAAI;SACpD;QACD,IAAI,EAAE;YACJ,WAAW;YACX,OAAO,CAAC,YAAY;YACpB,OAAO,CAAC,MAAM;YACd,OAAO,CAAC,KAAK;YACb,OAAO,CAAC,cAAc;YACtB,+DAA+D;YAC/D,yDAAyD;YACzD,OAAO,CAAC,iBAAiB;SAC1B;QACD,WAAW,EAAE;YACX;gBACE,OAAO,EAAE,CAAC,+BAA+B,CAAC;gBAC1C,SAAS,EAAE,CAAC,YAAY,CAAA,2BAA2B,KAAK,CAAC,EAAE,IAAI,CAAC;aACjE;SACF;KACF,CAAC,CAAC;IAEH,iDAAiD;IACjD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,WAAW,CAClD,GAAG,IAAI,eAAe,EACtB;QACE,KAAK,EAAE,KAAK,CAAC,EAAE;QACf,eAAe,EAAE,WAAW;QAC5B,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS;KACnD,CACF,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;QAC/D,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,IAAI,UAAU,QAAQ,EAAE,EAAE;YACtD,KAAK,EAAE,KAAK,CAAC,EAAE;YACf,QAAQ;YACR,MAAM,EAAE,YAAY,CAAA,gBAAgB,WAAW,CAAC,EAAE,EAAE;SACrD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,IAAI,SAAS,EAAE;QAC3C,KAAK,EAAE,KAAK,CAAC,EAAE;QACf,IAAI,EAAE,IAAI,CAAC,KAAK;QAChB,UAAU,EAAE,IAAI;KACjB,CAAC,CAAC;IAEH,gDAAgD;IAChD,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,cAAc,EAAE;QAC/C,MAAM,EAAE,uBAAuB;QAC/B,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;QACvC,SAAS,EAAE,0BAA0B;QACrC,SAAS,EAAE,YAAY,CAAA,GAAG,KAAK,CAAC,YAAY,MAAM;KACnD,CAAC,CAAC;IAEH,MAAM,KAAK,GACT,YAAY,CAAA,SAAS,KAAK,CAAC,EAAE,gBAAgB,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,kBAAkB,IAAI,CAAC,KAAK,EAAE,CAAC;IAExG,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACrC,CAAC"}

package/dist/index.d.ts

@@ -11,6 +11,7 @@ export type { ImageResources } from "./image.js";
 export type { ApiResources } from "./api.js";
 export type { CdnResources } from "./cdn.js";
 export type { SchedulerResources } from "./scheduler.js";
+export type { CollaborationResources } from "./collaboration.js";
 export type { AdminSiteResources } from "./admin-site.js";
 export interface HeadroomCMSArgs {
     /**
@@ -74,7 +75,17 @@ export interface HeadroomCMSArgs {
         adminPath: string;
         /** Go source path for scheduler Lambda, e.g. "packages/scheduler" */
         schedulerHandler?: string;
+        /** SST handler for collab Lambda, e.g. "packages/collab/src/index.handler" */
+        collabHandler?: string;
     };
+    /**
+     * Build-time toggle for the collaboration feature in the admin UI.
+     * Defaults to `true`. Set `false` to keep the WebSocket / Collab table
+     * deployed but hide the "Collaborate" / "Request collaboration" buttons
+     * and refuse to open WebSockets — a kill-switch without teardown. Used
+     * to ship the feature to a stage before turning it on for editors.
+     */
+    collabEnabled?: boolean;
 }
 export declare class HeadroomCMS {
     readonly apiUrl: $util.Output<string>;
@@ -82,6 +93,7 @@ export declare class HeadroomCMS {
     readonly adminUrl: $util.Output<string>;
     readonly userPoolId: $util.Output<string>;
     readonly userPoolClientId: $util.Output<string>;
+    readonly collabWsUrl: $util.Output<string>;
     readonly outputs: Record<string, $util.Output<string>>;
     constructor(name: string, args: HeadroomCMSArgs);
 }

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAwCH,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,gEAAgE;QAChE,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,gEAAgE;QAChE,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;OAGG;IACH,UAAU,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;IAEpE;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,cAAc,CAAC,EAAE;QACf,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC;IAEF;;;OAGG;IACH,GAAG,CAAC,EAAE;QACJ,yDAAyD;QACzD,UAAU,EAAE,MAAM,CAAC;QACnB,wEAAwE;QACxE,oBAAoB,EAAE,MAAM,CAAC;QAC7B,gGAAgG;QAChG,oBAAoB,EAAE,MAAM,CAAC;QAC7B,+EAA+E;QAC/E,kBAAkB,EAAE,MAAM,CAAC;QAC3B,qDAAqD;QACrD,SAAS,EAAE,MAAM,CAAC;QAClB,qEAAqE;QACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED,qBAAa,WAAW;IACtB,SAAgB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,SAAgB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,SAAgB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/C,SAAgB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjD,SAAgB,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEvD,SAAgB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBAElD,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe;CAgGhD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAyCH,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,YAAY,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACjE,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,gEAAgE;QAChE,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,gEAAgE;QAChE,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;OAGG;IACH,UAAU,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;IAEpE;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,cAAc,CAAC,EAAE;QACf,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC;IAEF;;;OAGG;IACH,GAAG,CAAC,EAAE;QACJ,yDAAyD;QACzD,UAAU,EAAE,MAAM,CAAC;QACnB,wEAAwE;QACxE,oBAAoB,EAAE,MAAM,CAAC;QAC7B,gGAAgG;QAChG,oBAAoB,EAAE,MAAM,CAAC;QAC7B,+EAA+E;QAC/E,kBAAkB,EAAE,MAAM,CAAC;QAC3B,qDAAqD;QACrD,SAAS,EAAE,MAAM,CAAC;QAClB,qEAAqE;QACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,8EAA8E;QAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,qBAAa,WAAW;IACtB,SAAgB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,SAAgB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,SAAgB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/C,SAAgB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjD,SAAgB,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvD,SAAgB,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAElD,SAAgB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBAElD,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe;CA0HhD"}

package/dist/index.js

@@ -13,6 +13,7 @@ import { createImage } from "./image.js";
 import { createApi } from "./api.js";
 import { createCdn } from "./cdn.js";
 import { createScheduler } from "./scheduler.js";
+import { createCollabTable, createCollabHandler } from "./collaboration.js";
 import { createAdminSite } from "./admin-site.js";
 /**
  * Resolve the headroom-cms package root directory.
@@ -44,6 +45,7 @@ export class HeadroomCMS {
     adminUrl;
     userPoolId;
     userPoolClientId;
+    collabWsUrl;
     outputs;
     constructor(name, args) {
         // Only need pkgRoot for package mode (pre-built artifacts)
@@ -75,19 +77,38 @@ export class HeadroomCMS {
                 ? { handler: args.dev.imageLambdaHandler }
                 : undefined,
         });
-        // 5. API Lambda (Go handler with access to all resources)
+        // 5a. Collaboration table (must exist before the API Lambda, which
+        // links it for ticket reads/writes).
+        const collabTable = createCollabTable(name);
+        // 6. API Lambda (Go handler with access to all resources)
         const api = createApi(name, {
             storage,
             auth,
             webhooks,
             image,
+            collab: collabTable,
             senderEmail: args.senderEmail,
             pkgRoot,
             dev: args.dev
                 ? { handler: args.dev.apiHandler }
                 : undefined,
         });
-        // 6. Scheduler (EventBridge cron + Go Lambda + lock table)
+        // 5b. Collaboration WebSocket handler (must be created AFTER the API
+        // because its Lambda environment includes API_URL = api.api.url, which
+        // `snapshotToDraft` uses to PUT the disconnect snapshot back to the
+        // Go draft endpoint).
+        const collabHandler = createCollabHandler(name, {
+            storage,
+            auth,
+            api,
+            collabTable: collabTable.collabTable,
+            pkgRoot,
+            dev: args.dev?.collabHandler
+                ? { handler: args.dev.collabHandler }
+                : undefined,
+        });
+        const collab = { ...collabTable, ...collabHandler };
+        // 7. Scheduler (EventBridge cron + Go Lambda + lock table)
         const schedulerResources = createScheduler(name, {
             storage,
             api,
@@ -96,7 +117,7 @@ export class HeadroomCMS {
                 ? { handler: args.dev.schedulerHandler }
                 : undefined,
         });
-        // 7. CDN (CloudFront distribution + edge functions)
+        // 8. CDN (CloudFront distribution + edge functions)
         const cdn = createCdn(name, {
             api,
             image,
@@ -106,16 +127,18 @@ export class HeadroomCMS {
             apiCacheTtl: args.apiCacheTtl,
             domain: args.domain,
         });
-        // 8. Admin UI (static site)
+        // 9. Admin UI (static site)
         const admin = createAdminSite(name, {
             api,
             cdn,
             auth,
+            collab,
             pkgRoot,
             dev: args.dev
                 ? { adminPath: args.dev.adminPath }
                 : undefined,
             domain: args.adminDomain,
+            collabEnabled: args.collabEnabled,
         });
         // Expose outputs
         this.apiUrl = api.api.url;
@@ -123,12 +146,14 @@ export class HeadroomCMS {
         this.adminUrl = admin.url;
         this.userPoolId = auth.userPool.id;
         this.userPoolClientId = auth.userPoolClient.id;
+        this.collabWsUrl = collab.wsUrl;
         this.outputs = {
             api: api.api.url,
             cdn: cdn.url,
             admin: admin.url,
             userPoolId: auth.userPool.id,
             userPoolClientId: auth.userPoolClient.id,
+            collabWs: collab.wsUrl,
         };
     }
 }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;;;;;;GAQG;AACH,SAAS,cAAc;IACrB,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACxB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;QACjE,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CACb,uDAAuD;QACvD,yCAAyC,CAC1C,CAAC;AACJ,CAAC;AAmFD,MAAM,OAAO,WAAW;IACN,MAAM,CAAuB;IAC7B,MAAM,CAAuB;IAC7B,QAAQ,CAAuB;IAC/B,UAAU,CAAuB;IACjC,gBAAgB,CAAuB;IAEvC,OAAO,CAAuC;IAE9D,YAAY,IAAY,EAAE,IAAqB;QAC7C,2DAA2D;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QAEjD,+CAA+C;QAC/C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAEpC,gDAAgD;QAChD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE;YAC5B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE;gBAC5C,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE;YACpC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE;gBAC5C,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,0DAA0D;QAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE;YAC9B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE;gBAC1C,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,0DAA0D;QAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE;YAC1B,OAAO;YACP,IAAI;YACJ,QAAQ;YACR,KAAK;YACL,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE;gBAClC,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,2DAA2D;QAC3D,MAAM,kBAAkB,GAAG,eAAe,CAAC,IAAI,EAAE;YAC/C,OAAO;YACP,GAAG;YACH,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,gBAAgB;gBAC7B,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE;gBACxC,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,oDAAoD;QACpD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE;YAC1B,GAAG;YACH,KAAK;YACL,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,4BAA4B;QAC5B,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE;YAClC,GAAG;YACH,GAAG;YACH,IAAI;YACJ,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE;gBACnC,CAAC,CAAC,SAAS;YACb,MAAM,EAAE,IAAI,CAAC,WAAW;SACzB,CAAC,CAAC;QAEH,iBAAiB;QACjB,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QAE/C,IAAI,CAAC,OAAO,GAAG;YACb,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG;YAChB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,KAAK,CAAC,GAAG;YAChB,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAC5B,gBAAgB,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE;SACzC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;;;;;;GAQG;AACH,SAAS,cAAc;IACrB,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACxB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;QACjE,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CACb,uDAAuD;QACvD,yCAAyC,CAC1C,CAAC;AACJ,CAAC;AA+FD,MAAM,OAAO,WAAW;IACN,MAAM,CAAuB;IAC7B,MAAM,CAAuB;IAC7B,QAAQ,CAAuB;IAC/B,UAAU,CAAuB;IACjC,gBAAgB,CAAuB;IACvC,WAAW,CAAuB;IAElC,OAAO,CAAuC;IAE9D,YAAY,IAAY,EAAE,IAAqB;QAC7C,2DAA2D;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QAEjD,+CAA+C;QAC/C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAEpC,gDAAgD;QAChD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE;YAC5B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE;gBAC5C,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE;YACpC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE;gBAC5C,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,0DAA0D;QAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE;YAC9B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE;gBAC1C,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,mEAAmE;QACnE,qCAAqC;QACrC,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAE5C,0DAA0D;QAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE;YAC1B,OAAO;YACP,IAAI;YACJ,QAAQ;YACR,KAAK;YACL,MAAM,EAAE,WAAW;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE;gBAClC,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,sBAAsB;QACtB,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,EAAE;YAC9C,OAAO;YACP,IAAI;YACJ,GAAG;YACH,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa;gBAC1B,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE;gBACrC,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,aAAa,EAAE,CAAC;QAEpD,2DAA2D;QAC3D,MAAM,kBAAkB,GAAG,eAAe,CAAC,IAAI,EAAE;YAC/C,OAAO;YACP,GAAG;YACH,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,gBAAgB;gBAC7B,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE;gBACxC,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QAEH,oDAAoD;QACpD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE;YAC1B,GAAG;YACH,KAAK;YACL,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,4BAA4B;QAC5B,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE;YAClC,GAAG;YACH,GAAG;YACH,IAAI;YACJ,MAAM;YACN,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE;gBACnC,CAAC,CAAC,SAAS;YACb,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;QAEH,iBAAiB;QACjB,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;QAEhC,IAAI,CAAC,OAAO,GAAG;YACb,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG;YAChB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,KAAK,CAAC,GAAG;YAChB,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAC5B,gBAAgB,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE;YACxC,QAAQ,EAAE,MAAM,CAAC,KAAK;SACvB,CAAC;IACJ,CAAC;CACF"}

package/dist/storage.d.ts

@@ -16,7 +16,9 @@ export declare function createStorage(name: string): {
     relationships: sst.aws.Dynamo;
     siteUsers: sst.aws.Dynamo;
     contentBucket: sst.aws.Bucket;
+    collabStateBucket: sst.aws.Bucket;
     kvs: aws.cloudfront.KeyValueStore;
+    internalSecret: sst.Secret;
 };
 export type StorageResources = ReturnType<typeof createStorage>;
 //# sourceMappingURL=storage.d.ts.map

package/dist/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM;;;;;;;;;;;;;EAiJzC;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM;;;;;;;;;;;;;;;EAoLzC;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC"}

package/dist/storage.js

@@ -119,10 +119,41 @@ export function createStorage(name) {
             },
         },
     });
+    // Phase 7.1 "Large documents": YJS room state that exceeds DynamoDB's 400KB
+    // per-item cap is uploaded here instead of being inlined on the Collab
+    // item. Dedicated bucket (vs reusing `contentBucket`) for two reasons:
+    //   1. `contentBucket` is `access: "cloudfront"` for media delivery; YJS
+    //      state must NOT be CDN-fronted (it's per-collaboration-session
+    //      transient state, never publicly addressable).
+    //   2. Lifecycle expiration is much shorter — these objects are recovery
+    //      fallback for an active collaboration session; the matching Collab
+    //      table item carries a 24h DynamoDB TTL, so the S3 lifecycle rule
+    //      cleans up overflow objects on a similar timeline.
+    const collabStateBucket = new sst.aws.Bucket(`${name}CollabStateBucket`, {
+        transform: {
+            bucket: (args) => {
+                args.lifecycleRules = [
+                    {
+                        id: "expire-collab-state",
+                        enabled: true,
+                        expiration: { days: 7 },
+                        // Keep the matching Collab DynamoDB TTL (24h) as the primary
+                        // cleanup mechanism; this is a long-stop safety net so orphaned
+                        // S3 objects don't accumulate forever.
+                    },
+                ];
+            },
+        },
+    });
     const kvs = new aws.cloudfront.KeyValueStore(`${name}KVS`, {
         name: $interpolate `${$app.name}-${$app.stage}-kvs`,
         comment: "Headroom CMS edge data: API keys and site versions",
     });
+    // Shared secret for internal service-to-service auth between the collab
+    // Lambda and the Go API (`X-Headroom-Internal` header). Both Lambdas read
+    // this from their `INTERNAL_SECRET` environment variable. Set the value via
+    // `sst secret set HeadroomInternalSecret <value>` (or the namespaced equivalent).
+    const internalSecret = new sst.Secret(`${name}InternalSecret`);
     return {
         sites,
         content,
@@ -135,7 +166,9 @@ export function createStorage(name) {
         relationships,
         siteUsers,
         contentBucket,
+        collabStateBucket,
         kvs,
+        internalSecret,
     };
 }
 //# sourceMappingURL=storage.js.map

package/dist/storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"storage.js","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE;QAC/C,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE;QACnD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,QAAQ;YACf,aAAa,EAAE,QAAQ;YACvB,eAAe,EAAE,QAAQ;YACzB,OAAO,EAAE,QAAQ;YACjB,cAAc,EAAE,QAAQ;YACxB,cAAc,EAAE,QAAQ;SACzB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,eAAe,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE;YACxD,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE;YAC3D,iBAAiB,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE;YACtE,eAAe,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,EAAE;SAC3E;KACF,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,cAAc,EAAE;QAC7D,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,QAAQ,EAAE;QACjD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;KAChC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE;QAC/C,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;YACZ,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,QAAQ;SACtB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE;YACjD,QAAQ,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE;SAC7D;KACF,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,aAAa,EAAE;QAC3D,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,YAAY,EAAE;QACzD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,YAAY,EAAE;QACzD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE;QAC/D,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;YACZ,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,QAAQ;SACnB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,QAAQ,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE;SACxD;KACF,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE;QACvD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;YACZ,MAAM,EAAE,QAAQ;SACjB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;SAChD;QACD,GAAG,EAAE,WAAW;KACjB,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE;QAC/D,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,YAAY;QACpB,SAAS,EAAE;YACT,MAAM,EAAE,CAAC,IAAS,EAAE,EAAE;gBACpB,IAAI,CAAC,cAAc,GAAG;oBACpB;wBACE,EAAE,EAAE,yBAAyB;wBAC7B,OAAO,EAAE,IAAI;wBACb,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;wBACvB,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;qBAC5B;iBACF,CAAC;YACJ,CAAC;SACF;KACF,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,IAAI,KAAK,EAAE;QACzD,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,MAAM;QAClD,OAAO,EAAE,oDAAoD;KAC9D,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;QACL,OAAO;QACP,YAAY;QACZ,MAAM;QACN,KAAK;QACL,WAAW;QACX,UAAU;QACV,UAAU;QACV,aAAa;QACb,SAAS;QACT,aAAa;QACb,GAAG;KACJ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE;QAC/C,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE;QACnD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,QAAQ;YACf,aAAa,EAAE,QAAQ;YACvB,eAAe,EAAE,QAAQ;YACzB,OAAO,EAAE,QAAQ;YACjB,cAAc,EAAE,QAAQ;YACxB,cAAc,EAAE,QAAQ;SACzB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,eAAe,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE;YACxD,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE;YAC3D,iBAAiB,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE;YACtE,eAAe,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,EAAE;SAC3E;KACF,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,cAAc,EAAE;QAC7D,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,QAAQ,EAAE;QACjD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;KAChC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE;QAC/C,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;YACZ,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,QAAQ;SACtB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE;YACjD,QAAQ,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE;SAC7D;KACF,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,aAAa,EAAE;QAC3D,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,YAAY,EAAE;QACzD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,YAAY,EAAE;QACzD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;SACb;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChD,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE;QAC/D,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;YACZ,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,QAAQ;SACnB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,QAAQ,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE;SACxD;KACF,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE;QACvD,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,QAAQ;YACZ,MAAM,EAAE,QAAQ;SACjB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/C,aAAa,EAAE;YACb,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;SAChD;QACD,GAAG,EAAE,WAAW;KACjB,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE;QAC/D,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,YAAY;QACpB,SAAS,EAAE;YACT,MAAM,EAAE,CAAC,IAAS,EAAE,EAAE;gBACpB,IAAI,CAAC,cAAc,GAAG;oBACpB;wBACE,EAAE,EAAE,yBAAyB;wBAC7B,OAAO,EAAE,IAAI;wBACb,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;wBACvB,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;qBAC5B;iBACF,CAAC;YACJ,CAAC;SACF;KACF,CAAC,CAAC;IAEH,4EAA4E;IAC5E,uEAAuE;IACvE,uEAAuE;IACvE,yEAAyE;IACzE,qEAAqE;IACrE,qDAAqD;IACrD,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,yDAAyD;IACzD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,mBAAmB,EAAE;QACvE,SAAS,EAAE;YACT,MAAM,EAAE,CAAC,IAAS,EAAE,EAAE;gBACpB,IAAI,CAAC,cAAc,GAAG;oBACpB;wBACE,EAAE,EAAE,qBAAqB;wBACzB,OAAO,EAAE,IAAI;wBACb,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;wBACvB,6DAA6D;wBAC7D,gEAAgE;wBAChE,uCAAuC;qBACxC;iBACF,CAAC;YACJ,CAAC;SACF;KACF,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,IAAI,KAAK,EAAE;QACzD,IAAI,EAAE,YAAY,CAAA,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,MAAM;QAClD,OAAO,EAAE,oDAAoD;KAC9D,CAAC,CAAC;IAEH,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,kFAAkF;IAClF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC;IAE/D,OAAO;QACL,KAAK;QACL,OAAO;QACP,YAAY;QACZ,MAAM;QACN,KAAK;QACL,WAAW;QACX,UAAU;QACV,UAAU;QACV,aAAa;QACb,SAAS;QACT,aAAa;QACb,iBAAiB;QACjB,GAAG;QACH,cAAc;KACf,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "headroom-cms",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Headroom CMS — Serverless headless CMS for AWS, deployed with SST",
   "type": "module",
   "main": "dist/index.js",

package/src/admin-site.ts

@@ -11,11 +11,13 @@ import path from "path";
 import type { ApiResources } from "./api.js";
 import type { CdnResources } from "./cdn.js";
 import type { AuthResources } from "./auth.js";
+import type { CollaborationResources } from "./collaboration.js";
 
 export interface AdminSiteArgs {
   api: ApiResources;
   cdn: CdnResources;
   auth: AuthResources;
+  collab: CollaborationResources;
   pkgRoot: string;
   dev?: {
     /** Path to admin UI source, e.g. "packages/admin" */
@@ -25,10 +27,23 @@ export interface AdminSiteArgs {
     name: string;
     certificateArn: string;
   };
+  /**
+   * Build-time toggle for the entire collaboration UI. Defaults to `true`
+   * (collab is on whenever the WS infra is deployed). Set to `false` from
+   * the consuming SST config to keep the WebSocket / Collab DynamoDB table
+   * deployed but hide the "Collaborate" / "Request collaboration" buttons
+   * and refuse to open WebSockets — useful as a kill-switch without a full
+   * teardown. Plumbs to `VITE_COLLAB_ENABLED` in the admin Vite env; see
+   * `packages/admin/src/collab/featureFlag.ts` for the consumer.
+   */
+  collabEnabled?: boolean;
 }
 
 export function createAdminSite(name: string, args: AdminSiteArgs) {
-  const { api, cdn, auth } = args;
+  const { api, cdn, auth, collab } = args;
+  // Default ON for backward compat — only emit "false" when explicitly
+  // disabled so existing stages without the flag set don't change behaviour.
+  const collabEnabledStr = args.collabEnabled === false ? "false" : "true";
 
   const domainConfig = args.domain
     ? {
@@ -54,6 +69,8 @@ export function createAdminSite(name: string, args: AdminSiteArgs) {
         VITE_USER_POOL_ID: auth.userPool.id,
         VITE_USER_POOL_CLIENT_ID: auth.userPoolClient.id,
         VITE_AWS_REGION: aws.getRegionOutput().name,
+        VITE_COLLAB_WS_URL: collab.wsUrl,
+        VITE_COLLAB_ENABLED: collabEnabledStr,
       },
       domain: domainConfig,
     });
@@ -84,6 +101,8 @@ export function createAdminSite(name: string, args: AdminSiteArgs) {
           '__HEADROOM_USER_POOL_ID__': '${auth.userPool.id}',
           '__HEADROOM_USER_POOL_CLIENT_ID__': '${auth.userPoolClient.id}',
           '__HEADROOM_AWS_REGION__': '${aws.getRegionOutput().name}',
+          '__HEADROOM_COLLAB_WS_URL__': '${collab.wsUrl}',
+          '__HEADROOM_COLLAB_ENABLED__': '${collabEnabledStr}',
         };
         function walk(d) {
           for (const f of fs.readdirSync(d)) {

package/src/api.ts

@@ -10,12 +10,19 @@ import type { StorageResources } from "./storage.js";
 import type { AuthResources } from "./auth.js";
 import type { WebhookResources } from "./webhooks.js";
 import type { ImageResources } from "./image.js";
+import type { CollabTableResources } from "./collaboration.js";
 
 export interface ApiArgs {
   storage: StorageResources;
   auth: AuthResources;
   webhooks: WebhookResources;
   image: ImageResources;
+  /**
+   * Just the collab DynamoDB table — the API Lambda only links the table
+   * for ticket reads/writes, it does NOT depend on the WebSocket handler.
+   * (The WS handler is created AFTER the API because its env needs api.url.)
+   */
+  collab: CollabTableResources;
   senderEmail: string;
   pkgRoot: string;
   dev?: {
@@ -25,7 +32,7 @@ export interface ApiArgs {
 }
 
 export function createApi(name: string, args: ApiArgs) {
-  const { storage, auth, webhooks, image } = args;
+  const { storage, auth, webhooks, image, collab } = args;
 
   const handlerConfig = args.dev
     ? {
@@ -67,6 +74,11 @@ export function createApi(name: string, args: ApiArgs) {
       RELATIONSHIPS_TABLE: storage.relationships.name,
       SITE_USERS_TABLE: storage.siteUsers.name,
       SES_FROM_EMAIL: args.senderEmail,
+      COLLAB_TABLE: collab.collabTable.name,
+      // Shared with the collab Lambda. The Go JWT middleware verifies
+      // `X-Headroom-Internal` against this on internal service calls
+      // (collab → draft snapshot). See packages/api/internal/middleware/jwt.go.
+      INTERNAL_SECRET: storage.internalSecret.value,
     },
     link: [
       storage.sites,
@@ -84,6 +96,8 @@ export function createApi(name: string, args: ApiArgs) {
       image.imageSigningSecret,
       storage.relationships,
       storage.siteUsers,
+      collab.collabTable,
+      storage.internalSecret,
     ],
     permissions: [
       {