@dragonmastery/tamer 0.40.1 → 0.42.0

package/dist/{registry-X9dlQxG3.mjs → registry-CTerXUza.mjs}

@@ -1,6 +1,7 @@
 import { H as getWorkers } from "./tamer.mjs";
-import { n as r2S3CredentialsFromEnv, t as emptyR2BucketViaS3 } from "./r2S3EmptyBucket-CXLmOrYF.mjs";
-import { n as logApplyChange } from "./planFormat-DpA8XhzX.mjs";
+import { t as emptyR2BucketViaS3 } from "./r2S3EmptyBucket-DD81ZWQ7.mjs";
+import { n as logApplyChange } from "./planFormat-CJw8Kq2s.mjs";
+import { createHash } from "crypto";
 
 //#region src/core/naming/resolveCloudflareName.ts
 function resolveOverride(fn, tenantId, env, ctx) {
@@ -667,21 +668,71 @@ function r2Drift(allR2, resources, env, state, naming) {
 }
 
 //#endregion
-//#region src/features/r2/r2CfApiEmptyBucket.ts
-async function emptyR2BucketViaCfApi(api, bucketName) {
-	let cursor;
-	let objectsDeleted = 0;
-	for (;;) {
-		const { objects, cursor: nextCursor } = await api.r2ListObjects(bucketName, cursor);
-		if (objects.length === 0 && !nextCursor) break;
-		for (const obj of objects) {
-			await api.r2DeleteObject(bucketName, obj.key);
-			objectsDeleted += 1;
-		}
-		if (!nextCursor) break;
-		cursor = nextCursor;
+//#region src/features/r2/r2TempS3Creds.ts
+/**
+* Find the "Workers R2 Storage Bucket Item Write" permission group ID.
+* This is the bucket-scoped permission that maps to S3 operations.
+*/
+async function findR2BucketItemWriteGroupId(api) {
+	const groups = await api.accountTokenPermissionGroupsListAll();
+	for (const g of groups) {
+		const name = g.name.toLowerCase();
+		if (/workers r2 storage/i.test(name) && /bucket item/i.test(name) && /write|edit/i.test(name)) return g.id;
 	}
-	return { objectsDeleted };
+	throw new Error("Could not find 'Workers R2 Storage Bucket Item Write' permission group. Available: " + groups.slice(0, 12).map((g) => g.name).join(", "));
+}
+/**
+* Mint a temporary R2 S3 credential for a specific bucket.
+* Returns S3-compatible credentials + the token ID (for cleanup).
+*
+* Uses the same permission group and resource format as the Cloudflare
+* dashboard when creating R2 API tokens:
+*   group: "Workers R2 Storage Bucket Item Write"
+*   resource: "com.cloudflare.edge.r2.bucket.{accountId}_default_{bucketName}"
+*/
+async function mintR2S3Credentials(api, accountId, bucketName) {
+	const groupId = await findR2BucketItemWriteGroupId(api);
+	const bucketResource = `com.cloudflare.edge.r2.bucket.${accountId}_default_${bucketName}`;
+	const tokenName = `Tamer R2 cleanup ${bucketName} ${Date.now()}`;
+	console.log(`R2: minting S3 token — group=${groupId}, resource=${bucketResource}`);
+	const result = await api.accountTokenCreate({
+		name: tokenName,
+		policies: [{
+			effect: "allow",
+			permission_groups: [{ id: groupId }],
+			resources: { [bucketResource]: "*" }
+		}],
+		condition: {}
+	});
+	if (!result.value) {
+		try {
+			await api.accountTokenDelete(result.id);
+		} catch {}
+		throw new Error("R2 S3 cleanup: token create succeeded but no value returned. Check that the CF API token has 'API Tokens: Edit' permission.");
+	}
+	if (!result.policies?.[0]?.id) {
+		try {
+			await api.accountTokenDelete(result.id);
+		} catch {}
+		throw new Error("R2 S3 cleanup: token create succeeded but no policy id returned.");
+	}
+	const policyId = result.policies?.[0]?.id;
+	console.log(`R2: token created — id=${result.id}, policyId=${policyId}, valuePrefix=${result.value?.slice(0, 12)}…`);
+	const secretAccessKey = createHash("sha256").update(result.value).digest("hex");
+	console.log(`R2: derived secret — prefix=${secretAccessKey.slice(0, 16)}…`);
+	return {
+		accessKeyId: policyId,
+		secretAccessKey,
+		tokenId: result.id
+	};
+}
+/**
+* Delete a previously minted temporary R2 S3 token.
+*/
+async function deleteR2S3Credentials(api, tokenId) {
+	try {
+		await api.accountTokenDelete(tokenId);
+	} catch {}
 }
 
 //#endregion
@@ -691,38 +742,35 @@ async function r2Destroy(_env, state, api, config, baseDir, _force) {
 	const resources = state.getAll();
 	const r2Entries = Object.values(resources).filter((e) => e.type === "r2_bucket");
 	const accountId = api.getAccountId();
-	const s3creds = r2S3CredentialsFromEnv();
 	for (const entry of r2Entries) {
 		if (!owned.has(entry.logicalName)) continue;
 		const name = entry.derivedName;
-		if (s3creds) try {
-			console.log(`R2: emptying bucket "${name}" via S3 API…`);
-			const { uploadsAborted, objectsDeleted } = await emptyR2BucketViaS3(accountId, name, s3creds);
+		let creds = null;
+		try {
+			creds = await mintR2S3Credentials(api, accountId, name);
+		} catch {}
+		if (creds) try {
+			const { uploadsAborted, objectsDeleted } = await emptyR2BucketViaS3(accountId, name, {
+				accessKeyId: creds.accessKeyId,
+				secretAccessKey: creds.secretAccessKey
+			});
 			console.log(`R2: bucket "${name}" — aborted ${uploadsAborted} multipart upload(s), deleted ${objectsDeleted} object(s).`);
 		} catch (err) {
-			console.warn(`R2: S3 empty failed for "${name}", trying CF API:`, err instanceof Error ? err.message : err);
-			await tryEmptyViaCfApi(api, name);
+			console.warn(`R2: S3 empty failed for "${name}":`, err instanceof Error ? err.message : err);
 		}
-		else await tryEmptyViaCfApi(api, name);
 		try {
 			await api.r2Delete(name);
 			state.delete(name);
+			console.log(`R2: deleted bucket "${name}".`);
 		} catch (err) {
 			const msg = err instanceof Error ? err.message : String(err);
 			if (/404|not found/i.test(msg)) state.delete(name);
 			else throw err;
+		} finally {
+			if (creds) await deleteR2S3Credentials(api, creds.tokenId);
 		}
 	}
 }
-async function tryEmptyViaCfApi(api, bucketName) {
-	try {
-		console.log(`R2: emptying bucket "${bucketName}" via CF API…`);
-		const { objectsDeleted } = await emptyR2BucketViaCfApi(api, bucketName);
-		console.log(`R2: bucket "${bucketName}" — deleted ${objectsDeleted} object(s) via CF API.`);
-	} catch (err) {
-		console.warn(`R2: CF API empty failed for "${bucketName}" (bucket may have objects that prevent deletion):`, err instanceof Error ? err.message : err);
-	}
-}
 
 //#endregion
 //#region src/features/r2/r2.generate.ts
@@ -3109,4 +3157,4 @@ function getResourceModule(kind) {
 
 //#endregion
 export { logicalNamesForResourceKind as a, workflowsApply as i, resourceModules as n, d1CloudflareDatabaseName as o, secretsStoreDeriveName as r, d1SkipsProvisionAndMigrate as s, getResourceModule as t };
-//# sourceMappingURL=registry-X9dlQxG3.mjs.map
+//# sourceMappingURL=registry-CTerXUza.mjs.map