[cnuss]

#152 wrote the function's whole environment, secrets included, to each spec.hosts target. The intent was the deployment's state: LambdaFunction['State'].

• writeStore now writes the values that are set in State: FunctionUrl, FunctionArn, AliasArn, FunctionVersion, Qualifier, ImageUri, RoleArn, RoleId, RoleName and, with a managed bucket, Bucket. It runs after the Function URL step, so FunctionUrl is set.
• No environment variables or secrets go to the store anymore. These values are small, so the 1 KB limit no longer skips anything in practice.
• Keys already in the store are left alone, as before. A CloudFront Function reads kvs.get('FunctionUrl'); the docs show a viewer-request example.
• CdnStore.write(environment) is renamed to write(values). Docs and comments say "state".
• New test: writeStore sends State and not a secret set with withSecrets.

Unit suite: 369 passed.

Keys from the previous release that are already in the store stay there. rowdy never deletes keys, so remove them by hand if they shouldn't be there.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}