@vritti/api-sdk 0.3.5 → 0.3.7

package/dist/storage.cjs

@@ -0,0 +1,571 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/storage/index.ts
+var storage_exports = {};
+__export(storage_exports, {
+  BucketUsageReader: () => BucketUsageReader,
+  OrgStorageProvisionerFactory: () => OrgStorageProvisionerFactory,
+  R2BucketProvisioner: () => R2BucketProvisioner,
+  R2StorageProvider: () => R2StorageProvider,
+  StorageFactory: () => StorageFactory,
+  orgBucketNames: () => orgBucketNames,
+  readConfigSource: () => readConfigSource
+});
+module.exports = __toCommonJS(storage_exports);
+
+// src/storage/bucket-usage.reader.ts
+var import_common = require("@nestjs/common");
+var CF_GRAPHQL = "https://api.cloudflare.com/client/v4/graphql";
+var QUERY = `query BucketUsage($accountTag: string!, $bucketName: string, $start: Time, $end: Time) {
+  viewer {
+    accounts(filter: { accountTag: $accountTag }) {
+      r2StorageAdaptiveGroups(
+        limit: 1
+        filter: { datetime_geq: $start, datetime_leq: $end, bucketName: $bucketName }
+        orderBy: [datetime_DESC]
+      ) {
+        max { objectCount payloadSize metadataSize }
+        dimensions { datetime }
+      }
+    }
+  }
+}`;
+var BucketUsageReader = class _BucketUsageReader {
+  static {
+    __name(this, "BucketUsageReader");
+  }
+  config;
+  logger = new import_common.Logger(_BucketUsageReader.name);
+  constructor(config) {
+    this.config = config;
+  }
+  // Returns the newest reported sample, or zeroes for a bucket the dataset has not reported on yet (a new or
+  // empty bucket produces no rows at all rather than a row of zeroes)
+  async getBucketUsage(bucketName, windowHours = 24) {
+    const end = /* @__PURE__ */ new Date();
+    const start = new Date(end.getTime() - windowHours * 60 * 60 * 1e3);
+    const response = await fetch(CF_GRAPHQL, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${this.config.analyticsToken}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        query: QUERY,
+        variables: {
+          accountTag: this.config.accountId,
+          bucketName,
+          start: start.toISOString(),
+          end: end.toISOString()
+        }
+      })
+    });
+    const body = await response.json();
+    if (body.errors?.length) {
+      throw new Error(`Cloudflare usage query failed for ${bucketName}: ${body.errors.map((e) => e.message).join("; ")}`);
+    }
+    const sample = body.data?.viewer?.accounts?.[0]?.r2StorageAdaptiveGroups?.[0]?.max;
+    if (!sample) {
+      this.logger.debug(`No usage samples yet for bucket ${bucketName}`);
+      return {
+        bytes: 0,
+        objectCount: 0
+      };
+    }
+    return {
+      bytes: (sample.payloadSize ?? 0) + (sample.metadataSize ?? 0),
+      objectCount: sample.objectCount ?? 0
+    };
+  }
+};
+
+// src/storage/config-source.ts
+function readConfigSource(source, provider) {
+  if (source === void 0) {
+    throw new Error(`Storage provider '${provider}' is not configured.`);
+  }
+  return typeof source === "function" ? source() : source;
+}
+__name(readConfigSource, "readConfigSource");
+
+// src/storage/providers/r2-storage.provider.ts
+var import_client_s3 = require("@aws-sdk/client-s3");
+var import_s3_request_presigner = require("@aws-sdk/s3-request-presigner");
+var import_common21 = require("@nestjs/common");
+
+// src/exceptions/bad-gateway.exception.ts
+var import_common3 = require("@nestjs/common");
+
+// src/exceptions/base-field.exception.ts
+var import_common2 = require("@nestjs/common");
+var HttpProblemException = class extends import_common2.HttpException {
+  static {
+    __name(this, "HttpProblemException");
+  }
+  constructor(detailOrOptions, httpStatus) {
+    const options = typeof detailOrOptions === "string" ? {
+      detail: detailOrOptions
+    } : detailOrOptions;
+    super({
+      type: options.type ?? "about:blank",
+      label: options.label,
+      detail: options.detail,
+      errors: options.errors ?? []
+    }, httpStatus);
+  }
+};
+
+// src/exceptions/bad-request.exception.ts
+var import_common4 = require("@nestjs/common");
+
+// src/exceptions/conflict.exception.ts
+var import_common5 = require("@nestjs/common");
+
+// src/exceptions/forbidden.exception.ts
+var import_common6 = require("@nestjs/common");
+
+// src/exceptions/gone.exception.ts
+var import_common7 = require("@nestjs/common");
+
+// src/exceptions/internal-server-error.exception.ts
+var import_common8 = require("@nestjs/common");
+
+// src/exceptions/method-not-allowed.exception.ts
+var import_common9 = require("@nestjs/common");
+
+// src/exceptions/not-acceptable.exception.ts
+var import_common10 = require("@nestjs/common");
+
+// src/exceptions/not-found.exception.ts
+var import_common11 = require("@nestjs/common");
+var NotFoundException = class extends HttpProblemException {
+  static {
+    __name(this, "NotFoundException");
+  }
+  constructor(detailOrOptions) {
+    super(detailOrOptions ?? "Not Found", import_common11.HttpStatus.NOT_FOUND);
+  }
+};
+
+// src/exceptions/not-implemented.exception.ts
+var import_common12 = require("@nestjs/common");
+
+// src/exceptions/payload-too-large.exception.ts
+var import_common13 = require("@nestjs/common");
+
+// src/exceptions/request-timeout.exception.ts
+var import_common14 = require("@nestjs/common");
+
+// src/exceptions/service-unavailable.exception.ts
+var import_common15 = require("@nestjs/common");
+
+// src/exceptions/too-many-requests.exception.ts
+var import_common16 = require("@nestjs/common");
+
+// src/exceptions/unauthorized.exception.ts
+var import_common17 = require("@nestjs/common");
+
+// src/exceptions/unprocessable-entity.exception.ts
+var import_common18 = require("@nestjs/common");
+
+// src/exceptions/unsupported-media-type.exception.ts
+var import_common19 = require("@nestjs/common");
+
+// src/exceptions/validation.exception.ts
+var import_common20 = require("@nestjs/common");
+
+// src/storage/providers/r2-storage.provider.ts
+var R2StorageProvider = class _R2StorageProvider {
+  static {
+    __name(this, "R2StorageProvider");
+  }
+  config;
+  logger = new import_common21.Logger(_R2StorageProvider.name);
+  client;
+  constructor(config) {
+    this.config = config;
+    this.client = new import_client_s3.S3Client({
+      region: "auto",
+      endpoint: `https://${config.accountId}.r2.cloudflarestorage.com`,
+      credentials: {
+        accessKeyId: config.accessKeyId,
+        secretAccessKey: config.secretAccessKey
+      }
+    });
+  }
+  // Uploads a file buffer or stream
+  async upload(params) {
+    await this.client.send(new import_client_s3.PutObjectCommand({
+      Bucket: this.requireBucket(params.bucket, this.config.defaultBucket),
+      Key: params.key,
+      Body: params.body,
+      ContentType: params.contentType
+    }));
+    this.logger.log(`Uploaded file to R2: ${params.key}`);
+    return params.key;
+  }
+  // Uploads a file to a public bucket and returns its permanent URL
+  async uploadPublic(key, body, contentType, bucket) {
+    await this.client.send(new import_client_s3.PutObjectCommand({
+      Bucket: this.requireBucket(bucket, this.config.publicBucket),
+      Key: key,
+      Body: body,
+      ContentType: contentType
+    }));
+    const url = this.getPublicUrl(key);
+    this.logger.log(`Uploaded public file to R2: ${key} \u2192 ${url}`);
+    return url;
+  }
+  // Public URLs come from the configured custom domain, which maps to one bucket — R2 has no per-bucket URL to derive,
+  // so a multi-tenant caller with a bucket per org cannot build one at all
+  getPublicUrl(key) {
+    if (!this.config.publicUrl) {
+      throw new Error("R2 storage has no publicUrl configured; public URLs cannot be built.");
+    }
+    return `${this.config.publicUrl}/${key}`;
+  }
+  // Deletes a file
+  async delete(key, bucket) {
+    await this.client.send(new import_client_s3.DeleteObjectCommand({
+      Bucket: bucket ?? this.config.defaultBucket,
+      Key: key
+    }));
+    this.logger.log(`Deleted file from R2: ${key}`);
+  }
+  // Generates a presigned download URL (default 1 hour)
+  async getSignedUrl(key, expiresInSeconds = 3600, bucket) {
+    const command = new import_client_s3.GetObjectCommand({
+      Bucket: this.requireBucket(bucket, this.config.defaultBucket),
+      Key: key
+    });
+    return (0, import_s3_request_presigner.getSignedUrl)(this.client, command, {
+      expiresIn: expiresInSeconds
+    });
+  }
+  // Returns a readable stream
+  async getStream(key, bucket) {
+    const response = await this.client.send(new import_client_s3.GetObjectCommand({
+      Bucket: this.requireBucket(bucket, this.config.defaultBucket),
+      Key: key
+    }));
+    if (!response.Body) {
+      throw new NotFoundException("File not found in storage.");
+    }
+    return response.Body;
+  }
+  // One page of a bucket's contents. S3 has no "list everything" call and no bucket-size call — a full inventory is
+  // this looped until nextToken is absent, and each page is a Class A request.
+  async listObjects(bucket, continuationToken) {
+    const response = await this.client.send(new import_client_s3.ListObjectsV2Command({
+      Bucket: bucket,
+      ContinuationToken: continuationToken
+    }));
+    return {
+      objects: (response.Contents ?? []).map((o) => ({
+        key: o.Key ?? "",
+        size: o.Size ?? 0,
+        lastModified: o.LastModified ?? /* @__PURE__ */ new Date(0)
+      })),
+      nextToken: response.NextContinuationToken
+    };
+  }
+  // Failing loudly here beats letting a missing org bucket fall through to some other tenant's default
+  requireBucket(bucket, fallback) {
+    const resolved = bucket ?? fallback;
+    if (!resolved) {
+      throw new Error("No bucket supplied and R2 storage has no default bucket configured.");
+    }
+    return resolved;
+  }
+};
+
+// src/storage/provisioners/r2-bucket.provisioner.ts
+var import_node_crypto = require("crypto");
+var import_common22 = require("@nestjs/common");
+var CF_API = "https://api.cloudflare.com/client/v4";
+var BUCKET_ITEM_WRITE = "Workers R2 Storage Bucket Item Write";
+function orgBucketNames(subdomain) {
+  return {
+    storageBucket: `org-${subdomain}`,
+    storagePublicBucket: `org-${subdomain}-public`
+  };
+}
+__name(orgBucketNames, "orgBucketNames");
+var R2BucketProvisioner = class _R2BucketProvisioner {
+  static {
+    __name(this, "R2BucketProvisioner");
+  }
+  config;
+  logger = new import_common22.Logger(_R2BucketProvisioner.name);
+  jurisdiction;
+  bucketItemWriteGroupId = null;
+  constructor(config) {
+    this.config = config;
+    this.jurisdiction = config.jurisdiction ?? "default";
+  }
+  // Creates the org's two buckets and one credential scoped to just those buckets
+  async provisionOrg(subdomain) {
+    const names = orgBucketNames(subdomain);
+    await this.createBucket(names.storageBucket);
+    await this.createBucket(names.storagePublicBucket);
+    let publicUrl = null;
+    try {
+      publicUrl = await this.enablePublicAccess(names.storagePublicBucket);
+    } catch (error) {
+      this.logger.warn(`Public access not enabled for ${names.storagePublicBucket}: ${error}`);
+    }
+    const token = await this.createScopedToken(subdomain, [
+      names.storageBucket,
+      names.storagePublicBucket
+    ]);
+    return {
+      provider: "r2",
+      accountId: this.config.accountId,
+      bucket: names.storageBucket,
+      publicBucket: names.storagePublicBucket,
+      publicUrl,
+      accessKeyId: token.id,
+      // R2 derives the S3 pair from the token: key id = token id, secret = SHA-256 of the token value. The value is
+      // returned exactly once, so it is hashed here rather than handed back to a caller that might drop it.
+      secretAccessKey: (0, import_node_crypto.createHash)("sha256").update(token.value).digest("hex"),
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  // Mints a replacement credential scoped to the same buckets. Returns only the credential pair, not a whole
+  // descriptor: the control plane does not hold the org's publicUrl, so it is in no position to rebuild one.
+  //
+  // The old token is NOT revoked here. Revoking before the caller has persisted the new credential would leave the org
+  // with no working key in the gap; deleteCredential is a separate call, made once the new one is stored.
+  async rotateCredential(subdomain, buckets) {
+    const token = await this.createScopedToken(subdomain, [
+      buckets.storageBucket,
+      buckets.storagePublicBucket
+    ]);
+    return {
+      accessKeyId: token.id,
+      secretAccessKey: (0, import_node_crypto.createHash)("sha256").update(token.value).digest("hex")
+    };
+  }
+  // Removes an org's buckets. R2 refuses to delete a bucket that still holds objects, so the uploading server must
+  // have emptied them first — a 'not empty' failure here means that step did not finish.
+  async deleteOrgBuckets(buckets) {
+    for (const bucket of [
+      buckets.storageBucket,
+      buckets.storagePublicBucket
+    ]) {
+      const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets/${bucket}`, {
+        method: "DELETE",
+        headers: {
+          Authorization: `Bearer ${this.config.adminToken}`
+        }
+      });
+      const body = await response.json();
+      if (body.success || body.errors?.some((e) => e.code === 10006)) {
+        this.logger.log(`Deleted bucket ${bucket}`);
+        continue;
+      }
+      throw new Error(`Cloudflare bucket delete failed for ${bucket}: ${this.describe(body)}`);
+    }
+  }
+  // Revokes a credential by its access key id, which on R2 is the Cloudflare token id
+  async deleteCredential(accessKeyId) {
+    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens/${accessKeyId}`, {
+      method: "DELETE",
+      headers: {
+        Authorization: `Bearer ${this.config.tokensToken}`
+      }
+    });
+    const body = await response.json();
+    if (!body.success) {
+      throw new Error(`Cloudflare token delete failed for ${accessKeyId}: ${this.describe(body)}`);
+    }
+    this.logger.log(`Revoked storage credential ${accessKeyId}`);
+  }
+  // Creates one bucket, treating an existing bucket as success so provisioning can be re-run to reconcile
+  async createBucket(name) {
+    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${this.config.adminToken}`,
+        "Content-Type": "application/json",
+        "cf-r2-jurisdiction": this.jurisdiction
+      },
+      body: JSON.stringify({
+        name,
+        ...this.config.locationHint && {
+          locationHint: this.config.locationHint
+        }
+      })
+    });
+    const body = await response.json();
+    if (body.success) {
+      this.logger.log(`Created bucket ${name}`);
+      return;
+    }
+    if (body.errors?.some((e) => e.code === 10004)) return;
+    throw new Error(`Cloudflare bucket create failed for ${name}: ${this.describe(body)}`);
+  }
+  // Turns on the bucket's Cloudflare-managed domain and returns it. NOTE: r2.dev is rate limited and documented as
+  // non-production — sustained traffic gets 429s. A custom domain per bucket is the production answer, and drops into
+  // this same field.
+  async enablePublicAccess(bucket) {
+    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets/${bucket}/domains/managed`, {
+      method: "PUT",
+      headers: {
+        Authorization: `Bearer ${this.config.adminToken}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        enabled: true
+      })
+    });
+    const body = await response.json();
+    if (!body.success || !body.result?.domain) {
+      throw new Error(`Cloudflare enable public access failed for ${bucket}: ${this.describe(body)}`);
+    }
+    this.logger.log(`Enabled public access for ${bucket} \u2192 ${body.result.domain}`);
+    return `https://${body.result.domain}`;
+  }
+  // Mints an ACCOUNT-owned token that can only touch this org's buckets. Account-owned rather than user-owned so a
+  // tenant's credential does not die with whichever Cloudflare user happened to create the parent token. Requires the
+  // parent to hold `Account API Tokens Write`; a user-scoped `API Tokens: Edit` token is rejected here with 9109.
+  async createScopedToken(subdomain, buckets) {
+    const permissionGroupId = await this.resolveBucketItemWriteGroupId();
+    const resources = Object.fromEntries(buckets.map((bucket) => [
+      `com.cloudflare.edge.r2.bucket.${this.config.accountId}_${this.jurisdiction}_${bucket}`,
+      "*"
+    ]));
+    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${this.config.tokensToken}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        name: `org-${subdomain}`,
+        policies: [
+          {
+            effect: "allow",
+            permission_groups: [
+              {
+                id: permissionGroupId
+              }
+            ],
+            resources
+          }
+        ]
+      })
+    });
+    const body = await response.json();
+    if (!body.success || !body.result?.value) {
+      throw new Error(`Cloudflare token create failed for org-${subdomain}: ${this.describe(body)}`);
+    }
+    this.logger.log(`Minted storage credential for org-${subdomain} scoped to ${buckets.length} bucket(s)`);
+    return body.result;
+  }
+  // The create-token API takes permission group UUIDs, not names. Looked up once rather than hardcoded: a UUID copied
+  // from docs fails much later with an error that says nothing useful. Same account-scoped endpoint as creation.
+  async resolveBucketItemWriteGroupId() {
+    if (this.bucketItemWriteGroupId) return this.bucketItemWriteGroupId;
+    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens/permission_groups`, {
+      headers: {
+        Authorization: `Bearer ${this.config.tokensToken}`
+      }
+    });
+    const body = await response.json();
+    const group = body.result?.find((g) => g.name === BUCKET_ITEM_WRITE);
+    if (!group) {
+      throw new Error(`Cloudflare permission group '${BUCKET_ITEM_WRITE}' not found: ${this.describe(body)}`);
+    }
+    this.bucketItemWriteGroupId = group.id;
+    return group.id;
+  }
+  describe(body) {
+    return body.errors?.map((e) => `${e.code} ${e.message}`).join("; ") || "unknown error";
+  }
+};
+
+// src/storage/provisioner.factory.ts
+var OrgStorageProvisionerFactory = class {
+  static {
+    __name(this, "OrgStorageProvisionerFactory");
+  }
+  options;
+  cache = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.options = options;
+  }
+  // Resolves a provisioner by provider name, constructing it once on first use
+  resolve(provider) {
+    const cached = this.cache.get(provider);
+    if (cached) return cached;
+    const created = this.create(provider);
+    this.cache.set(provider, created);
+    return created;
+  }
+  create(provider) {
+    switch (provider) {
+      case "r2":
+        return new R2BucketProvisioner(readConfigSource(this.options.r2, "r2"));
+      default:
+        throw new Error(`Unsupported storage provider: ${provider}`);
+    }
+  }
+};
+
+// src/storage/storage.factory.ts
+var StorageFactory = class {
+  static {
+    __name(this, "StorageFactory");
+  }
+  options;
+  cache = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.options = options;
+  }
+  // Resolves a provider by name, constructing it once on first use
+  resolve(provider) {
+    const cached = this.cache.get(provider);
+    if (cached) return cached;
+    const created = this.create(provider);
+    this.cache.set(provider, created);
+    return created;
+  }
+  create(provider) {
+    switch (provider) {
+      case "r2":
+        return new R2StorageProvider(readConfigSource(this.options.r2, "r2"));
+      default:
+        throw new Error(`Unsupported storage provider: ${provider}`);
+    }
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  BucketUsageReader,
+  OrgStorageProvisionerFactory,
+  R2BucketProvisioner,
+  R2StorageProvider,
+  StorageFactory,
+  orgBucketNames,
+  readConfigSource
+});
+//# sourceMappingURL=storage.cjs.map

package/dist/storage.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/storage/index.ts","../src/storage/bucket-usage.reader.ts","../src/storage/config-source.ts","../src/storage/providers/r2-storage.provider.ts","../src/exceptions/bad-gateway.exception.ts","../src/exceptions/base-field.exception.ts","../src/exceptions/bad-request.exception.ts","../src/exceptions/conflict.exception.ts","../src/exceptions/forbidden.exception.ts","../src/exceptions/gone.exception.ts","../src/exceptions/internal-server-error.exception.ts","../src/exceptions/method-not-allowed.exception.ts","../src/exceptions/not-acceptable.exception.ts","../src/exceptions/not-found.exception.ts","../src/exceptions/not-implemented.exception.ts","../src/exceptions/payload-too-large.exception.ts","../src/exceptions/request-timeout.exception.ts","../src/exceptions/service-unavailable.exception.ts","../src/exceptions/too-many-requests.exception.ts","../src/exceptions/unauthorized.exception.ts","../src/exceptions/unprocessable-entity.exception.ts","../src/exceptions/unsupported-media-type.exception.ts","../src/exceptions/validation.exception.ts","../src/storage/provisioners/r2-bucket.provisioner.ts","../src/storage/provisioner.factory.ts","../src/storage/storage.factory.ts"],"sourcesContent":["export { type BucketUsage, BucketUsageReader, type BucketUsageReaderConfig } from './bucket-usage.reader';\nexport { readConfigSource, type StorageConfigSource } from './config-source';\nexport { R2StorageProvider } from './providers/r2-storage.provider';\nexport { OrgStorageProvisionerFactory, type OrgStorageProvisionerFactoryOptions } from './provisioner.factory';\nexport { orgBucketNames, R2BucketProvisioner } from './provisioners/r2-bucket.provisioner';\nexport { StorageFactory, type StorageFactoryOptions } from './storage.factory';\nexport type {\n  ListObjectsPage,\n  OrgBuckets,\n  OrgCredential,\n  OrgStorage,\n  OrgStorageProvisioner,\n  OrgStorageTracking,\n  R2ProvisionerConfig,\n  R2StorageConfig,\n  StorageProvider,\n  StoredObject,\n  UploadParams,\n} from './types';\n","import { Logger } from '@nestjs/common';\n\nconst CF_GRAPHQL = 'https://api.cloudflare.com/client/v4/graphql';\n\nexport interface BucketUsage {\n  bytes: number;\n  objectCount: number;\n}\n\nexport interface BucketUsageReaderConfig {\n  accountId: string;\n  // Account-level token with Analytics Read. NOT the org's scoped S3 credential and NOT the R2 admin token: the\n  // analytics dataset is filtered by accountTag and is not reachable with object-level credentials.\n  analyticsToken: string;\n}\n\n// r2StorageAdaptiveGroups is a time series, so the newest bucketed sample is the closest thing to \"current\". It lags\n// real writes by minutes — fine for a periodic quota check, useless for gating an individual upload.\n//\n// `dimensions { datetime }` is required, not decorative: ordering by a field that is neither aggregated nor selected\n// as a dimension is rejected. Keep the query free of `#` comments too — Cloudflare's parser rejects them.\nconst QUERY = `query BucketUsage($accountTag: string!, $bucketName: string, $start: Time, $end: Time) {\n  viewer {\n    accounts(filter: { accountTag: $accountTag }) {\n      r2StorageAdaptiveGroups(\n        limit: 1\n        filter: { datetime_geq: $start, datetime_leq: $end, bucketName: $bucketName }\n        orderBy: [datetime_DESC]\n      ) {\n        max { objectCount payloadSize metadataSize }\n        dimensions { datetime }\n      }\n    }\n  }\n}`;\n\ninterface UsageResponse {\n  errors?: { message: string }[];\n  data?: {\n    viewer?: {\n      accounts?: {\n        r2StorageAdaptiveGroups?: {\n          max?: { objectCount?: number; payloadSize?: number; metadataSize?: number };\n        }[];\n      }[];\n    };\n  };\n}\n\n// Reads how much an org's bucket actually holds, straight from the provider — the authoritative figure a locally\n// maintained counter would only ever approximate.\nexport class BucketUsageReader {\n  private readonly logger = new Logger(BucketUsageReader.name);\n\n  constructor(private readonly config: BucketUsageReaderConfig) {}\n\n  // Returns the newest reported sample, or zeroes for a bucket the dataset has not reported on yet (a new or\n  // empty bucket produces no rows at all rather than a row of zeroes)\n  async getBucketUsage(bucketName: string, windowHours = 24): Promise<BucketUsage> {\n    const end = new Date();\n    const start = new Date(end.getTime() - windowHours * 60 * 60 * 1000);\n\n    const response = await fetch(CF_GRAPHQL, {\n      method: 'POST',\n      headers: { Authorization: `Bearer ${this.config.analyticsToken}`, 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        query: QUERY,\n        variables: {\n          accountTag: this.config.accountId,\n          bucketName,\n          start: start.toISOString(),\n          end: end.toISOString(),\n        },\n      }),\n    });\n\n    const body = (await response.json()) as UsageResponse;\n    if (body.errors?.length) {\n      throw new Error(\n        `Cloudflare usage query failed for ${bucketName}: ${body.errors.map((e) => e.message).join('; ')}`,\n      );\n    }\n\n    const sample = body.data?.viewer?.accounts?.[0]?.r2StorageAdaptiveGroups?.[0]?.max;\n    if (!sample) {\n      this.logger.debug(`No usage samples yet for bucket ${bucketName}`);\n      return { bytes: 0, objectCount: 0 };\n    }\n\n    // Billed storage is payload plus per-object metadata, so both count against a quota\n    return {\n      bytes: (sample.payloadSize ?? 0) + (sample.metadataSize ?? 0),\n      objectCount: sample.objectCount ?? 0,\n    };\n  }\n}\n","// Config may be a value or a thunk. Servers pass a thunk when the credentials come from required-only-if-selected\n// env keys, so reading them is deferred to the first resolve() instead of running at module construction.\nexport type StorageConfigSource<T> = T | (() => T);\n\n// A backend configured nowhere is a deployment asking for something it was never given credentials for\nexport function readConfigSource<T>(source: StorageConfigSource<T> | undefined, provider: string): T {\n  if (source === undefined) {\n    throw new Error(`Storage provider '${provider}' is not configured.`);\n  }\n  return typeof source === 'function' ? (source as () => T)() : source;\n}\n","import type { Readable } from 'node:stream';\nimport {\n  DeleteObjectCommand,\n  GetObjectCommand,\n  ListObjectsV2Command,\n  PutObjectCommand,\n  S3Client,\n} from '@aws-sdk/client-s3';\nimport { getSignedUrl } from '@aws-sdk/s3-request-presigner';\nimport { Logger } from '@nestjs/common';\nimport { NotFoundException } from '../../exceptions';\nimport type { ListObjectsPage, R2StorageConfig, StorageProvider, UploadParams } from '../types';\n\nexport class R2StorageProvider implements StorageProvider {\n  private readonly logger = new Logger(R2StorageProvider.name);\n  private readonly client: S3Client;\n\n  constructor(private readonly config: R2StorageConfig) {\n    this.client = new S3Client({\n      region: 'auto',\n      endpoint: `https://${config.accountId}.r2.cloudflarestorage.com`,\n      credentials: { accessKeyId: config.accessKeyId, secretAccessKey: config.secretAccessKey },\n    });\n  }\n\n  // Uploads a file buffer or stream\n  async upload(params: UploadParams): Promise<string> {\n    await this.client.send(\n      new PutObjectCommand({\n        Bucket: this.requireBucket(params.bucket, this.config.defaultBucket),\n        Key: params.key,\n        Body: params.body,\n        ContentType: params.contentType,\n      }),\n    );\n\n    this.logger.log(`Uploaded file to R2: ${params.key}`);\n    return params.key;\n  }\n\n  // Uploads a file to a public bucket and returns its permanent URL\n  async uploadPublic(key: string, body: Buffer, contentType: string, bucket?: string): Promise<string> {\n    await this.client.send(\n      new PutObjectCommand({\n        Bucket: this.requireBucket(bucket, this.config.publicBucket),\n        Key: key,\n        Body: body,\n        ContentType: contentType,\n      }),\n    );\n\n    const url = this.getPublicUrl(key);\n    this.logger.log(`Uploaded public file to R2: ${key} → ${url}`);\n    return url;\n  }\n\n  // Public URLs come from the configured custom domain, which maps to one bucket — R2 has no per-bucket URL to derive,\n  // so a multi-tenant caller with a bucket per org cannot build one at all\n  getPublicUrl(key: string): string {\n    if (!this.config.publicUrl) {\n      throw new Error('R2 storage has no publicUrl configured; public URLs cannot be built.');\n    }\n    return `${this.config.publicUrl}/${key}`;\n  }\n\n  // Deletes a file\n  async delete(key: string, bucket?: string): Promise<void> {\n    await this.client.send(new DeleteObjectCommand({ Bucket: bucket ?? this.config.defaultBucket, Key: key }));\n\n    this.logger.log(`Deleted file from R2: ${key}`);\n  }\n\n  // Generates a presigned download URL (default 1 hour)\n  async getSignedUrl(key: string, expiresInSeconds = 3600, bucket?: string): Promise<string> {\n    const command = new GetObjectCommand({ Bucket: this.requireBucket(bucket, this.config.defaultBucket), Key: key });\n    return getSignedUrl(this.client, command, { expiresIn: expiresInSeconds });\n  }\n\n  // Returns a readable stream\n  async getStream(key: string, bucket?: string): Promise<Readable> {\n    const response = await this.client.send(\n      new GetObjectCommand({ Bucket: this.requireBucket(bucket, this.config.defaultBucket), Key: key }),\n    );\n\n    if (!response.Body) {\n      throw new NotFoundException('File not found in storage.');\n    }\n\n    return response.Body as Readable;\n  }\n\n  // One page of a bucket's contents. S3 has no \"list everything\" call and no bucket-size call — a full inventory is\n  // this looped until nextToken is absent, and each page is a Class A request.\n  async listObjects(bucket: string, continuationToken?: string): Promise<ListObjectsPage> {\n    const response = await this.client.send(\n      new ListObjectsV2Command({ Bucket: bucket, ContinuationToken: continuationToken }),\n    );\n\n    return {\n      objects: (response.Contents ?? []).map((o) => ({\n        key: o.Key ?? '',\n        size: o.Size ?? 0,\n        lastModified: o.LastModified ?? new Date(0),\n      })),\n      nextToken: response.NextContinuationToken,\n    };\n  }\n\n  // Failing loudly here beats letting a missing org bucket fall through to some other tenant's default\n  private requireBucket(bucket: string | undefined, fallback: string | undefined): string {\n    const resolved = bucket ?? fallback;\n    if (!resolved) {\n      throw new Error('No bucket supplied and R2 storage has no default bucket configured.');\n    }\n    return resolved;\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class BadGatewayException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Bad Gateway', HttpStatus.BAD_GATEWAY);\n  }\n}\n","import { HttpException, HttpStatus } from '@nestjs/common';\nimport type { FieldError } from '../types/error-response.types';\n\n// Re-export FieldError for backwards compatibility\nexport type { FieldError } from '../types/error-response.types';\n\nexport interface ProblemOptions {\n  type?: string;\n  label?: string;\n  detail?: string;\n  errors?: FieldError[];\n}\n\nexport abstract class HttpProblemException extends HttpException {\n  constructor(detailOrOptions: string | ProblemOptions, httpStatus: HttpStatus) {\n    const options = typeof detailOrOptions === 'string' ? { detail: detailOrOptions } : detailOrOptions;\n\n    super(\n      {\n        type: options.type ?? 'about:blank',\n        label: options.label,\n        detail: options.detail,\n        errors: options.errors ?? [],\n      },\n      httpStatus,\n    );\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class BadRequestException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Bad Request', HttpStatus.BAD_REQUEST);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class ConflictException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Conflict', HttpStatus.CONFLICT);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class ForbiddenException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Forbidden', HttpStatus.FORBIDDEN);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class GoneException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Gone', HttpStatus.GONE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class InternalServerErrorException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Internal Server Error', HttpStatus.INTERNAL_SERVER_ERROR);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class MethodNotAllowedException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Method Not Allowed', HttpStatus.METHOD_NOT_ALLOWED);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class NotAcceptableException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Not Acceptable', HttpStatus.NOT_ACCEPTABLE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class NotFoundException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Not Found', HttpStatus.NOT_FOUND);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class NotImplementedException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Not Implemented', HttpStatus.NOT_IMPLEMENTED);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class PayloadTooLargeException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Payload Too Large', HttpStatus.PAYLOAD_TOO_LARGE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class RequestTimeoutException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Request Timeout', HttpStatus.REQUEST_TIMEOUT);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class ServiceUnavailableException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Service Unavailable', HttpStatus.SERVICE_UNAVAILABLE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class TooManyRequestsException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Too Many Requests', HttpStatus.TOO_MANY_REQUESTS);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class UnauthorizedException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Unauthorized', HttpStatus.UNAUTHORIZED);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class UnprocessableEntityException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Unprocessable Entity', HttpStatus.UNPROCESSABLE_ENTITY);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class UnsupportedMediaTypeException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Unsupported Media Type', HttpStatus.UNSUPPORTED_MEDIA_TYPE);\n  }\n}\n","import { HttpStatus } from '@nestjs/common';\nimport { HttpProblemException, type ProblemOptions } from './base-field.exception';\n\nexport class ValidationException extends HttpProblemException {\n  constructor(detailOrOptions?: string | ProblemOptions) {\n    super(detailOrOptions ?? 'Validation Failed', HttpStatus.UNPROCESSABLE_ENTITY);\n  }\n}\n","import { createHash } from 'node:crypto';\nimport { Logger } from '@nestjs/common';\nimport type { OrgBuckets, OrgCredential, OrgStorage, OrgStorageProvisioner, R2ProvisionerConfig } from '../types';\n\nconst CF_API = 'https://api.cloudflare.com/client/v4';\n\n// Bucket-level group: read/write/list objects in named buckets. Deliberately NOT 'Workers R2 Storage Write', which is\n// account-level and can create and delete buckets — exactly what a tenant credential must never do.\nconst BUCKET_ITEM_WRITE = 'Workers R2 Storage Bucket Item Write';\n\n// Bucket names are prefixed because the account also holds Vritti's own buckets, and a subdomain like \"media\" collides\nexport function orgBucketNames(subdomain: string): OrgBuckets {\n  return { storageBucket: `org-${subdomain}`, storagePublicBucket: `org-${subdomain}-public` };\n}\n\ninterface CloudflareEnvelope<T> {\n  success: boolean;\n  errors: { code: number; message: string }[];\n  result: T;\n}\n\nexport class R2BucketProvisioner implements OrgStorageProvisioner {\n  private readonly logger = new Logger(R2BucketProvisioner.name);\n  private readonly jurisdiction: string;\n  private bucketItemWriteGroupId: string | null = null;\n\n  constructor(private readonly config: R2ProvisionerConfig) {\n    this.jurisdiction = config.jurisdiction ?? 'default';\n  }\n\n  // Creates the org's two buckets and one credential scoped to just those buckets\n  async provisionOrg(subdomain: string): Promise<OrgStorage> {\n    const names = orgBucketNames(subdomain);\n    await this.createBucket(names.storageBucket);\n    await this.createBucket(names.storagePublicBucket);\n\n    // Not fatal: an org whose public bucket is private still works for every presigned read, and the URL can be\n    // filled in later. Failing the whole signup over a CDN convenience would be the wrong trade.\n    let publicUrl: string | null = null;\n    try {\n      publicUrl = await this.enablePublicAccess(names.storagePublicBucket);\n    } catch (error: unknown) {\n      this.logger.warn(`Public access not enabled for ${names.storagePublicBucket}: ${error}`);\n    }\n\n    const token = await this.createScopedToken(subdomain, [names.storageBucket, names.storagePublicBucket]);\n\n    return {\n      provider: 'r2',\n      accountId: this.config.accountId,\n      bucket: names.storageBucket,\n      publicBucket: names.storagePublicBucket,\n      publicUrl,\n      accessKeyId: token.id,\n      // R2 derives the S3 pair from the token: key id = token id, secret = SHA-256 of the token value. The value is\n      // returned exactly once, so it is hashed here rather than handed back to a caller that might drop it.\n      secretAccessKey: createHash('sha256').update(token.value).digest('hex'),\n      createdAt: new Date().toISOString(),\n    };\n  }\n\n  // Mints a replacement credential scoped to the same buckets. Returns only the credential pair, not a whole\n  // descriptor: the control plane does not hold the org's publicUrl, so it is in no position to rebuild one.\n  //\n  // The old token is NOT revoked here. Revoking before the caller has persisted the new credential would leave the org\n  // with no working key in the gap; deleteCredential is a separate call, made once the new one is stored.\n  async rotateCredential(subdomain: string, buckets: OrgBuckets): Promise<OrgCredential> {\n    const token = await this.createScopedToken(subdomain, [buckets.storageBucket, buckets.storagePublicBucket]);\n\n    return {\n      accessKeyId: token.id,\n      secretAccessKey: createHash('sha256').update(token.value).digest('hex'),\n    };\n  }\n\n  // Removes an org's buckets. R2 refuses to delete a bucket that still holds objects, so the uploading server must\n  // have emptied them first — a 'not empty' failure here means that step did not finish.\n  async deleteOrgBuckets(buckets: OrgBuckets): Promise<void> {\n    for (const bucket of [buckets.storageBucket, buckets.storagePublicBucket]) {\n      const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets/${bucket}`, {\n        method: 'DELETE',\n        headers: { Authorization: `Bearer ${this.config.adminToken}` },\n      });\n\n      const body = (await response.json()) as CloudflareEnvelope<unknown>;\n      // 10006 is \"bucket not found\" — already gone, which is the state we wanted\n      if (body.success || body.errors?.some((e) => e.code === 10006)) {\n        this.logger.log(`Deleted bucket ${bucket}`);\n        continue;\n      }\n      throw new Error(`Cloudflare bucket delete failed for ${bucket}: ${this.describe(body)}`);\n    }\n  }\n\n  // Revokes a credential by its access key id, which on R2 is the Cloudflare token id\n  async deleteCredential(accessKeyId: string): Promise<void> {\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens/${accessKeyId}`, {\n      method: 'DELETE',\n      headers: { Authorization: `Bearer ${this.config.tokensToken}` },\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<unknown>;\n    if (!body.success) {\n      throw new Error(`Cloudflare token delete failed for ${accessKeyId}: ${this.describe(body)}`);\n    }\n\n    this.logger.log(`Revoked storage credential ${accessKeyId}`);\n  }\n\n  // Creates one bucket, treating an existing bucket as success so provisioning can be re-run to reconcile\n  private async createBucket(name: string): Promise<void> {\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets`, {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${this.config.adminToken}`,\n        'Content-Type': 'application/json',\n        'cf-r2-jurisdiction': this.jurisdiction,\n      },\n      body: JSON.stringify({\n        name,\n        ...(this.config.locationHint && { locationHint: this.config.locationHint }),\n      }),\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<unknown>;\n    if (body.success) {\n      this.logger.log(`Created bucket ${name}`);\n      return;\n    }\n\n    // 10004 is \"bucket already exists\" — two provisioning attempts racing, or a reconcile pass\n    if (body.errors?.some((e) => e.code === 10004)) return;\n    throw new Error(`Cloudflare bucket create failed for ${name}: ${this.describe(body)}`);\n  }\n\n  // Turns on the bucket's Cloudflare-managed domain and returns it. NOTE: r2.dev is rate limited and documented as\n  // non-production — sustained traffic gets 429s. A custom domain per bucket is the production answer, and drops into\n  // this same field.\n  private async enablePublicAccess(bucket: string): Promise<string | null> {\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/r2/buckets/${bucket}/domains/managed`, {\n      method: 'PUT',\n      headers: { Authorization: `Bearer ${this.config.adminToken}`, 'Content-Type': 'application/json' },\n      body: JSON.stringify({ enabled: true }),\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<{ domain?: string; enabled?: boolean }>;\n    if (!body.success || !body.result?.domain) {\n      throw new Error(`Cloudflare enable public access failed for ${bucket}: ${this.describe(body)}`);\n    }\n\n    this.logger.log(`Enabled public access for ${bucket} → ${body.result.domain}`);\n    return `https://${body.result.domain}`;\n  }\n\n  // Mints an ACCOUNT-owned token that can only touch this org's buckets. Account-owned rather than user-owned so a\n  // tenant's credential does not die with whichever Cloudflare user happened to create the parent token. Requires the\n  // parent to hold `Account API Tokens Write`; a user-scoped `API Tokens: Edit` token is rejected here with 9109.\n  private async createScopedToken(subdomain: string, buckets: string[]): Promise<{ id: string; value: string }> {\n    const permissionGroupId = await this.resolveBucketItemWriteGroupId();\n\n    // The jurisdiction is embedded in the resource key and must match the bucket's, or the token authenticates fine\n    // and then 403s on every object because it is scoped to a bucket that does not exist\n    const resources = Object.fromEntries(\n      buckets.map((bucket) => [\n        `com.cloudflare.edge.r2.bucket.${this.config.accountId}_${this.jurisdiction}_${bucket}`,\n        '*',\n      ]),\n    );\n\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens`, {\n      method: 'POST',\n      headers: { Authorization: `Bearer ${this.config.tokensToken}`, 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        name: `org-${subdomain}`,\n        policies: [{ effect: 'allow', permission_groups: [{ id: permissionGroupId }], resources }],\n      }),\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<{ id: string; value: string }>;\n    if (!body.success || !body.result?.value) {\n      throw new Error(`Cloudflare token create failed for org-${subdomain}: ${this.describe(body)}`);\n    }\n\n    this.logger.log(`Minted storage credential for org-${subdomain} scoped to ${buckets.length} bucket(s)`);\n    return body.result;\n  }\n\n  // The create-token API takes permission group UUIDs, not names. Looked up once rather than hardcoded: a UUID copied\n  // from docs fails much later with an error that says nothing useful. Same account-scoped endpoint as creation.\n  private async resolveBucketItemWriteGroupId(): Promise<string> {\n    if (this.bucketItemWriteGroupId) return this.bucketItemWriteGroupId;\n\n    const response = await fetch(`${CF_API}/accounts/${this.config.accountId}/tokens/permission_groups`, {\n      headers: { Authorization: `Bearer ${this.config.tokensToken}` },\n    });\n\n    const body = (await response.json()) as CloudflareEnvelope<{ id: string; name: string }[]>;\n    const group = body.result?.find((g) => g.name === BUCKET_ITEM_WRITE);\n    if (!group) {\n      throw new Error(`Cloudflare permission group '${BUCKET_ITEM_WRITE}' not found: ${this.describe(body)}`);\n    }\n\n    this.bucketItemWriteGroupId = group.id;\n    return group.id;\n  }\n\n  private describe(body: CloudflareEnvelope<unknown>): string {\n    return body.errors?.map((e) => `${e.code} ${e.message}`).join('; ') || 'unknown error';\n  }\n}\n","import { readConfigSource, type StorageConfigSource } from './config-source';\nimport { R2BucketProvisioner } from './provisioners/r2-bucket.provisioner';\nimport type { OrgStorageProvisioner, R2ProvisionerConfig } from './types';\n\nexport interface OrgStorageProvisionerFactoryOptions {\n  r2?: StorageConfigSource<R2ProvisionerConfig>;\n}\n\n// Mirrors StorageFactory for the control-plane side: same provider names, same lazy config, different job\nexport class OrgStorageProvisionerFactory {\n  private readonly cache = new Map<string, OrgStorageProvisioner>();\n\n  constructor(private readonly options: OrgStorageProvisionerFactoryOptions) {}\n\n  // Resolves a provisioner by provider name, constructing it once on first use\n  resolve(provider: string): OrgStorageProvisioner {\n    const cached = this.cache.get(provider);\n    if (cached) return cached;\n\n    const created = this.create(provider);\n    this.cache.set(provider, created);\n    return created;\n  }\n\n  private create(provider: string): OrgStorageProvisioner {\n    switch (provider) {\n      case 'r2':\n        return new R2BucketProvisioner(readConfigSource(this.options.r2, 'r2'));\n      default:\n        throw new Error(`Unsupported storage provider: ${provider}`);\n    }\n  }\n}\n","import { readConfigSource, type StorageConfigSource } from './config-source';\nimport { R2StorageProvider } from './providers/r2-storage.provider';\nimport type { R2StorageConfig, StorageProvider } from './types';\n\nexport interface StorageFactoryOptions {\n  r2?: StorageConfigSource<R2StorageConfig>;\n}\n\nexport class StorageFactory {\n  private readonly cache = new Map<string, StorageProvider>();\n\n  constructor(private readonly options: StorageFactoryOptions) {}\n\n  // Resolves a provider by name, constructing it once on first use\n  resolve(provider: string): StorageProvider {\n    const cached = this.cache.get(provider);\n    if (cached) return cached;\n\n    const created = this.create(provider);\n    this.cache.set(provider, created);\n    return created;\n  }\n\n  private create(provider: string): StorageProvider {\n    switch (provider) {\n      case 'r2':\n        return new R2StorageProvider(readConfigSource(this.options.r2, 'r2'));\n      default:\n        throw new Error(`Unsupported storage provider: ${provider}`);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;ACAA,oBAAuB;AAEvB,IAAMA,aAAa;AAmBnB,IAAMC,QAAQ;;;;;;;;;;;;;;AA8BP,IAAMC,oBAAN,MAAMA,mBAAAA;EAnDb,OAmDaA;;;;EACMC,SAAS,IAAIC,qBAAOF,mBAAkBG,IAAI;EAE3D,YAA6BC,QAAiC;SAAjCA,SAAAA;EAAkC;;;EAI/D,MAAMC,eAAeC,YAAoBC,cAAc,IAA0B;AAC/E,UAAMC,MAAM,oBAAIC,KAAAA;AAChB,UAAMC,QAAQ,IAAID,KAAKD,IAAIG,QAAO,IAAKJ,cAAc,KAAK,KAAK,GAAA;AAE/D,UAAMK,WAAW,MAAMC,MAAMf,YAAY;MACvCgB,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAKZ,OAAOa,cAAc;QAAI,gBAAgB;MAAmB;MACrGC,MAAMC,KAAKC,UAAU;QACnBC,OAAOtB;QACPuB,WAAW;UACTC,YAAY,KAAKnB,OAAOoB;UACxBlB;UACAI,OAAOA,MAAMe,YAAW;UACxBjB,KAAKA,IAAIiB,YAAW;QACtB;MACF,CAAA;IACF,CAAA;AAEA,UAAMP,OAAQ,MAAMN,SAASc,KAAI;AACjC,QAAIR,KAAKS,QAAQC,QAAQ;AACvB,YAAM,IAAIC,MACR,qCAAqCvB,UAAAA,KAAeY,KAAKS,OAAOG,IAAI,CAACC,MAAMA,EAAEC,OAAO,EAAEC,KAAK,IAAA,CAAA,EAAO;IAEtG;AAEA,UAAMC,SAAShB,KAAKiB,MAAMC,QAAQC,WAAW,CAAA,GAAIC,0BAA0B,CAAA,GAAIC;AAC/E,QAAI,CAACL,QAAQ;AACX,WAAKjC,OAAOuC,MAAM,mCAAmClC,UAAAA,EAAY;AACjE,aAAO;QAAEmC,OAAO;QAAGC,aAAa;MAAE;IACpC;AAGA,WAAO;MACLD,QAAQP,OAAOS,eAAe,MAAMT,OAAOU,gBAAgB;MAC3DF,aAAaR,OAAOQ,eAAe;IACrC;EACF;AACF;;;AC1FO,SAASG,iBAAoBC,QAA4CC,UAAgB;AAC9F,MAAID,WAAWE,QAAW;AACxB,UAAM,IAAIC,MAAM,qBAAqBF,QAAAA,sBAA8B;EACrE;AACA,SAAO,OAAOD,WAAW,aAAcA,OAAAA,IAAuBA;AAChE;AALgBD;;;ACJhB,uBAMO;AACP,kCAA6B;AAC7B,IAAAK,kBAAuB;;;ACTvB,IAAAC,iBAA2B;;;ACA3B,IAAAC,iBAA0C;AAanC,IAAeC,uBAAf,cAA4CC,6BAAAA;EAbnD,OAamDA;;;EACjD,YAAYC,iBAA0CC,YAAwB;AAC5E,UAAMC,UAAU,OAAOF,oBAAoB,WAAW;MAAEG,QAAQH;IAAgB,IAAIA;AAEpF,UACE;MACEI,MAAMF,QAAQE,QAAQ;MACtBC,OAAOH,QAAQG;MACfF,QAAQD,QAAQC;MAChBG,QAAQJ,QAAQI,UAAU,CAAA;IAC5B,GACAL,UAAAA;EAEJ;AACF;;;AC3BA,IAAAM,iBAA2B;;;ACA3B,IAAAC,iBAA2B;;;ACA3B,IAAAC,iBAA2B;;;ACA3B,IAAAC,iBAA2B;;;ACA3B,IAAAC,iBAA2B;;;ACA3B,IAAAC,iBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;AAGpB,IAAMC,oBAAN,cAAgCC,qBAAAA;EAHvC,OAGuCA;;;EACrC,YAAYC,iBAA2C;AACrD,UAAMA,mBAAmB,aAAaC,2BAAWC,SAAS;EAC5D;AACF;;;ACPA,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;ACA3B,IAAAC,kBAA2B;;;AnBapB,IAAMC,oBAAN,MAAMA,mBAAAA;EAZb,OAYaA;;;;EACMC,SAAS,IAAIC,uBAAOF,mBAAkBG,IAAI;EAC1CC;EAEjB,YAA6BC,QAAyB;SAAzBA,SAAAA;AAC3B,SAAKD,SAAS,IAAIE,0BAAS;MACzBC,QAAQ;MACRC,UAAU,WAAWH,OAAOI,SAAS;MACrCC,aAAa;QAAEC,aAAaN,OAAOM;QAAaC,iBAAiBP,OAAOO;MAAgB;IAC1F,CAAA;EACF;;EAGA,MAAMC,OAAOC,QAAuC;AAClD,UAAM,KAAKV,OAAOW,KAChB,IAAIC,kCAAiB;MACnBC,QAAQ,KAAKC,cAAcJ,OAAOK,QAAQ,KAAKd,OAAOe,aAAa;MACnEC,KAAKP,OAAOQ;MACZC,MAAMT,OAAOU;MACbC,aAAaX,OAAOY;IACtB,CAAA,CAAA;AAGF,SAAKzB,OAAO0B,IAAI,wBAAwBb,OAAOQ,GAAG,EAAE;AACpD,WAAOR,OAAOQ;EAChB;;EAGA,MAAMM,aAAaN,KAAaE,MAAcE,aAAqBP,QAAkC;AACnG,UAAM,KAAKf,OAAOW,KAChB,IAAIC,kCAAiB;MACnBC,QAAQ,KAAKC,cAAcC,QAAQ,KAAKd,OAAOwB,YAAY;MAC3DR,KAAKC;MACLC,MAAMC;MACNC,aAAaC;IACf,CAAA,CAAA;AAGF,UAAMI,MAAM,KAAKC,aAAaT,GAAAA;AAC9B,SAAKrB,OAAO0B,IAAI,+BAA+BL,GAAAA,WAASQ,GAAAA,EAAK;AAC7D,WAAOA;EACT;;;EAIAC,aAAaT,KAAqB;AAChC,QAAI,CAAC,KAAKjB,OAAO2B,WAAW;AAC1B,YAAM,IAAIC,MAAM,sEAAA;IAClB;AACA,WAAO,GAAG,KAAK5B,OAAO2B,SAAS,IAAIV,GAAAA;EACrC;;EAGA,MAAMY,OAAOZ,KAAaH,QAAgC;AACxD,UAAM,KAAKf,OAAOW,KAAK,IAAIoB,qCAAoB;MAAElB,QAAQE,UAAU,KAAKd,OAAOe;MAAeC,KAAKC;IAAI,CAAA,CAAA;AAEvG,SAAKrB,OAAO0B,IAAI,yBAAyBL,GAAAA,EAAK;EAChD;;EAGA,MAAMc,aAAad,KAAae,mBAAmB,MAAMlB,QAAkC;AACzF,UAAMmB,UAAU,IAAIC,kCAAiB;MAAEtB,QAAQ,KAAKC,cAAcC,QAAQ,KAAKd,OAAOe,aAAa;MAAGC,KAAKC;IAAI,CAAA;AAC/G,eAAOc,0CAAa,KAAKhC,QAAQkC,SAAS;MAAEE,WAAWH;IAAiB,CAAA;EAC1E;;EAGA,MAAMI,UAAUnB,KAAaH,QAAoC;AAC/D,UAAMuB,WAAW,MAAM,KAAKtC,OAAOW,KACjC,IAAIwB,kCAAiB;MAAEtB,QAAQ,KAAKC,cAAcC,QAAQ,KAAKd,OAAOe,aAAa;MAAGC,KAAKC;IAAI,CAAA,CAAA;AAGjG,QAAI,CAACoB,SAASnB,MAAM;AAClB,YAAM,IAAIoB,kBAAkB,4BAAA;IAC9B;AAEA,WAAOD,SAASnB;EAClB;;;EAIA,MAAMqB,YAAYzB,QAAgB0B,mBAAsD;AACtF,UAAMH,WAAW,MAAM,KAAKtC,OAAOW,KACjC,IAAI+B,sCAAqB;MAAE7B,QAAQE;MAAQ4B,mBAAmBF;IAAkB,CAAA,CAAA;AAGlF,WAAO;MACLG,UAAUN,SAASO,YAAY,CAAA,GAAIC,IAAI,CAACC,OAAO;QAC7C7B,KAAK6B,EAAE9B,OAAO;QACd+B,MAAMD,EAAEE,QAAQ;QAChBC,cAAcH,EAAEI,gBAAgB,oBAAIC,KAAK,CAAA;MAC3C,EAAA;MACAC,WAAWf,SAASgB;IACtB;EACF;;EAGQxC,cAAcC,QAA4BwC,UAAsC;AACtF,UAAMC,WAAWzC,UAAUwC;AAC3B,QAAI,CAACC,UAAU;AACb,YAAM,IAAI3B,MAAM,qEAAA;IAClB;AACA,WAAO2B;EACT;AACF;;;AoBpHA,yBAA2B;AAC3B,IAAAC,kBAAuB;AAGvB,IAAMC,SAAS;AAIf,IAAMC,oBAAoB;AAGnB,SAASC,eAAeC,WAAiB;AAC9C,SAAO;IAAEC,eAAe,OAAOD,SAAAA;IAAaE,qBAAqB,OAAOF,SAAAA;EAAmB;AAC7F;AAFgBD;AAUT,IAAMI,sBAAN,MAAMA,qBAAAA;EArBb,OAqBaA;;;;EACMC,SAAS,IAAIC,uBAAOF,qBAAoBG,IAAI;EAC5CC;EACTC,yBAAwC;EAEhD,YAA6BC,QAA6B;SAA7BA,SAAAA;AAC3B,SAAKF,eAAeE,OAAOF,gBAAgB;EAC7C;;EAGA,MAAMG,aAAaV,WAAwC;AACzD,UAAMW,QAAQZ,eAAeC,SAAAA;AAC7B,UAAM,KAAKY,aAAaD,MAAMV,aAAa;AAC3C,UAAM,KAAKW,aAAaD,MAAMT,mBAAmB;AAIjD,QAAIW,YAA2B;AAC/B,QAAI;AACFA,kBAAY,MAAM,KAAKC,mBAAmBH,MAAMT,mBAAmB;IACrE,SAASa,OAAgB;AACvB,WAAKX,OAAOY,KAAK,iCAAiCL,MAAMT,mBAAmB,KAAKa,KAAAA,EAAO;IACzF;AAEA,UAAME,QAAQ,MAAM,KAAKC,kBAAkBlB,WAAW;MAACW,MAAMV;MAAeU,MAAMT;KAAoB;AAEtG,WAAO;MACLiB,UAAU;MACVC,WAAW,KAAKX,OAAOW;MACvBC,QAAQV,MAAMV;MACdqB,cAAcX,MAAMT;MACpBW;MACAU,aAAaN,MAAMO;;;MAGnBC,qBAAiBC,+BAAW,QAAA,EAAUC,OAAOV,MAAMW,KAAK,EAAEC,OAAO,KAAA;MACjEC,YAAW,oBAAIC,KAAAA,GAAOC,YAAW;IACnC;EACF;;;;;;EAOA,MAAMC,iBAAiBjC,WAAmBkC,SAA6C;AACrF,UAAMjB,QAAQ,MAAM,KAAKC,kBAAkBlB,WAAW;MAACkC,QAAQjC;MAAeiC,QAAQhC;KAAoB;AAE1G,WAAO;MACLqB,aAAaN,MAAMO;MACnBC,qBAAiBC,+BAAW,QAAA,EAAUC,OAAOV,MAAMW,KAAK,EAAEC,OAAO,KAAA;IACnE;EACF;;;EAIA,MAAMM,iBAAiBD,SAAoC;AACzD,eAAWb,UAAU;MAACa,QAAQjC;MAAeiC,QAAQhC;OAAsB;AACzE,YAAMkC,WAAW,MAAMC,MAAM,GAAGxC,MAAAA,aAAmB,KAAKY,OAAOW,SAAS,eAAeC,MAAAA,IAAU;QAC/FiB,QAAQ;QACRC,SAAS;UAAEC,eAAe,UAAU,KAAK/B,OAAOgC,UAAU;QAAG;MAC/D,CAAA;AAEA,YAAMC,OAAQ,MAAMN,SAASO,KAAI;AAEjC,UAAID,KAAKE,WAAWF,KAAKG,QAAQC,KAAK,CAACC,MAAMA,EAAEC,SAAS,KAAA,GAAQ;AAC9D,aAAK5C,OAAO6C,IAAI,kBAAkB5B,MAAAA,EAAQ;AAC1C;MACF;AACA,YAAM,IAAI6B,MAAM,uCAAuC7B,MAAAA,KAAW,KAAK8B,SAAST,IAAAA,CAAAA,EAAO;IACzF;EACF;;EAGA,MAAMU,iBAAiB7B,aAAoC;AACzD,UAAMa,WAAW,MAAMC,MAAM,GAAGxC,MAAAA,aAAmB,KAAKY,OAAOW,SAAS,WAAWG,WAAAA,IAAe;MAChGe,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAK/B,OAAO4C,WAAW;MAAG;IAChE,CAAA;AAEA,UAAMX,OAAQ,MAAMN,SAASO,KAAI;AACjC,QAAI,CAACD,KAAKE,SAAS;AACjB,YAAM,IAAIM,MAAM,sCAAsC3B,WAAAA,KAAgB,KAAK4B,SAAST,IAAAA,CAAAA,EAAO;IAC7F;AAEA,SAAKtC,OAAO6C,IAAI,8BAA8B1B,WAAAA,EAAa;EAC7D;;EAGA,MAAcX,aAAaN,MAA6B;AACtD,UAAM8B,WAAW,MAAMC,MAAM,GAAGxC,MAAAA,aAAmB,KAAKY,OAAOW,SAAS,eAAe;MACrFkB,QAAQ;MACRC,SAAS;QACPC,eAAe,UAAU,KAAK/B,OAAOgC,UAAU;QAC/C,gBAAgB;QAChB,sBAAsB,KAAKlC;MAC7B;MACAmC,MAAMY,KAAKC,UAAU;QACnBjD;QACA,GAAI,KAAKG,OAAO+C,gBAAgB;UAAEA,cAAc,KAAK/C,OAAO+C;QAAa;MAC3E,CAAA;IACF,CAAA;AAEA,UAAMd,OAAQ,MAAMN,SAASO,KAAI;AACjC,QAAID,KAAKE,SAAS;AAChB,WAAKxC,OAAO6C,IAAI,kBAAkB3C,IAAAA,EAAM;AACxC;IACF;AAGA,QAAIoC,KAAKG,QAAQC,KAAK,CAACC,MAAMA,EAAEC,SAAS,KAAA,EAAQ;AAChD,UAAM,IAAIE,MAAM,uCAAuC5C,IAAAA,KAAS,KAAK6C,SAAST,IAAAA,CAAAA,EAAO;EACvF;;;;EAKA,MAAc5B,mBAAmBO,QAAwC;AACvE,UAAMe,WAAW,MAAMC,MAAM,GAAGxC,MAAAA,aAAmB,KAAKY,OAAOW,SAAS,eAAeC,MAAAA,oBAA0B;MAC/GiB,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAK/B,OAAOgC,UAAU;QAAI,gBAAgB;MAAmB;MACjGC,MAAMY,KAAKC,UAAU;QAAEE,SAAS;MAAK,CAAA;IACvC,CAAA;AAEA,UAAMf,OAAQ,MAAMN,SAASO,KAAI;AACjC,QAAI,CAACD,KAAKE,WAAW,CAACF,KAAKgB,QAAQC,QAAQ;AACzC,YAAM,IAAIT,MAAM,8CAA8C7B,MAAAA,KAAW,KAAK8B,SAAST,IAAAA,CAAAA,EAAO;IAChG;AAEA,SAAKtC,OAAO6C,IAAI,6BAA6B5B,MAAAA,WAAYqB,KAAKgB,OAAOC,MAAM,EAAE;AAC7E,WAAO,WAAWjB,KAAKgB,OAAOC,MAAM;EACtC;;;;EAKA,MAAczC,kBAAkBlB,WAAmBkC,SAA2D;AAC5G,UAAM0B,oBAAoB,MAAM,KAAKC,8BAA6B;AAIlE,UAAMC,YAAYC,OAAOC,YACvB9B,QAAQ+B,IAAI,CAAC5C,WAAW;MACtB,iCAAiC,KAAKZ,OAAOW,SAAS,IAAI,KAAKb,YAAY,IAAIc,MAAAA;MAC/E;KACD,CAAA;AAGH,UAAMe,WAAW,MAAMC,MAAM,GAAGxC,MAAAA,aAAmB,KAAKY,OAAOW,SAAS,WAAW;MACjFkB,QAAQ;MACRC,SAAS;QAAEC,eAAe,UAAU,KAAK/B,OAAO4C,WAAW;QAAI,gBAAgB;MAAmB;MAClGX,MAAMY,KAAKC,UAAU;QACnBjD,MAAM,OAAON,SAAAA;QACbkE,UAAU;UAAC;YAAEC,QAAQ;YAASC,mBAAmB;cAAC;gBAAE5C,IAAIoC;cAAkB;;YAAIE;UAAU;;MAC1F,CAAA;IACF,CAAA;AAEA,UAAMpB,OAAQ,MAAMN,SAASO,KAAI;AACjC,QAAI,CAACD,KAAKE,WAAW,CAACF,KAAKgB,QAAQ9B,OAAO;AACxC,YAAM,IAAIsB,MAAM,0CAA0ClD,SAAAA,KAAc,KAAKmD,SAAST,IAAAA,CAAAA,EAAO;IAC/F;AAEA,SAAKtC,OAAO6C,IAAI,qCAAqCjD,SAAAA,cAAuBkC,QAAQmC,MAAM,YAAY;AACtG,WAAO3B,KAAKgB;EACd;;;EAIA,MAAcG,gCAAiD;AAC7D,QAAI,KAAKrD,uBAAwB,QAAO,KAAKA;AAE7C,UAAM4B,WAAW,MAAMC,MAAM,GAAGxC,MAAAA,aAAmB,KAAKY,OAAOW,SAAS,6BAA6B;MACnGmB,SAAS;QAAEC,eAAe,UAAU,KAAK/B,OAAO4C,WAAW;MAAG;IAChE,CAAA;AAEA,UAAMX,OAAQ,MAAMN,SAASO,KAAI;AACjC,UAAM2B,QAAQ5B,KAAKgB,QAAQa,KAAK,CAACC,MAAMA,EAAElE,SAASR,iBAAAA;AAClD,QAAI,CAACwE,OAAO;AACV,YAAM,IAAIpB,MAAM,gCAAgCpD,iBAAAA,gBAAiC,KAAKqD,SAAST,IAAAA,CAAAA,EAAO;IACxG;AAEA,SAAKlC,yBAAyB8D,MAAM9C;AACpC,WAAO8C,MAAM9C;EACf;EAEQ2B,SAAST,MAA2C;AAC1D,WAAOA,KAAKG,QAAQoB,IAAI,CAAClB,MAAM,GAAGA,EAAEC,IAAI,IAAID,EAAE0B,OAAO,EAAE,EAAEC,KAAK,IAAA,KAAS;EACzE;AACF;;;ACxMO,IAAMC,+BAAN,MAAMA;EATb,OASaA;;;;EACMC,QAAQ,oBAAIC,IAAAA;EAE7B,YAA6BC,SAA8C;SAA9CA,UAAAA;EAA+C;;EAG5EC,QAAQC,UAAyC;AAC/C,UAAMC,SAAS,KAAKL,MAAMM,IAAIF,QAAAA;AAC9B,QAAIC,OAAQ,QAAOA;AAEnB,UAAME,UAAU,KAAKC,OAAOJ,QAAAA;AAC5B,SAAKJ,MAAMS,IAAIL,UAAUG,OAAAA;AACzB,WAAOA;EACT;EAEQC,OAAOJ,UAAyC;AACtD,YAAQA,UAAAA;MACN,KAAK;AACH,eAAO,IAAIM,oBAAoBC,iBAAiB,KAAKT,QAAQU,IAAI,IAAA,CAAA;MACnE;AACE,cAAM,IAAIC,MAAM,iCAAiCT,QAAAA,EAAU;IAC/D;EACF;AACF;;;ACxBO,IAAMU,iBAAN,MAAMA;EARb,OAQaA;;;;EACMC,QAAQ,oBAAIC,IAAAA;EAE7B,YAA6BC,SAAgC;SAAhCA,UAAAA;EAAiC;;EAG9DC,QAAQC,UAAmC;AACzC,UAAMC,SAAS,KAAKL,MAAMM,IAAIF,QAAAA;AAC9B,QAAIC,OAAQ,QAAOA;AAEnB,UAAME,UAAU,KAAKC,OAAOJ,QAAAA;AAC5B,SAAKJ,MAAMS,IAAIL,UAAUG,OAAAA;AACzB,WAAOA;EACT;EAEQC,OAAOJ,UAAmC;AAChD,YAAQA,UAAAA;MACN,KAAK;AACH,eAAO,IAAIM,kBAAkBC,iBAAiB,KAAKT,QAAQU,IAAI,IAAA,CAAA;MACjE;AACE,cAAM,IAAIC,MAAM,iCAAiCT,QAAAA,EAAU;IAC/D;EACF;AACF;","names":["CF_GRAPHQL","QUERY","BucketUsageReader","logger","Logger","name","config","getBucketUsage","bucketName","windowHours","end","Date","start","getTime","response","fetch","method","headers","Authorization","analyticsToken","body","JSON","stringify","query","variables","accountTag","accountId","toISOString","json","errors","length","Error","map","e","message","join","sample","data","viewer","accounts","r2StorageAdaptiveGroups","max","debug","bytes","objectCount","payloadSize","metadataSize","readConfigSource","source","provider","undefined","Error","import_common","import_common","import_common","HttpProblemException","HttpException","detailOrOptions","httpStatus","options","detail","type","label","errors","import_common","import_common","import_common","import_common","import_common","import_common","import_common","import_common","NotFoundException","HttpProblemException","detailOrOptions","HttpStatus","NOT_FOUND","import_common","import_common","import_common","import_common","import_common","import_common","import_common","import_common","import_common","R2StorageProvider","logger","Logger","name","client","config","S3Client","region","endpoint","accountId","credentials","accessKeyId","secretAccessKey","upload","params","send","PutObjectCommand","Bucket","requireBucket","bucket","defaultBucket","Key","key","Body","body","ContentType","contentType","log","uploadPublic","publicBucket","url","getPublicUrl","publicUrl","Error","delete","DeleteObjectCommand","getSignedUrl","expiresInSeconds","command","GetObjectCommand","expiresIn","getStream","response","NotFoundException","listObjects","continuationToken","ListObjectsV2Command","ContinuationToken","objects","Contents","map","o","size","Size","lastModified","LastModified","Date","nextToken","NextContinuationToken","fallback","resolved","import_common","CF_API","BUCKET_ITEM_WRITE","orgBucketNames","subdomain","storageBucket","storagePublicBucket","R2BucketProvisioner","logger","Logger","name","jurisdiction","bucketItemWriteGroupId","config","provisionOrg","names","createBucket","publicUrl","enablePublicAccess","error","warn","token","createScopedToken","provider","accountId","bucket","publicBucket","accessKeyId","id","secretAccessKey","createHash","update","value","digest","createdAt","Date","toISOString","rotateCredential","buckets","deleteOrgBuckets","response","fetch","method","headers","Authorization","adminToken","body","json","success","errors","some","e","code","log","Error","describe","deleteCredential","tokensToken","JSON","stringify","locationHint","enabled","result","domain","permissionGroupId","resolveBucketItemWriteGroupId","resources","Object","fromEntries","map","policies","effect","permission_groups","length","group","find","g","message","join","OrgStorageProvisionerFactory","cache","Map","options","resolve","provider","cached","get","created","create","set","R2BucketProvisioner","readConfigSource","r2","Error","StorageFactory","cache","Map","options","resolve","provider","cached","get","created","create","set","R2StorageProvider","readConfigSource","r2","Error"]}